Bug hunt ledger: vlt #307

[agent] 2026-09-30: vlt bug-hunt run

Tested: main f6b7fb9 (CLI 4.0.0 workspace version). The latest published release is 4.0.0 (previous 3.3.0), but it predates vlt hosted support: on a vlt project it reports redirect_npm_no_lockfile, so it can't be compared. vlt 1.0.0-rc.14, 1.0.10, 1.2.0, 1.3.0, 1.3.1 and 1.3.2 (the current latest), installed through scripts/install-vlt.sh, on Node 22.22.2 on Linux. Patch data came from a local Node mock of the npm registry plus the patch API (mock.mjs, below), and from a hand-staged .socket/ for agent mode. No secrets.

This is the first run: there was no earlier ledger and no pm:vlt issue to re-triage.

CI status found

• The nightly vlt-compatibility.yml fails on main (runs 36522277204 and 36669570554), but only in canary (ubuntu-latest). The cause is "vlt 1.3.0 / 1.3.1 is published but neither supported nor excluded" in docs/testing/vlt-compatibility.md (Releases). All 5 capstone suites pass on 1.3.1 in that job, and push-triggered runs and ci.yml's 35 vlt e2e rows plus hosted-e2e are green. So this is a doc/matrix gap, not a code failure, and nothing was filed for it. vlt 1.3.2 is also out now.

Cells

• fail Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372: vlt ≥ 1.3.0 brotli tarballs. With a registry that advertises dist.alternates tar.br, vlt writes node flag bit 4. vlt_lock_text.rs:673 only accepts 0–3, so hosted refuses the lock (redirect_vlt_lock_unsupported, rc 0, stays unpatched) and vendored fails with vendor_lockfile_version_unsupported. Reproduced on 1.3.1 and 1.3.2. The control with no alternates passes. I verified by hand that a fix must also clear bit 4, otherwise vlt ci rewrites the lock.
• pass, Linux, vlt 1.3.2: all five real-vlt capstones (e2e_redirect_vlt_build 37 ran / 1 skip, e2e_vendor_vlt_build 30/2, mode_migration_vlt 12/2, e2e_safety_vlt 7/3, e2e_vlt 14/1), and every check-vlt-legs manifest is clean. 1.3.2 behaves as 1.2.0 on npmjs bytes.
• pass, vlt 1.3.2 against the mock: hosted scan → vlt install / vlt ci patched; vendored scan → vlt ci patched, lock byte-stable through --frozen-lockfile, vendor --revert byte-exact; vendored workspace members, including the dirs packages/my pkg and packages/café (DepIDs my_spkg, café); transitive-only target refused with vendor_vlt_transitive_unsupported; a direct+transitive target also refused, lock untouched; hosted direct+transitive both patched; agent apply / rollback on a brotli (flag 4) store; vex attests hosted and vendored-workspace projects and emits nothing for the refused project.
• vlt 1.3.0 itself fails vlt install ("Integrity check failure") against a registry advertising alternates. That's a vlt bug (fixed in 1.3.1), not ours.

Issues

• Filed Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372).

False positives ruled out

• scan --mode vendored giving no_local_source against my first mock: vendored needs blobContent in the patch view and the /patches/blob/<hash> route. It was a mock gap.
• Capstones failing "could not fetch … from npmjs" in the sandbox: the test harness's reqwest::Client doesn't trust the sandbox TLS proxy CA. Prefill /tmp/socket-patch-test-caches/vlt-e2e-registry/v1/<name+scope>@<ver>.{json,tgz} with curl (the version manifest JSON plus the tarball).

Probe

• No probe branch this run. Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 is in a pure text parser, so it's expected to be OS-independent, and macOS/Windows remain untested for it.

Next

1. Update the docs matrix (maintainer side) for 1.3.0–1.3.2 and re-check Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 once the fix lands. Hosted on a mixed lock (some brotli nodes, some not): the lock-level check passes, the brotli target is refused per-dep. Confirm redirect_vlt_lock_entry_unsupported wording.
2. Probe branch: vlt 1.3.2 capstones on macOS and Windows (not in CI yet), plus store-linker hardlink/copy on 1.3.2.
3. Heal after a hosted rewrite on a brotli dev node (flag 6): reinstalls_after_removal keeps the stale copy.
4. Workspaces nested ≥ 3 deep and a workspace member depending on another member that depends on the target (member-transitive refusal).
5. vlt install --lockfile-only checkouts → hosted/vendored → vlt ci.

