feat(sandbox): add querystring to QuickJS module registry

[kwburns-kong]

Pure-JS querystring reimplementation for the QuickJS plugin sandbox, grantable via permissions.modules. Adds parity tests against real node:querystring and a manifest-grant test block. Gaps documented in PERMISSIONS.md.

Part of the legacy-module porting plan (packages/insomnia/src/templating/sandbox/plans/). Milestone 2a.

Security review (2b)

Independent sandbox-security review completed. Capability gating (baseline exclusion, manifest-grant requirement, resolveTemplateTagModules/canonicalizeModule resolution), the absence of any live host-object reference in QUERYSTRING_FACTORY's exports, and parse()'s Object.create(null) prototype-pollution defense were all confirmed correct — the last one via an actual adversarial run inside the sandbox (crafted __proto__/constructor query keys, cross-render leakage), not just source reading.

One real gap found and fixed in this module's own scope: parse()'s per-key/value decode shares unescape()'s fallback-to-unchanged-input behavior on malformed percent-encoding, but this was only documented (and tested) for unescape(). Extended the PERMISSIONS.md/code-comment documentation to cover parse() too, and added a regression test pinning the divergence against real node:querystring. No behavior change — it's a decode-fidelity gap, not a security issue (the fallback can only ever return the caller's own original substring unchanged, never smuggle new characters, and never throws uncontrolled). Full detail in SANDBOX-SECURITY-FINDINGS.md.

[github-actions]

✅ Circular References Report

Generated at: 2026-08-10T18:06:17.963Z
Status: ✅ NO CHANGE

Summary

Metric	Base (develop)	PR	Change
Total Circular References	9	9	0 (0.00%)

Click to view all circular references in PR (9)

insomnia-inso/src/db/models/types.ts -> insomnia-inso/src/db/types.ts
insomnia/src/main/prompt-bridge.ts -> insomnia/src/main/window-utils.ts -> insomnia/src/main/plugin-window.ts
insomnia/src/main/window-utils.ts -> insomnia/src/main/plugin-window.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts
insomnia/src/ui/components/settings/import-export.tsx -> insomnia/src/ui/components/modals/export-requests-modal.tsx
insomnia/src/ui/components/tabs/tab-list.tsx -> insomnia/src/ui/components/tabs/tab.tsx
insomnia/src/ui/components/templating/tag-editor-arg-sub-form.tsx -> insomnia/src/ui/components/templating/external-vault/external-vault-form.tsx
insomnia/src/ui/components/viewers/response-viewer.tsx -> insomnia/src/ui/components/viewers/response-multipart-viewer.tsx

Click to view all circular references in base branch (9)

insomnia-inso/src/db/models/types.ts -> insomnia-inso/src/db/types.ts
insomnia/src/main/prompt-bridge.ts -> insomnia/src/main/window-utils.ts -> insomnia/src/main/plugin-window.ts
insomnia/src/main/window-utils.ts -> insomnia/src/main/plugin-window.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts
insomnia/src/ui/components/settings/import-export.tsx -> insomnia/src/ui/components/modals/export-requests-modal.tsx
insomnia/src/ui/components/tabs/tab-list.tsx -> insomnia/src/ui/components/tabs/tab.tsx
insomnia/src/ui/components/templating/tag-editor-arg-sub-form.tsx -> insomnia/src/ui/components/templating/external-vault/external-vault-form.tsx
insomnia/src/ui/components/viewers/response-viewer.tsx -> insomnia/src/ui/components/viewers/response-multipart-viewer.tsx

Analysis

✅ No Change: This PR does not introduce or remove any circular references.

---

This report was generated automatically by comparing against the develop branch.