Bug hunt ledger: Bun

[Mikola Lysenko (mikolalysenko)]

[agent] Progress ledger for the scheduled Bun bug-hunt routine (label pm:bun).

Last updated: 2026-10-02 (run 9), main 203e092, latest release 4.0.0, latest Bun 1.4.2.

Method: real Bun installs (npm @oven/bun-* or GitHub release binaries) and a local Python mock of the patch API: batch, by-package, the patches/package grant, patches/view with blob contents, blob/<hash>, the hosted tarball route, and a /registry/ passthrough for SOCKET_NPM_REGISTRY. Set SOCKET_PATCH_SERVER_URL to the mock. The oracle is the marker bytes after a fresh-checkout bun install --frozen-lockfile with an empty cache, plus byte comparison of the lockfiles and node require where runtime matters. The repo's own matrix (scripts/backtest-bun.py, bun-compatibility.yml) already covers plain hosted and vendored shapes across Bun 0.8.1–1.4.2. It always runs with --ignore-scripts and never in agent mode, and it never runs vex on an isolated-linker tree. This ledger tracks what it doesn't.

Run 9: #366, #405 (fixed by #496) and #469 (fixed by #472) were verified fixed on Linux. Their cells below now read pass (Linux), and the macOS/Windows cells for them are untested on the fixed main.

Coverage matrix

OS	Bun	Agent: hoisted	Agent: isolated linker	Hosted/vendored: bun patch	Hosted/vendored: default-trusted scripts	Hosted → vex: isolated linker	Hosted rollback/remove byte-exact (text lock)	bun.lockb takeover ⇄ revert
Linux	1.1.45	untested	n/a	untested	pass	n/a	pass (v0)	untested
Linux	1.2.23	pass	pass (opt-in; run 9)	fail #367	pass	pass, but fail #599 after an in-place reinstall	untested	untested
Linux	1.3.0–1.3.4	pass (1.3.0, 1.3.4)	pass (1.3.0, 1.3.4; run 9)	untested	pass	pass (1.3.0, 1.3.4; run 9)	pass (single: hosted + vendored; workspace: hosted, vendored refuses as documented)	untested
Linux	1.3.5–1.3.9	untested	untested	fail #367 (1.3.9)	fail #371	untested	untested	untested
Linux	1.3.14	pass	pass (run 9)	fail #367	fail #371	pass fresh; fail #599 in place	pass (v1, workspace, catalog)	untested
Linux	1.4.2	pass	pass (run 9; peer-hash entries, symlink backend)	fail #367 (text + lockb)	fail #371	pass fresh (text + lockb workspace); fail #599 in place	pass (v2, alias, overrides)	pass (semantic; not byte-exact, see Known non-bugs)
macOS	1.2.23	pass	fail #366	fail #367	untested	fail #405	untested	untested
macOS	1.3.4 / 1.3.5	untested	untested	untested	pass / fail #371	untested	untested	untested
macOS	1.3.14 / 1.4.2	pass	fail #366	fail #367	fail #371 (1.4.2)	fail #405	untested	untested
Windows	1.2.23	pass	fail #366	fail #367	untested	fail #405	untested	untested
Windows	1.3.4 / 1.3.5	untested	untested	untested	pass / fail #371	untested	untested	untested
Windows	1.3.14 / 1.4.2	pass	fail #366 (bunfig)	fail #367	fail #371 (1.4.2)	fail #405 (bunfig + default workspace)	untested	untested

Isolated-store edge cases after #496 (run 9, Linux)

Bun	agent: peer-hash +<hash> entries	agent: --backend=symlink	hosted vex fresh clone	hosted vex after in-place frozen reinstall (orphaned .bun entries)	vendored vex after in-place reinstall	bundled in a workspace member
1.4.2	pass	pass (no write-through)	pass	fail #599	false vendored_tree_out_of_sync (#599)	pass (hosted warns; vendored refuses)
1.3.14	untested	untested	pass	fail #599	untested	untested
1.2.23	untested	untested	pass	fail #599	untested	untested
macOS, Windows	untested	untested	untested	untested	untested	untested

Global mode (-g, agent; run 3)

OS	Bun	default layout: scan report / apply / vex / rollback / get	BUN_INSTALL_BIN set	BUN_INSTALL_GLOBAL_DIR set	npm-installed bun (shim only)	-g --mode hosted refusal
Linux	1.1.45 / 1.2.23 / 1.3.14 / 1.4.2	pass	fail #443	fail #443	pass (1.4.2)	pass
macOS	1.1.45 / 1.2.23 / 1.3.14 / 1.4.2	pass	fail #443	fail #443	pass	pass
Windows	1.3.14 / 1.4.2	pass	fail #443	fail #443	fail #434 (bun.cmd)	pass
Windows	1.1.45 / 1.2.23	blocked (bun add -g failed in the probe's space+unicode temp path)	blocked	blocked	blocked	untested

Untested: a non-writable global dir, a symlinked BUN_INSTALL, and Bun 1.0.x.

Bundled dependencies (bundled: true lock entries; run 4)

OS	Bun	lock	hosted scan warns/skips	vendored scan warns/skips	bundled copy patched after frozen install	vendored vex	hosted vex	hosted vex --no-verify
Linux	1.1.45	text v0 / lockb	fail #469 (lockb: pass after #472, run 9)	fail #469 (lockb: pass, run 9)	fail #469	fail #469 (attests; lockb: pass, run 9)	pass (not_applied)	fail #469 (lockb: pass, run 9)
Linux	1.2.23 / 1.3.14	text v1	fail #469	fail #469	fail #469	fail #469	pass	fail #469
Linux	1.4.2	text v2 / lockb	pass (run 9, #472)	pass (run 9)	n/a (warned)	pass (run 9)	pass	pass (run 9)
macOS, Windows	all	all	untested	untested	untested	untested	untested	untested

Non-registry copies of a patched name@version (run 5, Linux)

Bun	lock	URL tgz + nested registry copy: scan warns	root copy patched after frozen install	vendored vex	hosted vex	hosted vex --no-verify	URL-only refusal
1.1.45	text v0	fail #497	fail #497	fail #497 (attests)	pass (not_applied)	fail #497	untested
1.2.23	text v1	fail #497	fail #497	fail #497	pass	fail #497	untested
1.3.14	text v1	fail #497	fail #497	fail #497	pass	untested	untested
1.4.2	text v2 (URL and file: tgz)	fail #497	fail #497	fail #497	pass	fail #497	pass
1.1.45 (read by 1.1.45 / 1.2.23 / 1.4.2)	bun.lockb (URL tgz; run 6)	fail #497	fail #497	fail #497	pass	fail #497	untested
any	github: tuples	untested	untested	untested	untested	untested	untested
macOS, Windows	all	untested	untested	untested	untested	untested	untested

socket.yml policy and staged rollout (run 6, Linux)

Bun	lock	hosted maxNewPatches: 1 advance	vendored maxNewPatches: 1 advance	vendored → hosted takeover under cap	ignorePackages keeps pin	enabled: false writes nothing	hosted upgrade (new uuid)	rollback after upgrade
1.1.45	lockb (workspace)	pass	untested	untested	pass	pass	pass	n/a (refuses, documented)
1.3.14	text v1 (workspace)	pass	untested	untested	untested	untested	pass	pass (byte-exact)
1.4.2	text v2 (workspace)	pass	pass	pass	pass	pass	untested	untested
macOS, Windows	all	untested	untested	untested	untested	untested	untested	untested

socket.yml across several independent Bun projects in one repo (run 7, Linux)

Bun	lock	includePaths (hosted, PATH glob)	shared maxNewPatches across dirs	minSeverity flag > env > file	ignorePaths keeps pins byte-identical	!/tests/ re-include	**/bun.lockb marker	vendored PATH glob
1.4.2	text v2	pass	pass	pass	pass	pass	n/a	pass
1.1.45	lockb	untested	untested	untested	untested	untested	pass	n/a
macOS, Windows	all	untested	untested	untested	untested	untested	untested	untested

Agent mode applies path policy only at the scan root, so nested independent projects are always patched. That's generic, not Bun-specific: handed to npm (entries/npm/20261002T072532Z-from-bun.md).

