Bug hunt ledger: Yarn Berry (2+)

[Mikola Lysenko (mikolalysenko)]

[agent] Progress ledger for the scheduled Yarn Berry (2+) bug-hunt routine (label pm:yarn-berry).

Last updated: 2026-10-02 (run 7), main 61cfb9b (CLI still reports 4.0.0), latest release 4.0.0 (previous 3.3.0).

Harness: yarn bundles come from npm @yarnpkg/cli-dist@<v> (node package/bin/yarn.js), because corepack's fetch can't use the sandbox proxy. Yarn 4 needs YARN_HTTPS_CA_FILE_PATH; yarn 2/3 need YARN_CA_FILE_PATH. The npm registry has 2.4.2 as the last 2.x in cli-dist. Agent and vendored cells hand-stage .socket/manifest.json plus blobs (a marker prepended to index.js). Hosted cells use a local Python mock (fresh-checkout copies must keep .socket/ for vendored cells) of the patch API (batch, by-package, patches/package with a yarn-berry-zip yarnBerry10c0 artifact, view, and the tarball route). The 10c0 checksum is bootstrapped with a real yarn resolutions: file: install. Every hosted and vendored cell ends in a fresh-checkout yarn install --immutable. v5: hosted rollback/remove need the mock's /upstream/npm/<uuid>.json route, SOCKET_NPM_REGISTRY pointed at a local registry passthrough (the rustls binary can't use the sandbox proxy CA), and --patch-server-url <mock> so the pins count as hosted. Global (-g) cells use real npm global installs (NPM_CONFIG_PREFIX) and a Python mock of the authenticated API (--api-url <mock> --api-token x --org org; blob route /v0/orgs/org/patches/blob/<sha256>). v5 vendored mode downloads from the vendoring service: the same mock's /patches/package with a granted tarball artifact (real sha512) is enough, and an optional per-patch status override (for example pending_build) is supported. A corepack shim (corepack yarn@X → node <cli-dist X>/bin/yarn.js, setting the CA env itself because the harness scrubs YARN_*) runs the repo's berry e2e suites in the sandbox (SOCKET_PATCH_YARN_E2E_REQUIRED=1, SOCKET_PATCH_YARN_BERRY_VERSION=<v>). setup was removed in v5. On GH runners, fixture installs need YARN_ENABLE_IMMUTABLE_INSTALLS=false (CI turns immutable on).

Coverage matrix

Cells are "pass", "fail #N", "refused (by design)" or "untested". Linker is node-modules unless noted.

OS	yarn	Agent apply / rollback	Vendored	Hosted	setup hook
Linux	2.4.2 (cacheKey 7)	pass on 61cfb9b (node-modules: apply, vex, rollback byte-exact and idempotent)	untested	refused (by design) redirect_yarn_berry_cache_unsupported	untested
Linux	3.8.7 (cacheKey 8)	pass on 61cfb9b: node-modules and pnpm linker (transitive dep in .store, real dirs), apply/vex/rollback byte-exact	refused (by design) vendor_yarn_berry_cache_unsupported	refused (by design)	untested
Linux	4.0.2 (bare-hex checksums)	pnpm linker: fail #495 (store-only transitive dep); repo e2e suites pass on 61cfb9b	PnP lock-only: fail #539 (re-run)	pass (left-pad, v5 rollback byte-exact); fail #368 (resolve); fail #404	removed in v5
Linux	4.12.0	pass on f6b7fb9 (node-modules and pnpm linkers, rollback byte-exact). On 61cfb9b: pass for direct deps (pnpm linker, root and scoped) and hoisted transitive deps; fail #495 (pnpm-linker transitive dep only in .store/<slug>/package); repo e2e suites pass	pass on 61cfb9b: pnpm linker (in-place + fresh --check-cache, --revert byte-exact); PnP lock-only checkout vendors and loads patched bytes, but re-run after install fails #539 (also 4.0.2, 4.18.1); zero-install committed cache → YN0056 (docs gap). package.json tab / 4-space / BOM / CRLF+tab / no trailing newline / existing or empty resolutions (fresh immutable + --revert byte-exact); mixed-EOL yarn.lock refused loudly (vendor_yarn_berry_mixed_line_endings). pass on f6b7fb9: root, scoped root name, scoped target, **/ glob resolution, workspaces, pnpm linker, re-run idempotent, --revert, in-place immutable install. pass on v5: root, workspaces + enableImmutableInstalls: true (--revert and remove byte-exact), CRLF lock + package.json. Refused (by design): resolve/typescript (patch: builtin), yarn 3. fail #370 (commented compressionLevel). fail #369 (hosted→vendored via scan/get --mode vendored; vendor itself is fixed on v5). fail #468 (vendored→hosted with no yarnBerry10c0)	pass: left-pad, pnpm linker + vex, rollback byte-exact; 61cfb9b: rollback and remove byte-exact for npm:^1.3.0, dev-only and optional-only descriptors; v5 main: npm:1.3.0 / npm:^1.3.0 descriptors, dev-only and optional-only deps, mixed-case name JSONStream (case-kept purl, also on 4.18.1), mixed-EOL lock refused loudly, scoped, CRLF, workspaces merged-range, re-scan idempotent, manifest-less rollback/remove/list byte-exact, PnP lock-only checkout, upgrade path (uuid A→B re-pin, then rollback byte-exact), hardened mode accepts __archiveUrl pins, vendored→hosted takeover (checksum present; pending_build stays vendored). fail #368 (resolve, typescript, user yarn patch). fail #404 (registry token sent to patch host). fail #369 (hosted→vendored takeover). fail #370. Refused (by design): PnP (yarn_pnp_unsupported), direct + alias merged entry (redirect_yarn_berry_ambiguous_entry). PnP stale .pnp.cjs + hosted pin → standalone vex attests unpatched copy: fail #519 (yarn-classic issue; berry evidence commented, also 4.0.2 and 4.18.1)	pass on f6b7fb9; removed in v5
Linux	4.18.1 (latest)	pnpm linker: fail #495; repo e2e suites pass on 61cfb9b	pass on f6b7fb9 (CRLF-respelled lock + package.json); v5: fail #468; PnP lock-only: fail #539 (re-run)	pass (left-pad, scoped, lock version: 10); fail #368; fail #370; fail #404; fail #468	removed in v5
macOS	4.12.0, 4.18.1	untested	untested	pass (left-pad); fail #368; fail #369 (probe run 36764922521)	untested
Windows	4.12.0, 4.18.1 (yarn writes CRLF)	untested	untested	pass (left-pad, CRLF lock); fail #368; fail #369 (probe run 36764922521)	untested

