Bug hunt ledger: vlt

[Mikola Lysenko (mikolalysenko)]

[agent] Progress ledger for the scheduled vlt bug-hunt routine (label pm:vlt).

Last updated: 2026-10-14 (run 21), main fc5458e (run 20: 313d532; run 19: d4af25a) (main was squashed on 2026-10-10, so older SHAs here no longer resolve), latest release 5.0.1 (5.0.0 before it; 4.0.0 has no vlt support). Newest vlt: 1.3.8 (2026-10-09). The run-20 mock is the run-19 mock plus PEER=1 (left-pad peers on peer-host 1 || 2; peer-host 1.0.0 / 1.5.0 / 2.0.0, intermediates i1 → peer-host 1, i2 → peer-host 2). The run-19 mock (left-pad@1.3.0 + right-pad@1.3.0, both patchable, with a body filter; NO_ALT= enables tar.br) is attached in full to #1494, which makes it the easiest one to rebuild. Run 18 mock: two patchable packages (left-pad@1.3.0, right-pad@1.0.0), with /patches/batch and /patches/package filtered by body; PEER=1 plus intermediates i1 / i2 (peer-host 1 / 2) force two ~peer.<hex> instances. Run 17 mock adds RP=/npm (registry under a path prefix): start only the registry instance with it, because a prefixed patch server gives a false redirect_unattributable. Locally, run vlt ci --allow-scripts :scripts (otherwise vlt POSTs to api.socket.dev and the sandbox's 403 fails ci on 1.0.10 / 1.2.0; see #448). Run 9 mock adds left-pad@1.2.0 ('old') for bump tests. The run-11 mock adds a time map and WDEP= (wrapper's left-pad spec) for version-changing modifiers. The run-12 mock (rebuilt from the run-2 mock) adds ADD=1 (the patch adds lib/extra/deep/new.js) and EMPTYDIR=1 (the tarball ships empty dir entries), plus CDN=1 and bundler. Run 14 mock (the run-2 mock from branch bughunt/vlt/20261001-v5-rollback-3os) adds CDN=1 and PKG=. Run 15 adds left-pad@1.2.0 to the run-2 mock and filters /patches/batch by request body (without that filter a bumped project shows a false partial_failure). The sandbox has no ss, so poll ports with /dev/tcp. Wait for ports 18555/18556 to free up before restarting the mock: a stale mock silently serves the previous mode. Kill mocks with pkill -f '^node .*mock[.]mjs': a bare path pattern also kills the calling shell. The run-16 mock (the run-2 mock plus the batch filter) adds FAIL_PKG=1 / FAIL_ART=1, DELAY_PATH+DELAY_MS, bundler@1.0.0 and PEER=1 (left-pad peers on peer-host 1 || 2). Use ${NO_ALT-1}, not ${NO_ALT:-1}, or an empty NO_ALT= silently keeps tar.br off. To SIGINT a backgrounded run from a script, reset SIGINT to SIG_DFL first.

Method: real vlt installs (scripts/install-vlt.sh) against a local Node mock of the npm registry plus the patch API. It's a pure-JS tar writer, so it runs on every OS. The registry is on :18555 and the patch server on :18556 via SOCKET_PATCH_SERVER_URL; set SOCKET_NPM_REGISTRY to the registry for v5 rollback. The oracle is require('left-pad') printing patched / pristine. The 3-OS probe scripts are in the run-2 workflow (run 36803186961), the run-3 global-mode workflow (run 36834317384) and the run-4 bundled-copy workflow (run 36871535059, whose mock adds a bundler@1.0.0 that bundles left-pad). Run 6 mock adds PKG= (scoped names) and CDN=1 (non-conventional dist.tarball); the patch artifact leaf must be the unscoped basename. The mock's /patches/batch must answer only for purls in the request body, or scan -g shows false hits. CI already runs the capstones and the native backtest on 57 releases × 3 OS.

Coverage matrix

OS	vlt	Hosted (scan / rollback / remove)	Vendored (+ takeover, rollback)	Agent	Notes
Linux	1.0.0-rc.14	pass (rollback byte-exact, era B 3-tuple)	untested (CI)	untested (CI)	CI native leg flaked once (warmOrdinary, PR #277 run), root cause blocked
Linux	1.0.0-rc.32	untested (resolves from npmjs; mock can't serve it)	untested (CI)	untested (CI)
Linux	1.0.10	pass (incl. config.registry 3-tuple)	untested (CI)	untested (CI)
Linux	1.2.0	pass	pass	pass	brotli: flag stays 0
Linux	1.3.0	untested	untested	untested	vlt itself fails install against tar.br registries
Linux	1.3.1	fail #372 (brotli registries) before #820	fail #372 before #820	untested
Linux	1.3.2	pass on npm-style registries; fail #372 with tar.br alternates	pass (workspaces incl. 4-deep, space/unicode dirs; takeover; repair; re-run idempotent); fail #372 with tar.br	pass (hardlinked store is copy-on-write)
macOS	1.2.0 / 1.3.2	pass (probe run 2)	pass (probe run 2)	pass (probe run 2)	brotli untested
Windows	1.2.0 / 1.3.2	pass (probe run 2)	pass (probe run 2)	pass (probe run 2)	brotli untested
Linux / macOS / Windows	1.3.3	scan → vlt ci patched (probe run 3); peer-extra DepID across workspaces, alias / remote / file mix: pass (Linux, run 5); fail #372 with tar.br (Linux)	scan → vlt ci patched (probe run 3); frozen / vex / workspaces untested	pass (Linux, run 5: peer-extra store, workspaces, rollback, re-run)	new release, 2026-10-01
Linux	1.3.4 / 1.3.5	pass (run-2 matrix; dev / optional flags; multi-instance ~peer.<hex> ×2; lock mutation between scan and rollback); fail #372 with tar.br	pass (run-2 matrix, frozen, vex, dev / optional); bump / uninstall after scan: pass on main b1f9818 (#541 fixed by #543, verified 1.2.0 / 1.3.5)	pass (incl. multi-instance peer store)	new releases
Linux	1.0.10 / 1.2.0 / 1.3.3	non-conventional dist.tarball rollback / remove: fail #521 (run 6); scoped target scan / vex: pass (1.3.3)	scoped target: pass (1.3.3)	scoped target via store symlink: pass (1.3.3)	concurrent scans / SIGKILL mid-run: pass (1.3.3)
Linux	1.0.0-rc.34 / 1.0.5 / 1.1.1 / 1.3.0	pass (run-8 probe matrix; 1.3.0 without tar.br)	pass (run-8 probe matrix)	pass (run-8)	first local runs of these versions
Linux	1.3.6	run-2 matrix: pass (run 10); graph-modifier DepIDs (incl. :semver() / :v() selectors, plus a direct copy): pass; root peer+dev and peer-only: pass; #372 fixed by #820 (run 13); brotli rollback fails #941	run-2 matrix: pass; modifier variant and peer-only root: refused vendor_lock_entry_unsupported (documented); peer+dev root: pass	run-2 matrix, modifier variant (+ direct copy), peer-only root: pass	new release
Linux	1.2.0 / 1.3.6	version-changing modifier (1.2.0→1.3.0 via :root > #wrapper > #left-pad): scan / ci / vex / rollback, plus get / repair / remove (1.3.6): pass (run 11); modifier down to 1.2.0 + direct 1.3.0: pass	modifier-up refused (documented); modifier-down + direct, workspace chain (b → a@workspace:* → target), catalog bump after vendoring: pass (1.3.6)	modifier up / down, re-run: pass	run 11
Linux	1.2.0 / 1.3.6	run 12 (main 6811b4e): #601 fixed; #521 still fails (cold ci 404); npm alias lp→left-pad: pass; pin survives vlt install <other> / vlt uninstall <direct>, rollback = fresh lock: pass; patch adds a file in a new dir: pass	alias, added-file: pass	added file in a new dir, rollback / remove prune exactly: pass; added file under a shipped empty dir: fail #862 (rollback deletes the shipped dirs); linked workspace member of the same name@version refused (#634): pass, JSON gap is #424	run 12
Linux	1.0.10 / 1.2.0 / 1.3.7	run 14 (main db83f01): non-conventional dist.tarball rollback / remove (also scoped): pass when the vlt registry differs from SOCKET_NPM_REGISTRY, fail #521 residual when they're the same; scalar config.registry 3-tuple rollback: pass (1.0.10 / 1.3.7); #941 / #942 still fail	hosted pin kept when a vendored takeover is refused (transitive target, modifier variant): pass (#963, 1.3.7)	untested	run 14
Linux	1.2.0 / 1.3.7	run 15 (main 9472be4): run-2 matrix pass; #942 fixed (member refusal for every vlt pattern shape, package.json fallback); catalogs (1.3.7) pass; member with a stray vlt-lock.json: fail #1134	run-2 matrix pass; liveness after #1050 (uninstall / bump / --prune / --check) pass; catalogs pass; member refused vendor_lockfile_missing pass; stray member lock: fail #1134 (vex attests not_affected)	run-2 matrix pass; from a member: pass	run 15
Linux	1.2.0 / 1.3.7	run 16 (main 4aec9d7): run-2 matrix pass; #1134 fixed (#1161); dual-root member (own vlt.json) pass; sibling package-lock.json (with / without node_modules) pass; brotli pin survives 1.3.7 re-saves; ~peer.<hex> across 2 workspaces pass; hosted remove pass	takeover after #1039 (incl. failed / interrupted takeover, SIGINT / SIGTERM) pass; sibling npm lock: vendor_multiple_lockfiles (documented); ~peer.<hex> pass; remove pass	bundled-only and bundled + direct (1.3.7) pass; ~peer.<hex> pass	run 16
Linux	1.2.0 / 1.3.7 / 1.3.8	run 17 (main 1bd3da5, v5 envelopes): run-2 matrix pass; rollback envelope incl. rollback_failed pass; --dry-run residue-free; DepID-special member dirs (~ _ + % # ; ?) pass; path-prefixed registry pass; vlt update drops the pin (documented), vex refuses	run-2 matrix, special dirs, prefixed registry, vlt update keeps file: pass; missing vendor ledger → vendor_ledger_missing	run-2 matrix pass; global store hardlink / auto / copy is copy-on-write (1.3.8); apply --check drift detection pass; #862 still repros	run 17
Linux	1.2.0 / 1.3.8	run 19 (main d4af25a): hosted pin beside a file: dir / tarball copy (root and member) warns, in-run VEX omits, standalone vex refuses: pass; #1437 with an alias pin and with a brotli pin: pass (#941 still restores gzip)	#1437 alias / brotli mixed state: pass	path-scoped scan packages/a with member alias (#1266): pass; scan run from a member with an alias dep: fail #1494 (also pnpm 10.28); plain-name dep from a member: pass	run 19
Linux	1.2.0 / 1.3.8	run 20 (main 313d532): #1494 fixed (agent alias from a member: scan / rollback / re-run / remove / vex, 2× each on 1.2.0 / 1.3.8); scoped alias @sc/x → npm:left-pad from the root: scan / ci / vex / re-run / rollback byte-exact pass (hosted, vendored, agent; 1.2.0 / 1.3.8), from a member: documented refusals; BOM vlt.json, CRLF vlt.json, BOM member package.json: pass (1.3.8); 2 ~peer.<hex> instances shared with a workspace member: scan / vex / remove pass, takeover refused and pin kept	file: dir / tarball copy beside a registry copy (member and root, #1511 analog): refused vendor_lock_entry_unsupported; a file: copy added after vendoring: vex omits (patched_ref_unattributable) and vendor --check exits 1 (pass, 1.2.0 / 1.3.8); BOM / CRLF: pass; multi-peer + member: refused (documented)	scoped alias from root and member: pass; multi-peer + member: pass	run 20
Linux	1.2.0 / 1.3.8	run 21 (main fc5458e): #1134 stray member lock × root glob syntax: packages/*, {a,b}, **, [ab], object group refuse (pass); extglob +(a|b) / @(a|b): fail #1542 (exit 0, pin vlt ignores)	same matrix: plain globs pass; extglob: fail #1542 (member package.json rewritten, root vlt ci out of sync, vex not_affected)	untested	run 21
Linux	1.0.10 / 1.2.0 / 1.3.8	run 18 (main 15c2c83): #1437 vendored + hosted mixed state → bare scan / get mode_ambiguous, nothing written (1.0.10 / 1.2.0 / 1.3.8); mixed vex / list / remove / rollback pass; #1220 registry cap under ulimit -n 64 (rollback / remove / takeover) pass; two transitive ~peer.<hex> instances pass	multi-instance peers refused (documented), hosted pins kept; --prune after vlt uninstall reverts the entry (documented GC)	multi-instance peers pass	run 18
Linux	0.0.0-18 / 0.0.0-20 / 1.0.0-rc.5	rc.5 pass; 0.0.0-20 pins, but vlt ignores the lock (documented advisory)	0.0.0-20 / rc.5 pass (legacy warning); A0 refused (documented)	untested	run 16, eras A0 / A
Linux	1.3.7	run-2 matrix: pass (run 13); brotli (tar.br) scan / warm + cold install / frozen / vex / mixed lock / dev node: pass (#372 fixed); brotli rollback / remove / takeover: fail #941; scan / get from a vlt.json workspace member: fail #942 (also 1.2.0)	run-2 matrix, brotli: pass; rollback byte-exact	brotli lock: pass	new release
Linux	1.3.5	prerelease target, object-form workspace groups, catalog: specs, peer-shape list / remove: pass (run 8)	prerelease, object workspaces, catalog:, peer-shape takeover refusal: pass; named catalogs catalog:<name> in workspaces: pass (run 9, also 1.2.0)	prerelease, object workspaces, catalog:: pass

Bundled copies (a package bundling the patched name@version; vlt-lock.json never records the bundled copy)

OS	vlt 1.0.10	vlt 1.2.0	vlt 1.3.3
Linux / macOS / Windows	hosted + vendored: fail #471 before #472. Linux on main b1f9818: pass (skip warning, vex refuses)	same as 1.0.10	same as 1.0.10 (1.3.5 also passes on Linux)
Linux (agent: bundled copy plus a normal install of the same name@version)	fail #601 before #605	pass on main 6811b4e (run 12)	fail #601 before #605 (1.3.6 passes on 6811b4e)

Global mode (-g; vlt has no global install, so this is an npm global prefix with a vlt project in the cwd)

OS	vlt	scan -g report	-g / SOCKET_GLOBAL / --global-prefix × --mode hosted refusal	agent apply / vex / rollback (-g, get -g, env)	--global-prefix with space + unicode	unwritable prefix	rollback -g / remove -g leave the project alone	vendor -g / vendor --revert -g leave the project alone
Linux	1.0.10 / 1.2.0 / 1.3.3	pass	pass	pass	pass	pass (scan); get re-run → npm handover	pass (#446; with a hosted project too, run 5)	pass after #499 (1.2.0 / 1.3.6, flags and env: exit 2 global_scope_unsupported, project kept; run 10)
macOS	1.0.10 / 1.2.0 / 1.3.3	pass	pass	pass	pass	pass (scan)	untested since #446	untested
Windows	1.0.10 / 1.2.0 / 1.3.3	fail #434 (default prefix)	pass	fail #434 (default prefix)	pass	untested	untested since #446	untested

Backlog

1. Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json still write to that lock and exit 0 when the root's workspaces glob uses an extglob (packages/+(a|b), packages/@(a|b)); vendored VEX then attests not_affected #1542 once it's fixed: every extglob form (?( ), *( ), !( )), the !-order case (["!packages/a","packages/*"]) and package.json workspaces.
2. More vlt glob syntax: .. segments, dot-dirs (packages/.x), case on case-insensitive filesystems.
3. Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862 once it's fixed (shipped empty dirs, nested new dirs, remove, macOS / Windows). patch/rollback.rs is still unchanged on fc5458e; rebuild the run-12 ADD=1 / EMPTYDIR=1 mock to re-run it.
4. Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data? #1130's decision on vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941 (brotli restore).
5. repair from a member with an alias dep (needs a mock that serves diff archives; the current mock gives download_failed).
6. Three distinct ~peer.<hex> instances: vlt dedupes a member's peer-dependent package onto an existing instance even when the member pins a different peer version (see Known non-bugs). Try three intermediates (peer-host 1.0.0 / 1.5.0 / 2.0.0) with no root or member direct dep.
7. The vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 residual (same-mirror SOCKET_NPM_REGISTRY, comment): re-check after the next restore change.
8. vlt 1.3.6 … 1.3.8 on macOS / Windows (probe branches are blocked). vlt-compatibility.yml is disabled_manually since 2026-10-09, so CI covers no vlt macOS / Windows legs either; re-check its native legs once a maintainer re-enables it.
9. On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (closed by Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442): Windows with the default prefix, and the rest of the maintainer -g request (20261001T040000Z).
10. Probe branches are blocked: branch deletion is denied, and 3 old bughunt/vlt/* branches still need a maintainer to delete them. The run-2 mock lives in bughunt/vlt/20261001-v5-rollback-3os.

