feat: disable nodeIntegration in renderer mainWindow, remove Node import check tooling by jackkav · Pull Request #9996 · Kong/insomnia

jackkav · 2026-06-01T05:19:26Z

What

Final step in removing nodeIntegration from the Electron renderer. Flips nodeIntegration: false / contextIsolation: true on mainWindow, then traces and eliminates every remaining Node-dependent import path from the renderer bundle.

The hidden window that runs pre/post-request scripts keeps nodeIntegration: true — that boundary is intentional.

How

Security flag (`window-utils.ts`)

nodeIntegration: true → false, contextIsolation: false → true on mainWindow

Cookie IPC bridge (`main/ipc/cookies.ts`)

tough-cookie jar logic moved to main process; renderer calls window.main.cookies.* via IPC
network-adapter.renderer.ts / network-adapter.node.ts split so each side gets the right cookie implementation

HAR export IPC bridge (`main/har.ts`)

HAR file generation logic moved to main process; renderer calls window.main.har.* via IPC
Exposed via entry.preload.ts to renderer

Vault adapter split (`vault-adapter.node.ts` / `vault-adapter.renderer.ts`)

Node-side vault keeps node-forge; renderer calls window.main.vault.{en,de}cryptSecretValue via IPC bridge

Script security split (`script-security-rules.ts`)

Pure-data constants (blockedPropertyRules, blockedRootRules, maskRules, types) extracted to a new module with zero Node imports
Renderer imports from script-security-rules directly; script-security-policy.ts keeps only the requireInterceptor-dependent logic

Templating renderer-safe surface (`render-adapter.ts`)

render, reload, getTagDefinitions re-exported without pulling in plugin/Node-heavy templating/index
All renderer callers (codemirror, tag-editor, variable-editor, env-utils, json-lint) updated

Testing IPC bridge (`main/ipc/main.ts`)

insomnia-testing dynamically imported in main; renderer calls window.main.runTests(src)
generate-to-file.ts split from generate.ts so generate() has zero Node imports

Plugin types extracted (`plugins/types.ts`)

Plugin interface types moved to a standalone module so renderer-side plugin consumers don't drag in Node-heavy plugin index

Proto validation IPC (`main/ipc/grpc.ts`)

@grpc/proto-loader validation moved to main process

File watcher notifier split (`git-service.ts`)

createElectronNotifier moved to main process to prevent Electron imports in renderer/SSR context
Fixes SSR evaluation errors when renderer-side code is executed server-side

Code snippet types (`types/code-snippet.ts`)

Code snippet type definitions extracted for use by code generation features
Decouples code generation UI from Node-heavy generation logic

Remove migration tooling (now redundant)

Delete vite-plugin-electron-node-require.ts, check-renderer-node-imports.ts, renderer-node-import-baseline.json
Remove DetectNodeBuiltinImports vite plugin and related CI step
Remove analyze:renderer-node-imports, check:renderer-node-imports, update:renderer-node-import-baseline scripts

Test plan

github-actions · 2026-06-01T05:22:19Z

✨ Circular References Report

Generated at: 2026-06-03T19:27:55.844Z
Status: ✨ IMPROVED

Summary

Metric	Base (`develop`)	PR	Change
Total Circular References	10	8	-2 (-20.00%)

✨ Circular References Removed (2)

Click to expand/collapse

insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/store.ts
insomnia/src/plugins/misc.ts -> insomnia/src/plugins/index.ts

Click to view all circular references in PR (8)

insomnia-inso/src/db/models/types.ts -> insomnia-inso/src/db/types.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/insomnia.ts -> insomnia-scripting-environment/src/objects/interfaces.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts
insomnia/src/ui/components/settings/import-export.tsx -> insomnia/src/ui/components/modals/export-requests-modal.tsx
insomnia/src/ui/components/tabs/tab-list.tsx -> insomnia/src/ui/components/tabs/tab.tsx
insomnia/src/ui/components/templating/tag-editor-arg-sub-form.tsx -> insomnia/src/ui/components/templating/external-vault/external-vault-form.tsx
insomnia/src/ui/components/viewers/response-viewer.tsx -> insomnia/src/ui/components/viewers/response-multipart-viewer.tsx