mock.mjs (registry + patch API; PORT, NO_ALT=1 turns off the tar.br alternates)

import http from 'node:http';
import zlib from 'node:zlib';
import crypto from 'node:crypto';
import { execSync } from 'node:child_process';
import fs from 'node:fs';
const PORT = +process.env.PORT || 18555;
const R = `http://127.0.0.1:${PORT}`;
const NAME='left-pad', VER='1.3.0', UUID='aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa', TOKEN='bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb', ORG='test-org';
const PURL=`pkg:npm/${NAME}@${VER}`;
const ALT = process.env.NO_ALT ? false : true;
function tarOf(content){
  const d=fs.mkdtempSync('/tmp/bt/t'); fs.mkdirSync(d+'/package');
  fs.writeFileSync(d+'/package/package.json', JSON.stringify({name:NAME,version:VER,main:'index.js'})+'\n');
  fs.writeFileSync(d+'/package/index.js', content);
  const tar = execSync(`tar -C ${d} --owner=0 --group=0 --mtime=@0 -cf - package`);
  return tar;
}
const sri = b => 'sha512-'+crypto.createHash('sha512').update(b).digest('base64');
const git = b => crypto.createHash('sha256').update(Buffer.concat([Buffer.from(`blob ${b.length}\0`), b])).digest('hex');
const PRIST = Buffer.from("module.exports = 'pristine'\n"), PATCH = Buffer.from("module.exports = 'patched'\n");
const tgz = zlib.gzipSync(tarOf(PRIST)), br = zlib.brotliCompressSync(tarOf(PRIST)), ptgz = zlib.gzipSync(tarOf(PATCH));
function wrapTar(){ const d=fs.mkdtempSync('/tmp/bt/w'); fs.mkdirSync(d+'/package'); fs.writeFileSync(d+'/package/package.json', JSON.stringify({name:'wrapper',version:'1.0.0',main:'index.js',dependencies:{'left-pad':'1.3.0'}})+'\n'); fs.writeFileSync(d+'/package/index.js', "module.exports = require('left-pad')\n"); return zlib.gzipSync(execSync(`tar -C ${d} --owner=0 --group=0 --mtime=@0 -cf - package`)); }
const wtgz = wrapTar();
const artPath = `/patch/npm/${NAME}/${VER}/${TOKEN}/${UUID}/${NAME}-${VER}.tgz`;
const log = [];
http.createServer((req,res)=>{
  let body=''; req.on('data',c=>body+=c); req.on('end',()=>{
  const u = req.url.split('?')[0]; log.push(req.method+' '+u); fs.appendFileSync('/tmp/bt/mock.log', req.method+' '+u+'\n');
  const j = o => { res.writeHead(200,{'content-type':'application/json'}); res.end(JSON.stringify(o)); };
  const b = x => { res.writeHead(200,{'content-type':'application/octet-stream'}); res.end(x); };
  if (u===`/${NAME}`) {
    const dist = {tarball:`${R}/${NAME}/-/${NAME}-${VER}.tgz`, integrity: sri(tgz)};
    if (ALT) dist.alternates=[{kind:'tar.br', tarball:`${R}/${NAME}/-/${NAME}-${VER}.tar.br`, integrity: sri(br)}];
    return j({name:NAME, 'dist-tags':{latest:VER}, versions:{[VER]:{name:NAME,version:VER,main:'index.js',dist}}});
  }
  if (u==='/wrapper') return j({name:'wrapper','dist-tags':{latest:'1.0.0'},versions:{'1.0.0':{name:'wrapper',version:'1.0.0',main:'index.js',dependencies:{'left-pad':'1.3.0'},dist:{tarball:`${R}/wrapper/-/wrapper-1.0.0.tgz`,integrity:sri(wtgz)}}}});
  if (u==='/wrapper/-/wrapper-1.0.0.tgz') return b(wtgz);
  if (u===`/${NAME}/-/${NAME}-${VER}.tgz`) return b(tgz);
  if (u===`/${NAME}/-/${NAME}-${VER}.tar.br`) return b(br);
  if (u===artPath) return b(ptgz);
  if (u.startsWith(`/v0/orgs/${ORG}/patches/blob/`)) { const h=u.split('/').pop(); for (const x of [PRIST,PATCH]) if (git(x)===h) return b(x); }
  if (u===`/v0/orgs/${ORG}/patches/batch`) return j({packages:[{purl:PURL,patches:[{uuid:UUID,purl:PURL,tier:'free',cveIds:[],ghsaIds:[],severity:'high',title:'fx'}]}],canAccessPaidPatches:false});
  if (u.startsWith(`/v0/orgs/${ORG}/patches/by-package/`)) return j({patches:[{uuid:UUID,purl:PURL,publishedAt:'2024-01-01T00:00:00Z',description:'x',license:'MIT',tier:'free',vulnerabilities:{}}],canAccessPaidPatches:false});
  if (u===`/v0/orgs/${ORG}/patches/package`) return j({results:{[UUID]:{status:'granted',url:R+artPath,purl:PURL,artifacts:[{kind:'tarball',url:R+artPath,integrity:{sha512:sri(ptgz)}}],registryOverride:null}}});
  if (u===`/v0/orgs/${ORG}/patches/view/${UUID}`) return j({uuid:UUID,purl:PURL,publishedAt:'2024-01-01T00:00:00Z',files:{'package/index.js':{beforeHash:git(PRIST),afterHash:git(PATCH),blobContent:PATCH.toString('base64'),beforeBlobContent:PRIST.toString('base64')}},vulnerabilities:{'GHSA-vlth-aaaa-bbbb':{cves:['CVE-2026-4242'],summary:'s',severity:'high',description:'d'}},description:'x',license:'MIT',tier:'free'});
  res.writeHead(404); res.end('nf');
  });
}).listen(PORT, '127.0.0.1', ()=>console.log('listening', PORT));

