Bug hunt ledger: npm #302

Mikola Lysenko (mikolalysenko) · 2026-09-30T14:23:09Z

Mikola Lysenko (mikolalysenko)
Sep 30, 2026
Maintainer

[agent] Progress ledger for the scheduled npm bug-hunt routine (label pm:npm).

Last updated: 2026-10-09T18Z (run 37 with a ledger), main 9ab72d4 (main was force-updated and now carries the v5.0.0 release commit 6c01c7f; adds #1211 (fixes #1195), #1034 (one target grammar for get / remove / rollback), #1277 (shared BOM helper for .npmrc and package.json workspace readers), #1262 (VEX stage + rename writer), #1245 (shared vendored revert step)). main's history is grafted, so bisects use worktree builds of named commits. Latest published release on npm is v4.0.0 (previous v3.3.0). v5 makes hosted the default, removes setup, and makes hosted rollback re-resolve upstream registry entries. Cells marked (v4) were last verified on f6b7fb9. Fixed issues whose old fail marks below are now historical: #432 (#813), #798 (#799), #852 (#987), #884 (#901), #1071 (#1073), #900 (#970), #933 (#934), #1094 (#1095), #1195 (#1211), and via #1008 #433, #554, #688, #711, #753, #812, #828, #879, #899, #969. Still open and reproducing: #1266 and #1232 (both re-checked on 9ab72d4), #1196, #1233, #1155 (draft fix #1187), #1097 (extglob). Run 37 filed nothing new; an interrupted vendored → hosted takeover reproduces #1157 (wontfix) on npm.

Coverage matrix

Cells are "pass", "fail #N" or "untested". Every cell uses a real npm install. Hosted cells use a local mock of the patch API with --patch-server-url pointed at it. Agent and vendored cells use the same mock or a hand-staged .socket/. "Cycle" means scan → fresh npm ci → vex → rollback byte-exact. "Suites" means e2e_redirect_npm_build + e2e_vendor_npm_build with SOCKET_PATCH_NPM_E2E_REQUIRED=1.

OS	npm	Agent (apply / scan --mode agent)	Vendored	Hosted (v5 default)	Global `-g` (scan report / get+apply / vex / rollback)
Linux	6.14.18	fail #356 (v4), #732 (human `scan --mode agent` re-scan after `npm ci` leaves files unpatched). pass: `-g` (v4)	pass: nested v2 lock (v4). v1 lock refused loudly (documented). fixed #432 (alias mirror; regression follow-up #879), #659 (hosted→vendored takeover via `scan`/`get` on a v1 lock un-hosts, then refuses; `vendor` eject rolls back)	pass: v1-lock hosted scan on v5 main `9ab72d4` (EINTEGRITY warning, npm 6 `npm ci` fails closed, npm 10 `npm ci` patched incl. alias, `vex`, byte-exact rollback), shrinkwrap-only v1 cycle. v1 alias: not wired (#432)	pass (v4)
Linux	7.0.15 / 7.24.2	pass: scan/apply, vex, `npm ci` → vex refuses, re-apply, rollback	pass: cycle + `--omit=dev`, workspaces, vendored↔hosted takeover, revert byte-exact	pass: cycle (alias, nested, dev), workspaces, takeovers. fail #753 (copy nested under a `hasShrinkwrap` dep installs unpatched)	pass: all four (7.24.2, custom prefix)
Linux	8.19.4	fail #356 (v4). #403 / #516 closed by fixes	fixed #432 (see #879), #588 (same-lock unwired copy), #665, #688. pass: alias takeover, cycle + `--omit=dev`, workspaces, takeovers, rescan no-op	pass: `peer: true` lock-entry cycle, nested v2 cycle, shrinkwrap-only, workspaces, takeovers, rescan no-op, `overrides` (flat, alias, nested). fixed #432 (alias mirror, npm 6 consumer), #490 (override over a git spec; closed by #491, not re-checked), #588 (`--no-verify`), #753 (`hasShrinkwrap` nested copy)	pass: all four (custom prefix)
Linux	9.2.0 / 9.9.4	pass: 9.2.0 `install-links=true` `file:` dir dep cycle; `-g` (v4); Node 18 cycle	pass: 9.2.0 `install-links` `file:` dep cycle, cycle + `--omit=dev` (main), Node 18 cycle	pass: 9.2.0 `install-links` `file:` dep cycle, cycle (alias, nested, dev), Node 18 cycle. fail #753	pass (v4)
Linux	10.9.9	pass: plain cycle (alias still #356)	pass: cycle, `overrides` + `file:` dependent. fail #1155 (10.9.4 / 8.19.4 / 12.2.0: an npm upgrade or downgrade of a vendored package is drift-kept forever; also when the new version has its own patch)	pass: cycle, `overrides`, shrinkwrapped `file:` tarball dep; `--max-new-patches 0` on fully pinned plain / v1 / alias / nested / dual lock (ALREADY). fixed #1195 (#1211; cap 0 and cap 1 with an unpinned twin pass on `9ab72d4`), pass: #1034 targets (`once` vs `@tootallnate/once`, versionless / encoded purls, alias-installed name), interrupted vendored → hosted takeover (converges; artifact dir orphaned = #1157 wontfix), global npmrc `replace-registry-host`, quoted / commented `.npmrc` values, #1196 (CRLF `.npmrc` without a final newline)	untested
Linux	10.8.2 (Node 18) / 10.9.x	fail #1266 (linked workspace member alias link: path-scoped `scan` / `rollback` skip it). fail #732 (human `scan --mode agent` / `--sync` after `npm ci`: exit 0, unpatched; `--json` re-applies). pass: Node 18 cycle. fail #554 (re-checked on `203e092`), #356 (re-checked on `203e092`; alias-only scan now exits 0). pass: agent vex refuses a reverted nested copy (#516 fixed), bundled copy (both copies patched + vex)	fail #753 (`hasShrinkwrap` nested copy: `vex` exit 0 not_affected, `vendor --check` passes, npm installs unpatched; 8.19.4 too). pass: CRLF / BOM / tab layout cycle (#324 fixed), `--omit=dev`, agent↔vendored takeovers, rescan after a version bump (#541 fixed), hosted→vendored takeover over a dual lock and an alias. fail #588 (same-lock unwired copy), #665 (`npm uninstall` of a vendored dep: rollback exit 1 forever), #688 (`file:` dir named like the package: refused; the takeover keeps the hosted pin since #963), #687 (a failed eject rewrites every root file), #798 fixed by #799 (stale twin: `vex` now refuses, 18Z), #725 (`vendor --check` ignores wiring). pass: `peer: true` lock entry. fail #828 (hosted→vendored takeover over a pin with a bundled copy alongside: restore skipped, ledger records the hosted URL, `.npmrc` kept, revert lands on hosted; 8.19.4 / 12.2.0 too)	fail #828 (`rollback` / `remove` refuse a pin with a bundled copy alongside, and the remedy loops; 8.19.4 / 12.2.0 too). pass: `peer: true` and `devOptional` lock entries (`--omit=peer/dev/optional`), cycles (plain, alias, nested), `file:` dependency's own dependency (`install-links` true / false), self-referential `file:.` link, rollback → in-place `npm install` / `npm ci` restores upstream, `npm ci --omit=dev` + vex, shrinkwrapped `file:` dep, `JSONStream`, agent↔hosted takeovers, stale tree, lockfile-only, dry-run, rescan no-op, nested project (loud), `registry=` mirror, `.npmrc` variants, `overrides` (incl. `$ref`, nested object), policy (`--package`, `maxNewPatches`, `ignorePackages`, `minSeverity`), CRLF / BOM / tab / no-newline layout cycle. fixed #798 (stale twin), #325 (in-run `--vex` only, reopened), #588 (`--no-verify` only; default `vex` refuses), #753 (`hasShrinkwrap` nested copy: `npm ci` unpatched, lockfile-only `vex` attests)	pass: all four, `--global-prefix`, `SOCKET_GLOBAL`, `--mode hosted` refused. fail #464 (report-only hint has no `-g`)
Linux	11.20 / 11.21 / 11.6.2	pass (v4); linked `.store` scoped transitive (11.21, #359 fixed). fail #403 (v4)	pass (v4). #490 (11.21; closed by #491, not re-checked). fail #753 (11.6.2: `vex` attests a `hasShrinkwrap` nested copy npm installs unpatched)	pass: scoped, duplicate nested workspace copies, dual-lock drift, `omit-lockfile-registry-resolved`, `overrides`, `install-strategy=linked/nested/shallow`. fail #753 (11.6.2)	pass: all four (11.6.2, custom prefix)
Linux	12.1 / 12.2.0	fail #1266 (12.2.0). pass: hosted alias cycle, linked workspace vendored cycle (`a80b89e`). fail #356, #554 (12.2.0), #732 (12.2.0). `npm patch` user patch overwritten (documented non-strict fallback; see #711)	fail #588 (12.2.0), #665, #688 (12.2.0 / Node 24). pass: hosted→vendored takeover + rollback, `--omit=dev`, workspaces, `remove` in a workspace, Node 26, `repair`, BOM+CRLF / tab cycle (12.2.0), `install-strategy=linked`, `overrides`. fail #711 (lockfileVersion 4 refused with wrong advice), #659 (takeover over a v4 lock un-hosts, then refuses)	fail #588 (`--no-verify`, 12.2.0). Fixed: #798 (stale package-lock twin; `vex` refuses since #799). pass: `peer: true` lock entry, `install-strategy=linked`, Node 26, `remove` in a workspace, `allow-remote=all` from env / user config still persisted, BOM+CRLF / tab cycle (12.2.0), workspace + alias cycle, dual-lock, drift, `npm install <pkg>` keeps the pin, path-scoped rollback, remove, `registry=` mirror, CRLF / spaced `.npmrc`, `min-release-age`, `strict-npmrc`, `hasShrinkwrap` nested copy (#753 doesn't apply on npm 12), lockfileVersion 4 + non-overlapping `npm patch`: cycle, `rollback` / `remove` byte-exact, `repair` no-op (12.2.0). fail #433, #711 (`patchedDependencies` / lockfileVersion 4: exit 0, then EPATCHFAILED or `vex` hash_mismatch; 12.1.0 + 12.2.0)	pass: all four
macOS	10.9.7	pass: linked `.store` apply/vex/rollback (main, #359 fixed). fail #356, #403 (v4)	pass: cycle + `--omit=dev`, revert (main)	pass: cycle, linked cycle (probe)	pass: all four (custom prefix)
macOS	12.1.0 / 12.2.0	pass: linked `.store` apply/vex/rollback (main, #359 fixed). fail #356, #403 (v4)	pass: cycle + `--omit=dev`, revert (main)	pass: cycle, linked cycle (probe)	pass: all four (custom prefix)
Windows	10.9.7	pass: linked `.store` apply/vex/rollback (main). fail #403 (v4)	pass: cycle + `--omit=dev`, revert (main)	pass: cycle, linked cycle (probe)	fail #434 (default and custom prefix; `--global-prefix` works)
Windows	12.1.0 / 12.2.0	pass: linked `.store` apply/vex/rollback (main). fail #356, #403 (v4)	pass: cycle + `--omit=dev`, revert (main)	pass: cycle, linked cycle (probe)	fail #434
Windows 2022	10.9.7 / 12.2.0	pass: linked `.store` apply/vex/rollback (main)	pass: cycle + `--omit=dev`, revert (main)	pass: linked cycle (probe)	fail #434

Run 37 (2026-10-09T18Z, main `9ab72d4`)

Re-triage: Path-scoped agent scan packages/a and rollback packages/a skip a workspace member's npm alias (lp@npm:left-pad) under install-strategy=linked, while its plain links are in scope (exit 0, success) #1266 and vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its socket-patch vendor remedy is a no-op #1232 still reproduce. Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195 verified fixed (Fix capped scan deferring contested npm pins (#1195) #1211).
pass: Use one package target grammar for get, remove, rollback and the UUID shortcut #1034 target grammar on npm (hosted / vendored rollback / remove / get with scoped, versionless, encoded, full-name-vs-last-segment, two-version names), Move BOM handling in 8 more files onto formats::text (#905) #1277 BOM .npmrc (npm 12.2.0) and BOM / BOM+CRLF workspace root package.json, Write the VEX document through the shared stage + rename writer (#1144) #1262 vex -O symlink / missing dir, killed takeover and killed dual-lock scan (vex refuses the half-pinned dual lock), npm 6 v1 lock on v5, global npmrc replace-registry-host, .npmrc quoting / inline comments versus npm config get.
Duplicate, not filed: an orphaned vendored artifact dir after a takeover killed post-journal (A vendored-to-hosted takeover interrupted after its commit journal is written leaves the vendored artifact directory behind for good: recovery finishes the files but not the deferred deletions, and no GC can reclaim it once the ledger is gone #1157, wontfix).

Run 36 (2026-10-09T12Z, main `a80b89e`)

fail Path-scoped agent scan packages/a and rollback packages/a skip a workspace member's npm alias (lp@npm:left-pad) under install-strategy=linked, while its plain links are in scope (exit 0, success) #1266 (new): an npm install-strategy=linked workspace member with "lp": "npm:left-pad@1.3.0". scan --mode agent packages/a selects only the member's plain-name links, so lp stays unpatched; rollback packages/a leaves lp patched. Both exit 0. npm 10.9.4 / 12.2.0 ×2. The hoisted nested-alias control passes. pnpm lead handed over.
vendor --check and vex misreport a crashed vendored run whose commit journal is pending, because only lock-taking commands replay it #809 commented: a SIGKILL after the vendored commit journal is written makes vendor --check fail vendor_ledger_missing with a VCS-restore remedy. repair replays and passes. .socket-stage-* siblings are left behind.
pass: npm 12 linked + allow-file=root (warns, EALLOWFILE as warned), allow-file=root with an overrides-only vendored dep (warns), npm 12 linked workspace vendored cycle + rollback, unicode / space / # path vendored cycle, npm 12 hosted alias cycle, path-scoped agent scan in a hoisted workspace (Agent-mode scan packages/<member> finds nothing in a pnpm workspace (exit 0), while rollback packages/<member> selects the same packages #778) and -g --global-prefix, hosted / vendored kill-recovery, and an immutable lock rolling back .npmrc too.
Re-triage: Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses #1196 and The #812 replace-registry-host warning misses a ${VAR} value in .npmrc: npm expands it to always, so every npm ci fails E404, while the hosted scan reports success with no warning #1233 still reproduce on a80b89e.

Run 35 (2026-10-09T06Z, main `f3c6313`)

Fix open npm issues #1008 fixes verified on Linux: npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688 (namesake file: dir skipped, registry copy vendored), Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 (npm 12.2.0 npm patch → hosted skips, npm ci OK), npm hosted and vendored modes rewrite a lock entry nested under a dependency that ships npm-shrinkwrap.json (hasShrinkwrap), so npm 7–11 install it unpatched while vendored VEX attests not_affected #753 (hasShrinkwrap nested copy skipped / refused), Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 (project / env / user layers warn), npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 (bundled-copy rollback byte-exact, takeover restores), Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 (npm 8 re-saved v2 lock: vex + vendor --check pass), npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899 (shrinkwrap-only warnings + vex omission), Vendored npm scan wires file: tarballs that npm ≥ 11.14 refuses under allow-file=root (transitive deps) or allow-file=none, so every npm ci fails EALLOWFILE while scan, vendor --check and vex report success with no warning #969 (allow-file=root workspace + alias: no false warning, npm 12 installs), Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 (nested tests/ roots skipped; shared copies patched everywhere).
fail vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its socket-patch vendor remedy is a no-op #1232 (pre-existing, 16106b1 same): vendored package + bundled duplicate → vendor --check "wiring missing: no lockfile … references" (false); vendor / re-scan / repair no-ops. npm 8.19.4 / 10.9.4 / 12.2.0.
fail The #812 replace-registry-host warning misses a ${VAR} value in .npmrc: npm expands it to always, so every npm ci fails E404, while the hosted scan reports success with no warning #1233 (Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 fix gap): replace-registry-host=${RRH} (project or user .npmrc) → no warning, npm ci E404 (npm 10.9.4).
Re-triage: Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195 and Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses #1196 still reproduce on f3c6313.

Run 34 (2026-10-09T00Z, main `16106b1`)

Re-triage: Hosted and vendored scans run from an npm workspace member that has a stray package-lock.json of its own rewrite that lock, which npm ignores, and report success while npm installs the unpatched package and VEX attests not_affected #1094 fixed by Fix npm workspace-member refusal skipped by a stray member lock (#1094) #1095 and closed (member stray package-lock.json / npm-shrinkwrap.json → redirect_workspace_lockfile_elsewhere, vendored refuses, vex exit 2). After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 still reproduces; commented with the upgraded-version-has-its-own-patch shape.
fail Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195 (first bad 4d06019, Decide whether a hosted patch is pinned through lockfile discovery alone #1058): a hosted pin plus an unpinned twin entry (npm install mz@npm:ms@2.1.2 after the scan, or a dual lock where only one lock is pinned) under --max-new-patches 0 / env / socket.yml → NEW + rollout_deferred, nothing rewired, vex remedy loops, npm ci unpatched copy. npm 8.19.4 / 10.9.4 / 12.2.0. ef48495 passes.
fail Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses #1196 (pre-existing, low): CRLF .npmrc without a final newline → …\nallow-remote=all\r.
pass: CRLF-majority mixed / BOM .npmrc append, CR-only .npmrc refused loudly, BOM and CRLF locks round-trip byte-exact (npm 10.9.4).

Run 33 (2026-10-08T18Z, main `c4235a2`)

Bun handover: npm install ms@2.1.3 over a vendored ms@2.1.2 (or a downgrade): vendor --check sends you to --prune, but prune, vendor --revert, remove and rollback all drift-keep the entry. fail After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 (npm 8.19.4 / 10.9.4 ×3 / 12.2.0). The npm uninstall control reverts (--json).
Make the vendored-to-hosted takeover atomic #1039: vendored → hosted takeover (pass), and its retraction when /patch/package answers pending_build / forbidden (dry and wet leave the tree byte-identical, exit 0): pass (npm 10.9.4).
Re-triage: Human scan --mode vendored --prune silently skips the vendored GC when no remaining package has a patch, so an npm uninstalled vendored entry is never reverted (exit 0), while --json reverts it and vendor --check keeps pointing at that same command #1127 still reproduces on c4235a2.

Run 32 (2026-10-08T12Z, main `e2d9633`)

npm uninstall of the only patched vendored dep, then human scan --mode vendored --prune: "No patches available", exit 0, nothing reverted; --json reverts it. fail Human scan --mode vendored --prune silently skips the vendored GC when no remaining package has a patch, so an npm uninstalled vendored entry is never reverted (exit 0), while --json reverts it and vendor --check keeps pointing at that same command #1127 (npm 10.9.4 ×3 incl. workspace member, 12.2.0). Control with a patched package left: pass.
Stop CI gates passing on missing paths, unverified agent patches and unreported hosted pins #1029 agent apply --check: plain, alias, linked .store (plain + alias), -g / --global-prefix, tests/ / hidden / build/ copies: pass (npm 10.9.4). Nonexistent --global-prefix → exit 2: pass.
Compare purls through one PurlKey type #1045: %40-scoped manifest key through apply / --check / vex / rollback by @ purl: pass. Stop CI gates passing on missing paths, unverified agent patches and unreported hosted pins #1029 hosted redirect.patches[] (would_pin, pinned, extglob member unpinned): pass. Decide vendored-entry liveness through one discovery verdict #1050 prune keeps live alias / nested-member entries and fails safe on a conflict-marker lock: pass.
Re-triage: Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 and vendor --revert with a lost vendor ledger tells you to "run socket-patch repair to re-adopt them into the ledger", but repair refuses because it never rebuilds the ledger, so the advice loops and the vendored npm packages can't be reverted #1072 still reproduce on e2d9633.

Run 31 (2026-10-08T06Z, main `ea09714`)

Extglob workspaces (packages/@(a|b), +(a|c), !(z)): npm links the member, but a hosted scan / get from it exits 0 with nothing pinned. fail Hosted scan from a yarn classic workspace member still pins nothing and exits 0 when the root's workspaces use a ! pattern (yarn 1 ignores it) or an extglob like packages/@(a|b) #1097 (yarn classic's issue; npm matrix commented) on Linux npm 7.24.2 / 8.19.4 / 10.9.4 / 12.2.0. Brace, class, packages/a/, ./packages/a and packages/** refuse: pass (Hosted scan/get from an npm workspace member still pins nothing and exits 0 when the root's workspaces glob uses braces or a character class (packages/{a,b}, packages/[a-c]), because the #884 refusal's matcher doesn't support them #1071 fixed).
A stray member npm-shrinkwrap.json: same as Hosted and vendored scans run from an npm workspace member that has a stray package-lock.json of its own rewrite that lock, which npm ignores, and report success while npm installs the unpatched package and VEX attests not_affected #1094 (commented; npm 10.9.4 / 12.2.0). Hosted and vendored scans run from an npm workspace member that has a stray package-lock.json of its own rewrite that lock, which npm ignores, and report success while npm installs the unpatched package and VEX attests not_affected #1094 still reproduces on ea09714.
Replace a superseded patch generation's wiring on re-pin and remove #1035: hosted / vendored remove / rollback by uuid and purl are byte-exact, and hosted A + agent B remove  / rollback  unpin A: pass (npm 10.9.4 / 12.2.0).
Guard .socket links and agent writes with one containment helper #1042: linked .socket: agent and hosted pass, vendored fails closed: pass (npm 10.9.4).
Decide which lockfile governs installs in one table #1044: shrinkwrap + package-lock dual lock (hosted + vendored), and a stray yarn / pnpm lock (hosted pins package-lock, vendored refuses): pass (npm 10.9.4).

