Bug hunt ledger: PDM

[Mikola Lysenko (mikolalysenko)]

[agent] Progress ledger for the scheduled PDM bug-hunt routine (label pm:pdm).

Last run: 2026-10-02 03:34Z on main 61cfb9b (latest tag v4.0.0; PR #522 head e5ab4b5 also tested). Linux runs use real PDM against a local mock patch API, because the sandbox blocks the Socket patch hosts. macOS and Windows runs use probe branches.

Coverage matrix

PDM	lock_version	agent (Linux / macOS / Windows)	hosted (Linux)	vendored (Linux)
1.4.5	2	untested	pass on v5 (__pypackages__ sync, legacy [metadata.files], rollback byte-exact); post-rollback install fail #477	untested
2.0.3	4.0	fail #332 w/ install.cache symlink; fail #502 (.pdm.toml python.path) / untested / untested	refused (documented)	refused (documented)
2.8.2	4.3	fail #332 w/ install.cache symlink (all 3 OS)	pass (stale-install warning)	untested
2.10.4	4.4	fail #332 w/ install.cache symlink; pth fails closed	pass (stale-install warning)	untested
2.11.2	4.4.1	fail #332 w/ install.cache symlink	untested	untested
2.12.4	4.4.1	fail #332 w/ install.cache symlink (all 3 OS; re-confirmed on v5 Linux); hardlink pass; fail #502 (venv.in_project=false)	pass (v5: #331/#382 fixed; dev/optional groups, relocks, pdm add repair); fail #528 (PEP 582 stale warning + VEX); fail #413 (private index static_urls); post-rollback install fail #477	pass on v5 (warm sync patched, vex); post-rollback install fail #477
2.15.4	4.4.1	pass (all 3 OS, symlink + hardlink)	untested	untested
2.20.1	4.5.0	pass	pass (v5: #331/#382 fixed); fail #413	pass (v4)
2.26.9	4.5.0	pass (symlink/hardlink/pth)	pass on v4; untested on v5	untested
2.29.2	4.5.1	pass (all 3 OS, in-project .venv); fail #502 Linux (venv.in_project=false / pdm use <venv>: real env skipped, stray .venv or PATH python patched)	fail #528 (PEP 582 __pypackages__: no stale warning, VEX attests); pass on v5 (dev/optional groups, update --update-all/--update-reuse/--unconstrained, lock --refresh keeps patch, lock-only scan, sync, manifest-less rollback byte-exact, VEX); multi-target fork refused (documented); fail #413 (re-confirmed 61cfb9b); stale warning + VEX with out-of-tree env fail #502; post-rollback install fail #477	pass on v5 (warm/fresh/frozen, lock --check, idempotent, vex, rollback byte-exact; private index + static_urls rollback byte-exact; nested services/* project; agent→vendored takeover); post-rollback / remove install fail #477
1.15.5	3.1	fail #502 (.pdm.toml python.path external venv)	refused (documented)	refused (documented)
2.15.4, 2.20.1	4.4.1 / 4.5.0	—	pdm add → uninstallable lock (PDM reuse, #331); re-scan repairs (pass)	pdm add → rollback fails closed; pdm lock → re-scan → rollback (pass)
0.12, 1.0, 1.8 – 1.14	2 / 3.1	untested	untested	untested

Modes × macOS/Windows for hosted and vendored: untested by this routine (the repo's pdm-compatibility.yml covers them).

Global mode (-g, maintainer request)

PDM	global location	scan -g report (Linux)	apply / rollback / vex -g (Linux)	macOS / Windows
2.29.2	system interpreter (default)	pass	pass (apply, idempotent, vex, rollback byte-exact)	untested
2.29.2	pdm use -g → global-project/.venv	fail #451 (pass on PR #522)	pass via --global-prefix (incl. space/unicode path, install.cache symlink per-file)	untested
2.29.2	PDM-managed cpython@3.12	fail #451 (pass on PR #522, apply + rollback)	untested
2.29.2 / 2.12.4	venv.in_project=false → <data>/pdm/venvs/global-project-*	fail #451 (pass on PR #522, apply + rollback)	untested
any	same release also in an earlier global env (system / pipx)	—	only the first copy patched (#501, generic)	untested
2.12.4	system interpreter (default)	pass	pass without install.cache; fail #332 with install.cache symlink (writes PDM cache)	untested
2.12.4	pdm use -g <pdm python> (no venv)	fail #451	untested
2.12.4	global-project/.venv	fail #451 (pass on PR #522)	—	untested
any	unwritable prefix (non-root)	—	exit 1, file untouched (pass); scan --json drops the reason (#424)	untested
0.12 – 2.0.3	—	untested	untested	untested

-g --mode hosted and --global-prefix --mode hosted refuse with exit 2 (pass). SOCKET_GLOBAL=1 matches -g (pass). --global-prefix <site-packages> finds both #451 locations (pass).

