@usebruno/js 0.48.0 → 0.50.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usebruno/js",
-  "version": "0.48.0",
+  "version": "0.50.0",
   "license": "MIT",
   "main": "src/index.js",
   "files": [
@@ -9,16 +9,17 @@
   ],
   "scripts": {
     "test": "node --experimental-vm-modules $(npx which jest) --testPathIgnorePatterns test.js",
+    "test:ci": "node --experimental-vm-modules ../../node_modules/jest/bin/jest.js --testPathIgnorePatterns test.js",
     "sandbox:bundle-libraries": "node ./src/sandbox/bundle-libraries.js",
     "prepack": "npm run test"
   },
   "dependencies": {
-    "@usebruno/common": "0.22.0",
+    "@usebruno/common": "0.24.0",
     "@usebruno/query": "0.2.2",
     "ajv": "^8.12.0",
     "ajv-formats": "^2.1.1",
     "atob": "^2.1.2",
-    "axios": "1.13.6",
+    "axios": "1.16.0",
     "btoa": "^1.2.1",
     "chai": "^4.3.7",
     "chai-string": "^1.5.0",
@@ -27,7 +28,7 @@
     "handlebars": "^4.7.9",
     "json-query": "^2.2.2",
     "jsonwebtoken": "^9.0.3",
-    "lodash": "^4.17.21",
+    "lodash": "4.18.1",
     "moment": "^2.29.4",
     "nanoid": "3.3.8",
     "node-fetch": "^2.7.0",

package/src/bru.js

@@ -1,8 +1,8 @@
-const { cloneDeep } = require('lodash');
+const { cloneDeep, isEqual } = require('lodash');
 const { uuid } = require('./utils');
 const xmlFormat = require('xml-formatter');
 const { interpolate: _interpolate } = require('@usebruno/common');
-const { sendRequest, createSendRequest } = require('@usebruno/requests').scripting;
+const { createSendRequest } = require('@usebruno/requests').scripting;
 const { jar: createCookieJar, getCookiesForUrl } = require('@usebruno/requests').cookies;
 const CookieList = require('./cookie-list');
 const Handlebars = require('handlebars');
@@ -102,8 +102,17 @@ class Bru {
     this.setVisualizations = setVisualizations;
     this.onConsoleLog = onConsoleLog || null;
     this.collectionName = collectionName;
-    // Use createSendRequest with config if provided, otherwise use default sendRequest
-    this.sendRequest = certsAndProxyConfig ? createSendRequest(certsAndProxyConfig) : sendRequest;
+    // Set by the host-side __bruSetScope global at the top of each segment's IIFE.
+    this._currentScope = null;
+    this.scriptedRequestEntries = [];
+    this.sendRequest = (...args) => {
+      const scopeSnapshot = this._currentScope ? { ...this._currentScope } : null;
+      const send = createSendRequest(certsAndProxyConfig, {
+        onComplete: (entry) =>
+          this._recordScriptedRequest({ source: 'sendRequest', scope: scopeSnapshot, ...entry })
+      });
+      return send(...args);
+    };
     this.runtime = runtime;
     this.requestUrl = requestUrl;
     this.cookies = new CookieList({
@@ -112,8 +121,11 @@ class Bru {
       createCookieJar,
       getCookiesForUrl
     });
-    // Holds variables that are marked as persistent by scripts
-    this.persistentEnvVariables = {};
+    // Dirty flags — set by mutators so runtimes can skip IPC/disk writes for unchanged scopes
+    this._envDirty = false;
+    this._globalEnvDirty = false;
+    this._collVarsDirty = false;
+    this._runtimeVarsDirty = false;
     // Holds credential IDs to be reset after script execution
     this.oauth2CredentialsToReset = [];
     this.runner = {
@@ -205,6 +217,16 @@ class Bru {
     return this.collectionPath;
   }
 
+  _recordScriptedRequest(entry) {
+    // Prefer scope passed in by the caller (snapshot at call time). Fall back to
+    // _currentScope for callers that don't supply one (e.g. bru.runRequest).
+    const { scope: providedScope, ...rest } = entry;
+    const scope = providedScope !== undefined
+      ? providedScope
+      : (this._currentScope ? { ...this._currentScope } : null);
+    this.scriptedRequestEntries.push({ ...rest, scope });
+  }
+
   getEnvName() {
     return this.envVariables.__name__;
   }
@@ -221,7 +243,7 @@ class Bru {
     return this.interpolate(this.envVariables[key]);
   }
 
-  setEnvVar(key, value, options = {}) {
+  setEnvVar(key, value) {
     if (!key) {
       throw new Error('Creating a env variable without specifying a name is not allowed.');
     }
@@ -232,24 +254,21 @@ class Bru {
       );
     }
 
