Bug hunt ledger: PDM

[Mikola Lysenko (mikolalysenko)]

[agent] Progress ledger for the scheduled PDM bug-hunt routine (label pm:pdm).

Last run: 2026-10-03 03:15Z on main 045d7ec (latest tag v4.0.0; #522 and #540 merged; #332/#451/#502/#528 closed by maintainers). Linux runs use real PDM against a local mock patch API, because the sandbox blocks the Socket patch hosts. macOS and Windows runs use probe branches.

Coverage matrix

PDM	lock_version	agent (Linux / macOS / Windows)	hosted (Linux)	vendored (Linux)
1.4.5	2	untested	pass on v5 (__pypackages__ sync, legacy [metadata.files], rollback byte-exact; CRLF lock pass d63ae5f); post-rollback install fail #477	pass d63ae5f (CRLF lock, sync patched, rollback byte-exact)
2.0.3	4.0	fail #332 w/ install.cache symlink; fail #502 (.pdm.toml python.path) / untested / untested	refused (documented)	refused (documented)
2.8.2	4.3	fail #332 w/ install.cache symlink (all 3 OS)	pass (stale-install warning)	untested
2.10.4	4.4	fail #332 w/ install.cache symlink; pth fails closed	pass (stale-install warning)	untested
2.11.2	4.4.1	fail #332 w/ install.cache symlink	untested	untested
2.12.4	4.4.1	fail #332 w/ install.cache symlink (all 3 OS; re-confirmed on v5 Linux); hardlink pass; fail #502 (venv.in_project=false; pass on PR #540)	pass (v5: #331/#382 fixed; dev/optional groups, relocks, pdm add repair); fail #528 (PEP 582 stale warning + VEX; pass on PR #540); fail #413 (private index static_urls); post-rollback install fail #477; CRLF lock pass; extras [socks] pass	pass on v5 (warm sync patched, vex; CRLF / mixed-ending lock, extras [socks]); post-rollback install fail #477
2.15.4	4.4.1	pass (all 3 OS, symlink + hardlink)	untested	untested
2.20.1	4.5.0	pass	pass (v5: #331/#382 fixed); fail #413	pass (v4)
2.26.9	4.5.0	pass (symlink/hardlink/pth)	pass on v4; untested on v5	untested
2.29.2	4.5.1	pass (all 3 OS, in-project .venv); fail #502 Linux (venv.in_project=false / pdm use <venv>: real env skipped, stray .venv or PATH python patched; pass on PR #540); space/unicode path pass	fail #528 (PEP 582 __pypackages__: no stale warning, VEX attests; pass on PR #540); CRLF lock pass, mixed-ending rollback LF-normalizes (cosmetic); extras [socks] pass; concurrent scans lock_held pass; space/unicode path pass; pass on v5 (dev/optional groups, update --update-all/--update-reuse/--unconstrained, lock --refresh keeps patch, lock-only scan, sync, manifest-less rollback byte-exact, VEX); multi-target fork refused (documented); fail #413 (re-confirmed 61cfb9b); stale warning + VEX with out-of-tree env fail #502; post-rollback install fail #477	pass on v5 (warm/fresh/frozen, lock --check, idempotent, vex, rollback byte-exact; private index + static_urls rollback byte-exact; nested services/* project; agent→vendored takeover; CRLF / mixed-ending lock; extras [socks]; rollback --preserve-state → re-scan; concurrent scans; space/unicode path); post-rollback / remove install fail #477
1.15.5	3.1	fail #502 (.pdm.toml python.path external venv)	refused (documented)	refused (documented)
2.15.4, 2.20.1	4.4.1 / 4.5.0	—	pdm add → uninstallable lock (PDM reuse, #331); re-scan repairs (pass)	pdm add → rollback fails closed; pdm lock → re-scan → rollback (pass)
1.4.5 / 1.15.5 / 2.0.3	2 / 3.1 / 4.0	agent PEP 582 (.pdm.toml python.path; plain, activated venv, stray .venv) pass on 045d7ec	—	—
2.27.0 – 2.29.2	4.5.x	agent PEP 582 with pdm.toml use_venv = "false" (PDM-written string) + activated / stray venv: fail #609; bool form and PDM_USE_VENV pass	—	—
all (2.26.9, 2.29.2 run)	—	agent PEP 582 with use_venv false in the user config + stray venv: fail #609	—	—
0.12.3	2 (legacy [tool.pdm])	untested	pass (fresh sync patched, rollback byte-exact); vex / scan --vex fail #642	pass (same); vex fail #642
1.0.0	2	untested	pass (fresh, vex, rollback byte-exact)	pass (fresh, vex, rollback byte-exact)
1.5.3	2	untested	pass (fresh)	pass (fresh, rollback byte-exact); warm env fail #641
1.6.4	3	untested	refused (pass)	refused (pass)
1.4.5 / 2.8.2 / 2.10.4	2 / 4.3 / 4.4	—	warm env warns (pass)	warm env: no stale warning, pdm sync/install keep upstream, vex attests: fail #641
2.11.2 / 2.29.2	4.4.1 / 4.5.1	—	—	warm env re-installs patched (pass)
1.8 – 1.14	3.1	untested	untested	untested

Modes × macOS/Windows for hosted and vendored: untested by this routine (the repo's pdm-compatibility.yml covers them).

Global mode (-g, maintainer request)

PDM	global location	scan -g report (Linux)	apply / rollback / vex -g (Linux)	macOS / Windows
2.29.2	system interpreter (default)	pass	pass (apply, idempotent, vex, rollback byte-exact)	untested
2.29.2	pdm use -g → global-project/.venv	pass on main d63ae5f (#451 fixed)	pass via --global-prefix (incl. space/unicode path, install.cache symlink per-file)	untested
2.29.2	PDM-managed cpython@3.12	fail #451 (pass on PR #522, apply + rollback)	untested
2.29.2 / 2.12.4	venv.in_project=false → <data>/pdm/venvs/global-project-*	pass on main (user-config venv.location, apply + rollback)	untested
2.29.2 / 2.12.4	global_project.path set in the site config /etc/xdg/pdm/config.toml	fail #566 (user-config control passes)	get -g patches another copy, global-project copy unpatched	untested
any	same release also in an earlier global env (system / pipx)	—	only the first copy patched (#501, generic)	untested
2.12.4	system interpreter (default)	pass	pass without install.cache; fail #332 with install.cache symlink (writes PDM cache)	untested
2.12.4	pdm use -g <pdm python> (no venv)	fail #451	untested
2.12.4	global-project/.venv	fail #451 (pass on PR #522)	—	untested
any	unwritable prefix (non-root)	—	exit 1, file untouched (pass); scan --json drops the reason (#424)	untested
0.12 – 2.0.3	—	untested	untested	untested

-g --mode hosted and --global-prefix --mode hosted refuse with exit 2 (pass). SOCKET_GLOBAL=1 matches -g (pass). --global-prefix <site-packages> finds both #451 locations (pass).

Backlog

1. Vendored PDM < 2.11 gives no stale-install warning, so after pdm sync the unpatched release stays installed while vex attests not_affected #641 follow-ups: vendored on a warm PEP 582 __pypackages__ (PDM 1.x); per-version pdm sync --reinstall remedy.
2. PDM PEP 582 detection misses python.use_venv = false as PDM 2.27+ writes it (a TOML string) and in the user config, so agent mode patches an activated or stray venv and leaves __pypackages__ unpatched #609 on macOS / Windows user-config paths, site config, PDM_CONFIG_FILE. (PDM ≥ 2.27 string venv.in_project doesn't matter: socket-patch never reads it and follows .pdm-python instead.)
3. Global scan (-g) ignores PDM's site-wide config, so a global project relocated in /etc/xdg/pdm/config.toml is never crawled and get -g reports "applied" while the copy PDM runs stays unpatched #566 on macOS / Windows site-config paths and site-config venv.location / python.install_root (use a non-3.11 interpreter). PDM 1.x global project (~/.pdm/global-project) under -g.
4. Re-run After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477 / Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 on main once patch/redirect/pdm.rs or upstream/pypi_locks.rs change (hosted mock: references + view).
5. Hash variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 (private index serving different bytes); PDM 1.x feature.install_cache with agent mode; PDM 1.8 – 1.14 agent cells.
6. macOS / Windows probes (branch deletion through the proxy / permission policy has failed before; the stale bughunt/pdm/20260930-cache-symlink needs a maintainer to delete it).
7. Done: PDM 0.12.3 / 1.0.0 / 1.5.3 hosted + vendored fresh; Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502/In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528 on main for 1.4.5 / 1.15.5 / 2.0.3 agent PEP 582; CRLF lock_version 2, SIGKILL-interrupted scans, groups, relocks, pdm add after hosted/vendored, CRLF / mixed / BOM locks, extras, rollback --preserve-state, concurrent scans, space/unicode paths.

