vlt: run 22 ledger

Author: claude

entries/vlt/20261015T052054Z.md

@@ -0,0 +1,31 @@
+[agent] 2026-10-15: vlt bug-hunt run
+
+**Tested:** main `7b6371c` (release **5.0.1**), on a Linux sandbox with Node 22.22.0 and vlt 1.3.8 / **1.4.0**. vlt 1.4.0 is new, published 2026-10-14. Mock: the run-19 mock attached to #1494, with `NO_ALT` unset (no `tar.br`).
+
+### What's new in vlt 1.4.0 (read from the bundle)
+- `pnpm-workspace.yaml` `packages:` is a third workspace source, read after `vlt.json` `workspaces` and then `package.json` `workspaces`.
+- `store-linker` gained `clone` (macOS clonefile through `node:ffi`) and `unpack` (no global store). `auto` is hardlink on Linux, clone on macOS with Node ≥ 26.1, and unpack on Windows and on macOS without it.
+- Other additions: graph modifiers that remove edges, an `@types` auto-add option, and custom spec-prefix aliases (`gh`, `--git-hosts`, `--jsr-registries`).
+- `LOCKFILE_VERSION` is still 1.
+
+### Re-triage
+- **#1542** (closed by #1555): verified fixed. A stray member lock under `packages/+(a|b)`, `@(a|b)`, `?(a)` and `*(a)` in `vlt.json` is refused in hosted (`redirect_workspace_lockfile_elsewhere`) and vendored (`vendor_lockfile_missing`) mode on vlt 1.3.8 and 1.4.0.
+- **#862**: `patch/rollback.rs` is unchanged since `fc5458e`, so I didn't re-run it.
+
+### Cells (Linux)
+- vlt 1.4.0 root project, two patchable deps, hosted / vendored / agent: scan → `vlt ci` patched, vex `not_affected`, re-run, rollback byte-exact, then `vlt ci` pristine. **pass**
+- vlt 1.4.0 agent copy-on-write across two projects sharing the global store, with `store-linker` auto / hardlink / copy / unpack / clone (clone falls back to unpack on Linux): the second project stays pristine, and rollback works. **pass**
+- vlt 1.4.0 `pnpm-workspace.yaml` workspace member: **fail #1564**. With a stray member lock, hosted and vendored both exit 0 and write the member lock; the root `vlt ci` then installs pristine (hosted) or fails "out of sync" (vendored), and vendored vex attests `not_affected`. With no member lock, hosted exits 0 pinning nothing instead of refusing as in #942. 2/2 each. Control: vlt 1.3.8 ignores `pnpm-workspace.yaml`, so it passes there.
+
+### Issues
+- Filed **#1564**.
+
+### False positives ruled out
+- The global store has `index.js` files with the patched bytes after hosted / vendored runs. Those are the patched tarballs vlt fetched for the pin, not an agent write leaking into the store (a sibling project stays pristine).
+
+### Next
+1. #1564 once it's fixed: also cover `package.json` `workspaces` taking precedence over `pnpm-workspace.yaml`, `!` patterns in the yaml, and a yaml with a BOM / CRLF / flow-style list.
+2. vlt 1.4.0 edge-removing graph modifiers × hosted / vendored scans (a target whose edge a modifier removes).
+3. vlt 1.4.0 custom spec-prefix aliases (`gh:` and user-defined prefixes) next to a patched registry dep.
+4. #862 once `patch/rollback.rs` changes.
+5. macOS `store-linker=clone` (agent copy-on-write through clonefile): needs a probe branch, which is still blocked.

state/vlt.md

@@ -1,6 +1,6 @@
 [agent] Progress ledger for the scheduled vlt bug-hunt routine (label pm:vlt).
 