-    // When persist is true, only string values are allowed
-    if (options?.persist && typeof value !== 'string') {
-      throw new Error(`Persistent environment variables must be strings. Received ${typeof value} for key "${key}".`);
-    }
-
-    this.envVariables[key] = value;
-
-    if (options?.persist) {
-      this.persistentEnvVariables[key] = value;
-    } else {
-      if (this.persistentEnvVariables[key]) {
-        delete this.persistentEnvVariables[key];
-      }
+    // Deep-equal compare so object/array writes that mutate in place
+    // (e.g. `const c = bru.getEnvVar('cfg'); c.port = 4000; bru.setEnvVar('cfg', c);`)
+    // still flip the dirty flag — strict `!==` returned false for same-reference writes.
+    if (!Object.hasOwn(this.envVariables, key) || !isEqual(this.envVariables[key], value)) {
+      this.envVariables[key] = value;
+      this._envDirty = true;
     }
   }
 
   deleteEnvVar(key) {
-    delete this.envVariables[key];
+    if (key === '__name__') return;
+    if (Object.hasOwn(this.envVariables, key)) {
+      delete this.envVariables[key];
+      this._envDirty = true;
+    }
   }
 
   getAllEnvVars() {
@@ -259,15 +278,19 @@ class Bru {
   }
 
   deleteAllEnvVars() {
-    const envName = this.envVariables.__name__;
-    for (let key in this.envVariables) {
-      if (this.envVariables.hasOwnProperty(key)) {
-        delete this.envVariables[key];
-      }
-    }
-    if (envName !== undefined) {
-      this.envVariables.__name__ = envName;
+    // Iterate via Object.keys (own enumerable) so a user-set `hasOwnProperty` var
+    // can't shadow Object.prototype.hasOwnProperty and crash the loop.
+    let removed = false;
+    for (const key of Object.keys(this.envVariables)) {
+      if (key === '__name__') continue;
+      delete this.envVariables[key];
+      removed = true;
     }
+    if (removed) this._envDirty = true;
+  }
+
+  hasGlobalEnvVar(key) {
+    return Object.hasOwn(this.globalEnvironmentVariables, key);
   }
 
   getGlobalEnvVar(key) {
@@ -279,28 +302,31 @@ class Bru {
       throw new Error('Creating a env variable without specifying a name is not allowed.');
     }
 
-    this.globalEnvironmentVariables[key] = value;
+    if (!Object.hasOwn(this.globalEnvironmentVariables, key) || !isEqual(this.globalEnvironmentVariables[key], value)) {
+      this.globalEnvironmentVariables[key] = value;
+      this._globalEnvDirty = true;
+    }
   }
 
-  // TODO: deleteGlobalEnvVar works in the request lifecycle but does not update the UI.
-  // Re-enable once the UI sync issue is resolved.
-  // deleteGlobalEnvVar(key) {
-  //   delete this.globalEnvironmentVariables[key];
-  // }
+  deleteGlobalEnvVar(key) {
+    if (Object.hasOwn(this.globalEnvironmentVariables, key)) {
+      delete this.globalEnvironmentVariables[key];
+      this._globalEnvDirty = true;
+    }
+  }
 
   getAllGlobalEnvVars() {
     return Object.assign({}, this.globalEnvironmentVariables);
   }
 
-  // TODO: deleteAllGlobalEnvVars works in the request lifecycle but does not update the UI.
-  // Re-enable once the UI sync issue is resolved.
-  // deleteAllGlobalEnvVars() {
-  //   for (let key in this.globalEnvironmentVariables) {
-  //     if (this.globalEnvironmentVariables.hasOwnProperty(key)) {
-  //       delete this.globalEnvironmentVariables[key];
-  //     }
-  //   }
-  // }
+  deleteAllGlobalEnvVars() {
+    const keys = Object.keys(this.globalEnvironmentVariables);
+    if (!keys.length) return;
+    for (const key of keys) {
+      delete this.globalEnvironmentVariables[key];
+    }
+    this._globalEnvDirty = true;
+  }
 
   getOauth2CredentialVar(key) {
     return this.interpolate(this.oauth2CredentialVariables[key]);
@@ -340,7 +366,10 @@ class Bru {
       );
     }
 
-    this.runtimeVariables[key] = value;
+    if (!Object.hasOwn(this.runtimeVariables, key) || !isEqual(this.runtimeVariables[key], value)) {
+      this.runtimeVariables[key] = value;
+      this._runtimeVarsDirty = true;
+    }
   }
 
   getVar(key) {
@@ -355,15 +384,19 @@ class Bru {
   }
 
   deleteVar(key) {
-    delete this.runtimeVariables[key];
+    if (Object.hasOwn(this.runtimeVariables, key)) {
+      delete this.runtimeVariables[key];
+      this._runtimeVarsDirty = true;
+    }
   }
 
   deleteAllVars() {
-    for (let key in this.runtimeVariables) {
-      if (this.runtimeVariables.hasOwnProperty(key)) {
-        delete this.runtimeVariables[key];
-      }
+    const keys = Object.keys(this.runtimeVariables);
+    if (!keys.length) return;
+    for (const key of keys) {
+      delete this.runtimeVariables[key];
     }
+    this._runtimeVarsDirty = true;
   }
 
   getAllVars() {
@@ -374,48 +407,47 @@ class Bru {
     return this.interpolate(this.collectionVariables[key]);
   }
 
