Support vlt in hosted, vendored and agent modes - #269
Open
Mikola Lysenko (mikolalysenko) wants to merge 47 commits into
Open
Mikola Lysenko (mikolalysenko) wants to merge 47 commits into
Mikola Lysenko (mikolalysenko) wants to merge 47 commits into
Conversation
Resolve inherited dependency aliases through their workspace definitions and match local lockfile owners by both package name and version. This allows valid workspace patches while refusing consumers outside the editable project. Read quoted dependency values and annotated registry tables consistently so repeated application cannot leave an alias unpatched or create an invalid duplicate TOML table. Validated with 70 Cargo redirect unit tests and real service-backed hosted, vendored service, and vendored build installs using fresh Cargo caches, locked offline builds, integrity rejection, and revert. Assisted-by: Codex:gpt-6-astra
Validate planned dependency pins against parsed TOML before writing any files. Legal root and target dotted or inline declarations that the source-preserving editor cannot rewrite now refuse the entire patch instead of leaving a mixture of original and patched sources. Validate unchanged member manifests too, while preserving workspace inheritance and declarations for other package versions. Malformed TOML is refused without changing the project. Validated with 73 Cargo unit tests and the real converter/API/CLI matrix, including an actual Cargo build proving the dotted manifest is valid and remains byte-identical after refusal. Assisted-by: Codex:gpt-6-astra
Combine identical refusal branches for dotted dependencies without changing which declarations are refused. Full workspace Clippy and all 73 Cargo redirect tests pass. Assisted-by: Codex:gpt-6-astra
A redirect ledger written by a newer socket-patch (for example a vlt lock edit) could be half-reverted: rollback dropped the npm record and left the lockfile it did not understand still pointing at the hosted artifact, with nothing tracking it. Now an unknown hosted edit kind holds every record in the ledger, and rollback of one package, remove and the hosted-to-vendored takeover refuse with nothing written when that edit names the package. repair skips vendored npm entries whose flavor it does not know instead of judging or rebuilding them with the wrong layout rules. The contract and changelog say vlt ledgers need the release that adds vlt support. Assisted-by: Claude Code:claude-opus-5-5
The end-of-run hosted-to-vendored reconcile in `vendor` and `scan --mode vendored` could still drop a redirect record together with a ledger edit this release does not understand (for example a vlt-lock.json edit), leaving that lockfile on the hosted URL with nothing tracking it while reporting the migration as reconciled. It now leaves such a package in the ledger and prints the manual cleanup advisory instead. An unknown edit now only blocks the package it actually names, so an edit for left-pad or @scope/pad no longer refuses a rollback of pad. Whole-ledger rollbacks that hit an unknown edit now say to upgrade socket-patch rather than suggesting a rescan that cannot help. The changelog and contract now say that such a rollback still unwinds the lockfiles this release understands while keeping every record. Assisted-by: Claude Code:claude-opus-5-5
repair and the vendored health check decide whether an npm flavor is known from a hand-kept list that the revert dispatch did not share, so a release adding a flavor could revert its entries yet still skip them in repair as unknown. The known set, the revert routing and the in-use probe now all come from a single string-to-flavor mapping with exhaustive matches. Assisted-by: Claude Code:claude-opus-5-5
Lays the groundwork for vlt support without changing any behavior yet. socket-patch can now decode vlt's package ids in both lockfile encodings (vlt up to 1.0.0-rc.14 and every later release), recognize vlt's default registry the way vlt does, read vlt-lock.json strictly (a BOM, a non-object or an unknown lockfileVersion is refused, never parsed around), and read and write its one-entry-per-line node and edge lines without re-serializing the file. It also reproduces vlt's own lockfile ordering, pinned by a golden generated with Node's collator, so later vendored edits leave a lock that vlt ci keeps byte-identical. Fixture directories that hold tables rather than projects are kept out of the VEX golden corpus. Assisted-by: Claude Code:claude-opus-5-5
vlt lock ids now give a package identity to every name npm still accepts for existing packages, the same rule depscan uses. Scoped names whose scope or name starts with "." or "_" (such as the published @_koii/web3.js) and names over 214 characters were refused before, so hosted redirects, VEX and vendored-copy checks would have missed them while depscan patched them. Names npm blocks (node_modules, favicon.ico) and versions too large for npm to publish no longer get an identity. A refused lockfileVersion is now reported exactly as it is written in the lockfile (1e0 rather than 1.0), and tests now pin the default-registry scheme check and the fixture-corpus skip of the vlt tables. Assisted-by: Claude Code:claude-opus-5-5
socket-patch now recognizes a project installed by vlt (the node_modules/.vlt store or node_modules/.vlt-lock.json) ahead of any sibling bun, pnpm, yarn or npm marker, and apply prints a vlt layout note in human mode. scan, get, apply, rollback and vex now find every package in vlt's store in every DepID era: transitive-only packages, aliases, git, remote and file: entries, and workspace members whose node_modules hold only links. apply and rollback reach every store copy of a patched package, including vlt's peer and modifier variants, and each write replaces the file instead of writing through it, so vlt's machine-wide store stays untouched. The store-copy failure note now reads "store copy <path> failed to patch" for pnpm and vlt alike. In a vlt project, --update suggests vlt install @socketsecurity/socket-patch@latest, and in vlx's cache it suggests re-running vlx with @latest. The crawler tests stage real layouts captured from vlt 0.0.0-32, 1.0.0-rc.14, 1.0.10, 1.2.0 and a 1.0.0-rc.22 workspace. Assisted-by: Claude Code:claude-opus-5-5
