SC8006 mistakes shadowed parameters for builtin module patches

クローズ
  • 何か問題がありますか？
#2,919 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@MathurAditya724 がすでに取り組んでいます。

2026年11月3日 から。

  • #2921 @MathurAditya724 による — オープン

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
22/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
停滞
技術スタック
nodejs, typescript
領域
compilers

調査の方向性

Start with the scanner state keyed by identifier text: builtinBindings, cjsBuiltinObjects, and createdRequires. Reproduce with the reduced annotate(data) example, which should raise SC8006 today. Done means the shadowed write stays native while a genuine data.sdkProcessingMetadata = 1 outside the function is still refused. Pull request #2921 is already open against this, so check it before starting.

索引モデルが issue の本文から書いたものです。

説明

We are trying to compile the full Sentry CLI with scriptc while retaining its commands, SQLite fallback, and Ink/React UI. A fresh CommonJS bundle stops with SC8006 in Sentry SDK event-metadata code: scriptc treats a write through a local function parameter as a mutation of Node's path module.

The reduced example does not patch the builtin:

const data = require("node:path");
function annotate(data) {
  data.sdkProcessingMetadata = 1;
  return data.sdkProcessingMetadata;
}
console.log(annotate({}), typeof data.sdkProcessingMetadata);

Node 24.22.1 prints:

1 undefined

Building the same file with scriptc built from current main at the time of reproduction fails with SC8006, claiming that the entry module patches path.sdkProcessingMetadata. Replacing the first line with import data from "node:path" in an .mjs file reproduces the same refusal.

The parameter refers to the object passed to annotate. It shadows the imported builtin alias, and the builtin remains unchanged. The expected behavior is to keep this write native while preserving the refusal for a genuine write such as data.sdkProcessingMetadata = 1 outside the function.

The scanner currently keys builtinBindings, cjsBuiltinObjects, and createdRequires by identifier text across an entire module. Registering a parameter does not mask a same-named outer alias. Distinct local aliases can also overwrite one another's builtin identity. Removing the outer alias globally when encountering a parameter would hide genuine writes after the function, so the alias state needs to follow lexical bindings.

Regression coverage should include CommonJS and default-import aliases, parameters and local declarations, aliases created inside shadowed scopes, captured outer aliases, and genuine patches before and after an inner scope. Reads and patch forms such as Object.assign, Object.defineProperty, and delete should resolve the same binding. Recorded aliases of a createRequire result should also follow their lexical binding when captured or shadowed.

I checked existing issues and PRs before opening this. The overlapping scanner changes in #2592 and #2828 concern direct builtin reads and global-read tracking; neither addresses this alias-shadowing case. Fixing this refusal would remove one blocker from the CLI experiment, rather than establish that the full CLI compiles or runs correctly.

主要言語
TypeScript
スター
6.4k
フォーク
204
平均マージ
7時間 35分
マージ済み PR（30日）
873

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

vercel-labs/scriptc のほかの issue

vercel-labs/scriptc の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。