fix(supply-chain): detect indirect CommonJS loaders

[seonghobae]

Closes #289.

Problem

The packed-bundle authority verifier uses a TypeScript AST to reject executable module lookup/loading authority without raw-text false positives. Its statically recognizable CommonJS coverage was incomplete across indirect loaders, resolver authority, require.main.require(...), .call(...), .apply(...), built-in Reflect.apply(...), and standard Function.prototype.bind(...) compositions. Any missed form can leave runtime dependency lookup/loading authority in an artifact expected to be self-contained.

Exact TDD lineage

Indirect CommonJS loaders

• RED — 2d6cee41ecb7eb5bce9574eff96de7060886cfdf: exposed (0, require)(...), require.call(...), and module.require(...) misses.
• GREEN — f616d0d776f4a186b4ecd52784fc142189e71690: bounded syntax-only recognition for those loader forms.

Direct CommonJS resolver authority

• RED — dc3d47b1bb818ec0592619c5c6ee73e8da09a8c6: exposed require.resolve(...) / require['resolve'](...) misses while preserving ordinary-object negative controls.
• GREEN — 7a13161d3afc4dade60854f067d8b5c758b053bf: recognizes resolver access rooted at the CommonJS loader.

Indirect CommonJS resolver authority

• RED — a4152db03576f2e886b4b14613800a4ce430f4b4: exposed comma- and .call-indirected resolver forms. Exact-head CI 31766755958 reached the intended package-verifier failure after setup/typecheck/tests/100% owned-production coverage/library build; Security Scan 31766755977 and SAST Semgrep 31766755945 succeeded.
• GREEN — 2193959432099d418e471d9b02683fff9e7112d6: syntax-only parentheses/comma-RHS/static .call handling without alias or receiver evaluation.

require.main CommonJS loader authority

• RED — 1a78422433df7f2329ac6dc5ad2eb34b380b2aac: exposed require.main.require(...), element access, .call, and computed-specifier forms. Exact-head CI 31768669536 reached the intended package-verifier failure after setup/typecheck/tests/100% owned-production coverage/library build; Security Scan 31768669375 and SAST Semgrep 31768669549 succeeded.
• GREEN — d2b52eca59f8b11def3e8714b8841538da6a8419: recognizes statically named main rooted at a recognized CommonJS loader while leaving ordinary object.main.require(...) benign.

CommonJS .apply authority

• RED — 0f3f1d06a2ad0961f2bc7b4e7293c8d9c854d04a: added require.apply(...), module['require']['apply'](...), require.main.require.apply(...), resolver .apply, computed payload controls, and ordinary-object negative controls. Exact-head CI 31782543705 passed immutable setup, typecheck, 143 test files / 827 tests, 100% aggregate owned-production statement/branch/function/line coverage, and library build before packed-package verification failed at the new regression.
• GREEN — 9dc017e787e6d4e3d49416141a39937325a3129d: recognizes statically named .apply / ['apply'] only when its receiver is already a recognized CommonJS loader or resolver. Static array payloads expose only the first package argument; unknown/computed/missing payloads remain authority with specifier: undefined.

Built-in Reflect.apply CommonJS authority

• RED — b5a18634b2ee88a7798d82d228cdf4f88cf04ef7: added Reflect.apply(require, ...), element-access Reflect['apply'], module.require, require.main.require, require.resolve, computed payload controls, and ordinary-object negative controls. Exact-head CI 31788362835 passed immutable setup, typecheck, repository 100% coverage and library build before failing at packed-package verification.
• GREEN — ff3459f48a5884e4894d742a949336d6b3ebce36: recognizes only statically written Reflect.apply / Reflect['apply'] whose target is already a recognized CommonJS loader/resolver; it does not resolve aliases, arbitrary receivers, computed member names, or executable values.

Composed bound CommonJS authority

• RED — b7be216922681c33765a18696b36da2998880faa: added require.bind(...).call(...), bound module.require through .apply, bound require.main.require through Reflect.apply, resolver equivalents, computed-package evidence, and ordinary-object negative controls. Exact-head CI 31881118310 reached the intended packed-package failure after immutable install, typecheck, 144 test files / 828 tests, repository 100% statement/branch/function/line coverage, and library build; the new authority test expected five findings and observed none.
• GREEN source — da16556a0e4d85d2ca8998f8b4527f58c1d7bc78: recognizes a statically written .bind only when its target is already recognized loader/resolver authority, preserves an explicitly prebound package argument ahead of later call/apply payloads, and composes that bounded syntax through .call, .apply, and Reflect.apply. Computed prebound arguments remain specifier: undefined; no alias, receiver, property, or caller code is evaluated.
• Standards doctoring — 8f907dbb91da22ce47e39bf9346b8e494fb65db9: adds docs/doctoring/commonjs-runtime-authority.md, explicitly labeled active-PR evidence, grounded in current Node.js CommonJS documentation and ECMA-262 2026 semantics for bound functions and reflective application.

Current scanner contract

The verifier reports static imports/re-exports, dynamic import(...), bare/parenthesized/comma-indirected require, recognized CommonJS loader/resolver authority under direct invocation, .call, .apply, built-in Reflect.apply, module.require, require.main.require, require.resolve, and statically composed .bind forms whose bound target is already recognized authority. Literal package specifiers remain actionable; computed or missing specifiers remain undefined rather than receiving invented meaning. Comments, strings, template text, ordinary object methods merely named require/resolve, arbitrary aliases, arbitrary receivers, and computed member names remain non-findings. Invalid emitted JavaScript fails closed.

Exact-head evidence

Current exact head: 8f907dbb91da22ce47e39bf9346b8e494fb65db9.

• CI 31881479808: completed / success on this exact head. Build-and-test passed immutable installation, typecheck, repository 100% coverage, library build, packed-package consumers, and demo build. Cross-engine Playwright and Office Python 3.11–3.14 also completed successfully on the same run.
• Security Scan 31881479815: queued / non-passing at the latest exact-head refresh.
• SAST Semgrep 31881479830: queued / non-passing at the latest exact-head refresh.
• Formal reviews: 0.
• Unresolved inline review threads: 0.
• GitHub currently reports the PR mergeable, but it intentionally remains Draft.

The independently refetched protected base remains exact main@e8109ec2a17de8bd6594487aa12c8c8a93cb2c03; exact ancestry is 19 commits ahead / 0 behind with that SHA as merge base. Any head/base movement invalidates this evidence generation.

Integration boundary

Keep this PR Draft and unmerged while #118 owns exact v0.6.0 publication from unchanged protected main and while live review/required-workflow policy remains unsatisfied. Live organization policy requires one qualifying independent approval, approval after the last push by another actor, resolved review threads, and the applicable central required workflows. This change hardens deterministic package/release evidence only; it adds no runtime module loader, filesystem, network, credential, persistence, deployment, model, or release authority.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 94ad6c6d-7657-49dc-b823-a28785284425

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}