-Last updated: 2026-10-14 (run 21), main `fc5458e` (run 20: `313d532`; run 19: `d4af25a`) (main was squashed on 2026-10-10, so older SHAs here no longer resolve), latest release 5.0.1 (5.0.0 before it; 4.0.0 has no vlt support). Newest vlt: 1.3.8 (2026-10-09). The run-20 mock is the run-19 mock plus `PEER=1` (left-pad peers on `peer-host` `1 || 2`; `peer-host` 1.0.0 / 1.5.0 / 2.0.0, intermediates `i1` → peer-host 1, `i2` → peer-host 2). The run-19 mock (`left-pad@1.3.0` + `right-pad@1.3.0`, both patchable, with a body filter; `NO_ALT=` enables `tar.br`) is attached in full to #1494, which makes it the easiest one to rebuild. Run 18 mock: two patchable packages (`left-pad@1.3.0`, `right-pad@1.0.0`), with `/patches/batch` and `/patches/package` filtered by body; `PEER=1` plus intermediates `i1` / `i2` (peer-host 1 / 2) force two `~peer.<hex>` instances. Run 17 mock adds `RP=/npm` (registry under a path prefix): start only the registry instance with it, because a prefixed patch server gives a false `redirect_unattributable`. Locally, run `vlt ci --allow-scripts :scripts` (otherwise vlt POSTs to api.socket.dev and the sandbox's 403 fails `ci` on 1.0.10 / 1.2.0; see #448). Run 9 mock adds `left-pad@1.2.0` (`'old'`) for bump tests. The run-11 mock adds a `time` map and `WDEP=` (wrapper's left-pad spec) for version-changing modifiers. The run-12 mock (rebuilt from the run-2 mock) adds `ADD=1` (the patch adds `lib/extra/deep/new.js`) and `EMPTYDIR=1` (the tarball ships empty dir entries), plus `CDN=1` and `bundler`. Run 14 mock (the run-2 mock from branch `bughunt/vlt/20261001-v5-rollback-3os`) adds `CDN=1` and `PKG=`. Run 15 adds `left-pad@1.2.0` to the run-2 mock and filters `/patches/batch` by request body (without that filter a bumped project shows a false `partial_failure`). The sandbox has no `ss`, so poll ports with `/dev/tcp`. Wait for ports 18555/18556 to free up before restarting the mock: a stale mock silently serves the previous mode. Kill mocks with `pkill -f '^node .*mock[.]mjs'`: a bare path pattern also kills the calling shell. The run-16 mock (the run-2 mock plus the batch filter) adds `FAIL_PKG=1` / `FAIL_ART=1`, `DELAY_PATH`+`DELAY_MS`, `bundler@1.0.0` and `PEER=1` (left-pad peers on `peer-host` `1 || 2`). Use `${NO_ALT-1}`, not `${NO_ALT:-1}`, or an empty `NO_ALT=` silently keeps `tar.br` off. To SIGINT a backgrounded run from a script, reset SIGINT to `SIG_DFL` first.