-  // TODO: setCollectionVar works in the request lifecycle but does not update the UI.
-  // Re-enable once the UI sync issue is resolved.
-  // setCollectionVar(key, value) {
-  //   if (!key) {
-  //     throw new Error('Creating a variable without specifying a name is not allowed.');
-  //   }
-  //
-  //   if (variableNameRegex.test(key) === false) {
-  //     throw new Error(
-  //       `Variable name: "${key}" contains invalid characters!`
-  //       + ' Names must only contain alpha-numeric characters, "-", "_", "."'
-  //     );
-  //   }
-  //
-  //   this.collectionVariables[key] = value;
-  // }
+  setCollectionVar(key, value) {
+    if (!key) {
+      throw new Error('Creating a variable without specifying a name is not allowed.');
+    }
+
+    if (variableNameRegex.test(key) === false) {
+      throw new Error(
+        `Variable name: "${key}" contains invalid characters!`
+        + ' Names must only contain alpha-numeric characters, "-", "_", "."'
+      );
+    }
+
+    if (!Object.hasOwn(this.collectionVariables, key) || !isEqual(this.collectionVariables[key], value)) {
+      this.collectionVariables[key] = value;
+      this._collVarsDirty = true;
+    }
+  }
 
   hasCollectionVar(key) {
     return Object.hasOwn(this.collectionVariables, key);
   }
 
-  // TODO: deleteCollectionVar works in the request lifecycle but does not update the UI.
-  // Re-enable once the UI sync issue is resolved.
-  // deleteCollectionVar(key) {
-  //   delete this.collectionVariables[key];
-  // }
-
-  // TODO: deleteAllCollectionVars works in the request lifecycle but does not update the UI.
-  // Re-enable once the UI sync issue is resolved.
-  // deleteAllCollectionVars() {
-  //   for (let key in this.collectionVariables) {
-  //     if (this.collectionVariables.hasOwnProperty(key)) {
-  //       delete this.collectionVariables[key];
-  //     }
-  //   }
-  // }
-
-  // TODO: getAllCollectionVars works in the request lifecycle but does not update the UI.
-  // Re-enable once the UI sync issue is resolved.
-  // getAllCollectionVars() {
-  //   return Object.assign({}, this.collectionVariables);
-  // }
+  deleteCollectionVar(key) {
+    if (Object.hasOwn(this.collectionVariables, key)) {
+      delete this.collectionVariables[key];
+      this._collVarsDirty = true;
+    }
+  }
+
+  deleteAllCollectionVars() {
+    const keys = Object.keys(this.collectionVariables);
+    if (!keys.length) return;
+    for (const key of keys) {
+      delete this.collectionVariables[key];
+    }
+    this._collVarsDirty = true;
+  }
+
+  getAllCollectionVars() {
+    return Object.assign({}, this.collectionVariables);
+  }
 
   getFolderVar(key) {
     return this.interpolate(this.folderVariables[key]);

package/src/bruno-request.js

@@ -70,7 +70,13 @@ class BrunoRequest {
             if (segment.startsWith(':')) {
               const paramName = segment.slice(1);
               const pathParam = this.req.pathParams.find((param) => param.name === paramName);
-              if (pathParam && pathParam.value) {
+              if (
+                pathParam
+                && pathParam.enabled !== false
+                && pathParam.value !== null
+                && pathParam.value !== undefined
+                && (typeof pathParam.value !== 'string' || pathParam.value.trim() !== '')
+              ) {
                 return pathParam.value;
               }
             }

package/src/runtime/script-runtime.js

@@ -8,6 +8,7 @@ const { createBruTestResultMethods } = require('../utils/results');
 const { runScriptInNodeVm } = require('../sandbox/node-vm');
 const { executeQuickJsVmAsync } = require('../sandbox/quickjs');
 const { SANDBOX } = require('../utils/sandbox');
+const { bindRunRequest, createScopeSetter } = require('./scripted-entries');
 
 class ScriptRuntime {
   constructor(props) {
@@ -80,7 +81,8 @@ class ScriptRuntime {
       test,
       expect: chai.expect,
       assert: chai.assert,
-      __brunoTestResults: __brunoTestResults
+      __brunoTestResults: __brunoTestResults,
+      __bruSetScope: createScopeSetter(bru)
     };
 
     if (onConsoleLog && typeof onConsoleLog === 'function') {
@@ -98,24 +100,23 @@ class ScriptRuntime {
       };
     }
 
-    if (runRequestByItemPathname) {
-      context.bru.runRequest = runRequestByItemPathname;
-    }
+    bindRunRequest(bru, runRequestByItemPathname);
 
