[PR #515] [MERGED] fix(replay): link the complete ESM graph before evaluating #2042

New issue

Closed

opened 2026-10-16 21:13:39 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:13:39 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/515
Author: @rudycelekli
Created: 10/5/2026
Status: ✅ Merged
Merged: 10/5/2026
Merged by: @morluto

Base: main ← Head: fix/replay-esm-link-graph-20261004

📝 Commits (3)

4cadd57 fix(replay): link the complete ESM graph before evaluating
f226425 fix(replay): rename shadowed module bindings in ESM link graph
dd12619 Merge origin/main into fix/replay-esm-link-graph-20261004

📊 Changes

2 files changed (+148 additions, -9 deletions)

View changed files

📝 src/replay/JavaScriptReplayWorker.ts (+14 -9)
📝 tests/boundary/providers/replay/javascriptReplayWorker.test.ts (+134 -0)

📄 Description

Change

Summary

Construct/cache the selected replay modules before linking and evaluating their complete ESM graph. Resolve each import against the referencing module's declared dependency map.

Recursive loading currently links and evaluates dependencies while their importing graph is still being linked. Ordinary two- and three-module cycles return a linking exception rather than the selected callable result. Letting the native VM linker own graph traversal fixes that ordering.

Verification

Actual compiled production worker subprocess: before 2 failed / 13 passed; after 15 passed.
Two-/three-module cycles, acyclic dependency initialization, shared diamond single initialization, mixed CommonJS factory, and undeclared-import denial.
Existing dynamic-import denial and worker projection controls remain green.
Pinned build, TypeScript and official repository lint pass.
Full repository/package gates recorded separately before publication.

This verifies the disposable worker directly, not Linux Bubblewrap/systemd or original-application behavior. See the Node VM linking contract.

Reproduction and verification

2 failed/13 passed

npm run check:pr: passed (Test Files 352 passed (352); Tests 1804 passed | 2 skipped (1806)).
npm run check:ci: passed.
npm run verify:package: passed installed-tarball CLI/MCP verification, including optional-dependency degradation.
npm pack --dry-run: passed.
Exact lockfile installation on Node 24.18.0 and npm 11.16.0.

These tests exercise the production seams described above. No real Hopper, Ghidra, desktop browser or Linux sandbox end-to-end verification is claimed.

Prepared with AI assistance; the reproductions and verification commands above were executed locally.

Matching Linux replay lane

The unchanged upstream real-javascript-replay.yml workflow was dispatched on the exact signed head in the fork: run 37264857431. It completed successfully with the upstream REA_REPLAY_ALLOW_UNAVAILABLE=true setting, but its verifier payload was available:false, AnalysisCapabilityUnavailableError. This is a degraded prerequisite result, not positive Linux sandbox execution verification. The failing-before/passing-after compiled worker regressions above remain separate evidence; no Linux sandbox end-to-end proof is claimed.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/515 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/5/2026 **Status:** ✅ Merged **Merged:** 10/5/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/replay-esm-link-graph-20261004` --- ### 📝 Commits (3) - [`4cadd57`](https://github.com/morluto/rea/commit/4cadd57ff15f1b4e8dd6f0de5d836fc1d20e28bb) fix(replay): link the complete ESM graph before evaluating - [`f226425`](https://github.com/morluto/rea/commit/f226425172388d6f35c9b586bb7911c933a46301) fix(replay): rename shadowed module bindings in ESM link graph - [`dd12619`](https://github.com/morluto/rea/commit/dd126195ac7c6fa22f00176323001fb24c89b842) Merge origin/main into fix/replay-esm-link-graph-20261004 ### 📊 Changes **2 files changed** (+148 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `src/replay/JavaScriptReplayWorker.ts` (+14 -9) 📝 `tests/boundary/providers/replay/javascriptReplayWorker.test.ts` (+134 -0) </details> ### 📄 Description ## Change ## Summary Construct/cache the selected replay modules before linking and evaluating their complete ESM graph. Resolve each import against the referencing module's declared dependency map. Recursive loading currently links and evaluates dependencies while their importing graph is still being linked. Ordinary two- and three-module cycles return a linking exception rather than the selected callable result. Letting the native VM linker own graph traversal fixes that ordering. ## Verification - Actual compiled production worker subprocess: before 2 failed / 13 passed; after 15 passed. - Two-/three-module cycles, acyclic dependency initialization, shared diamond single initialization, mixed CommonJS factory, and undeclared-import denial. - Existing dynamic-import denial and worker projection controls remain green. - Pinned build, TypeScript and official repository lint pass. - Full repository/package gates recorded separately before publication. This verifies the disposable worker directly, not Linux Bubblewrap/systemd or original-application behavior. See the [Node VM linking contract](https://nodejs.org/api/vm.html#modulelinklinker). ## Reproduction and verification 2 failed/13 passed - `npm run check:pr`: passed (Test Files 352 passed (352); Tests 1804 passed | 2 skipped (1806)). - `npm run check:ci`: passed. - `npm run verify:package`: passed installed-tarball CLI/MCP verification, including optional-dependency degradation. - `npm pack --dry-run`: passed. - Exact lockfile installation on Node 24.18.0 and npm 11.16.0. These tests exercise the production seams described above. No real Hopper, Ghidra, desktop browser or Linux sandbox end-to-end verification is claimed. Prepared with AI assistance; the reproductions and verification commands above were executed locally. ## Matching Linux replay lane The unchanged upstream `real-javascript-replay.yml` workflow was dispatched on the exact signed head in the fork: [run 37264857431](https://github.com/rudycelekli/rea/actions/runs/37264857431). It completed successfully with the upstream `REA_REPLAY_ALLOW_UNAVAILABLE=true` setting, but its verifier payload was `available:false`, `AnalysisCapabilityUnavailableError`. This is a degraded prerequisite result, **not positive Linux sandbox execution verification**. The failing-before/passing-after compiled worker regressions above remain separate evidence; no Linux sandbox end-to-end proof is claimed. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:13:39 +00:00