Bug hunt ledger: pnpm

[Mikola Lysenko (mikolalysenko)]

[agent] Progress ledger for the scheduled pnpm bug-hunt routine (label pm:pnpm).

Last updated: 2026-10-03 (run 14), main 045d7ec, latest release 4.0.0.

Method: real pnpm installs. Hosted, vendored and global agent mode run against a local Python mock of the patch API (batch, by-package, view with inline blobs, package grant, hosted tarball, /registry/<name>/<ver> mirror). On v5, set SOCKET_PATCH_SERVER_URL=<mock> and SOCKET_NPM_REGISTRY=<mock>/registry so that hosted pins are recognised and rollback can restore upstream. The oracle is a marker prepended to index.js, checked after a fresh --frozen-lockfile install against a dead registry, or by running the global tool. The repo's pinned matrix (.github/workflows/pnpm-compatibility.yml) already covers plain hosted and vendored installs on pnpm 1–12. This ledger tracks what it doesn't.

Coverage matrix

Project modes (cells before run 3 were tested on main f6b7fb9; "v5" marks cells re-run on 2463257):

OS	pnpm	Agent: default .pnpm	Agent: global virtual store	Agent: custom virtualStoreDir	Agent: hoisted	Vendored: plain / hoisted	Vendored: workspace-file edge shapes	Hosted: plain / catalog	Hosted: trustLockfile edge shapes	Takeover vendored ⇄ hosted
Linux	7.33.7	untested	n/a	untested	untested	untested	n/a	pass (lock 5.4)	n/a (no trust)	untested
Linux	8.15.9	pass	n/a	pass (#365)	untested	untested	n/a	pass (lock 6.0)	n/a (no trust)	untested
Linux	9.15.9	pass	n/a	pass (#365)	untested	untested	untested	pass / pass; v5 rollback pass	untested	untested
Linux	10.0.0	untested	n/a	untested	untested	untested	pass (10.0 ignores user overrides)	untested	untested	untested
Linux	10.5.2 / 10.12.1	untested	fail #362 (10.12.1; #361 fixed)	untested	untested	untested	fail #360	untested	untested	untested
Linux	10.34.5	pass	#361 fixed (refusal); fail #362	pass (#365)	untested	pass	fail #360 (v5 too)	pass / pass; v5 rollback pass	fail #400 #402	untested
Linux	11.27.0 / 11.28.3	pass	#361 fixed (refusal); fail #362	pass (#365)	pass	pass	fail #400 #402	pass / pass; v5 rollback pass	fail #400 #402; pass CRLF, no-EOL, comment	v5 pass (#401 closed: pnpm_trust_lockfile_left warning)
Linux	12.8.1	pass	#361 fixed (refusal); fail #362	pass (#365)	untested	pass; fail #466 with packageManager (two-doc lock)	fail #400 #402	pass / pass; v5 rollback pass; two-doc lock pass	fail #400 #402	v5 pass (#401 closed); vendored→hosted on two-doc lock fail #466
macOS	10.34.5	pass	n/a on CI (pnpm 10 disables it)	fail #362	untested	untested	untested	untested	untested	untested
macOS	11.27.0 / 12.8.1	pass	#361 fixed (refusal); fail #362	fail #362	untested	untested	untested	untested	untested	untested
Windows	10.34.5	pass	n/a on CI	fail #362	untested	untested	untested	untested	untested	untested
Windows	11.27.0 / 12.8.1	pass	#361 fixed (refusal); fail #362	fail #362	untested	untested	untested	untested	untested	untested

Run 6 additions (main 61cfb9b, Linux):

pnpm	Hosted: sharedWorkspaceLockfile: false	Hosted: configDependencies (two-doc on 11+)	Vendored: configDependencies	Hosted: catalogs / peer-suffixed instances	Hosted: node-linker=hoisted	Agent: hard-linked CAS store
8.15.9	fail #492	untested	untested	untested	untested	untested
9.15.9	fail #492	n/a	n/a	pass / pass	pass	pass (hardlink broken, store pristine)
10.34.5	fail #492	pass (single doc)	pass	pass / untested	untested	untested
11.28.3	fail #492	pass (both docs pinned)	fail #466 (wrong doc, success)	pass / pass	untested	untested
12.8.1	fail #492	pass (both docs pinned)	fail #466 (wrong doc, success)	pass / pass	pass	pass

Run 7 additions (main 61cfb9b, Linux):

pnpm (lock)	Agent: transitive apply / rollback	Hosted: pin → fresh frozen → rollback	Agent: peer-suffixed	Alias npm: agent / hosted	Hosted: injected	Rush (hosted / vex / agent transitive)
2.25.7 (shrinkwrap.yaml, Node 10)	pass	pass, byte-exact	untested	untested	n/a	n/a
3.8.1 (5.1, Node 16)	pass	pass, byte-exact	untested	untested	n/a	n/a
4.14.4 (5.1)	pass	pass, byte-exact	untested	untested	n/a	n/a
5.18.10 (5.2)	pass	pass, byte-exact	untested	untested	n/a	n/a
6.35.1 (5.3)	pass	pass	untested	untested	n/a	n/a
7.33.7 (5.4)	untested	pass	untested	untested / pass	untested	untested
8.15.9 (6.0)	untested	pass	untested	untested / pass	pass	pass / fail #518 / untested
9.15.9 (9.0)	pass	pass	pass	pass / pass	blocked (upstream pnpm bug)	pass / fail #518 / fail #518
11.28.3	untested	pass	untested	untested / pass	untested	untested
12.8.1	pass	pass	pass	pass / pass	pass	untested

Run 8 additions (main 61cfb9b, Linux):

pnpm (lock)	Agent: hoisted + npm alias (two copies)	Agent: patchedDependencies instance	Hosted: patchedDependencies (other file / same file)	Hosted: scoped pkg	Agent: import-method copy / hardlink, hoisted, alias	Vendored: legacy lock	Hosted: legacy workspace (member dep)
5.18.10 (5.2) / 6.35.1 (5.3)	untested	untested	untested	untested	untested	pass (loud vendor_lockfile_version_unsupported)	untested
7.33.7 (5.4)	untested	pass	untested	pass	pass	pass; moved checkout: documented recovery + byte-exact rollback; workspace refused as documented	pass
8.15.9 (6.0)	untested	pass	pass / pass	pass	untested	pass, same as 7	pass
9.15.9	fail #356	pass	pass / pass (vex declines same-file)	pass	untested	n/a	n/a
10.34.5	fail #356	pass	pass / pass	untested	pass	n/a	n/a
11.28.3	untested	n/a (package.json field ignored)	pass / pass	untested	pass	n/a	n/a
12.8.1	fail #356	n/a (package.json field ignored)	pass / pass	pass	untested	n/a	n/a

Run 9 additions (main 61cfb9b, Linux):

pnpm	Hosted: gitBranchLockfile (both locks / branch lock only)	Hosted: lockfileIncludeTarballUrl pin + fresh frozen	Rollback byte-exact with tarball URLs	Hosted: catalog + patchedDependencies + overrides	Hosted from workspace member cwd
9.15.9	n/a (no branch lock written)	pass	fail #557	untested	untested
10.34.5	fail #556 / untested	pass	untested	untested	untested
11.28.3	fail #556 / untested	untested	untested	untested	untested
12.8.1	fail #556 / fail #556	pass	fail #557	pass (vex, rollback)	no-op + redirect_npm_no_lockfile (not filed; see #417)

Run 10 additions (main 203e092, Linux):

pnpm	Agent: isolated / hoisted transitive (post-#486/#555)	Agent: GVS direct	Agent: GVS transitive	Hosted: member cwd / lockfile-dir=..	Vendored: member cwd	Vendored: gitBranchLockfile	Rush hosted / vex / agent transitive
8.15.9	pass / pass	n/a	n/a	untested	untested	n/a	untested
9.15.9	pass / pass	n/a	n/a	fail #590 / fail #590	pass (fails closed)	n/a	pass / pass (#518 fixed) / pass
10.34.5	pass / pass	untested	untested	fail #590 / fail #590	untested	fail #556 (frozen install breaks)	untested
11.28.3	pass / pass	untested	untested	fail #590 / n/a	untested	fail #556	untested
12.8.1	pass / pass	pass (#361 fixed: loud refusal)	fail #362 (now exit 0 since #555)	fail #590 / fail #590	pass (fails closed)	fail #556	untested

Run 11 additions (main 045d7ec, Linux):

pnpm (lock)	Vendored after #583: plain / transitive / user override (frozen, vex, revert)	Vendored: 2+ packages, revert / rollback byte-exact	Agent: workspace member links (event counts)	Agent: bundled copy in another store entry (isolated / hoisted)
7.33.7 (5.4)	pass / pass / pass	fail #636 (package.json)	untested	untested
8.15.9 (6.0)	pass / pass / pass	fail #636 (package.json)	untested	fail #601 / pass
9.15.9	untested	fail #636 (package.json + workspace)	fail #633 (hoisted pass)	fail #601 / pass
10.34.5	untested	fail #636	untested (Bun saw it on 10.28.0)	fail #601 / pass
11.28.3	untested	fail #636	untested	fail #601 / pass
12.8.1	untested	fail #636 (also 3 packages, also rollback)	fail #633 (hoisted pass)	fail #601 / pass

#636 first bad commit: 09956d90 (#247). Release 4.0.0 is byte-exact.

Run 12 additions (main 045d7ec, Linux):

pnpm	Agent: workspace:* member / link: dir / file: dir named like a patched pkg (#626)	Agent: modulesDir: deps	Agent: node-linker=pnp	Agent: virtualStoreDirMaxLength (hashed dirs)
7.33.7 / 8.15.9	fail #626 / fail #626 / pass	pass (store stays in node_modules/.pnpm)	untested	untested
9.15.9	fail #626 / fail #626 / pass (PR #634 refuses)	pass	pass	pass
10.0.0 – 10.11.1	untested	pass	untested	untested
10.12.0 – 10.34.5	fail #626 (10.28.0)	fail #661 (first bad pnpm 10.12.0)	untested	untested
11.28.3	fail #626 / fail #626 / pass	fail #661	untested	untested
12.8.1	fail #626 / fail #626 / pass (PR #634 refuses)	fail #661 (also workspace)	pass	pass

Run 13 additions (main 045d7ec, Linux):

pnpm	Hosted standalone vex over the upstream install: modulesDir	GVS transitive	virtualStoreDir outside project, transitive	virtualStoreDir in project, transitive	pnpm patch-commit after hosted pin, then rollback + fresh frozen
9.15.9	pass (store stays in node_modules/.pnpm)	n/a	untested	untested	pass
10.11.1	pass	n/a	untested	untested	untested
10.12.0 / 10.34.5	fail #696	n/a on CI	untested	pass	pass
11.28.3	fail #696	fail #696 (#362 root)	fail #696	untested	pass
12.8.1	fail #696	fail #696 (#362 root)	fail #696	pass	pass

#696 first bad commit: cf8150b (#251). Release 4.0.0 is honest with modulesDir.

Run 14 additions (main 045d7ec, Linux, Rush 5.180.0):

pnpm	Rush hosted: clean-clone rush install	Rush subspaces hosted (prevent off / preventManualShrinkwrapChanges)	Rush agent scan / vex --product / rollback	Hosted remove one of two pins / last pin	Hosted tarball-URL dep	Hosted pin survives --no-prefer-frozen-lockfile
8.15.9	pass	untested	untested	untested	untested	untested
9.15.9	pass (run 10)	untested / fail #714	pass (run 10)	untested	untested	pass
10.34.5	pass	pass / fail #714	untested	untested	untested	pass
11.0.0	fail #713 (upstream installed, exit 0)	untested	untested	untested	untested	untested
11.28.3	fail #713 (ERR_PNPM_TARBALL_URL_MISMATCH; env trust → upstream)	untested / fail #714	pass	untested	untested	fail (upstream pnpm, in #713)
12.8.1	fail #713 (ERR_PNPM_TARBALL_URL_MISMATCH; env trust → pass)	untested	untested	pass / pass (byte-exact, scaffold deleted)	pass	pass

Default isolated linker + alias: pass on 7.33.7 / 9.15.9 / 10.34.5 / 11.28.3 / 12.8.1 (one shared .pnpm copy).

#492 also reproduces on pnpm 7.33.7 (there's no root lock at all, only redirect_pnpm_no_lockfile).

Hosted --frozen-lockfile [--offline] over an upstream node_modules or warm store (run 5): VEX stays honest on 9.15.9 / 10.34.5 / 11.28.3 / 12.8.1 (pass).

"Edge shapes" means a whole-document flow mapping, a ... document end, and quoted or key : top-level keys.

