npm: run 42 ledger (#1554)

Author: claude

entries/npm/20261015T001857Z.md

@@ -0,0 +1,26 @@
+[agent] 2026-10-15: npm bug-hunt run
+
+Run 42. Tested main `e719a9b` (the latest published release is v5.0.1). Linux only, with npm 8.19.4 / 10.9.4 / 12.2.0 on Node 22.22. Real npm installs and a wiremock patch API (a scratch e2e built on `tests/scan/scan_nested_project_e2e.rs`, with `mount_view_from_source` over the real installed bytes).
+
+**Filed**
+- #1554: a root `scan --mode vendored` still exits 1 (`partialFailure`, `vendor_lock_entry_not_found`) on every run, and writes no in-run VEX, when a nested npm project has **no lockfile** (`.npmrc package-lock=false` or `npm install --no-package-lock`). The #1534 fix (#1543) only recognises nested projects that have their own lock (`governing_root.rs:487`). Hosted only warns and exits 0. Reproduces on npm 8.19.4, 10.9.4 and 12.2.0, ×2 runs each plus `--vex`.
+
+**Re-triage**
+- #1534 (closed by #1543): verified fixed with real npm 10.9.4. A nested project with its own `package-lock.json`, or with only an `npm-shrinkwrap.json`, gets `nested_project_skipped`, exit 0, and the VEX is written.
+- #1072: still open. The `vendor_orphan_still_wired` text at `vendor.rs:4410` still says "run `socket-patch repair` to re-adopt", and repair (`vendored_backend/repair.rs:194`) still refuses. Checked from the source only this run; no comment posted.
+
+**Cells**
+- pass: vendored root scan, nested project with a lock (10.9.4)
+- pass: vendored root scan, nested project with only a shrinkwrap (10.9.4)
+- pass: hosted root scan, lockless nested project (8.19.4 / 10.9.4 / 12.2.0)
+- fail #1554: vendored root scan, lockless nested project, both shapes (8.19.4 / 10.9.4 / 12.2.0)
+- blocked: macOS / Windows (probe branches still blocked)
+
+**False positives ruled out:** none.
+
+**Next**
+1. Re-check #1554 and #1072 on the next main.
+2. #1534 siblings: a nested project inside an `ignorePaths`-excluded dir, a nested project under a workspace member, and `scan . tools/x` with a lockless `tools/x` (expected: a loud refusal for that leg only).
+3. Hosted `nested_project_skipped` over a nested project that has a lock (check the warning parity).
+4. npm 12 `npm patch rm` lock downgrade vs the vendored refusal text.
+5. #1440 follow-ups.

state/npm.md

@@ -1,6 +1,6 @@
 [agent] Progress ledger for the scheduled npm bug-hunt routine (label pm:npm).
 
-Last updated: 2026-10-14T12Z (run 41), main `37c8918` (v5.0.1 `latest`). Run 41 filed **#1534**: a root `scan --mode vendored` exits 1 (`partialFailure`, `vendor_lock_entry_not_found`) on every run and omits its in-run VEX when a nested independent npm project installs a patched package the root lock lacks; hosted only warns (Bun handover; npm 8.19.4 / 10.9.4 / 12.2.0, v5.0.1 too). Closed as fixed: #1232 (by #1513). Verified fixed: #1511 (#1513). Open and still reproducing: #1534, #1072. **Every other issue number marked `fail` in the matrix below is closed** (#356, #403, #433, #434, #464, #554, #588, #659, #665, #687, #688, #711, #725, #732, #753, #798, #812, #828, #852, #879, #899, #1097, #1155, #1196, #1232, #1233, #1266, #1481, #1511); those marks are historical. Probe branches remain blocked (`git push --delete` refused).
+Last updated: 2026-10-15T00Z (run 42), main `e719a9b` (v5.0.1 `latest`). Run 42 filed **#1554**: a root `scan --mode vendored` still exits 1 (`vendor_lock_entry_not_found`) and drops its in-run VEX when a nested npm project has no lockfile (`package-lock=false`). The #1534 fix only covers nested projects that have their own lock (npm 8.19.4 / 10.9.4 / 12.2.0). Verified fixed: #1534 (#1543, with real npm: lock and shrinkwrap-only nested projects). Open: #1554, #1072. **Every other issue number marked `fail` in the matrix below is closed** (#356, #403, #433, #434, #464, #554, #588, #659, #665, #687, #688, #711, #725, #732, #753, #798, #812, #828, #852, #879, #899, #1097, #1155, #1196, #1232, #1233, #1266, #1481, #1511, #1534); those marks are historical. Probe branches remain blocked (`git push --delete` refused).
 ## Coverage matrix
 
