[PR #4401] [CLOSED] fix(reference): retain static template require dependencies #6214

Closed
opened 2026-10-31 01:12:44 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4401
Author: @shreyans-chowdry
Created: 10/16/2026
Status: ❌ Closed

Base: main ← Head: fix/reference-static-template-requires


📝 Commits (1)

  • e02981b fix(reference): retain static template require dependencies

📊 Changes

3 files changed (+102 additions, -15 deletions)

View changed files

📝 src/domain/referenceSourceImportParsing.ts (+7 -14)
➕ tests/boundary/cli/referenceSourceTemplateRequire.test.ts (+94 -0)
📝 tests/boundary/filesystem/referenceSourceComputedRequire.test.ts (+1 -1)

📄 Description

Summary

Fixes #4382. Historical-source imports now retain CommonJS dependencies written as expression-free templates, including cooked escapes, through the existing exact-literal reader.

Problem and expected behavior

require("./dep.cjs") produced a dependency, while require(`./dep.cjs`) silently disappeared. Both spellings provide the same exact string and should produce the same requires relationship and resolution.

Change and scope

Reuse readExactJavaScriptLiteral in the historical-source specifier producer and remove the redundant string/call admission gate. The existing loader-binding checks and application resolver remain the owners of loader identity and path resolution. Replace an existing test's now-supported static template with a genuinely computed template, and add a compiled CLI regression.

Ordinary static-analysis fix within existing boundaries; a separate maintainer scope decision is not applicable. This is distinct from merged #2842, which changed captured-browser/source-map producers, not historical-source imports. The ImportExpression branch is unchanged.

Contract and boundary impact

  • Semantic owner and earliest changed stage: src/domain/referenceSourceImportParsing.ts, before application graph resolution.
  • Contribution scope fit and linked maintainer decision: existing static source inspection; not applicable.
  • CLI and MCP/tool-catalog contract: no schema or tool changes; historical-source graphs retain previously omitted relationships.
  • Provider, bridge, target-format, or platform compatibility: no provider/bridge changes; existing JavaScript/TypeScript literal semantics are reused.
  • Evidence, artifact, provenance, or reconstruction contract: existing relationship kinds and source hashes are preserved.
  • Target selection, authority, upstream behavior, and cleanup: unchanged source reading and loader-binding rules; source text is not executed.
  • Generated metadata, package, or installation impact: none.

Expected effects:

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Executed base reproduction at 2c7583599b9ac1c847bd77b1940930fd8d4594c7: the new compiled CLI test failed with 3 relationships instead of 7. The four missing relationships come from static templates, including an escaped path and require.resolve.
  • With the fix, that same test passes. It also checks external modules, unchanged source SHA-256 hashes, and negative controls for computed/tagged templates, shadowed/reassigned loaders, and unbound ESM require. Computed dynamic imports retain their unknown/partial relationship.
  • Representative CLI graph entry: { "from_path": "template.cjs", "to": "dep.cjs", "kind": "requires", "resolution": "internal", "parse_state": "parsed" }.
  • An additional local source-parser probe confirmed that non-string arguments remain ignored, template dynamic imports retain existing unknown/partial behavior, and invalid static ESM template declarations still report parse failures.
  • Remaining proof gaps: macOS arm64 only; no independent MCP run, Linux/Windows execution, or full deterministic suite. The CLI regression follows the existing Windows skip because reference-source no-follow reads are unsupported there. No native analysis provider is needed for this fix.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Node 24.18.0 / npm 11.16.0, macOS arm64:

  • npm ci — passed.
  • npm run test:focused -- tests/boundary/cli/referenceSourceTemplateRequire.test.ts tests/boundary/filesystem/referenceSourceComputedRequire.test.ts tests/boundary/filesystem/referenceSourceDynamicImports.test.ts tests/boundary/filesystem/referenceSourceShadowedRequire.test.ts tests/boundary/cli/referenceSourceDirectoryImports.test.ts — 8 tests passed across 5 files; compiled runtime built successfully.
  • npm run verify:test-discovery — all 1,415 test files discovered exactly once.
  • npm run check — passed typecheck, lint, formatting, unused-code checks, metadata checks, module boundaries, and architecture guards. Lint reported 0 errors and 1,563 warnings across the repository.
  • git diff --check — passed.

Compatibility, safety, and release

  • Breaking changes or migration steps: none; graphs gain supported dependency relationships.
  • Real Hopper/Ghidra, browser, or OS coverage: no native/browser provider involved; compiled CLI and filesystem boundaries exercised on macOS arm64.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: no new target-execution, network, or mutation authority. Caller-selected source bytes and their hashes remain intact.