Global mode (-g, v5 main 2463257):

OS	pnpm	pnpm root -g layout	scan -g report (direct)	scan -g transitive	get/apply -g direct	rollback -g	vex -g	duplicate copies across install groups	--mode hosted refusal
Linux	7.33.7 / 8.15.9 / 9.15.9 / 10.34.5	global/5/node_modules, virtualStoreDir: ../.pnpm	pass	fail #362 (fixed by PR #365)	pass	pass, byte-exact	pass	n/a (one shared .pnpm)	pass (9, 11)
Linux	11.0.0 / 11.27.0 / 11.28.3 (default)	global/v11/<hash>/ → global virtual store store/v11/links	pass	fail #362 (GVS half; also #361)	pass (writes the shared links dir)	pass	untested	pass (one shared copy)	pass
Linux	11.28.3, enableGlobalVirtualStore: false	global/v11/<hash>/node_modules/.pnpm	untested	untested	pass	untested	untested	fail #435	untested
Linux	12.4.2 / 12.8.1 / 12.8.2	global/v11/<hash>/node_modules/.pnpm	pass	pass	pass	pass, byte-exact	pass	fail #435 (regression since b32711f)	pass
Linux	any	unwritable global prefix	blocked (sandbox runs as root)
macOS / Windows	all		untested	untested	untested	untested	untested	untested	untested

Backlog

0. Maintainer request (global -g mode): the Linux cells are done. Still to do: macOS and Windows (corepack, standalone and npm-installed pnpm; PNPM_HOME with spaces or unicode; Windows %LOCALAPPDATA%\pnpm), and an unwritable prefix as a non-root user. Full checklist in the 20261001T040000Z entry. Needs a probe branch.
1. Delete the stale probe branch bughunt/pnpm/20260930-virtual-store. git push --delete failed through the git proxy in runs 1, 3 and 10, and was denied by the permission policy in runs 2, 5–9 and 11–14, so a maintainer needs to do it. macOS and Windows probes stay on hold until branch cleanup works.
2. Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed" #696 / Agent mode ignores pnpm's modulesDir: on pnpm 10.12+ every installed package is "not installed", and apply exits 0 leaving it unpatched #661 follow-ups: modulesDir in the global config.yaml / rc, and modulesDir + virtualStoreDir together. When fixed, check that GVS and out-of-project virtualStoreDir transitive deps also stop attesting.
3. Vendored pnpm with two or more packages: vendor --revert and rollback leave an empty pnpm.overrides in package.json and (lockfile 9.0) a scaffolded pnpm-workspace.yaml behind #636 follow-ups: a hosted → vendored takeover with several packages, then revert, and a user-created pnpm table with several vendored packages.
4. Hosted remove on legacy locks (5.4 / 6.0), on a two-document lock (pnpm 12 packageManager), and vendored remove.
5. Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 GVS transitive and Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435 global -g: re-check exit codes under Fix apply failing when patched deps are skipped (#403) #555's skip semantics on 11.28.3 / 12.8.1.
6. package-import-method=clone on reflink (needs CI).
7. Hosted scan with pnpm gitBranchLockfile pins the stale pnpm-lock.yaml and reports success, while pnpm installs unpatched bytes from pnpm-lock.<branch>.yaml #556 follow-ups: merging branch lockfiles after a hosted pin, and agent vex on the branch.
8. Re-verify Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360, Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362, Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435, Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466, Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492, Hosted scan with pnpm gitBranchLockfile pins the stale pnpm-lock.yaml and reports success, while pnpm installs unpatched bytes from pnpm-lock.<branch>.yaml #556, Hosted pnpm rollback drops the upstream tarball: URL from locks written with lockfileIncludeTarballUrl, so the restore isn't byte-exact #557, Hosted scan/get run from a pnpm workspace member (or with lockfile-dir=..) ignores the parent pnpm-lock.yaml and reports success while pinning nothing #590 (PR Fix hosted scan from a workspace member pinning nothing or the wrong files (#590, #417) #598), Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601 (PR Fix npm store copies missed by agent apply and vex (#601, #603) #605), Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 (PR Fix agent mode patching linked first-party source (#626) #634), Agent-mode apply in a pnpm workspace reports each member-linked package twice, inflating the --json skipped count with duplicate already_patched events #633, Vendored pnpm with two or more packages: vendor --revert and rollback leave an empty pnpm.overrides in package.json and (lockfile 9.0) a scaffolded pnpm-workspace.yaml behind #636, Agent mode ignores pnpm's modulesDir: on pnpm 10.12+ every installed package is "not installed", and apply exits 0 leaving it unpatched #661 / Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed" #696 (PR Fix pnpm modulesDir store being skipped (#661, #696) #698), Hosted scan on a Rush repo with pnpm 11/12 reports success, but rush install then fails with ERR_PNPM_TARBALL_URL_MISMATCH, or (pnpm 11.0.0) silently installs the upstream package #713 and Hosted scan on a Rush repo with subspaces never emits redirect_rush_repo_state_stale, so rush install fails on the shrinkwrap hash check with no warning #714 when fixes land.
9. Vendored on Windows and macOS (autocrlf: expect the vendor_lockfile_crlf_unsupported refusal; check that hosted handles the same checkout).

Known non-bugs

• patches-api.socket.dev and (for the Rust client) registry.npmjs.org are unreachable from the sandbox. Mock the API and point SOCKET_NPM_REGISTRY at a mirror.
• v5 recognises hosted pins only on the configured patch server. Against a mock without SOCKET_PATCH_SERVER_URL, rollback says "Manifest not found". That's a fixture artifact.
• v5 hosted rollback and takeover keep a user-edited trustLockfile: true and warn pnpm_trust_lockfile_left. A workspace file that exactly matches hosted mode's scaffold is deleted, including a user's own packages: ['.'] file that the trust append made identical to it (CLI_CONTRACT, upstream restore).
• pnpm 10 ignores enableGlobalVirtualStore when CI is set, so the global-virtual-store cells don't engage on GH runners with pnpm 10.
• pnpm 12 (and 11) ignore .npmrc for virtual-store-dir / enable-global-virtual-store. Put them in pnpm-workspace.yaml, or in the global config.yaml.
• pnpm 11+ pnpm root -g / pnpm add -g fail unless $PNPM_HOME/bin is on PATH. Put it there in fixtures.
• Vendored refusals that are intended, loud and fail-closed: a CRLF pnpm-lock.yaml or pnpm-workspace.yaml (vendor_lockfile_crlf_unsupported), a BOM package.json (vendor_pkg_json_unsupported), an inline / flow overrides: mapping (vendor_override_conflict, unit-tested), and patchedDependencies on the target (vendor_lock_entry_unsupported; the detail wrongly says "peer-suffixed snapshot key", which is cosmetic).
• Vendored vex attests from the committed artifact plus lock wiring even when the tree isn't installed. That's by design (CLI_CONTRACT "Manifest-less VEX").
• vex -g needs --product outside a project ("Could not auto-detect a top-level product PURL").
• Agent-mode get <purl> for an uninstalled package reports success, applied: 1 when another manifest entry applies. The nested apply fails only when nothing matches. It's not pnpm-specific (noted on Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362).
• A compact single-line package.json comes back 2-space-indented after vendor + rollback. There's no indent to detect, and indented files round-trip byte-exactly, so it's cosmetic.
• Hosted on pnpm 9 over an existing upstream node_modules: a frozen install keeps the upstream bytes. That's documented in the redirect_pnpm_trust_lockfile warning, and VEX doesn't attest it.
• pnpm 12 warns that package.json pnpm.overrides is ignored on vendored projects. The workspace-file override is what takes effect, so this is noise only.
• A vex --output /dev/stdout hang when stdout is a pipe is not pnpm-specific.
• Vendored refuses pnpm catalogs (catalogs: entry) and peer-suffixed snapshot keys with vendor_lock_entry_unsupported ("this lock shape is not supported yet"). It's loud and writes nothing. Hosted handles both.
• pnpm 10's configDependencies copy (node_modules/.pnpm-config/) stays unpatched under hosted mode while VEX attests the regular copy. Config deps run only at install time, and pnpm 10 keeps their integrity in pnpm-workspace.yaml.
• On v5, vendoring always downloads its artifact from the patch service (--vendor-source build was removed), so offline vendoring with only a staged manifest fails with vendor_service_offline_conflict. Fixtures need the mock grant to match the manifest UUID.
• rush update --full re-resolves the Rush lock and drops the hosted pin, like pnpm update. VEX then honestly reports nothing to attest.
• pnpm 9.15.9's frozen install fails on its own unmodified lock when a workspace uses dependenciesMeta.injected ("importer dependencies meta (undefined) doesn't match"). That's upstream pnpm, not socket-patch.
• Old pnpm needs an old Node (≤ 6 needs Node 16, ≤ 2 needs Node 10), and pnpm 3 takes --store rather than --store-dir. Fixture notes.
• Agent apply over a pnpm patchedDependencies edit to the same file overwrites it with the verified patched content and warns content_mismatch_overwritten (documented default mismatch policy; --strict refuses). Hosted composes both patches, and vex then declines (no_applicable_patches), because the file matches neither hash.
• Hosted on pnpm 11/12 respects an explicit trustLockfile: false (any YAML spelling) and warns redirect_pnpm_trust_lockfile with the remedy. The following frozen install fails, which is documented.
• Vendored refuses pnpm ≤ 6 locks (5.x up to 5.3) with vendor_lockfile_version_unsupported, and pnpm 7/8 workspace locks with vendor_lock_entry_unsupported. pnpm 7/8 vendored locks carry an absolute file: specifier (vendor_pnpm_legacy_absolute_specifier), so a moved checkout needs pnpm install --offline --no-frozen-lockfile once. Both are documented.
• pnpm 11+ ignores package.json pnpm.patchedDependencies. Put it in pnpm-workspace.yaml.
• A dead-registry fresh install fails when the fixture has any unpatched dependency (it still needs the registry). Use the live registry for those fixtures, or patch every dependency.
• Vendored from a workspace member cwd fails closed with vendor_lockfile_missing (partial_failure). Hosted's silent success in the same layout is Hosted scan/get run from a pnpm workspace member (or with lockfile-dir=..) ignores the parent pnpm-lock.yaml and reports success while pinning nothing #590.
• A package.json without a trailing newline gains one after vendor + revert. That's a fixture artifact; files that end in a newline round-trip byte-exactly.
• Bundled-copy fixtures need a registry-served host package. A file: tarball host (.pnpm/bundler@file+…) is patched correctly, so it doesn't reproduce Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601.
• pnpm ≤10 .npmrc keys must be kebab-case (modules-dir, virtual-store-dir-max-length); camelCase is silently ignored. pnpm 7–10.11 keep the virtual store in node_modules/.pnpm even with modules-dir, so agent mode passes there.
• pnpm file: directory dependencies are copied into the store (.pnpm/<name>@file+…), so patching that copy is correct and doesn't touch the source (unlike link: / workspace:, Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626).
• In-run scan --mode hosted --vex attests from this run's records without hash verification, so it says not_affected over an upstream install (CLI_CONTRACT (redirected) row). Use standalone vex after the install as the oracle.
• A pnpm patch-commit over a hosted pin makes vex decline with hash_mismatch (the file matches neither hash). That's honest. Rollback keeps the user's patch and restores the upstream pin.
• pnpm ≤10 patch-commit under CI=true runs a frozen install and fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH (fixture note: use confirmModulesPurge=false, not CI). A mock /registry must serve the real npmjs tarball, or a rollback restores a foreign integrity.
• Rush has no root package.json, so vex needs --product there (product_undetected), like -g.
• pnpm 12.0.0 doesn't run under Rush 5.180 (it rejects Rush's --no-prefer-frozen-lockfile). Rush subspace fixtures need common/config/subspaces/<name>/ folders created and common/config/rush/.pnpmfile.cjs removed before rush update.
• pnpm 11.28.3 pnpm install --no-prefer-frozen-lockfile re-resolves hosted pins to upstream even with trustLockfile: true (9 / 10 / 12 keep them). That's upstream pnpm behaviour; the default pnpm install and --frozen-lockfile keep the pin. It's tracked inside Hosted scan on a Rush repo with pnpm 11/12 reports success, but rush install then fails with ERR_PNPM_TARBALL_URL_MISMATCH, or (pnpm 11.0.0) silently installs the upstream package #713 because Rush uses that flag by default.

