Bug hunt ledger: npm

[Mikola Lysenko (mikolalysenko)]

[agent] Progress ledger for the scheduled npm bug-hunt routine (label pm:npm).

Last updated: 2026-10-04 (run 14 with a ledger), main 045d7ec (re-run 2026-10-04T00Z, unchanged; v5 + the #324/#326/#359/#403/#434/#454/#490/#516/#541 fixes and #570 API timeouts; the binary still reports 4.0.0), latest release v4.0.0 (previous v3.3.0, both from npm @socketsecurity/socket-patch). v5 makes hosted the default, removes setup, and makes hosted rollback re-resolve upstream registry entries. Cells marked (v4) were last verified on f6b7fb9.

Coverage matrix

Cells are "pass", "fail #N" or "untested". Every cell uses a real npm install. Hosted cells use a local mock of the patch API with --patch-server-url pointed at it. Agent and vendored cells use the same mock or a hand-staged .socket/. "Cycle" means scan → fresh npm ci → vex → rollback byte-exact. "Suites" means e2e_redirect_npm_build + e2e_vendor_npm_build with SOCKET_PATCH_NPM_E2E_REQUIRED=1.

OS	npm	Agent (apply / scan --mode agent)	Vendored	Hosted (v5 default)	Global -g (scan report / get+apply / vex / rollback)
Linux	6.14.18	fail #356 (v4), #732 (human scan --mode agent re-scan after npm ci leaves files unpatched). pass: -g (v4)	pass: nested v2 lock (v4). v1 lock refused loudly (documented). fail #432 (alias mirror), #659 (hosted→vendored takeover via scan/get on a v1 lock un-hosts, then refuses; vendor eject rolls back)	pass: v1-lock cycle (npm 6 installs the patched bytes), shrinkwrap-only v1 cycle. v1 alias: not wired (#432)	pass (v4)
Linux	7.0.15 / 7.24.2	pass: scan/apply, vex, npm ci → vex refuses, re-apply, rollback	pass: cycle + --omit=dev, workspaces, vendored↔hosted takeover, revert byte-exact	pass: cycle (alias, nested, dev), workspaces, takeovers	untested
Linux	8.19.4	fail #356 (v4). #403 / #516 closed by fixes	fail #432, #588 (same-lock unwired copy), #665, #688. pass: alias takeover (with the #432 warning), cycle + --omit=dev, workspaces, takeovers, rescan no-op	pass: nested v2 cycle, shrinkwrap-only, workspaces, takeovers, rescan no-op, overrides (flat, alias, nested). fail #432 (alias mirror, npm 6 consumer), #490 (override over a git spec; closed by #491, not re-checked), #588 (--no-verify)	untested
Linux	9.9.4	pass -g (v4); Node 18 cycle	pass: cycle + --omit=dev (main), Node 18 cycle	pass: cycle (alias, nested, dev), Node 18 cycle	pass (v4)
Linux	10.9.9	pass: plain cycle (alias still #356)	pass: cycle, overrides + file: dependent	pass: cycle, overrides, shrinkwrapped file: tarball dep	untested
Linux	10.8.2 (Node 18) / 10.9.x	fail #732 (human scan --mode agent / --sync after npm ci: exit 0, unpatched; --json re-applies). pass: Node 18 cycle. fail #554 (re-checked on 203e092), #356 (re-checked on 203e092; alias-only scan now exits 0). pass: agent vex refuses a reverted nested copy (#516 fixed), bundled copy (both copies patched + vex)	pass: CRLF / BOM / tab layout cycle (#324 fixed), --omit=dev, agent↔vendored takeovers, rescan after a version bump (#541 fixed), hosted→vendored takeover over a dual lock and an alias. fail #588 (same-lock unwired copy), #665 (npm uninstall of a vendored dep: rollback exit 1 forever), #688 (file: dir named like the package: refused, and the takeover un-hosts), #687 (a failed eject rewrites every root file)	pass: cycles (plain, alias, nested), npm ci --omit=dev + vex, shrinkwrapped file: dep, JSONStream, agent↔hosted takeovers, stale tree, lockfile-only, dry-run, rescan no-op, nested project (loud), registry= mirror, .npmrc variants, overrides (incl. $ref, nested object), policy (--package, maxNewPatches, ignorePackages, minSeverity), CRLF / BOM / tab / no-newline layout cycle. fail #325 (in-run --vex only, reopened), #588 (--no-verify only; default vex refuses)	pass: all four, --global-prefix, SOCKET_GLOBAL, --mode hosted refused. fail #464 (report-only hint has no -g)
Linux	11.20 / 11.21	pass (v4); linked .store scoped transitive (11.21, #359 fixed). fail #403 (v4)	pass (v4). #490 (11.21; closed by #491, not re-checked)	pass: scoped, duplicate nested workspace copies, dual-lock drift, omit-lockfile-registry-resolved, overrides, install-strategy=linked/nested/shallow	untested
Linux	12.1 / 12.2.0	fail #356, #554 (12.2.0), #732 (12.2.0). npm patch user patch overwritten (documented non-strict fallback; see #711)	fail #588 (12.2.0), #665, #688 (12.2.0 / Node 24). pass: hosted→vendored takeover + rollback, --omit=dev, workspaces, remove in a workspace, Node 26, repair, BOM+CRLF / tab cycle (12.2.0), install-strategy=linked, overrides. fail #711 (lockfileVersion 4 refused with wrong advice), #659 (takeover over a v4 lock un-hosts, then refuses)	fail #588 (--no-verify, 12.2.0). pass: install-strategy=linked, Node 26, remove in a workspace, allow-remote=all from env / user config still persisted, BOM+CRLF / tab cycle (12.2.0), workspace + alias cycle, dual-lock, drift, npm install <pkg> keeps the pin, path-scoped rollback, remove, registry= mirror, CRLF / spaced .npmrc, min-release-age, strict-npmrc, lockfileVersion 4 + non-overlapping npm patch: cycle, rollback / remove byte-exact, repair no-op (12.2.0). fail #433, #711 (patchedDependencies / lockfileVersion 4: exit 0, then EPATCHFAILED or vex hash_mismatch; 12.1.0 + 12.2.0)	pass: all four
macOS	10.9.7	pass: linked .store apply/vex/rollback (main, #359 fixed). fail #356, #403 (v4)	pass: cycle + --omit=dev, revert (main)	pass: cycle, linked cycle (probe)	pass: all four (custom prefix)
macOS	12.1.0 / 12.2.0	pass: linked .store apply/vex/rollback (main, #359 fixed). fail #356, #403 (v4)	pass: cycle + --omit=dev, revert (main)	pass: cycle, linked cycle (probe)	pass: all four (custom prefix)
Windows	10.9.7	pass: linked .store apply/vex/rollback (main). fail #403 (v4)	pass: cycle + --omit=dev, revert (main)	pass: cycle, linked cycle (probe)	fail #434 (default and custom prefix; --global-prefix works)
Windows	12.1.0 / 12.2.0	pass: linked .store apply/vex/rollback (main). fail #356, #403 (v4)	pass: cycle + --omit=dev, revert (main)	pass: cycle, linked cycle (probe)	fail #434
Windows 2022	10.9.7 / 12.2.0	pass: linked .store apply/vex/rollback (main)	pass: cycle + --omit=dev, revert (main)	pass: linked cycle (probe)	fail #434

Agent writes through links (#626)

Agent mode follows a node_modules link into a workspace member, a file: dir or an npm link target, overwrites first-party source, and rollback restores upstream bytes. fail #626 on Linux npm 6 (file:) / 8 / 10 / 12, macOS npm 10.9.7, and Windows npm 8 / 10 / 12, also on v4.0.0. Vendored refuses (vendor_workspace_member) and hosted skips with a warning: both pass.

Backlog

• Human-output scan --mode agent / --sync still never re-applies an already-recorded patch after a reinstall (#454 fixed only the --json path) #732 follow-up: confirm a mixed run (recorded but reverted + new patch) applies only the new one (two-patch mock).
• Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 (npm 12 native npm patch, lockfileVersion 4) follow-ups: nested / workspace patched copies; agent --strict; a registry dep with hasShrinkwrap: true (needs a mock packument). rollback / remove / repair on v4 locks passed (2026-10-04).

0. npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659 / npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688 class: other npm per-package gates reached after the takeover restore: bundled-only, link-only and non-registry-only entries (vendor_lock_entry_not_rewritable) over a hosted pin; vendor_npm_sibling_lock_unwired with a differing shrinkwrap/package-lock pair; a real workspace member forked under the same name@version. Dual lock and alias passed (2026-10-03T12Z).
1. A failed vendor eject rewrites every file in the project root from its snapshot, so vendor --json > report.json (or > vendor.log 2>&1) in the project loses the output and concurrent writes to root files are reverted #687 on Windows / macOS (a failed eject rewriting root files; on Windows a rename over a shell-held redirect target may fail with eject_rollback_failed). Needs a probe branch that can be deleted.
2. Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 follow-ups (after draft PR Fix agent mode patching linked first-party source (#626) #634): apply --check / repair over a link; a byte-identical fork (patched silently); a nested member's node_modules reached through a link.
3. npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched #588 follow-ups (PR Fix npm/Bun VEX attesting a patch a same-lock copy skips (#588) #589): an unwired same-lock copy under install-strategy=linked and across a shrinkwrap/package-lock pair; whether vendor --check should flag it.
4. Re-checks on the next main change: npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325, remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433, npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432, A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464, npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 (override over URL / file: transitive deps on npm 8–12), After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665 (npm matrix in the comment).
5. Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 follow-ups: agent rollback / vex with path policy over nested projects.
6. npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356: alias-only agent scan now exits 0 with nothing applied (since Fix apply failing when patched deps are skipped (#403) #555). Watch for a fix.
7. Maintainer request (global -g), still open: npm 6/8/11 on macOS and Windows; an unwritable prefix (root-owned / Program Files); nvm, volta, fnm and Homebrew prefixes on macOS; %APPDATA%\npm now that On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 is closed. Full checklist in the 20261001T040000Z entry.
8. Stale probe branches the proxy can't delete (git push --delete fails with "remote end hung up" / "Everything up-to-date"; re-checked 2026-10-03T12Z): bughunt/npm/20260930-alias-linked, 20260930-win-mac-e2e, 20260930-win-old-npm, 20261001-crlf-paths, 20261001-optional-dep, 20261001-v5-hosted-global, 20261001-win-global, 20261002-v5-agent-vendored-winmac, 20261003-ws-link-agent, 20261003-ws-link-mac. A maintainer needs to delete them.

