GeezerVison

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

A hosted yarn classic pin wrote `resolved "<url>"` with no `#<sha1>`
fragment when the grant carried only a sha512. Yarn 1 names its cache
slot after that fragment, so the hosted tarball shared the slot of any
fragmentless upstream copy of the same version: a warm cache installed
the unpatched bytes (yarn <= 1.17) or failed every install with
"Incorrect integrity" (yarn >= 1.19), while scan reported success.

When a classic yarn.lock is targeted and the grant has no sha1, the
disk and in-memory hosted flows now download the served tarball, check
it against the grant's sha512 and pin the sha1 of those bytes. A
tarball that can't be fetched or verified drops the patch as
`npm_tarball_unavailable`, and the rewriter itself refuses a dep that
still lacks a sha1 (`redirect_yarn_classic_missing_sha1`).

Fixes #558

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

The served-tarball fetch picked its yarn classic targets with a raw
substring test, so `lodash` matched a `lodash.debounce` block and a
package locked only as a git or file: copy (which the rewriter never
pins) was fetched too, and a failed fetch dropped its patch. Targets
are now read by block real name, version and registry copy source,
the way the rewriter selects blocks.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

cursor Bot left a comment

A patch that adds a dependency to the package's own package.json, or
moves one to a new range, left yarn classic locks that yarn could not
install reproducibly. Vendored mode recomputed the block's
dependencies sub-map but added no block for the new descriptor, so
online frozen installs fetched it unpinned, --offline installs failed
and every yarn install re-saved the lock. Hosted mode never looked at
the patched manifest, so yarn never installed the new dependency and
the patched package crashed at runtime, while scan and vex reported
success.

Both writers now compare the patched package.json with the lock.
Vendored mode refuses the patch before any wiring is written
(vendor_dep_manifest_unlocked) when a descriptor has no block of its
own. Hosted mode reads the served tarball (with the #558 sha1 fetch)
for every entry it has not pinned yet, refuses the pin with
redirect_yarn_classic_dep_manifest_unlocked, and rewrites the sub-maps
when every descriptor is already locked. Each refusal names the
descriptors and a remedy (lock them first, e.g. with yarn add).

Fixes #591

Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>

…test

Two interactions with main after merging it into this branch:

- #1026 made ApiClient's "artifact not found" errors redact the grant
  token themselves, so the error no longer contains the raw artifact URL
  and npm_tarball_unavailable's literal replace of that URL with
  "<hosted artifact>" stopped matching. The token was still redacted, but
  the detail now shows the host and path, which broke
  issue_558_unfetchable_tarball_skips_the_patch's "server URI absent"
  check. npm_tarball_unavailable now goes through redact_artifact_text
  like its sibling skip builders. The test asserts that the grant token
  never appears, and that the unfetchable detail names the URL with the
  token redacted. The #558 skip assertions (npm_tarball_unavailable,
  nothing redirected, yarn.lock untouched) are unchanged.

- #1274's yarn_classic_empty_range_key_is_pinned expected a fragmentless
  resolved. With this PR the pin carries the grant's sha1 fragment
  (#5ha1), as in the other classic tests this PR already updated.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>