Known non-bugs

• lock_version absent / 3.1 / 4.0–4.2 refused; 2.8.0 accepted-but-crashes (documented).
• __pypackages__ (PEP 582) not crawled; agent mode falls through to the PATH interpreter (documented). Hosted mode installs into __pypackages__ fine.
• A plain relock (pdm lock, pdm update <pkg>) drops the hosted / vendored patch (documented; re-scan). Measured: pdm lock --refresh actually keeps it on 2.12.4 and 2.29.2 (the doc's claim is conservative drift, not a bug). Rollback still works when the package stays at the same version.
• PDM < 2.11 keeps an already-installed same-version package after a hosted rewrite (redirect_pdm_stale_install_risk, documented).
• Vendored refuses lock-only checkouts (vendor_fetch_unverifiable), by design.
• Hosted never takes over a vendored path (redirect_pdm_refused), by design (hosted-direction takeover is warn-only). Hosted→vendored for PyPI fails closed with pypi_pdm_source_already_exists (the same for uv/poetry): run rollback first.
• A multi-target (pdm lock --append) lock holding the package at two versions is refused (redirect_pdm_refused), documented.
• PDM 2.10 install.cache_method=pth: agent apply fails closed with File not found.
• pdm lock without -G does not lock optional groups (PDM behaviour, not a socket-patch bug).
• The mock-based published 4.0.0 wheel yields redirected: 0 on lock-only projects, so it can't be used to bisect hosted findings.
• v5 hosted rollback/remove after the package left the lock (pdm remove, upgrade): exit 1 Manifest not found is the documented truly-empty result (formerly Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382).
• v5 hosted rollback refuses a non-universal release (binary wheels) on a lock without cross_platform (PDM ≥ 2.17 default inherit_metadata): documented in CLI_CONTRACT "Hosted unwind coverage".
• v5 hosted rollback on a cross_platform lock writes every PyPI release file (e.g. pyyaml 6.0.1: 51), where PDM locked a requires-python-filtered subset (39). Installs and lock --check are unaffected; cosmetic.
• v5 hosted VEX on a lock-only checkout attests the redirect (the lock is the hosted state); a stale installed copy is omitted not_applied.
• A first pdm add -g with no pdm use -g installs into the system interpreter, which scan -g does find; only the venv and PDM-managed interpreter cases are Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451.
• scan -g --mode vendored is accepted (exit 0) while hosted refuses. It isn't PDM-specific, so it's left to maintainers; not filed.
• rollback deletes the manifest entry (documented: it removes local state), so a later apply is a no-op.
• A mode-less scan without -g / --prune defaults to hosted and rewrites pdm.lock (documented default).
• From a monorepo root, scan 'services/*' writes per-project .socket/, but rollback from the root reports Manifest not found (use --cwd services/api). That's generic, not PDM-specific; left to maintainers.
• After an agent → vendored takeover, .socket/manifest.json stays as {"patches": {}} (cosmetic).
• Test-harness note: PDM's http:// downloads from a 127.0.0.1 mock get a 405 from the agent proxy unless HTTPS_PROXY is unset (sandbox artifact, not a bug).
• PDM 2.12 – 2.20 pdm add <other> after hosted/vendored keeps the patched hash but drops the url/path (an uninstallable lock, PDM reuse behaviour, known from Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331). Hosted re-scan repairs it. Vendored re-scan refuses (pypi_pdm_source_already_exists, "run pdm lock") and rollback fails closed (drift); the pdm lock → re-scan → rollback path works. 2.29.2 keeps the source.
• pdm sync --prod --clean leaves dev/optional-only packages installed: identical without socket-patch (PDM behaviour).
• The hosted stale-install warning mentions "Poetry before 1.4" on PDM projects (generic text, cosmetic).
• Test-harness note: VEX resolves the hosted patch uuid from the URL's second uuid segment, so a mock view must answer for it. Don't pkill -f mock, which kills the calling shell.
• A UTF-8 BOM pdm.lock is rejected by PDM itself (lock --check / sync fail with no socket-patch involved).
• Hosted rollback of a lock that mixes CRLF and LF rewrites the whole file to LF (scan only touches the edited unit; vendored rollback and pure-CRLF hosted rollback are byte-exact). PDM never writes mixed endings and the result is semantically identical, so it's cosmetic and not filed, though it drifts from pdm-compatibility.md's "preserves line endings".
• Test-harness note: hosted refs on a mock origin need SOCKET_PATCH_SERVER_URL; vendored grants need integrity.sha512 as SRI. pdm use in a fresh dir can pick another project's interpreter, so write .pdm-python explicitly. Out-of-tree PDM venvs are shared between copies of a project dir, so reset them (pdm sync --reinstall) between builds.
• A SIGKILLed hosted/vendored scan leaves .socket-stage-pdm.lock-<uuid> files in the project root that re-scan / rollback never sweep. The lock itself is always original or fully rewritten (85 kills, 2.29.2). Generic staging behaviour and crash-only, so it's left to maintainers.
• Test-harness note: the sandbox's /usr/local/lib/python3.11/dist-packages now carries urllib3 1.26.18 (from a pdm add -g with no global venv), which masks -g scan counts on python3.11; check the file bytes of the target copy instead.
• PDM 2.0–2.4 treat a .pdm.toml with a base python.path (from pdm use -f <base>) as PEP 582, and discovery agrees (verified on 2.0.3).
• Agent vex after a PDM PEP 582 detection misses python.use_venv = false as PDM 2.27+ writes it (a TOML string) and in the user config, so agent mode patches an activated or stray venv and leaves __pypackages__ unpatched #609 mis-patch fails closed (not_applied), so there's no false attestation there.
• lock_version by release: 1.5.x writes 2 (supported, installs fine), 1.6.x writes 3 and 1.7.x writes 3.1 (both refused, lock untouched). pdm-compatibility.md's "0.12 – 1.4" / "1.8 – 1.15" ranges are slightly off (doc drift only).
• The vendored vex attestation over an out-of-sync installed tree is by design (the vendored_tree_out_of_sync disclosure). Vendored PDM < 2.11 gives no stale-install warning, so after pdm sync the unpatched release stays installed while vex attests not_affected #641 covers only the missing scan warning and the remedy on PDM < 2.11.
• Test-harness note: PDM 1.5.x needs resolvelib==0.7.0; PDM 1.x pdm sync exits 1 on a throwaway [project] without [tool.pdm] distribution = false (self-install), unrelated to socket-patch.

[github-actions[bot]]

[agent] 2026-09-30: PDM bug-hunt run

First run. The ledger was empty and there were no earlier pm:pdm issues, so there was nothing to re-triage.

Tested: main f6b7fb9 (latest release tag v4.0.0), release build of socket-patch-cli. The sandbox blocks patches-api.socket.dev and patch.socket.dev, so all Linux work used real PDM releases against a local mock of the authenticated patch API (/patches/batch, /by-package, /view, /blob, /package). The mock serves a real urllib3 1.26.18 wheel with a marker appended to urllib3/response.py, with a correct RECORD and sha256. The mock script is embedded in the probe workflow of run 36735829162.

Filed

• Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332: agent mode writes the patch through PDM 2.0–2.12's directory-symlink install cache (install.cache=true, cache_method=symlink). The shared ~/.cache/pdm/packages gets patched, and so does every other project using it. Reproduced on Linux, macOS and Windows (probe run https://github.com/SocketDev/socket-patch/actions/runs/36735829162). 2.15+ (per-file symlinks) and hardlink are OK; pth fails closed.
• Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331: hosted rollback reports success but leaves the patch url/hash in pdm.lock after pdm add <other> / pdm lock --update-reuse followed by the suggested re-scan. On 2.12/2.20 it leaves the patched hash with no url, and pdm sync then fails. Linux, 2.12.4 / 2.20.1 / 2.26.9 / 2.29.2.

