GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #432

Summary

A lockfileVersion 2 package-lock.json (written by npm 7 and 8) carries
two copies of every install: the packages map that npm 7+ reads, and
the legacy dependencies mirror that npm 6 reads. npm 6 spells an npm
alias install in that mirror as "lp": {"version": "npm:[email protected]"}.
Before this change:

• Hosted scan/get rewired only packages["node_modules/lp"]. The
  alias mirror node silently stayed on the registry.
• Vendored did the same, with only a vendor_legacy_alias_skipped
  warning.
• Lockfile-only vex attested not_affected from the packages
  half while npm 6 npm ci installed the unpatched registry tarball
  (exit 0).
• With a lockfileVersion 1 alias lock, hosted scan pinned nothing
  (redirect_npm_entry_not_found, exit 0).

After this change:

• Hosted rewires the alias mirror node like any other mirror node. npm 6
  then fails closed (EINTEGRITY) instead of installing unpatched bytes,
  and the run warns redirect_npm_legacy_alias_client.
• Vendored rewires it, and npm 6 installs the patched bytes.
• vex withholds the attestation (patched_ref_unattributable) while a
  v2 mirror still resolves the package from the registry. That is the
  state of any lock written before this fix.
• A v1 alias lock gets pinned, with the existing
  redirect_npm_legacy_client npm 6 caveat.

Root cause

Every reader and writer of the legacy dependencies tree identified a
node by its key and version. An alias node's key is the alias and its
version is the npm:<name>@<version> spec, so the node never matched
the patched package. Four call sites had this: the hosted writer
(rewrite_npm_v2_deps), the vendored writer (rewrite_legacy_tree,
which noticed the alias but skipped it), the hosted rollback restorer
(upstream::npm::v2_hits, which would have looked up lp@npm:[email protected]
on the registry), and the lock-inventory walk behind VEX for v1 locks.
VEX also never looked at the v2 mirror, so it could not see that npm 6
would install unpatched bytes.

Fix

• lock_inventory::npm_legacy_identity is the single rule for what a
  legacy node stands for: npm:<name>@<version> decodes to the target,
  including scoped names. Anything else is the key at its own version.
  All four sites use it.
• Hosted writer: alias mirror nodes are rewired. A new
  redirect_npm_legacy_alias_client warning fires for v2 locks when an
  alias node was rewired. v1 locks already carry
  redirect_npm_legacy_client, so the new warning is not repeated there.
• Vendored writer: alias mirror nodes are rewired and recorded for
  revert. vendor_legacy_alias_skipped is gone.
• VEX: new drop_mirror_unwired drops a packages ref when the v2
  mirror resolves the same package from a non-Socket source, and records
  the package as resolved elsewhere, so the sibling npm lock's ref is
  contested too.
• Docs: docs/ecosystems.md and docs/testing/npm-compatibility.md.

What real npm does (probed locally, Node 22.22)

Hosted mode can't make npm 6 install an aliased hosted tarball. So the
fix makes that case fail closed and warn loudly, and the warning points
npm 6 users at vendored mode.

Test evidence

New tests, each red with the fix disabled (identity decode, no mirror
check) and green with it:

The VEX discovery golden (vex-discover-golden/redirect-npm.json) only
gained the two new fixture entries. No existing entry changed.

Local checks:

• cargo fmt --all -- --check: main itself is not fmt-clean with the
  pinned 1.93.1 toolchain (31 pre-existing diffs in redirect/mod.rs,
  CI does not run fmt). This PR adds no new fmt diffs, and the e2e file
  it touches stays fmt-clean.
• cargo clippy --workspace --all-features -- -D warnings: clean
• cargo test --workspace --all-features: 9,730 passed, 253 ignored, 12 failed. All 12 are write-failure tests (*_write_failure_*, *unremovable*, read-only .socket/vendor) that need a non-root user to make chmod stick; this sandbox runs as root (uid 0). None touch npm lock code, and CI runs them as non-root.
• npm e2e: e2e_vendor_npm_build --include-ignored passes in full under npm 10.9.4 and under npm 6.14.18 (lock writer npm 10.9.4), 18/18 each. e2e_redirect_npm_build --include-ignored passes 13/15 under npm 10.9.4 and 14/15 under npm 6.14.18. The failures are the hosted rollback tests, whose live registry.npmjs.org fetch can't verify this sandbox's TLS-intercepting proxy: reqwest is built with bundled webpki roots and ignores SSL_CERT_FILE. That fetch is for a plain (non-alias) package, a path this PR doesn't change, and it runs normally on CI.

Per-issue checklist

• npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 hosted v2 alias mirror: npm_v2_legacy_alias_mirror_is_rewired_and_warned, golden legacy-alias-mirror-v2
• npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 vendored v2 alias mirror: v2_legacy_alias_node_is_rewired_and_reverted, e2e npm6_installs_a_vendored_v2_alias_from_its_legacy_mirror
• npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 VEX attesting while npm 6 installs unpatched: v2_alias_mirror_left_on_the_registry_contests_the_ref, stale_alias_mirror_contests_the_sibling_lock_ref
• npm v2 lock: aliased packages stay on the registry in the legacy dependencies mirror (hosted silently, vendored with a warning), so npm 6 installs unpatched bytes while VEX attests not_affected #432 v1 alias lock pinning nothing: npm_v1_alias_entry_is_rewired, lockfile_v1_alias_node_is_its_target
• rollback of an alias mirror pin: upstream_restore_golden round trip

Follow-ups

None. The npm/pypi/gem wrappers only dispatch to the binary, so they
need no change.

🤖 Generated with Claude Code

Generated by Claude Code