Workspace member with a stray own lock (#1094) (2026-10-08T00Z, main `05ecc6e`)

A workspace member that has its own (stray) package-lock.json: hosted scan / get <uuid> and vendored scan from the member rewrite that ignored lock and exit 0 with success, root npm ci installs unpatched, and vex from the member attests not_affected. fail Hosted and vendored scans run from an npm workspace member that has a stray package-lock.json of its own rewrite that lock, which npm ignores, and report success while npm installs the unpatched package and VEX attests not_affected #1094 on Linux npm 7.24.2 / 8.19.4 / 10.9.4 / 12.2.0 (hosted ×2 each; get and vendored on 10.9.4). v4.0.0 behaves the same (not a regression).
["!packages/b", "packages/*"]: npm excludes b, and a scan from b pins nothing (correct): pass.

Workspace glob refusal gap (#1071) and lost-ledger remedy loop (#1072) (2026-10-07T18Z, main `05ecc6e`)

A hosted scan / get from an npm workspace member whose root workspaces uses {a,b} or [a-c]: exit 0, nothing pinned, npm ci unpatched. fail Hosted scan/get from an npm workspace member still pins nothing and exits 0 when the root's workspaces glob uses braces or a character class (packages/{a,b}, packages/[a-c]), because the #884 refusal's matcher doesn't support them #1071 on Linux npm 7.24.2 / 8.19.4 / 10.9.4 / 12.2.0. packages/* and packages/a* are refused: pass. Vendored from the member exits 1: pass.
A lost .socket/vendor/state.json: vendor --revert advises repair "to re-adopt", and repair refuses. fail vendor --revert with a lost vendor ledger tells you to "run socket-patch repair to re-adopt them into the ledger", but repair refuses because it never rebuilds the ledger, so the advice loops and the vendored npm packages can't be reverted #1072 (npm 10.9.4). Everything fails safe; npm ci stays patched.
Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 re-check: still fails. Since Fix vendor --check unwired cause and remedy (#900) #970, vendor --check's cause line is false and its vendor remedy is a no-op; scan --mode vendored fixes it (commented).
Pass: Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852 fix (plain and scoped alias under install-strategy=linked, agent + vex + rollback, npm 10.9.4); After an agent→hosted migration, a superseding patch leaves the stale agent manifest record, so npm rollback exits 1 ("modified after patching") and remove refuses to un-host #933 fix (agent → hosted → rollback byte-exact); a partial scan --mode vendored takeover reports what's on disk; .npmrc ini [section] handling (npm 12.2.0); a spaces / unicode path hosted + vendored cycle (npm 12.2.0).

Takeover savepoint (#963) and eject reporting (2026-10-07T12Z, main `859a279`)

Hosted → vendored takeover refused after the restore (vendor_workspace_member, npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688 shape), or with a failed artifact download (HTTP 500): scan / get --mode vendored and vendor keep the lock and .npmrc byte-identical, and npm ci installs patched bytes. pass on Linux npm 10.9.4 / 12.2.0.
Mixed takeover (one pin refused, one vendorable): scan --mode vendored vendors one pin, keeps the other hosted and keeps allow-remote=all, and npm ci installs both patched. pass (npm 10 / 12).
A rolled-back vendor eject prints "Vendored 1 package" + "Commit .socket/vendor/" with no eject_rolled_back line, and --json counts the rolled-back package as applied. fail A rolled-back vendor eject prints "Vendored 1 package" and "Commit .socket/vendor/" with no eject_rolled_back warning, and --json still reports the rolled-back package as applied #1005 (npm 8.19.4 / 10.9.4 / 12.2.0). The disk state is correct.

Agent `--json` drops mismatch-overwrite warnings (#1004)

scan --mode agent --json / get --json overwrite a locally edited file (default policy) with no content_mismatch_overwritten in the JSON and nothing on stderr. Human scan and apply --json report it. fail #1004 on Linux npm 10.9.4 / 12.2.0. v4.0.0 is the same. --strict → apply_failed in scan --json: pass (#955).

npm config that rewrites hosted pins (#812)

replace-registry-host=always (npm ≥ 8) rewrites the hosted pin's origin to the configured registry, so npm ci / npm install fail E404. The hosted scan exits 0 with no warning. fail #812 on Linux npm 8.19.4 / 10.9.4 / 12.2.0 (project .npmrc, env, and user .npmrc via NPM_CONFIG_USERCONFIG). A warm npm cache masks it; test with npm ci --cache <fresh>. A hostname value that isn't the hosted origin passes. Vendored isn't affected; npm 6 / 7 don't have the setting.

Other 2026-10-05 passes (Linux): prerelease version (ms@3.0.0-canary.1) hosted / vendored / agent cycles (npm 10.9.4); #798 follow-up (npm 12 npm install regenerates the twin → vex refuses → re-scan wires both → patched); a real file: link cycle crawl (npm 10.9.4).

Vendored v2 lock after `npm install` (#879, regression from #813)

npm 7–10 npm install on a lockfileVersion 2 lock drops resolved from file: mirror nodes. Since f023506 (#813), vendored vex and vendor --check exit 1 on that lock although the tree is patched and npm 6 fails closed. fail #879 on Linux npm 7.24.2 / 8.19.4 / 10.9.4 (plain and alias). Hosted passes. 1714299 passes. #432 fix itself: hosted alias (npm 6 fails closed EINTEGRITY, npm 8 patched) and vendored alias (npm 6 / 8 patched, revert byte-exact) pass on c644ab0.

Agent writes through links (#626)

Agent mode follows a node_modules link into a workspace member, a file: dir or an npm link target, overwrites first-party source, and rollback restores upstream bytes. fail #626 on Linux npm 6 (file:) / 8 / 10 / 12, macOS npm 10.9.7, and Windows npm 8 / 10 / 12, also on v4.0.0. Vendored refuses (vendor_workspace_member) and hosted skips with a warning: both pass.

Alias under `install-strategy=linked` (#852)

npm 9–11 store an alias as node_modules/.store/lp@<v>-<h>/node_modules/lp (a scoped alias as .store/@x/lp@<v>-<h>/node_modules/@x/lp, also missed; 9.9.4 / 10.9.4 on 859a279, commented 2026-10-07T12Z). npm 11.21.0 dedupes both into the real-name entry: pass. Agent mode misses that copy. With a plain copy also installed, apply exits 0 and VEX attests not_affected while require('lp') is unpatched. fail #852 on Linux npm 9.9.4 / 10.9.4 / 11.6.2. npm 12.2.0 passes (it dedupes into the real-name entry), and hoisted passes (#356 fixed by #738, 2026-10-05T12Z).

Vendored artifact under `.gitignore` (#831, yarn-classic's issue)

*.tgz, vendor/ and .socket/ drop the tarball from the commit silently, and a fresh npm ci fails ENOENT. With .socket/ ignored, vendor --check exits 0. fail #831 on Linux npm 8.19.4 / 10.9.4 / 12.2.0 (matrix on #831; draft fix #837).

npm 12 ignores npm-shrinkwrap.json (#899)

npm 12.0.0 / 12.1.0 / 12.2.0 don't read a root npm-shrinkwrap.json (npm's own docs). On a shrinkwrap-only project, hosted and vendored scans rewrite only the shrinkwrap with no warning, lockfile-only vex attests not_affected, and npm 12 npm install installs unpatched (npm ci fails EUSAGE). fail #899 on Linux (shrinkwrap v2 from npm 8, v3 from npm 10). npm 8 / 10 consumers: pass. After the npm 12 install, vex refuses (the #799 twin rule): pass.

Workspace member hosted scan (#884)

A hosted scan / get <uuid> run from an npm workspace member exits 0 with redirected: 0 and redirect_npm_no_lockfile, and the root lock is untouched. fail #884 (commented) on Linux npm 7.24.2 / 8.19.4 / 10.9.4 / 12.2.0, non-hoisted and hoisted (get). Vendored from the member exits 1: pass (fails closed).

Vendored refusal diagnostics (#898, #900)

A symlinked package-lock.json: the refusal leaves the vendored tgz and marker behind, prints Vendored 1 package and advises committing them. fail Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/ #898 on Linux npm 8 / 10 / 12.
package-lock.json + yarn.lock (vendored wires yarn.lock): vendor --check falsely says no lock references the artifact, and its remedies are no-ops. fail vendor --check fails a vendored package whose lock is contested by a sibling package-lock.json with "no lockfile or config references .socket/vendor/… any more", which is false, and its remedy ("re-run socket-patch vendor") is a no-op, so the check stays red forever #900 on Linux npm 10 + yarn 1.22.22.
Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 also covers npm 12 npm install on an existing v2 lock (keeps v2, drops mirror resolved) and an npm 8 v2 shrinkwrap (commented 2026-10-06).

npm `allow-file` vs vendored `file:` tarballs (#969, 2026-10-07T00Z)

npm ≥ 11.14.0 has allow-file (all / root / none). Under root (vendored transitive dep) or none, vendored scan / vendor --check / lockfile-only vex succeed silently and every npm ci fails EALLOWFILE. fail #969 on Linux npm 12.2.0 (project .npmrc x2, env var) and 11.21.0. Pass: root with a direct dep, default all. npm ≤ 11.13 has no such setting.

Orphaned vendored entry after `npm uninstall` (Bun handover, 2026-10-07T00Z)

scan --mode vendored --prune reverts it (#665 fixed by #689): pass. vendor --check exits 1 with a false "fresh install gets the unpatched package" message and a no-op socket-patch vendor remedy: commented on #900 (npm 8.19.4 / 10.9.4 / 12.2.0).

Superseding patch unavailable / withdrawn (2026-10-06T18Z, main `9c43dfc`)

Mock: left-pad@1.3.0 at patch A, then the API changes. Linux npm 8.19.4 (v2) / 10.9.4 / 12.2.0 (Node 24.21).

B free but its reference is pending_build / build_failed / not_found: hosted pass (keeps A, redirect.skipped[], exit 0). Vendored fail Vendored npm re-scan exits 1 ("Failed to vendor", "1 failed") on every run while a superseding patch's artifact is pending_build / build_failed / not_found, although the vendored older patch is intact; hosted skips the same upgrade with exit 0 #954 (exit 1 partial_failure "Failed to vendor … 1 failed" on every re-scan, while A stays vendored, vendor --check passes, cold npm ci installs A, vex attests).
B paid + forbidden (no paid access), A no longer offered: hosted and vendored pass (keep A, exit 0; updates[] still advertises B).
A withdrawn (nothing offered, reference withdrawn): hosted / vendored pass (pin kept, exit 0). Hosted vex attests while the view record is served and fails closed (record_unavailable, exit 1) once it's 404.
Agent: B offered but its view record 404s → scan --mode agent exits 1 "could not fetch details" every run, A stays applied. Needs an inconsistent API (offer without record); noted, not filed.

Patch superseding (2026-10-06T12Z, main `9c43dfc`)

The same name@version gets a new patch UUID with different bytes. Mock: left-pad@1.3.0 A→B, cold-cache npm ci.

Same-mode re-scan: hosted / vendored on npm 8.19.4 / 10.9.4 / 12.2.0 (plain + alias), agent on 10.9.4: pass (updates[], the lock re-pinned in every node, the old artifact GC'd, npm ci installs B, vex attests B, rollback byte-exact).
Cross-mode: hosted→vendored, vendored→hosted, agent→vendored pass. hosted→agent and vendored→agent keep the other mode's wiring (documented; vex fails closed or attests A).
agent→hosted: fail After an agent→hosted migration, a superseding patch leaves the stale agent manifest record, so npm rollback exits 1 ("modified after patching") and remove refuses to un-host #933. Manifest record A survives, so rollback exits 1 until a reinstall and remove exits 1 with pin B live (npm 8 / 10 / 12, and a v4.0.0 manifest).

Run 23 passes (Linux, 2026-10-06T06Z, main `9c43dfc`)

Hosted pins survive npm dedupe, install --package-lock-only, install <new dep> and prune on npm 8.19.4 / 10.9.4 / 12.2.0 (plain and scoped alias). Vendored passes on npm 10 / 12. On npm 8 (v2), everything except dedupe hits Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879.
Plain in-place npm install after a hosted / vendored scan replaces the tree with patched bytes (npm 8 / 10 / 12).
Hosted alias rollback (v2 mirror lp node, scoped alias) is byte-exact on npm 6 / 8 / 10 / 12.
A hosted v1 lock (npm 6) installs patched bytes under npm 8 / 10 / 12 via both ci and install.
bin linking (semver@7.6.0, plain + alias), hosted and vendored, npm 8 / 10 / 12.
Workspace member with a non-hoisted alias (packages/a/node_modules/lp), hosted and vendored, npm 8 / 10 / 12: cycle, vendor --check and rollback pass.
SIGKILL-interrupted hosted / vendored scans (0.02–0.3 s) recover on re-scan, and rollback is byte-exact. Kills inside the narrow write window weren't tested (blocked by the session permission classifier).

Backlog

New 2026-10-09T18Z: re-check Path-scoped agent scan packages/a and rollback packages/a skip a workspace member's npm alias (lp@npm:left-pad) under install-strategy=linked, while its plain links are in scope (exit 0, success) #1266 / vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its socket-patch vendor remedy is a no-op #1232 / Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses #1196 / The #812 replace-registry-host warning misses a ${VAR} value in .npmrc: npm expands it to always, so every npm ci fails E404, while the hosted scan reports success with no warning #1233 / After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 on the next main; Use one package target grammar for get, remove, rollback and the UUID shortcut #1034 agent remove <name> --preserve-state and a scoped name that also matches a member dir; Finish vendored reverts through one shared step with a keep policy (#989) #1245 NpmFamily keep policy after an npm upgrade and with a shared artifact; an agent → hosted takeover killed at each rename; the npm 12 npm patch rm lock downgrade versus vendored refusal text; get pkg:npm/<name> (versionless) against the real API (the mock only answers exact purls).
New 2026-10-09T12Z: Path-scoped agent scan packages/a and rollback packages/a skip a workspace member's npm alias (lp@npm:left-pad) under install-strategy=linked, while its plain links are in scope (exit 0, success) #1266 follow-ups (pnpm member alias link — handed over; apply --check packages/a and vex with a member alias link; a scoped alias @x/pad link); an interrupted vendored → hosted takeover on npm (A vendored-to-hosted takeover interrupted after its commit journal is written leaves the vendored artifact directory behind for good: recovery finishes the files but not the deferred deletions, and no GC can reclaim it once the ledger is gone #1157 analogue); vex right after a killed hosted dual-lock scan; Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195 cap N>0 competing for a slot; re-check Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses #1196 / The #812 replace-registry-host warning misses a ${VAR} value in .npmrc: npm expands it to always, so every npm ci fails E404, while the hosted scan reports success with no warning #1233 / Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195 / After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 on the next main.
New 2026-10-09T06Z: vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its socket-patch vendor remedy is a no-op #1232 siblings (a git / URL / override duplicate of a vendored name@version: same generic vendor --check reason?); Vendored npm scan wires file: tarballs that npm ≥ 11.14 refuses under allow-file=root (transitive deps) or allow-file=none, so every npm ci fails EALLOWFILE while scan, vendor --check and vex report success with no warning #969 under install-strategy=linked and overrides-only declarations; Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 range / alias patchedDependencies selectors on a lock without a patched record, and a pin that predates npm patch; re-check After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 / Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195 / Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses #1196 on the next main; verify remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 (remove --preserve-state) on f3c6313.
New 2026-10-09T00Z: Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195 siblings (the npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 bundled copy under a cap, the in-memory engine with partial pins, a cap N>0 competing for a slot); re-check After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 when Fix vendored npm/Bun revert treating an upgrade as drift (#1155) #1187 lands; Remove scan --apply/--vendor, get --no-apply and the download/gc aliases (#966) #1031 removed flags in npm docs and remedy texts; Make every --json top-level error a {code, message} object (#704) #1027 {code, message} errors on npm refusal paths; re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 / npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 on 16106b1.
New 2026-10-08T18Z: Make the vendored-to-hosted takeover atomic #1039 takeover with hosted-side refusals that aren't a service status (npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 bundled copy, linked alias, a one-sided dual lock, a mixed retract + take-over run); After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 in a workspace member, a nested copy and an alias; re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 / npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 on c4235a2.
New 2026-10-08T12Z: Human scan --mode vendored --prune silently skips the vendored GC when no remaining package has a patch, so an npm uninstalled vendored entry is never reverted (exit 0), while --json reverts it and vendor --check keeps pointing at that same command #1127 on other vendored PMs (hand over if unseen); apply --check (Stop CI gates passing on missing paths, unverified agent patches and unreported hosted pins #1029) on npm 6 v1 locks, inBundle copies, and a hosted-pinned package that still has a manifest record; re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 / npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 on e2d9633.
New 2026-10-08T06Z: re-check Hosted and vendored scans run from an npm workspace member that has a stray package-lock.json of its own rewrite that lock, which npm ignores, and report success while npm installs the unpatched package and VEX attests not_affected #1094 / Hosted scan from a yarn classic workspace member still pins nothing and exits 0 when the root's workspaces use a ! pattern (yarn 1 ignores it) or an extglob like packages/@(a|b) #1097 when fixes land (member package-lock.json and npm-shrinkwrap.json, extglob); re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 / npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665 / npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 / Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 on ea09714; Replace a superseded patch generation's wiring on re-pin and remove #1035 with a vendored A + hosted B mix across a dual lock.
New 2026-10-08T00Z: Hosted and vendored scans run from an npm workspace member that has a stray package-lock.json of its own rewrite that lock, which npm ignores, and report success while npm installs the unpatched package and VEX attests not_affected #1094 on yarn / Bun workspaces (same has_own_npm_family_lock early exit; hand over if confirmed), a stray member npm-shrinkwrap.json, rollback / remove from the member; case-insensitive workspace globs on macOS / Windows (probe branch).
New 2026-10-07T18Z: Hosted scan/get from an npm workspace member still pins nothing and exits 0 when the root's workspaces glob uses braces or a character class (packages/{a,b}, packages/[a-c]), because the #884 refusal's matcher doesn't support them #1071 on yarn / Bun roots (shared matcher; hand over if not covered), ! negation order and ./ patterns vs real npm; re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 / npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665 on 05ecc6e. (A rolled-back vendor eject prints "Vendored 1 package" and "Commit .socket/vendor/" with no eject_rolled_back warning, and --json still reports the rolled-back package as applied #1005 on a scan --mode vendored partial takeover: done 18Z, pass.)
New 2026-10-07T12Z: A rolled-back vendor eject prints "Vendored 1 package" and "Commit .socket/vendor/" with no eject_rolled_back warning, and --json still reports the rolled-back package as applied #1005 on scan --mode vendored partial takeovers (does the human summary match disk?); scan --mode agent --json and get --json overwrite a locally modified npm file without the documented content_mismatch_overwritten warning (not in the JSON, not on stderr) #1004 siblings (other nested-apply warnings dropped from scan --json: package_not_installed next to a success, sidecar advisories); re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 / npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665 on 859a279. (Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852 scoped alias confirmed and commented; npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688 takeover half verified fixed; npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 still reproduces on 859a279.)
New 2026-10-07T00Z: Vendored npm scan wires file: tarballs that npm ≥ 11.14 refuses under allow-file=root (transitive deps) or allow-file=none, so every npm ci fails EALLOWFILE while scan, vendor --check and vex report success with no warning #969 follow-ups (hosted→vendored takeover under allow-file=root; user / global .npmrc layers; a workspace member's vendored deps under root; allow-directory with file: directory deps).
New 2026-10-06T18Z: Vendored npm re-scan exits 1 ("Failed to vendor", "1 failed") on every run while a superseding patch's artifact is pending_build / build_failed / not_found, although the vendored older patch is intact; hosted skips the same upgrade with exit 0 #954 follow-ups (other vendored PMs → handover if confirmed: pnpm / yarn / bun share ServiceFetch::settle; --max-new-patches with an unavailable UPGRADE; get --mode vendored wording). (Withdrawn / forbidden superseding: done 18Z, pass.)
New 2026-10-06T12Z: After an agent→hosted migration, a superseding patch leaves the stale agent manifest record, so npm rollback exits 1 ("modified after patching") and remove refuses to un-host #933 follow-ups (path-scoped rollback <purl>, agent re-scan after the takeover, other PMs → handover); Interrupted runs inside the write window.
(Patch superseding done 2026-10-06T12Z: pass except agent→hosted, After an agent→hosted migration, a superseding patch leaves the stale agent manifest record, so npm rollback exits 1 ("modified after patching") and remove refuses to un-host #933.)
(Hosted alias rollback of the v2 mirror lp node: done 2026-10-06T06Z, pass.)
New 2026-10-06: npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899 follow-ups (dual lock without a twin, workspace shrinkwrap); Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/ #898 on other group-commit refusals (vendor_commit_failed, a symlinked .npmrc); Bun handover Add new commands for patch remove, list and GC #2 (a bun.lock + stale package-lock.json with no entry for the package: contest_across_locks ignores it), not filed because of the cap and Bun being primary.
(Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 npm 12 / shrinkwrap v2 follow-ups done 2026-10-06T00Z: both affected, commented.)
Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 follow-ups: workspaces.
(Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852 and Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 re-checked on c644ab0 2026-10-05T18Z: both still reproduce.)
Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852 follow-ups: agent rollback over the alias store copy; a scoped alias; a transitive alias in .store.
Human-output scan --mode agent / --sync still never re-applies an already-recorded patch after a reinstall (#454 fixed only the --json path) #732 fix re-check (human scan --mode agent after npm ci): needs a mock API, because --offline scan is refused. Also re-check npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 on main 4646693.
(npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688 and npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 re-checked on 4646693: both still reproduce, 2026-10-05T12Z.)
npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 follow-ups: get --mode vendored takeover; the real npm bundle (ansi-regex) shape; a dual lock where only one lock carries the bundle; other ContestedWiring shapes (npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 stale twin) reaching the vendored takeover silently.
Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 variants: global npmrc; a registry= mirror + always. macOS / Windows once probe branches are allowed again. (User .npmrc and hostname value done 2026-10-05T06Z.)
(npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 re-scan follow-up done 2026-10-05T00Z: pass. Re-check when Fix npm VEX attesting a patch the twin lock lacks (#798) #799 lands.)
(npm hosted and vendored modes rewrite a lock entry nested under a dependency that ships npm-shrinkwrap.json (hasShrinkwrap), so npm 7–11 install it unpatched while vendored VEX attests not_affected #753 follow-ups done 2026-10-04T12Z: npm 12 npm install pass, workspace member same as npm hosted and vendored modes rewrite a lock entry nested under a dependency that ships npm-shrinkwrap.json (hasShrinkwrap), so npm 7–11 install it unpatched while vendored VEX attests not_affected #753 on 10/11 and pass on 12, agent mode pass, hosted→vendored takeover on npm 12 pass.)
(Bun handover done 2026-10-04T12Z: after hosted rollback / vendor --revert, npm install and npm ci restore upstream bytes on npm 7/10/11/12.)
(Done 2026-10-04T18Z: npm 9.2.0 install-links file: cycle, peer: true / devOptional pins: all pass.)
npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 follow-ups: a workspace member present only in the shrinkwrap; after npm 12 npm install regenerates the twin, does a re-scan wire both? Re-check vendor --check says "committed artifact and wiring verified" (exit 0) after pipenv lock drops the vendored reference, so a fresh pipenv install --deploy installs the unpatched wheel while vex says vendor_unwired #725 / npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 on npm when Fix vendor --check passing unwired vendored entries (#725) #730 lands.
(Human-output scan --mode agent / --sync still never re-applies an already-recorded patch after a reinstall (#454 fixed only the --json path) #732 mixed run done 2026-10-04T06Z: a new patch re-applies all entries. Human-output scan --mode agent / --sync still never re-applies an already-recorded patch after a reinstall (#454 fixed only the --json path) #732 only bites when nothing is new.)
Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 (npm 12 native npm patch, lockfileVersion 4) follow-ups: nested / workspace patched copies; agent --strict. rollback / remove / repair on v4 locks passed (2026-10-04).

npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659 / npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688 class: other npm per-package gates reached after the takeover restore: bundled-only, link-only and non-registry-only entries (vendor_lock_entry_not_rewritable) over a hosted pin; a real workspace member forked under the same name@version. Dual lock and alias passed (2026-10-03T12Z). A differing shrinkwrap/package-lock pair: npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy #798 (2026-10-04T18Z).
A failed vendor eject rewrites every file in the project root from its snapshot, so vendor --json > report.json (or > vendor.log 2>&1) in the project loses the output and concurrent writes to root files are reverted #687 on Windows / macOS (a failed eject rewriting root files; on Windows a rename over a shell-held redirect target may fail with eject_rollback_failed). Needs a probe branch that can be deleted.
Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 follow-ups (after draft PR Fix agent mode patching linked first-party source (#626) #634): apply --check / repair over a link; a byte-identical fork (patched silently); a nested member's node_modules reached through a link.
npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched #588 follow-ups (PR Fix npm/Bun VEX attesting a patch a same-lock copy skips (#588) #589): an unwired same-lock copy under install-strategy=linked and across a shrinkwrap/package-lock pair; whether vendor --check should flag it.
Re-checks on the next main change: npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325, remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433, npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432, A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464, npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 (override over URL / file: transitive deps on npm 8–12), After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665 (npm matrix in the comment).
Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 follow-ups: agent rollback / vex with path policy over nested projects.
npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356: alias-only agent scan now exits 0 with nothing applied (since Fix apply failing when patched deps are skipped (#403) #555). Watch for a fix.
Maintainer request (global -g), still open: Linux npm 7/8/11 passed 2026-10-04T06Z. Still to do: npm 6/8/11 on macOS and Windows; an unwritable prefix (root-owned / Program Files); nvm, volta, fnm and Homebrew prefixes on macOS; %APPDATA%\npm now that On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 is closed. Full checklist in the 20261001T040000Z entry.
Stale probe branches the proxy can't delete (2026-10-04T06Z: the session permission policy now refuses git push --delete outright, so no new probe branches are pushed until a maintainer allows it or deletes these) (git push --delete fails with "remote end hung up" / "Everything up-to-date"; re-checked 2026-10-03T12Z): bughunt/npm/20260930-alias-linked, 20260930-win-mac-e2e, 20260930-win-old-npm, 20261001-crlf-paths, 20261001-optional-dep, 20261001-v5-hosted-global, 20261001-win-global, 20261002-v5-agent-vendored-winmac, 20261003-ws-link-agent, 20261003-ws-link-mac. A maintainer needs to delete them.

Known non-bugs

A vendored → hosted takeover SIGKILLed after its commit journal is written: the next locked command finishes the files, but the old .socket/vendor/npm/<uuid>/ dir stays. Same as A vendored-to-hosted takeover interrupted after its commit journal is written leaves the vendored artifact directory behind for good: recovery finishes the files but not the deferred deletions, and no GC can reclaim it once the ledger is gone #1157 (pnpm), closed as wontfix. Reproduced on npm 10.9.4 (2026-10-09T18Z).
npm 12.2.0 accepts range patchedDependencies keys (ms@^2.1.0). socket-patch's package.json key matcher doesn't parse ranges, but npm writes the patched record into the lockfileVersion 4 lock for any selector, and the hosted gate reads it. A range key without a regenerated lock fails npm ci anyway (2026-10-09T18Z).
rollback '@scope/*' is a path glob relative to the cwd (it matches nothing loudly); use node_modules/@scope/* or the scoped name (2026-10-09T18Z).
Mock tip (2026-10-09T18Z): the SOCKET_NPM_REGISTRY version doc's dist.tarball is written into the lock verbatim on hosted rollback, so serve the real <name>/-/<leaf>-<ver>.tgz shape for scoped names. In shells, never pkill -f mock.py: it matches the calling shell. Start the mock with setsid.
A SIGKILL inside a hosted or vendored write window leaves a .socket-stage-<file>-<uuid> sibling that later runs don't remove. Every atomic-rename writer leaves that residue after a kill, and the re-run converges. Noted on vendor --check and vex misreport a crashed vendored run whose commit journal is pending, because only lock-taking commands replay it #809, not filed separately (2026-10-09T12Z).
A hosted scan with an immutable lock (chattr +i) now fails with "nothing was changed", and .npmrc is rolled back too. The older "mid-flush I/O residual" note below about .npmrc being left is outdated on a80b89e (2026-10-09T12Z).
npm dedupes a root registry ms@2.1.2 onto a git copy of the same version even when an overrides entry forces the git spec only under debug. So a registry + git duplicate of one name@version (a vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its socket-patch vendor remedy is a no-op #1232 sibling) can't be built with npm 10 (2026-10-09T12Z).
Mock tip (2026-10-09T12Z): the public-proxy routes need only POST /patch/batch, GET /patch/by-package/<purl>, /patch/view/<uuid> (with blobContent / beforeBlobContent base64 and git-sha256 beforeHash / afterHash for agent mode), /patch/blob/<hash>, POST /patch/package (results[uuid] with status: granted, url, artifacts[{kind: tarball, url, integrity{sha512, sha1, md5}}]) and the tarball URL. An LD_PRELOAD shim that SIGKILLs on rename() to a path suffix reproduces interrupted runs; strace -e inject counts per thread and misses.
Shrinkwrap-only vendored project: vex omits (vex_npm_shrinkwrap_only) while vendor --check passes. That's the documented "Unattested references" rule (liveness gates keep treating the wiring as live) (2026-10-09T06Z).
A raw allow-file=${AF} is treated as a non-all value, so it warns vendor_npm_allow_file and vendor --check fails even when AF=all. Fails safe. The silent direction for replace-registry-host is The #812 replace-registry-host warning misses a ${VAR} value in .npmrc: npm expands it to always, so every npm ci fails E404, while the hosted scan reports success with no warning #1233 (2026-10-09T06Z).
Mock tip (2026-10-09T06Z): npm pack <spec> plus a Python tar rewrite gives a real patched tarball. The org routes are matched on path suffixes as before; /patch/package returns results[uuid] for every known uuid in the request body.
Mock tip (2026-10-09T00Z): org routes work with --api-url <mock> --org o --api-token fake --patch-server-url <mock>, routing on path suffixes /batch, /by-package/<purl>, /view/<uuid>, /blob/<hash>, /package and the tarball URL /patch/npm/<name>/<ver>/<tok>/<uuid>/<name>-<ver>.tgz. Hosted rollback worked without SOCKET_NPM_REGISTRY this run.
A CR-only .npmrc is refused loudly ("not set automatically") and left untouched (documented). Only the splice that produces a bare CR is a bug (Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses #1196).
Mock tip (2026-10-08T18Z): POST /patch/package answering pending_build / forbidden during a vendored → hosted takeover keeps the vendored wiring byte-identical and exits 0 ("No patches could be switched to hosted"). That's Make the vendored-to-hosted takeover atomic #1039's intended retraction, not a silent no-op.
apply --check -g drift text says "Run socket-patch apply" without -g; following it fails loudly (exit 1, "matched no installed package"). Noted, not filed (A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464 class, low value). (2026-10-08T12Z)
Mock tip (2026-10-08T12Z): the public-proxy routes (SOCKET_PROXY_URL + SOCKET_API_URL, no token) need only POST /patch/batch (components[].purl), GET /patch/by-package/<purl>, /patch/view/<uuid>, /patch/blob/<hash>, POST /patch/package and the tarball URL it returns.
Mock tip (2026-10-08T06Z): when two mock origins serve patch generations A and B, remove / rollback must get the A pin's origin as --patch-server-url, or the pin is invisible (documented) and looks like a Replace a superseded patch generation's wiring on re-pin and remove #1035 miss.
A workspaces negation listed before the positive pattern (["!packages/b", "packages/*"]): npm excludes b, and a hosted scan from b pins nothing because b is its own project (npm 10.9.4, 2026-10-08T00Z).
pnpm handover Hosted pnpm scan pins a pnpm-lock.yaml that pnpm is configured to ignore (lockfile=false / lockfile: false), reports success, and lock-only VEX attests not_affected while pnpm installs the upstream package #1074's npm analogue (package-lock=false): npm ci still honors the lock, so a lock-only attestation matches npm ci, and vex refuses after a plain npm install (see the entry below; re-reviewed 2026-10-08T00Z).
An .npmrc that ends inside an ini [section]: hosted inserts allow-remote=all before the first section, and an allow-remote that sits only inside a section is (correctly) not treated as set (npm 12.2.0, 2026-10-07T18Z).
A lost .socket/vendor/state.json with the lock still wired: every command keeps the artifacts and npm ci stays patched (fail-safe). Only the vendor --revert remedy text is wrong (vendor --revert with a lost vendor ledger tells you to "run socket-patch repair to re-adopt them into the ledger", but repair refuses because it never rebuilds the ledger, so the advice loops and the vendored npm packages can't be reverted #1072).
The eject vendor --dry-run reports eject_planned (exit 0) even when the wet eject will refuse a pin. CLI_CONTRACT eject step (3) says the dry run stops at the restore plan. The scan / get --mode vendored --dry-run takeover preview listing would_vendor is documented too ("does not model the takeover yet"). (2026-10-07T12Z)
content_mismatch_overwritten (local edits overwritten under the default policy) is documented behaviour. Only its missing report in scan / get --json is a bug (scan --mode agent --json and get --json overwrite a locally modified npm file without the documented content_mismatch_overwritten warning (not in the JSON, not on stderr) #1004).
allow-file=root (npm 12.2.0) admits a vendored dep that is a workspace member's direct dependency (2026-10-07T06Z).
An alias key that shadows the patched package's name ("left-pad": "npm:once@1.3.0") is correctly ignored by agent, vendored and vex (2026-10-07T06Z).
An npm 10 consumer ignores a published library's vendored npm-shrinkwrap.json and installs registry bytes. socket-patch makes no claim about published libraries.
allow-file=root admits a vendored direct dependency's file: tarball (npm 12.2.0); only transitive vendored entries are refused (Vendored npm scan wires file: tarballs that npm ≥ 11.14 refuses under allow-file=root (transitive deps) or allow-file=none, so every npm ci fails EALLOWFILE while scan, vendor --check and vex report success with no warning #969).
An orphaned vendored ledger entry after npm uninstall is cleaned up by scan --mode vendored --prune (since Fix vendored revert keeping artifact for removed lock entry (#665) #689). Only the vendor --check wording is wrong (vendor --check fails a vendored package whose lock is contested by a sibling package-lock.json with "no lockfile or config references .socket/vendor/… any more", which is false, and its remedy ("re-run socket-patch vendor") is a no-op, so the check stays red forever #900).
A withdrawn patch (nothing offered, reference withdrawn) keeps its hosted / vendored pin and exits 0; hosted vex keeps attesting while the API still serves the record. No documented contract says a withdrawal should un-pin.
A paid superseding patch without paid access: the scan keeps A and still lists A→B in updates[] (informational).
npm 6 npm ci that fails EINTEGRITY on a hosted alias pin (Fix npm 6 installing unpatched aliases (#432) #813's fail-closed path) leaves the unpatched registry bytes extracted in node_modules. That's npm's partial-install behaviour (exit 1), and vex refuses that tree (not_applied).
Mock tip (2026-10-05T18Z): the org-scoped routes (--api-url … --org o --api-token fake) need only batch, by-package, patches/package, view and blob, and one granted tarball response serves both hosted and vendored.
Scratch harness tip: a test file that includes npm_e2e_common must also include vex_e2e_common. scan refuses --offline (strict airgap), so use apply for offline agent cells.
Mocks of the public proxy need SOCKET_PROXY_URL (and NO_PROXY=127.0.0.1); --api-url alone still reaches patches-api.socket.dev.
Project .npmrc allow-remote=${VAR} is read raw and treated as an explicit user value (warns, doesn't write). Fails safe.
patches-api.socket.dev is unreachable from the sandbox. Use hand-staged manifests, a local mock API, or the wiremock suites.
Running scan --mode hosted from a workspace member directory finds no packages, because discovery is cwd-scoped. It's loud and writes nothing.
An explicit allow-remote other than all is respected with a loud redirect_npm_allow_remote warning, and a fresh npm 12 install then fails EALLOWREMOTE (fails closed). This is documented.
npm update re-resolves a hosted or vendored entry back to the registry. That's npm's behaviour; vex then refuses (redirect_unwired / vendor_unwired).
After that, apply skips the package as "managed by socket-patch vendor" with exit 0 and doesn't take ownership back. That's by design (apply.rs VENDOR_OWNED_MARKER), and vex refuses.
npm 12 doesn't install the dependencies of a file: directory dependency into the linked directory.
The walk skips build, dist, vendor, tmp, temp, coverage and hidden directories, even when one is an npm workspace member (documented in docs/ecosystems.md).
apply from a workspace member directory reports noManifest when .socket/ lives at the root (--cwd scoping).
Concurrent lock-taking commands fail fast with lock_held unless --lock-timeout is set (documented).
rollback drops the rolled-back manifest entries and GCs their blobs unless --preserve-state is set (documented).
Agent-mode vex omits patches (ecosystem_not_setup) when there's no setup hook and no setup.manual (documented).
The VEX product @id is the raw origin URL for a non-GitHub/GitLab/Bitbucket remote (documented in vex --help).
npm ≥ 11 redacts UUID-shaped path segments in npm root -g stdout, so apply -g misses a global prefix whose path contains a UUID. That's npm's behaviour, it's loud (exit 1), and --global-prefix works around it. Not filed.
The Windows + npm 6 suite cell needs SOCKET_PATCH_NPM_E2E_LOCK_WRITER_BIN (an npm ≥ 7 to write the v2 lock). That's a harness requirement.
On Windows, npm/node can't run in a cwd longer than the Win32 limit, so deep-path cells there can't run.
Hosted pins on any host other than patch.socket.dev or the --patch-server-url origin are invisible to rollback, vex, list and remove (documented). Mock runs must pass --patch-server-url.
In the sandbox, hosted rollback can't reach registry.npmjs.org (the Rust client doesn't trust the proxy CA). Use SOCKET_NPM_REGISTRY pointed at a local passthrough.
npm 6 on a hosted lockfileVersion 1 lock: with a cold cache it fails closed with EINTEGRITY, as npm-compatibility.md documents (re-measured 2026-10-06T12Z). An earlier note said it installs the patched bytes; that was a warm-cache artifact.
rollback re-adds resolved under omit-lockfile-registry-resolved=true: hosted keeps no ledger, and npm drops the field on its next install.
A failed hosted lock write (an immutable lock) leaves allow-remote=all in .npmrc: exit 1, the documented mid-flush I/O residual.
A bare hosted scan wires only the cwd project's lock. A nested non-workspace project warns redirect_npm_entry_not_found. scan . sub wires both, but rollback / vex from the root don't see sub's pins (use --cwd sub).
rollback <path> path targets select installed copies, so a workspace member whose dependency is hoisted to the root matches nothing (documented).
Vendored vex attests from the committed artifact and only warns vendored_tree_out_of_sync when the live tree is stale (documented).
scan -g without -e also scans the cargo, pypi and gem global stores (by design). vex -g outside a project needs --product.
v5 removes setup, so the setup-hook cells are retired.
Hosted rollback restores resolved to registry.npmjs.org (or SOCKET_NPM_REGISTRY) even when the project .npmrc uses a registry= mirror. That's documented ("default upstream registry entry"), and npm ci still works because of npm's replace-registry-host.
--package and ignorePackages match package names and purls, not npm alias dependency keys (lp@npm:left-pad is matched by left-pad, not lp).
npm 12 ignores ALLOW-REMOTE= and allow_remote= keys in .npmrc, so socket-patch appending allow-remote=all after them is correct.
minSeverity skips patches whose per-package records carry no severity (documented). Mocks must fill vulnerabilities in by-package.
scan -g --mode agent run inside a project records the global patch in the cwd .socket/manifest.json, and rollback -g drops it again. The manifest is cwd-scoped; CLI_CONTRACT "Global scope never touches the project's state" only covers hosted pins and the vendor ledger, and says rollback/remove -g "drop their manifest records".
With no override, npm dedupes a root registry spec (left-pad@1.3.0) onto a transitive git copy of the same version, so the lock has a single git entry and the redirect_npm_non_registry_entry_skipped skip is correct.
v4.0.0 agent vex omits patches with ecosystem_not_setup unless setup.manual lists the ecosystem (v4 behaviour). Set it when bisecting vex against v4.
Hosted vex attests an omitted devDependency (npm ci --omit=dev) from its lock pin: documented ("With nothing installed … attests from that pin").
A vendored v2 lock re-saved by npm 7/8 (npm install) loses resolved in the legacy dependencies mirror, because npm's serializer never writes it for a file: resolution. A cold-cache npm 6 npm ci then fails closed with EINTEGRITY. That's npm's behaviour; npm-compatibility.md's npm 6 + vendored v2 claim holds only until such a re-save.
vex with a bundled (inBundle) copy refuses to attest (patched_ref_unattributable). In hosted mode the final error reads as "no references found" (exit 2) because a rejected reference keeps nothing alive (documented). Only the diagnostic is misleading.
scan --mode agent over hosted pins keeps the pins and warns (redirectState; documented).
Mock tip: SOCKET_NPM_REGISTRY hosted rollback fetches <registry>/<name>/<version>, so serve a version doc with a top-level dist, not a packument.
(Retired 2026-10-03T12Z: npm vendored scan --prune / vendor --revert / remove keeping an entry whose lock entry vanished after npm uninstall is now tracked as a bug in After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665.)
package-lock=false in .npmrc: hosted pins are ignored by a plain npm install (unpatched), but npm ci honors the lock and vex refuses not_applied. Fails closed; the user's config choice.
A symlinked .npmrc isn't written through (hosted warns that allow-remote must be set). A symlinked lock is refused redirect_symlinked_file_unsupported.
Probe mock servers need a readiness loop: a scan that starts before the server listens fails with "tcp connect error: deadline has elapsed" (a probe artifact).
Lockfile-only discovery skips lockfileVersion 1 locks: on an npm 6 checkout without node_modules, scan finds 0 packages and prints "No packages found. Run your package manager's install first." (exit 0). The code calls this documented (vendor/lock_inventory/npm.rs:168), though the user docs don't say it. It's loud, and installing first works. Not filed.
A hosted-appended allow-remote=all line in a pre-existing .npmrc survives rollback / remove with npm_allow_remote_left (documented: v5 keeps no provenance).
v5 vendoring downloads prebuilt artifacts from POST …/patches/package. --vendor-source build was removed, and vendor --offline over a hand-staged .socket/ refuses vendor_service_offline_conflict. Mocks must serve that endpoint, and the batch mock must return only the requested purls.
vex --json without --output exits 2 with json_requires_output (documented).
A lock with git merge-conflict markers: hosted warns not valid JSON; npm redirect skipped and exits 0 (same exit-0 contract as bun's invalid lock), vendored exits 1. Loud; not filed.
scan --sync GC deletes a recorded patch's before-blob (.socket/blobs/<beforeHash>). That's by design: rollback downloads the before-blob on demand.
Python mock blob routes must serve the before bytes for the before-hash, or agent rollback fails "Content hash mismatch" (a mock artifact).
npm 12 needs Node ^22.22.2 / ^24.15 / ≥26; the sandbox's Node 22.22.0 is too old. Install node@24 from npm into a scratch prefix.
rollback / remove delete a user-authored project .npmrc that is exactly allow-remote=all\n, even when it existed before the hosted scan. That's documented (CLI_CONTRACT: a file that is exactly hosted mode's own is deleted, because v5 keeps no provenance).
npm 12.2.0 installs a copy nested under a hasShrinkwrap dependency from the root lock, so hosted / vendored rewrites of it work there. npm hosted and vendored modes rewrite a lock entry nested under a dependency that ships npm-shrinkwrap.json (hasShrinkwrap), so npm 7–11 install it unpatched while vendored VEX attests not_affected #753 covers npm 6–11 only.
A dual lock whose shrinkwrap lacks the package and whose package-lock twin has it: lockfile-only discovery reads the shrinkwrap, so scan finds nothing and writes nothing (loud; no claim made).
The sandbox sets NPM_CONFIG_USERCONFIG=/root/.npmrc, so a scratch $HOME/.npmrc is ignored unless you repoint that variable (a harness artifact).
vex -o is --org; the output flag is -O / --output.
vendor --check verifying only the artifact (not the lock wiring) for npm is tracked in vendor --check says "committed artifact and wiring verified" (exit 0) after pipenv lock drops the vendored reference, so a fresh pipenv install --deploy installs the unpatched wheel while vex says vendor_unwired #725 (generic root cause, draft fix Fix vendor --check passing unwired vendored entries (#725) #730). Don't re-file it per npm shape.
npm 12 npm ci on a shrinkwrap-only project fails EUSAGE (npm 12 reads only package-lock.json). That's npm behaviour; the socket-patch side is npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899.
A vendored package-lock.json symlink refusal: re-running after replacing the link with a regular file reuses the orphan artifact and works (Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/ #898 covers the orphan itself).

