GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Fix hosted scan from a workspace member pinning nothing or the wrong files (#590, #417) by mikolalysenko · Pull Request #598 · SocketDev/socket-patch

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Collaborator

LLM Description written by Claude Code:claude-opus-5-5

Final-head CI is complete: 479 successful checks, 6 skipped; no failures or pending checks. Bugbot passed, there are no unresolved review threads, and the PR is mergeable.

Fixes #590 and #417. Hosted scan and get run from a pnpm or Cargo workspace member can otherwise report success while reading only the member directory: pnpm pins nothing, and Cargo may rewrite member manifests as a lockless project, breaking workspace builds.

The hosted path now refuses these layouts before takeover or writes, including dry runs. Cargo shares the existing vendored workspace-root check and reports cargo_manifest_not_workspace_root. A pnpm candidate with no local npm-family lock reports redirect_pnpm_lockfile_elsewhere when its governing lock exists elsewhere, naming that lock and returning exit 1.

pnpm resolution follows native configuration controls: the nearest workspace YAML takes precedence over member .npmrc, which takes precedence over root .npmrc. Configured relative lockfileDir/lockfile-dir paths resolve from the invocation directory; without an override, the lock is sought at the workspace root. Existing local locks and Rush bypass this ancestor check, and the nearest workspace bounds lookup. The disk check is shared by hosted scan/get; in-memory projects have no ancestor directory to inspect.

Validation:

Eight governing-root unit tests, all 16 pnpm CLI tests, and the Cargo member refusal test passed after the correction.
Three CLI regressions fail on the original PR head and pass with the fix: inherited root .npmrc, inherited relative YAML directory, and YAML precedence over member .npmrc. Refused runs preserve project and lock bytes.
Native pnpm 10.34.5 offline installs verified both setting sources, relative-path behavior, and the precedence combinations.
Independent review checked the final correction against the native evidence. Diff and targeted lint checks passed (with the existing macOS unused_variables allowance), and the fixed commit merges cleanly with current main.
Full CI, compatibility workflows, benchmarks, and Bugbot completed successfully on the corrected commit 93c3e32b.

Other package managers' workspace-member rules remain outside this pnpm/Cargo change.

Note

Medium Risk
Changes hosted-mode entry preconditions for pnpm/Cargo workspaces; refused runs write nothing, but successful runs from members that previously appeared to succeed will now error until run from the governing root.

Overview
Hosted scan and get --mode hosted now fail closed when --cwd is a workspace member whose governing lock or Cargo workspace root lives outside that directory, instead of exiting successfully while pinning nothing (pnpm) or rewriting member manifests and breaking builds (Cargo).

A new hosted::governing_root pre-check runs on disk projects before any takeover or writes (dry runs included). pnpm/npm candidates with no local npm-family lock resolve the governing pnpm-lock.yaml using native-style config precedence (pnpm-workspace.yaml lockfileDir, then member/root .npmrc lockfile-dir, default workspace root) and return redirect_pnpm_lockfile_elsewhere with the directory to run from. Cargo reuses the vendored workspace_root_refusal path with a hosted-specific hint and cargo_manifest_not_workspace_root.

CLI_CONTRACT.md documents the new top-level error codes. Integration and regression tests cover pnpm workspace variants, inherited lock paths, Cargo member refusal, and small vex_consumed adjustments for the #605 resolver.

^{Reviewed by Cursor Bugbot for commit 7f0ed18. Configure here.}

Generated by Claude Code

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Start fix for #590, #417

663c0db

Assisted-by: Claude Code:claude-opus-5-5

This was referenced Oct 2, 2026

Hosted scan/get run from a pnpm workspace member (or with lockfile-dir=..) ignores the parent pnpm-lock.yaml and reports success while pinning nothing #590

Closed

Hosted cargo scan run from a workspace member treats it as a lockless project, rewrites only the member, and breaks every build of the workspace while reporting success #417

Closed

Claude (claude) added 2 commits

October 2, 2026 19:45


          Refuse hosted runs from a workspace member

d930de2

Hosted scan and get read locks only in --cwd. Run from a pnpm
workspace member (or a project whose lockfile-dir puts pnpm-lock.yaml
elsewhere), they pinned nothing and still reported success, so pnpm
kept installing the unpatched package (#590). Run from a cargo
workspace member, they rewrote the member as a lockless project and
broke every build of the workspace (#417).

Both layouts are now refused before any takeover or write, exit 1,
naming the directory to run from: redirect_pnpm_lockfile_elsewhere
for pnpm, and the vendored cargo_manifest_not_workspace_root check,
now shared, for cargo.

