@usebruno/js 0.48.0 → 0.49.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usebruno/js",
-  "version": "0.48.0",
+  "version": "0.49.0",
   "license": "MIT",
   "main": "src/index.js",
   "files": [
@@ -9,16 +9,17 @@
   ],
   "scripts": {
     "test": "node --experimental-vm-modules $(npx which jest) --testPathIgnorePatterns test.js",
+    "test:ci": "node --experimental-vm-modules ../../node_modules/jest/bin/jest.js --testPathIgnorePatterns test.js",
     "sandbox:bundle-libraries": "node ./src/sandbox/bundle-libraries.js",
     "prepack": "npm run test"
   },
   "dependencies": {
-    "@usebruno/common": "0.22.0",
+    "@usebruno/common": "0.23.0",
     "@usebruno/query": "0.2.2",
     "ajv": "^8.12.0",
     "ajv-formats": "^2.1.1",
     "atob": "^2.1.2",
-    "axios": "1.13.6",
+    "axios": "1.16.0",
     "btoa": "^1.2.1",
     "chai": "^4.3.7",
     "chai-string": "^1.5.0",

package/src/bru.js

@@ -2,7 +2,7 @@ const { cloneDeep } = require('lodash');
 const { uuid } = require('./utils');
 const xmlFormat = require('xml-formatter');
 const { interpolate: _interpolate } = require('@usebruno/common');
-const { sendRequest, createSendRequest } = require('@usebruno/requests').scripting;
+const { createSendRequest } = require('@usebruno/requests').scripting;
 const { jar: createCookieJar, getCookiesForUrl } = require('@usebruno/requests').cookies;
 const CookieList = require('./cookie-list');
 const Handlebars = require('handlebars');
@@ -102,8 +102,17 @@ class Bru {
     this.setVisualizations = setVisualizations;
     this.onConsoleLog = onConsoleLog || null;
     this.collectionName = collectionName;
-    // Use createSendRequest with config if provided, otherwise use default sendRequest
-    this.sendRequest = certsAndProxyConfig ? createSendRequest(certsAndProxyConfig) : sendRequest;
+    // Set by the host-side __bruSetScope global at the top of each segment's IIFE.
+    this._currentScope = null;
+    this.scriptedRequestEntries = [];
+    this.sendRequest = (...args) => {
+      const scopeSnapshot = this._currentScope ? { ...this._currentScope } : null;
+      const send = createSendRequest(certsAndProxyConfig, {
+        onComplete: (entry) =>
+          this._recordScriptedRequest({ source: 'sendRequest', scope: scopeSnapshot, ...entry })
+      });
+      return send(...args);
+    };
     this.runtime = runtime;
     this.requestUrl = requestUrl;
     this.cookies = new CookieList({
@@ -205,6 +214,16 @@ class Bru {
     return this.collectionPath;
   }
 
+  _recordScriptedRequest(entry) {
+    // Prefer scope passed in by the caller (snapshot at call time). Fall back to
+    // _currentScope for callers that don't supply one (e.g. bru.runRequest).
+    const { scope: providedScope, ...rest } = entry;
+    const scope = providedScope !== undefined
+      ? providedScope
+      : (this._currentScope ? { ...this._currentScope } : null);
+    this.scriptedRequestEntries.push({ ...rest, scope });
+  }
+
   getEnvName() {
     return this.envVariables.__name__;
   }
@@ -270,6 +289,10 @@ class Bru {
     }
   }
 