Known non-bugs

• Hosted pins are recognized only on patch.socket.dev or SOCKET_PATCH_SERVER_URL. Against a mock without it, rollback says "Manifest not found" (documented).
• If the patch server shares the project registry's config.registry origin, vlt omits slot [3] on re-save and the pin becomes invisible. That's a mock artifact only.
• vlt re-saves CRLF locks as LF on any install (documented). socket-patch itself keeps \r through scan and rollback.
• Vendored refuses a package entirely when any instance is on a named non-default registry (vendor_lock_entry_unsupported). That's loud and fail-closed.
• vlt 1.0.0-rc.14 / rc.32 resolve from public npmjs despite registries.npm.
• The nightly canary failure "vlt 1.3.x is published but neither supported nor excluded" is the docs Releases table lagging new vlt releases.
• vendor_vlt_transitive_unsupported for a target that is also a transitive dep is documented and fail-closed.
• vlt 1.3.0 fails vlt install with "Integrity check failure" against registries advertising tar.br alternates (a vlt bug, fixed in 1.3.1).
• Sandbox: the Rust binaries can't reach npmjs through the TLS proxy (serve version docs locally), vlt's cold-cache "security data" fetch fails, vlt's machine cache must be isolated per mock change (XDG/HOME), the Actions artifact/log blob host is blocked, and the git proxy drops branch deletions.
• Release 4.0.0 reports redirect_npm_no_lockfile on vlt projects: it predates vlt support.
• vlt has no global install surface (no vlt install -g, as of 1.0.10 … 1.3.3). -g only covers npm/pnpm/yarn/bun globals.
• vex -g in a hosted or vendored project attests the cwd project's patches (the project is the VEX product). That's deliberate per commands/vex.rs:1013 (cwd ledgers gate discovery under --global).
• A -g "unwritable prefix" test needs files the user doesn't own: socket-patch may chmod files it owns.
• vlt-lock.json has no node for a bundled copy (1.0.10 … 1.3.3). That's vlt's format, not a socket-patch parse bug. The bug is vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471 (not detecting it).
• vlt 1.0.10 vlt ci fails EINTEGRITY on a remote~ (tarball URL) dependency whenever vlt's machine cache is warm, with or without socket-patch. It's a vlt bug that's gone by 1.2.0.
• vlt dedupes a peer-dependent package to one ~peer.<hex> instance across workspaces when the peer range is *, even with different peer versions installed.
• A mock patch artifact whose leaf keeps the scope (@sc/name-ver.tgz) is refused as patched_ref_invalid. The real service uses the unscoped leaf, so that's a mock artifact.
• Concurrent socket-patch runs in one directory: the losers fail with "Another socket-patch process is operating in this directory" (.socket/apply.lock, --lock-timeout). That's by design.
• Vendored refuses a target with several ~peer.<hex> instances (vendor_lock_entry_unsupported, "peer/modifier variants; use --mode hosted"). That's loud and fail-closed. Hosted and agent handle the shape.
• vex exits 1 after the vendored target was bumped away: nothing patched is installed, so that's correct.
• A hosted scan deletes the stale installed store copies, including every ~peer.<hex> instance, so require fails until vlt install / vlt ci. That's documented, and the scan prints a warning.
• vlt 1.0.0-rc.14 full-probe rollback mismatches against the mock because rc.14 resolves left-pad from public npmjs. That's a mock artifact.
• vlt ci / install with a cold machine cache fails "Failed to fetch security data" (403 host_not_allowed to api.socket.dev) in the sandbox. That's a sandbox artifact; use --allow-scripts :scripts.
• Agent-mode patches disappear after rm -rf node_modules && vlt ci. That's expected: a reinstall replaces agent edits.
• Vendored refuses graph-modifier variants (~<selector> DepID suffix) and root peer-only edges with vendor_lock_entry_unsupported ("use --mode hosted"). That's loud and fail-closed; hosted and agent handle both.
• Vendored rollback after a refused vendored scan returns "Manifest not found": nothing was written.
• Vendoring a catalog: member rewrites its spec to file:, so a later catalog bump doesn't move it until rollback restores catalog: (consistent with vendored owning the spec).
• Agent mode refuses a node_modules link to a first-party workspace member / file: dir that shares the patched name@version (Fix agent mode patching linked first-party source (#626) #634, Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead #626). That's intended. The missing failure count in scan --json is scan/get --json drop the agent-mode apply failure: exit 1 with failed: 0, the patch shown as "added", and no error anywhere (e.g. a read-only global ~/.m2) #424 (generic, not vlt).
• A rerun that "passes" right after switching mock modes can be a stale mock still bound to the port. That's a harness artifact.
• With a scalar config.registry (3-tuple lock) and a registry whose dist.tarball isn't conventional, vlt drops the URL and a cold vlt ci 404s even without socket-patch (vlt 1.0.10 … 1.3.7). That's vlt behavior.
• vlt 1.0.10 … 1.3.7 refuse to install with only a scalar config.registry ("Missing npm registry configuration"). Set registries.npm too.
• vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941 (hosted rollback / remove restore a vlt 1.3 brotli node as gzip): a maintainer closed it not_planned on 2026-10-08 pending Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data? #1130. Don't re-file it unless Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data? #1130 decides to restore the brotli entry.
• A mock whose /patches/batch answers every request gives a bumped or uninstalled project a false partial_failure / redirect_vlt_entry_not_found. Filter by the request body.
• A vlt workspace member with its own vlt.json is its own vlt project root. A refusal from it before its first install is acceptable.
• Dual-root shape (a member with its own vlt.json, also listed by the root's workspaces): socket-patch treats the member as its own project, as vlt does from there. A vendored run from the member then makes the root's vlt ci fail "out of sync", because the shared package.json changed. Run from the root to patch the root's install.
• Hosted scan with an artifact the preflight can't verify, over a vendored entry: exits 0 with redirect_vlt_artifact_unverifiable and stays vendored (documented).
• vlt (1.2.0 / 1.3.7) doesn't restore a deleted node_modules/<name> link or node_modules/.vlt on vlt install, with or without socket-patch. Use vlt ci.
• vlt ci re-resolves the peer edge of a vendored file: node (e.g. peer-host 1.0.0 → 2.0.0) and re-saves the lock. A later rollback keeps vlt's edge, so it isn't byte-exact against the pre-scan lock. That's vlt's change.
• Hosted rollback writes resolved / integrity into a sibling package-lock.json entry that npm wrote without them. Rollback restores the upstream registry entry (contract).
• vlt 0.0.0-16 … 0.0.0-24 ignore vlt-lock.json without "modifiers": {}, so a hosted pin there installs pristine. socket-patch warns redirect_vlt_old_lockfile_ignored. vlt 0.0.0-18 has no ci command.
• Agent repair against the mock fails download_failed: the mock serves no diff archives.
• vlt update (>= 1.0.8) re-resolves an exact spec and drops a hosted pin (documented, docs/ecosystems.md). vex then refuses. A vendored file: spec survives it.
• Hosted vex with nothing installed attests from the lock's pin (documented in the CLI_CONTRACT hosted VEX row).
• Vendored rollback with .socket/vendor deleted fails loudly with vendor_ledger_missing and changes nothing (fail-closed). vlt ci exits 0 in that state with the file: target missing, which is vlt's behavior.
• A mock patch server with a path prefix (RP= on port 18556) gives redirect_unattributable: the artifact URL is off the patch host. That's a mock artifact.
• apply --check on hosted / vendored vlt projects prints "No patch manifest found": vendor-owned and hosted patches are out of its scope by contract.
• A no-mode scan --prune on a vendored vlt project is report-only for patching, but its GC runs for real: it reverts a ledger entry whose dependency vlt uninstall dropped and deletes that .socket/vendor/npm/<uuid> dir (documented, CLI_CONTRACT.md mode resolution and --prune leg (b)).
• A bare scan / get from a vlt workspace member while the vendor ledger sits at the root runs hosted mode and refuses redirect_workspace_lockfile_elsewhere without writing. That's fail-closed; run from the root.
• vlt ci (1.2.0 / 1.3.8), and vlt install in a workspace member, link a file: tarball dependency straight to the raw .tgz (node_modules/x -> ../x.tgz) instead of extracting it, with or without socket-patch. No copy can be loaded, so vex attesting the registry pin there isn't a false attestation. With the tarball copy extracted pristine (a fresh root vlt install), vex refuses correctly.
• vlt-compatibility.yml (with every other *-compatibility.yml) was disabled_manually on 2026-10-09, so it has no runs on main since. That's a maintainer choice, not a trigger bug; the blocking vlt rows run in ci.yml.
• vlt (1.3.8) dedupes a workspace member's peer-dependent package onto an existing ~peer.<hex> instance (peer-host 1.0.0) even when the member itself depends on peer-host 1.5.0, and a root peer-host dep collapses every instance into one. That's vlt's peer resolution.
• vendor --check on a vendored project that later gained a file: copy of the same name@version says "wiring missing: no lockfile or config references …" although the lock still references the vendored dir. The exit code (1) and VEX omission are right; only the wording is imprecise.
• vlt's workspace globs (1.3.8): a ! pattern excludes regardless of its position, but a later literal path re-includes; "packages" lists nothing. A directory excluded by ! isn't its own project (vlt install there installs the root), so socket-patch refusing from it is fail-closed.
• vlt 1.2.0 ignores package.json workspaces with extglobs when vlt.json exists without workspaces (the member gets no edge), so a vendored write to that directory's own lock isn't the Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json still write to that lock and exit 0 when the root's workspaces glob uses an extglob (packages/+(a|b), packages/@(a|b)); vendored VEX then attests not_affected #1542 bug.

[github-actions[bot]]

[agent] 2026-09-30: vlt bug-hunt run

Tested: main f6b7fb9 (CLI 4.0.0 workspace version). The latest published release is 4.0.0 (previous 3.3.0), but it predates vlt hosted support: on a vlt project it reports redirect_npm_no_lockfile, so it can't be compared. vlt 1.0.0-rc.14, 1.0.10, 1.2.0, 1.3.0, 1.3.1 and 1.3.2 (the current latest), installed through scripts/install-vlt.sh, on Node 22.22.2 on Linux. Patch data came from a local Node mock of the npm registry plus the patch API (mock.mjs, below), and from a hand-staged .socket/ for agent mode. No secrets.

This is the first run: there was no earlier ledger and no pm:vlt issue to re-triage.

CI status found

• The nightly vlt-compatibility.yml fails on main (runs 36522277204 and 36669570554), but only in canary (ubuntu-latest). The cause is "vlt 1.3.0 / 1.3.1 is published but neither supported nor excluded" in docs/testing/vlt-compatibility.md (Releases). All 5 capstone suites pass on 1.3.1 in that job, and push-triggered runs and ci.yml's 35 vlt e2e rows plus hosted-e2e are green. So this is a doc/matrix gap, not a code failure, and nothing was filed for it. vlt 1.3.2 is also out now.

Cells

• fail Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372: vlt ≥ 1.3.0 brotli tarballs. With a registry that advertises dist.alternates tar.br, vlt writes node flag bit 4. vlt_lock_text.rs:673 only accepts 0–3, so hosted refuses the lock (redirect_vlt_lock_unsupported, rc 0, stays unpatched) and vendored fails with vendor_lockfile_version_unsupported. Reproduced on 1.3.1 and 1.3.2. The control with no alternates passes. I verified by hand that a fix must also clear bit 4, otherwise vlt ci rewrites the lock.
• pass, Linux, vlt 1.3.2: all five real-vlt capstones (e2e_redirect_vlt_build 37 ran / 1 skip, e2e_vendor_vlt_build 30/2, mode_migration_vlt 12/2, e2e_safety_vlt 7/3, e2e_vlt 14/1), and every check-vlt-legs manifest is clean. 1.3.2 behaves as 1.2.0 on npmjs bytes.
• pass, vlt 1.3.2 against the mock: hosted scan → vlt install / vlt ci patched; vendored scan → vlt ci patched, lock byte-stable through --frozen-lockfile, vendor --revert byte-exact; vendored workspace members, including the dirs packages/my pkg and packages/café (DepIDs my_spkg, café); transitive-only target refused with vendor_vlt_transitive_unsupported; a direct+transitive target also refused, lock untouched; hosted direct+transitive both patched; agent apply / rollback on a brotli (flag 4) store; vex attests hosted and vendored-workspace projects and emits nothing for the refused project.
• vlt 1.3.0 itself fails vlt install ("Integrity check failure") against a registry advertising alternates. That's a vlt bug (fixed in 1.3.1), not ours.

Issues

• Filed Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372).

False positives ruled out

• scan --mode vendored giving no_local_source against my first mock: vendored needs blobContent in the patch view and the /patches/blob/<hash> route. It was a mock gap.
• Capstones failing "could not fetch … from npmjs" in the sandbox: the test harness's reqwest::Client doesn't trust the sandbox TLS proxy CA. Prefill /tmp/socket-patch-test-caches/vlt-e2e-registry/v1/<name+scope>@<ver>.{json,tgz} with curl (the version manifest JSON plus the tarball).

Probe

• No probe branch this run. Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 is in a pure text parser, so it's expected to be OS-independent, and macOS/Windows remain untested for it.

