vlt: run 21 ledger (#1542)

Author: claude

entries/vlt/20261014T172011Z.md

@@ -0,0 +1,24 @@
+[agent] 2026-10-14: vlt bug-hunt run
+
+**Tested:** main `fc5458e` (release **5.0.1**). main was force-updated again, so the run-20 SHA `313d532` is now an ancestor reached through 13 new commits. None of them touch vlt code: they change Bun / pnpm / gem / uv / PyPI files and `vex/product.rs` for pyproject. Linux sandbox, Node 22.22.0, vlt 1.2.0 / 1.3.8 (1.3.8 is still the newest vlt). Mock: the run-19 mock attached to #1494, unchanged.
+
+### Re-triage
+- **#862**: `patch/rollback.rs` is unchanged since `313d532`, so I didn't re-run it.
+
+### Cells (Linux)
+- **vlt's workspace-glob dialect, probed with real `vlt install`** (1.3.8): vlt lists members for `packages/{a,b}`, `packages/**`, `packages/[ab]`, `packages/?`, `packages/+(a|b)`, `packages/@(a|b)`, `./packages/b`, `packages/b/` and `packages/b/**`. A `!` pattern excludes regardless of order (`["!packages/a","packages/*"]` drops `a`), but a later literal path re-includes (`["packages/*","!packages/b","packages/b"]` keeps `b`). `"packages"` lists nothing.
+- **#1134 shape (stray member `vlt-lock.json`) × glob syntax:** `packages/*`, `{a,b}`, `**`, `[ab]` and an object group refuse in both hosted and vendored, and write nothing: **pass** (1.2.0 / 1.3.8). Extglob `+(a|b)` / `@(a|b)`: **fail #1542**. Hosted and vendored both exit 0 and write the member's lock or `package.json`; `vlt ci` then installs pristine (vendored: `vlt ci` fails "out of sync"); vendored `vex` attests `not_affected` (1.2.0 / 1.3.8, `vlt.json` and `package.json` workspaces).
+- **Excluded-by-`!` directory** (`["!packages/a","packages/*"]`): `vlt install` run inside `packages/a` installs the root project, so `a` is never its own project. socket-patch counts `a` as a member (last-match-wins) and refuses, which is fail-closed. I noted it in #1542 as a dialect mismatch, not a separate bug.
+
+### Issues
+- Filed **#1542**: an extglob in vlt `workspaces` bypasses the #1134 / #1161 member stray-lock refusal, and vendored VEX attests `not_affected`.
+
+### False positives ruled out
+- vlt 1.2.0 doesn't list `packages/+(a|b)` from `package.json` `workspaces` when `vlt.json` exists without `workspaces`, so `a` isn't a member there and vendoring its lock isn't wrong. I left that cell out of #1542.
+
+### Next
+1. #1542 once it's fixed: re-run with every extglob form (`?( )`, `*( )`, `!( )`) and the `!`-order case.
+2. #862 once `patch/rollback.rs` changes (rebuild the run-12 `ADD=1` / `EMPTYDIR=1` mock).
+3. Other glob syntax vlt may read differently: `..` segments, dot-dirs (`packages/.x`), case on case-insensitive filesystems, and trailing `/**` on the member itself.
+4. `repair` from a member with an alias (needs diff archives in the mock).
+5. macOS / Windows for 1.3.6 … 1.3.8 once probe branches or `vlt-compatibility.yml` are available again.

state/vlt.md

@@ -1,6 +1,6 @@
 [agent] Progress ledger for the scheduled vlt bug-hunt routine (label pm:vlt).
 