[github-actions[bot]]

[agent] 2026-09-30: pnpm bug-hunt run

Tested: main f6b7fb9 (CLI 4.0.0 workspace version), latest release 4.0.0 (previous 3.3.0, both installed from npm for comparison). pnpm 7.33.7, 8.15.9, 9.15.9, 10.0.0, 10.5.2, 10.12.1, 10.34.5, 11.27.0, 12.4.2 and 12.8.1 (the current latest), on Node 22 in the sandbox. Patch data is a hand-staged .socket/manifest.json plus blobs (agent and vendored mode) and a local Python mock of the patch API and tarball routes (hosted mode). No secrets.

This is the first run: no earlier ledger, and no open pm:pnpm issues to re-triage.

Cells

• fail Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361: agent apply / rollback with enableGlobalVirtualStore. Writes land in the shared <store>/links dir: an unrelated project is patched, and one project's rollback unpatches another. Fails on Linux with pnpm 10.12.1–12.8.1, and on the macOS and Windows probe with pnpm 11.27.0 and 12.8.1. Releases 3.3.0 and 4.0.0 behave the same.
• fail Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362: agent apply on a transitive dep with a custom virtualStoreDir (pnpm 8–12) or the global virtual store (10.12+) is reported package_not_installed. Fails on Linux, macOS and Windows.
• fail Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360: vendored mode on pnpm 10.5.2, 10.12.1 and 10.34.5 with user overrides: in pnpm-workspace.yaml. vendor succeeds, then a fresh --frozen-lockfile install fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH, and a re-lock drops the user's overrides. Passes on 10.0.0, 11.27.0 and 12.8.1. Release 4.0.0 has the same bug.
• pass: vendored lifecycle on pnpm 10.34.5 and 11.27.0 (vendor → fresh frozen --offline install → vex → revert). Also passes with nodeLinker: hoisted and with a flow packages: ['.'] plus catalog: {…}.
• pass: agent apply / rollback with nodeLinker: hoisted (pnpm 11.27.0). The CAS file is not written through.
• pass: hosted scan --mode hosted on pnpm 11.27.0 against the mock API: fresh frozen install with an empty store gets the patched bytes. trustLockfile handling passes for CRLF, no-EOL and trailing-comment trustLockfile: true workspace files.
• fail, not filed (queued in the backlog): hosted trustLockfile append and vendored overrides append on a whole-document flow pnpm-workspace.yaml ({packages: [.]}) or a file ending in .... The command reports success, then pnpm can't parse the file ("end of the stream or a document separator is expected"). Reproduced on pnpm 11.27.0.
• refused, as designed: vendored with a CRLF pnpm-workspace.yaml or pnpm-lock.yaml (vendor_lockfile_crlf_unsupported), a BOM package.json (vendor_pkg_json_unsupported), inline overrides: {} / {x: y} (vendor_override_conflict, covered by the inline_workspace_overrides_mapping_is_refused unit test), and patchedDependencies on the target (vendor_lock_entry_unsupported).

Issues

• Filed Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360, Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361 and Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362.

False positives ruled out

• Vendored vex attesting not_affected in a fresh clone whose install failed is by design: vendored VEX stands on the committed artifact plus lock wiring (CLI_CONTRACT "Manifest-less VEX"; vendored_tree_out_of_sync is a warning only).
• The global virtual store "not reproducing" with pnpm 10.34.5 on GH runners is expected: pnpm 10 disables it when CI is set. pnpm 11+ keeps it.
• vex --output /dev/stdout hangs when stdout is a pipe. It's not pnpm-specific, so it wasn't filed here; it's noted for whoever owns the CLI.

Probe

• bughunt/pnpm/20260930-virtual-store, run https://github.com/SocketDev/socket-patch/actions/runs/36759597534 (ubuntu, macos and windows × pnpm 10.34.5, 11.27.0 and 12.8.1). The branch could not be deleted: the git proxy dropped git push --delete three times ("unexpected disconnect while reading sideband packet"). A maintainer needs to delete it.

Next

1. Flow-style or ...-terminated pnpm-workspace.yaml breaking under the hosted trust append and the vendored overrides append. Confirm on pnpm 10 and 12, then file.
2. Hosted mode on pnpm 7/8 (lock 5.4/6.0) workspaces with catalogs, and peer-suffixed instances with the mock API. Then Rush/subspace locks.
3. The vendored takeover (hosted → vendored → hosted) on pnpm 11/12, plus rollback byte-exactness of pnpm-workspace.yaml.
4. Agent apply with injected workspace deps (dependenciesMeta.injected) and package-import-method=clone/copy.
5. pnpm 1–6 legacy layouts (node_modules/.registry.npmjs.org, pnpm 4/5 nested host dirs) on Node 16 for agent mode.

[github-actions[bot]]

[agent] 2026-10-01: pnpm bug-hunt run

Tested: main f6b7fb9 (unchanged since run 1), latest release 4.0.0 (npm @socketsecurity/socket-patch@4.0.0, used for the regression checks). pnpm 7.33.7, 8.15.9, 9.15.9, 10.34.5, 11.27.0 and 12.8.1, on Node 22 in the Linux sandbox. Hosted mode ran against a local Python mock of the patch API and tarball routes, modelled on e2e_redirect_pnpm_build.rs. Vendored mode ran from a hand-staged .socket/manifest.json plus blobs. The oracle is a marker on left-pad/index.js after a fresh --frozen-lockfile install against a dead registry.

Re-triage

• Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360, Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361 and Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 are still open. Main hasn't moved, so there's no fix to verify. Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 has draft PR Fix npm crawler missing relocated dependency stores (#359, #362) #365 (the custom virtualStoreDir half; the global-virtual-store half stays open per the maintainer note). Nothing to close.

Cells

• fail Hosted trustLockfile and vendored overrides appends corrupt a flow-style or ...-terminated pnpm-workspace.yaml while reporting success #400: a whole-document flow pnpm-workspace.yaml ({packages: [.]}), or one ending in .... The hosted trustLockfile: true append and the vendored overrides: append both write YAML pnpm can't load, and both report success. Hosted fails on 10.34.5, 11.27.0 and 12.8.1; vendored fails on 11.27.0 and 12.8.1. Release 4.0.0 behaves the same.
• fail Hosted→vendored takeover leaves trustLockfile: true in pnpm-workspace.yaml, and vendor --revert never removes it #401: hosted → vendored takeover (vendor and scan --mode vendored) on pnpm 11.27.0 and 12.8.1 leaves trustLockfile: true plus an orphan redirect_pnpm_workspace_trust ledger edit with no records. vendor --revert doesn't remove it either. npm's .npmrc gets a last-one-out unwind in the same situation. Release 4.0.0 behaves the same.
• fail pnpm-workspace.yaml edits miss quoted or space-before-colon top-level keys, append a duplicate trustLockfile/overrides key, and break every install #402: a quoted or space-before-colon top-level "trustLockfile": false, 'trustLockfile': true, trustLockfile : false, or a quoted "overrides":, is not recognised, so a duplicate key is appended (duplicated mapping key). Hosted fails on 10.34.5, 11.27.0 and 12.8.1; vendored fails on 11.27.0 and 12.8.1. Release 4.0.0 behaves the same.
• pass: hosted baseline (no workspace file) on pnpm 7.33.7 (lock 5.4), 8.15.9 (lock 6.0) and 9.15.9 (lock 9.0, trust file created). The fresh frozen install is patched.
• pass: hosted with a catalog: dependency on pnpm 9.15.9, 10.34.5, 11.27.0 and 12.8.1.
• pass: the full cycle vendor → hosted takeover → vendored takeover → bare rollback on pnpm 11.27.0. Every fresh frozen install is patched, and the lock, pnpm-workspace.yaml and a tab-indented package.json come back byte-identical.
• pass: scoped rollback <purl> after hosted only on pnpm 11.27.0 and 12.8.1 (2 runs each). The trust line is removed through whole-ledger replay.

Issues

• Filed Hosted trustLockfile and vendored overrides appends corrupt a flow-style or ...-terminated pnpm-workspace.yaml while reporting success #400, Hosted→vendored takeover leaves trustLockfile: true in pnpm-workspace.yaml, and vendor --revert never removes it #401 and pnpm-workspace.yaml edits miss quoted or space-before-colon top-level keys, append a duplicate trustLockfile/overrides key, and break every install #402.

False positives ruled out

• A compact single-line package.json comes back 2-space-indented after vendor + rollback. A one-line file has no indent to detect, and an indented file round-trips byte-exactly, so this wasn't filed. It's cosmetic, and JsonLayout work in PR Fix JSON writers dropping CRLF/BOM/indent (#324, #351) #357 is nearby.
• A scan --mode vendored re-run that returned status: error after a bare rollback came from the fixture: rollback garbage-collected the staged blobs, and the mock doesn't serve blob content.

Probe

• No new probe branches. git push --delete of the stale bughunt/pnpm/20260930-virtual-store was denied by the session's permission policy, so new probe branches couldn't be cleaned up either. A maintainer needs to delete bughunt/pnpm/20260930-virtual-store.

Next

1. Hosted: Rush / subspace locks (common/config/rush/pnpm-lock.yaml) and peer-suffixed instances in a workspace with the mock harness.
2. Hosted --frozen-lockfile --offline with a warm store that holds the upstream tarball, on pnpm 9–12. Confirm the documented warm-cache caveat and that vex doesn't attest unpatched bytes.
3. Agent: dependenciesMeta.injected and package-import-method=clone|copy, and pnpm 1–6 legacy layouts on Node 16.
4. Vendored on Windows / macOS autocrlf checkouts (needs a probe branch; blocked until probe-branch deletion is allowed).
5. Re-check Hosted trustLockfile and vendored overrides appends corrupt a flow-style or ...-terminated pnpm-workspace.yaml while reporting success #400–pnpm-workspace.yaml edits miss quoted or space-before-colon top-level keys, append a duplicate trustLockfile/overrides key, and break every install #402 once fixes land, including both modes and pnpm 12.

[github-actions[bot]]

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major pnpm version and on Linux, macOS and Windows.

Where pnpm puts global installs: pnpm add -g; discovery via pnpm root -g (PNPM_HOME). Cover pnpm 7–10 global-dir layouts, the global virtual store, and pnpm installed through corepack, standalone and npm.

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed pnpm package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a pnpm project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × pnpm version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

[github-actions[bot]]

[agent] 2026-10-01: pnpm bug-hunt run

Tested: main 2463257 (#277, the v5 consolidation; the CLI still reports 4.0.0), latest release 4.0.0 (npm @socketsecurity/socket-patch@4.0.0) for regression checks, and draft PR #365's head 80f4a71 for the global cells. pnpm 7.33.7, 8.15.9, 9.15.9, 10.34.5, 11.0.0, 11.27.0, 11.28.3, 12.4.2, 12.8.1 and 12.8.2, on Node 22 in the Linux sandbox. The patch API is a local Python mock (batch, by-package, view with inline blobs, package grant, hosted tarball, plus a /registry/<name>/<ver> mirror). This run focused on the maintainer's global (-g) request.

v5 harness note: hosted pins are recognised only on the named patch server, so set SOCKET_PATCH_SERVER_URL=<mock>. Rollback restores upstream from the registry, and the Rust client can't reach registry.npmjs.org from the sandbox, so set SOCKET_NPM_REGISTRY=<mock>/registry. Without these, rollback reports "Manifest not found" or cannot restore … upstream registry entry. Both are fixture artifacts.

Re-triage

• Hosted→vendored takeover leaves trustLockfile: true in pnpm-workspace.yaml, and vendor --revert never removes it #401: closed as fixed by v5 prerelease: scan → vex → vendor workflow, hosted by default #277. v5 keeps no redirect ledger. The hosted → vendored takeover (vendor and scan --mode vendored) on pnpm 11.27.0 and 12.8.1 now emits the documented pnpm_trust_lockfile_left advisory, and a workspace file that exactly matches the scaffold is deleted. Hosted→vendored takeover leaves trustLockfile: true in pnpm-workspace.yaml, and vendor --revert never removes it #401 (comment)
• Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360: still reproduces on 2463257 (pnpm 10.34.5, 2/2, through scan --mode vendored). Comment: Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360 (comment)
• Hosted trustLockfile and vendored overrides appends corrupt a flow-style or ...-terminated pnpm-workspace.yaml while reporting success #400 and pnpm-workspace.yaml edits miss quoted or space-before-colon top-level keys, append a duplicate trustLockfile/overrides key, and break every install #402 were already re-triaged on 2463257 by the triager (draft PR Fix pnpm-workspace.yaml key detection and appends (#400, #402) #414). Not repeated.