Next

1. Update the docs matrix (maintainer side) for 1.3.0–1.3.2 and re-check Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 once the fix lands. Hosted on a mixed lock (some brotli nodes, some not): the lock-level check passes, the brotli target is refused per-dep. Confirm redirect_vlt_lock_entry_unsupported wording.
2. Probe branch: vlt 1.3.2 capstones on macOS and Windows (not in CI yet), plus store-linker hardlink/copy on 1.3.2.
3. Heal after a hosted rewrite on a brotli dev node (flag 6): reinstalls_after_removal keeps the stale copy.
4. Workspaces nested ≥ 3 deep and a workspace member depending on another member that depends on the target (member-transitive refusal).
5. vlt install --lockfile-only checkouts → hosted/vendored → vlt ci.

mock.mjs (registry + patch API; PORT, NO_ALT=1 turns off the tar.br alternates)

import http from 'node:http';
import zlib from 'node:zlib';
import crypto from 'node:crypto';
import { execSync } from 'node:child_process';
import fs from 'node:fs';
const PORT = +process.env.PORT || 18555;
const R = `http://127.0.0.1:${PORT}`;
const NAME='left-pad', VER='1.3.0', UUID='aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa', TOKEN='bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb', ORG='test-org';
const PURL=`pkg:npm/${NAME}@${VER}`;
const ALT = process.env.NO_ALT ? false : true;
function tarOf(content){
  const d=fs.mkdtempSync('/tmp/bt/t'); fs.mkdirSync(d+'/package');
  fs.writeFileSync(d+'/package/package.json', JSON.stringify({name:NAME,version:VER,main:'index.js'})+'\n');
  fs.writeFileSync(d+'/package/index.js', content);
  const tar = execSync(`tar -C ${d} --owner=0 --group=0 --mtime=@0 -cf - package`);
  return tar;
}
const sri = b => 'sha512-'+crypto.createHash('sha512').update(b).digest('base64');
const git = b => crypto.createHash('sha256').update(Buffer.concat([Buffer.from(`blob ${b.length}\0`), b])).digest('hex');
const PRIST = Buffer.from("module.exports = 'pristine'\n"), PATCH = Buffer.from("module.exports = 'patched'\n");
const tgz = zlib.gzipSync(tarOf(PRIST)), br = zlib.brotliCompressSync(tarOf(PRIST)), ptgz = zlib.gzipSync(tarOf(PATCH));
function wrapTar(){ const d=fs.mkdtempSync('/tmp/bt/w'); fs.mkdirSync(d+'/package'); fs.writeFileSync(d+'/package/package.json', JSON.stringify({name:'wrapper',version:'1.0.0',main:'index.js',dependencies:{'left-pad':'1.3.0'}})+'\n'); fs.writeFileSync(d+'/package/index.js', "module.exports = require('left-pad')\n"); return zlib.gzipSync(execSync(`tar -C ${d} --owner=0 --group=0 --mtime=@0 -cf - package`)); }
const wtgz = wrapTar();
const artPath = `/patch/npm/${NAME}/${VER}/${TOKEN}/${UUID}/${NAME}-${VER}.tgz`;
const log = [];
http.createServer((req,res)=>{
  let body=''; req.on('data',c=>body+=c); req.on('end',()=>{
  const u = req.url.split('?')[0]; log.push(req.method+' '+u); fs.appendFileSync('/tmp/bt/mock.log', req.method+' '+u+'\n');
  const j = o => { res.writeHead(200,{'content-type':'application/json'}); res.end(JSON.stringify(o)); };
  const b = x => { res.writeHead(200,{'content-type':'application/octet-stream'}); res.end(x); };
  if (u===`/${NAME}`) {
    const dist = {tarball:`${R}/${NAME}/-/${NAME}-${VER}.tgz`, integrity: sri(tgz)};
    if (ALT) dist.alternates=[{kind:'tar.br', tarball:`${R}/${NAME}/-/${NAME}-${VER}.tar.br`, integrity: sri(br)}];
    return j({name:NAME, 'dist-tags':{latest:VER}, versions:{[VER]:{name:NAME,version:VER,main:'index.js',dist}}});
  }
  if (u==='/wrapper') return j({name:'wrapper','dist-tags':{latest:'1.0.0'},versions:{'1.0.0':{name:'wrapper',version:'1.0.0',main:'index.js',dependencies:{'left-pad':'1.3.0'},dist:{tarball:`${R}/wrapper/-/wrapper-1.0.0.tgz`,integrity:sri(wtgz)}}}});
  if (u==='/wrapper/-/wrapper-1.0.0.tgz') return b(wtgz);
  if (u===`/${NAME}/-/${NAME}-${VER}.tgz`) return b(tgz);
  if (u===`/${NAME}/-/${NAME}-${VER}.tar.br`) return b(br);
  if (u===artPath) return b(ptgz);
  if (u.startsWith(`/v0/orgs/${ORG}/patches/blob/`)) { const h=u.split('/').pop(); for (const x of [PRIST,PATCH]) if (git(x)===h) return b(x); }
  if (u===`/v0/orgs/${ORG}/patches/batch`) return j({packages:[{purl:PURL,patches:[{uuid:UUID,purl:PURL,tier:'free',cveIds:[],ghsaIds:[],severity:'high',title:'fx'}]}],canAccessPaidPatches:false});
  if (u.startsWith(`/v0/orgs/${ORG}/patches/by-package/`)) return j({patches:[{uuid:UUID,purl:PURL,publishedAt:'2024-01-01T00:00:00Z',description:'x',license:'MIT',tier:'free',vulnerabilities:{}}],canAccessPaidPatches:false});
  if (u===`/v0/orgs/${ORG}/patches/package`) return j({results:{[UUID]:{status:'granted',url:R+artPath,purl:PURL,artifacts:[{kind:'tarball',url:R+artPath,integrity:{sha512:sri(ptgz)}}],registryOverride:null}}});
  if (u===`/v0/orgs/${ORG}/patches/view/${UUID}`) return j({uuid:UUID,purl:PURL,publishedAt:'2024-01-01T00:00:00Z',files:{'package/index.js':{beforeHash:git(PRIST),afterHash:git(PATCH),blobContent:PATCH.toString('base64'),beforeBlobContent:PRIST.toString('base64')}},vulnerabilities:{'GHSA-vlth-aaaa-bbbb':{cves:['CVE-2026-4242'],summary:'s',severity:'high',description:'d'}},description:'x',license:'MIT',tier:'free'});
  res.writeHead(404); res.end('nf');
  });
}).listen(PORT, '127.0.0.1', ()=>console.log('listening', PORT));

[github-actions[bot]]

[agent] 2026-10-01: vlt bug-hunt run

Tested: main 2463257 ("feat!: consolidate the v5 patching workflow", #277; CLI still reports 4.0.0). Latest release is still 4.0.0 (previous 3.3.0); neither has vlt support, so v5 can't be bisected against a release. vlt 1.3.2 (still latest, no new release since run 1), 1.2.0, 1.0.10, 1.0.0-rc.32, 1.0.0-rc.14, on Node 22.22.2 (Linux) and Node 24.21.0 (probe). Patch data comes from the run-1 mock, now with a pure-JS tar writer (so it runs on Windows) and the /<name>/<version> version doc that v5's upstream restore fetches. It runs on two ports: the registry on :18555 and the patch API/artifacts on :18556 with SOCKET_PATCH_SERVER_URL, because a shared origin is a mock artifact, see below.

Focus this run: v5 regressions. #277 replaced v4's hosted ledger with the upstream restore (patch/redirect/upstream/vlt.rs) for rollback / remove / the hosted→vendored takeover, and made hosted the default for a bare scan.

Re-triage

• Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (brotli flag bit 4) still reproduces on 2463257: bare scan gives rc 0, redirected: 0, redirect_vlt_lock_unsupported; --mode vendored gives partial_failure with vendor_lockfile_version_unsupported. Commented: Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (comment) (v5 now hits it with no flags, and the new upstream restore shares the parser).

Cells (all pass unless noted)

• Linux, vlt 1.3.2 / 1.2.0 / 1.0.10, hosted: bare scan → warm vlt install patched → vlt ci patched, lock byte-stable → rollback gives a byte-exact lock and a pristine warm install. Also checked: config.registry 3-tuple locks (no slot [3] written back); CRLF lock (rollback is byte-exact and keeps \r); re-scan idempotent; rollback --dry-run writes nothing; remove <purl> is byte-exact; get <purl>; rollback after vlt install wrapper added a second dependent; lockfile-only checkout with a sibling package-lock.json (redirect_vlt_sibling_lockfiles; both restored byte-exact; npm_allow_remote_left as documented).
• Linux, rc.14 (era B, ·npm· 3-tuple, lockfileVersion 0): hosted scan → rollback byte-exact (restore against a local copy of the real npmjs version doc).
• Linux, 1.3.2 / 1.2.0, hosted→vendored takeover → vlt ci patched → frozen install byte-stable → rollback byte-exact, .socket/ removed.
• Linux, 1.3.2, vendored workspaces: members packages/a → packages/b → left-pad and a 4-deep member apps/x/y/z (edge file:../../../../.socket/...). vlt ci patched, frozen stable, vex attests, rollback byte-exact.
• Linux, 1.3.2, default + named-registry copies of the same left-pad@1.3.0 (corp: alias in a member): hosted redirects only the default node (redirect_vlt_custom_registry_skipped), and vex refuses to attest. Vendored refuses the whole package with vendor_lock_entry_unsupported (loud, partial_failure).
• Linux, 1.3.2, agent on the hardlinked global store: patching project A breaks the hardlink (link count 9 → 1 on A's copy), and projects B and C stay pristine. Path-scoped agent rollback 'apps/**' restores all 3 copies and emits out_of_scope_copies_restored.
• Linux, 1.3.2, vendored re-run idempotent (lock + .socket files stable), repair after deleting a payload file, remove byte-exact.
• Probe: ubuntu / macos / windows × vlt 1.2.0 / 1.3.2, all 6 green, 22/22 checks each (hosted scan/warm/ci/rollback, CRLF, takeover + vendored ci/frozen/vex/rollback, a vendored workspace with dirs packages/my pkg and packages/café, agent apply/rollback/other-project isolation). Run: https://github.com/SocketDev/socket-patch/actions/runs/36803186961. This is the first macOS/Windows coverage of vlt 1.3.x, which CI's matrix still doesn't list.
• CI install-proof legs: on main's push run (36798098098) every vlt-compatibility job is green. On PR v5 prerelease: scan → vex → vendor workflow, hosted by default #277's run (36797999817), one cell failed: native (ubuntu-latest, 1.0.0-rc.14) hosted-direct: unsafe, failing=['warmOrdinary'] (35/36). The same cell passed on main 13 minutes later, and it passes 5/5 locally against the mock. Blocked: the result artifact (11134182795) is on the Actions blob host, which the sandbox proxy refuses (403), so I couldn't root-cause it. It's an intermittent production-service leg; nothing filed.

Issues

• Commented on Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (still reproduces on v5 main). No new issues: nothing met the filing bar.

False positives ruled out

• rollback printed "Manifest not found" after a hosted scan against the mock. The contract only recognizes hosted pins on patch.socket.dev or SOCKET_PATCH_SERVER_URL; with that set, rollback works.
• config.registry project left patched after rollback: my patch server shared the registry's origin, so vlt re-saved the hosted node without slot [3] (its registry prefix rule), and the pin became invisible. That's a mock artifact; with the patch server on a separate origin it passes on 1.0.10, 1.2.0 and 1.3.2.
• Rollback lock "differ" in the first probe draft: vlt's machine-wide cache still held tarballs from the old mock at the same URL (stale integrity). The probe now isolates XDG/HOME per run.
• CRLF rollback "differ" after a vlt install: vlt re-saves locks as LF (documented). This was my probe's fault.
• vlt ci "Failed to fetch security data" on a cold cache (1.0.10, 1.2.0): the sandbox network blocks it. It passes on the GitHub runners.
• rc.32 / rc.14 rollback "differ" in the probe: those releases resolved left-pad from public npmjs despite registries.npm, while the probe's SOCKET_NPM_REGISTRY pointed at the mock. The integrity mismatch came from my probe. Restoring rc.14 against the real npmjs doc is byte-exact.
• scan packages/b (hosted) in a vlt workspace finds the patch but redirects nothing (redirect_npm_no_lockfile, rc 0). The contract defines each PATH as its own project "exactly as if it were --cwd (its own lockfiles)", and the human output says "Switched 0 packages". So this is documented. The warning names npm locks rather than the root vlt-lock.json: cosmetic, not filed.

Infra

• Probe-branch delete is blocked: git push origin --delete bughunt/vlt/20261001-v5-rollback-3os prints "Everything up-to-date" and the ref stays (4 attempts, plus one try with an explicit :refs/heads/... refspec). Sibling routines' bughunt/<pm>/* branches are stuck the same way. A maintainer needs to delete them; the session git proxy seems to drop ref deletions.

Next

1. Upstream restore against a registry whose dist.tarball isn't the conventional {base}/{name}/-/{leaf}-{ver}.tgz (Artifactory scoped /-/@scope/name-ver.tgz). The restore rebuilds slot [3] conventionally from the project registry and takes integrity from SOCKET_NPM_REGISTRY (npmjs), not the project registry. Check whether vlt ci still installs after rollback on such a registry.
2. Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 follow-ups once fixed: a mixed brotli / non-brotli lock, a brotli dev node (flag 6) in the heal, and the upstream restore putting bit 4 back.
3. Peer-extras DepIDs (~npm~x@1~peer.<hex>, two instances of one name@version) through hosted scan → remove (all-or-nothing per pin).
4. Concurrent scan + rollback (apply.lock) on a vlt project, and a rollback interrupted mid-run.
5. vlt 1.3.x in the docs Releases table / CI matrix (maintainer side), then drop the probe.

[github-actions[bot]]

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major vlt version and on Linux, macOS and Windows.

Where vlt puts global installs: Whatever vlt's global install surface is on each vlt version (none, or vlt install -g). If vlt has none, -g must not pick up the project's vlt store, and must still report the other Node globals.

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed vlt package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a vlt project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × vlt version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

[github-actions[bot]]

[agent] 2026-10-01: vlt bug-hunt run

Tested: main 2463257 (unchanged since run 2), latest release 4.0.0 (previous 3.3.0). New vlt release: 1.3.3 (2026-10-01T02:36Z, now latest), covered this run. Also covered vlt 1.2.0 and 1.0.10. Node 22.22.0 in the sandbox, 24.21.0 on the probes. Focus: the maintainer's global-mode (-g) checklist (20261001T040000Z entry).

vlt has no global install surface: none of 1.0.10, 1.2.0 or 1.3.3 has vlt install -g or a global prefix. So -g reaches only npm/pnpm/yarn/bun globals, and must never pick up a vlt project or its store. The global cells below use an npm global prefix (NPM_CONFIG_PREFIX), plus a vlt project in the cwd as the thing that must stay untouched.

Re-triage

• Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (brotli flag): still reproduces on main and on vlt 1.3.3: slot [0] = 4, redirect_vlt_lock_unsupported, 2/2 runs. Commented: Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (comment)

Cells: probe run https://github.com/SocketDev/socket-patch/actions/runs/36834317384 (ubuntu / macos / windows × vlt 1.0.10 / 1.2.0 / 1.3.3) plus the Linux sandbox

• scan -g --json (report-only) inside and outside a vlt project: finds exactly the global left-pad, with no project leakage. The project lock and .socket are untouched, and the global copy is unchanged. pass on Linux and macOS (all 3 vlt). On Windows, fail (On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434): bare npm root -g finds nothing (fix in PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442).
• scan -g --mode hosted, scan --global-prefix <dir> --mode hosted and SOCKET_GLOBAL=1 scan --mode hosted: exit 2, nothing written. pass, all 9 cells.
• scan -g --mode agent → global patched, project pristine → vex -g rc 0 → rollback -g byte-exact. get <purl> -g (agent default) and SOCKET_GLOBAL=1 the same. pass on Linux and macOS. On Windows On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (exit 0, nothing patched).
• --global-prefix "<dir>/my prefix café/node_modules": apply and rollback byte-exact, the default global untouched. pass, all 9 cells, Windows included.
• A local (non--g) agent scan never touches the global copy. pass, 9/9.
• Unwritable (root-owned) global prefix, probe run https://github.com/SocketDev/socket-patch/actions/runs/36835560958 (ubuntu, macos) plus the sandbox as a non-root user: scan -g --mode agent, --global-prefix and SOCKET_GLOBAL=1 all give rc 1 partial_failure, global unchanged (pass). But a re-run of get -g after a failed one exits 0 success ("already in manifest") with the global copy unpatched. That's npm global, not vlt: handed over to npm (entries/npm/20261001T083036Z-from-vlt.md).
• FAIL → rollback -g and remove <purl> -g also unwind the current project's hosted pins and vendored wiring; on vlt they delete node_modules/left-pad too #445: rollback -g and remove <purl> -g run inside a hosted or vendored vlt project also unwind the project: lock restored or unwired, .socket/vendor deleted, node_modules/left-pad deleted, rc 0. This happens even with an empty global prefix. 9/9 probe cells plus the sandbox, and npm projects too. Bisected to d5e1815 (feat!: scan↔rollback duality — full-state rollback default, --preserve-state, path targeting #231, full-state rollback). 4.0.0 and 3a2b06d are clean. Same root cause: in a vendored project, scan -g --mode agent skips the global copy (vendored_ownership_retained, rc 0).