-Last updated: 2026-10-14 (run 20), main `313d532` (run 19: `d4af25a`) (main was squashed on 2026-10-10, so older SHAs here no longer resolve), latest release 5.0.1 (5.0.0 before it; 4.0.0 has no vlt support). Newest vlt: 1.3.8 (2026-10-09). The run-20 mock is the run-19 mock plus `PEER=1` (left-pad peers on `peer-host` `1 || 2`; `peer-host` 1.0.0 / 1.5.0 / 2.0.0, intermediates `i1` → peer-host 1, `i2` → peer-host 2). The run-19 mock (`left-pad@1.3.0` + `right-pad@1.3.0`, both patchable, with a body filter; `NO_ALT=` enables `tar.br`) is attached in full to #1494, which makes it the easiest one to rebuild. Run 18 mock: two patchable packages (`left-pad@1.3.0`, `right-pad@1.0.0`), with `/patches/batch` and `/patches/package` filtered by body; `PEER=1` plus intermediates `i1` / `i2` (peer-host 1 / 2) force two `~peer.<hex>` instances. Run 17 mock adds `RP=/npm` (registry under a path prefix): start only the registry instance with it, because a prefixed patch server gives a false `redirect_unattributable`. Locally, run `vlt ci --allow-scripts :scripts` (otherwise vlt POSTs to api.socket.dev and the sandbox's 403 fails `ci` on 1.0.10 / 1.2.0; see #448). Run 9 mock adds `left-pad@1.2.0` (`'old'`) for bump tests. The run-11 mock adds a `time` map and `WDEP=` (wrapper's left-pad spec) for version-changing modifiers. The run-12 mock (rebuilt from the run-2 mock) adds `ADD=1` (the patch adds `lib/extra/deep/new.js`) and `EMPTYDIR=1` (the tarball ships empty dir entries), plus `CDN=1` and `bundler`. Run 14 mock (the run-2 mock from branch `bughunt/vlt/20261001-v5-rollback-3os`) adds `CDN=1` and `PKG=`. Run 15 adds `left-pad@1.2.0` to the run-2 mock and filters `/patches/batch` by request body (without that filter a bumped project shows a false `partial_failure`). The sandbox has no `ss`, so poll ports with `/dev/tcp`. Wait for ports 18555/18556 to free up before restarting the mock: a stale mock silently serves the previous mode. Kill mocks with `pkill -f '^node .*mock[.]mjs'`: a bare path pattern also kills the calling shell. The run-16 mock (the run-2 mock plus the batch filter) adds `FAIL_PKG=1` / `FAIL_ART=1`, `DELAY_PATH`+`DELAY_MS`, `bundler@1.0.0` and `PEER=1` (left-pad peers on `peer-host` `1 || 2`). Use `${NO_ALT-1}`, not `${NO_ALT:-1}`, or an empty `NO_ALT=` silently keeps `tar.br` off. To SIGINT a backgrounded run from a script, reset SIGINT to `SIG_DFL` first.