Click to view all circular references in base branch (10)

insomnia-inso/src/db/models/types.ts -> insomnia-inso/src/db/types.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/insomnia.ts -> insomnia-scripting-environment/src/objects/interfaces.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/store.ts
insomnia/src/plugins/misc.ts -> insomnia/src/plugins/index.ts
insomnia/src/ui/components/settings/import-export.tsx -> insomnia/src/ui/components/modals/export-requests-modal.tsx
insomnia/src/ui/components/tabs/tab-list.tsx -> insomnia/src/ui/components/tabs/tab.tsx
insomnia/src/ui/components/templating/tag-editor-arg-sub-form.tsx -> insomnia/src/ui/components/templating/external-vault/external-vault-form.tsx
insomnia/src/ui/components/viewers/response-viewer.tsx -> insomnia/src/ui/components/viewers/response-multipart-viewer.tsx

Analysis

✨ Great Job! This PR removes 2 circular references. Keep up the good work!

This report was generated automatically by comparing against the develop branch.

jackkav · 2026-06-01T09:35:25Z

Rebase + review notes

Rebased onto origin/develop and fixed three CI failures found in the prior run:

Fixes applied (new commit `fix: sort imports, use static TestResults type, remove unused analytics import`)

packages/insomnia/src/main/ipc/main.ts

getSendRequestCallback import was placed in the wrong group (relative ../ group instead of ~/ group). Moved to the correct ~/network/unit-test-feature position.
import('insomnia-testing').TestResults inline dynamic type was flagged by @typescript-eslint/consistent-type-imports. Replaced with a static import type { TestResults } from 'insomnia-testing' at the top of the file.

packages/insomnia-testing/src/generate/generate-to-file.ts

simple-import-sort required import type { TestSuite } before the value import from the same module. Swapped.

Copilot

Pull request overview

This PR completes the renderer Node-integration removal by flipping mainWindow security flags (nodeIntegration off + contextIsolation on), routing unit-test execution through a main-process IPC boundary, and deleting the Vite/node-import migration scaffolding that was previously used to support renderer Node imports.

Changes:

Disable nodeIntegration and enable contextIsolation for the renderer main window.
Move unit-test execution to main via a new run-tests IPC handler and expose it in preload.
Remove renderer Node-import tooling (Vite plugin + reporting scripts/baseline) and replace mime-types usage with local MIME helpers in a few call sites.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
packages/insomnia/vite.config.ts	Removes renderer Node-require tooling and Node import detection from the Vite build.
packages/insomnia/vite-plugin-electron-node-require.ts	Removes the custom Vite plugin that enabled runtime `require()` in the renderer.
packages/insomnia/src/ui/components/panes/response-pane-utils.ts	Switches response download extension detection to local MIME helpers.
packages/insomnia/src/ui/components/editors/body/body-editor.tsx	Switches file-body MIME lookup to local MIME helpers.
packages/insomnia/src/routes/organization.$organizationId.project.$projectId.workspace.$workspaceId.test.test-suite.$testSuiteId.test.$testId.run.tsx	Replaces direct `runTests` usage with `window.main.runTests`.
packages/insomnia/src/routes/organization.$organizationId.project.$projectId.workspace.$workspaceId.test.test-suite.$testSuiteId.run-all-tests.tsx	Replaces direct `runTests` usage with `window.main.runTests`.
packages/insomnia/src/routes/organization.$organizationId.project.$projectId.workspace.$workspaceId.debug.request.$requestId.send.tsx	Switches `mime-types` extension helper to local MIME helper.
packages/insomnia/src/main/window-utils.ts	Flips `webPreferences` security flags for the main window.
packages/insomnia/src/main/ipc/main.ts	Adds `run-tests` IPC handler and types it on the renderer bridge API.
packages/insomnia/src/main/ipc/electron.ts	Adds `run-tests` to the typed IPC channel union.
packages/insomnia/src/entry.preload.ts	Exposes `runTests` via `window.main` using `invokeWithNormalizedError`.
packages/insomnia/src/common/mime.ts	Adds a Node-free MIME mapping helper module for the renderer.
packages/insomnia/scripts/check-renderer-node-imports.ts	Removes the node-import baseline check script.
packages/insomnia/package.json	Removes renderer node-import analysis scripts (but currently introduces indentation drift).
packages/insomnia/config/renderer-node-import-baseline.json	Removes the node-import baseline file.
packages/insomnia-testing/src/index.ts	Adjusts exports so `generateToFile` is split into its own module.
packages/insomnia-testing/src/generate/index.ts	Adjusts exports so `generateToFile` is split into its own module.
packages/insomnia-testing/src/generate/generate.ts	Removes Node `fs` usage from `generate()` implementation.
packages/insomnia-testing/src/generate/generate-to-file.ts	Introduces Node-only `generateToFile()` implementation.
package.json	Removes the top-level renderer node-import script (but currently introduces indentation drift).