[agent] 2026-10-01: vlt bug-hunt run

Tested: main 2463257 ("feat!: consolidate the v5 patching workflow", #277; CLI still reports 4.0.0). Latest release is still 4.0.0 (previous 3.3.0); neither has vlt support, so v5 can't be bisected against a release. vlt 1.3.2 (still latest, no new release since run 1), 1.2.0, 1.0.10, 1.0.0-rc.32, 1.0.0-rc.14, on Node 22.22.2 (Linux) and Node 24.21.0 (probe). Patch data comes from the run-1 mock, now with a pure-JS tar writer (so it runs on Windows) and the /<name>/<version> version doc that v5's upstream restore fetches. It runs on two ports: the registry on :18555 and the patch API/artifacts on :18556 with SOCKET_PATCH_SERVER_URL, because a shared origin is a mock artifact, see below.

Focus this run: v5 regressions. #277 replaced v4's hosted ledger with the upstream restore (patch/redirect/upstream/vlt.rs) for rollback / remove / the hosted→vendored takeover, and made hosted the default for a bare scan.

Re-triage

• Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (brotli flag bit 4) still reproduces on 2463257: bare scan gives rc 0, redirected: 0, redirect_vlt_lock_unsupported; --mode vendored gives partial_failure with vendor_lockfile_version_unsupported. Commented: Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (comment) (v5 now hits it with no flags, and the new upstream restore shares the parser).

Cells (all pass unless noted)

• Linux, vlt 1.3.2 / 1.2.0 / 1.0.10, hosted: bare scan → warm vlt install patched → vlt ci patched, lock byte-stable → rollback gives a byte-exact lock and a pristine warm install. Also checked: config.registry 3-tuple locks (no slot [3] written back); CRLF lock (rollback is byte-exact and keeps \r); re-scan idempotent; rollback --dry-run writes nothing; remove <purl> is byte-exact; get <purl>; rollback after vlt install wrapper added a second dependent; lockfile-only checkout with a sibling package-lock.json (redirect_vlt_sibling_lockfiles; both restored byte-exact; npm_allow_remote_left as documented).
• Linux, rc.14 (era B, ·npm· 3-tuple, lockfileVersion 0): hosted scan → rollback byte-exact (restore against a local copy of the real npmjs version doc).
• Linux, 1.3.2 / 1.2.0, hosted→vendored takeover → vlt ci patched → frozen install byte-stable → rollback byte-exact, .socket/ removed.
• Linux, 1.3.2, vendored workspaces: members packages/a → packages/b → left-pad and a 4-deep member apps/x/y/z (edge file:../../../../.socket/...). vlt ci patched, frozen stable, vex attests, rollback byte-exact.
• Linux, 1.3.2, default + named-registry copies of the same [email protected] (corp: alias in a member): hosted redirects only the default node (redirect_vlt_custom_registry_skipped), and vex refuses to attest. Vendored refuses the whole package with vendor_lock_entry_unsupported (loud, partial_failure).
• Linux, 1.3.2, agent on the hardlinked global store: patching project A breaks the hardlink (link count 9 → 1 on A's copy), and projects B and C stay pristine. Path-scoped agent rollback 'apps/**' restores all 3 copies and emits out_of_scope_copies_restored.
• Linux, 1.3.2, vendored re-run idempotent (lock + .socket files stable), repair after deleting a payload file, remove byte-exact.
• Probe: ubuntu / macos / windows × vlt 1.2.0 / 1.3.2, all 6 green, 22/22 checks each (hosted scan/warm/ci/rollback, CRLF, takeover + vendored ci/frozen/vex/rollback, a vendored workspace with dirs packages/my pkg and packages/café, agent apply/rollback/other-project isolation). Run: https://github.com/SocketDev/socket-patch/actions/runs/36803186961. This is the first macOS/Windows coverage of vlt 1.3.x, which CI's matrix still doesn't list.
• CI install-proof legs: on main's push run (36798098098) every vlt-compatibility job is green. On PR v5 prerelease: scan → vex → vendor workflow, hosted by default #277's run (36797999817), one cell failed: native (ubuntu-latest, 1.0.0-rc.14) hosted-direct: unsafe, failing=['warmOrdinary'] (35/36). The same cell passed on main 13 minutes later, and it passes 5/5 locally against the mock. Blocked: the result artifact (11134182795) is on the Actions blob host, which the sandbox proxy refuses (403), so I couldn't root-cause it. It's an intermittent production-service leg; nothing filed.