Backlog

1. In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528 on PDM 1.4.5 / 1.15.5 (PEP 582 default) and agent -g with PEP 582.
2. Once PR Fix global Python scan missing uv and PDM installs (#449, #451) #522 merges: re-run the -g matrix on main; PDM 1.4.5 / 2.0.3 global projects; macOS / Windows global dirs.
3. Hash variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 (private index serving different bytes); rollback --preserve-state; PDM 1.x feature.install_cache with agent mode.
4. CRLF / BOM pdm.lock hosted + vendored on 2.12 / 2.29; concurrent scan runs (--lock-timeout).
5. macOS / Windows probes, once probe-branch deletion works (git push --delete fails through the git proxy; the stale bughunt/pdm/20260930-cache-symlink still needs a maintainer to delete it).
6. Done: groups (-G dev/optional, --prod), relocks (update --unconstrained/--update-all/--update-reuse, lock --refresh), vendored relocks, pdm add after hosted/vendored on 2.12–2.29, Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502 on 1.15.5 / 2.0.3.

Known non-bugs

• lock_version absent / 3.1 / 4.0–4.2 refused; 2.8.0 accepted-but-crashes (documented).
• __pypackages__ (PEP 582) not crawled; agent mode falls through to the PATH interpreter (documented). Hosted mode installs into __pypackages__ fine.
• A plain relock (pdm lock, pdm update <pkg>) drops the hosted / vendored patch (documented; re-scan). Measured: pdm lock --refresh actually keeps it on 2.12.4 and 2.29.2 (the doc's claim is conservative drift, not a bug). Rollback still works when the package stays at the same version.
• PDM < 2.11 keeps an already-installed same-version package after a hosted rewrite (redirect_pdm_stale_install_risk, documented).
• Vendored refuses lock-only checkouts (vendor_fetch_unverifiable), by design.
• Hosted never takes over a vendored path (redirect_pdm_refused), by design (hosted-direction takeover is warn-only). Hosted→vendored for PyPI fails closed with pypi_pdm_source_already_exists (the same for uv/poetry): run rollback first.
• A multi-target (pdm lock --append) lock holding the package at two versions is refused (redirect_pdm_refused), documented.
• PDM 2.10 install.cache_method=pth: agent apply fails closed with File not found.
• pdm lock without -G does not lock optional groups (PDM behaviour, not a socket-patch bug).
• The mock-based published 4.0.0 wheel yields redirected: 0 on lock-only projects, so it can't be used to bisect hosted findings.
• v5 hosted rollback/remove after the package left the lock (pdm remove, upgrade): exit 1 Manifest not found is the documented truly-empty result (formerly Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382).
• v5 hosted rollback refuses a non-universal release (binary wheels) on a lock without cross_platform (PDM ≥ 2.17 default inherit_metadata): documented in CLI_CONTRACT "Hosted unwind coverage".
• v5 hosted rollback on a cross_platform lock writes every PyPI release file (e.g. pyyaml 6.0.1: 51), where PDM locked a requires-python-filtered subset (39). Installs and lock --check are unaffected; cosmetic.
• v5 hosted VEX on a lock-only checkout attests the redirect (the lock is the hosted state); a stale installed copy is omitted not_applied.
• A first pdm add -g with no pdm use -g installs into the system interpreter, which scan -g does find; only the venv and PDM-managed interpreter cases are Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451.
• scan -g --mode vendored is accepted (exit 0) while hosted refuses. It isn't PDM-specific, so it's left to maintainers; not filed.
• rollback deletes the manifest entry (documented: it removes local state), so a later apply is a no-op.
• A mode-less scan without -g / --prune defaults to hosted and rewrites pdm.lock (documented default).
• From a monorepo root, scan 'services/*' writes per-project .socket/, but rollback from the root reports Manifest not found (use --cwd services/api). That's generic, not PDM-specific; left to maintainers.
• After an agent → vendored takeover, .socket/manifest.json stays as {"patches": {}} (cosmetic).
• Test-harness note: PDM's http:// downloads from a 127.0.0.1 mock get a 405 from the agent proxy unless HTTPS_PROXY is unset (sandbox artifact, not a bug).
• PDM 2.12 – 2.20 pdm add <other> after hosted/vendored keeps the patched hash but drops the url/path (an uninstallable lock, PDM reuse behaviour, known from Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331). Hosted re-scan repairs it. Vendored re-scan refuses (pypi_pdm_source_already_exists, "run pdm lock") and rollback fails closed (drift); the pdm lock → re-scan → rollback path works. 2.29.2 keeps the source.
• pdm sync --prod --clean leaves dev/optional-only packages installed: identical without socket-patch (PDM behaviour).
• The hosted stale-install warning mentions "Poetry before 1.4" on PDM projects (generic text, cosmetic).
• Test-harness note: VEX resolves the hosted patch uuid from the URL's second uuid segment, so a mock view must answer for it. Don't pkill -f mock, which kills the calling shell.

[github-actions[bot]]

[agent] 2026-09-30: PDM bug-hunt run

First run. The ledger was empty and there were no earlier pm:pdm issues, so there was nothing to re-triage.

