Bug hunt ledger: PDM #312

[agent] 2026-09-30: PDM bug-hunt run

First run. The ledger was empty and there were no earlier pm:pdm issues, so there was nothing to re-triage.

Tested: main f6b7fb9 (latest release tag v4.0.0), release build of socket-patch-cli. The sandbox blocks patches-api.socket.dev and patch.socket.dev, so all Linux work used real PDM releases against a local mock of the authenticated patch API (/patches/batch, /by-package, /view, /blob, /package). The mock serves a real urllib3 1.26.18 wheel with a marker appended to urllib3/response.py, with a correct RECORD and sha256. The mock script is embedded in the probe workflow of run 36735829162.

Filed

• Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332: agent mode writes the patch through PDM 2.0–2.12's directory-symlink install cache (install.cache=true, cache_method=symlink). The shared ~/.cache/pdm/packages gets patched, and so does every other project using it. Reproduced on Linux, macOS and Windows (probe run https://github.com/SocketDev/socket-patch/actions/runs/36735829162). 2.15+ (per-file symlinks) and hardlink are OK; pth fails closed.
• Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331: hosted rollback reports success but leaves the patch url/hash in pdm.lock after pdm add <other> / pdm lock --update-reuse followed by the suggested re-scan. On 2.12/2.20 it leaves the patched hash with no url, and pdm sync then fails. Linux, 2.12.4 / 2.20.1 / 2.26.9 / 2.29.2.

Cells covered (Linux unless noted)

Ruled out / not filed

• Vendored lock-only checkout refused (vendor_fetch_unverifiable): by design (lock_inventory/pypi.rs:531).
• static_urls hosted rewrite emits {file, hash} rather than the {url, hash} shape the doc claims. PDM installs it fine, so this is at most a doc nit.
• The empty-venv hosted scan crawls the PATH interpreter (119 packages): documented fall-through.
• 2.22.4 / 2.25.9 are SKIP in results.json. That is a harness artifact on the doc's run, and the CI matrix covers them.

Housekeeping

• Probe branch bughunt/pdm/20260930-cache-symlink could not be deleted: the sandbox git proxy disconnects on ref-delete pushes (tried 5×). A maintainer should delete it. It only adds .github/workflows/bughunt-pdm.yml.
• The GitHub issue search API returns 0 results for every query in this sandbox, so dedup used a full REST listing of issues and PRs (308) grepped locally.

Next

1. PDM 1.x feature.install_cache (symlink/pth) with agent mode, on python.use_venv=true.
2. Hosted after pdm update urllib3 / pdm remove / pdm lock --refresh, plus the rollback invariants (sibling of Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331).
3. CRLF + pdm add rebase; pdm lock -L custom.lock with a later rename to pdm.lock.
4. Windows long-path and unicode project dirs for hosted and vendored (probe).
5. inherit_metadata multi-target lock (pdm lock --append --python) with a forked package vs a single version: refusal and VEX.

[agent] 2026-09-30: PDM bug-hunt run

Tested: main f6b7fb9 (v4.0.0-33), release build of socket-patch-cli, plus the published PyPI socket-patch 4.0.0 for comparison. Linux only, with real PDM releases against a local mock of the authenticated patch API (batch, by-package, view, blob, package), which serves a real urllib3 1.26.18 wheel with a marker line appended to urllib3/response.py.

Filed / commented

• Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 (new): hosted rollback and remove <purl> fail permanently (exit 1, "the file drifted; re-run scan") once the patched package leaves pdm.lock through pdm remove, a transitive removal, or an upgrade to another version. The recommended re-scan (redirected: 0) never prunes the stale ledger edit. Reproduced 2/2 on 2.12.4, 2.20.1 and 2.29.2, plus 1.4.5 (commented). VEX correctly omits the package (redirect_unwired). Not covered by Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 / PR Fix PDM rollback leaving the patch after a re-scan (#331) #375.
• Handover to uv (entries/uv/…-from-pdm.md): the same flow fails with uv remove, possibly already covered by Hosted uv rollback and remove are stuck after any unrelated pyproject.toml edit or uv add, and the suggested re-scan doesn't fix it #379.

Re-triage

• Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 and Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332: main is unchanged since the last run (f6b7fb9), so no re-check was needed. Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 has fix PR Fix PDM rollback leaving the patch after a re-scan (#331) #375 (open, draft), which doesn't cover Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382's case.

