GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | ||||||||||||||||||||||||||||||||||||||||||||||||||
GeezerVison is showing github.com — Fix path-scoped scan missing member alias links (#1266) by mikolalysenko · Pull Request #1470 · SocketDev/socket-patch Conversation
|
| `scan packages/a --mode agent --dry-run`, debug build | main | 84b3690 | 4288a72 |
|---|---|---|---|
| pnpm store, 1,000 entries | 0.10 s (review) | 4.7 s | 0.10 s |
| pnpm store, 3,000 entries | 0.24 s (review) | 34.6 s | 0.24 s |
| Issue shape | Test |
|---|---|
| #1266 pnpm isolated, scoped scan | scan::scan_paths_e2e::paths_scope_selects_pnpm_member_alias_link |
| #1266 npm linked (npm 11+ and npm 10 store-entry spellings), scoped scan | scan::scan_paths_e2e::paths_scope_selects_npm_linked_member_alias_link |
| #1266 member alias resolving to a different pnpm peer variant | scan::scan_paths_e2e::paths_scope_selects_member_alias_link_to_a_peer_variant |
#1266 rollback packages/a (pnpm .pnpm and npm .store) |
rollback::rollback_duality_invariants::path_scoped_rollback_selects_member_alias_link |
Without the fix, the scan tests fail with a batch body of only
{"components":[{"purl":"pkg:npm/[email protected]"}]}, and the rollback test
fails on the exit code. The peer-variant test also fails if the
variant expansion is removed.
Local runs:
cargo fmt --all -- --check: cleancargo clippy --workspace --all-features -- -D warnings: cleancargo test --workspace --all-features --no-fail-fast: everythingmain. Most are write-failure tests that need chmod-denied writes,/code-review high found 6 issues and all of them are fixed in
84b3690: the peer-variant gap, moving the link pass out of rollback's
restore resolver, skipping the root clone when there are no npm purls,
no panic on a join error, Ecosystem::from_purl in place of a prefix
test, and folding a duplicate test scan into the loop.
🤖 Generated with Claude Code
https://claude.ai/code/session_011KEL5sGU2JuwHvDCpJtMwi
Generated by Claude Code
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Assisted-by: Claude Code:claude-opus-5-5
Under pnpm's default isolated linker and npm's linked install
strategy, a workspace member's alias dependency ("lp":
"npm:[email protected]") is a symlink from packages/a/node_modules/lp
into the root store. `scan --mode agent packages/a` never selected it
and `rollback packages/a` never restored it, both reporting success,
while the member's plain-name links were handled.
Path scoping now also counts every package link in a node_modules
root that resolves to one of a package's installed copies. The
crawler itself still records only physical copies, so apply and VEX
see each copy once, as before.
Fixes #1266
Assisted-by: Claude Code:claude-opus-5-5
ac8b66c to
88c91ff
Compare
The link pass lived in the resolver rollback also restores from, so every rollback did extra filesystem work it then threw away. It now runs only for scan and rollback path targets, in its own lookup. A member's alias link can also point at a pnpm peer variant the crawl skipped once it found the root's copy, so store peer variants now count when matching links. A failed link enumeration falls back to the plain copies instead of aborting the run. Assisted-by: Claude Code:claude-opus-5-5
|
BugBot review Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
BugBot review Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Stale Bugbot comment from a previous run.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Labeled Ready for review by the burn-down agent.
Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Final review: blocking perf regression on path-scoped
|
| Store entries | merge-base | this head |
|---|---|---|
| 1,000 | 0.10 s | 6.9 s |
| 3,000 | 0.24 s | 53 s |
Unscoped scan on this head stays at 0.16 s for N=3,000. Release builds are faster but still quadratic, so a store of about 5,000 entries would take minutes.
Suggested fix (any one)
node_modules root links once, canonicalize each, read the target's package.json name@version, and match it against the unresolved purls. This avoids per-purl variant expansion.scanned set and one store listing across all purls.Non-blocking
node_modules links now select too (e.g. node_modules/left-pad). That fits the semantics, but the CLI_CONTRACT.md clause only describes member aliases.#[cfg(unix)].find_all_packages_for_rollback_reusing may have no non-test caller left.Question for a human: is the scoped-scan slowdown acceptable to ship, or should this wait for one of the fixes above? I recommend the fix. I've labelled this agent:needs-human and removed Ready for review; whoever picks it up can drop the label once it's fixed.
Generated by Claude Code
Sorry, something went wrong.
There was an error while loading. Please reload this page.
