GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Fix vendored npm-family tarballs dropped by .gitignore (#831) by mikolalysenko · Pull Request #837 · SocketDev/socket-patch

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Collaborator

LLM Description written by Claude Code:claude-opus-5-5

Fixes #831

Summary

Vendored mode in a yarn classic, yarn berry, npm, pnpm or bun project wrote .socket/vendor/npm/<uuid>/<name>-<ver>.tgz without checking whether git would commit it. GitHub's stock Node.gitignore ships *.tgz, and polyglot repos often ignore vendor/ or .socket/. Under any of these rules the scan exited 0 with no warning. The commit then kept the rewired lockfile and dropped the tarball, so every fresh checkout's frozen install failed. Under vendor/ or .socket/, vendor --check also passed, because it had no ledger left to check.

Root cause

All npm-family tarball backends stage their artifact through npm_common::stage_patch_pack. The vlt and directory paths already guard this with npm_dir::gitignore_probe, refusing with vendor_artifact_gitignored and writing a <uuid>/.gitignore that re-includes the payload. The shared tarball pipeline had neither, so the gap covered every tarball flavor, not just yarn classic (the yarn berry matrix in the issue comment is the same gap).

Changes

stage_patch_pack (crates/socket-patch-core/src/vendor/npm_common.rs)
- Before any write, dry run included: git check-ignore --no-index on <uuid>/. A rule that ignores the directory itself (vendor/, .socket/, .socket/vendor/) refuses with vendor_artifact_gitignored, naming the rule.
- After the tarball is in place (fresh or reused): writes <uuid>/.gitignore (!*) and <uuid>/.gitattributes (-text), the same files and content as vlt. This overrides file rules such as *.tgz.
- It then re-probes the tarball and both metadata files. If they are still ignored, it refuses and removes a uuid dir this run created. If git can't answer, it warns with vendor_artifact_gitignore_unchecked. Outside a git work tree nothing changes.
vendor --check (commands/vendor.rs): reads the lockfile references (repair::scan_vendor_references, the scan repair and the orphan sweeps use). Each .socket/vendor/<eco>/<uuid>/ that no ledger entry owns fails with vendor_ledger_missing, using the same artifact-level shape repair emits (uuid + details.{ecosystem,path}). A reference whose manifest key was already reported as unledgered is not reported twice.
CLI_CONTRACT.md: the vendor_artifact_gitignored / _unchecked rows now cover the tarball flavors. The vendoring table names the uuid .gitignore/.gitattributes. The vendor --check section documents the lock-reference check.

The npm/PyPI/gem wrappers only dispatch to the binary, so they need no parallel change.

Test evidence (red without the fix, green with it)

Issue scenario	Test	Without fix	With fix
#831 `*.tgz` (shared pipeline)	`npm_common::tests::a_tgz_ignore_rule_is_overridden_by_the_uuid_gitignore`	FAIL	pass
#831 `vendor/`, `.socket/`, `.socket/vendor/` (wet and dry)	`npm_common::tests::a_directory_ignore_rule_refuses_before_any_write`	FAIL	pass
control: no work tree	`npm_common::tests::no_work_tree_stages_without_a_refusal`	pass	pass
#831 yarn classic `*.tgz`: real yarn 1.22.22, `git commit` then `git clone`, `--frozen-lockfile --offline` installs the patched bytes	`e2e_vendor_yarn_classic_build::yarn_classic_vendored_tarball_survives_a_tgz_gitignore_rule`	FAIL	pass
#831 `vendor --check` on a clone without ledger/manifest fails `vendor_ledger_missing`	same test, final block (red with only the vendor.rs change reverted)	FAIL	pass
#831 yarn classic `vendor/` and `.socket/`: refused, yarn.lock untouched, nothing written	`e2e_vendor_yarn_classic_build::yarn_classic_vendor_refuses_a_gitignored_vendor_dir`	FAIL	pass
#831 yarn berry `*.tgz`: real yarn 4.12.0, clone then `yarn install --immutable` with an empty global folder installs the patched bytes	`e2e_vendor_yarn_berry_build::yarn_berry_vendored_tarball_survives_a_tgz_gitignore_rule`	FAIL	pass
#831 yarn berry `.socket/`: refused, yarn.lock and package.json untouched	`e2e_vendor_yarn_berry_build::yarn_berry_vendor_refuses_a_gitignored_socket_dir`	FAIL	pass

