Error when trying to use isolated-vm in a Forge App

Forge
,
7

Ok sure, I will provide more detail. Here is the code. First of all, we have the UI, which is a simple text area that allows the user to input their script. You can imagine that this will be replaced by a code editor like Monaco:

import ForgeReconciler, {Button, Form, FormFooter, FormSection, Label, useForm, TextArea} from '@forge/react';
import { invoke } from '@forge/bridge';
import React from 'react';
const App = () => {
    const { handleSubmit, register, getFieldId } = useForm();
    const onSubmit = (formData: any) => {
        const query: any = {}
        query["code"] = formData.script
        invoke("executeScript", query).then((res) => console.log(res));
    };
  return (
 <>
    <Form onSubmit={handleSubmit(onSubmit)}>
        <FormSection>
            <Label labelFor={getFieldId("script")}>
                Script
            </Label>
            <TextArea {...register("script", {required: true})} />
        </FormSection>
        <FormFooter>
            <Button appearance="primary" type="submit">
                Run Script
            </Button>
        </FormFooter>
    </Form>
 </>
  );
};
ForgeReconciler.render(
  <React.Fragment>
    <App />
  </React.Fragment>
);

We also have a resolver that executes the script in a VM:

import Resolver from '@forge/resolver';
import { ResolverRequest } from '../types';
const resolver = new Resolver();
const abc = 25;
resolver.define("executeScript", async function(req) {
  const { payload } = req as ResolverRequest
  if (payload.code != undefined) {
    try {
      console.log(abc)
      const vm = require('vm')
      const script = new vm.Script(`${payload.code}`)
      const result = script.runInThisContext()
      console.log(result)
      return result
    }
    catch (e) {
      return "Script threw an exception: " + e
    }
  }
  return "Unable to execute code or no code provided";
});
export const executeCodeHandler = resolver.getDefinitions();

So, abc is a variable that is defined outside of the user-uploaded script (a global variable). Now, suppose we have two different tenants (A and B) that both install this app in their own workspaces. Now, if tenant A were to enter global.abc = 10 into their script window (the frontend), they would set abc to 10 for BOTH tenant A and tenant B, even though they are installed on different workspaces.

This has been verified by multiple engineers and at the moment our theory is that this is because the app id in the manifest is the same for both apps (as it is hardcoded), so they are treated as the same application, but we are not sure.