Comments suppressed due to low confidence (1)

packages/insomnia/vite.config.ts:55

resolve.alias no longer shims the Node path module, but there is still renderer code importing mime-types (e.g. src/ui/components/viewers/response-multipart-viewer.tsx). mime-types depends on path.extname, so removing this alias will break the Vite dev server / renderer build with an unresolved path builtin unless all renderer mime-types usage is removed in the same PR.

        '~': path.resolve(__dirname, './src'),

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+  ipcMainHandle('run-tests', async (_, src: string) => {
+    const { runTests } = await import('insomnia-testing');
+    const sendRequest = getSendRequestCallback();
+    return runTests(src, { sendRequest });
+  });


  try {
-    window.localStorage.setItem('insomnia.secretKey', getInsomniaSecretKey() || res);
+    const sec = await encodeBase64(kp.secretKey);
+    window.localStorage.setItem('insomnia.secretKey', getInsomniaSecretKey() || sec);


                                } catch (err) {
-                                  console.warn(`Failed to parse cookie string "${event.target.value}"`, err);
-                                  return;
+                                  console.warn(`Failed to parse cookie string "${str}"`, err);


ZxBing0066 · 2026-06-03T05:26:02Z

 const isDebug = Boolean(process.env.DEBUG);
 const version = process.env.VERSION || 'dev';
+// Redirects *.renderer imports to their *.node equivalents for node/CLI builds.
+const rendererToNodePlugin: Plugin = {


This is a bit hacky. Should this be handled by the bundler by process.type in the adapter? Why do we need this plugin?

because that approach is equally hacky, and doesn't help vite determine what not to bundle, because vite only sets type to renderer in prod not dev, theres an explanation in the comment. a better approach might be window !== undefined, you are welcome to experiment with this branch to your satisfaction.

I have no preference for the solution. But it should be consistent and won't introduce misunderstandings.

I'll look into it

Looked into it, inso is hacky, hacks on hacks isn't new.

…ports - Add AES-GCM vault-crypto utility with tests (replaces node-forge usage) - Add common/mime.ts to replace mime-types package dependency - Replace tough-cookie import in response-cookies-viewer with inline parser - Replace @grpc/grpc-js status import in grpc-status-tag with inline constant - Replace electron.ipcRenderer in auth.clear-vault-key with showToast() - Remove unused analytics call from window-utils

Replace key={Date.now()} with a useEffect that calls editorRef.current.setValue(snippet) whenever snippet changes, keeping the editor mounted. Also apply prettier fixes from quick-check.

- vault-crypto: replace forge-in-renderer with IPC bridge (main process retains forge; renderer calls window.main.vault.{en,de}cryptSecretValue) - mime.ts: expand lookup table to 48 entries (webp, wasm, mp4, docx, xlsx, fonts, audio/video, etc.) and fix remaining mime-types import in send route - response-viewer: move charset alias map to module level; normalise iconv-lite alias names (utf8, latin1, win1252, …) to WHATWG labels for TextDecoder - auth.clear-vault-key: fix typo "all you local" → "all your local"

…heck tooling - Set nodeIntegration:false and contextIsolation:true on mainWindow webPreferences (hidden window keeps nodeIntegration:true for user script execution) - Split script-security-rules.ts out of script-security-policy.ts so the renderer can import display-only constants without pulling in require-interceptor - Add templating/renderer-safe.ts with Node-free render/reload/getTagDefinitions; update all renderer callers to import from it instead of templating/index - Split insomnia-testing generate.ts: move generateToFile to generate-to-file.ts so generate() has no Node imports; expose generateToFile from new entry point - Move runTests execution to main process via IPC (run-tests channel) so the renderer routes no longer import the Mocha-backed test runner directly - Delete vite-plugin-electron-node-require.ts, check-renderer-node-imports.ts, renderer-node-import-baseline.json and all related scripts/plugins now that the renderer bundle is free of Node built-in imports