 Cells are "pass", "fail #N" or "untested". Every cell uses a real npm install. Hosted cells use a local mock of the patch API with `--patch-server-url` pointed at it. Agent and vendored cells use the same mock or a hand-staged `.socket/`. "Cycle" means scan → fresh `npm ci` → `vex` → `rollback` byte-exact. "Suites" means `e2e_redirect_npm_build` + `e2e_vendor_npm_build` with `SOCKET_PATCH_NPM_E2E_REQUIRED=1`.
@@ -11,7 +11,7 @@ Cells are "pass", "fail #N" or "untested". Every cell uses a real npm install. H
 | Linux | 7.0.15 / 7.24.2 | pass: scan/apply, vex, `npm ci` → vex refuses, re-apply, rollback | pass: cycle + `--omit=dev`, workspaces, vendored↔hosted takeover, revert byte-exact | pass: cycle (alias, nested, dev), workspaces, takeovers. fail **#753** (copy nested under a `hasShrinkwrap` dep installs unpatched) | pass: all four (7.24.2, custom prefix) |
 | Linux | 8.19.4 | fail #356 (v4). #403 / #516 closed by fixes | fixed #432 (see #879), **#588** (same-lock unwired copy), **#665**, **#688**. pass: alias takeover, cycle + `--omit=dev`, workspaces, takeovers, rescan no-op | pass: `peer: true` lock-entry cycle, nested v2 cycle, shrinkwrap-only, workspaces, takeovers, rescan no-op, `overrides` (flat, alias, nested). fixed #432 (alias mirror, npm 6 consumer), #490 (override over a git spec; closed by #491, not re-checked), **#588** (`--no-verify`), **#753** (`hasShrinkwrap` nested copy) | pass: all four (custom prefix) |
 | Linux | 9.2.0 / 9.9.4 | pass: 9.2.0 `install-links=true` `file:` dir dep cycle; `-g` (v4); Node 18 cycle | pass: 9.2.0 `install-links` `file:` dep cycle, cycle + `--omit=dev` (main), Node 18 cycle | pass: 9.2.0 `install-links` `file:` dep cycle, cycle (alias, nested, dev), Node 18 cycle. fail **#753** | pass (v4) |
-| Linux | 10.9.9 | pass: plain cycle (alias still #356) | fail **#1534** (root `scan --mode vendored` exit 1 forever + no in-run VEX over a nested independent project's patched package; 8.19.4 / 10.9.4 / 12.2.0). fixed #1511 (run 41: member `file:` dir copy refuses; scoped and dual-lock variants refuse too). Historical: fail **#1511** (`scan --mode vendored --vex` / `vex` attest beside a member's `file:` directory copy, nested; 10.9.4 / 11.6.2 / 12.2.0). pass: member `file:` tarball / URL copy and `overrides`-forced `file:` tarball refuse (run 40), cycle, `overrides` + `file:` dependent. fail **#1155** (10.9.4 / 8.19.4 / 12.2.0: an npm upgrade or downgrade of a vendored package is drift-kept forever; also when the new version has its own patch) | fixed #1481 (run 40: `file:` tarball / directory / URL member copies refuse; `overrides`-forced `file:` tarball refuses). pass: cycle, `overrides`, shrinkwrapped `file:` tarball dep; `--max-new-patches 0` on fully pinned plain / v1 / alias / nested / dual lock (ALREADY). fixed #1195 (#1211; cap 0 and cap 1 with an unpinned twin pass on `9ab72d4`), pass: #1034 targets (`once` vs `@tootallnate/once`, versionless / encoded purls, alias-installed name), interrupted vendored → hosted takeover (converges; artifact dir orphaned = #1157 wontfix), global npmrc `replace-registry-host`, quoted / commented `.npmrc` values, **#1196** (CRLF `.npmrc` without a final newline) | pass (10.9.4, run 38): `--global-prefix` report-only scan, `scan --mode agent`, `rollback` |
+| Linux | 10.9.9 | pass: plain cycle (alias still #356) | fail **#1554** (run 42: as #1534, but the nested project has no lockfile, via `package-lock=false` / `--no-package-lock`; 8.19.4 / 10.9.4 / 12.2.0). fixed #1534 (#1543, run 42: a nested project with a lock or a shrinkwrap gets `nested_project_skipped`, exit 0, and the VEX is written). fixed #1511 (run 41: member `file:` dir copy refuses; scoped and dual-lock variants refuse too). Historical: fail **#1511** (`scan --mode vendored --vex` / `vex` attest beside a member's `file:` directory copy, nested; 10.9.4 / 11.6.2 / 12.2.0). pass: member `file:` tarball / URL copy and `overrides`-forced `file:` tarball refuse (run 40), cycle, `overrides` + `file:` dependent. fail **#1155** (10.9.4 / 8.19.4 / 12.2.0: an npm upgrade or downgrade of a vendored package is drift-kept forever; also when the new version has its own patch) | fixed #1481 (run 40: `file:` tarball / directory / URL member copies refuse; `overrides`-forced `file:` tarball refuses). pass: cycle, `overrides`, shrinkwrapped `file:` tarball dep; `--max-new-patches 0` on fully pinned plain / v1 / alias / nested / dual lock (ALREADY). fixed #1195 (#1211; cap 0 and cap 1 with an unpinned twin pass on `9ab72d4`), pass: #1034 targets (`once` vs `@tootallnate/once`, versionless / encoded purls, alias-installed name), interrupted vendored → hosted takeover (converges; artifact dir orphaned = #1157 wontfix), global npmrc `replace-registry-host`, quoted / commented `.npmrc` values, **#1196** (CRLF `.npmrc` without a final newline) | pass (10.9.4, run 38): `--global-prefix` report-only scan, `scan --mode agent`, `rollback` |
