feat: [US-009] - [Fix module.exports capture in NodeRuntime.run()]

Author: NathanFlurry

packages/secure-exec/tests/runtime-driver/node/standalone-dist-smoke.test.ts

@@ -99,4 +99,67 @@ describe("standalone dist bootstrap", () => {
 		expect(result.kernelCode).toBe(0);
 		expect(result.kernelStdout).toContain("1");
 	}, 30_000);
+
+	it("supports runtime.run exports outside vitest transforms", async () => {
+		const stdout = await runStandaloneScript(`
+			import {
+				NodeRuntime,
+				createNodeDriver,
+				createNodeRuntimeDriverFactory,
+			} from ${JSON.stringify(DIST_INDEX_URL)};
+
+			const runtime = new NodeRuntime({
+				systemDriver: createNodeDriver(),
+				runtimeDriverFactory: createNodeRuntimeDriverFactory(),
+			});
+
+			const cjsObject = await runtime.run('module.exports = { message: "hello" };');
+			const cjsScalar = await runtime.run("module.exports = 42;");
+			const cjsNested = await runtime.run("module.exports = { a: 1, b: [2, 3] };");
+			const esm = await runtime.run("export const answer = 42;", "/entry.mjs");
+
+			const result = JSON.stringify({
+				cjsObject,
+				cjsScalar,
+				cjsNested,
+				esm,
+			});
+
+			await runtime.terminate();
+			await new Promise((resolve, reject) => {
+				process.stdout.write(result, (error) => {
+					if (error) {
+						reject(error);
+						return;
+					}
+					resolve();
+				});
+			});
+			process.exit(0);
+		`);
+
+		const result = JSON.parse(stdout) as {
+			cjsObject: { code: number; exports: { message: string } };
+			cjsScalar: { code: number; exports: number };
+			cjsNested: { code: number; exports: { a: number; b: number[] } };
+			esm: { code: number; exports: { answer: number } };
+		};
+
+		expect(result.cjsObject).toEqual({
+			code: 0,
+			exports: { message: "hello" },
+		});
+		expect(result.cjsScalar).toEqual({
+			code: 0,
+			exports: 42,
+		});
+		expect(result.cjsNested).toEqual({
+			code: 0,
+			exports: { a: 1, b: [2, 3] },
+		});
+		expect(result.esm).toEqual({
+			code: 0,
+			exports: { answer: 42 },
+		});
+	}, 30_000);
 });

scripts/ralph/prd.json

@@ -172,7 +172,7 @@
         "Typecheck passes"
       ],
       "priority": 9,
-      "passes": false,
+      "passes": true,
       "notes": "runtime.run() completes with exit code 0 but result.exports is always undefined. The export extraction in runtimeDriver.run() isn't capturing module.exports. May be related to US-008 bridge bootstrap issue \u2014 if require is undefined, module.exports assignment can't work either."
     },
     {

scripts/ralph/progress.txt

@@ -7,6 +7,7 @@
 - `bridge-initial-globals.ts` intentionally removes `SharedArrayBuffer`; when vendored conformance files hard-require it, classify the expectation as a `security-constraint` instead of treating the failure as a crypto implementation bug
 - When a crypto/node-conformance expectation reason looks stale, temporarily remove just that entry and rerun the exact vendored file filter; the runner prints the real sandbox stderr, which is often a missing fixture or error-shape mismatch rather than the older bridge-gap guess
 - Host-side ESM packages in `packages/nodejs/src/` cannot use bare `require(...)`; standalone `dist/` execution runs them as real ESM, so bridge helpers must use static imports or `createRequire()`
+- Standalone `dist/` smoke tests that spawn `node --input-type=module -e ...` should flush `process.stdout.write(...)` via a callback and then `process.exit(0)`; otherwise the verification script can print the right JSON but linger long enough for Vitest to hit its timeout
 - Conformance tests live in packages/secure-exec/tests/node-conformance/ — vendored Node.js v22.14.0 test/parallel/
 - Runner is packages/secure-exec/tests/node-conformance/runner.test.ts — run with: pnpm vitest run packages/secure-exec/tests/node-conformance/runner.test.ts
 - Expectations are in packages/secure-exec/tests/node-conformance/expectations.json — each entry has expected (pass/fail/skip), reason, category
@@ -104,3 +105,11 @@
   - `packages/nodejs/src/bridge-handlers.ts` runs on the host as ESM, so any leftover `require("@secure-exec/core")` calls will only fail once the published-style `dist/` path is used.
   - When a spawned verification script only needs to report pass/fail state, explicitly flushing stdout and exiting keeps the smoke test focused on bootstrap behavior instead of shared-runtime process lifetime.
 ---
+## [2026-03-25 04:31 PDT] - US-009
+- Verified the underlying `runtime.run()` export capture issue is already fixed on the current branch and added standalone `dist/` regression coverage for CommonJS object/scalar/nested `module.exports` plus ESM named exports.
+- Files changed: `packages/secure-exec/tests/runtime-driver/node/standalone-dist-smoke.test.ts`, `scripts/ralph/prd.json`, `scripts/ralph/progress.txt`
+- **Learnings for future iterations:**
+  - `US-008`'s standalone bootstrap fix also restored `runtime.run()` export capture from `packages/secure-exec/dist/index.js`; the missing piece was regression coverage, not another runtime patch.
+  - A standalone smoke that validates multiple `run()` calls should flush stdout through the write callback and exit explicitly after `runtime.terminate()` to keep Vitest from timing out on a lingering host process.
+  - This test area is best exercised against built `dist/` imports, because source-level Vitest coverage already passes and does not prove publish-style behavior.
+---