From e381ca241278dafda56bfdeccb9a87a5fb3dfe08 Mon Sep 17 00:00:00 2001
From: A <258483684+la14-1@users.noreply.github.com>
Date: Sat, 21 Feb 2026 22:50:08 -0800
Subject: [PATCH] fix: replace require() with ESM imports in bun eval scripts
 (#1682)

* fix: replace require() with ESM imports in bun eval scripts (#1669)

Fixes #1669

Agent: security-auditor
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* fix: update test assertion to match ESM import pattern

The test expected require('http') but the PR changed shared/common.sh
to use ESM imports. Update assertion to expect import http from 'http'.

Agent: pr-maintainer
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

---------

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 aws/lib/common.sh                                  | 4 ++--
 cli/src/__tests__/shared-common-oauth-flow.test.ts | 2 +-
 shared/common.sh                                   | 6 +++---
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/aws/lib/common.sh b/aws/lib/common.sh
index c193bd57..9a2d1b6a 100644
--- a/aws/lib/common.sh
+++ b/aws/lib/common.sh
@@ -364,7 +364,7 @@ ensure_ssh_key() {
         # Build JSON body with bun so the key content is properly escaped
         local import_body
         import_body=$(bun eval \
-            "const k=require('fs').readFileSync(process.argv[2],'utf8').trim();process.stdout.write(JSON.stringify({keyPairName:process.argv[3],publicKeyBase64:k}));" \
+            "const {readFileSync}=await import('fs');const k=readFileSync(process.argv[2],'utf8').trim();process.stdout.write(JSON.stringify({keyPairName:process.argv[3],publicKeyBase64:k}));" \
             "${pub_path}" "${key_name}")
 
         _lightsail_rest "Lightsail_20161128.ImportKeyPair" "${import_body}" >/dev/null || {
@@ -492,7 +492,7 @@ create_server() {
         local ud_tmp create_body
         ud_tmp=$(mktemp)
         printf '%s' "${userdata}" > "${ud_tmp}"
-        create_body=$(bun eval "const ud=require('fs').readFileSync(process.argv[2],'utf8');process.stdout.write(JSON.stringify({instanceNames:[process.argv[3]],availabilityZone:process.argv[4],blueprintId:'ubuntu_24_04',bundleId:process.argv[5],keyPairName:'spawn-key',userData:ud}));" \
+        create_body=$(bun eval "const {readFileSync}=await import('fs');const ud=readFileSync(process.argv[2],'utf8');process.stdout.write(JSON.stringify({instanceNames:[process.argv[3]],availabilityZone:process.argv[4],blueprintId:'ubuntu_24_04',bundleId:process.argv[5],keyPairName:'spawn-key',userData:ud}));" \
             "${ud_tmp}" "${name}" "${az}" "${bundle}")
         rm -f "${ud_tmp}"
 
diff --git a/cli/src/__tests__/shared-common-oauth-flow.test.ts b/cli/src/__tests__/shared-common-oauth-flow.test.ts
index e53465b2..237afc6f 100644
--- a/cli/src/__tests__/shared-common-oauth-flow.test.ts
+++ b/cli/src/__tests__/shared-common-oauth-flow.test.ts
@@ -320,7 +320,7 @@ describe("_generate_oauth_server_script", () => {
         "${testDir}/code" "${testDir}/port" 5180
     `);
     expect(result.exitCode).toBe(0);
-    expect(result.stdout).toContain("require('http')");
+    expect(result.stdout).toContain("import http from 'http'");
   });
 
   it("should embed the expected CSRF state", () => {
diff --git a/shared/common.sh b/shared/common.sh
index 8602338b..d3c0c6f5 100644
--- a/shared/common.sh
+++ b/shared/common.sh
@@ -790,9 +790,9 @@ _generate_oauth_server_script() {
     port_file="${port_file//\'/\\\'}"
 
     printf '%s' "
-const http = require('http');
-const fs = require('fs');
-const url = require('url');
+import http from 'http';
+import fs from 'fs';
+import url from 'url';
 const expectedState = '${expected_state}';
 const html = '${success_html}';
 const errorHtml = '${error_html}';