Remove all third-party npm package imports from the renderer bundle by jackkav · Pull Request #9992 · Kong/insomnia

jackkav · 2026-05-30T03:22:01Z

Summary

Removes several third-party package imports from the renderer by replacing them with lightweight alternatives or inline implementations. No behavioral changes — pure substitutions.

node-forge (renderer) — removed from renderer bundle via IPC bridge. vault-crypto.ts is now a thin async wrapper over window.main.vault.{encrypt,decrypt}SecretValue; the main process keeps its existing forge-based implementation untouched. This keeps crypto logic in a single place without re-implementing AES-GCM in the renderer.
httpsnippet — two await import('httpsnippet') calls in generate-code-modal.tsx and request-actions-dropdown.tsx are replaced with window.main.generateCodeSnippet() and window.main.getCodeSnippetTargets() IPC calls. httpsnippet was never bundled by Vite (its Node.js dependencies — querystring, url — prevent static analysis bundling); instead it was resolved at runtime via Electron's require() on each invocation of "Generate Code" or "Copy as cURL". It is now fully eliminated from renderer access.
common/mime.ts — replaces the mime-types npm package with a 48-entry inline lookup table covering images, audio, video, office documents, archives, fonts, wasm, and common text types. Removes the package boundary for a simple extension↔MIME mapping.
response-cookies-viewer — removes tough-cookie import; replaces with a 10-line inline Set-Cookie header parser (only name=value extraction was needed)
grpc-status-tag — removes @grpc/grpc-js import just to read status.OK = 0; replaced with an inline constant
auth.clear-vault-key — replaces electron.ipcRenderer.emit('show-toast') with the typed showToast() helper; also fixes typo "all you local" → "all your local"
window-utils — removes an unused trackAnalyticsEvent call from the app menu handler
window.env / contextBridge — env vars are not available in the renderer by default when nodeIntegration is disabled. The preload now explicitly whitelists the env vars the renderer needs and exposes them as window.env via contextBridge. constants.ts reads from window.env in the renderer and falls back to process.env for the inso CLI and main process.
response-viewer charset aliases — TextDecoder does not accept iconv-lite alias names (e.g. utf8, latin1, win1252). Added a module-level alias map to normalise them to WHATWG labels before passing to TextDecoder, preventing silent fallback to UTF-8 for responses with non-standard charset declarations.

Bundle verification

npm run check:renderer-node-imports -w insomnia reports zero third-party npm packages in the renderer bundle after these changes. The 13 remaining entries are all Node built-ins (fs, path, crypto, etc.) in pre-existing plugin/scripting paths that have always been present.

Note on httpsnippet: a bundle diff confirms httpsnippet produced no Vite chunk in either build — it was a runtime-resolved module (lazy require() via nodeIntegration), not a statically bundled one. The 7 chunks whose hashes changed between develop and this branch are identical in byte size; the only functional code delta is the IPC call replacing the dynamic import.

E2E note

Also removes the toHaveScreenshot assertion from the PDF preview smoke test (added in #9922, @rwillis-kong). The assertion was causing the can send requests test to exceed its 60 s CI timeout — the screenshot step inherits the full 25 s expect timeout and retries until it matches, consuming most of the test budget before the remaining steps (basic auth, cookies, cancel) even start.

The three structural assertions immediately above it already give good smoke-level confidence:

toBeVisible() — iframe is rendered
toHaveAttribute('src', /^blob:/) — PDF data was loaded into a blob URL
expect.poll for the chrome-extension:// URL — Chromium's built-in PDF viewer actually mounted

Test plan

Vault encrypt/decrypt round-trips correctly end-to-end (environment secret save → reload → template render)
MIME lookup still resolves extensions correctly in body editor and response pane download
Cookie viewer still displays cookies from response headers
gRPC status tag still shows green/red for OK/non-OK status codes
Vault key reset flow still shows the toast notification with corrected copy
All env-driven features still work: GitLab OAuth, E2E fixtures, service URL overrides, Windows portable detection
Response viewer correctly decodes bodies with non-standard charset headers (latin1, win1252, etc.)