Issues

• Filed rollback -g and remove <purl> -g also unwind the current project's hosted pins and vendored wiring; on vlt they delete node_modules/left-pad too #445: rollback -g and remove <purl> -g also unwind the current project's hosted pins and vendored wiring; on vlt they delete node_modules/left-pad too #445
• Commented on Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (vlt 1.3.3).
• Handover to npm (Bug hunt ledger: npm #302): failed get -g re-run reports success.

False positives ruled out

• scan -g "found" the project's left-pad with an empty global prefix. My mock's /patches/batch answered left-pad for any query. With the mock filtering on the request body, scan -g reports 0. Not a bug.
• vex -g in a hosted or vendored project emits a statement for the project's patched left-pad, with the project as the VEX product. vex.rs:1013 documents that the cwd ledgers and pins are consulted under --global on purpose. Not filed; noted under Known non-bugs.
• The probe's first read-only cell (chmod -R a-w on runner-owned files) "patched anyway": the owner can chmod its own files. Re-done with a root-owned prefix, which fails loudly.
• 1.2.0 / 1.0.10 vlt ci leaving left-pad missing in the sandbox: "Failed to fetch security data" (known sandbox network block). It passes on runners.

Infra

• The probe-branch deletes are still dropped by the git proxy ("Everything up-to-date", ref stays). Stuck: bughunt/vlt/20261001-v5-rollback-3os, bughunt/vlt/20261001-global-3os, bughunt/vlt/20261001-global-ro. A maintainer needs to delete them.

Next

1. Global-mode on Windows once PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 (On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434) lands: re-run the run-36834317384 probe on windows-latest with the default prefix.
2. rollback -g and remove <purl> -g also unwind the current project's hosted pins and vendored wiring; on vlt they delete node_modules/left-pad too #445 follow-up once fixed: rollback -g with a patched global AND a hosted project (only the global is restored), and repair -g / vendor -g in a vlt project.
3. v5 upstream restore against a non-conventional dist.tarball registry (Artifactory scoped path).
4. Peer-extras DepIDs (two instances of one name@version) through hosted scan → remove.
5. Concurrent / interrupted scan + rollback on a vlt project.

[github-actions[bot]]

[agent] 2026-10-01: vlt bug-hunt run

Tested: main 5678b76 (3 commits past 2463257: #330 Poetry, #337 npm bundled-copy VEX fix for #325, #322 Maven docs). Latest release is still 4.0.0 (previous 3.3.0). vlt 1.0.10 / 1.2.0 / 1.3.3 (1.3.3 is still the newest). Node 22.22.0 in the sandbox, 24.21.0 on the probes. Focus: does the new #337 bundled-copy contest reach vlt?

Re-triage

• rollback -g and remove <purl> -g also unwind the current project's hosted pins and vendored wiring; on vlt they delete node_modules/left-pad too #445 (rollback -g unwinds the cwd project): still reproduces on 5678b76 (Linux, vlt 1.3.3, empty npm global prefix; hosted pin removed from vlt-lock.json, rc 0). The fix is open in PR Fix -g touching the cwd project's state (#436, #445) #446. No comment, nothing new to add.
• Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (brotli flag): no parser change on main (vlt_lock_text.rs untouched by the 3 new commits), and already re-triaged on 1.3.3 last run. No comment.

Cells: probe run https://github.com/SocketDev/socket-patch/actions/runs/36871535059 (ubuntu / macos / windows × vlt 1.0.10 / 1.2.0 / 1.3.3) plus the Linux sandbox

• Bundled copy (bundler@1.0.0 with bundleDependencies: ["left-pad"], plus a direct left-pad@1.3.0), hosted: scan rc 0 with no bundled warning → vlt ci → direct copy patched, bundled copy pristine → vex attests not_affected. FAIL vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471, 9/9 cells plus sandbox 3/3.
• The same in vendored mode: FAIL vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471, 9/9.
• npm control (same mock, npm install): warns redirect_npm_bundled_instance_skipped, and vex refuses to attest. That's the Fix npm VEX attesting packages with an unpatched bundled copy (#325) #337 behaviour, so it passes.
• Bundled-only (no direct dep), hosted: rc 0 with redirect_vlt_entry_not_found "run vlt install first", which is misleading. Folded into vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471.
• vlt-lock.json never records bundled copies (1.0.10 … 1.3.3), so a lock-only fix can't work. The contest must come from the store or from manifest bundleDependencies.

Issues

• Filed vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471: vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471
• No comments or closes.

False positives ruled out

• vlt 1.2.0 vlt ci rc 1 in the sandbox: the known "security data" fetch block. It passes on all runners.

Infra

• The probe reused my existing branch bughunt/vlt/20261001-global-3os (merged origin/main, so the diff is still the single workflow file), so no new branch was added. The delete is still dropped by the git proxy ("remote end hung up" / "Everything up-to-date"). Still stuck: bughunt/vlt/20261001-global-3os, bughunt/vlt/20261001-global-ro, bughunt/vlt/20261001-v5-rollback-3os. A maintainer needs to delete them.

Next

1. Global-mode on Windows once PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 (On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434) lands (default prefix).
2. rollback -g and remove <purl> -g also unwind the current project's hosted pins and vendored wiring; on vlt they delete node_modules/left-pad too #445 follow-ups once PR Fix -g touching the cwd project's state (#436, #445) #446 lands: rollback -g with a patched global AND a hosted project, and repair -g / vendor -g in a vlt project.
3. vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471 follow-ups once fixed: a bundled copy at a different version (must not contest), a nested bundle (a bundle inside a bundle), and agent mode on the bundled store copy.
4. v5 upstream restore against a non-conventional dist.tarball registry (Artifactory scoped path).
5. Peer-extras DepIDs (two instances of one name@version) through hosted scan → remove.

[github-actions[bot]]

[agent] 2026-10-01: vlt bug-hunt run

Tested: main 61cfb9b (17 commits past 5678b76, incl. #446 -g scope fix, #448 vlt ci off the Socket API, #365 npm .store / pnpm relocated-store crawler). Latest release is still 4.0.0 (previous 3.3.0). vlt 1.0.10 / 1.2.0 / 1.3.3 (1.3.3 still newest), Node 22.22.0, Linux sandbox only.

Re-triage

• rollback -g and remove <purl> -g also unwind the current project's hosted pins and vendored wiring; on vlt they delete node_modules/left-pad too #445: closed by PR Fix -g touching the cwd project's state (#436, #445) #446 before this run, so no action. The follow-ups (rollback -g / remove -g with a patched global AND a hosted project) pass on Linux 1.3.3: the global copy is restored and the project lock, .socket and node_modules are unchanged.
• Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 / vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471: no change to the vlt parser or the bundled-copy paths on main. vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471 has draft fix PR Fix Bun/vlt bundled copies left unpatched (#469, #471) #472. No comment.
• CI root cause: the "install-proof legs failing" were vlt ci's default --allow-scripts :scripts:not(:malware) POSTing to api.socket.dev (fixed in the harness by Fix vlt e2e legs failing when api.socket.dev blips #448). It's also why vlt ci failed in this sandbox in earlier runs. Pass --allow-scripts :scripts locally.

Cells (Linux)

• Peer-extra DepID (~npm~left-pad@1.3.0~peer.<hex>) shared by root plus 2 workspaces with different peer versions, hosted: scan → vlt ci patched in all 3 importers, vex not_affected, rollback byte-exact. pass (1.3.3). vlt still writes ONE instance (peer *), so no real multi-instance shape yet.
• Odd lock mix (npm: alias lp, remote tarball dep, file: dep), hosted: pass on 1.2.0 / 1.3.3. Vendored refuses with vendor_vlt_transitive_unsupported (documented). 1.0.10: see false positives.
• Agent scan --mode agent on the peer-extra workspace store: patched in all importers, vex, rollback, re-run idempotent. pass (1.3.3).
• -g with a patched npm global plus a hosted vlt project: rollback -g / remove -g pass (Fix -g touching the cwd project's state (#436, #445) #446). vendor -g / vendor --revert -g FAIL vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498 on 1.0.10 / 1.2.0 / 1.3.3 (also npm). repair -g touches only .socket/blobs (GC; the download failure is a mock artifact, no diff archive served).

Issues

• Filed vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498: vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498. vendor --revert -g reverts the cwd project's vendoring (rc 0, the next vlt ci is pristine), and vendor -g vendors into the project and takes over its hosted pin. Fix -g touching the cwd project's state (#436, #445) #446 never touched vendor.rs.

False positives ruled out

• vlt 1.0.10 vlt ci EINTEGRITY on a remote~ tarball dep after scan: this is vlt 1.0.10 with a warm machine cache, and it reproduces with no socket-patch at all (wanted = the lock's integrity, found = something unknown, no network request made). 1.2.0 and later are fine. Added to known non-bugs.

Infra

• git push --delete is now denied by the session's permission policy, so I opened no new probe branches. Still stuck: bughunt/vlt/20261001-global-3os, -global-ro, -v5-rollback-3os. A maintainer needs to delete them. macOS / Windows for vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498 untested.

Next

1. vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498 on macOS / Windows once a probe branch can be cleaned up, and re-test once it's fixed.
2. vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471 follow-ups once PR Fix Bun/vlt bundled copies left unpatched (#469, #471) #472 lands (bundled copy at another version, nested bundle, agent mode).
3. Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 follow-ups once fixed (mixed brotli lock, dev flag 6, restore bit 4, VEX).
4. Global-mode on Windows with the default prefix once PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 lands.
5. Concurrent or interrupted scan / rollback on vlt projects. v5 upstream restore with an Artifactory-style scoped dist.tarball.

[github-actions[bot]]

[agent] 2026-10-02: vlt bug-hunt run

Tested: main 61cfb9b (no new commits since run 5). Latest release still 4.0.0 (previous 3.3.0). vlt 1.0.10 / 1.2.0 / 1.3.3 (1.3.3 still newest), Node 22.22.0, Linux sandbox only. The mock is the run-4 probe mock plus PKG= (any name, incl. scoped) and CDN=1 (non-conventional dist.tarball).

Re-triage

• Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372, vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471, vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498: main unchanged, so nothing to re-check. Fix PRs Fix Bun/vlt bundled copies left unpatched (#469, #471) #472 and Fix vendor -g rewiring the cwd project (#498) #499 are still open. No comment.

Cells (Linux)

• Non-conventional dist.tarball, hosted rollback / remove (backlog item 5): FAIL vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 on 1.0.10 / 1.2.0 / 1.3.3. Slot [3] is restored to the synthesized /<name>/-/<leaf>-<ver>.tgz instead of the registry's dist.tarball, so a cold-cache vlt ci gets a 404. The npm package-lock control restores byte-identically on the same mock.
• Scoped target @sc/left-pad, 1.3.3: hosted scan → vlt ci patched, vex not_affected: pass. Hosted rollback: fail vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 (Artifactory/GitLab-style scoped tarball). Vendored scan / vex / rollback byte-identical: pass. Agent apply through the .vlt store symlink + vex: pass.
• Concurrent scan --mode hosted ×4 on one project (5 rounds): pass. .socket/apply.lock lets one through, the others error cleanly, and the lock stays valid.
• SIGKILL of scan / rollback at 10–200 ms: pass. The lock is always the old or the new bytes, and the next scan succeeds.

Issues

• Filed vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521: vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521

False positives ruled out

• A mock whose patch artifact leaf was @sc/left-pad-1.3.0.tgz made rollback/vex refuse with patched_ref_invalid. The real service uses the unscoped leaf (left-pad-1.3.0.tgz), so that was a mock artifact.
• Agent vex rc 1 after rm -rf node_modules && vlt ci is a correct refusal: the reinstall is pristine.

Infra

• No probe branches this run (git push --delete is still denied). The 3 old bughunt/vlt/* branches still need a maintainer to delete them.

Next

1. vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 on macOS / Windows and with the 3-tuple (config.registry) convention once fixed. Also check the hosted→vendored takeover's upstream restore with a non-conventional tarball.
2. vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498 / vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471 / Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 re-tests once PRs Fix vendor -g rewiring the cwd project (#498) #499 / Fix Bun/vlt bundled copies left unpatched (#469, #471) #472 land.
3. A real multi-instance peer shape (conflicting peer ranges).
4. vlt 1.3.3 frozen / workspaces cells on macOS and Windows.

[github-actions[bot]]

[agent] 2026-10-02: vlt bug-hunt run

Tested: main 61cfb9b (unchanged since run 5). Latest release still 4.0.0 (previous 3.3.0). New vlt releases: 1.3.4 (2026-10-01) and 1.3.5 (2026-10-02). Also tested 1.0.10 / 1.2.0 / 1.3.3. Node 22.22.0, Linux sandbox only.

Re-triage

• Main unchanged, and fix PRs Fix Bun/vlt bundled copies left unpatched (#469, #471) #472 / Fix vendor -g rewiring the cwd project (#498) #499 are still open, so vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471 / vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498 / vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 need no re-check.
• Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372: still reproduces on 1.3.4 / 1.3.5 (flag 4 nodes are still not redirected). Commented: Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (comment)

Cells (Linux)

• Run-2 probe matrix (hosted scan / warm / ci / rollback byte-exact, CRLF, vendored + takeover + frozen + vex + rollback, space/unicode workspaces, agent) on 1.3.3 / 1.3.4 / 1.3.5: pass (22/22 each).
• 1.3.5 dev (flag 2) and optional (flag 1) targets, hosted + vendored + frozen + vex + rollback: pass (flags preserved).
• Real multi-instance peer shape (backlog 6): wrap-a→peer-x@1 and wrap-b→peer-x@2, with left-pad peer ^1 || ^2. vlt 1.3.5 writes two DepIDs, ~npm~left-pad@1.3.0~peer.<hex> ×2. Hosted redirects both, vlt ci is patched in both, vex not_affected, rollback byte-exact: pass. Agent patches both store dirs, rollback: pass. Vendored refuses with vendor_lock_entry_unsupported ("peer/modifier variants; use --mode hosted"), lock untouched: loud and fail-closed, so known non-bug.
• Lock mutated between scan and rollback (vlt install other@1.0.0 after a hosted / vendored scan): pin kept, rollback restores only the left-pad node, other kept: pass.
• Hosted, left-pad bumped 1.3.0 → 1.2.0 after scan: rescan / --prune rc 0, lock untouched: pass.
• Vendored, left-pad bumped or uninstalled after scan: FAIL Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 on 1.0.10 / 1.2.0 / 1.3.3 / 1.3.5. Every rescan exits 1 (vendor_lock_entry_not_found, "run vlt install first"), and scan --prune reverts the entry but still exits 1.

Issues

• Filed Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541: Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541
• Commented on Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (new versions).
• Handed over to npm (entries/npm/*-from-vlt.md): npm's scan --prune doesn't revert the lockfile-unused vendored entry at all.

False positives ruled out

• vex rc 1 after the bump: a correct refusal (nothing patched is installed).
• Vendored peer-variant refusal: documented-style, loud, recommends hosted.

Infra

• git push --delete is still denied, so no probe branches. The 3 old bughunt/vlt/* branches still need a maintainer to delete them.

Next

1. Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 on macOS / Windows, and re-test once it's fixed (also vendor standalone and repair after a bump).
2. vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 / vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498 / vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471 / Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 re-tests once their PRs land.
3. Hosted→vendored takeover on the multi-instance peer shape (it should refuse before reverting the hosted pin).
4. vlt 1.3.5 frozen / workspaces cells on macOS and Windows.
5. The vlt 1.3.4 tarball-cache integrity changes: a warm cache holding pristine bytes at a re-used patch URL (an updated patch with the same uuid).

[github-actions[bot]]

[agent] 2026-10-02: vlt bug-hunt run

Tested: main 61cfb9b (unchanged since run 5). Latest release is still 4.0.0. There's no new vlt release (newest is 1.3.5). Linux sandbox, Node 22.22.0.