Global (-g) cells. Berry has no global dir, so these are npm-prefix globals scanned from inside or outside a Berry project:

OS	yarn	scan -g report (inside/outside a Berry project)	-g hosted refusal	-g apply / rollback / vex
Linux	2.4.2, 3.8.7, 4.0.2, 4.12.0, 4.18.1	fail #440 (project global script runs); otherwise pass, no project leak (node-modules, pnpm, PnP)	pass (exit 2, nothing written)	pass on 4.12.0 (byte-exact rollback, vex not_applied after reinstall, EACCES loud, --global-prefix with space and unicode)
macOS	2.4.2, 3.8.7, 4.12.0, 4.18.1	fail #440 (probe run 36828589815)	untested	untested
Windows	2.4.2, 3.8.7, 4.12.0, 4.18.1	pass for #440 (.cmd shim not run)	untested	untested

Backlog

1. Blocked on a maintainer: the git proxy drops probe-branch deletes, so no new probes. Stale branches bughunt/yarn-berry/20260930-builtin-patch-takeover and bughunt/yarn-berry/20261001-global-script need deleting by hand. After that, probe Yarn 4 pnpm linker: transitive packages that live only in node_modules/.store are "not installed" in agent mode and stay unpatched #495 (Windows junctions), Vendored → hosted takeover on yarn berry deletes the vendored patch, then skips the hosted rewrite when the grant has no yarnBerry10c0 checksum, and still exits 0 "fully hosted" #468, Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369 and Vendored yarn berry PnP refusal keys only on .pnp.cjs: a lock-only PnP checkout vendors successfully, then every re-run in an installed checkout fails exit 1 with vendor_yarn_berry_unsupported #539 on macOS/Windows.
2. Re-triage when the fix PRs land: Fix berry mode takeover reverting before gates (#468, #369) #470 (Vendored → hosted takeover on yarn berry deletes the vendored patch, then skips the hosted rewrite when the grant has no yarnBerry10c0 checksum, and still exits 0 "fully hosted" #468, Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369), Fix yarnrc compressionLevel comment refusal (#370) #508 (Yarn berry vendored and hosted modes refuse compressionLevel: 0 # comment in .yarnrc.yml as a non-default compression level #370), Fix yarn berry hosted pin leaking npm auth (#404) #465 (Hosted yarn berry redirect makes yarn send the project's npm registry auth token to the patch host #404), Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 (scan -g inside a Yarn Berry project runs the project's global package.json script and scans whatever directory it prints as a global install #440), Fix npm crawler missing Bun, Deno and Yarn 4 stores (#366, #373, #405, #495) #496 (Yarn 4 pnpm linker: transitive packages that live only in node_modules/.store are "not installed" in agent mode and stay unpatched #495). Hosted yarn berry redirect of resolve/typescript (yarn builtin compat patch) reports success, then every yarn install --immutable fails YN0028 #368 and Vendored yarn berry PnP refusal keys only on .pnp.cjs: a lock-only PnP checkout vendors successfully, then every re-run in an installed checkout fails exit 1 with vendor_yarn_berry_unsupported #539 have no PR yet.
3. Maintainer request (partly done): global (-g) mode. Linux is covered (see the global table). Remaining: macOS and Windows -g apply/rollback/vex and the hosted refusal (probe), and a version-manager prefix (nvm/volta under $HOME). Full checklist in the 20261001T040000Z entry.
4. Vendored PnP workspaces and a vendored upgrade (uuid A→B) from a lock-only PnP checkout; takeovers into hosted after a vendored revert with version drift.
5. Unconfirmed lead: a lower-cased npm purl from the API (pkg:npm/jsonstream@1.3.5) for a mixed-case package is missed by every mode (agent skips with exit 1; hosted/vendored *_entry_not_found). File it (cross-PM, npm crawler) only if the real API is shown to lower-case.
6. Private npmRegistryServer plus npmAlwaysAuth for hosted (Hosted yarn berry redirect makes yarn send the project's npm registry auth token to the patch host #404 follow-up).

Known non-bugs

• Yarn 2/3 (cacheKey 7/8) are refused by hosted and vendored mode (documented).
• PnP projects with a .pnp.cjs are refused in every mode with yarn_pnp_unsupported (documented).
• Vendoring a package yarn builtin-patches (resolve, typescript, fsevents) is refused fail-closed with vendor_override_conflict. It's loud and closed, so it isn't filed (the hosted counterpart is Hosted yarn berry redirect of resolve/typescript (yarn builtin compat patch) reports success, then every yarn install --immutable fails YN0028 #368).
• Hosted refuses an entry that merges a direct descriptor with an npm: alias ("left-pad@npm:1.3.0, lp@npm:left-pad@1.3.0") with redirect_yarn_berry_ambiguous_entry and exit 1. It's fail-closed and loud; arguably over-broad, but not filed.
• Agent mode: a later yarn install --immutable in the same tree doesn't restore unpatched bytes (yarn's install-state), and the setup hook re-patches after a clean install. Standalone vex in agent mode needs setup or setup.manual (documented).
• patches-api.socket.dev is unreachable from the sandbox; use the mock.
• A BOM'd yarn.lock fails yarn install --immutable (YN0028) on its own, because yarn strips the BOM. Not caused by socket-patch.
• Hosted on a berry npm: alias-only entry → redirect_yarn_berry_alias_skipped (documented in docs/ecosystems.md).
• scan <workspace-member-dir> finds 0 packages: hosted/vendored PATHs are project dirs, and members share the root's lock (CLI_CONTRACT "exclude it with ignorePackages, not paths").
• PnP with .pnp.cjs: scan reports 0 packages with a PnP warning (same in 4.0.0). A PnP lock-only checkout gets hosted pins, and those install correctly under PnP.
• v5 rollback/remove/list treat only patch.socket.dev (or --patch-server-url) URLs as hosted pins. Without that flag, a mock host reads as "Manifest not found".
• PnP on yarn 2.x (.pnp.js) and 3.x is detected and gets the loud PnP warning in every mode, exit 0 (same as 4.x).
• An agent-mode re-run (scan -g --mode agent) after a failed apply (EACCES) exits 0 with "already recorded … run socket-patch apply". This is the designed re-run message; apply -g itself exits 1.
• The report-only hint after scan -g doesn't mention -g. It's cross-PM and was handed to npm (Bug hunt ledger: npm #302), so it isn't filed here.
• Yarn 4 hardened mode (enableHardenedMode, auto-on for public fork PRs in GitHub Actions) accepts a hosted ::__archiveUrl= lock pin, as does --check-resolutions (4.12.0, registry reachable).
• Zero-install (enableGlobalCache: false with .yarn/cache committed): hosted mode is lock-only, so the committed cache keeps the unpatched zip, and yarn install --immutable --immutable-cache fails YN0056 until yarn install refreshes the cache. Vendored mode behaves the same way (the file: entry has no cache zip; no warning). It's a docs gap, not filed.
• compressionLevel set outside the project .yarnrc.yml (env, home or parent rc) can't cause a wrong checksum: yarn bakes the level into the lock's cacheKey, which both modes gate on.
• Vendored refuses a user yarn patch (patch: descriptor) with vendor_override_conflict, plus an alias-only dependency (root or workspace member) with vendor_lock_entry_not_found, a merged direct + alias entry, and a user-authored resolutions key for the target. All are loud and closed with nothing written, so none are filed.
• Mixed CRLF/LF yarn.lock is refused by vendored (vendor_yarn_berry_mixed_line_endings) and hosted (redirect_yarn_berry_mixed_line_endings). That's correct: yarn itself fails YN0028 on such a lock.
• v5 rollback drops the patch's manifest entry, so a later apply is a no-op (designed).
• A berry install rewrites a BOM'd, compact, or no-trailing-newline package.json. Vendored snapshots the post-install bytes and reverts to them byte-exactly.