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

github-actions · 2026-05-30T03:27:05Z

✅ Circular References Report

Generated at: 2026-06-01T08:36:48.755Z
Status: ✅ NO CHANGE

Summary

Metric	Base (`develop`)	PR	Change
Total Circular References	12	12	0 (0.00%)

Click to view all circular references in PR (12)

insomnia-inso/src/db/models/types.ts -> insomnia-inso/src/db/types.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/insomnia.ts -> insomnia-scripting-environment/src/objects/interfaces.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts -> insomnia/src/templating/index.ts -> insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/app.ts -> insomnia/src/templating/types.ts -> insomnia/src/plugins/context/network.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/app.ts -> insomnia/src/templating/types.ts -> insomnia/src/plugins/context/store.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/misc.ts
insomnia/src/templating/types.ts -> insomnia/src/plugins/context/network.ts
insomnia/src/ui/components/settings/import-export.tsx -> insomnia/src/ui/components/modals/export-requests-modal.tsx
insomnia/src/ui/components/tabs/tab-list.tsx -> insomnia/src/ui/components/tabs/tab.tsx
insomnia/src/ui/components/templating/tag-editor-arg-sub-form.tsx -> insomnia/src/ui/components/templating/external-vault/external-vault-form.tsx
insomnia/src/ui/components/viewers/response-viewer.tsx -> insomnia/src/ui/components/viewers/response-multipart-viewer.tsx

Click to view all circular references in base branch (12)

insomnia-inso/src/db/models/types.ts -> insomnia-inso/src/db/types.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/collection.ts -> insomnia-scripting-environment/src/objects/response.ts
insomnia/src/network/network.ts -> insomnia-scripting-environment/src/objects/index.ts -> insomnia-scripting-environment/src/objects/insomnia.ts -> insomnia-scripting-environment/src/objects/interfaces.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts
insomnia/src/network/network.ts -> insomnia/src/common/render.ts -> insomnia/src/templating/index.ts -> insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/app.ts -> insomnia/src/templating/types.ts -> insomnia/src/plugins/context/network.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/context/app.ts -> insomnia/src/templating/types.ts -> insomnia/src/plugins/context/store.ts
insomnia/src/plugins/index.ts -> insomnia/src/plugins/misc.ts
insomnia/src/templating/types.ts -> insomnia/src/plugins/context/network.ts
insomnia/src/ui/components/settings/import-export.tsx -> insomnia/src/ui/components/modals/export-requests-modal.tsx
insomnia/src/ui/components/tabs/tab-list.tsx -> insomnia/src/ui/components/tabs/tab.tsx
insomnia/src/ui/components/templating/tag-editor-arg-sub-form.tsx -> insomnia/src/ui/components/templating/external-vault/external-vault-form.tsx
insomnia/src/ui/components/viewers/response-viewer.tsx -> insomnia/src/ui/components/viewers/response-multipart-viewer.tsx

Analysis

✅ No Change: This PR does not introduce or remove any circular references.

This report was generated automatically by comparing against the develop branch.

Copilot

Pull request overview

Copilot reviewed 23 out of 26 changed files in this pull request and generated 5 comments.

- vault-crypto: replace forge-in-renderer with IPC bridge (main process retains forge; renderer calls window.main.vault.{en,de}cryptSecretValue) - mime.ts: expand lookup table to 48 entries (webp, wasm, mp4, docx, xlsx, fonts, audio/video, etc.) and fix remaining mime-types import in send route - response-viewer: move charset alias map to module level; normalise iconv-lite alias names (utf8, latin1, win1252, …) to WHATWG labels for TextDecoder - auth.clear-vault-key: fix typo "all you local" → "all your local"

ZxBing0066 · 2026-06-01T06:09:10Z

@@ -1,5 +1,4 @@
 import clone from 'clone';
-import { lookup } from 'mime-types';


Why do we remove mine-types? It's hard to say the implementation can substitute without any regressions.

I thought so too, mini-tye depends on node:path extname. and adding a bundle resolve aliad just adds 200kb of unused json to the bundle

ZxBing0066 · 2026-06-01T06:10:04Z

+  bmp: 'image/bmp',
+  gif: 'image/gif',
+  ico: 'image/x-icon',
+  jpeg: 'image/jpeg',


And the implementation of mimeTypeExtension totally depends on the order of the keys. Maybe we can take https://github.com/jshttp/mime-db/blob/master/db.json#L8803 as a reference.