Re-triage

• Main is unchanged, so Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 / vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471 / vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498 / vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 need no re-check.
• Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541: checked draft fix PR Fix vendored rescans failing on unwired ledger entries (#541) #543 (head 11934b9) with real vlt 1.2.0 / 1.3.5. Bump and uninstall now give rescan / --prune / rescan rc 0 / 0 / 0 (main gives 1 / 1 / 0), and --prune empties the vendor dir. Commented: Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 (comment)

Cells (Linux)

• Full probe matrix (22 checks: hosted scan / warm / ci / rollback byte-exact, CRLF, vendored + takeover + frozen + vex + rollback, space/unicode workspaces, agent) on 1.0.0-rc.34, 1.0.5, 1.1.1, 1.3.0 (no tar.br alternates), 1.3.5: pass, twice each. These are the first local runs on 1.0.x, 1.1.x and 1.3.0.
• Hosted→vendored takeover on the multi-instance peer shape (backlog 7, vlt 1.3.5): vendored refuses with vendor_lock_entry_unsupported before touching anything, and the hosted pins stay intact: pass. Hosted list (one entry) and remove <purl> on the same shape (lock byte-exact, vlt install pristine in both instances): pass.
• Prerelease target (left-pad@1.3.0-rc.1), hosted / vendored / agent: scan, ci, vex not_affected, rollback byte-exact: pass.
• Object-form workspace groups ("workspaces": {"apps": "apps/*", "libs": ["libs/*"]}), all 3 modes: pass.
• catalog: specs (vlt.json catalog, recorded in lock options.catalog), all 3 modes, plus vlt install --frozen-lockfile: pass. Vendored rewrites catalog: to file: in package.json, vlt install stays stable warm and cold, and rollback restores catalog:.
• 1.0.0-rc.14 full probe: blocked. rc.14 resolves from public npmjs (a known non-bug), so the mock's integrity mismatches on rollback.

Issues

• No new issues. Commented on Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 (verified Fix vendored rescans failing on unwired ledger entries (#541) #543 on vlt).

False positives ruled out

• After a hosted scan, the ~peer.<hex> store dirs are deleted and require fails until the next vlt install. That's documented: the scan prints the stale-copy warning.
• The rc.14 rollback "differ" result is a mock / npmjs mix (see above).

Next

1. Re-test Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 once Fix vendored rescans failing on unwired ledger entries (#541) #543 merges, and run Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 on macOS / Windows.
2. Re-test vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 / vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498 / vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471 / Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 once their PRs land.
3. Named catalogs (catalog:<name>) in workspaces, and vendored vlt update after a catalog bump.
4. The vlt 1.3.5 frozen / workspaces cells on macOS and Windows (probe branches are still blocked).
5. The vlt 1.3.4 tarball-cache integrity changes: a warm cache that holds pristine bytes at a re-used patch URL.

[github-actions[bot]]

[agent] Janitor: ledger drift. The coverage matrix still lists these issues as fail, but they are now closed on GitHub. Please re-check those cells on main 6cd37540 on the next run:

• On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434: closed 2026-10-02 17:07 UTC
• vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471: closed 2026-10-02 15:36 UTC
• vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498: closed 2026-10-02 14:26 UTC
• Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541: closed 2026-10-02 14:25 UTC

This is a heads-up only. The janitor never edits ledgers.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-02: vlt bug-hunt run

Tested: main b1f9818 (34 commits since run 8, including #472 / #499 / #543 / #442 / #486 / #517). Latest release is still 4.0.0. There's no new vlt release (newest is 1.3.5). Linux sandbox, Node 22.22.0. vlt ci in the sandbox needs --allow-scripts :scripts; without it the security-data fetch to api.socket.dev returns 403 (a known sandbox artifact, see #448).

Re-triage

• vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521: still reproduces on vlt 1.2.0 / 1.3.5. A non-conventional dist.tarball comes back as /<name>/-/<name>-<ver>.tgz after rollback. vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 (comment)
• Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372: still reproduces on vlt 1.3.5. The flag-4 tar.br node isn't redirected, and the scan exits 0 with the lock untouched. Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (comment)
• vlt hosted and vendored vex attests not_affected while a bundled copy of the same name@version in node_modules/.vlt stays unpatched (the #325 fix covers npm locks only) #471 (closed by Fix Bun/vlt bundled copies left unpatched (#469, #471) #472): verified on 1.2.0 / 1.3.5. Hosted and vendored warn *_bundled_instance_skipped, and vex refuses (hosted rc 2, vendored rc 1). pass.
• Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 (closed by Fix vendored rescans failing on unwired ledger entries (#541) #543): verified on 1.2.0 / 1.3.5, twice each. After the bump, rescan / --prune / rescan give rc 0 / 0 / 0 and the vendor dir is empty. pass.

Cells (Linux)

• Run-2 probe matrix (22 checks) on 1.0.10 / 1.2.0 / 1.3.5: pass, twice for 1.0.10 / 1.2.0.
• Named catalogs (vlt.json catalogs.sec, two workspace members on catalog:sec), hosted / vendored on 1.2.0 / 1.3.5: scan, --frozen-lockfile stable, ci patched in both members, vex, rollback byte-exact on all 5 files: pass. Agent: scan / rollback: pass.
• Agent mode with a bundled copy plus a normal install of the same name@version: FAIL Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601 on 1.0.10 / 1.2.0 / 1.3.5 (and on pnpm 10.28.0). Only the ~npm~left-pad@1.3.0 copy gets patched. The copy under ~npm~bundler@1.0.0/node_modules/bundler/node_modules/left-pad stays pristine, apply exits 0 (already_patched), and vex says not_affected. With a bundled-only install it passes.

Issues

• Filed Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601: Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601
• Commented on vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 and Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372.
• Handed over to pnpm (entries/pnpm/*-from-vlt.md): Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601 also reproduces on pnpm 10.28.0.

False positives ruled out

• hosted.ci failing on 1.0.10 / 1.2.0 came from vlt's security-data fetch (403 host_not_allowed), not from socket-patch. It passes with --allow-scripts :scripts.
• Agent-mode require reading pristine after rm -rf node_modules && vlt ci is expected: a reinstall replaces agent patches.

Infra

• No probe branches this run, since branch deletion is still denied. The 3 old bughunt/vlt/* branches still need a maintainer to delete them.

Next

1. Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601 on macOS / Windows and with a bundled copy at a different version; re-test once it's fixed.
2. vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 / Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 re-tests once fixes land; vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 on the 3-tuple (config.registry) project.
3. vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498 fix (Fix vendor -g rewiring the cwd project (#498) #499) verification with the npm global prefix plus a vlt project, and On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (fixed by Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442) on Windows.
4. The vlt 1.3.4 tarball-cache integrity changes: a warm cache holding pristine bytes at a re-used patch URL.
5. Vendored vlt update after a catalog bump.

[github-actions[bot]]

[agent] 2026-10-03: vlt bug-hunt run

Tested: main 045d7ec (one commit since run 9: #581, bounded patch API timeouts). Latest release is still 4.0.0. New vlt release: 1.3.6 (2026-10-03 00:40 UTC). Linux sandbox, Node 22.22.0, vlt ci/install --allow-scripts :scripts.

vlt 1.3.6 vs 1.3.5: the bundle diff only touches manifest picking (pickManifest now skips versions that are missing from the packument's time map even without --before, and caches parsed versions) plus warning-listener plumbing. Nothing changes the lock format, DepIDs or the store layout.

Re-triage

• Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372: still reproduces on vlt 1.3.6. The tar.br node is written with flag 4, scan exits 0, and the lock is unchanged. Main only changed by Bound patch API connects and stalled reads (#570) #581, so I didn't add another comment (last one: run 9).
• vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498 (closed by Fix vendor -g rewiring the cwd project (#498) #499): verified fixed on 1.2.0 and 1.3.6, with the flags and with SOCKET_GLOBAL=1 / SOCKET_GLOBAL_PREFIX. vendor -g and vendor --revert -g both exit 2 global_scope_unsupported, vlt-lock.json and .socket/vendor are kept, the project is still patched after vlt ci, and the global copy stays patched.
• Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601: claimed, with fix PR Fix npm store copies missed by agent apply and vex (#601, #603) #605 open. Not re-run.
• vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521: not re-run (main unchanged in that area since run 9).

Cells (Linux)

• Run-2 probe matrix (22 checks: hosted scan / warm / ci / rollback byte-exact, CRLF, vendored + takeover + frozen + vex + rollback, space/unicode workspaces, agent) on 1.3.6 (twice) and 1.3.5: pass.
• Graph modifiers (vlt.json modifiers, DepID suffix ~_croot_s_g_s#wrapper_s_g_s#left-pad), target only via wrapper, vlt 1.3.6:
  • hosted: pin, ci patched, lock stable, vex, rollback byte-exact: pass.
  • agent: patched, rollback: pass.
  • vendored: refused, vendor_lock_entry_unsupported ("modifier variant"), as documented.
• Modifier variant plus a direct dependency on the same name@version: hosted and agent patch both paths: pass.
• Modifier selector encodings (:semver(^1), :v(1.3.0), a selector without :root), hosted scan / ci / rollback: pass. A [name="wrapper"] selector is rejected by vlt itself.
• Root peerDependencies + devDependencies (the library pattern), all 3 modes, including frozen: pass. Vendored rewrites only the dev spec, and the peer range stays.
• Peer-only root dependency: hosted and agent pass. Vendored refuses with vendor_lock_entry_unsupported ("through a peer peer edge", a cosmetic doubled word).
• CI: vlt patch compatibility is green on main 045d7ec (run 37057640206). No install-proof leg is failing right now.

Issues

• None filed, commented on or closed this run (vendor -g and vendor --revert -g still rewire the current project: on vlt, --revert -g silently unpatches a vendored project (the #446 fix skipped vendor.rs) #498 was already closed).

False positives ruled out

• Vendored rollback exiting 1 after a refused vendored scan is the "Manifest not found" status. Nothing was written.
• Hosted require failing between scan and reinstall is the documented stale-copy deletion.

Infra

• No probe branches: branch deletion is still denied. The 3 old bughunt/vlt/* branches still need a maintainer to delete them.

Next

1. vlt 1.3.6 on macOS / Windows, once probe branches can be deleted.
2. Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601 re-test when Fix npm store copies missed by agent apply and vex (#601, #603) #605 merges, including macOS / Windows and a bundled copy at a different version.
3. vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 / Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 re-tests on 1.3.6 once fixes land; vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 on the 3-tuple (config.registry) project.
4. A modifier that changes the version (:root > #wrapper > #left-pad → a different version than wrapper asks for) in hosted and agent modes; that needs a second left-pad version in the mock.
5. The vlt 1.3.4 tarball-cache integrity changes: a warm cache holding pristine bytes at a reused patch URL.

[github-actions[bot]]

[agent] 2026-10-03: vlt bug-hunt run

Tested: main 045d7ec (unchanged since run 10). Latest release is still 4.0.0. Newest vlt is still 1.3.6. Linux sandbox, Node 22.22.0, vlt ci/install --allow-scripts :scripts. The mock now serves two left-pad versions (1.2.0 → 'old', 1.3.0 → 'pristine'/'patched') with a time map, and WDEP= sets wrapper's left-pad spec.

Re-triage

• Main is unchanged and no fix PR has merged (Fix npm store copies missed by agent apply and vex (#601, #603) #605 for Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601 and Resolve vlt registry bases through one shared function (#562) #574 for vlt lock inventory and hosted restore resolve a node's registry differently #562 are still open), so there was nothing to re-check. Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 and vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 are still open as of run 10.
• CI: vlt patch compatibility is green on main and on recent PRs. No install-proof leg is failing right now.

Cells (Linux)

• Version-changing graph modifier, up (wrapper asks for left-pad@1.2.0, vlt.json modifier :root > #wrapper > #left-pad → 1.3.0; the target exists only through the modifier, DepID ~npm~left-pad@1.3.0~_croot_s_g_s#wrapper_s_g_s#left-pad), vlt 1.3.6 and 1.2.0:
  • hosted: scan, ci patched, lock stable, vex not_affected, rollback byte-exact, re-install pristine: pass.
  • hosted get <uuid>, repair (keeps the pin), list, remove <purl> (byte-exact): pass (1.3.6).
  • agent: patched, re-run idempotent, rollback: pass.
  • vendored: refused, vendor_lock_entry_unsupported ("modifier variant … use --mode hosted"), as documented.
• Version-changing modifier, down (wrapper asks for 1.3.0, the modifier forces 1.2.0, plus a direct left-pad@1.3.0), 1.3.6: all 3 modes patch only the direct copy, and the modifier copy stays 'old'. Vex, frozen and rollback byte-exact: pass.
• Workspace chain (member b → a@workspace:*, a → left-pad), vendored and hosted, 1.3.6: both members see patched; frozen, vex and rollback byte-exact: pass. The transitive-target refusal correctly does not fire.
• Vendored + catalog bump (catalog: → vendored file: spec, then the catalog bumps 1.3.0 → 1.2.0 and vlt install runs), 1.3.6: the member stays vendored-patched (its spec is no longer catalog:), a re-scan is a no-op, vex is ok, and rollback restores catalog:, so the bumped version installs: pass.

Issues

• None filed, commented on or closed.

False positives ruled out

• Agent vex exits 1 after rm -rf node_modules && vlt ci: the reinstall replaces agent edits (a known non-bug).

Infra

• No probe branches (branch deletion is still denied). The 3 old bughunt/vlt/* branches still exist.

Next

1. vlt 1.3.6 on macOS / Windows, once probe branches can be deleted.
2. Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601 re-test when Fix npm store copies missed by agent apply and vex (#601, #603) #605 merges; vlt lock inventory and hosted restore resolve a node's registry differently #562 re-test when Resolve vlt registry bases through one shared function (#562) #574 merges (a vlt registry_base precedence fix that touches the restore path, so re-run the 3-tuple and vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 cells).
3. vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 / Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 re-tests once fixes land.
4. A registry whose packument lacks time entries on vlt 1.3.6 (the new pickManifest skip) against a hosted pin and a vendored spec.
5. A hosted pin plus vlt install <other> on 1.3.6 with a modifier present (lock re-save keeps the modifier DepID pin).

[github-actions[bot]]

[agent] Janitor: state drift. Next-steps item 9 still says to watch #579 (vlt/hosted perf regression after #472), but a maintainer closed #579 at 2026-10-03 12:24Z as expected: the slowdown comes from correctly scanning code that was skipped before. Please drop or update the item.

---

Generated by Claude Code

[github-actions[bot]]

[agent] Janitor: ledger drift. This ledger was last updated on main 045d7ec, before the 2026-10-05 11:13–13:20Z merge wave. It still cites these issues as fail, but they are now closed as completed:

• Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601 (fixed by PR Fix npm store copies missed by agent apply and vex (#601, #603) #605)

Please re-verify those cells on main 6811b4e7.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-05: vlt bug-hunt run

Tested: main 6811b4e (49 commits since 045d7ec, including #605 (store copies, #601 / #603), #574 (shared vlt registry_base, #562), #818 (pnpm / yarn berry tarball-URL restore), #634 (first-party-link refusal, #626), #738 (agent aliases, #356) and #846 (rollback prunes dirs, #838)). Latest release is still 4.0.0, and newest vlt is still 1.3.6. Linux sandbox, Node 22.22.0, vlt ci/install --allow-scripts :scripts. The mock was rebuilt from the run-2 probe mock, with switches CDN=1 (non-conventional dist.tarball), NO_ALT, ADD=1 (the patch adds lib/extra/deep/new.js), EMPTYDIR=1 (the tarball ships empty lib/ and lib/extra/ dir entries) and a bundler@1.0.0 that bundles left-pad.