[github-actions[bot]]

[agent] 2026-09-30: Yarn Berry (2+) bug-hunt run

Tested: main f6b7fb9 (CLI 4.0.0 workspace version), latest release 4.0.0 (previous 3.3.0, both from npm for comparison). Yarn 2.4.2, 3.8.7, 4.0.2, 4.12.0 and 4.18.1 (the current latest) from @yarnpkg/cli-dist, on Node 22. Patch data is a hand-staged .socket/manifest.json plus blobs (agent and vendored mode) and a local Python mock of the patch API with a bootstrapped 10c0 checksum (hosted mode). No secrets.

This is the first run: no earlier ledger, and no pm:yarn-berry issues to re-triage.

Cells

• fail Hosted yarn berry redirect of resolve/typescript (yarn builtin compat patch) reports success, then every yarn install --immutable fails YN0028 #368: hosted scan --mode hosted of resolve@1.22.8 / typescript@5.4.5 (packages yarn builtin-patches, optional!builtin<compat/…>). It exits 0 with success and VEX not_affected, and then every fresh yarn install --immutable fails YN0028. Linux on 4.0.2, 4.12.0 and 4.18.1; macOS and Windows probe on 4.12.0 and 4.18.1. Release 4.0.0 has the same bug.
• fail Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369: the hosted→vendored takeover (vendor) reverts the hosted redirect, then per-package vendoring refuses (vendor_override_conflict: a second left-pad version in a workspace). The package ends up unpatched in both modes. Linux, macOS and Windows; release 4.0.0 has the same bug.
• fail Yarn berry vendored and hosted modes refuse compressionLevel: 0 # comment in .yarnrc.yml as a non-default compression level #370: compressionLevel: 0 # comment in .yarnrc.yml is refused as a non-default compression level, in vendored and hosted mode (4.12.0, 4.18.1; release 4.0.0 too).
• pass, vendored (4.12.0): root, scoped root workspace name, scoped target, **/ glob resolution present, workspaces (member dep), pnpm linker, re-run idempotent (already_vendored), --revert, in-place --immutable install after vendor. 4.18.1: CRLF-respelled lock + package.json.
• pass, hosted: left-pad on 4.0.2 / 4.12.0 / 4.18.1 (fresh --immutable gets the patched bytes); pnpm linker + standalone vex; rollback byte-exact (lock + package.json), including after a resolve redirect; Windows CRLF locks (probe).
• pass, agent: apply / rollback on node-modules and pnpm linkers (byte-exact); setup postinstall hook re-patches on a clean install; setup --remove byte-exact.
• refused, as designed: yarn 2.4.2 / 3.8.7 (cacheKey 7/8) in hosted and vendored; PnP with .pnp.cjs (yarn_pnp_unsupported); vendoring a builtin-patched package (vendor_override_conflict); hosted with a merged direct + npm: alias entry (redirect_yarn_berry_ambiguous_entry).

Issues

• Filed Hosted yarn berry redirect of resolve/typescript (yarn builtin compat patch) reports success, then every yarn install --immutable fails YN0028 #368, Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369 and Yarn berry vendored and hosted modes refuse compressionLevel: 0 # comment in .yarnrc.yml as a non-default compression level #370.

False positives ruled out

• The first probe run (36763523523) failed because of my harness, not the product. GH runners set CI, so yarn made the fixture install immutable; also, Windows tar parses D:\… as a remote host. Fixed in the rerun.
• Agent-mode rollback "failing" was a fixture without the before-blob. With the blob staged, it's byte-exact.
• An agent-mode yarn install --immutable in the same tree keeping the patched bytes is yarn's install-state behaviour, not a socket-patch problem.

Probe

• bughunt/yarn-berry/20260930-builtin-patch-takeover, run https://github.com/SocketDev/socket-patch/actions/runs/36764922521 (ubuntu, macos and windows × yarn 4.12.0 and 4.18.1). The branch could not be deleted: git push --delete got "remote end hung up" three times, and the REST ref delete returned 403. A maintainer needs to delete it.

Next

1. Yarn 2/3 agent and vendored cells; get --mode hosted|vendored front doors.
2. Zero-install .yarn/cache interplay (--immutable-cache after hosted or vendored), and PnP lock-only checkouts with no .pnp.cjs.
3. The vendored→hosted takeover mirror of Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369, and whether yarn classic / npm share the per-target takeover gap.
4. compressionLevel from env / home / parent .yarnrc.yml, and quoted keys.
5. macOS/Windows cells for vendored and agent mode.

[github-actions[bot]]

[agent] 2026-10-01: Yarn Berry (2+) bug-hunt run

Tested: main 2463257 (the v5 consolidation, #277; the CLI still reports 4.0.0), against release 4.0.0 from npm. Yarn 4.0.2, 4.12.0 and 4.18.1 from @yarnpkg/cli-dist, on Node 22, Linux only. Hosted cells use a local Python mock of the patch API (batch, by-package, patches/package, view, the tarball route, and the new v5 /upstream/npm/<uuid>.json route). Rollback needs that route plus SOCKET_NPM_REGISTRY pointed at a local registry passthrough, because the rustls binary can't reach the registry through the sandbox proxy. Rollback, remove and list need --patch-server-url <mock>, or the pins aren't recognised as hosted.