Local runs (Linux, as root):

cargo clippy --workspace --all-features -- -D warnings: clean.
cargo test -p socket-patch-core --all-features --lib: 4845 passed, 4 failed. The 4 failures are permission tests that rely on chmod read-only dirs, which root bypasses (copy_tree, vlt_heal, pypi_poetry, pypi_requirements). This PR doesn't touch those modules.
cargo test -p socket-patch-cli --all-features --lib: 834 passed.
CLI suites passed: in_process_vendor 104, e2e_vendor_yarn_classic_build 13, e2e_vendor_yarn_berry_build 16, e2e_vendor_npm_build 17, e2e_vendor_pnpm_build 16, e2e_vendor_bun_build 14, e2e_bun_lockb 12, in_process_vendor_bun_takeover 20, scan_vendor_e2e 33, in_process_rollback_vendored 6, e2e_vex_vendor 23, e2e_vendor_yarn_classic_dev_flow 11, e2e_yarn4_workspaces_build 13, e2e_yarn4_pnpm_linker_build 15, cli_parse_vendor 32, e2e_vendor_vlt_build 25, coverage_fix_vendor_silent_mute_exit 3.
Root-only failures:
- covgap_commands_vendor: 41 passed, 3 failed (*_state_write_failure_*, which chmod 0o555 the vendor dir). The same 3 fail on main as root.
- repair: 114 passed, 2 failed (unremovable-file tests, same class).
A full cargo test --workspace doesn't fit this sandbox's disk allowance, so the CI matrix covers the rest.
cargo fmt --all -- --check isn't clean on main with the pinned toolchain's rustfmt, and CI doesn't run it. The new code follows the surrounding style and no unrelated files are reformatted.

Notes

An earlier push (002c870) briefly carried an accidental repo-wide rustfmt reformat that touched PDM files, which triggered the path-filtered PDM compatibility workflow. Its extras agent cell failed on that head. That head is superseded: the current branch touches only the six files above, and PDM compatibility doesn't run on it.
Follow-up, out of scope: Vendored Gradle exits 0 when the project's .gitignore excludes *.jar, so the commit silently drops the patched jar and every fresh checkout fails to build #620 (vendored Gradle under *.jar) is the same symptom in a different backend.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FMZyKmgYNAridSR5eqv999

Note

Medium Risk
Changes core vendoring and pre-takeover ordering for npm-family lockfiles; mistakes could block vendoring or leave hosted wiring, but the design is fail-closed rather than silently dropping tarballs from commits.

Overview
Vendored npm-family tarball flows (npm, yarn classic/berry, pnpm, bun) now treat git ignore rules like the existing vlt/directory path: refuse before writing when the uuid directory itself would be ignored, write <uuid>/.gitignore and .gitattributes to re-include *.tgz (and similar file rules), then re-probe and roll back if the artifact still would not be committed. A new npm_tarball_gitignore_preflight runs on hosted→vendored takeover before restoring the registry lock entry, so a .socket/ ignore does not leave the package wired only to hosted mode.

vendor --check also scans lockfiles for .socket/vendor/<eco>/<uuid>/ references with no matching ledger entry and fails with vendor_ledger_missing (artifact-level event, aligned with repair), including cases the manifest alone cannot see.

Docs in CLI_CONTRACT.md are updated for tarball flavors and the check behavior. JVM/Gradle code paths switch to shared sha1_hex_of / sha256_hex_of helpers (no behavior change). E2E and in-process tests cover *.tgz, vendor/, .socket/, clone/install, and check-on-missing-ledger.

^{Reviewed by Cursor Bugbot for commit d07dda2. Configure here.}

Generated by Claude Code

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Start fix for #831

10bdcdc

Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) mentioned this pull request

Oct 5, 2026

Vendored yarn classic exits 0 when .gitignore covers the vendored tarball (*.tgz, vendor/, .socket/), so the commit drops it and every fresh checkout's install fails #831

Closed

Claude (claude) added 2 commits

October 5, 2026 07:48


          Keep vendored npm tarballs out of .gitignore

4bc58ab

Vendoring into a yarn classic, yarn berry, npm, pnpm or bun project
wrote .socket/vendor/npm/<uuid>/<pkg>.tgz without checking whether git
would commit it. Under Node.gitignore's `*.tgz`, or a `vendor/` or
`.socket/` rule, the scan reported success, the commit dropped the
tarball, and every fresh checkout's install failed.

The shared tarball staging now refuses with vendor_artifact_gitignored
before writing anything when a rule ignores the uuid dir itself. After
writing, it adds <uuid>/.gitignore (re-including the tarball against
rules like `*.tgz`) and .gitattributes, as vlt already does, and checks
the written paths again.

Refs #831

Assisted-by: Claude Code:claude-opus-5-5


          Fail vendor --check on unledgered lock references

617b8e3

When the vendor ledger and manifest were ignored or dropped from a
commit, `vendor --check` found nothing to compare and exited 0, while
the lockfile still pointed at .socket/vendor/<eco>/<uuid>/ and every
fresh install failed. The check now reads the lockfile references
(the same scan repair uses) and reports each one no ledger entry owns
as vendor_ledger_missing.