+  hasGlobalEnvVar(key) {
+    return Object.hasOwn(this.globalEnvironmentVariables, key);
+  }
+
   getGlobalEnvVar(key) {
     return this.interpolate(this.globalEnvironmentVariables[key]);
   }

package/src/runtime/script-runtime.js

@@ -8,6 +8,7 @@ const { createBruTestResultMethods } = require('../utils/results');
 const { runScriptInNodeVm } = require('../sandbox/node-vm');
 const { executeQuickJsVmAsync } = require('../sandbox/quickjs');
 const { SANDBOX } = require('../utils/sandbox');
+const { bindRunRequest, createScopeSetter } = require('./scripted-entries');
 
 class ScriptRuntime {
   constructor(props) {
@@ -80,7 +81,8 @@ class ScriptRuntime {
       test,
       expect: chai.expect,
       assert: chai.assert,
-      __brunoTestResults: __brunoTestResults
+      __brunoTestResults: __brunoTestResults,
+      __bruSetScope: createScopeSetter(bru)
     };
 
     if (onConsoleLog && typeof onConsoleLog === 'function') {
@@ -98,9 +100,7 @@ class ScriptRuntime {
       };
     }
 
-    if (runRequestByItemPathname) {
-      context.bru.runRequest = runRequestByItemPathname;
-    }
+    bindRunRequest(bru, runRequestByItemPathname);
 
     // Helper to build the result object for pre-request scripts
     // Extracted to avoid duplication across runtime branches
@@ -115,7 +115,8 @@ class ScriptRuntime {
       results: cleanJson(__brunoTestResults.getResults()),
       nextRequestName: bru.nextRequest,
       skipRequest: bru.skipRequest,
-      stopExecution: bru.stopExecution
+      stopExecution: bru.stopExecution,
+      scriptedRequestEntries: cleanJson(bru.scriptedRequestEntries || [])
     });
 
     // Track script errors to attach partial results before re-throwing
@@ -233,7 +234,8 @@ class ScriptRuntime {
       test,
       expect: chai.expect,
       assert: chai.assert,
-      __brunoTestResults: __brunoTestResults
+      __brunoTestResults: __brunoTestResults,
+      __bruSetScope: createScopeSetter(bru)
     };
 
     if (onConsoleLog && typeof onConsoleLog === 'function') {
@@ -251,9 +253,7 @@ class ScriptRuntime {
       };
     }
 
-    if (runRequestByItemPathname) {
-      context.bru.runRequest = runRequestByItemPathname;
-    }
+    bindRunRequest(bru, runRequestByItemPathname);
 
     // Helper to build the result object for post-response scripts
     // Extracted to avoid duplication across runtime branches
@@ -268,7 +268,8 @@ class ScriptRuntime {
       results: cleanJson(__brunoTestResults.getResults()),
       nextRequestName: bru.nextRequest,
       skipRequest: bru.skipRequest,
-      stopExecution: bru.stopExecution
+      stopExecution: bru.stopExecution,
+      scriptedRequestEntries: cleanJson(bru.scriptedRequestEntries || [])
     });
 
     // Track script errors to attach partial results before re-throwing

package/src/runtime/scripted-entries.js

@@ -0,0 +1,16 @@
+// Forwards the caller's bru as a second arg so the host can attribute the call.
+const bindRunRequest = (bru, runRequestByItemPathname) => {
+  if (!runRequestByItemPathname) return;
+  bru.runRequest = (relativePathname) =>
+    runRequestByItemPathname(relativePathname, bru);
+};
+
+// Kept off bru to stay out of user-facing autocomplete.
+const createScopeSetter = (bru) => (scope) => {
+  bru._currentScope = scope || null;
+};
+
+module.exports = {
+  bindRunRequest,
+  createScopeSetter
+};

package/src/runtime/test-runtime.js

@@ -9,6 +9,7 @@ const { runScriptInNodeVm } = require('../sandbox/node-vm');
 const jsonwebtoken = require('jsonwebtoken');
 const { executeQuickJsVmAsync } = require('../sandbox/quickjs');
 const { SANDBOX } = require('../utils/sandbox');
+const { bindRunRequest, createScopeSetter } = require('./scripted-entries');
 
 class TestRuntime {
   constructor(props) {
@@ -84,7 +85,8 @@ class TestRuntime {
       expect: chai.expect,
       assert: chai.assert,
       __brunoTestResults: __brunoTestResults,
-      jwt: jsonwebtoken
+      jwt: jsonwebtoken,
+      __bruSetScope: createScopeSetter(bru)
     };
 
     if (onConsoleLog && typeof onConsoleLog === 'function') {
@@ -102,9 +104,7 @@ class TestRuntime {
       };
     }
 
