fix(cli): apply params:query block to outgoing URL (#1681)

[tyskjohan]

Summary

Fixes #1681 — @usebruno/cli parses the params:query block but never appends the entries to the outgoing URL, so any query param defined only there is silently dropped. The desktop GUI hides this because it keeps the URL bar and the params table in sync on edit, so by request-time the URL already carries every query param. The CLI never runs that sync step.

Reproduces on current @usebruno/cli@3.3.0 against httpbin.org/anything:

get { url: https://httpbin.org/anything }
params:query { q: foo }

→ args: {} from httpbin. The q never reaches the wire.

What's in the fix

Two small changes, both in packages/bruno-cli:

1. src/runner/prepare-request.js — surface a queryParams field on the prepared request, mirroring the existing pathParams extraction. Filters out disabled and unnamed entries.

2. src/runner/interpolate-vars.js — after the existing pathParams substitution, interpolate each queryParam name/value, then append to the URL via URLSearchParams. Names already present on the URL are left alone, so a GUI-saved file (which carries the same params in both url: and params:query) round-trips identically — no double-appending, no behaviour change for existing collections.

The "URL value wins on collision" choice mirrors how the GUI behaves: when you edit a row in the params table, it rewrites the URL, so the URL is always the authoritative copy at request time.

Test plan

New tests, all passing locally:

tests/runner/interpolate-vars.spec.js — 9 new cases:

• appends a single query param to a URL with no existing query string
• appends multiple query params and preserves order
• interpolates {{vars}} in query param names and values
• does not duplicate params already present in the URL (URL value wins)
• encodes special characters required by Oracle Fusion q-syntax (' and ;)
• skips disabled query params
• leaves URL untouched when queryParams is empty or undefined
• co-exists with pathParams substitution

tests/runner/prepare-request.spec.js — 2 new cases:

• extracts enabled type=query params, dropping disabled and unnamed entries
• treats missing enabled as enabled (legacy bru files)

Full suite: npx jest in packages/bruno-cli → 120 passed, 120 total (118 pre-existing + 2 new in prepare-request; the 9 new in interpolate-vars are counted separately under that file). No existing tests modified.

End-to-end smoke — patched @usebruno/cli@3.3.0 with these two source changes against a real Oracle Fusion REST endpoint (q=ItemNumber='AS85000';OrganizationCode='001' filter), with a clean url: and all params declared only in params:query:

✓ status is 200
✓ at least one reservation matches

Same .bru file returns 400 (params:query dropped) on stock 3.3.0.

Notes for reviewers

• Semantics question: I chose searchParams.append (preserves the order params were declared in) and skip-if-name-already-in-URL (so GUI-saved files don't double up). Open to switching to set (overwrite) if you'd prefer params:query to win — happy to adjust.
• Scope: CLI only. The Electron path doesn't need this change because the GUI keeps the URL synced on every edit. If you'd like a parallel guard there for files authored externally, I can do it in a follow-up.
• Closes CLI: query declaration ignored #1681, also relevant to Bruno CLI doesn't seem to be injecting properly #3136 (CLI param injection) and [Issue] CLI ignores path params in request-urls #2506 (CLI path-param sister bug, not addressed here).

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Query parameters now support variable interpolation (e.g., {{vars}}) in both names and values
  • Query parameters are automatically synchronized with the request URL during execution
  • Disabled query parameters are properly excluded from URL synchronization
  • Existing URL parameters are preserved and not duplicated when adding new query parameters

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b5670757-6403-441f-9ee9-efaae433932e

📥 Commits

Reviewing files that changed from the base of the PR and between f8bf146 and 125a07d.

📒 Files selected for processing (4)

• packages/bruno-cli/src/runner/interpolate-vars.js
• packages/bruno-cli/src/runner/prepare-request.js
• packages/bruno-cli/tests/runner/interpolate-vars.spec.js
• packages/bruno-cli/tests/runner/prepare-request.spec.js

---

Walkthrough

This PR extends the Bruno CLI runner to interpolate and apply request.queryParams to request.url during execution. Query parameters defined in .bru files are now filtered in prepare-request.js, interpolated and synced to the URL by interpolate-vars.js, with comprehensive test coverage validating interpolation, URL parsing, param precedence, encoding, and coexistence with path parameters.

Changes

Query Parameter Interpolation

Layer / File(s)	Summary
Request Params Extraction packages/bruno-cli/src/runner/prepare-request.js	axiosRequest now populates queryParams by filtering request.params to include only enabled entries with non-empty names and type: query.
Query Param Interpolation & URL Sync packages/bruno-cli/src/runner/interpolate-vars.js	Interpolates queryParams name/value, parses request.url, appends params not already present in search params, and updates the URL. URL parsing failures raise an Invalid URL format error. Query param syncing occurs before proxy/auth interpolation.
Test Coverage packages/bruno-cli/tests/runner/interpolate-vars.spec.js, packages/bruno-cli/tests/runner/prepare-request.spec.js	New test suites verify single/multiple param appending, variable interpolation, URL param precedence, special character encoding (Oracle Fusion), disabled param skipping, empty queryParams handling, and coexistence with pathParams.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• usebruno/bruno#6969: Modifies the same interpolateVars function to inject global environment variables; may have relevant interaction patterns or merge conflict considerations.
• usebruno/bruno#7595: Updates multipart value interpolation in the same interpolate-vars.js file; touches overlapping request body interpolation logic.

Suggested labels

size/M

Suggested reviewers

• helloanoop
• lohit-bruno
• naman-bruno

Poem

Query params now flow from .bru to URL,
No duplication dance, no synchronization dull,
Interpolated, validated, in order they append,
With respect to existing params that won't bend. 🔗✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: applying query parameters from the params:query block to the outgoing URL in the CLI.
Linked Issues check	✅ Passed	The PR fully addresses #1681 by implementing query parameter interpolation and appending to URLs, with proper filtering of disabled/unnamed params and collision handling.
Out of Scope Changes check	✅ Passed	All changes are scoped to CLI query parameter handling in prepare-request.js and interpolate-vars.js, directly addressing the linked issue with comprehensive test coverage.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}