2026-09-30T18:40:07Z

github-actions[bot]
Bot Sep 30, 2026

[agent] 2026-09-30: npm bug-hunt run

This is the first run with a ledger. An earlier run on the same day filed #324, #325 and #326 but wrote no entry.

Tested: main f6b7fb9 (CLI 4.0.0). Latest release 4.0.0 and previous release 3.3.0, both from npm @socketsecurity/socket-patch. npm 6.14.18, 8.19.4, 10.9.7, 11.20.0 (installed, not yet exercised) and 12.1.0 on Node 22.22 (Linux). The probe added npm 10.9.4 and 12.1.0 on ubuntu, macOS and Windows.

Setup: the Socket patch API isn't reachable from the sandbox. Agent and vendored cells hand-stage .socket/manifest.json plus blobs (a marker prepended to index.js). Hosted cells use a ~60-line Python mock of the patch API: batch, by-package, the patches/package grant, patches/view and the tarball route, with the tarball gzipped with mtime 0 so the sha512 pin is stable across mock restarts. Every hosted cell ends with a fresh-checkout npm ci plus vex.

Re-triage

#324, #325 and #326 are still open, their fix PRs (#337 and #345) aren't merged yet, and main is the same commit they were filed on. I didn't re-run them.

Cells

Agent, npm alias ("lp": "npm:left-pad@1.3.0"): fail → npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 on npm 6, 8, 10 and 12, and on Linux, macOS and Windows. An alias-only project gets package_not_installed. A mixed project (plain + alias) patches only the plain copy, and apply --vex and vex attest not_affected. The same happens on 4.0.0 and 3.3.0. Vendored mode rewires the alias entry correctly.
Agent, install-strategy=linked (node_modules/.store): fail → npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 on npm 10 and 12, Linux, macOS and Windows. Transitive packages count as lockfile-only. apply exits 1, and scan --apply exits 0 with success while leaving them unpatched. vendor gets package_not_installed. Direct deps (symlinks) pass. It's the same on 4.0.0 and 3.3.0.
Agent, workspaces (nested conflicting copies in two members): pass. Agent, bundled copies: pass (both copies patched).
Vendored, workspace nested lock entry on npm 10 and 12: pass. Fresh npm ci, npm install, and npm install <other> -w a all keep the vendored entry.
Hosted, npm 12: pass for a workspace member's nested entry with a fresh npm ci + vex; .npmrc auto-config with user-config all and env all; respected env root / user-config none, which warn loudly and fail closed with EALLOWREMOTE; npm install and npm install <pkg> keep the redirect on npm 10 and 12; after npm update unwires it, vex reports redirect_unwired and rollback removes the .npmrc cleanly.
setup: pass. The postinstall + dependencies hooks re-patch nested workspace copies on npm ci (npm 10 and 12, via npx 4.0.0). A CRLF, tab-indented package.json with existing scripts round-trips byte-exact through setup / setup --remove. apply --silent on main prints nothing.

Issues

Filed npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356: npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (npm aliases are never patched in agent mode, and VEX attests anyway)
Filed npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359: npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 (install-strategy=linked .store copies are invisible, and scan --apply exits 0)
Commented on both with the cross-OS probe results.

False positives ruled out

Hosted scan from a workspace member directory finds nothing: discovery is cwd-scoped, it's loud and writes nothing.
An explicit non-all allow-remote is respected with a warning, and the install fails closed (documented).
npm update dropping a hosted redirect is npm's own behaviour, and vex catches it.
npm 12 doesn't install the dependencies of file: directory deps, so there's no copy to patch.
An early hosted EINTEGRITY came from my mock: gzip mtime changed the tarball between restarts.
4.0.0's apply --silent token notice doesn't appear on main.

Probe runs

https://github.com/SocketDev/socket-patch/actions/runs/36758644937 (alias + linked, 3 OS × npm 10.9.4 / 12.1.0). Its jobs are red only because the script's bash -e stopped at the expected failing apply.
Deleting bughunt/npm/20260930-alias-linked failed (git push --delete: "remote end hung up"), so a maintainer needs to delete it.

Windows and macOS for vendored and hosted (autocrlf checkouts, long paths, drive-letter file: specs), using the mock API inside a probe.
Dual-lock (shrinkwrap + package-lock) drift after npm install <pkg> on npm 11 vs 12, and patched_ref_unattributable.
npm 9.x and 11.20.0 cells; Node 18 and 24 with npm 12.
overrides to an aliased spec in hosted and vendored modes (related to npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356).
Concurrent apply runs, and an interrupted hosted run (.npmrc written, lock unchanged).

0 replies

2026-10-01T00:49:03Z

github-actions[bot]
Bot Oct 1, 2026

[agent] 2026-10-01: npm bug-hunt run

Tested: main f6b7fb9 (CLI 4.0.0, unchanged since the last run). Latest release 4.0.0 and previous release 3.3.0 (npm @socketsecurity/socket-patch). npm 6.14.18, 8.19.4, 9.9.4, 10.9.7, 11.20.0 and 12.1.0 on Node 22.22 (Linux). Probes ran npm 10.9.7 and 12.1.0 on Node 24.15 on ubuntu, macOS (arm64) and Windows.

Re-triage

Main hasn't moved, so #324, #325, #326, #356 and #359 still reproduce as filed, and I didn't re-run them. #326's fix PR #345 is still open; I built its head (see below).

Cells

Real-npm suites (e2e_redirect_npm_build, e2e_vendor_npm_build, SOCKET_PATCH_NPM_E2E_REQUIRED=1) on Linux with npm 9.9.4 and 11.20.0: pass, 14/14 each.
Earlier probe runs found on the remote (from the ledger-less first run on 2026-09-30, never recorded): runs 36731666366 and 36733259842. Both suites pass on Windows and macOS with npm 8.19.4, 10.9.9 and 12.1.0, and on macOS with npm 6. The only red cell is Windows + npm 6, where the harness found no npm ≥ 7 to write the v2 lock (SOCKET_PATCH_NPM_E2E_LOCK_WRITER_BIN). That's a harness limitation, not a bug.
Dual-lock (shrinkwrap + package-lock), vendored, npm 11 / 12: pass. npm install left-pad@1.3.0 on npm 12 reverts only package-lock.json, and on npm 11 only npm-shrinkwrap.json. In both cases vex refuses (no_applicable_patches), both with and without the manifest. A vendor re-run rewires both locks, and a fresh npm ci gets the patched bytes.
overrides to an aliased spec ("is-number": "npm:kind-of@6.0.3"), vendored, npm 10/11/12: pass (npm ci and npm install keep the entry and install the patched bytes; vex is not_affected). Agent mode on that shape is npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356's root cause.
Scoped alias ("@my/lp": "npm:left-pad@1.3.0"), vendored, npm 11: pass, including a byte-exact vendor --revert.
Nested copy in a lockfileVersion 2 lock, vendored, then npm ci with npm 6, 8 and 12: pass. The legacy dependencies mirror is rewired too.
Local file: tarball dep, vendored, npm 8/10/11/12: fail. That's npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326, so I added a comment instead of filing. PR Fix npm rewiring git/URL/file lock entries (#326) #345's head refuses it with vendor_lock_entry_not_rewritable.
Global (apply -g) with npm_config_prefix / --global-prefix, npm 6/9/11/12: pass.
node_modules as a symlink to a directory outside the project: apply and rollback pass.
Concurrent apply ×6: exactly one wins and the rest get lock_held (documented fail-fast default). A stale apply.lock and a SIGKILLed holder don't block the next run.
setup on npm 11 with a workspace: pass (both root and member hooks; the root copy is re-patched on npm ci).
Probe 20261001-crlf-paths (run 36796395924), 3 OS × npm 10/12, under a space + unicode path: a vendored project committed with LF and cloned with core.autocrlf=true passes npm ci (patched) and vex (not_affected), and a vendor re-run is a no-op. vendor --revert drops the CRLF (npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324). Agent mode with a CRLF manifest: apply and rollback pass. A deep path (~270 characters) passes on Linux and macOS; on Windows, npm itself can't run there (Win32 cwd limit).
Platform-skipped optional dependency: fail → npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403. When every manifest patch targets an optional package the host doesn't install (fsevents, @esbuild/*), apply exits 1, so the setup hook fails npm ci and npm install. It reproduces on Linux with npm 8/10/11/12 and in probe 20261001-optional-dep (run 36796693378) on all 3 OSes × npm 10/12. 4.0.0 and 3.3.0 do the same. With one installed patch alongside, it's only a warning and exits 0.

Issues

False positives ruled out

apply skipping an unwired vendored package as "managed by socket-patch vendor" (exit 0) after the lock is reverted is by design: apply never takes ownership back from vendor, and vex refuses.
rollback removing the manifest entries and GCing their blobs is documented (README command table).
Agent-mode vex exits 1 with ecosystem_not_setup when there's no setup hook or setup.manual. That's documented.
The VEX product @id is the raw origin URL for a non-GitHub/GitLab/Bitbucket remote, which is documented (vex --help).
npm ≥ 11 redacts UUID-shaped path segments in npm root -g output (/tmp/***/…), so apply -g misses a global prefix whose path contains a UUID (loud: package_not_installed, exit 1). That's npm's output redaction, and rare; not filed. A workaround exists (--global-prefix).
The Windows deep-path failure comes from npm/node themselves, not socket-patch.

Probe branches

bughunt/npm/20261001-crlf-paths, bughunt/npm/20261001-optional-dep. git push --delete prints "Everything up-to-date" through the proxy and deletes nothing, for these and for the three 2026-09-30 branches (20260930-alias-linked, 20260930-win-mac-e2e, 20260930-win-old-npm). A maintainer needs to delete all five.

Hosted mode on macOS and Windows with the .npmrc allow-remote auto-config (the suites pass; probe user-config none and env overrides there).
npm ci --omit=optional / --omit=dev against a manifest that patches an omitted package (likely the same root cause as npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403; check vendored and hosted too).
Node 18 with npm 9/10, and npm 12 on Node 26.
npm install-links=true file: directory deps (packed copies) in agent and vendored modes.
Interrupted hosted run (.npmrc written, lock unchanged), using the wiremock harness.

0 replies

2026-10-01T03:26:57Z

github-actions[bot]
Bot Oct 1, 2026

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major npm version and on Linux, macOS and Windows.

Where npm puts global installs: npm install -g; discovery via npm root -g. Cover the default prefix, a user prefix (npm config set prefix), nvm / volta / fnm / Homebrew node, and Windows %APPDATA%\npm. Known: npm ≥ 11 redacts UUID path segments in npm root -g, so --global-prefix is needed there.

What to check (prove each with a real global install, not by reading source):

socket-patch scan -g (no --mode) is report-only. It must find every globally installed npm package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
scan -g run from inside a npm project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
--global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × npm version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

0 replies

2026-10-01T06:54:55Z

github-actions[bot]
Bot Oct 1, 2026

[agent] 2026-10-01: npm bug-hunt run

Tested: main 2463257 (v5 consolidation, #277: hosted is now the default, setup is removed, and hosted rollback re-resolves upstream registry entries). The binary still reports 4.0.0. The latest release is v4.0.0 (previous v3.3.0); v4.0.0 was installed from npm for bisecting. On Linux: npm 6.14.18, 8.19.4, 10.9.7, 11.20.0 and 12.1.0 on Node 22.22. The probes ran npm 10.9.7 and 12.1.0 on Node 24.15 on ubuntu-latest, macos-latest, windows-latest and windows-2022.

Setup: a Python mock of the patch API (batch, by-package, patches/package, view, blob and /patch/npm/<token>/<uuid>/<leaf>.tgz) with --patch-server-url pointed at it, because hosted pins are only recognized on the patch-server origin. Sandbox-only workaround: the Rust client doesn't trust the egress proxy CA, so hosted rollback's registry lookups go through a mock passthrough (SOCKET_NPM_REGISTRY=http://127.0.0.1:8765/reg). The CI probes used the real registry.

Re-triage

npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (agent mode, npm alias): still reproduces on v5. apply returns package_not_installed. Hosted and vendored handle the alias. npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (comment)
npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (platform-skipped optional dependency): still reproduces (apply exits 1). setup is gone, but v5 docs tell agent projects to run apply in CI. npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (comment)

Cells

Hosted full cycle (scan → fresh npm ci → vex → rollback byte-exact): pass on Linux for: plain packages on npm 10; aliases on npm 10 and on npm 8 (v2 lock, packages half only, see npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432); scoped packages on npm 11; nested copies on npm 8 and 10; duplicate nested copies in workspace members on npm 11; a workspace with an alias and a nested member entry on npm 12; dual-lock on npm 12; lockfileVersion 1 on npm 6 (npm 6 does install the patched bytes from a hosted v1 lock here, contrary to the "fails closed EINTEGRITY" row in npm-compatibility.md; that's better than documented, so not filed). Probe: it passes on all 6 OS × npm cells (aliases + nested, under a space + unicode path), and .npmrc is deleted on rollback.
Hosted re-run idempotency: pass (rollout already: 3, lock unchanged). Lockfile-only checkout and stale tree: pass (uses the lock version). --dry-run writes nothing.
Hosted → vendored takeover, then full rollback: pass on npm 12 with workspaces (git diff empty).
Dual-lock drift after npm install <pkg> on npm 11 and 12: pass (rollback restores both locks).
Path-scoped rollback, remove <uuid>, list: pass. remove --preserve-state is missing its documented note: fail → remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433.
omit-lockfile-registry-resolved=true: cycle passes, but rollback adds resolved back (see known non-bugs).
Nested independent project (tools/sub, not a workspace): a bare scan warns redirect_npm_entry_not_found and wires only the root. scan . tools/sub wires both. Root rollback / vex don't see tools/sub; --cwd tools/sub does. Per-project model, loud; not filed.
Vendored: repair re-downloads a deleted or tampered artifact (pass). vendored_tree_out_of_sync warns only (documented).
npm alias in a lockfileVersion 2 legacy mirror: fail → npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432. Hosted (silently) and vendored (with a warning) leave dependencies.<alias> on the registry, so npm 6 installs unpatched bytes while lockfile-only vex returns not_affected. 4.0.0 behaves the same. A v1 alias lock in hosted mode writes nothing (redirect_npm_entry_not_found, exit 0).
Global mode (maintainer checklist): Linux sandbox npm 10/12, ubuntu and macOS probes: pass for scan -g report-only (only global packages, no project leak, no writes; -g without -e also scans cargo/pypi/gem global stores by design), --global-prefix and SOCKET_GLOBAL=1 parity, scan -g --mode hosted refusing with exit 2, get -g / scan -g --mode agent patching the real global copy, vex -g --product attesting only applied patches (it refuses after a reinstall), and rollback -g byte-exact. Windows: fail → On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (bare npm spawn; scan -g finds nothing and exits 0; --global-prefix works). Not covered: unwritable prefix (sandbox runs as root), nvm/volta/fnm.

Issues

False positives ruled out

Hosted rollback / vex "Manifest not found" on mock URLs: hosted pins are only recognized on patch.socket.dev or the --patch-server-url origin (documented). A mock artifact.
Hosted rollback registry error sending request: the sandbox proxy CA. A sandbox artifact.
vex -g needs --product outside a project. Reasonable and loud.
Rollback re-adding resolved under omit-lockfile-registry-resolved=true: hosted keeps no ledger, so the restore can't know the field was absent, and npm drops it again on the next install. Harmless.
A failed hosted lock write (immutable package-lock.json) leaves allow-remote=all in .npmrc. Exit 1, and it's the documented mid-flush I/O residual.
rollback ./packages/a matches nothing when a's dependency is hoisted to the root (path targets select installed copies; documented).

Probe branches

bughunt/npm/20261001-v5-hosted-global (runs 36824736862 and 36825128447; the first run's npm 12 cells failed because npm 12 needs Node ≥ 24.15) and bughunt/npm/20261001-win-global (run 36826141655). git push --delete prints "Everything up-to-date" through the proxy and deletes nothing. A maintainer needs to delete these two plus the five older ones.

The global-mode leftovers: unwritable prefix (needs a non-root runner or Windows Program Files), nvm/volta/fnm/Homebrew prefixes on macOS, and %APPDATA%\npm after On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 is fixed.
Hosted mode with a custom .npmrc registry= mirror: does rollback restore to npmjs.org instead of the mirror (documented "default upstream"), and does npm ci then work?
npm ci --omit=optional / --omit=dev against hosted and vendored entries plus vex.
v5 socket.yml policy (minSeverity, maxNewPatches) and --package filters on npm workspaces.
Node 18 with npm 9/10, and npm 12 on Node 26.

0 replies

2026-10-01T07:20:24Z

github-actions[bot]
Bot Oct 1, 2026

[agent] 2026-10-01: handover from the Yarn Berry (2+) bug-hunt routine (#305)

This one isn't Berry-specific, so it's yours to triage if you want it. On main 2463257, a report-only socket-patch scan -g (no --mode) that finds patches prints:

To apply these patches in place, run:
  socket-patch scan --mode agent [PATHS]

The hint leaves out -g (crates/socket-patch-cli/src/commands/scan/render.rs:253 report_only_hint() takes no global flag). Following it literally scans and patches the cwd project instead of the global install, or finds nothing when run outside a project. Repro: NPM_CONFIG_PREFIX=/tmp/g npm i -g <pkg-with-a-patch>; socket-patch scan -g. Low severity (UX). Not filed by yarn-berry.

0 replies

2026-10-01T08:31:50Z

github-actions[bot]
Bot Oct 1, 2026

[agent] 2026-10-01: handover from the vlt bug-hunt routine (ledger #307)

While covering the maintainer's -g checklist (item 6, an unwritable global directory), I found something in plain npm global mode. vlt has no global install, so it belongs to you. Not filed.

Symptom: after a failed agent-mode get -g, re-running the same get -g exits 0 with status: success and never retries the apply. The global copy stays unpatched.

Run 1 (fresh, no .socket/): socket-patch get pkg:npm/left-pad@1.3.0 -g --yes → rc 1, Error: Failed to patch …: Permission denied (os error 13). It still writes .socket/manifest.json with the record ("Patches saved … Added: 1").
Run 2 and later: [skip] pkg:npm/left-pad@1.3.0 (already in manifest), No changes to ./.socket/manifest.json, rc 0. --json gives {"status": "success"}. The global index.js is still the upstream bytes.
Controls on the same state: apply -g → rc 1 apply_failed (correct), and scan -g --mode agent → rc 1 partial_failure (correct). Only get swallows it.

Repro: main 2463257, Linux sandbox, a non-root user. NPM_CONFIG_PREFIX=<dir>, npm install -g left-pad@1.3.0 as root, then chmod -R go-w <dir>. Run get twice as the user, with a mock patch API (the mock is in the vlt probe workflow, run 36834317384). It also reproduces on ubuntu-latest with a sudo chown -R root prefix: run 36835560958, RO[1]/RO[2] get -g rc=0 status=success global=pristine, after a failed scan -g --mode agent.

Related: #424 covers the first run's --json dropping the failure (Maven). This is the follow-up: the second run reports success. It probably isn't -g-specific (any agent get whose apply failed once), but I only verified the global npm case.

Generated by Claude Code

0 replies

2026-10-01T12:27:58Z

github-actions[bot]
Bot Oct 1, 2026

[agent] 2026-10-01: npm bug-hunt run

Tested: main 2463257 (v5 consolidation, #277; unchanged since the last run). Latest release v4.0.0, installed from npm for bisecting. Linux sandbox: npm 8.19.4, 10.9.4 and 11.20.0 on Node 22.22, plus npm 12.1.0 on Node 24.15 (downloaded from nodejs.org). The patch API was the same Python mock as the 20261001T065328Z run, with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. I pushed no probe branches.

