GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1542

Summary

A vlt workspace member listed through an extglob (packages/+(a|b), packages/@(a|b)) wasn't recognised as a member. Hosted and vendored runs from it wrote a stray lock or package.json that vlt never reads, exited 0, and vendored VEX attested not_affected for a pristine install. Hosted and vendored runs now refuse such a member the same way they already refused one listed by packages/* (#1134 / #1161).

Root cause

WorkspacesDialect::VLT (crates/socket-patch-core/src/utils/workspace_globs.rs) turned extglobs off and read ! patterns last-match-wins. I probed real vlt to see what it actually lists (vlt install then vlt query ':workspace') and read its bundled Monorepo#glob:

vlt 1.3's splitNegatedPatterns moves a ! pattern into an ignore list, and a later positive pattern drops any ignore that its own text matches. vlt 1.2 globs every pattern as given, so a leading ! is literal. Neither reading is the old last-match-wins one, and the issue's suggested Negation::Unordered would also be wrong, because relisting works.

Fix

• workspace_globs.rs: VLT is now extglob: true, dot: false, Negation::Relisted (1.3's rule). A new VLT_PRE_1_3 uses Negation::Literal. A new dot field on the dialect keeps every other dialect at true, so their behaviour is unchanged.
• governing_root.rs: vlt_lists_member evaluates each vlt.json group separately. Both vlt versions write the same vlt-lock.json, so when they disagree on a directory, the root lock's workspace~<path> edge sources decide which version wrote it. vlt records an edge from every installed member that has a dependency. This is the same approach as the Bun 1.3 split (Bun 1.3.0 and 1.3.1 locks have no configVersion, so a "!"-excluded member is still refused in hosted and vendored mode after the #1492 fix (regression since #1480) #1521). An unreadable lock keeps the wider reading. It's used by the vlt.json walk (vlt_workspace_root) and by the package.json fallback (lock_lists_member), so the hosted refusal, member_stray_lock (vendored vendor_lockfile_missing, VEX discovery) and nested_npm_project all pick it up.
• A nearer vlt.json with no lock that excludes the member no longer stops the root walk. This came from the /code-review high pass.

No wrapper (npm/, pypi/, gem/) changes: membership is decided only in core.

Tests (red → green)

The red run used a placeholder VLT_PRE_1_3 = VLT on top of main: 4 of 5 new tests failed. The 5th (groups) guards against the new negation rule leaking across groups.

Local runs:

• cargo fmt --all -- --check and cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --all-features --lib: 6504 passed, 4 failed. The 4 failures (copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure…, pypi_requirements::wire_failure_rolls_back…) are chmod-based tests that can't fail as root in this sandbox, and they're unrelated to this change.
• cargo test -p socket-patch-cli --all-features (--lib, in_process_redirect_pnpm, in_process_vendor, mode_migration_vlt, e2e_vlt, in_process_vendor_npm_v1_takeover): all pass.
• I didn't run the full cargo test --workspace: building every test binary ran this container out of disk. CI runs it.

Follow-ups

• vlt also drops a member nested inside another member (Monorepo#globOptions). That's not modelled here; it only matters for nested member layouts.

🤖 Generated with Claude Code

Generated by Claude Code