Re-triage

• Hosted yarn berry redirect of resolve/typescript (yarn builtin compat patch) reports success, then every yarn install --immutable fails YN0028 #368: still reproduces on v5 main (resolve, YN0028). New: user yarn patch entries (patch:…#./.yarn/patches/x.patch) break the same way for any package. Commented: Hosted yarn berry redirect of resolve/typescript (yarn builtin compat patch) reports success, then every yarn install --immutable fails YN0028 #368 (comment)
• Yarn berry vendored and hosted modes refuse compressionLevel: 0 # comment in .yarnrc.yml as a non-default compression level #370: still reproduces (compressionLevel: 0 # default is refused). Commented: Yarn berry vendored and hosted modes refuse compressionLevel: 0 # comment in .yarnrc.yml as a non-default compression level #370 (comment)
• Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369: not re-checked. Vendored mode in v5 needs a vendoring-service mock (--vendor-url), which isn't built yet.

Cells

• fail Hosted yarn berry redirect makes yarn send the project's npm registry auth token to the patch host #404 (new): a hosted ::__archiveUrl= pin makes yarn send the npm registry Authorization: Bearer token to the patch host. This happens for scoped packages whenever an npmAuthToken / YARN_NPM_AUTH_TOKEN / npmScopes token is set, and for all packages under npmAlwaysAuth: true. Seen on 4.0.2, 4.12.0 and 4.18.1.
• pass, hosted (v5 main): left-pad on 4.0.2 (bare-hex), 4.12.0 and 4.18.1 (lock version: 10); a scoped package; CRLF lock + package.json; re-scan idempotent; workspaces with a merged-range entry (left-pad@npm:1.3.0, left-pad@npm:^1.3.0); a PnP lock-only checkout (hosted pin, then a fresh PnP install loads the patched bytes).
• pass, v5 manifest-less rollback / remove / list: byte-exact upstream restore on 4.0.2, 4.12.0, CRLF and workspaces (including after a resolve redirect); per-purl remove; list shows the hosted pins; rollback under PnP with .pnp.cjs present.
• documented / not a bug: npm: alias-only entry → redirect_yarn_berry_alias_skipped; scan packages/a on a workspace member finds nothing (contract: PATH is a project dir, members share the root's lock); PnP with .pnp.cjs → scan reports 0 packages with a PnP warning, the same as release 4.0.0.

False positives ruled out

• A BOM'd yarn.lock fails --immutable YN0028 because yarn itself strips the BOM. It does that on the untouched lock too.
• The first rollback "Manifest not found" came from my harness: the mock host isn't recognised as hosted without --patch-server-url.
• 4.18.1 installs against a lock written by 4.12 fail YN0028 (lock version: 8 → 10). That's yarn's own migration.

Probe

• No new probe branch this run. The stale bughunt/yarn-berry/20260930-builtin-patch-takeover still can't be deleted (git push --delete hangs up again), so a maintainer needs to delete it.

Next

1. Build a vendoring-service mock (--vendor-url) and re-run the v5 vendored cells, Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369, and the takeovers.
2. Probe branch: Hosted yarn berry redirect makes yarn send the project's npm registry auth token to the patch host #404 token capture on macOS/Windows, and yarn 4.x with npmRegistryServer pointing at a private registry.
3. Hosted upgrade path (a superseding uuid for a pinned dep), then rollback through the new uuid's upstream metadata.
4. Zero-install committed .yarn/cache after hosted/rollback (stale zips, --immutable-cache).
5. compressionLevel from env / home .yarnrc.yml.

[github-actions[bot]]

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major Yarn Berry (2+) version and on Linux, macOS and Windows.

Where Yarn Berry (2+) puts global installs: Berry has no yarn global; yarn dlx caches don't persist. Check that -g on a Berry-only machine discovers nothing from the project's .yarn/cache or PnP, is clean and loud about it, and still finds the npm/pnpm globals that sit next to it.

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed Yarn Berry (2+) package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a Yarn Berry (2+) project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × Yarn Berry (2+) version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

[github-actions[bot]]

[agent] 2026-10-01: Yarn Berry (2+) bug-hunt run

Tested: main 2463257 (unchanged since the last run; the CLI reports 4.0.0), against release 4.0.0 from npm. Yarn 2.4.2, 3.8.7, 4.0.2, 4.12.0 and 4.18.1 from @yarnpkg/cli-dist, on Node 22 on Linux. macOS and Windows were covered by a probe branch. This run worked the maintainer's global (-g) request. It used real npm global installs (NPM_CONFIG_PREFIX, under a prefix whose path has a space and a ü) and a local Python mock of the authenticated patch API (batch, by-package, view, blob).

Re-triage

• Hosted yarn berry redirect of resolve/typescript (yarn builtin compat patch) reports success, then every yarn install --immutable fails YN0028 #368, Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369, Yarn berry vendored and hosted modes refuse compressionLevel: 0 # comment in .yarnrc.yml as a non-default compression level #370 and Hosted yarn berry redirect makes yarn send the project's npm registry auth token to the patch host #404 weren't re-run. Main hasn't moved since the 2026-10-01 01:14Z run, which re-checked Hosted yarn berry redirect of resolve/typescript (yarn builtin compat patch) reports success, then every yarn install --immutable fails YN0028 #368 and Yarn berry vendored and hosted modes refuse compressionLevel: 0 # comment in .yarnrc.yml as a non-default compression level #370, so there's nothing new to report.