     // Helper to build the result object for pre-request scripts
     // Extracted to avoid duplication across runtime branches
     const buildRequestScriptResult = () => ({
       request,
-      envVariables: cleanJson(envVariables),
-      runtimeVariables: cleanJson(runtimeVariables),
+      envVariables: bru._envDirty ? cleanJson(envVariables) : null,
+      runtimeVariables: bru._runtimeVarsDirty ? cleanJson(runtimeVariables) : null,
+      collectionVariables: bru._collVarsDirty ? cleanJson(collectionVariables) : null,
+      globalEnvironmentVariables: bru._globalEnvDirty ? cleanJson(globalEnvironmentVariables) : null,
       visualizations,
-      persistentEnvVariables: bru.persistentEnvVariables,
-      globalEnvironmentVariables: cleanJson(globalEnvironmentVariables),
       oauth2CredentialsToReset: bru.oauth2CredentialsToReset,
       results: cleanJson(__brunoTestResults.getResults()),
       nextRequestName: bru.nextRequest,
       skipRequest: bru.skipRequest,
-      stopExecution: bru.stopExecution
+      stopExecution: bru.stopExecution,
+      scriptedRequestEntries: cleanJson(bru.scriptedRequestEntries || [])
     });
 
     // Track script errors to attach partial results before re-throwing
@@ -233,7 +234,8 @@ class ScriptRuntime {
       test,
       expect: chai.expect,
       assert: chai.assert,
-      __brunoTestResults: __brunoTestResults
+      __brunoTestResults: __brunoTestResults,
+      __bruSetScope: createScopeSetter(bru)
     };
 
     if (onConsoleLog && typeof onConsoleLog === 'function') {
@@ -251,24 +253,23 @@ class ScriptRuntime {
       };
     }
 
-    if (runRequestByItemPathname) {
-      context.bru.runRequest = runRequestByItemPathname;
-    }
+    bindRunRequest(bru, runRequestByItemPathname);
 
     // Helper to build the result object for post-response scripts
     // Extracted to avoid duplication across runtime branches
     const buildResponseScriptResult = () => ({
       response,
-      envVariables: cleanJson(envVariables),
-      persistentEnvVariables: cleanJson(bru.persistentEnvVariables),
-      runtimeVariables: cleanJson(runtimeVariables),
+      envVariables: bru._envDirty ? cleanJson(envVariables) : null,
+      runtimeVariables: bru._runtimeVarsDirty ? cleanJson(runtimeVariables) : null,
+      collectionVariables: bru._collVarsDirty ? cleanJson(collectionVariables) : null,
+      globalEnvironmentVariables: bru._globalEnvDirty ? cleanJson(globalEnvironmentVariables) : null,
       visualizations,
-      globalEnvironmentVariables: cleanJson(globalEnvironmentVariables),
       oauth2CredentialsToReset: bru.oauth2CredentialsToReset,
       results: cleanJson(__brunoTestResults.getResults()),
       nextRequestName: bru.nextRequest,
       skipRequest: bru.skipRequest,
-      stopExecution: bru.stopExecution
+      stopExecution: bru.stopExecution,
+      scriptedRequestEntries: cleanJson(bru.scriptedRequestEntries || [])
     });
 
     // Track script errors to attach partial results before re-throwing

package/src/runtime/scripted-entries.js

@@ -0,0 +1,16 @@
+// Forwards the caller's bru as a second arg so the host can attribute the call.
+const bindRunRequest = (bru, runRequestByItemPathname) => {
+  if (!runRequestByItemPathname) return;
+  bru.runRequest = (relativePathname) =>
+    runRequestByItemPathname(relativePathname, bru);
+};
+
+// Kept off bru to stay out of user-facing autocomplete.
+const createScopeSetter = (bru) => (scope) => {
+  bru._currentScope = scope || null;
+};
+
+module.exports = {
+  bindRunRequest,
+  createScopeSetter
+};

package/src/runtime/test-runtime.js

@@ -9,6 +9,7 @@ const { runScriptInNodeVm } = require('../sandbox/node-vm');
 const jsonwebtoken = require('jsonwebtoken');
 const { executeQuickJsVmAsync } = require('../sandbox/quickjs');
 const { SANDBOX } = require('../utils/sandbox');
+const { bindRunRequest, createScopeSetter } = require('./scripted-entries');
 
 class TestRuntime {
   constructor(props) {
@@ -68,9 +69,10 @@ class TestRuntime {
     if (!testsFile || !testsFile.length) {
       return {
         request,
-        envVariables,
-        runtimeVariables,
-        globalEnvironmentVariables,
+        envVariables: null,
+        runtimeVariables: null,
+        collectionVariables: null,
+        globalEnvironmentVariables: null,
         results: __brunoTestResults.getResults(),
         nextRequestName: bru.nextRequest
       };
@@ -84,7 +86,8 @@ class TestRuntime {
       expect: chai.expect,
       assert: chai.assert,
       __brunoTestResults: __brunoTestResults,
-      jwt: jsonwebtoken
+      jwt: jsonwebtoken,
+      __bruSetScope: createScopeSetter(bru)
     };
 
     if (onConsoleLog && typeof onConsoleLog === 'function') {
@@ -102,9 +105,7 @@ class TestRuntime {
       };
     }
 