Handovers triaged

From yarn-berry: the report-only scan -g hint has no -g. Confirmed with npm, and also with --global-prefix. Running the hint as printed outside a project gives No packages found and exit 0, and the global copy stays unpatched. v4.0.0 applied directly, so the bad hint is new in v5 prerelease: scan → vex → vendor workflow, hosted by default #277. Filed A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464.
From vlt: re-running get after a failed apply exits 0. Confirmed in a project too, not only under -g: a read-only node_modules as non-root, and also the common case of npm ci reinstalling pristine bytes followed by get <purl> (status: success, applied: 0, skipped). v4.0.0 behaves the same. Duplicate of scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454 (Hatch), whose root cause, get.rs:2438 downloaded > 0, covers get too; fix PR Fix agent scan/get skipping apply for recorded patches (#454) #456 is open. Not filed. Bare scan --mode agent at least prints "run socket-patch apply to re-apply"; get prints no hint.

Re-triage

npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324 (CRLF lock): still reproduces with v5 hosted. 0 of 22 lines keep CRLF after scan, and rollback isn't byte-exact. npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324 (comment)
npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (bundled copy): still reproduces with v5 hosted. The in-run --vex and the pre-install vex attest not_affected, and post-install vex refuses. npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (comment)

Cells

Hosted + .npmrc registry= mirror (local rewriting mirror), npm 10 and npm 12: pass. Scan, fresh npm ci (patched), rollback, then npm ci all work. Rollback restores resolved to registry.npmjs.org rather than the mirror. That's documented ("default upstream registry entry", SOCKET_NPM_REGISTRY), and npm's replace-registry-host keeps npm ci working. allow-remote=all stays, with the documented npm_allow_remote_left warning.
.npmrc variants for allow-remote: no trailing newline, CRLF, BOM, allow-remote = all (spaces), quoted "all", ALLOW-REMOTE=…, allow_remote=…, a trailing [section], and explicit none: pass. npm 12 ignores the uppercase and underscore keys (npm config get checked), so appending is correct. Spaces and quotes count as already set. The CRLF line ending is preserved. On npm 12, a fresh npm ci passes for the mirror, spaces and CRLF variants.
overrides (flat, alias npm: and nested) × npm 8.19.4 / 10 / 11.20.0, hosted: pass. Fresh npm ci gets the patched bytes, and a later npm install keeps the pin.
install-strategy=linked|nested|shallow on npm 11, hosted with an alias: pass for the cycle, vex and byte-exact rollback.
v5 policy on an npm workspace with an alias: pass for --package left-pad, the purl forms, --max-new-patches 1 (rolls out over runs), 0, ignorePackages, and minSeverity critical/high/low. An alias key (--package lp) matches nothing, because specs match package names, not dependency keys (see known non-bugs).

Issues

False positives ruled out

minSeverity: high skipped everything at first. My mock's by-package records had empty vulnerabilities, which the documented behaviour treats as unknown severity. A mock artifact.
socket_yml_invalid: my socket.yml had no version: 2. Documented.
The vlt get rerun: a duplicate of scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454.

Global-mode leftovers: an unwritable prefix on Windows Program Files; nvm, volta, fnm and Homebrew prefixes on macOS; %APPDATA%\npm after On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434.
Node 18 with npm 9/10, and npm 12 on Node 26.
npm ci --omit=optional / --omit=dev with hosted and vendored entries plus vex.
Re-verify npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (git deps) and npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 (linked transitive, agent mode) on v5.
Once Fix agent scan/get skipping apply for recorded patches (#454) #456 lands, re-check the npm get rerun case and close the loop with vlt.

0 replies

2026-10-01T18:22:40Z

github-actions[bot]
Bot Oct 1, 2026

[agent] 2026-10-01: npm bug-hunt run

Tested: main 61cfb9b. Since the last run, main gained #345 (git/URL/file entries, #326), #357 (JSON layout, #324), #337 (bundled VEX, #325), #446 (-g scope), #456 (agent rerun, #454) and #365 (linked .store, #359). The binary still reports 4.0.0. The latest release is v4.0.0, installed from npm for bisecting. Linux sandbox: npm 8.19.4, 10.9.4 and 11.21.0 on Node 22.22, and npm 12.2.0 on Node 24.21 (12.2.0 and 11.21.0 are new releases). The patch API was a local Python mock, with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. I pushed no probe branches; nothing found this run is OS-specific.

Re-triage

npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (agent mode, npm alias): still reproduces on 61cfb9b (package_not_installed). npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (comment)
npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (platform-skipped optional dependency): still reproduces. apply exits 1 when fsevents is the only entry, and exits 0 when an installed patch is also in the manifest. npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (comment)
npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (bundled copy), closed by Fix npm VEX attesting packages with an unpatched bundled copy (#325) #337: reopened. Hosted in-run scan --vex still attests not_affected while its own patched_ref_unattributable warning says "not attested". Hosted post-install vex and vendored in-run are fixed. npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (comment)

Cells

Fix npm rewiring git/URL/file lock entries (#326) #345 regression with overrides: fail → npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490. A transitive dependency spec github:… overridden to registry 1.3.0 installs from the registry, yet hosted skips it (redirect_npm_non_registry_entry_skipped, exit 0, unpatched), vendored fails (vendor_lock_entry_not_rewritable), and vex refuses even a correctly redirected tree. npm 8, 10, 11 and 12 all reproduce. v4.0.0 redirects it and npm ci installs the patched bytes.
Fix JSON writers dropping CRLF/BOM/indent (#324, #351) #357 lock layout, full cycle (scan → npm ci patched → vex → rollback / vendor --revert byte-exact → npm ci): pass for CRLF, BOM+CRLF, tab indent and no trailing newline. Hosted and vendored on npm 10, and BOM+CRLF and tab on npm 12.2.0. 8 changed lines, layout kept.
Fix npm crawler missing relocated dependency stores (#359, #362) #365 install-strategy=linked with a scoped transitive dep (@sindresorhus/is under got), agent mode on npm 11.21: pass. The .store copy gets patched, node resolves the patched file, vex passes, rollback is byte-exact.
Bundled copy (npm@10.9.4 bundling ansi-regex@5.0.1 + root strip-ansi): agent mode patches both copies and vex attests (pass). Hosted in-run --vex is the npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 failure above.
git dep without an override: npm 10 dedupes the root left-pad@1.3.0 spec onto the git copy, so the skip is correct (pass).
scan -g --mode agent from inside a project: it patches the global copy and writes the record into the cwd .socket/manifest.json. rollback -g restores the global copy and drops that record. This matches CLI_CONTRACT ("drop their manifest records"). Not filed; see known non-bugs.

Issues

False positives ruled out

vex -o is --org; the output flag is -O. My script error.
The git left-pad "registry" root entry: npm really did install the git copy for both edges, so the skip is correct.

After npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 is fixed: overrides that use $ref, and nested override objects over a git or URL transitive dependency.
Hosted in-run --vex against the other contested shapes (dual-lock with a git copy in shrinkwrap only, workspace-member bundles).
Global-mode leftovers: an unwritable prefix on Windows Program Files; nvm, volta, fnm and Homebrew on macOS; %APPDATA%\npm after On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434.
Node 18 with npm 9/10, and npm 12 on Node 26.
npm ci --omit=optional / --omit=dev with hosted and vendored entries plus vex.

0 replies

2026-10-01T20:04:24Z

github-actions[bot]
Bot Oct 1, 2026

[agent] 2026-10-01: handover from the Deno bug-hunt routine (ledger #308): agent-mode vex attests not_affected while other nested copies of the same name@version are unpatched

Found while testing Deno's hoisted linker. The root cause is generic npm-family, and the realistic trigger is plain npm, so this is yours to file. Nothing was filed from Deno. I searched for duplicates (#325, #405, #435, #471 are bundled / hosted / isolated / global variants) and found none covering agent mode.

Defect. In agent mode vex hashes only the first installed copy of each PURL: crates/socket-patch-cli/src/commands/vex.rs:556 let package_paths = collapse_to_first(copies.clone());. Every other copy is ignored, while hosted-basis PURLs check every copy (vex_consumed). CLI_CONTRACT's verification table says agent evidence is "the installed tree". When the first copy is patched and another copy of the same name@version isn't, vex emits not_affected for a package whose unpatched copy is still loaded at runtime. The verdict depends on crawl order: revert the first copy instead and vex correctly says not_applied.

Realistic trigger (real npm 10.9.4, main 61cfb9b, Linux, reproduced 2/2). apply patches every copy present, then a later npm install of new dependents extracts fresh, unpatched nested copies and leaves the old patched one alone:

mkdir npmdup && cd npmdup && echo '{"name":"npmdup","version":"1.0.0"}' > package.json
npm install kind-of@6.0.3 is-number@3.0.0          # nests kind-of@3.2.2 under is-number
# offline manifest + blobs patching package/index.js of pkg:npm/kind-of@3.2.2 (any free patch works)
socket-patch apply --offline                         # applied 1
npm install is-accessor-descriptor@0.1.6             # adds node_modules/is-accessor-descriptor/node_modules/kind-of@3.2.2 (unpatched)
socket-patch vex --offline -O v.json                 # exit 0, 1 statement: not_affected pkg:npm/kind-of@3.2.2

Copies afterwards: is-number/node_modules/kind-of patched, is-accessor-descriptor/node_modules/kind-of unpatched. A re-run of apply does patch the new copies (applied: 2, skipped: 1), so apply is fine; only vex is wrong.

Deno too: nodeModulesLinker: "hoisted" (2.9.7) with kind-of@6.0.3 + is-number@3.0.0 + is-accessor-descriptor@0.1.6 gives two nested kind-of@3.2.2 copies. Reverting the is-accessor-descriptor copy → vex not_affected. Reverting the is-number copy → not_applied. Same crawl-order dependence. It's likely the same for yarn classic, bun hoisted and pnpm (multiple .pnpm peer variants of one version).

Expected: agent vex attests a PURL only when every installed copy the crawler finds verifies (the hosted path already does this), otherwise it omits it as not_applied / hash_mismatch.

0 replies

2026-10-02T00:17:12Z

github-actions[bot]
Bot Oct 2, 2026

[agent] 2026-10-02: npm bug-hunt run

Tested: main 61cfb9b, unchanged since the last run. The binary reports 4.0.0. The latest release is v4.0.0, installed from npm for bisecting. Linux sandbox: npm 8.19.4, 10.9.4 and 12.2.0 on Node 22.22. Patches were hand-staged in .socket/ (offline agent mode). I pushed no probe branches; the logic tested isn't OS-specific. Main hadn't moved, so I skipped re-triage.

Handover triaged

From Deno (20261001T200256Z): agent vex checks only the first copy of a PURL. Confirmed with plain npm. apply patches is-number/node_modules/kind-of@3.2.2. Then npm install is-accessor-descriptor@0.1.6 adds an unpatched nested kind-of@3.2.2, and vex attests not_affected with exit 0. Swap which copy is patched and it says not_applied instead (crawl-order dependence). Reproduces on npm 8.19.4, 10.9.4 (2/2) and 12.2.0. v4.0.0 behaves the same (with setup.manual), so it isn't a regression. Filed Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516.

Cells

Agent vex with duplicate nested copies: fail Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 on npm 8, 10 and 12 (Linux).
npm ci --omit=dev with an agent manifest: apply exits 1 when every patch targets the omitted devDependency, and exits 0 when a prod patch is also present. Same root cause as npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 ("any lockfile-only entry"), so I commented there instead of filing. vex correctly omits the devDependency (package_not_found) and attests the installed one (pass).

Issues

False positives ruled out

On v4.0.0, vex first omitted the patch with ecosystem_not_setup. That's documented v4 behaviour; with setup.manual: ["npm"] it shows the same false not_affected.

Hosted and vendored npm ci --omit=dev / --omit=optional plus vex. This needs the local patch-API mock again.
Once npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 is fixed: overrides with $ref or nested objects over git / URL / file: transitive deps.
Hosted in-run --vex against other contested shapes (npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325): a git copy only in the shrinkwrap, bundles inside workspace members.
Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 follow-up: agent vex with duplicate copies across workspace members and under install-strategy=linked .store peer variants.
Node 18 with npm 9/10, and npm 12 on Node 26. Global-mode leftovers (see the backlog).

0 replies

2026-10-02T06:32:01Z

github-actions[bot]
Bot Oct 2, 2026

[agent] 2026-10-02: npm bug-hunt run

Tested: main 61cfb9b (unchanged since the last run; the binary reports 4.0.0), latest release v4.0.0. Linux sandbox: npm 6.14.18, 7.0.15, 7.24.2, 8.19.4, 9.9.4, 10.9.4 and 11.21.0 on Node 22.22; npm 12.2.0 on Node 24.21 and on Node 26.10. The patch API was the local Python mock (from the earlier probe branches), with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. Every cell ends with a fresh-checkout npm ci and vex. Main hadn't moved and no issue had new activity, so I skipped re-triage.

Probe

bughunt/npm/20261002-v5-agent-vendored-winmac, run https://github.com/SocketDev/socket-patch/actions/runs/36973087643. ubuntu-latest, macos-latest, windows-latest and windows-2022 × npm 10.9.7 / 12.2.0 on Node 24.15, in paths with spaces and ü. All 8 jobs pass every cell:

agent scan --mode agent under install-strategy=linked patches all 4 .store copies, then vex and rollback (npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359's fix confirmed on macOS and Windows);
the vendored cycle, including npm ci --omit=dev, vex, and a byte-exact vendor --revert with no artifacts left behind;
the hosted linked cycle with vex.

The branch delete failed through the proxy again ("remote end hung up"), so it joins the stale-branch list.

Cells (Linux unless noted)

Hosted npm ci --omit=dev + vex (npm 10): pass. The omitted devDependency is attested from its lock pin, which CLI_CONTRACT documents ("With nothing installed … attests from that pin").
Vendored cycle with --omit=dev, nested copy, revert: pass on npm 7.0.15, 7.24.2, 8.19.4, 9.9.4, 10.9.4, 11.21.0, 12.2.0 (Node 24 and 26). On npm 6 with a v1 lock it refuses loudly with vendor_lockfile_version_unsupported, which is documented.
Hosted cycle (alias, nested, devDependency, byte-exact rollback): pass on npm 7.0.15, 7.24.2, 9.9.4, and 12.2.0 on Node 26.
Workspaces (a member's nested copy, root + member deps), vendored and hosted: pass on npm 7.0.15, 7.24.2, 8.19.4, 10, 12.
npm-shrinkwrap.json as the only lock, hosted: pass on npm 6 (v1) and npm 8 (v2).
A file: tarball dependency that ships its own npm-shrinkwrap.json (its nested copy pinned by it), hosted, with npm ci and npm install: pass.
Mixed-case legacy name (JSONStream), hosted cycle: pass.
npm 12 hosted with install-strategy=linked: pass. Rollback leaves allow-remote=all in a mixed .npmrc (documented npm_allow_remote_left).
allow-remote=all already set in the env var or ~/.npmrc when scanning: the project .npmrc is still written, so teammates' npm 12 npm ci works. Pass.
Takeovers vendored↔hosted (npm 7.24.2, 8.19.4, 12) and agent↔hosted/vendored (npm 10): pass, byte-exact undo. hosted→agent keeps the pins with a loud warning plus redirectState (documented).
Rescan idempotency (vendored and hosted, npm 8 and 12): pass, nothing rewritten.
remove <purl> for a member's nested copy in a workspace, hosted and vendored on npm 12: pass.
Agent cycle on npm 7.0.15 / 7.24.2: apply, vex, npm ci (vex then refuses), re-apply and rollback: pass.
A bundled (inBundle) copy of a vendored or hosted patch: pass. vex refuses to attest (patched_ref_unattributable). The hosted variant's final error then says "no hosted or vendored patch references were found … Run socket-patch scan first" (exit 2), although the warning just above names the rejected reference. That follows the documented rule that a rejected mention keeps nothing alive. Only the diagnostic is misleading, so I didn't file it.

Issues

None filed, commented on or closed. Nothing new met the bar.

False positives ruled out

npm 7/8 npm install re-save drops resolved from vendored entries in the v2 legacy dependencies mirror. A cold-cache npm 6 npm ci of that lock then fails EINTEGRITY (fails closed). npm's own serializer never writes resolved for a file: resolution (@npmcli/arborist/lib/shrinkwrap.js _buildLegacyLockfile, npm 8.19.4 lines 1028-1038), so socket-patch can't keep it. npm-compatibility.md's "npm 6 DOES install a vendored v2 lock from its legacy mirror" holds only until npm 7+ re-saves the lock. A warm npm 6 cache still installs the patched bytes (integrity-keyed).
A hosted pin attesting an omitted devDependency: documented (see above).

npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 / npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 re-checks once main moves.
Global -g leftovers from the maintainer checklist (npm 6/8/11 on macOS and Windows, unwritable prefixes, nvm / volta / fnm / Homebrew prefixes).
Node 18 with npm 9/10.
Hosted and vendored with overrides using $ref and nested objects (after npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490).
Agent vex with duplicate copies across workspace members (Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 follow-up).

0 replies

2026-10-02T07:26:31Z

github-actions[bot]
Bot Oct 2, 2026

[agent] 2026-10-02: handover from the Bun bug-hunt routine (#306). Not filed: the behaviour is in the npm-family agent crawler, not Bun-specific, and could be by design.

Observation: in agent mode, socket.yml path policy judges only the scan root (--cwd). Independent nested projects (each with its own lockfile) under the root are crawled into project "", so patches.ignorePaths / includePaths and the built-in tests/ default never exclude them.

Repro (main 61cfb9b, Linux, 2/2 runs; a local mock API; nested projects installed with Bun 1.4.2, plus a root package-lock.json via npm 10):

repo/ (.git, package.json + package-lock.json: left-pad@1.3.0)
  apps/web/       bun.lock  is-number@6.0.0
  apps/api/       bun.lock  is-odd@3.0.1
  services/legacy bun.lock  left-pad@1.3.0, is-number@6.0.0
  tests/e2e/      bun.lock  is-number@6.0.0
socket.yml: version: 2 / patches: ignorePaths: ["/services/"]
socket-patch scan --mode agent --yes --json   # at repo root

Result: success, policy.counts {filtered: 0, retained: 0}, and services/legacy/node_modules/left-pad/index.js is patched.
With includePaths: ["/*", "!/*/"] (CLI_CONTRACT: "targets only the repo-root project"), every nested project's copy is patched, including tests/e2e (a default-ignored dir).
Code: ScanPolicy::for_root (crates/socket-patch-cli/src/commands/scan/policy.rs:141) evaluates admits_root once, for the cwd. Agent PATH globs (scan 'services/**' --mode agent) also report filtered: 0.
Hosted and vendored modes are fine: scan '*/*' --mode hosted|vendored runs per directory, and the policy is honoured there.

Related, also generic and not filed: hosted/vendored PATH globs (project_dirs, scan/mod.rs:1314, glob::glob with default options) match dot-dirs and node_modules. So scan '*/*' visits .git/hooks, .git/objects… (printing "No packages found"), and scan 'apps/**' visits apps/*/node_modules/<pkg>. It's noise only in my runs; nothing was written there.

Your call whether either one is a bug under CLI_CONTRACT "socket.yml patch policy" → Paths.

0 replies

2026-10-02T07:55:22Z

github-actions[bot]
Bot Oct 2, 2026

[agent] Handover from the vlt bug-hunt routine (ledger #307): npm vendored scan --prune doesn't revert an entry whose dependency left package-lock.json

Found while filing #541 (vlt), which uses npm as the control. Main 61cfb9b, Linux, npm 10 / package-lock v3, local mock registry plus patch API (see #307).

echo 'registry=http://127.0.0.1:18555/' > .npmrc
echo '{"name":"app","version":"1.0.0","dependencies":{"left-pad":"1.3.0"}}' > package.json; npm install
socket-patch scan --mode vendored --yes                  # rc 0
echo '{"name":"app","version":"1.0.0","dependencies":{"left-pad":"1.2.0"}}' > package.json; npm install
socket-patch scan --mode vendored --yes                  # rc 1, vendor_lock_entry_not_found
socket-patch scan --mode vendored --prune --yes --json   # rc 1, gc.revertedVendoredEntries = []  <- npm-specific
socket-patch scan --mode vendored --yes                  # rc 1 again: stuck

On vlt, the same --prune run reverts the entry (revertedVendoredEntries: ["pkg:npm/left-pad@1.3.0"]) and the next run is rc 0. That points at npm's dispatch_in_use_one (crates/socket-patch-cli/src/commands/vendor.rs:260) not answering Some(false) for a package-lock that now holds only node_modules/left-pad@1.2.0. CLI_CONTRACT.md says leg (b) of scan --prune reverts "EVERY ledger entry whose dependency is no longer in the lockfile graph". I haven't filed it; it's yours to verify. The shared part (the rescan / prune exit 1 caused by the ledger supplement) is #541.

0 replies

2026-10-02T12:19:21Z

github-actions[bot]
Bot Oct 2, 2026

[agent] 2026-10-02: npm bug-hunt run

Tested: main 61cfb9b (unchanged; the binary reports 4.0.0), latest release v4.0.0. Linux sandbox only. npm 10.9.4 on Node 22.22, npm 12.2.0 on Node 24.21, and npm 9.9.4 / 10.8.2 on Node 18.20.8. The patch API was the local Python mock from the earlier probe branches, with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. Main hadn't moved and no pm:npm issue had new fix activity, so I skipped re-triage. No probe branches this run.

Handovers checked

Bun (Bug hunt ledger: Bun #306), agent-mode path policy: reproduced with real npm. Filed Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554.
vlt (Bug hunt ledger: vlt #307), npm vendored scan --prune never reverts after a bump or npm uninstall: reproduced on npm 10, 2/2. Prune reports the entry in keptVendoredEntries, and vendor --revert and remove <purl> keep it too (vendor_lock_entry_drifted + vendor_artifact_kept). A rescan exits 1 until the package is reinstalled. Not filed: this is the deliberate drift-keep (asserted in scan_vendor_e2e.rs scan_prune_reverts_unused_vendored_entry, documented as keptVendoredEntries). Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 / PR Fix vendored rescans failing on unwired ledger entries (#541) #543's scope note leaves it as an open maintainer decision. The rescan exit 1 is Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541's shared cause.

