fix(js,ts): `require('./x').default` reaches an ES module's default export by colbymchenry · Pull Request #2433 · colbymchenry/codegraph

colbymchenry · 2026-10-07T13:03:03Z

Summary

extractJSImports maps const X = require('./x').default (and const { default: X } = require('./x')) as { exportedName: 'default', isDefault: false }, so findExportedSymbol looks only for a named export called default. That is right for a CommonJS module that sets the property itself. A module written as an ES module (export default class Foo) has no named default, though, so every reference through the binding stayed unresolved or fell to name matching.

bitwarden's desktop app is the reported case. main-biometrics.service.ts:51-52 and os-biometrics-mac.service.spec.ts:105 load export default class OsBiometricsServiceMac with require("./os-biometrics-mac.service").default and new it, and both instantiates refs stayed failed.

#2412 fixed the ESM sibling (import { default as X }) by mapping it as the default import. The require form can't be mapped that way, because .default there is a property of module.exports:

an ESM-compiled module sets it to its default export;
a CommonJS module can set it by name (exports.default = fn, module.exports.default = X);
the dual export module.exports = X; module.exports.default = X sets it to X.

Change

The named property is still looked up first. When findExportedSymbolWalk finds no named default, it falls back to the module's ESM default export, under three gates:

JS family only (ESM_IMPORT_LANGUAGES). Python's from .mod import default is untouched.
Only the module the require names (depth === 0). export * from never forwards a default, so the walk through a wildcard re-export doesn't take one.
Only when that module has an ESM default export at all: it is a single-file component, or has an export default statement. A CommonJS module's anonymous exports.x = function () {} is flagged exported, so without this gate the first-exported-function guess would invent a default for a module that has none. That is the express normalizeType bug class from fix(js): resolve calls through CommonJS require bindings #2189.

The ESM default lookup itself (component, then the export default NAME binding, then the first exported function or class) is factored into esmDefaultExport and shared with the isDefault branch, so require('./x').default and import X from './x' land on the same declaration.

layoutComponent (frameworks/react.ts) tries context.resolveImport first. A require(…).default layout now resolves there, to the declaration its module read (lazyRouteComponent) found before. Its isDefault || exportedName === 'default' branch stays as the fallback for when import resolution finds nothing. After #2412, that branch's second half is reached only by the require forms.

Other readers of isDefault are unchanged. jsx-render's zero-candidate fallback, expo-modules, tier-synthesizer and react-router-synthesizer read the mapping flag, not findExportedSymbol. topcoder's two require('../shared').default sites feed only JSX tags (<Application />), which go through jsx-render by name, so that repo is byte-identical.

Validation

Fresh codegraph init -y indexes, scripts/dump-graph.mjs before/after, native kernel staged in both arms. The arms are main 19f91e2 and this branch's fix commit, and only dist/resolution/import-resolver.js differs between them. The main commits merged in since (#2413, #2416, #2417, #2419, #2425, #2426) don't touch import-resolver.ts, and their resolver hunks are gated to Go, C++ and sync-time navigation.

repo	edges	notes
bitwarden/clients	+2 / −0	the two `failed` refs now `instantiates` `OsBiometricsServiceMac` via `import`
facebook/react-native	+872 / −617	details below
express, eslint, mocha, koa, body-parser (#2189's CommonJS set)	byte-identical
fastify (dual export, `{ default: fastify } = require('../../fastify')`)	byte-identical	the named `default` already found `fastify`
topcoder community-app	byte-identical	require-default sites feed JSX tags only
proshop_mern, next-saas-starter, create-t3-turbo (controls)	byte-identical

React Native's Libraries have 238 require(…).default loads:

All 617 removed edges are re-resolved at the same call site (0 lost):
- 541 moved from the local const X = require(…).default binding to the real function or class;
- 47 moved off a namesake method in another package (JSTimers.setInterval → an rn-tester test's method, Animated.delay → IntersectionObserver.delay, Keyboard.dismiss → a dev-server handler) onto the right module. That is the method itself for Keyboard.dismiss. For JSTimers and Animated it is the exported value, whose members are chosen at run time;
- 28 keep the same target and gain import metadata;
- 1 moved from the log(…) signature in a Flow type to the log implementation.
Added edges, checked against each target file's export default statement:
- 834 land on the declared default or a member inside it;
- 36 land on module functions an object-literal facade lists (ExceptionsManager.handleException) or on methods of the class a new instance has (Keyboard.dismiss);
- 2 (BatchedBridge.registerCallableModule / registerLazyCallableModule) land on the right methods but in the deprecated types_DEPRECATED/modules/BatchedBridge.d.ts declare class MessageQueue rather than MessageQueue.js. That is the existing instance-member type lookup, which import BatchedBridge from gets too.
The 255 net-new edges match the 255 refs that left unresolved_refs.