-    if (runRequestByItemPathname) {
-      context.bru.runRequest = runRequestByItemPathname;
-    }
+    bindRunRequest(bru, runRequestByItemPathname);
 
     let scriptError = null;
 
@@ -147,7 +147,8 @@ class TestRuntime {
       persistentEnvVariables: cleanJson(bru.persistentEnvVariables),
       oauth2CredentialsToReset: bru.oauth2CredentialsToReset,
       results: cleanJson(__brunoTestResults.getResults()),
-      nextRequestName: bru.nextRequest
+      nextRequestName: bru.nextRequest,
+      scriptedRequestEntries: cleanJson(bru.scriptedRequestEntries || [])
     };
 
     if (scriptError) {

package/src/sandbox/quickjs/index.js

@@ -11,7 +11,7 @@ const { newQuickJSWASMModule, memoizePromiseFactory } = require('quickjs-emscrip
 // execute `npm run sandbox:bundle-libraries` if the below file doesn't exist
 const getBundledCode = require('../bundle-browser-rollup');
 const addPathShimToContext = require('./shims/lib/path');
-const { marshallToVm } = require('./utils');
+const { marshallToVm, createManagedQuickJsContext } = require('./utils');
 const addCryptoUtilsShimToContext = require('./shims/lib/crypto-utils');
 const { wrapScriptInClosure, SANDBOX } = require('../../utils/sandbox');
 
@@ -56,9 +56,10 @@ const executeQuickJsVm = ({ script: externalScript, context: externalContext, sc
 
     externalScript = removeQuotes(externalScript);
   }
-
+  let managedQuickJsContext;
   try {
-    const vm = QuickJSModule.newContext();
+    managedQuickJsContext = createManagedQuickJsContext(QuickJSModule);
+    const vm = managedQuickJsContext.vm;
     const { bru, req, res, ...variables } = externalContext;
 
     bru && addBruShimToContext(vm, bru);
@@ -74,7 +75,7 @@ const executeQuickJsVm = ({ script: externalScript, context: externalContext, sc
 
     let scriptText = scriptType === 'template-literal' ? templateLiteralText : jsExpressionText;
 
-    const result = vm.evalCode(scriptText);
+    const result = vm.evalCodeRetained(scriptText);
     if (result.error) {
       let e = vm.dump(result.error);
       result.error.dispose();
@@ -86,6 +87,8 @@ const executeQuickJsVm = ({ script: externalScript, context: externalContext, sc
     }
   } catch (error) {
     console.error('Error executing the script!', error);
+  } finally {
+    managedQuickJsContext?.dispose();
   }
 };
 
@@ -95,9 +98,11 @@ const executeQuickJsVmAsync = async ({ script: externalScript, context: external
   }
   externalScript = externalScript?.trim();
 
+  let managedQuickJsContext;
   try {
     const module = await loader();
-    const vm = module.newContext();
+    managedQuickJsContext = createManagedQuickJsContext(module);
+    const vm = managedQuickJsContext.vm;
 
     // add crypto utilities required by the crypto-js library in bundledCode
     await addCryptoUtilsShimToContext(vm);
@@ -126,17 +131,27 @@ const executeQuickJsVmAsync = async ({ script: externalScript, context: external
 
     const script = wrapScriptInClosure(externalScript, SANDBOX.QUICKJS);
 