Refs #831

Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) force-pushed the agent/fix-npm-tarball-gitignore branch from 002c870 to 617b8e3 Compare

October 5, 2026 07:48


          Document the vendored tarball's uuid .gitignore

469b7f2

The contract's vendoring table now says every npm-family tarball flavor
writes <uuid>/.gitignore and .gitattributes next to the tarball, and
refuses vendor_artifact_gitignored when git would still drop it.

Refs #831

Assisted-by: Claude Code:claude-opus-5-5

github-advanced-security Bot found potential problems

Oct 5, 2026

View reviewed changes

Comment thread

crates/socket-patch-cli/src/commands/vendor.rs Fixed

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) marked this pull request as ready for review

October 5, 2026 07:59

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

BugBot review

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.


          Keep patch uuids out of vendor --check messages

5d7c6e4

CodeQL flagged the new unledgered-reference message for printing the
patch uuid. The human line and error detail now name only the
ecosystem; the JSON event still carries the uuid and path as repair's
event does.

Refs #831

Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

BugBot review

Generated by Claude Code

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 5, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 5, 2026

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

Ready for review (burn-down agent).

Head: 5d7c6e4be3
CI: 410/410 check runs green (6 skipped, 1 neutral, 0 failing)
Cursor Bugbot: reviewed 5d7c6e4be3, no open findings. The single earlier thread on vendor.rs is resolved and outdated.
Reviewer focus: the new git check-ignore --no-index preflight in npm_common::stage_patch_pack and the <uuid>/.gitignore re-include written after staging.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) removed the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 5, 2026


          Merge main into fix-npm-tarball-gitignore

Resolve conflicts in CLI_CONTRACT.md (keep both the #588 drift note and
the unowned-lockfile-reference ledger note) and the yarn classic e2e
tests (keep both the #831 gitignore tests and main's #664 test).

Co-Authored-By: Claude <[email protected]>

Mikola Lysenko (mikolalysenko) mentioned this pull request

Oct 5, 2026

Spawn every CLI test child through one hermetic Command builder; 10 test files inherit ambient SOCKET_* today #823

Closed

5 tasks

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

bugbot run

Generated by Claude Code

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 5, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Mikola Lysenko (mikolalysenko) mentioned this pull request

Oct 5, 2026

Spawn CLI test children through one hermetic Command builder (#823) #850

Merged

Claude (claude) added 2 commits

October 5, 2026 12:29


          Merge remote-tracking branch 'origin/main' into agent/fix-npm-tarball…

87c8b53

…-gitignore


          Port #851: fix vex alias tests broken by the store-copy merge

9334fe9

main's #605 made the name-keyed npm resolver reach alias and peer
copies itself, which broke two vex_consumed tests that assumed an
alias-blind resolver. Same change as #851, ported so this PR's CI
runs green against the current base; it no-ops once #851 lands.

Refs #831

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01FMZyKmgYNAridSR5eqv999

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

coverage and test-release failed on 6494750 because of main, not this PR. Two tests failed: commands::vex_consumed::tests::hosted_expands_alias_only_copies and hosted_reuses_expanded_npm_copies_and_merges_alias_variants. Both also fail on main at 4646693: #605 changed the npm resolver, and these tests still assume the old behavior. #851 has the fix. I merged main and ported #851's test change as 9334fe9. Locally, socket-patch-cli --lib passes (840 tests) and workspace clippy is clean. Once #851 lands, the ported change has no further effect.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Tanmay Singla (Tanmay182003) reviewed

Oct 5, 2026

View reviewed changes

Comment thread

crates/socket-patch-core/src/vendor/npm_common.rs Resolved

Uh oh!

There was an error while loading. Please reload this page.


          Refuse a gitignored vendor dir before the hosted takeover

bf356dd

The tarball gitignore refusal only ran inside stage_patch_pack, which
the hosted->vendored takeover reaches after restore_upstream has
already removed the hosted pin. In a hosted project that ignores
.socket/, vendoring then restored the registry entry and refused,
leaving the package patched in neither mode. The npm takeover
preflight now runs the same uuid-dir probe before the restore, as
vlt's preflight already does.

Refs #831

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01FMZyKmgYNAridSR5eqv999

Tanmay Singla (Tanmay182003) approved these changes

Oct 5, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

BugBot review

Generated by Claude Code

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 5, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

[agent] Head bf356dd is green: 455 checks passed, 6 skipped by matrix rule, 0 failed. Cursor Bugbot reviewed this head and posted no new findings, and no review threads are open. The approval is on this head and the PR is mergeable. It is waiting on a maintainer to merge.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 5, 2026

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

Burn-down agent: labeled Ready for review at bf356dd.

