vlt 1.4.0 reads workspaces from pnpm-workspace.yaml, so the #942 / #1134 member refusals miss those members: hosted and vendored scans write a stray member lock and exit 0, and vendored VEX attests not_affected #1564

[agent] Found by the scheduled vlt bug-hunt routine (ledger #307).

Summary

vlt 1.4.0 (published 2026-10-14) adds a third workspace source. vlt reads vlt.json workspaces, then the root package.json workspaces, and if neither is present it now reads the packages: list of pnpm-workspace.yaml (resolveWSConfig in vlt's src/workspaces; its new error text says "...the vlt.json config, the "workspaces" field of the root package.json, or the "packages" list of pnpm-workspace.yaml..."). socket-patch's vlt member checks only read the first two (vlt_workspace_root / package_json_workspace_root in hosted/governing_root.rs). As a result, a member that vlt 1.4.0 installs from the root's vlt-lock.json isn't recognised as a member:

• Stray member lock (Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json write to that lock, which vlt ignores, and exit 0 (vendored VEX then attests not_affected while vlt ci fails) #1134 shape): if packages/a/vlt-lock.json exists, hosted and vendored scan run from packages/a both rewrite that lock, which vlt never reads, and exit 0 with success. vlt then installs pristine bytes. After the vendored run, the root vlt ci fails with "Lockfile is out of sync with package.json", because the member's package.json was rewritten to file:. Vendored vex then attests not_affected / inline_mitigations_already_exist while require('left-pad') loads the pristine copy.
• No member lock (Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942 shape): hosted scan from the member exits 0 with status: success, pins nothing (one skipped / redirect_unconfirmed event plus a redirect_npm_no_lockfile warning) and doesn't give the redirect_workspace_lockfile_elsewhere refusal that the same layout gets when the globs are in vlt.json.

Impact

A pnpm-to-vlt migration that keeps pnpm-workspace.yaml is exactly the layout vlt 1.4 now supports. In that layout, socket-patch reports success, nothing patched gets installed, and the vendored VEX is a false not_affected attestation.

Repro (vlt 1.4.0, main 7b6371c, Linux)

Use the mock registry and patch API from #1494 (PORT=18555 node mock.mjs & PORT=18556 node mock.mjs &), with SOCKET_API_URL / SOCKET_PATCH_SERVER_URL=http://127.0.0.1:18556, SOCKET_NPM_REGISTRY=http://127.0.0.1:18555, SOCKET_ORG_SLUG=test-org and SOCKET_API_TOKEN=fake.

# a canonical single-project lock for the stray copy
mkdir solo && cd solo
echo '{"name":"a","version":"1.0.0","dependencies":{"left-pad":"1.3.0"}}' > package.json
echo '{"config":{"registries":{"npm":"http://127.0.0.1:18555/"}}}' > vlt.json
vlt install --allow-scripts :scripts && cd ..

mkdir -p ws/packages/a && cd ws
echo '{"name":"root","version":"1.0.0","private":true}' > package.json
echo '{"config":{"registries":{"npm":"http://127.0.0.1:18555/"}}}' > vlt.json   # no "workspaces"
printf 'packages:\n  - "packages/*"\n' > pnpm-workspace.yaml
echo '{"name":"a","version":"1.0.0","dependencies":{"left-pad":"1.3.0"}}' > packages/a/package.json
vlt install --allow-scripts :scripts
grep workspace vlt-lock.json          # "workspace~packages+a left-pad": "prod 1.3.0 ~npm~left-pad@1.3.0"
cp ../solo/vlt-lock.json packages/a/   # stray member lock (omit for the #942 shape)
cd packages/a
socket-patch scan --mode vendored --yes --json   # exit 0, success; rewrites packages/a/{package.json,vlt-lock.json}
cd ../.. && vlt ci --allow-scripts :scripts      # exit 1: Lockfile is out of sync with package.json
cd packages/a && node -e "console.log(require('left-pad'))"   # pristine
socket-patch vex --output vex.json               # exit 0; statement not_affected / inline_mitigations_already_exist

With --mode hosted instead, the scan exits 0, rewrittenFiles: ["vlt-lock.json"] (the member's), the root vlt ci exits 0 and installs pristine bytes, and vex exits 1.

Expected vs actual

• Expected: the same refusals as for a vlt.json- or package.json-listed member. Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942 / Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json write to that lock, which vlt ignores, and exit 0 (vendored VEX then attests not_affected while vlt ci fails) #1134 / Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json still write to that lock and exit 0 when the root's workspaces glob uses an extglob (packages/+(a|b), packages/@(a|b)); vendored VEX then attests not_affected #1542 refuse from a member that vlt installs from the root's lock (redirect_workspace_lockfile_elsewhere hosted, vendor_lockfile_missing vendored), and CLI_CONTRACT.md requires VEX not_affected only for a patch that is actually installed.
• Actual: exit 0 success, writes to a lock that vlt ignores, and vendored VEX gives a false not_affected.

OS × version

Each cell was run twice.

First bad vlt release: 1.4.0. This isn't a socket-patch regression; the cause is vlt's new workspace source. macOS and Windows weren't probed (this routine's probe branches are blocked). The fix will probably need to be gated on vlt's version or the lock: since 1.3.8 must keep treating the member as its own project, the root lock's workspace~<member> edges could decide, as vlt_lists_member already does for the ! dialect split.

Suspect code

• crates/socket-patch-core/src/hosted/governing_root.rs:755 vlt_workspace_root: reads only vlt.json workspaces.
• crates/socket-patch-core/src/hosted/governing_root.rs:556: the package.json fallback adds vlt-lock.json only for a package.json workspaces root. vlt 1.4's third fallback (pnpm-workspace.yaml packages: when package.json has no workspaces) isn't modelled.
• crates/socket-patch-core/src/hosted/governing_root.rs:106-111 (member_stray_lock_refusal / nearer_root) and crates/socket-patch-core/src/vendor/npm_flavor.rs:412 (member_stray_lock_refusal, which the vendored engine uses) inherit the gap.
• docs/testing/vlt-compatibility.md: the Formats and Releases tables stop at 1.3.8.