Workspace members under ignored paths, and growth after a scan (run 8, Linux)

Bun	lock	tests/ member: agent	tests/ member: hosted (frozen patched)	ignorePaths over members keeps them (agent / hosted / vendored)	rollback / revert byte-exact	re-run rewires a newly added registry copy	dual package-lock.json + bun.lock hosted
1.4.2	text v2	pass	pass	pass	pass	pass	pass (rollback byte-exact, .npmrc removed)
1.3.14	text v1	untested	pass	untested	untested	untested	untested
1.1.45	lockb	untested	pass	untested	n/a (refuses, documented)	pass	untested
macOS, Windows	all	untested	untested	untested	untested	untested	untested

Between a scan and its re-run, an unwired registry copy of a patched name@version in the same lock is still attested by vendored vex and by hosted vex --no-verify. npm does the same, so it's handed to npm (entries/npm/20261002T133747Z-from-bun.md), not filed as a Bun bug.

Also passing in run 6: a dual-lock checkout (bun.lock + a stale bun.lockb, where Bun ≥ 1.2 reads bun.lock and hosted rewrites only it), and global mode with a symlinked BUN_INSTALL (1.4.2: agent scan, vex -g, rollback -g).

Lock-shape edge cases (run 5, Linux)

• CRLF bun.lock + CRLF package.json (1.1.45 v0, 1.3.14, 1.4.2): hosted scan → frozen install → rollback, and vendored → vendor --revert. Both byte-exact: pass.
• bun install --yarn (sibling yarn.lock), on 1.1.45 lockb, 1.2.23 and 1.4.2: hosted rewires both locks; lockb rollback refuses and touches neither file: pass.
• [install.scopes] custom-registry scope (1.3.14, 1.4.2): hosted rewrite and byte-exact rollback: pass.
• 1.1.45 binary workspace lock, hosted, read by 1.1.45 / 1.2.23 / 1.3.14 / 1.4.2. Frozen installs are patched, the takeover refuses as documented, and vex is correct: pass.
• bun add after hosted (all four versions; the pins survive) and after vendored (digest-less re-save on < 1.3.10, healed by the re-run): pass.

Takeovers and vendored VEX (run 4, Linux)

• Hosted → vendored on a v1 workspace lock (1.3.14): pass. Refuses before any write; dry-run parity is as documented.
• Vendored + isolated linker, stale tree → vendored_tree_out_of_sync is missing (1.4.2): fail, under With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405 (comment). Hoisted control: pass.

Other passes (Linux, 1.4.2 unless noted):

• Run 1: agent scan --global, and the (pre-v5) setup hook.
• Run 3: SOCKET_GLOBAL=1 ≡ -g; SOCKET_GLOBAL_PREFIX / --global-prefix scan only that dir; scan -g inside a project with a bunfig setting globalDir doesn't leak project dirs; vex without -g ignores global copies.
• Run 2:
  • Agent scan → vex → rollback, with no cache write-through.
  • remove, repair and list on hosted pins.
  • Hosted bun.lockb idempotency, --dry-run, and the rollback refusal.
  • Vendored catalog: and overrides.
  • Lockfile-only vendored scan on 1.1.45 v0 with a CRLF + BOM package.json.
  • A corrupt served tarball rejected on 1.3.9, 1.3.10 and 1.4.2, text + lockb.

Backlog

0. Maintainer request (partly covered in runs 3 and 6): global (-g) mode for hosted patches. Still to do: a non-writable global dir must fail loudly (needs a probe; the sandbox runs as root); Windows 1.1.45/1.2.23 with an ASCII temp path; Bun 1.0.x. Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 is still open (re-checked in run 9); re-test On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (bun.cmd) on Windows now that Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 has landed. Checklist: the 20261001T040000Z entry.
1. A maintainer needs to delete the probe branches bughunt/bun/20260930-default-trust, bughunt/bun/20260930-isolated-bunpatch, bughunt/bun/20261001-vex-isolated and bughunt/bun/20261001-global-dirs. Deletion is still blocked from the sandbox (runs 7–9), so no new probes until then.
2. With Bun's isolated linker, vex refuses every hosted patch as not_applied after the usual in-place bun install, because it checks orphaned node_modules/.bun registry entries that Bun never removes (regression from #496) #599 follow-ups: the orphan state after a version upgrade, and after hosted → rollback → in-place install. Re-test when fixed.
3. macOS/Windows re-runs of the Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366 / With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405 / Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 fixes (Windows isolated uses junctions).
4. Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 github: tuples (needs a probe); re-test Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 when fixed.
5. The multi-project policy cells on a 1.1.45 lockb repo; ignorePaths over workspace members on 1.3.14 / 1.1.45.
6. Hosted rollback on real macOS and Windows checkouts.
7. Digest boundary with a valid substitute tarball, 1.3.9 text lock vs 1.3.10 (low priority, documented limitation).

Known non-bugs

• patches-api.socket.dev is blocked by the sandbox proxy. Mock the API. Also, the CLI's reqwest can't reach registry.npmjs.org from the sandbox (curl can), so hosted rollback/remove need SOCKET_NPM_REGISTRY pointed at a local passthrough. Without it you get cannot restore … error sending request, which is a sandbox artifact.
• Agent rollback → missing_blob when the mock serves no before-blob (fixture limit).
• v5 rollback removes the rolled-back entries from .socket/manifest.json, so a later apply is a success no-op (CLI_CONTRACT rollback row).
• Hosted bun.lockb pins: rollback / remove refuse with the git checkout -- bun.lockb remedy (documented). After a hosted → vendored → vendor --revert round trip, bun.lockb is semantically identical (same bun pm hash and yarn dump) but not byte-identical: its string buffer keeps the dead URLs. The doc promises a byte-exact registry record, not the whole file.
• Bun 1.2.23 workspaces default to the hoisted layout (isolated only via linker = "isolated"). From Bun 1.3.x a fresh workspace lock defaults to isolated.
• setup was removed in v5 (v5 prerelease: scan → vex → vendor workflow, hosted by default #277). The run-1 setup pass is obsolete.
• esbuild after rewiring is listed by bun pm untrusted but has no observable effect. Use better-sqlite3 to observe On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371.
• Documented refusals (docs/testing/bun-compatibility.md): a version-0 workspace lock in hosted mode (redirect_bun_workspace_unsupported), a pre-v2 workspace lock in vendored mode (vendor_bun_workspace_unsupported), and missing digest enforcement for text-lock URL/local tuples on Bun < 1.3.10.
• Agent-mode npm aliases under Bun are npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (npm-owned).
• --global-prefix must name the node_modules dir itself (~/.bun/install/global/node_modules). Its parent scans 0 packages; the flag is documented as the packages root.
• -g combined with --mode hosted is a clap-level conflict: plain-text error, exit 2, no JSON envelope even with --json. Consistent with other usage errors.
• Vendored scan --dry-run exits 0 with status: success and would_refuse while the real run exits 1 with partial_failure, for the same Bun preflight refusal. Documented (CLI_CONTRACT would_refuse).
• Vendored vex attests from the committed artifact even when the installed tree is stale. By design: only a vendored_tree_out_of_sync warning is owed.
• Hosted default vex on a bundled-copy project correctly refuses (not_applied). Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 is about vendored mode and --no-verify.
• bun pm bin -g ignores a project-local bunfig.toml, so scan -g inside a project can't be redirected by the project.
• Vendored, then bun add, on Bun < 1.3.10 re-saves the local tuples without sha512. That's documented ("Digest-less re-saves"): the vendored re-run reports already_vendored and re-pins the digest.
• Bun records "" as the registry field of a tuple even when it came from an [install.scopes] or custom default registry, so rollback restoring "" is correct.
• On a bun install --yarn project, hosted rollback restores bun.lock byte-exact but adds a #<sha1> fragment to Bun's yarn.lock resolved lines. It's semantically equivalent and yarn-classic's rewriter, so it isn't filed as a Bun bug.
• Mock fixture: build the patched tarball with a fixed gzip mtime. Otherwise a mock restart changes its sha512 and later installs fail IntegrityCheckFailed.
• link: deps need bun link registration, and github: deps don't resolve in the sandbox. Both are environment limits.
• scan <workspace-member> (e.g. scan packages/a): hosted reports success with 0 redirected and redirect_npm_no_lockfile; vendored refuses with vendor_lockfile_missing. Pinned as today's behaviour in bun-compatibility.md ("Not measured"); scan the root instead.
• Mode-less scan -g is report-only. Use --mode agent to patch global copies. -g agent runs record the global copies in the cwd's .socket/manifest.json (by design).
• A v1/v2 text bun.lock can't be read by Bun 1.1.45 (lockfile had changes, but lockfile is frozen) even without socket-patch. When bun.lock and bun.lockb are both present, Bun ≥ 1.2 reads bun.lock.
• Mock fixture: SOCKET_PATCH_SERVER_URL must name the same origin across runs. A mock on another port makes the earlier pins non-hosted.
• A hosted scan at a repo root that is itself a Bun project crawls nested independent projects' node_modules and warns redirect_bun_entry_not_found for their packages (exit 0). They have their own locks: scan them by PATH (scan '*/*' --mode hosted).
• Mock fixture: agent mode needs a blob/<hash> route. Without it the result is partial_failure.
• Vendored scan on a Bun 1.3.x workspace (lockfileVersion 1) refuses vendor_bun_workspace_unsupported. That's the documented pre-v2 workspace limitation, and the lock is untouched.
• vex exit 2 product_undetected in a fixture without a package version or git origin: pass --product (fixture limit).
• Bun never prunes node_modules/.bun entries: after a dependency is removed, its store dir (and, on 1.4.2, the member link) stays. That's Bun behaviour. It only matters to socket-patch through With Bun's isolated linker, vex refuses every hosted patch as not_applied after the usual in-place bun install, because it checks orphaned node_modules/.bun registry entries that Bun never removes (regression from #496) #599.
• Agent apply on a workspace whose member links into an isolated store reports a duplicate already_patched skip per member-linked package (counts only, the bytes are right). pnpm behaves the same, so it's handed to pnpm (entries/pnpm/20261002T193154Z-from-bun.md).
• scan -g with BUN_INSTALL_GLOBAL_DIR set reports the Node global prefix's packages, not Bun's. That's Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443, not a new bug.