When a git, remote or file: dependency in a vlt (or pnpm) store depended on a patched package, apply and rollback treated that dependency link as a second installed copy: the run reported an extra "already patched" or "already original" result, and get, vex, vendor and repair could pick the link as the package's location. An importer link into a git or tarball entry was also listed twice. The resolver now follows the store-entry rule the scan already uses: inside a store entry only real directories are copies, and a store copy an importer link already points at keeps the importer path. A node_modules/.vlt that is a link is never followed, and tests now pin the hoist-dir skip and the policy that a same-version git copy is patched as its own copy. Doc comments broken in the previous commit are rewrapped. Assisted-by: Claude Code:claude-opus-5-5
The hosted rewriter now understands vlt-lock.json. For each patched package it points every default-registry node at the Socket-hosted tarball by splicing only the integrity and URL slots, so the DepID, the flags, the trailing slots, the edges and the options stay byte-identical and vlt ci keeps the lock as written. It reads every vlt lock era (no lockfileVersion, 0 with the legacy ids, 1), refuses a lock vlt itself could not read (BOM, unknown version, non-canonical layout), skips named-alias, scoped and jsr registry copies with a warning, and warns when an old vlt would ignore the lock. Rollback, remove and the vendored takeover now revert these edits, including ledgers the depscan PR flow writes: the registry slots go back on the node even after vlt re-laid the line, and a node vlt has re-locked away counts as already reverted. The scan and get commands start reading vlt-lock.json in a later change; until then this is reachable through the shared golden fixtures and the revert paths. Assisted-by: Claude Code:claude-opus-5-5
Rolling back a vlt hosted redirect no longer refuses when vlt re-locked one peer or modifier variant away while an earlier instance of the same package still carries the pin. Every surviving instance is restored first, and only then is a vanished one checked for a leftover hosted URL, so rollback, remove and the vendored takeover succeed whatever order the ledger holds. The "vlt ignores this old lockfile" advisory now fires only for the empty or registry-URL segments the spec names, so v0 locks that use a named registry alias no longer get a spurious warning (and a withheld VEX attestation). A bun.lockb on disk now counts as a sibling lock when deciding whether vlt drives the install, without passing its bytes as text. New tests pin the slot-level revert through both revert entry points, the install-state sentinel on its own, both advisory alias cases and a CRLF copy of every captured vlt lock. Assisted-by: Claude Code:claude-opus-5-5
`scan --mode hosted` and `get --mode hosted` now repoint vlt-lock.json at Socket's hosted patches: every default-registry node of a patched package keeps its DepID and gets the patched sha512 and hosted URL, and vlt drives confirmation when its install state is present or no other npm-family lock is. Before anything is written, each artifact is fetched the way vlt fetches it. A response vlt would reject (re-gzipped, wrong sha512, HTTP error, unreachable) withholds the package instead of pinning a lock `vlt ci` cannot install. vlt never refreshes an installed copy, so after the rewrite socket-patch removes stale store entries and the hidden lock, and rollback and remove do the same once the registry pins are back. --no-vlt-install-cleanup (SOCKET_NO_VLT_INSTALL_CLEANUP) keeps them; the redirect_vlt_reinstall_required advisory says what to run. A same-run --vex no longer attests a vlt package whose installed copy is stale or unchecked, whose lock an older vlt may ignore, or which also resolves from another registry. Assisted-by: Claude Code:claude-opus-5-5
A vendored vlt package taken over by `scan --mode hosted` is now fetched and verified before its vendored state is reverted, dry runs included. An artifact vlt would reject keeps the package vendored instead of leaving a lock pinned to bytes nobody checked. A same-run --vex attests a vlt package only when the heal checked its installed copy; a pin on a host socket-patch does not own is left to a later `socket-patch vex`. When vlt-lock.json is withheld beside another lockfile, its old pin no longer confirms the package, and the warning says only vlt-lock.json was left unchanged. The heal keeps every store entry when node_modules/.vlt-lock.json cannot be removed, so vlt never trusts a hidden lock with dangling links, and packages that bundle dependencies are no longer re-invalidated on every run. Assisted-by: Claude Code:claude-opus-5-5
`socket-patch vendor` now wires projects that install with vlt. A vlt-lock.json (lockfileVersion 0 or 1) routes npm vendoring to a new vlt backend ahead of every other lockfile, and a package already vendored through another lockfile refuses with vendor_flavor_changed. A direct dependency of the root or a workspace member is committed as the patched package directory under .socket/vendor/npm/<uuid>/<name>-<version>/node_modules/<name>/, so packages that require their own name keep resolving. Its devDependencies are dropped from the vendored package.json, and the uuid dir's .gitignore and .gitattributes keep the payload committable and byte-exact on every checkout. The lock node, its importer edges and the importers' package.json specs move to the file: path, placed where vlt itself writes them, so `vlt ci` leaves the lock unchanged; this is checked against locks real vlt 1.2.0, 1.0.10 and 1.0.0-rc.14 wrote. Transitive targets, peer or modifier variants, foreign registries, peer edges, multi-field declarations, stale specs, unreadable locks and git-ignored payloads refuse before any write. `vendor --revert` restores the registry node, edges and specs while keeping whatever vlt re-laid since, or leaves everything on drift. Health checks, reuse and repair judge the directory with its package.json exemption, and lock inventory reads vlt-lock.json. Assisted-by: Claude Code:claude-opus-5-5