Cells (global mode)

• fail scan -g inside a Yarn Berry project runs the project's global package.json script and scans whatever directory it prints as a global install #440 (new): scan -g run from inside a Berry project calls yarn global dir. Berry turns that into yarn run global dir, so it runs the project's "global" script and scans whatever directory the script prints as a global install. This reproduces on Linux and macOS with yarn 2.4.2, 3.8.7, 4.12.0 and 4.18.1, under the node-modules and PnP linkers, with SOCKET_GLOBAL=1, and on release 4.0.0. It doesn't reproduce on Windows, because Command::new("yarn") doesn't resolve yarn.cmd. Probe run: https://github.com/SocketDev/socket-patch/actions/runs/36828589815
• pass: scan -g report-only with no --mode (finds the global zz-global-pkg; --json scannedPackages and packages are correct). Run inside node-modules, pnpm and PnP Berry projects, it gives the same result as outside, with no project packages leaking in. scan without -g never touches the global copy.
• pass: scan -g --mode hosted, scan --global-prefix <dir> --mode hosted and SOCKET_GLOBAL=1 scan --mode hosted all refuse with exit 2 and write nothing.
• pass: scan -g --mode agent, get -g (defaults to agent), apply -g (idempotent) and rollback -g (byte-exact sha256, twice) on the real global copy. --global-prefix and SOCKET_GLOBAL_PREFIX behave the same, on a path with a space and unicode.
• pass: vex -g attests while the patch is applied. After npm i -g --force restores unpatched bytes, it omits the package (not_applied) and exits 1.
• pass: a root-owned prefix with a non-root user (setpriv uid 65534). scan -g --mode agent fails loudly (EACCES, exit 1), and so does apply -g.
• pass: agent mode on yarn 2.4.2 and 3.8.7 with the node-modules linker (apply, then rollback restores the bytes). PnP on 2.4.2 (.pnp.js) and 3.8.7 gets the loud PnP warning in every mode (documented).

Observations not filed

• A re-run of scan -g --mode agent after the EACCES failure exits 0 with "already recorded … run socket-patch apply" while the package is still unpatched. It's the designed agent-mode re-run message, the same in project mode, and not Berry-specific.
• The report-only hint after scan -g says socket-patch scan --mode agent [PATHS] without -g, so following it targets the project, not the globals. It applies to every package manager, so it's handed over to npm (Bug hunt ledger: npm #302).
• Windows: yarn global dir is never run, because of the .cmd shim, so yarn classic's global dir is probably never discovered on Windows. Handed over to yarn-classic (Bug hunt ledger: Yarn classic (1.x) #304).

Probe branches

• bughunt/yarn-berry/20261001-global-script (run 36828589815). Deletion failed: the git proxy answers git push --delete with HTTP 403. bughunt/yarn-berry/20260930-builtin-patch-takeover still can't be deleted either. A maintainer needs to delete both.

Next

1. Global mode, rest of the checklist: macOS and Windows apply/rollback for -g (probe), and a version-manager prefix (nvm/volta layout under $HOME).
2. Build a vendoring-service mock (--vendor-url) and re-run the v5 vendored cells and Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369.
3. Probe Hosted yarn berry redirect makes yarn send the project's npm registry auth token to the patch host #404 on macOS and Windows; private npmRegistryServer plus npmAlwaysAuth.
4. Hosted upgrade path (a superseding uuid) plus rollback through the new uuid's upstream metadata.
5. Zero-install committed .yarn/cache after hosted/rollback; compressionLevel from env or ~/.yarnrc.yml.

[github-actions[bot]]

[agent] 2026-10-01: Yarn Berry (2+) bug-hunt run

Tested: main 2463257 (unchanged; the CLI reports 4.0.0), against release 4.0.0 from npm. Yarn 4.0.2, 4.12.0 and 4.18.1 from @yarnpkg/cli-dist, on Node 22 on Linux. No probe branches this run: the new finding is platform-independent, and the git proxy still refuses branch deletes.

Harness, new this run: the Python patch-API mock now also serves the v5 vendoring service. /patches/package returns a granted tarball artifact with a real sha512 plus the yarn-berry-zip artifact, and a status override (pending_build and so on). With the mock's upstream and registry routes, one mock drives scan --mode vendored, get --mode vendored, hosted, rollback and both takeovers. A corepack shim on PATH (corepack yarn@X → node <cli-dist X>/bin/yarn.js) should let the repo's own berry e2e suites run in the sandbox. It was built but not exercised yet.

Re-triage

• Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369 commented (Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369 (comment)). It still reproduces on v5 through scan --mode vendored and get <uuid> --mode vendored (the hosted pin is restored to the registry, then vendor_override_conflict, exit 1, patched in neither mode). vendor with no manifest (the v5 eject path) now refuses first and keeps the hosted pin.
• Hosted yarn berry redirect makes yarn send the project's npm registry auth token to the patch host #404 has a fix in flight (draft PR Fix yarn berry hosted pin leaking npm auth (#404) #465, not merged), so I didn't re-run it. Hosted yarn berry redirect of resolve/typescript (yarn builtin compat patch) reports success, then every yarn install --immutable fails YN0028 #368, Yarn berry vendored and hosted modes refuse compressionLevel: 0 # comment in .yarnrc.yml as a non-default compression level #370 and scan -g inside a Yarn Berry project runs the project's global package.json script and scans whatever directory it prints as a global install #440 weren't re-run (main is unchanged).

Cells

• fail Vendored → hosted takeover on yarn berry deletes the vendored patch, then skips the hosted rewrite when the grant has no yarnBerry10c0 checksum, and still exits 0 "fully hosted" #468 (new): Vendored → hosted takeover on yarn berry deletes the vendored patch, then skips the hosted rewrite when the grant has no yarnBerry10c0 checksum, and still exits 0 "fully hosted" #468. The vendored → hosted takeover reverts the vendored wiring, artifact and ledger, and only then does the berry rewriter skip the package because the grant has no yarnBerry10c0 (redirect_yarn_berry_missing_checksum). The run reports exit 0, success, redirected: 0, and claims "the project is now fully hosted for this package". After that, a fresh immutable install is unpatched and vex says manifest_not_found. Reproduces on yarn 4.0.2, 4.12.0 and 4.18.1.
• pass: the vendored → hosted takeover when the grant has the checksum (redirects 1, fresh immutable install patched).
• pass: the vendored → hosted takeover with the hosted reference pending_build. It stays vendored and exits 0 with redirected 0 and no warning, which is quiet but correct.
• pass: the hosted upgrade path. A lock pinned to uuid A, with the API now serving uuid B: re-scan re-pins to B, a fresh install --immutable --check-cache installs B's bytes, and vex attests. Then rollback (through B's /upstream metadata) restores the pre-hosted registry lock byte-exact.
• pass (v5 vendored, first v5 cells): root vendoring with scan --mode vendored (resolutions file: plus the lock entry; fresh install --immutable --check-cache patched). A workspace with ^1.3.0 and 1.3.0 members, with enableImmutableInstalls: true in .yarnrc.yml: vendor, then the fresh install patched, then vendor --revert byte-exact, then re-vendor and remove <purl> byte-exact. A CRLF lock and package.json: vendor keeps CRLF and the revert is byte-exact.
• pass (not a bug): hardened mode. A lock with a ::__archiveUrl= resolution passes YARN_ENABLE_HARDENED_MODE=1 yarn install --immutable and --check-resolutions on 4.12.0, with the registry reachable.
• observation, not filed: zero-install (enableGlobalCache: false with .yarn/cache committed). Hosted rewrites only yarn.lock, so the committed cache keeps the unpatched zip. yarn install --immutable --immutable-cache, yarn's recommended zero-install CI check, then fails YN0056 ("Cache entry required but missing"). A plain --immutable fetches the patched zip and swaps the cache files. This is a docs gap (hosted is documented as lock-only, and the zero-install cache isn't mentioned), not a defect.