[github-actions[bot]]

[agent] 2026-09-30: Bun bug-hunt run

Tested: main f6b7fb9 (CLI 4.0.0 workspace version). Latest release 4.0.0 and previous release 3.3.0, both from npm @socketsecurity/socket-patch, for regression checks. Bun 1.1.38, 1.1.45, 1.2.23, 1.3.0, 1.3.2, 1.3.4, 1.3.5, 1.3.6, 1.3.9, 1.3.10, 1.3.14, 1.4.0 and 1.4.2 (the current latest) from GitHub releases, on Node 22 in the sandbox. Probes ran on ubuntu, macOS and Windows.

Method: the patch API is unreachable from the sandbox (patches-api.socket.dev is proxy-denied), so I used a ~70-line Python mock with these routes: batch, by-package, the patches/package grant, patches/view with blobContent, and the hosted tarball route. Patched tarballs are built from the real registry tarball with a marker prepended to the main file, gzipped with mtime 0 so the sha512 is stable. The oracle is the marker in the installed file after a fresh-checkout bun install --frozen-lockfile with an empty cache, plus node require for the native-module case.

This is the first run: there was no earlier ledger and no pm:bun issues to re-triage.

Cells

• fail Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366: agent mode with Bun's isolated linker. Transitive packages under node_modules/.bun/ are treated as lockfile-only: scan --mode agent exits 0 with success and doesn't patch or record them. This happens by default in fresh workspaces on Bun 1.3.14 and 1.4.2, and with linker = "isolated" on 1.2.23+. Reproduced on Linux, macOS and Windows. Releases 3.3.0 and 4.0.0 behave the same.
• fail Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367: hosted and vendored mode silently discard the project's own bun patch (patchedDependencies). The fresh frozen install exits 0 with Socket's patch but without the user's. Reproduced on Bun 1.2.23, 1.3.9, 1.3.14 and 1.4.2, text lock and bun.lockb, on all 3 OSes. 3.3.0 and 4.0.0 behave the same. rollback restores it (pass).
• fail On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371: hosted and vendored rewiring loses Bun's default trust, so better-sqlite3's install script is blocked and require fails after a fresh frozen install. The first bad Bun release is 1.3.5 (1.3.4 passes). Confirmed on all 3 OSes. trustedDependencies works around it.
• commented on npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (npm-owned): agent-mode npm aliases under Bun 1.4.2. The mixed project patches only left-pad, not lp, and VEX attests not_affected.
• pass: agent mode with the hoisted linker (direct and transitive), on Bun 1.2.23 / 1.3.14 / 1.4.2 × 3 OS.
• pass: hosted + bun update unwires the redirect, and vex then reports redirect_unwired (Bun 1.4.2).
• pass: agent scan --global on bun add -g packages (~/.bun/install/global/node_modules, Bun 1.4.2).
• pass: the setup hook (npx …) in a Bun-only PATH with no node/npx. Bun maps npx itself, and bun install exits 0 (1.4.2).
• pass: agent writes break Bun's cache hardlinks (rename-over write, code-verified; the cache is not written through).

Issues

• Filed Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366: Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366
• Filed Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367: Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367
• Filed On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371: On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371
• Commented on npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356: npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (comment)

False positives ruled out

• Agent rollback failing with missing_blob came from my mock, which serves no before-blob. It's a fixture limit, not a bug.
• The esbuild postinstall that became "untrusted" after rewiring has no observable effect (its binary comes via optionalDependencies), so I used better-sqlite3 to prove the On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371 impact.
• On Windows, the default-linker workspace cell had bun install exit 1 on the runner. That cell is inconclusive there; the explicit linker = "isolated" cell reproduces Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366.
• On Bun 1.2.23, a new workspace defaults to the hoisted layout, so agent mode passes there. That's expected, not a fix.

Probe

• bughunt/bun/20260930-isolated-bunpatch, run https://github.com/SocketDev/socket-patch/actions/runs/36765789215 (3 OS × Bun 1.2.23 / 1.3.14 / 1.4.2)
• bughunt/bun/20260930-default-trust, run https://github.com/SocketDev/socket-patch/actions/runs/36766578001 (3 OS × Bun 1.3.4 / 1.3.5 / 1.4.2)
• Neither branch could be deleted. git push --delete failed through the git proxy ("remote end hung up", three tries each), so a maintainer needs to delete both.

Next

1. Agent mode on Windows with the isolated linker (junction layout) once Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366 is fixed. Also re-test the Windows default-workspace bun install exit 1.
2. The hosted ⇄ vendored takeover and scoped rollback / remove on bun.lockb with two patched packages, one of them workspace-only (1.2.23 vs 1.4.2).
3. bun install --frozen-lockfile after a hosted run on Bun 1.3.9 vs 1.3.10 with a tampered hosted tarball in a lockb project (digest enforcement for binary locks).
4. overrides / resolutions targeting the patched package (text and lockb), and catalog: specs in workspaces (Bun 1.3+).
5. Lockfile-only checkout + vendored scan on Bun 1.1.45 (lockfileVersion 0, no workspaces) with CRLF + BOM package.json.

[github-actions[bot]]

[agent] 2026-10-01: Bun bug-hunt run

Tested: main 2463257 ("feat!: consolidate the v5 patching workflow", #277). It's a big rewrite: scan is now hosted by default, setup is gone, hosted mode keeps no ledger, and VEX works without a manifest. Latest release 4.0.0 (npm @socketsecurity/socket-patch-linux-x64-gnu) for regression checks. Bun 1.1.45, 1.2.23, 1.3.9, 1.3.10, 1.3.14 and 1.4.2 (still the current latest), from npm @oven/bun-linux-x64, on Linux. Probes ran on ubuntu, macOS and Windows.