`vendor --revert` on a vlt project no longer writes a lock with duplicate keys when `vlt install` has since added a registry copy of the vendored package beside it: the vendored entries fold into the matching registry ones, and a mismatching copy is reported as drift with nothing written and the artifact kept. Re-vendoring a new patch over a dir whose ledger entry lost its pre-vendor wiring now refuses with vendor_wiring_unknown and says how to recover, instead of recording wiring that could never be reverted. A rebuild of the committed package dir replaces the whole version-level directory, so stray files beside the package no longer cause an endless corrupt-then-rebuild loop, and it keeps vlt's dependency links (or says to run `vlt install` when they had to be discarded). Prebuilt service trees are pruned of node_modules and bundling packages refuse, as the local build already did. The git-ignore probe now parses rule sources that contain a colon, such as Windows drive-letter paths. New tests pin every revert inverse's already-reverted branch, the importer allowlist, dry-run revert, the rebuild branch, the reuse-time .gitignore restore, the gitignored refusal, both bundleDependencies refusals, the service layout fallback, local dir artifact staging and the FIFO-safe vlt-lock.json inventory. Assisted-by: Claude Code:claude-opus-5-5
`socket-patch vex` and every embedded `--vex` now read vlt-lock.json: a Socket-hosted registry node (patch URL plus sha512, any DepID era) and a vendored vlt package directory become attestation inputs, so a vlt project attests its patches without .socket/manifest.json or the ledgers, and a redirect or vendor ledger stays live only while the vlt lock still wires it. A lock vlt cannot read (BOM, unknown version) wires nothing. Hosted npm packages are now judged by every store variant of their installed copies (pnpm and vlt peer, modifier and registry-alias instances), and a vlt package that another registry also resolves at the same version no longer attests before install. Vendored vlt directories verify with the package.json exemption, including the out-of-sync check of the installed link, and setup.manual accepts `vlt`. Assisted-by: Claude Code:claude-opus-5-5
A hosted vlt-lock.json node now attests only when its patch URL's embedded package name and version (scope included) match the node, so a lock pointing one package at another package's patch URL is no longer read as patched. A Socket-shaped node that fails these checks counts against its siblings of the same version: a hosted pin next to it no longer attests before install, and a vendored directory next to it is not attested. A vendored vlt directory checked without its vendor ledger now verifies a package.json with devDependencies stripped against the patched blob in .socket/blobs. When that blob is missing, the package is left out with the new reason vendor_manifest_unverifiable instead of a misleading hash mismatch. The warnings for an unreadable vlt-lock.json and for an unattributable vendored node now describe the actual cause and a fix that works. Assisted-by: Claude Code:claude-opus-5-5
vendor, scan --mode vendored and get --mode vendored now refuse every vlt project the vlt backend would refuse (lock version or layout, transitive, peer or foreign-registry targets, multi-field or out-of-sync declarations, a flavor switch, bundled or duplicate devDependencies, a git rule ignoring .socket/) before any patch is downloaded, anything is written, or a live hosted redirect is reverted for a takeover; dry runs preview the same codes. A fresh clone re-vendors from the committed vlt directory artifact, verified against the ledger inventory, and vlt's own link to that directory is never used as a pristine source. A hosted to vendored takeover removes the store copies vlt installed from the hosted pin. repair finds, rebuilds and reconstructs vlt directory artifacts and restores their .gitignore and .gitattributes; the human output names the vlt files to commit and `vlt install`. rollback now fetches a before-blob that only a pnpm or vlt store peer variant still needs instead of failing that copy. Assisted-by: Claude Code:claude-opus-5-5
A root .gitignore rule like `*.json` no longer makes vendored vlt refuse `vendor_artifact_gitignored`: the preflight now asks git only about the uuid directory, so it refuses just the rules (such as `.socket/`) that the directory's own .gitignore cannot override. Re-vendoring under a newer patch with nothing installed no longer builds the new artifact from the old patch's committed artifact, for every npm lockfile flavor. It fetches the pristine package instead, and `--offline` skips it with the reason. When vlt's link to the committed directory is the only installed copy, vendor now names it instead of claiming nothing is installed. A lost ledger entry fails `vendor_ledger_entry_missing` and points at `socket-patch repair`. A hosted to vendored takeover whose vendoring then fails still removes the store copies vlt installed from the hosted pin, and prints the reinstall advisory. Before, the redirect record was gone and nothing could find those copies again. The rollback before-blob fix is filed under Fixed, with a pnpm store peer-variant test beside the vlt one. New tests cover the get uuid-path refusal line, vlt references that only the lock or a workspace package.json carries, and restoring vlt wiring files after a failed repair post-verify. Assisted-by: Claude Code:claude-opus-5-5
`socket-patch setup` now recognizes a vlt project (vlt-lock.json, vlt.json, node_modules/.vlt-lock.json or a node_modules/.vlt directory in the project root, ahead of any pnpm marker) and writes npm's npx hook into its package.json. A vlt workspace, declared in vlt.json or the legacy vlt-workspaces.json, is wired at the root only, because vlt runs the root hook once per install. `setup --json` and the setup telemetry report the package manager as "vlt". vlt releases before 1.0.0-rc.13 never run a root postinstall, so setup now warns `vlt_root_scripts_not_run`: definitely when the vlt on PATH reports such a version (checked with telemetry off and a 5 second limit), and as a "may" when no usable vlt is found and vlt-lock.json has lockfileVersion 0 or none. The hook is still written. The setup-matrix gains vlt single-project and workspace cases, and the npm test image moves to Node 22 with vlt 1.2.0 installed. Assisted-by: Claude Code:claude-opus-5-5