Ruled out

• compressionLevel from YARN_COMPRESSION_LEVEL, ~/.yarnrc.yml or a parent rc: yarn bakes the level into the lock's cacheKey (10c<level>, 10 for mixed), and both modes already gate on cacheKey, so the project-rc-only read can't produce a wrong checksum. Low value; dropped from the backlog.

Next

1. Probe Vendored → hosted takeover on yarn berry deletes the vendored patch, then skips the hosted rewrite when the grant has no yarnBerry10c0 checksum, and still exits 0 "fully hosted" #468 and Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369 (scan --mode vendored) on macOS and Windows, once branch deletion works again (or accept stale branches).
2. Run the repo's berry e2e suites through the corepack shim on 4.0.2 / 4.12.0 / 4.18.1 as a regression baseline.
3. Global (-g) macOS/Windows apply/rollback/vex and a version-manager prefix (maintainer checklist).
4. Takeovers with other per-dep hosted refusals after a vendored revert (redirect_yarn_berry_entry_not_found after a version drift; scoped packages).
5. Yarn 2/3 agent-mode cells on the pnpm linker; PnP lock-only checkout with vendored mode.

[github-actions[bot]]

[agent] 2026-10-01: Yarn Berry (2+) bug-hunt run

Tested: main 61cfb9b (20 commits past 2463257, including #365 for the npm .store / pnpm virtualStoreDir crawler, #357 for the JSON writers' CRLF/BOM/indent handling, and #446 to keep -g off project state; the CLI still reports 4.0.0), against release 4.0.0 from npm. Yarn 3.8.7, 4.0.2, 4.12.0 and 4.18.1 from @yarnpkg/cli-dist, on Node 22 on Linux. No probe branches this run (the git proxy still refuses branch deletes).

Re-triage

• scan -g inside a Yarn Berry project runs the project's global package.json script and scans whatever directory it prints as a global install #440: still reproduces on 61cfb9b. scan -g inside a Berry project runs the project's global script; Fix -g touching the cwd project's state (#436, #445) #446 didn't touch the probe spawn, and fix PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 is still open. No comment (nothing new).
• Hosted yarn berry redirect makes yarn send the project's npm registry auth token to the patch host #404: fix PR Fix yarn berry hosted pin leaking npm auth (#404) #465 is still open (blocked on the hardened-mode decision), so I didn't re-run it. Hosted yarn berry redirect of resolve/typescript (yarn builtin compat patch) reports success, then every yarn install --immutable fails YN0028 #368, Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369, Yarn berry vendored and hosted modes refuse compressionLevel: 0 # comment in .yarnrc.yml as a non-default compression level #370 and Vendored → hosted takeover on yarn berry deletes the vendored patch, then skips the hosted rewrite when the grant has no yarnBerry10c0 checksum, and still exits 0 "fully hosted" #468: the berry redirect and vendor code is unchanged since the last run, so they weren't re-run.

Cells

• fail Yarn 4 pnpm linker: transitive packages that live only in node_modules/.store are "not installed" in agent mode and stay unpatched #495 (new): Yarn 4 pnpm linker: transitive packages that live only in node_modules/.store are "not installed" in agent mode and stay unpatched #495. On Yarn 4's pnpm linker, a transitive dependency lives only at node_modules/.store/<slug>-npm-<v>-<hash>/package, and the entry's node_modules/<name> is a symlink to ../package. Agent apply reports package_not_installed and leaves it unpatched, with exit 0 when other patches apply. It fails on 4.0.2, 4.12.0 and 4.18.1. Yarn 3.8.7 passes (its store entries are real dirs), and the node-modules linker passes as a control. Not a regression: 4.0.0 behaves identically. Fix npm crawler missing relocated dependency stores (#359, #362) #365's .store walk only handles npm's <name>@<v>-<hash>/node_modules/<name> real-dir layout. Suspect: npm_crawler.rs:1140 (is_real_package_dir_sync rejects the symlink).
• pass (regression baseline, first run through the corepack shim): the repo's e2e_yarn4_pnpm_linker_build, e2e_vendor_yarn_berry_build, e2e_redirect_yarn_berry_build, e2e_yarn4_workspaces_build and e2e_safety_yarn_pnp suites (87 tests per version), all green on 4.0.2, 4.12.0 and 4.18.1 with SOCKET_PATCH_YARN_E2E_REQUIRED=1 (no skips).
• pass: agent apply on the pnpm linker for direct deps (root and scoped @sindresorhus/is via .store/@sindresorhus-is-npm-…/package) on 61cfb9b: no double-count from the new .store walk.

Ruled out

• The new .store walk (Fix npm crawler missing relocated dependency stores (#359, #362) #365) doesn't regress yarn's direct-dependency resolution on the pnpm linker (each direct dep is applied once, through the importer link).

Harness notes

• Corepack shim: $S/shim/corepack maps corepack yarn@X … to node <cli-dist X>/bin/yarn.js and sets the CA env itself (the test harness scrubs YARN_*). With it, cargo test --release -p socket-patch-cli --test e2e_*yarn*berry* … runs fully in the sandbox; select the version with SOCKET_PATCH_YARN_BERRY_VERSION.

Next

1. Probe Yarn 4 pnpm linker: transitive packages that live only in node_modules/.store are "not installed" in agent mode and stay unpatched #495 on macOS and Windows (Windows junctions), plus vex and rollback for a store-only transitive dep on the pnpm linker.
2. Global (-g) macOS/Windows apply/rollback/vex and a version-manager prefix (maintainer checklist).
3. Probe Vendored → hosted takeover on yarn berry deletes the vendored patch, then skips the hosted rewrite when the grant has no yarnBerry10c0 checksum, and still exits 0 "fully hosted" #468 and Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369 on macOS/Windows.
4. Vendored-mode regression check of Fix JSON writers dropping CRLF/BOM/indent (#324, #351) #357 (JSON writers) on berry: a package.json with a BOM, tab indent or 4-space indent, plus resolutions round-trip and revert byte-exactness.
5. Takeovers with other per-dep hosted refusals after a vendored revert (version drift, scoped packages).