Method: same as run 1, with the mock rebuilt (mkpatch.py + mock.py). I added a /registry/<name>/<ver> passthrough and set SOCKET_NPM_REGISTRY to it, because the CLI's reqwest can't reach registry.npmjs.org from this sandbox even though curl can. Hosted rollback needs that registry lookup. I also set SOCKET_PATCH_SERVER_URL to the mock, so its URLs count as hosted pins. The oracle: marker bytes after a fresh-checkout bun install --frozen-lockfile with an empty cache, plus byte comparison of the lockfiles.

Re-triage (on 2463257)

• Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366: still reproduces. With the isolated linker and Bun 1.4.2, scan --mode agent gives package_not_installed for is-number under .bun/, exit 0. No comment, since nothing is new.
• Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367 / On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371: v5 still has no handling for patchedDependencies or trustedDependencies (grep over crates/ and docs/ finds nothing). I didn't re-run the runtime repro this time (see Blocked). No change, no comment.

Cells

• fail With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405 (new): hosted scan (now the default) → vex with Bun's isolated linker. vex attests a transitive package under node_modules/.bun/ as verified / not_affected while the installed copy is unpatched (a stale tree before reinstall) or tampered (after a fresh install). The same project with the hoisted linker gives not_applied. Reproduced on Linux, macOS and Windows × Bun 1.2.23 (linker=isolated), 1.3.14 and 1.4.2, both with the bunfig setting and as a default workspace. Regression: 4.0.0 omits the purl (package_not_found).
• pass: hosted rollback <purl> and unscoped rollback, with two packages, on text locks version 0 (1.1.45), 1 (1.3.14) and 2 (1.4.2). The lock comes back byte-identical and the frozen install is OK.
• pass: hosted rollback byte-exact for an npm alias (lp@npm:left-pad), a v1 workspace (1.3.14), catalog: (1.3.14), and overrides forcing the patched transitive (1.4.2). Vendored catalog: and overrides on 1.4.2 also pass, rollback included.
• pass: remove <purl> × 2 restores the hosted text lock byte-exact. repair and list on a hosted project work.
• pass: bun.lockb hosted → vendored takeover → vendor --revert with two packages (1.4.2). Every fresh frozen install is correct, and bun pm hash and the bun ./bun.lockb dump match the original. The file isn't byte-identical: it's 1997 → 2301 bytes, because its string buffer keeps the dead hosted and vendored URLs. That isn't a bug: semantics are preserved, and the doc only promises a byte-exact registry record. Logged under Known non-bugs.
• pass: hosted bun.lockb idempotency (a second scan leaves it unchanged, --dry-run writes nothing), and rollback refuses with the documented git checkout -- bun.lockb remedy.
• pass: lockfile-only vendored scan on Bun 1.1.45 (lockfileVersion 0) with a CRLF + BOM package.json. The manifest isn't touched, the frozen install is patched, and rollback is byte-exact.
• pass: a corrupt served tarball is rejected on 1.3.9, 1.3.10 and 1.4.2, text and bun.lockb. Note that bun.lockb enforces the sha512 already on 1.3.9 ("Integrity check failed"). My tamper corrupted the gzip, so a 1.3.9 text lock failed with ZlibError instead. That isn't a digest-boundary test; it's still in the backlog.
• pass: agent scan → vex → rollback with the mock serving before-blobs (1.4.2). A warm-cache reinstall after apply gives pristine bytes, so the Bun cache isn't written through.
• pass, Windows: a default-workspace bun install on 1.3.14 and 1.4.2 exited 0 on windows-latest this time (inconclusive in run 1).

Issues

• Filed With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405: With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405

False positives ruled out

• Hosted rollback → partial_failure "error sending request for url (https://registry.npmjs.org/…)" was a sandbox artifact: reqwest can't connect to npmjs here. With SOCKET_NPM_REGISTRY pointed at a passthrough, the restore succeeds.
• apply after agent rollback is a success no-op. v5 rollback deliberately removes manifest entries (CLI_CONTRACT rollback row), so this is expected.

Probe

• bughunt/bun/20261001-vex-isolated: runs https://github.com/SocketDev/socket-patch/actions/runs/36800886824 (failed on pipefail in my script) and https://github.com/SocketDev/socket-patch/actions/runs/36801259018 (9/9 jobs, all results reported in With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405).

Blocked

• Deleting branches is still impossible from this sandbox. In run 1, git push --delete went through the git proxy and got "remote end hung up". This run the first attempt failed the same way, and a later command was refused by the session's permission classifier ("Git Destructive"), so I didn't retry. A maintainer needs to delete three branches: bughunt/bun/20260930-default-trust, bughunt/bun/20260930-isolated-bunpatch and bughunt/bun/20261001-vex-isolated.
• I didn't re-run the Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367 runtime repro (bun patch --commit) because that command was refused by the same classifier. I re-triaged it by code inspection only.

Next

1. Digest boundary with a valid substitute tarball (a different but well-formed tgz) on a 1.3.9 text lock vs 1.3.10, in hosted and vendored mode. Confirm bun.lockb enforces on 1.3.9.
2. vex with a vendored project under the isolated linker: does the vendored_tree_out_of_sync warning fire when the .bun/ copy is stale?
3. A Windows agent run with the isolated linker (junction layout) once Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366 is fixed. Also VEX on Windows after a real frozen hosted install.
4. A hosted → vendored takeover on a v1 workspace lock (1.3.14). It must refuse vendor_bun_workspace_unsupported and leave the hosted pin byte-untouched. Check --dry-run parity too.
5. v5 socket.yml policy and per-run limits in a Bun workspace with two patched packages (Bun 1.4.2).

[github-actions[bot]]

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major Bun version and on Linux, macOS and Windows.

Where Bun puts global installs: bun add -g; discovery via bun pm bin -g (~/.bun/install/global/node_modules, BUN_INSTALL). Cover Bun 1.0 through latest, and Windows %USERPROFILE%\.bun.

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed Bun package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a Bun project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × Bun version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

[github-actions[bot]]

[agent] 2026-10-01: Bun bug-hunt run

Tested: main 2463257 (unchanged since run 2) and latest release 4.0.0 (npm @socketsecurity/socket-patch-linux-x64-gnu) for regression checks. Bun 1.1.45, 1.2.23, 1.3.14 and 1.4.2, from npm @oven/bun-*, on Linux, plus a probe on ubuntu, macOS and Windows. This run focused on the maintainer request: global (-g) mode.

Method: real bun add -g semver@7.6.0 is-number@7.0.0 into an isolated BUN_INSTALL, with a Python mock of the public proxy (SOCKET_PROXY_URL: /patch/batch, view, by-package, blob) serving free patches for both packages. The oracle: marker bytes in the real global copy, node require() of the global package, VEX statements, and sha256 of the original files after rollback. Paths in the probe contain a space and ü.

Re-triage (on 2463257)

• Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366: still reproduces. With the isolated linker and Bun 1.4.2, to-regex-range → transitive is-number gives scan --mode agent → [skip] … not installed, exit 0, unpatched. Direct deps under .bun/ do patch. Nothing new, no comment.
• With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405, Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367, On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371: main is unchanged since run 2, so I didn't re-check them.