…cs import Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Fix incorrect ~/insomnia-data imports (should be insomnia-data package) - Remove non-existent mime utility imports and provide simple fallback - Remove incorrect analytics call from main process - Remove unused imports (Settings, Cookie) - Fix Response type annotation for getResponseBodyBuffer

…atibility The session.ts module is used in both renderer and main process contexts (via sync.invoke IPC handlers). When running in the main process, window.main is undefined, causing TypeError when trying to access window.main.crypt.decryptAES(). Changes: - Use dynamic import of crypt module (only loaded in main process context) - In renderer: window.main.crypt is always available so dynamic import never executes - In main process: dynamic import loads crypt with node:crypto support - Protect loginStateChange() calls with window existence checks This avoids bundling node:crypto in the Vite renderer build while still supporting both execution contexts. Fixes E2E test failures in sync operations (remoteBackendProjects, _assertSession, etc.) caused by disabled nodeIntegration.

… fallback - Add aria-label="Live Preview" to textarea in TagEditor for better Playwright accessibility - Add atob() fallback for decodeEncoding in browser contexts where Buffer isn't available - Fixes smoke test element discovery for template tag preview modal

Add toBeEnabled() and toBeVisible() waits before clicking elements in the 'kv pair environment can be updated' test. This prevents timeout errors from unstable/flickering elements during modal interactions, especially in high-concurrency shard execution.

….ts removal

Move the electron-dependent createElectronNotifier function from repo-file-watcher.ts to git-service.ts to prevent electron imports from being evaluated in the renderer/SSR context.

jackkav force-pushed the pr/templating-adapter branch 2 times, most recently from 299c1f5 to 1d8de98 Compare June 1, 2026 07:24

jackkav force-pushed the pr/disable-node-integration branch from 64cc384 to 9394680 Compare June 1, 2026 07:26

jackkav force-pushed the pr/templating-adapter branch from 1d8de98 to 418da0f Compare June 1, 2026 08:23

Base automatically changed from pr/templating-adapter to pr/safe-utilities-cleanup June 1, 2026 08:27

jackkav force-pushed the pr/safe-utilities-cleanup branch 2 times, most recently from 88fc536 to 805fcc4 Compare June 1, 2026 08:30

Base automatically changed from pr/safe-utilities-cleanup to develop June 1, 2026 08:44

jackkav force-pushed the pr/disable-node-integration branch from 9394680 to 94098a5 Compare June 1, 2026 09:34

Copilot AI review requested due to automatic review settings June 1, 2026 09:34

Copilot started reviewing on behalf of jackkav June 1, 2026 09:34 View session

Copilot AI reviewed Jun 1, 2026

View reviewed changes

github-advanced-security AI found potential problems Jun 2, 2026

View reviewed changes

Comment thread packages/insomnia/src/ui/auth-session-provider.client.ts

try {

window.localStorage.setItem('insomnia.secretKey', getInsomniaSecretKey() || res);

const sec = await encodeBase64(kp.secretKey);

window.localStorage.setItem('insomnia.secretKey', getInsomniaSecretKey() || sec);

jackkav mentioned this pull request Jun 2, 2026

feat: renderer IPC bridges + script security split + decouple scripting #10011

Closed

8 tasks

jackkav force-pushed the pr/disable-node-integration branch from 67c8c01 to d047842 Compare June 2, 2026 19:27

github-advanced-security AI found potential problems Jun 2, 2026

View reviewed changes

Comment thread packages/insomnia/src/ui/components/modals/cookies-modal.tsx

} catch (err) {

console.warn(`Failed to parse cookie string "${event.target.value}"`, err);

return;

console.warn(`Failed to parse cookie string "${str}"`, err);

jackkav force-pushed the pr/disable-node-integration branch from 990c167 to 2ab0baa Compare June 3, 2026 04:26