Re-triage

• Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected #601 (closed by Fix npm store copies missed by agent apply and vex (#601, #603) #605): verified fixed on vlt 1.2.0 and 1.3.6. A bundled copy inside ~npm~bundler@1.0.0 plus a direct install: agent patches both, vex passes, and rollback restores both.
• vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521: still reproduces on 1.2.0 and 1.3.6 (×2). After rollback slot [3] is the synthesized /left-pad/-/left-pad-1.3.0.tgz, and a cold vlt ci 404s. Resolve vlt registry bases through one shared function (#562) #574 / Fix hosted restore dropping registry tarball URLs (#557, #817) #818 didn't touch the vlt restorer. Commented.
• Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372: still reproduces on 1.3.6 (×2): the lock is unchanged, scan rc 0, and ci installs pristine. Fix PR Fix vlt 1.3 brotli lock nodes being refused (#372) #820 is open, so I didn't comment.
• vlt lock inventory and hosted restore resolve a node's registry differently #562 (closed by Resolve vlt registry bases through one shared function (#562) #574): the config.registries.npm single-registry hosted / rollback cells pass. I didn't re-run the 3-tuple config.registry project.

Cells (Linux, vlt 1.2.0 and 1.3.6 unless noted)

• Fix rollback leaving directories apply created (#838) #846 dir pruning, patch adds a file in a new dir: agent rollback and remove leave the store dir tree identical to pre-apply. The bundled copy also gets the file. Re-apply, hosted (scan / ci / rollback byte-exact) and vendored (ci / vex / rollback, vendor dir emptied): pass.
• Fix rollback leaving directories apply created (#838) #846 dir pruning, patch adds a file under a shipped empty dir: agent rollback and remove delete the package's own lib/ and lib/extra/: fail Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862 (new regression, first bad 6811b4e; 428b938 keeps them).
• npm aliases ("lp": "npm:left-pad@1.3.0", alone and alongside a direct dep), agent / hosted / vendored, plus vex, frozen and rollback byte-exact: pass (1.3.6).
• Workspace member named left-pad@1.3.0 linked through workspace:*: agent refuses (loudly in human output), the source is untouched, hosted is a no-op, and vendored says vendor_lock_entry_not_found: pass. But scan --json reports partial_failure with apply.failed: 0 and no error. That's an existing generic issue (scan/get --json drop the agent-mode apply failure: exit 1 with failed: 0, the patch shown as "added", and no error anywhere (e.g. a read-only global ~/.m2) #424, also npm), so I commented.
• Hosted pin, then vlt install wrapper@1.0.0 and vlt uninstall left-pad (transitive only): the pin survives both re-saves, ci is patched, vex and re-scan pass, rollback matches a fresh lock byte for byte, and a cold ci is pristine: pass.
• Agent apply with an added file: vlt's machine cache and data dirs are untouched, and another project installs pristine: pass (1.3.6).
• CI: vlt patch compatibility was green on e24693c. The runs on 4646693 / 6811b4e were still queued.

Issues

• Filed Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862: agent-mode rollback / remove delete empty directories the package shipped (regression from Fix rollback leaving directories apply created (#838) #846).
• Commented on vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 and scan/get --json drop the agent-mode apply failure: exit 1 with failed: 0, the patch shown as "added", and no error anywhere (e.g. a read-only global ~/.m2) #424.

False positives ruled out

• The first Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 re-run "passed" because the previous mock (CDN mode) was still bound to the port. The harness now waits for the ports to free up. A clean rerun reproduced it.
• The agent refusal of a linked workspace member is the intended Fix agent mode patching linked first-party source (#626) #634 behavior.

Infra

• No probe branches (branch deletion is still denied). The 3 old bughunt/vlt/* branches still exist.

Next

1. Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862 once it's fixed: shipped empty dirs, nested new dirs under a shipped dir, macOS / Windows.
2. Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 once PR Fix vlt 1.3 brotli lock nodes being refused (#372) #820 merges: mixed brotli / non-brotli lock, brotli dev node, restore bit 4, vex.
3. vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 once it's fixed. Also the 3-tuple config.registry restore after Resolve vlt registry bases through one shared function (#562) #574.
4. Agent-mode vex still attests not_affected when a Deno .deno/<name>@<ver>_1 copy is unpatched: the #517 every-copy check never sees store peer-variant copies #603-style store peer-variant vex (~peer.<hex> ×2) on vlt after Fix npm store copies missed by agent apply and vex (#601, #603) #605's vex_consumed rewrite.
5. vlt 1.3.6 on macOS / Windows once probe branches can be deleted.

[github-actions[bot]]

[agent] Janitor: state drift for the bug-hunt routine to pick up (this ledger body is not edited).

#372 (vlt 1.3 brotli tar.br lock nodes refused) was closed as completed by PR #820 (merge 7fd88f55, 2026-10-05 17:28Z). The matrix rows for 1.3.1, 1.3.2 and 1.3.3 still say fail #372.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-06: vlt bug-hunt run

Tested: main 9c43dfc (25 commits since 6811b4e, including #820 (vlt brotli nodes, #372), #598 (hosted workspace-member refusal for pnpm / cargo), #774 (store-copy fold) and #799 (npm VEX twin lock)). Latest release is still 4.0.0. New vlt 1.3.7 (2026-10-06): it adds vlt outdated and a hidden-lock rule that reuses a reference node's resolved only when its tarball format matches the node's brotli flag. The lock format is unchanged. Linux sandbox, Node 22.22.0, vlt ci/install --allow-scripts :scripts. The mock is the run-2 probe mock (tar.br alternates on by default, NO_ALT=1 off).

Re-triage

• Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (closed by Fix vlt 1.3 brotli lock nodes being refused (#372) #820): verified fixed on 1.3.6 and 1.3.7. Hosted scan pins brotli prod (4→0) and dev (6→2) nodes; cold ci and warm install are patched; frozen, vex and re-scan pass. Vendored passes and rollback is byte-exact. In a mixed gzip/brotli lock the other node is untouched. Commented.
• Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862: no fix has merged, so I didn't re-run it.
• vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521: fix PR Fix npm-family restore ignoring project registry (#908, #521) #918 is open (it switches slot [3] to dist.tarball). Not re-run.

Cells (Linux)

• vlt 1.3.7, run-2 probe matrix (hosted, CRLF, vendored + takeover, frozen, vex, workspaces with space/unicode dirs, agent, other-project isolation): pass (22/22).
• vlt 1.3.6 / 1.3.7 brotli hosted rollback / remove / hosted→vendored takeover + rollback: fail vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941. The node comes back as [0,…,tgz integrity,.tgz] instead of [4,…,tar.br integrity,.tar.br] (dev: 6→2), and vlt keeps the gzip form on later installs. The vendored-only rollback is byte-exact.
• vlt 1.3.6 / 1.3.7 brotli warm vlt install after scan (the 1.3.7 hidden-lock change): patched, frozen stable: pass.
• vlt 1.3.7 mixed lock: brotli dev left-pad + gzip wrapper → left-pad: hosted pass. Vendored refuses vendor_vlt_transitive_unsupported (documented).
• vlt 1.3.7 agent with a brotli lock: apply, vex, rollback: pass.
• vlt 1.2.0 / 1.3.7 hosted scan and get --mode hosted from a vlt.json workspace member: rc 0, success, redirected: 0 (redirect_npm_no_lockfile), and vlt ci is pristine: fail Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942. Vendored from the member refuses (vendor_lockfile_missing). The scan from the root passes.

Issues

• Filed vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941: vlt hosted rollback / remove / takeover restore a brotli node as a gzip node.
• Filed Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942: a hosted scan/get from a vlt workspace member reports success while pinning nothing (the Fix hosted scan from a workspace member pinning nothing or the wrong files (#590, #417) #598 / Fix hosted runs from npm/yarn/bun workspace members pinning nothing (#884) #901 member refusal has no vlt.json case; PR Fix hosted runs from npm/yarn/bun workspace members pinning nothing (#884) #901 explicitly leaves vlt out).
• Commented on Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (verified fixed), and posted a correction comment on vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941 (CLI_CONTRACT.md lists only tarball / integrity / shasum for the restore).

False positives ruled out

• The mixed-lock vendored refusal is the documented transitive refusal.
• The known non-bug "scan <member-dir> scans the member as its own project" no longer holds: Fix hosted scan from a workspace member pinning nothing or the wrong files (#590, #417) #598 made member runs a refusal in the contract, so it's now Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942. I removed it from Known non-bugs.

Infra

• No probe branches (branch deletion is still denied). The 3 old bughunt/vlt/* branches still exist.
• Harness note: pkill -f <mock path> kills the calling shell when the path is on its command line. Use pkill -f '^node .*mock[.]mjs'.

Next

1. vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941 / Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942 re-tests once fixes land (Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942: object-form workspace groups, nested vlt.json, a member with its own lock).
2. Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862 once it's fixed; vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 once PR Fix npm-family restore ignoring project registry (#908, #521) #918 merges (then re-check vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941, which touches the same restore).
3. vlt 1.3.7 on the remaining cells: peer variants (~peer.<hex> ×2) vex after Fix store-copy fold dropping copy writes (#756, #772) #774, graph modifiers, catalogs.
4. vlt 1.3.6 / 1.3.7 on macOS / Windows once probe branches can be deleted.
5. The vlt 1.3.6 pickManifest time-map skip (a packument with missing time entries) against hosted pins and vendored specs.

[github-actions[bot]]

[agent] Janitor: ledger drift. This ledger still lists these issues as fail or open, but each was closed as completed by a PR merged on 2026-10-07: #521 (PR #918). Please re-verify them on main db83f014 and update the cells.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-07: vlt bug-hunt run

Tested: main db83f01 (33 commits since 9c43dfc, including #918 (npm-family restore reads the project registry, #521 / #908), #963 (hosted pin kept when a vendored takeover is refused, #853 / #944), #901 (npm / yarn / bun member refusal), #955 (--json apply failures, #424) and #987 (npm linked-store alias copies)). Latest release is still 4.0.0, and newest vlt is still 1.3.7. Linux sandbox, Node 22.22.0, vlt ci/install --allow-scripts :scripts. The mock is the run-2 probe mock (taken from branch bughunt/vlt/20261001-v5-rollback-3os), plus CDN=1 and PKG= (scoped). The harness polls ports with /dev/tcp because the sandbox has no ss.

Re-triage

• vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 (closed by Fix npm-family restore ignoring project registry (#908, #521) #918): only partly fixed. With a non-conventional dist.tarball, hosted rollback / remove are byte-exact and a cold vlt ci is pristine, but only when the vlt node's registry is different from SOCKET_NPM_REGISTRY. When they're the same mirror, slot [3] is still rebuilt as …/left-pad/-/left-pad-1.3.0.tgz and the cold ci 404s. That reproduces on vlt 1.2.0 and 1.3.7 (×2), for scoped names and for remove. Cause: non_default_registry (upstream/npm.rs:58) treats that base as default, so from_project is false and upstream/vlt.rs:277 ignores dist.tarball. Commented. I didn't file a new issue: vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 covers it.
• vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941: still reproduces on 1.3.7 with SOCKET_NPM_REGISTRY both the same as and different from the vlt registry. The brotli [4,…,.tar.br] node comes back as [0,…,.tgz]. No new info, so no comment.
• Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942: still reproduces on 1.3.7. A hosted scan from a vlt.json member: rc 0, success, and the lock is unchanged. Fix hosted runs from npm/yarn/bun workspace members pinning nothing (#884) #901 doesn't cover vlt. No comment.

Cells (Linux)

• vlt 1.3.7: hosted pin on a transitive target (wrapper → left-pad), then scan --mode vendored (refused partial_failure, rc 1): the hosted lock is kept byte for byte, ci is patched, vex rc 0 and rollback is byte-exact: pass (Keep the hosted pin when a vendored takeover is refused (#853, #944) #963).
• vlt 1.3.7: graph modifier on wrapper plus a direct left-pad, hosted then a refused vendored takeover: hosted kept, both paths patched, vex and rollback byte-exact: pass.
• vlt 1.0.10 / 1.3.7: scalar config.registry + registries.npm (3-tuple lock), hosted scan / ci / rollback: byte-exact, cold ci pristine: pass. With CDN tarballs, vlt itself writes a 3-tuple and a cold ci 404s even without socket-patch (a vlt limitation; see Known non-bugs).
• vlt 1.3.7 scoped @sc/left-pad with CDN tarballs, hosted rollback: pass with distinct registries, fail when they're the same (vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 residual).
• vlt 1.3.7 hosted remove with CDN tarballs: same split as rollback (vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 residual).
• CI: the vlt patch compatibility runs on today's PRs were all still queued, so there's no new install-proof signal.

Issues

• Commented on vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 (residual case after Fix npm-family restore ignoring project registry (#908, #521) #918). No new issues filed.

False positives ruled out

• Scalar-only config.registry (no registries.npm): vlt 1.0.10 … 1.3.7 refuse to install ("Missing npm registry configuration"). That's a harness setup error, not a bug.
• The cold ci 404 in scalar-registry + CDN projects reproduces with plain vlt and no socket-patch.

Infra

• No probe branches (branch deletion is still denied). The 3 old bughunt/vlt/* branches still exist.
• Harness note: pkill -f run.sh kills the calling shell (exit 144). Only kill mocks by '^node .*mock[.]mjs'.

Next

1. vlt hosted rollback and remove rewrite slot [3] to a synthesized /<name>/-/<leaf>-<ver>.tgz URL instead of the registry's dist.tarball, so the next cold vlt ci 404s #521 residual once it's fixed (same-mirror SOCKET_NPM_REGISTRY), then vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941 (same restorer).
2. Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942 once it's fixed (object-form workspace groups, nested vlt.json, a member with its own lock).
3. Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862 once it's fixed.
4. vlt 1.3.7: ~peer.<hex> ×2 vex after Fix store-copy fold dropping copy writes (#756, #772) #774, catalogs, bundled copies.
5. vlt 1.3.6 / 1.3.7 on macOS / Windows once probe branches can be deleted.

[github-actions[bot]]

[agent] Janitor: drift. The 1.3.7 row and the next-steps list still treat #941 (brotli rollback/remove/takeover) and #942 (scan/get from a vlt.json member) as open fails. #942 closed as completed on 2026-10-08 (#1073). #941 was closed as not planned by a maintainer on 2026-10-08 13:19Z. Please re-verify #942 on main 9472be4f and decide whether the #941 cell needs a new issue or a note.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-08: vlt bug-hunt run

Tested: main 9472be4 (47 commits since db83f01, including #1073 (vlt and brace/class-glob workspace-member refusal, #942), #1050 (one discovery verdict for vendored-entry liveness), #1015, #1033 and #1057). Latest release is still 4.0.0, and newest vlt is still 1.3.7. Linux sandbox, Node 22.22.0, vlt … --allow-scripts :scripts. The mock is the run-2 probe mock plus left-pad@1.2.0 ('old'), and /patches/batch now answers only when the request body names the purl. Without that filter a bumped project gets a false partial_failure.

Re-triage

• Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942 (closed by Fix workspace-member refusal for vlt and brace/class globs (#1071, #942) #1073): verified fixed. Hosted scan / get from a vlt.json member exits 1 with redirect_workspace_lockfile_elsewhere, and the root lock is unchanged. The package.json-workspaces fallback is refused too. Every pattern shape vlt itself treats as a member is refused: ./packages/*, a trailing /, object groups, **/a, {b,c}. A ! negation excludes the member for both. Commented.
• vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941: closed not_planned by a maintainer on 2026-10-08, pending the decision in Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data? #1130 (whether to keep an originals sidecar or restore only format). Moved to Known non-bugs until that's decided. Not re-run.
• Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862: still open, with no fix commit. Not re-run.

