JavaScriptSolidServer
diff --git a/‎markets/test.js‎
Lines changed: 17 additions & 0 deletions b/‎markets/test.js‎
Lines changed: 17 additions & 0 deletions
diff --git a/‎markets/ui.js‎
Lines changed: 7 additions & 2 deletions b/‎markets/ui.js‎
Lines changed: 7 additions & 2 deletions
@@ -341,6 +341,23 @@ describe('markets plugin', () => {
     assert.ok(sorted, 'ordered by net worth, descending');
   });
 
+  it('the emitted client script actually parses (template-literal escapes bite)', async () => {
+    // ui.js is one big server-side template literal, so a backslash escape
+    // is consumed before the browser sees it: a regex like /\\/m\\// arrives
+    // as //m// and the ENTIRE app dies with "Unexpected token". Meta-tag
+    // assertions cannot see that; parsing can.
+    const { renderUi } = await import('./ui.js');
+    for (const opts of [{}, { accounts: true, brand: 'x', market: { id: 'a', title: 'T', category: 'C', status: 'open', closesAt: Date.now() + 8.64e7, outcomes: ['Yes', 'No'], prices: [0.5, 0.5] } }]) {
+      const html = renderUi('/markets', opts);
+      const scripts = [...html.matchAll(/<script(?![^>]*src=)[^>]*>([\s\S]*?)<\/script>/g)].map((m) => m[1]);
+      assert.ok(scripts.length >= 1, 'the page ships an inline script');
+      for (const src of scripts) {
+        // new Function COMPILES without executing: a SyntaxError throws here.
+        assert.doesNotThrow(() => new Function(src), 'inline client script must parse');
+      }
+    }
+  });
+
   it('exposes the category facets for topic browsing', async () => {
     const { categories } = await json(await call(null, 'GET', '/categories'), 200);
     assert.ok(Array.isArray(categories), 'a facet list is public');
 
@@ -1618,9 +1618,14 @@ ${ogMeta}
     // Both server-visible forms are honoured: the path (/m/<id>) and the
     // query (?m=<id>). A fragment never reaches the server, which is why
     // shared #m/ links unfurled as the generic card.
-    const byPath = /\/m\/([A-Za-z0-9_-]+)\/?$/.exec(location.pathname);
+    // NO REGEX HERE: this file is one big server-side template literal, so
+    // a backslash escape is consumed before the browser ever sees it and
+    // /\/m\// arrives as //m// — which is a syntax error that takes the
+    // whole app down. Plain string work is immune.
+    const seg = location.pathname.split('/').filter(Boolean);
+    const byPath = seg.length >= 2 && seg[seg.length - 2] === 'm' ? seg[seg.length - 1] : null;
     const byQuery = new URLSearchParams(location.search).get('m');
-    const id = (byPath && byPath[1]) || byQuery;
+    const id = byPath || byQuery;
     if (!id || location.hash) return;
     history.replaceState(null, '', (PREFIX || '/') + '#m/' + id);
   })();