chore: update goja to latest and document ES2020+ support

CLAUDE.md

@@ -403,7 +403,7 @@ All server responses include a `health` field that provides consistent status in
 
 ## JavaScript Code Execution
 
-The `code_execution` tool enables orchestrating multiple upstream MCP tools in a single request using sandboxed JavaScript (ES5.1+).
+The `code_execution` tool enables orchestrating multiple upstream MCP tools in a single request using sandboxed JavaScript (ES2020+). Modern syntax is fully supported: arrow functions, const/let, template literals, destructuring, classes, for-of, optional chaining (?.), nullish coalescing (??), spread/rest, Promises, Symbols, Map/Set, Proxy/Reflect, and generators.
 
 ### Configuration
 
@@ -554,7 +554,7 @@ Runtime detection (uvx→Python, npx→Node.js), image selection, environment pa
 Dynamic port allocation, RFC 8252 + PKCE, flow coordinator (`internal/oauth/coordinator.go`), automatic token refresh. See [docs/oauth-resource-autodetect.md](docs/oauth-resource-autodetect.md).
 
 ### Code Execution
-Sandboxed JavaScript (ES5.1+), orchestrates multiple upstream tools in single request. See [docs/code_execution/overview.md](docs/code_execution/overview.md).
+Sandboxed JavaScript (ES2020+), orchestrates multiple upstream tools in single request. See [docs/code_execution/overview.md](docs/code_execution/overview.md).
 
 ### Connection Management
 Exponential backoff, separate contexts for app vs server lifecycle, state machine: Disconnected → Connecting → Authenticating → Ready.

docs/code_execution/api-reference.md

@@ -27,7 +27,7 @@ Complete reference for the `code_execution` MCP tool.
     "properties": {
       "code": {
         "type": "string",
-        "description": "JavaScript source code (ES5.1+) to execute..."
+        "description": "JavaScript source code (ES2020+) to execute..."
       },
       "input": {
         "type": "object",
@@ -97,7 +97,7 @@ Complete reference for the `code_execution` MCP tool.
 
 | Parameter | Type | Required | Description |
 |-----------|------|----------|-------------|
-| `code` | string | **Yes** | JavaScript source code to execute (ES5.1+ syntax) |
+| `code` | string | **Yes** | JavaScript source code to execute (ES2020+ syntax supported) |
 | `input` | object | No | Input data accessible as `input` global variable (default: `{}`) |
 | `options` | object | No | Execution options (see below) |
 
@@ -260,7 +260,7 @@ var data = res.result;
 
 ### Available JavaScript Features
 
-#### ES5.1 Standard Library
+#### JavaScript Standard Library (ES2020+)
 
 ✅ **Available**:
 - **Objects**: `Object.keys()`, `Object.create()`, `Object.defineProperty()`, etc.
@@ -277,7 +277,7 @@ var data = res.result;
 - **Filesystem**: No `fs` module or file I/O
 - **Network**: No `http`, `https`, `fetch`, or network access
 - **Process**: No `process` object or environment variables
-- **ES6+**: No arrow functions, template literals, `async/await`, `Promise`, etc.
+- **Node.js APIs**: No Node.js-specific APIs (Buffer, Stream, etc.)
 
 #### Type Conversions
 
@@ -577,13 +577,12 @@ mcpproxy code exec --code="while(true){}" --timeout=1000 2>&1
 
 # Save code to file for complex scripts
 cat > /tmp/script.js << 'EOF'
-var users = ['octocat', 'torvalds'];
-var results = [];
-for (var i = 0; i < users.length; i++) {
-  var res = call_tool('github', 'get_user', {username: users[i]});
-  if (res.ok) results.push(res.result.name);
-}
-return {names: results};
+const users = ['octocat', 'torvalds'];
+const names = users
+  .map(username => call_tool('github', 'get_user', {username}))
+  .filter(res => res.ok)
+  .map(res => res.result.name);
+return {names};
 EOF
 
 mcpproxy code exec --file=/tmp/script.js
@@ -597,7 +596,7 @@ mcpproxy code exec --file=/tmp/script.js
 
 - **Required**: `code` parameter must be provided
 - **Type**: Must be a string
-- **Syntax**: Must be valid ES5.1 JavaScript
+- **Syntax**: Must be valid JavaScript (ES2020+ supported)
 - **Serialization**: Return value must be JSON-serializable
 
 ### Input Validation