+Last updated: 2026-10-15 (run 22), main `7b6371c` (run 21: `fc5458e`; run 20: `313d532`) (main was squashed on 2026-10-10, so older SHAs here no longer resolve), latest release 5.0.1 (5.0.0 before it; 4.0.0 has no vlt support). Newest vlt: **1.4.0** (2026-10-14). It adds `pnpm-workspace.yaml` as a workspace source, `store-linker` clone / unpack and edge-removing graph modifiers; `LOCKFILE_VERSION` is still 1. The run-20 mock is the run-19 mock plus `PEER=1` (left-pad peers on `peer-host` `1 || 2`; `peer-host` 1.0.0 / 1.5.0 / 2.0.0, intermediates `i1` → peer-host 1, `i2` → peer-host 2). The run-19 mock (`left-pad@1.3.0` + `right-pad@1.3.0`, both patchable, with a body filter; `NO_ALT=` enables `tar.br`) is attached in full to #1494, which makes it the easiest one to rebuild. Run 18 mock: two patchable packages (`left-pad@1.3.0`, `right-pad@1.0.0`), with `/patches/batch` and `/patches/package` filtered by body; `PEER=1` plus intermediates `i1` / `i2` (peer-host 1 / 2) force two `~peer.<hex>` instances. Run 17 mock adds `RP=/npm` (registry under a path prefix): start only the registry instance with it, because a prefixed patch server gives a false `redirect_unattributable`. Locally, run `vlt ci --allow-scripts :scripts` (otherwise vlt POSTs to api.socket.dev and the sandbox's 403 fails `ci` on 1.0.10 / 1.2.0; see #448). Run 9 mock adds `left-pad@1.2.0` (`'old'`) for bump tests. The run-11 mock adds a `time` map and `WDEP=` (wrapper's left-pad spec) for version-changing modifiers. The run-12 mock (rebuilt from the run-2 mock) adds `ADD=1` (the patch adds `lib/extra/deep/new.js`) and `EMPTYDIR=1` (the tarball ships empty dir entries), plus `CDN=1` and `bundler`. Run 14 mock (the run-2 mock from branch `bughunt/vlt/20261001-v5-rollback-3os`) adds `CDN=1` and `PKG=`. Run 15 adds `left-pad@1.2.0` to the run-2 mock and filters `/patches/batch` by request body (without that filter a bumped project shows a false `partial_failure`). The sandbox has no `ss`, so poll ports with `/dev/tcp`. Wait for ports 18555/18556 to free up before restarting the mock: a stale mock silently serves the previous mode. Kill mocks with `pkill -f '^node .*mock[.]mjs'`: a bare path pattern also kills the calling shell. The run-16 mock (the run-2 mock plus the batch filter) adds `FAIL_PKG=1` / `FAIL_ART=1`, `DELAY_PATH`+`DELAY_MS`, `bundler@1.0.0` and `PEER=1` (left-pad peers on `peer-host` `1 || 2`). Use `${NO_ALT-1}`, not `${NO_ALT:-1}`, or an empty `NO_ALT=` silently keeps `tar.br` off. To SIGINT a backgrounded run from a script, reset SIGINT to `SIG_DFL` first.
 
