GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #852

Summary

With npm 9–11's install-strategy=linked, agent mode now patches, verifies and rolls back an npm alias copy that lives in an alias-named store entry. Before this change:

• Alias plus a plain copy: apply patched only left-pad and exited 0. vex attested not_affected while require('lp') loaded unpatched code.
• Alias only: apply reported "1 not found on disk" (exit 0), and vex omitted the purl as not installed.

Root cause

npm names the store entry for an alias install after the alias: node_modules/.store/[email protected]<hash>/node_modules/lp holds the real [email protected]. Agent mode missed that copy in two places:

• Resolver (NpmCrawler::find_by_purls → visit_resolver_dir): inside a store entry it only probed node_modules/<real name>. The Fix agent mode skipping npm-aliased copies (#356) #738 alias pass (alias_copies) ran on importer trees only.
• Store variant fan-out (find_store_peer_variant_copies, used by apply, rollback and VEX through with_store_peer_variant_copies): it skipped every entry whose dir name advertised another name, then probed node_modules/<real name>.

Fix

• visit_resolver_dir also runs alias_copies on npm linked-store entries (new is_npm_linked_store_entry, which handles .store/<entry> and .store/@scope/<entry>). It counts real dirs only, and the dir's package.json stays the authority on name@version.
• On the NpmLinked layout, find_store_peer_variant_copies probes a same-version entry under another name at node_modules/<advertised name>. That dir must be a real directory, since a link is a dependency edge into another entry. Its package.json must name the target, and the name's components pass is_safe_npm_component.
• No other layout changes. pnpm, Bun, Deno and vlt name store entries after the real package, and Yarn 4's .store entries don't decode as npm entries.
• The npm/PyPI/gem wrappers need no change, because the logic lives in the Rust core.

Ported CI fix: this PR carries 87bbd60, a cherry-pick of #878's "Route Gradle digests through utils::digest". main's utils::digest::tests::production_digests_go_through_the_helpers guard is red: Gradle/JVM/Maven code hashes inline. Without the port, coverage fails for reasons unrelated to this PR. It becomes a no-op once #878 lands.

Test evidence

The issue's repro with a real npm 10.9.4 / Node 22 install-strategy=linked install and the hand-staged [email protected] patch, run with a binary built from main and one built from this branch:

rollback --offline --yes on the alias + plain case restores both copies.

Commands run locally:

• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo fmt --all -- --check: no diffs in files this PR touches. The local rustfmt reports existing diffs in files this PR doesn't touch.
• cargo test -p socket-patch-core --all-features --lib: 5247 passed, 5 failed.
  • 4 of the failures can't pass as root, because the sandbox runs as root and chmod can't make a dir read-only: copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched, pypi_requirements::wire_failure_rolls_back_already_written_files.
  • The 5th, the main digest guard, passes after the port.
• cargo test -p socket-patch-core --all-features --test crawler_npm_e2e --test covgap_crawlers_npm_crawler: 93 passed.
• cargo test -p socket-patch-cli --all-features --test e2e_vex: 19 passed.
• A full cargo test --workspace --all-features couldn't finish here: it hit the sandbox's disk allowance while linking test binaries, with no test failures. CI runs the full matrix.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RL7etZZRZ4tKZVNsPFD3KL

Generated by Claude Code