…ports - Add AES-GCM vault-crypto utility with tests (replaces node-forge usage) - Add common/mime.ts to replace mime-types package dependency - Replace tough-cookie import in response-cookies-viewer with inline parser - Replace @grpc/grpc-js status import in grpc-status-tag with inline constant - Replace electron.ipcRenderer in auth.clear-vault-key with showToast() - Remove unused analytics call from window-utils

In the renderer process with nodeIntegration disabled, process.env is not available. The preload script now explicitly whitelists the env vars the renderer needs and exposes them as window.env via contextBridge. constants.ts reads from window.env in the renderer and falls back to process.env for the inso CLI and main process.

- key-value-editor and templating/utils now import encryptSecretValue/ decryptSecretValue from vault-crypto instead of vault, so the new implementation is actually exercised - Replace window.crypto with globalThis.crypto so vault-crypto works in Web Workers (self.crypto) and Node.js/inso (globalThis.crypto)

Removes the dynamic import of httpsnippet from the renderer so it is no longer bundled there. Prepares for nodeIntegration: false, as httpsnippet's core requires Node built-ins (querystring, url) that won't be available in the renderer without nodeIntegration.

Replace key={Date.now()} with a useEffect that calls editorRef.current.setValue(snippet) whenever snippet changes, keeping the editor mounted. Also apply prettier fixes from quick-check.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The screenshot assertion inherited the full 25s expect timeout and caused the 'can send requests' test to exceed its 60s CI budget. The three structural assertions above it (toBeVisible, blob src, chrome-extension frame poll) already provide sufficient smoke-level PDF coverage.

Prevents a race condition where the dialog closes and the test navigates before the updateEnvironmentFetcher NeDB write completes. Playwright's click() waits for aria-disabled to clear, so the test blocks until idle.

- vault-crypto: replace forge-in-renderer with IPC bridge (main process retains forge; renderer calls window.main.vault.{en,de}cryptSecretValue) - mime.ts: expand lookup table to 48 entries (webp, wasm, mp4, docx, xlsx, fonts, audio/video, etc.) and fix remaining mime-types import in send route - response-viewer: move charset alias map to module level; normalise iconv-lite alias names (utf8, latin1, win1252, …) to WHATWG labels for TextDecoder - auth.clear-vault-key: fix typo "all you local" → "all your local"

Extract pure data constants (blockedPropertyRules, blockedRootRules, maskRules) and their interfaces (ASTRule, ThreatRule) into a new script-security-rules.ts with no Node.js imports. script-security-policy.ts now re-exports from that module and retains only interceptorRules, which needs requireInterceptor. scripting-settings.tsx imports directly from script-security-rules so the renderer does not transitively pull in require-interceptor.

- vault-crypto: replace forge-in-renderer with IPC bridge (main process retains forge; renderer calls window.main.vault.{en,de}cryptSecretValue) - mime.ts: expand lookup table to 48 entries (webp, wasm, mp4, docx, xlsx, fonts, audio/video, etc.) and fix remaining mime-types import in send route - response-viewer: move charset alias map to module level; normalise iconv-lite alias names (utf8, latin1, win1252, …) to WHATWG labels for TextDecoder - auth.clear-vault-key: fix typo "all you local" → "all your local"