 Method: real vlt installs (`scripts/install-vlt.sh`) against a local Node mock of the npm registry plus the patch API. It's a pure-JS tar writer, so it runs on every OS. The registry is on :18555 and the patch server on :18556 via `SOCKET_PATCH_SERVER_URL`; set `SOCKET_NPM_REGISTRY` to the registry for v5 rollback. The oracle is `require('left-pad')` printing `patched` / `pristine`. The 3-OS probe scripts are in the run-2 workflow (run 36803186961), the run-3 global-mode workflow (run 36834317384) and the run-4 bundled-copy workflow (run 36871535059, whose mock adds a `bundler@1.0.0` that bundles left-pad). Run 6 mock adds `PKG=` (scoped names) and `CDN=1` (non-conventional `dist.tarball`); the patch artifact leaf must be the unscoped basename. The mock's `/patches/batch` must answer only for purls in the request body, or `scan -g` shows false hits. CI already runs the capstones and the native backtest on 57 releases × 3 OS.
 
@@ -30,6 +30,7 @@ Method: real vlt installs (`scripts/install-vlt.sh`) against a local Node mock o
 | Linux | 1.2.0 / 1.3.7 / 1.3.8 | run 17 (main `1bd3da5`, v5 envelopes): run-2 matrix pass; rollback envelope incl. `rollback_failed` pass; `--dry-run` residue-free; DepID-special member dirs (`~ _ + % # ; ?`) pass; path-prefixed registry pass; `vlt update` drops the pin (documented), vex refuses | run-2 matrix, special dirs, prefixed registry, `vlt update` keeps `file:` pass; missing vendor ledger → `vendor_ledger_missing` | run-2 matrix pass; global store hardlink / auto / copy is copy-on-write (1.3.8); `apply --check` drift detection pass; #862 still repros | run 17 |
 | Linux | 1.2.0 / 1.3.8 | run 19 (main `d4af25a`): hosted pin beside a `file:` dir / tarball copy (root and member) warns, in-run VEX omits, standalone vex refuses: pass; #1437 with an alias pin and with a brotli pin: pass (#941 still restores gzip) | #1437 alias / brotli mixed state: pass | path-scoped `scan packages/a` with member alias (#1266): pass; **scan run from a member with an alias dep: fail #1494** (also pnpm 10.28); plain-name dep from a member: pass | run 19 |
 | Linux | 1.2.0 / 1.3.8 | run 20 (main `313d532`): #1494 fixed (agent alias from a member: scan / rollback / re-run / remove / vex, 2× each on 1.2.0 / 1.3.8); scoped alias `@sc/x` → `npm:left-pad` from the root: scan / ci / vex / re-run / rollback byte-exact pass (hosted, vendored, agent; 1.2.0 / 1.3.8), from a member: documented refusals; BOM `vlt.json`, CRLF `vlt.json`, BOM member `package.json`: pass (1.3.8); 2 `~peer.<hex>` instances shared with a workspace member: scan / vex / remove pass, takeover refused and pin kept | `file:` dir / tarball copy beside a registry copy (member and root, #1511 analog): refused `vendor_lock_entry_unsupported`; a `file:` copy added after vendoring: `vex` omits (`patched_ref_unattributable`) and `vendor --check` exits 1 (pass, 1.2.0 / 1.3.8); BOM / CRLF: pass; multi-peer + member: refused (documented) | scoped alias from root and member: pass; multi-peer + member: pass | run 20 |
+| Linux | 1.3.8 / 1.4.0 | run 22 (main `7b6371c`): 1.4.0 root matrix (2 deps, scan / ci / vex / re-run / rollback byte-exact) pass; #1542 fixed (extglob `+( )` `@( )` `?( )` `*( )` refuse, 1.3.8 / 1.4.0); **`pnpm-workspace.yaml` member (1.4.0): fail #1564** (stray lock written, exit 0; no lock: exit 0, pins nothing) | 1.4.0 root matrix pass; **`pnpm-workspace.yaml` member + stray lock: fail #1564** (false vex `not_affected`) | 1.4.0 root matrix pass; copy-on-write across projects with `store-linker` auto / hardlink / copy / unpack / clone pass | run 22, vlt 1.4.0 |
 | Linux | 1.2.0 / 1.3.8 | run 21 (main `fc5458e`): #1134 stray member lock × root glob syntax: `packages/*`, `{a,b}`, `**`, `[ab]`, object group refuse (pass); **extglob `+(a\|b)` / `@(a\|b)`: fail #1542** (exit 0, pin vlt ignores) | same matrix: plain globs pass; **extglob: fail #1542** (member `package.json` rewritten, root `vlt ci` out of sync, vex `not_affected`) | untested | run 21 |
 | Linux | 1.0.10 / 1.2.0 / 1.3.8 | run 18 (main `15c2c83`): #1437 vendored + hosted mixed state → bare `scan` / `get` `mode_ambiguous`, nothing written (1.0.10 / 1.2.0 / 1.3.8); mixed vex / list / remove / rollback pass; #1220 registry cap under `ulimit -n 64` (rollback / remove / takeover) pass; two transitive `~peer.<hex>` instances pass | multi-instance peers refused (documented), hosted pins kept; `--prune` after `vlt uninstall` reverts the entry (documented GC) | multi-instance peers pass | run 18 |
 | Linux | 0.0.0-18 / 0.0.0-20 / 1.0.0-rc.5 | rc.5 pass; 0.0.0-20 pins, but vlt ignores the lock (documented advisory) | 0.0.0-20 / rc.5 pass (legacy warning); A0 refused (documented) | untested | run 16, eras A0 / A |
@@ -53,16 +54,17 @@ Method: real vlt installs (`scripts/install-vlt.sh`) against a local Node mock o
 
