Bug hunt ledger: Hatch #314

[agent] 2026-09-30: Hatch bug-hunt run

First run. The ledger was empty and there were no earlier pm:hatch issues, so there was nothing to re-triage.

Tested: main f6b7fb9, release build of socket-patch-cli. The latest tag is v4.0.0, which predates Hatch support (#244, 649d457), so no published release has anything to bisect. The sandbox can't reach the Socket patch hosts, so the Linux work used real Hatch releases against a local Python mock of the patch API (the same shape as tests/vex_pypi_real_common: six 1.16.0 with a SOCKET_PATCHED marker). The mock and driver are embedded in probe run 36740025279.

Filed

• Hosted Hatch rewrite leaves an existing Hatch environment unpatched with no stale-install warning, and vex still attests not_affected #335: a hosted rewrite leaves an existing Hatch env (pip installer) unpatched. pip keeps the same-version install on pip install "six @ url", and Hatch then records the dependency hash as synced. socket-patch never discovers Hatch's out-of-tree envs, so there's no redirect_pypi_stale_install warning, and vex attests not_affected. Reproduced on Linux, macOS and Windows × Hatch 1.7.0 / 1.9.7 / 1.16.5 / 1.18.1 (https://github.com/SocketDev/socket-patch/actions/runs/36740025279). The uv installer and fresh envs are fine. The same root cause makes agent mode apply 0 to the Hatch env (Poetry siblings: Agent-mode scan misses Poetry's venv for nameless non-package-mode projects, [project].name overrides, and in-project = false with a stray .venv, and still exits 0 #327, Windows agent-mode scan never finds Poetry's default out-of-tree virtualenv, so patches are skipped and the scan exits 0 #329).

Cells covered (Linux, Hatch 1.18.1 unless noted)

Ruled out / not filed

• Vendored scan failing package_not_installed without VIRTUAL_ENV: the mock has no vendoring-service endpoints, so auto fell back to a local build. With the real service it downloads. This is a mock artifact, apart from the discovery gap already in Hosted Hatch rewrite leaves an existing Hatch environment unpatched with no stale-install warning, and vex still attests not_affected #335.
• Hatch's internal envs (hatch-test, hatch-build, hatch-static-analysis, hatch-uv) default to installer = "uv", and the vendored uv refusal doesn't consider them. But uv 0.12 does enforce #sha256= on local wheels, so there's no integrity gap. docs/testing/hatch.md's "uv ignores hash fragments for local wheels" looks outdated; the refusal is only over-conservative.
• rollback on a project where nothing was written exits 2 Manifest not found: benign.

Housekeeping

• Probe branch bughunt/hatch/20260930-stale-env could not be deleted: the sandbox git proxy hangs up on ref-delete pushes (the same as the PDM routine). A maintainer should delete it. It only adds .github/workflows/bughunt-hatch.yml.

Next

1. Hatch 1.0 / 1.1 / 1.2 boundary: vendored env-dependency refusal and the {root:uri} expansion, with a pinned virtualenv; also 1.14.x.
2. Workspaces (Hatch 1.16+ workspace.members) and local path deps next to a patched pin, hosted and vendored.
3. hatch.toml overriding envs with a non-table / [env] collectors / template inheritance / overrides refusal firing correctly.
4. Hosted takeover vendored→hosted and hosted→vendored on Hatch (the sibling of Poetry's Poetry hosted ⇄ vendored mode switch is refused, and blames a "user-authored" source that socket-patch wrote itself #328), and rollback --preserve-state keeping allow-direct-references ownership.
5. Windows long paths / drive-letter {root:uri} on vendored (probe).

[agent] 2026-09-30: Hatch bug-hunt run

Tested: main f6b7fb9 (unchanged since the last run), release build. The latest tag is still v4.0.0, which predates Hatch support. Linux, real Hatch 1.18.1 and 1.7.0, using the same local mock patch API as last run (six 1.16.0).

Filed

• Hatch rollback and remove refuse with "configuration drifted" after the project version is bumped or a dependency is added, in both hosted and vendored mode #385: Hatch rollback / remove refuse ("Hatch configuration drifted" / "pyproject.toml changed since patching") after a [project].version bump, a comment on name, or an added dependency in the patched array. Hosted and vendored both fail, on Hatch 1.18.1 and 1.7.0, and a re-scan doesn't recover. The cause: vendor/pypi_lock.rs restore_document applies the lock-package same_identity (name + version) and array-length checks to pyproject tables.

Commented

• Poetry hosted ⇄ vendored mode switch is refused, and blames a "user-authored" source that socket-patch wrote itself #328 (PyPI mode takeover): added the Hatch rows. hosted → vendored fails pypi_hatch_unsupported "existing direct source must be reverted", exit 1. vendored → hosted gives redirected: 0 with status: success. Same root cause, so no new issue.

Re-triage

• Hosted Hatch rewrite leaves an existing Hatch environment unpatched with no stale-install warning, and vex still attests not_affected #335: main hasn't moved (f6b7fb9), so it wasn't re-run. Still open.

Cells covered (Linux)

Ruled out / not filed

• Vendored scan without Hatch on PATH fails pypi_hatch_unsupported ("require Hatch >=1.2 on PATH"). This is the documented preflight. Note that it also fires for pipx run hatch / uvx hatch users.
• Workspace member deps refused from the root: this is the documented transitive-only refusal, with a warning.
• Hosted project rewrites put six @ https://… into the built wheel's Requires-Dist, which PyPI rejects on upload. This is inherent to the design and not filed; the docs could mention it for libraries.

Housekeeping

• Probe branch bughunt/hatch/20260930-stale-env still can't be deleted (the git proxy disconnects on ref-delete). A maintainer should delete it. No probe branch was pushed this run.

Next

1. Hatch 1.0 / 1.1 / 1.2 boundary (the vendored preflight) and 1.14.x with a pinned virtualenv.
2. Refusal correctness: overrides, template, [env] collectors, hatch-pip-compile env type, hatch.toml envs non-table.
3. Multi-patch rollback <purl> / --preserve-state and allow-direct-references ownership (the mock needs a second package).
4. Windows long paths / drive-letter {root:uri} on vendored (probe).
5. Re-check Hosted Hatch rewrite leaves an existing Hatch environment unpatched with no stale-install warning, and vex still attests not_affected #335 / Hatch rollback and remove refuse with "configuration drifted" after the project version is bumped or a dependency is added, in both hosted and vendored mode #385 / Poetry hosted ⇄ vendored mode switch is refused, and blames a "user-authored" source that socket-patch wrote itself #328 once main moves.