Issues

• Carry apply/rollback advisories as typed values: ApplyResult.error doubles as a warning string that three consumers decode by substring, and they disagree

  arch-auditrefactor
  SocketDev/socket-patch#1987 · Filter by author mikolalysenko opened on Nov 2, 2026

• e2e_hosted_production and e2e_vendored_production are a near-fork: 11 identical helpers, a copied PURL/UUID catalog and hand-rolled VEX checkers beside vex_e2e_common

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1983 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• Gradle --global-prefix e2e tests pass without --global-prefix: the harness always sets GRADLE_USER_HOME, and no test asserts gradle_user_home_differs fires

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1982 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• hermetic test children inherit GOFLAGS, GOENV, GOWORK, GOPATH and GOMODCACHE, which the go crawler and apply read; two hosted-production Go/Deno tests can't fail

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1981 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• Share the Go e2e harness through golang_e2e_matrix: go(), the file-proxy publisher, Machine/ChmodGuard and the grant mocks are copied across 5 suites

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1980 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• Copy test fixture trees through one tests/common::copy_tree: 38 recursive copiers, 20 identical

  agent:claimedagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1979 · Filter by author mikolalysenko opened on Nov 2, 2026
  2

• Vendored npm dry run and --max-new-patches planning miss per-entry package-lock refusals, so a URL-spec, git-spec or workspace-member package previews as vendorable and takes the only rollout slot on every run

  agent:claimedagent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#1976 · Filter by author mikolalysenko opened on Nov 2, 2026
  3

• Move npm-family workspace resolution out of hosted::governing_root: vendor, vex, scan and the crawler all import it

  agent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1974 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• 8 of 9 docker agent e2e suites serve an all-zeros beforeHash and apply with --force, so they only prove the --force path; port gem's real-beforeHash probe

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1970 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• prebuilt_common::prepare_command silently drops --offline from vendor/repair, so 49 "--offline" test calls actually run online against a fixture server

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1969 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• Share one docker test harness: cov_docker_args ×10, skip_if_no_image ×11 and assert_vex_agent_attested ×8 are copied, and 8 docker suites never honour SOCKET_PATCH_DOCKER_E2E_REQUIRED

  agent:claimedagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1968 · Filter by author mikolalysenko opened on Nov 2, 2026
  2

• npm hosted and vendored scans pin a dependency that overrides forces to a remote tarball URL; npm ci installs it unpatched, and vendored vex / vendor --check still pass

  agent:claimedagent:needs-humanagent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#1965 · Filter by author mikolalysenko opened on Nov 2, 2026
  4

• Read gradle-wrapper.properties through one parser: the hosted and vendored Gradle 6.8 gates read the wrapper version two different ways and disagree on distributionUrl = …

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1963 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• Use tests/common's helpers in the suites that already include it: has_command ×9, sha256_hex ×16, a dead stderr_chatter filter ×5, and rollback_json's drifted envelope readers

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1959 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• hermetic::command leaves color env ambient (CLICOLOR_FORCE=1 fails a list test), and its HOSTILE_SEEDS seed-then-remove the same list so they can never catch a dropped scrub

  agent:claimedagent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1958 · Filter by author mikolalysenko opened on Nov 1, 2026
  2

• Run tests/common's selftests in one binary: 21 helper selftests are compiled into and re-run by every one of ~104 includers

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1957 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• Parse every cli_parse_* suite through hermetic::try_parse: four suites carry a byte-identical EnvScrub, and list/remove/main parse with no scrub at all

  agent:claimedagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1956 · Filter by author mikolalysenko opened on Nov 1, 2026
  2

• After a hosted rollback or vendored revert of a requirements.txt pin, plain pip install -r keeps the patched build, though rollback says the next install restores it (and vendor --revert says nothing)

  agent:claimedagent:triagedbugbughuntpm:pippriority:p1
  SocketDev/socket-patch#1953 · Filter by author mikolalysenko opened on Nov 1, 2026
  3

• "pnpm lock importers list a non-root member" is written twice and drifted on comment lines: keep formats::pnpm::workspace, delete the utils::pnpm_workspace copy

  agent:claimedagent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1952 · Filter by author mikolalysenko opened on Nov 1, 2026
  3

• Resolve a yarn classic file:/url copy's identity through formats::yarn::copy only: source.rs keeps a drifted second reader that hosted uses

  agent:claimedagent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1951 · Filter by author mikolalysenko opened on Nov 1, 2026
  3

• formats::xml::attr matches a name inside another attribute's quoted value and never decodes entities; NuGet keeps a second, quote-aware attribute reader

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1950 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• PnpmLock::parse inventories a pnpm 11 env-lockfile document's configDependencies as project packages, while InstalledPackages and the upstream evidence reader drop it

  agent:claimedagent:triagedarch-auditbugpriority:p1
  SocketDev/socket-patch#1949 · Filter by author mikolalysenko opened on Nov 1, 2026
  3

• hosted-e2e red on every PR: patch.socket.dev 403s bun; new transitive gem patches

  agent:triagedci-janitorpriority:p3
  SocketDev/socket-patch#1945 · Filter by author mikolalysenko opened on Nov 1, 2026
  2

• Run PTY test children through one common::pty_io::run: the openpty-spawn-feed-collect runner is copied 7×, and only 2 copies pin TERM

  agent:claimedagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1942 · Filter by author mikolalysenko opened on Nov 1, 2026
  2

• Build every tests/apply fixture through apply_fixture: 9 suites in the apply binary re-write the manifest, blob, package and event-lookup helpers it already has

  agent:claimedagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1941 · Filter by author mikolalysenko opened on Nov 1, 2026
  2