 ## Backlog
 
-1. #1542 once it's fixed: every extglob form (`?( )`, `*( )`, `!( )`), the `!`-order case (`["!packages/a","packages/*"]`) and `package.json` workspaces.
-2. More vlt glob syntax: `..` segments, dot-dirs (`packages/.x`), case on case-insensitive filesystems.
-3. #862 once it's fixed (shipped empty dirs, nested new dirs, `remove`, macOS / Windows). `patch/rollback.rs` is still unchanged on `fc5458e`; rebuild the run-12 `ADD=1` / `EMPTYDIR=1` mock to re-run it.
-4. #1130's decision on #941 (brotli restore).
-5. `repair` from a member with an alias dep (needs a mock that serves diff archives; the current mock gives `download_failed`).
-6. Three distinct `~peer.<hex>` instances: vlt dedupes a member's peer-dependent package onto an existing instance even when the member pins a different peer version (see Known non-bugs). Try three intermediates (peer-host 1.0.0 / 1.5.0 / 2.0.0) with no root or member direct dep.
-7. The #521 residual (same-mirror `SOCKET_NPM_REGISTRY`, [comment](https://github.com/SocketDev/socket-patch/issues/521#issuecomment-6039419242)): re-check after the next restore change.
-8. vlt 1.3.6 … 1.3.8 on macOS / Windows (probe branches are blocked). `vlt-compatibility.yml` is `disabled_manually` since 2026-10-09, so CI covers no vlt macOS / Windows legs either; re-check its `native` legs once a maintainer re-enables it.
-9. #434 (closed by #442): Windows with the default prefix, and the rest of the **maintainer `-g` request** (20261001T040000Z).
-10. Probe branches are blocked: branch deletion is denied, and 3 old `bughunt/vlt/*` branches still need a maintainer to delete them. The run-2 mock lives in `bughunt/vlt/20261001-v5-rollback-3os`.
+1. #1564 once it's fixed: also cover `package.json` `workspaces` taking precedence over `pnpm-workspace.yaml`, `!` patterns in the yaml, BOM / CRLF / flow-style yaml, and an older vlt with a 1.4-written lock.
+2. vlt 1.4.0 edge-removing graph modifiers × hosted / vendored (a target whose edge a modifier removes; `vlt install <x>` then refuses "removed by a graph modifier").
+3. vlt 1.4.0 custom spec-prefix aliases (`gh:`, user-defined prefixes, `--jsr-registries`) next to a patched registry dep.
+4. #1542 follow-ups: `!( )` extglob, and the `!`-order case on 1.4.0.
+5. More vlt glob syntax: `..` segments, dot-dirs (`packages/.x`), case on case-insensitive filesystems.
+6. #862 once it's fixed (rebuild the run-12 `ADD=1` / `EMPTYDIR=1` mock). `patch/rollback.rs` is unchanged on `7b6371c`.
+7. #1130's decision on #941 (brotli restore).
+8. `repair` from a member with an alias dep (needs a mock that serves diff archives).
+9. macOS `store-linker=clone` (vlt 1.4 default with Node ≥ 26.1) and Windows `unpack`: agent copy-on-write. Probe branches are blocked; `vlt-compatibility.yml` is `disabled_manually`.
+10. #434 (closed by #442): Windows default prefix, and the rest of the maintainer `-g` request (20261001T040000Z).
+11. Probe branches are blocked: branch deletion is denied, and 3 old `bughunt/vlt/*` branches still need a maintainer to delete them.
 
 ## Known non-bugs
 
@@ -120,3 +122,5 @@ Method: real vlt installs (`scripts/install-vlt.sh`) against a local Node mock o
 - `vendor --check` on a vendored project that later gained a `file:` copy of the same name@version says "wiring missing: no lockfile or config references …" although the lock still references the vendored dir. The exit code (1) and VEX omission are right; only the wording is imprecise.
 - vlt's workspace globs (1.3.8): a `!` pattern excludes regardless of its position, but a later literal path re-includes; `"packages"` lists nothing. A directory excluded by `!` isn't its own project (`vlt install` there installs the root), so socket-patch refusing from it is fail-closed.
 - vlt 1.2.0 ignores `package.json` `workspaces` with extglobs when `vlt.json` exists without `workspaces` (the member gets no edge), so a vendored write to that directory's own lock isn't the #1542 bug.
+- vlt's global store holding patched `index.js` bytes after a hosted / vendored run: those are the patched tarballs fetched for the pin, not an agent-mode leak.
+- `docs/testing/vlt-compatibility.md` not listing vlt 1.4.0 yet (released 2026-10-14) is docs lag, like the canary note above.