[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1827

Summary

Agent mode now crawls a declared npm/yarn/Bun workspace member that lives
in a hidden directory, for example a JavaScript GitHub Action kept at
.github/actions/<name> or an explicit .config/tool entry. Before
this change, scan --mode agent / apply left that member's
node_modules copy unpatched, apply --check said "in sync", and
vex attested not_affected. Hosted vex's installed-copy check missed
the same copy.

Root cause

The project walk prunes hidden and build dirs. #1627 added
skipped_members_of (crates/socket-patch-core/src/crawlers/npm_crawler.rs)
to add back declared members the walk prunes, but only members whose
path crosses a SKIP_DIRS name, and its own walk refused every
dot-named dir. So a hidden member was never added back.

Fix

• The member walk follows a hidden dir where the pattern spells the
  dot, either in the literal prefix (.github/actions/*,
  .config/tool) or in the glob part (build/.*,
  {.github/actions,tools}/*). A path through a hidden dir is matched
  with no wildcard matching a dot component, which is how pnpm, Bun and
  vlt read patterns.
• A member is added back when its path crosses a hidden name or a
  SKIP_DIRS name. Both rules now come from one walk_prunes_name
  helper that the main walk's workspace_children also uses, so the
  two can't drift apart again.
• docs/ecosystems.md describes the rule.

No changes to the npm/PyPI/gem wrappers: the crawl runs only in the
Rust core.

Test evidence

Each new test fails on main and passes with the fix:

Test	without fix	with fix
crawler_npm_e2e::crawl_all_finds_declared_members_in_hidden_dirs	FAILED	ok
in_process_alternate_installers::apply_patches_workspace_member_in_a_hidden_dir (.github/actions/x glob, .config/tool literal)	FAILED	ok
in_process_alternate_installers::apply_check_and_vex_see_unpatched_member_in_a_hidden_dir	FAILED	ok
crawler_npm_e2e::crawl_all_still_skips_undeclared_hidden_dirs (control)	ok	ok

• cargo fmt --all -- --check: clean.
• cargo clippy --workspace --all-features -- -D warnings: clean.
• crawler_npm_e2e 125/125, core crawlers:: unit tests 780/780,
  in_process_alternate_installers 42/42.
• cargo test --workspace --all-features --no-fail-fast: everything
  passes except 11 tests that need things this sandbox doesn't have. Some
  need a non-root user (chmod-based "unremovable"/write-failure tests in
  repair, in_process_redirect, and core vendor::pypi_*,
  vlt_heal, copy_tree). The other two are e2e_bun_lockb tests,
  one of which needs patches-api.socket.dev. None of them touch the npm
  crawler. CI is the authority on these.
• Real npm 10.9.4 repro from the issue (packages/* +
  .github/actions/*, hand-staged manifest for left-pad@1.2.0):
  before apply, apply --check exits 1 and vex writes no
  not_affected. apply patches both packages/y and
  .github/actions/x copies, and apply --check then exits 0.

Per-issue checklist

• Agent-mode npm apply, apply --check and vex skip a declared workspace member in a hidden directory (.github/actions/x, .config/tool), so its nested copy stays unpatched while VEX attests not_affected #1827 .github/actions/* glob member is patched by agent apply: apply_patches_workspace_member_in_a_hidden_dir, crawl_all_finds_declared_members_in_hidden_dirs
• Agent-mode npm apply, apply --check and vex skip a declared workspace member in a hidden directory (.github/actions/x, .config/tool), so its nested copy stays unpatched while VEX attests not_affected #1827 explicit .config/tool member: same two tests
• Agent-mode npm apply, apply --check and vex skip a declared workspace member in a hidden directory (.github/actions/x, .config/tool), so its nested copy stays unpatched while VEX attests not_affected #1827 apply --check / vex do not report in-sync / not_affected while the hidden copy is unpatched (agent and hosted vex share this crawl): apply_check_and_vex_see_unpatched_member_in_a_hidden_dir

/code-review high findings

Fixed in 3b0c72a:

• Walking into every hidden dir let a ** pattern spend its 20k-dir
  budget in .git / .next and drop real members. Build output such
  as .output/server and hidden worktrees could also become "members",
  and Bun/pnpm projects were read with npm's dot rule. Now a hidden dir
  counts only where a pattern spells its dot.
• The duplicated prune predicate is now one shared walk_prunes_name.
• The cheap listing checks now run before the multi-dialect glob match.