Assisted-by: Claude Code:claude-opus-5-5


          Document the hosted workspace-member refusals

70f46f8

Assisted-by: Claude Code:claude-opus-5-5

This was referenced Oct 2, 2026

NuGet and Cargo crawlers hang on a FIFO at obj/project.assets.json or vendor/<crate>/Cargo.toml #592

Closed

Read NuGet and Cargo crawler project files through the FIFO-safe reader (#592) #602

Merged

Mikola Lysenko (mikolalysenko) marked this pull request as ready for review

October 2, 2026 19:58

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Copy link

Copy Markdown

Collaborator Author

BugBot review

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Copy link

Copy Markdown

Collaborator Author

[agent] CI note: native (ubuntu-latest, 1.4.2) (Bun compatibility) failed 51/52 on 70f46f8.

The failing cell: 1.4.2 crlf hosted, on the rollbackSucceeded / rollbackOriginalFiles / rollbackOriginalBytes checks.
Why it isn't this PR's: this PR only adds a pre-check to hosted scan / get for a cwd that is a pnpm or cargo workspace member. It doesn't touch rollback, Bun locks, or line-ending handling. The crlf cell runs from a project root with its own bun.lock, so the new check is a no-op there. In the same job, 12 other cells failed on patches-api.socket.dev Connection reset by peer and passed on their transport retry. The rollback step re-resolves upstream over the network, and its failure text doesn't match the harness's retry pattern, so that cell wasn't retried.
Fix to port: none exists. Fix npm/Bun VEX attesting a patch a same-lock copy skips (#588) #589 hit the same job, failing on the same patches-api connection resets.
Next step: I'll re-run the failed job once the workflow finishes; the API refuses a re-run while other jobs are still running. If it fails again I'll treat it as real and dig into the rollback artifact.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 2, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

crates/socket-patch-core/src/hosted/governing_root.rs Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

crates/socket-patch-core/src/hosted/governing_root.rs Resolved

Uh oh!

There was an error while loading. Please reload this page.


          Honor lockfileDir set by the workspace root

afce769

A workspace root can move pnpm-lock.yaml with lockfileDir, and the
key may be written quoted in pnpm-workspace.yaml. Hosted runs from a
member of such a workspace, or of one with a quoted key, still
reported success while pinning nothing. Both are now refused like
any other member whose lock lives elsewhere.

Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Copy link

Copy Markdown

Collaborator Author

BugBot review

Generated by Claude Code

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 2, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 2, 2026

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Copy link

Copy Markdown

Collaborator Author

[burn-down agent] Labeled Ready for review at afce7693da711fa73e019c2c3c89fa0c12303041.

CI: 469/469 completed check runs on the head pass (463 success, 6 skipped by matrix), no failing commit statuses.
Bugbot: 2 findings on 70f46f8 (quoted lockfileDir keys; a workspace root that relocates its lock) were fixed in afce769. Bugbot's re-review of afce769 found no new issues. 0 unresolved review threads.
Mergeability: no conflicts. The branch is 1 commit behind main (045d7ec, Bound patch API connects and stalled reads (#570) #581 patch API timeouts). That commit only overlaps this PR in CHANGELOG.md, and GitHub still reports the PR as cleanly mergeable.
Reviewer focus: hosted/governing_root.rs, which decides pnpm lock discovery precedence (lockfile-dir / lockfileDir, then the nearest ancestor pnpm-workspace.yaml), and the new pub(crate) workspace_root_refusal reuse in vendor/cargo.rs.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) mentioned this pull request

Oct 2, 2026

Stream patch blob and diff downloads to disk (#571) #607

Merged

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Collaborator Author

Review updated for 93c3e32bee97ae4041b627cee3a295b1d1a6e249: Ready to merge as-is from this review. Final-head CI is complete: 479 successful checks, 6 skipped; no failures or pending checks. Bugbot passed, there are no unresolved review threads, and the PR is mergeable.

The original guard missed root .npmrc settings and resolved inherited YAML paths from the wrong directory. Full CLI regressions reproduced exit 0, status: success, and zero redirects while native pnpm used an external lock.

The correction reads the nearest workspace's settings with native precedence (YAML, then member .npmrc, then root .npmrc) and resolves configured relative paths from the invocation directory. Ordinary workspace locks are still located at the workspace root when no override applies.

Validation passed: eight governing-root tests, all 16 pnpm CLI tests, and the Cargo member refusal test. Three new CLI regressions fail on the original head and pass with the fix. Native pnpm 10.34.5 offline installs verify inherited settings, path resolution, and precedence. Independent review of the final correction found no remaining issue; it merges cleanly with current main.

