Fix npm workspace-member refusal skipped by a stray member lock (#1094)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #1094 (fixes the hosted and vendored legs; the vex leg for a member lock pinned before this fix is a follow-up, see below)

Root cause

hosted::governing_root::refusal skips the #884 package.json-workspaces member check whenever the member directory holds any npm-family lock (has_own_npm_family_lock). npm reads no package-lock.json / npm-shrinkwrap.json inside a workspace member: it always installs members from the workspace root's lock. So a stray member lock (common after a package moves into a monorepo with its old lock still committed) suppressed the refusal. Hosted scan / get then pinned the ignored member lock, and vendored mode vendored into it. Both exited 0 while npm installed the unpatched package.

Fix

• governing_root::npm_member_stray_lock (new, pub(crate)): a directory whose only own locks are npm locks, listed by an ancestor package.json workspaces whose root holds package-lock.json or npm-shrinkwrap.json. The workspace-root walk is split out of package_json_workspace_refusal (package_json_workspace_root) so both checks share it. Fix workspace-member refusal for vlt and brace/class globs (#1071, #942) #1073's vlt fallback (merged from main) lives in that shared walk too.
• Hosted: refusal runs that check when the member has its own lock, and refuses with the existing redirect_workspace_lockfile_elsewhere. The message names the root lock and the ignored member lock, plus the workspace root to run from. That's the only remedy that clears the refusal, since the directory stays a listed member whatever lock it holds (Bugbot).
• Vendored: npm_flavor::npm_member_stray_lock_refusal refuses the package-lock flavor in that layout with vendor_lockfile_missing, the same code a member with no lock gets. Both vendor_npm_any and npm_lock_vendor_preflight raise it. The preflight runs before any download or hosted→vendored takeover revert, so a leftover hosted pin is never restored only to have vendoring refused (Bugbot). vendor --revert / rollback don't go through this path, so anything already vendored there can still be unwound.
• The own-lock shortcut stays for a member that also holds a lock its own manager reads (pnpm, yarn, Bun, vlt, Rush) and for a root with no npm lock. pnpm and vlt ignore package.json workspaces, and yarn berry treats a nested yarn.lock as its own project. Classic yarn and Bun weren't tested in the issue and aren't changed here.
• CLI_CONTRACT.md: the redirect_workspace_lockfile_elsewhere row now describes the new case.
• Since the 09:24Z main merge (Decide which lockfile governs installs in one table #1044's governing-lock table), the check reads npm's locks and the other families' locks from NpmLockFamily / npm_lock_files() instead of the removed NPM_LOCKS / OWN_LOCKS lists.

Follow-up (why Refs, not Fixes)

With this change, socket-patch no longer writes a pin into an ignored member lock. But a member lock pinned by an earlier version is still read by vex, which would attest it. Gating that needs a new VEX omission code and note in the contract (the existing unattested gate's note is Gradle-specific). I left #1094 open for that piece.

Tests (red → green)

Issue leg	Test	Without fix	With fix
hosted refusal (core)	hosted::governing_root::tests::npm_member_with_stray_npm_lock_is_refused	FAILED	ok
vendored refusal, and the takeover preflight raising the identical refusal	vendor::npm_flavor::tests::npm_member_with_stray_lock_is_refused	FAILED (vendored into the member lock; preflight None)	ok
hosted scan + get <uuid> CLI, 3 root/member lock combos	in_process_redirect_pnpm::hosted_scan_from_npm_member_with_stray_lock_refuses	FAILED	ok

Commands run locally:

• cargo clippy --workspace --all-features -- -D warnings: clean (on d9a569f, and on the 09:24Z main merge)
• cargo test --workspace --all-features --no-fail-fast (on the main merge 3c8e956): 237 test binaries pass. The only 12 failures are permission-based write-failure tests (*_write_failure_*, *unremovable*, relax_loop_must_not_traverse_symlinked_root), which can't fail as root, the user this sandbox runs as. Re-run as an unprivileged user (setpriv --reuid=65534), all 12 pass.
• On 75fdc9a (09:24Z main merge): cargo test --workspace --all-features --no-fail-fast fails the same 12 root-only permission tests plus mode_migration_pypi::pipenv_hosted_to_vendored_names_the_unpatched_requirements, which needs pypi.org (unreachable from this sandbox; unrelated to npm). Everything else passes, including in_process_redirect_pnpm (23) and scan_vendor_e2e (37).
• cargo fmt: the changed code is formatted. main itself isn't cargo fmt --check clean (about 120 files), and CI doesn't run fmt, so I didn't reformat unrelated files.