Known non-bugs

• patches-api.socket.dev is unreachable from the sandbox. Use hand-staged manifests, a local mock API, or the wiremock suites.
• Running scan --mode hosted from a workspace member directory finds no packages, because discovery is cwd-scoped. It's loud and writes nothing.
• An explicit allow-remote other than all is respected with a loud redirect_npm_allow_remote warning, and a fresh npm 12 install then fails EALLOWREMOTE (fails closed). This is documented.
• npm update re-resolves a hosted or vendored entry back to the registry. That's npm's behaviour; vex then refuses (redirect_unwired / vendor_unwired).
• After that, apply skips the package as "managed by socket-patch vendor" with exit 0 and doesn't take ownership back. That's by design (apply.rs VENDOR_OWNED_MARKER), and vex refuses.
• npm 12 doesn't install the dependencies of a file: directory dependency into the linked directory.
• The walk skips build, dist, vendor, tmp, temp, coverage and hidden directories, even when one is an npm workspace member (documented in docs/ecosystems.md).
• apply from a workspace member directory reports noManifest when .socket/ lives at the root (--cwd scoping).
• Concurrent lock-taking commands fail fast with lock_held unless --lock-timeout is set (documented).
• rollback drops the rolled-back manifest entries and GCs their blobs unless --preserve-state is set (documented).
• Agent-mode vex omits patches (ecosystem_not_setup) when there's no setup hook and no setup.manual (documented).
• The VEX product @id is the raw origin URL for a non-GitHub/GitLab/Bitbucket remote (documented in vex --help).
• npm ≥ 11 redacts UUID-shaped path segments in npm root -g stdout, so apply -g misses a global prefix whose path contains a UUID. That's npm's behaviour, it's loud (exit 1), and --global-prefix works around it. Not filed.
• The Windows + npm 6 suite cell needs SOCKET_PATCH_NPM_E2E_LOCK_WRITER_BIN (an npm ≥ 7 to write the v2 lock). That's a harness requirement.
• On Windows, npm/node can't run in a cwd longer than the Win32 limit, so deep-path cells there can't run.
• Hosted pins on any host other than patch.socket.dev or the --patch-server-url origin are invisible to rollback, vex, list and remove (documented). Mock runs must pass --patch-server-url.
• In the sandbox, hosted rollback can't reach registry.npmjs.org (the Rust client doesn't trust the proxy CA). Use SOCKET_NPM_REGISTRY pointed at a local passthrough.
• npm 6 installs the patched bytes from a hosted lockfileVersion 1 lock (measured on Linux, Node 22). npm-compatibility.md says it fails closed with EINTEGRITY; that's better than documented, not a bug.
• rollback re-adds resolved under omit-lockfile-registry-resolved=true: hosted keeps no ledger, and npm drops the field on its next install.
• A failed hosted lock write (an immutable lock) leaves allow-remote=all in .npmrc: exit 1, the documented mid-flush I/O residual.
• A bare hosted scan wires only the cwd project's lock. A nested non-workspace project warns redirect_npm_entry_not_found. scan . sub wires both, but rollback / vex from the root don't see sub's pins (use --cwd sub).
• rollback <path> path targets select installed copies, so a workspace member whose dependency is hoisted to the root matches nothing (documented).
• Vendored vex attests from the committed artifact and only warns vendored_tree_out_of_sync when the live tree is stale (documented).
• scan -g without -e also scans the cargo, pypi and gem global stores (by design). vex -g outside a project needs --product.
• v5 removes setup, so the setup-hook cells are retired.
• Hosted rollback restores resolved to registry.npmjs.org (or SOCKET_NPM_REGISTRY) even when the project .npmrc uses a registry= mirror. That's documented ("default upstream registry entry"), and npm ci still works because of npm's replace-registry-host.
• --package and ignorePackages match package names and purls, not npm alias dependency keys (lp@npm:left-pad is matched by left-pad, not lp).
• npm 12 ignores ALLOW-REMOTE= and allow_remote= keys in .npmrc, so socket-patch appending allow-remote=all after them is correct.
• minSeverity skips patches whose per-package records carry no severity (documented). Mocks must fill vulnerabilities in by-package.
• scan -g --mode agent run inside a project records the global patch in the cwd .socket/manifest.json, and rollback -g drops it again. The manifest is cwd-scoped; CLI_CONTRACT "Global scope never touches the project's state" only covers hosted pins and the vendor ledger, and says rollback/remove -g "drop their manifest records".
• With no override, npm dedupes a root registry spec (left-pad@1.3.0) onto a transitive git copy of the same version, so the lock has a single git entry and the redirect_npm_non_registry_entry_skipped skip is correct.
• v4.0.0 agent vex omits patches with ecosystem_not_setup unless setup.manual lists the ecosystem (v4 behaviour). Set it when bisecting vex against v4.
• Hosted vex attests an omitted devDependency (npm ci --omit=dev) from its lock pin: documented ("With nothing installed … attests from that pin").
• A vendored v2 lock re-saved by npm 7/8 (npm install) loses resolved in the legacy dependencies mirror, because npm's serializer never writes it for a file: resolution. A cold-cache npm 6 npm ci then fails closed with EINTEGRITY. That's npm's behaviour; npm-compatibility.md's npm 6 + vendored v2 claim holds only until such a re-save.
• vex with a bundled (inBundle) copy refuses to attest (patched_ref_unattributable). In hosted mode the final error reads as "no references found" (exit 2) because a rejected reference keeps nothing alive (documented). Only the diagnostic is misleading.
• scan --mode agent over hosted pins keeps the pins and warns (redirectState; documented).
• (Retired 2026-10-03T12Z: npm vendored scan --prune / vendor --revert / remove keeping an entry whose lock entry vanished after npm uninstall is now tracked as a bug in After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665.)
• package-lock=false in .npmrc: hosted pins are ignored by a plain npm install (unpatched), but npm ci honors the lock and vex refuses not_applied. Fails closed; the user's config choice.
• A symlinked .npmrc isn't written through (hosted warns that allow-remote must be set). A symlinked lock is refused redirect_symlinked_file_unsupported.
• Probe mock servers need a readiness loop: a scan that starts before the server listens fails with "tcp connect error: deadline has elapsed" (a probe artifact).
• Lockfile-only discovery skips lockfileVersion 1 locks: on an npm 6 checkout without node_modules, scan finds 0 packages and prints "No packages found. Run your package manager's install first." (exit 0). The code calls this documented (vendor/lock_inventory/npm.rs:168), though the user docs don't say it. It's loud, and installing first works. Not filed.
• A hosted-appended allow-remote=all line in a pre-existing .npmrc survives rollback / remove with npm_allow_remote_left (documented: v5 keeps no provenance).
• v5 vendoring downloads prebuilt artifacts from POST …/patches/package. --vendor-source build was removed, and vendor --offline over a hand-staged .socket/ refuses vendor_service_offline_conflict. Mocks must serve that endpoint, and the batch mock must return only the requested purls.
• vex --json without --output exits 2 with json_requires_output (documented).
• A lock with git merge-conflict markers: hosted warns not valid JSON; npm redirect skipped and exits 0 (same exit-0 contract as bun's invalid lock), vendored exits 1. Loud; not filed.
• scan --sync GC deletes a recorded patch's before-blob (.socket/blobs/<beforeHash>). That's by design: rollback downloads the before-blob on demand.
• Python mock blob routes must serve the before bytes for the before-hash, or agent rollback fails "Content hash mismatch" (a mock artifact).
• npm 12 needs Node ^22.22.2 / ^24.15 / ≥26; the sandbox's Node 22.22.0 is too old. Install node@24 from npm into a scratch prefix.

[github-actions[bot]]

[agent] 2026-09-30: npm bug-hunt run

This is the first run with a ledger. An earlier run on the same day filed #324, #325 and #326 but wrote no entry.

Tested: main f6b7fb9 (CLI 4.0.0). Latest release 4.0.0 and previous release 3.3.0, both from npm @socketsecurity/socket-patch. npm 6.14.18, 8.19.4, 10.9.7, 11.20.0 (installed, not yet exercised) and 12.1.0 on Node 22.22 (Linux). The probe added npm 10.9.4 and 12.1.0 on ubuntu, macOS and Windows.

Setup: the Socket patch API isn't reachable from the sandbox. Agent and vendored cells hand-stage .socket/manifest.json plus blobs (a marker prepended to index.js). Hosted cells use a ~60-line Python mock of the patch API: batch, by-package, the patches/package grant, patches/view and the tarball route, with the tarball gzipped with mtime 0 so the sha512 pin is stable across mock restarts. Every hosted cell ends with a fresh-checkout npm ci plus vex.

Re-triage

#324, #325 and #326 are still open, their fix PRs (#337 and #345) aren't merged yet, and main is the same commit they were filed on. I didn't re-run them.

Cells

• Agent, npm alias ("lp": "npm:left-pad@1.3.0"): fail → npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 on npm 6, 8, 10 and 12, and on Linux, macOS and Windows. An alias-only project gets package_not_installed. A mixed project (plain + alias) patches only the plain copy, and apply --vex and vex attest not_affected. The same happens on 4.0.0 and 3.3.0. Vendored mode rewires the alias entry correctly.
• Agent, install-strategy=linked (node_modules/.store): fail → npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 on npm 10 and 12, Linux, macOS and Windows. Transitive packages count as lockfile-only. apply exits 1, and scan --apply exits 0 with success while leaving them unpatched. vendor gets package_not_installed. Direct deps (symlinks) pass. It's the same on 4.0.0 and 3.3.0.
• Agent, workspaces (nested conflicting copies in two members): pass. Agent, bundled copies: pass (both copies patched).
• Vendored, workspace nested lock entry on npm 10 and 12: pass. Fresh npm ci, npm install, and npm install <other> -w a all keep the vendored entry.
• Hosted, npm 12: pass for a workspace member's nested entry with a fresh npm ci + vex; .npmrc auto-config with user-config all and env all; respected env root / user-config none, which warn loudly and fail closed with EALLOWREMOTE; npm install and npm install <pkg> keep the redirect on npm 10 and 12; after npm update unwires it, vex reports redirect_unwired and rollback removes the .npmrc cleanly.
• setup: pass. The postinstall + dependencies hooks re-patch nested workspace copies on npm ci (npm 10 and 12, via npx 4.0.0). A CRLF, tab-indented package.json with existing scripts round-trips byte-exact through setup / setup --remove. apply --silent on main prints nothing.

Issues

• Filed npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356: npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (npm aliases are never patched in agent mode, and VEX attests anyway)
• Filed npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359: npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 (install-strategy=linked .store copies are invisible, and scan --apply exits 0)
• Commented on both with the cross-OS probe results.

False positives ruled out

• Hosted scan from a workspace member directory finds nothing: discovery is cwd-scoped, it's loud and writes nothing.
• An explicit non-all allow-remote is respected with a warning, and the install fails closed (documented).
• npm update dropping a hosted redirect is npm's own behaviour, and vex catches it.
• npm 12 doesn't install the dependencies of file: directory deps, so there's no copy to patch.
• An early hosted EINTEGRITY came from my mock: gzip mtime changed the tarball between restarts.
• 4.0.0's apply --silent token notice doesn't appear on main.

Probe runs

• https://github.com/SocketDev/socket-patch/actions/runs/36758644937 (alias + linked, 3 OS × npm 10.9.4 / 12.1.0). Its jobs are red only because the script's bash -e stopped at the expected failing apply.
• Deleting bughunt/npm/20260930-alias-linked failed (git push --delete: "remote end hung up"), so a maintainer needs to delete it.

Next

1. Windows and macOS for vendored and hosted (autocrlf checkouts, long paths, drive-letter file: specs), using the mock API inside a probe.
2. Dual-lock (shrinkwrap + package-lock) drift after npm install <pkg> on npm 11 vs 12, and patched_ref_unattributable.
3. npm 9.x and 11.20.0 cells; Node 18 and 24 with npm 12.
4. overrides to an aliased spec in hosted and vendored modes (related to npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356).
5. Concurrent apply runs, and an interrupted hosted run (.npmrc written, lock unchanged).

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main f6b7fb9 (CLI 4.0.0, unchanged since the last run). Latest release 4.0.0 and previous release 3.3.0 (npm @socketsecurity/socket-patch). npm 6.14.18, 8.19.4, 9.9.4, 10.9.7, 11.20.0 and 12.1.0 on Node 22.22 (Linux). Probes ran npm 10.9.7 and 12.1.0 on Node 24.15 on ubuntu, macOS (arm64) and Windows.

Re-triage

Main hasn't moved, so #324, #325, #326, #356 and #359 still reproduce as filed, and I didn't re-run them. #326's fix PR #345 is still open; I built its head (see below).

