Bug hunt ledger: pnpm #303

[agent] 2026-09-30: pnpm bug-hunt run

Tested: main f6b7fb9 (CLI 4.0.0 workspace version), latest release 4.0.0 (previous 3.3.0, both installed from npm for comparison). pnpm 7.33.7, 8.15.9, 9.15.9, 10.0.0, 10.5.2, 10.12.1, 10.34.5, 11.27.0, 12.4.2 and 12.8.1 (the current latest), on Node 22 in the sandbox. Patch data is a hand-staged .socket/manifest.json plus blobs (agent and vendored mode) and a local Python mock of the patch API and tarball routes (hosted mode). No secrets.

This is the first run: no earlier ledger, and no open pm:pnpm issues to re-triage.

Cells

• fail Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361: agent apply / rollback with enableGlobalVirtualStore. Writes land in the shared <store>/links dir: an unrelated project is patched, and one project's rollback unpatches another. Fails on Linux with pnpm 10.12.1–12.8.1, and on the macOS and Windows probe with pnpm 11.27.0 and 12.8.1. Releases 3.3.0 and 4.0.0 behave the same.
• fail Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362: agent apply on a transitive dep with a custom virtualStoreDir (pnpm 8–12) or the global virtual store (10.12+) is reported package_not_installed. Fails on Linux, macOS and Windows.
• fail Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360: vendored mode on pnpm 10.5.2, 10.12.1 and 10.34.5 with user overrides: in pnpm-workspace.yaml. vendor succeeds, then a fresh --frozen-lockfile install fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH, and a re-lock drops the user's overrides. Passes on 10.0.0, 11.27.0 and 12.8.1. Release 4.0.0 has the same bug.
• pass: vendored lifecycle on pnpm 10.34.5 and 11.27.0 (vendor → fresh frozen --offline install → vex → revert). Also passes with nodeLinker: hoisted and with a flow packages: ['.'] plus catalog: {…}.
• pass: agent apply / rollback with nodeLinker: hoisted (pnpm 11.27.0). The CAS file is not written through.
• pass: hosted scan --mode hosted on pnpm 11.27.0 against the mock API: fresh frozen install with an empty store gets the patched bytes. trustLockfile handling passes for CRLF, no-EOL and trailing-comment trustLockfile: true workspace files.
• fail, not filed (queued in the backlog): hosted trustLockfile append and vendored overrides append on a whole-document flow pnpm-workspace.yaml ({packages: [.]}) or a file ending in .... The command reports success, then pnpm can't parse the file ("end of the stream or a document separator is expected"). Reproduced on pnpm 11.27.0.
• refused, as designed: vendored with a CRLF pnpm-workspace.yaml or pnpm-lock.yaml (vendor_lockfile_crlf_unsupported), a BOM package.json (vendor_pkg_json_unsupported), inline overrides: {} / {x: y} (vendor_override_conflict, covered by the inline_workspace_overrides_mapping_is_refused unit test), and patchedDependencies on the target (vendor_lock_entry_unsupported).

Issues

• Filed Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360, Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361 and Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362.

False positives ruled out

• Vendored vex attesting not_affected in a fresh clone whose install failed is by design: vendored VEX stands on the committed artifact plus lock wiring (CLI_CONTRACT "Manifest-less VEX"; vendored_tree_out_of_sync is a warning only).
• The global virtual store "not reproducing" with pnpm 10.34.5 on GH runners is expected: pnpm 10 disables it when CI is set. pnpm 11+ keeps it.
• vex --output /dev/stdout hangs when stdout is a pipe. It's not pnpm-specific, so it wasn't filed here; it's noted for whoever owns the CLI.

Probe

• bughunt/pnpm/20260930-virtual-store, run https://github.com/SocketDev/socket-patch/actions/runs/36759597534 (ubuntu, macos and windows × pnpm 10.34.5, 11.27.0 and 12.8.1). The branch could not be deleted: the git proxy dropped git push --delete three times ("unexpected disconnect while reading sideband packet"). A maintainer needs to delete it.

Next

1. Flow-style or ...-terminated pnpm-workspace.yaml breaking under the hosted trust append and the vendored overrides append. Confirm on pnpm 10 and 12, then file.
2. Hosted mode on pnpm 7/8 (lock 5.4/6.0) workspaces with catalogs, and peer-suffixed instances with the mock API. Then Rush/subspace locks.
3. The vendored takeover (hosted → vendored → hosted) on pnpm 11/12, plus rollback byte-exactness of pnpm-workspace.yaml.
4. Agent apply with injected workspace deps (dependenciesMeta.injected) and package-import-method=clone/copy.
5. pnpm 1–6 legacy layouts (node_modules/.registry.npmjs.org, pnpm 4/5 nested host dirs) on Node 16 for agent mode.

[agent] 2026-10-01: pnpm bug-hunt run

Tested: main f6b7fb9 (unchanged since run 1), latest release 4.0.0 (npm @socketsecurity/[email protected], used for the regression checks). pnpm 7.33.7, 8.15.9, 9.15.9, 10.34.5, 11.27.0 and 12.8.1, on Node 22 in the Linux sandbox. Hosted mode ran against a local Python mock of the patch API and tarball routes, modelled on e2e_redirect_pnpm_build.rs. Vendored mode ran from a hand-staged .socket/manifest.json plus blobs. The oracle is a marker on left-pad/index.js after a fresh --frozen-lockfile install against a dead registry.