Global-mode cells (scan -g report / hosted refusal / scan -g --mode agent / runtime import / vex -g / vex -g omits an unapplied patch / apply -g / rollback -g byte-exact / get -g)

• pass, default layout ($BUN_INSTALL/bin + $BUN_INSTALL/install/global): Linux, macOS and Windows × 1.1.45, 1.2.23, 1.3.14 and 1.4.2. The exception is Windows 1.1.45/1.2.23, where bun add -g itself failed in the space + unicode temp dir (blocked, not ours).
• pass: scan -g --mode hosted, --global-prefix … --mode hosted, SOCKET_GLOBAL=1 --mode hosted and SOCKET_GLOBAL_PREFIX … --mode hosted all exit 2 with "global installs have no project lockfile to redirect" and write nothing.
• pass: SOCKET_GLOBAL=1 matches -g, and SOCKET_GLOBAL_PREFIX / --global-prefix <bun global node_modules> scan only that directory.
• pass: scan -g from inside a Bun project, even one with a project bunfig.toml setting globalDir / globalBinDir, scans only the real global dir. bun pm bin -g ignores the project bunfig, so nothing leaks from the project.
• pass: vex -g attests applied global patches and omits a reverted one with not_applied. Without -g, vex doesn't touch the global copy (package_not_found).
• fail Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 (new): with BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR set, scan -g finds no Bun globals (exit 0, success). scan -g --mode agent exits 0 unpatched, get -g exits 1, and vex -g has nothing to attest. This holds on every OS × version tested and on release 4.0.0 (not a regression). The cause is parse_bun_bin_output guessing <bin>/../install/global/node_modules.
• fail On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (commented): on Windows, an npm-installed Bun (only bun.cmd on PATH) gives scan -g empty, on 1.3.14 and 1.4.2. It's the bare-bun spawn already covered by On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 / PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442. macOS and Linux pass the same layout.

Issues

• Filed Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443: Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443
• Commented on On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (npm-owned, bughunt) with the Bun evidence: On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (comment)

False positives ruled out

• --global-prefix ~/.bun/install/global (the parent, not node_modules) scans 0 packages. The flag is documented as the packages root, so that's user error.
• scan -g --mode hosted --json prints plain text on stderr with exit 2 and no JSON envelope. That's a clap-level argument conflict, consistent with other usage errors.
• A bunfig globalDir in ~/.bunfig.toml wasn't honoured by bun add -g in my sandbox setup. Bun ignored it, so it isn't socket-patch's problem. The env vars are the reproducible trigger.
• scan -g also scans npm's own global root (/opt/node22/lib/node_modules). That's by design: global mode covers every package manager's globals.

Probe

• bughunt/bun/20261001-global-dirs: https://github.com/SocketDev/socket-patch/actions/runs/36830650075 (3 builds + 12 probe jobs; Windows 1.1.45/1.2.23 failed in the probe's own bun add -g).

Blocked

• git push --delete still fails ("remote end hung up"). A maintainer needs to delete four branches: bughunt/bun/20260930-default-trust, bughunt/bun/20260930-isolated-bunpatch, bughunt/bun/20261001-vex-isolated and bughunt/bun/20261001-global-dirs.

Next

1. Global mode, remaining checklist items: a non-writable global dir (root-owned prefix, or a read-only BUN_INSTALL on Windows) must fail loudly; -g with a symlinked BUN_INSTALL; Windows 1.1.45/1.2.23 with an ASCII temp path.
2. Re-test Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 and the bun.cmd case once PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 lands.
3. A hosted → vendored takeover on a v1 workspace lock (1.3.14). It must refuse before writes; check --dry-run parity.
4. vex on a vendored project with the isolated linker (stale .bun/ copy → vendored_tree_out_of_sync?).
5. Hosted rollback on macOS and Windows (CRLF lock with core.autocrlf).

[github-actions[bot]]

[agent] 2026-10-01: Bun bug-hunt run

Tested: main d984832 (new since run 3: #337 npm bundled-copy VEX fix, #322 Maven docs) and release 4.0.0 (npm @socketsecurity/socket-patch-linux-x64-gnu) for the regression check. Bun 1.1.45, 1.2.23, 1.3.14 and 1.4.2 from npm @oven/bun-linux-x64, on Linux only. No probe branch this run: the new bug is in lockfile parsing and rewriting, not OS-specific code, and old probe branches still can't be deleted from the sandbox.

Method: a Python mock of the authenticated patch API (batch, by-package, patches/package, view/<uuid>, blob, the hosted tarball, a /registry/ passthrough) plus a local @bh scope registry serving @bh/bund@1.0.0 with bundleDependencies: ["is-number"]. The patch prepends /* SOCKET-PATCHED */ to is-number@7.0.0/index.js. Oracle: a fresh checkout with a cold cache and bun install --frozen-lockfile, marker bytes in every installed copy, and require.resolve from the parent.

Re-triage

• Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443: still reproduces on d984832. With BUN_INSTALL_BIN set, scan -g scans 551 packages vs 552 without it, so the Bun global is-number is missed. PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 hasn't landed. No comment.
• With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405: still reproduces. Commented with a vendored variant (below).

Cells

• fail Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 (new): Bun bundled: true lock entries ("@bh/bund/is-number": ["is-number@7.0.0", "", {"bundled": true}, …]). Hosted and vendored rewire them silently (success, no warning; npm warns *_bundled_instance_skipped). Bun unpacks bundled copies from the parent tarball, so the copy the parent loads stays unpatched after a frozen install. On text locks with Bun ≥ 1.2 there's also an extra patched hoisted copy that nothing loads. Vendored default vex attests not_affected and hosted vex --no-verify attests too. Hosted default vex → not_applied (ok). Affected: 1.1.45 (text v0 + lockb), 1.2.23, 1.3.14 and 1.4.2 (text + lockb), in both the "bundled only" and "bundled + direct" shapes. Release 4.0.0 behaves the same and also attests in hosted default vex: not a regression.
• pass: hosted → vendored takeover on a v1 workspace lock (1.3.14, hoisted). Refuses with vendor_bun_workspace_unsupported before any write: bun.lock, the package.json files and the file list are unchanged, and the hosted pin is kept. --dry-run gives would_refuse with exit 0, the real run partial_failure with exit 1. That asymmetry is documented (CLI_CONTRACT would_refuse row).
• fail → With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405 (commented): vendored + isolated linker, stale tree (not reinstalled). vex attests from the artifact (by design) but omits the vendored_tree_out_of_sync warning. Hoisted emits it. 2/2 runs each, Bun 1.4.2. After a frozen reinstall the .bun/ copy is patched and vex is correct. With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405 (comment)

Issues

• Filed Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469: Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469
• Commented on With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405: see above.

False positives ruled out

• Hosted default vex on the bundled shape correctly refuses (not_applied): its installed-tree check sees the bundled copy. Only vendored, and --no-verify, attest.
• Vendored --dry-run exits 0 with success while the real run exits 1 with partial_failure, for the same refusal. That's documented.
• Vendored vex attesting while the installed tree is stale is by design: the artifact is the evidence. Only the missing warning is a bug.

Blocked

• Still can't delete probe branches (no new ones this run). A maintainer needs to delete bughunt/bun/20260930-default-trust, bughunt/bun/20260930-isolated-bunpatch, bughunt/bun/20261001-vex-isolated and bughunt/bun/20261001-global-dirs.

Next

1. Global-mode leftovers: a non-writable global dir must fail loudly; a symlinked BUN_INSTALL; Windows 1.1.45/1.2.23 with an ASCII temp path.
2. Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 on macOS and Windows (a cheap probe, if branch deletion works again), plus bundled inside a workspace member, and rollback/remove of a rewired bundled entry.
3. Hosted rollback on macOS and Windows (CRLF lock with core.autocrlf).
4. v5 socket.yml policy and per-run limits in a Bun workspace.
5. Re-test Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 and the bun.cmd case once PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 lands.

[github-actions[bot]]

[agent] 2026-10-01: Bun bug-hunt run

Tested: main 61cfb9b (new since run 4: #365 npm .store / pnpm virtualStoreDir crawler walks, #446 -g cwd-state fix, gem/pip fixes) and release 4.0.0 (npm @socketsecurity/socket-patch-linux-x64-gnu) for the regression check. Bun 1.1.45, 1.2.23, 1.3.14 and 1.4.2 (1.4.2 is still the latest stable) from npm @oven/bun-linux-x64, on Linux only.

No probe branch this run: git push --delete is still denied in the sandbox, so a new probe branch couldn't be cleaned up.

Method: a Python mock of the patch API (batch, by-package, patches/package, view with blob contents, blob/<hash>, the hosted tarball, and a /registry/ passthrough). Patches prepend /* SOCKET-PATCHED */ to is-number@6.0.0/index.js, is-odd@3.0.1/index.js and @sindresorhus/is@4.6.0/dist/index.js. Gzip the patched tarball with mtime=0: otherwise a mock restart changes its sha512 and every later install fails IntegrityCheckFailed, which is a fixture artifact. Oracle: a fresh checkout, a cold cache, bun install --frozen-lockfile, the marker bytes and require.resolve.

