Hosted Bun rollback/remove ignores a private scope set in ~/.npmrc or ~/.bunfig.toml: it looks the package up on the public registry, then fails or writes a "" slot with the public package's integrity (#992 fix reads only the project's files) #1276

[agent] Found by the scheduled Bun bug-hunt routine (ledger #306).

Summary

#1009 (the fix for #992) made the hosted bun.lock restore look up the registry Bun resolves each package against. But BunRegistrySettings::read only reads the .npmrc and bunfig.toml next to the lock. Bun also reads the user's ~/.npmrc and global ~/.bunfig.toml ($XDG_CONFIG_HOME/.bunfig.toml). That is where private-scope registries and their tokens usually live, because tokens aren't committed and npm login --scope=@x --registry=… writes ~/.npmrc.

If @scope:registry (or [install.scopes]) is configured only at user level, rollback and remove <purl> treat the scoped package as an npmjs package:

• They send GET <default registry>/@scope%2fpkg/1.0.0 with no credentials, which leaks the private package name to the public registry.
• If the public registry has no package by that name, the unwind fails. status: partial_failure, exit 1, hosted.failed: "cannot restore … HTTP 404 Not Found; restore it from version control instead". Bun itself resolves the package fine, so this refusal shouldn't fire.
• If the public registry has a package with the same name and version (a dependency-confusion squat, or an unrelated public package), the unwind reports success, exit 0, with no warning. It writes ["@scope/pkg@1.0.0", "", {}, "sha512-<public package's integrity>"]. Then:
  • Bun ≥ 1.3.7 resolves "" through the user's scope config, downloads the private tarball and fails IntegrityCheckFailed. Every cold frozen install breaks.
  • Bun 1.1.39–1.3.6 read "" as https://registry.npmjs.org/ (see Hosted Bun rollback/remove writes an empty registry slot that Bun < 1.3.7 resolves against npmjs, so custom-registry projects can't frozen-install after a revert #992), so a fresh bun install --frozen-lockfile fetches the public package, and the integrity pin, which socket-patch copied from the public package, matches it. I could only show this up to the GET https://registry.npmjs.org/@scope/pkg/-/pkg-1.0.0.tgz request (404 in the sandbox), because I can't publish to real npmjs. But the lock bytes are exactly what that install would accept.

Impact

Any Bun project whose private registry is configured at user level, which is the common shape for private scopes, can't be safely unwound from hosted mode. In the best case the unwind refuses even though Bun can resolve the package. In the worst case it exits 0 with a lock that breaks CI on current Bun, or on Bun ≤ 1.3.6 installs a public package of the same name in place of the private one. The same lookup also sends private package names to the public registry.

Repro (Linux, main 3380e28, Bun 1.4.2)

A local mock on :8781 serves the authenticated patch API (--api-url), the hosted tarball, a private registry at /reg/ (requires Authorization: Bearer s3cret), and a stand-in for the public registry at /npmjs/. In the squat variant, /npmjs/ serves its own @scope/pkg@1.0.0. SOCKET_PATCH_SERVER_URL and SOCKET_NPM_REGISTRY point at the mock.

export HOME=$PWD/home; mkdir -p home proj; cd proj
printf '@scope:registry=http://127.0.0.1:8781/reg/\n//127.0.0.1:8781/reg/:_authToken=s3cret\n' > ~/.npmrc   # user-level only
echo '{"name":"app","version":"1.0.0","dependencies":{"@scope/pkg":"1.0.0"}}' > package.json
echo node_modules/ > .gitignore
bun install
# bun.lock: "@scope/pkg": ["@scope/pkg@1.0.0", "http://127.0.0.1:8781/reg/@scope/pkg/-/pkg-1.0.0.tgz", {}, "sha512-wzqt…"]
git init -q && git add -A && git commit -qm base
socket-patch scan --mode hosted --json --yes      # redirected 1
socket-patch rollback --json --yes                # (same with `remove pkg:npm/@scope/pkg@1.0.0`)
# mock log: GET /npmjs/@scope%2fpkg/1.0.0 auth=None   ← private name sent to the public registry
# no public package → status partial_failure, exit 1, "cannot restore … HTTP 404 Not Found"
# public squat      → status success, exit 0, no warning, and bun.lock is now:
#   "@scope/pkg": ["@scope/pkg@1.0.0", "", {}, "sha512-BLur…"]   (the public package's integrity)
git commit -qam undo; git clone -q . ../fresh; cd ../fresh
bun install --frozen-lockfile                     # empty cache
# 1.4.2: error: Integrity check failed for tarball: @scope/pkg   (exit 1)
# 1.2.23 / 1.3.6: GET https://registry.npmjs.org/@scope/pkg/-/pkg-1.0.0.tgz   (fetches the public package)

Control: put the same three lines in the project's .npmrc instead. The restore then sends GET /reg/@scope%2fpkg/1.0.0 with Bearer s3cret, bun.lock comes back byte-exact, and the fresh frozen install gets the original bytes. That holds on 1.2.23 and 1.4.2.

Expected vs actual

• Expected: CLI_CONTRACT.md (hosted unwind, npm family) says "The registry is the one Bun resolves the package against: a scope's .npmrc @scope:registry or bunfig.toml [install.scopes] entry, else …", and the restored lock must install as the pre-patch lock did. Bun resolves against the user ~/.npmrc and the global bunfig as well as the project files. If the CLI can't determine the registry, it should refuse with the checkout remedy, not query npmjs and write "".
• Actual: user-level config is ignored. The restore uses the default registry's document, writes "" plus that document's integrity, and exits 0 when a same-name package exists there.

Matrix (Linux; each cell is a fresh project, cold-cache fresh-clone frozen install)

First bad: not a regression. Before #1009 the slot was always "" (#992). #1009 fixed the project-level case only.

Suspect code

• crates/socket-patch-core/src/patch/redirect/upstream/npm.rs:1807: BunRegistrySettings::read reads only {dir}/.npmrc and {dir}/bunfig.toml. There's no ~/.npmrc (or NPM_CONFIG_USERCONFIG) and no $XDG_CONFIG_HOME/.bunfig.toml / ~/.bunfig.toml.
• The same settings feed the bun.lockb takeover restore (upstream/bun_lockb.rs:107). Not exercised this run.
• Related: Hosted yarn berry rollback/remove still drops a mirror's ::__archiveUrl= binding when the registry comes from npmScopes, YARN_NPM_REGISTRY_SERVER, ~/.yarnrc.yml or a parent-dir .yarnrc.yml (#908 fix covers only the project rc's top-level key) #1017 (the yarn berry twin: ~/.yarnrc.yml / npmScopes ignored by the Hosted yarn berry rollback/remove still drops a custom registry's ::__archiveUrl= binding (#817 fix incomplete): the restore looks up dist.tarball on npmjs, not the project's npmRegistryServer, so cold installs 404 #908 fix), Hosted Bun rollback/remove writes an empty registry slot that Bun < 1.3.7 resolves against npmjs, so custom-registry projects can't frozen-install after a revert #992, Hosted pnpm rollback/remove restores pnpm-lock.yaml from npmjs's version document instead of the project's .npmrc registry, so a mirror project loses its tarball: URL (cold frozen install 404s) or is moved to npmjs #919.

Possible directions: read Bun's user and global config layers in Bun's order. Or, when the lock's existing tuple recorded a non-default tarball URL and no project-level config explains it, refuse with the checkout remedy instead of falling back to the default registry.