[github-actions[bot]]

[agent] 2026-10-02: handover from the Yarn classic (1.x) bug-hunt routine (#304)

Lead for yarn berry PnP, not verified with berry. In a yarn classic PnP project, standalone socket-patch vex attests a hosted patch as not_affected from the yarn.lock pin while .pnp.js still loads the unpatched copy. The pin got there from a lock-only checkout where no .pnp.* existed, so scan didn't refuse. Filed as #519. The cause isn't classic-specific: crates/socket-patch-cli/src/commands/vex.rs:603-611 excuses package_not_found into a lockfile-basis attestation whenever the purl's ecosystem was "crawled", with no check that a .pnp.* loader makes the npm tree invisible. A berry PnP project with a hosted ::__archiveUrl= pin and a stale .yarn/cache zip / .pnp.cjs probably attests the same way. Worth one cell: hosted pin from a lock-only checkout, then vex beside the old .pnp.cjs before yarn install.

[github-actions[bot]]

[agent] 2026-10-02: Yarn Berry (2+) bug-hunt run

Tested: main 61cfb9b (unchanged since the last run; the CLI reports 4.0.0), release 4.0.0. Yarn 2.4.2, 3.8.7, 4.0.2, 4.12.0 and 4.18.1 from @yarnpkg/cli-dist, on Node 22 on Linux. No probe branches: the git proxy still drops branch deletes (send-pack: unexpected disconnect), so the two stale probe branches remain and I didn't add more.

Re-triage

• I didn't re-run anything. Main hasn't moved, and every open pm:yarn-berry issue has an open fix PR (Hosted yarn berry redirect of resolve/typescript (yarn builtin compat patch) reports success, then every yarn install --immutable fails YN0028 #368: none yet; Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369/Vendored → hosted takeover on yarn berry deletes the vendored patch, then skips the hosted rewrite when the grant has no yarnBerry10c0 checksum, and still exits 0 "fully hosted" #468: Fix berry mode takeover reverting before gates (#468, #369) #470; Yarn berry vendored and hosted modes refuse compressionLevel: 0 # comment in .yarnrc.yml as a non-default compression level #370: Fix yarnrc compressionLevel comment refusal (#370) #508; Hosted yarn berry redirect makes yarn send the project's npm registry auth token to the patch host #404: Fix yarn berry hosted pin leaking npm auth (#404) #465; scan -g inside a Yarn Berry project runs the project's global package.json script and scans whatever directory it prints as a global install #440: Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442; Yarn 4 pnpm linker: transitive packages that live only in node_modules/.store are "not installed" in agent mode and stay unpatched #495: Fix npm crawler missing Bun, Deno and Yarn 4 stores (#366, #373, #405, #495) #496).

Handover from yarn-classic (#519)

• Reproduced on berry, so I commented on In a yarn classic Plug'n'Play project, vex attests a hosted patch as not_affected while the copy .pnp.js loads is still unpatched #519 instead of filing: In a yarn classic Plug'n'Play project, vex attests a hosted patch as not_affected while the copy .pnp.js loads is still unpatched #519 (comment). In a nodeLinker: pnp project installed from the registry lock, I pulled in a hosted ::__archiveUrl= lock from a lock-only checkout. Before yarn install, node -r ./.pnp.cjs still loads the unpatched bytes, but standalone vex attests not_affected "(redirected)" with exit 0. This held on 4.0.2, 4.12.0 and 4.18.1 (2/2 runs each), and the attestation only becomes true after yarn install --immutable. Root cause is the same as In a yarn classic Plug'n'Play project, vex attests a hosted patch as not_affected while the copy .pnp.js loads is still unpatched #519 (vex.rs:603-611). On berry, though, lock-basis attestation under PnP is documented (yarn-berry-compatibility.md:11), so the fix needs a stale-install check rather than a blanket "PnP ⇒ not crawled".

Cells (Linux)

• pass: vendored 4.12.0 with a package.json using tab indent, 4-space indent, a BOM, CRLF + tabs, no trailing newline, existing resolutions for another package, and an empty resolutions object. Every case got the fresh-checkout --immutable --check-cache patched bytes, the in-place immutable install, and a byte-exact --revert of package.json and yarn.lock. This is the Fix JSON writers dropping CRLF/BOM/indent (#324, #351) #357 regression check.
• pass: vendored mixed CRLF/LF yarn.lock → vendor_yarn_berry_mixed_line_endings (loud, nothing written; yarn itself fails YN0028 there). A mixed package.json vendors and installs fine. Hosted mixed lock → redirect_yarn_berry_mixed_line_endings.
• pass: hosted 4.12.0 with the descriptors npm:1.3.0, npm:^1.3.0, devDependencies-only and optionalDependencies-only. Fresh --immutable --check-cache got patched bytes and left the lock unchanged.
• pass: hosted 4.12.0 and 4.18.1 for a legacy upper-case name (JSONStream@1.3.5, with registry deps) when the purl keeps its case.
• pass: agent apply / vex / rollback on yarn 2.4.2 (node-modules) and 3.8.7 (node-modules and pnpm linker, .store/…/node_modules/left-pad real dir). Rollback is byte-exact and idempotent, and vex reports not_affected after apply and exits 1 after rollback.
• refused (fail-closed, loud): vendored user yarn patch (patch: descriptor) → vendor_override_conflict; vendored npm-alias-only (root or workspace member) → vendor_lock_entry_not_found; vendored merged direct + alias entry → vendor_override_conflict; vendored user resolutions key left-pad@npm:1.3.0 → vendor_override_conflict.

Ruled out

• Agent apply "applied: 2" for one purl came from my harness (a nested fresh/ checkout under the project), not a crawler double-count.
• JSONStream fresh-install failure was my harness too: the poisoned npmRegistryServer blocks its registry deps.
• Rollback "Before blob not found" happened because my harness didn't stage the before-blob.

Unconfirmed lead (not filed)

• If the patch API ever returns a lower-cased npm purl (pkg:npm/jsonstream@1.3.5, which the purl spec's npm rule suggests) for a legacy mixed-case package, every mode misses it: agent apply skips (exit 1), hosted gives redirect_yarn_berry_entry_not_found, vendored gives vendor_lock_entry_not_found. The crawler keeps the case (pkg:npm/JSONStream@1.3.5), and that end-to-end path passes. Whether the real API lower-cases is unknown from the sandbox, so I didn't file it. It's cross-PM (the npm crawler) if confirmed.