No remaining code finding from this review. The Ready label has been restored after all checks completed on the corrected commit.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) removed the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 2, 2026


          Honor pnpm workspace lockfile configuration precedence

93c3e32

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Copy link

Copy Markdown

Collaborator Author

bugbot run

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 2, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 2, 2026

Mikola Lysenko (mikolalysenko) mentioned this pull request

Oct 2, 2026

Vendored→hosted takeover drops the vendored ledger entry when the revert drift-keeps the artifact #568

Closed

3 tasks

Tanmay Singla (Tanmay182003) approved these changes

Oct 5, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) removed the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 5, 2026

Mikola Lysenko (mikolalysenko) and others added 3 commits

October 5, 2026 07:30


          Drop CHANGELOG entry from this PR

64626d1

Release notes are written when a release is cut, from the merged PR
log and the code, so PRs no longer edit CHANGELOG.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>


          Merge branch 'main' into agent/fix-hosted-ancestor-workspace-lock

d088a14


          Merge remote-tracking branch 'origin/main' into agent/fix-hosted-ance…

d25eae5

…stor-workspace-lock

# Conflicts:
#	crates/socket-patch-cli/tests/in_process_redirect.rs

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

BugBot review

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.


          Fix vex alias tests broken by store-copy merge

257a9fe

#605 taught the name-keyed npm resolver to probe bundled store
trees, so it now finds aliased copies (node_modules/lp) and a nested
host's store peers itself. Two vex_consumed tests from #738 assumed
that set never held aliases, so main's CI went red after both merged.

The tests now feed the alias-free set explicitly to keep covering
alias expansion, and also check the resolver's own set reaches the
same copies with no duplicates. No production code changes.

Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

[agent] Merged main to clear the conflict in tests/in_process_redirect.rs (both sides appended tests; kept both). main is red at 4646693 in -p socket-patch-cli --lib (vex alias tests broken by the store-copy merge), which isn't this PR's failure, so I ported the fix from #851 (40dac07) here. It no-ops once #851 lands. Clippy is clean and the governing-root, pnpm and redirect suites pass locally.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

BugBot review

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 5, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

crates/socket-patch-core/src/hosted/governing_root.rs Resolved

Uh oh!

There was an error while loading. Please reload this page.


          Read lockfileDir past a BOM and take the last

7f0ed18

A pnpm-workspace.yaml saved with a UTF-8 BOM, or one that sets
lockfileDir twice, could hide a relocated lock from the member check,
so a hosted run from a member still reported success while pinning
nothing. The reader now skips the BOM and uses the last assignment.

Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

BugBot review

Generated by Claude Code

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 5, 2026

View reviewed changes

cursor Bot left a comment

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 7f0ed18. Configure here.}

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 5, 2026

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

Burn-down agent: Ready for review at 7f0ed18.

CI: 491/491 check runs green (485 success, 6 skipped), mergeable clean.
Bugbot: reviewed 7f0ed18, no findings; 0 unresolved review threads.
Reviewer focus: hosted scan/get from a pnpm or Cargo workspace member now refuses before any write (redirect_pnpm_lockfile_elsewhere, cargo_manifest_not_workspace_root); check the pnpm config precedence (workspace YAML > member .npmrc > root .npmrc) in the governing-lock lookup.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) merged commit abb5787 into main

Oct 5, 2026

492 checks passed

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) deleted the agent/fix-hosted-ancestor-workspace-lock branch

October 5, 2026 17:23

This was referenced Oct 5, 2026

Hosted scan from a pnpm 11/12 workspace member with its own lock writes trustLockfile into a nested member pnpm-workspace.yaml that pnpm ignores, so the root install fails with ERR_PNPM_TARBALL_URL_MISMATCH #880

Closed

Hosted scan/get run from a yarn classic workspace member still reports success while pinning nothing: the #598 governing-root refusal covers pnpm and cargo only #884

Closed

Fix pnpm member settings written to an ignored nested pnpm-workspace.yaml (#880, #881) #888

Merged

Fix hosted runs from npm/yarn/bun workspace members pinning nothing (#884) #901

Merged

Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942

Closed

Reviewers

cursor[bot]

cursor[bot] left review comments

Tanmay Singla (Tanmay182003)

Tanmay182003 approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

Ready for review

Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Hosted scan/get run from a pnpm workspace member (or with lockfile-dir=..) ignores the parent pnpm-lock.yaml and reports success while pinning nothing

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

LLM Description written by Claude Code:claude-opus-5-5

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.