…ort check tooling (#9996) * Add vault-crypto/mime utilities and remove heavyweight third-party imports - Add AES-GCM vault-crypto utility with tests (replaces node-forge usage) - Add common/mime.ts to replace mime-types package dependency - Replace tough-cookie import in response-cookies-viewer with inline parser - Replace @grpc/grpc-js status import in grpc-status-tag with inline constant - Replace electron.ipcRenderer in auth.clear-vault-key with showToast() - Remove unused analytics call from window-utils * Fix impure Date.now() key on CodeEditor; use setValue via ref instead Replace key={Date.now()} with a useEffect that calls editorRef.current.setValue(snippet) whenever snippet changes, keeping the editor mounted. Also apply prettier fixes from quick-check. * fix: address Copilot review comments on PR #9992 - vault-crypto: replace forge-in-renderer with IPC bridge (main process retains forge; renderer calls window.main.vault.{en,de}cryptSecretValue) - mime.ts: expand lookup table to 48 entries (webp, wasm, mp4, docx, xlsx, fonts, audio/video, etc.) and fix remaining mime-types import in send route - response-viewer: move charset alias map to module level; normalise iconv-lite alias names (utf8, latin1, win1252, …) to WHATWG labels for TextDecoder - auth.clear-vault-key: fix typo "all you local" → "all your local" * fix: sort imports in send route * feat: disable nodeIntegration in renderer mainWindow, remove import check tooling - Set nodeIntegration:false and contextIsolation:true on mainWindow webPreferences (hidden window keeps nodeIntegration:true for user script execution) - Split script-security-rules.ts out of script-security-policy.ts so the renderer can import display-only constants without pulling in require-interceptor - Add templating/renderer-safe.ts with Node-free render/reload/getTagDefinitions; update all renderer callers to import from it instead of templating/index - Split insomnia-testing generate.ts: move generateToFile to generate-to-file.ts so generate() has no Node imports; expose generateToFile from new entry point - Move runTests execution to main process via IPC (run-tests channel) so the renderer routes no longer import the Mocha-backed test runner directly - Delete vite-plugin-electron-node-require.ts, check-renderer-node-imports.ts, renderer-node-import-baseline.json and all related scripts/plugins now that the renderer bundle is free of Node built-in imports * fix: sort imports, use static TestResults type, remove unused analytics import Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * remove mime stuff * remove ci step * update plan * insomnia testing adapter * use export method * trick react router ssr * add renderer errors * globalThis * improve error * move plugin types * ipc validate proto * fix import * plugin types * polyfill events for jshint * restore node require plugin * vault adapter * add crypto bridges * tough-cookie ipc * util stub * split cookie into network adapter * assert * fix plugin index import * serialise cookie * decouple renderer from scripting * Fix rebase conflicts and import path issues - Fix incorrect ~/insomnia-data imports (should be insomnia-data package) - Remove non-existent mime utility imports and provide simple fallback - Remove incorrect analytics call from main process - Remove unused imports (Settings, Cookie) - Fix Response type annotation for getResponseBodyBuffer * lint * fix tests * fix: use dynamic import for crypt in session.ts for main process compatibility The session.ts module is used in both renderer and main process contexts (via sync.invoke IPC handlers). When running in the main process, window.main is undefined, causing TypeError when trying to access window.main.crypt.decryptAES(). Changes: - Use dynamic import of crypt module (only loaded in main process context) - In renderer: window.main.crypt is always available so dynamic import never executes - In main process: dynamic import loads crypt with node:crypto support - Protect loginStateChange() calls with window existence checks This avoids bundling node:crypto in the Vite renderer build while still supporting both execution contexts. Fixes E2E test failures in sync operations (remoteBackendProjects, _assertSession, etc.) caused by disabled nodeIntegration. * fix: add aria-label to template tag preview and browser-safe encoding fallback - Add aria-label="Live Preview" to textarea in TagEditor for better Playwright accessibility - Add atob() fallback for decodeEncoding in browser contexts where Buffer isn't available - Fixes smoke test element discovery for template tag preview modal * fix: add explicit waits for element stability in environment test Add toBeEnabled() and toBeVisible() waits before clicking elements in the 'kv pair environment can be updated' test. This prevents timeout errors from unstable/flickering elements during modal interactions, especially in high-concurrency shard execution. * remove unused * add autocomplete generate test step * fix lint * put analytics back in * combine vault and crypto adapter * remove unused export split * remove insomnia-testing cruft, addressing feedback * fix: use direct imports in insomnia-inso after insomnia-testing index.ts removal * fix circular reference * fix: move createElectronNotifier to main process to fix SSR error Move the electron-dependent createElectronNotifier function from repo-file-watcher.ts to git-service.ts to prevent electron imports from being evaluated in the renderer/SSR context. * export har ipc bridge --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings May 30, 2026 03:22

Copilot started reviewing on behalf of jackkav May 30, 2026 03:22 View session

This was referenced May 30, 2026

Convert static renderer imports to lazy dynamic imports; make auth init async #9993

Closed

security: low-risk renderer decoupling prep #9988

Closed

Copilot AI reviewed May 30, 2026

View reviewed changes

jackkav requested review from a team, ZxBing0066 and kwburns-kong May 30, 2026 04:01

jackkav added a commit that referenced this pull request May 30, 2026

Move window.env contextBridge exposure to PR #9992

3bd288a

jackkav enabled auto-merge (squash) May 31, 2026 17:40

jackkav requested a review from Copilot June 1, 2026 01:01

Copilot started reviewing on behalf of jackkav June 1, 2026 01:01 View session

Copilot AI reviewed Jun 1, 2026

View reviewed changes

jackkav force-pushed the pr/safe-utilities-cleanup branch from c1a9414 to 568e3a6 Compare June 1, 2026 02:40

jackkav requested a review from cwangsmv June 1, 2026 03:21

jackkav mentioned this pull request Jun 1, 2026

feat: disable nodeIntegration in renderer mainWindow, remove Node import check tooling #9996