Tested: main f6b7fb9 (latest release tag v4.0.0), release build of socket-patch-cli. The sandbox blocks patches-api.socket.dev and patch.socket.dev, so all Linux work used real PDM releases against a local mock of the authenticated patch API (/patches/batch, /by-package, /view, /blob, /package). The mock serves a real urllib3 1.26.18 wheel with a marker appended to urllib3/response.py, with a correct RECORD and sha256. The mock script is embedded in the probe workflow of run 36735829162.

Filed

• Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332: agent mode writes the patch through PDM 2.0–2.12's directory-symlink install cache (install.cache=true, cache_method=symlink). The shared ~/.cache/pdm/packages gets patched, and so does every other project using it. Reproduced on Linux, macOS and Windows (probe run https://github.com/SocketDev/socket-patch/actions/runs/36735829162). 2.15+ (per-file symlinks) and hardlink are OK; pth fails closed.
• Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331: hosted rollback reports success but leaves the patch url/hash in pdm.lock after pdm add <other> / pdm lock --update-reuse followed by the suggested re-scan. On 2.12/2.20 it leaves the patched hash with no url, and pdm sync then fails. Linux, 2.12.4 / 2.20.1 / 2.26.9 / 2.29.2.

Cells covered (Linux unless noted)

Cell	Result
agent, install.cache symlink, 2.0.3 / 2.8.2 / 2.10.4 / 2.11.2 / 2.12.4	fail #332 (2.8.2 and 2.12.4 also fail on macOS and Windows)
agent, install.cache symlink (per-file), 2.15.4 / 2.20.1 / 2.26.9 / 2.29.2	pass (all 3 OS for 2.15.4 and 2.29.2)
agent, install.cache hardlink, 2.12.4 / 2.15.4 / 2.26.9 / 2.29.2	pass (all 3 OS)
agent, install.cache pth, 2.10.4 / 2.26.9	2.10.4 fails closed (File not found, exit 1); 2.26.9 pass
hosted 2.29.2: default / --static-urls / direct_minimal_versions / --platform linux / no_cross_platform / no_static_urls,no_cross_platform → pdm sync + pdm lock --check	pass
hosted 2.8.2 / 2.10.4 / 2.12.4: rewrite + warnings (redirect_pdm_stale_install_risk)	pass (documented)
hosted groups: dev group + sync --prod, optional group -G http	pass (VEX omits the not-installed package)
VEX on hosted lock before reinstall (stale install)	pass (not_applied omitted)
vendored 2.29.2: scan, sync --clean, install --frozen-lockfile, lock --check, idempotent re-scan, rollback byte-exact	pass
takeover vendored→hosted	refused redirect_pdm_refused (hosted direction is warn-only by design)
takeover hosted→vendored	fails pypi_pdm_source_already_exists, exit 1 (the same for uv/poetry; redirect_revert_supported has no pypi)
hosted relock pdm lock → re-scan → rollback	pass
hosted pdm add / lock --update-reuse → re-scan → rollback	fail #331

Ruled out / not filed

• Vendored lock-only checkout refused (vendor_fetch_unverifiable): by design (lock_inventory/pypi.rs:531).
• static_urls hosted rewrite emits {file, hash} rather than the {url, hash} shape the doc claims. PDM installs it fine, so this is at most a doc nit.
• The empty-venv hosted scan crawls the PATH interpreter (119 packages): documented fall-through.
• 2.22.4 / 2.25.9 are SKIP in results.json. That is a harness artifact on the doc's run, and the CI matrix covers them.

Housekeeping

• Probe branch bughunt/pdm/20260930-cache-symlink could not be deleted: the sandbox git proxy disconnects on ref-delete pushes (tried 5×). A maintainer should delete it. It only adds .github/workflows/bughunt-pdm.yml.
• The GitHub issue search API returns 0 results for every query in this sandbox, so dedup used a full REST listing of issues and PRs (308) grepped locally.

Next

1. PDM 1.x feature.install_cache (symlink/pth) with agent mode, on python.use_venv=true.
2. Hosted after pdm update urllib3 / pdm remove / pdm lock --refresh, plus the rollback invariants (sibling of Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331).
3. CRLF + pdm add rebase; pdm lock -L custom.lock with a later rename to pdm.lock.
4. Windows long-path and unicode project dirs for hosted and vendored (probe).
5. inherit_metadata multi-target lock (pdm lock --append --python) with a forked package vs a single version: refusal and VEX.

[github-actions[bot]]

[agent] 2026-09-30: PDM bug-hunt run

Tested: main f6b7fb9 (v4.0.0-33), release build of socket-patch-cli, plus the published PyPI socket-patch 4.0.0 for comparison. Linux only, with real PDM releases against a local mock of the authenticated patch API (batch, by-package, view, blob, package), which serves a real urllib3 1.26.18 wheel with a marker line appended to urllib3/response.py.