Bugbot (fixed in a1eb7df): a brace pattern such as {.github,packages}/**
let the walk descend into every hidden dir because the unexpanded remainder
contained a dot. Braces are now expanded before the walk, each alternative
walks from its own literal prefix, and only an alternative that spells a dot
descends into hidden dirs, with one shared budget per pattern.

Not fixed (on purpose):

• npm and yarn (dot: true) would also treat packages/.hidden as a
  member through plain packages/*. That case is still not crawled.
  It's rare, and picking it up would mean walking every hidden tree
  under every wildcard, which brings back the budget and build-output
  problems above. Main never crawled it either. I can follow up if a
  maintainer wants it.
• A hidden member that is itself a nested workspace root doesn't get
  its own members crawled. This is the same existing limit that
  Agent-mode npm apply, apply --check and vex skip a declared workspace member whose directory is named build, dist, vendor, tmp, temp or coverage, so its nested copy stays unpatched while VEX attests not_affected #1627's SKIP_DIRS members have, so it isn't new here.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a1eb7df. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review at a1eb7df9887e673a16302ea1c9dccc1776f16b71.

• CI: 31/31 run checks green (19 skipped by path filters); no main-wide failures.
• Bugbot: reviewed a1eb7df with no new issues; the one earlier thread is resolved and outdated.
• Mergeable: yes, no conflicts with main.
• For the reviewer: the npm workspace-member walk now follows declared members under hidden dirs (.github/, .config/). Check workspace_globs.rs, where it decides which hidden dirs are crawled.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does. Agent-mode crawls of npm, yarn and Bun projects now include declared workspace members that sit in a hidden directory, such as .github/actions/<name> or .config/tool. Before this, apply left those members' node_modules unpatched while apply --check and vex reported them as fine (#1827). A hidden directory is followed only when a workspaces pattern spells its dot, so ** never walks into .git or .next.

Risk: low. The change is in one function (skipped_members_of) that only adds crawl roots for declared members, and both the walk's prune rule and the member rule now come from one helper. The worst case is an extra declared member getting crawled. Each pattern keeps its directory budget.

Look here

• npm_crawler.rs:102: walk_prunes_name, now shared by the main walk and the member add-back.
• npm_crawler.rs:143: braces are expanded before the walk, and all alternatives share one budget.
• npm_crawler.rs:184 and :221: the walk descends into a hidden directory only when the glob part names a dot.
• npm_crawler.rs:207: a path through a hidden directory is matched with dot: false (the pnpm/Bun/vlt reading).
• crawler_npm_e2e.rs:1046 and :1098: positive cases, plus negative controls (.output/server, .git/build, packages/.hidden, undeclared .cache/tool).

Verified

• Read the full diff: about 300 lines across 6 files, with no unrelated edits and no debug leftovers. CHANGELOG.md is untouched.
• Cross-platform: paths still split on both / and \\.
• Ran cargo test -p socket-patch-core --test crawler_npm_e2e hidden locally on the head: 3/3 pass.
• CI on the head: ci-ok and clippy are green. Burn-down reports 31/31 run checks green.
• Bugbot reviewed a1eb7df with no new issues. 0 review threads are unresolved.

Changes I made: none.

Open questions: none blocking. The PR body lists two limits it leaves out on purpose: packages/.hidden reached only through a wildcard under npm/yarn's dot: true, and the members of a hidden nested workspace. Neither was crawled on main either.

Auto-merge is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code