rollback -g and remove <purl> -g also unwind the current project's hosted pins and vendored wiring; on vlt they delete node_modules/left-pad too #445

[agent] Found by the scheduled vlt bug-hunt routine (ledger #307).

Summary

--global / -g is documented as "Operate on globally-installed packages". If socket-patch rollback -g or socket-patch remove <purl> -g runs from inside a project that uses hosted or vendored mode, it rolls back the global copy as expected. It also runs v5's full-state rollback legs against the cwd project:

• the project's hosted pins in vlt-lock.json are restored to the registry, and
• its vendored wiring is reverted: the lock is unwired and .socket/vendor/ is deleted.

On vlt this goes further: the run deletes the project's installed node_modules/left-pad (redirect_vlt_reinstall_required / vendor_vlt_reinstall_required). The project is left with a missing dependency until someone runs vlt install. The run exits 0 with status: success.

The same happens with an empty global prefix: there's nothing global to roll back, and the project still gets unwound.

The reverse direction has the same root cause. In a vendored project, scan -g --mode agent skips the global copy with vendored_ownership_retained, because the cwd project's vendor ledger "owns" the purl. It exits 0, and the global install stays unpatched.

Impact

• A user who runs socket-patch rollback -g to undo a global patch silently loses the security patches of whatever repo they happen to be in. In CI, that's the checkout. The lockfile change looks like an ordinary diff and can get committed, which un-patches every later vlt ci / npm ci.
• On vlt the working tree breaks right away: require('left-pad') throws MODULE_NOT_FOUND.
• This isn't vlt-specific. An npm project (package-lock.json, hosted or vendored) is unwound the same way. vlt just adds the deleted install.

Repro (vlt 1.3.3, any OS)

The patch API and registry are a local mock: patch aaaaaaaa-… for pkg:npm/left-pad@1.3.0, with registry on :18555 and patch server on :18556. The mock is in the probe workflow linked below.

export SOCKET_NPM_REGISTRY=http://127.0.0.1:18555 SOCKET_API_URL=http://127.0.0.1:18556 \
       SOCKET_PATCH_SERVER_URL=http://127.0.0.1:18556 SOCKET_ORG_SLUG=test-org SOCKET_API_TOKEN=fake
export NPM_CONFIG_PREFIX=$PWD/gprefix; mkdir -p gprefix/lib/node_modules   # empty global
mkdir proj && cd proj
echo '{"name":"app","version":"1.0.0","dependencies":{"left-pad":"1.3.0"}}' > package.json
echo '{"config":{"registries":{"npm":"http://127.0.0.1:18555/"}}}' > vlt.json
vlt install
socket-patch scan --yes                       # hosted (v5 default); or: scan --mode vendored --yes
rm -rf node_modules && vlt ci
node -e "console.log(require('left-pad'))"    # patched
cp vlt-lock.json wired.lock
socket-patch rollback -g --yes --json; echo rc=$?   # rc=0, status success
cmp wired.lock vlt-lock.json                  # differ: hosted URL / file:.socket/vendor edge gone
ls .socket/vendor                             # (vendored case) gone
node -e "require('left-pad')"                 # MODULE_NOT_FOUND
# same with: socket-patch remove pkg:npm/left-pad@1.3.0 -g --yes --json

Reverse direction: in a vendored project with left-pad also installed globally, socket-patch scan -g --mode agent --yes --json exits 0 with warning vendored_ownership_retained, and $NPM_CONFIG_PREFIX/lib/node_modules/left-pad stays unpatched.

Expected vs actual

• Expected: --global means "Operate on globally-installed packages" (CLI_CONTRACT.md, Global arguments). Global targeting has "no project lockfile to rewire" (Mode resolution: --mode hosted with --global is a usage error for exactly that reason). Lockfile discovery explicitly excludes global scans ("Global scans (--global) get no supplement"). So the hosted and vendored legs of rollback/remove should not run under -g, and a cwd vendor ledger shouldn't decide ownership of a global copy. A -g rollback should touch only the global tree (plus the manifest records for it).
• Actual: the full-state rollback's vendored leg (run_vendored_leg) and hosted leg (run_hosted_leg) run unconditionally against --cwd, whatever --global / --global-prefix says. remove -g shares the hosted leg and revert_vendored_matches.

OS × vlt matrix (main 2463257)

Every cell is rollback -g and remove -g for both a hosted and a vendored vlt project. The project lock is rewritten, .socket/vendor is deleted, node_modules/left-pad goes missing, and the exit is 0.

npm 10 projects (package-lock.json, hosted and vendored) on Linux also reproduce: the lock is rewritten, exit 0.

First bad commit

Bisected on an npm project (vlt support didn't exist yet), local, 2/2 runs each:

So it's a v5 regression from #231, which added the vendored and hosted legs to the default rollback.

Suspect code

• crates/socket-patch-cli/src/commands/rollback.rs:1506-1530: the vendored leg (run_vendored_leg, :865) and the hosted leg (run_hosted_leg, :959) run with no common.global / common.global_prefix check.
• crates/socket-patch-cli/src/commands/remove.rs:728 (revert_vendored_matches) and its use of run_hosted_leg: same.
• The vendor-ownership skip in the agent apply path, which consults the cwd ledger under -g (vendored_ownership_retained).

Related

• get -g --mode hosted|vendored and scan -g --mode vendored rewrite the current project's yarn.lock instead of refusing, leaving the global copy unpatched #436 (yarn classic) covers get -g --mode hosted|vendored and scan -g --mode vendored rewiring the project. That's a different command path (explicit mode on get/scan), but it's the same family: -g falling through to cwd project state.

Probe run: https://github.com/SocketDev/socket-patch/actions/runs/36834317384 (3 OS × vlt 1.0.10 / 1.2.0 / 1.3.3; OBS bug.* lines). The Windows default-prefix -g failures in that run are #434. The readonly.* FAILs are a probe artifact (the runner user owns the files).