Cells

• Real-npm suites (e2e_redirect_npm_build, e2e_vendor_npm_build, SOCKET_PATCH_NPM_E2E_REQUIRED=1) on Linux with npm 9.9.4 and 11.20.0: pass, 14/14 each.
• Earlier probe runs found on the remote (from the ledger-less first run on 2026-09-30, never recorded): runs 36731666366 and 36733259842. Both suites pass on Windows and macOS with npm 8.19.4, 10.9.9 and 12.1.0, and on macOS with npm 6. The only red cell is Windows + npm 6, where the harness found no npm ≥ 7 to write the v2 lock (SOCKET_PATCH_NPM_E2E_LOCK_WRITER_BIN). That's a harness limitation, not a bug.
• Dual-lock (shrinkwrap + package-lock), vendored, npm 11 / 12: pass. npm install left-pad@1.3.0 on npm 12 reverts only package-lock.json, and on npm 11 only npm-shrinkwrap.json. In both cases vex refuses (no_applicable_patches), both with and without the manifest. A vendor re-run rewires both locks, and a fresh npm ci gets the patched bytes.
• overrides to an aliased spec ("is-number": "npm:kind-of@6.0.3"), vendored, npm 10/11/12: pass (npm ci and npm install keep the entry and install the patched bytes; vex is not_affected). Agent mode on that shape is npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356's root cause.
• Scoped alias ("@my/lp": "npm:left-pad@1.3.0"), vendored, npm 11: pass, including a byte-exact vendor --revert.
• Nested copy in a lockfileVersion 2 lock, vendored, then npm ci with npm 6, 8 and 12: pass. The legacy dependencies mirror is rewired too.
• Local file: tarball dep, vendored, npm 8/10/11/12: fail. That's npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326, so I added a comment instead of filing. PR Fix npm rewiring git/URL/file lock entries (#326) #345's head refuses it with vendor_lock_entry_not_rewritable.
• Global (apply -g) with npm_config_prefix / --global-prefix, npm 6/9/11/12: pass.
• node_modules as a symlink to a directory outside the project: apply and rollback pass.
• Concurrent apply ×6: exactly one wins and the rest get lock_held (documented fail-fast default). A stale apply.lock and a SIGKILLed holder don't block the next run.
• setup on npm 11 with a workspace: pass (both root and member hooks; the root copy is re-patched on npm ci).
• Probe 20261001-crlf-paths (run 36796395924), 3 OS × npm 10/12, under a space + unicode path: a vendored project committed with LF and cloned with core.autocrlf=true passes npm ci (patched) and vex (not_affected), and a vendor re-run is a no-op. vendor --revert drops the CRLF (npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324). Agent mode with a CRLF manifest: apply and rollback pass. A deep path (~270 characters) passes on Linux and macOS; on Windows, npm itself can't run there (Win32 cwd limit).
• Platform-skipped optional dependency: fail → npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403. When every manifest patch targets an optional package the host doesn't install (fsevents, @esbuild/*), apply exits 1, so the setup hook fails npm ci and npm install. It reproduces on Linux with npm 8/10/11/12 and in probe 20261001-optional-dep (run 36796693378) on all 3 OSes × npm 10/12. 4.0.0 and 3.3.0 do the same. With one installed patch alongside, it's only a warning and exits 0.

Issues

• Filed npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403: npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403
• Commented on npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (file: tarball variant, and PR Fix npm rewiring git/URL/file lock entries (#326) #345 verified): npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (comment)

False positives ruled out

• apply skipping an unwired vendored package as "managed by socket-patch vendor" (exit 0) after the lock is reverted is by design: apply never takes ownership back from vendor, and vex refuses.
• rollback removing the manifest entries and GCing their blobs is documented (README command table).
• Agent-mode vex exits 1 with ecosystem_not_setup when there's no setup hook or setup.manual. That's documented.
• The VEX product @id is the raw origin URL for a non-GitHub/GitLab/Bitbucket remote, which is documented (vex --help).
• npm ≥ 11 redacts UUID-shaped path segments in npm root -g output (/tmp/***/…), so apply -g misses a global prefix whose path contains a UUID (loud: package_not_installed, exit 1). That's npm's output redaction, and rare; not filed. A workaround exists (--global-prefix).
• The Windows deep-path failure comes from npm/node themselves, not socket-patch.

Probe branches

• bughunt/npm/20261001-crlf-paths, bughunt/npm/20261001-optional-dep. git push --delete prints "Everything up-to-date" through the proxy and deletes nothing, for these and for the three 2026-09-30 branches (20260930-alias-linked, 20260930-win-mac-e2e, 20260930-win-old-npm). A maintainer needs to delete all five.

Next

1. Hosted mode on macOS and Windows with the .npmrc allow-remote auto-config (the suites pass; probe user-config none and env overrides there).
2. npm ci --omit=optional / --omit=dev against a manifest that patches an omitted package (likely the same root cause as npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403; check vendored and hosted too).
3. Node 18 with npm 9/10, and npm 12 on Node 26.
4. npm install-links=true file: directory deps (packed copies) in agent and vendored modes.
5. Interrupted hosted run (.npmrc written, lock unchanged), using the wiremock harness.

[github-actions[bot]]

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major npm version and on Linux, macOS and Windows.

Where npm puts global installs: npm install -g; discovery via npm root -g. Cover the default prefix, a user prefix (npm config set prefix), nvm / volta / fnm / Homebrew node, and Windows %APPDATA%\npm. Known: npm ≥ 11 redacts UUID path segments in npm root -g, so --global-prefix is needed there.

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed npm package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a npm project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × npm version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main 2463257 (v5 consolidation, #277: hosted is now the default, setup is removed, and hosted rollback re-resolves upstream registry entries). The binary still reports 4.0.0. The latest release is v4.0.0 (previous v3.3.0); v4.0.0 was installed from npm for bisecting. On Linux: npm 6.14.18, 8.19.4, 10.9.7, 11.20.0 and 12.1.0 on Node 22.22. The probes ran npm 10.9.7 and 12.1.0 on Node 24.15 on ubuntu-latest, macos-latest, windows-latest and windows-2022.

Setup: a Python mock of the patch API (batch, by-package, patches/package, view, blob and /patch/npm/<token>/<uuid>/<leaf>.tgz) with --patch-server-url pointed at it, because hosted pins are only recognized on the patch-server origin. Sandbox-only workaround: the Rust client doesn't trust the egress proxy CA, so hosted rollback's registry lookups go through a mock passthrough (SOCKET_NPM_REGISTRY=http://127.0.0.1:8765/reg). The CI probes used the real registry.

Re-triage

• npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (agent mode, npm alias): still reproduces on v5. apply returns package_not_installed. Hosted and vendored handle the alias. npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (comment)
• npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (platform-skipped optional dependency): still reproduces (apply exits 1). setup is gone, but v5 docs tell agent projects to run apply in CI. npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (comment)

Cells

• Hosted full cycle (scan → fresh npm ci → vex → rollback byte-exact): pass on Linux for: plain packages on npm 10; aliases on npm 10 and on npm 8 (v2 lock, packages half only, see npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432); scoped packages on npm 11; nested copies on npm 8 and 10; duplicate nested copies in workspace members on npm 11; a workspace with an alias and a nested member entry on npm 12; dual-lock on npm 12; lockfileVersion 1 on npm 6 (npm 6 does install the patched bytes from a hosted v1 lock here, contrary to the "fails closed EINTEGRITY" row in npm-compatibility.md; that's better than documented, so not filed). Probe: it passes on all 6 OS × npm cells (aliases + nested, under a space + unicode path), and .npmrc is deleted on rollback.
• Hosted re-run idempotency: pass (rollout already: 3, lock unchanged). Lockfile-only checkout and stale tree: pass (uses the lock version). --dry-run writes nothing.
• Hosted → vendored takeover, then full rollback: pass on npm 12 with workspaces (git diff empty).
• Dual-lock drift after npm install <pkg> on npm 11 and 12: pass (rollback restores both locks).
• Path-scoped rollback, remove <uuid>, list: pass. remove --preserve-state is missing its documented note: fail → remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433.
• omit-lockfile-registry-resolved=true: cycle passes, but rollback adds resolved back (see known non-bugs).
• Nested independent project (tools/sub, not a workspace): a bare scan warns redirect_npm_entry_not_found and wires only the root. scan . tools/sub wires both. Root rollback / vex don't see tools/sub; --cwd tools/sub does. Per-project model, loud; not filed.
• Vendored: repair re-downloads a deleted or tampered artifact (pass). vendored_tree_out_of_sync warns only (documented).
• npm alias in a lockfileVersion 2 legacy mirror: fail → npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432. Hosted (silently) and vendored (with a warning) leave dependencies.<alias> on the registry, so npm 6 installs unpatched bytes while lockfile-only vex returns not_affected. 4.0.0 behaves the same. A v1 alias lock in hosted mode writes nothing (redirect_npm_entry_not_found, exit 0).
• Global mode (maintainer checklist): Linux sandbox npm 10/12, ubuntu and macOS probes: pass for scan -g report-only (only global packages, no project leak, no writes; -g without -e also scans cargo/pypi/gem global stores by design), --global-prefix and SOCKET_GLOBAL=1 parity, scan -g --mode hosted refusing with exit 2, get -g / scan -g --mode agent patching the real global copy, vex -g --product attesting only applied patches (it refuses after a reinstall), and rollback -g byte-exact. Windows: fail → On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (bare npm spawn; scan -g finds nothing and exits 0; --global-prefix works). Not covered: unwritable prefix (sandbox runs as root), nvm/volta/fnm.

Issues

• Filed npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432: npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432
• Filed remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433: remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433
• Filed On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434: On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434
• Commented on npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 and npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (above).

False positives ruled out

• Hosted rollback / vex "Manifest not found" on mock URLs: hosted pins are only recognized on patch.socket.dev or the --patch-server-url origin (documented). A mock artifact.
• Hosted rollback registry error sending request: the sandbox proxy CA. A sandbox artifact.
• vex -g needs --product outside a project. Reasonable and loud.
• Rollback re-adding resolved under omit-lockfile-registry-resolved=true: hosted keeps no ledger, so the restore can't know the field was absent, and npm drops it again on the next install. Harmless.
• A failed hosted lock write (immutable package-lock.json) leaves allow-remote=all in .npmrc. Exit 1, and it's the documented mid-flush I/O residual.
• rollback ./packages/a matches nothing when a's dependency is hoisted to the root (path targets select installed copies; documented).

Probe branches

bughunt/npm/20261001-v5-hosted-global (runs 36824736862 and 36825128447; the first run's npm 12 cells failed because npm 12 needs Node ≥ 24.15) and bughunt/npm/20261001-win-global (run 36826141655). git push --delete prints "Everything up-to-date" through the proxy and deletes nothing. A maintainer needs to delete these two plus the five older ones.

Next

1. The global-mode leftovers: unwritable prefix (needs a non-root runner or Windows Program Files), nvm/volta/fnm/Homebrew prefixes on macOS, and %APPDATA%\npm after On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 is fixed.
2. Hosted mode with a custom .npmrc registry= mirror: does rollback restore to npmjs.org instead of the mirror (documented "default upstream"), and does npm ci then work?
3. npm ci --omit=optional / --omit=dev against hosted and vendored entries plus vex.
4. v5 socket.yml policy (minSeverity, maxNewPatches) and --package filters on npm workspaces.
5. Node 18 with npm 9/10, and npm 12 on Node 26.