`setup` now also warns `vlt_root_scripts_not_run` as a "may" when the vlt on PATH is recent but the committed vlt-lock.json is one it would never write: a lock without lockfileVersion, or a v0 lock beside vlt 1.0.0-rc.15 or later (which refuses v0, so an older vlt elsewhere installs the project). vlt rc.13 and rc.14 write v0 locks themselves and stay silent. `setup --remove` now also clears the hooks that earlier socket-patch releases wrote into vlt workspace members, so a removal that reports success no longer leaves member hooks running (and keeping npm counted as set up for VEX). Excluded and clean members are still left alone. The static check that the setup matrix routes vlt through the npm round trip now runs in the default test suite instead of only with the setup-e2e feature. Assisted-by: Claude Code:claude-opus-5-5
The hosted warm-tree heal removed stale store entries of optional dependencies too. vlt does not put a removed optional dependency back on `vlt install` unless the same install also reinstalls a non-optional package, so the dependency could silently vanish and its node_modules link dangle (measured on vlt 0.0.0-32 through 1.2.0). scan/get, rollback/remove and the vendored takeover now leave every optional copy (lock flags 1 or 3, or unreadable flags) in place. Such a copy stays out of the run's in-run VEX, and the redirect_vlt_reinstall_required advisory tells the user to run `vlt ci` (or delete node_modules and run `vlt install`), noting that vlt before 1.0.5 installs no optional dependency from the lock of a project that declares only optional dependencies. Assisted-by: Claude Code:claude-opus-5-5
When a heal both removed stale vlt copies and kept an optional one, the redirect_vlt_reinstall_required advisory reported only the optional copy, so it no longer said node_modules was incomplete or that `vlt update` drops the redirects. With cleanup skipped, it counted the optional copies among those a re-run would refresh, which it never does. Every advisory now reports removed, skipped and unchecked copies as before and adds how many optional copies were kept and that `vlt ci` refreshes them. It also warns that on vlt before 1.0.5, in a project whose dependencies are all optional, `vlt ci` would drop the installed copy, so users should upgrade vlt first. Assisted-by: Claude Code:claude-opus-5-5
vlt users get hosted, vendored and agent-mode patches that are checked against the real vlt releases they run, not only against hand-written lockfiles. Five new capstone suites install projects with the vlt under test and let vlt itself install what socket-patch wrote: fresh-checkout `vlt ci`, frozen and ordinary installs, tamper and warm-cache cases, rollback and heal, optional dependencies, registry shapes, takeovers between modes, the Linux hardlinked global store, the setup hook and the npm launcher. Two production legs prove the flow against the live patch service (the hosted one refuses cleanly while the server still re-encodes artifacts). Every leg reports whether it ran or why it skipped, and scripts/check-vlt-legs.py fails a run that skipped something it should have run, so a CI row can no longer pass without testing anything. The expected skips come from the release table in docs/testing/vlt-compatibility.md, which records the vlt behavior boundaries measured on every supported release. Assisted-by: Claude Code:claude-opus-5-5
The Windows npx shim passed the package name through to socket-patch, so every setup-hook leg on Windows would have aborted vlt's install. It now forwards only the arguments after the package, and a harness self-test runs the shim. The capstones now also prove what they claimed but skipped: the optional-only hosted to vendored takeover runs on every vlt release that writes a lock, the vendored VEX of a package.json patch without the vendor ledger fails closed without the patched blob and attests with it, vendored to hosted takes over through both scan and get, the heal and rollback legs check that no other store entry changed, and the hook-failure leg pins exit 1. Two new vendored legs use the real peer-bearing use-sync-external-store and record where vendored mode still refuses it, so fixing that refusal flips a visible expectation. check-vlt-legs.py reads Windows cargo output and fails a run whose test binary crashed before printing its result line. Assisted-by: Claude Code:claude-opus-5-5
Pull requests now run the real-vlt capstones on 35 release and OS cells, each checked against the leg manifest, and the required hosted-e2e job proves vlt hosted and vendored installs against production. A new advisory workflow runs every capstone on every vlt era of Linux, macOS and Windows, backtests the production service per release, mode and project shape, compares the locks each OS writes, and nightly tries vlt@latest, watches for new vlt releases and checks that the published socket-patch never half-reverts a vlt ledger. A watchdog probes the public patch artifact every six hours the way vlt fetches it, so re-encoded artifacts are caught early. vlt releases are installed from a sha512-checked npm pack, and the docs now cover vlt in every mode: eras, the hosted heal, vendored package directories, setup and the known vlt limitations. Every vlt error code is documented in the CLI contract and mapped to the tests that assert it. Assisted-by: Claude Code:claude-opus-5-5
The vlt compatibility backtest no longer fails every hosted cell on 0.0.0-16 and 0.0.0-32 while the service re-encodes the artifact: a blocked cell now owes only its refusal code, since the withheld dependency never reaches a rewriter. The tampered-lock check accepts vlt 0.0.0-16's optional-skip failure the way the depscan capture does, so those cells pass once the serve fix ships. Vendored cells now also prove the user's existing tree: a plain `vlt install` and then `vlt ci` must land the vendored bytes. From 0.0.0-30 vlt keeps an installed optional dependency on a plain install; that is pinned in the boundary table and documented, and `vlt ci` must still link the patch. The production e2e retries in CI now actually retry, a narrowed compatibility dispatch no longer fails its lock diff, and the README and vlt notes say vendored mode needs a 0.0.0-19 or later lock. Assisted-by: Claude Code:claude-opus-5-5