Re-triage

• Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366: still reproduces on 61cfb9b. Fix npm crawler missing relocated dependency stores (#359, #362) #365 added the .store / pnpm virtual-store walks but not .bun. Commented: Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366 (comment)
• Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443: BUN_INSTALL_BIN / BUN_INSTALL_GLOBAL_DIR are still unread on main (PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 not landed). No new information, so no comment.

Cells (Linux)

• fail Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 (new): a URL or file: tarball dependency on the patched name@version, beside a nested registry copy of the same version.
  • Hosted and vendored rewire only the registry tuple, with no warning (success, warnings: []).
  • After a frozen install the root copy the app requires is unpatched.
  • Vendored vex (default and --no-verify) attests not_affected, and so does hosted vex --no-verify. Hosted default vex → not_applied (correct).
  • Affected: 1.1.45 v0, 1.2.23 v1, 1.3.14 v1 and 1.4.2 v2 (URL), plus 1.4.2 file: tgz. 2/2 runs on 1.3.14 and 1.4.2.
  • Release 4.0.0 behaves the same, so it isn't a regression. It's the Bun counterpart of npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (npm-only fix).
  • Controls: URL-only (no registry copy) → vendored vendor_lock_entry_not_found, hosted redirect_bun_entry_not_found. Both correct.
• pass: CRLF bun.lock (Windows autocrlf analog) on 1.1.45 v0, 1.3.14 and 1.4.2. Hosted scan keeps CRLF on every line, the frozen install is patched, and rollback is byte-exact for both bun.lock and the CRLF package.json. Vendored vendor --revert is byte-exact too and removes .socket/.
• pass: bun install --yarn projects (bun.lockb + yarn.lock on 1.1.45; bun.lock + yarn.lock on 1.2.23 and 1.4.2).
  • Hosted rewires both locks, and the frozen install is patched.
  • The lockb variant's rollback refuses with the git checkout -- bun.lockb yarn.lock remedy and touches neither file.
  • (Observation, not filed: on the text-lock variants rollback restores bun.lock byte-exact but rewrites Bun's yarn.lock resolved lines with a #<sha1> fragment Bun didn't write. Semantically equivalent, and it's yarn-classic territory.)
• pass: [install.scopes] custom-registry scope (@sindresorhus/is), 1.3.14 and 1.4.2. Bun records "" as the registry. Hosted rewrite, then rollback, is byte-exact.
• pass: a Bun 1.1.45 binary workspace bun.lockb (root → a → b, two is-number versions).
  • Hosted rewrite, then cold frozen installs with 1.1.45, 1.2.23, 1.3.14 and 1.4.2: only the patched versions are patched.
  • The hosted → vendored takeover refuses redirect_revert_failed (normalized workspace behaviors, documented) and leaves the lock unchanged.
  • vex: not_applied on the stale tree, not_affected after a frozen install.
• pass: hosted pins survive a later bun add left-pad on 1.1.45, 1.2.23, 1.3.14 and 1.4.2, and a cold frozen install is still patched.
• pass (documented): vendored then bun add on 1.1.45 and 1.2.23 drops the local tuples' sha512 (the digest-less re-save). The re-run is already_vendored and re-pins the digest on disk, as the doc says. 1.3.14 and 1.4.2 keep the digest.

Issues

• Filed Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497: Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497
• Commented on Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366.

False positives ruled out

• IntegrityCheckFailed on bun add after a mock restart: the mock's tarball gzip mtime changed. Fixed the fixture (mtime=0) and re-ran: pass.
• The digest-less vendored tuple after bun add on Bun < 1.3.10 is documented, and it's healed by the re-run.
• Hosted default vex on the Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 shape correctly refuses. Only vendored and --no-verify attest.

Blocked

• Probe branches: git push origin --delete is denied in the sandbox, so no new probes. A maintainer still needs to delete bughunt/bun/20260930-default-trust, bughunt/bun/20260930-isolated-bunpatch, bughunt/bun/20261001-vex-isolated and bughunt/bun/20261001-global-dirs.
• GitHub (github:) dependencies can't be resolved by Bun in the sandbox, so the git-tuple variant of Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 is untested.

Next

1. Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 variants: github: tuples (needs a probe runner) and a binary bun.lockb URL dependency. Re-test when fixed.
2. Global-mode leftovers: a non-writable global dir must fail loudly; a symlinked BUN_INSTALL; Windows 1.1.45/1.2.23 with an ASCII temp path.
3. Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 / Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 on macOS and Windows, once probe branches can be deleted again.
4. v5 socket.yml policy and per-run limits in a Bun workspace.
5. Re-test Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366 when .bun joins the crawler walks, and Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 once PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 lands.

[github-actions[bot]]

[agent] 2026-10-02: Bun bug-hunt run

Tested: main 61cfb9b (unchanged since run 5) and latest release 4.0.0. Bun 1.1.45, 1.2.23, 1.3.14 and 1.4.2 (1.4.2 is still the latest stable; canary 1.4.2-canary.20261001.1), from npm @oven/bun-linux-x64, on Linux only. No probe branch: git push --delete is still blocked from the sandbox.

Method: a fresh Python mock of the org-scoped patch API (batch, by-package, patches/package grants, view with blob contents, blob/<hash>, the hosted tarball route, and a /registry/ passthrough for SOCKET_NPM_REGISTRY), with SOCKET_PATCH_SERVER_URL set to the mock's origin. Patches: is-number@6.0.0 (critical), is-odd@3.0.1 (high), left-pad@1.3.0 (low). A second mock instance on the same origin serves a new is-number uuid with a -V2 marker, to exercise upgrades. Oracle: cold-cache bun install --frozen-lockfile in a fresh checkout, then the marker bytes.

Re-triage

• Main hasn't moved since run 5, so none of the open pm:bun issues (Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366, Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367, On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371, With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405, Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443, Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469, Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497) can have changed. No re-checks beyond Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 (below).

Cells (Linux)

• fail Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 (new variant, commented): binary bun.lockb (Bun 1.1.45) with a root URL-tarball is-number@6.0.0 and a nested registry copy under is-odd. Reproduced 2/2.
  • Hosted and vendored both report success with no warning and rewire only the nested record.
  • Frozen installs by 1.1.45, 1.2.23 and 1.4.2 leave the root copy unpatched.
  • Vendored vex (default and --no-verify) and hosted vex --no-verify attest not_affected. Hosted default vex omits it, correctly.
  • Comment: Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 (comment)
• pass: socket.yml maxNewPatches: 1 staged rollout in a Bun workspace (root + packages/a), hosted mode, on a text v2 lock (1.4.2), a text v1 lock (1.3.14) and a binary lockb (1.1.45). Runs go new 1 / deferred 2 → already 1 / new 1 → already 2 / new 1 → already 3 / new 0, in severity order. The member's dependency is ranked under project "", as documented.
• pass: the same rollout in vendored mode (1.4.2 v2 workspace).
• pass: a vendored → hosted takeover under maxNewPatches: 1. All three count as already, --dry-run shows redirect_would_revert_vendored ×3 and the wet run redirect_takeover_reverted_vendored ×3, .socket/ is removed, and the frozen install is patched (isolated linker).
• pass: ignorePackages on an already-pinned package (1.4.2 v2, 1.1.45 lockb). It's retained, and the lock is byte-identical.
• pass: enabled: false (1.4.2 v2, 1.1.45 lockb): redirected: 0 and nothing written.
• pass: a hosted upgrade to a new patch uuid (text v1, lockb). upgrade: 1, the pin moves to the new uuid, the re-run is already: 3, and the lockb frozen install gets the V2 bytes. Hosted rollback after the upgrade restores bun.lock byte-exact to the pre-patch commit (1.3.14 v1).
• pass: a dual-lock checkout (bun.lock + a stale bun.lockb). Hosted rewrites bun.lock only, and Bun 1.2.23 and 1.3.14 read bun.lock (frozen installs patched). A v1/v2 text lock is unreadable by 1.1.45 (lockfile had changes) with or without socket-patch, so that's environmental.
• pass: global mode with a symlinked BUN_INSTALL (1.4.2). scan -g --mode agent patches the global copy, vex -g attests it, and rollback -g restores it.
• documented: scan packages/a (a workspace-member PATH). Hosted reports success, 0 redirected, redirect_npm_no_lockfile. Vendored reports partial_failure with vendor_lockfile_missing (bun-compatibility.md, "Not measured").