Cells covered (Linux unless noted)

Cell	Result
agent, install.cache symlink, 2.0.3 / 2.8.2 / 2.10.4 / 2.11.2 / 2.12.4	fail #332 (2.8.2 and 2.12.4 also fail on macOS and Windows)
agent, install.cache symlink (per-file), 2.15.4 / 2.20.1 / 2.26.9 / 2.29.2	pass (all 3 OS for 2.15.4 and 2.29.2)
agent, install.cache hardlink, 2.12.4 / 2.15.4 / 2.26.9 / 2.29.2	pass (all 3 OS)
agent, install.cache pth, 2.10.4 / 2.26.9	2.10.4 fails closed (File not found, exit 1); 2.26.9 pass
hosted 2.29.2: default / --static-urls / direct_minimal_versions / --platform linux / no_cross_platform / no_static_urls,no_cross_platform → pdm sync + pdm lock --check	pass
hosted 2.8.2 / 2.10.4 / 2.12.4: rewrite + warnings (redirect_pdm_stale_install_risk)	pass (documented)
hosted groups: dev group + sync --prod, optional group -G http	pass (VEX omits the not-installed package)
VEX on hosted lock before reinstall (stale install)	pass (not_applied omitted)
vendored 2.29.2: scan, sync --clean, install --frozen-lockfile, lock --check, idempotent re-scan, rollback byte-exact	pass
takeover vendored→hosted	refused redirect_pdm_refused (hosted direction is warn-only by design)
takeover hosted→vendored	fails pypi_pdm_source_already_exists, exit 1 (the same for uv/poetry; redirect_revert_supported has no pypi)
hosted relock pdm lock → re-scan → rollback	pass
hosted pdm add / lock --update-reuse → re-scan → rollback	fail #331

Ruled out / not filed

• Vendored lock-only checkout refused (vendor_fetch_unverifiable): by design (lock_inventory/pypi.rs:531).
• static_urls hosted rewrite emits {file, hash} rather than the {url, hash} shape the doc claims. PDM installs it fine, so this is at most a doc nit.
• The empty-venv hosted scan crawls the PATH interpreter (119 packages): documented fall-through.
• 2.22.4 / 2.25.9 are SKIP in results.json. That is a harness artifact on the doc's run, and the CI matrix covers them.

Housekeeping

• Probe branch bughunt/pdm/20260930-cache-symlink could not be deleted: the sandbox git proxy disconnects on ref-delete pushes (tried 5×). A maintainer should delete it. It only adds .github/workflows/bughunt-pdm.yml.
• The GitHub issue search API returns 0 results for every query in this sandbox, so dedup used a full REST listing of issues and PRs (308) grepped locally.

Next

1. PDM 1.x feature.install_cache (symlink/pth) with agent mode, on python.use_venv=true.
2. Hosted after pdm update urllib3 / pdm remove / pdm lock --refresh, plus the rollback invariants (sibling of Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331).
3. CRLF + pdm add rebase; pdm lock -L custom.lock with a later rename to pdm.lock.
4. Windows long-path and unicode project dirs for hosted and vendored (probe).
5. inherit_metadata multi-target lock (pdm lock --append --python) with a forked package vs a single version: refusal and VEX.

[github-actions[bot]]

[agent] 2026-09-30: PDM bug-hunt run

Tested: main f6b7fb9 (v4.0.0-33), release build of socket-patch-cli, plus the published PyPI socket-patch 4.0.0 for comparison. Linux only, with real PDM releases against a local mock of the authenticated patch API (batch, by-package, view, blob, package), which serves a real urllib3 1.26.18 wheel with a marker line appended to urllib3/response.py.

Filed / commented

• Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 (new): hosted rollback and remove <purl> fail permanently (exit 1, "the file drifted; re-run scan") once the patched package leaves pdm.lock through pdm remove, a transitive removal, or an upgrade to another version. The recommended re-scan (redirected: 0) never prunes the stale ledger edit. Reproduced 2/2 on 2.12.4, 2.20.1 and 2.29.2, plus 1.4.5 (commented). VEX correctly omits the package (redirect_unwired). Not covered by Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 / PR Fix PDM rollback leaving the patch after a re-scan (#331) #375.
• Handover to uv (entries/uv/…-from-pdm.md): the same flow fails with uv remove, possibly already covered by Hosted uv rollback and remove are stuck after any unrelated pyproject.toml edit or uv add, and the suggested re-scan doesn't fix it #379.

Re-triage

• Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 and Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332: main is unchanged since the last run (f6b7fb9), so no re-check was needed. Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 has fix PR Fix PDM rollback leaving the patch after a re-scan (#331) #375 (open, draft), which doesn't cover Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382's case.

Cells covered (Linux)

Cell	Result
hosted pdm remove → rollback / re-scan+rollback / remove <purl>, 2.12.4 / 2.20.1 / 2.29.2 / 1.4.5	fail #382
hosted, upgrade to urllib3 1.26.19 + pdm lock → re-scan → rollback, 2.20.1 / 2.29.2	fail #382
hosted, transitive removal (pdm remove requests), 2.29.2	fail #382
vendored 2.12.4 / 2.20.1: scan, fresh sync, install --frozen-lockfile, lock --check, idempotent re-scan, byte-exact rollback	pass
multi-target --append lock (1.26.18 for <3.10, 2.0.7 for >=3.10), 2.29.2 hosted	refused redirect_pdm_refused, lock unchanged (documented)
CRLF lock hosted → sync → pdm lock (re-renders LF) → re-scan → rollback, 2.29.2	pass (lands on the relocked registry lock)
PDM 1.4.5 lock_version 2 ([metadata.files]) hosted: rewrite, both warnings, pdm sync into __pypackages__ installs patched bytes, idempotent, byte-exact rollback	pass
VEX after the package left the lock	pass (omitted, redirect_unwired)

Ruled out / not filed

• The multi-target fork refusal is documented.
• The published 4.0.0 wheel doesn't produce a hosted redirect for a lock-only project against the mock (redirected: 0), so Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 can't be bisected against it. That's not a finding: it's a mock/route difference.
• PDM 1.x bootstrap needs the era pins from scripts/backtest-pdm.py:pins_for (pythonfinder 1.2.10 etc.). That's an environment issue, not a bug.

Housekeeping

• The old probe branch bughunt/pdm/20260930-cache-symlink still can't be deleted: git push --delete gets "remote end hung up" from the sandbox proxy again. A maintainer should delete it. For that reason I didn't create a new probe branch this run, and Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 is platform-independent logic anyway.

Next

1. pdm update --unconstrained / pdm lock --update-all on hosted (does it keep the url, like --update-reuse in Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331?).
2. PDM 1.x feature.install_cache with agent mode (sibling of Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332); 1.4.5 now bootstraps with the backtest pins.
3. Hosted with a private [[tool.pdm.source]] index and respect-source-order; pdm export of a hosted lock.
4. Windows long-path / unicode dirs (probe, once branch deletion works).
5. Re-triage Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 when PR Fix PDM rollback leaving the patch after a re-scan (#331) #375 merges; Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332.

[github-actions[bot]]

[agent] 2026-10-01: PDM bug-hunt run

Tested: main 2463257 (#277, "consolidate the v5 patching workflow"; latest tag v4.0.0), release build, plus a build of f6b7fb9 (v4) to bisect. Linux only. Real PDM 2.12.4 / 2.20.1 / 2.29.2 against a local mock of the v5 patch API (batch, by-package, package grant, view, hosted wheel), with SOCKET_PATCH_SERVER_URL set to the mock origin. Hosted rollback in v5 re-derives files from PyPI's JSON API. The Rust client can't reach pypi.org through the sandbox proxy, so SOCKET_PYPI_JSON_API pointed at a local pass-through to pypi.org.

Filed / closed

• Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 (new): hosted rollback and remove rewrite a private-index static_urls lock's file URLs to files.pythonhosted.org. PDM 2.20/2.29 then bypass the mirror (0 mirror hits), and PDM 2.12.4 fails pdm sync on a mirror-only network. The uv and Pipenv restores refuse a non-PyPI index; restore_pdm doesn't check. First bad commit is 2463257; v4 f6b7fb9 round-trips byte-exactly.
• Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 closed (fixed by v5 prerelease: scan → vex → vendor workflow, hosted by default #277): pdm add / --update-reuse → re-scan → rollback leaves 0 patch refs, and pdm sync / lock --check pass (2.12.4, 2.20.1, 2.29.2).
• Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 closed (fixed by v5 prerelease: scan → vex → vendor workflow, hosted by default #277): with no v5 ledger there's no stale state. After pdm remove or an upgrade, rollback / remove exit 1 with Manifest not found, the documented truly-empty project result.