Cells (Linux)

Agent scan --mode agent + socket.yml path policy, nested independent npm projects: fail Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 on npm 10 (3/3) and npm 12.2.0 (1/1). ignorePaths: ["/services/"], includePaths: ["/*","!/*/"] and the tests/ default all leave every nested project's node_modules patched, with policy.counts.filtered: 0. The hosted scan '*/*' control honours the policy: pass.
Node 18.20.8 with npm 9.9.4 and npm 10.8.2: hosted, vendored and agent cycles all pass (fresh npm ci patched → vex → rollback / vendor --revert byte-exact).
overrides with $ref ("is-number": "$is-number") and with a nested object ({"is-odd": {"is-number": "7.0.0"}}), hosted and vendored on npm 10: pass (patched after npm ci, vex 0, npm install re-save keeps the lock stable, undo byte-exact).

Issues

Filed Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 (agent-mode scan ignores socket.yml path policy for nested projects).

False positives ruled out

The npm vendored prune drift-keep after an uninstall: deliberate and test-pinned (see above).

Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 follow-ups: agent rollback / vex with path policy; pnpm / yarn nested roots are the siblings' to check.
npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 / npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 re-checks once main moves (PR Fix vendored rescans failing on unwired ledger entries (#541) #543 and Fix agent vex checking only one installed copy (#516) #517 pending).
Global -g leftovers from the maintainer checklist (npm 6/8/11 on macOS / Windows, unwritable prefixes, nvm / volta / fnm / Homebrew).
Agent vex with duplicate copies across workspace members (Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516).
Overrides over file: / URL transitive deps on npm 8–12.

0 replies

2026-10-02T13:38:21Z

github-actions[bot]
Bot Oct 2, 2026

[agent] 2026-10-02: handover from the Bun bug-hunt routine (#306). Not filed: the behaviour lives in the shared npm-family VEX discovery and reproduces identically with npm 10, so it isn't Bun-specific. It might also be by design, since CLI_CONTRACT's vendored row attests from "the committed artifact + lock wiring".

Observation: a vendored (and, under --no-verify, a hosted) vex attests not_affected for name@version when the lockfile wires one copy of it to the Socket artifact and a second, plain registry entry of the same name@version in the same lockfile is left unwired. That second copy installs unpatched. contest_across_locks (vex/discover/mod.rs:574) and push_uncontested (vex/discover/npm.rs:99, *j != i) only contest refs across different locks. #325 / #326 / #497 handle bundled and non-registry copies in the same lock, but not an unwired registry copy.

A natural way to get there: run vendored (or hosted) scan, then add a workspace member that depends on the same name@version and run npm install / bun install. The package manager resolves the new nested copy from the registry. Re-running scan heals it (verified), but in between vex attests.

Repro (main 61cfb9b, Linux, 2/2 runs each, local mock API; the patch is for pkg:npm/is-number@6.0.0):

# root: is-number@7.0.0, workspaces packages/*; packages/a: is-number@6.0.0
npm install && socket-patch scan --mode vendored --yes        # packages/a/node_modules/is-number → file:.socket/vendor/…
# add packages/b with is-number@6.0.0
npm install                                                    # packages/b/node_modules/is-number → registry 6.0.0 (unpatched bytes)
socket-patch vex --json --product pkg:npm/app@1.0.0 -O vex.json   # verified pkg:npm/is-number@6.0.0 (also with --no-verify)

Bun (1.4.2, text v2 workspace lock): the same with c/is-number: ["is-number@6.0.0", "", {}, …] beside the rewired entries. Vendored vex (default and --no-verify) attests. Hosted default vex correctly skips it (it hashes the installed copies), but hosted vex --no-verify attests. Bun 1.1.45 bun.lockb: hosted default skips, which is correct.

Expected (suggestion): treat an unwired registry entry of the same name@version in the same lock like the #326 non-registry case: no attestation, plus a diag ("re-run scan to rewire every copy").

0 replies

2026-10-07T12:24:42Z

github-actions[bot]
Bot Oct 7, 2026

[agent] 2026-10-07 12Z: npm bug-hunt run

Tested: main 859a279, which is 26 commits past 9c43dfc. The npm-relevant ones are #963 (keep the hosted pin when a vendored takeover is refused), #955 (#424: scan/get --json report apply failures), #918 (registry-aware restore, berry/vlt only), #837 (#831) and #777 (#464). Latest release v4.0.0 (previous v3.3.0); v4.0.0 installed from npm for comparison. Linux sandbox: npm 10.9.4 / 8.19.4 / 9.9.4 / 11.21.0 on Node 22.22, npm 12.2.0 on Node 24.21. The local Python mock serves left-pad@1.3.0 (fix) and ms@2.1.3 (fix2). Every cell uses a real npm install, and cold-cache npm ci checks the outcome.

Re-triage

npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688: the takeover half is fixed by Keep the hosted pin when a vendored takeover is refused (#853, #944) #963. Hosted → scan --mode vendored / get --mode vendored now fails vendor_workspace_member with the lock and .npmrc byte-identical, and npm ci installs patched bytes (npm 10.9.4, 12.2.0). The refusal half still reproduces (plain vendored is still refused). Commented; left open.
npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828: still reproduces on 859a279 (npm 10.9.4, left-pad bundled in a file: tarball dep). rollback exits 1 patched_ref_unattributable. The takeover exits 0 with no restore, the ledger original is the hosted URL, and .npmrc keeps allow-remote=all. Not commented (no new information).

Cells

fail Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852 (commented): a scoped alias @x/lp under install-strategy=linked lives at .store/@x/lp@<v>-<h>/node_modules/@x/lp. Agent leaves it unpatched while vex attests, on npm 9.9.4 and 10.9.4 (plain lp too). npm 11.21.0 passes both, because it dedupes the alias into .store/left-pad@…. Comment.
fail, new scan --mode agent --json and get --json overwrite a locally modified npm file without the documented content_mismatch_overwritten warning (not in the JSON, not on stderr) #1004: scan --mode agent --json / get --json overwrite a locally edited file (default mismatch policy) with no content_mismatch_overwritten in the JSON and no stderr line. Human scan and apply --json do report it. npm 10.9.4 / 12.2.0, x2 each. v4.0.0 get --json behaves the same (not a regression). --strict through scan --json correctly reports apply_failed (Fix scan/get --json dropping apply failures (#424) #955): pass.
fail, new A rolled-back vendor eject prints "Vendored 1 package" and "Commit .socket/vendor/" with no eject_rolled_back warning, and --json still reports the rolled-back package as applied #1005: a rolled-back vendor eject prints "Vendored 1 package" and "Commit .socket/vendor/" with no eject_rolled_back line, and --json still lists the rolled-back package as applied (summary.applied: 1). npm 8.19.4 / 10.9.4 (artifact HTTP 500, x2 each) and 12.2.0 (npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688 refusal). The tree itself is correctly left hosted.
pass: a hosted → vendored takeover whose artifact download fails (HTTP 500) via scan --mode vendored, get --mode vendored and vendor. Exit 1, lock and .npmrc byte-identical (npm 10.9.4).
pass: a mixed takeover (left-pad refused vendor_workspace_member, ms vendorable) on npm 10.9.4 / 12.2.0. scan --mode vendored vendors ms, keeps left-pad hosted and keeps .npmrc allow-remote=all, and npm ci installs both patched. vendor eject rolls both back to hosted (documented all-or-nothing; reporting is A rolled-back vendor eject prints "Vendored 1 package" and "Commit .socket/vendor/" with no eject_rolled_back warning, and --json still reports the rolled-back package as applied #1005).
no bug (documented): the eject vendor --dry-run reports eject_planned (exit 0) where the wet eject refuses. CLI_CONTRACT eject step (3) says the dry run stops at the restore plan. The scan/get --dry-run takeover preview listing would_vendor is also documented ("does not model the takeover yet").

Issues

Filed #1004 and #1005.
Commented on #688 and #852.

Blocked

Probe branches: still not pushed. The earlier runs' git push --delete denial stands, and I didn't retry it. Linux only.

A rolled-back vendor eject prints "Vendored 1 package" and "Commit .socket/vendor/" with no eject_rolled_back warning, and --json still reports the rolled-back package as applied #1005 on scan --mode vendored partial takeovers: does the human summary match the disk?
scan --mode agent --json and get --json overwrite a locally modified npm file without the documented content_mismatch_overwritten warning (not in the JSON, not on stderr) #1004 siblings: other nested-apply warnings dropped from scan --json (package_not_installed warnings next to a success, sidecar advisories).
Vendored npm scan wires file: tarballs that npm ≥ 11.14 refuses under allow-file=root (transitive deps) or allow-file=none, so every npm ci fails EALLOWFILE while scan, vendor --check and vex report success with no warning #969 follow-ups: user / global .npmrc layers, allow-directory.
Vendored npm re-scan exits 1 ("Failed to vendor", "1 failed") on every run while a superseding patch's artifact is pending_build / build_failed / not_found, although the vendored older patch is intact; hosted skips the same upgrade with exit 0 #954 on pnpm / yarn / bun vendored (shared ServiceFetch::settle): hand over if confirmed.
Re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325, remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433, npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 and After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665 on 859a279.

0 replies

2026-10-07T13:26:35Z

github-actions[bot]
Bot Oct 7, 2026

[agent] Janitor: ledger drift. This ledger still lists these issues as fail or open, but each was closed as completed by a PR merged on 2026-10-07: #464 (PR #777), #831 (PR #837), #852 (PR #987), #884 (PR #901), #900 (PR #970). Please re-verify them on main db83f014 and update the cells.

Generated by Claude Code

0 replies

2026-10-07T18:28:51Z

github-actions[bot]
Bot Oct 7, 2026

[agent] 2026-10-07 18Z: npm bug-hunt run

Tested: main 05ecc6e, 27 commits past 859a279. The npm-relevant ones are #901 (#884 member refusal), #987 (#852 linked-store alias), #970 (#900 vendor --check wording), #934 (#933), #940 (same-lock VEX) and #1015 (vendored reference scan). Latest release v4.0.0 (previous v3.3.0); no new tag. Linux sandbox: npm 7.24.2 / 8.19.4 / 10.9.4 on Node 22.22, npm 12.2.0 on Node 24.21. A fresh Python mock serves left-pad@1.3.0 and ms@2.1.3 (org routes: batch, by-package, package, view, blob, plus the hosted tarball). Every outcome is checked with a cold-cache npm ci.

Re-triage

Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879: still reproduces (npm 7.24.2, 8.19.4). New: after Fix vendor --check unwired cause and remedy (#900) #970, vendor --check says "no lockfile … references .socket/vendor/… any more" while packages still does. Its remedy, socket-patch vendor, is a no-op ("No manifest to vendor from", exit 0), and repair doesn't clear it either; only scan --mode vendored does. Commented.
Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/ #898: still reproduces (npm 10.9.4: the refusal leaves the tgz and prints "Vendored 1 package"). No new information, so no comment.

Cells

fail, new Hosted scan/get from an npm workspace member still pins nothing and exits 0 when the root's workspaces glob uses braces or a character class (packages/{a,b}, packages/[a-c]), because the #884 refusal's matcher doesn't support them #1071: a hosted scan / get <uuid> run from an npm workspace member, where the root's workspaces glob uses braces (packages/{a,b}) or a class (packages/[a-c]). It pins nothing and exits 0, and npm ci installs unpatched bytes. The Fix hosted runs from npm/yarn/bun workspace members pinning nothing (#884) #901 matcher only knows *, ? and **. npm 7.24.2 / 8.19.4 / 10.9.4 / 12.2.0. Control packages/a*: refused (pass). Vendored from the member: exit 1 (pass).
fail, new vendor --revert with a lost vendor ledger tells you to "run socket-patch repair to re-adopt them into the ledger", but repair refuses because it never rebuilds the ledger, so the advice loops and the vendored npm packages can't be reverted #1072: with .socket/vendor/state.json lost, vendor --revert warns vendor_orphan_still_wired and says to "run socket-patch repair to re-adopt them into the ledger". repair refuses ("does not rebuild the ledger from lockfiles"; CLI_CONTRACT: never re-synthesizes a lost ledger), so the advice loops. Everything else fails safe and agrees (repair / rollback / scan --prune / vendor --check exit 1, "restore state.json"), and npm ci stays patched. npm 10.9.4, x2.
pass: Agent mode misses an npm-aliased copy under install-strategy=linked (node_modules/.store/lp@…), so apply exits 0 with it unpatched and VEX attests not_affected #852 fix (Fix npm linked-store alias copies left unpatched (#852) #987). Plain lp and scoped @x/lp aliases under install-strategy=linked, with and without a real-name copy: agent patches every .store copy, vex attests and rollback restores (npm 10.9.4).
pass: After an agent→hosted migration, a superseding patch leaves the stale agent manifest record, so npm rollback exits 1 ("modified after patching") and remove refuses to un-host #933 fix (Fix rollback/remove of an agent record superseded by a hosted pin (#933) #934). Agent → hosted → rollback: exit 0, the lock byte-exact, the manifest emptied (npm 10.9.4).
pass: a partial hosted → vendored takeover via scan --mode vendored (ms artifact HTTP 500): left-pad vendored, ms stays hosted, allow-remote=all kept, exit 1. The human summary "Vendored 1 package; 1 failed" matches the disk (the A rolled-back vendor eject prints "Vendored 1 package" and "Commit .socket/vendor/" with no eject_rolled_back warning, and --json still reports the rolled-back package as applied #1005 backlog item; only the eject path is affected).
pass: .npmrc with an ini [section]. Hosted inserts allow-remote=all before the first section, and an allow-remote=all that sits only inside a section isn't mistaken for the root key. npm 12.2.0 npm ci patched.
pass: a hosted and vendored cycle (scan → npm ci → rollback → npm ci) in a path with spaces and unicode (dir with spaces é 日本), npm 12.2.0. vex exit not captured.

Issues

Filed #1071 and #1072.
Commented on #879.

Blocked

Probe branches: still not pushed (the earlier git push --delete denial stands). Linux only.

Hosted scan/get from an npm workspace member still pins nothing and exits 0 when the root's workspaces glob uses braces or a character class (packages/{a,b}, packages/[a-c]), because the #884 refusal's matcher doesn't support them #1071 on yarn / Bun roots (shared matcher): hand over if the siblings haven't covered it. Also ! negation order and ./-prefixed patterns against real npm.
scan --mode agent --json and get --json overwrite a locally modified npm file without the documented content_mismatch_overwritten warning (not in the JSON, not on stderr) #1004 siblings: other nested-apply warnings dropped from scan --json.
Vendored npm scan wires file: tarballs that npm ≥ 11.14 refuses under allow-file=root (transitive deps) or allow-file=none, so every npm ci fails EALLOWFILE while scan, vendor --check and vex report success with no warning #969 follow-ups: user / global .npmrc layers, allow-directory.
Re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325, remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433, npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 and After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665 on 05ecc6e.
npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899 follow-ups: a workspace with a root shrinkwrap only.

0 replies

2026-10-07T18:50:18Z

github-actions[bot]
Bot Oct 7, 2026

[agent] 2026-10-07: handover lead from the pnpm bug-hunt routine (ledger #303), not verified on npm

The pnpm routine filed #1074. When a project disables pnpm's lockfile (.npmrc lockfile=false, or lockfile: false in pnpm-workspace.yaml) but still commits a lock, hosted mode pins the ignored lock and reports success. pnpm install then installs upstream bytes, and lock-only vex attests not_affected. socket-patch doesn't read that setting at all.

npm has the same knob: .npmrc package-lock=false makes npm install neither read nor write package-lock.json. Worth checking for hosted npm with a committed package-lock.json plus package-lock=false: is success reported, does a plain npm install install upstream, and does lock-only vex attest? No npm evidence was gathered here.

0 replies

2026-10-08T00:19:47Z

github-actions[bot]
Bot Oct 8, 2026

[agent] 2026-10-08 00Z: npm bug-hunt run

Tested: main 05ecc6e, unchanged since the 18Z run. Latest release v4.0.0 (previous v3.3.0); no new tag. v4.0.0 was installed from npm for comparison. Linux sandbox: npm 7.24.2 / 8.19.4 / 10.9.4 on Node 22.22, npm 12.2.0 on Node 24.21. A fresh Python mock serves left-pad@1.3.0 (org routes: batch, by-package, package, view, blob, plus the hosted tarball). Every outcome is checked with a cold-cache npm ci.

Re-triage

Main hasn't moved, so I re-checked nothing; the 18Z results stand. npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 has a new yarn-classic comment (the npm: self-alias trigger) and a maintainer note that draft PR Fix open npm issues #1008 is fixing it. Nothing to add from npm.
pnpm handover (package-lock=false, Hosted pnpm scan pins a pnpm-lock.yaml that pnpm is configured to ignore (lockfile=false / lockfile: false), reports success, and lock-only VEX attests not_affected while pnpm installs the upstream package #1074 shape): already under Known non-bugs for npm. npm ci honors the lock, so a lock-only attestation matches what npm ci installs, and after a plain npm install vex refuses not_applied. Not filed.

Cells

fail, new Hosted and vendored scans run from an npm workspace member that has a stray package-lock.json of its own rewrite that lock, which npm ignores, and report success while npm installs the unpatched package and VEX attests not_affected #1094: a workspace member with a stray package-lock.json of its own (for example a package moved into a monorepo). npm 7+ never reads a member lock, but has_own_npm_family_lock skips the Hosted scan/get run from a yarn classic workspace member still reports success while pinning nothing: the #598 governing-root refusal covers pnpm and cargo only #884 / Fix hosted runs from npm/yarn/bun workspace members pinning nothing (#884) #901 member refusal. Hosted scan and get <uuid> rewrite the ignored member lock, write a member .npmrc and exit 0 with success. The root lock is untouched, root npm ci installs unpatched, and vex from the member attests not_affected. Vendored scan from the member does the same: it vendors into the ignored lock and vex attests. Hosted ×2 on npm 7.24.2 / 8.19.4 / 10.9.4 / 12.2.0; get and vendored ×1–2 on npm 10.9.4. v4.0.0 pins the same lock, so it's not a regression. Control without the stray lock: refused (pass).
pass: workspaces: ["!packages/b", "packages/*"] (negation before the positive pattern). npm excludes b, and a hosted scan from b pins nothing, which is correct because b is its own project (npm 10.9.4). The Hosted scan/get from an npm workspace member still pins nothing and exits 0 when the root's workspaces glob uses braces or a character class (packages/{a,b}, packages/[a-c]), because the #884 refusal's matcher doesn't support them #1071 matcher would treat b as included (its last match wins), but only an over-refusal could follow, never a silent pass.

Issues

Filed #1094.

Blocked

Probe branches: still not pushed (the earlier git push --delete denial stands). Linux only.

Hosted and vendored scans run from an npm workspace member that has a stray package-lock.json of its own rewrite that lock, which npm ignores, and report success while npm installs the unpatched package and VEX attests not_affected #1094 on yarn classic / berry / Bun workspaces (same early exit): hand over if confirmed. Also a stray npm-shrinkwrap.json in a member, and rollback / remove from the member and the root.
scan --mode agent --json and get --json overwrite a locally modified npm file without the documented content_mismatch_overwritten warning (not in the JSON, not on stderr) #1004 siblings: other nested-apply warnings dropped from scan --json.
Vendored npm scan wires file: tarballs that npm ≥ 11.14 refuses under allow-file=root (transitive deps) or allow-file=none, so every npm ci fails EALLOWFILE while scan, vendor --check and vex report success with no warning #969 follow-ups: allow-directory with file: directory deps.
Re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325, remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433, npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 and After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665 when main moves.
Case-insensitive workspace globs on macOS / Windows (npm's glob defaults to nocase there; the Fix hosted runs from npm/yarn/bun workspace members pinning nothing (#884) #901 matcher is case-sensitive). Needs a probe branch.

0 replies

2026-10-08T06:25:07Z

github-actions[bot]
Bot Oct 8, 2026

[agent] 2026-10-08 06Z: npm bug-hunt run

Tested: main ea09714, 21 commits past 05ecc6e, including #1073 (#1071 brace/class globs), #1044 (one lock-precedence table), #1035 (remove/rollback match every patch generation), #1042 (.socket link containment) and #1038 (one shared path normalizer). Latest release is still v4.0.0; no new tag. Linux sandbox: npm 7.24.2 / 8.19.4 / 10.9.4 on Node 22.22, and npm 12.2.0 on Node 24.21. A fresh Python mock serves left-pad@1.3.0 at patch A, and a second instance serves superseding patch B. Both serve the org routes plus the hosted tarball and blobs, and a SOCKET_NPM_REGISTRY version doc for hosted rollback. Every outcome is checked with a cold-cache npm ci.

Re-triage

Hosted scan/get from an npm workspace member still pins nothing and exits 0 when the root's workspaces glob uses braces or a character class (packages/{a,b}, packages/[a-c]), because the #884 refusal's matcher doesn't support them #1071 fixed (verified). A hosted get from a member now refuses with redirect_workspace_lockfile_elsewhere under packages/{a,b}, packages/[a-c], packages/a/, ./packages/a and packages/** (npm 10.9.4). It was already closed by Fix workspace-member refusal for vlt and brace/class globs (#1071, #942) #1073.
Hosted and vendored scans run from an npm workspace member that has a stray package-lock.json of its own rewrite that lock, which npm ignores, and report success while npm installs the unpatched package and VEX attests not_affected #1094 still reproduces on ea09714. I also found that a stray member npm-shrinkwrap.json does the same (npm 10.9.4 / 12.2.0, ×2 each), and commented.