Cells (global mode, Linux)

• pass: scan -g (report only) lists globally installed direct packages on pnpm 7.33.7, 8.15.9, 9.15.9, 10.34.5, 11.27.0 and 12.8.1. -g inside a project doesn't leak project packages, and a scan without -g never reads the global dir. SOCKET_GLOBAL=1 and --global-prefix $(pnpm root -g) behave the same as -g.
• pass: scan -g --mode hosted refuses ("global installs have no project lockfile to redirect"), exits 2 and writes nothing.
• pass: scan -g --mode agent, get -g, apply -g, rollback -g (byte-exact) and vex -g --product … on direct global deps, pnpm 7.33.7–12.8.1. vex -g omits a copy that was manually reverted (not_applied).
• fail Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 (commented): transitive deps of global packages are invisible on pnpm 7–10, because the default -g layout records virtualStoreDir: ../.pnpm. The same happens on pnpm 11, where -g uses the global virtual store by default. PR Fix npm crawler missing relocated dependency stores (#359, #362) #365 fixes pnpm 7–10 -g and leaves pnpm 11 out by design. Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 (comment)
• fail Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435 (new, regression): pnpm 12.4.2, 12.8.1 and 12.8.2, and 11.28.3 with enableGlobalVirtualStore: false. Each pnpm add -g gets its own global/v11/<hash>/node_modules/.pnpm. When two groups both hold left-pad@1.3.0, get -g / apply -g patch only one, report success, and vex -g attests not_affected while the global tool loads the unpatched copy. The result depends on listing order, and it's deterministic on tmpfs. First bad commit is b32711f (Support vlt in hosted, vendored and agent modes #269); 0b4e645 and release 4.0.0 pass. Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435
• pass: the project-mode analogue (a sharedWorkspaceLockfile: false workspace with two .pnpm stores) patches both copies on 10.34.5 and 12.8.2.
• pass: hosted → rollback on a packages/* workspace, pnpm 9.15.9 / 10.34.5 / 11.27.0 / 12.8.1. The lock is byte-exact, the trust line is kept with a pnpm_trust_lockfile_left warning, and a fresh frozen install passes.
• blocked: an unwritable global dir (item 6 of the maintainer list). The sandbox runs as root.
• blocked: macOS and Windows. There's no probe branch, because git push --delete bughunt/pnpm/20260930-virtual-store failed again ("unexpected disconnect while reading sideband packet").

Issues

• Filed Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435.
• Commented on Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 and Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360. Closed Hosted→vendored takeover leaves trustLockfile: true in pnpm-workspace.yaml, and vendor --revert never removes it #401.

False positives ruled out

• "rollback deletes the user's pnpm-workspace.yaml": only a user file that becomes byte-identical to hosted mode's scaffold (packages: ['.'] plus the appended trustLockfile: true) is deleted. That's documented in CLI_CONTRACT.md (upstream restore, npm family).
• get <uninstalled purl> reports success, applied: 1 when another manifest patch applies. The nested apply fails only when no entry matches. It's not pnpm-specific, so it wasn't filed; it's noted on Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362.
• A rollback -g that looked "not byte-exact" came from a fixture polluted by an earlier 4.0.0 scan in the same global dir. Clean re-runs are byte-exact.

Next

1. Global mode on macOS and Windows (corepack and standalone pnpm, PNPM_HOME with spaces or unicode), once the stale probe branch is deleted.
2. Re-run the hosted edge shapes against v5 (Rush / subspace locks, peer-suffixed workspace instances, catalogs), using the SOCKET_PATCH_SERVER_URL / SOCKET_NPM_REGISTRY harness.
3. Hosted --frozen-lockfile --offline with a warm store that holds the upstream tarball, on pnpm 9–12, plus the vex honesty check.
4. Agent mode: dependenciesMeta.injected, package-import-method=clone|copy, and pnpm 1–6 on Node 16.
5. Re-verify Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435 and Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 when PR Fix npm crawler missing relocated dependency stores (#359, #362) #365 or a fix lands.

[github-actions[bot]]

[agent] 2026-10-01: pnpm bug-hunt run

Tested: main 2463257 (unchanged since run 4; the CLI reports 4.0.0), latest release 4.0.0. pnpm 9.15.9, 10.34.5, 11.28.3 and 12.8.1 on Node 22 in the Linux sandbox. The patch API is a local Python mock (batch, by-package, package grant, view, hosted tarball, /registry mirror), run with SOCKET_PATCH_SERVER_URL / SOCKET_NPM_REGISTRY pointed at it.

Re-triage

• Skipped. Main hasn't moved since run 4, which re-triaged Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360, Hosted→vendored takeover leaves trustLockfile: true in pnpm-workspace.yaml, and vendor --revert never removes it #401 (closed), Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 and Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435 on 2463257.

Cells

• New shape: pnpm 12 two-document lock. pnpm 12.8.1 writes pnpm-lock.yaml as two YAML documents (an env document holding packageManagerDependencies / @pnpm/exe.*, then the project lock) whenever package.json has packageManager. pnpm 11.28.3 and 10.34.5 write a single document for the same input.
  • pass: hosted scan --mode hosted pins the entry in document 2. A fresh dead-registry frozen install lands the patched bytes, vex attests not_affected, and rollback restores the lock byte for byte. It needs manage-package-manager-versions=false, or a reachable registry for pnpm itself.
  • fail Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466 (new): vendored on the two-doc lock refuses with vendor_lock_entry_not_found. A project vendored first and turned two-doc later breaks on every unwind. vendor --revert exits 0 with success, rollback reports vendoredKept "left untouched", and the default scan takeover exits 0 having deleted the ledger. All three leave 5 file:.socket/vendor refs, so the next frozen install fails with ERR_PNPM_OUTDATED_LOCKFILE. Root cause: section_bounds takes the first packages: / importers: header. Reproduced 2/2, and the single-doc control passes. Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466
• pass (VEX honesty): hosted followed by pnpm install --frozen-lockfile [--offline] over an existing upstream node_modules and warm store, on 9.15.9 / 10.34.5 / 11.28.3 / 12.8.1. pnpm 9 keeps the upstream tree, and pnpm 10 and 11 --offline fail with ERR_PNPM_NO_OFFLINE_TARBALL. vex emits no statement whenever the installed bytes are unpatched, and attests not_affected only when the marker is present.
• blocked: macOS and Windows. git push --delete of the stale probe branch was denied by the session's permission policy, so no new probe branches were pushed (they couldn't be cleaned up).

Issues

• Filed Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466.

False positives ruled out

• Hosted on pnpm 9 plus an existing node_modules: the frozen install keeps the upstream bytes. That's documented in the redirect_pnpm_trust_lockfile warning ("existing node_modules or a warm pnpm store can still contain upstream files"), and VEX doesn't attest it.
• 4.0.0 vendored on the two-doc lock fails with no_local_source against the v5-shaped mock. That's a mock incompatibility, so it can't be used for a bisect.
• pnpm 12 warns The "pnpm" field in package.json is no longer read … pnpm.overrides on vendored projects. The workspace-file override is what takes effect, so this is noise only. Noted on Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466.

Next

1. Two-doc lock, part 2: pnpm 10.x / 11.x configDependencies (does an env document appear there?), and two-doc plus a packages/* workspace in hosted mode.
2. Global (-g) mode on macOS and Windows, once a maintainer deletes bughunt/pnpm/20260930-virtual-store.
3. Hosted v5: Rush / subspace locks, peer-suffixed workspace instances, catalogs.
4. Agent: dependenciesMeta.injected, package-import-method=clone|copy, pnpm 1–6 on Node 16.
5. Re-verify Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435, Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 (PR Fix npm crawler missing relocated dependency stores (#359, #362) #365), Hosted trustLockfile and vendored overrides appends corrupt a flow-style or ...-terminated pnpm-workspace.yaml while reporting success #400 and pnpm-workspace.yaml edits miss quoted or space-before-colon top-level keys, append a duplicate trustLockfile/overrides key, and break every install #402 (PR Fix pnpm-workspace.yaml key detection and appends (#400, #402) #414) when they land.

[github-actions[bot]]

[agent] 2026-10-01: pnpm bug-hunt run

Tested: main 61cfb9b (adds #365, which fixes the custom-virtualStoreDir half of #362, and #414, which fixes #400 / #402), latest release 4.0.0. pnpm 8.15.9, 9.15.9, 10.34.5, 11.28.3 and 12.8.1 on Node 22 in the Linux sandbox, run against the local Python patch-API mock (SOCKET_PATCH_SERVER_URL / SOCKET_NPM_REGISTRY). Note: on v5, vendored downloads its artifact from the service (--vendor-source build was removed), so the mock's grant must use the staged manifest's UUID.

Re-triage

• Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362: the custom virtualStoreDir half is fixed on 8.15.9 / 9.15.9 (.npmrc) and on 10.34.5 / 11.28.3 / 12.8.1 (workspace file). Apply patches the transitive copy, Node loads it, and rollback restores it. The global-virtual-store half still reports package_not_installed on 11 and 12, as PR Fix npm crawler missing relocated dependency stores (#359, #362) #365 intended, so the issue stays open. Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 (comment)

Cells

• fail Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492 (new): hosted on a workspace with sharedWorkspaceLockfile: false reads only the root lock, ignores packages/*/pnpm-lock.yaml, and reports success, exit 0, redirected: 0. Seen on 8.15.9 / 9.15.9 / 10.34.5 / 11.28.3 / 12.8.1 (2/2 on 9 and 12). The --cwd packages/a workaround creates a nested pnpm-workspace.yaml, and the root frozen install then fails with ERR_PNPM_TARBALL_URL_MISMATCH on 12. Vendored refuses loudly (vendor_lock_entry_not_found). Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492
• fail Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466 (comment): configDependencies makes pnpm 11.28.3 and 12.8.1 write a two-document lock (10.34.5 doesn't). When the target is both a config dep and a regular dep, vendor exits success with all 6 file:.socket/vendor refs in document 1, and the next frozen install fails ("Cannot update configDependencies…" / ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE). 2/2 on each version. vendor --revert restores byte for byte. Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466 (comment)
• pass: hosted with configDependencies on 10.34.5 / 11.28.3 / 12.8.1. On 11 and 12 both documents are pinned and the patched bytes land in node_modules/is-number and .pnpm-config/is-number. Rollback is byte-exact (it leaves trustLockfile with pnpm_trust_lockfile_left, a known non-bug).
• pass: hosted with catalogs (catalog: in a member, plus a transitive consumer) on 9 / 10 / 11 / 12. Frozen install is patched for both, and rollback restores the lock.
• pass: hosted with peer-suffixed instances (use-sync-external-store@1.2.0 under react 17 and 18 in two members) on 9 / 11 / 12. Both instances are patched, and rollback restores the lock.
• pass: hosted with node-linker=hoisted on 9.15.9 / 12.8.1. Frozen install is patched, vex says not_affected, and rollback is byte-exact.
• pass: agent mode against a hard-linked CAS store (package-import-method=hardlink) on 9.15.9 / 12.8.1. Apply breaks the hardlink (nlink 3→1), the store and sibling projects stay pristine, and a warm-store install elsewhere gets upstream bytes.
• refused as documented: vendored with catalogs and with peer-suffixed snapshot keys (vendor_lock_entry_unsupported, loud, nothing written).
• blocked: macOS and Windows. git push --delete of bughunt/pnpm/20260930-virtual-store was denied by the permission policy again, so no probe branches were pushed.

Issues

• Filed Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492. Commented on Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466 and Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362.

False positives ruled out

• pnpm 10 configDependencies copy (node_modules/.pnpm-config/<pkg>) stays unpatched under hosted mode, while vex attests not_affected for the regular copy. Config deps run only at install time (pnpmfile / config) and aren't part of the product's runtime graph, and on pnpm 10 their integrity lives in pnpm-workspace.yaml. Not filed.
• Hosted rollback keeps trustLockfile: true in a pre-existing workspace file with pnpm_trust_lockfile_left (stateless v5; known non-bug).
• Offline frozen installs of peer fixtures failed with ERR_PNPM_NO_OFFLINE_TARBALL because of an empty store (fixture error). They pass online with an empty store.

Next

1. Re-verify Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492 and Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466 when fixes land. For Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492, also check pnpm 7 (shared-workspace-lockfile=false with lock 5.4) and rollback / vex once member locks are pinned.
2. Global (-g) mode, and vendored on macOS and Windows, once a maintainer deletes bughunt/pnpm/20260930-virtual-store.
3. Rush / subspace hosted locks with real rush install (@microsoft/rush), including preventManualShrinkwrapChanges.
4. Agent: dependenciesMeta.injected, package-import-method=clone|copy, pnpm 1–6 on Node 16.
5. Re-verify Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360, Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361, Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435 when fixed.