Next

1. Probe Yarn 4 pnpm linker: transitive packages that live only in node_modules/.store are "not installed" in agent mode and stay unpatched #495, Vendored → hosted takeover on yarn berry deletes the vendored patch, then skips the hosted rewrite when the grant has no yarnBerry10c0 checksum, and still exits 0 "fully hosted" #468 and Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369 on macOS/Windows once probe-branch deletes work again (a maintainer needs to delete bughunt/yarn-berry/20260930-builtin-patch-takeover and bughunt/yarn-berry/20261001-global-script).
2. Re-triage when PRs Fix berry mode takeover reverting before gates (#468, #369) #470, Fix yarnrc compressionLevel comment refusal (#370) #508, Fix yarn berry hosted pin leaking npm auth (#404) #465, Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 and Fix npm crawler missing Bun, Deno and Yarn 4 stores (#366, #373, #405, #495) #496 land.
3. Global (-g) macOS/Windows apply/rollback/vex, and a version-manager prefix (nvm/volta).
4. Hosted rollback/remove for npm: range and dev-only descriptors; vendored on the pnpm linker under v5.
5. Find out whether the patch API emits case-preserved npm purls (see the lead above).

[github-actions[bot]]

[agent] 2026-10-02: Yarn Berry (2+) bug-hunt run

Tested: main 61cfb9b (unchanged; the CLI reports 4.0.0), release 4.0.0. Yarn 4.0.2, 4.12.0 and 4.18.1 from @yarnpkg/cli-dist, Node 22, Linux. No probe branches: git push origin --delete still fails with send-pack: unexpected disconnect, so the two stale probe branches remain.

Re-triage

• I skipped it: main hasn't moved since the last run, and each open pm:yarn-berry issue still has its fix PR open (or, for Hosted yarn berry redirect of resolve/typescript (yarn builtin compat patch) reports success, then every yarn install --immutable fails YN0028 #368, no PR yet). No human replies on Bug hunt ledger: Yarn Berry (2+) #305.

Filed

• Vendored yarn berry PnP refusal keys only on .pnp.cjs: a lock-only PnP checkout vendors successfully, then every re-run in an installed checkout fails exit 1 with vendor_yarn_berry_unsupported #539: Vendored yarn berry PnP refusal keys only on .pnp.cjs: a lock-only PnP checkout vendors successfully, then every re-run in an installed checkout fails exit 1 with vendor_yarn_berry_unsupported #539. The vendored PnP refusal keys only on whether .pnp.cjs / .pnp.js / .pnp.loader.mjs exists, so a lock-only PnP checkout (default linker, or explicit nodeLinker: pnp) vendors with exit 0. The file: wiring works under PnP: a fresh --immutable --check-cache install passes, and node -r ./.pnp.cjs loads the patched bytes. After the install creates .pnp.cjs, every re-run of scan --mode vendored fails with exit 1 vendor_yarn_berry_unsupported ("nothing vendor could stage", which is false in v5). Reproduced 2/2 on 4.0.2, 4.12.0 and 4.18.1. vendor --revert (byte-exact), vendor --check and vex still work in the installed PnP tree. Suspect code: vendor/npm_flavor.rs:166, vendor/lock_inventory/view.rs:379.

Cells (Linux)

• pass: hosted 4.12.0 baseline (left-pad): fresh --immutable gets patched bytes, and rollback is byte-exact.
• pass: hosted rollback and remove on 4.12.0 for the descriptors npm:^1.3.0, devDependencies-only ^1.3.0 and optionalDependencies-only ~1.3.0 (6 cells). The lock came back byte-exact, reconstructed through /upstream/npm/<uuid>.json plus the registry passthrough (7/7 hits logged), and a fresh --immutable --check-cache reinstalls the registry bytes.
• pass: vendored on the pnpm linker under v5 (4.12.0): in-place and fresh --immutable --check-cache both get patched bytes, and --revert is byte-exact.
• pass (with Vendored yarn berry PnP refusal keys only on .pnp.cjs: a lock-only PnP checkout vendors successfully, then every re-run in an installed checkout fails exit 1 with vendor_yarn_berry_unsupported #539): vendored on a PnP lock-only checkout works end to end, but the gate is inconsistent (see Vendored yarn berry PnP refusal keys only on .pnp.cjs: a lock-only PnP checkout vendors successfully, then every re-run in an installed checkout fails exit 1 with vendor_yarn_berry_unsupported #539).
• docs gap, not filed: vendored with zero-install (enableGlobalCache: false, committed .yarn/cache). The cache keeps the registry zip, so a fresh --immutable --immutable-cache fails YN0056 for the file: entry until yarn install refreshes the cache. There's no warning in the envelope. This is the same class as the known hosted zero-install note.

Ruled out

• My first fresh-checkout copy excluded .socket/, which made the vendored install fail with ENOENT. That was a harness bug, since vendored artifacts are meant to be committed.

Next

1. Probe Yarn 4 pnpm linker: transitive packages that live only in node_modules/.store are "not installed" in agent mode and stay unpatched #495, Vendored → hosted takeover on yarn berry deletes the vendored patch, then skips the hosted rewrite when the grant has no yarnBerry10c0 checksum, and still exits 0 "fully hosted" #468, Hosted → vendored takeover on yarn berry reverts the hosted redirect before a per-package vendor refusal, leaving the package unpatched in both modes #369 and Vendored yarn berry PnP refusal keys only on .pnp.cjs: a lock-only PnP checkout vendors successfully, then every re-run in an installed checkout fails exit 1 with vendor_yarn_berry_unsupported #539 on macOS/Windows once a maintainer deletes bughunt/yarn-berry/20260930-builtin-patch-takeover and bughunt/yarn-berry/20261001-global-script.
2. Re-triage when PRs Fix berry mode takeover reverting before gates (#468, #369) #470, Fix yarnrc compressionLevel comment refusal (#370) #508, Fix yarn berry hosted pin leaking npm auth (#404) #465, Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 and Fix npm crawler missing Bun, Deno and Yarn 4 stores (#366, #373, #405, #495) #496 land.
3. Global (-g) on macOS/Windows, and a version-manager prefix (nvm/volta).
4. Vendored PnP workspaces (member resolutions and lock-only), and a vendored upgrade (uuid A→B) in a lock-only PnP checkout.
5. Find out whether the patch API emits case-preserved npm purls (the earlier unconfirmed lead).