[PR #2077] [MERGED] fix(javascript): keep CommonJS require file URLs unresolved #5006

Closed
opened 2026-10-31 00:57:56 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2077
Author: @rekcilyssup
Created: 10/12/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @morluto

Base: main ← Head: fix/commonjs-file-url-require


📝 Commits (3)

  • 72f7c97 fix(javascript): keep CommonJS require file URLs unresolved
  • 2875007 fix(javascript): reconcile CommonJS file URL resolution with main
  • 7ea2769 test(javascript): consolidate CommonJS file URL public workflow coverage

📊 Changes

1 file changed (+7 additions, -0 deletions)

View changed files

📝 tests/acceptance/applications/packageSubpathsCli.test.ts (+7 -0)

📄 Description

Summary

require("file:///dep.cjs") was reported as a resolved dependency of the inventoried dep.cjs while Node rejects that exact string with MODULE_NOT_FOUND. The shared module-specifier resolver decoded file URLs before applying the declared CommonJS loader semantics, so the graph invented a local dependency the CommonJS loader never loads, under coverage.status = complete. Fixes #2057.

Problem and expected behavior

  • Smallest trigger: a CommonJS source containing require("file:///dep.cjs") in a directory that also inventories dep.cjs.
  • Violated invariant: dependency evidence must match the loader that actually runs. Node's CommonJS loader does not decode file: strings, so a require edge must not resolve them to a local file.
  • Controls from the reported reproduction: node main.cjs exits 1 with MODULE_NOT_FOUND; node control.cjs (require("./dep.cjs")) exits 0 and prints 42.
  • Expected: the declared string and its source range stay intact, with an explicit external outcome and no resolved_path, instead of a false resolved local file.

Change and scope

  • In contextualCandidate (src/application/javascript/JavaScriptArtifactPathResolution.ts), file-URL decoding through fileUrlPath now applies only when moduleKind !== "require". Under require, a declared file: URL returns external with a limitation that states Node's rejection.
  • Why this fits: it is the single shared resolver boundary where module specifiers are resolved, so both semantic module-link edges and static reference edges inherit the correction without downstream repairs. It mirrors the existing rule that already skips ESM percent-decoding for require.
  • Intentionally not included: no change to ESM import file URLs, html-reference/url-reference contexts, package exports/main target selection, or ordinary relative and bare require paths. No schema, CLI, or MCP contract change.

Contract and boundary impact

  • Semantic owner and earliest changed stage: application/javascript static artifact path resolution for module-specifier context with moduleKind = "require".
  • CLI and MCP/tool-catalog contract: none — result shape unchanged; only the values of resolution_status (resolved → external) and resolved_path (dep.cjs → null) for this specifier class.
  • Provider, bridge, target-format, or platform compatibility: none.
  • Evidence, artifact, provenance, or reconstruction contract: the declared specifier and source-range evidence are preserved; the unresolved outcome stays visible with an explicit limitation instead of a fabricated local link.
  • Process execution, authorization, cleanup, or containment impact: none.
  • Generated metadata (docs/public/product-catalog.json), package, or installation impact: none.

Evidence and regression coverage

  • Tests added or updated: two tests in src/application/javascript/JavaScriptModuleSpecifierPaths.test.ts under CommonJS file URL module specifiers — a resolver-level test covering require file URL → external, ESM file URL → resolved, and relative require → resolved; and an end-to-end test that executes the fixture under real Node, then asserts the graph.
  • Base reproduction or other evidence: both new tests fail on base 7c207c79 when only the source fix is stashed (2 failed | 29 passed), and pass with the fix. The issue's own probe now prints resolution_status external with resolved_path null for main.cjs.
  • User-visible CLI/MCP output (if applicable): analyze-javascript-application edges for a CommonJS file-URL require now carry resolution_status: "external", resolved_path: null, and target_file_kind: null at medium confidence, matching the established treatment of other external specifiers such as node:fs.
  • Remaining proof gaps: none known.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • npx vitest run src/application/javascript/ src/domain/javascript/ — 62 files, 1129 tests passed (three consecutive runs).
  • npx vitest run src/application/javascript/JavaScriptModuleSpecifierPaths.test.ts — 31 passed; with the source fix stashed, the 2 new tests fail.
  • npx vitest run tests/boundary/filesystem/javascriptPackageExportTargets.test.ts tests/boundary/javascript/packageConditionalExports.test.ts tests/composition/javascript-applications/electronApplicationAnalysis.test.ts tests/acceptance/applications/electronPreloadOverridesCli.test.ts tests/acceptance/applications/packageSubpathsCli.test.ts — 5 files, 128 tests passed.
  • npm run check:fast — typecheck and lint passed.
  • Issue reproduction probe (Node + scripts/rea.mjs analyze-javascript-application) — Node: main.cjs exit 1 MODULE_NOT_FOUND, control.cjs exit 0 42; REA: require file URL external/null, ESM file URL and relative require still resolved to dep.cjs, coverage.status complete.

Compatibility, safety, and release

  • Breaking changes or migration steps: none for valid input; this corrects a wrong resolution result. Callers that consumed the false resolved outcome for CommonJS file-URL requires will now observe external with a null path.
  • Real Hopper/Ghidra, browser, or OS coverage: not applicable — static JavaScript source analysis only, no target execution or native provider involved. Node.js itself was executed as the loader control.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: none; resolution remains confined to the inventoried container and this change only removes an invented local link.

