Bug hunt ledger: Composer #321

[agent] 2026-09-30: Composer bug-hunt run

This is the first run, so the ledger started empty and there were no pm:composer issues to re-triage.

Tested: main f6b7fb9 (CLI 4.0.0 = latest release). Composer 2.8.12 on PHP 8.4.19, Linux only. No probe branches this run: both defects are OS-independent file/text logic.

Cells

• Agent, setup on a CRLF composer.json: fail → Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351. setup rewrites the whole file as LF, and setup --remove doesn't restore the CRLF bytes (CLI_CONTRACT §8). The same serde round trip also un-escapes \/ and \uXXXX. Composer's own composer config keeps CRLF.
• Agent, setup + real composer install / install --no-dev: pass. The hook runs socket-patch apply --offline --silent --ecosystems composer with exit 0 and leaves no .socket/ residue when there's no manifest.
• Agent, BOM composer.json: not a bug. Composer itself rejects it ("does not contain valid JSON").
• Scan, custom config.vendor-dir: lib/deps (plus COMPOSER_VENDOR_DIR) with require-dev: pass (2 packages discovered).
• Vendored, installed from source (--prefer-source / preferred-install: source) → git commit → fresh clone → composer install: fail → Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355. The copy carries .git/, git records a gitlink to the pristine upstream commit, and the fresh clone installs an empty package with exit 0. VEX correctly refuses on the fresh clone.
• Repo capstones (e2e_redirect_composer_build, e2e_vendor_composer_build) on 2.8.12 / PHP 8.4: hosted 5/5 pass. Vendored 4/6 pass. The 2 failures (…mirror_filters_would_drop, …fast_path_heals_legacy_copy) are the same .git copy as Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355: the sandbox can't download GitHub zipballs, so Composer falls back to source.

Issues

• Filed Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351: Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351
• Filed Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355: Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355

False positives ruled out

• A BOM composer.json is rejected by Composer itself, so socket-patch's refusal matches.
• vendor/-style .gitignore patterns also match .socket/vendor/. That was my own repro bug; use /vendor/.
• The sandbox always installs from source (zipball downloads fail), so a local "dist" control isn't possible. Upstream CI is the dist control.

Next

1. Probe branch: Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355 on Composer 1.10 and 2.2 (macOS/Windows), plus a --prefer-source hosted cell (does a source install over a rewritten lock ever keep the pristine code on Composer 1?).
2. setup on composer.json with floats/exponents (1e3), duplicate keys, and scripts referencing @php/@putenv. Also setup --check when the hook exists only in post-update-cmd.
3. Hosted/vendored with path-repository siblings (dist.type: path), dev-* versions, packages-dev-only targets, and a lock with "packages-dev": null (old Composer 1 writers).
4. Composer/installers custom install-path (e.g. a WordPress plugin) for agent apply and vendored copy discovery.
5. The Composer 1.x reinstall-over-existing-vendor hint and composer install --no-scripts (hook skipped) docs coverage.

[agent] 2026-10-01: Composer bug-hunt run

Tested: main f6b7fb9 (unchanged since run 1; CLI 4.0.0 = latest release). Locally on Linux: Composer 2.8.12, 2.2.30 and 1.10.28 (the phars come from GitHub releases; getcomposer.org is blocked in the sandbox), all on PHP 8.3. There was one probe run over ubuntu/macos/windows × Composer 1.10.28 / 2.2.30 / 2.10.3: https://github.com/SocketDev/socket-patch/actions/runs/36793579033 (9/9 jobs completed).

All fixtures were offline (path repositories, local VCS repos, a local Composer repository, and a local mock of the patch API). The sandbox's GitHub zipball problem doesn't affect any cell.

Re-triage

• Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351 and Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355: main hasn't moved, so both are still open. Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351 has a draft fix in Fix JSON writers dropping CRLF/BOM/indent (#324, #351) #357. No change.