Author readiness

Human owner: @shreyans-chowdry

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4401 **Author:** [@shreyans-chowdry](https://github.com/shreyans-chowdry) **Created:** 10/16/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/reference-static-template-requires` --- ### 📝 Commits (1) - [`e02981b`](https://github.com/morluto/rea/commit/e02981b2a4e07b432f39997ffcb1d6a27bbc3417) fix(reference): retain static template require dependencies ### 📊 Changes **3 files changed** (+102 additions, -15 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/referenceSourceImportParsing.ts` (+7 -14) ➕ `tests/boundary/cli/referenceSourceTemplateRequire.test.ts` (+94 -0) 📝 `tests/boundary/filesystem/referenceSourceComputedRequire.test.ts` (+1 -1) </details> ### 📄 Description ## Summary Fixes #4382. Historical-source imports now retain CommonJS dependencies written as expression-free templates, including cooked escapes, through the existing exact-literal reader. ## Problem and expected behavior `require("./dep.cjs")` produced a dependency, while ``require(`./dep.cjs`)`` silently disappeared. Both spellings provide the same exact string and should produce the same `requires` relationship and resolution. ## Change and scope Reuse `readExactJavaScriptLiteral` in the historical-source specifier producer and remove the redundant string/call admission gate. The existing loader-binding checks and application resolver remain the owners of loader identity and path resolution. Replace an existing test's now-supported static template with a genuinely computed template, and add a compiled CLI regression. Ordinary static-analysis fix within existing boundaries; a separate maintainer scope decision is not applicable. This is distinct from merged #2842, which changed captured-browser/source-map producers, not historical-source imports. The `ImportExpression` branch is unchanged. ## Contract and boundary impact - Semantic owner and earliest changed stage: `src/domain/referenceSourceImportParsing.ts`, before application graph resolution. - Contribution scope fit and linked maintainer decision: existing static source inspection; not applicable. - CLI and MCP/tool-catalog contract: no schema or tool changes; historical-source graphs retain previously omitted relationships. - Provider, bridge, target-format, or platform compatibility: no provider/bridge changes; existing JavaScript/TypeScript literal semantics are reused. - Evidence, artifact, provenance, or reconstruction contract: existing relationship kinds and source hashes are preserved. - Target selection, authority, upstream behavior, and cleanup: unchanged source reading and loader-binding rules; source text is not executed. - Generated metadata, package, or installation impact: none. Expected effects: - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Executed base reproduction at `2c7583599b9ac1c847bd77b1940930fd8d4594c7`: the new compiled CLI test failed with 3 relationships instead of 7. The four missing relationships come from static templates, including an escaped path and `require.resolve`. - With the fix, that same test passes. It also checks external modules, unchanged source SHA-256 hashes, and negative controls for computed/tagged templates, shadowed/reassigned loaders, and unbound ESM `require`. Computed dynamic imports retain their unknown/partial relationship. - Representative CLI graph entry: `{ "from_path": "template.cjs", "to": "dep.cjs", "kind": "requires", "resolution": "internal", "parse_state": "parsed" }`. - An additional local source-parser probe confirmed that non-string arguments remain ignored, template dynamic imports retain existing unknown/partial behavior, and invalid static ESM template declarations still report parse failures. - Remaining proof gaps: macOS arm64 only; no independent MCP run, Linux/Windows execution, or full deterministic suite. The CLI regression follows the existing Windows skip because reference-source no-follow reads are unsupported there. No native analysis provider is needed for this fix. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed Node 24.18.0 / npm 11.16.0, macOS arm64: - `npm ci` — passed. - `npm run test:focused -- tests/boundary/cli/referenceSourceTemplateRequire.test.ts tests/boundary/filesystem/referenceSourceComputedRequire.test.ts tests/boundary/filesystem/referenceSourceDynamicImports.test.ts tests/boundary/filesystem/referenceSourceShadowedRequire.test.ts tests/boundary/cli/referenceSourceDirectoryImports.test.ts` — 8 tests passed across 5 files; compiled runtime built successfully. - `npm run verify:test-discovery` — all 1,415 test files discovered exactly once. - `npm run check` — passed typecheck, lint, formatting, unused-code checks, metadata checks, module boundaries, and architecture guards. Lint reported 0 errors and 1,563 warnings across the repository. - `git diff --check` — passed. ## Compatibility, safety, and release - Breaking changes or migration steps: none; graphs gain supported dependency relationships. - Real Hopper/Ghidra, browser, or OS coverage: no native/browser provider involved; compiled CLI and filesystem boundaries exercised on macOS arm64. - Package or release metadata impact: none. - Security, privacy, process, or containment review: no new target-execution, network, or mutation authority. Caller-selected source bytes and their hashes remain intact. ## Author readiness Human owner: @shreyans-chowdry - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-10-31 01:12:44 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#6214
No description provided.