echo: false is ignored for {ojs} cells in docx/pdf output, exposing source code

[MiriamMarling]

Description

An {ojs} cell with echo: false correctly hides its source in HTML, but in
docx and pdf — where OJS cannot execute — Quarto writes the cell's raw
JavaScript source into the document body as visible text, ignoring echo: false.
The OJS docs state echo controls whether OJS cells display their source and that
echo: false means "do not include source code in output", so this is an
expectation-vs-actual mismatch. The only current avoidance is manually wrapping
every OJS cell in ::: {.content-visible when-format="html"}.

Steps to reproduce (minimal)

cat > doc.qmd <<'QMD'
---
title: OJS echo test
format:
  docx: default
  pdf: default
---

Intro paragraph.

```{ojs}
//| echo: false
ojsEchoFalseToken = 41 + 1
```

Outro paragraph.
QMD

quarto render doc.qmd --to docx
unzip -p doc.docx word/document.xml | grep ojsEchoFalseToken   # -> match (leaked)

quarto render doc.qmd --to pdf
pdftotext doc.pdf - | grep ojsEchoFalseToken                   # -> match (leaked)

Both greps return a match on Quarto 1.9.37 (docx and pdf each contain the source).

Expected

With echo: false, the OJS source is not shown. In formats where OJS cannot run,
the cell should be omitted (consistent with echo: false), not echoed as source.

Actual

The source ojsEchoFalseToken = 41 + 1 appears in both the .docx body and the
rendered PDF, despite echo: false.

Impact

Any document that uses OJS for interactive HTML figures and also exports to
Word/PDF leaks JavaScript source into the print outputs unless the author wraps
every OJS cell in a when-format="html" div. echo: false reads as suppressing
the code but does not in these formats.

Suggested fix

Honor echo: false for {ojs} cells in all formats, or — for formats where OJS
cannot execute — omit the cell by default rather than echoing its source.

Environment

Quarto      1.9.37
Pandoc      3.8.3
OS          macOS 26.5.1 (arm64)

Reported by: Miriam Marling · miriam@bonquery.ca

[mcanouil]

@MiriamMarling please follow th contributing guidelines, especially the issue template.

Using LLMs to file issues does not exempt you from checking the contributing guidelines:

https://github.com/quarto-dev/quarto-cli/blob/main/.github/CONTRIBUTING.md

Also be aware of the Code of Conduct which you agreed to by opening this issue, especially the following:

Submitting issues or pull requests via autonomous AI agents acting without human oversight. This specifically includes autonomous agents such as OpenClaw. AI assistants are accepted only when a human contributor has reviewed and verified the submission (see CONTRIBUTING.md). Autonomous agents deciding on their own to open issues or PRs in this repository are not. We consider these account-bannable on first offense. You have been warned.

[mcanouil]

Note that Observable.js cannot be evaluated in context other than HTML as it is evaluated by JS, so since there are no JavaScripts in the format you chose, there are no evaluation, thus no options processing, i.e., the code is displayed as plain code block (similarly as if you hadn't typed the brackets).

So, the correct approach for multi-formats including no JS formats, is to use conditional content: https://quarto.org/docs/authoring/conditional.html

I'll the maintainers decide if they want to change the behaviour of exiting early when no JS compatible format is found.

• quarto-cli/src/execute/ojs/compile.ts

  Lines 136 to 144 in 5807604

  	// if ojs-engine is explicitly `false` or it's an unsupported format,
  	// do nothing
  	if (
  	!isJavascriptCompatible(options.format) ||
  	options.format.metadata?.["ojs-engine"] === false
  	) {
  	return { markdown: markdown };
  	}

[cderv]

yes I wonder if we should somehow hide ```{ojs} by default in non HTML format.

If one want to show OJS cell code in PDF it would be ```ojs

@MiriamMarling why exactly are you trying to use OJS cell with

format:
  docx: default
  pdf: default

Do you have something like

format:
  html: default
  pdf: default

with HTML where you want OJS and PDF without ?

So, the correct approach for multi-formats including no JS formats, is to use conditional content: quarto.org/docs/authoring/conditional.html

Yes this is the way currently to solve this.

[MiriamMarling]

Thanks to both of you. That clears it up. Since OJS is only evaluated in HTML, the
```{ojs} block falls through to a plain code block in the other formats,
so echo: false never gets a chance to apply. I've switched to
content-visible when-format="html" and confirmed on 1.9.37 that it keeps the
source out of the Word and PDF output while the figures still run in HTML. I'm
unblocked now.

@cderv, regarding your question: yes, I render html, pdf, and docx from one
manuscript. HTML is the interactive version where the OJS figures run, and the
PDF/Word versions are print and collaborator exports. The only thing that
surprised me was the OJS source appearing as visible text in those print outputs.

That lines up with what I found: on 1.9.37, the default does put the OJS source
into the Word and PDF output. So defaulting to hide ```{ojs} in
non-HTML formats, with ```ojs still available when someone wants to show
it, would prevent that surprise.

Thanks for taking a look into this.