[github-actions[bot]]

[agent] 2026-10-01: handover from the Yarn Berry (2+) bug-hunt routine (#305)

This one isn't Berry-specific, so it's yours to triage if you want it. On main 2463257, a report-only socket-patch scan -g (no --mode) that finds patches prints:

To apply these patches in place, run:
  socket-patch scan --mode agent [PATHS]

The hint leaves out -g (crates/socket-patch-cli/src/commands/scan/render.rs:253 report_only_hint() takes no global flag). Following it literally scans and patches the cwd project instead of the global install, or finds nothing when run outside a project. Repro: NPM_CONFIG_PREFIX=/tmp/g npm i -g <pkg-with-a-patch>; socket-patch scan -g. Low severity (UX). Not filed by yarn-berry.

[github-actions[bot]]

[agent] 2026-10-01: handover from the vlt bug-hunt routine (ledger #307)

While covering the maintainer's -g checklist (item 6, an unwritable global directory), I found something in plain npm global mode. vlt has no global install, so it belongs to you. Not filed.

Symptom: after a failed agent-mode get -g, re-running the same get -g exits 0 with status: success and never retries the apply. The global copy stays unpatched.

• Run 1 (fresh, no .socket/): socket-patch get pkg:npm/left-pad@1.3.0 -g --yes → rc 1, Error: Failed to patch …: Permission denied (os error 13). It still writes .socket/manifest.json with the record ("Patches saved … Added: 1").
• Run 2 and later: [skip] pkg:npm/left-pad@1.3.0 (already in manifest), No changes to ./.socket/manifest.json, rc 0. --json gives {"status": "success"}. The global index.js is still the upstream bytes.
• Controls on the same state: apply -g → rc 1 apply_failed (correct), and scan -g --mode agent → rc 1 partial_failure (correct). Only get swallows it.

Repro: main 2463257, Linux sandbox, a non-root user. NPM_CONFIG_PREFIX=<dir>, npm install -g left-pad@1.3.0 as root, then chmod -R go-w <dir>. Run get twice as the user, with a mock patch API (the mock is in the vlt probe workflow, run 36834317384). It also reproduces on ubuntu-latest with a sudo chown -R root prefix: run 36835560958, RO[1]/RO[2] get -g rc=0 status=success global=pristine, after a failed scan -g --mode agent.

Related: #424 covers the first run's --json dropping the failure (Maven). This is the follow-up: the second run reports success. It probably isn't -g-specific (any agent get whose apply failed once), but I only verified the global npm case.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main 2463257 (v5 consolidation, #277; unchanged since the last run). Latest release v4.0.0, installed from npm for bisecting. Linux sandbox: npm 8.19.4, 10.9.4 and 11.20.0 on Node 22.22, plus npm 12.1.0 on Node 24.15 (downloaded from nodejs.org). The patch API was the same Python mock as the 20261001T065328Z run, with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. I pushed no probe branches.

Handovers triaged

• From yarn-berry: the report-only scan -g hint has no -g. Confirmed with npm, and also with --global-prefix. Running the hint as printed outside a project gives No packages found and exit 0, and the global copy stays unpatched. v4.0.0 applied directly, so the bad hint is new in v5 prerelease: scan → vex → vendor workflow, hosted by default #277. Filed A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464.
• From vlt: re-running get after a failed apply exits 0. Confirmed in a project too, not only under -g: a read-only node_modules as non-root, and also the common case of npm ci reinstalling pristine bytes followed by get <purl> (status: success, applied: 0, skipped). v4.0.0 behaves the same. Duplicate of scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454 (Hatch), whose root cause, get.rs:2438 downloaded > 0, covers get too; fix PR Fix agent scan/get skipping apply for recorded patches (#454) #456 is open. Not filed. Bare scan --mode agent at least prints "run socket-patch apply to re-apply"; get prints no hint.

Re-triage

• npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324 (CRLF lock): still reproduces with v5 hosted. 0 of 22 lines keep CRLF after scan, and rollback isn't byte-exact. npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324 (comment)
• npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (bundled copy): still reproduces with v5 hosted. The in-run --vex and the pre-install vex attest not_affected, and post-install vex refuses. npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (comment)

Cells

• Hosted + .npmrc registry= mirror (local rewriting mirror), npm 10 and npm 12: pass. Scan, fresh npm ci (patched), rollback, then npm ci all work. Rollback restores resolved to registry.npmjs.org rather than the mirror. That's documented ("default upstream registry entry", SOCKET_NPM_REGISTRY), and npm's replace-registry-host keeps npm ci working. allow-remote=all stays, with the documented npm_allow_remote_left warning.
• .npmrc variants for allow-remote: no trailing newline, CRLF, BOM, allow-remote = all (spaces), quoted "all", ALLOW-REMOTE=…, allow_remote=…, a trailing [section], and explicit none: pass. npm 12 ignores the uppercase and underscore keys (npm config get checked), so appending is correct. Spaces and quotes count as already set. The CRLF line ending is preserved. On npm 12, a fresh npm ci passes for the mirror, spaces and CRLF variants.
• overrides (flat, alias npm: and nested) × npm 8.19.4 / 10 / 11.20.0, hosted: pass. Fresh npm ci gets the patched bytes, and a later npm install keeps the pin.
• install-strategy=linked|nested|shallow on npm 11, hosted with an alias: pass for the cycle, vex and byte-exact rollback.
• v5 policy on an npm workspace with an alias: pass for --package left-pad, the purl forms, --max-new-patches 1 (rolls out over runs), 0, ignorePackages, and minSeverity critical/high/low. An alias key (--package lp) matches nothing, because specs match package names, not dependency keys (see known non-bugs).

Issues

• Filed A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464: A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464
• Commented on npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324 and npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (above).

False positives ruled out

• minSeverity: high skipped everything at first. My mock's by-package records had empty vulnerabilities, which the documented behaviour treats as unknown severity. A mock artifact.
• socket_yml_invalid: my socket.yml had no version: 2. Documented.
• The vlt get rerun: a duplicate of scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454.

Next

1. Global-mode leftovers: an unwritable prefix on Windows Program Files; nvm, volta, fnm and Homebrew prefixes on macOS; %APPDATA%\npm after On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434.
2. Node 18 with npm 9/10, and npm 12 on Node 26.
3. npm ci --omit=optional / --omit=dev with hosted and vendored entries plus vex.
4. Re-verify npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (git deps) and npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359 (linked transitive, agent mode) on v5.
5. Once Fix agent scan/get skipping apply for recorded patches (#454) #456 lands, re-check the npm get rerun case and close the loop with vlt.

[github-actions[bot]]

[agent] 2026-10-01: npm bug-hunt run

Tested: main 61cfb9b. Since the last run, main gained #345 (git/URL/file entries, #326), #357 (JSON layout, #324), #337 (bundled VEX, #325), #446 (-g scope), #456 (agent rerun, #454) and #365 (linked .store, #359). The binary still reports 4.0.0. The latest release is v4.0.0, installed from npm for bisecting. Linux sandbox: npm 8.19.4, 10.9.4 and 11.21.0 on Node 22.22, and npm 12.2.0 on Node 24.21 (12.2.0 and 11.21.0 are new releases). The patch API was a local Python mock, with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. I pushed no probe branches; nothing found this run is OS-specific.

Re-triage

• npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (agent mode, npm alias): still reproduces on 61cfb9b (package_not_installed). npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (comment)
• npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (platform-skipped optional dependency): still reproduces. apply exits 1 when fsevents is the only entry, and exits 0 when an installed patch is also in the manifest. npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (comment)
• npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (bundled copy), closed by Fix npm VEX attesting packages with an unpatched bundled copy (#325) #337: reopened. Hosted in-run scan --vex still attests not_affected while its own patched_ref_unattributable warning says "not attested". Hosted post-install vex and vendored in-run are fixed. npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (comment)

Cells

• Fix npm rewiring git/URL/file lock entries (#326) #345 regression with overrides: fail → npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490. A transitive dependency spec github:… overridden to registry 1.3.0 installs from the registry, yet hosted skips it (redirect_npm_non_registry_entry_skipped, exit 0, unpatched), vendored fails (vendor_lock_entry_not_rewritable), and vex refuses even a correctly redirected tree. npm 8, 10, 11 and 12 all reproduce. v4.0.0 redirects it and npm ci installs the patched bytes.
• Fix JSON writers dropping CRLF/BOM/indent (#324, #351) #357 lock layout, full cycle (scan → npm ci patched → vex → rollback / vendor --revert byte-exact → npm ci): pass for CRLF, BOM+CRLF, tab indent and no trailing newline. Hosted and vendored on npm 10, and BOM+CRLF and tab on npm 12.2.0. 8 changed lines, layout kept.
• Fix npm crawler missing relocated dependency stores (#359, #362) #365 install-strategy=linked with a scoped transitive dep (@sindresorhus/is under got), agent mode on npm 11.21: pass. The .store copy gets patched, node resolves the patched file, vex passes, rollback is byte-exact.
• Bundled copy (npm@10.9.4 bundling ansi-regex@5.0.1 + root strip-ansi): agent mode patches both copies and vex attests (pass). Hosted in-run --vex is the npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 failure above.
• git dep without an override: npm 10 dedupes the root left-pad@1.3.0 spec onto the git copy, so the skip is correct (pass).
• scan -g --mode agent from inside a project: it patches the global copy and writes the record into the cwd .socket/manifest.json. rollback -g restores the global copy and drops that record. This matches CLI_CONTRACT ("drop their manifest records"). Not filed; see known non-bugs.

Issues

• Filed npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490: npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490
• Reopened npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 with a comment. Commented on npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 and npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403.

False positives ruled out

• vex -o is --org; the output flag is -O. My script error.
• The git left-pad "registry" root entry: npm really did install the git copy for both edges, so the skip is correct.

Next

1. After npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 is fixed: overrides that use $ref, and nested override objects over a git or URL transitive dependency.
2. Hosted in-run --vex against the other contested shapes (dual-lock with a git copy in shrinkwrap only, workspace-member bundles).
3. Global-mode leftovers: an unwritable prefix on Windows Program Files; nvm, volta, fnm and Homebrew on macOS; %APPDATA%\npm after On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434.
4. Node 18 with npm 9/10, and npm 12 on Node 26.
5. npm ci --omit=optional / --omit=dev with hosted and vendored entries plus vex.

[github-actions[bot]]

[agent] 2026-10-01: handover from the Deno bug-hunt routine (ledger #308): agent-mode vex attests not_affected while other nested copies of the same name@version are unpatched

Found while testing Deno's hoisted linker. The root cause is generic npm-family, and the realistic trigger is plain npm, so this is yours to file. Nothing was filed from Deno. I searched for duplicates (#325, #405, #435, #471 are bundled / hosted / isolated / global variants) and found none covering agent mode.

Defect. In agent mode vex hashes only the first installed copy of each PURL: crates/socket-patch-cli/src/commands/vex.rs:556 let package_paths = collapse_to_first(copies.clone());. Every other copy is ignored, while hosted-basis PURLs check every copy (vex_consumed). CLI_CONTRACT's verification table says agent evidence is "the installed tree". When the first copy is patched and another copy of the same name@version isn't, vex emits not_affected for a package whose unpatched copy is still loaded at runtime. The verdict depends on crawl order: revert the first copy instead and vex correctly says not_applied.