ZxBing0066 reviewed Jun 3, 2026

View reviewed changes

Comment thread packages/insomnia/src/main/window-utils.ts

Comment thread packages/insomnia/src/main/window-utils.ts

jackkav force-pushed the pr/disable-node-integration branch from feb0efb to c9cc29c Compare June 3, 2026 10:39

jackkav and others added 8 commits June 3, 2026 19:52

Fix impure Date.now() key on CodeEditor; use setValue via ref instead

1f2904c

Replace key={Date.now()} with a useEffect that calls editorRef.current.setValue(snippet) whenever snippet changes, keeping the editor mounted. Also apply prettier fixes from quick-check.

fix: sort imports in send route

6201e4c

fix: sort imports, use static TestResults type, remove unused analyti…

39eb7f1

…cs import Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

remove mime stuff

66f344a

remove ci step

ae29c90

jackkav added 25 commits June 3, 2026 19:52

polyfill events for jshint

a45f2d8

restore node require plugin

452c997

vault adapter

ff68717

add crypto bridges

29eb511

tough-cookie ipc

a5102d0

util stub

f12a358

split cookie into network adapter

78edbae

assert

426efa1

fix plugin index import

dc866d8

serialise cookie

da7a9ac

decouple renderer from scripting

08579b2

lint

51f9588

fix tests

7fbe5fd

remove unused

1324ba4

add autocomplete generate test step

653e43f

fix lint

42870b2

put analytics back in

69aba65

combine vault and crypto adapter

7c2af23

remove unused export split

47500bf

remove insomnia-testing cruft, addressing feedback

f1bf059

fix: use direct imports in insomnia-inso after insomnia-testing index…

787cee8

….ts removal

jackkav force-pushed the pr/disable-node-integration branch from 8bb40e8 to 787cee8 Compare June 3, 2026 17:56

jackkav added 3 commits June 3, 2026 20:02

fix circular reference

1255fae

fix: move createElectronNotifier to main process to fix SSR error

d38edcc

Move the electron-dependent createElectronNotifier function from repo-file-watcher.ts to git-service.ts to prevent electron imports from being evaluated in the renderer/SSR context.

export har ipc bridge

8c06c36

jackkav enabled auto-merge (squash) June 3, 2026 19:49

Conversation

jackkav commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

How

Security flag (window-utils.ts)

Cookie IPC bridge (main/ipc/cookies.ts)

HAR export IPC bridge (main/har.ts)

Vault adapter split (vault-adapter.node.ts / vault-adapter.renderer.ts)

Script security split (script-security-rules.ts)

Templating renderer-safe surface (render-adapter.ts)

Testing IPC bridge (main/ipc/main.ts)

Plugin types extracted (plugins/types.ts)

Proto validation IPC (main/ipc/grpc.ts)

File watcher notifier split (git-service.ts)

Code snippet types (types/code-snippet.ts)

Remove migration tooling (now redundant)

Test plan

Uh oh!

github-actions Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✨ Circular References Report

Summary

✨ Circular References Removed (2)

Analysis

Uh oh!

jackkav commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rebase + review notes

Fixes applied (new commit fix: sort imports, use static TestResults type, remove unused analytics import)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ZxBing0066 Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

jackkav Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ZxBing0066 Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

jackkav Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

jackkav Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jackkav commented Jun 1, 2026 •

edited

Loading

Security flag (`window-utils.ts`)

Cookie IPC bridge (`main/ipc/cookies.ts`)

HAR export IPC bridge (`main/har.ts`)

Vault adapter split (`vault-adapter.node.ts` / `vault-adapter.renderer.ts`)

Script security split (`script-security-rules.ts`)

Templating renderer-safe surface (`render-adapter.ts`)

Testing IPC bridge (`main/ipc/main.ts`)

Plugin types extracted (`plugins/types.ts`)

Proto validation IPC (`main/ipc/grpc.ts`)

File watcher notifier split (`git-service.ts`)

Code snippet types (`types/code-snippet.ts`)

github-actions Bot commented Jun 1, 2026 •

edited

Loading

jackkav commented Jun 1, 2026 •

edited

Loading

Fixes applied (new commit `fix: sort imports, use static TestResults type, remove unused analytics import`)

jackkav Jun 3, 2026 •

edited

Loading