GeezerVison

Copy link

Copy Markdown

Collaborator

cursor Bot reviewed Sep 30, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

4 of 9 checks passed

Mikola Lysenko (mikolalysenko) deleted the codex/server-only-vendoring branch September 30, 2026 14:38

The #300 squash kept both Composer file-inventory fixes: one before
the lock rewrite and one after the marker write. The second rebound
an already-moved value, so socket-patch-core failed to compile and
every Rust CI job went red.

Keep the pre-rewrite inventory. It runs after filter normalization,
and a failure there refuses before composer.lock is touched. The
marker lives in the uuid dir, outside the inventoried copy, so the
result is the same.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01F3KCWT9B1MUVPrgerxxGpK
Assisted-by: Claude Code:claude-opus-5-5

#300 made the ledger-less vendored `scan --vex` cell expect a
`vendor_ledger_entry_missing` refusal. yarn < 1.7 installs nothing for
a vendored `file:` entry, so that scan finds no package to vendor and
attests from the lockfile instead, failing the yarn-classic 1.0.2 and
1.6.0 legs. Gate the expectation on installs_file_tarballs and pin the
older releases' shape (zero scanned packages, attested).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NEUik3Qo9HQtYGVEAMs1Di

#300 added .zip to artifact_is_file_shaped for pypi sdists. A vlt package
dir path ends in the npm package name, so a package such as lodash.zip
stopped being recognized as a vlt dir: its health check took the generic
dir branch, which refuses the dependency links under its node_modules,
and restore took the file branch and refused for want of an archive
SHA-256.

is_vlt_dir_entry now also accepts a path in the vendored vlt dir layout
(<name>-<version>/node_modules/<name>), whatever its suffix.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NEUik3Qo9HQtYGVEAMs1Di

Ledgers written before #300 record no file inventory for cargo, Go and
composer copies, and a copy past the inventory cap records none either.
Exact restore refuses such an entry, and vendor sent every same-uuid
entry that was not healthy to that same restore, so the re-vendor the
error suggested failed with vendor_redownload_failed on every run.

A dir-shaped entry without an inventory now skips the exact restore and
goes to the backend, which rebuilds the copy from a fresh verified
download as vendor did before #300. The file-shaped entry without a
SHA-256 still refuses. Both restore refusals now name the remedy that
records a new fingerprint: vendor --revert and then vendor.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NEUik3Qo9HQtYGVEAMs1Di

#300 sent every same-uuid ledger entry that was not healthy to exact
redownload before the backend ran. That includes a bun.lockb workspace
whose member-relative mirror tarball is missing or stale while the
canonical tarball still matches its ledger SHA-256. Offline, the
redownload failed with vendor_redownload_failed and skipped the backend,
which would have rewritten the mirror from the committed tarball; online
it downloaded an artifact the project already held.

A workspace mirror issue over a canonical tarball with a recorded
SHA-256 now goes straight to the backend, as repair also handles it
locally.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NEUik3Qo9HQtYGVEAMs1Di