Harden generated shell commands against embedded code fragments

Context

PR #732 adds Create Index handoffs that generate executable createIndex(...) code for the playground and interactive shell.

Most index options come from structured form state, but partial-filter and collation values are raw advanced-editor text. The host validates them with @mongodb-js/shell-bson-parser in ParseMode.Loose, which explicitly accepts // and /* */ comments. Direct index creation uses the parsed object, while buildCreateIndexShellCommand() embeds the original raw text into a larger generated command.

This was identified as LOW-2 in the PR #732 correctness review and is marked as required work.

Reproduction

1. Open a collection's Indexes tab.

2. Open Create Index and configure a Standard index on status.

3. In Advanced options, enter this partial filter:

   { active: true } // only active documents
   

4. Choose Create in Playground or Create in Shell.

Direct creation accepts and parses this input, but the handoff currently generates:

db.getCollection("users").createIndex({"status":1}, {"partialFilterExpression":{ active: true } // only active documents})

The line comment consumes the generated closing delimiters, so the prepared command is syntactically incomplete. The same normal UI path exists for collation. Wildcard projection is currently generated from structured fields, but the wrapper should remain safe regardless of which trusted or untrusted producer supplies a fragment.

Expected behavior

• Every input accepted for direct creation should produce valid Playground and Shell handoffs.
• Generated commands do not need to retain comments.
• BSON fidelity must remain intact for accepted values such as ObjectId(...), dates, and regular expressions.
• Code-generation helpers must not rely on an embedded fragment being unable to affect the syntax of the surrounding wrapper, even when that fragment is currently generated internally.

Requested implementation

Establish and apply a syntax-safe serialization boundary for executable command generation:

• Parse once and generate from the parsed value where possible.
• Use JSON.stringify for plain structured values.
• Use a shell/BSON-aware serializer for values that require shell syntax.
• Do not concatenate raw expression text directly into executable wrappers.
• If raw preservation is unavoidable, isolate the fragment so trailing line comments cannot consume separators or closing delimiters.
• Add parity tests covering direct create, Playground handoff, and Shell handoff with comments and BSON constructors.

Broader codebase review

Please audit the remaining repository for similar code-generation boundaries, especially template strings or concatenation that assemble executable shell, playground, JavaScript, or query text from embedded fragments.

The review should include:

• Shell initialInput generation and Playground content generation.
• Query/index command previews and copy-to-clipboard command builders.
• Collection/database names, field names, option objects, and raw query fragments embedded in code.
• Both user-authored fragments and values generated from trusted structured state.
• Inputs containing quotes, backslashes, newlines, //, /* ... */, regex literals, ObjectId(...), and date/BSON constructors.

For each equivalent boundary, either fix it in this issue or record a linked follow-up with the affected code path and risk.

Definition of done

• The reproduction above generates executable code in both targets.
• Direct create and both handoffs accept the same supported advanced-option syntax.
• BSON constructors retain their runtime meaning.
• Tests cover trailing line comments, block comments, ordinary relaxed JSON, and BSON values.
• The repository-wide audit is documented, with fixes or linked follow-ups for every additional unsafe wrapper found.

Locate buildCreateIndexShellCommand and the Create Index Playground and Shell handoff entry points, then trace how advanced-option text reaches generated commands. Run the existing direct-create and handoff tests before adding parity coverage for comments, relaxed JSON, and BSON constructors. Done means both handoffs remain executable, BSON values retain their meaning, and the repository-wide audit records fixes or linked follow-ups for every unsafe wrapper.