Cells covered (Linux)

Ruled out / not filed

• The multi-target fork refusal is documented.
• The published 4.0.0 wheel doesn't produce a hosted redirect for a lock-only project against the mock (redirected: 0), so Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 can't be bisected against it. That's not a finding: it's a mock/route difference.
• PDM 1.x bootstrap needs the era pins from scripts/backtest-pdm.py:pins_for (pythonfinder 1.2.10 etc.). That's an environment issue, not a bug.

Housekeeping

• The old probe branch bughunt/pdm/20260930-cache-symlink still can't be deleted: git push --delete gets "remote end hung up" from the sandbox proxy again. A maintainer should delete it. For that reason I didn't create a new probe branch this run, and Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 is platform-independent logic anyway.

Next

1. pdm update --unconstrained / pdm lock --update-all on hosted (does it keep the url, like --update-reuse in Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331?).
2. PDM 1.x feature.install_cache with agent mode (sibling of Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332); 1.4.5 now bootstraps with the backtest pins.
3. Hosted with a private [[tool.pdm.source]] index and respect-source-order; pdm export of a hosted lock.
4. Windows long-path / unicode dirs (probe, once branch deletion works).
5. Re-triage Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 when PR Fix PDM rollback leaving the patch after a re-scan (#331) #375 merges; Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332.

[agent] 2026-10-01: PDM bug-hunt run

Tested: main 2463257 (#277, "consolidate the v5 patching workflow"; latest tag v4.0.0), release build, plus a build of f6b7fb9 (v4) to bisect. Linux only. Real PDM 2.12.4 / 2.20.1 / 2.29.2 against a local mock of the v5 patch API (batch, by-package, package grant, view, hosted wheel), with SOCKET_PATCH_SERVER_URL set to the mock origin. Hosted rollback in v5 re-derives files from PyPI's JSON API. The Rust client can't reach pypi.org through the sandbox proxy, so SOCKET_PYPI_JSON_API pointed at a local pass-through to pypi.org.

Filed / closed

• Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 (new): hosted rollback and remove rewrite a private-index static_urls lock's file URLs to files.pythonhosted.org. PDM 2.20/2.29 then bypass the mirror (0 mirror hits), and PDM 2.12.4 fails pdm sync on a mirror-only network. The uv and Pipenv restores refuse a non-PyPI index; restore_pdm doesn't check. First bad commit is 2463257; v4 f6b7fb9 round-trips byte-exactly.
• Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 closed (fixed by v5 prerelease: scan → vex → vendor workflow, hosted by default #277): pdm add / --update-reuse → re-scan → rollback leaves 0 patch refs, and pdm sync / lock --check pass (2.12.4, 2.20.1, 2.29.2).
• Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 closed (fixed by v5 prerelease: scan → vex → vendor workflow, hosted by default #277): with no v5 ledger there's no stale state. After pdm remove or an upgrade, rollback / remove exit 1 with Manifest not found, the documented truly-empty project result.

Cells covered (Linux)

Ruled out / not filed

• The 2.29 default-strategy rollback refusal for non-universal releases is documented ("a pdm.lock without cross_platform …").
• The cross_platform file-superset restore: pdm sync and lock --check are unaffected, so it isn't a functional break. It's noted under Known non-bugs.

Housekeeping

• git push --delete of the stale probe branch bughunt/pdm/20260930-cache-symlink was denied by the session's permission classifier this run. A maintainer should delete it. No new probe branches were created, since they couldn't be cleaned up.

Next

1. Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 re-triage on v5 (agent mode, install.cache symlink, PDM 2.0–2.12).
2. Vendored mode on v5 (vendored_backend): 2.29.2 / 2.12.4 / 1.4.5, plus private index + static_urls (does vendored rollback keep the mirror URLs?).
3. Hosted on lock_version 2 (PDM 0.12 / 1.4.5) through the v5 upstream restore ([metadata.files] full-release assumption).
4. Hosted → vendored takeover on v5 (now through the upstream restore).
5. A non-static_urls private index serving different bytes for the same name and version (the hash variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413).

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major PDM version and on Linux, macOS and Windows.

Where PDM puts global installs: pdm -g global project (~/.pdm/global-project, or ~/.local/share/pdm/global-project) plus the global interpreter's site-packages. Check that -g doesn't patch PDM's shared install cache (see #332).

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed PDM package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a PDM project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × PDM version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.