Dead-code reports (bitwarden, react-native): no claims lost or gained.

Known limitations, both shared with `import X from` and filed as follow-ups

First-export guess. The ESM default lookup falls back to the first exported function or class when the default is written export default class Foo / export default function foo. So a module that exports a helper above its default class resolves to the helper, for an ESM default import today and now for require(…).default too. Repro on main: export function helper() above export default class Foo, and import Foo from './x'; new Foo() instantiates helper. A scan found the shape in 7 react-native, 4 topcoder and 1 bitwarden file. None of them is a require(…).default target in this corpus, so no edge above depends on it. The fix (reading the declaration forms in defaultExportBinding) changes ESM default imports everywhere and needs its own validation.
Sync retry. When a required module only later gains its export default, codegraph sync leaves the waiting ref failed while a fresh index links it. The failed-ref retry keys on the names the changed files declare, and a default binding's local name (X) is not the declaration's (Foo). import Y from './x' behaves the same way on main.

Test plan

__tests__/require-default.test.ts (new, 8 tests):
- an ESM-compiled .default and { default: X } (bitwarden's shape), and a Svelte component, are red on main and green with the fix;
- CommonJS exports.default = fn beside an anonymous exports.pad = function (the first-export guess would pick pad), the dual export, a CommonJS module with no default, export * from, and Python from .mod import default are green on both.
Mutations: dropping the depth gate fails the export * test; dropping the export default gate fails the no-default CommonJS test and the require-binding summary. Dropping the language gate changes nothing, because the target-file check already excludes Python; the Python test pins the behavior.
tsc --noEmit, npm run build, kernel rebuilt after merging main
Full suite, run in parallel before merging main, on a box at 100% CPU (other sessions' suites, about 60–145 node processes): 6347 passed, 153 failed in 69 files. 148 were timeouts, 3 EBUSY temp-dir cleanups and 2 daemon assertions (mcp-daemon, mcp-writer-lock).
- After merging main, the 26 JS/TS resolution files, which include every JS/TS-related file among those 69, were rerun serially with long timeouts: 1281 of 1282 passed.
- The one left is a Python case, function-ref Caller/impact graph misses methods passed as first-class references (callbacks), e.g. executor.submit(obj.method, …) #1820 "a module global never binds through a shadow". It hits its own 60 s in-file limit even alone, and passes with the limit raised (219 s on this box).
- The other 56 failed files (sync/git/daemon/MCP/WAL, and C/C++, Go, PHP, Dart, CFML, Java, Kotlin, Scala, Terraform, Nix and Laravel resolution) were not rerun. The new branch only runs for a JS-family named-default lookup, and none of their fixtures has a require(…).default.

🤖 Generated with Claude Code

…xport `const X = require('./x').default` and `const { default: X } = require('./x')` map to a named import of `default`. That is right for a CommonJS module that sets the property itself (`exports.default = fn`, or the dual `module.exports = X; module.exports.default = X`), but a module written as an ES module and compiled to CommonJS sets it to its default export, which is no named export. References through the binding stayed unresolved (bitwarden's `new OsBiometricsServiceMac(...)`) or fell to name matching: the local variable holding the module, or a namesake method in another package. findExportedSymbolWalk now falls back to the module's ESM default export when the named lookup finds no `default`. Only for JS-family refs, only in the module the require names (`export * from` forwards no default), and only when that module has an ESM default export at all: a single-file component, or an `export default` statement. A CommonJS module's `exports.x = function` declarations are flagged exported, so without that gate the first-exported-function guess would invent a default for it. bitwarden +2 edges (the two failed `instantiates` refs). react-native +872 -617: all 617 re-resolved at the same site (541 from the local require binding to the real function or class, 47 from a namesake method in another package to the right module, 28 metadata only, 1 from a type signature to the implementation), 870 of 872 added edges on the declared default or what it holds. express, eslint, mocha, koa, body-parser, fastify, topcoder, proshop_mern, next-saas-starter and create-t3-turbo byte-identical. Dead-code claims unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…dbaf37