-    if (runRequestByItemPathname) {
-      context.bru.runRequest = runRequestByItemPathname;
-    }
+    bindRunRequest(bru, runRequestByItemPathname);
 
     let scriptError = null;
 
@@ -141,13 +142,14 @@ class TestRuntime {
 
     const result = {
       request,
-      envVariables: cleanJson(envVariables),
-      runtimeVariables: cleanJson(runtimeVariables),
-      globalEnvironmentVariables: cleanJson(globalEnvironmentVariables),
-      persistentEnvVariables: cleanJson(bru.persistentEnvVariables),
+      envVariables: bru._envDirty ? cleanJson(envVariables) : null,
+      runtimeVariables: bru._runtimeVarsDirty ? cleanJson(runtimeVariables) : null,
+      collectionVariables: bru._collVarsDirty ? cleanJson(collectionVariables) : null,
+      globalEnvironmentVariables: bru._globalEnvDirty ? cleanJson(globalEnvironmentVariables) : null,
       oauth2CredentialsToReset: bru.oauth2CredentialsToReset,
       results: cleanJson(__brunoTestResults.getResults()),
-      nextRequestName: bru.nextRequest
+      nextRequestName: bru.nextRequest,
+      scriptedRequestEntries: cleanJson(bru.scriptedRequestEntries || [])
     };
 
     if (scriptError) {

package/src/runtime/vars-runtime.js

@@ -92,10 +92,10 @@ class VarsRuntime {
     }
 
     return {
-      envVariables,
-      runtimeVariables,
-      globalEnvironmentVariables: cleanJson(globalEnvironmentVariables),
-      persistentEnvVariables: cleanJson(bru.persistentEnvVariables),
+      envVariables: bru._envDirty ? cleanJson(envVariables) : null,
+      runtimeVariables: bru._runtimeVarsDirty ? cleanJson(runtimeVariables) : null,
+      collectionVariables: bru._collVarsDirty ? cleanJson(collectionVariables) : null,
+      globalEnvironmentVariables: bru._globalEnvDirty ? cleanJson(globalEnvironmentVariables) : null,
       error
     };
   }

package/src/sandbox/quickjs/index.js

@@ -11,7 +11,7 @@ const { newQuickJSWASMModule, memoizePromiseFactory } = require('quickjs-emscrip
 // execute `npm run sandbox:bundle-libraries` if the below file doesn't exist
 const getBundledCode = require('../bundle-browser-rollup');
 const addPathShimToContext = require('./shims/lib/path');
-const { marshallToVm } = require('./utils');
+const { marshallToVm, createManagedQuickJsContext } = require('./utils');
 const addCryptoUtilsShimToContext = require('./shims/lib/crypto-utils');
 const { wrapScriptInClosure, SANDBOX } = require('../../utils/sandbox');
 
@@ -56,9 +56,10 @@ const executeQuickJsVm = ({ script: externalScript, context: externalContext, sc
 
     externalScript = removeQuotes(externalScript);
   }
-
+  let managedQuickJsContext;
   try {
-    const vm = QuickJSModule.newContext();
+    managedQuickJsContext = createManagedQuickJsContext(QuickJSModule);
+    const vm = managedQuickJsContext.vm;
     const { bru, req, res, ...variables } = externalContext;
 
     bru && addBruShimToContext(vm, bru);
@@ -74,7 +75,7 @@ const executeQuickJsVm = ({ script: externalScript, context: externalContext, sc
 
     let scriptText = scriptType === 'template-literal' ? templateLiteralText : jsExpressionText;
 
-    const result = vm.evalCode(scriptText);
+    const result = vm.evalCodeRetained(scriptText);
     if (result.error) {
       let e = vm.dump(result.error);
       result.error.dispose();
@@ -86,6 +87,8 @@ const executeQuickJsVm = ({ script: externalScript, context: externalContext, sc
     }
   } catch (error) {
     console.error('Error executing the script!', error);
+  } finally {
+    managedQuickJsContext?.dispose();
   }
 };
 
@@ -95,9 +98,11 @@ const executeQuickJsVmAsync = async ({ script: externalScript, context: external
   }
   externalScript = externalScript?.trim();
 
+  let managedQuickJsContext;
   try {
     const module = await loader();
-    const vm = module.newContext();
+    managedQuickJsContext = createManagedQuickJsContext(module);
+    const vm = managedQuickJsContext.vm;
 
