Fix npm linked-store alias copies left unpatched (#852)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #852

Summary

With npm 9–11's install-strategy=linked, agent mode now patches, verifies and rolls back an npm alias copy that lives in an alias-named store entry. Before this change:

• Alias plus a plain copy: apply patched only left-pad and exited 0. vex attested not_affected while require('lp') loaded unpatched code.
• Alias only: apply reported "1 not found on disk" (exit 0), and vex omitted the purl as not installed.

Root cause

npm names the store entry for an alias install after the alias: node_modules/.store/lp@1.3.0-<hash>/node_modules/lp holds the real left-pad@1.3.0. Agent mode missed that copy in two places:

• Resolver (NpmCrawler::find_by_purls → visit_resolver_dir): inside a store entry it only probed node_modules/<real name>. The Fix agent mode skipping npm-aliased copies (#356) #738 alias pass (alias_copies) ran on importer trees only.
• Store variant fan-out (find_store_peer_variant_copies, used by apply, rollback and VEX through with_store_peer_variant_copies): it skipped every entry whose dir name advertised another name, then probed node_modules/<real name>.

Fix

• visit_resolver_dir also runs alias_copies on npm linked-store entries (new is_npm_linked_store_entry, which handles .store/<entry> and .store/@scope/<entry>). It counts real dirs only, and the dir's package.json stays the authority on name@version.
• On the NpmLinked layout, find_store_peer_variant_copies probes a same-version entry under another name at node_modules/<advertised name>. That dir must be a real directory, since a link is a dependency edge into another entry. Its package.json must name the target, and the name's components pass is_safe_npm_component.
• No other layout changes. pnpm, Bun, Deno and vlt name store entries after the real package, and Yarn 4's .store entries don't decode as npm entries.
• The npm/PyPI/gem wrappers need no change, because the logic lives in the Rust core.

Ported CI fix: this PR carries 87bbd60, a cherry-pick of #878's "Route Gradle digests through utils::digest". main's utils::digest::tests::production_digests_go_through_the_helpers guard is red: Gradle/JVM/Maven code hashes inline. Without the port, coverage fails for reasons unrelated to this PR. It becomes a no-op once #878 lands.

Test evidence

Issue	Variant	Test	Before → after
#852	alias + plain copy (also scoped alias name, other-version alias ignored, link-only entry ignored)	npm_crawler::tests::test_npm_linked_store_alias_entry_beside_a_plain_copy_is_a_copy	FAILED → ok
#852	alias only (also unscoped alias of a scoped package)	npm_crawler::tests::test_npm_linked_store_alias_only_install_is_resolved	FAILED → ok
#852	vex every-copy rule, new npm linked-store alias entry (#852) layout	e2e_vex::verify_mode_requires_every_store_copy_patched	FAILED on main's crawler ("an unpatched store copy must keep the purl out of the VEX doc") → ok

The issue's repro with a real npm 10.9.4 / Node 22 install-strategy=linked install and the hand-staged left-pad@1.3.0 patch, run with a binary built from main and one built from this branch:

case	main	this PR
alias + plain	apply "1 of 1 applied"; vex not_affected; lp unpatched	apply 1 of 1; vex not_affected; left-pad and lp both patched
alias only	apply "1 not found on disk"; vex exit 1, omitted as not installed; lp unpatched	apply 1 of 1; vex not_affected; lp patched

rollback --offline --yes on the alias + plain case restores both copies.

Commands run locally:

• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo fmt --all -- --check: no diffs in files this PR touches. The local rustfmt reports existing diffs in files this PR doesn't touch.
• cargo test -p socket-patch-core --all-features --lib: 5247 passed, 5 failed.
  • 4 of the failures can't pass as root, because the sandbox runs as root and chmod can't make a dir read-only: copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched, pypi_requirements::wire_failure_rolls_back_already_written_files.
  • The 5th, the main digest guard, passes after the port.
• cargo test -p socket-patch-core --all-features --test crawler_npm_e2e --test covgap_crawlers_npm_crawler: 93 passed.
• cargo test -p socket-patch-cli --all-features --test e2e_vex: 19 passed.
• A full cargo test --workspace --all-features couldn't finish here: it hit the sandbox's disk allowance while linking test binaries, with no test failures. CI runs the full matrix.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RL7etZZRZ4tKZVNsPFD3KL

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 87bbd60. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[agent] Resolved: both one-time re-runs passed on 87bbd60, and CI is now fully green.

Original note: two CI jobs failed on 87bbd60 for reasons I don't think this PR caused.

1. e2e (ubuntu-latest, e2e_vendor_maven_build, maven, 4.0.0-rc-6): the test's fixture warm-up got a 404 from Maven Central for org.apache.maven.plugins:maven-dependency-plugin:3.6.1 on all 3 attempts, before any socket-patch code ran. The re-run passed.
2. native (macos-latest, 1.3.10) (Bun patch compatibility): 52 of 53 cells passed. The preexisting-manifest vendored cell failed its refusalCodesExact check. It passed on every other runner with the same binary, and passed on the re-run.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] Ready for review at 87bbd60.

• CI: 464/464 check runs green on 87bbd60 (Maven Central 404 and Bun macOS cell passed on their one-time re-runs).
• Bugbot: reviewed 87bbd60, no issues; no open review threads.
• Reviewer note: 87bbd60 is a cherry-pick of Route Gradle digests through utils::digest #878 (Gradle/JVM/Maven digests through utils::digest) so main's digest guard passes; it becomes a no-op once Route Gradle digests through utils::digest #878 lands.

---

Generated by Claude Code