fix(apps): keep backend runtime context private

Author: Scott-Meyer

packages/plugins/apps/src/backend/virtual-entry.test.ts

@@ -38,15 +38,6 @@ describe('Backend Functions - generateVirtualEntryContent', () => {
             expect(result).toContain('export async function main($)');
         });
 
-        test('Should set globalThis.$ = $', () => {
-            const result = generateVirtualEntryContent(
-                'myHandler',
-                '/src/handler.ts',
-                PROJECT_ROOT,
-            );
-            expect(result).toContain('globalThis.$ = $');
-        });
-
         test('Should read args from $.backendFunctionArgs (no source-text substitution)', () => {
             const result = generateVirtualEntryContent(
                 'myHandler',
@@ -69,7 +60,7 @@ describe('Backend Functions - generateVirtualEntryContent', () => {
                 '/src/handler.ts',
                 PROJECT_ROOT,
             );
-            expect(result).toContain('await myHandler(...args)');
+            expect(result).toContain('await myHandler(...args, $)');
         });
 
         test('Should include the setExecuteActionImplementation bridge snippet', () => {
@@ -175,9 +166,8 @@ describe('Backend Functions - args round-trip via $.backendFunctionArgs', () =>
             .filter((line) => !line.trimStart().startsWith('import '))
             .join('\n')
             // Replace the call site with a $-bound handler we control.
-            .replace(/await myHandler\(\.\.\.args\)/, 'await $.__handler(...args)');
-        // The generated code declares globalThis.$, which has no effect in this
-        // sandbox but is harmless. Wrap the body so we can return main().
+            .replace(/await myHandler\(\.\.\.args, \$\)/, 'await $.__handler(...args, $)');
+        // Wrap the executable body so we can return main().
         const wrapper = `${body}\nreturn main($);`;
         // eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func
         const fn = new Function(
@@ -222,11 +212,26 @@ describe('Backend Functions - args round-trip via $.backendFunctionArgs', () =>
         const source = generateVirtualEntryContent('myHandler', '/src/handler.ts', PROJECT_ROOT);
         let received: unknown[] | undefined;
         const handler = (...args: unknown[]) => {
-            received = args;
+            // Slice off the final implicitly passed $ context argument to check user-supplied args
+            received = args.slice(0, -1);
             return 'ok';
         };
         const main = buildMainFromSource(source, handler);
         await main({});
         expect(received).toEqual([]);
     });
+
+    test('Should keep the runtime context out of customer global scope', async () => {
+        const source = generateVirtualEntryContent('myHandler', '/src/handler.ts', PROJECT_ROOT);
+        let exposedContext: unknown;
+        const handler = () => {
+            exposedContext = Reflect.get(global, '$');
+            return 'ok';
+        };
+        const main = buildMainFromSource(source, handler);
+
+        await main({ backendFunctionArgs: [], privateRuntimeValue: 'secret' });
+
+        expect(exposedContext).toBeUndefined();
+    });
 });

packages/plugins/apps/src/backend/virtual-entry.ts

@@ -28,13 +28,13 @@ export function generateVirtualEntryContent(
     lines.push('');
     lines.push('/** @param {import("./context.types").Context} $ */');
     lines.push('export async function main($) {');
-    lines.push('    globalThis.$ = $;');
-    lines.push('');
     lines.push(`    // Register the $.Actions-based implementation for executeAction`);
     lines.push(SET_EXECUTE_ACTION_SNIPPET);
     lines.push('');
     lines.push('    const args = $.backendFunctionArgs ?? [];');
-    lines.push(`    const result = await ${functionName}(...args);`);
+    lines.push(`    // To maintain backward compatibility with legacy handlers, keep passing $ as
+    // the final argument. This will be removed in a future major release.
+    const result = await ${functionName}(...args, $);`);
     lines.push('    return result;');
     lines.push('}');