Re-triage

• Vendored pnpm 10.5+ with overrides: in pnpm-workspace.yaml: the new package.json pnpm.overrides shadows the user's overrides, so frozen installs fail and a re-lock drops them #360, Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361 and Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 are still open. Main hasn't moved, so there's no fix to verify. Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362 has draft PR Fix npm crawler missing relocated dependency stores (#359, #362) #365 (the custom virtualStoreDir half; the global-virtual-store half stays open per the maintainer note). Nothing to close.

Cells

• fail Hosted trustLockfile and vendored overrides appends corrupt a flow-style or ...-terminated pnpm-workspace.yaml while reporting success #400: a whole-document flow pnpm-workspace.yaml ({packages: [.]}), or one ending in .... The hosted trustLockfile: true append and the vendored overrides: append both write YAML pnpm can't load, and both report success. Hosted fails on 10.34.5, 11.27.0 and 12.8.1; vendored fails on 11.27.0 and 12.8.1. Release 4.0.0 behaves the same.
• fail Hosted→vendored takeover leaves trustLockfile: true in pnpm-workspace.yaml, and vendor --revert never removes it #401: hosted → vendored takeover (vendor and scan --mode vendored) on pnpm 11.27.0 and 12.8.1 leaves trustLockfile: true plus an orphan redirect_pnpm_workspace_trust ledger edit with no records. vendor --revert doesn't remove it either. npm's .npmrc gets a last-one-out unwind in the same situation. Release 4.0.0 behaves the same.
• fail pnpm-workspace.yaml edits miss quoted or space-before-colon top-level keys, append a duplicate trustLockfile/overrides key, and break every install #402: a quoted or space-before-colon top-level "trustLockfile": false, 'trustLockfile': true, trustLockfile : false, or a quoted "overrides":, is not recognised, so a duplicate key is appended (duplicated mapping key). Hosted fails on 10.34.5, 11.27.0 and 12.8.1; vendored fails on 11.27.0 and 12.8.1. Release 4.0.0 behaves the same.
• pass: hosted baseline (no workspace file) on pnpm 7.33.7 (lock 5.4), 8.15.9 (lock 6.0) and 9.15.9 (lock 9.0, trust file created). The fresh frozen install is patched.
• pass: hosted with a catalog: dependency on pnpm 9.15.9, 10.34.5, 11.27.0 and 12.8.1.
• pass: the full cycle vendor → hosted takeover → vendored takeover → bare rollback on pnpm 11.27.0. Every fresh frozen install is patched, and the lock, pnpm-workspace.yaml and a tab-indented package.json come back byte-identical.
• pass: scoped rollback <purl> after hosted only on pnpm 11.27.0 and 12.8.1 (2 runs each). The trust line is removed through whole-ledger replay.

Issues

• Filed Hosted trustLockfile and vendored overrides appends corrupt a flow-style or ...-terminated pnpm-workspace.yaml while reporting success #400, Hosted→vendored takeover leaves trustLockfile: true in pnpm-workspace.yaml, and vendor --revert never removes it #401 and pnpm-workspace.yaml edits miss quoted or space-before-colon top-level keys, append a duplicate trustLockfile/overrides key, and break every install #402.

False positives ruled out

• A compact single-line package.json comes back 2-space-indented after vendor + rollback. A one-line file has no indent to detect, and an indented file round-trips byte-exactly, so this wasn't filed. It's cosmetic, and JsonLayout work in PR Fix JSON writers dropping CRLF/BOM/indent (#324, #351) #357 is nearby.
• A scan --mode vendored re-run that returned status: error after a bare rollback came from the fixture: rollback garbage-collected the staged blobs, and the mock doesn't serve blob content.

Probe

• No new probe branches. git push --delete of the stale bughunt/pnpm/20260930-virtual-store was denied by the session's permission policy, so new probe branches couldn't be cleaned up either. A maintainer needs to delete bughunt/pnpm/20260930-virtual-store.

Next

1. Hosted: Rush / subspace locks (common/config/rush/pnpm-lock.yaml) and peer-suffixed instances in a workspace with the mock harness.
2. Hosted --frozen-lockfile --offline with a warm store that holds the upstream tarball, on pnpm 9–12. Confirm the documented warm-cache caveat and that vex doesn't attest unpatched bytes.
3. Agent: dependenciesMeta.injected and package-import-method=clone|copy, and pnpm 1–6 legacy layouts on Node 16.
4. Vendored on Windows / macOS autocrlf checkouts (needs a probe branch; blocked until probe-branch deletion is allowed).
5. Re-check Hosted trustLockfile and vendored overrides appends corrupt a flow-style or ...-terminated pnpm-workspace.yaml while reporting success #400–pnpm-workspace.yaml edits miss quoted or space-before-colon top-level keys, append a duplicate trustLockfile/overrides key, and break every install #402 once fixes land, including both modes and pnpm 12.

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major pnpm version and on Linux, macOS and Windows.

Where pnpm puts global installs: pnpm add -g; discovery via pnpm root -g (PNPM_HOME). Cover pnpm 7–10 global-dir layouts, the global virtual store, and pnpm installed through corepack, standalone and npm.

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed pnpm package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a pnpm project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × pnpm version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.