     // add crypto utilities required by the crypto-js library in bundledCode
     await addCryptoUtilsShimToContext(vm);
@@ -126,17 +131,27 @@ const executeQuickJsVmAsync = async ({ script: externalScript, context: external
 
     const script = wrapScriptInClosure(externalScript, SANDBOX.QUICKJS);
 
-    const result = vm.evalCode(script, scriptPath);
+    const result = vm.evalCodeRetained(script, scriptPath);
     const promiseHandle = vm.unwrapResult(result);
     const resolvedResult = await vm.resolvePromise(promiseHandle);
     promiseHandle.dispose();
     const resolvedHandle = vm.unwrapResult(resolvedResult);
     resolvedHandle.dispose();
-    // vm.dispose();
     return;
   } catch (error) {
     error.__isQuickJS = true;
     throw error;
+  } finally {
+    // Wait for any in-flight async work (sendRequest, axios, cookie jar, timers,
+    // un-awaited promises) to settle before tearing down the VM. Disposing while
+    // a deferred is still pending lets its later host callback touch a freed
+    // context, throwing `QuickJSUseAfterFree`.
+    try {
+      await managedQuickJsContext?.waitForPendingDeferreds?.();
+      managedQuickJsContext?.dispose();
+    } catch (teardownError) {
+      throw teardownError;
+    }
   }
 };
 

package/src/sandbox/quickjs/shims/bru.js

@@ -55,8 +55,8 @@ const addBruShimToContext = (vm, bru) => {
   vm.setProp(bruObject, 'getEnvVar', getEnvVar);
   getEnvVar.dispose();
 
-  let setEnvVar = vm.newFunction('setEnvVar', function (key, value, options = {}) {
-    bru.setEnvVar(vm.dump(key), vm.dump(value), vm.dump(options));
+  let setEnvVar = vm.newFunction('setEnvVar', function (key, value) {
+    bru.setEnvVar(vm.dump(key), vm.dump(value));
   });
   vm.setProp(bruObject, 'setEnvVar', setEnvVar);
   setEnvVar.dispose();
@@ -103,13 +103,11 @@ const addBruShimToContext = (vm, bru) => {
   vm.setProp(bruObject, 'setGlobalEnvVar', setGlobalEnvVar);
   setGlobalEnvVar.dispose();
 
-  // TODO: deleteGlobalEnvVar works in the request lifecycle but does not update the UI.
-  // Re-enable once the UI sync issue is resolved.
-  // let deleteGlobalEnvVar = vm.newFunction('deleteGlobalEnvVar', function (key) {
-  //   bru.deleteGlobalEnvVar(vm.dump(key));
-  // });
-  // vm.setProp(bruObject, 'deleteGlobalEnvVar', deleteGlobalEnvVar);
-  // deleteGlobalEnvVar.dispose();
+  let deleteGlobalEnvVar = vm.newFunction('deleteGlobalEnvVar', function (key) {
+    bru.deleteGlobalEnvVar(vm.dump(key));
+  });
+  vm.setProp(bruObject, 'deleteGlobalEnvVar', deleteGlobalEnvVar);
+  deleteGlobalEnvVar.dispose();
 
   let getAllGlobalEnvVars = vm.newFunction('getAllGlobalEnvVars', function () {
     return marshallToVm(bru.getAllGlobalEnvVars(), vm);
@@ -117,13 +115,17 @@ const addBruShimToContext = (vm, bru) => {
   vm.setProp(bruObject, 'getAllGlobalEnvVars', getAllGlobalEnvVars);
   getAllGlobalEnvVars.dispose();
 
-  // TODO: deleteAllGlobalEnvVars works in the request lifecycle but does not update the UI.
-  // Re-enable once the UI sync issue is resolved.
-  // let deleteAllGlobalEnvVars = vm.newFunction('deleteAllGlobalEnvVars', function () {
-  //   bru.deleteAllGlobalEnvVars();
-  // });
-  // vm.setProp(bruObject, 'deleteAllGlobalEnvVars', deleteAllGlobalEnvVars);
-  // deleteAllGlobalEnvVars.dispose();
+  let hasGlobalEnvVar = vm.newFunction('hasGlobalEnvVar', function (key) {
+    return marshallToVm(bru.hasGlobalEnvVar(vm.dump(key)), vm);
+  });
+  vm.setProp(bruObject, 'hasGlobalEnvVar', hasGlobalEnvVar);
+  hasGlobalEnvVar.dispose();
+
+  let deleteAllGlobalEnvVars = vm.newFunction('deleteAllGlobalEnvVars', function () {
+    bru.deleteAllGlobalEnvVars();
+  });
+  vm.setProp(bruObject, 'deleteAllGlobalEnvVars', deleteAllGlobalEnvVars);
+  deleteAllGlobalEnvVars.dispose();
 
   let hasVar = vm.newFunction('hasVar', function (key) {
     return marshallToVm(bru.hasVar(vm.dump(key)), vm);
@@ -277,13 +279,11 @@ const addBruShimToContext = (vm, bru) => {
   vm.setProp(bruObject, 'getCollectionVar', getCollectionVar);
   getCollectionVar.dispose();
 