Review checklist

  • This PR addresses a concrete problem or an agreed enhancement.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2077 **Author:** [@rekcilyssup](https://github.com/rekcilyssup) **Created:** 10/12/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/commonjs-file-url-require` --- ### 📝 Commits (3) - [`72f7c97`](https://github.com/morluto/rea/commit/72f7c97a6d2b70272d90a78ea313d09a823d15cc) fix(javascript): keep CommonJS require file URLs unresolved - [`2875007`](https://github.com/morluto/rea/commit/28750073642b49b47f00794697cf6331bd3866e2) fix(javascript): reconcile CommonJS file URL resolution with main - [`7ea2769`](https://github.com/morluto/rea/commit/7ea27692e5de6caee516328cdd0e75c983dc5be9) test(javascript): consolidate CommonJS file URL public workflow coverage ### 📊 Changes **1 file changed** (+7 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `tests/acceptance/applications/packageSubpathsCli.test.ts` (+7 -0) </details> ### 📄 Description ## Summary `require("file:///dep.cjs")` was reported as a resolved dependency of the inventoried `dep.cjs` while Node rejects that exact string with `MODULE_NOT_FOUND`. The shared module-specifier resolver decoded file URLs before applying the declared CommonJS loader semantics, so the graph invented a local dependency the CommonJS loader never loads, under `coverage.status = complete`. Fixes #2057. ## Problem and expected behavior - Smallest trigger: a CommonJS source containing `require("file:///dep.cjs")` in a directory that also inventories `dep.cjs`. - Violated invariant: dependency evidence must match the loader that actually runs. Node's CommonJS loader does not decode `file:` strings, so a require edge must not resolve them to a local file. - Controls from the reported reproduction: `node main.cjs` exits 1 with `MODULE_NOT_FOUND`; `node control.cjs` (`require("./dep.cjs")`) exits 0 and prints `42`. - Expected: the declared string and its source range stay intact, with an explicit `external` outcome and no `resolved_path`, instead of a false resolved local file. ## Change and scope - In `contextualCandidate` (`src/application/javascript/JavaScriptArtifactPathResolution.ts`), file-URL decoding through `fileUrlPath` now applies only when `moduleKind !== "require"`. Under `require`, a declared `file:` URL returns `external` with a limitation that states Node's rejection. - Why this fits: it is the single shared resolver boundary where module specifiers are resolved, so both semantic module-link edges and static reference edges inherit the correction without downstream repairs. It mirrors the existing rule that already skips ESM percent-decoding for `require`. - Intentionally not included: no change to ESM `import` file URLs, `html-reference`/`url-reference` contexts, package `exports`/`main` target selection, or ordinary relative and bare require paths. No schema, CLI, or MCP contract change. ## Contract and boundary impact - Semantic owner and earliest changed stage: `application/javascript` static artifact path resolution for `module-specifier` context with `moduleKind = "require"`. - CLI and MCP/tool-catalog contract: none — result shape unchanged; only the values of `resolution_status` (`resolved` → `external`) and `resolved_path` (`dep.cjs` → `null`) for this specifier class. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: the declared specifier and source-range evidence are preserved; the unresolved outcome stays visible with an explicit limitation instead of a fabricated local link. - Process execution, authorization, cleanup, or containment impact: none. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none. ## Evidence and regression coverage - Tests added or updated: two tests in `src/application/javascript/JavaScriptModuleSpecifierPaths.test.ts` under `CommonJS file URL module specifiers` — a resolver-level test covering require file URL → `external`, ESM file URL → `resolved`, and relative require → `resolved`; and an end-to-end test that executes the fixture under real Node, then asserts the graph. - Base reproduction or other evidence: both new tests fail on base `7c207c79` when only the source fix is stashed (`2 failed | 29 passed`), and pass with the fix. The issue's own probe now prints `resolution_status external` with `resolved_path null` for `main.cjs`. - User-visible CLI/MCP output (if applicable): `analyze-javascript-application` edges for a CommonJS file-URL require now carry `resolution_status: "external"`, `resolved_path: null`, and `target_file_kind: null` at `medium` confidence, matching the established treatment of other external specifiers such as `node:fs`. - Remaining proof gaps: none known. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npx vitest run src/application/javascript/ src/domain/javascript/` — 62 files, 1129 tests passed (three consecutive runs). - `npx vitest run src/application/javascript/JavaScriptModuleSpecifierPaths.test.ts` — 31 passed; with the source fix stashed, the 2 new tests fail. - `npx vitest run tests/boundary/filesystem/javascriptPackageExportTargets.test.ts tests/boundary/javascript/packageConditionalExports.test.ts tests/composition/javascript-applications/electronApplicationAnalysis.test.ts tests/acceptance/applications/electronPreloadOverridesCli.test.ts tests/acceptance/applications/packageSubpathsCli.test.ts` — 5 files, 128 tests passed. - `npm run check:fast` — typecheck and lint passed. - Issue reproduction probe (Node + `scripts/rea.mjs analyze-javascript-application`) — Node: `main.cjs` exit 1 `MODULE_NOT_FOUND`, `control.cjs` exit 0 `42`; REA: require file URL `external`/`null`, ESM file URL and relative require still `resolved` to `dep.cjs`, `coverage.status` `complete`. ## Compatibility, safety, and release - Breaking changes or migration steps: none for valid input; this corrects a wrong resolution result. Callers that consumed the false `resolved` outcome for CommonJS file-URL requires will now observe `external` with a null path. - Real Hopper/Ghidra, browser, or OS coverage: not applicable — static JavaScript source analysis only, no target execution or native provider involved. Node.js itself was executed as the loader control. - Package or release metadata impact: none. - Security, privacy, process, or containment review: none; resolution remains confined to the inventoried container and this change only removes an invented local link. ## Review checklist - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-10-31 00:57:56 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#5006
No description provided.