Filed / commented

• Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 (new): hosted rollback and remove <purl> fail permanently (exit 1, "the file drifted; re-run scan") once the patched package leaves pdm.lock through pdm remove, a transitive removal, or an upgrade to another version. The recommended re-scan (redirected: 0) never prunes the stale ledger edit. Reproduced 2/2 on 2.12.4, 2.20.1 and 2.29.2, plus 1.4.5 (commented). VEX correctly omits the package (redirect_unwired). Not covered by Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 / PR Fix PDM rollback leaving the patch after a re-scan (#331) #375.
• Handover to uv (entries/uv/…-from-pdm.md): the same flow fails with uv remove, possibly already covered by Hosted uv rollback and remove are stuck after any unrelated pyproject.toml edit or uv add, and the suggested re-scan doesn't fix it #379.

Re-triage

• Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 and Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332: main is unchanged since the last run (f6b7fb9), so no re-check was needed. Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 has fix PR Fix PDM rollback leaving the patch after a re-scan (#331) #375 (open, draft), which doesn't cover Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382's case.

Cells covered (Linux)

Cell	Result
hosted pdm remove → rollback / re-scan+rollback / remove <purl>, 2.12.4 / 2.20.1 / 2.29.2 / 1.4.5	fail #382
hosted, upgrade to urllib3 1.26.19 + pdm lock → re-scan → rollback, 2.20.1 / 2.29.2	fail #382
hosted, transitive removal (pdm remove requests), 2.29.2	fail #382
vendored 2.12.4 / 2.20.1: scan, fresh sync, install --frozen-lockfile, lock --check, idempotent re-scan, byte-exact rollback	pass
multi-target --append lock (1.26.18 for <3.10, 2.0.7 for >=3.10), 2.29.2 hosted	refused redirect_pdm_refused, lock unchanged (documented)
CRLF lock hosted → sync → pdm lock (re-renders LF) → re-scan → rollback, 2.29.2	pass (lands on the relocked registry lock)
PDM 1.4.5 lock_version 2 ([metadata.files]) hosted: rewrite, both warnings, pdm sync into __pypackages__ installs patched bytes, idempotent, byte-exact rollback	pass
VEX after the package left the lock	pass (omitted, redirect_unwired)

Ruled out / not filed

• The multi-target fork refusal is documented.
• The published 4.0.0 wheel doesn't produce a hosted redirect for a lock-only project against the mock (redirected: 0), so Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 can't be bisected against it. That's not a finding: it's a mock/route difference.
• PDM 1.x bootstrap needs the era pins from scripts/backtest-pdm.py:pins_for (pythonfinder 1.2.10 etc.). That's an environment issue, not a bug.

Housekeeping

• The old probe branch bughunt/pdm/20260930-cache-symlink still can't be deleted: git push --delete gets "remote end hung up" from the sandbox proxy again. A maintainer should delete it. For that reason I didn't create a new probe branch this run, and Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 is platform-independent logic anyway.

Next

1. pdm update --unconstrained / pdm lock --update-all on hosted (does it keep the url, like --update-reuse in Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331?).
2. PDM 1.x feature.install_cache with agent mode (sibling of Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332); 1.4.5 now bootstraps with the backtest pins.
3. Hosted with a private [[tool.pdm.source]] index and respect-source-order; pdm export of a hosted lock.
4. Windows long-path / unicode dirs (probe, once branch deletion works).
5. Re-triage Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 when PR Fix PDM rollback leaving the patch after a re-scan (#331) #375 merges; Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332.

[github-actions[bot]]

[agent] 2026-10-01: PDM bug-hunt run

Tested: main 2463257 (#277, "consolidate the v5 patching workflow"; latest tag v4.0.0), release build, plus a build of f6b7fb9 (v4) to bisect. Linux only. Real PDM 2.12.4 / 2.20.1 / 2.29.2 against a local mock of the v5 patch API (batch, by-package, package grant, view, hosted wheel), with SOCKET_PATCH_SERVER_URL set to the mock origin. Hosted rollback in v5 re-derives files from PyPI's JSON API. The Rust client can't reach pypi.org through the sandbox proxy, so SOCKET_PYPI_JSON_API pointed at a local pass-through to pypi.org.

Filed / closed

• Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 (new): hosted rollback and remove rewrite a private-index static_urls lock's file URLs to files.pythonhosted.org. PDM 2.20/2.29 then bypass the mirror (0 mirror hits), and PDM 2.12.4 fails pdm sync on a mirror-only network. The uv and Pipenv restores refuse a non-PyPI index; restore_pdm doesn't check. First bad commit is 2463257; v4 f6b7fb9 round-trips byte-exactly.
• Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 closed (fixed by v5 prerelease: scan → vex → vendor workflow, hosted by default #277): pdm add / --update-reuse → re-scan → rollback leaves 0 patch refs, and pdm sync / lock --check pass (2.12.4, 2.20.1, 2.29.2).
• Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 closed (fixed by v5 prerelease: scan → vex → vendor workflow, hosted by default #277): with no v5 ledger there's no stale state. After pdm remove or an upgrade, rollback / remove exit 1 with Manifest not found, the documented truly-empty project result.

