GeezerVison

Assisted-by: Claude Code:claude-opus-5-5

Running socket-patch from a yarn berry workspace member whose root
lists it with a regex group (packages/(a|b)), a POSIX class
([[:alpha:]]) or a `..` segment (packages/a/../b) pinned nothing and
exited 0, so the next install at the root stayed unpatched. Yarn berry
matches workspaces with picomatch, which reads all three, while our
matcher read them as literal text and saw no workspace root.

The yarn berry dialect now reads that syntax the way picomatch does,
so the run is refused with redirect_workspace_lockfile_elsewhere and
names the root to run from. A group without `|` stays literal in a
pattern fast-glob treats as a plain path, as yarn reads it, and a
negated group now excludes the members it names. npm, yarn classic,
Bun, vlt, pnpm and uv keep their grammar.

Assisted-by: Claude Code:claude-opus-5-5

Review of the first pass found yarn berry patterns it still misread,
so a run from a member could again pin nothing and exit 0, or refuse
a directory yarn never lists:

- `(a|b)?`, `(a|b)+`, `[ab]+` and `(a+|c)`: picomatch reads `?` and
  `+` there as regex quantifiers.
- `(a|[)])`: a `)` or `|` inside a class closed or split the group.
- `packages/{(a),c}`: fast-glob decides static vs dynamic per brace
  alternative, so `(a)` stays a literal path there.
- `packages/*/../b` lists nothing, and `!packages/a/../b` excludes
  nothing: fast-glob resolves `..` only through a static prefix and
  never in an ignore.
- `(a|)` and `(a/b|c)`: an alternative is matched within one path
  component.

Regex groups are now rewritten into the extglob groups the matcher
already reads, instead of being spliced in as text, and extglob groups
skip classes whole for every package manager.

Assisted-by: Claude Code:claude-opus-5-5

Running `scan` or `get` in hosted mode from a yarn berry workspace
member that the root lists through a regex group, a `?` quantifier, a
POSIX class or a `..` segment must refuse with exit 1 and leave the
root lock untouched.

Assisted-by: Claude Code:claude-opus-5-5

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Bugbot on #1493 found two shapes that still pinned nothing and exited
0 from a yarn berry member:

- `(packages/ui|packages/core)`: a group alternative holding `/` was
  dropped, so neither member was listed. Such groups are now spelled
  out like brace sets and matched across path components.
- `packages/(a)/../b`: fast-glob reads a static pattern as a literal
  path, so its `..` resolves even after the `(a)` segment.

Assisted-by: Claude Code:claude-opus-5-5

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

A `?(` or `+(` right after a regex group or a class was read as a
quantifier, so the extglob it opens matched literally. Members listed
by `packages/(a|b)?(c|d)`, `packages/(a|b)+(c)` or `packages/[ab]+(c)`
were then missed and the run exited 0 with nothing pinned, and the
same `!` pattern excluded nothing. Those characters now open the
extglob, as picomatch reads them.

Assisted-by: Claude Code:claude-opus-5-5

When a regex group with a `/` in an alternative was spelled out, a
`?` or `+` after it, and a `+` inside it, were left as plain text.
Members listed by `(packages/a|apps/b)?x` or `(packages/a+|apps/b)`
were then missed and the run exited 0 with nothing pinned. A `?` now
also yields the spelling without the group, a `+` keeps one
occurrence, and each alternative is read as inside a group.

Assisted-by: Claude Code:claude-opus-5-5

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

A `?` or `+` after a yarn berry regex group with a `/` in an
alternative skips or repeats a path separator, which can't be matched
component by component. Approximating it either missed members
(the run exited 0 with nothing pinned) or listed directories yarn does
not. Such a pattern now fails closed: it lists every directory, so a
run from under that root is refused, and as a `!` pattern it excludes
nothing.

Assisted-by: Claude Code:claude-opus-5-5

cursor Bot left a comment