…he first exported function (#2432) A default import resolved to the module's first exported function or component whenever the `export default` statement wrote a declaration (`export default function Vans()`, `export default class Store`): only a separate `export default NAME` statement was read. A React Router 6.4+ data-router page exports its `loader` or `action` above the page component, so `import Vans, { loader as vansLoader } from './Vans'` bound the route `/vans` (and every call through `Vans`) to `loader`. The resolver now reads the file's own `export default` statement from comment-stripped code. A declaration it writes is found by position, a binding it names by name, and an anonymous function, class or arrow function is no node at all (the guess took an exported function beside it, or one nested inside it). The statement also beats an exported styled/memo component above it. Every line-initial statement is read and the first one that names a node of the file wins, so template text that only reads like a statement names nothing. Strings are not masked: a masker loses step on a template whose `${…}` holds another template or a regex with a backtick, and on outline it blanked the real statement below one. Only an expression default (`memo(Card)`, `new Service()`), a binding the file doesn't declare, or no statement keeps the old guess. `require('./x').default` (#2433) reads the same statement first, so it reaches the declared default too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…eceivers (#430) * fix(context): call paths label synthesized hops like explore, not as events (colbymchenry#2428) Two surfaces label a synthesized (dynamic-dispatch) `calls` hop: codegraph_explore's Flow and dynamic-dispatch links plus the codegraph_node trail (`dynamic: interface → impl @file:line`), and ContextBuilder's "## Call paths", which `codegraph context` prints (`→[…]`). Each kept its own list. The call paths' list stopped at callback, react-render, jsx-render, vue-handler, http-client, queue-job and socket messages, so every other synthesizer fell through to `event ${m.event ?? ''}`: an interface-impl hop read `→[event @src/pdf-exporter.ts:5]`, and so did a C++ override, a redux thunk, a gin middleware chain or a closure collection. The wording now lives once, in src/graph/synthesized-hop.ts (`describeSynthesizedHop`: a summary, the detail only the call paths print, and the wiring site), as AGENTS.md asks of a derivation two surfaces render. ToolHandler renders `dynamic: <summary> @site`, the call paths `<summary><detail> @site`. Explore and the node trail print exactly what they printed before; the call paths keep their wording for the kinds they already labelled, including the queue name, a socket's direction and the HTTP clause, and now name the rest the way explore does. A bus event reads `bus event` there too, and the section's footnote no longer says hops are marked `[callback/event …]`. The helper also holds the wording colbymchenry#2414 gives a Go method a struct gets by embedding (`metadata.promotedInto`), so that arm moves here too. The unused long `label` form of ToolHandler.synthEdgeNote (last read by the removed codegraph_trace) is dropped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(sync): a route rendering a same-file lazy value follows its module, and a new component gets its JSX edges (colbymchenry#2452) A route that renders `const Docs = lazy(() => import('./pages/Docs'))` binds to the component that module exports, and to the declaration while the module is missing or exports none (colbymchenry#2400's declaredComponent). The reference had resolved, so no failed-ref retry saw it, and CG-33's rebind reached it only when the module's component shared the declaration's name: a sync that added the module, gave it its default export or moved that export left the route on its old answer. A data router's `lazy` route kept a moved default export the same way. FrameworkResolver.lazyModules names the modules a route's answer reads, including the files a barrel forwards it through (colbymchenry#2436); React implements it for lazy-import references and the same-file lazy values Pattern 1 reads. After the CG-33 rebind, sync puts back the route references whose modules it added or changed (reopenRouteModuleReaders), in the order their edges were written, for the orphan sweep. The jsx-render refresh read only each changed file's own content, so a new component without JSX of its own never got the edge from `<Team />` in an unchanged file. A sync whose definition delta holds a JSX-renderable node now refreshes synthesis. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cpp): a range-based for loop's variable has the type the loop declares (colbymchenry#2439) C++ receiver inference read a declaration only when the declared name was followed by `;`, `=`, `,`, `)`, `[`, `{` or `(`, so a range-based for's `Type name :` was never read. In protocolbuffers/protobuf's conformance runner, `suite->SetVerbose(…)`, `suite->RunSuite(…)` and `suite->GetFailureListFlagName()` inside `for (ConformanceTestSuite *suite : suites)` fell through to Strategy 3's guess by the receiver's name, and in RocksDB `log->file()` on a `log::Writer` loop variable went to `BlobLogWriter::file`. A line the declarator regex doesn't match is now read as a range-based for when its `for (` header declares the receiver before a single `:` (not `::`), and the loop's variable is taken only when the call is inside the loop's body: past the header, up to the `}` closing a braced body or the end of a single-statement body, with comments and literals skipped. After the loop, or in a later function, the same name is another variable, and the scan goes on as before. A loop over `auto` elements has nothing to read and keeps the existing fallback. Bit-fields and the scope operator are never read as a loop's declaration. A loop's declaration is recorded like any other (colbymchenry#2413's noteCppDeclaration), so the std-type gate applies to `for (const std::string& s : …)` too, and a loop that doesn't enclose the call still marks the receiver as shadowed. With colbymchenry#2421, the 13 conformance runner calls reach ConformanceTestSuite's methods at 0.9. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(js,ts): a default import is what `export default` declares, not the first exported function (colbymchenry#2432) A default import resolved to the module's first exported function or component whenever the `export default` statement wrote a declaration (`export default function Vans()`, `export default class Store`): only a separate `export default NAME` statement was read. A React Router 6.4+ data-router page exports its `loader` or `action` above the page component, so `import Vans, { loader as vansLoader } from './Vans'` bound the route `/vans` (and every call through `Vans`) to `loader`. The resolver now reads the file's own `export default` statement from comment-stripped code. A declaration it writes is found by position, a binding it names by name, and an anonymous function, class or arrow function is no node at all (the guess took an exported function beside it, or one nested inside it). The statement also beats an exported styled/memo component above it. Every line-initial statement is read and the first one that names a node of the file wins, so template text that only reads like a statement names nothing. Strings are not masked: a masker loses step on a template whose `${…}` holds another template or a regex with a backtick, and on outline it blanked the real statement below one. Only an expression default (`memo(Card)`, `new Service()`), a binding the file doesn't declare, or no statement keeps the old guess. `require('./x').default` (colbymchenry#2433) reads the same statement first, so it reaches the declared default too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cpp): a `->` call on a smart pointer or optional reaches the type it holds (colbymchenry#2440) A C++ call made with `->` on a receiver the calling function or its class declares as a `std::unique_ptr<T>`, `std::shared_ptr<T>` or `std::optional<T>` now resolves on `T`: on the class C++ name lookup finds for it where the call is written, or on a class that class derives from. Before, receiver inference read the type as `unique_ptr`, found no method, and the call fell through to the guess by method name: rocksdb's `std::unique_ptr<Iterator> iter; iter->Valid()` reached `ArenaWrappedDBIter::Valid`. The held type goes through colbymchenry#2407's lookup (`cppClassWritten`, extracted from `matchCppSupertype`), not `resolveMethodOnType` on its last name: rocksdb has 22 classes named `Iterator`, and the one the calls mean inherits its methods from `IteratorBase`, so a last-name lookup reaches `MemTableRep::Iterator`. The method is taken from that class or its bases through the class's own extends edges (`getSupertypeNodes`). A template parameter, a library type or an alias of one gets no edge; a type the project doesn't declare, or an alias the lookup can't follow, leaves the call as it was. The namespace-macro helpers move from name-matcher.ts to cpp-namespaces.ts unchanged, so name-matcher can import cpp-supertypes without a cycle. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(sync): a barrel edited to forward another page moves the routes that lazily load it --------- Co-authored-by: Colby Mchenry <me@colbymchenry.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…ed default (#2481) #2432 made a default import read the module's own `export default` statement, and its merge pointed #2433's `require('./x').default` fallback (esmDefaultExport) at the same reading. Nothing in the suite pinned that path with a guessable helper above the default: #2433's fixture keeps its helper unexported. Two cases: - React Native's AnimatedColor shape, an exported helper above `export default class AnimatedColor`, loaded with `require("./AnimatedColor").default` and `const { default: Color } = require("./AnimatedColor")`. With the first-exported guess both `new` calls instantiate the helper. - `export default abstract class Repository` below an exported `connect()`, extended by `class Users extends Repository`. With the guess the `extends` edge is missing. Both fail with e47cb25's resolver (before #2432). On main, putting the guess back on the require path fails only the first, and dropping `abstract` from the declaration pattern fails only the second. The CHANGELOG's default-import bullet now says `require('./x').default` is read the same way. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