Cells

• Hosted, a package from a Composer repo that has options.http.header: fail → Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 (filed). Composer copies repo options into the lock as transport-options. The hosted rewrite keeps them, so composer install sends the private header to the hosted patch URL. Reproduced on 1.10.28, 2.2.30 and 2.8.12 (twice).
• Hosted, warm Composer cache from the pristine install (dist keeps reference): pass on 1.10.28 / 2.2.30 / 2.8.12. Composer re-downloads, and the patched bytes install.
• Hosted → vendored takeover (scan --mode vendored --vendor-source build over a hosted lock): pass.
• Vendored, source-only lock entry (a type: vcs repo with no dist): fail, same bug as Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355. No --prefer-source is needed. The probe shows it fails on all 9 OS × version cells: the gitlink is committed, and the fresh clone's composer install exits 0 without the patched package. I added two comments to Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355.
• Vendored, path repo symlink: false → fresh install → vendor --revert: pass on all 9 probe cells, plus locally on Composer 1.10.28.
• Vendored, path repo (default symlink), transport-options {relative: true} → revert: the lock is restored byte for byte. Pass.
• Vendored, dev-main version → fresh install → repair (copy deleted) → remove <purl>: pass. The lock is restored, including transport-options.
• Vendored, dev-feature/foo (slash in the version): refused with unsafe_coordinates, fail-closed. Agent mode applies fine. Not filed (see below).
• Agent apply, Composer 1.10.28 installed.json (no install-path): pass.
• Agent apply, path-repo package installed as a symlink/junction: writes through the link into ../sib, outside the project. Same in all 9 probe cells. Not filed (see below).
• setup --check with the hook in only one of post-install-cmd / post-update-cmd: it reports configured (exit 0) while setup --dry-run reports wouldUpdate: 1, and a fresh composer install leaves the package unpatched. Confirmed twice. Not filed: setup is deleted on release/v5-prerelease (v5: remove setup (WS7) + patch UI streamlining (WS8) #279, merged), so a fix is unlikely to be worth it. Recorded below.

Issues

• Filed Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399: Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399
• Commented on Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355 twice (source-only trigger; 9-cell probe matrix): Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355

False positives ruled out

• A "packages-dev": null lock: Composer 2.8 itself fails to install from it (Locker.php), with or without socket-patch. Not a socket-patch bug.
• Path-repo symlink write-through: the npm crawler deliberately accepts npm link / file: symlinks too, and Composer created the link from the user's own composer.json. It's a design question, not a contract violation.
• unsafe_coordinates for a / in a dev branch version: an explicit fail-closed refusal on a shape Socket patches don't target (released versions).

Housekeeping

• I couldn't delete the probe branch bughunt/composer/20260930-srconly-probe: git push --delete gets a 403 from the sandbox git proxy policy. It holds only the probe workflow, which fires only on pushes to bughunt/composer/**. A maintainer can delete it.

Next

1. Hosted: other repo-scoped lock fields that follow the package to the new origin (notification-url, ssl transport options, http.proxy), and whether rollback / the vendored takeover restore transport-options.
2. Vendored and hosted on the release/v5-prerelease branch (v5 prerelease: scan → vex → vendor workflow, hosted by default #277), where the hosted ledger is gone: re-check Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 and Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355 there.
3. composer/installers custom install-path (a WordPress plugin) for agent apply and vendored copy discovery, Composer 2 vs Composer 1.
4. A COMPOSER=<other>.json project: crawler vendor-dir resolution reads only composer.json.
5. Concurrent vendor + composer install, and an interrupted vendor (kill mid-copy) followed by repair.

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major Composer version and on Linux, macOS and Windows.

Where Composer puts global installs: composer global require (composer global config home, COMPOSER_HOME: ~/.config/composer or ~/.composer on Linux/macOS, %APPDATA%\Composer on Windows).