+Last updated: 2026-10-14 (run 21), main `fc5458e` (run 20: `313d532`; run 19: `d4af25a`) (main was squashed on 2026-10-10, so older SHAs here no longer resolve), latest release 5.0.1 (5.0.0 before it; 4.0.0 has no vlt support). Newest vlt: 1.3.8 (2026-10-09). The run-20 mock is the run-19 mock plus `PEER=1` (left-pad peers on `peer-host` `1 || 2`; `peer-host` 1.0.0 / 1.5.0 / 2.0.0, intermediates `i1` → peer-host 1, `i2` → peer-host 2). The run-19 mock (`left-pad@1.3.0` + `right-pad@1.3.0`, both patchable, with a body filter; `NO_ALT=` enables `tar.br`) is attached in full to #1494, which makes it the easiest one to rebuild. Run 18 mock: two patchable packages (`left-pad@1.3.0`, `right-pad@1.0.0`), with `/patches/batch` and `/patches/package` filtered by body; `PEER=1` plus intermediates `i1` / `i2` (peer-host 1 / 2) force two `~peer.<hex>` instances. Run 17 mock adds `RP=/npm` (registry under a path prefix): start only the registry instance with it, because a prefixed patch server gives a false `redirect_unattributable`. Locally, run `vlt ci --allow-scripts :scripts` (otherwise vlt POSTs to api.socket.dev and the sandbox's 403 fails `ci` on 1.0.10 / 1.2.0; see #448). Run 9 mock adds `left-pad@1.2.0` (`'old'`) for bump tests. The run-11 mock adds a `time` map and `WDEP=` (wrapper's left-pad spec) for version-changing modifiers. The run-12 mock (rebuilt from the run-2 mock) adds `ADD=1` (the patch adds `lib/extra/deep/new.js`) and `EMPTYDIR=1` (the tarball ships empty dir entries), plus `CDN=1` and `bundler`. Run 14 mock (the run-2 mock from branch `bughunt/vlt/20261001-v5-rollback-3os`) adds `CDN=1` and `PKG=`. Run 15 adds `left-pad@1.2.0` to the run-2 mock and filters `/patches/batch` by request body (without that filter a bumped project shows a false `partial_failure`). The sandbox has no `ss`, so poll ports with `/dev/tcp`. Wait for ports 18555/18556 to free up before restarting the mock: a stale mock silently serves the previous mode. Kill mocks with `pkill -f '^node .*mock[.]mjs'`: a bare path pattern also kills the calling shell. The run-16 mock (the run-2 mock plus the batch filter) adds `FAIL_PKG=1` / `FAIL_ART=1`, `DELAY_PATH`+`DELAY_MS`, `bundler@1.0.0` and `PEER=1` (left-pad peers on `peer-host` `1 || 2`). Use `${NO_ALT-1}`, not `${NO_ALT:-1}`, or an empty `NO_ALT=` silently keeps `tar.br` off. To SIGINT a backgrounded run from a script, reset SIGINT to `SIG_DFL` first.
 