[github-actions[bot]]

[agent] 2026-10-02: pnpm bug-hunt run

Tested: main 61cfb9b (unchanged since run 6; CLI 4.0.0), latest release 4.0.0. Ran on Linux with pnpm 2.25.7 (Node 10), 3.8.1 / 4.14.4 / 5.18.10 / 6.35.1 (Node 16), and 7.33.7 / 8.15.9 / 9.15.9 / 11.28.3 / 12.8.1 (Node 22), plus Rush 5.180.0 with pnpm 8.15.9 and 9.15.9. I rebuilt the local Python patch-API mock (batch, by-package, package grant, view, hosted tarball, /registry), and agent mode ran from a hand-staged manifest plus before/after blobs.

Re-triage

• Main hasn't changed since run 6, so there was nothing new to re-check. Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360, Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361, Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 (GVS half), Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435, Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466 and Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492 are all still open.

Cells

• fail npm crawler never looks in Rush's common/temp store: hosted vex attests a transitive dep not_affected while its installed copy is unpatched, and agent apply reports it package_not_installed #518 (new): in a Rush repo (pnpm 9.15.9 lock 9.0, and 8.15.9 lock 6.0), the npm crawler skips common/temp (SKIP_DIRS has "temp"). Transitive deps installed in common/temp/node_modules/.pnpm therefore show as notInstalled. After scan --mode hosted pins common/config/rush/pnpm-lock.yaml, vex attests not_affected from the lockfile basis while the installed store copy is still upstream. On plain pnpm in the same state, vex correctly says not_applied. Agent apply for the same transitive dep reports package_not_installed. Direct deps pass. Reproduced 2/2. npm crawler never looks in Rush's common/temp store: hosted vex attests a transitive dep not_affected while its installed copy is unpatched, and agent apply reports it package_not_installed #518
• pass: hosted on Rush. scan --mode hosted pins the Rush lock with redirect_rush_repo_state_stale. With preventManualShrinkwrapChanges: true, rush install refuses until rush update, as documented. The pin survives rush update. A cold rush install, a warm one, and rush install --purge all install the patched bytes. vex attests correctly once the tree is patched.
• fail Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492 (comment): pnpm 7.33.7 with shared-workspace-lockfile=false writes no root lock at all. Hosted then exits success / redirected: 0 with only redirect_pnpm_no_lockfile, and the member lock stays unpinned. Reproduced 2/2. Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492 (comment)
• pass: legacy layouts. Agent apply and rollback on a transitive dep (Node loads the patched copy), plus hosted pin → fresh frozen install with an empty store → byte-exact rollback, all pass on:
  • pnpm 2.25.7 (shrinkwrap.yaml, node_modules/.registry.npmjs.org/…)
  • pnpm 3.8.1 (lock 5.1, same layout)
  • pnpm 4.14.4 (lock 5.1, .pnpm/registry.npmjs.org/<name>/<ver>)
  • pnpm 5.18.10 (lock 5.2)
  • pnpm 6.35.1 (lock 5.3)
• pass: agent apply and rollback on peer-suffixed instances (use-sync-external-store@1.2.0 under react 17 and 18) on 9.15.9 / 12.8.1. Both copies are patched and both are restored.
• pass: npm aliases (isnum: npm:is-number@7.0.0). Agent mode passes on 9 / 12. Hosted passes on 7 (lock 5.4), 8 (6.0), 9, 11 and 12: the fresh frozen install is patched.
• pass: hosted with dependenciesMeta.injected on 8.15.9 / 12.8.1.
• blocked: hosted injected on 9.15.9. pnpm 9.15.9's own frozen install fails on the unmodified lock ("importer dependencies meta (undefined) doesn't match…"), which is an upstream pnpm bug.
• blocked: macOS and Windows. Deleting bughunt/pnpm/20260930-virtual-store was denied by the permission policy again, so no probe branches were pushed.

Issues

• Filed npm crawler never looks in Rush's common/temp store: hosted vex attests a transitive dep not_affected while its installed copy is unpatched, and agent apply reports it package_not_installed #518. Commented on Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492.

False positives ruled out

• pnpm 9.15.9's frozen install failing with injected workspace deps reproduces without socket-patch, so it's upstream.
• rush update --full drops the hosted pin, because it re-resolves the lock. That's like pnpm update, and VEX then honestly reports nothing to attest.
• pnpm 3 rejects --store-dir (it wants --store), and pnpm ≤ 6 can't run on Node 22 / pnpm ≤ 2 can't run on Node 16. Those are fixture issues.
• scan --offline refusing with "requires network access" is documented (strict airgap).

Next

1. Re-verify npm crawler never looks in Rush's common/temp store: hosted vex attests a transitive dep not_affected while its installed copy is unpatched, and agent apply reports it package_not_installed #518 once fixed, and test Rush subspaces (common/config/subspaces/*/pnpm-lock.yaml) plus the Rush + pnpm 10 cells.
2. Global -g mode and vendored mode on macOS / Windows, once a maintainer deletes the stale probe branch.
3. Agent package-import-method=copy|clone, and agent mode on pnpm 7 / 10 / 11 with aliases and injected deps.
4. Re-verify Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492 / Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466 / Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360 / Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361 / Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435 when fixes land.
5. Vendored mode on legacy locks (pnpm ≤ 6): expect a loud refusal or a working round-trip.

[github-actions[bot]]

[agent] 2026-10-02: pnpm bug-hunt run

Tested: main 61cfb9b (unchanged since run 6; CLI 4.0.0), latest release 4.0.0. Ran on Linux with pnpm 5.18.10 / 6.35.1 (Node 16), and 7.33.7 / 8.15.9 / 9.15.9 / 10.34.5 / 11.28.3 / 12.8.1 (Node 22). I rebuilt the local Python patch-API mock (batch, by-package, package grant, view with inline blobs, hosted tarball, /registry mirror), run with SOCKET_PATCH_SERVER_URL / SOCKET_NPM_REGISTRY pointed at it. Agent mode ran from a hand-staged manifest plus blobs.

Re-triage

• Main hasn't changed, so there was nothing new to re-check. npm crawler never looks in Rush's common/temp store: hosted vex attests a transitive dep not_affected while its installed copy is unpatched, and agent apply reports it package_not_installed #518 now has a maintainer-claimed draft fix (Fix npm crawler missing configured install roots (#493, #518) #520), shared with Agent mode ignores yarn classic's --modules-folder: packages installed there are reported "not installed" and scan --mode agent exits 0 leaving them unpatched #493. Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360, Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361, Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 (GVS half), Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435, Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466, Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492 and npm crawler never looks in Rush's common/temp store: hosted vex attests a transitive dep not_affected while its installed copy is unpatched, and agent apply reports it package_not_installed #518 are all still open.

Cells

• fail npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (comment, not a new issue): with node-linker=hoisted, an npm alias ("isnum": "npm:is-number@7.0.0") next to a hoisted is-number@7.0.0 gives two physical copies. Agent apply reports success, applied 1, patches node_modules/is-number only, and leaves node_modules/isnum (what require('isnum') loads) unpatched. vex attests not_affected. Reproduced 2/2 on 9.15.9, 10.34.5 and 12.8.1. It's the same find_by_purls path as npm's npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356. npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (comment)
• pass: pnpm's default isolated linker with the same alias. The alias symlinks into the shared .pnpm/is-number@7.0.0, so the one copy gets patched.
• pass: patchedDependencies interplay. Two shapes: a pnpm patch on a different file (README.md), and one on the same file (index.js).
  • Agent apply / rollback on the _patch_hash= instance passes on 7.33.7 / 8.15.9 / 9.15.9 / 10.34.5. On 11.28.3 / 12.8.1 it only ran without the pnpm patch, because pnpm 11+ ignores package.json pnpm.patchedDependencies. The same-file shape overwrites pnpm's change with content_mismatch_overwritten, which is documented.
  • Hosted on 8.15.9 / 9.15.9 / 10.34.5 / 11.28.3 / 12.8.1 (workspace-file patchedDependencies on 11+) passes for both shapes: the lock pin lands, and a fresh frozen install from an empty store gets both the Socket patch and the pnpm patch.
  • vex attests not_affected for the different-file shape. For the same-file shape it declines with no_applicable_patches, because the installed file matches neither hash. That's conservative and honest.
  • Hosted rollback restores the lock.
• pass: hosted on a scoped package (@isaacs/string-locale-compare) on 7.33.7 (lock 5.4 /@s/n/v), 8.15.9 (6.0 /@s/n@v), 9.15.9 and 12.8.1 (quoted 9.0 keys). The fresh frozen install is patched.
• pass (documented): hosted on 11.28.3 / 12.8.1 with an explicit trustLockfile: false | False | no | 'false'. The setting is respected, the warning names it and gives the remedy, and the frozen install fails (or on 11, 'false' / no installs patched). This matches the CLI_CONTRACT "explicit user settings preserved" rule.
• pass: agent transitive apply / Node load / rollback, with the store kept pristine, on 7.33.7 / 10.34.5 / 11.28.3 for package-import-method=copy, package-import-method=hardlink, node-linker=hoisted, and an npm alias under the isolated linker (12 cells).
• pass (documented refusal): vendored on pnpm 5.18.10 (lock 5.2) and 6.35.1 (lock 5.3) fails loudly with vendor_lockfile_version_unsupported and writes nothing.
• pass: vendored on 7.33.7 (lock 5.4) and 8.15.9 (lock 6.0):
  • The documented vendor_pnpm_legacy_absolute_specifier warning fires.
  • Same-path frozen install is patched, and vex attests not_affected.
  • A checkout copied to a path containing a space fails --frozen-lockfile (ERR_PNPM_OUTDATED_LOCKFILE), as documented. The documented --offline --no-frozen-lockfile recovery installs the patched tarball.
  • rollback from the moved checkout restores package.json and the lock byte-exactly, and the frozen install is upstream again.
• pass (documented refusal): vendored on a 7.33.7 / 8.15.9 workspace lock (importers:) fails with vendor_lock_entry_unsupported, and the message says to upgrade to pnpm 9.
• pass: hosted on a 7.33.7 / 8.15.9 workspace lock (member dependency). The pin lands, and the fresh frozen install is patched for the member.
• blocked: macOS and Windows. Deleting bughunt/pnpm/20260930-virtual-store was denied by the permission policy again, so no probe branches were pushed.

Issues

• Commented on npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (pnpm hoisted alias cells). No new issues filed.

False positives ruled out

• Agent apply overwriting a pnpm patchedDependencies edit to the same file is the documented default mismatch policy (content_mismatch_overwritten; --strict refuses instead).
• Hosted keeping an explicit trustLockfile: false is documented, and warned.
• pnpm 9 rejects a pnpm-workspace.yaml without packages: ("packages field missing or empty"). That's a fixture issue.
• rollback emptying the staged manifest and GC-ing blobs makes a re-vendor a silent no-op (events: []). That's expected: there's nothing left to vendor.

Next

1. Re-verify npm crawler never looks in Rush's common/temp store: hosted vex attests a transitive dep not_affected while its installed copy is unpatched, and agent apply reports it package_not_installed #518 / Agent mode ignores yarn classic's --modules-folder: packages installed there are reported "not installed" and scan --mode agent exits 0 leaving them unpatched #493 when Fix npm crawler missing configured install roots (#493, #518) #520 lands, then Rush subspaces and Rush + pnpm 10.
2. Global -g and vendored mode on macOS / Windows, once a maintainer deletes the stale probe branch.
3. Agent hoisted with nested duplicate copies (pnpm side of Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516), and package-import-method=clone on a reflink filesystem (needs CI).
4. Hosted on pnpm 11/12 with patchedDependencies plus catalogs and configDependencies together; pnpm patch-commit after a hosted pin.
5. Re-verify Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492 / Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466 / Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360 / Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361 / Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435 when fixes land.

[github-actions[bot]]

[agent] 2026-10-02: pnpm bug-hunt run

Tested: main 61cfb9b (unchanged since run 6; CLI 4.0.0), latest release 4.0.0. Ran on Linux with pnpm 9.15.9 / 10.34.5 / 11.28.3 / 12.8.1 on Node 22. I rebuilt the local Python patch-API mock (batch, by-package, package grant, view with inline blobs, blob, hosted tarball, /registry mirror), run with SOCKET_PATCH_SERVER_URL / SOCKET_NPM_REGISTRY pointed at it.

Re-triage

• Main hasn't changed since run 6, so there was nothing new to re-check. Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360, Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361, Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 (GVS half), Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435, Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466, Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492 and npm crawler never looks in Rush's common/temp store: hosted vex attests a transitive dep not_affected while its installed copy is unpatched, and agent apply reports it package_not_installed #518 are still open, and Fix npm crawler missing configured install roots (#493, #518) #520 (the fix for npm crawler never looks in Rush's common/temp store: hosted vex attests a transitive dep not_affected while its installed copy is unpatched, and agent apply reports it package_not_installed #518 and Agent mode ignores yarn classic's --modules-folder: packages installed there are reported "not installed" and scan --mode agent exits 0 leaving them unpatched #493) is still unmerged.

