[GH-ISSUE #6882] [Bug] Module tracing silently drops a valid JavaScript dynamic import #4218

New issue

Closed

opened 2026-10-31 00:47:48 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:47:48 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6882

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

The production collector silently omits the native dynamic import in valid JavaScript left < import("./dep.js") > (right), returning imports: [], state: "parsed", and no diagnostics. A disk-backed WebModuleTraceService probe returned the same empty inventory and made zero resolver calls. Explicit JavaScript parsing retained the import. CLI/MCP transport and a real browser resolver were not executed.

Reproduction

From the source checkout at the revision below with its locked dependencies installed, run this focused source-module probe with Node.js 24.22.1:

node --import ./node_modules/tsx/dist/loader.mjs --input-type=module <<'JS'
import { spawnSync } from 'node:child_process';
import { collectWebModuleImports } from './src/domain/webModuleImports.ts';
for (const source of [
  'const order = left < import("./dep.js") > (right);\n',
  'import("./dep.js");\n',
]) {
  const check = spawnSync(process.execPath,
    ['--input-type=module', '--check'], { input: source, encoding: 'utf8' });
  console.log(JSON.stringify({ source, syntax_exit: check.status,
    syntax_stderr: check.stderr, result: collectWebModuleImports(source) }));
}
JS

Each case ran once in the final independent two-case reproduction. Both syntax-only checks exited 0 with empty stderr; target source was never evaluated. An earlier disk-backed probe used production LocalWebModuleArtifacts and a deterministic resolver seam. Its digest-matching main.js, media type text/javascript, and importer URL https://app.test/main.js?build=1#entry passed the service guards; the failing branch never called that seam.

Expected behavior

Retain one literal dynamic import for ./dep.js, with its source coordinates, then request native resolution when tracing the selected JavaScript file. The module-trace contract covers literal dynamic imports and explicit parse diagnostics. The shared parser contract explains that TypeScript must not select the meaning of ambiguous JavaScript expressions. The source is native JavaScript, not a type-only TypeScript dependency.

Impact and scope

The observed collector and application-service results lose one native import relationship while declaring parsing successful. A related conditional-arrow fixture loses three imports with explicit parse failure; it is another symptom of the same missing grammar selection. Real-application frequency and the first affected revision are unknown. Captured source remains readable for manual inspection; no execution or loading claim is involved.

REA version

Source main 3e7e102a518b9112a2a8aa0590ae6f6951fd0635; source module imports only. No installed or published REA package was used.

Runtime and platform

Node.js v24.22.1; Linux x86_64; the checkout's locked TSX loader and Babel dependencies. No browser, WABT, GPU, Hopper, Ghidra, or target code execution was used.

Target and artifact context

Self-authored JavaScript strings and a synthetic exported-capture manifest with a digest-matching 51-byte main.js file. All artifacts used disposable local files; the example HTTP(S) URL was context data and was not fetched.

Interface

Other

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Selected output from the final focused reproduction:

relational source:
  syntax_exit=0; syntax_stderr=""
  {"imports":[],"state":"parsed","diagnostics":[]}
direct-import control:
  syntax_exit=0; syntax_stderr=""
  {"imports":[{"kind":"dynamic-import","specifier":"./dep.js",
    "expression":"\"./dep.js\"","start":{"offset":7,"line":1,"column":7},
    "end":{"offset":17,"line":1,"column":17}}],
   "state":"parsed","diagnostics":[]}

Explicit JavaScript parsing returned no errors and one ImportExpression. The disk-backed application result returned parser.state: "parsed", parser.diagnostics: [], imports: [], and engine: null, with 0 resolver calls.

Expected source: The linked module-trace and JavaScript-grammar contracts, plus the successful syntax-only and explicit-JavaScript parsing controls above.
Failure source: Observed production collector results and the disk-backed WebModuleTraceService result. The service calls the collector after selected-file/context admission and acquires the resolver only for retained literal imports.
Evidence provenance: observed; public-adapter reachability and the explanation below are source-derived.
Local verification: reproduced at the module and application-service boundaries; no CLI/MCP or real-browser replay is claimed.
Reproduction completeness: complete for the observed collection failure. The inline probe reproduces it without a browser or hidden fixture.

