Fix pnpm modulesDir store being skipped (#661, #696)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #661
Fixes #696

Summary

pnpm projects that set modulesDir (pnpm 10.12+) are now patched and attested correctly:

• Agent mode ignores pnpm's modulesDir: on pnpm 10.12+ every installed package is "not installed", and apply exits 0 leaving it unpatched #661: agent apply patches the copy pnpm installed under <modulesDir>/.pnpm. Before, it exited 0 with the package unpatched as "not installed".
• Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed" #696: hosted standalone vex hash-checks that copy and omits an unpatched one. Before, it attested not_affected from the lock pin.
• Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed" #696, follow-up variants from the issue comment: hosted vex no longer attests a pinned npm package from the lock when the installed pnpm tree keeps its virtual store outside the project (enableGlobalVirtualStore, or a virtualStoreDir that climbs out). A transitive dep there is invisible to the crawler, so "not found" doesn't mean "not installed".

Root cause

pnpm's modulesDir (modulesDir: in pnpm-workspace.yaml, modules-dir= in .npmrc) renames node_modules. From pnpm 10.12 the virtual store moves with it. The npm crawler only collects directories literally named node_modules, plus the roots in configured_install_roots (yarn --modules-folder, Rush). It never read modulesDir. The miss surfaced as the lockfile-only "not installed" skip in agent mode (#661), and the hosted lockfile_basis exemption turned it into an attestation in vex (#696). The same exemption also excused every other crawler blind spot, such as pnpm stores outside the project.

Changes

• crawlers/npm_crawler.rs
  • configured_install_roots now includes pnpm's modules dirs:
    • the configured modulesDir: nearest pnpm-workspace.yaml first, else the nearest .npmrc modules-dir. It is resolved per project, like pnpm does, and honored only strictly inside the project (same guard as yarn's modules folder).
    • any direct child dir holding pnpm's .modules.yaml install record. This catches a modulesDir that came from pnpm's global config or the environment.
  • New pnpm_store_outside_project: true when a .modules.yaml in node_modules or a pnpm modules dir records a virtualStoreDir outside the project.
• commands/vex.rs: the hosted lockfile_basis exemption no longer excuses package_not_found for pkg:npm/ purls when pnpm_store_outside_project holds. With nothing installed (no .modules.yaml) the lock basis still attests, as before.
• CLI_CONTRACT.md (manifest-less VEX hosted row) and CHANGELOG.md document the new behavior.
• No wrapper changes needed: npm/, pypi/ and gem/ only dispatch to the binary.

Test evidence

Red → green: each new test was run with the source fix reverted (tests kept) and failed, then passed with the fix.

Issue	Test	Without fix	With fix
#661	core test_pnpm_modules_dir_is_a_crawl_root (workspace yaml, quoted/commented yaml key, .npmrc, .modules.yaml probe)	FAILED	ok
#661	core test_pnpm_modules_dir_setting_resolution (workspace member, yaml beats .npmrc, out-of-project values refused)	FAILED	ok
#661	cli in_process_alternate_installers::pnpm_modules_dir_install_is_patched (yaml and .npmrc)	FAILED (apply exit 0, file unpatched: the reported symptom)	ok
#661	cli in_process_alternate_installers::pnpm_modules_dir_install_then_apply_patches_file (real pnpm install; skips if pnpm < 10.12)	n/a (new real-toolchain leg)	ok on pnpm 10.28.0
#696	cli e2e_vex_redirect::pnpm_modules_dir_install_is_hash_verified_not_lockfile_attested	FAILED (exit 0 attested)	ok: hash_mismatch, exit 1; patched copy attests; nothing installed attests
#696	core test_pnpm_store_outside_project	FAILED	ok
#696	cli e2e_vex_redirect::pnpm_store_outside_project_is_not_lockfile_attested (GVS-style outside store, in-project store control, nothing-installed control)	FAILED (exit 0 attested)	ok

Local runs on Linux, Rust 1.93.1:

• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo fmt: the changed files are fmt-clean. main itself isn't fmt-clean under this toolchain and CI doesn't run fmt, so I left unrelated files untouched.
• cargo test --workspace --all-features --no-fail-fast: 9731 passed, 12 failed, 253 ignored. All 12 failures are write-failure / unremovable-file simulations that depend on chmod denying writes. This sandbox runs as root (uid 0), which bypasses that. The 4 core-lib ones (copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched, pypi_requirements::wire_failure_rolls_back_already_written_files) fail identically on origin/main. The others are in covgap_commands_vendor, in_process_redirect and repair, none of which touch the npm crawler or the vex exemption. CI runs non-root.

Follow-ups / not covered

• In agent mode, a transitive dep that lives only in pnpm's global virtual store is still not patched in place. That is deliberate (shared store, Agent-mode apply and rollback on a pnpm project with enableGlobalVirtualStore patch (and unpatch) every other project that shares the store #361/Agent mode ignores pnpm's virtualStoreDir: transitive dependencies are reported package_not_installed with a custom virtualStoreDir or the global virtual store #362) and not part of these issues.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JKwbXnQ94oRf1r94V1yupy

---

Note

Medium Risk
Changes npm discovery and hosted VEX attestation for pnpm layouts; incorrect handling could miss patches or over-attest, but behavior is narrowly scoped and heavily regression-tested.

Overview
Fixes pnpm modulesDir layouts (pnpm 10.12+ puts the virtual store under <modulesDir>/.pnpm with no node_modules). The npm crawler now treats configured modulesDir (pnpm-workspace.yaml / .npmrc) and child dirs with .modules.yaml as install roots, so agent apply patches those store copies instead of treating them as not installed (#661).

Hosted vex hash-checks installs under that layout. It also stops using lockfile-only attestation for pkg:npm/ when .modules.yaml records a virtualStoreDir outside the project (global virtual store or an escaping path), because transitive deps there are invisible to the crawler (#696). With nothing installed, lock-pin attestation is unchanged.

CLI_CONTRACT.md and CHANGELOG.md document the behavior; new unit and e2e tests cover crawl roots, setting resolution, apply, and vex outcomes.

^{Reviewed by Cursor Bugbot for commit f548ad0. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f548ad0. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[burn-down agent] Ready for review at head f548ad0dc35c8a8cb55d03c71b79b311d17ded4b.

• CI: 491/491 check runs green (success/skipped) on f548ad0.
• Bugbot: reviewed f548ad0 — no findings; no unresolved review threads.
• Mergeable: yes, up to date with main.
• Reviewer focus: npm_crawler.rs modulesDir/.modules.yaml root detection, and the vex.rs change that stops lock-only attestation when virtualStoreDir escapes the project.

Slack announcement not sent this run (Slack send tool unavailable).

---

Generated by Claude Code