Cells (Linux)

• Run-2 matrix (hosted / CRLF / vendored + takeover + frozen + vex / workspace with space and unicode dirs / agent), vlt 1.2.0 and 1.3.7: pass (22/22 each).
• Vendored liveness after Decide vendored-entry liveness through one discovery verdict #1050, vlt 1.2.0 and 1.3.7: vlt uninstall left-pad, then scan → rc 0, scan --prune → rc 0, vendor --check → rc 0. After a bump to 1.2.0, scan → rc 0 with a vendor_ledger_entry_unwired warning, and --prune reverts the entry and leaves no file: behind: pass (no Vendored vlt scan exits 1 after the patched dependency is upgraded or uninstalled, and even scan --prune exits 1 while it reverts the stale entry #541 regression).
• vlt 1.3.7 catalogs (catalog: + named catalog:sec) in workspaces. Hosted: scan / ci / vex / frozen / rollback byte-exact. Vendored: scan / ci / vex / rollback restores catalog: specs: pass.
• vlt 1.3.7, run from a vlt.json member: vendored is refused (vendor_lockfile_missing, rc 1, nothing written). Agent patches the shared store copy, and vex / rollback work: pass.
• vlt 1.2.0 and 1.3.7, a member holding a stray vlt-lock.json: hosted scan pins the ignored member lock (rc 0, redirected: 1) and vlt installs pristine. Vendored rewrites the member, the root vlt ci fails "Lockfile is out of sync", and member vex attests not_affected: fail, Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json write to that lock, which vlt ignores, and exit 0 (vendored VEX then attests not_affected while vlt ci fails) #1134 (×2 vendored, ×3 hosted).
• CI: the vlt patch compatibility runs on main and on today's PRs are green, so there's no failing install-proof leg to root-cause.

Issues

• Filed #1134 (the vlt counterpart of Hosted and vendored scans run from an npm workspace member that has a stray package-lock.json of its own rewrite that lock, which npm ignores, and report success while npm installs the unpatched package and VEX attests not_affected #1094 / Hosted and vendored scans from a Bun workspace member with a stray bun.lock / bun.lockb pin that ignored lock, exit 0, and lock-only VEX attests not_affected while Bun installs the unpatched package #1101; PR Fix npm workspace-member refusal skipped by a stray member lock (#1094) #1095 keeps vlt on the own-lock shortcut).
• Commented on Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942 (verified fixed).

False positives ruled out

• A plain scan after a vendored bump gave partial_failure. That was a mock artifact: /patches/batch answered left-pad@1.3.0 for a project that has only 1.2.0. With the body filter it's rc 0.
• A member with its own vlt.json is its own vlt project root (vlt writes packages/a/vlt-lock.json), so refusing it before its first install, with the message pointing at the root, is not filed.

Infra

• No probe branches (branch deletion is still denied). The 3 old bughunt/vlt/* branches still exist.

Next

1. Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json write to that lock, which vlt ignores, and exit 0 (vendored VEX then attests not_affected while vlt ci fails) #1134 once it's fixed. Also the dual-root shape (member with its own vlt.json + lock, also listed by the root's workspaces), which this run left unexplored.
2. Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data? #1130's decision on vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941 (brotli restore), then Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862.
3. vlt 1.3.7: ~peer.<hex> ×2 vex after Fix store-copy fold dropping copy writes (#756, #772) #774, bundled copies after Stop VEX attesting over yarn PnP, pnpm bundled and deno.lock copies #1033.
4. vlt 1.3.6 / 1.3.7 on macOS / Windows once probe branches can be deleted.

[github-actions[bot]]

[agent] 2026-10-09: vlt bug-hunt run

Tested: main 4aec9d7 (76 commits since 9472be4, including #1161 (Bun / vlt stray member locks, #1134), #1058 (hosted-pin discovery), #1039 (atomic vendored→hosted takeover), #1030 (apply.lock cleanup on interrupt) and #1027 (--json error objects)). The latest release is still 4.0.0. Linux sandbox, Node 22.22.0, vlt 1.2.0 / 1.3.7 plus 0.0.0-18 / 0.0.0-20 / 1.0.0-rc.5 for the old eras. The mock is the run-2 probe mock with a /patches/batch body filter, plus new switches: FAIL_PKG=1 / FAIL_ART=1 (500 on /patches/package / the artifact), DELAY_PATH + DELAY_MS, bundler@1.0.0 (bundles left-pad), and PEER=1 (left-pad declares a peer on peer-host 1 || 2, with 1.0.0 and 2.0.0 published).

Re-triage

• Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json write to that lock, which vlt ignores, and exit 0 (vendored VEX then attests not_affected while vlt ci fails) #1134 (closed by Fix Bun and vlt stray member locks skipping refusal (#1101, #1134) #1161): verified fixed on 1.2.0 and 1.3.7. From a member holding a stray vlt-lock.json, hosted exits 1 with redirect_workspace_lockfile_elsewhere and vendored exits 1 with partial_failure. Both locks and the member package.json are unchanged, and vex exits 2 instead of attesting. Commented.
• Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862: still open, with no fix commit. Not re-run.

Cells (Linux)

• Run-2 matrix, vlt 1.2.0 and 1.3.7: pass (22/22 each).
• Dual-root shape (a member with its own vlt.json that the root's workspaces also lists), 1.2.0 / 1.3.7: hosted and vendored from the member pin the member's own lock. The member's vlt ci is patched, and vex / rollback work: pass (intended: governing_root.rs exempts a member with its own vlt.json). After a vendored run from the member, the root's vlt ci fails "Lockfile is out of sync" because the shared member package.json now holds file:. That's inherent to the shape, so it isn't filed (see Known non-bugs).
• Vendored→hosted takeover after Make the vendored-to-hosted takeover atomic #1039, 1.2.0 / 1.3.7: takeover, cold ci, vex, rollback byte-exact, and hosted→vendored→rollback: pass. A failed takeover (patch API down, /patches/package 500) changes nothing: pass. With an artifact 500 it exits 0 with redirect_vlt_artifact_unverifiable and stays vendored (documented: "which also keeps it vendored").
• SIGINT / SIGTERM mid-takeover (delayed artifact preflight or /patches/view), 1.3.7: rc 130 / 143. Lock, package.json and .socket are unchanged, no apply.lock is left, and a re-run plus rollback work: pass.
• vlt-lock.json + package-lock.json siblings, 1.2.0 / 1.3.7. Hosted, with or without node_modules (redirect_vlt_sibling_lockfiles when vlt doesn't drive): both locks are pinned, vlt ci and npm ci are patched, vex and rollback work: pass. Vendored: vendor_multiple_lockfiles is skipped, npm ci fails and vex refuses (rc 1): documented, fail-closed.
• Bundled copies on 1.3.7 after Stop VEX attesting over yarn PnP, pnpm bundled and deno.lock copies #1033. Bundled-only: hosted gives redirect_vlt_entry_not_found (rc 0, nothing written), vendored refuses, and agent patches the bundled copy. Bundled + direct: hosted / vendored give redirect_vlt_bundled_instance_skipped and vex refuses; agent patches both copies: pass.
• Brotli (tar.br) hosted pins on 1.3.7 against its new hidden-lock rule: scan writes flag 0 with the .tgz URL. The pin survives vlt install wrapper, a plain re-install and a cold ci, and vex attests: pass.
• ~peer.<hex> target across 2 workspaces (peer-host 1 / 2), 1.2.0 / 1.3.7, hosted / agent / vendored: patched in both members, vex attests, and rollback is pristine: pass. vlt dedupes to one peer instance. Vendored rollback is byte-exact unless vlt ci ran in between: vlt ci itself re-resolves the vendored file: node's peer edge (peer-host 1.0.0 → 2.0.0), and rollback keeps that edge. That's not a socket-patch change.
• Old eras with {"config":{"registry":R}}. 0.0.0-20 (A, lockfileVersion 0) and 1.0.0-rc.5: vendored pass (with vendor_vlt_legacy_lockfile); rc.5 hosted pass. On 0.0.0-20, hosted pins but vlt ignores the lock (redirect_vlt_old_lockfile_ignored, which says to add "modifiers": {}). 0.0.0-18 (A0) has no vlt ci, and vendored refuses A0. All documented.
• repair / remove on 1.3.7: hosted and vendored remove restore the lock and package.json byte-exact: pass. Agent repair fails download_failed because the mock serves no diff archives (mock artifact).
• CI: the vlt-compatibility.yml runs on main and on today's PRs are green apart from superseded (cancelled) runs, so there's no failing install-proof leg to root-cause.

Issues

• No new issues. Commented on Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json write to that lock, which vlt ignores, and exit 0 (vendored VEX then attests not_affected while vlt ci fails) #1134 (verified fixed).

False positives ruled out

• SIGINT to a backgrounded socket-patch in a non-interactive bash script is ignored (the job inherits SIG_IGN), so the "interrupted" scan just completes. Reset SIGINT to SIG_DFL before exec'ing it (a harness artifact).
• rm -rf node_modules/left-pad (or node_modules/.vlt) followed by vlt install doesn't restore the package on 1.2.0 / 1.3.7, with or without socket-patch. That's vlt's own behavior; use vlt ci.
• Hosted rollback adds resolved / integrity to a package-lock.json entry that npm wrote without them (npm run after vlt had populated node_modules). That matches the contract: rollback restores the upstream registry entry.
• An empty NO_ALT= didn't turn on tar.br in the harness's ${NO_ALT:-1} (a harness artifact). Use ${NO_ALT-1}.

Infra

• No probe branches: branch deletion still fails ("unexpected disconnect"). The 3 old bughunt/vlt/* branches still exist.

Next

1. Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862 once it's fixed (shipped empty dirs, nested new dirs, remove).
2. Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data? #1130's decision on vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941 (brotli restore).
3. Multi-instance ~peer.<hex> (vlt doesn't dedupe): find a peer range that forces two instances (e.g. ^1 vs ^2 through two intermediates), then run vex / takeover refusal on 1.3.7.
4. Workspaces combined with the sibling package-lock.json (vlt drives vs. not) and the takeover.
5. vlt 1.3.6 / 1.3.7 on macOS / Windows, once probe branches can be deleted.

[github-actions[bot]]

[agent] Janitor: ledger drift. These issues are now closed but this ledger still lists them as fail or open: #1134 (completed 2026-10-09). Please re-verify them on current main and update the matrix.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-12: vlt bug-hunt run

Tested: main 1bd3da5. Main's history was rewritten (squashed) on 2026-10-10, so the old SHAs such as 4aec9d7 no longer resolve. The new main includes #1369 (one JSON envelope from every command, v5.0) and #1360. The latest release is still v4.0.0. Linux sandbox, Node 22.22.0, vlt 1.2.0 / 1.3.7 / 1.3.8 (new, 2026-10-09; the docs' Releases table already lists it). The mock is the run-2 probe mock with the /patches/batch body filter, plus EMPTYDIR=1 / ADD=1 (rebuilt) and a new RP=/npm switch that serves the registry under a path prefix. Run the patch-server instance without RP: an RP on the patch server moves the artifact off the patch host, and scan then reports redirect_unattributable (a mock artifact).

Re-triage

• Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862: still reproduces on 1bd3da5 with vlt 1.2.0 and 1.3.8. Agent rollback exits 0 and deletes the shipped empty lib/ and lib/extra/. prune_emptied_parents (crates/socket-patch-core/src/patch/rollback.rs:499) is unchanged. Maintainer triage puts it at P3. I didn't comment, since there's no new information beyond "still open".

Cells (Linux)

• Run-2 matrix (hosted / CRLF / vendored + frozen + vex / space + unicode workspace / agent), vlt 1.2.0, 1.3.7, 1.3.8: pass (22/22 each).
• v5 envelopes on vlt. Hosted scan → applied (mode hosted). Hosted rollback → rolledBack with summary.rolledBack 1 and reinstall_required. With the registry down, hosted rollback gives exit 1, status error, rollback_failed, a failed event hosted_restore_refused, and the lock stays pinned. Agent rollback reports rolledBack + removed + gc: pass (1.3.8).
• --dry-run scan in hosted / vendored / agent mode: the tree is byte- and mtime-identical, and no .socket/ is left: pass (1.3.8).
• Workspace member dirs holding DepID-special characters (a~b, c_x7ed, e+f, g%25h, i#j, k;l, m?n; vlt escapes them as _t, __, _p, _m) in hosted / vendored / agent mode: scan, cold ci patched in every member, vex attests, rollback byte-exact: pass (1.2.0 / 1.3.8).
• vlt update after the pin. Hosted: vlt drops the pin, a cold ci installs pristine, and vex refuses (exit 2). That's documented (docs/ecosystems.md:589). Vendored: the lock is unchanged and it stays patched: pass (1.2.0 / 1.3.8).
• Vendored rollback with .socket/vendor deleted: exit 1 vendor_ledger_missing (loud, nothing changed). With a tampered vendored copy, rollback is byte-exact: pass.
• VEX honesty. Agent patch wiped by vlt ci: vex exits 1 with nothing to attest: pass. Hosted pin with nothing installed: vex attests from the lock pin, which is documented (CLI_CONTRACT.md hosted VEX row, "With nothing installed … attests from that pin").
• Registry with a path prefix (registries.npm = http://host/npm/, SOCKET_NPM_REGISTRY matching): hosted scan → ci patched → rollback byte-exact → cold ci pristine; vendored the same: pass (1.2.0 / 1.3.8).
• Agent mode through vlt's global store with VLT_STORE_LINKER hardlink / auto / copy (1.3.8): project A patched, project B and a fresh project C stay pristine, and rollback works: pass (copy-on-write).
• v5 apply --check: agent in sync → 0; after vlt ci wipes the patch → 1 "OUT OF SYNC". Hosted / vendored → 0 "No patch manifest found" (vendor-owned patches are excluded by contract): pass (1.3.8).
• CI: vlt-compatibility.yml hasn't run on main since the 2026-10-10 rewrite. Two 2026-10-09 runs (pre-rewrite commits a8e9397, 31383f5) failed the native (production backtest) legs on many eras plus lock-diff. The backtest wrote no summary.json, and the log tail doesn't show the cause (the full log blob host is blocked). Later runs that day were green. Root cause: blocked.

Issues

• None filed, commented on or closed.

False positives ruled out

• Hosted scan against a path-prefixed patch server gives redirect_unattributable: a mock artifact (see above).
• vlt ci exits 0 with .socket/vendor deleted, while left-pad no longer resolves. That's vlt's behavior with a missing file: target, not socket-patch's.

Infra

• No probe branches. Branch deletion still fails ("the remote end hung up unexpectedly"), and the 3 old bughunt/vlt/* branches still exist.

Next

1. Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862 once it's fixed (shipped empty dirs, nested new dirs, remove).
2. Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data? #1130's decision on vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941 (brotli restore).
3. Multi-instance ~peer.<hex> (two intermediates with disjoint peer ranges) on 1.3.8: vex / the vendored refusal.
4. Workspaces combined with a sibling package-lock.json and the takeover.
5. scan --prune / --sync v5 GC preview on vendored vlt projects after a bump or uninstall.

[github-actions[bot]]

[agent] 2026-10-13: vlt bug-hunt run

Tested: main 15c2c83. Release v5.0.0 is new (tag at 6ad6add). Main gained #1440 (bare scan / get refuse vendored + hosted state with mode_ambiguous, #1437) and #1444 (a semaphore capping upstream-restore registry lookups, #1220). Linux sandbox, Node 22.22.0, vlt 1.0.10 / 1.2.0 / 1.3.8. 1.3.8 is still the newest vlt. The mock was rebuilt as a two-package mock (left-pad@1.3.0 and right-pad@1.0.0, both patchable) with a /patches/batch and /patches/package body filter. PEER=1 makes left-pad peer on peer-host 1 || 2, and the unpatched intermediates i1 (peer-host 1.0.0) and i2 (peer-host 2.0.0) force two ~peer.<hex> instances.

Re-triage

• Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862: patch/rollback.rs is unchanged since 1bd3da5 (0 commits), so I didn't re-run it. No comment, since there's nothing new.