Cells

• fail Hosted scan with pnpm gitBranchLockfile pins the stale pnpm-lock.yaml and reports success, while pnpm installs unpatched bytes from pnpm-lock.<branch>.yaml #556 (new): gitBranchLockfile / git-branch-lockfile=true. Main has pnpm-lock.yaml committed, and the feature branch writes pnpm-lock.feature.yaml. Hosted scan pins the stale pnpm-lock.yaml and reports success, redirected 1. A fresh frozen install on the branch installs upstream bytes. vex honestly declines (not_applied). Reproduced 2/2 on 10.34.5 and 12.8.1, and 1/1 on 11.28.3.
  • With only the branch lock present (12.8.1), the scan gives redirected 0 and a misleading redirect_pnpm_no_lockfile ("run pnpm install").
  • pnpm 9.15.9 wrote no branch lock in this fixture, so it's n/a there.
• fail Hosted pnpm rollback drops the upstream tarball: URL from locks written with lockfileIncludeTarballUrl, so the restore isn't byte-exact #557 (new, low impact): lockfile-include-tarball-url / lockfileIncludeTarballUrl.
  • The hosted pin replaces both integrity and tarball, and the fresh frozen install is patched. That passes on 9.15.9 / 10.34.5 / 12.8.1.
  • rollback drops the upstream tarball: field, so it isn't byte-exact, and pnpm never re-adds it. Reproduced 2/2 on 9.15.9 and 12.8.1.
• pass: hosted on pnpm 12.8.1 combining a catalog: dep, workspace patchedDependencies (different file) and a workspace overrides entry that folds a transitive is-number@6 into 7.0.0.
  • The pin lands, and the fresh frozen install gets both the Socket patch and the pnpm patch on the _patch_hash instance.
  • vex attests not_affected.
  • Rollback clears the pin and warns reinstall_required and pnpm_trust_lockfile_left (documented).
• observed, not filed: hosted scan run with cwd inside a pnpm workspace member (packages/a) on 12.8.1. It doesn't look up the root pnpm-lock.yaml: success, redirected 0, warning redirect_npm_no_lockfile, and nothing is written. It's fail-safe, but the warning is misleading. The cargo analog is Hosted cargo scan run from a workspace member treats it as a lockless project, rewrites only the member, and breaks every build of the workspace while reporting success #417. Before filing, check how the npm sibling's workspaces behave and whether running from the root is documented.
• blocked: macOS and Windows. Deleting bughunt/pnpm/20260930-virtual-store was denied by the permission policy again, so no probe branches were pushed.

Issues

• Filed Hosted scan with pnpm gitBranchLockfile pins the stale pnpm-lock.yaml and reports success, while pnpm installs unpatched bytes from pnpm-lock.<branch>.yaml #556 Hosted scan with pnpm gitBranchLockfile pins the stale pnpm-lock.yaml and reports success, while pnpm installs unpatched bytes from pnpm-lock.<branch>.yaml #556
• Filed Hosted pnpm rollback drops the upstream tarball: URL from locks written with lockfileIncludeTarballUrl, so the restore isn't byte-exact #557 Hosted pnpm rollback drops the upstream tarball: URL from locks written with lockfileIncludeTarballUrl, so the restore isn't byte-exact #557

False positives ruled out

• With a dead registry, the fresh frozen install of the combined fixture failed because the unpatched is-odd needs the registry. That's a fixture artifact; it passes against the live registry.
• pnpm_trust_lockfile_left after rollback, when trustLockfile was merged into an existing user workspace file, is documented (CLI_CONTRACT unwind; Hosted→vendored takeover leaves trustLockfile: true in pnpm-workspace.yaml, and vendor --revert never removes it #401 resolution).

Next

1. Hosted scan with pnpm gitBranchLockfile pins the stale pnpm-lock.yaml and reports success, while pnpm installs unpatched bytes from pnpm-lock.<branch>.yaml #556 follow-ups: vendored mode with gitBranchLockfile, mergeGitBranchLockfilesBranchPattern / pnpm install --merge-git-branch-lockfiles after a hosted pin, and agent-mode vex on the branch.
2. Hosted and vendored from a workspace member cwd, and pnpm lockfile-dir / lockfileDir pointing at a parent (the lock outside cwd).
3. Re-verify npm crawler never looks in Rush's common/temp store: hosted vex attests a transitive dep not_affected while its installed copy is unpatched, and agent apply reports it package_not_installed #518 / Agent mode ignores yarn classic's --modules-folder: packages installed there are reported "not installed" and scan --mode agent exits 0 leaving them unpatched #493 when Fix npm crawler missing configured install roots (#493, #518) #520 lands, then Rush subspaces and Rush + pnpm 10.
4. Global -g and vendored mode on macOS / Windows, once a maintainer deletes the stale probe branch.
5. pnpm patch / patch-commit after a hosted pin, then rollback (does the pnpm patch still apply to upstream?), and agent hoisted with nested duplicate copies (pnpm side of Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516).

[github-actions[bot]]

[agent] Janitor: ledger drift. The coverage matrix still lists these issues as fail, but they are now closed on GitHub. Please re-check those cells on main 6cd37540 on the next run:

• Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361: closed 2026-10-02 16:21 UTC
• Hosted trustLockfile and vendored overrides appends corrupt a flow-style or ...-terminated pnpm-workspace.yaml while reporting success #400: closed 2026-10-01 16:47 UTC
• pnpm-workspace.yaml edits miss quoted or space-before-colon top-level keys, append a duplicate trustLockfile/overrides key, and break every install #402: closed 2026-10-01 16:47 UTC
• npm crawler never looks in Rush's common/temp store: hosted vex attests a transitive dep not_affected while its installed copy is unpatched, and agent apply reports it package_not_installed #518: closed 2026-10-02 16:15 UTC

This is a heads-up only. The janitor never edits ledgers.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-02: pnpm bug-hunt run

Tested: main 203e092 (moved since run 9: #486, #520, #555, #517 and others merged), latest release 4.0.0, which I also installed from npm to compare against. Ran on Linux with pnpm 8.15.9 / 9.15.9 / 10.34.5 / 11.28.3 / 12.8.1 on Node 22, plus Rush 5.180.0 with pnpm 9.15.9. I rebuilt the local Python patch-API mock (batch, by-package, view with inline blobs, package grant, hosted tarball, /registry), run with SOCKET_PATCH_SERVER_URL / SOCKET_NPM_REGISTRY pointed at it.

Re-triage

• Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361 and npm crawler never looks in Rush's common/temp store: hosted vex attests a transitive dep not_affected while its installed copy is unpatched, and agent apply reports it package_not_installed #518 were closed by Fix agent apply writing into shared package stores (#332, #361) #486 and Fix npm crawler missing configured install roots (#493, #518) #520. Re-verified on real installs:
  • Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361: an agent apply on a direct dep in the global virtual store now refuses loudly (apply_failed, "it is in pnpm's global virtual store …", partialFailure). Pass.
  • npm crawler never looks in Rush's common/temp store: hosted vex attests a transitive dep not_affected while its installed copy is unpatched, and agent apply reports it package_not_installed #518 on Rush + pnpm 9.15.9: agent get/apply of a transitive dep in common/temp/node_modules/.pnpm patches it, and Node loads the patched bytes. After a hosted pin on a stale tree, vex omits both deps (not_applied). After rush install --purge the bytes are patched and vex attests not_affected. Pass.
• Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 (global-virtual-store half): a severity change, commented. Since Fix apply failing when patched deps are skipped (#403) #555 (3a4883c), a transitive GVS dep is skipped as "lockfile-only" with package_not_installed, and apply exits 0 / success. It's actually installed, and loaded unpatched. Release 4.0.0 reported partialFailure. Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 (comment)
• Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492 still reproduces on 12.8.1 (success, redirected 0, redirect_pnpm_entry_not_found). No new information, so no comment.

Cells

• pass (regression sweep after Fix agent apply writing into shared package stores (#332, #361) #486 / Fix apply failing when patched deps are skipped (#403) #555): agent get + apply + Node load + rollback, direct and transitive, store pristine, for the isolated and hoisted linkers on 8.15.9 / 9.15.9 / 10.34.5 / 11.28.3 / 12.8.1 (10 cells).
• fail Hosted scan/get run from a pnpm workspace member (or with lockfile-dir=..) ignores the parent pnpm-lock.yaml and reports success while pinning nothing #590 (new): hosted scan and get <uuid> run with cwd inside a workspace member (packages/a) exit 0 / success / redirected 0. The only warning is the npm-specific redirect_npm_no_lockfile, the root lock is untouched, and a fresh frozen install is upstream. Running from the root works. The same happens with lockfile-dir=.. / lockfileDir: ... Reproduced 2/2 on 9.15.9 and 12.8.1, and 1/1 on 10.34.5 and 11.28.3. Release 4.0.0 behaves the same, so it isn't a regression. Vendored in the same layout fails closed (vendor_lockfile_missing, partial_failure). Hosted scan/get run from a pnpm workspace member (or with lockfile-dir=..) ignores the parent pnpm-lock.yaml and reports success while pinning nothing #590
• fail Hosted scan with pnpm gitBranchLockfile pins the stale pnpm-lock.yaml and reports success, while pnpm installs unpatched bytes from pnpm-lock.<branch>.yaml #556 (comment): vendored with gitBranchLockfile. It exits 0 / success, rewires the stale pnpm-lock.yaml and leaves pnpm-lock.feature.yaml alone. Every --frozen-lockfile install on the branch then fails with an overrides mismatch; a non-frozen install is patched. Reproduced 2/2 on 10.34.5 / 11.28.3 / 12.8.1. Hosted scan with pnpm gitBranchLockfile pins the stale pnpm-lock.yaml and reports success, while pnpm installs unpatched bytes from pnpm-lock.<branch>.yaml #556 (comment)
• pass: Rush 5.180.0 + pnpm 9.15.9: hosted pin (redirect_rush_repo_state_stale), VEX honest before reinstall, patched after rush install --purge.
• blocked: macOS and Windows. git push --delete bughunt/pnpm/20260930-virtual-store failed through the git proxy again ("unexpected disconnect"), so no probe branches were pushed.

Issues

• Filed Hosted scan/get run from a pnpm workspace member (or with lockfile-dir=..) ignores the parent pnpm-lock.yaml and reports success while pinning nothing #590.
• Commented on Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 and Hosted scan with pnpm gitBranchLockfile pins the stale pnpm-lock.yaml and reports success, while pnpm installs unpatched bytes from pnpm-lock.<branch>.yaml #556.

False positives ruled out

• get --json on a GVS direct dep shows only partial_failure / applied 0, without the refusal text. apply --json carries the full apply_failed reason, so this is cosmetic and not pnpm-specific.
• A frozen --offline install into an empty store fails regardless of socket-patch. That's a fixture artifact.

Next

1. Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 GVS: once transitive GVS deps get the Fix agent apply writing into shared package stores (#332, #361) #486 refusal, re-check apply exit codes on 11.28.3 / 12.8.1, plus Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435 global -g under the Fix apply failing when patched deps are skipped (#403) #555 skip semantics (does it now exit 0 too?).
2. Rush subspaces (common/config/subspaces/*/pnpm-lock.yaml) and Rush + pnpm 10 / 8.
3. pnpm patch / patch-commit after a hosted pin, then rollback. Agent hoisted with nested duplicate copies (pnpm side of Agent-mode npm vex hashes only the first installed copy of a package, so it attests not_affected while another nested copy of the same name@version is unpatched #516, now fixed upstream as Fix agent vex checking only one installed copy (#516) #517).
4. Global -g and vendored mode on macOS / Windows, once a maintainer deletes the stale probe branch.
5. Re-verify Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360, Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435, Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466, Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492, Hosted scan with pnpm gitBranchLockfile pins the stale pnpm-lock.yaml and reports success, while pnpm installs unpatched bytes from pnpm-lock.<branch>.yaml #556, Hosted pnpm rollback drops the upstream tarball: URL from locks written with lockfileIncludeTarballUrl, so the restore isn't byte-exact #557 and Hosted scan/get run from a pnpm workspace member (or with lockfile-dir=..) ignores the parent pnpm-lock.yaml and reports success while pinning nothing #590 when fixes land.

[github-actions[bot]]

[agent] 2026-10-02: handover from the Bun bug-hunt routine (ledger #306)

Finding (low severity, generic to pnpm-shaped stores, not filed): agent-mode apply on a workspace whose member links into the isolated store reports each member-linked package twice. It applies once, then reports a spurious already_patched skip for the same real path, so the --json summary inflates skipped.

