SC8006 mistakes shadowed parameters for builtin module patches

Chiusa
  • Qualcosa non va?
#2,919 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@MathurAditya724 ci sta già lavorando.

Dal 3/11/2026.

  • #2921 di @MathurAditya724 — aperta

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
22/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Ferma
Stack tecnologico
nodejs, typescript
Ambito
compilers

Direzione di ricerca

Start with the scanner state keyed by identifier text: builtinBindings, cjsBuiltinObjects, and createdRequires. Reproduce with the reduced annotate(data) example, which should raise SC8006 today. Done means the shadowed write stays native while a genuine data.sdkProcessingMetadata = 1 outside the function is still refused. Pull request #2921 is already open against this, so check it before starting.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

We are trying to compile the full Sentry CLI with scriptc while retaining its commands, SQLite fallback, and Ink/React UI. A fresh CommonJS bundle stops with SC8006 in Sentry SDK event-metadata code: scriptc treats a write through a local function parameter as a mutation of Node's path module.

The reduced example does not patch the builtin:

const data = require("node:path");
function annotate(data) {
  data.sdkProcessingMetadata = 1;
  return data.sdkProcessingMetadata;
}
console.log(annotate({}), typeof data.sdkProcessingMetadata);

Node 24.22.1 prints:

1 undefined

Building the same file with scriptc built from current main at the time of reproduction fails with SC8006, claiming that the entry module patches path.sdkProcessingMetadata. Replacing the first line with import data from "node:path" in an .mjs file reproduces the same refusal.

The parameter refers to the object passed to annotate. It shadows the imported builtin alias, and the builtin remains unchanged. The expected behavior is to keep this write native while preserving the refusal for a genuine write such as data.sdkProcessingMetadata = 1 outside the function.

The scanner currently keys builtinBindings, cjsBuiltinObjects, and createdRequires by identifier text across an entire module. Registering a parameter does not mask a same-named outer alias. Distinct local aliases can also overwrite one another's builtin identity. Removing the outer alias globally when encountering a parameter would hide genuine writes after the function, so the alias state needs to follow lexical bindings.

Regression coverage should include CommonJS and default-import aliases, parameters and local declarations, aliases created inside shadowed scopes, captured outer aliases, and genuine patches before and after an inner scope. Reads and patch forms such as Object.assign, Object.defineProperty, and delete should resolve the same binding. Recorded aliases of a createRequire result should also follow their lexical binding when captured or shadowed.

I checked existing issues and PRs before opening this. The overlapping scanner changes in #2592 and #2828 concern direct builtin reads and global-read tracking; neither addresses this alias-shadowing case. Fixing this refusal would remove one blocker from the CLI experiment, rather than establish that the full CLI compiles or runs correctly.

Lingua principale
TypeScript
Stelle
6.4k
Fork
204
Merge medio
7h 35m
PR unite (30g)
873

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di vercel-labs/scriptc

Tutte le issue di vercel-labs/scriptc

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.