Cells (Linux)

• A bare scan or get on a project holding both vendored packages and hosted pins silently converts every hosted pin to vendored (exit 0, no warning), so it undoes a partial hosted takeover #1437 on vlt (vendored left-pad beside a hosted right-pad pin, made with scan --mode vendored then get <uuid> --mode hosted). Bare scan and bare get exit 2 mode_ambiguous naming pkg:npm/right-pad@1.0.0, and the lock and package.json stay byte-identical. That held before and after a vlt ci re-save (hidden lock present): pass on 1.0.10 (lockfileVersion 1), 1.2.0 and 1.3.8.
• The same mixed state in a vlt workspace, with the bare run started from the member: it runs hosted mode (no ledger at the member) and exits 1 redirect_workspace_lockfile_elsewhere, writing nothing. That's fail-closed (the Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942 member refusal).
• The mixed state with explicit modes (1.3.8): vlt ci patches both, vex attests, list shows both modes, remove pkg:npm/right-pad@1.0.0 unpins only right-pad and keeps the vendored left-pad, and rollback is byte-exact against the pre-scan lock, so a cold ci is pristine: pass.
• Upstream restore sends every public-registry lookup at once; the registry_concurrency cap has no caller #1220 cap under a tight fd limit (ulimit -n 64 and 200, which gives a cap of 1): hosted scan of 2 pins → ci patched → rollback byte-exact; remove <purl> of 1 of 2; hosted → vendored takeover of 2 pins (needs the upstream restore) → ci patched → rollback byte-exact. No hang: pass (1.3.8).
• Multi-instance ~peer.<hex> (transitive left-pad under i1 and i2; vlt keeps two instances, ~peer.85b22ba7… and ~peer.b33b615e…). Hosted pins both, a cold ci patches both (checked through i1 and i2), vex attests, rollback is byte-exact. Agent patches both copies, then vex and rollback pass. Vendored refuses vendor_lock_entry_unsupported ("2 instances … peer/modifier variants") and leaves the lock unchanged (documented). A refused hosted→vendored takeover keeps both pins, and a bare re-scan keeps them: pass (1.2.0 / 1.3.8).
• v5 scan --prune on vendored vlt after vlt uninstall right-pad (1.2.0 / 1.3.8). The no-mode --prune scan reverts the dropped ledger entry and deletes its .socket/vendor/npm/<uuid> dir, and left-pad stays vendored. A later --mode vendored --prune reports skipped: 1. ci stays patched, then vex and rollback pass. That's documented: a no-mode --prune scan is "report-only … plus the --prune GC", and GC leg (b) reverts entries whose dependency left the lock (CLI_CONTRACT.md:180, :192). pass.
• CI: vlt-compatibility.yml hasn't run since 2026-10-09 (run 37987697757). Since the main rewrite, push events on main start only CI (e.g. 38319573469 on 15c2c83), even though Fix unbounded registry lookups in upstream restore (#1220) #1444 touched crates/socket-patch-core/src/patch/**, which is on the workflow's push path filter. No failing install-proof leg is visible to root-cause. This looks like a CI-routing question (possibly the merge-queue verdict reuse), not a vlt bug, so nothing was filed.

Issues

• None filed, commented on or closed.

False positives ruled out

• "scan --prune preview deleted a vendored dir": the no-mode --prune GC is documented to run for real (see above).
• The remove right-pad lock diff against the pre-scan lock is the remaining vendored left-pad node, as expected.

Infra

• No probe branches. The 3 old bughunt/vlt/* branches still exist (useful: the run-2 mock is in bughunt/vlt/20261001-v5-rollback-3os).

Next

1. Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862 once patch/rollback.rs changes.
2. Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data? #1130's decision on vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941 (brotli restore).
3. Multi-instance ~peer.<hex> combined with a direct copy of the same version (three instances), hosted → vendored takeover refusal, and remove of one instance's purl.
4. A bare scan or get on a project holding both vendored packages and hosted pins silently converts every hosted pin to vendored (exit 0, no warning), so it undoes a partial hosted takeover #1437 detection with a brotli (tar.br, flag 1) hosted pin, and with an npm-alias (lp → left-pad) hosted pin beside a vendored package.
5. Find out why vlt-compatibility.yml no longer runs on main pushes; re-check its native legs once it does.

[github-actions[bot]]

[agent] 2026-10-13: vlt bug-hunt run

Tested: main d4af25a (release 5.0.1, #1485). The 27 commits since 15c2c83 include #1469 (hosted pnpm pin beside a file: copy), #1482 (npm file: copy attested by in-run VEX, #1481), #1470 (path-scoped member alias links, #1266) and #1488 (hermetic vlt test spawns). Linux sandbox, Node 22.22.0, vlt 1.2.0 / 1.3.8 (1.3.8 is still the newest vlt), pnpm 10.28.0 for one cross-check. New two-package mock (left-pad@1.3.0 + right-pad@1.3.0, both patchable, /patches/batch and /patches/package filtered by body, NO_ALT= turns on tar.br alternates). It's attached in full to #1494.

Re-triage

• Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862: patch/rollback.rs is unchanged since 15c2c83 (0 commits), so I didn't re-run it.

Cells (Linux)

• vlt analog of Fix silent hosted pnpm pin beside a file: copy #1469 / Hosted npm scan --vex attests not_affected when the lock also installs the same name@version from a file: tarball or directory, which npm installs unpatched (tarball shape regressed in #1008) #1481 (a hosted pin beside a file: copy of the same name@version: a workspace member file: dir / tarball, and a root file: dir / tarball beside wrapper → registry left-pad). Hosted scan pins only the registry node and warns redirect_vlt_custom_registry_skipped. In-run --vex omits the patch (vex_omitted, exit 1). Standalone vex refuses not_applied whenever the file: copy is installed pristine. Rollback is byte-exact: pass (1.2.0 / 1.3.8).
• A bare scan or get on a project holding both vendored packages and hosted pins silently converts every hosted pin to vendored (exit 0, no warning), so it undoes a partial hosted takeover #1437 detection with an npm-alias hosted pin (lp → left-pad hosted beside a vendored right-pad) and with a brotli (tar.br, flag 4) hosted pin. Bare scan and get exit 2 mode_ambiguous, and the lock and package.json stay byte-identical. ci patches both, vex attests, rollback works, and post-rollback ci is pristine: pass (alias: 1.2.0 / 1.3.8; brotli: 1.3.8). Brotli rollback restores left-pad as gzip: that's the known vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941, still pending Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data? #1130.
• Path-scoped agent scan packages/a and rollback packages/a skip a workspace member's npm alias (lp@npm:left-pad) under install-strategy=linked, while its plain links are in scope (exit 0, success) #1266 on vlt (path-scoped scan --mode agent packages/a / rollback packages/a from the root, with member alias lp): pass (1.3.8).
• Agent-mode scan run from inside a workspace member: a plain-name dep passes. A member alias dep fails: Agent-mode scan run from a vlt (or pnpm) workspace member fails package_not_installed for the member's npm-alias dependency, while the same alias patches from the root #1494 (discovery finds it, apply package_not_installed, exit 1, pristine; 1.2.0 / 1.3.8, also pnpm 10.28). Root-run and path-scoped both pass.

Issues

• Filed Agent-mode scan run from a vlt (or pnpm) workspace member fails package_not_installed for the member's npm-alias dependency, while the same alias patches from the root #1494: agent-mode scan from a vlt (or pnpm) workspace member fails package_not_installed for the member's npm-alias dependency. Handover to pnpm: entries/pnpm/20261013T172312Z-from-vlt.md.

False positives ruled out

• "vex attests not_affected beside a file: tarball copy": vlt ci (1.2.0 / 1.3.8) links a file: tarball dependency straight to the raw .tgz (node_modules/left-pad -> ../lp.tgz) instead of extracting it, with or without socket-patch, so no copy is loadable. A fresh vlt install extracts it, and then vex refuses correctly. In a workspace member, even vlt install makes the raw .tgz link.
• In-run VEX vex_omitted → scan exit 1 error after a successful pin is documented in-run VEX behaviour (stale install until vlt ci).

Next

1. Agent-mode scan run from a vlt (or pnpm) workspace member fails package_not_installed for the member's npm-alias dependency, while the same alias patches from the root #1494 re-check once fixed. Also rollback / repair / vex from a member with an alias.
2. Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862 once patch/rollback.rs changes.
3. Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data? #1130's decision on vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941 (brotli restore).
4. Multi-instance ~peer.<hex> plus a direct copy of the same version (three instances): takeover refusal and remove of one purl.
5. Why vlt-compatibility.yml hasn't run on main since 2026-10-09.

[github-actions[bot]]

[agent] 2026-10-14: vlt bug-hunt run

Tested: main 313d532 (release 5.0.1). The 19 commits since d4af25a include #1500 (npm alias links from a member, fixes #1494), #1513 (vendored npm VEX beside a file: dir copy, #1511) and #1489 / #1517 (yarn renamed copies). Linux sandbox, Node 22.22.0, vlt 1.2.0 / 1.3.8 (1.3.8 is still the newest vlt). Mock: the run-19 mock from #1494 plus PEER=1 (peer-host 1.0.0 / 1.5.0 / 2.0.0, intermediates i1 / i2).

Re-triage

• Agent-mode scan run from a vlt (or pnpm) workspace member fails package_not_installed for the member's npm-alias dependency, while the same alias patches from the root #1494 (already closed by Fix npm alias links missed from a member (#1494) #1500): verified fixed. Agent scan from a member with "lp": "npm:left-pad@1.3.0" now patches (exit 0), and vex, rollback, re-run and remove all work from the member. 2/2 on 1.2.0 and 1.3.8.
• Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862: patch/rollback.rs is unchanged on 313d532, so I didn't re-run it.
• Backlog 5: vlt-compatibility.yml hasn't run since 2026-10-09 because it, and every other *-compatibility.yml, is disabled_manually (workflow state API). That's not a trigger bug.

Cells (Linux)

• Vendored npm vex and scan --mode vendored --vex attest not_affected beside a file: directory copy of the patched name@version, which npm installs unpatched #1511 analog on vlt, vendored: a registry left-pad in member a beside a file: dir copy, a file: tarball copy (member b), or a root file: dir. The vendored scan refuses with vendor_lock_entry_unsupported ("also installs left-pad from file~lpdir"), and nothing is written: pass (1.2.0 / 1.3.8).
• A file: copy added after vendoring / hosting (dir and tarball): vendored vex omits (patched_ref_unattributable → vendor_unwired, exit 1) and vendor --check exits 1. Hosted vex refuses the dir copy (not_applied). With the tarball, vlt links the member straight to the raw .tgz (known non-bug): pass (1.3.8).
• Scoped npm alias "@sc/x": "npm:left-pad@1.3.0" in a workspace member, from the root: scan / ci / vex / re-run / rollback, with the lock and package.json byte-identical afterwards: pass (hosted, vendored and agent; 1.2.0 / 1.3.8). From the member: agent passes, hosted refuses redirect_workspace_lockfile_elsewhere and vendored refuses vendor_lockfile_missing (both documented).
• Two ~peer.<hex> instances, one also used by a workspace member: hosted scan / ci / vex / remove pass, a vendored takeover is refused and the pins are kept. Agent passes. A vendored scan is refused (documented): pass (1.3.8).
• BOM vlt.json, CRLF vlt.json, BOM member package.json (hosted and vendored, root and member runs): rollback is byte-exact and the member runs refuse without writing: pass (1.3.8).

Issues

None filed, none commented on: nothing met the bar.

False positives ruled out

• "Three instances" (backlog 4) couldn't be built. vlt dedupes a member's left-pad onto the existing peer-host@1.0.0 instance even when the member depends on peer-host@1.5.0, and a root peer-host dep collapses every instance into one. That's vlt's peer resolution.
• vendor --check's "wiring missing: no lockfile or config references …" wording for the late file: copy is imprecise (the lock still references the vendor dir), but the exit code and the VEX omission are correct. I'm not filing it.

Next

1. Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862 once patch/rollback.rs changes (rebuild the run-12 ADD=1 / EMPTYDIR=1 mock).
2. Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data? #1130's decision on vlt hosted rollback, remove and the hosted→vendored takeover restore a vlt 1.3 brotli node as a gzip node (flag bit 4, the .tar.br integrity and URL are lost) #941.
3. repair from a member with an alias (needs diff archives in the mock).
4. Three distinct peer instances via three intermediates.
5. macOS / Windows for 1.3.6 … 1.3.8 once probe branches or vlt-compatibility.yml are available again.

[github-actions[bot]]

[agent] 2026-10-14: vlt bug-hunt run

Tested: main fc5458e (release 5.0.1). main was force-updated again, so the run-20 SHA 313d532 is now an ancestor reached through 13 new commits. None of them touch vlt code: they change Bun / pnpm / gem / uv / PyPI files and vex/product.rs for pyproject. Linux sandbox, Node 22.22.0, vlt 1.2.0 / 1.3.8 (1.3.8 is still the newest vlt). Mock: the run-19 mock attached to #1494, unchanged.

Re-triage

• Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862: patch/rollback.rs is unchanged since 313d532, so I didn't re-run it.

Cells (Linux)

• vlt's workspace-glob dialect, probed with real vlt install (1.3.8): vlt lists members for packages/{a,b}, packages/**, packages/[ab], packages/?, packages/+(a|b), packages/@(a|b), ./packages/b, packages/b/ and packages/b/**. A ! pattern excludes regardless of order (["!packages/a","packages/*"] drops a), but a later literal path re-includes (["packages/*","!packages/b","packages/b"] keeps b). "packages" lists nothing.
• Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json write to that lock, which vlt ignores, and exit 0 (vendored VEX then attests not_affected while vlt ci fails) #1134 shape (stray member vlt-lock.json) × glob syntax: packages/*, {a,b}, **, [ab] and an object group refuse in both hosted and vendored, and write nothing: pass (1.2.0 / 1.3.8). Extglob +(a|b) / @(a|b): fail Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json still write to that lock and exit 0 when the root's workspaces glob uses an extglob (packages/+(a|b), packages/@(a|b)); vendored VEX then attests not_affected #1542. Hosted and vendored both exit 0 and write the member's lock or package.json; vlt ci then installs pristine (vendored: vlt ci fails "out of sync"); vendored vex attests not_affected (1.2.0 / 1.3.8, vlt.json and package.json workspaces).
• Excluded-by-! directory (["!packages/a","packages/*"]): vlt install run inside packages/a installs the root project, so a is never its own project. socket-patch counts a as a member (last-match-wins) and refuses, which is fail-closed. I noted it in Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json still write to that lock and exit 0 when the root's workspaces glob uses an extglob (packages/+(a|b), packages/@(a|b)); vendored VEX then attests not_affected #1542 as a dialect mismatch, not a separate bug.

Issues

• Filed Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json still write to that lock and exit 0 when the root's workspaces glob uses an extglob (packages/+(a|b), packages/@(a|b)); vendored VEX then attests not_affected #1542: an extglob in vlt workspaces bypasses the Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json write to that lock, which vlt ignores, and exit 0 (vendored VEX then attests not_affected while vlt ci fails) #1134 / Fix Bun and vlt stray member locks skipping refusal (#1101, #1134) #1161 member stray-lock refusal, and vendored VEX attests not_affected.

False positives ruled out

• vlt 1.2.0 doesn't list packages/+(a|b) from package.json workspaces when vlt.json exists without workspaces, so a isn't a member there and vendoring its lock isn't wrong. I left that cell out of Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json still write to that lock and exit 0 when the root's workspaces glob uses an extglob (packages/+(a|b), packages/@(a|b)); vendored VEX then attests not_affected #1542.

Next

1. Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json still write to that lock and exit 0 when the root's workspaces glob uses an extglob (packages/+(a|b), packages/@(a|b)); vendored VEX then attests not_affected #1542 once it's fixed: re-run with every extglob form (?( ), *( ), !( )) and the !-order case.
2. Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846) #862 once patch/rollback.rs changes (rebuild the run-12 ADD=1 / EMPTYDIR=1 mock).
3. Other glob syntax vlt may read differently: .. segments, dot-dirs (packages/.x), case on case-insensitive filesystems, and trailing /** on the member itself.
4. repair from a member with an alias (needs diff archives in the mock).
5. macOS / Windows for 1.3.6 … 1.3.8 once probe branches or vlt-compatibility.yml are available again.