Cells covered (Linux)

Cell	Result
hosted 2.29.2 lock-only: scan → pdm sync (patched bytes) → idempotent re-scan → manifest-less rollback (byte-exact)	pass
hosted #331 flows, 2.12.4 / 2.20.1 / 2.29.2	pass (fixed)
hosted #382 flows (remove, upgrade), 2.12.4 / 2.20.1 / 2.29.2	pass (documented exit 1)
hosted private index + static_urls, rollback / remove, 2.12.4 / 2.20.1 / 2.29.2	fail #413
hosted pyyaml (binary wheels), 2.29.2 default inherit_metadata: rollback	refused (documented in CLI_CONTRACT)
hosted pyyaml, 2.12.4 cross_platform: rollback	success, but writes all 51 PyPI files where PDM had locked 39 (it drops the cp36/cp37 wheels by requires-python). Installs fine. Cosmetic, not filed.
VEX manifest-less, 2.29.2: stale install omitted (not_applied); after pdm sync attests; lock-only attests	pass

Ruled out / not filed

• The 2.29 default-strategy rollback refusal for non-universal releases is documented ("a pdm.lock without cross_platform …").
• The cross_platform file-superset restore: pdm sync and lock --check are unaffected, so it isn't a functional break. It's noted under Known non-bugs.

Housekeeping

• git push --delete of the stale probe branch bughunt/pdm/20260930-cache-symlink was denied by the session's permission classifier this run. A maintainer should delete it. No new probe branches were created, since they couldn't be cleaned up.

Next

1. Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 re-triage on v5 (agent mode, install.cache symlink, PDM 2.0–2.12).
2. Vendored mode on v5 (vendored_backend): 2.29.2 / 2.12.4 / 1.4.5, plus private index + static_urls (does vendored rollback keep the mirror URLs?).
3. Hosted on lock_version 2 (PDM 0.12 / 1.4.5) through the v5 upstream restore ([metadata.files] full-release assumption).
4. Hosted → vendored takeover on v5 (now through the upstream restore).
5. A non-static_urls private index serving different bytes for the same name and version (the hash variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413).

[github-actions[bot]]

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major PDM version and on Linux, macOS and Windows.

Where PDM puts global installs: pdm -g global project (~/.pdm/global-project, or ~/.local/share/pdm/global-project) plus the global interpreter's site-packages. Check that -g doesn't patch PDM's shared install cache (see #332).

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed PDM package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a PDM project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × PDM version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

[github-actions[bot]]

[agent] 2026-10-01: PDM bug-hunt run

Tested: main 2463257 (#277, v5 consolidation; latest tag v4.0.0, unchanged since the last run), release build. Linux only, real PDM 2.12.4 and 2.29.2. Global-mode discovery was checked with a logging mock of POST /patch/batch (SOCKET_PROXY_URL), which records every PURL the CLI queries. #332 was re-checked with the issue's own probe.py (a v4-shaped mock, which v5 agent mode still accepts).

Filed / commented

• Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 (new): scan -g never crawls PDM's global locations: the global-project venv that pdm use -g creates (<config>/pdm/global-project/.venv), and PDM-managed interpreters (<data>/pdm/python/cpython@X/…/site-packages, which pdm add -g uses directly on 2.12). It exits 0 and the packages are never queried. --global-prefix <site-packages> finds them.
• Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 commented: it still reproduces on v5 2463257. With PDM 2.12.4 symlink cache, both the PDM cache and a never-scanned project get the patch (2/2 runs); the 2.29.2 control is OK.

Cells covered (Linux)

Cell	Result
scan -g report, PDM 2.29.2 / 2.12.4 default global (system interpreter → /usr/local/lib/python3.11/dist-packages)	pass
scan -g, 2.29.2 pdm use -g → global-project/.venv	fail #451
scan -g, PDM-managed cpython@3.12 (2.29.2 pdm python install; 2.12.4 pdm use -g without a venv)	fail #451
scan -g run from inside the global project dir	fail (same as #451)
--global-prefix <dir> on both locations	pass (finds them)
SOCKET_GLOBAL=1 parity with -g	pass
scan -g --mode hosted, --global-prefix … --mode hosted	pass (exit 2, loud refusal, nothing written)
#332 agent mode + install.cache symlink, 2.12.4 / 2.29.2 on v5	fail #332 / pass

Ruled out / not filed

• scan -g --mode vendored is accepted (exit 0, crawls 108 global packages, nothing to vendor), while hosted refuses. It isn't PDM-specific and isn't documented either way, so I didn't file it. A sibling or maintainer may want to decide whether vendored should refuse like hosted.
• The first pdm add -g without pdm use -g uses the system interpreter, and that is found. Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 is limited to pdm use -g / pdm python install setups.

Housekeeping

• git push origin --delete bughunt/pdm/20260930-cache-symlink fails again ("unexpected disconnect while reading sideband packet"). The git proxy appears to reject ref deletion. A maintainer still needs to delete that branch. I created no new probe branches, so macOS and Windows weren't covered.
• Side effect: the sandbox's first pdm add -g installed pip/setuptools/wheel/six/packaging into the container's system interpreter (ephemeral container, no impact on the repo).

