fix(apps): keep backend runtime context private

Author: Scott-Meyer

packages/plugins/apps/src/backend/virtual-entry.test.ts

@@ -38,15 +38,6 @@ describe('Backend Functions - generateVirtualEntryContent', () => {
             expect(result).toContain('export async function main($)');
         });
 
-        test('Should set globalThis.$ = $', () => {
-            const result = generateVirtualEntryContent(
-                'myHandler',
-                '/src/handler.ts',
-                PROJECT_ROOT,
-            );
-            expect(result).toContain('globalThis.$ = $');
-        });
-
         test('Should read args from $.backendFunctionArgs (no source-text substitution)', () => {
             const result = generateVirtualEntryContent(
                 'myHandler',
@@ -176,8 +167,7 @@ describe('Backend Functions - args round-trip via $.backendFunctionArgs', () =>
             .join('\n')
             // Replace the call site with a $-bound handler we control.
             .replace(/await myHandler\(\.\.\.args\)/, 'await $.__handler(...args)');
-        // The generated code declares globalThis.$, which has no effect in this
-        // sandbox but is harmless. Wrap the body so we can return main().
+        // Wrap the executable body so we can return main().
         const wrapper = `${body}\nreturn main($);`;
         // eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func
         const fn = new Function(
@@ -229,4 +219,18 @@ describe('Backend Functions - args round-trip via $.backendFunctionArgs', () =>
         await main({});
         expect(received).toEqual([]);
     });
+
+    test('Should keep the runtime context out of customer global scope', async () => {
+        const source = generateVirtualEntryContent('myHandler', '/src/handler.ts', PROJECT_ROOT);
+        let exposedContext: unknown;
+        const handler = () => {
+            exposedContext = Reflect.get(global, '$');
+            return 'ok';
+        };
+        const main = buildMainFromSource(source, handler);
+
+        await main({ backendFunctionArgs: [], privateRuntimeValue: 'secret' });
+
+        expect(exposedContext).toBeUndefined();
+    });
 });

packages/plugins/apps/src/backend/virtual-entry.ts

@@ -28,8 +28,6 @@ export function generateVirtualEntryContent(
     lines.push('');
     lines.push('/** @param {import("./context.types").Context} $ */');
     lines.push('export async function main($) {');
-    lines.push('    globalThis.$ = $;');
-    lines.push('');
     lines.push(`    // Register the $.Actions-based implementation for executeAction`);
     lines.push(SET_EXECUTE_ACTION_SNIPPET);
     lines.push('');