[GH-ISSUE #1793] Unbound CommonJS require calls lack semantic module edges and report zero import relationships #601

New issue

Closed

opened 2026-10-15 18:26:32 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:26:32 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1793

Compiled REA on main ce845ba428e9b23d6b74eae1e25e17c37532adac omits the semantic module-to-module CommonJS relationship when the return value is not assigned. The separate static kind: "require" reference to a javascript-asset is retained. Both public CLI and real SDK stdio MCP reproduce it on Node 24.18.0 / Linux x64.

Create a directory containing these three files (101 bytes total):

// main.cjs
require("./dependency.cjs");

// imports.mjs
import "./dependency.cjs";

// dependency.cjs
throw new Error("fixture must not execute");

Run rea analyze-javascript-application <directory> --artifact-format directory --max-heap-mb 512 --analysis-timeout-ms 30000 --json, or call analyze_javascript_application with the same directory, format: "directory", max_heap_mb: 512, and analysis_timeout_ms: 30000.

Observed: the complete graph contains static kind: "require" and kind: "static-import" asset-reference edges. Filtering specifically for semantic module_link_kind relationships yields one ESM module-to-module edge from imports.mjs and zero module_link_kind: "require" edges from main.cjs. The main.cjs source-module observation reports import_relationships: 0. This is a semantic projection omission, not a claim that every dependency/reference edge is missing. Native createRequire(<main.cjs>).resolve("./dependency.cjs") selects the dependency without executing it. REA does not execute these files either. Complete CLI/MCP Evidence envelopes authenticate, normalized results match, and the MCP client can ping afterward.

Expected: retain the unbound static require semantic module relationship and correct source-module import count, including its caller-selected specifier, source digest/range, and resolved target. Imported/local/exported names can remain null because this use does not establish a binding.

Clarification after inspecting all edge representations: the initial issue title/description overstated this as absence of the dependency overall. Static asset references are present; the defect is the missing semantic relationship and count.

The omission originates in collectSemanticModuleLink: require collection is dispatched for variable declarators and CommonJS export assignments, but not for the call itself. Fixing the semantic owner should retain other unbound call contexts while preserving lexical shadowing and unknown dynamic arguments. Existing bound/destructured imports and direct CommonJS re-exports must not acquire duplicate dependency links; distinct nested calls must remain distinct.

Native Windows and real deep-analysis providers were not exercised; this reproduction uses the production static JavaScript CLI/MCP workflow. PR #1762 concerns package target selection after a link exists and is separate from this missing semantic relationship.

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1793 Compiled REA on main `ce845ba428e9b23d6b74eae1e25e17c37532adac` omits the semantic module-to-module CommonJS relationship when the return value is not assigned. The separate static `kind: "require"` reference to a `javascript-asset` is retained. Both public CLI and real SDK stdio MCP reproduce it on Node 24.18.0 / Linux x64. Create a directory containing these three files (101 bytes total): ```js // main.cjs require("./dependency.cjs"); ``` ```js // imports.mjs import "./dependency.cjs"; ``` ```js // dependency.cjs throw new Error("fixture must not execute"); ``` Run `rea analyze-javascript-application <directory> --artifact-format directory --max-heap-mb 512 --analysis-timeout-ms 30000 --json`, or call `analyze_javascript_application` with the same directory, `format: "directory"`, `max_heap_mb: 512`, and `analysis_timeout_ms: 30000`. Observed: the complete graph contains static `kind: "require"` and `kind: "static-import"` asset-reference edges. Filtering specifically for semantic `module_link_kind` relationships yields one ESM module-to-module edge from `imports.mjs` and zero `module_link_kind: "require"` edges from `main.cjs`. The `main.cjs` source-module observation reports `import_relationships: 0`. This is a semantic projection omission, not a claim that every dependency/reference edge is missing. Native `createRequire(<main.cjs>).resolve("./dependency.cjs")` selects the dependency without executing it. REA does not execute these files either. Complete CLI/MCP Evidence envelopes authenticate, normalized results match, and the MCP client can ping afterward. Expected: retain the unbound static require semantic module relationship and correct source-module import count, including its caller-selected specifier, source digest/range, and resolved target. Imported/local/exported names can remain null because this use does not establish a binding. Clarification after inspecting all edge representations: the initial issue title/description overstated this as absence of the dependency overall. Static asset references are present; the defect is the missing semantic relationship and count. The omission originates in `collectSemanticModuleLink`: require collection is dispatched for variable declarators and CommonJS export assignments, but not for the call itself. Fixing the semantic owner should retain other unbound call contexts while preserving lexical shadowing and unknown dynamic arguments. Existing bound/destructured imports and direct CommonJS re-exports must not acquire duplicate dependency links; distinct nested calls must remain distinct. Native Windows and real deep-analysis providers were not exercised; this reproduction uses the production static JavaScript CLI/MCP workflow. PR #1762 concerns package target selection after a link exists and is separate from this missing semantic relationship.

bsakaguchi

2026-10-15 18:26:32 +00:00