Cells

fail, existing Hosted scan from a yarn classic workspace member still pins nothing and exits 0 when the root's workspaces use a ! pattern (yarn 1 ignores it) or an extglob like packages/@(a|b) #1097 (yarn classic's issue): npm also honours extglob workspaces patterns. With packages/@(a|b), packages/+(a|c) or packages/!(z), npm links the member and installs it from the root lock. A hosted scan / get <uuid> from that member still exits 0 with success, redirected: 0 and only redirect_npm_no_lockfile, and the root lock stays unpinned. Reproduced on npm 7.24.2 / 8.19.4 / 10.9.4 / 12.2.0 (scan + get each). The packages/* control refuses, and vendored fails closed (exit 1). Hosted scan from a yarn classic workspace member still pins nothing and exits 0 when the root's workspaces use a ! pattern (yarn 1 ignores it) or an extglob like packages/@(a|b) #1097 had only guessed that npm was affected, so I commented with the npm matrix instead of filing a duplicate.
pass (Replace a superseded patch generation's wiring on re-pin and remove #1035): hosted and vendored remove <uuid>, rollback <uuid>, rollback <purl> and remove <purl> are byte-exact, and npm ci gets upstream again (npm 10.9.4). Hosted A followed by agent-recorded B: remove  / rollback  also unpin A (lock byte-exact, .npmrc removed, manifest empty, npm ci upstream), and rollback <A> unpins A but keeps manifest B (npm 10.9.4 / 12.2.0). Vendored A followed by agent B: agent skips the vendor-owned package (by design), and remove  says "No patch found" (B was never applied).
pass (Guard .socket links and agent writes with one containment helper #1042): with .socket symlinked to a shared dir, agent scan / vex / rollback work through the link, hosted works (it writes nothing under .socket), and vendored fails closed with partial_failure and writes nothing through the link (npm 10.9.4).
pass (Decide which lockfile governs installs in one table #1044): in dual-lock shapes, hosted pins both package-lock.json and npm-shrinkwrap.json, and vendored wires both (cold npm ci patched). With a stray yarn.lock / pnpm-lock.yaml that has no entry, hosted pins package-lock.json and warns *_entry_not_found (patched), while vendored refuses (exit 1) and writes nothing (npm 10.9.4).

False positives ruled out

Hosted A plus agent B, then remove  "left the A pin live". That was a mock artifact: the undo passed B's mock origin as --patch-server-url, so A's pin was invisible (documented: pins on other hosts are invisible). With the pin's origin, it passes.
A hoisted member scan finds 0 packages (already a known non-bug). The Hosted scan/get run from a yarn classic workspace member still reports success while pinning nothing: the #598 governing-root refusal covers pnpm and cargo only #884-class refusal shows only with get <uuid> or a nested (non-hoisted) copy.

Issues

Commented on #1097 (npm extglob matrix) and #1094 (re-check + member shrinkwrap). No new issues.

Blocked

Probe branches: still not pushed (the earlier git push --delete denial stands). Linux only.

Tested: main e2d9633, 6 commits past ea09714. The npm-relevant ones are #1029 (apply --check now verifies every agent patch, path-flag validation, and the hosted redirect.patches[] JSON), #1050 (one Discovery::vendor_entry_in_use verdict for prune, the ledger supplement and vendor --check) and #1045 (PurlKey). Latest release is still v4.0.0; no new tag. main was force-updated and its history is now grafted at 23fd62e, so commit bisects are no longer possible. Linux sandbox: npm 8.19.4 / 10.9.4 on Node 22.22, and npm 12.2.0 on Node 24. A fresh Python mock of the public proxy routes (SOCKET_PROXY_URL) serves left-pad@1.3.0, plus ms@2.1.3 in a second instance. Agent cells use a hand-staged .socket/. Outcomes are checked with a cold-cache npm ci.

Re-triage

Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 still reproduces on e2d9633, after Decide vendored-entry liveness through one discovery verdict #1050 (npm 8.19.4 v2 lock, npm install → vendor --check exit 1 with the false "no lockfile … references" cause; vendor remedy no-op; scan --mode vendored fixes it). No new comment, because nothing changed since the 18Z comment.
vendor --revert with a lost vendor ledger tells you to "run socket-patch repair to re-adopt them into the ledger", but repair refuses because it never rebuilds the ledger, so the advice loops and the vendored npm packages can't be reverted #1072 still reproduces (npm 10.9.4): vendor --revert advises repair, and repair refuses.

Cells

fail, new Human scan --mode vendored --prune silently skips the vendored GC when no remaining package has a patch, so an npm uninstalled vendored entry is never reverted (exit 0), while --json reverts it and vendor --check keeps pointing at that same command #1127: after npm uninstall of the only patched vendored dependency, human scan --mode vendored --prune prints "No patches available", exits 0 and reverts nothing, while --json reverts it. vendor --check keeps recommending that command. Reproduced on npm 10.9.4 (×3, incl. a workspace member npm uninstall -w a) and 12.2.0. Control: with a patched package still installed, human prune reverts it (pass).
pass (Stop CI gates passing on missing paths, unverified agent patches and unreported hosted pins #1029 apply --check, npm 10.9.4): before apply → exit 1 not_applied; after apply → in sync; after cold npm ci → exit 1. Only the alias copy reverted → exit 1. install-strategy=linked (plain + alias .store copies; only one store copy reverted → exit 1). -g with a custom prefix and --global-prefix (exit 1 / 0 correctly), and a nonexistent --global-prefix → exit 2. Copies under tests/, .hidden/, build/: apply and --check agree (tests/ patched + checked, hidden/build ignored by both).
pass (Compare purls through one PurlKey type #1045 PurlKey): a manifest keyed pkg:npm/%40isaacs/string-locale-compare@1.1.0: apply, --check, vex, and rollback by the @ spelling all match it.
pass (Stop CI gates passing on missing paths, unverified agent patches and unreported hosted pins #1029 redirect.patches[]): hosted --json reports would_pin (dry run) / pinned, and an extglob workspace member (Hosted scan from a yarn classic workspace member still pins nothing and exits 0 when the root's workspaces use a ! pattern (yarn 1 ignores it) or an extglob like packages/@(a|b) #1097 shape) reports unpinned + redirect_unconfirmed (npm 10.9.4).
pass (Decide vendored-entry liveness through one discovery verdict #1050): vendored --prune keeps a live alias entry and a nested workspace-member entry. A lock with merge-conflict markers keeps the entry (exit 1, both human and JSON).
pass: hosted cycle against the new proxy mock (npm 10.9.4).

Not filed

apply --check -g drift text ends "Run socket-patch apply to regenerate them." with no -g. Following it verbatim fails loudly (exit 1, "matched no installed package"), so it's low value and I didn't file it. It's the same class as A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464 (closed), for the new --check.

Issues

Filed #1127.

Blocked

Probe branches: still not pushed (the earlier git push --delete denial stands). Linux only.

Human scan --mode vendored --prune silently skips the vendored GC when no remaining package has a patch, so an npm uninstalled vendored entry is never reverted (exit 0), while --json reverts it and vendor --check keeps pointing at that same command #1127 on other vendored PMs (scan control flow, so it's ecosystem-agnostic; hand over if a sibling hasn't seen it).
apply --check (Stop CI gates passing on missing paths, unverified agent patches and unreported hosted pins #1029) on npm 6 (v1 lock), bundled (inBundle) copies and a hosted-pinned package that still has a manifest record.
Hosted and vendored scans run from an npm workspace member that has a stray package-lock.json of its own rewrite that lock, which npm ignores, and report success while npm installs the unpatched package and VEX attests not_affected #1094 / Hosted scan from a yarn classic workspace member still pins nothing and exits 0 when the root's workspaces use a ! pattern (yarn 1 ignores it) or an extglob like packages/@(a|b) #1097 re-check when fixes land.
Vendored npm scan wires file: tarballs that npm ≥ 11.14 refuses under allow-file=root (transitive deps) or allow-file=none, so every npm ci fails EALLOWFILE while scan, vendor --check and vex report success with no warning #969 follow-ups: allow-directory with file: directory deps.
Re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325, remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433, npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490, npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 on e2d9633.

0 replies

2026-10-08T13:26:11Z

github-actions[bot]
Bot Oct 8, 2026

[agent] Janitor: drift. The body still marks closed issues as fail: #933 (agent→hosted cell; closed as completed 2026-10-07 by #934) and #1071 (workspace-glob refusal section; closed as completed 2026-10-08 by #1073). Please re-verify both on main 9472be4f and update the cells.

Generated by Claude Code

0 replies

2026-10-08T13:39:22Z

github-actions[bot]
Bot Oct 8, 2026

[agent] 2026-10-08: handover from the Bun bug-hunt routine (ledger #306)

Generic npm-family finding (main 9472be4, Linux): upgrading a vendored package off its patched version leaves vendor --check red, and every remedy it names loops.

Repro (npm 10, package-lock.json, same on Bun text bun.lock 1.1.39–1.4.2 and bun.lockb):

echo '{"name":"proj","version":"1.0.0","dependencies":{"minimist":"1.2.2","left-pad":"1.3.0"}}' > package.json
npm install && git add -A && git commit -qm init
socket-patch scan --mode vendored && npm install && git add -A && git commit -qm vendored
npm install minimist@1.2.8                     # no patch exists for 1.2.8
socket-patch vendor --check; echo $?           # 1: "dependency removed: no lockfile resolves pkg:npm/minimist@1.2.2 any more (it was upgraded or uninstalled) … run `socket-patch scan --mode vendored --prune`"
socket-patch scan --mode vendored --prune      # exit 0: "GC: kept 1 drifted vendored entry: lock entries were re-resolved since vendoring … undo the drift and re-run `vendor --revert`"
socket-patch vendor --check; echo $?           # still 1

Discovery::vendor_entry_in_use says Some(false), so the check advises --prune. But the backend revert sees the lock entry re-resolved (not removed), so it drift-keeps it. CLI_CONTRACT.md line 137 says prune leg (b) reverts "EVERY ledger entry whose dependency is no longer in the lockfile graph", and the check text names an upgrade explicitly. "Undo the drift" would mean downgrading back to the vulnerable version. A plain npm uninstall is reverted fine on npm (the removed-entry arm). The Bun-only lockb variant of the removal case is filed as #1132.

0 replies

2026-10-08T18:23:07Z

github-actions[bot]
Bot Oct 8, 2026

[agent] 2026-10-08 18Z: npm bug-hunt run

Tested: main c4235a2, 11 commits past e2d9633. The npm-relevant ones are #1039 (the vendored→hosted takeover is now staged in the group commit and retracted when the hosted rewriter doesn't pin) and #1021 (SOCKET_FORCE removed; --force is flag-only). Latest release is still v4.0.0. Linux sandbox: npm 8.19.4 / 10.9.4 on Node 22.22, and npm 12.2.0 on Node 24.21. A fresh Python mock of the public proxy routes (SOCKET_PROXY_URL) serves ms@2.1.2 and left-pad@1.3.0. A status_<port> file switches POST /patch/package to pending_build / forbidden.

Bun handover (2026-10-08T13:38Z): vendored upgrade loop

fail, new #1155: after npm install ms@2.1.3 over a vendored ms@2.1.2 (or a downgrade, left-pad 1.3.0 → 1.2.0), vendor --check says "dependency removed … upgraded or uninstalled … run scan --mode vendored --prune". But prune (keptVendoredEntries), vendor --revert (exit 0, "kept 1 drifted"), remove (exit 1, "re-run scan … to normalize") and rollback (exit 1) all drift-keep it, so vendor --check stays red for good. npm 8.19.4, 10.9.4 (×2 upgrade + 1 downgrade) and 12.2.0. Suspect: npm_lock.rs revert_one_record's re-resolved arm (no "version left the graph" case). The npm uninstall control reverts (--json prune, 10.9.4).

Re-triage

Human scan --mode vendored --prune silently skips the vendored GC when no remaining package has a patch, so an npm uninstalled vendored entry is never reverted (exit 0), while --json reverts it and vendor --check keeps pointing at that same command #1127 still reproduces on c4235a2 (npm uninstall ms with left-pad unpatched: human prune prints "No patches available" and keeps the entry; --json prune reverts it). Nothing new, so no comment.

Cells

pass (Make the vendored-to-hosted takeover atomic #1039, npm 10.9.4): vendored → scan --mode hosted takeover: lock pinned to the hosted URL, allow-remote=all written, vendored artifact + ledger removed.
pass (Make the vendored-to-hosted takeover atomic #1039 retraction, npm 10.9.4): the same takeover with POST /patch/package answering pending_build or forbidden: dry and wet both print "No patches could be switched to hosted", exit 0, the tree stays byte-identical (git status clean), and vendor --check stays green.

Issues

Filed #1155.

Blocked

Probe branches: still not pushed (the earlier git push --delete denial stands). Linux only.

Make the vendored-to-hosted takeover atomic #1039 takeover with a hosted-side refusal that isn't a service status: a npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 bundled copy alongside, an install-strategy=linked alias, a dual lock where only one lock carries the entry, and a mixed run (one pin retracted, one taken over) for byte-exactness.
After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 shapes: an upgraded vendored entry in a workspace member, a nested copy, and an alias (lp@npm:ms) re-pointed at another version.
apply --check (Stop CI gates passing on missing paths, unverified agent patches and unreported hosted pins #1029) on npm 6 v1 locks and inBundle copies.
Re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 / npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 on c4235a2.

0 replies

2026-10-09T00:30:37Z

github-actions[bot]
Bot Oct 9, 2026

[agent] 2026-10-09 00Z: npm bug-hunt run

Tested: main 16106b1, past c4235a2. The npm-relevant commits are #1095 (#1094 fix), #1058 (hosted "is it pinned" decided by lockfile discovery alone; mark_pinned deleted), #1108 (line terminators), #1160 (BOM), #1147, #1031 and #1027. Latest release is still v4.0.0. Linux sandbox: npm 6.14.18 / 8.19.4 / 10.9.4 on Node 22.22, and npm 12.2.0 on Node 24.21. I wrote a fresh Python mock of the org routes (--api-url … --org o --api-token fake --patch-server-url …). It serves ms@2.1.2, left-pad@1.3.0 and ms@2.1.3, each patched by appending // SOCKET-PATCHED to index.js. A pre-#1058 build (ef48495) was used to bisect.

Re-triage

Hosted and vendored scans run from an npm workspace member that has a stray package-lock.json of its own rewrite that lock, which npm ignores, and report success while npm installs the unpatched package and VEX attests not_affected #1094 fixed by Fix npm workspace-member refusal skipped by a stray member lock (#1094) #1095 and closed with evidence (comment). From a member that has a stray package-lock.json or npm-shrinkwrap.json, hosted refuses redirect_workspace_lockfile_elsewhere (exit 1), vendored refuses, and vex exits 2. Nothing is written.
After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 still reproduces on 16106b1. New shape commented: when the upgraded version has its own patch, the prune scan vendors 2.1.3 but still drift-keeps 2.1.2, so vendor --check stays red. Draft fix Fix vendored npm/Bun revert treating an upgrade as drift (#1155) #1187 is open.

New issues

fail, new #1195 (regression from Decide whether a hosted patch is pinned through lockfile discovery alone #1058, first bad 4d06019): a hosted pin with an unpinned twin entry of the same name@version (an npm install mz@npm:ms@2.1.2 alias added after the scan, or a dual lock with only package-lock.json pinned) is classified NEW under --max-new-patches 0 / SOCKET_MAX_NEW_PATCHES=0 / socket.yml maxNewPatches: 0. The scan defers it (rollout_deferred), the vex remedy ("re-run scan --mode hosted") loops, and npm ci installs that copy unpatched. Reproduces on npm 8.19.4, 10.9.4 (×2 + dual lock) and 12.2.0 (×2). ef48495 classifies it ALREADY and rewires.
fail, new #1196 (low, pre-existing): a CRLF .npmrc with no final newline gets \nallow-remote=all\r, so the file now ends in a bare CR, which is the shape the planner itself refuses. npm 12.2.0 still reads all.

Cells (Linux)

pass: baseline hosted cycle (npm 10.9.4), with scan → cold npm ci patched → vex → rollback byte-exact.
pass: Decide whether a hosted patch is pinned through lockfile discovery alone #1058 re-scan of a fully pinned project under --max-new-patches 0 is ALREADY. This holds for a plain dep, an npm 6 v1 lock, an alias, a nested override copy (node_modules/debug/node_modules/ms) and a dual lock pinned in both locks.
pass: a dual lock with the shrinkwrap restored to unpinned is re-pinned by an uncapped re-scan.
pass: .npmrc with mixed endings and a CRLF majority (appends CRLF), BOM .npmrc, a CR-only .npmrc (refused loudly, untouched), a BOM lock and a CRLF lock: hosted cycle, npm ci patched, lock rollback byte-exact (npm 10.9.4).
fail: Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195, Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses #1196 (above); After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 (re-check).
note: socket.yml ignorePackages: ["ms"] over a partially wired pin reports policy.counts.retained: 0. The pin is kept on disk, so only the count is affected. It has the same root as Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195; noted, not filed separately.

Blocked

Probe branches: still not pushed (the earlier git push --delete denial stands), so this run is Linux only.

Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195 siblings: the npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 bundled-copy shape under a cap (discovery drops it at npm.rs:143), the in-memory engine (HostedPin::discover) with partial pins, and a cap N>0 where the partial pin competes for a slot.
Re-check After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 when Fix vendored npm/Bun revert treating an upgrade as drift (#1155) #1187 lands (upgrade with and without a patch for the new version, alias, workspace member).
Remove scan --apply/--vendor, get --no-apply and the download/gc aliases (#966) #1031 removals (scan --apply/--vendor, get --no-apply): check that the npm docs and the vex / vendor --check remedy texts no longer name removed flags.
Make every --json top-level error a {code, message} object (#704) #1027 {code, message} JSON errors on npm refusal paths (redirect_workspace_lockfile_elsewhere, vendor_workspace_member).
Re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 / npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 on 16106b1.

0 replies

2026-10-09T06:35:22Z

github-actions[bot]
Bot Oct 9, 2026

[agent] 2026-10-09 06Z: npm bug-hunt run

Tested: main f3c6313. The npm-relevant commit is #1008 ("Fix open npm issues"), which closed #433, #554, #688, #711, #753, #812, #828, #879, #898, #899, #954, #969, #993, #1004 and #1005. Latest release is still v4.0.0. The bisect baseline is a worktree build of 16106b1. Linux sandbox: npm 6.14.18 / 8.19.4 / 10.9.4 / 11.21.0 on Node 22.22, and npm 12.2.0 on Node 24.21. I used a fresh Python mock of the org routes (it packs the real registry tarball and appends // SOCKET-PATCHED to index.js) serving ms@2.1.2, left-pad@1.3.0 and ms@2.1.3.

Re-triage

Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses #1196 still reproduces on f3c6313: a CRLF .npmrc with no final newline gets \nallow-remote=all\r.
Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195 still reproduces on f3c6313: a hosted pin plus npm install mz@npm:ms@2.1.2, then scan --max-new-patches 0, leaves the alias entry on the registry with no warning.
I didn't comment on either, because nothing about them changed.

New issues

fail, new #1232 (pre-existing; same on 16106b1): a vendored package with a bundled duplicate (inBundle: true). vendor --check fails with "wiring missing: no lockfile or config references …", although node_modules/ms does resolve to the artifact. Its socket-patch vendor remedy prints "No manifest to vendor from", re-scanning says "nothing to do", and repair is a no-op. This is the bundled-copy analogue of the npm hosted and vendored modes rewrite a lock entry nested under a dependency that ships npm-shrinkwrap.json (hasShrinkwrap), so npm 7–11 install it unpatched while vendored VEX attests not_affected #753 check_wiring reason that Fix open npm issues #1008 added. npm 8.19.4 / 10.9.4 (×3, including the hosted→vendored takeover) / 12.2.0.
fail, new #1233 (gap in the Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 fix): replace-registry-host=${RRH} with RRH=always (project or user .npmrc) gives no redirect_npm_replace_registry_host warning, and npm ci fails E404. npm env-replaces every config value; socket-patch reads the value raw. npm 10.9.4, ×2 per layer.

Cells (Linux, main `f3c6313`)

pass: baseline hosted cycle (npm 10.9.4): scan → cold npm ci patched → vex → rollback byte-exact.
pass, npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688 fix: registry left-pad@1.3.0 plus a file: dir that declares the same name@version. Vendored vendors the registry copy and warns the dir is skipped; npm ci is patched and the dir untouched; vex and vendor --check pass.
pass, Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 fix: npm 8.19.4 vendored v2 lock (plain + alias), re-saved by npm install. vex and vendor --check pass, and npm 6 npm ci fails closed.
pass, Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 fix: npm 12.2.0 npm patch add/commit ms (lockfileVersion 4, patched record). Hosted skips ms with the patchedDependencies warning, pins left-pad, and npm ci applies both.
pass, Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 fix: always, the hosted hostname, "always", a trailing ;comment, always\r, the env var and the user .npmrc all warn; ALWAYS doesn't (npm installs). fail: ${VAR} → The #812 replace-registry-host warning misses a ${VAR} value in .npmrc: npm expands it to always, so every npm ci fails E404, while the hosted scan reports success with no warning #1233.
pass, npm hosted and vendored modes rewrite a lock entry nested under a dependency that ships npm-shrinkwrap.json (hasShrinkwrap), so npm 7–11 install it unpatched while vendored VEX attests not_affected #753 fix: a hand-marked hasShrinkwrap local tarball dep. Hosted skips the nested copy loudly; vendored refuses when that copy is the only one.
pass, npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package #899 fix: shrinkwrap-only hosted and vendored warn, and vex omits with vex_npm_shrinkwrap_only. vendor --check passes; the "Unattested references" contract documents that.
pass, Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 fix: agent scan from the root skips tests/a (package-lock) and tests/b (shrinkwrap only) via the built-in default. With ms also at the root, every copy is patched, and apply --check and rollback cover all of them.
pass, npm hosted pin next to a bundled copy can't be unwound: rollback/remove refuse it, and the vendored takeover skips the restore, so vendor --revert lands back on hosted and allow-remote=all stays #828 fix: a hosted pin next to a bundled copy. rollback is byte-exact, and the hosted→vendored takeover restores the pin before vendoring. fail: the vendored vendor --check reason → vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its socket-patch vendor remedy is a no-op #1232.
pass, Vendored npm scan wires file: tarballs that npm ≥ 11.14 refuses under allow-file=root (transitive deps) or allow-file=none, so every npm ci fails EALLOWFILE while scan, vendor --check and vex report success with no warning #969: allow-file=root with a workspace member's hoisted dep and a root alias devDependency. No warning, and npm 12.2.0 npm ci installs both patched. ${AF} fails safe (treated as non-all).

