[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1115

Summary

A hosted scan of a yarn 1 workspace now refuses with redirect_yarn_classic_offline_mirror (and writes nothing, attests nothing) when yarn run in any workspace member would use a yarn-offline-mirror, e.g. one set only in packages/a/.yarnrc or packages/a/.npmrc. Before, it pinned the root yarn.lock, exited 0, VEX said not_affected, and every install run from that member failed Integrity check failed for "left-pad".

Root cause

resolve_outer_yarn_mirror_for_process (crates/socket-patch-core/src/patch/redirect/yarnrc.rs) resolved the mirror the way yarn 1 does from the scan root only: root rc files, env, user / global rc, the root's ancestors. Yarn 1 builds its config from the directory it runs in, and a member is a supported install directory (cd packages/a && yarn install, yarn --cwd packages/a install), which still installs into the root lock. A member's own rc files were never read.

Fix

• yarn_classic_workspace_members lists the members yarn 1 installs for a classic lock: dirs holding a package.json that the root workspaces (array or object form) list, matched with the shared workspaces_include_as matcher in yarn classic's dialect. It follows dir links like yarn's globber, skips node_modules / .git, searches as deep as the deepest pattern (**: 32 levels), and stops after 20,000 dirs. It only runs when the root holds a classic yarn.lock and declares workspaces.
• resolve_member_yarn_mirror resolves, per member, the full yarn 1 layering with the member as the project (its rc files as the project layer, the root's as an ancestor's) and returns the first member mirror. It lands in a new OuterYarnMirror::member field, which yarn_classic_offline_mirror falls back to. The refusal detail names the file and the member (…/packages/a/.yarnrc, as read by yarn run in the workspace member …/packages/a).
• The hosted scan, its classic tarball prefetch and the vendored→hosted takeover all read the same resolver, so all three refuse. The hosted scan now resolves it once (OnceLock) instead of on every rewrite pass.
• docs/ecosystems.md documents the member layer.

No wrapper (npm/, pypi/, gem/) change: they only dispatch to the binary.

Tests (per issue)

• Hosted yarn classic offline-mirror refusal misses a mirror set in a workspace member's .yarnrc, so installs run from that member fail the integrity check while the scan reports success and VEX attests #1115 member .yarnrc (issue repro) and member .npmrc (follow-up comment): e2e classic_offline_mirror_in_workspace_member_rc_refuses_hosted in e2e_redirect_yarn_classic_build does a real yarn 1.22 install from member a (filling the mirror), scans from the root, and asserts the refusal, no applied redirect, a byte-identical lock and no not_affected in the VEX.
• Unit: member_layers_read_the_members_own_rc_files, yarn_classic_workspace_members_follow_the_root_globs (object/array forms, non-members, node_modules, deep literal, symlinked member, **, berry lock, no workspaces), and a member case added to yarn_classic_outer_offline_mirror_refuses_rewrite (incl. a root .yarnrc false not hiding a member mirror).

Red → green. With the fallback in yarn_classic_offline_mirror removed, the new e2e fails with the issue's exact symptom ("status":"success", "applied":1, rewrittenFiles: ["yarn.lock"], one VEX statement) and yarn_classic_outer_offline_mirror_refuses_rewrite fails on the member case; with it, both pass.

Local runs on 1f3fc57:

• cargo fmt --all -- --check: clean. cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-cli --all-features --test e2e_redirect_yarn_classic_build: 41 passed.
• cargo test --workspace --all-features --no-fail-fast: 14,834 passed, 10 failed, all environmental in this sandbox and outside the diff: 9 tests that make a write fail with chmod (the sandbox runs as uid 0, which bypasses it) and e2e_bun_lockb::binary_shared_bundled_record_hosted_pin_is_managed (needs patches-api.socket.dev, blocked by the sandbox proxy). CI is the reference for those.

/code-review high

Fixed: symlinked members were skipped; members deeper than 8 levels were missed; the resolver (now a tree walk) ran on every rewrite pass; the refusal didn't say which member. Not changed:

• A root false no longer hides a user-level mirror in a workspace: that is yarn 1's precedence. A member run reads the user rc above the root's (an ancestor's), so that install really does use the mirror and would fail integrity. The docs now say to set false in the member too.
• Reuse an existing member walker: npm_crawler::expand_workspace_pattern_sync and UserPatchIndex::workspace_members don't read yarn classic's full pattern grammar (braces, extglob, ignored negation) that workspaces_include_as does, so this walk drives that matcher instead.
• Per-member re-resolution of the user / env layers: bounded by the member count and run once per scan now; not worth a cache.

https://claude.ai/code/session_01RJ6ze68VotuyevvN6kqX6r

---

Note

Medium Risk
Changes when yarn classic hosted redirect is allowed vs refused, which affects lockfile integrity and install behavior for workspace monorepos; bounded by new workspace walk limits and tests.

Overview
Yarn 1 hosted scans now treat yarn-offline-mirror set only on a workspace member (e.g. packages/a/.yarnrc or .npmrc) the same as a root-level mirror: hosted redirect is refused with redirect_yarn_classic_offline_mirror instead of rewriting the root yarn.lock.

Member discovery walks classic workspace globs (yarn_classic_workspace_members), resolves each member’s mirror with yarn 1’s full config layering (resolve_member_yarn_mirror → OuterYarnMirror::member), and yarn_classic_offline_mirror consults that fallback. The hosted scan resolves outer/member mirror once per run via OnceLock.

E2E and unit tests cover member rc files, workspace globbing, and docs in ecosystems.md describe member precedence (root false does not disable a user mirror for member installs).

^{Reviewed by Cursor Bugbot for commit 1f3fc57. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1f3fc57. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Labeled Ready for review (burn-down agent).

• Head: 1f3fc57
• CI: 86/86 settled green (36 success / 50 skipped); no main-wide failures on this head
• Bugbot: reviewed 1f3fc57, no findings; no open review threads
• Mergeable, no conflicts; CHANGELOG.md untouched
• Reviewer focus: the new workspace-member walk in yarnrc.rs (yarn_classic_workspace_members: glob dialect, symlink following, 20,000-dir cap) and the OuterYarnMirror::member fallback in yarn_classic_offline_mirror.

Slack announcement not sent: this run had no Slack send tool.

---

Generated by Claude Code