No wrapper changes (npm/, pypi/, gem/): the logic lives in the core crate only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01479CXaUep24uv6zcJnZ59g

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] CI notes:

• composer 2.10.3 / php 8.5 / macos-latest (run 37708340588) failed in shivammathur/setup-php ("Could not setup PHP 8.5": php: command not found) before any test ran. This PR doesn't touch Composer, so it's a runner/toolchain install failure, not this change. I re-ran the failed job once. If it fails again, I'll treat it as real.
• The red ci-ok on ebf6a74 comes from the CI run on the empty start commit, which was cancelled when the fix commits were pushed. It doesn't apply to the current head.

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

[agent] Update:

• Merged main (3c8e956) to pick up Fix workspace-member refusal for vlt and brace/class globs (#1071, #942) #1073, which also edits governing_root.rs. Fix workspace-member refusal for vlt and brace/class globs (#1071, #942) #1073's vlt fallback now lives in the shared package_json_workspace_root helper. The stray-lock check still counts only npm locks at the root. The CLI_CONTRACT row keeps both additions. Locally, the governing_root / npm_flavor / workspace unit tests (163), in_process_redirect_pnpm (23) and clippy pass. A full workspace run is in progress.
• composer 2.10.3 / php 8.5 / macos-latest failed again on the re-run, the same way: shivammathur/setup-php can't install PHP 8.5 on macOS, before any test runs. So it's a real failure, but not this PR's. It has been red on main since about 00:33Z (push run 37708358429) and on Fix open bun issues (#992, #861, #784, #764, #735, #635, #599, #578, #497, #443, #371) #1009, Fix gem pair model ignoring custom lockfile and Bundler 1 twins (#749, #751) #768 and Fix open npm issues #1008. Composer runs before that were green. No fix exists yet. It needs a workflow-level change (setup-php or the macOS PHP 8.5 cell), which is out of scope for this PR.

BugBot review

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

CI note: I cancelled this PR's Bun and vlt compatibility runs from 03:15Z (37721894513, 37721894616). They ran on the pre-#1093 workflow config, which runs macOS legs on PRs, and were holding about 22 macOS jobs while the merge queue was starved. Merging origin/main into this branch picks up the new config (no macOS legs on PRs). Please don't re-run the cancelled runs, because a re-run uses the old config.

[Mikola Lysenko (mikolalysenko)]

[agent] Merged origin/main (d9a569f) to pick up the new PR CI config (no macOS legs on PRs). There were no conflicts, and the PR diff is unchanged (the same 5 files). Clippy, the core governing_root / npm_flavor / npm_lock / workspace tests (466), in_process_redirect_pnpm (23) and scan_vendor_e2e (37) all pass locally. I haven't re-run the cancelled 03:15Z Bun/vlt runs.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] Took this over (stale heartbeat, merge conflict with main). 75fdc9a merges main and ports the stray-member-lock check onto NpmLockFamily / npm_lock_files(), replacing the removed NPM_LOCKS / OWN_LOCKS.

On 75fdc9a, "Audit GitHub Actions" failed with zizmor ref-version-mismatch on ci.yml:1400: the setup-php pin is commented # v2, and that tag moved upstream. This PR doesn't cause it. Every PR on main hits it, and #1118 has the fix. 3faf081 ports that one-line comment fix here. It becomes a no-op once #1118 lands.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 3faf081. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent).

• Head: 3faf081750fb33f205e4968c9da608a3bb2e8661
• CI: 434/434 check runs green (success/skipped/neutral) on this head, mergeable, no conflicts.
• Bugbot: reviewed this head (Cursor Bugbot check: success), no unresolved review threads.
• Changelog: untouched.

Nothing specific flagged for the reviewer beyond the PR description.

---

Generated by Claude Code