 | Linux | 10.8.2 (Node 18) / 10.9.x | fixed #1266 (run 40: linked member alias link patched by `scan --mode agent packages/a`, reverted by `rollback packages/a`). fail **#732** (human `scan --mode agent` / `--sync` after `npm ci`: exit 0, unpatched; `--json` re-applies). pass: Node 18 cycle. fail **#554** (re-checked on `203e092`), **#356** (re-checked on `203e092`; alias-only scan now exits 0). pass: agent vex refuses a reverted nested copy (#516 fixed), bundled copy (both copies patched + vex) | fail **#753** (`hasShrinkwrap` nested copy: `vex` exit 0 not_affected, `vendor --check` passes, npm installs unpatched; 8.19.4 too). pass: CRLF / BOM / tab layout cycle (#324 fixed), `--omit=dev`, agent↔vendored takeovers, rescan after a version bump (#541 fixed), hosted→vendored takeover over a dual lock and an alias. fail **#588** (same-lock unwired copy), **#665** (`npm uninstall` of a vendored dep: rollback exit 1 forever), **#688** (`file:` dir named like the package: refused; the takeover keeps the hosted pin since #963), **#687** (a failed eject rewrites every root file), #798 fixed by #799 (stale twin: `vex` now refuses, 18Z), #725 (`vendor --check` ignores wiring). pass: `peer: true` lock entry. fail **#828** (hosted→vendored takeover over a pin with a bundled copy alongside: restore skipped, ledger records the hosted URL, `.npmrc` kept, revert lands on hosted; 8.19.4 / 12.2.0 too) | fail **#828** (`rollback` / `remove` refuse a pin with a bundled copy alongside, and the remedy loops; 8.19.4 / 12.2.0 too). pass: `peer: true` and `devOptional` lock entries (`--omit=peer/dev/optional`), cycles (plain, alias, nested), `file:` dependency's own dependency (`install-links` true / false), self-referential `file:.` link, rollback → in-place `npm install` / `npm ci` restores upstream, `npm ci --omit=dev` + vex, shrinkwrapped `file:` dep, `JSONStream`, agent↔hosted takeovers, stale tree, lockfile-only, dry-run, rescan no-op, nested project (loud), `registry=` mirror, `.npmrc` variants, `overrides` (incl. `$ref`, nested object), policy (`--package`, `maxNewPatches`, `ignorePackages`, `minSeverity`), CRLF / BOM / tab / no-newline layout cycle. fixed #798 (stale twin), #325 (in-run `--vex` only, reopened), **#588** (`--no-verify` only; default `vex` refuses), **#753** (`hasShrinkwrap` nested copy: `npm ci` unpatched, lockfile-only `vex` attests) | pass: all four, `--global-prefix`, `SOCKET_GLOBAL`, `--mode hosted` refused. fail #464 (report-only hint has no `-g`) |
 | Linux | 11.20 / 11.21 / 11.6.2 | pass (v4); linked `.store` scoped transitive (11.21, #359 fixed). fail #403 (v4) | pass (v4). #490 (11.21; closed by #491, not re-checked). fail **#753** (11.6.2: `vex` attests a `hasShrinkwrap` nested copy npm installs unpatched) | pass: scoped, duplicate nested workspace copies, dual-lock drift, `omit-lockfile-registry-resolved`, `overrides`, `install-strategy=linked/nested/shallow`. fail **#753** (11.6.2) | pass: all four (11.6.2, custom prefix) |
 | Linux | 12.1 / 12.2.0 | fail **#1266** (12.2.0). pass: hosted alias cycle, linked workspace vendored cycle (`a80b89e`). fail #356, **#554** (12.2.0), **#732** (12.2.0). `npm patch` user patch overwritten (documented non-strict fallback; see #711) | fail **#588** (12.2.0), **#665**, **#688** (12.2.0 / Node 24). pass: hosted→vendored takeover + rollback, `--omit=dev`, workspaces, `remove` in a workspace, Node 26, `repair`, BOM+CRLF / tab cycle (12.2.0), `install-strategy=linked`, `overrides`. fail **#711** (lockfileVersion 4 refused with wrong advice), **#659** (takeover over a v4 lock un-hosts, then refuses) | fail **#1511** (vendored `file:` directory member copy, nested, 12.2.0). Fixed #1481. fail **#588** (`--no-verify`, 12.2.0). Fixed: #798 (stale package-lock twin; `vex` refuses since #799). pass: `peer: true` lock entry, `install-strategy=linked`, Node 26, `remove` in a workspace, `allow-remote=all` from env / user config still persisted, BOM+CRLF / tab cycle (12.2.0), workspace + alias cycle, dual-lock, drift, `npm install <pkg>` keeps the pin, path-scoped rollback, remove, `registry=` mirror, CRLF / spaced `.npmrc`, `min-release-age`, `strict-npmrc`, `hasShrinkwrap` nested copy (#753 doesn't apply on npm 12), lockfileVersion 4 + non-overlapping `npm patch`: cycle, `rollback` / `remove` byte-exact, `repair` no-op (12.2.0). fail #433, **#711** (`patchedDependencies` / lockfileVersion 4: exit 0, then EPATCHFAILED or `vex` hash_mismatch; 12.1.0 + 12.2.0) | pass: all four |
@@ -21,6 +21,11 @@ Cells are "pass", "fail #N" or "untested". Every cell uses a real npm install. H
 | Windows | 12.1.0 / 12.2.0 | pass: linked `.store` apply/vex/rollback (main). fail #356, #403 (v4) | pass: cycle + `--omit=dev`, revert (main) | pass: cycle, linked cycle (probe) | **fail #434** |
 | Windows 2022 | 10.9.7 / 12.2.0 | pass: linked `.store` apply/vex/rollback (main) | pass: cycle + `--omit=dev`, revert (main) | pass: linked cycle (probe) | **fail #434** |
 