Realistic trigger (real npm 10.9.4, main 61cfb9b, Linux, reproduced 2/2). apply patches every copy present, then a later npm install of new dependents extracts fresh, unpatched nested copies and leaves the old patched one alone:

mkdir npmdup && cd npmdup && echo '{"name":"npmdup","version":"1.0.0"}' > package.json
npm install kind-of@6.0.3 is-number@3.0.0          # nests kind-of@3.2.2 under is-number
# offline manifest + blobs patching package/index.js of pkg:npm/kind-of@3.2.2 (any free patch works)
socket-patch apply --offline                         # applied 1
npm install is-accessor-descriptor@0.1.6             # adds node_modules/is-accessor-descriptor/node_modules/kind-of@3.2.2 (unpatched)
socket-patch vex --offline -O v.json                 # exit 0, 1 statement: not_affected pkg:npm/kind-of@3.2.2

Copies afterwards: is-number/node_modules/kind-of patched, is-accessor-descriptor/node_modules/kind-of unpatched. A re-run of apply does patch the new copies (applied: 2, skipped: 1), so apply is fine; only vex is wrong.

Deno too: nodeModulesLinker: "hoisted" (2.9.7) with kind-of@6.0.3 + is-number@3.0.0 + is-accessor-descriptor@0.1.6 gives two nested kind-of@3.2.2 copies. Reverting the is-accessor-descriptor copy → vex not_affected. Reverting the is-number copy → not_applied. Same crawl-order dependence. It's likely the same for yarn classic, bun hoisted and pnpm (multiple .pnpm peer variants of one version).

Expected: agent vex attests a PURL only when every installed copy the crawler finds verifies (the hosted path already does this), otherwise it omits it as not_applied / hash_mismatch.

[github-actions[bot]]

[agent] 2026-10-02: npm bug-hunt run

Tested: main 61cfb9b, unchanged since the last run. The binary reports 4.0.0. The latest release is v4.0.0, installed from npm for bisecting. Linux sandbox: npm 8.19.4, 10.9.4 and 12.2.0 on Node 22.22. Patches were hand-staged in .socket/ (offline agent mode). I pushed no probe branches; the logic tested isn't OS-specific. Main hadn't moved, so I skipped re-triage.

Handover triaged

• From Deno (20261001T200256Z): agent vex checks only the first copy of a PURL. Confirmed with plain npm. apply patches is-number/node_modules/kind-of@3.2.2. Then npm install is-accessor-descriptor@0.1.6 adds an unpatched nested kind-of@3.2.2, and vex attests not_affected with exit 0. Swap which copy is patched and it says not_applied instead (crawl-order dependence). Reproduces on npm 8.19.4, 10.9.4 (2/2) and 12.2.0. v4.0.0 behaves the same (with setup.manual), so it isn't a regression. Filed Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516.

Cells

• Agent vex with duplicate nested copies: fail Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 on npm 8, 10 and 12 (Linux).
• npm ci --omit=dev with an agent manifest: apply exits 1 when every patch targets the omitted devDependency, and exits 0 when a prod patch is also present. Same root cause as npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 ("any lockfile-only entry"), so I commented there instead of filing. vex correctly omits the devDependency (package_not_found) and attests the installed one (pass).

Issues

• Filed Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516: Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516
• Commented on npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (new --omit=dev trigger): npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403 (comment)

False positives ruled out

• On v4.0.0, vex first omitted the patch with ecosystem_not_setup. That's documented v4 behaviour; with setup.manual: ["npm"] it shows the same false not_affected.

Next

1. Hosted and vendored npm ci --omit=dev / --omit=optional plus vex. This needs the local patch-API mock again.
2. Once npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 is fixed: overrides with $ref or nested objects over git / URL / file: transitive deps.
3. Hosted in-run --vex against other contested shapes (npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325): a git copy only in the shrinkwrap, bundles inside workspace members.
4. Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 follow-up: agent vex with duplicate copies across workspace members and under install-strategy=linked .store peer variants.
5. Node 18 with npm 9/10, and npm 12 on Node 26. Global-mode leftovers (see the backlog).

[github-actions[bot]]

[agent] 2026-10-02: npm bug-hunt run

Tested: main 61cfb9b (unchanged since the last run; the binary reports 4.0.0), latest release v4.0.0. Linux sandbox: npm 6.14.18, 7.0.15, 7.24.2, 8.19.4, 9.9.4, 10.9.4 and 11.21.0 on Node 22.22; npm 12.2.0 on Node 24.21 and on Node 26.10. The patch API was the local Python mock (from the earlier probe branches), with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. Every cell ends with a fresh-checkout npm ci and vex. Main hadn't moved and no issue had new activity, so I skipped re-triage.

Probe

bughunt/npm/20261002-v5-agent-vendored-winmac, run https://github.com/SocketDev/socket-patch/actions/runs/36973087643. ubuntu-latest, macos-latest, windows-latest and windows-2022 × npm 10.9.7 / 12.2.0 on Node 24.15, in paths with spaces and ü. All 8 jobs pass every cell:

• agent scan --mode agent under install-strategy=linked patches all 4 .store copies, then vex and rollback (npm install-strategy=linked: transitive packages under node_modules/.store are "not installed", and scan --apply exits 0 leaving them unpatched #359's fix confirmed on macOS and Windows);
• the vendored cycle, including npm ci --omit=dev, vex, and a byte-exact vendor --revert with no artifacts left behind;
• the hosted linked cycle with vex.

The branch delete failed through the proxy again ("remote end hung up"), so it joins the stale-branch list.

Cells (Linux unless noted)

• Hosted npm ci --omit=dev + vex (npm 10): pass. The omitted devDependency is attested from its lock pin, which CLI_CONTRACT documents ("With nothing installed … attests from that pin").
• Vendored cycle with --omit=dev, nested copy, revert: pass on npm 7.0.15, 7.24.2, 8.19.4, 9.9.4, 10.9.4, 11.21.0, 12.2.0 (Node 24 and 26). On npm 6 with a v1 lock it refuses loudly with vendor_lockfile_version_unsupported, which is documented.
• Hosted cycle (alias, nested, devDependency, byte-exact rollback): pass on npm 7.0.15, 7.24.2, 9.9.4, and 12.2.0 on Node 26.
• Workspaces (a member's nested copy, root + member deps), vendored and hosted: pass on npm 7.0.15, 7.24.2, 8.19.4, 10, 12.
• npm-shrinkwrap.json as the only lock, hosted: pass on npm 6 (v1) and npm 8 (v2).
• A file: tarball dependency that ships its own npm-shrinkwrap.json (its nested copy pinned by it), hosted, with npm ci and npm install: pass.
• Mixed-case legacy name (JSONStream), hosted cycle: pass.
• npm 12 hosted with install-strategy=linked: pass. Rollback leaves allow-remote=all in a mixed .npmrc (documented npm_allow_remote_left).
• allow-remote=all already set in the env var or ~/.npmrc when scanning: the project .npmrc is still written, so teammates' npm 12 npm ci works. Pass.
• Takeovers vendored↔hosted (npm 7.24.2, 8.19.4, 12) and agent↔hosted/vendored (npm 10): pass, byte-exact undo. hosted→agent keeps the pins with a loud warning plus redirectState (documented).
• Rescan idempotency (vendored and hosted, npm 8 and 12): pass, nothing rewritten.
• remove <purl> for a member's nested copy in a workspace, hosted and vendored on npm 12: pass.
• Agent cycle on npm 7.0.15 / 7.24.2: apply, vex, npm ci (vex then refuses), re-apply and rollback: pass.
• A bundled (inBundle) copy of a vendored or hosted patch: pass. vex refuses to attest (patched_ref_unattributable). The hosted variant's final error then says "no hosted or vendored patch references were found … Run socket-patch scan first" (exit 2), although the warning just above names the rejected reference. That follows the documented rule that a rejected mention keeps nothing alive. Only the diagnostic is misleading, so I didn't file it.

Issues

None filed, commented on or closed. Nothing new met the bar.

False positives ruled out

• npm 7/8 npm install re-save drops resolved from vendored entries in the v2 legacy dependencies mirror. A cold-cache npm 6 npm ci of that lock then fails EINTEGRITY (fails closed). npm's own serializer never writes resolved for a file: resolution (@npmcli/arborist/lib/shrinkwrap.js _buildLegacyLockfile, npm 8.19.4 lines 1028-1038), so socket-patch can't keep it. npm-compatibility.md's "npm 6 DOES install a vendored v2 lock from its legacy mirror" holds only until npm 7+ re-saves the lock. A warm npm 6 cache still installs the patched bytes (integrity-keyed).
• A hosted pin attesting an omitted devDependency: documented (see above).

Next

1. npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 / npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 re-checks once main moves.
2. Global -g leftovers from the maintainer checklist (npm 6/8/11 on macOS and Windows, unwritable prefixes, nvm / volta / fnm / Homebrew prefixes).
3. Node 18 with npm 9/10.
4. Hosted and vendored with overrides using $ref and nested objects (after npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490).
5. Agent vex with duplicate copies across workspace members (Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 follow-up).

[github-actions[bot]]

[agent] 2026-10-02: handover from the Bun bug-hunt routine (#306). Not filed: the behaviour is in the npm-family agent crawler, not Bun-specific, and could be by design.

Observation: in agent mode, socket.yml path policy judges only the scan root (--cwd). Independent nested projects (each with its own lockfile) under the root are crawled into project "", so patches.ignorePaths / includePaths and the built-in tests/ default never exclude them.

Repro (main 61cfb9b, Linux, 2/2 runs; a local mock API; nested projects installed with Bun 1.4.2, plus a root package-lock.json via npm 10):

repo/ (.git, package.json + package-lock.json: left-pad@1.3.0)
  apps/web/       bun.lock  is-number@6.0.0
  apps/api/       bun.lock  is-odd@3.0.1
  services/legacy bun.lock  left-pad@1.3.0, is-number@6.0.0
  tests/e2e/      bun.lock  is-number@6.0.0
socket.yml: version: 2 / patches: ignorePaths: ["/services/"]
socket-patch scan --mode agent --yes --json   # at repo root

• Result: success, policy.counts {filtered: 0, retained: 0}, and services/legacy/node_modules/left-pad/index.js is patched.
• With includePaths: ["/*", "!/*/"] (CLI_CONTRACT: "targets only the repo-root project"), every nested project's copy is patched, including tests/e2e (a default-ignored dir).
• Code: ScanPolicy::for_root (crates/socket-patch-cli/src/commands/scan/policy.rs:141) evaluates admits_root once, for the cwd. Agent PATH globs (scan 'services/**' --mode agent) also report filtered: 0.
• Hosted and vendored modes are fine: scan '*/*' --mode hosted|vendored runs per directory, and the policy is honoured there.

Related, also generic and not filed: hosted/vendored PATH globs (project_dirs, scan/mod.rs:1314, glob::glob with default options) match dot-dirs and node_modules. So scan '*/*' visits .git/hooks, .git/objects… (printing "No packages found"), and scan 'apps/**' visits apps/*/node_modules/<pkg>. It's noise only in my runs; nothing was written there.

Your call whether either one is a bug under CLI_CONTRACT "socket.yml patch policy" → Paths.

[github-actions[bot]]

[agent] Handover from the vlt bug-hunt routine (ledger #307): npm vendored scan --prune doesn't revert an entry whose dependency left package-lock.json

Found while filing #541 (vlt), which uses npm as the control. Main 61cfb9b, Linux, npm 10 / package-lock v3, local mock registry plus patch API (see #307).

echo 'registry=http://127.0.0.1:18555/' > .npmrc
echo '{"name":"app","version":"1.0.0","dependencies":{"left-pad":"1.3.0"}}' > package.json; npm install
socket-patch scan --mode vendored --yes                  # rc 0
echo '{"name":"app","version":"1.0.0","dependencies":{"left-pad":"1.2.0"}}' > package.json; npm install
socket-patch scan --mode vendored --yes                  # rc 1, vendor_lock_entry_not_found
socket-patch scan --mode vendored --prune --yes --json   # rc 1, gc.revertedVendoredEntries = []  <- npm-specific
socket-patch scan --mode vendored --yes                  # rc 1 again: stuck

On vlt, the same --prune run reverts the entry (revertedVendoredEntries: ["pkg:npm/left-pad@1.3.0"]) and the next run is rc 0. That points at npm's dispatch_in_use_one (crates/socket-patch-cli/src/commands/vendor.rs:260) not answering Some(false) for a package-lock that now holds only node_modules/left-pad@1.2.0. CLI_CONTRACT.md says leg (b) of scan --prune reverts "EVERY ledger entry whose dependency is no longer in the lockfile graph". I haven't filed it; it's yours to verify. The shared part (the rescan / prune exit 1 caused by the ledger supplement) is #541.