Next

1. Global mode, rest of the maintainer checklist: scan -g --mode agent / apply -g / rollback -g / vex -g against a real global install (needs a v5-shaped mock serving a patch for a package in /usr/local/.../dist-packages and in global-project/.venv via --global-prefix). Also check that -g never writes into PDM's install cache (a Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 variant: global project with install.cache=true).
2. Global mode on PDM 1.4.5 / 2.0.3 (where does -g install? PEP 582 __pypackages__ in the global project?), and with venv.in_project=false (<data>/pdm/venvs/global-project-*).
3. Vendored on v5 (vendored_backend): 2.29.2 / 2.12.4 / 1.4.5, incl. private index + static_urls.
4. Hosted lock_version 2 (0.12, 1.4.5) through the v5 upstream restore.
5. macOS / Windows probes for Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 and the global checklist, once branch deletion works.

[github-actions[bot]]

[agent] 2026-10-01: PDM bug-hunt run

Tested: main 6e7ef74 (4 commits since 2463257: npm, poetry and maven fixes; none touch PDM code; latest tag v4.0.0), release build. Linux only. Real PDM 1.4.5 / 2.12.4 / 2.29.2 against a local mock of the patch API (batch, by-package, view, blob, package grant plus the patched-wheel download, with SOCKET_PATCH_SERVER_URL set to the mock). Hosted restores used SOCKET_PYPI_JSON_API pointed at a local pass-through to pypi.org.

Filed / commented

• After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477 (new): after a hosted or vendored rollback, pdm sync, pdm install and pdm install --frozen-lockfile keep the patched build installed (All complete! 0/0; direct_url.json still points at the patch server, or at the deleted .socket/vendor wheel). Rollback's note says the bytes stay "until the next package-manager install", which is false on PDM. Only pdm sync --reinstall restores upstream. Reproduced on 1.4.5, 2.12.4 and 2.29.2, vendored and hosted.
• Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 commented: global mode hits it too. With PDM 2.12.4 install.cache + symlink, pdm add -g links the global interpreter's urllib3 directory into the cache. scan -g --mode agent then patches PDM's cache and, through it, a never-scanned project (2/2 runs). rollback -g un-patches both. The 2.29.2 control is clean.
• scan/get --json drop the agent-mode apply failure: exit 1 with failed: 0, the patch shown as "added", and no error anywhere (e.g. a read-only global ~/.m2) #424 commented (Maven-labelled, generic): the same scan --json agent-apply failure drop reproduces for PyPI. A root-owned --global-prefix, run as uid 65534, gives exit 1 with failed: 0 and no error, while apply --json gives apply_failed / "Permission denied".

Re-triage

• Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 still reproduces on 6e7ef74: scan -g with a 2.29.2 pdm use -g venv crawls 15 packages and finds 0 patches. Unchanged code, so no comment.
• Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 and Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332: no PDM-relevant change on main. Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 was re-confirmed via -g (above).

Cells covered (Linux)

Cell	Result
-g agent, 2.29.2 default global (system dist-packages): scan -g --mode agent, apply -g idempotent, vex -g --product, rollback -g byte-exact; mode-less scan -g report-only	pass
-g agent, 2.12.4 install.cache symlink global	fail #332
--global-prefix <global-project/.venv site-packages> agent apply → import sees the patch → vex → rollback byte-exact, 2.29.2 with install.cache symlink (per-file links, cache pristine)	pass
--global-prefix with a space + unicode path, apply / rollback	pass
Unwritable global prefix (non-root user): exit 1, file untouched; apply reports clearly; scan --json drops the reason	fail #424 (JSON only)
vendored v5 2.29.2: scan → warm pdm sync installs the patch → lock --check → fresh install --frozen-lockfile → idempotent re-scan → vex → rollback byte-exact	pass
vendored v5 2.12.4: scan → warm sync / install patched → vex	pass
rollback (vendored + hosted) → pdm sync / install --frozen-lockfile, 2.29.2 / 2.12.4 / 1.4.5	fail #477
hosted lock_version 2 (1.4.5, [metadata.files]) via the v5 upstream restore: rewrite + both legacy warnings, pdm sync into __pypackages__ patched, idempotent, rollback byte-exact	pass

Ruled out / not filed

• Rollback deletes the manifest entry, so a later apply has nothing to do. That's documented (usage.md: rollback "remove[s] their local state").
• A mode-less scan (not -g) defaults to hosted and rewrites the lock. That's documented. My own run tripped on it mid-test; the affected observation was discarded and redone.
• vex needs --product outside a packaged project (documented error).

Housekeeping

• git push origin --delete bughunt/pdm/20260930-cache-symlink still fails ("remote end hung up"). A maintainer needs to delete it. I created no new probe branches, so macOS and Windows weren't covered.
• Side effect: pdm add -g / pdm remove -g against the container's system interpreter also synced away unrelated packages in /usr/local/lib/python3.11/dist-packages (ephemeral container, so no repo impact).

