GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #661
Fixes #696

Summary

pnpm projects that set modulesDir (pnpm 10.12+) are now patched and attested correctly:

• Agent mode ignores pnpm's modulesDir: on pnpm 10.12+ every installed package is "not installed", and apply exits 0 leaving it unpatched #661: agent apply patches the copy pnpm installed under <modulesDir>/.pnpm. Before, it exited 0 with the package unpatched as "not installed".
• Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed" #696: hosted standalone vex hash-checks that copy and omits an unpatched one. Before, it attested not_affected from the lock pin.
• Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed" #696, follow-up variants from the issue comment: hosted vex no longer attests a pinned npm package from the lock when the installed pnpm tree keeps its virtual store outside the project (enableGlobalVirtualStore, or a virtualStoreDir that climbs out). A transitive dep there is invisible to the crawler, so "not found" doesn't mean "not installed".

Root cause

pnpm's modulesDir (modulesDir: in pnpm-workspace.yaml, modules-dir= in .npmrc) renames node_modules. From pnpm 10.12 the virtual store moves with it. The npm crawler only collects directories literally named node_modules, plus the roots in configured_install_roots (yarn --modules-folder, Rush). It never read modulesDir. The miss surfaced as the lockfile-only "not installed" skip in agent mode (#661), and the hosted lockfile_basis exemption turned it into an attestation in vex (#696). The same exemption also excused every other crawler blind spot, such as pnpm stores outside the project.

Changes

• crawlers/npm_crawler.rs
  • configured_install_roots now includes pnpm's modules dirs:
    • the configured modulesDir: nearest pnpm-workspace.yaml first, else the nearest .npmrc modules-dir. It is resolved per project, like pnpm does, and honored only strictly inside the project (same guard as yarn's modules folder).
    • any direct child dir holding pnpm's .modules.yaml install record. This catches a modulesDir that came from pnpm's global config or the environment.
  • New pnpm_store_outside_project: true when a .modules.yaml in node_modules or a pnpm modules dir records a virtualStoreDir outside the project.
• commands/vex.rs: the hosted lockfile_basis exemption no longer excuses package_not_found for pkg:npm/ purls when pnpm_store_outside_project holds. With nothing installed (no .modules.yaml) the lock basis still attests, as before.
• CLI_CONTRACT.md (manifest-less VEX hosted row) and CHANGELOG.md document the new behavior.
• No wrapper changes needed: npm/, pypi/ and gem/ only dispatch to the binary.

Test evidence

Red → green: each new test was run with the source fix reverted (tests kept) and failed, then passed with the fix.

Local runs on Linux, Rust 1.93.1:

• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo fmt: the changed files are fmt-clean. main itself isn't fmt-clean under this toolchain and CI doesn't run fmt, so I left unrelated files untouched.
• cargo test --workspace --all-features --no-fail-fast: 9731 passed, 12 failed, 253 ignored. All 12 failures are write-failure / unremovable-file simulations that depend on chmod denying writes. This sandbox runs as root (uid 0), which bypasses that. The 4 core-lib ones (copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched, pypi_requirements::wire_failure_rolls_back_already_written_files) fail identically on origin/main. The others are in covgap_commands_vendor, in_process_redirect and repair, none of which touch the npm crawler or the vex exemption. CI runs non-root.

Follow-ups / not covered

• In agent mode, a transitive dep that lives only in pnpm's global virtual store is still not patched in place. That is deliberate (shared store, Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361/Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362) and not part of these issues.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JKwbXnQ94oRf1r94V1yupy

Generated by Claude Code