Repository navigation
id(world_compile): check_imports matches the literal 'import ' prefix — a double space or tab imports an ungranted platform module #2095
Description
Summary
check_imports in pkgs/id/src/world_compile.rs — the only gate that keeps a compile request from importing platform modules the world was not granted — matches imports with the literal prefix "import " (exactly one ASCII space). Roc's parser accepts other whitespace between import and the module path, so an ungranted import written with two spaces or a tab passes the gate and compiles.
Evidence (verified this run, main bd880194; world_compile.rs sha256 11b5c8afaecdb8ddcd23e796cc588908b9cc39506485c87d8961617cecc0d583)
The gate, world_compile.rs:118-144:
:121—line.trim_start().strip_prefix("import "): a tab afterimportmakes the prefix miss, so the line is skipped entirely.:124-127— with two spaces,reststarts with a space andsplit(whitespace | '[' | '{' | '(').next()yields the empty string, so the path examined is""and no segment is ever checked.
compile() stages the whole platform (copy_platform, world_compile.rs:~227), so every platform module is resolvable by the compiler; this line scan is the sole grant enforcement before the compiler runs.
Verbatim-logic probe (laptop, ~/git/fleet/probe-2026-10-28-laneB-importws/probe_import.rs, modules [Key, Screen], granted []):
import pf.Screen→ refused: "main.roc imports Screen, which this world does not allow" (control)import pf.Screen(two spaces) → Okimport<TAB>pf.Screen→ Ok- leading-tab + single space, and
import pf.Screen exposing [x]→ refused (those paths work) - sibling file
Helper.rocwithimport pf.Key→ Ok (the sibling-smuggle test atworld_compile.rs:1281only covers the single-space form)
Roc acceptance probe (laptop roc fmt, same probe dir): both the double-space and tab forms parse and are normalized by the formatter to import pf.Screen (exit 0). Checked and NOT a bypass: import pf . Screen passes the gate but Roc rejects it (incomplete_import parse error), so spaced dots are out of scope.
Why it matters
Platform modules are the world's capabilities (Screen, Key, …). The grant list is the effective intersection of world grants with server/world ceilings (see compile() docs, world_compile.rs:188-204). A world author who was granted nothing — or whose ceiling excludes a module — can use it anyway by changing one space to two, silently defeating the ceiling the operator configured. The existing tests (an_ungranted_platform_import_is_refused_by_name, a_sibling_file_cannot_smuggle_an_ungranted_import) pin only the canonical single-space spelling.
Acceptance criteria
check_importsrecognizes an import regardless of the whitespace Roc accepts betweenimportand the path (at minimum: multiple spaces, a tab), inmain.rocand in sibling files.- Regression tests: the double-space and tab spellings of an ungranted platform import are refused by name, mirroring the existing single-space tests; the granted and
*cases still pass for those spellings. - No false refusals: comment lines (
# import pf.Screen), non-platform imports, andexposing [...]forms keep their current behavior. - Token-based parsing (first token
import, second token the path) or an equivalent whitespace-flexible scan is fine; matching Roc's exact grammar is not required beyond the whitespace class.
Activity
developing-today commentedon Oct 29, 2026
CODE-1006
dezren39 commentedon Oct 29, 2026
🤖 Agent note · filed
31 remaining items
dezren39 commentedon Nov 1, 2026
🤖 Agent note · parked
cargo test --lib world_compilein/home/user/git/fleet/5183/pkgs/id; result is not yet verified./home/user/.local/share/opencode/shell/7c77335d64f274eda14617ff1d9e59c351817dd6/sh_1a1960e8b0b001j6iP3XMFp9tC.out, then review PR and checks before merging. Parked 20 minutes.dezren39 commentedon Nov 1, 2026
🤖 Agent note · picked up (resume)
Merge pull request #3392 from developing-today/queue/5183-2095-check-…
dezren39 commentedon Nov 1, 2026
🤖 Agent note · done — PR #3392 merged
importand the path), closing the double-space/tab bypass of the platform grant gate.cargo test --lib world_compile— 27 passed, 0 failed, exit 0, including both new regression tests by name (an_ungranted_platform_import_with_extra_whitespace_is_refused_by_name; a_sibling_file_cannot_smuggle_an_ungranted_import_with_extra_whitespace) and all pre-existing gate tests. Codex review on a5ec5fe: completed, zero findings. This repo runs no PR CI (commit status pending with zero statuses), per the standing pattern.