colbymchenry and others added 2 commits October 7, 2026 05:54

Merge remote-tracking branch 'origin/main' into claude/bold-sinoussi-…

78211fa

…dbaf37

colbymchenry mentioned this pull request Oct 7, 2026

fix(react): a JSX tag renders what the file imports under that name #2451

Open

colbymchenry added 2 commits October 7, 2026 09:44

Merge remote-tracking branch 'origin/main' into claude/bold-sinoussi-…

af948ad

…dbaf37

Merge remote-tracking branch 'origin/main' into claude/bold-sinoussi-…

7af8b43

…dbaf37

colbymchenry merged commit 9a1d4bd into main Oct 7, 2026

colbymchenry deleted the claude/bold-sinoussi-dbaf37 branch October 10, 2026 06:15

colbymchenry mentioned this pull request Oct 10, 2026

test(js,ts): pin require().default and abstract classes to the declared default #2481

Merged

Navigation Menu

Repository navigation

fix(js,ts): `require('./x').default` reaches an ES module's default export - #2433

fix(js,ts): `require('./x').default` reaches an ES module's default export#2433
colbymchenry merged 4 commits into
mainfrom
claude/bold-sinoussi-dbaf37

colbymchenry commented Oct 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

colbymchenry commented Oct 7, 2026

Summary

Change

Validation

Known limitations, both shared with import X from and filed as follow-ups

Test plan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Known limitations, both shared with `import X from` and filed as follow-ups