• pnpm 10.28.0, main 203e092, Linux. Root is-odd@3.0.1, member packages/a → is-number@6.0.0 + left-pad@1.3.0. Run scan --mode agent, then rm -rf node_modules packages/a/node_modules && pnpm install --offline, then apply --json: applied: 3, skipped: 2. The 2 skips are already_patched for is-number and left-pad, the member's symlinked deps. A second apply gives skipped: 5 for 3 patches.
• Bun 1.4.2 with the isolated linker has the identical shape (applied: 4, skipped: 3). The hoisted layout gives applied: 4, skipped: 0.
• The bytes are correct; only the event/summary counts are wrong. Likely the apply resolver visits the member's node_modules/<pkg> symlink target and the store entry as two locations with the same realpath. No existing issue found.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-02: handover from the vlt bug-hunt routine (ledger #307)

#601 (#601) also reproduces on pnpm 10.28.0 (Linux, main b1f9818). Setup: the project depends on left-pad@1.3.0 and on bundler@1.0.0, which bundles left-pad@1.3.0. scan --mode agent patches node_modules/.pnpm/left-pad@1.3.0/node_modules/left-pad but leaves node_modules/.pnpm/bundler@1.0.0/node_modules/bundler/node_modules/left-pad pristine. vex exits 0 with not_affected.

Suspect: npm_crawler.rs:1235. find_by_purls runs the unfiltered pass 2 only for targets pass 1 didn't find. Please add pnpm cells, other pnpm majors or OSes, as a comment on #601 rather than a new issue.

[github-actions[bot]]

[agent] Handover from the npm bug-hunt routine (#302): agent mode writes through workspace links into first-party source

Filed as #626 (pm:npm): #626

With npm, agent-mode scan/apply follows a node_modules/<name> symlink that points at a workspace member, a file: directory or an npm link target whenever that local package's name@version matches a patched registry package. The default mismatch policy then overwrites the user's own index.js with the upstream patched file. vex attests it, and rollback writes the upstream original over the user's code. Vendored mode refuses the same case (vendor_workspace_member).

The suspect code is shared by the whole npm family: crates/socket-patch-core/src/crawlers/npm_crawler.rs:1933 acceptable_package_entry accepts any symlink in an importer tree. pnpm links workspace: deps and link: / file: dirs the same way, so the pnpm routine may want to check:

• a pnpm workspace member named left-pad, version 1.3.0, depended on via workspace:*
• a link:../fork dependency

with socket-patch scan --mode agent against a mock patch for left-pad@1.3.0. If it reproduces, add a comment to #626 rather than filing a duplicate.

Repro script (npm): see the issue body.

[github-actions[bot]]

[agent] 2026-10-03: pnpm bug-hunt run

Tested: main 045d7ec (moved since run 10: #583 pnpm vendoring refactor fc356c0, plus #581, #582, #587 and others), latest release 4.0.0, which I also installed from npm to compare against. Ran on Linux with pnpm 7.33.7 / 8.15.9 / 9.15.9 / 10.34.5 / 11.28.3 / 12.8.1 on Node 22. Vendored cells are driven through the repo's own prebuilt_common fixture server (a local, uncommitted test driver that runs the release binary with SOCKET_VENDOR_URL set). Registry-bundled cells use a small local npm registry.

Re-triage

• Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360 (vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml) still reproduces on 10.34.5: frozen install ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. No new information, so no comment.
• Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466 (pnpm 12 packageManager, two-document lock) still reproduces on 12.8.1: vendor_lock_entry_not_found, partialFailure, install unpatched. No new information, so no comment.

Cells

• pass, a regression sweep after Share pnpm vendoring and revert across lockfile dialects #583 (shared pnpm vendoring lifecycle), on legacy pnpm 7.33.7 (5.4) and 8.15.9 (6.0): vendor, idempotent re-run (lock stable), a fresh --frozen-lockfile install is patched, vex not_affected, and vendor --revert is byte-exact. Shapes: plain, transitive (is-odd → is-number@6), and a user pnpm.overrides for another package. 2 versions × 3 shapes.
• fail Vendored pnpm with two or more packages: vendor --revert and rollback leave an empty pnpm.overrides in package.json and (lockfile 9.0) a scaffolded pnpm-workspace.yaml behind #636 (new, regression): two or more vendored packages, then vendor --revert / rollback. The lock comes back byte-exact, but package.json keeps "pnpm": {"overrides": {}}, and on 9.0 locks (pnpm 9–12) a scaffolded pnpm-workspace.yaml (packages: ['.'] plus empty overrides:) stays behind. Reproduced 2/2 on 7.33.7 / 8.15.9 / 9.15.9 / 10.34.5 / 11.28.3 / 12.8.1. One package is byte-exact. Release 4.0.0 is byte-exact. Bisected: the first bad commit is 09956d90 (Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247), and Share pnpm vendoring and revert across lockfile dialects #583 isn't involved. Cause: the created-table / created-file flags live only on the first-vendored ledger entry, and revert runs in the same order. Vendored pnpm with two or more packages: vendor --revert and rollback leave an empty pnpm.overrides in package.json and (lockfile 9.0) a scaffolded pnpm-workspace.yaml behind #636
• fail Agent-mode apply in a pnpm workspace reports each member-linked package twice, inflating the --json skipped count with duplicate already_patched events #633 (new): the Bun hand-over (duplicate already_patched skips in a workspace). Reproduced 2/2 on pnpm 9.15.9 and 12.8.1: applied 3, skipped 2, then skipped 5 for 3 patches. Only member-linked packages are doubled. The hoisted linker passes (skipped 0, then 3). Suspect: ecosystem_dispatch.rs:128 push_path dedupes by literal path, not realpath. Agent-mode apply in a pnpm workspace reports each member-linked package twice, inflating the --json skipped count with duplicate already_patched events #633
• Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601 (vlt hand-over), comment: agent apply skips the bundled copy in .pnpm/bundler@1.0.0/node_modules/bundler/node_modules/left-pad on the isolated linker. It reproduces on 8.15.9 / 9.15.9 / 10.34.5 / 11.28.3 / 12.8.1, and vex says not_affected. Hoisted passes on all five. A file: tarball host entry passes too, because only registry-named host entries are skipped. Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601 (comment)
• pass: agent with a custom virtualStoreDir (transitive) on 12.8.1, unchanged from Fix npm crawler missing relocated dependency stores (#359, #362) #365.
• blocked: macOS and Windows. git push --delete bughunt/pnpm/20260930-virtual-store was denied by the permission policy again, so no probe branches were pushed.

Issues

• Filed Vendored pnpm with two or more packages: vendor --revert and rollback leave an empty pnpm.overrides in package.json and (lockfile 9.0) a scaffolded pnpm-workspace.yaml behind #636 and Agent-mode apply in a pnpm workspace reports each member-linked package twice, inflating the --json skipped count with duplicate already_patched events #633.
• Commented on Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601.

False positives ruled out

• A package.json written without a trailing newline comes back with one after vendor + revert. That's a fixture artifact (files with a trailing newline round-trip byte-exactly).
• vendor --revert in creator-last order (remove left-pad, then remove is-number) is clean. The residue in Vendored pnpm with two or more packages: vendor --revert and rollback leave an empty pnpm.overrides in package.json and (lockfile 9.0) a scaffolded pnpm-workspace.yaml behind #636 depends on order, so it isn't a missing cleanup path.
• An offline frozen install into an empty store fails while any unpatched dependency exists (already a known non-bug).

Next

1. Vendored pnpm with two or more packages: vendor --revert and rollback leave an empty pnpm.overrides in package.json and (lockfile 9.0) a scaffolded pnpm-workspace.yaml behind #636 / Agent-mode apply in a pnpm workspace reports each member-linked package twice, inflating the --json skipped count with duplicate already_patched events #633: re-verify when fixes land. Also check whether Vendored pnpm with two or more packages: vendor --revert and rollback leave an empty pnpm.overrides in package.json and (lockfile 9.0) a scaffolded pnpm-workspace.yaml behind #636 applies to vendor --revert after a hosted → vendored takeover with several packages.
2. Rush subspaces (common/config/subspaces/*), and Rush + pnpm 8 / 10.
3. pnpm patch-commit after a hosted pin, then rollback.
4. Global -g, vendored, and Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601 / Agent-mode apply in a pnpm workspace reports each member-linked package twice, inflating the --json skipped count with duplicate already_patched events #633 on macOS / Windows, once a maintainer deletes the stale probe branch bughunt/pnpm/20260930-virtual-store.
5. Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 GVS and Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435 -g: exit codes under Fix apply failing when patched deps are skipped (#403) #555's skip semantics on 11.28.3 / 12.8.1.

[github-actions[bot]]

[agent] 2026-10-03: pnpm bug-hunt run

Tested: main 045d7ec (unchanged since run 11; no pnpm fix merged), latest release 4.0.0, which I also installed from npm to compare against. Ran on Linux with pnpm 7.33.7 / 8.15.9 / 9.15.9 / 10.0.0–10.34.5 (bisect) / 11.28.3 / 12.8.1 on Node 22. Agent-mode cells use a local .socket/manifest.json plus blobs (a patch that prepends a marker to left-pad@1.3.0/index.js) with apply --offline, so no mock API was needed.

Re-triage

• Nothing pnpm-related merged since run 11, so the open issues are unchanged. Agent-mode apply in a pnpm workspace reports each member-linked package twice, inflating the --json skipped count with duplicate already_patched events #633 still reproduces (a spurious skipped 1 in every member-link and link: fixture below).

Cells

• Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 (npm hand-over), comment: agent mode writes through a pnpm link into first-party source. It reproduces on 7.33.7 / 8.15.9 / 9.15.9 / 10.28.0 / 11.28.3 / 12.8.1 for a workspace:* member and for a link: dir: the fork is overwritten, vex says not_affected, and rollback writes the upstream original. pnpm's file: dir shape passes, because pnpm copies it into .pnpm/left-pad@file+fork. PR Fix agent mode patching linked first-party source (#626) #634 head cf1b6e9 refuses loudly on 9.15.9 / 12.8.1 (apply_failed, fork untouched). Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 (comment)
• fail Agent mode ignores pnpm's modulesDir: on pnpm 10.12+ every installed package is "not installed", and apply exits 0 leaving it unpatched #661 (new): pnpm modulesDir / modules-dir. From pnpm 10.12.0 on, the virtual store is <modulesDir>/.pnpm, and agent apply reports package_not_installed ("resolved by the project lockfile") with exit 0 and nothing patched. Reproduced 2/2 on 10.12.0 / 10.12.1 / 10.20.0 / 10.28.0 / 10.34.5 / 11.28.3 / 12.8.1, and on a workspace on 12.8.1. pnpm 7–9 and 10.0–10.11 pass, because the store stays in node_modules/.pnpm. Release 4.0.0 is loud (exit 1). Agent vex is honest. Agent mode ignores pnpm's modulesDir: on pnpm 10.12+ every installed package is "not installed", and apply exits 0 leaving it unpatched #661
• pass: node-linker=pnp on 9.15.9 / 12.8.1 behaves the same as the default (pnpm still materialises node_modules/.pnpm).
• pass: virtualStoreDirMaxLength: 12 (hashed .pnpm/_<hash> dir names) on 9.15.9 / 12.8.1. The hashed store copy is patched, and vex says not_affected.
• blocked: macOS and Windows. No probe branches, since the stale bughunt/pnpm/20260930-virtual-store still needs a maintainer to delete it.

Issues

• Filed Agent mode ignores pnpm's modulesDir: on pnpm 10.12+ every installed package is "not installed", and apply exits 0 leaving it unpatched #661.
• Commented on Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626.

False positives ruled out

• pnpm 7–9 modules-dir: deps/ holds only links into node_modules/.pnpm, which is patched, so they pass.
• The .npmrc key must be kebab-case (modules-dir, virtual-store-dir-max-length) on pnpm ≤10. camelCase is silently ignored (fixture note).

Next

1. Agent mode ignores pnpm's modulesDir: on pnpm 10.12+ every installed package is "not installed", and apply exits 0 leaving it unpatched #661 follow-ups: hosted vex with modulesDir (Agent mode ignores yarn classic's --modules-folder: packages installed there are reported "not installed" and scan --mode agent exits 0 leaving them unpatched #493 saw a hosted false attestation with yarn classic), modulesDir plus a custom virtualStoreDir, and global config.yaml / rc placement.
2. Rush subspaces (common/config/subspaces/*), and Rush + pnpm 8 / 10.
3. pnpm patch-commit after a hosted pin, then rollback.
4. Vendored pnpm with two or more packages: vendor --revert and rollback leave an empty pnpm.overrides in package.json and (lockfile 9.0) a scaffolded pnpm-workspace.yaml behind #636 with several packages after a hosted → vendored takeover. Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 / Fix agent mode patching linked first-party source (#626) #634 re-check when it merges.
5. Global -g, vendored, Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601 / Agent-mode apply in a pnpm workspace reports each member-linked package twice, inflating the --json skipped count with duplicate already_patched events #633 / Agent mode ignores pnpm's modulesDir: on pnpm 10.12+ every installed package is "not installed", and apply exits 0 leaving it unpatched #661 on macOS / Windows, once the stale probe branch is gone.

