GeezerVison

Problem

The real-vlt e2e legs depend on api.socket.dev returning 2xx. When it doesn't, whole matrix rows go red with:

Error: Failed to fetch security data
  at #retrieveRemoteData (vlt/chunk-FOJCK57G.js:471:13)
  ...
  [cause]: { response: Response { status: 401, statusText: 'Unauthorized',
             url: 'https://api.socket.dev/v0/purl?alerts=true' } }

Evidence: CI run 36808399029 (PR #365, merged with current main 2463257) had 15 vlt e2e jobs fail in one go around 03:05–03:06 UTC on 2026-10-01: e2e_vlt, e2e_redirect_vlt_build, e2e_vendor_vlt_build and mode_migration_vlt on vlt 1.0.4, 1.0.7, 1.1.1 and 1.2.0, on ubuntu, macOS and Windows (e.g. job 110199311052: vlt_pinned_matrix_agent_reruns_and_vex and ..._persistence_reverted_by_reinstall, 1.2.0 vlt ci failed). None of those failures had anything to do with the PR. It was one incident, but the same dependency is in every vlt ci call the harness makes, so the next API blip or rate limit will fail them all again. It also stops the suites from running offline or behind a proxy.

Root cause

From 1.0.0-rc.24 vlt ci defaults --allow-scripts to :scripts:not(:malware) (rc.12–rc.23: *; vlt install defaults to :not(*)). I checked this in the published tarballs for rc.23, rc.24, rc.26, rc.28, rc.30, rc.31, rc.32, 1.0.4, 1.0.7, 1.1.1 and 1.2.0. When the query has a security selector, reify calls SecurityArchive.start, which POSTs every newly added node to https://api.socket.dev/v0/purl?alerts=true using vlt's public token. Any non-2xx reply throws, and vlt ci exits 1. Packages served by the harness's local registry count as "npm" packages because registries.npm points at that registry, so they are sent to the API too.

Fix

Leg::vlt_with is the one place every harness vlt call goes through. For vlt ≥ rc.24 it now adds --allow-scripts :scripts to vlt ci. That is vlt's own default without the :not(:malware) filter. The harness's packages have no malware alerts, so the set of packages allowed to run scripts stays the same and the API call goes away. An explicit --allow-scripts set by a test is left as is. Older releases and vlt install are untouched. A harness self-test (vlt_e2e_harness_ci_never_queries_the_socket_api) pins the version boundary and the pass-through cases.

This is a root-cause hermeticity fix: no retries, no raised timeouts, no ignored tests.

Proof

I reproduced it locally with vlt 1.2.0, using a sandbox where api.socket.dev returns 403, the same failure class as the 401:

Every failure on main was Failed to fetch security data (138 occurrences). With the fix there were none.

I also ran e2e_vlt and mode_migration_vlt with the fix on vlt 1.0.0-rc.24, 1.0.0-rc.32, 1.0.4 and 1.1.1: all pass (9/9 and 14/14 each), so every pinned release in range accepts the flag. On this PR's CI, every vlt e2e row (0.0.0-16 through 1.2.0, ubuntu/macOS/Windows) and the rest of CI passed.

rustfmt --check is clean on the touched file. cargo clippy -p socket-patch-cli --test e2e_vlt --test mode_migration_vlt --test e2e_safety_vlt --test e2e_redirect_vlt_build -- -D warnings is clean. Clippy on e2e_vendor_vlt_build has 7 needless_borrow errors, all in tests/prebuilt_common/mod.rs and already on main. CI's clippy job doesn't lint tests, so they are left alone here.

Where tests run

Nothing was removed or moved. Job names and required checks are unchanged.

🤖 Generated with Claude Code

https://claude.ai/code/session_018ghbvY52iuzejTo4knpDvq

Generated by Claude Code