Issues

• Commented on Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 (lockb variant). Filed nothing new.

False positives ruled out

• Mode-less scan -g is report-only (CLI_CONTRACT, mode resolution), so nothing is patched without --mode agent.
• scan -g --mode agent records the global copies in the cwd's .socket/manifest.json. By design (the global-scope paragraph).
• Dual-lock frozen-install failures on 1.1.45 come from the text-lock version, not from socket-patch (the control fails too).

Blocked

• Probe branches: git push origin --delete is still blocked from the sandbox. A maintainer still needs to delete bughunt/bun/20260930-default-trust, bughunt/bun/20260930-isolated-bunpatch, bughunt/bun/20261001-vex-isolated and bughunt/bun/20261001-global-dirs.

Next

1. Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 github: tuples (needs a probe runner).
2. Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 / Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 on macOS and Windows, once probe branches can be deleted.
3. socket.yml includePaths / ignorePaths over several independent Bun projects in one repo (shared budget, sorted visit order).
4. Re-test Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366 / With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405 when .bun joins the crawler walks, Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 when PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 lands, and Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 when PR Fix Bun/vlt bundled copies left unpatched (#469, #471) #472 lands.
5. Hosted rollback on real macOS and Windows checkouts.

[github-actions[bot]]

[agent] 2026-10-02: Bun bug-hunt run

Tested: main 61cfb9b (unchanged since run 5), latest release 4.0.0 (installed for comparison). Bun 1.4.2 and 1.1.45 (npm @oven/bun-linux-x64), Linux only. No probe branch: the four old probe branches still exist (deletion is still blocked from the sandbox).

Method: a fresh Python mock of the org-scoped patch API (batch, by-package with per-advisory severity, patches/package grants, view, blob/<hash>, the hosted tarball route and a /registry/ passthrough). Patches: is-number@6.0.0 (critical), is-odd@3.0.1 (high), left-pad@1.3.0 (low). The fixture is a git repo holding several independent Bun projects (apps/web, apps/api, services/legacy, tests/e2e, each with its own text v2 bun.lock, plus services/old with a 1.1.45 bun.lockb). Oracle: cold-cache bun install --frozen-lockfile and the marker bytes.

Re-triage

• Main hasn't moved and none of the open pm:bun issues (Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366, Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367, On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371, With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405, Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443, Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469, Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497) has new activity. Nothing to re-check.

Cells (Linux): backlog item 5, socket.yml across several Bun projects

• pass: includePaths: ["apps/**"] with scan '*/*' --mode hosted. Rewrites only apps/*/bun.lock. services/legacy is skipped (not matched by patches.includePaths), tests/e2e is skipped (built-in default), and frozen installs of the apps are patched while legacy stays unpatched.
• pass: a shared maxNewPatches: 2 across directories in sorted order. Run 1: apps/api 2 new, apps/web 1 (admitted free), services/legacy 1 of 2 (left-pad deferred). Run 2: left-pad lands. Run 3: no-op. The frozen installs are patched.
• pass: minSeverity precedence (1.4.2 v2): the file (critical), SOCKET_MIN_SEVERITY=high (source env), an empty env value (falls back to the file), --min-severity none beating the env, MODERATE read as medium, and a malformed value (exit 2).
• pass: ignorePaths: ["/services/"] plus minSeverity: critical over already-pinned projects. Retained, and every lock is byte-identical.
• pass: ignorePaths: ["!/tests/"] re-includes tests/e2e (rewired).
• pass: includePaths: ["**/bun.lockb"] selects only the 1.1.45 binary-lock project. It's rewired, and the frozen install by 1.1.45 is patched.
• pass: a case-insensitive includePaths: ["/APPS/WEB/"], and --cwd apps/web under a root-only policy (filtered policy_path_not_included).
• pass: vendored scan 'apps/**' (v2 locks). Both apps are vendored.

Handed over (not Bun-specific, not filed)

• Agent mode judges socket.yml path policy only at the scan root, so ignorePaths: ["/services/"] or a root-only includePaths still patch nested independent projects' node_modules (including tests/). Reproduced 2/2. Handed to npm: entries/npm/20261002T072532Z-from-bun.md.
• Hosted/vendored PATH globs also match .git/* and node_modules/* dirs (noise only). Same handover.

Issues

• None filed, none commented on, none closed.

False positives ruled out

• A hosted scan at a repo root with its own Bun project crawls nested projects' node_modules and warns redirect_bun_entry_not_found for their packages (status success, exit 0). That's warned and harmless: each nested project has its own lock and must be scanned by PATH.
• Agent partial_failure on the first try was a mock gap (no blob/<hash> route), not a CLI bug.
• No Bun cache write-through after the agent apply (~/.bun/install/cache/left-pad@1.3.0@@@1 stays pristine).

Next

1. Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 github: tuples, and Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 / Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 on macOS and Windows, once the probe branches can be deleted.
2. Re-test Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366 / With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405 when .bun joins the crawler walks, Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 when PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 lands, and Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 when PR Fix Bun/vlt bundled copies left unpatched (#469, #471) #472 lands.
3. Bun workspaces with a member under tests/ or an ignored path (the policy says to use ignorePackages); verify that hosted and vendored keep the member's deps.
4. Hosted rollback on real macOS and Windows checkouts.
5. A non-writable global dir (global mode, needs a probe), and Bun 1.0.x.

[github-actions[bot]]

[agent] 2026-10-02: Bun bug-hunt run

Tested: main 61cfb9b (unchanged since run 5), latest release 4.0.0. Bun 1.4.2, 1.3.14, 1.3.4, 1.3.2, 1.3.0 and 1.1.45 (npm @oven/bun-linux-x64), Linux only. No probe branch: the four old probe branches still exist, and deleting them is still blocked from the sandbox.

Method: a fresh Python mock of the org-scoped patch API (batch, by-package, patches/package grants, view with blobContent, blob/<hash>, the hosted tarball route, a /registry/ passthrough). Patches: is-number@6.0.0, is-odd@3.0.1, left-pad@1.3.0. The fixture is a hoisted workspace with root is-number@7.0.0, member packages/a → is-odd@3.0.1 (nested is-odd/is-number@6), and member tests/e2e → is-number@6.0.0 + left-pad (nested e2e/is-number@6). Oracle: cold-cache bun install --frozen-lockfile in a fresh clone, plus the marker bytes.

Re-triage

• Main hasn't moved, and no open pm:bun issue (Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366, Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367, On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371, With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405, Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443, Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469, Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497) has new activity. Nothing to re-check.

Cells (Linux)

• pass: a workspace member under tests/ (built-in default exclusion) on 1.4.2. Agent patches tests/e2e/node_modules/is-number. Hosted rewires e2e/is-number and is-odd/is-number, and the frozen install is patched. Hosted rollback and vendor --revert are byte-exact.
• pass: socket.yml ignorePaths: ["/packages/", "/tests/"] on the same workspace. Agent, hosted and vendored all keep patching the members (they share the root lock, per docs/configuration.md). Vendored frozen install is patched and vendor --revert is byte-exact.
• pass: the same workspace on 1.1.45 bun.lockb and on 1.3.14 text v1, hosted. Frozen installs are patched, and vex attests all three on 1.1.45, 1.3.14 and 1.4.2.
• pass: a dual lock (package-lock.json + bun.lock, 1.4.2). Hosted rewrites both and writes .npmrc. Bun's frozen install is patched, and rollback restores all three files byte-exact.
• pass: growth after a scan (1.4.2 hosted/vendored, 1.1.45 lockb hosted). A new member adds an unwired registry c/is-number@6.0.0, and re-running scan rewires it (frozen install patched).
• pass: Bun 1.3.0 / 1.3.2 / 1.3.4 (previously untested). On a single project, hosted and vendored scan → frozen install patched → rollback / vendor --revert byte-exact. On a workspace (lockfileVersion 1), hosted is the same, and vendored refuses vendor_bun_workspace_unsupported (documented) with no write. Agent scan + rollback pass on both shapes (1.3.0, 1.3.4).
• handover, not filed: vendored vex (and hosted vex --no-verify) attests a name@version while an unwired registry copy of it sits in the same lock (after the growth above, before the re-run). npm 10 behaves identically, so the cause is the shared discovery (contest_across_locks only contests across locks): entries/npm/20261002T133747Z-from-bun.md. Hosted default vex correctly skips it.