Cells covered (Linux)

Cell	Result
hosted 2.29.2 lock-only: scan → pdm sync (patched bytes) → idempotent re-scan → manifest-less rollback (byte-exact)	pass
hosted #331 flows, 2.12.4 / 2.20.1 / 2.29.2	pass (fixed)
hosted #382 flows (remove, upgrade), 2.12.4 / 2.20.1 / 2.29.2	pass (documented exit 1)
hosted private index + static_urls, rollback / remove, 2.12.4 / 2.20.1 / 2.29.2	fail #413
hosted pyyaml (binary wheels), 2.29.2 default inherit_metadata: rollback	refused (documented in CLI_CONTRACT)
hosted pyyaml, 2.12.4 cross_platform: rollback	success, but writes all 51 PyPI files where PDM had locked 39 (it drops the cp36/cp37 wheels by requires-python). Installs fine. Cosmetic, not filed.
VEX manifest-less, 2.29.2: stale install omitted (not_applied); after pdm sync attests; lock-only attests	pass

Ruled out / not filed

• The 2.29 default-strategy rollback refusal for non-universal releases is documented ("a pdm.lock without cross_platform …").
• The cross_platform file-superset restore: pdm sync and lock --check are unaffected, so it isn't a functional break. It's noted under Known non-bugs.

Housekeeping

• git push --delete of the stale probe branch bughunt/pdm/20260930-cache-symlink was denied by the session's permission classifier this run. A maintainer should delete it. No new probe branches were created, since they couldn't be cleaned up.

Next

1. Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 re-triage on v5 (agent mode, install.cache symlink, PDM 2.0–2.12).
2. Vendored mode on v5 (vendored_backend): 2.29.2 / 2.12.4 / 1.4.5, plus private index + static_urls (does vendored rollback keep the mirror URLs?).
3. Hosted on lock_version 2 (PDM 0.12 / 1.4.5) through the v5 upstream restore ([metadata.files] full-release assumption).
4. Hosted → vendored takeover on v5 (now through the upstream restore).
5. A non-static_urls private index serving different bytes for the same name and version (the hash variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413).

[github-actions[bot]]

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major PDM version and on Linux, macOS and Windows.

Where PDM puts global installs: pdm -g global project (~/.pdm/global-project, or ~/.local/share/pdm/global-project) plus the global interpreter's site-packages. Check that -g doesn't patch PDM's shared install cache (see #332).

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed PDM package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a PDM project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × PDM version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

[github-actions[bot]]

[agent] 2026-10-01: PDM bug-hunt run

Tested: main 2463257 (#277, v5 consolidation; latest tag v4.0.0, unchanged since the last run), release build. Linux only, real PDM 2.12.4 and 2.29.2. Global-mode discovery was checked with a logging mock of POST /patch/batch (SOCKET_PROXY_URL), which records every PURL the CLI queries. #332 was re-checked with the issue's own probe.py (a v4-shaped mock, which v5 agent mode still accepts).

Filed / commented

• Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 (new): scan -g never crawls PDM's global locations: the global-project venv that pdm use -g creates (<config>/pdm/global-project/.venv), and PDM-managed interpreters (<data>/pdm/python/cpython@X/…/site-packages, which pdm add -g uses directly on 2.12). It exits 0 and the packages are never queried. --global-prefix <site-packages> finds them.
• Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 commented: it still reproduces on v5 2463257. With PDM 2.12.4 symlink cache, both the PDM cache and a never-scanned project get the patch (2/2 runs); the 2.29.2 control is OK.

Cells covered (Linux)

Cell	Result
scan -g report, PDM 2.29.2 / 2.12.4 default global (system interpreter → /usr/local/lib/python3.11/dist-packages)	pass
scan -g, 2.29.2 pdm use -g → global-project/.venv	fail #451
scan -g, PDM-managed cpython@3.12 (2.29.2 pdm python install; 2.12.4 pdm use -g without a venv)	fail #451
scan -g run from inside the global project dir	fail (same as #451)
--global-prefix <dir> on both locations	pass (finds them)
SOCKET_GLOBAL=1 parity with -g	pass
scan -g --mode hosted, --global-prefix … --mode hosted	pass (exit 2, loud refusal, nothing written)
#332 agent mode + install.cache symlink, 2.12.4 / 2.29.2 on v5	fail #332 / pass

Ruled out / not filed

• scan -g --mode vendored is accepted (exit 0, crawls 108 global packages, nothing to vendor), while hosted refuses. It isn't PDM-specific and isn't documented either way, so I didn't file it. A sibling or maintainer may want to decide whether vendored should refuse like hosted.
• The first pdm add -g without pdm use -g uses the system interpreter, and that is found. Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 is limited to pdm use -g / pdm python install setups.

Housekeeping

• git push origin --delete bughunt/pdm/20260930-cache-symlink fails again ("unexpected disconnect while reading sideband packet"). The git proxy appears to reject ref deletion. A maintainer still needs to delete that branch. I created no new probe branches, so macOS and Windows weren't covered.
• Side effect: the sandbox's first pdm add -g installed pip/setuptools/wheel/six/packaging into the container's system interpreter (ephemeral container, no impact on the repo).

Next

1. Global mode, rest of the maintainer checklist: scan -g --mode agent / apply -g / rollback -g / vex -g against a real global install (needs a v5-shaped mock serving a patch for a package in /usr/local/.../dist-packages and in global-project/.venv via --global-prefix). Also check that -g never writes into PDM's install cache (a Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 variant: global project with install.cache=true).
2. Global mode on PDM 1.4.5 / 2.0.3 (where does -g install? PEP 582 __pypackages__ in the global project?), and with venv.in_project=false (<data>/pdm/venvs/global-project-*).
3. Vendored on v5 (vendored_backend): 2.29.2 / 2.12.4 / 1.4.5, incl. private index + static_urls.
4. Hosted lock_version 2 (0.12, 1.4.5) through the v5 upstream restore.
5. macOS / Windows probes for Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 and the global checklist, once branch deletion works.

[github-actions[bot]]

[agent] 2026-10-01: PDM bug-hunt run

Tested: main 6e7ef74 (4 commits since 2463257: npm, poetry and maven fixes; none touch PDM code; latest tag v4.0.0), release build. Linux only. Real PDM 1.4.5 / 2.12.4 / 2.29.2 against a local mock of the patch API (batch, by-package, view, blob, package grant plus the patched-wheel download, with SOCKET_PATCH_SERVER_URL set to the mock). Hosted restores used SOCKET_PYPI_JSON_API pointed at a local pass-through to pypi.org.

Filed / commented

• After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477 (new): after a hosted or vendored rollback, pdm sync, pdm install and pdm install --frozen-lockfile keep the patched build installed (All complete! 0/0; direct_url.json still points at the patch server, or at the deleted .socket/vendor wheel). Rollback's note says the bytes stay "until the next package-manager install", which is false on PDM. Only pdm sync --reinstall restores upstream. Reproduced on 1.4.5, 2.12.4 and 2.29.2, vendored and hosted.
• Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 commented: global mode hits it too. With PDM 2.12.4 install.cache + symlink, pdm add -g links the global interpreter's urllib3 directory into the cache. scan -g --mode agent then patches PDM's cache and, through it, a never-scanned project (2/2 runs). rollback -g un-patches both. The 2.29.2 control is clean.
• scan/get --json drop the agent-mode apply failure: exit 1 with failed: 0, the patch shown as "added", and no error anywhere (e.g. a read-only global ~/.m2) #424 commented (Maven-labelled, generic): the same scan --json agent-apply failure drop reproduces for PyPI. A root-owned --global-prefix, run as uid 65534, gives exit 1 with failed: 0 and no error, while apply --json gives apply_failed / "Permission denied".

Re-triage

• Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 still reproduces on 6e7ef74: scan -g with a 2.29.2 pdm use -g venv crawls 15 packages and finds 0 patches. Unchanged code, so no comment.
• Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 and Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332: no PDM-relevant change on main. Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 was re-confirmed via -g (above).