 Method: real vlt installs (`scripts/install-vlt.sh`) against a local Node mock of the npm registry plus the patch API. It's a pure-JS tar writer, so it runs on every OS. The registry is on :18555 and the patch server on :18556 via `SOCKET_PATCH_SERVER_URL`; set `SOCKET_NPM_REGISTRY` to the registry for v5 rollback. The oracle is `require('left-pad')` printing `patched` / `pristine`. The 3-OS probe scripts are in the run-2 workflow (run 36803186961), the run-3 global-mode workflow (run 36834317384) and the run-4 bundled-copy workflow (run 36871535059, whose mock adds a `bundler@1.0.0` that bundles left-pad). Run 6 mock adds `PKG=` (scoped names) and `CDN=1` (non-conventional `dist.tarball`); the patch artifact leaf must be the unscoped basename. The mock's `/patches/batch` must answer only for purls in the request body, or `scan -g` shows false hits. CI already runs the capstones and the native backtest on 57 releases × 3 OS.
 
@@ -30,6 +30,7 @@ Method: real vlt installs (`scripts/install-vlt.sh`) against a local Node mock o
 | Linux | 1.2.0 / 1.3.7 / 1.3.8 | run 17 (main `1bd3da5`, v5 envelopes): run-2 matrix pass; rollback envelope incl. `rollback_failed` pass; `--dry-run` residue-free; DepID-special member dirs (`~ _ + % # ; ?`) pass; path-prefixed registry pass; `vlt update` drops the pin (documented), vex refuses | run-2 matrix, special dirs, prefixed registry, `vlt update` keeps `file:` pass; missing vendor ledger → `vendor_ledger_missing` | run-2 matrix pass; global store hardlink / auto / copy is copy-on-write (1.3.8); `apply --check` drift detection pass; #862 still repros | run 17 |
 | Linux | 1.2.0 / 1.3.8 | run 19 (main `d4af25a`): hosted pin beside a `file:` dir / tarball copy (root and member) warns, in-run VEX omits, standalone vex refuses: pass; #1437 with an alias pin and with a brotli pin: pass (#941 still restores gzip) | #1437 alias / brotli mixed state: pass | path-scoped `scan packages/a` with member alias (#1266): pass; **scan run from a member with an alias dep: fail #1494** (also pnpm 10.28); plain-name dep from a member: pass | run 19 |
 | Linux | 1.2.0 / 1.3.8 | run 20 (main `313d532`): #1494 fixed (agent alias from a member: scan / rollback / re-run / remove / vex, 2× each on 1.2.0 / 1.3.8); scoped alias `@sc/x` → `npm:left-pad` from the root: scan / ci / vex / re-run / rollback byte-exact pass (hosted, vendored, agent; 1.2.0 / 1.3.8), from a member: documented refusals; BOM `vlt.json`, CRLF `vlt.json`, BOM member `package.json`: pass (1.3.8); 2 `~peer.<hex>` instances shared with a workspace member: scan / vex / remove pass, takeover refused and pin kept | `file:` dir / tarball copy beside a registry copy (member and root, #1511 analog): refused `vendor_lock_entry_unsupported`; a `file:` copy added after vendoring: `vex` omits (`patched_ref_unattributable`) and `vendor --check` exits 1 (pass, 1.2.0 / 1.3.8); BOM / CRLF: pass; multi-peer + member: refused (documented) | scoped alias from root and member: pass; multi-peer + member: pass | run 20 |
+| Linux | 1.2.0 / 1.3.8 | run 21 (main `fc5458e`): #1134 stray member lock × root glob syntax: `packages/*`, `{a,b}`, `**`, `[ab]`, object group refuse (pass); **extglob `+(a\|b)` / `@(a\|b)`: fail #1542** (exit 0, pin vlt ignores) | same matrix: plain globs pass; **extglob: fail #1542** (member `package.json` rewritten, root `vlt ci` out of sync, vex `not_affected`) | untested | run 21 |
 | Linux | 1.0.10 / 1.2.0 / 1.3.8 | run 18 (main `15c2c83`): #1437 vendored + hosted mixed state → bare `scan` / `get` `mode_ambiguous`, nothing written (1.0.10 / 1.2.0 / 1.3.8); mixed vex / list / remove / rollback pass; #1220 registry cap under `ulimit -n 64` (rollback / remove / takeover) pass; two transitive `~peer.<hex>` instances pass | multi-instance peers refused (documented), hosted pins kept; `--prune` after `vlt uninstall` reverts the entry (documented GC) | multi-instance peers pass | run 18 |
 | Linux | 0.0.0-18 / 0.0.0-20 / 1.0.0-rc.5 | rc.5 pass; 0.0.0-20 pins, but vlt ignores the lock (documented advisory) | 0.0.0-20 / rc.5 pass (legacy warning); A0 refused (documented) | untested | run 16, eras A0 / A |
 | Linux | 1.3.7 | run-2 matrix: pass (run 13); brotli (`tar.br`) scan / warm + cold install / frozen / vex / mixed lock / dev node: pass (#372 fixed); brotli rollback / remove / takeover: **fail #941**; scan / `get` from a `vlt.json` workspace member: **fail #942** (also 1.2.0) | run-2 matrix, brotli: pass; rollback byte-exact | brotli lock: pass | new release |
@@ -52,14 +53,16 @@ Method: real vlt installs (`scripts/install-vlt.sh`) against a local Node mock o
 