+## Run 42 (2026-10-15T00Z, main `e719a9b`)
+
+- Filed #1554. A nested npm project with no lockfile (`.npmrc package-lock=false` or `--no-package-lock`) still makes a root `scan --mode vendored` fail `vendor_lock_entry_not_found` (exit 1 every run, no in-run VEX). Hosted only warns. npm 8.19.4 / 10.9.4 / 12.2.0. Cause: `nested_npm_project` requires the nested directory to have its own lock (`governing_root.rs:487`).
+- Verified #1534 fixed (#1543) with real npm 10.9.4: lock and shrinkwrap-only nested projects pass. #1072 is unchanged: the remedy text at `vendor.rs:4410` is still there.
+
 ## Run 41 (2026-10-14T12Z, main `37c8918`)
 
 - Filed #1534 (Bun handover): root `scan --mode vendored` crawls a nested independent project's `node_modules` and fails `vendor_lock_entry_not_found` on its package → `partialFailure` exit 1 on every run, in-run `--vex` omitted, `scan . tools/x` also red; hosted skips with a warning. npm 8.19.4 / 10.9.4 ×3 / 12.2.0, v5.0.1.
@@ -190,6 +195,7 @@ The same `name@version` gets a new patch UUID with different bytes. Mock: left-p
 
 ## Backlog
 
+- **New 2026-10-15T00Z:** re-check #1554 / #1072 on the next main; #1534 siblings (a nested project inside an `ignorePaths`-excluded dir or under a workspace member, `scan . tools/x` with a lockless `tools/x`); hosted `nested_project_skipped` parity; npm 12 `npm patch rm` lock downgrade vs vendored refusal text; #1440 follow-ups.
 - **New 2026-10-14T12Z:** re-check #1534 / #1072 on the next main; #1534 siblings (an `ignorePaths`-excluded nested project, a nested project with no lock, a workspace member with a stray own lock under vendored); #1440 follow-ups; npm 12 `npm patch rm` lock downgrade vs vendored refusal text.
 - **New 2026-10-14T00Z:** re-check #1511 / #1232 / #1072 on the next main; #1511 siblings (a scoped `file:` dir copy, a dual lock carrying the link, agent mode with a `file:` dir copy); #1440 follow-ups (still open).
 - **New 2026-10-13T12Z:** re-check #1481 / #1266 (PR #1470) on the next main; #1481 siblings (a git or URL dependency of the same `name@version` under `install-strategy=nested|linked`, an `overrides`-forced `file:` copy, `scan --mode vendored --vex` over the same shapes).