Typed outcome or recovery expected

Preserve the actual dynamic-import record rather than return a successfully parsed empty inventory. The unchanged relational source must yield its one literal import and request resolver work in the application path. Keep the direct-import control and genuine TypeScript type-only exclusion behavior.

Analysis or suspected cause

Source-derived: the collector calls the parser without source-path or grammar context. The unnamed mode enables TypeScript, which interprets this relational expression as a generic call containing TSImportType. The collector's traversal handles native ImportExpression nodes and returns no diagnostic for that alternative interpretation. No fix was made.

Additional context

Source reachability: the CLI adapter and MCP registration call the same application service. The disk-backed probe exercised regular-file, digest, byte-size and UTF-8 admission.

All reproduction work finished before drafting; no post-draft execution or reverification was performed.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: The focused collector and disk-backed service observations show one valid native import silently omitted with successful parse status. The failure is bounded to affected syntax; no execution, modification, or broad runtime impact was observed.
Workaround status: unverified
Workaround basis: Manual inspection and the explicit-JavaScript parse recover the literal specifier, but no result-preserving workaround for native resolution and complete trace Evidence was verified. No public grammar override or automatic tracing workaround was tested.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6882 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior The production collector silently omits the native dynamic import in valid JavaScript `left < import("./dep.js") > (right)`, returning `imports: []`, `state: "parsed"`, and no diagnostics. A disk-backed `WebModuleTraceService` probe returned the same empty inventory and made zero resolver calls. Explicit JavaScript parsing retained the import. CLI/MCP transport and a real browser resolver were not executed. ## Reproduction From the source checkout at the revision below with its locked dependencies installed, run this focused source-module probe with Node.js 24.22.1: ```sh node --import ./node_modules/tsx/dist/loader.mjs --input-type=module <<'JS' import { spawnSync } from 'node:child_process'; import { collectWebModuleImports } from './src/domain/webModuleImports.ts'; for (const source of [ 'const order = left < import("./dep.js") > (right);\n', 'import("./dep.js");\n', ]) { const check = spawnSync(process.execPath, ['--input-type=module', '--check'], { input: source, encoding: 'utf8' }); console.log(JSON.stringify({ source, syntax_exit: check.status, syntax_stderr: check.stderr, result: collectWebModuleImports(source) })); } JS ``` Each case ran once in the final independent two-case reproduction. Both syntax-only checks exited 0 with empty stderr; target source was never evaluated. An earlier disk-backed probe used production `LocalWebModuleArtifacts` and a deterministic resolver seam. Its digest-matching `main.js`, media type `text/javascript`, and importer URL `https://app.test/main.js?build=1#entry` passed the service guards; the failing branch never called that seam. ## Expected behavior Retain one literal dynamic import for `./dep.js`, with its source coordinates, then request native resolution when tracing the selected JavaScript file. The [module-trace contract](https://github.com/morluto/rea/blob/3e7e102a518b9112a2a8aa0590ae6f6951fd0635/docs/website-module-trace.md#L47-L53) covers literal dynamic imports and explicit parse diagnostics. The [shared parser contract](https://github.com/morluto/rea/blob/3e7e102a518b9112a2a8aa0590ae6f6951fd0635/src/domain/javascript/javascriptSourceParser.ts#L77-L93) explains that TypeScript must not select the meaning of ambiguous JavaScript expressions. The source is native JavaScript, not a type-only TypeScript dependency. ## Impact and scope The observed collector and application-service results lose one native import relationship while declaring parsing successful. A related conditional-arrow fixture loses three imports with explicit parse failure; it is another symptom of the same missing grammar selection. Real-application frequency and the first affected revision are unknown. Captured source remains readable for manual inspection; no execution or loading claim is involved. ## REA version Source main `3e7e102a518b9112a2a8aa0590ae6f6951fd0635`; source module imports only. No installed or published REA package was used. ## Runtime and platform Node.js v24.22.1; Linux x86_64; the checkout's locked TSX loader and Babel dependencies. No browser, WABT, GPU, Hopper, Ghidra, or target code execution was used. ## Target and artifact context Self-authored JavaScript strings and a synthetic exported-capture manifest with a digest-matching 51-byte `main.js` file. All artifacts used disposable local files; the example HTTP(S) URL was context data and was not fetched. ## Interface Other ## Earliest failure stage Native analysis or reconstruction ## Relevant output or evidence Selected output from the final focused reproduction: ```text relational source: syntax_exit=0; syntax_stderr="" {"imports":[],"state":"parsed","diagnostics":[]} direct-import control: syntax_exit=0; syntax_stderr="" {"imports":[{"kind":"dynamic-import","specifier":"./dep.js", "expression":"\"./dep.js\"","start":{"offset":7,"line":1,"column":7}, "end":{"offset":17,"line":1,"column":17}}], "state":"parsed","diagnostics":[]} ``` Explicit JavaScript parsing returned no errors and one `ImportExpression`. The disk-backed application result returned `parser.state: "parsed"`, `parser.diagnostics: []`, `imports: []`, and `engine: null`, with 0 resolver calls. - Expected source: The linked module-trace and JavaScript-grammar contracts, plus the successful syntax-only and explicit-JavaScript parsing controls above. - Failure source: Observed production collector results and the disk-backed `WebModuleTraceService` result. The [service](https://github.com/morluto/rea/blob/3e7e102a518b9112a2a8aa0590ae6f6951fd0635/src/application/WebModuleTraceService.ts#L126-L138) calls the collector after selected-file/context admission and acquires the resolver only for retained literal imports. - Evidence provenance: observed; public-adapter reachability and the explanation below are source-derived. - Local verification: reproduced at the module and application-service boundaries; no CLI/MCP or real-browser replay is claimed. - Reproduction completeness: complete for the observed collection failure. The inline probe reproduces it without a browser or hidden fixture. ## Typed outcome or recovery expected Preserve the actual dynamic-import record rather than return a successfully parsed empty inventory. The unchanged relational source must yield its one literal import and request resolver work in the application path. Keep the direct-import control and genuine TypeScript type-only exclusion behavior. ## Analysis or suspected cause Source-derived: [the collector](https://github.com/morluto/rea/blob/3e7e102a518b9112a2a8aa0590ae6f6951fd0635/src/domain/webModuleImports.ts#L14-L27) calls the parser without source-path or grammar context. The unnamed mode enables TypeScript, which interprets this relational expression as a generic call containing `TSImportType`. The [collector's traversal](https://github.com/morluto/rea/blob/3e7e102a518b9112a2a8aa0590ae6f6951fd0635/src/domain/webModuleImports.ts#L60-L85) handles native `ImportExpression` nodes and returns no diagnostic for that alternative interpretation. No fix was made. ## Additional context Source reachability: the [CLI adapter](https://github.com/morluto/rea/blob/3e7e102a518b9112a2a8aa0590ae6f6951fd0635/src/cli/webModuleCommands.ts#L42-L68) and [MCP registration](https://github.com/morluto/rea/blob/3e7e102a518b9112a2a8aa0590ae6f6951fd0635/src/server/registerWebModuleTool.ts#L19-L30) call the same application service. The disk-backed probe exercised regular-file, digest, byte-size and UTF-8 admission. All reproduction work finished before drafting; no post-draft execution or reverification was performed. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: The focused collector and disk-backed service observations show one valid native import silently omitted with successful parse status. The failure is bounded to affected syntax; no execution, modification, or broad runtime impact was observed. - Workaround status: unverified - Workaround basis: Manual inspection and the explicit-JavaScript parse recover the literal specifier, but no result-preserving workaround for native resolution and complete trace Evidence was verified. No public grammar override or automatic tracing workaround was tested.

bsakaguchi closed this issue

2026-10-31 00:47:48 +00:00

bsakaguchi referenced this issue

2026-10-31 01:12:07 +00:00

[PR #4222] [CLOSED] fix(website): translate coding agent as an AI assistant in Russian and Ukrainian #6134