-g agent scan + rollback silently unpatch a hosted NuGet project's install

Offen
  • Stimmt etwas nicht?
#1,793 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
35/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
rust
Bereich
backend, cli

Rechercherichtung

Start with the hosted NuGet ownership handling described around NuGetCrawler::global_roots_shared_with, commands::vendor_owned_keys, and the hosted_wiring_retained warning, then inspect the e2e_nuget_dotnet_build fixture. Reproduce with hosted scan, locked restore, global agent scan, and global rollback using NUGET_PACKAGES set to the restore folder. Done means the global workflow preserves the hosted pin's patched bytes and reports the ownership outcome consistently; the issue leaves the CLI contract decision open.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

agent:triaged bug pm:nuget priority:p3

[agent] Split out of #489 (the hosted-mode variant from https://github.com/SocketDev/socket-patch/issues/489#issuecomment-5937178049, reported 2026-10-01).

Summary

A hosted NuGet project's locked restore extracts the Socket-feed nupkg into the global packages folder (~/.nuget/packages or NUGET_PACKAGES). A global agent run started in that project treats the copy as a separate global install. scan -g --mode agent --yes reports applied: 1 and writes an agent record. rollback -g --yes then restores upstream bytes into it with rolledBack: 1. The next dotnet restore --locked-mode says "up-to-date" and keeps the pristine bytes, so the project builds unpatched with exit 0 everywhere.

This predates #446: -g never consulted the project's hosted pins. #1790 fixes the vendored half of #489. It treats the project's vendored NuGet packages as ledger-owned when the global folder is one the project restores into (NuGetCrawler::global_roots_shared_with, commands::vendor_owned_keys).

Why it's separate

Hosted mode has no ownership skip even in project scope. Agent scan over a hosted pin warns (hosted_wiring_retained) and proceeds, and project-scope rollback unwinds the pin through its hosted leg. Under -g neither the hosted leg nor the warning runs. Fixing this needs a contract decision: either a new skip reason/code for "hosted pin owns this copy" in scan/apply/rollback under -g, or running discovery under -g and reusing hosted_wiring_retained plus a rollback skip. That's new CLI surface, not the vendored ownership rule #1790 restores.

Repro

As in #489's hosted comment: the e2e_nuget_dotnet_build hosted fixture, scan --mode hosted, a locked restore, then scan -g --mode agent --yes and rollback -g --yes with NUGET_PACKAGES set to the restore's folder.

Generated by Claude Code

Vorherrschende Sprache
Rust
Sterne
9
Forks
2
Ø Merge
20 Std. 47 Min.
Gemergte PRs (30 T.)
681

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus SocketDev/socket-patch

Alle Issues in SocketDev/socket-patch

Ähnliche Issues

Weitere Issues zu Rust

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.