feat(require-profiler-plugin): add package rollup, require chains and duplicate detection

[V3RON]

Description

Stacked on #453. Base is claude/require-profiler-refactor-7nu8nb, so the diff shown here is only the analysis views. GitHub will retarget this to main automatically once #453 merges.

The profiler could show what ran and how long it took. These three views answer the questions you actually act on afterwards.

• Package rollup. A "Group by" control switches the top-modules table between modules and npm packages — the granularity dependency decisions are actually made at. One row reading lodash — 340ms across 87 modules is actionable where 87 four-millisecond rows are not.
• Require chains. Selecting a module shows the chain that pulled it in, root-first and clickable. This is the question every profiling session ends on, and previously it was answerable only by reading ancestors off the flame graph by eye.
• Duplicate detection. Flags packages evaluated from more than one install location. A duplicated dependency costs evaluation time and bundle bytes twice, and with a stateful library two live copies can break behaviour outright.

A fourth view, bundle coverage, was built and then removed — see the last commit and the note at the end of Context.

Related Issue

Follows up #452, which #453 closes.

Context

On two numbers per package, not one. Summing value across a package's modules would double-count, because a parent's value already contains its children's. So each package reports two separately well-defined figures: selfTime (Σ of member self times — exactly additive, since self times partition total time) and inclusiveTime (Σ of value over entry nodes only, where an entry is a member with no same-package ancestor at any depth, tracked with an open-ancestor count during the walk). A package nested inside itself, or entered at several points in the tree, is counted once rather than compounded by its own descendants. There is a test for exactly this: lodash → src/glue.ts → lodash must report inclusiveTime: 100, not 140.

On package-name parsing. The last node_modules segment wins, so a nested copy resolves to the inner package — the copy actually evaluated. Matching is on whole path segments, so a directory like my_node_modules_helper never false-positives. Scoped packages take two segments.

On the require-chain lookup. Breadth-first with parent pointers rather than a depth-first walk carrying an ancestor array: BFS order makes the shallowest occurrence the first one found and gives a stable tie-break between equally shallow matches, and the parent pointers reconstruct the chain without copying an array at every node. occurrences counts every evaluation of the module across the whole tree, not just those on the returned path.

On the bundle coverage tab, and why it is gone. It read Metro's module registry on demand and ranked packages by how many of their modules had not been evaluated yet. The read itself works — getModules() and isInitialized are real and correct — but the number cannot support the decision the tab invited:

• It is not reproducible. React Native sets inlineRequires: true by default, so a module is evaluated the first time its binding is used — during a render, on navigation, on a tap. Coverage therefore climbs the longer you use the app before opening the tab. Two people on the same commit get different numbers and different rankings, with nothing to say which is right. The tab's caveat copy admitted the snapshot was a moment in time, but a disclaimer does not make a ranking stable.
• It cannot isolate the signal worth having. Metro does not tree shake, so genuinely dead imports really do ride along in the bundle. From a single registry read, those are indistinguishable from a module that is merely lazy and has not been reached yet.
• The call to action does not exist on this platform. import() compiles to asyncRequire, which calls require.importAll against the same bundle unless __loadBundleAsync is installed (Re.Pack, or a lazy serializer). In a stock app, moving a package behind a dynamic import on this evidence removes zero bytes and zero startup time — the deferral it would buy is exactly what the row already reports.
• It is the wrong axis for this plugin. A require profiler's unit is milliseconds, and an unevaluated module costs zero by definition. Its real cost is bytes, which the tab neither measured nor could measure — it counted modules as a proxy. The top rows of a startup-time tool were the things costing nothing.

Removed with it: the getBundleModules polyfill reader, its two wire messages and types, and the registry-wide duplicate detection. The evaluated-set duplicate detection stays — two live copies of a stateful library is a real finding, measured off real evaluations.

On reuse. findDuplicatePackages takes a plain iterable of module paths rather than a require tree, so any caller with paths to hand reuses the grouping logic without reimplementing path parsing.

Testing

From the repository root after git fetch origin main:

• pnpm checks:affected — 90 tasks green; pnpm format:all clean across 1320 files.
• pnpm test:affected — 51 tasks green.
• pnpm --filter @rozenite/require-profiler-plugin test — 55 tests across 6 files.

Coverage:

• src/ui/analysis/__tests__/packages.test.ts — path parsing (plain, scoped, nested copy resolving to the inner package, the my_node_modules_helper false positive, trailing node_modules/, empty string, leading ./); the double-counting guard; a package entered at two points; a module evaluated twice counting once toward moduleCount; ordering; duplicate detection including application code never being reported and repeated input paths not manufacturing a false positive.
• src/ui/analysis/__tests__/require-path.test.ts — full root-first chain with correct depths, target as root, absent module, null root, shallowest-wins across differing depths, occurrences counted off the returned path, deterministic tie-break.

Not done: none of this has been exercised against a running device — no simulator was available in this environment, so the require-chain breadcrumb and the duplicate alert are verified by types, unit tests and reasoning rather than seen.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
rozenite	Skipped		Aug 24, 2026 5:48pm