GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1465

Summary

Some projects sit behind a registry mirror that passes npmjs metadata through unchanged, so the tarball URLs still point at registry.npmjs.org. In those projects, hosted rollback and remove dropped yarn berry's ::__archiveUrl= binding (and pnpm's tarball:) while exiting 0. The next cold install then fetched the conventional path under the mirror, which 404s (YN0035). After this PR the restore writes back what the package manager itself wrote.

Root cause

registry_derives_tarball (crates/socket-patch-core/src/patch/redirect/upstream/npm.rs) decides whether the package manager derives a tarball URL itself and so leaves it out of the lock. It accepted a URL that was conventional under either the project's registry or npm_registry_base() (npmjs, or SOCKET_NPM_REGISTRY). Yarn (isConventionalTarballUrl via getScopeRegistry) and pnpm compare only against the package's own registry. So an npmjs URL served by a mirror was wrongly treated as derived.

The same helper drives three call sites, and the fix covers all of them:

• the berry npm: locator restore (berry_registry_locator)
• pnpm's tarball: restore
• pnpm's lock evidence for lockfile-include-tarball-url

Fix

registry_derives_tarball now takes from_project, which says whether the version document was read from the project's own registry (ProjectDist::from_project).

• If it was, only the project registry counts.
• If it wasn't, the default base still counts too. That covers two cases: the project resolves from the default registry (where SOCKET_NPM_REGISTRY stands in for npmjs), and the mirror could not be read so its document is the fallback guess.

The lock-evidence path reads no document, so it uses non_default_registry, the same test fetch_dists_on uses to decide whether to read the project registry.

Tests (red → green)

Commands run locally:

• cargo fmt --all -- --check: ok
• cargo clippy --workspace --all-features -- -D warnings: ok
• cargo test -p socket-patch-core --all-features --lib: 6407 pass. 4 fail only as root (chmod-based write-failure tests) and pass as an unprivileged user.
• in_process_redirect: 142 pass. 3 fail only as root, same as above, and pass as non-root. in_process_rollback_hosted 38/38, hosted_memory_engine 39/39.
• yarn-berry e2e leg (SOCKET_PATCH_YARN_E2E_REQUIRED=1, yarn 4.18.0): e2e_redirect_yarn_berry_build 35/35, e2e_vendor_yarn_berry_build 39/39, e2e_yarn4_pnpm_linker_build 38/38, e2e_yarn4_workspaces_build 37/37.
• The full cargo test --workspace doesn't fit this sandbox's disk, so CI covers the rest. mode_migration_npm's two berry tests can't reach npmjs through the sandbox proxy's CA from their test-side reqwest::Client. That is unrelated to this change.

No npm/pypi/gem wrapper changes are needed: the wrappers only dispatch to the binary.

Review findings not fixed

From /code-review high:

• Fallback still guesses "derived" when the mirror can't be read. That path has no document from the project registry, so the URL scheme the mirror serves is unknown. Most mirrors (Artifactory, Verdaccio, Nexus) rewrite tarball URLs to themselves, so the bare locator stays the better guess. upstream_registry_fallback already warns, and the Hosted pnpm rollback/remove restores pnpm-lock.yaml from npmjs's version document instead of the project's .npmrc registry, so a mirror project loses its tarball: URL (cold frozen install 404s) or is moved to npmjs #919 fallback test pins this behaviour.
• SOCKET_NPM_REGISTRY counted on the evidence path. It stands in for npmjs throughout this module (non_default_registry, fetch_dists_on). The behaviour is unchanged from main.
• Carry the source registry in ProjectDist instead of a bool. It's a reasonable refactor, but it's wider than this fix.
• e2e uses curl. The test-side reqwest client uses webpki roots only, so it fails behind TLS-intercepting proxies. curl ships on every CI runner OS.
• e2e rewrites .yarnrc.yml. The new rc repeats every key the fixture writes.
• Empty start commit. The agent claim protocol requires it, and the PR squash-merges.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QT2WDJPU22ezCv8jCEUNSP

Generated by Claude Code