From vlt 1.0.8 a root dependency with resolved peers, and from rc.15 a workspace member's, gets a peer extra on its lock node even with a single peer context, so vendored mode refused them. Such a node is now vendored as a file node without the extra, exactly as vlt writes file: dependencies, with its peer edges moved along; revert restores the original node. Several instances or modifier variants still refuse. Vendoring an optional dependency now prints vendor_vlt_reinstall_required: from vlt 0.0.0-30 a plain vlt install keeps the old installed copy, so users are told to run vlt ci. The same advisory names any dependency whose link still points at vlt's store. Era-A locks with scalar-registry ids now warn vendor_vlt_legacy_lockfile, and the takeover advisory no longer calls kept registry copies hosted artifacts. The byte-stability fixtures now come from real vlt 1.2.0, 1.0.10, 1.0.4, rc.32 and rc.14, checked through vlt ci, warm and cold frozen installs and vlt install <new>, and the vendored capstone gains legs for a single peer context and an optional dependency on a warm tree. Assisted-by: Claude Code:claude-opus-5-5
Reverting a vendored optional vlt dependency left node_modules linked to the removed vendored directory, and from vlt 0.0.0-30 a plain vlt install keeps that dangling link, so the dependency silently vanished. vendor --revert, and the revert a vendored-to-hosted takeover runs, now print vendor_vlt_reinstall_required telling users to run vlt ci; a revert whose importer links still point into the vendored directory says to reinstall too. A vendoring run whose patch fails to apply no longer prints the advisory, since nothing was vendored. The fixture oracle now requires vlt install <new> to keep the vendored node's edges byte-identical on every release except rc.14, and new tests cover the advisory on dry runs, workspace members and both takeover directions. Assisted-by: Claude Code:claude-opus-5-5
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
|
|
||
| fn read(p: &Path) -> String { | ||
| std::fs::read_to_string(p).unwrap_or_else(|e| panic!("{}: {e}", p.display())) |
| } | ||
|
|
||
| pub fn read(root: &Path, rel: &str) -> String { | ||
| std::fs::read_to_string(root.join(rel)).unwrap_or_else(|e| panic!("read {rel}: {e}")) |
The first CI run of the vlt suites failed on four real causes: - vlt finishes work in detached children after a command returns (the 1.2.0 global-store explode on Linux, cache unzip, deletion of .VLT.DELETE staging dirs). Legs raced them: the Linux 1.2.0 heal legs saw store entries appear, the Windows hook-abort leg saw a staging dir mid-delete, and the Windows hardlink leg reinstalled before the store was complete. Every harness vlt run now preloads a hook that waits for those children where vlt would exit. - git refuses the \\?\ verbatim leg root on Windows, so the vendored clone legs clone with root-relative paths; the Windows junction unit test passed a '/' path to mklink, which reads it as a switch. - vlt's engines field is not the Node it runs on: 0.0.0-11 ... -30 need 22.7.0 (ESM without "type": "module") and 0.0.0-31 ... rc.18 need 22.13.0 (node:sqlite). install-vlt.sh enforces the measured floors before running vlt and the Node-floor rows test them; those rows no longer install the 1.2.0 upgrade vlt, which cannot run there. - rc.8's scalar-registry vendored arm now configures the local registry, and pins that rc.7 ... rc.29 re-resolve such a lock on vlt ci instead of asserting a byte-stable lock. Assisted-by: Claude Code:claude-opus-5-5
| ); | ||
| continue; | ||
| } | ||
| assert_eq!(payload.get(&file), Some(&after), "{r}/{file}"); |
The vlt and bun backtests rerun a cell from a clean tree when the patch service's transport fails, but only recognized a request error. A 5xx from the production patch API (504 gateway timeouts, 503 upstream resets) is the same external failure, and it failed three native backtest jobs in the last two CI runs. Both harnesses now retry it too; a 4xx still fails the cell at once, and a 5xx that persists still fails after three attempts. Assisted-by: Claude Code:claude-opus-5-5
Vendoring a package with a few thousand files inside a git work tree (date-fns@2.30.0 has 5722) hung forever. The gitignore probe wrote the whole path list to `git check-ignore -v` before reading its answers, and git answers every path, so once its output pipe filled neither side could move. The probe now reads git's output while it writes the paths, and its 30 second limit covers the whole exchange. Assisted-by: Claude Code:claude-opus-5-5
Two ledger states left a hosted vlt pin that rollback and remove refused forever, and the refusal's advice (re-run the scan) could not fix either one: - From vlt 1.0.8 a dependency with resolved peers is keyed by its peer context, so bumping its peer (`vlt install react@18.3.1`) re-keys the pinned node and carries the hosted pin to the new id. Rollback now restores the registry pin on every default-registry node of the same package that holds exactly the recorded pin, and heals the patched copy installed under the new id. A rescan that pins such a node again merges into the old ledger edit and keeps its registry entry instead of recording the Socket pin as the original. - The server's hosted PRs append one ledger edit per PR, and a later CLI rescan merged into the oldest one, leaving the newer link stale. The rescan now folds the whole chain into one edit. A real-vlt leg pins a peer-keyed package, bumps its peer, rescans and rolls back on 1.0.8 and later. Assisted-by: Claude Code:claude-opus-5-5
A vlt project could install the same package twice: from the registry
and from a git, remote-tarball or local-directory dependency (an lp2
alias pointing at left-pad's tarball URL, say). Only the registry copy
is patched, yet hosted and vendored runs reported the package as
patched, and `vex` attested it as not affected while `require('lp2')`
still loaded the unpatched code.