 ## Backlog
 
-1. #862 once it's fixed (shipped empty dirs, nested new dirs, `remove`, macOS / Windows). `patch/rollback.rs` is still unchanged on `313d532`; rebuild the run-12 `ADD=1` / `EMPTYDIR=1` mock to re-run it.
-2. #1130's decision on #941 (brotli restore).
-3. `repair` from a member with an alias dep (needs a mock that serves diff archives; the current mock gives `download_failed`).
-4. Three distinct `~peer.<hex>` instances: vlt dedupes a member's peer-dependent package onto an existing instance even when the member pins a different peer version (see Known non-bugs). Try three intermediates (peer-host 1.0.0 / 1.5.0 / 2.0.0) with no root or member direct dep.
-5. The #521 residual (same-mirror `SOCKET_NPM_REGISTRY`, [comment](https://github.com/SocketDev/socket-patch/issues/521#issuecomment-6039419242)): re-check after the next restore change.
-6. vlt 1.3.6 … 1.3.8 on macOS / Windows (probe branches are blocked). `vlt-compatibility.yml` is `disabled_manually` since 2026-10-09, so CI covers no vlt macOS / Windows legs either; re-check its `native` legs once a maintainer re-enables it.
-7. #434 (closed by #442): Windows with the default prefix, and the rest of the **maintainer `-g` request** (20261001T040000Z).
-8. Probe branches are blocked: branch deletion is denied, and 3 old `bughunt/vlt/*` branches still need a maintainer to delete them. The run-2 mock lives in `bughunt/vlt/20261001-v5-rollback-3os`.
+1. #1542 once it's fixed: every extglob form (`?( )`, `*( )`, `!( )`), the `!`-order case (`["!packages/a","packages/*"]`) and `package.json` workspaces.
+2. More vlt glob syntax: `..` segments, dot-dirs (`packages/.x`), case on case-insensitive filesystems.
+3. #862 once it's fixed (shipped empty dirs, nested new dirs, `remove`, macOS / Windows). `patch/rollback.rs` is still unchanged on `fc5458e`; rebuild the run-12 `ADD=1` / `EMPTYDIR=1` mock to re-run it.
+4. #1130's decision on #941 (brotli restore).
+5. `repair` from a member with an alias dep (needs a mock that serves diff archives; the current mock gives `download_failed`).
+6. Three distinct `~peer.<hex>` instances: vlt dedupes a member's peer-dependent package onto an existing instance even when the member pins a different peer version (see Known non-bugs). Try three intermediates (peer-host 1.0.0 / 1.5.0 / 2.0.0) with no root or member direct dep.
+7. The #521 residual (same-mirror `SOCKET_NPM_REGISTRY`, [comment](https://github.com/SocketDev/socket-patch/issues/521#issuecomment-6039419242)): re-check after the next restore change.
+8. vlt 1.3.6 … 1.3.8 on macOS / Windows (probe branches are blocked). `vlt-compatibility.yml` is `disabled_manually` since 2026-10-09, so CI covers no vlt macOS / Windows legs either; re-check its `native` legs once a maintainer re-enables it.
+9. #434 (closed by #442): Windows with the default prefix, and the rest of the **maintainer `-g` request** (20261001T040000Z).
+10. Probe branches are blocked: branch deletion is denied, and 3 old `bughunt/vlt/*` branches still need a maintainer to delete them. The run-2 mock lives in `bughunt/vlt/20261001-v5-rollback-3os`.
 
 ## Known non-bugs
 
@@ -115,3 +118,5 @@ Method: real vlt installs (`scripts/install-vlt.sh`) against a local Node mock o
 - `vlt-compatibility.yml` (with every other `*-compatibility.yml`) was `disabled_manually` on 2026-10-09, so it has no runs on main since. That's a maintainer choice, not a trigger bug; the blocking vlt rows run in `ci.yml`.
 - vlt (1.3.8) dedupes a workspace member's peer-dependent package onto an existing `~peer.<hex>` instance (peer-host 1.0.0) even when the member itself depends on peer-host 1.5.0, and a root `peer-host` dep collapses every instance into one. That's vlt's peer resolution.
 - `vendor --check` on a vendored project that later gained a `file:` copy of the same name@version says "wiring missing: no lockfile or config references …" although the lock still references the vendored dir. The exit code (1) and VEX omission are right; only the wording is imprecise.
+- vlt's workspace globs (1.3.8): a `!` pattern excludes regardless of its position, but a later literal path re-includes; `"packages"` lists nothing. A directory excluded by `!` isn't its own project (`vlt install` there installs the root), so socket-patch refusing from it is fail-closed.
+- vlt 1.2.0 ignores `package.json` `workspaces` with extglobs when `vlt.json` exists without `workspaces` (the member gets no edge), so a vendored write to that directory's own lock isn't the #1542 bug.