depsRoot in packages/webrun-modules/src/deps/proxy.ts returns "" when an importer id matches neither ~/… nor {name}@{version}/…:
return importerId.match(/^((?:@[^/]+\/)?[^/]+@[^/]+)\//)?.[1] ?? "";
Unreachable today — that regex is the same one loadRaw uses as its accept guard, and every proxyId caller runs on an id loadRaw already accepted. But the failure mode if it ever fired is worse than a thrown error:
proxyId would yield ~deps/react/index.js with no leading root segment. That id does not contain /~deps/, and both routing guards test exactly that substring — walk.ts's incremental-skip and new-module-server.ts's 404 guard. So the proxy would be walked as if it were a real module and served as a 500 rather than a 404, with no indication of the real cause.
Prefer throwing (or asserting) over the silent "", so a future relaxation of loadRaw's accepted id forms surfaces immediately.
Lower priority, same file: ctx.proxies entries are shared mutable objects — mergeProxyShape mutates the object every caller can read via ctx.proxies.get(pid). No live bug, since current call sites only read it synchronously to build a string, but a future reader that retains .imp.names could corrupt the accumulator. A defensive copy on read would close it.
🤖 Filed with Claude Code
depsRootinpackages/webrun-modules/src/deps/proxy.tsreturns""when an importer id matches neither~/…nor{name}@{version}/…:Unreachable today — that regex is the same one
loadRawuses as its accept guard, and everyproxyIdcaller runs on an idloadRawalready accepted. But the failure mode if it ever fired is worse than a thrown error:proxyIdwould yield~deps/react/index.jswith no leading root segment. That id does not contain/~deps/, and both routing guards test exactly that substring —walk.ts's incremental-skip andnew-module-server.ts's 404 guard. So the proxy would be walked as if it were a real module and served as a 500 rather than a 404, with no indication of the real cause.Prefer throwing (or asserting) over the silent
"", so a future relaxation ofloadRaw's accepted id forms surfaces immediately.Lower priority, same file:
ctx.proxiesentries are shared mutable objects —mergeProxyShapemutates the object every caller can read viactx.proxies.get(pid). No live bug, since current call sites only read it synchronously to build a string, but a future reader that retains.imp.namescould corrupt the accumulator. A defensive copy on read would close it.🤖 Filed with Claude Code