feat: validate num_modules/byte_count for esm-chunked candidates - #343
Merged
bash0816 merged 11 commits intoAug 30, 2026
Conversation
Add runtime validation of num_modules and byte_count from the discoverModuleGraph result against audited values to detect potential binary corruption or version mismatches early in the native package validation flow. Co-Authored-By: Claude Haiku 4.5 <[email protected]>
- Extract validateEsmChunkedOffsets, validateLegacyCjsOffsets, validateOffsets, and verifyTarball to native-validators.js - Parameterize version argument to enable testability - Add native-validators.test.js with 3 test cases covering normal and error cases - All existing tests (bunfs-extract.test.js: 11 tests) continue to pass Co-Authored-By: Claude Sonnet 5 <[email protected]>
Co-Authored-By: Claude Sonnet 5 <[email protected]>
- Consolidate 3 separate integration tests into 1 unified test to avoid register() hook accumulation issues - Test validates: normal /$bunfs/root/ resolution, path traversal rejection, and missing module errors - Add bunfs-esm-loader.test.js and native-validators.test.js to CI Co-Authored-By: Claude Sonnet 5 <[email protected]>
…sign - Add analyzeCycleHoists and discoverCycleHoists functions to audit cycle-breaking patterns - Modify discoverOffsets to load cycle_hoists data from binary analysis - Implement data-driven hoisting in bunfs-esm-loader.mjs to support multiple cycles - Add __bunfsAssertHoistedProps helper to detect evaluation-order regressions - Update cycle_hoists field in both config JSON files for versions 2.1.245 and 2.1.248 - Add comprehensive test coverage for cycle hoisting logic - Integrate cycle_hoists into termux-run-claude-native.sh register() calls This change moves from a hardcoded single-cycle fix (O9/chunk-y0jj307t.js) to a generic, data-driven design that can handle arbitrary module graph cycles, improving maintainability and reducing brittleness for future versions. Co-Authored-By: Claude Sonnet 5 <[email protected]>
…ks() to fix hang on cycle_hoists Changes: - Convert resolve() and load() functions from async to sync - Add caller origin gate (fromChunk) to restrict child_process/vm/ws redirects - Replace module.register() with module.registerHooks() for synchronous in-process hooks - Update Node.js version requirement to >=22.15.0 <23.0.0 || >=23.5.0 - Add Node.js version check in bin/claude - Improve load() format detection (ESM vs CommonJS) Co-Authored-By: Claude Sonnet 5 <[email protected]>
The prior commit (66f26b6) added a regex-based commonjs/module format detector to load() to work around a failing integration test. Verified against a real 2.1.248 extraction (1768 chunk files) that PROCESS_OWNED_DIR never contains genuine CommonJS files (0 use module.exports without import/export syntax) - the failure was caused by the test's synthetic foo.js fixture using module.exports, not a real production case. Reverted load() to always return format: 'module' and fixed the fixture to use ESM syntax instead. Co-Authored-By: Claude Sonnet 5 <[email protected]>
…locker) The second esmChunkedMain() bootstrap path (used when CLAUDE_TERMUX_STDIN=inherit, i.e. TUI/interactive sessions) still destructured `register` from node:module while calling the undefined `registerHooks(...)`, causing a ReferenceError not reachable via the default -p smoke test path. Found by G3 review (terra). Fixed the destructure to match the first path and verified both paths (-p default and CLAUDE_TERMUX_STDIN=inherit) succeed on 2.1.248 and 2.1.245. Co-Authored-By: Claude Sonnet 5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add runtime validation of
num_modulesandbyte_countfrom thediscoverModuleGraphresult against audited values invalidateEsmChunkedOffsets(). This detects potential binary corruption or version mismatches early in the native package validation flow.The new checks:
audited.num_modulesmatchesgraph.numModulesif definedaudited.byte_countmatchesgraph.byteCountif definedBoth checks throw descriptive errors with expected vs. actual values on mismatch.
Test plan
node --check prepare-native.jspassesbunfs-extract.jssource