-    const result = vm.evalCode(script, scriptPath);
+    const result = vm.evalCodeRetained(script, scriptPath);
     const promiseHandle = vm.unwrapResult(result);
     const resolvedResult = await vm.resolvePromise(promiseHandle);
     promiseHandle.dispose();
     const resolvedHandle = vm.unwrapResult(resolvedResult);
     resolvedHandle.dispose();
-    // vm.dispose();
     return;
   } catch (error) {
     error.__isQuickJS = true;
     throw error;
+  } finally {
+    // Wait for any in-flight async work (sendRequest, axios, cookie jar, timers,
+    // un-awaited promises) to settle before tearing down the VM. Disposing while
+    // a deferred is still pending lets its later host callback touch a freed
+    // context, throwing `QuickJSUseAfterFree`.
+    try {
+      await managedQuickJsContext?.waitForPendingDeferreds?.();
+      managedQuickJsContext?.dispose();
+    } catch (teardownError) {
+      throw teardownError;
+    }
   }
 };
 

package/src/sandbox/quickjs/shims/bru.js

@@ -117,6 +117,12 @@ const addBruShimToContext = (vm, bru) => {
   vm.setProp(bruObject, 'getAllGlobalEnvVars', getAllGlobalEnvVars);
   getAllGlobalEnvVars.dispose();
 
+  let hasGlobalEnvVar = vm.newFunction('hasGlobalEnvVar', function (key) {
+    return marshallToVm(bru.hasGlobalEnvVar(vm.dump(key)), vm);
+  });
+  vm.setProp(bruObject, 'hasGlobalEnvVar', hasGlobalEnvVar);
+  hasGlobalEnvVar.dispose();
+
   // TODO: deleteAllGlobalEnvVars works in the request lifecycle but does not update the UI.
   // Re-enable once the UI sync issue is resolved.
   // let deleteAllGlobalEnvVars = vm.newFunction('deleteAllGlobalEnvVars', function () {
@@ -401,10 +407,20 @@ const addBruShimToContext = (vm, bru) => {
   });
   sendRequestHandle.consume((handle) => vm.setProp(bruObject, '_sendRequest', handle));
 
+  // On vm.global, not bru, to stay off user-facing autocomplete.
+  let setScopeHandle = vm.newFunction('__bruSetScope', (scopeArg) => {
+    bru._currentScope = vm.dump(scopeArg) || null;
+  });
+  setScopeHandle.consume((handle) => vm.setProp(vm.global, '__bruSetScope', handle));
+
   const sleep = vm.newFunction('sleep', (timer) => {
     const t = vm.getString(timer);
     const promise = vm.newPromise();
     setTimeout(() => {
+      // The VM may have been disposed while this native timer was pending
+      // (e.g. a setTimeout/sleep whose promise the script never awaited).
+      // Touching the VM after teardown throws QuickJSUseAfterFree, so bail out.
+      if (!vm.alive) return;
       promise.resolve(vm.newString('slept'));
     }, t);
     promise.settled.then(vm.runtime.executePendingJobs);