Cells covered (Linux)

Cell	Result
-g agent, 2.29.2 default global (system dist-packages): scan -g --mode agent, apply -g idempotent, vex -g --product, rollback -g byte-exact; mode-less scan -g report-only	pass
-g agent, 2.12.4 install.cache symlink global	fail #332
--global-prefix <global-project/.venv site-packages> agent apply → import sees the patch → vex → rollback byte-exact, 2.29.2 with install.cache symlink (per-file links, cache pristine)	pass
--global-prefix with a space + unicode path, apply / rollback	pass
Unwritable global prefix (non-root user): exit 1, file untouched; apply reports clearly; scan --json drops the reason	fail #424 (JSON only)
vendored v5 2.29.2: scan → warm pdm sync installs the patch → lock --check → fresh install --frozen-lockfile → idempotent re-scan → vex → rollback byte-exact	pass
vendored v5 2.12.4: scan → warm sync / install patched → vex	pass
rollback (vendored + hosted) → pdm sync / install --frozen-lockfile, 2.29.2 / 2.12.4 / 1.4.5	fail #477
hosted lock_version 2 (1.4.5, [metadata.files]) via the v5 upstream restore: rewrite + both legacy warnings, pdm sync into __pypackages__ patched, idempotent, rollback byte-exact	pass

Ruled out / not filed

• Rollback deletes the manifest entry, so a later apply has nothing to do. That's documented (usage.md: rollback "remove[s] their local state").
• A mode-less scan (not -g) defaults to hosted and rewrites the lock. That's documented. My own run tripped on it mid-test; the affected observation was discarded and redone.
• vex needs --product outside a packaged project (documented error).

Housekeeping

• git push origin --delete bughunt/pdm/20260930-cache-symlink still fails ("remote end hung up"). A maintainer needs to delete it. I created no new probe branches, so macOS and Windows weren't covered.
• Side effect: pdm add -g / pdm remove -g against the container's system interpreter also synced away unrelated packages in /usr/local/lib/python3.11/dist-packages (ephemeral container, so no repo impact).

Next

1. Global -g on PDM 1.4.5 / 2.0.3 (where does -g install: __pypackages__ in the global project?), and venv.in_project=false global venvs (<data>/pdm/venvs/global-project-*).
2. After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477 siblings: remove <purl> and rollback --preserve-state on PDM; agent → vendored takeover on v5.
3. Vendored v5 with a private index + static_urls (does vendored rollback keep the mirror URLs, unlike Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413?).
4. pdm update --unconstrained / lock --update-all on hosted; groups / dev-dependencies via pdm sync -G.
5. macOS / Windows probes, once branch deletion works.

[github-actions[bot]]

[agent] 2026-10-01: PDM bug-hunt run

Tested: main 61cfb9b (16 commits since 6e7ef74: Python crawler .egg-info #452, global pipx #418, -g cwd state #446, Pipenv fixes. None touch PDM discovery or the pdm.lock writers. Latest tag v4.0.0, also installed from PyPI for bisection). Release build. Linux only, real PDM 2.29.2 / 2.12.4 against a fresh local mock of the public patch proxy (SOCKET_PROXY_URL: batch, by-package, view, blob, package with sha256 + sha512 integrity, plus a real patched-wheel host, a PyPI JSON pass-through and a private simple index). Note for future runs: PDM must run with HTTPS_PROXY unset (PyPI is in no_proxy), or its http:// downloads from 127.0.0.1 get a 405 from the agent proxy.

Filed / commented

• Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502 (new): agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false → <data>/pdm/venvs/…, or pdm use <venv>). Agent mode either skips the real env ("not installed", exit 0) or patches a stray ./.venv / the PATH python3 (applied: 1). Hosted mode gives no stale-install warning, and vex attests not_affected while pdm run imports upstream bytes. Reproduced on 2.29.2 and 2.12.4. Not a regression (4.0.0 is the same). It's the PDM version of the Poetry/Pipenv out-of-tree probes (Agent-mode scan misses Poetry's venv for nameless non-package-mode projects, [project].name overrides, and in-project = false with a stray .venv, and still exits 0 #327/Windows agent-mode scan never finds Poetry's default out-of-tree virtualenv, so patches are skipped and the scan exits 0 #329/Agent-mode scan skips Pipenv's out-of-tree venv when the project has a stray venv/ directory or a .venv with PIPENV_VENV_IN_PROJECT=0, and still exits 0 #334/Poetry with virtualenvs.in-project = true but no ./.venv keeps using its out-of-tree env, which socket-patch never probes: agent patches the global interpreter and hosted VEX falsely attests #476).
• After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477 commented: remove <purl> (vendored) restores the lock but prints no advisory, and pdm sync keeps the patched wheel.

Re-triage

• Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 still reproduces on 61cfb9b. Hosted scan → rollback on a private-index static_urls lock rewrites both file URLs to files.pythonhosted.org. No new information, so no comment.
• Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332, Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451: no PDM-relevant change on main. Not re-run.

Cells covered (Linux)

Cell	Result
hosted 2.29.2 smoke: scan → pdm sync installs the patch	pass
vendored 2.29.2, nested project services/api scanned from the repo root (scan 'services/*') → sync / install --frozen-lockfile patched	pass
vendored 2.29.2, private index + static_urls lock: scan → sync patched → frozen install → idempotent → rollback byte-exact (mirror URLs kept, unlike hosted #413)	pass
agent → vendored takeover v5 (2.29.2): manifest record moved to the vendor ledger, sync installs the vendored wheel, rollback restores the lock	pass (leftover install = #477)
remove <purl> vendored → pdm sync	fail #477 (no advisory)
agent, venv.in_project=false (2.29.2, 2.12.4), ± stray .venv, ± PATH python, pdm use <external venv>	fail #502
hosted stale warning + VEX with an out-of-tree env	fail #502; in-project control pass
hosted rollback, private index static_urls	fail #413 (still)

Ruled out / not filed

• From a monorepo root, scan 'services/*' writes state to services/api/.socket, but rollback / rollback 'services/*' from the root fail with Manifest not found at ./.socket/manifest.json. rollback --cwd services/api works. That's generic (not PDM-specific) and arguably the path-glob contract, so it's left to maintainers and not filed.
• After the agent → vendored takeover, .socket/manifest.json is left as {"patches": {}}. Cosmetic, not filed.

Housekeeping

• No probe branches were created (the stale bughunt/pdm/20260930-cache-symlink still needs a maintainer to delete it, since ref deletion through the git proxy fails), so macOS and Windows weren't covered.

Next

1. Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502 on PDM 1.4.5 (.pdm.toml python.path, PEP 582 default) and 2.0.3; macOS / Windows venv dirs.
2. Global -g on PDM 1.4.5 / 2.0.3, and venv.in_project=false global venvs (overlaps Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 / Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502).
3. Hosted pdm update --unconstrained / lock --update-all; groups via pdm sync -G / --prod after hosted and vendored.
4. Hash-variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 (private index serving different bytes); PDM 1.x feature.install_cache with agent mode.
5. macOS / Windows probes once probe-branch deletion works.

[github-actions[bot]]

[agent] 2026-10-02: PDM bug-hunt run

Tested: main 61cfb9b (unchanged since the last run; latest tag v4.0.0), release build, and draft PR #522 head e5ab4b5 for re-triage. Linux only, real PDM 1.15.5 / 2.0.3 / 2.12.4 / 2.15.4 / 2.20.1 / 2.29.2, against a fresh local mock of the authenticated patch API (SOCKET_API_URL + fake token + org, batch / by-package / view / blob / package, a real patched-wheel host, a PyPI JSON pass-through). A second mock instance serves urllib3 1.26.17, because the container's system interpreter now carries urllib3 1.26.18 (left over from an earlier pdm add -g, which I can't remove), and that copy would shadow -g results.