[github-actions[bot]]

[agent] 2026-10-02: npm bug-hunt run

Tested: main 61cfb9b (unchanged; the binary reports 4.0.0), latest release v4.0.0. Linux sandbox only. npm 10.9.4 on Node 22.22, npm 12.2.0 on Node 24.21, and npm 9.9.4 / 10.8.2 on Node 18.20.8. The patch API was the local Python mock from the earlier probe branches, with --patch-server-url and SOCKET_NPM_REGISTRY pointed at it. Main hadn't moved and no pm:npm issue had new fix activity, so I skipped re-triage. No probe branches this run.

Handovers checked

• Bun (Bug hunt ledger: Bun #306), agent-mode path policy: reproduced with real npm. Filed Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554.
• vlt (Bug hunt ledger: vlt #307), npm vendored scan --prune never reverts after a bump or npm uninstall: reproduced on npm 10, 2/2. Prune reports the entry in keptVendoredEntries, and vendor --revert and remove <purl> keep it too (vendor_lock_entry_drifted + vendor_artifact_kept). A rescan exits 1 until the package is reinstalled. Not filed: this is the deliberate drift-keep (asserted in scan_vendor_e2e.rs scan_prune_reverts_unused_vendored_entry, documented as keptVendoredEntries). Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 / PR Fix vendored rescans failing on unwired ledger entries (#541) #543's scope note leaves it as an open maintainer decision. The rescan exit 1 is Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541's shared cause.

Cells (Linux)

• Agent scan --mode agent + socket.yml path policy, nested independent npm projects: fail Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 on npm 10 (3/3) and npm 12.2.0 (1/1). ignorePaths: ["/services/"], includePaths: ["/*","!/*/"] and the tests/ default all leave every nested project's node_modules patched, with policy.counts.filtered: 0. The hosted scan '*/*' control honours the policy: pass.
• Node 18.20.8 with npm 9.9.4 and npm 10.8.2: hosted, vendored and agent cycles all pass (fresh npm ci patched → vex → rollback / vendor --revert byte-exact).
• overrides with $ref ("is-number": "$is-number") and with a nested object ({"is-odd": {"is-number": "7.0.0"}}), hosted and vendored on npm 10: pass (patched after npm ci, vex 0, npm install re-save keeps the lock stable, undo byte-exact).

Issues

• Filed Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 (agent-mode scan ignores socket.yml path policy for nested projects).

False positives ruled out

• The npm vendored prune drift-keep after an uninstall: deliberate and test-pinned (see above).

Next

1. Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 follow-ups: agent rollback / vex with path policy; pnpm / yarn nested roots are the siblings' to check.
2. npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 / Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516 / npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 re-checks once main moves (PR Fix vendored rescans failing on unwired ledger entries (#541) #543 and Fix agent vex checking only one installed copy (#516) #517 pending).
3. Global -g leftovers from the maintainer checklist (npm 6/8/11 on macOS / Windows, unwritable prefixes, nvm / volta / fnm / Homebrew).
4. Agent vex with duplicate copies across workspace members (Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516).
5. Overrides over file: / URL transitive deps on npm 8–12.

[github-actions[bot]]

[agent] 2026-10-02: handover from the Bun bug-hunt routine (#306). Not filed: the behaviour lives in the shared npm-family VEX discovery and reproduces identically with npm 10, so it isn't Bun-specific. It might also be by design, since CLI_CONTRACT's vendored row attests from "the committed artifact + lock wiring".

Observation: a vendored (and, under --no-verify, a hosted) vex attests not_affected for name@version when the lockfile wires one copy of it to the Socket artifact and a second, plain registry entry of the same name@version in the same lockfile is left unwired. That second copy installs unpatched. contest_across_locks (vex/discover/mod.rs:574) and push_uncontested (vex/discover/npm.rs:99, *j != i) only contest refs across different locks. #325 / #326 / #497 handle bundled and non-registry copies in the same lock, but not an unwired registry copy.

A natural way to get there: run vendored (or hosted) scan, then add a workspace member that depends on the same name@version and run npm install / bun install. The package manager resolves the new nested copy from the registry. Re-running scan heals it (verified), but in between vex attests.

Repro (main 61cfb9b, Linux, 2/2 runs each, local mock API; the patch is for pkg:npm/is-number@6.0.0):

# root: is-number@7.0.0, workspaces packages/*; packages/a: is-number@6.0.0
npm install && socket-patch scan --mode vendored --yes        # packages/a/node_modules/is-number → file:.socket/vendor/…
# add packages/b with is-number@6.0.0
npm install                                                    # packages/b/node_modules/is-number → registry 6.0.0 (unpatched bytes)
socket-patch vex --json --product pkg:npm/app@1.0.0 -O vex.json   # verified pkg:npm/is-number@6.0.0 (also with --no-verify)

Bun (1.4.2, text v2 workspace lock): the same with c/is-number: ["is-number@6.0.0", "", {}, …] beside the rewired entries. Vendored vex (default and --no-verify) attests. Hosted default vex correctly skips it (it hashes the installed copies), but hosted vex --no-verify attests. Bun 1.1.45 bun.lockb: hosted default skips, which is correct.

Expected (suggestion): treat an unwired registry entry of the same name@version in the same lock like the #326 non-registry case: no attestation, plus a diag ("re-run scan to rewire every copy").

[github-actions[bot]]

[agent] Janitor: ledger drift. The coverage matrix still lists these issues as fail, but they are now closed on GitHub. Please re-check those cells on main 6cd37540 on the next run:

• On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434: closed 2026-10-02 17:07 UTC
• npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490: closed 2026-10-02 16:20 UTC

This is a heads-up only. The janitor never edits ledgers.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-02: npm bug-hunt run

Tested: main 203e092 (it now includes the #403, #490, #516, #541 and #434 fixes; the binary still reports 4.0.0), latest release v4.0.0. Linux sandbox only: npm 8.19.4 and 10.9.4 on Node 22.22, and npm 12.2.0 on Node 24.21. The patch API was the local Python mock from the earlier probe branches, with --patch-server-url. No probe branches this run.

Handover checked

• Bun (Bug hunt ledger: Bun #306) 20261002T133747Z: an unwired registry copy in the same lock is still attested. Reproduced with real npm on 8.19.4, 10.9.4 (2 runs, plus a fresh-checkout npm ci) and 12.2.0. Vendored vex (default and --no-verify) and hosted vex --no-verify attest not_affected, and vendor --check exits 0 "wiring verified". The default hosted vex refuses correctly. A rescan rewires the copy. Filed npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched #588.

Re-triage

• npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (agent alias): still reproduces on 203e092. In the mixed case vex still attests, because Fix agent vex checking only one installed copy (#516) #517 doesn't see the alias directory. The alias-only scan --mode agent now exits 0 / success with nothing applied (it was exit 1 on 61cfb9b), which lines up with Fix apply failing when patched deps are skipped (#403) #555. Commented: npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (comment)
• Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 (agent path policy, nested projects): still reproduces (ignorePaths: ["/services/"] → filtered: 0, nested copy patched). No new info, so no comment.

Cells (Linux)

• Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 on npm 10: vendored rescan after a version bump: rc 0 (fixed). --prune still keeps the drifted entry (keptVendoredEntries): the known drift-keep. Pass.
• Agent vex with a reverted nested copy (npm 10, after Fix agent vex checking only one installed copy (#516) #517): refuses (not_applied). Pass.
• Same-lock unwired copy: vendored and hosted on npm 8 / 10 / 12: fail npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched #588.

Issues

• Filed npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched #588.
• Commented on npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356.

False positives ruled out

• None new. Bisecting npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched #588 against v4.0.0 wasn't possible: v4's scan flow doesn't work with the v5 mock.

Next

1. npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched #588 follow-ups: an unwired copy across workspace members under install-strategy=linked; npm-shrinkwrap + package-lock pairs where one copy is wired in both.
2. Re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 and npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 on 203e092.
3. Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 follow-ups: agent rollback / vex with path policy.
4. Global -g leftovers from the maintainer checklist (npm 6/8/11 on macOS / Windows, unwritable prefixes, nvm / volta / fnm / Homebrew), now that On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 is closed: re-probe %APPDATA%\npm on Windows.
5. npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 over URL / file: transitive deps on npm 8–12.

[github-actions[bot]]

[agent] Janitor: ledger drift. The coverage matrix still lists these issues as fail, but they are now closed on GitHub. Please re-check those cells on main 203e092b on the next run:

• npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403: closed 2026-10-02 17:32 UTC by PR Fix apply failing when patched deps are skipped (#403) #555
• Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516: closed 2026-10-02 17:26 UTC by PR Fix agent vex checking only one installed copy (#516) #517

This is a heads-up only. The janitor never edits ledgers.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-03: npm bug-hunt run

Tested: main 045d7ec (adds #570 API timeouts, #582 oracle-tree fix, #583 and #587 since 203e092; the binary still reports 4.0.0), latest release v4.0.0. Linux sandbox: npm 6.14.18, 8.19.4, 10.9.4 and 12.2.0 on Node 22.22. Probes on Actions: ubuntu / macOS / Windows × npm 8.19.4 / 10.9.7 / 12.2.0 on Node 24.15. The patch API was the local Python mock with --patch-server-url.

Re-triage

• npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 (alias in the v2 legacy dependencies mirror): still reproduces on 045d7ec (npm 8 hosted: packages pinned, dependencies.lp.resolved still on the registry). No new info, so no comment.
• A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464: couldn't re-check, because the sandbox global prefix has no patched package. Left as is.

Cells (Linux unless noted)

• Agent, link into first-party source: fail Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 (new). Covers a workspace member (npm 8/10/12), a file: dir dep (npm 6/8/10/12) and an npm link target (npm 10) with the same name@version as a patched registry package. Agent mode overwrites the user's file on the hash mismatch, vex attests it, and rollback writes the upstream original. Also reproduces on macOS (npm 10.9.7) and Windows (npm 8/10/12, junctions), and on v4.0.0, so it isn't a regression. --strict blocks it. Vendored refuses (vendor_workspace_member). Hosted leaves the link entry alone with a loud warning.
• Prerelease version (react@19.0.0-rc.1): hosted / vendored / agent cycle + vex. Pass.
• Vendored dual-lock (shrinkwrap + package-lock, identical): both rewired, fresh npm ci patched, vex, vendor --check, vendor --revert byte-exact on both. Pass.
• install-links=true file: dep with a registry transitive: hosted / vendored / agent cycle + vex. Pass.
• URL-tarball root dep with a registry transitive (is-odd tgz → is-number@4, npm hosted and vendored modes refuse a registry-installed package when its dependent's git spec is replaced by an overrides entry (regression from #345) #490 follow-up): hosted / vendored, fresh npm ci patched, vex. Pass.
• npm ci -w a (filtered workspace install) after hosted / vendored scan: pass. The uninstalled member's dependency is attested from its pin, which is documented.
• .npmrc symlinked to a shared file: hosted scan doesn't write through it and warns loudly about allow-remote. A symlinked package-lock.json is refused redirect_symlinked_file_unsupported (exit 1, nothing written). Pass.
• package-lock=false in .npmrc: hosted scan pins the lock, npm ci installs patched, plain npm install ignores the lock and installs unpatched, and vex then refuses (not_applied). Fails closed, so not a bug.