package/src/sandbox/quickjs/utils/index.js

@@ -1,3 +1,130 @@
+/**
+ * Creates a QuickJS context with centralized lifecycle management:
+ * - vm.evalCode() auto-disposes result handles (for shim setup code)
+ * - vm.evalCodeRetained() returns the raw result (for user script execution)
+ * - all newObject/newFunction/newArray handles are tracked and disposed on teardown
+ */
+const createManagedQuickJsContext = (module) => {
+  const vm = module.newContext();
+  const disposeTracked = trackQuickJsContext(vm);
+  const evalCodeRetained = vm.evalCode.bind(vm);
+  const waitForPendingDeferreds = trackPendingDeferreds(vm);
+
+  vm.evalCode = (code, filename = 'eval.js') => {
+    const result = evalCodeRetained(code, filename);
+    if (result.error) {
+      const error = vm.dump(result.error);
+      result.error.dispose();
+      throw error;
+    }
+    result.value.dispose();
+  };
+
+  vm.evalCodeRetained = evalCodeRetained;
+
+  return {
+    vm,
+    waitForPendingDeferreds,
+    dispose: () => disposeQuickJsContext(vm, disposeTracked)
+  };
+};
+
+/**
+ * Track every deferred created by the async shims (sendRequest, axios, cookie
+ * jar, sleep, ...) so teardown can wait for them to settle. A user script that
+ * fires-and-forgets async work (e.g. an un-awaited setTimeout) resolves the
+ * wrapping closure immediately; without this, the VM is disposed before the
+ * deferred's host callback runs, and touching the freed context throws
+ * `QuickJSUseAfterFree`. Each `.settled` resolves once the deferred is
+ * resolved/rejected, so awaiting them keeps the context alive long enough.
+ *
+ * The hook is installed now (at context creation) so it captures promises as
+ * the script runs. Returns a function that drains the captured deferreds at
+ * teardown; new deferreds can be created while we wait (a chained timer), so it
+ * drains in place until none remain.
+ */
+
+const trackPendingDeferreds = (vm) => {
+  const pendingDeferreds = [];
+  const originalNewPromise = vm.newPromise.bind(vm);
+  vm.newPromise = (...args) => {
+    const deferred = originalNewPromise(...args);
+    pendingDeferreds.push(deferred.settled.catch(() => { }));
+    return deferred;
+  };
+
+  return async () => {
+    while (pendingDeferreds.length) {
+      const batch = pendingDeferreds.splice(0);
+      await Promise.all(batch);
+    }
+  };
+};
+
+/**
+ * Tracks handles created via newObject/newFunction/newArray so they can all be
+ * disposed before the context. quickjs-emscripten requires every heap handle to
+ * be disposed individually; shims attach then drop their ref via .dispose().
+ */
+const trackQuickJsContext = (vm) => {
+  const handles = [];
+
+  const track = (handle) => {
+    handles.push(handle);
+    return handle;
+  };
+
+  // Replace an allocator with a wrapper that records every handle it returns,
+  // so teardown can dispose them all. Behaviour is otherwise identical.
+  const trackAllocations = (method) => {
+    const original = vm[method]?.bind(vm);
+    if (!original) {
+      return;
+    }
+
+    vm[method] = (...args) => track(original(...args));
+  };
+
+  ['newObject', 'newFunction', 'newArray'].forEach(trackAllocations);
+
+  // Dispose newest-first: later handles may reference earlier ones.
+  return () => {
+    for (const handle of handles.reverse()) {
+      if (handle?.alive) {
+        handle.dispose();
+      }
+    }
+  };
+};
+
+/**
+ * Clears shim globals, drains pending QuickJS jobs, and disposes the context.
+ * Pass disposeTracked from trackQuickJsContext() to free shim handles first.
+ */
+const disposeQuickJsContext = (vm, disposeTracked) => {
+  if (!vm?.alive) {
+    return;
+  }
+
+  if (typeof disposeTracked === 'function') {
+    disposeTracked();
+  }
+
+  // Drain the runtime's pending job queue (resolved/rejected promise callbacks)
+  // before disposing. Executing a job can schedule more jobs (chained `.then()`s),
+  // so we keep going until `hasPendingJob()` reports the queue is empty or a job
+  // throws.
+  while (vm.runtime?.hasPendingJob?.()) {
+    const result = vm.runtime.executePendingJobs();
+    // On error, dispose the error handle and stop draining.
+    if (result.error) {
+      result.error.dispose();
+      break;
+    }
+  }
+  vm.dispose();
+};
+
 const marshallToVm = (value, vm) => {
   if (value === undefined) {
     return vm.undefined;
@@ -79,5 +206,8 @@ async function invokeFunction(vm, quickFn, args = []) {
 
 module.exports = {
   marshallToVm,
-  invokeFunction
+  invokeFunction,
+  createManagedQuickJsContext,
+  disposeQuickJsContext,
+  trackQuickJsContext
 };