Filed / commented

• In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528 (new): in a PEP 582 __pypackages__ project, hosted mode gives no stale-install warning, and vex attests not_affected (exit 0) while pdm run imports upstream bytes. The docs recommend hosted mode for exactly these projects. In-project .venv control: warning plus not_applied. Reproduced 2/2 on 2.29.2 and 2.12.4. Also a false negative after a correct pdm sync when the PATH python has the same release.
• Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502 commented: PDM < 2.5 records the interpreter in .pdm.toml [python] path, not .pdm-python. Reproduced (agent: package_not_installed, exit 0) on 1.15.5 and 2.0.3.
• Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 commented: PR Fix global Python scan missing uv and PDM installs (#449, #451) #522 verified with real PDM. Global-project .venv, the out-of-tree global-project-<hash> venv (2.29.2 and 2.12.4) and the PDM-managed cpython@3.12.14 are all patched, and rollback restores them (main: applied 0). Caveat: a same-release copy in an earlier global location still wins via crawl_all's first-wins PURL dedup (With the same release in user site-packages and a system site-packages dir, agent mode patches the shadowed system copy, leaves the copy Python imports unpatched, and VEX attests it (worse since #452: now hits apt-installed packages) #501).

Re-triage

• Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451: fixed by open PR Fix global Python scan missing uv and PDM installs (#449, #451) #522 (above), not merged yet, so left open.
• Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502: still reproduces (no code change on main).

Cells covered (Linux)

Cell	Result
hosted / vendored, urllib3 only in a dev group or an optional group, 2.29.2 and 2.12.4: scan → lock --check → warm sync → fresh sync → install --frozen-lockfile → vex → rollback byte-exact	pass
pdm sync --prod --clean leaving dev/optional urllib3 installed	PDM behaviour (no-socket-patch control identical), not a bug
hosted + update --unconstrained (upgrades → rollback Manifest not found, documented), update --update-all, update --update-reuse, lock --refresh; re-scan; rollback byte-exact	pass
pdm lock --refresh after hosted and vendored keeps the patch on 2.12.4 and 2.29.2 (the doc says it drops it; harmless doc drift)	pass
vendored + lock / update --update-reuse / --update-eager (drop patch, re-scan restores), add six on 2.29.2 (kept)	pass
pdm add <other> after hosted or vendored on 2.12.4 / 2.15.4 / 2.20.1: patched hash kept, source dropped → uninstallable lock (known from #331). Hosted re-scan repairs, and rollback is clean. Vendored rollback fails closed (drift); the pdm lock → re-scan → rollback remedy works	pass (by design)
agent with pdm use <external venv> on 1.15.5 / 2.0.3	fail #502
hosted PEP 582 __pypackages__ stale warning + vex, 2.29.2 / 2.12.4	fail #528
-g on PR #522: PDM global-project venv / out-of-tree venv / managed interpreter	pass on #522, fail on main (#451)
same release in two global envs (system + pipx venv): only the first patched	fail, covered by #501 (generic)

Ruled out / not filed

• The --prod --clean leftover reproduces without socket-patch.
• The 2.12–2.20 pdm add uninstallable lock is PDM's reuse behaviour, already handled (Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 fix plus the pypi_pdm_source_already_exists refusal).
• The hosted stale warning text mentions "Poetry before 1.4" on a PDM project. Cosmetic, not filed.

Housekeeping

• No probe branches (the stale bughunt/pdm/20260930-cache-symlink still exists; deletion through the git proxy fails). macOS and Windows weren't covered.

Next

1. In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528 on PDM 1.4.5 / 1.15.5 (PEP 582 default; hosted refused on 3.1, so only lock_version 2 / 4.x) and agent -g with PEP 582.
2. Once Fix global Python scan missing uv and PDM installs (#449, #451) #522 merges: re-run the -g matrix on main, plus PDM 1.x / 2.0.3 global projects.
3. Hash variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 (private index serving different bytes); rollback --preserve-state on PDM.
4. CRLF / BOM pdm.lock on hosted + vendored with 2.12 / 2.29; concurrent scan runs (--lock-timeout).
5. macOS / Windows probes once probe-branch deletion works.

[github-actions[bot]]

[agent] 2026-10-02 (09:23Z): PDM bug-hunt run

Tested: main 61cfb9b (unchanged since the last run; latest tag v4.0.0), release build, and PR #540 head 60dfb81 for re-triage. Linux only, real PDM 2.12.4 / 2.29.2, against a fresh local mock of the authenticated patch API serving a real patched urllib3 1.26.18 wheel.

Filed / commented

• No new issues.
• In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528 commented: PR Fix Python env discovery ignoring uv/PDM env (#502, #525, #528) #540 fixes it on 2.29.2 and 2.12.4. Before the fix: no stale-install warning, and vex exits 0 with not_affected over upstream __pypackages__. With the fix: warning printed, and vex exits 1 and omits the package. Main still reproduces it. In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528 (comment)
• Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502 commented: PR Fix Python env discovery ignoring uv/PDM env (#502, #525, #528) #540 fixes venv.in_project=false. In agent mode on 2.29.2, main skips the package as "not installed", while Fix Python env discovery ignoring uv/PDM env (#502, #525, #528) #540 patches the out-of-tree venv. In hosted mode on 2.29.2 / 2.12.4, Fix Python env discovery ignoring uv/PDM env (#502, #525, #528) #540 prints the stale-install warning and vex omits the package. Main still reproduces it. Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502 (comment)

Re-triage

• In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528 and Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502: still reproduce on main. Fixed on open PR Fix Python env discovery ignoring uv/PDM env (#502, #525, #528) #540, so both stay open.

Cells covered (Linux, main 61cfb9b)

Cell	Result
hosted, CRLF pdm.lock, 2.29.2 / 2.12.4: scan keeps CRLF, lock --check, sync patched, vex, rollback byte-exact	pass
vendored, CRLF and mixed-ending pdm.lock, 2.29.2 / 2.12.4: scan, lock --check, sync patched, install --frozen-lockfile, vex, rollback byte-exact	pass
hosted, mixed CRLF/LF pdm.lock, 2.29.2 / 2.12.4: install, vex pass; rollback normalizes every line of the lock to LF (not byte-exact)	minor, not filed (see below)
UTF-8 BOM pdm.lock	PDM itself rejects it (lock --check / sync fail before socket-patch runs), so out of scope
urllib3[socks] (separate PDM extras [[package]] entry), hosted + vendored, 2.29.2 / 2.12.4: both entries rewritten, fresh frozen install patched, vex, rollback byte-exact	pass
vendored rollback --preserve-state → frozen install → re-scan rewires identically → rollback byte-exact; .socket/vendor removed	pass
3 concurrent scan runs (hosted and vendored, 2× each): one wins, the others exit 1 lock_held; lock valid, rollback byte-exact	pass
project path with spaces + unicode (sp ace/ünï-2.29.2): hosted, vendored, agent (apply, idempotent, vex, rollback)	pass
PEP 582 hosted warning + vex (#528), 2.29.2 / 2.12.4	fail #528 on main, pass on PR #540
venv.in_project=false agent + hosted (#502), 2.29.2 / 2.12.4	fail #502 on main, pass on PR #540

Ruled out / not filed

• Mixed-ending hosted rollback: scan only normalizes the edited [[package]] unit, but hosted rollback rewrites the whole file to LF. Vendored rollback is byte-exact, and so is a pure-CRLF hosted rollback. PDM never writes a mixed lock, and the result is semantically identical (lock --check passes), so it's cosmetic. It does contradict pdm-compatibility.md's "preserves line endings". Recorded as a known non-bug.
• BOM: PDM's own TOML reader rejects it.
• Harness pitfalls (not bugs): pdm venv create / pdm use in a fresh dir can reuse another project's interpreter in .pdm-python; out-of-tree venvs are shared across copies of a project dir; hosted refs on a mock origin need SOCKET_PATCH_SERVER_URL; vendored grants need integrity.sha512 as SRI (sha512-<b64>).

Housekeeping

• No probe branches. git push --delete of the stale bughunt/pdm/20260930-cache-symlink still fails through the git proxy ("remote end hung up"), so it still needs a maintainer to delete it. macOS and Windows weren't covered.

Next

1. Once Fix Python env discovery ignoring uv/PDM env (#502, #525, #528) #540 / Fix global Python scan missing uv and PDM installs (#449, #451) #522 merge: re-run the Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502 / In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528 / Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 matrix on main, including the .pdm.toml (PDM < 2.5) and PATH-python false-negative variants.
2. In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528 on PDM 1.4.5 (PEP 582 default, lock_version 2) and agent -g with PEP 582.
3. Hash variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 (private index serving different bytes).
4. CRLF on lock_version 2 (PDM 1.4.5 legacy [metadata.files]) for hosted and vendored.
5. Interrupted scan (SIGKILL mid-rewrite) leaves a coherent lock / .socket state.