- `vex` no longer attests a vlt package from its lock pin or vendored
directory when such a node of the same name exists, since vlt records
no version for it. A remote tarball whose `<name>-<version>.tgz` leaf
names another version does not count.
- Hosted mode still pins the registry copy but warns
`redirect_vlt_custom_registry_skipped` and keeps the package out of
the run's `--vex`.
- Vendored mode refuses the package, as it already refuses a copy from
another registry.
Assisted-by: Claude Code:claude-opus-5-5
Vendoring a new patch over an installed, already vendored vlt package removes the old patch's directory, but node_modules still linked into it, so `require()` failed until the next `vlt install`. The run reported success with no advisory. It now emits `vendor_vlt_reinstall_required` naming the links into the replaced directory and asking for `vlt install` (or `vlt ci`). Assisted-by: Claude Code:claude-opus-5-5
`repair` moved a corrupt vlt payload aside, rebuilt it, then deleted
the old copy, and vlt's links to the package's own dependencies went
with it: `require('debug')` failed with "Cannot find module 'ms'" while
repair reported success with no warning. Repair now moves those links
back into the rebuilt payload when they are only links.
When a rebuild cannot keep them (the old `node_modules/` held planted
files), vendor and repair emit `vendor_vlt_reinstall_required` asking
for `vlt ci`. The old hint said `vlt install`, which does not re-link
them on any tested vlt release.
The contract and coverage map also document the advisory for links
into the directory a re-vendor replaces.
Assisted-by: Claude Code:claude-opus-5-5
After `.socket/vendor/state.json` is lost in a vendored vlt project, repair restores the entry without a file fingerprint and told the user to run `socket-patch vendor` to record one. That run always refused: the rewired lock no longer holds a registry resolution and the only installed copy is the vendored dir. For vlt entries the advice now reads: restore the registry version spec in package.json, run `vlt install`, then run `socket-patch vendor`, which re-vendors the package and records the fingerprint (checked with vlt 1.2.0). Assisted-by: Claude Code:claude-opus-5-5
When a vendored vlt patch changes package.json dependencies, `vendor_dep_manifest_stale` said `vlt install` would re-resolve them. It never does: vlt installs the vendored node's recorded edges, so a dependency the patch adds stayed uninstalled through `vlt install` and `vlt ci`. The advisory now names `vlt update`, the command that re-resolves them, and says it resolves the whole project. After such an update, `vendor --revert` left the edges vlt had added from the vendored node in the lock, pointing from a node that no longer existed. Revert now drops them, along with nodes only those edges kept, so the reverted lock matches the pre-vendor one and stays byte-stable through `vlt ci` (checked with vlt 1.2.0). Assisted-by: Claude Code:claude-opus-5-5
vlt builds a registry copy in the untracked `node_modules/.vlt` store but a `file:` dependency in place. After vendoring a package with an install script (esbuild's postinstall, a node-gyp addon) the `vlt build` that vlt asks for rewrote the committed payload: esbuild's 9 KB JS shim became a 9.7 MB Mach-O binary staged for commit, every later `vendor` failed on the inventory, and `repair` restored the shim only until the next build. Vendored mode now refuses a package that declares a `preinstall`, `install`, `postinstall` or `prepare` script or ships a `binding.gyp` (`vendor_vlt_build_scripts_unsupported`, remedy `--mode hosted`), in the preflight and on every build of the payload. Assisted-by: Claude Code:claude-opus-5-5
Standalone `socket-patch vex` attested a hosted vlt pin from the lock alone even when some vlt release ignores that lock and installs the registry package instead: a lock with no lockfileVersion (vlt >= rc.15 re-resolves it), a pre-v1 legacy-id lock without vlt.json "modifiers", or a scalar registry the lock cannot use. In-run `scan --vex` already withheld those deps, so the two disagreed. Discovery now runs the hosted rewriter's own lock-level conditions (one shared predicate, reading vlt.json for "modifiers"). In such a lock every hosted reference keeps no lock pin, so only an installed tree whose copies verify attests it, and one patched_ref_unattributable warning names the packages and why. Assisted-by: Claude Code:claude-opus-5-5
The vendor_vlt_legacy_lockfile warning told every era-A vlt user that a vendored lock cannot be deleted and re-created, but only vlt 0.0.0-31 through 1.0.0-rc.5 fail that way; 0.0.0-19 through 0.0.0-30 and rc.6 through rc.8 reinstall the vendored directory fine. The optional dependency advisories likewise blamed every release before 1.0.5, although vlt 0.0.0-23 and older install such a project from its lock. The warning, the advisories, CLI_CONTRACT.md, docs/ecosystems.md and the changelog now name the measured windows (0.0.0-31 ... 1.0.0-rc.5 and 0.0.0-30 ... 1.0.4), matching the compatibility boundary table. Assisted-by: Claude Code:claude-opus-5-5
CLI_CONTRACT.md said a dep refused by the vlt rewriter is refused for every lock only while vlt drives, and elsewhere that all four per-dep vlt codes leave a dep unconfirmed whichever lock drives. Neither matched the code: a dep the rewriter refuses (missing sha512, unsupported lock key) is never confirmed, even when package-lock.json already carries its hosted URL, while a dep vlt-lock.json merely lacks (entry not found or vendored) is confirmed by a sibling lock when vlt does not drive. Both passages now state that rule, and two in-process tests pin it. Assisted-by: Claude Code:claude-opus-5-5
On vlt rc.7 and rc.8, the vendored era-A scalar-registry leg skipped the frozen-install half of its fresh-checkout check and hard-asserted that vlt ci re-keys the bystander package from public npm, a vlt quirk unrelated to socket-patch that was measured on rc.8 only. The leg now asserts that the vendored node and payload survive vlt ci, then clears node_modules and requires a frozen install to land the patch again without changing the lock vlt ci wrote. The bystander re-key is only logged. Measured on rc.7 and rc.8 (both re-key it to a `··` id); the boundary table row says so. Assisted-by: Claude Code:claude-opus-5-5
The test harness hook that waits for vlt's detached children dropped a child silently after 120 s, so a leg that then saw a half-finished tree failed with no hint of why. The hook now writes a `vlt-settle:` line to stderr naming the child it stopped waiting for. The cap can be set with SOCKET_PATCH_VLT_SETTLE_CAP_MS, which a new test uses to check the line and that a quick child is still awaited silently. Assisted-by: Claude Code:claude-opus-5-5
| let lock = read_lock(&fx.proj); | ||
| assert!( | ||
| vendored_file_node(&lock, t).is_some(), | ||
| "a file node for {r}: {lock:#}" |
The capture VEX test still expected every hosted pin of every captured lock to be attested, but discovery now withholds the pins of a lock some vlt release discards (the 0.0.0-1 and 0.0.0-16 captures have no lockfileVersion). It now copies each capture's vlt.json beside the lock and expects those locks to keep their refs unpinned with one patched_ref_unattributable warning. Assisted-by: Claude Code:claude-opus-5-5
Mikola Lysenko (mikolalysenko)
marked this pull request as ready for review
September 26, 2026 22:45
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: Unguarded vlt lockfile read
- Replaced bare tokio::fs reads with guarded read_regular_to_string and read_regular_to_bytes from utils::fs to prevent FIFO/device hangs.