The previous commit matched member links by expanding every crawled npm purl's store peer variants, re-listing the whole store once per purl. A path-scoped scan of a 3,000-entry pnpm store went from 0.24s to 35s (debug build). Links in each node_modules root are now matched by their target's own package.json name@version, in one pass however many purls are asked for. The same 3,000-entry scan takes 0.24s again, and a link to a peer variant the crawl skipped still counts. Assisted-by: Claude Code:claude-opus-5-5
|
[agent] Thanks, the regression was real. Fixed in 4288a72.
Both select the same single package. 4288a72 matches your merge-base numbers.
I'm removing Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
BugBot review Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 4288a72. Configure here.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Labeled Ready for review by the burn-down agent.
Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Final review briefWhat it does: Path-scoped Risk: low. It only adds match candidates for path-scoped runs. Writes still go through the crawled copies, so it can't touch anything an unscoped run wouldn't. Links are followed read-only ( Look here
Verified
Changes I made: none. Open questions (non-blocking)
Auto-merge is armed, so approving sends this straight to the merge queue. Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
|
Final reviewer: re-enqueued once. The merge group's Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
|
[agent] Dequeued on The fix is #1487: it marks the test Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
* ci(release): publish npm from release.yml, not publish-npm.yml Every socket-patch npm package's trusted publisher is registered against release.yml, and npm allows only one publisher per package. The 5.0.0 release dispatched publish-npm.yml, whose OIDC token named that file, so npm rejected it with E401 before staging anything. Move the npm leg back inline as release.yml's npm-publish job (same steps as publish-npm.yml) and delete publish-npm.yml, so the existing registration keeps working. Add an `npm-retry-version` input that skips the version gate, build, tag, GitHub release and crates.io jobs and re-stages npm from an existing release's assets; this retries 5.0.0 now and replaces the manual Publish npm dispatch. crates.io stays dispatched through publish-cargo.yml, since crates.io allows several publishers per crate. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> * chore(release): fold 22 more PRs into the 5.0.0 notes Cover the PRs merged to main after #1432's base (1779317..4cb3643): Cargo source replacement and registry = "crates-io" (#338/#455, #386), pnpm lockfile=false (#1074), berry removed descriptors (#1435), yarnrc ${VAR} reads (#1100), CRLF .npmrc append (#1196), Composer vendor-dir cascade and global home (#439/#686, #586), Go +incompatible vex (#484), gem moved BUNDLE_GEMFILE and commented Gemfile revert (#952, #988), Poetry source = "pypi" (#1282) and Hatch path characters (#547). No entries for #1411 (macOS fix to code #1393 added in this release; the #1393 entry already describes the intended behavior), #1426 (perf regression introduced and fixed within 5.0.0) or the CI/test/bench PRs. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> * chore(release): cover #1419, #1434, #1440, #1442, #1444 in the 5.0.0 notes Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> * chore(release): 5.0.1 Cut [Unreleased] into [5.0.1] — 2026-10-13 and stamp 5.0.1 with scripts/version-sync.sh. The 5.0.1 notes cover main through 501c6d9 (#1449), i.e. every PR after the v5.0.0 tag (6ad6add): the npm publish fix (5.0.0 never reached npm or crates.io, 5.0.1 is the first v5 there), #1465, #759, #1460, #1462, #1445, #869, #1447, #1450, #1467, and #1449 under Maintenance. CI/test-only PRs (#1448, #1452, #1454, #1457, #1459) have no entries. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> * chore(release): 5.0.1 notes for PRs merged since the cut Covers #1469, #1470, #1474, #1475, #1478, #1479, #1480 and #1482; #1484 is CI-only. The notes now cover main through 285a5e8. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
Run from inside a vlt, pnpm or npm-linked workspace member, apply
reported a member's npm alias dependency ("lp": "npm:[email protected]")
as package_not_installed and exited 1, and rollback could not restore
it, although scan had offered the patch. The member's node_modules is
the only root walked there, and its alias entry is only a link into
the root store, which the resolver never takes as a copy.
Apply's and rollback's lookups now add the root links whose target is
a requested package, the same pass path scoping got in #1470. Both
commands already act on each physical copy once, so a run from the
root still patches the store copy a single time.
Fixes #1494
Assisted-by: Claude Code:claude-opus-5-5
There was an error while loading. Please reload this page.
Successfully merging this pull request may close these issues.
Path-scoped agentscan packages/a and rollback packages/a skip a workspace member's npm alias (lp@npm:left-pad) under install-strategy=linked, while its plain links are in scope (exit 0, success)
There was an error while loading. Please reload this page.