[github-actions[bot]]

[agent] 2026-10-02 (15:19Z): PDM bug-hunt run

Tested: main d63ae5f (#522, the #451 fix, merged since the last run; latest tag v4.0.0), release build. Linux only, real PDM 1.4.5 / 2.12.4 / 2.29.2, against a fresh local mock of the authenticated patch API serving a patched urllib3 1.26.18 wheel. The mock's batch now answers only when the purl was actually sent.

Filed / commented

• Global scan (-g) ignores PDM's site-wide config, so a global project relocated in /etc/xdg/pdm/config.toml is never crawled and get -g reports "applied" while the copy PDM runs stays unpatched #566 (new): -g discovery ignores PDM's site config (platformdirs.site_config_path("pdm")/config.toml, i.e. /etc/xdg/pdm/config.toml on Linux), which PDM layers under the user config. A global_project.path set there is honoured by PDM (pdm add -g and pdm run -g use it), but scan -g finds nothing. With the same release also in the system interpreter, get -g reports 1 of 1 applied while the global-project copy stays unpatched. Reproduced 3/3 on 2.29.2 and 2.12.4; the same setting in the user config passes. Global scan (-g) ignores PDM's site-wide config, so a global project relocated in /etc/xdg/pdm/config.toml is never crawled and get -g reports "applied" while the copy PDM runs stays unpatched #566

Re-triage

• After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477: still reproduces on main with 2.29.2 (hosted rollback → pdm sync "0/0", patched bytes stay; sync --reinstall restores). Left open, no comment (nothing new).
• Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413: restore_pdm (upstream/pypi_locks.rs) is unchanged since 61cfb9b, where it was re-confirmed. Not re-run; left open.
• Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 (closed by Fix global Python scan missing uv and PDM installs (#449, #451) #522): verified on main. The default global-project .venv (2.29.2) and a user-config venv.location / in_project=false venv are found, patched and restored by rollback -g.

Cells covered (Linux, main d63ae5f)

Cell	Result
-g, global project relocated via the site config, 2.29.2 / 2.12.4	fail #566
-g, same relocation via the user config (control), 2.29.2	pass (scan, get, rollback)
-g, default global-project .venv (pdm use -g + global_project.user_site=true; PDM 2.29 still makes a venv), 2.29.2	pass
hosted #477 re-check, 2.29.2	fail #477 (still)
hosted, PDM 1.4.5 lock_version 2 (legacy [metadata.files]), CRLF lock: scan keeps CRLF, __pypackages__ sync patched, rollback byte-exact	pass
vendored, PDM 1.4.5 lock_version 2, CRLF lock: scan keeps CRLF, path entry, sync patched, rollback byte-exact, .socket removed	pass
SIGKILL at random points during hosted / vendored scan (85 kills, 2.29.2): the lock is always either original or fully rewritten, lock --check passes, re-scan → rollback byte-exact	pass (leaves .socket-stage-pdm.lock-<uuid> litter, see below)

Ruled out / not filed

• A SIGKILLed scan leaves .socket-stage-pdm.lock-<uuid> files in the project root, and neither re-scan nor rollback sweeps them. It's generic staging (not PDM-specific) and only appears after a crash, so it's left to maintainers. Recorded as a known non-bug.
• Harness pitfalls: pdm add -g with no global venv installed urllib3 1.26.18 into /usr/local/lib/python3.11/dist-packages. I couldn't remove it (denied), so later -g scan counts on python3.11 are masked; check file bytes instead. pgrep -f/pkill -f on the mock's name matches the calling shell, so use a pid file.

Housekeeping

• No probe branches; macOS and Windows weren't covered.

Next

1. Global scan (-g) ignores PDM's site-wide config, so a global project relocated in /etc/xdg/pdm/config.toml is never crawled and get -g reports "applied" while the copy PDM runs stays unpatched #566 on macOS / Windows site-config paths (/Library/Application Support/pdm, %PROGRAMDATA%\pdm\pdm) and for venv.location / python.install_root in the site config (use a non-3.11 interpreter, or a release the system copy doesn't have).
2. Once Fix Python env discovery ignoring uv/PDM env (#502, #525, #528) #540 merges: re-run the Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502 / In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528 matrix on main (.pdm.toml PDM < 2.5, PATH-python false negative).
3. In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528 on PDM 1.4.5 (PEP 582 default) with agent -g; PDM 1.x global project (~/.pdm/global-project, ~/.pdm/config.toml) under -g.
4. Hash variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 (private index serving different bytes).
5. Agent mode on PDM 1.4.5 / 1.15.5 (still untested).

[github-actions[bot]]

[agent] Janitor: ledger drift. The coverage matrix still lists these issues as fail, but they are now closed on GitHub. Please re-check those cells on main 6cd37540 on the next run:

• Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332: closed 2026-10-02 16:21 UTC
• Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451: closed 2026-10-02 14:28 UTC
• Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502: closed 2026-10-02 16:15 UTC
• In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528: closed 2026-10-02 16:15 UTC

This is a heads-up only. The janitor never edits ledgers.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-02 (21:12Z): PDM bug-hunt run

Tested: main 045d7ec, which now includes #540 (b0a32db, PDM .pdm-python / PEP 582 env discovery) and #522. The latest tag is still v4.0.0. Release build, Linux only, with real PDM 1.4.5 / 1.15.5 / 2.0.3 / 2.12.4 / 2.20.1 / 2.24.2 / 2.26.9 / 2.27.0 / 2.28.2 / 2.29.0 / 2.29.2. Agent mode ran against a fresh local mock of the authenticated patch API (batch + view) that serves a urllib3 1.26.18 _version.py patch.

Filed / commented

• PDM PEP 582 detection misses python.use_venv = false as PDM 2.27+ writes it (a TOML string) and in the user config, so agent mode patches an activated or stray venv and leaves __pypackages__ unpatched #609 (new): PEP 582 detection misreads python.use_venv = false. PDM ≥ 2.27.0 writes it as a TOML string (pdm config -l python.use_venv false → use_venv = "false"), but pdm_uses_venv uses .as_bool(). The user config (the default pdm config scope) is never read on any version. With a base interpreter in .pdm-python, discovery then falls to the generic probes: an activated VIRTUAL_ENV or a stray ./.venv gets patched (exit 0, success), and __pypackages__, which pdm run imports, stays unpatched. vex fails closed (not_applied). Bool form in pdm.toml and PDM_USE_VENV=false pass. PDM PEP 582 detection misses python.use_venv = false as PDM 2.27+ writes it (a TOML string) and in the user config, so agent mode patches an activated or stray venv and leaves __pypackages__ unpatched #609

Re-triage

• Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502, In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528, Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451, Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332: closed by maintainers since the last run (Fix Python env discovery ignoring uv/PDM env (#502, #525, #528) #540 / Fix global Python scan missing uv and PDM installs (#449, #451) #522). Spot-checked In a PDM __pypackages__ (PEP 582) project, hosted mode gives no stale-install warning and vex attests not_affected while the copy pdm run imports is still unpatched #528/Agent and hosted mode ignore the interpreter PDM records in .pdm-python (venv.in_project = false, pdm use <venv>), so the real env is skipped or a stray .venv / the PATH python is patched, and VEX attests an unpatched install #502 on old PDM below (pass).
• After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477 and Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413: patch/redirect/pdm.rs and upstream/pypi_locks.rs are unchanged between d63ae5f (where both were last reproduced) and 045d7ec. Left open, not re-run, no comment.
• Global scan (-g) ignores PDM's site-wide config, so a global project relocated in /etc/xdg/pdm/config.toml is never crawled and get -g reports "applied" while the copy PDM runs stays unpatched #566: not re-run (no related change on main).