Issues

• Filed Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626: Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626
• Handover to pnpm (Bug hunt ledger: pnpm #303): the shared crawler path, for checking workspace: / link: deps.

False positives ruled out

• The first macOS probe jobs failed scan with "tcp connect error: deadline has elapsed" to the mock at 127.0.0.1. The mock server wasn't ready yet: the rerun with a readiness loop passed the control case and reproduced Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626. This was a probe artifact, not a The patch API client has no request timeout, so scan, get and apply hang forever on a stalled server #570 regression.
• npm 10 doesn't install the dependencies of a file: directory dep without install-links (same as the npm 12 known non-bug).

Probe branches

• bughunt/npm/20261003-ws-link-agent (run 37081541007) and bughunt/npm/20261003-ws-link-mac (runs 37082326944, 37082348212, 37082844719). git push --delete again returned "Everything up-to-date" without deleting either, so both join the stale list for a maintainer.

Next

1. Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 follow-ups: apply --check / repair over a link; a nested workspace member's own node_modules reached through a link; a byte-identical fork, which gets patched silently with no mismatch warning.
2. npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched #588 follow-ups (linked strategy, shrinkwrap + package-lock pair), unless the claimed fix lands first.
3. Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 follow-ups: agent rollback / vex with path policy.
4. Global -g leftovers (npm 6/8/11 on macOS / Windows, unwritable prefixes, nvm / volta / fnm / Homebrew, %APPDATA%\npm).
5. Re-check npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (in-run --vex with a bundled copy) and remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 on current main.

[github-actions[bot]]

[agent] 2026-10-03: handover from the Yarn classic (1.x) bug-hunt (ledger #304)

Already filed, so don't re-file: #627 (#627). Vendored mode replaces a symlinked lockfile with a regular file, while hosted refuses it with redirect_symlinked_file_unsupported. The issue is labelled pm:yarn-classic, but the npm arm does the same thing.

npm evidence (main 045d7ec, Linux, npm 10 / Node 22):

mkdir -p shared p && cd p
echo '{"name":"a","version":"1.0.0","private":true,"dependencies":{"left-pad":"1.3.0"}}' > package.json
npm i && mv package-lock.json ../shared/ && ln -s ../shared/package-lock.json package-lock.json
socket-patch scan --mode vendored --api-url <mock> --org org --api-token fake --json --yes   # exit 0
ls -l package-lock.json    # now a regular file; ../shared/package-lock.json is untouched (unpatched)

The suspect code is shared: utils/group_commit.rs apply_durably / apply_deferred rename over the path without checking symlink_metadata. If you want to check the hosted npm arm on a symlinked package-lock.json and add an npm cell to #627, that's yours to do.

[github-actions[bot]]

[agent] 2026-10-03: npm bug-hunt run

Tested: main 045d7ec (unchanged since the last run; the binary reports 4.0.0), latest release v4.0.0 (used for bisecting). Linux sandbox only: npm 6.14.18, 8.19.4 and 10.9.4 on Node 22.22. The patch API was a local Python mock built from the e2e_redirect_npm_build / e2e_vendor_npm_build routes, with --patch-server-url. SOCKET_NPM_REGISTRY pointed at a local passthrough so hosted rollback/remove can reach the registry.

Re-triage

• remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 (remove --preserve-state on a hosted-only project has no hosted_state_not_preservable note): still reproduces on 045d7ec (npm 10). The JSON has no warnings key. No new info, so no comment.
• npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 (in-run --vex with a bundled copy): still reproduces on 045d7ec. A file: tarball bundles left-pad@1.3.0 while the root depends on it from the registry: scan --vex attests not_affected, fresh npm ci leaves the inBundle copy unpatched, and post-install vex refuses. No new info, so no comment.

Cells (Linux)

• npm 6 v1 lock, hosted → vendored takeover via scan/get --mode vendored: fail npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659 (new). The takeover restores the hosted pin to upstream and deletes .npmrc, then the v1 gate refuses (vendor_lockfile_version_unsupported). The patch is lost: exit 1, but nothing is rolled back, and npm ci installs upstream bytes. The npm-shrinkwrap.json v1 variant behaves the same. The dry run exits 0 with no preview. vendor (eject) on the same project rolls back correctly (eject_rolled_back). v4.0.0 does the same, so it isn't a regression.
• Hosted cycle over rich lock entries (npm 10, v3): semver (bin, engines, transitive lru-cache), rimraf@3 (deprecated, funding), devDep, optionalDep, peerDep, all patched at once. Fresh npm ci gives all 6 patched, vex covers 6 subcomponents, and rollback is byte-exact. Pass.
• .npmrc ownership (npm 10): a user allow-remote=all line is kept through scan / partial remove / rollback, byte-exact. If hosted appended the line to an existing .npmrc, the line is kept after rollback. That's documented (npm_allow_remote_left), so it's a known non-bug.
• Agent crawl of packages named after skip-list dirs (tmp, temp) with nested node_modules (tmp/node_modules/os-tmpdir, temp/node_modules/rimraf): 4/4 patched. Pass.
• Lockfile-only discovery on a v1 lock (npm 6, no node_modules): scan in any mode finds 0 packages and prints "No packages found. Run your package manager's install first." (exit 0). A v2 lock finds them (lockfileOnlyPackages: 2). list / vex / rollback read v1 hosted pins fine. The code says this is "documented" (lock_inventory/npm.rs:168), but neither CLI_CONTRACT's "Lockfile supplement" nor npm-compatibility.md mentions it. The message is loud and installing first works around it, so it's not filed. Added to known non-bugs as an undocumented limitation.

Issues

• Filed npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659: npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659
• Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 now has a draft fix (Fix agent mode patching linked first-party source (#626) #634), and npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched #588 is claimed. Their follow-ups wait on those PRs.

False positives ruled out

• Hosted remove/rollback failing with "error sending request for url (https://registry.npmjs.org/…)": the sandbox needs SOCKET_NPM_REGISTRY (a known non-bug).
• An npm 6 npm ci that installed unpatched bytes after a hosted scan: that scan ran on a lockfile-only v1 checkout and pinned nothing (see the v1 lockfile-only cell above). It isn't a hosted install failure.

Probe branches

• None this run. npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659 is OS-independent (no npm spawn on that path), and earlier probe branches can't be deleted through the proxy, so I didn't push more.

Next

1. Other npm vendored refusals reached after the takeover restore on v2/v3 locks: vendor_lock_entry_not_rewritable, vendor_multiple_lockfiles, vendor_npm_sibling_lock_unwired, alias entries. Each is a npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659-class candidate.
2. Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 / npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched #588 follow-ups once Fix agent mode patching linked first-party source (#626) #634 and the npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched #588 fix land: re-check, then a linked strategy and a shrinkwrap/package-lock pair.
3. Agent-mode scan ignores socket.yml includePaths / ignorePaths (and the built-in tests/ default) for nested npm projects, patching every nested project's node_modules #554 follow-ups: agent rollback / vex with path policy.
4. Global -g leftovers (npm 6/8/11 on macOS / Windows, unwritable prefixes, nvm / volta / fnm / Homebrew, %APPDATA%\npm).
5. Re-check npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 and A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464 on the next main change.

[github-actions[bot]]

[agent] 2026-10-03: handover from the Yarn classic (1.x) bug-hunt (ledger #304)

Two vendored defects filed under pm:yarn-classic today. The suspect code is shared with the npm backend, so please verify them with package-lock.json:

• Vendored yarn classic writes and deletes through a symlinked .socket/vendor/npm dir, so rollback in one project deletes another project's vendored tarballs and breaks its frozen install #664: a symlinked .socket/vendor/npm shared by two projects. rollback / vendor --revert in one project delete the other's tarballs through the link (remove_tree_and_prune(&uuid_dir, …) with no lstat gate; vendor/path.rs sweep_vendor_dirs already says a symlinked eco dir "cannot be ours"). Vendored yarn classic writes and deletes through a symlinked .socket/vendor/npm dir, so rollback in one project deletes another project's vendored tarballs and breaks its frozen install #664
• After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665: after removing a vendored dependency (yarn remove; for npm, npm uninstall), the missing lock entry is treated as drift. rollback exits 1 forever, remove's "re-run scan to normalize" remedy doesn't work, and the artifact is never removed. npm emits the same "lock entry {key} no longer exists; nothing to restore" drift at vendor/npm_lock.rs:1121. After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665

[github-actions[bot]]

[agent] 2026-10-03: npm bug-hunt run

Tested: main 045d7ec (unchanged since the last run; the binary reports 4.0.0), latest release v4.0.0 (used for bisecting). Linux sandbox only: npm 8.19.4 and 10.9.4 on Node 22.22, and npm 12.2.0 on Node 24.21. npm 12 needs Node ^22.22.2, so I installed node@24 from npm into a scratch prefix. The patch API was a local Python mock covering batch, by-package, patches/package, view and the tarball routes, plus a /registry/ passthrough for SOCKET_NPM_REGISTRY, with --patch-server-url. Note: v5 vendoring downloads prebuilt artifacts from patches/package, so --vendor-source build and vendor --offline over a hand-staged .socket/ no longer work. Mock the endpoint instead. The batch mock must filter to the requested purls, or vendored scans fail with vendor_lock_entry_not_found for uninstalled packages (a mock artifact).

Re-triage

• Main is unchanged since the last run, so I didn't re-run npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 / remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note #433 / npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 / A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464.
• Yarn-classic handover After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665 (vendored drift-keep after the dependency is removed): reproduces on npm with npm uninstall. npm 8 (lock v2), 10 and 12 (lock v3) all show: rollback exits 1 every time (vendor_lock_entry_drifted + vendor_artifact_kept), scan --prune keeps the entry, remove exits 1 (vendor_revert_kept), vendor --check passes, and the artifact stays. npm adds one more loop: the plain rescan's vendor_ledger_entry_unwired hint says to run scan --prune, and the prune keeps the entry anyway. Commented: After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665 (comment). The matching "known non-bug" (npm prune keeping a vanished entry) is retired.
• Yarn-classic handover Vendored yarn classic writes and deletes through a symlinked .socket/vendor/npm dir, so rollback in one project deletes another project's vendored tarballs and breaks its frozen install #664 (symlinked .socket/vendor/npm): already triaged as ecosystem-wide and fixed by draft PR Fix vendored revert deleting through a symlinked vendor dir (#664) #666. Nothing to add.

Cells (Linux)

• npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659 class, hosted→vendored takeover on v2/v3 locks:
  • Dual lock (shrinkwrap + package-lock, npm 10): pass. Both locks are restored and re-wired to vendored.
  • Alias lp@npm:left-pad (npm 10 v3): pass. npm 8 v2: pass, apart from the known npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 legacy-mirror warning.
  • A local file: dir dependency named like the patched package (third_party/left-pad = left-pad@1.3.0, next to a registry node_modules/left-pad): fail npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688 (new). A plain vendored scan refuses the registry copy with vendor_workspace_member; hosted works; scan/get --mode vendored un-host the pin and then refuse, so a fresh npm ci installs unpatched bytes. Same on npm 8 / 10 / 12, and v4.0.0 refuses the same way.
• Vendor eject failure rollback: fail A failed vendor eject rewrites every file in the project root from its snapshot, so vendor --json > report.json (or > vendor.log 2>&1) in the project loses the output and concurrent writes to root files are reverted #687 (new). EjectSnapshot snapshots and rewrites every regular file in the project root. vendor --json > report.json inside the project leaves an empty file (x3). > vendor.log 2>&1 loses the error lines. A concurrent appender lost 7 of 400 lines. An untouched README.md got a new inode. Eject is v5-only (v4.0.0 returns noManifest).
• Hosted left-pad + file: fork (npm 8 / 10 / 12): hosted pin, npm ci patched, vex attests. Pass. The file: copy is left alone.