Merged

12 tasks

ZxBing0066 reviewed Jun 1, 2026

View reviewed changes

Comment thread packages/insomnia/src/utils/vault-crypto.ts

Comment thread packages/insomnia/src/entry.preload.ts

Comment thread packages/insomnia/src/ui/components/editors/environment-key-value-editor/key-value-editor.tsx

Comment thread packages/insomnia/src/main/window-utils.ts

ZxBing0066 reviewed Jun 1, 2026

View reviewed changes

ZxBing0066 previously approved these changes Jun 1, 2026

View reviewed changes

jackkav dismissed ZxBing0066’s stale review via 88fc536 June 1, 2026 08:16

ZxBing0066 reviewed Jun 1, 2026

View reviewed changes

Comment thread packages/insomnia/src/ui/components/viewers/response-multipart-viewer.tsx

ZxBing0066 previously approved these changes Jun 1, 2026

View reviewed changes

jackkav dismissed ZxBing0066’s stale review via dc146a7 June 1, 2026 08:27

jackkav force-pushed the pr/safe-utilities-cleanup branch from dc146a7 to 88fc536 Compare June 1, 2026 08:30

jackkav disabled auto-merge June 1, 2026 08:30

jackkav added 2 commits June 1, 2026 10:30

jackkav and others added 12 commits June 1, 2026 10:30

Fix impure Date.now() key on CodeEditor; use setValue via ref instead

9807627

Replace key={Date.now()} with a useEffect that calls editorRef.current.setValue(snippet) whenever snippet changes, keeping the editor mounted. Also apply prettier fixes from quick-check.

Fix template tag prompt smoke race

82cffaa

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix e2e flake

1163dc2

fix: disable env editor Close button while save is in-flight

fe86fd4

Prevents a race condition where the dialog closes and the test navigates before the updateEnvironmentFetcher NeDB write completes. Playwright's click() waits for aria-disabled to clear, so the test blocks until idle.

fix: sort imports in send route

0b20d17

feedback

a2ae308

revert mime-type change, use alias

805fcc4

jackkav force-pushed the pr/safe-utilities-cleanup branch from 88fc536 to 805fcc4 Compare June 1, 2026 08:30

jackkav enabled auto-merge (squash) June 1, 2026 08:36

jackkav changed the title ~~Remove heavyweight third-party imports: mime-types, tough-cookie, @grpc/grpc-js, node-forge~~ Remove heavyweight third-party imports: tough-cookie, @grpc/grpc-js, node-forge Jun 1, 2026

jackkav changed the title ~~Remove heavyweight third-party imports: tough-cookie, @grpc/grpc-js, node-forge~~ Remove all third-party npm package imports from the renderer bundle Jun 1, 2026

ZxBing0066 approved these changes Jun 1, 2026

View reviewed changes

jackkav merged commit f36e1a8 into develop Jun 1, 2026
27 of 28 checks passed

jackkav deleted the pr/safe-utilities-cleanup branch June 1, 2026 08:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove all third-party npm package imports from the renderer bundle#9992

Remove all third-party npm package imports from the renderer bundle#9992
jackkav merged 14 commits into
developfrom
pr/safe-utilities-cleanup

jackkav commented May 30, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented May 30, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ZxBing0066 Jun 1, 2026

Uh oh!

jackkav Jun 1, 2026 •

edited

Loading

Uh oh!

ZxBing0066 Jun 1, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -1,5 +1,4 @@
		import clone from 'clone';
		import { lookup } from 'mime-types';

Conversation

jackkav commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Bundle verification

E2E note

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Circular References Report

Summary

Analysis

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ZxBing0066 Jun 1, 2026

Choose a reason for hiding this comment

Uh oh!

jackkav Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ZxBing0066 Jun 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jackkav commented May 30, 2026 •

edited

Loading

github-actions Bot commented May 30, 2026 •

edited

Loading

jackkav Jun 1, 2026 •

edited

Loading