[wunianze666-netizen]

Summary

Keep ambient require writes visible when a with block uses a quoted prototype setter in its unscopables object. Fixes #8943.

Problem and expected behavior

The Windows CLI resolved ./dep.cjs after a with block whose assignment can replace the outer loader. A quoted non-computed "__proto__" setter on Symbol.unscopables supplies an inherited truthy require entry. Its unquoted spelling already prevented that resolved link. A computed ["__proto__"] property still leaves the with binding available. ECMAScript object initializer evaluation, Object Environment Record lookup.

Change and scope

Use the shared object-literal prototype setter predicate for both literal checks in the with scope classifier. The existing conservative lookup preserves a possible outer loader write when the prototype is custom. The later call can then lose its resolved CommonJS dependency claim.

Follow the contribution scope.
Unresolved scope, authority, side effects, or required verification block
integration. Link the required maintainer scope decision for new providers or
capabilities involving target execution, injection, mutation, or protection
recovery; ordinary fixes within existing boundaries may state "not applicable".
Draft PRs may leave the scope decision pending and the readiness and merge checklists
unchecked. Maintainers can help resolve open questions.

Contract and boundary impact

• Semantic owner and earliest changed stage: The JavaScript semantic with-scope lookup reuses the AST property owner to classify prototype setters before loader assignment analysis.
• Contribution scope fit and linked maintainer decision: Existing static CommonJS dependency inference.
• CLI and MCP/tool-catalog contract: No schema change. The same graph relation reflects the corrected loader provenance.
• Provider, bridge, target-format, or platform compatibility: Static analysis of non-strict CommonJS source. No external engine or runtime evaluation is required.
• Evidence, artifact, provenance, or reconstruction contract: The false resolved require relationship is absent. The existing dynamic-scope uncertainty and local evidence identities are carried by the analysis.
• Target selection, authority, upstream behavior, and cleanup details (if applicable): Reads the same fixture files through the existing source worker.
• Generated metadata (docs/public/product-catalog.json), package, or installation impact (CI generates and validates ignored catalogs and skills/; edit authored instructions in .agents/skills/reverse-engineer-anything/ and never commit build outputs): None.

Expected effects (check known effects; use documentation-only on its own).
Unchecked items do not establish absence; leave uncertainties visible.

• Read existing files or captured data.
• Launch or attach to a process.
• Inject instrumentation or run scripts/code.
• Change process memory, registers, files, or configuration.
• Contact network services.
• Recover protected code or work around protections.
• Documentation or usability only; no target interaction.
• Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

• Tests added or updated: Five semantic tests cover quoted and unquoted setters, own true and false entries, and the computed-key control.
• Base reproduction or other evidence: Windows Node 24.22.1 and the preceding compiled runtime reproduced the reported false resolved edge only for the quoted setter. The semantic classifier, shared property predicate, and loader origin code match frozen main 71f680d. The five CLI inputs were parsed with no parse failures.
• User-visible CLI/MCP output (if applicable): Quoted and unquoted setter cases and the own true case omit the semantic require edge. Own false and the computed key still resolve dep.cjs.
• Remaining proof gaps: The local evidence uses synthetic CommonJS fixtures. REA read the files statically. The runtime comparison comes from the issue report. Hosted validation is listed below.

For boundary fixes, identify the applicable boundary regressions
and lifecycle regressions
covered by the evidence above, and explain relevant gaps.

For evidence-bearing changes:

• Observed, derived, and inferred claims remain distinguishable.
• Artifact identity, source provenance, and failed attempts remain preserved.
• Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

• build:cached succeeded. The same five Windows CLI fixtures passed after rebuilding. The actual named MCP tool matched the selected CLI edges for all five and passed its advertised input and output schemas with Ajv.
• All 38 focused require-link tests passed.
• check:fast, touched-file formatting, and git diff --check passed.
• Upstream CI 41946167173, attempt 1 passed for 3733bb662. Its merge checkout 3089f24d has the same tree as the PR head. Linux Source tests passed all 38 require-link cases, including the five new unscopables fixtures. The workflow recorded 18 successes and 22 conditional skips. The hosted Windows capability/package lane was skipped.

Compatibility, safety, and release

• Breaking changes or migration steps: None.
• Real Hopper/Ghidra, browser, or OS coverage: Windows compiled CLI and actual stdio MCP.
• Package or release metadata impact: None.
• Security, privacy, process, or containment review: Static source inference only.

Author readiness

Human owner: @wunianze666-netizen

• I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
• I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
• I declare this PR ready for initial maintainer review.

Before merge

• This PR addresses a concrete problem or an agreed enhancement.
• Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
• The PR has one focused outcome and the title follows type(scope): outcome.
• Related issue is linked, or the reason for not linking one is stated above.
• Tests cover changed observable behavior and meaningful failure paths.
• Owning docs, contracts, and generated metadata are updated where needed.
• User-visible CLI/MCP changes include representative output.
• I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The code appears safe to merge; no actionable defects were found.

Summary

The PR fixes how static JavaScript analysis treats quoted "__proto__" setters inside Symbol.unscopables.

• Quoted prototype setters no longer create false require links after with blocks.

_{Reviews (1) · Last reviewed commit: "fix(javascript): preserve require writes..." · Reviewed by Greptile}