Issues

• None filed, none commented on, none closed.

False positives ruled out

• Vendored scan partial_failure on 1.3.0–1.3.4 workspaces is the documented pre-v2 workspace refusal.
• vex exit 2 product_undetected in fixtures without a version or a git origin: pass --product (fixture limit).

Next

1. Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 github: tuples, and Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 / Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 on macOS and Windows, once the probe branches can be deleted.
2. Re-test Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366 / With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405 when .bun joins the crawler walks, Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 when PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 lands, and Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 when PR Fix Bun/vlt bundled copies left unpatched (#469, #471) #472 lands.
3. Hosted rollback on real macOS and Windows checkouts.
4. A non-writable global dir (global mode, needs a probe), and Bun 1.0.x.
5. 1.3.0–1.3.4 with the isolated linker (the 1.3.x default for a fresh workspace): hosted → vex, under With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405.

[github-actions[bot]]

[agent] Janitor: ledger drift. The coverage matrix still lists these issues as fail, but they are now closed on GitHub. Please re-check those cells on main 6cd37540 on the next run:

• On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434: closed 2026-10-02 17:07 UTC
• Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469: closed 2026-10-02 15:36 UTC

This is a heads-up only. The janitor never edits ledgers.

---

Generated by Claude Code

[github-actions[bot]]

[agent] Janitor: ledger drift. The coverage matrix still lists these issues as fail, but they are now closed on GitHub. Please re-check those cells on main 203e092b on the next run:

• Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366: closed 2026-10-02 17:26 UTC by PR Fix npm crawler missing Bun, Deno and Yarn 4 stores (#366, #373, #405, #495) #496
• With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405: closed 2026-10-02 17:26 UTC by PR Fix npm crawler missing Bun, Deno and Yarn 4 stores (#366, #373, #405, #495) #496

This is a heads-up only. The janitor never edits ledgers.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-02: Bun bug-hunt run

Tested: main 203e092 (moved since run 8: #496 .bun store crawl, #472 bundled skip, #517 agent vex multi-copy, #555 apply skip, #442 global probes), latest release 4.0.0, Bun 1.4.2 (latest; canary 1.4.2-canary.20261002.1), 1.3.14, 1.3.4, 1.3.0, 1.2.23 and 1.1.45. Linux only: deleting the four old probe branches still fails from the sandbox (unexpected disconnect), so no new probes.

Method: a fresh Python mock of the public proxy (/patch/batch, by-package, view with blob contents, blob/<hash>, /patch/package grants, the tarball route) and a /registry/ passthrough. Patches: is-number@6.0.0, is-odd@3.0.1, left-pad@1.3.0, @isaacs/string-locale-compare@1.1.0 and use-sync-external-store@1.2.0, each appending a marker line to index.js. Oracle: marker bytes after a cold-cache bun install --frozen-lockfile in a fresh clone, and require.resolve.

Re-triage

• Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366 (closed by Fix npm crawler missing Bun, Deno and Yarn 4 stores (#366, #373, #405, #495) #496): verified fixed. On an isolated workspace, agent scan patches all 4 .bun copies on 1.2.23 (opt-in), 1.3.0, 1.3.4, 1.3.14 and 1.4.2. Rollback restores them, and hardlinks are broken (no cache write-through).
• With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405 (closed by Fix npm crawler missing Bun, Deno and Yarn 4 stores (#366, #373, #405, #495) #496): verified fixed. Hosted → vex on a stale isolated tree → not_applied (exit 1). A fresh clone with a frozen install attests all 4, on the same five versions, text lock and 1.4.2 bun.lockb workspace. Vendored + a stale isolated tree now warns vendored_tree_out_of_sync.
• Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 (closed by Fix Bun/vlt bundled copies left unpatched (#469, #471) #472): verified fixed for a file: tgz bundling is-number@6 next to a registry copy, on 1.4.2 text v2 and 1.1.45 lockb. Hosted warns redirect_bun_bundled_instance_skipped. Vendored skips with vendor_bundled_instance_skipped. vex and vex --no-verify withhold is-number with patched_ref_unattributable. A bundled-only instance in a workspace member: hosted warns with nothing redirected; vendored refuses vendor_lock_entry_not_rewritable.
• Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 is still reproducible (URL tgz root copy, 1.4.2: success, 2 redirected, no warning). Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 is still reproducible (BUN_INSTALL_GLOBAL_DIR: scan -g finds no Bun global packages). Nothing new to add, so no comment.

Cells (Linux)

• pass: isolated peer-set entries name@ver+<hash>, both transitive (swr → use-sync-external-store) and two peer sets of the same version (react 17/18). Agent patches both. vex after reverting one copy → not_applied.
• pass: --backend=symlink agent apply. The cache symlinks are replaced; nothing is written through.
• pass: hoisted multi-copy agent vex (Fix agent vex checking only one installed copy (#516) #517): one reverted member copy → not_applied.
• pass: 1.3.0 / 1.3.4 isolated workspace, hosted → frozen fresh install patched → vex → byte-exact rollback (backlog 5).
• fail With Bun's isolated linker, vex refuses every hosted patch as not_applied after the usual in-place bun install, because it checks orphaned node_modules/.bun registry entries that Bun never removes (regression from #496) #599 (new): isolated linker, hosted, then an in-place bun install --frozen-lockfile. Bun keeps the orphaned registry .bun/<name>@<ver> entries, and vex refuses every patch as not_applied (exit 1), while every reachable copy is patched. Reproduced on 1.4.2 (twice), 1.3.14 and 1.2.23. In vendored mode the orphans give false vendored_tree_out_of_sync warnings. First bad: 35de754 (Fix npm crawler missing Bun, Deno and Yarn 4 stores (#366, #373, #405, #495) #496).
• handover: duplicate already_patched skip events in agent apply for member-linked store packages. pnpm behaves identically → entries/pnpm/20261002T193154Z-from-bun.md.

Issues

• Filed With Bun's isolated linker, vex refuses every hosted patch as not_applied after the usual in-place bun install, because it checks orphaned node_modules/.bun registry entries that Bun never removes (regression from #496) #599.

False positives ruled out

• After bun install removes a dependency, Bun 1.4.2 keeps its .bun entry and the member link. That's Bun behaviour, not a socket-patch issue (but it feeds With Bun's isolated linker, vex refuses every hosted patch as not_applied after the usual in-place bun install, because it checks orphaned node_modules/.bun registry entries that Bun never removes (regression from #496) #599).
• scan -g reporting 564 packages with BUN_INSTALL_GLOBAL_DIR set: that's the Node global prefix being scanned, not Bun's dir (Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 stands).

Next

1. Re-test With Bun's isolated linker, vex refuses every hosted patch as not_applied after the usual in-place bun install, because it checks orphaned node_modules/.bun registry entries that Bun never removes (regression from #496) #599 when fixed; also the orphan cases after a version upgrade and after a hosted → rollback → in-place install.
2. Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 github: tuples; macOS/Windows cells (Windows isolated = junctions), once the probe branches are deleted.
3. Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 once a fix lands; a non-writable global dir; Bun 1.0.x.
4. Hosted rollback on real macOS/Windows checkouts.
5. The multi-project policy cells on a 1.1.45 lockb repo.

---

Generated by Claude Code