Cells covered (Linux, main 045d7ec)

Cell	Result
agent, 2.29.2, base .pdm-python + pdm.toml use_venv = "false" (PDM-written) + activated venv / stray .venv	fail #609
agent, 2.29.2 / 2.26.9, use_venv false in the user config + stray .venv	fail #609
agent, 2.29.2 / 2.26.9, pdm.toml bool use_venv = false + stray .venv / activated venv	pass (__pypackages__ patched)
agent, 2.29.2, PDM_USE_VENV=false + stray .venv	pass
agent vex after the #609 mis-patch	pass (fails closed, not_applied)
agent, PDM 1.4.5 (lock_version 2, .pdm.toml python.path, PEP 582 default): plain, activated venv, stray .venv	pass (all 3)
agent, PDM 1.15.5 (.pdm.toml, PEP 582): plain, stray .venv	pass
agent, PDM 2.0.3 pdm use -f <base> → PEP 582 with .pdm.toml python.path: plain, stray .venv, activated venv	pass (all 3)
pdm config -l python.use_venv false output by version	bool on 2.12.4 / 2.20.1 / 2.24.2 / 2.26.9; string on 2.27.0 / 2.28.2 / 2.29.0 / 2.29.2
-g user-config parsing (global_project.path, venv.location, python.install_root)	code read only; all string settings, so not affected by the 2.27 string change

Ruled out / not filed

• Hosted stale-install warning / VEX under the PDM PEP 582 detection misses python.use_venv = false as PDM 2.27+ writes it (a TOML string) and in the user config, so agent mode patches an activated or stray venv and leaves __pypackages__ unpatched #609 config: hosted never patches the stray venv, and VEX fails closed, so there's no separate false attestation.
• PDM 2.0–2.4 treat a .pdm.toml without .pdm-python as "legacy, use_venv off". 2.0.3 with pdm use -f <base> really does use __pypackages__, so this matches PDM.

Housekeeping

• No probe branches; macOS and Windows weren't covered. Deleting the stale bughunt/pdm/20260930-cache-symlink was denied by this session's permission policy, so it still needs a maintainer.

Next

1. PDM PEP 582 detection misses python.use_venv = false as PDM 2.27+ writes it (a TOML string) and in the user config, so agent mode patches an activated or stray venv and leaves __pypackages__ unpatched #609 on macOS / Windows user-config paths, plus the site config and PDM_CONFIG_FILE variants. Check whether other PDM ≥ 2.27 string-valued settings matter elsewhere (e.g. venv.in_project = "false" for hosted/vendored stale checks).
2. Global scan (-g) ignores PDM's site-wide config, so a global project relocated in /etc/xdg/pdm/config.toml is never crawled and get -g reports "applied" while the copy PDM runs stays unpatched #566 on macOS / Windows site-config paths; PDM 1.x global project (~/.pdm/global-project) under -g.
3. Re-run After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477 hosted rollback on main once pdm.rs / pypi_locks.rs change (re-arm the hosted mock: references + view endpoints).
4. Hash variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 (private index serving different bytes).
5. Agent mode with PDM install.cache on 1.x (feature.install_cache).

[github-actions[bot]]

[agent] 2026-10-03 (03:15Z): PDM bug-hunt run

Tested: main 045d7ec (unchanged since the last run; the latest tag is still v4.0.0). Release build, Linux only, with real PDM 0.12.3 / 1.0.0 / 1.4.5 / 1.5.3 / 1.6.4 / 1.7.2 / 2.8.2 / 2.10.4 / 2.11.2 / 2.29.2 against a fresh local mock of the authenticated patch API (batch / by-package / package grant with sha256 + sha512 / view / blob, a patched urllib3 1.26.18 wheel host, and a PyPI JSON pass-through).

Filed

• Vendored PDM < 2.11 gives no stale-install warning, so after pdm sync the unpatched release stays installed while vex attests not_affected #641 (new): vendored mode on PDM < 2.11 locks (lock_version 2 / 4.3 / 4.4) has no stale-install warning. On a warm env, pdm sync / pdm install exit 0 but keep the upstream bytes, and vex attests not_affected, with only the generic vendored_tree_out_of_sync hint ("re-run your package manager's install", which doesn't help on these versions). Hosted mode warns about the same PDM behaviour (redirect_pdm_stale_install_risk + redirect_pypi_stale_install), and its vex fails closed. Reproduced on 1.4.5, 1.5.3, 2.8.2 and 2.10.4 (twice, sync and install); 2.11.2 and 2.29.2 pass. Vendored PDM < 2.11 gives no stale-install warning, so after pdm sync the unpatched release stays installed while vex attests not_affected #641
• VEX product detection ignores PDM 0.x's [tool.pdm] name/version, so vex and scan --vex fail with product_undetected on PDM 0.12 projects (after scan has already rewritten pdm.lock) #642 (new): VEX product detection ignores PDM 0.x's legacy [tool.pdm] name/version. vex exits 2 with product_undetected, and scan --mode hosted|vendored --vex exits 1 after it has already rewritten pdm.lock (and committed the vendored wheel). --product works around it. The backtest always passes --product, which masks it. VEX product detection ignores PDM 0.x's [tool.pdm] name/version, so vex and scan --vex fail with product_undetected on PDM 0.12 projects (after scan has already rewritten pdm.lock) #642

Re-triage

• Main is unchanged since the last run (045d7ec), so I didn't re-run PDM PEP 582 detection misses python.use_venv = false as PDM 2.27+ writes it (a TOML string) and in the user config, so agent mode patches an activated or stray venv and leaves __pypackages__ unpatched #609, Global scan (-g) ignores PDM's site-wide config, so a global project relocated in /etc/xdg/pdm/config.toml is never crawled and get -g reports "applied" while the copy PDM runs stays unpatched #566, After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477 or Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413. No comments.

Cells covered (Linux, main 045d7ec)

Cell	Result
hosted, PDM 0.12.3 (legacy [tool.pdm] manifest, lock 2), fresh env: scan → sync → re-scan → rollback	pass (patched installed, rollback byte-exact); vex fail #642
vendored, PDM 0.12.3, fresh env	pass (patched installed, rollback byte-exact); vex fail #642
hosted / vendored, PDM 1.0.0 ([project], lock 2), fresh env	pass (patched installed, vex not_affected, rollback byte-exact)
hosted / vendored, PDM 1.5.3 (lock 2), fresh env	pass (patched installed, rollback byte-exact)
vendored, warm env, PDM 1.4.5 / 1.5.3 / 2.8.2 / 2.10.4	fail #641
vendored, warm env, PDM 2.11.2 / 2.29.2	pass
hosted, warm env, PDM 2.10.4 (control)	pass (warns, vex fails closed)
PDM 1.6.4 lock (lock_version "3"), hosted / vendored	pass (refused redirect_pdm_refused / pypi_pdm_lock_version_unsupported, lock untouched)
lock_version by release	1.5.3 → 2, 1.6.4 → 3, 1.7.2 → 3.1

Ruled out / not filed

• PDM 1.5.x writes lock_version 2 and installs hosted/vendored rewrites correctly, so the accepted-format boundary is right. Docs nit: pdm-compatibility.md says "0.12 – 1.4 → 2" and "1.8 – 1.15 → 3.1", but 1.5.x also writes 2, 1.6.x writes 3 and 1.7.x writes 3.1. Both are refused correctly, so it's doc drift only, not filed.
• The vendored vex attestation over an out-of-sync tree is by design (documented by the vendored_tree_out_of_sync disclosure). Vendored PDM < 2.11 gives no stale-install warning, so after pdm sync the unpatched release stays installed while vex attests not_affected #641 is about the missing scan-time warning and the misleading remedy on PDM < 2.11.
• PDM 1.5.3 pdm sync exits 1 only because it tries to self-install the throwaway project (harness artifact; urllib3 itself installed patched).

Housekeeping

• No probe branches this run (both findings come from PDM's installer and metadata handling, not the OS). The stale bughunt/pdm/20260930-cache-symlink still needs a maintainer to delete it.

Next

1. Vendored PDM < 2.11 gives no stale-install warning, so after pdm sync the unpatched release stays installed while vex attests not_affected #641 follow-ups: PEP 582 __pypackages__ on PDM 1.x with vendored (a warm __pypackages__ with no venv probe); pdm sync --reinstall as the documented remedy per version.
2. PDM PEP 582 detection misses python.use_venv = false as PDM 2.27+ writes it (a TOML string) and in the user config, so agent mode patches an activated or stray venv and leaves __pypackages__ unpatched #609 on macOS / Windows user-config paths, site config and PDM_CONFIG_FILE.
3. Global scan (-g) ignores PDM's site-wide config, so a global project relocated in /etc/xdg/pdm/config.toml is never crawled and get -g reports "applied" while the copy PDM runs stays unpatched #566 on macOS / Windows site-config paths; PDM 1.x global project under -g.
4. Re-run After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477 / Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 once patch/redirect/pdm.rs or upstream/pypi_locks.rs change.
5. Hash variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413; agent mode with PDM 1.x feature.install_cache.