[agent] Found by the scheduled PDM bug-hunt routine (ledger #312).

Summary

docs/testing/pdm-compatibility.md:72-76 says __pypackages__ (PEP 582) projects aren't covered by agent or vendored mode, and tells users to "Run PDM with python.use_venv on, or use hosted mode." On that recommended hosted path, socket-patch never looks at __pypackages__/<py>/lib. After scan --mode hosted rewrites pdm.lock, the stale-install check therefore doesn't fire, and socket-patch vex attests the patch (not_affected / inline_mitigations_already_exist, exit 0), even though the copy PDM imports from __pypackages__ still holds upstream bytes.

The in-project .venv control behaves correctly: the "installed files … still differ from the patched hashes" warning fires, and vex omits the package (not_applied, exit 1).

The opposite direction also goes wrong. If the PATH interpreter happens to have the same release installed (here /usr/local/lib/python3.11/dist-packages/urllib3 1.26.18), vex checks that copy instead. So after a correct pdm sync that put the patched wheel into __pypackages__, it omits the patch as not_applied (exit 1).

Impact

A CI gate on socket-patch vex passes, and the VEX document says the CVE is mitigated, for a PEP 582 project that never reinstalled. Users can miss the reinstall because the stale-install warning they'd normally see doesn't print. PEP 582 is the default layout on PDM 0.x/1.x, and on 2.x under python.use_venv = false.

Repro (Linux, real PDM, local mock of the patch API serving a real patched urllib3 wheel)

cat > pyproject.toml <<'EOF'
[project]
name = "demo"
version = "0.1.0"
requires-python = ">=3.9"
dependencies = ["urllib3==1.26.17"]
EOF
pdm config -l python.use_venv false
mkdir __pypackages__
pdm use -f /usr/bin/python3.11          # .pdm-python -> /usr/bin/python3.11 (has no urllib3 1.26.17)
pdm lock && pdm sync                    # upstream urllib3 -> __pypackages__/3.11/lib
socket-patch scan --mode hosted --yes   # pdm.lock -> hosted url + patched sha256; NO "still differ" warning
socket-patch vex -O vex.json            # exit 0, 1 statement: not_affected / inline_mitigations_already_exist
pdm run python -c "import urllib3; print(urllib3.__file__, getattr(urllib3, 'SOCKET_PATCHED', 'UPSTREAM'))"
# .../__pypackages__/3.11/lib/urllib3/__init__.py UPSTREAM

Control: the same steps without use_venv false / __pypackages__ (in-project .venv) print the stale-install warning, and vex exits 1 with not_applied.

Expected vs actual

• Expected: the hosted stale-install check and vex verify the environment PDM actually installs into. In VEX terms, CLI_CONTRACT.md says vex attests from the hosted references "and the installed files", and the routine's bar is that a VEX attestation for a patch that isn't applied is a bug. At minimum, a PEP 582 project should get the same not_applied omission and stale-install warning a .venv gets, or vex should refuse to attest an install it can't locate rather than treat the lock as proof.
• Actual: no warning, and not_affected is attested over unpatched installed bytes. When the PATH interpreter has its own copy, the verdict comes from that unrelated copy instead.

Matrix (Linux; 2 of 2 fresh runs per cell, main 61cfb9b)

macOS and Windows weren't run. The discovery code has no OS-specific branch for this. Not bisected: v4.0.0 hosted VEX has different (ledger-based) semantics, so it isn't a like-for-like comparison.

Suspect code

• crates/socket-patch-core/src/crawlers/python_crawler.rs:329 (find_local_venv_site_packages) and :1709 (get_site_packages_paths): there's no __pypackages__/<X.Y>/lib probe, so a PDM PEP 582 project falls through to is_python_project → the global / PATH interpreter.
• crates/socket-patch-cli/src/commands/scan/hosted/python.rs:136: the stale-install warning uses the same discovery.
• Related but distinct: Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502 (the interpreter recorded in .pdm-python / .pdm.toml is ignored). Its fix wouldn't cover this, because in PEP 582 mode .pdm-python names the base interpreter (/usr/bin/python3.11), while packages live in __pypackages__. Same symptom family as Poetry with virtualenvs.in-project = true but no ./.venv keeps using its out-of-tree env, which socket-patch never probes: agent patches the global interpreter and hosted VEX falsely attests #476 / Hosted Hatch rewrite leaves an existing Hatch environment unpatched with no stale-install warning, and vex still attests not_affected #335 / In a --system-site-packages venv, pip keeps the base interpreter's unpatched copy after a hosted rewrite, no stale-install warning fires, and vex attests it as patched #409.