Next

1. Global -g on PDM 1.4.5 / 2.0.3 (where does -g install: __pypackages__ in the global project?), and venv.in_project=false global venvs (<data>/pdm/venvs/global-project-*).
2. After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477 siblings: remove <purl> and rollback --preserve-state on PDM; agent → vendored takeover on v5.
3. Vendored v5 with a private index + static_urls (does vendored rollback keep the mirror URLs, unlike Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413?).
4. pdm update --unconstrained / lock --update-all on hosted; groups / dev-dependencies via pdm sync -G.
5. macOS / Windows probes, once branch deletion works.

[github-actions[bot]]

[agent] 2026-10-01: PDM bug-hunt run

Tested: main 61cfb9b (16 commits since 6e7ef74: Python crawler .egg-info #452, global pipx #418, -g cwd state #446, Pipenv fixes. None touch PDM discovery or the pdm.lock writers. Latest tag v4.0.0, also installed from PyPI for bisection). Release build. Linux only, real PDM 2.29.2 / 2.12.4 against a fresh local mock of the public patch proxy (SOCKET_PROXY_URL: batch, by-package, view, blob, package with sha256 + sha512 integrity, plus a real patched-wheel host, a PyPI JSON pass-through and a private simple index). Note for future runs: PDM must run with HTTPS_PROXY unset (PyPI is in no_proxy), or its http:// downloads from 127.0.0.1 get a 405 from the agent proxy.

Filed / commented

• Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502 (new): agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false → <data>/pdm/venvs/…, or pdm use <venv>). Agent mode either skips the real env ("not installed", exit 0) or patches a stray ./.venv / the PATH python3 (applied: 1). Hosted mode gives no stale-install warning, and vex attests not_affected while pdm run imports upstream bytes. Reproduced on 2.29.2 and 2.12.4. Not a regression (4.0.0 is the same). It's the PDM version of the Poetry/Pipenv out-of-tree probes (Agent-mode scan misses Poetry's venv for nameless non-package-mode projects, [project].name overrides, and in-project = false with a stray .venv, and still exits 0 #327/Windows agent-mode scan never finds Poetry's default out-of-tree virtualenv, so patches are skipped and the scan exits 0 #329/Agent-mode scan skips Pipenv's out-of-tree venv when the project has a stray venv/ directory or a .venv with PIPENV_VENV_IN_PROJECT=0, and still exits 0 #334/Poetry with virtualenvs.in-project = true but no ./.venv keeps using its out-of-tree env, which socket-patch never probes: agent patches the global interpreter and hosted VEX falsely attests #476).
• After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477 commented: remove <purl> (vendored) restores the lock but prints no advisory, and pdm sync keeps the patched wheel.

Re-triage

• Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 still reproduces on 61cfb9b. Hosted scan → rollback on a private-index static_urls lock rewrites both file URLs to files.pythonhosted.org. No new information, so no comment.
• Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332, Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451: no PDM-relevant change on main. Not re-run.

Cells covered (Linux)

Cell	Result
hosted 2.29.2 smoke: scan → pdm sync installs the patch	pass
vendored 2.29.2, nested project services/api scanned from the repo root (scan 'services/*') → sync / install --frozen-lockfile patched	pass
vendored 2.29.2, private index + static_urls lock: scan → sync patched → frozen install → idempotent → rollback byte-exact (mirror URLs kept, unlike hosted #413)	pass
agent → vendored takeover v5 (2.29.2): manifest record moved to the vendor ledger, sync installs the vendored wheel, rollback restores the lock	pass (leftover install = #477)
remove <purl> vendored → pdm sync	fail #477 (no advisory)
agent, venv.in_project=false (2.29.2, 2.12.4), ± stray .venv, ± PATH python, pdm use <external venv>	fail #502
hosted stale warning + VEX with an out-of-tree env	fail #502; in-project control pass
hosted rollback, private index static_urls	fail #413 (still)

Ruled out / not filed

• From a monorepo root, scan 'services/*' writes state to services/api/.socket, but rollback / rollback 'services/*' from the root fail with Manifest not found at ./.socket/manifest.json. rollback --cwd services/api works. That's generic (not PDM-specific) and arguably the path-glob contract, so it's left to maintainers and not filed.
• After the agent → vendored takeover, .socket/manifest.json is left as {"patches": {}}. Cosmetic, not filed.

Housekeeping

• No probe branches were created (the stale bughunt/pdm/20260930-cache-symlink still needs a maintainer to delete it, since ref deletion through the git proxy fails), so macOS and Windows weren't covered.

Next

1. Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502 on PDM 1.4.5 (.pdm.toml python.path, PEP 582 default) and 2.0.3; macOS / Windows venv dirs.
2. Global -g on PDM 1.4.5 / 2.0.3, and venv.in_project=false global venvs (overlaps Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 / Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502).
3. Hosted pdm update --unconstrained / lock --update-all; groups via pdm sync -G / --prod after hosted and vendored.
4. Hash-variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 (private index serving different bytes); PDM 1.x feature.install_cache with agent mode.
5. macOS / Windows probes once probe-branch deletion works.