Or push these changes by commenting:
@cursor push 34d9bcf6a3
Preview (34d9bcf6a3)
diff --git a/crates/socket-patch-cli/src/commands/repair_vendor.rs b/crates/socket-patch-cli/src/commands/repair_vendor.rs
--- a/crates/socket-patch-cli/src/commands/repair_vendor.rs
+++ b/crates/socket-patch-cli/src/commands/repair_vendor.rs
@@ -56,7 +56,7 @@
use socket_patch_core::crawlers::CrawlerOptions;
use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
use socket_patch_core::patch::copy_tree::remove_tree;
-use socket_patch_core::utils::fs::read_regular_to_string;
+use socket_patch_core::utils::fs::{read_regular_to_bytes, read_regular_to_string};
use socket_patch_core::utils::purl::{
normalize_purl, percent_decode_purl_component, strip_purl_qualifiers,
};
@@ -1546,7 +1546,7 @@
names.extend(vendor::vlt_lock::vlt_importer_package_jsons(&common.cwd).await);
for name in names {
let p = common.cwd.join(name);
- if let Ok(bytes) = tokio::fs::read(&p).await {
+ if let Ok(bytes) = read_regular_to_bytes(&p).await {
snap.push((p, Some(bytes)));
}
}
diff --git a/crates/socket-patch-cli/src/commands/rollback.rs b/crates/socket-patch-cli/src/commands/rollback.rs
--- a/crates/socket-patch-cli/src/commands/rollback.rs
+++ b/crates/socket-patch-cli/src/commands/rollback.rs
@@ -15,6 +15,7 @@
VerifyRollbackResult, VerifyRollbackStatus,
};
use socket_patch_core::telemetry::{track_patch_rollback_failed, track_patch_rolled_back};
+use socket_patch_core::utils::fs::read_regular_to_string;
use socket_patch_core::utils::purl::{patch_matches, strip_purl_qualifiers};
use socket_patch_core::vendor::{save_state, RevertOpts, VendorState, VendorWarning};
use std::collections::{HashMap, HashSet};
@@ -1054,8 +1055,8 @@
} else {
purls.to_vec()
};
- let vlt_lock = tokio::fs::read_to_string(
- common
+ let vlt_lock = read_regular_to_string(
+ &common
.cwd
.join(socket_patch_core::constants::npm_family::VLT_LOCK),
)You can send follow-ups to the cloud agent here.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit ff2ceb8. Configure here.
| .join(socket_patch_core::constants::npm_family::VLT_LOCK), | ||
| ) | ||
| .await | ||
| .ok(); |
There was a problem hiding this comment.