Issues

• Filed A failed vendor eject rewrites every file in the project root from its snapshot, so vendor --json > report.json (or > vendor.log 2>&1) in the project loses the output and concurrent writes to root files are reverted #687: A failed vendor eject rewrites every file in the project root from its snapshot, so vendor --json > report.json (or > vendor.log 2>&1) in the project loses the output and concurrent writes to root files are reverted #687
• Filed npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688: npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688
• Commented on After yarn remove of a vendored package, rollback fails forever (exit 1) and no command can clean up the orphaned yarn classic artifact; the remedies it prints don't work #665 with the npm matrix.

False positives ruled out

• vex --json exiting 2 is json_requires_output (it needs --output). My usage error.
• Hosted vex reporting not_applied right after git stash restored committed unpatched node_modules. It's correct after a real npm ci.
• vendor_service_offline_conflict / --vendor-source build rejected: v5 removed local artifact building (documented in vendor --help).
• A vendored rescan failing vendor_lock_entry_not_found for an uninstalled package: my batch mock returned every patch regardless of the request.

Probe branches

• None. git push origin --delete bughunt/npm/20260930-alias-linked still fails ("remote end hung up" / "Everything up-to-date"), so I didn't push another branch that couldn't be cleaned up. Both findings are decided in OS-independent code. On Windows the A failed vendor eject rewrites every file in the project root from its snapshot, so vendor --json > report.json (or > vendor.log 2>&1) in the project loses the output and concurrent writes to root files are reverted #687 rename-over of a shell-held redirect target may fail outright (eject_rollback_failed); that's in the backlog.

Next

1. A failed vendor eject rewrites every file in the project root from its snapshot, so vendor --json > report.json (or > vendor.log 2>&1) in the project loses the output and concurrent writes to root files are reverted #687 on Windows/macOS once probe branches can be deleted again (Windows sharing violations when renaming over an open redirect target).
2. Other npm scan_lock_matches early returns or per-package gates reached after the takeover restore: bundled-only, link-only and non-registry-only entries (vendor_lock_entry_not_rewritable) over a hosted pin; vendor_npm_sibling_lock_unwired with a shrinkwrap/package-lock pair whose sibling differs.
3. A real npm workspace whose member is a fork with the same name@version as a registry copy that npm keeps nested (does npm vendored refuses a registry package with vendor_workspace_member whenever a local file: directory (or workspace member) has the same name@version, and the hosted→vendored takeover then un-hosts it, leaving it unpatched #688 also fire there?).
4. Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 / npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched #588 follow-ups once Fix agent mode patching linked first-party source (#626) #634 / Fix npm/Bun VEX attesting a patch a same-lock copy skips (#588) #589 land.
5. Global -g leftovers (npm 6/8/11 on macOS / Windows, unwritable prefixes, version managers).

[github-actions[bot]]

[agent] 2026-10-03 18Z: npm bug-hunt run

Tested: main 045d7ec (unchanged; the binary reports 4.0.0), latest release v4.0.0 (installed from npm for bisecting). Linux sandbox: npm 6.14.18, 7.24.2, 8.19.4, 10.9.9 (new), 11.21.0 on Node 22.22, and npm 12.1.0 / 12.2.0 on Node 24.21. The patch API was a rebuilt local Python mock (batch, by-package, view, blob, patches/package, artifact and /registry/ passthrough), run in two variants: one prepends a marker, the other rewrites return pad + str;. Mock note: the blob route must serve the before bytes for the before-hash, or agent rollback fails "Content hash mismatch" (a mock artifact).

Re-triage

Main hasn't moved and no human has commented, so I skipped re-triage.

Cells (Linux)

• Baseline cycles (scan → fresh npm ci → vex → rollback byte-exact), plain + alias: pass for agent / vendored / hosted on npm 10.9.9, 11.21.0 and 12.2.0. Agent still leaves the alias unpatched (npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356).
• overrides with a transitive file: dependent, vendored + hosted, npm 10 / 12, including npm install and npm install <other> afterwards: pass.
• Vendored with install-strategy=linked (npm 11 / 12), plain + alias: pass.
• A file: tarball dependency that ships its own npm-shrinkwrap.json (nested left-pad@1.3.0), hosted + vendored, npm 10 / 12: pass. npm sets no hasShrinkwrap for file: deps; the registry-dependency case is still untested.
• A lock with merge-conflict markers: hosted warns "not valid JSON; npm redirect skipped" and exits 0 (consistent with the bun redirect_*_invalid exit-0 contract), vendored exits 1 loudly, agent applies. pass (loud).
• npm 12 min-release-age, strict-npmrc=true with the hosted .npmrc: pass. npm 8 / 10 / 11 print no unknown-config warning for allow-remote.
• npm 12.1+ native npm patch / patchedDependencies (lockfileVersion 4): fail → Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 (new). Hosted rewrites the v4 entry, exits 0 with no warning, and when the user's diff overlaps the Socket patch every later npm ci / npm install fails EPATCHFAILED. With a non-overlapping diff both patches install, but vex refuses hash_mismatch. Vendored refuses with "lockfileVersion Some(4) … use npm >= 7" (wrong advice). Agent overwrites the user's npm-patched file (documented non-strict fallback). npm 12.1.0 and 12.2.0 both reproduce; v4.0.0 does the same, so it isn't a regression.
• npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659 class on lockfileVersion 4: a hosted pin on a v4 lock, then scan --mode vendored → takeover restores the registry entry and deletes .npmrc, then refuses on the version gate (exit 1, project unpatched). x2. Commented on npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659.

Issues

• Filed Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711: Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711
• Commented on npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659: npm lockfileVersion 1: scan/get --mode vendored un-host a hosted patch and then refuse to vendor it, so the project silently goes back to unpatched (vendor eject rolls back correctly) #659 (comment)

False positives ruled out

• Agent rollback "Content hash mismatch": the mock served patched bytes for the before-hash.
• First hosted npm patch check showed unpatched bytes: I had cloned the pre-scan commit.

Probe branches

None. Everything this run found is decided in OS-independent lock code, and the old probe branches still can't be deleted.

Next

1. Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 follow-ups: npm patch on a nested / workspace copy; rollback / remove / repair on v4 locks; vex wording; agent --strict.
2. A registry dependency that ships npm-shrinkwrap.json (hasShrinkwrap: true) holding the patched package, hosted / vendored, with npm install re-reading the shrinkwrap.
3. Backlog 0–2 from the state file (bundled-only / link-only takeovers, A failed vendor eject rewrites every file in the project root from its snapshot, so vendor --json > report.json (or > vendor.log 2>&1) in the project loses the output and concurrent writes to root files are reverted #687 on Windows / macOS, Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 follow-ups).
4. npm 12 allow-git=none / allow-scripts interplay with git dependents of a patched package.

[github-actions[bot]]

[agent] 2026-10-03: handover from the Bun bug-hunt routine (generic, not Bun-specific)

What: after an agent-mode apply is interrupted, or after any reinstall that restores unpatched bytes while .socket/manifest.json still records the patches, plain socket-patch scan --mode agent (human output) does not re-apply. It prints [skip] … (already recorded: …) and "All selected patches are already recorded in the manifest; run socket-patch apply to re-apply them.", then exits 0 with the files still unpatched. The same command with --json does re-apply (apply.applied: 3, files patched). So the output-format flag changes what is written to disk.

Evidence (main 045d7ec, Linux):

• npm 10 project (left-pad@1.3.0, is-odd@3.0.1): run scan --mode agent, strip the patch from node_modules/left-pad/index.js, then scan --mode agent → still unpatched; scan --mode agent --json → patched.
• Bun 1.4.2 isolated workspace, SIGKILL mid-apply (POO / PPO states): plain re-run → unchanged (5/5); --json re-run → PPP (4/4); socket-patch apply → PPP.
• Code: crates/socket-patch-cli/src/commands/scan/mod.rs ~2733–2771 (the human path partitions out already_recorded and returns early).

The human message names the remedy, and vex stays honest (not_applied) throughout, so this may be by design. I'm not filing it; it's handed over in case npm's routine wants to judge the human-vs-JSON divergence against CLI_CONTRACT.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-04 00Z: npm bug-hunt run

Tested: main 045d7ec (unchanged; the binary reports 4.0.0), latest release v4.0.0 (installed from npm for bisecting). Linux sandbox: npm 6.14.18 and 10.9.4 on Node 22.22, npm 12.2.0 on Node 24.21. The patch API was a rebuilt local Python mock (batch, by-package, view with inline blobs, blob, patches/package, the hosted tarball and a /registry/ passthrough).

Re-triage

Main hasn't moved and no human has commented on #302, so I skipped re-triage.

Cells (Linux)

• Bun handover (20261003T193043Z-from-bun), agent re-scan after a reinstall: fail → Human-output scan --mode agent / --sync still never re-applies an already-recorded patch after a reinstall (#454 fixed only the --json path) #732 (new). After npm ci restores pristine bytes, a human-output scan --mode agent or scan --sync prints [skip] … (already recorded) and exits 0 with the files unpatched. The same command with --json re-applies them. scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454 was fixed by Fix agent scan/get skipping apply for recorded patches (#454) #456 (a36432e) in the fetch loop, but the human path partitions recorded selections out first (scan/mod.rs:2733-2771, from de316b4 / Keep Composer redirects and rollback consistent #358). It reproduces on npm 6.14.18, 10.9.4 (×3) and 12.2.0. In v4.0.0 both formats skip (the original scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454).
• scan --sync GC removes the before-blob of a recorded patch: documented (rollback downloads the before-blob on demand). Not a bug.
• Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 follow-up, npm 12.2.0, lockfileVersion 4 with a non-overlapping npm patch (is-number) + hosted left-pad: scan → npm ci patches both packages, vex emits 1 statement, rollback and remove restore the lock byte-exact to the pre-scan commit and delete .npmrc, and a later npm ci keeps the user's npm patch. repair is a no-op with a hint. pass.

Issues

• Filed Human-output scan --mode agent / --sync still never re-applies an already-recorded patch after a reinstall (#454 fixed only the --json path) #732: Human-output scan --mode agent / --sync still never re-applies an already-recorded patch after a reinstall (#454 fixed only the --json path) #732

False positives ruled out

• The GC deleting the before-blob, as above.

Probe branches

None. #732 is decided in OS-independent code.

Next

1. Human-output scan --mode agent / --sync still never re-applies an already-recorded patch after a reinstall (#454 fixed only the --json path) #732: a mixed run (one recorded but reverted patch + one new patch) only applies the new one. Confirm that with a two-patch mock.
2. A registry dependency with hasShrinkwrap: true that holds the patched package (needs a mock registry packument), hosted / vendored.
3. Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice) #711 follow-ups: nested / workspace npm patch copies; agent --strict.
4. Backlog 0–2 from the state file (bundled-only / link-only takeovers, A failed vendor eject rewrites every file in the project root from its snapshot, so vendor --json > report.json (or > vendor.log 2>&1) in the project loses the output and concurrent writes to root files are reverted #687 on Windows / macOS, Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 follow-ups).