[github-actions[bot]]

[agent] 2026-10-02: PDM bug-hunt run

Tested: main 61cfb9b (unchanged since the last run; latest tag v4.0.0), release build, and draft PR #522 head e5ab4b5 for re-triage. Linux only, real PDM 1.15.5 / 2.0.3 / 2.12.4 / 2.15.4 / 2.20.1 / 2.29.2, against a fresh local mock of the authenticated patch API (SOCKET_API_URL + fake token + org, batch / by-package / view / blob / package, a real patched-wheel host, a PyPI JSON pass-through). A second mock instance serves urllib3 1.26.17, because the container's system interpreter now carries urllib3 1.26.18 (left over from an earlier pdm add -g, which I can't remove), and that copy would shadow -g results.

Filed / commented

• In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528 (new): in a PEP 582 __pypackages__ project, hosted mode gives no stale-install warning, and vex attests not_affected (exit 0) while pdm run imports upstream bytes. The docs recommend hosted mode for exactly these projects. In-project .venv control: warning plus not_applied. Reproduced 2/2 on 2.29.2 and 2.12.4. Also a false negative after a correct pdm sync when the PATH python has the same release.
• Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502 commented: PDM < 2.5 records the interpreter in .pdm.toml [python] path, not .pdm-python. Reproduced (agent: package_not_installed, exit 0) on 1.15.5 and 2.0.3.
• Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 commented: PR Fix global Python scan missing uv and PDM installs (#449, #451) #522 verified with real PDM. Global-project .venv, the out-of-tree global-project-<hash> venv (2.29.2 and 2.12.4) and the PDM-managed cpython@3.12.14 are all patched, and rollback restores them (main: applied 0). Caveat: a same-release copy in an earlier global location still wins via crawl_all's first-wins PURL dedup (With the same release in user site-packages and a system site-packages dir, agent mode patches the shadowed system copy, leaves the copy Python imports unpatched, and VEX attests it (worse since #452: now hits apt-installed packages) #501).

Re-triage

• Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451: fixed by open PR Fix global Python scan missing uv and PDM installs (#449, #451) #522 (above), not merged yet, so left open.
• Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502: still reproduces (no code change on main).

Cells covered (Linux)

Cell	Result
hosted / vendored, urllib3 only in a dev group or an optional group, 2.29.2 and 2.12.4: scan → lock --check → warm sync → fresh sync → install --frozen-lockfile → vex → rollback byte-exact	pass
pdm sync --prod --clean leaving dev/optional urllib3 installed	PDM behaviour (no-socket-patch control identical), not a bug
hosted + update --unconstrained (upgrades → rollback Manifest not found, documented), update --update-all, update --update-reuse, lock --refresh; re-scan; rollback byte-exact	pass
pdm lock --refresh after hosted and vendored keeps the patch on 2.12.4 and 2.29.2 (the doc says it drops it; harmless doc drift)	pass
vendored + lock / update --update-reuse / --update-eager (drop patch, re-scan restores), add six on 2.29.2 (kept)	pass
pdm add <other> after hosted or vendored on 2.12.4 / 2.15.4 / 2.20.1: patched hash kept, source dropped → uninstallable lock (known from #331). Hosted re-scan repairs, and rollback is clean. Vendored rollback fails closed (drift); the pdm lock → re-scan → rollback remedy works	pass (by design)
agent with pdm use <external venv> on 1.15.5 / 2.0.3	fail #502
hosted PEP 582 __pypackages__ stale warning + vex, 2.29.2 / 2.12.4	fail #528
-g on PR #522: PDM global-project venv / out-of-tree venv / managed interpreter	pass on #522, fail on main (#451)
same release in two global envs (system + pipx venv): only the first patched	fail, covered by #501 (generic)

Ruled out / not filed

• The --prod --clean leftover reproduces without socket-patch.
• The 2.12–2.20 pdm add uninstallable lock is PDM's reuse behaviour, already handled (Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 fix plus the pypi_pdm_source_already_exists refusal).
• The hosted stale warning text mentions "Poetry before 1.4" on a PDM project. Cosmetic, not filed.

Housekeeping

• No probe branches (the stale bughunt/pdm/20260930-cache-symlink still exists; deletion through the git proxy fails). macOS and Windows weren't covered.

Next

1. In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528 on PDM 1.4.5 / 1.15.5 (PEP 582 default; hosted refused on 3.1, so only lock_version 2 / 4.x) and agent -g with PEP 582.
2. Once Fix global Python scan missing uv and PDM installs (#449, #451) #522 merges: re-run the -g matrix on main, plus PDM 1.x / 2.0.3 global projects.
3. Hash variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 (private index serving different bytes); rollback --preserve-state on PDM.
4. CRLF / BOM pdm.lock on hosted + vendored with 2.12 / 2.29; concurrent scan runs (--lock-timeout).
5. macOS / Windows probes once probe-branch deletion works.