-  // TODO: setCollectionVar works in the request lifecycle but does not update the UI.
-  // Re-enable once the UI sync issue is resolved.
-  // let setCollectionVar = vm.newFunction('setCollectionVar', function (key, value) {
-  //   bru.setCollectionVar(vm.dump(key), vm.dump(value));
-  // });
-  // vm.setProp(bruObject, 'setCollectionVar', setCollectionVar);
-  // setCollectionVar.dispose();
+  let setCollectionVar = vm.newFunction('setCollectionVar', function (key, value) {
+    bru.setCollectionVar(vm.dump(key), vm.dump(value));
+  });
+  vm.setProp(bruObject, 'setCollectionVar', setCollectionVar);
+  setCollectionVar.dispose();
 
   let hasCollectionVar = vm.newFunction('hasCollectionVar', function (key) {
     return marshallToVm(bru.hasCollectionVar(vm.dump(key)), vm);
@@ -291,29 +291,23 @@ const addBruShimToContext = (vm, bru) => {
   vm.setProp(bruObject, 'hasCollectionVar', hasCollectionVar);
   hasCollectionVar.dispose();
 
-  // TODO: deleteCollectionVar works in the request lifecycle but does not update the UI.
-  // Re-enable once the UI sync issue is resolved.
-  // let deleteCollectionVar = vm.newFunction('deleteCollectionVar', function (key) {
-  //   bru.deleteCollectionVar(vm.dump(key));
-  // });
-  // vm.setProp(bruObject, 'deleteCollectionVar', deleteCollectionVar);
-  // deleteCollectionVar.dispose();
-
-  // TODO: deleteAllCollectionVars works in the request lifecycle but does not update the UI.
-  // Re-enable once the UI sync issue is resolved.
-  // let deleteAllCollectionVars = vm.newFunction('deleteAllCollectionVars', function () {
-  //   bru.deleteAllCollectionVars();
-  // });
-  // vm.setProp(bruObject, 'deleteAllCollectionVars', deleteAllCollectionVars);
-  // deleteAllCollectionVars.dispose();
-
-  // TODO: getAllCollectionVars works in the request lifecycle but does not update the UI.
-  // Re-enable once the UI sync issue is resolved.
-  // let getAllCollectionVars = vm.newFunction('getAllCollectionVars', function () {
-  //   return marshallToVm(bru.getAllCollectionVars(), vm);
-  // });
-  // vm.setProp(bruObject, 'getAllCollectionVars', getAllCollectionVars);
-  // getAllCollectionVars.dispose();
+  let deleteCollectionVar = vm.newFunction('deleteCollectionVar', function (key) {
+    bru.deleteCollectionVar(vm.dump(key));
+  });
+  vm.setProp(bruObject, 'deleteCollectionVar', deleteCollectionVar);
+  deleteCollectionVar.dispose();
+
+  let deleteAllCollectionVars = vm.newFunction('deleteAllCollectionVars', function () {
+    bru.deleteAllCollectionVars();
+  });
+  vm.setProp(bruObject, 'deleteAllCollectionVars', deleteAllCollectionVars);
+  deleteAllCollectionVars.dispose();
+
+  let getAllCollectionVars = vm.newFunction('getAllCollectionVars', function () {
+    return marshallToVm(bru.getAllCollectionVars(), vm);
+  });
+  vm.setProp(bruObject, 'getAllCollectionVars', getAllCollectionVars);
+  getAllCollectionVars.dispose();
 
   let getTestResults = vm.newFunction('getTestResults', () => {
     const promise = vm.newPromise();
@@ -401,10 +395,20 @@ const addBruShimToContext = (vm, bru) => {
   });
   sendRequestHandle.consume((handle) => vm.setProp(bruObject, '_sendRequest', handle));
 
+  // On vm.global, not bru, to stay off user-facing autocomplete.
+  let setScopeHandle = vm.newFunction('__bruSetScope', (scopeArg) => {
+    bru._currentScope = vm.dump(scopeArg) || null;
+  });
+  setScopeHandle.consume((handle) => vm.setProp(vm.global, '__bruSetScope', handle));
+
   const sleep = vm.newFunction('sleep', (timer) => {
     const t = vm.getString(timer);
     const promise = vm.newPromise();
     setTimeout(() => {
+      // The VM may have been disposed while this native timer was pending
+      // (e.g. a setTimeout/sleep whose promise the script never awaited).
+      // Touching the VM after teardown throws QuickJSUseAfterFree, so bail out.
+      if (!vm.alive) return;
       promise.resolve(vm.newString('slept'));
     }, t);
     promise.settled.then(vm.runtime.executePendingJobs);