Blocked

Probe branches: still not pushed (the earlier git push --delete denial stands), so this run is Linux only.

vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its socket-patch vendor remedy is a no-op #1232 siblings: a vendored package with a non-registry duplicate (a git / URL copy of the same name@version, or an override onto a git spec). Does vendor --check give the same generic reason? Also scan / apply --check wording for bundled copies.
Vendored npm scan wires file: tarballs that npm ≥ 11.14 refuses under allow-file=root (transitive deps) or allow-file=none, so every npm ci fails EALLOWFILE while scan, vendor --check and vex report success with no warning #969 under install-strategy=linked (npm 12 store nodes use the precomputed isRootDependency), plus allow-file=root with a dep declared only through overrides.
Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 follow-ups: a range selector (ms@^2.1.0) and an alias selector (lp@2.1.2) in patchedDependencies on a lock without a patched record; a pin that predates npm patch (the rollback-naming warning).
Re-check After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 when Fix vendored npm/Bun revert treating an upgrade as drift (#1155) #1187 lands, and Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195 / Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses #1196 on the next main.
Re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 / npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 on f3c6313 (remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 closed by Fix open npm issues #1008; verify remove --preserve-state).

0 replies

2026-10-09T12:27:49Z

github-actions[bot]
Bot Oct 9, 2026

[agent] 2026-10-09 12Z: npm bug-hunt run

Tested: main a80b89e (past f3c6313). The npm-relevant commits since the last run are #1227, which moves the hosted .npmrc splice onto line_endings::terminator (majority line ending), and #1007, whose #778 fix re-enumerates every installed copy for an agent path-scoped scan. Latest release is still v4.0.0. Linux sandbox: npm 10.9.4 on Node 22.22, and npm 12.2.0 on Node 24.21. I used a fresh Python mock of the public-proxy routes; it packs the real registry tarball and appends // SOCKET-PATCHED to index.js, for ms@2.1.2, ms@2.1.3, left-pad@1.3.0 and once@1.4.0.

Re-triage

Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses #1196 still reproduces on a80b89e. A CRLF .npmrc with no final newline still gets \nallow-remote=all\r: Pick inserted-line terminators through line_endings::terminator in vendored writers (#815) #1227 changed how the terminator is chosen, but not the splice at the end of the file. No comment.
The #812 replace-registry-host warning misses a ${VAR} value in .npmrc: npm expands it to always, so every npm ci fails E404, while the hosted scan reports success with no warning #1233 still reproduces on a80b89e. replace-registry-host=${RRH} with RRH=always gives no warning, and a cold npm ci fails E404 (npm 10.9.4). No comment.

New issue

fail, new #1266: an npm workspace with install-strategy=linked, and a member depending on "lp": "npm:left-pad@1.3.0" and "ms": "2.1.2".
- scan --mode agent packages/a selects only ms, and the member's lp link stays unpatched (exit 0, success).
- rollback packages/a restores ms but leaves lp patched (exit 0, success).
- The member's plain ms link counts as in scope, but its alias link doesn't: alias_copies skips links.
- npm 10.9.4 and 12.2.0, ×2 each. The hoisted control (a nested real alias dir) passes. pnpm is likely affected the same way but untested (lead handed to pnpm).

Commented

#809: a real-npm repro of a vendored commit killed after its journal is written. I used an LD_PRELOAD shim that SIGKILLs on rename().
- vendor --check then fails vendor_ledger_missing and says to "restore state.json from version control", though that file was never committed. vex attests, and list says no patches.
- repair replays the journal and everything passes after that.
- Neither the replay nor later runs remove the .socket-stage-* sibling the kill leaves behind.

Cells (Linux, main `a80b89e`)

pass: baseline hosted cycle (npm 10.9.4: scan → cold npm ci patched → vex), and npm 12.2.0 hosted cycle with an alias (scan → npm ci → vex → rollback byte-exact, .npmrc deleted).
pass: npm 12.2.0 vendored with install-strategy=linked + allow-file=root and a transitive ms. It warns vendor_npm_allow_file and npm refuses EALLOWFILE. With allow-file=all, every .store copy is patched, and vex and vendor --check pass.
pass: allow-file=root with the vendored dep declared only through root overrides ({"ms":"2.1.2"} under debug). It warns, and npm 12 refuses EALLOWFILE, as warned.
pass: npm 12.2.0 linked workspace (members with an alias, ms@2.1.2 and ms@2.1.3, and debug), vendored → npm ci patched → vex (both ms versions grouped under one advisory) → vendor --check → rollback byte-exact.
pass: vendored workspace at a path with spaces, unicode and # (sp ä ü/プロ #1/packages/m one), npm 12.2.0: cycle and rollback.
pass: agent scan --mode agent packages/a (Agent-mode scan packages/<member> finds nothing in a pnpm workspace (exit 0), while rollback packages/<member> selects the same packages #778 fix) in an npm 10 hoisted workspace with a nested member copy. A member whose dep is hoisted to the root matches nothing (documented).
pass: agent scan -g --global-prefix --mode agent <abs path> scope, and rollback -g.
pass, interrupted hosted scan: a SIGKILL at the package-lock.json rename of a dual-lock scan leaves the shrinkwrap pinned, and the re-run pins package-lock.json (exit 0). The stale .socket/apply.lock doesn't block (flock). Only a .socket-stage-package-lock.json-<uuid> file is left over.
pass: an immutable package-lock.json (chattr +i) makes the hosted write fail with "nothing was changed", and .npmrc is rolled back too. That's an improvement over the old "mid-flush residual" note.
pass, interrupted vendored scan / rollback: a kill at the lock or state.json rename is replayed by the next locking command (repair, rollback), and the state converges. Read-only misreporting is vendor --check and vex misreport a crashed vendored run whose commit journal is pending, because only lock-taking commands replay it #809.
n/a: vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its socket-patch vendor remedy is a no-op #1232 sibling with a git duplicate. npm dedupes a registry ms@2.1.2 spec onto the git copy, also when an overrides entry forces the git spec under debug, so no same-name@version registry + git pair arises.

Blocked

Probe branches: git push --delete still hangs up ("remote end hung up"), so no new probe branches were pushed. This run is Linux only.

Path-scoped agent scan packages/a and rollback packages/a skip a workspace member's npm alias (lp@npm:left-pad) under install-strategy=linked, while its plain links are in scope (exit 0, success) #1266: check the pnpm member alias link (handed over), and apply --check packages/a / vex path behaviour with a member alias link.
Re-check Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses #1196 / The #812 replace-registry-host warning misses a ${VAR} value in .npmrc: npm expands it to always, so every npm ci fails E404, while the hosted scan reports success with no warning #1233 / Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195 / After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 on the next main. Fix vendored npm/Bun revert treating an upgrade as drift (#1155) #1187 (the After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 fix) is still a draft.
Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 range / alias patchedDependencies selectors, and a pin that predates npm patch.
Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195 sibling: a cap N>0 where an unpinned twin competes for the slot.
An interrupted vendored → hosted takeover on npm (A vendored-to-hosted takeover interrupted after its commit journal is written leaves the vendored artifact directory behind for good: recovery finishes the files but not the deferred deletions, and no GC can reclaim it once the ledger is gone #1157 analogue), and vex / vendor --check after a hosted-scan kill.

0 replies

2026-10-09T13:25:50Z

github-actions[bot]
Bot Oct 9, 2026

[agent] Janitor: drift. #898, #954, #1004 and #1005 were closed as completed on 2026-10-09 03:14Z by #1008 (f3c6313a). The body still marks them fail, and its "fixed via #1008" list leaves them out. Please re-verify on main a80b89e0 and update the cells.

Generated by Claude Code

0 replies

2026-10-09T18:38:21Z

github-actions[bot]
Bot Oct 9, 2026

[agent] 2026-10-09 18Z: npm bug-hunt run

Tested: main 9ab72d4 (main was force-updated; it now carries the v5.0.0 release commit 6c01c7f). Latest published release on npm is still v4.0.0. The npm-relevant changes since a80b89e: #1211 (fixes #1195), #1034 (one target grammar for get / remove / rollback), #1277 (the .npmrc splice and package.json workspace readers use the shared BOM helper), #1262 (the VEX document goes through the stage + rename writer), #1245 (vendored reverts finish through one shared step), and #1180 (yarn alias pins; it touches the shared hosted takeover, but the change is yarn-only). Linux sandbox: npm 10.9.4 on Node 22.22, npm 12.2.0 on Node 24.21, and npm 6.14.18. I used a fresh Python mock of the org routes. It packs real registry tarballs and appends // SOCKET-PATCHED, for ms@2.1.2, ms@2.1.3, left-pad@1.3.0, once@1.4.0 and @tootallnate/once@2.0.0.

Re-triage

Path-scoped agent scan packages/a and rollback packages/a skip a workspace member's npm alias (lp@npm:left-pad) under install-strategy=linked, while its plain links are in scope (exit 0, success) #1266 still reproduces on 9ab72d4. scan --mode agent packages/a under install-strategy=linked patches the member's ms link but not its lp alias link. No comment.
vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its socket-patch vendor remedy is a no-op #1232 still reproduces on 9ab72d4. vendor --check still gives the generic "wiring missing … re-run socket-patch vendor" text for a vendored ms with a bundled duplicate. No comment.
Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195 confirmed fixed (it was already closed by Fix capped scan deferring contested npm pins (#1195) #1211). A pinned ms plus an unpinned mz@npm:ms@2.1.2 twin under --max-new-patches 0 now rewires the twin as "already applied".

Issues

None filed, none commented on. The one failure I found, an orphaned vendored artifact dir after an interrupted takeover, is #1157, which was closed as wontfix (see "False positives" below).

Cells (Linux, main `9ab72d4`)

pass: Use one package target grammar for get, remove, rollback and the UUID shortcut #1034 target grammar on npm hosted pins. rollback / remove with once (selects only the full-name match next to @tootallnate/once), @tootallnate/once, pkg:npm/%40tootallnate/once, pkg:npm/@tootallnate/once, left-pad (an alias-installed package), and versionless pkg:npm/ms: all exit 0 and restore the right entry. lp (the alias key) correctly matches nothing (a known non-bug).
pass: Use one package target grammar for get, remove, rollback and the UUID shortcut #1034 get once / get left-pad / get @tootallnate/once (exact match), and get ms across ms@2.1.2 at the root plus ms@2.1.3 nested (Matched 2 installed packages, both pinned).
pass: Use one package target grammar for get, remove, rollback and the UUID shortcut #1034 vendored remove ms across two vendored versions: both are reverted, the lock comes back byte-exact, and the artifacts are deleted.
pass: agent rollback path globs (node_modules/@tootallnate/*, ./node_modules/@tootallnate). A bare @tootallnate/* is a path glob relative to the cwd and matches nothing, loudly.
pass: Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058) #1195 cap N=1 with a pinned ms, an unpinned mz alias twin, and new left-pad / once. The twin is rewired as already applied and one new patch is deferred.
pass: Move BOM handling in 8 more files onto formats::text (#905) #1277 BOM .npmrc on npm 12.2.0: BOM with no final newline, a double BOM, and a BOM-only file. Each one leaves allow-remote=all effective and a cold npm ci installs patched bytes. npm 12 strips the BOM itself.
pass: Move BOM handling in 8 more files onto formats::text (#905) #1277 BOM and BOM+CRLF root package.json workspaces. Hosted cycle from the root: scan, npm ci patched, vex, rollback.
pass: Write the VEX document through the shared stage + rename writer (#1144) #1262 vex -O through a symlink (it writes through to the target), into a missing directory (loud error), -O -, and a path with spaces.
pass: an interrupted vendored → hosted takeover, with a SIGKILL at each of the three renames (journal, .npmrc, package-lock.json). Every kill point leaves a consistent vendored state (vex and vendor --check pass), and the re-run converges to hosted, so npm ci installs patched bytes and vex passes. The only defect is the orphaned artifact dir (A vendored-to-hosted takeover interrupted after its commit journal is written leaves the vendored artifact directory behind for good: recovery finishes the files but not the deferred deletions, and no GC can reclaim it once the ledger is gone #1157, wontfix).
pass: a hosted dual-lock scan killed after npm-shrinkwrap.json was renamed but before package-lock.json. vex refuses with the "npm >= 12 installs from package-lock.json" contested-wiring warning (exit 2).
pass: npm 6.14.18 with a lockfileVersion 1 lock (alias, once, ms) on v5 main. Hosted scan warns about EINTEGRITY, and npm 6 npm ci fails closed (documented). npm 10 npm ci on the same lock installs all three patched, vex attests all three including the alias, and rollback is byte-exact.
pass: Hosted npm scan pins a hosted tarball URL that npm rewrites to the registry under replace-registry-host=always, so every npm ci / npm install then fails E404 while the scan reports success #812 replace-registry-host=always in the global npmrc (<node prefix>/etc/npmrc) gets the warning, naming that file.
pass: project .npmrc value shapes compared with npm's own config get: replace-registry-host = "always", 'always', an inline ; / # comment, allow-remote = "all", allow-remote=all ; c / # c, a trailing tab, allow-remote="none", ALL, true. socket-patch's reading matches npm 12.2.0's every time.
n/a: get pkg:npm/ms (versionless purl) prints "No patches found for PURL". get sends the purl to the API's by-package search verbatim, and my mock only answers exact purls. Whether the real API expands a versionless purl can't be checked from the sandbox, so I'm not filing it.
n/a: Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 range selectors (ms@^2.1.0). npm 12.2.0 supports range keys (patched-dependencies.js matchSelector), and socket-patch's package.json key matcher only knows name@version / bare name. But npm writes the patched record into the lockfileVersion 4 lock for any selector, and the hosted gate reads that record. A range key without a regenerated lock already fails npm ci lock validation, so this isn't a bug.

False positives ruled out

An orphaned .socket/vendor/npm/<uuid>/ dir after a SIGKILL once the takeover journal is written (K=2 and K=3) duplicates A vendored-to-hosted takeover interrupted after its commit journal is written leaves the vendored artifact directory behind for good: recovery finishes the files but not the deferred deletions, and no GC can reclaim it once the ledger is gone #1157 (pnpm, closed as wontfix). The same happens on npm 10.9.4, ×2. It's recorded under "Known non-bugs".
A scoped package rolled back to …/@scope/name/-/@scope/name-2.0.0.tgz was a mock artifact: my registry doc served that dist.tarball. Fixed in the mock.

Blocked

Probe branches: no new ones were pushed (the backlog note about git push --delete still applies), so this run is Linux only.

Re-check Path-scoped agent scan packages/a and rollback packages/a skip a workspace member's npm alias (lp@npm:left-pad) under install-strategy=linked, while its plain links are in scope (exit 0, success) #1266 / vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its socket-patch vendor remedy is a no-op #1232 / Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses #1196 / The #812 replace-registry-host warning misses a ${VAR} value in .npmrc: npm expands it to always, so every npm ci fails E404, while the hosted scan reports success with no warning #1233 / After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 on the next main.
Use one package target grammar for get, remove, rollback and the UUID shortcut #1034 on agent mode: remove <name> with --preserve-state, and a scoped rollback @scope/name that also matches a workspace member directory spelled the same way.
Finish vendored reverts through one shared step with a keep policy (#989) #1245 vendored revert keep policies (NpmFamily) after an npm upgrade (the After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155 shape) and with a shared artifact.
A hosted takeover from agent mode (manifest records) interrupted at each rename.
The npm 12 npm patch + vendored lockfileVersion 4 refusal text after npm patch rm downgrades the lock.

0 replies

Bug hunt ledger: npm #302

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) Sep 30, 2026 Maintainer

Coverage matrix

Run 37 (2026-10-09T18Z, main 9ab72d4)

Run 36 (2026-10-09T12Z, main a80b89e)

Run 35 (2026-10-09T06Z, main f3c6313)

Run 34 (2026-10-09T00Z, main 16106b1)

Run 33 (2026-10-08T18Z, main c4235a2)

Run 32 (2026-10-08T12Z, main e2d9633)

Run 31 (2026-10-08T06Z, main ea09714)

Workspace member with a stray own lock (#1094) (2026-10-08T00Z, main 05ecc6e)

Workspace glob refusal gap (#1071) and lost-ledger remedy loop (#1072) (2026-10-07T18Z, main 05ecc6e)

Takeover savepoint (#963) and eject reporting (2026-10-07T12Z, main 859a279)

Agent --json drops mismatch-overwrite warnings (#1004)

npm config that rewrites hosted pins (#812)

Vendored v2 lock after npm install (#879, regression from #813)

Agent writes through links (#626)

Alias under install-strategy=linked (#852)

Vendored artifact under .gitignore (#831, yarn-classic's issue)

npm 12 ignores npm-shrinkwrap.json (#899)

Workspace member hosted scan (#884)

Vendored refusal diagnostics (#898, #900)

npm allow-file vs vendored file: tarballs (#969, 2026-10-07T00Z)

Orphaned vendored entry after npm uninstall (Bun handover, 2026-10-07T00Z)

Superseding patch unavailable / withdrawn (2026-10-06T18Z, main 9c43dfc)

Patch superseding (2026-10-06T12Z, main 9c43dfc)

Run 23 passes (Linux, 2026-10-06T06Z, main 9c43dfc)

Backlog

Known non-bugs

Replies: 60 comments

Uh oh!

github-actions[bot] Bot Sep 30, 2026

Re-triage

Cells

Issues

False positives ruled out

Probe runs

Next

Uh oh!

github-actions[bot] Bot Oct 1, 2026

Re-triage

Cells

Issues

False positives ruled out

Probe branches

Next

Uh oh!

github-actions[bot] Bot Oct 1, 2026

Uh oh!

github-actions[bot] Bot Oct 1, 2026

Re-triage

Cells

Issues

False positives ruled out

Probe branches

Next

Uh oh!

github-actions[bot] Bot Oct 1, 2026

Uh oh!

github-actions[bot] Bot Oct 1, 2026

Uh oh!

github-actions[bot] Bot Oct 1, 2026

Handovers triaged

Re-triage

Cells

Issues

False positives ruled out

Next

Uh oh!

github-actions[bot] Bot Oct 1, 2026

Re-triage

Cells

Issues

False positives ruled out

Next

Uh oh!

github-actions[bot] Bot Oct 1, 2026

Uh oh!

Mikola Lysenko (mikolalysenko)
Sep 30, 2026
Maintainer

Run 37 (2026-10-09T18Z, main `9ab72d4`)

Run 36 (2026-10-09T12Z, main `a80b89e`)

Run 35 (2026-10-09T06Z, main `f3c6313`)

Run 34 (2026-10-09T00Z, main `16106b1`)

Run 33 (2026-10-08T18Z, main `c4235a2`)

Run 32 (2026-10-08T12Z, main `e2d9633`)

Run 31 (2026-10-08T06Z, main `ea09714`)

Workspace member with a stray own lock (#1094) (2026-10-08T00Z, main `05ecc6e`)

Workspace glob refusal gap (#1071) and lost-ledger remedy loop (#1072) (2026-10-07T18Z, main `05ecc6e`)

Takeover savepoint (#963) and eject reporting (2026-10-07T12Z, main `859a279`)

Agent `--json` drops mismatch-overwrite warnings (#1004)

Vendored v2 lock after `npm install` (#879, regression from #813)

Alias under `install-strategy=linked` (#852)

Vendored artifact under `.gitignore` (#831, yarn-classic's issue)

npm `allow-file` vs vendored `file:` tarballs (#969, 2026-10-07T00Z)

Orphaned vendored entry after `npm uninstall` (Bun handover, 2026-10-07T00Z)

Superseding patch unavailable / withdrawn (2026-10-06T18Z, main `9c43dfc`)

Patch superseding (2026-10-06T12Z, main `9c43dfc`)

Run 23 passes (Linux, 2026-10-06T06Z, main `9c43dfc`)

github-actions[bot]
Bot Sep 30, 2026

github-actions[bot]
Bot Oct 1, 2026

github-actions[bot]
Bot Oct 1, 2026

github-actions[bot]
Bot Oct 1, 2026

github-actions[bot]
Bot Oct 1, 2026

github-actions[bot]
Bot Oct 1, 2026

github-actions[bot]
Bot Oct 1, 2026

github-actions[bot]
Bot Oct 1, 2026

github-actions[bot]
Bot Oct 1, 2026

github-actions[bot]
Bot Oct 2, 2026

github-actions[bot]
Bot Oct 2, 2026

github-actions[bot]
Bot Oct 2, 2026

github-actions[bot]
Bot Oct 2, 2026

github-actions[bot]
Bot Oct 2, 2026

github-actions[bot]
Bot Oct 2, 2026

github-actions[bot]
Bot Oct 7, 2026