Issues

• Commented on Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 (still reproduces on v5 main). No new issues: nothing met the filing bar.

False positives ruled out

• rollback printed "Manifest not found" after a hosted scan against the mock. The contract only recognizes hosted pins on patch.socket.dev or SOCKET_PATCH_SERVER_URL; with that set, rollback works.
• config.registry project left patched after rollback: my patch server shared the registry's origin, so vlt re-saved the hosted node without slot [3] (its registry prefix rule), and the pin became invisible. That's a mock artifact; with the patch server on a separate origin it passes on 1.0.10, 1.2.0 and 1.3.2.
• Rollback lock "differ" in the first probe draft: vlt's machine-wide cache still held tarballs from the old mock at the same URL (stale integrity). The probe now isolates XDG/HOME per run.
• CRLF rollback "differ" after a vlt install: vlt re-saves locks as LF (documented). This was my probe's fault.
• vlt ci "Failed to fetch security data" on a cold cache (1.0.10, 1.2.0): the sandbox network blocks it. It passes on the GitHub runners.
• rc.32 / rc.14 rollback "differ" in the probe: those releases resolved left-pad from public npmjs despite registries.npm, while the probe's SOCKET_NPM_REGISTRY pointed at the mock. The integrity mismatch came from my probe. Restoring rc.14 against the real npmjs doc is byte-exact.
• scan packages/b (hosted) in a vlt workspace finds the patch but redirects nothing (redirect_npm_no_lockfile, rc 0). The contract defines each PATH as its own project "exactly as if it were --cwd (its own lockfiles)", and the human output says "Switched 0 packages". So this is documented. The warning names npm locks rather than the root vlt-lock.json: cosmetic, not filed.

Infra

• Probe-branch delete is blocked: git push origin --delete bughunt/vlt/20261001-v5-rollback-3os prints "Everything up-to-date" and the ref stays (4 attempts, plus one try with an explicit :refs/heads/... refspec). Sibling routines' bughunt/<pm>/* branches are stuck the same way. A maintainer needs to delete them; the session git proxy seems to drop ref deletions.

Next

1. Upstream restore against a registry whose dist.tarball isn't the conventional {base}/{name}/-/{leaf}-{ver}.tgz (Artifactory scoped /-/@scope/name-ver.tgz). The restore rebuilds slot [3] conventionally from the project registry and takes integrity from SOCKET_NPM_REGISTRY (npmjs), not the project registry. Check whether vlt ci still installs after rollback on such a registry.
2. Hosted and vendored modes refuse vlt 1.3 locks whose nodes carry the new brotli flag (slot [0] = 4) #372 follow-ups once fixed: a mixed brotli / non-brotli lock, a brotli dev node (flag 6) in the heal, and the upstream restore putting bit 4 back.
3. Peer-extras DepIDs (~npm~x@1~peer.<hex>, two instances of one name@version) through hosted scan → remove (all-or-nothing per pin).
4. Concurrent scan + rollback (apply.lock) on a vlt project, and a rollback interrupted mid-run.
5. vlt 1.3.x in the docs Releases table / CI matrix (maintainer side), then drop the probe.