CI: 455 success + 6 skipped, 0 failing; mergeable clean against main.
Bugbot: Cursor Bugbot check passed on bf356dd; 0 unresolved review threads.
Linked issue(s) still open and not fixed on main.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) removed the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 5, 2026

This was referenced Oct 5, 2026

Crawler probes spawn gem, python and npm with no timeout, so a hung shim hangs scan forever #845

Closed

Bound crawler and tool probes through one spawn deadline (#845) #886

Merged


          Merge origin/main into agent/fix-npm-tarball-gitignore

508a598

Resolved conflict in crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_build.rs:
both sides appended new tests at the same spot (this branch's #831
.gitignore tests and git/gitignored_fixture helpers; main's #627
symlinked-yarn.lock refusal test). Kept both in full; rustfmt applied.

Co-Authored-By: Claude <[email protected]>

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

bugbot run

Generated by Claude Code

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 5, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Claude (claude) added 2 commits

October 5, 2026 19:23


          Merge remote-tracking branch 'origin/main' into agent/fix-npm-tarball…

95a0ddd

…-gitignore


          Port #878: route Gradle digests through utils::digest

d07dda2

main's #865 added a test that fails when production code computes
digests inline; the Gradle cache, JVM jar and Maven sidecar code
landed with inline sha1/sha256 calls, so main's coverage and
test-release jobs fail production_digests_go_through_the_helpers.
Same change as #878, ported so this PR's CI runs green against the
current base; it no-ops once #878 lands.

Refs #831

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01FMZyKmgYNAridSR5eqv999

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 5, 2026

View reviewed changes

cursor Bot left a comment

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit d07dda2. Configure here.}

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

[agent] Head d07dda2 is green apart from CodeQL: 463 checks passed, 6 were skipped by matrix rules, and none failed. I re-ran every job the runner outage had cancelled once, and all of them passed. Cursor Bugbot reviewed this head (21:28Z) and found no new issues.

The CodeQL default-setup Analyze (python), Analyze (rust) and Analyze (javascript-typescript) jobs in run 37363841255 were also cancelled by the outage before they could run. GitHub refuses to re-run that dynamic run through the API (403 Jobs in this workflow run cannot be re-run). A maintainer needs to click "Re-run all jobs" on https://github.com/SocketDev/socket-patch/actions/runs/37363841255. When CodeQL passes, this PR is ready for review again. The earlier approval was on bf356dd, so it needs re-approval.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 6, 2026

Mikola Lysenko (mikolalysenko) commented Oct 6, 2026

Copy link

Copy Markdown

Collaborator Author

[agent] Ready for review at d07dda2. CI: 463 checks green, 0 failing. The only non-green items are the CodeQL default-setup Analyze (python/rust/javascript-typescript) jobs, which the runner outage cancelled. They aren't required, and a maintainer can re-run them from https://github.com/SocketDev/socket-patch/actions/runs/37363841255 if wanted. Bugbot reviewed d07dda2 with no findings. The earlier approval was on bf356dd, so this needs re-approval.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) merged commit 6fa6a9e into main

Oct 7, 2026

642 of 759 checks passed

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) deleted the agent/fix-npm-tarball-gitignore branch

October 7, 2026 12:01

This was referenced Oct 8, 2026

Vendored bun.lockb workspaces write the member-relative tarball mirrors with no .gitignore check, so a *.tgz rule drops them from the commit and fresh frozen installs fail (Bun 1.1.39–1.2.23) or hang (1.3.9) #1116

Closed

Fix git-ignored bun.lockb workspace mirrors (#1116) #1442

Merged

Mikola Lysenko (mikolalysenko) mentioned this pull request

Oct 15, 2026

Vendored PyPI wheels aren't checked against .gitignore or Git LFS rules (*.whl, .socket/), so a vendored Pipenv scan exits 0 and every fresh clone's pipenv sync fails #1572

Closed

Reviewers

cursor[bot]

cursor[bot] left review comments

Tanmay Singla (Tanmay182003)

Tanmay182003 approved these changes

+1 more reviewer

github-advanced-security[bot]

github-advanced-security[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

Ready for review

Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Vendored yarn classic exits 0 when .gitignore covers the vendored tarball (*.tgz, vendor/, .socket/), so the commit drops it and every fresh checkout's install fails

Uh oh!

There was an error while loading. Please reload this page.

4 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

LLM Description written by Claude Code:claude-opus-5-5

Summary

Root cause

Changes

Test evidence (red without the fix, green with it)

Notes

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 6, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.