[PR #696] [MERGED] fix(reference): distinguish computed require member names #2176

New issue

Closed

opened 2026-10-16 21:15:16 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:15:16 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/696
Author: @kaoru0822-kitauji
Created: 10/6/2026
Status: ✅ Merged
Merged: 10/6/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/reference-computed-require

📝 Commits (1)

df6e476 fix(reference): distinguish computed require member names

📊 Changes

3 files changed (+198 additions, -1 deletions)

View changed files

📝 src/domain/referenceSourceImportParsing.ts (+2 -1)
➕ src/domain/referenceSourceRequireMembers.test.ts (+104 -0)
➕ tests/boundary/filesystem/referenceSourceComputedRequire.test.ts (+92 -0)

📄 Description

Summary

Stop treating computed member identifiers as literal CommonJS helper names during historical-source import.

No separate issue: this is a reproduced static dependency-inference defect.

Problem and expected behavior

require[resolve]("./dep.js") is currently interpreted as require.resolve("./dep.js") because the parser checks the property's identifier spelling without checking whether it is computed.

An owned CommonJS fixture sets resolve = "toString". Node returns a string without resolving or loading the throwing dependency, but public reference import invents a fully parsed internal requires edge. The same issue affects a computed identifier named main.

Change and scope

Accept identifier member names only on noncomputed members. Preserve direct require, existing dot helpers and literal-string computed helper names such as require["resolve"].

Computed expressions follow the existing unrecognized-callee behavior. This adds no constant evaluator or guessed module targets, and does not expand optional-call support. The separate parser-recovery fix in #695 was tested together with this change.

Contract and boundary impact

Semantic owner: CommonJS callee recognition before relationship extraction.
CLI/MCP: false dependency edges disappear; no schemas or tools change.
Provider/platform: unchanged.
Evidence/provenance: valid relationships, unknown dynamic-import evidence, file paths/hashes/sizes and existing parse states remain intact.
Process/authorization/cleanup: import remains inert. Only owned regression producer scripts are executed by the test.
Generated metadata/package: unchanged.

Evidence and regression coverage

The initial pre-fix regression suite recorded seven failures and 32 passing controls. The final suite additionally covers mixed valid/computed calls and extra literal forms; those initial counts are not claimed for the expanded suite.

Coverage includes direct/dot/literal-string members, both problematic computed identifiers, optional/member lookalikes, escaped/parenthesized literals, and unrecognized arguments. The filesystem regression runs owned Node producers, verifies that the throwing dependency is not evaluated, then checks exact graph relationships and source evidence.

Validation performed

On main 132a3a4:

Six focused parser, graph and public-import suites: 68 tests passed.
Build and npm run check: passed, all five check tasks succeeded (93 existing warnings, no errors).
npm run jscpd, npm run scan:todos, and git diff --check: passed.
Combined #695 + this patch: 72 tests passed in a separate tree.
Independent review completed before publication with no blocking findings.

Node.js 24.19.0, npm 11.9.0, exact locked dependencies. Hosted CI is tracked separately; no full local suite pass is claimed.

Compatibility, safety, and release

No schemas, dependencies, packaging or provider behavior changed. Package-install and real Hopper/Ghidra lanes were not rerun for this callee-recognition correction.

Prepared with AI assistance.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/696 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/6/2026 **Status:** ✅ Merged **Merged:** 10/6/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/reference-computed-require` --- ### 📝 Commits (1) - [`df6e476`](https://github.com/morluto/rea/commit/df6e476d67b2719c4b998daa3e9ad8a4b157ace2) fix(reference): distinguish computed require member names ### 📊 Changes **3 files changed** (+198 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/referenceSourceImportParsing.ts` (+2 -1) ➕ `src/domain/referenceSourceRequireMembers.test.ts` (+104 -0) ➕ `tests/boundary/filesystem/referenceSourceComputedRequire.test.ts` (+92 -0) </details> ### 📄 Description ## Summary Stop treating computed member identifiers as literal CommonJS helper names during historical-source import. No separate issue: this is a reproduced static dependency-inference defect. ## Problem and expected behavior `require[resolve]("./dep.js")` is currently interpreted as `require.resolve("./dep.js")` because the parser checks the property's identifier spelling without checking whether it is computed. An owned CommonJS fixture sets `resolve = "toString"`. Node returns a string without resolving or loading the throwing dependency, but public reference import invents a fully parsed internal `requires` edge. The same issue affects a computed identifier named `main`. ## Change and scope Accept identifier member names only on noncomputed members. Preserve direct `require`, existing dot helpers and literal-string computed helper names such as `require["resolve"]`. Computed expressions follow the existing unrecognized-callee behavior. This adds no constant evaluator or guessed module targets, and does not expand optional-call support. The separate parser-recovery fix in #695 was tested together with this change. ## Contract and boundary impact - Semantic owner: CommonJS callee recognition before relationship extraction. - CLI/MCP: false dependency edges disappear; no schemas or tools change. - Provider/platform: unchanged. - Evidence/provenance: valid relationships, unknown dynamic-import evidence, file paths/hashes/sizes and existing parse states remain intact. - Process/authorization/cleanup: import remains inert. Only owned regression producer scripts are executed by the test. - Generated metadata/package: unchanged. ## Evidence and regression coverage The initial pre-fix regression suite recorded seven failures and 32 passing controls. The final suite additionally covers mixed valid/computed calls and extra literal forms; those initial counts are not claimed for the expanded suite. Coverage includes direct/dot/literal-string members, both problematic computed identifiers, optional/member lookalikes, escaped/parenthesized literals, and unrecognized arguments. The filesystem regression runs owned Node producers, verifies that the throwing dependency is not evaluated, then checks exact graph relationships and source evidence. ## Validation performed On main `132a3a4`: - Six focused parser, graph and public-import suites: 68 tests passed. - Build and `npm run check`: passed, all five check tasks succeeded (93 existing warnings, no errors). - `npm run jscpd`, `npm run scan:todos`, and `git diff --check`: passed. - Combined #695 + this patch: 72 tests passed in a separate tree. - Independent review completed before publication with no blocking findings. Node.js 24.19.0, npm 11.9.0, exact locked dependencies. Hosted CI is tracked separately; no full local suite pass is claimed. ## Compatibility, safety, and release No schemas, dependencies, packaging or provider behavior changed. Package-install and real Hopper/Ghidra lanes were not rerun for this callee-recognition correction. Prepared with AI assistance. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:15:16 +00:00