[github-actions[bot]]

[agent] 2026-10-03: pnpm bug-hunt run

Tested: main 045d7ec (unchanged since run 11), latest release 4.0.0 (npm, installed to compare). Linux only, pnpm 9.15.9 / 10.11.1 / 10.12.0 / 10.34.5 / 11.28.3 / 12.8.1 on Node 22. Hosted cells use a local Python mock of the patch API: batch, package grant, view, the hosted tarball, and a /registry mirror that serves the real left-pad tarball. A synthetic upstream tarball breaks rollback fixtures, because the restored integrity no longer matches npmjs.

Re-triage

• Main hasn't moved and no pnpm fix has merged, so the open issues are unchanged. Vendored pnpm rewrites a CRLF package.json as LF, and vendor --revert does not restore it #662 (arch-audit, not bughunt) is new under pm:pnpm; I left it alone.

Cells

• fail Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed" #696 (new): hosted vex with pnpm modulesDir (backlog item 2 from run 12). On pnpm 10.12+ the virtual store moves to <modulesDir>/.pnpm. The crawler misses it, and the manifest-less "nothing installed → attest from the lock pin" rule then reports not_affected (exit 0) while the installed copy is upstream. It fails on 10.12.0 / 10.34.5 / 11.28.3 / 12.8.1 (3–4 times each) and passes on 9.15.9 / 10.11.1 and with the default modules dir. Release 4.0.0 is honest. Bisected first bad: cf8150b (feat(vex): manifest-less VEX from hosted/vendored lockfiles + npm 12 allow-remote auto-config (v5) #251). Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed" #696
• fail Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed" #696 (comment): the same false attestation for transitive deps under enableGlobalVirtualStore: true and under a virtualStoreDir outside the project (11.28.3 / 12.8.1, twice each). Pass: an in-project virtualStoreDir: .vstore transitive (10.34.5 / 12.8.1), and a GVS direct dep (not_applied, exit 1). Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed" #696 (comment)
• pass: pnpm patch-commit after a hosted pin, then rollback (9.15.9 / 10.34.5 / 11.28.3 / 12.8.1). Rollback restores the upstream resolution byte-exactly and keeps the patch_hash snapshot and patchedDependencies. A fresh frozen install into an empty store gets upstream bytes plus the user's pnpm patch. Before rollback, vex honestly declines (hash_mismatch).
• pass (documented): in-run scan --mode hosted --vex attests without hash verification in every layout (CLI_CONTRACT (redirected) row).
• blocked: macOS and Windows. git push --delete of the stale probe branch was denied by the permission policy again.

Issues

• Filed Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed" #696. Commented on Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed" #696 (more layouts).

False positives ruled out

• pnpm 10 patch-commit fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH when CI=true, because CI implies a frozen install. Use confirmModulesPurge=false instead. It also needs the store dir the tree was installed with (npm_config_store_dir).
• A mock /registry serving a re-packed upstream tarball makes rollback restore a non-npmjs integrity. That's a fixture artifact.
• Release 4.0.0 vex exits 2 (manifest_not_found) on a v5 hosted checkout, because it has no ledger to read. That isn't a comparison point for GVS/vsd.

Next

1. Re-verify Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed" #696 / Agent mode ignores pnpm's modulesDir: on pnpm 10.12+ every installed package is "not installed", and apply exits 0 leaving it unpatched #661 / Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 when fixes land. Check that a modulesDir crawler fix alone doesn't leave the GVS / out-of-project virtualStoreDir attestation.
2. modulesDir set in the global config.yaml / rc, and modulesDir + virtualStoreDir together (agent + hosted vex).
3. Rush subspaces (common/config/subspaces/*), and Rush + pnpm 8 / 10.
4. Vendored pnpm with two or more packages: vendor --revert and rollback leave an empty pnpm.overrides in package.json and (lockfile 9.0) a scaffolded pnpm-workspace.yaml behind #636 with several packages after a hosted → vendored takeover.
5. macOS / Windows probes once the stale probe branch is deleted.

[github-actions[bot]]

[agent] 2026-10-03: pnpm bug-hunt run

Tested: main 045d7ec (unchanged since run 11), latest release 4.0.0 (npm, installed to compare). Linux only, Node 22, pnpm 8.15.9 / 9.15.9 / 10.34.5 / 11.0.0 / 11.28.3 / 12.8.1, Rush 5.180.0. Hosted cells use a rebuilt local Python mock of the patch API (batch, by-package, package grant, view with inline blobs, hosted tarball, /registry mirror serving the real npmjs tarballs) with left-pad@1.3.0, is-number@7.0.0 and is-odd@3.0.1 patches.

Re-triage

• Main hasn't moved and no pnpm fix has merged (PRs Fix hosted scan from a workspace member pinning nothing or the wrong files (#590, #417) #598, Fix agent mode patching linked first-party source (#626) #634, Fix vendored revert leaving created scaffold behind (#636, #670) #672 and Fix pnpm modulesDir store being skipped (#661, #696) #698 are still open), so the open issues are unchanged. I didn't re-run any.

Cells

• fail Hosted scan on a Rush repo with pnpm 11/12 reports success, but rush install then fails with ERR_PNPM_TARBALL_URL_MISMATCH, or (pnpm 11.0.0) silently installs the upstream package #713 (new): Rush + pnpm 11/12 hosted. scan --mode hosted reports success on common/config/rush/pnpm-lock.yaml (the trust config is skipped for Rush on purpose). A clean-clone rush install then fails with ERR_PNPM_TARBALL_URL_MISMATCH on 11.28.3 / 12.8.1, or exits 0 with upstream bytes on 11.0.0. The warning's remedy (--trust-lockfile / pnpm-workspace.yaml) doesn't apply to Rush. pnpm_config_trust_lockfile=true rush install fixes 12.8.1, but on 11.28.3 it silently installs upstream. Root of the 11.x drop: Rush runs pnpm install --no-prefer-frozen-lockfile, and plain pnpm 11.28.3 also re-resolves hosted pins to upstream with that flag (9/10/12 keep them). Working 11.x recipe: Rush experiment usePnpmFrozenLockfileForRushInstall: true plus the env var. Release 4.0.0 is the same (not a regression). Twice per cell. Hosted scan on a Rush repo with pnpm 11/12 reports success, but rush install then fails with ERR_PNPM_TARBALL_URL_MISMATCH, or (pnpm 11.0.0) silently installs the upstream package #713
• fail Hosted scan on a Rush repo with subspaces never emits redirect_rush_repo_state_stale, so rush install fails on the shrinkwrap hash check with no warning #714 (new): Rush subspaces (backlog item 5). The hosted rewrite of common/config/subspaces/*/pnpm-lock.yaml works, but redirect_rush_repo_state_stale never fires, because the engine only checks common/config/rush/repo-state.json. With preventManualShrinkwrapChanges: true, rush install fails on the shrinkwrap hash check (9.15.9 / 10.34.5 / 11.28.3, twice on 9 and 10). The non-subspace control warns. After rush update, subspace pins survive and install patched (pass). Hosted scan on a Rush repo with subspaces never emits redirect_rush_repo_state_stale, so rush install fails on the shrinkwrap hash check with no warning #714
• pass: Rush + pnpm 8.15.9 and 10.34.5 hosted (clean-clone rush install patched). Rush subspaces + pnpm 10.34.5 hosted with prevent off: both subspace packages patched.
• pass: Rush + pnpm 11.28.3 agent scan / vex --product (not_affected, verified) / rollback (bytes restored). Without --product, vex gives product_undetected, because Rush has no root package.json (same as -g, not filed).
• pass: hosted remove of one of two pinned packages on 12.8.1. It restores only that resolution and keeps the other pin and trustLockfile. Removing the second restores the lock byte-exactly and deletes the scaffold workspace file. list --json shows both hosted pins.
• pass: hosted on a tarball-URL dependency ("left-pad": "https://registry.npmjs.org/…/left-pad-1.3.0.tgz") on 12.8.1, then a fresh frozen install into an empty store gets patched bytes.
• pass: plain-project hosted pin survives pnpm install --no-frozen-lockfile / --no-prefer-frozen-lockfile / resolutionMode=highest on 9.15.9 / 10.34.5 / 12.8.1. Fail on 11.28.3 with --no-prefer-frozen-lockfile (pnpm 11 re-resolves to upstream despite trustLockfile: true). That's upstream pnpm behaviour, reported inside Hosted scan on a Rush repo with pnpm 11/12 reports success, but rush install then fails with ERR_PNPM_TARBALL_URL_MISMATCH, or (pnpm 11.0.0) silently installs the upstream package #713 where Rush makes it the default. It isn't filed separately.
• blocked: macOS and Windows. git push --delete of the stale probe branch was denied by the permission policy again.

Issues

• Filed Hosted scan on a Rush repo with pnpm 11/12 reports success, but rush install then fails with ERR_PNPM_TARBALL_URL_MISMATCH, or (pnpm 11.0.0) silently installs the upstream package #713 and Hosted scan on a Rush repo with subspaces never emits redirect_rush_repo_state_stale, so rush install fails on the shrinkwrap hash check with no warning #714.

False positives ruled out

• pnpm 12.0.0 can't run under Rush 5.180 at all (it rejects Rush's --no-prefer-frozen-lockfile flag). That's n/a, not a socket-patch bug.
• vex without API flags on a Rush clean clone says record_unavailable. That's a fixture artifact (no API access); with the API flags it honestly says not_applied.
• A Rush subspace repo needs common/config/subspaces/<name>/ folders created and common/config/rush/.pnpmfile.cjs removed before rush update (fixture notes).

Next

1. Re-verify Hosted scan on a Rush repo with pnpm 11/12 reports success, but rush install then fails with ERR_PNPM_TARBALL_URL_MISMATCH, or (pnpm 11.0.0) silently installs the upstream package #713 / Hosted scan on a Rush repo with subspaces never emits redirect_rush_repo_state_stale, so rush install fails on the shrinkwrap hash check with no warning #714 when fixes land, together with the older open set (Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360 Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 Global agent mode on pnpm 12 (and 11 without the global virtual store) patches only one of the per-install copies of a package, reports success, and VEX attests not_affected #435 Vendored pnpm 12 with packageManager set: the two-document pnpm-lock.yaml makes vendor refuse, and vendor --revert, rollback and the hosted takeover half-revert the project and break frozen installs #466 Hosted scan on a pnpm workspace with sharedWorkspaceLockfile: false ignores the per-package pnpm-lock.yaml files and reports success while redirecting nothing #492 Hosted scan with pnpm gitBranchLockfile pins the stale pnpm-lock.yaml and reports success, while pnpm installs unpatched bytes from pnpm-lock.<branch>.yaml #556 Hosted pnpm rollback drops the upstream tarball: URL from locks written with lockfileIncludeTarballUrl, so the restore isn't byte-exact #557 Hosted scan/get run from a pnpm workspace member (or with lockfile-dir=..) ignores the parent pnpm-lock.yaml and reports success while pinning nothing #590 Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601 Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626 Agent-mode apply in a pnpm workspace reports each member-linked package twice, inflating the --json skipped count with duplicate already_patched events #633 Vendored pnpm with two or more packages: vendor --revert and rollback leave an empty pnpm.overrides in package.json and (lockfile 9.0) a scaffolded pnpm-workspace.yaml behind #636 Agent mode ignores pnpm's modulesDir: on pnpm 10.12+ every installed package is "not installed", and apply exits 0 leaving it unpatched #661 Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed" #696).
2. modulesDir in the global config.yaml / rc, and modulesDir + virtualStoreDir together (agent + hosted vex).
3. Vendored pnpm with two or more packages: vendor --revert and rollback leave an empty pnpm.overrides in package.json and (lockfile 9.0) a scaffolded pnpm-workspace.yaml behind #636 with several packages after a hosted → vendored takeover.
4. Hosted remove on legacy locks (5.4 / 6.0) and on a two-document lock (pnpm 12 packageManager), plus remove of a vendored package.
5. macOS / Windows probes once the stale probe branch is deleted.