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed Composer package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a Composer project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × Composer version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

[agent] 2026-10-01: Composer bug-hunt run

Tested: main 2463257 (the v5 consolidation, #277, landed since the last run; the CLI still reports 4.0.0). The latest release is v4.0.0, whose binary I used for the regression check. Locally on Linux: Composer 1.10.28, 2.2.30, 2.8.12 and 2.10.3 on PHP 8.3. The probe branch bughunt/composer/20261001-global-probe covered ubuntu/macos/windows × Composer 1.10.28 / 2.2.30 / 2.10.3 in runs https://github.com/SocketDev/socket-patch/actions/runs/36823671080 (the macOS cells hung in a probe-script PATH loop; ubuntu and Windows are valid) and https://github.com/SocketDev/socket-patch/actions/runs/36827949605 (macOS + Windows, all 6 jobs). An earlier run, 36822144647, was invalid on Windows because composer.bat mangled the JSON quoting. All fixtures were offline: a path-repo package acme/[email protected] installed with composer global require, plus a local mock patch API.

This run took up the maintainer backlog item: global (-g) mode.

Re-triage

• Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351 (setup CRLF): closed. setup was removed in v5 (unrecognized subcommand 'setup', docs/migrating-to-v5.md). Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351
• Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 (hosted keeps transport-options headers): still reproduces on v5 main, and I commented with the rewritten lock entry. Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 (comment)

Cells (global mode)

• scan -g report-only, default home: pass on Linux (1.10–2.10) and macOS (1.10/2.2/2.10). Fail on Windows (all 3 versions) → On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438: %APPDATA%\Composer is never found. composer.bat isn't spawned (Command::new without resolve_tool), and the fallback doesn't list APPDATA.
• scan -g --mode hosted / --global-prefix … --mode hosted: pass on every OS and version (exit 2, nothing written).
• scan -g --mode agent → global file patched; vex -g attests 1; rollback -g restores byte for byte: pass on Linux and macOS, and on Windows with an explicit COMPOSER_HOME. Fail on Windows with the default home (On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438).
• vex -g after composer global reinstall (pristine bytes): it omits with not_applied, which is correct. apply -g then re-patches. Pass (Linux, 2.8.12).
• -g from inside a Composer project touches only the global copy, and a scan without -g touches only the project copy: pass (Linux, 2.8.12).
• scan -g with composer not on PATH (phar) and XDG_CONFIG_HOME set: fail, folded into On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438.
• Custom global vendor-dir (composer global config vendor-dir deps, or COMPOSER_VENDOR_DIR): fail on all 3 OS × all versions → Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439. --global-prefix <home>/deps works around it.
• Local agent scan with a user-level composer config -g vendor-dir lib ($COMPOSER_HOME/config.json): fail → Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439 (Linux, 2.8.12, twice).
• Regression check: both On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438's fallback gap and Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439 behave identically on the v4.0.0 binary, so neither is a v5 regression.

Issues

• Filed On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438: On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438
• Filed Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439: Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439
• Closed Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351, and commented on Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399.
• Handed the bundler routine a lead: ruby_crawler.rs:549 spawns gem env through the same non-PATHEXT runner (unverified on Windows).

False positives ruled out

• The first rollback -g failure ("Before blob could not be downloaded") came from my mock missing beforeBlobContent and the blob route. With both present, it passes.
• Agent mode under -g writes .socket/manifest.json in the cwd, so rollback -g must run from the same directory. That's per-cwd manifest design, not a bug.
• The ubuntu "composer not on PATH" pass was invalid: stripping /usr/bin also removed bash. The local Linux run, which removed only /usr/local/bin, is valid and passes (the ~/.config/composer fallback).

Housekeeping

• The git proxy refused to delete the probe branches bughunt/composer/20261001-global-probe and bughunt/composer/20260930-srconly-probe (the remote hung up). Both only hold the probe workflow. A maintainer needs to delete them.

Next

1. A non-writable global dir (a root-owned prefix, Program Files) must fail loudly. This needs a non-root runner, so use a probe.
2. Re-run the -g matrix once On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438 and Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439 are fixed (Windows default home, vendor-dir), and add SOCKET_GLOBAL=1 and space/unicode --global-prefix cells.
3. Hosted: other repo-scoped lock fields (notification-url, ssl transport options) on v5. Re-check Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355 on v5 vendored.
4. composer/installers custom install-path (a WordPress plugin) for agent apply and vendored discovery.
5. COMPOSER=<other>.json projects, and concurrent vendor + composer install.