fix: add --sandbox-shared-modules flag - #9163
Closed
sid-bruno wants to merge 3 commits into
Closed
Conversation
sid-bruno
requested review from
bijin-bruno,
helloanoop,
lohit-bruno,
naman-bruno,
sachin-thakur-bruno,
sanish-bruno,
utkarsh-bruno and
vijayh-bruno
as code owners
September 3, 2026 08:28
sid-bruno
marked this pull request as draft
September 3, 2026 08:28
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The shared require path introduces behavior gaps (notably path separator normalization and bypassed allowlist semantics) that can break cross-platform scripts and weaken existing sandbox path validation expectations.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds an opt-in CLI flag to enable shared CommonJS module instances across Node VM script executions (via Node’s require.cache) to support stateful module reuse within a single bru run invocation.
Changes:
- Introduces
createSharedRequire()and wiresscriptingConfig.sharedModulesinto the Node VM sandbox. - Adds
--sandbox-shared-modulesflag plumbing in the CLI (runcommand → runner → scripting config). - Adds unit tests (bruno-js) and an integration test (bruno-cli) validating shared vs isolated module behavior and resolution fallbacks.
File summaries
| File | Description |
|---|---|
| packages/bruno-js/src/sandbox/node-vm/index.js | Switches require implementation based on scriptingConfig.sharedModules. |
| packages/bruno-js/src/sandbox/node-vm/cjs-loader.js | Adds createSharedRequire() that resolves modules relative to the collection and falls back to Bruno-bundled modules. |
| packages/bruno-js/src/sandbox/node-vm/index.spec.js | Adds unit coverage for shared module instance behavior and resolution rules. |
| packages/bruno-cli/src/commands/run.js | Adds --sandbox-shared-modules option and maps it into internal runner options. |
| packages/bruno-cli/src/runner/run-single-request.js | Passes CLI option into scriptingConfig.sharedModules. |
| packages/bruno-cli/tests/integration/run-sandbox-shared-modules.spec.js | New integration suite validating module sharing across requests and safe-sandbox compatibility. |
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 3
- Review effort level: Lite
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+57
to
+69
| // Shared host require (opt-in) or per-script custom CJS loader | ||
| if (get(scriptingConfig, 'sharedModules')) { | ||
| scriptContext.require = createSharedRequire(collectionPath); | ||
| } else { | ||
| const localModuleCache = new Map(); | ||
| scriptContext.require = createCustomRequire({ | ||
| collectionPath, | ||
| isolatedContext, | ||
| currentModuleDir: collectionPath, | ||
| localModuleCache, | ||
| additionalContextRootsAbsolute | ||
| }); | ||
| } |
Comment on lines
+18
to
+25
| beforeAll(async () => { | ||
| server = http.createServer((_req, res) => { | ||
| res.writeHead(200, { 'Content-Type': 'text/plain' }); | ||
| res.end('ok'); | ||
| }); | ||
| await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve)); | ||
| port = server.address().port; | ||
| }); |
Comment on lines
+391
to
+411
| return (moduleName) => { | ||
| if (isBuiltinModule(moduleName)) { | ||
| return require(moduleName); | ||
| } | ||
|
|
||
| let resolvedPath; | ||
| try { | ||
| resolvedPath = collectionRequire.resolve(moduleName); | ||
| } catch { | ||
| try { | ||
| resolvedPath = require.resolve(moduleName, { paths: module.paths }); | ||
| } catch (mainError) { | ||
| throw new Error( | ||
| `Could not resolve module "${moduleName}": ${mainError.message}\n\n` | ||
| + `Install it with: npm install ${moduleName}` | ||
| ); | ||
| } | ||
| } | ||
|
|
||
| return require(resolvedPath); | ||
| }; |
sid-bruno
changed the title
Collaborator
Author
|
Closed for #9170 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
TBD
Problem
Fix
Screenshots
Contribution Checklist:
Note: Keeping the PR small and focused helps make it easier to review and merge. If you have multiple changes you want to make, please consider submitting them as separate pull requests.
Publishing to New Package Managers
Please see here for more information.