package/src/sandbox/quickjs/utils/index.js

@@ -1,3 +1,130 @@
+/**
+ * Creates a QuickJS context with centralized lifecycle management:
+ * - vm.evalCode() auto-disposes result handles (for shim setup code)
+ * - vm.evalCodeRetained() returns the raw result (for user script execution)
+ * - all newObject/newFunction/newArray handles are tracked and disposed on teardown
+ */
+const createManagedQuickJsContext = (module) => {
+  const vm = module.newContext();
+  const disposeTracked = trackQuickJsContext(vm);
+  const evalCodeRetained = vm.evalCode.bind(vm);
+  const waitForPendingDeferreds = trackPendingDeferreds(vm);
+
+  vm.evalCode = (code, filename = 'eval.js') => {
+    const result = evalCodeRetained(code, filename);
+    if (result.error) {
+      const error = vm.dump(result.error);
+      result.error.dispose();
+      throw error;
+    }
+    result.value.dispose();
+  };
+
+  vm.evalCodeRetained = evalCodeRetained;
+
+  return {
+    vm,
+    waitForPendingDeferreds,
+    dispose: () => disposeQuickJsContext(vm, disposeTracked)
+  };
+};
+
+/**
+ * Track every deferred created by the async shims (sendRequest, axios, cookie
+ * jar, sleep, ...) so teardown can wait for them to settle. A user script that
+ * fires-and-forgets async work (e.g. an un-awaited setTimeout) resolves the
+ * wrapping closure immediately; without this, the VM is disposed before the
+ * deferred's host callback runs, and touching the freed context throws
+ * `QuickJSUseAfterFree`. Each `.settled` resolves once the deferred is
+ * resolved/rejected, so awaiting them keeps the context alive long enough.
+ *
+ * The hook is installed now (at context creation) so it captures promises as
+ * the script runs. Returns a function that drains the captured deferreds at
+ * teardown; new deferreds can be created while we wait (a chained timer), so it
+ * drains in place until none remain.
+ */
+
+const trackPendingDeferreds = (vm) => {
+  const pendingDeferreds = [];
+  const originalNewPromise = vm.newPromise.bind(vm);
+  vm.newPromise = (...args) => {
+    const deferred = originalNewPromise(...args);
+    pendingDeferreds.push(deferred.settled.catch(() => { }));
+    return deferred;
+  };
+
+  return async () => {
+    while (pendingDeferreds.length) {
+      const batch = pendingDeferreds.splice(0);
+      await Promise.all(batch);
+    }
+  };
+};
+
+/**
+ * Tracks handles created via newObject/newFunction/newArray so they can all be
+ * disposed before the context. quickjs-emscripten requires every heap handle to
+ * be disposed individually; shims attach then drop their ref via .dispose().
+ */
+const trackQuickJsContext = (vm) => {
+  const handles = [];
+
+  const track = (handle) => {
+    handles.push(handle);
+    return handle;
+  };
+
+  // Replace an allocator with a wrapper that records every handle it returns,
+  // so teardown can dispose them all. Behaviour is otherwise identical.
+  const trackAllocations = (method) => {
+    const original = vm[method]?.bind(vm);
+    if (!original) {
+      return;
+    }
+
+    vm[method] = (...args) => track(original(...args));
+  };
+
+  ['newObject', 'newFunction', 'newArray'].forEach(trackAllocations);
+
+  // Dispose newest-first: later handles may reference earlier ones.
+  return () => {
+    for (const handle of handles.reverse()) {
+      if (handle?.alive) {
+        handle.dispose();
+      }
+    }
+  };
+};
+
+/**
+ * Clears shim globals, drains pending QuickJS jobs, and disposes the context.
+ * Pass disposeTracked from trackQuickJsContext() to free shim handles first.
+ */
+const disposeQuickJsContext = (vm, disposeTracked) => {
+  if (!vm?.alive) {
+    return;
+  }
+
+  if (typeof disposeTracked === 'function') {
+    disposeTracked();
+  }
+
+  // Drain the runtime's pending job queue (resolved/rejected promise callbacks)
+  // before disposing. Executing a job can schedule more jobs (chained `.then()`s),
+  // so we keep going until `hasPendingJob()` reports the queue is empty or a job
+  // throws.
+  while (vm.runtime?.hasPendingJob?.()) {
+    const result = vm.runtime.executePendingJobs();
+    // On error, dispose the error handle and stop draining.
+    if (result.error) {
+      result.error.dispose();
+      break;
+    }
+  }
+  vm.dispose();
+};
+
 const marshallToVm = (value, vm) => {
   if (value === undefined) {
     return vm.undefined;
@@ -79,5 +206,8 @@ async function invokeFunction(vm, quickFn, args = []) {
 
 module.exports = {
   marshallToVm,
-  invokeFunction
+  invokeFunction,
+  createManagedQuickJsContext,
+  disposeQuickJsContext,
+  trackQuickJsContext
 };