Unguarded vlt lockfile read
High Severity
Hosted rollback now reads project vlt-lock.json with bare tokio::fs::read_to_string before any revert. A FIFO or device at that path blocks the process indefinitely, so rollback/remove of hosted vlt pins never start. The same unguarded tokio::fs::read is used when repair snapshots vlt-lock.json and workspace package.json files.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit ff2ceb8. Configure here.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
LLM Description written by Claude Code:claude-opus-5-5
What this does
socket-patch now supports the vlt package manager (
vlt-lock.json,vlt.json) in every mode and command. vlt purls staypkg:npm/….Hosted (
scan --mode hosted,get --mode hosted)optionsandvlt.jsonare left untouched, and the lock is spliced line by line.lockfileVersionabsent (≤0.0.0-18),0(both the··and·npm·default-registry forms) and1(rc.15+).node_modulesis healed automatically: the hidden lock and stale.vlt/<DepID>copies are removed so the nextvlt installfetches patched bytes.--no-vlt-install-cleanup/SOCKET_NO_VLT_INSTALL_CLEANUP.redirect_vlt_artifact_unverifiable) fetches each artifact the way vlt does. See "Production blocker" below.redirect_vlt_lock_node.Vendored (
vendor,scan --mode vendored,get --mode vendored).socket/vendor/npm/<uuid>/<name>-<version>/node_modules/<name>/.file:tarball deps break when reinstalled from a lock. Thenode_modules/<name>leaf keeps self-referencing packages resolvable.devDependenciesare stripped from the vendoredpackage.json; otherwise vlt installs hundreds of dev nodes.package.jsonfile:spec plus lock node and edge surgery. It is byte-stable through realvlt ci,--frozen-lockfileandvlt install <x>.~peer.<hash>).binding.gyp) —vendor_vlt_build_scripts_unsupported;vendor_vlt_reinstall_requiredtells the user when plainvlt installwould keep an already-installed upstream copy (optional deps, re-vendored or rebuilt dirs) andvlt ciis needed.vendor_vlt_transitive_unsupported, which points to hosted mode). vlt silently reverts lock-only rewiring (exit 0) onvlt install <x>,uninstall,updateand workspace edits in every current release.vltflavor.Agent (
apply,rollback,remove,list,setup)node_modules/.vlt/<DepID>/node_modules/<name>store for every DepID grammar era and patches every copy of name@version.setupwires the samenpx @socketsecurity/socket-patch applypostinstall hook for vlt projects, readingvlt.jsonworkspaces with root-only wiring.vlt_root_scripts_not_runis emitted for vlt < rc.13, which never runs a rootpostinstall.VEX
vlt-lock.json.lockfileVersion, the 0.0.0-16…24 ignored-lock window, rc.7…rc.29 with a scalarregistry).Forward compatibility
Production blocker: needs a depscan deploy
vlt cannot install patch.socket.dev artifacts today, on any version.
accept-encoding: gzip, and the edge re-gzips the.tgzon the fly (content-encoding: gzip, a new body on every request).EINTEGRITY. npm, pnpm and bun decodeContent-Encodingfirst, which is why they are unaffected.The server fix (
Cache-Control: …, no-transformon archive routes) is a separate depscan PR. Until it deploys:redirect_vlt_artifact_unverifiable;vlt-serve-watchdog.ymlworkflow iscontinue-on-error.Review and CI
git check-ignoredeadlock on packages with about 2,000+ files;vlt buildwriting into the vendored dir;vlt-compatibility.ymlversion × OS matrix, apart from two items:Pipenv compatibility: one hosted cell hit a production transport error. The job is being rerun; it passes on main and this PR doesn't touch pipenv.rust/cleartext-logging: the alerts flag patch UUIDs in test and warning output. Patch UUIDs are public identifiers, main has dismissed 23 alerts of this class as false positives, and the owner needs to dismiss these too (the code isn't renamed to dodge the heuristic).Tests
npm/vlthosted golden cases shared byte-for-byte with depscan's TS twin, plus a reverse-replay golden.tests/fixtures/vlt-locks,vlt-trees,vendor/npm/vlt). The vendored lock surgery is checked byte-for-byte against locks that real vlt wrote on 1.2.0, 1.0.10 and rc.14.e2e_redirect_vlt_build,e2e_vendor_vlt_build,mode_migration_vlt,e2e_safety_vltande2e_vlt, run throughscripts/check-vlt-legs.pyagainst a leg manifest so that no leg can pass vacuously.ci.ymlgains vlt e2e rows on ubuntu/macos/windows.vlt-compatibility.ymlruns a full version × OS matrix plus a production backtest (scripts/backtest-vlt.py).vlt-serve-watchdog.ymlchecks the artifact encoding.docs/ecosystems.mdvlt notes,docs/testing/vlt-compatibility.md(with its boundary table), README, CLI_CONTRACT codes and CHANGELOG.Companion PRs:
ff2ceb8f.Merge order: depscan#26856 (deploy and verify) → this PR → re-pin depscan#26859 to the merged main.
🤖 Generated with Claude Code
Note
Medium Risk
Large changes to npm-family redirect, vendor, rollback, and VEX paths with real lockfile byte semantics, but heavily gated by preflight, fail-closed ledger handling, and broad pinned-vlt CI.
Overview
Adds first-class vlt support (
vlt-lock.json/node_modules/.vlt) across agent, hosted, and vendored flows, with vlt taking npm-family routing precedence over bun/pnpm/yarn when its lock is present.Hosted rewrites default-registry lock nodes (integrity + patch URL) behind artifact preflight that fetches tarballs the way vlt does; failures withhold pins via
redirect_vlt_artifact_unverifiable. After writes, the CLI can invalidate stale.vltinstall copies (opt out with--no-vlt-install-cleanup), with ledger kindredirect_vlt_lock_nodeand rebasing logic for re-locks and peer re-keys.Vendored commits patched package dirs under
.socket/vendor/npm/…, rewires lock edges and importerpackage.jsonspecs, and runs a Bun-style vlt preflight onvendor/get/scanbefore downloads. Agent crawls vlt store layouts with copy-on-write-safe patches; setup, vex, repair, and rollback are extended (including heal after hosted unwind and probing all pnpm/vlt store variants for rollback blobs).CI & proof: new
vlt-compatibility.yml(version × OS matrix, production backtest, lock-diff, nightly canary),vlt-serve-watchdog.yml, manyci.ymlvlt e2e rows via sha512-pinnedinstall-vlt.shandcheck-vlt-legs.py, plus golden/captured lock fixtures (.gitattributes-text). Workspaceserde_jsongainsraw_valuefor lock surgery.Docs/CHANGELOG document behavior and the production caveat: hosted vlt stays refused until patch artifacts are served without re-encoding that breaks vlt integrity checks.
Reviewed by Cursor Bugbot for commit ff2ceb8. Configure here.