Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing

Offen
  • Stimmt etwas nicht?
#443 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
62/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
bun, rust
Bereich
cli, devtools

Rechercherichtung

Start in crates/socket-patch-core/src/crawlers/npm_crawler.rs at parse_bun_bin_output (around line 583) and get_global_node_modules_paths (around line 1154), then reproduce the BUN_INSTALL_BIN and BUN_INSTALL_GLOBAL_DIR cases from the issue. Trace how Bun's global directory is selected and verify that scan, get, vex, and rollback find the installed package; an undetectable directory should not produce a silent empty success.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

agent:triaged bug bughunt pm:bun priority:p1

[agent] Found by the scheduled Bun bug-hunt routine (ledger #306).

Summary

socket-patch doesn't ask Bun where its global packages are. It runs bun pm bin -g, which returns Bun's global bin directory, and then assumes the packages sit at <bin>/../install/global/node_modules. That only holds for Bun's default layout. Bun lets you move each directory on its own, through the documented BUN_INSTALL_BIN and BUN_INSTALL_GLOBAL_DIR environment variables (or globalBinDir / globalDir in bunfig):

  • With BUN_INSTALL_BIN=~/.local/bin (a common way to put Bun's global bins on an existing PATH dir), bun pm bin -g prints ~/.local/bin. socket-patch then looks in ~/.local/install/global/node_modules, which doesn't exist. The real packages are still in $BUN_INSTALL/install/global/node_modules.
  • With BUN_INSTALL_GLOBAL_DIR=<dir>, the packages live in <dir>/node_modules, but bun pm bin -g still prints $BUN_INSTALL/bin, so socket-patch looks in the default location and finds nothing.

get_global_node_modules_paths drops a non-existent directory without a word (p.is_dir()), so in both cases Bun's globals simply vanish from global mode.

Impact

It's a silent miss. scan -g exits 0 with status: success and no Bun packages, and scan -g --mode agent exits 0 with "No patches available for installed packages." So a user, or a CI job that patches globally installed CLIs, is told there's nothing to patch while a vulnerable global tool stays unpatched. get -g does fail (exit 1, "matched no installed package"), and vex -g can't attest the patch. The only workaround is to pass --global-prefix explicitly.

This isn't a regression: release 4.0.0 behaves the same way.

Repro (Linux; same on macOS and Windows)

The patch API is a local mock (SOCKET_PROXY_URL=http://127.0.0.1:8787) serving a free patch for pkg:npm/[email protected] (bin/semver.js).

export HOME=$(mktemp -d) BUN_INSTALL=$HOME/.bun PATH=$HOME/.bun/bin:$PATH   # bun 1.4.2 copied into $BUN_INSTALL/bin
export BUN_INSTALL_BIN=$HOME/.local/bin                                      # or: BUN_INSTALL_GLOBAL_DIR=$HOME/gdir
bun add -g [email protected]
bun pm bin -g                       # $HOME/.local/bin
ls $BUN_INSTALL/install/global/node_modules   # semver  (BUN_INSTALL_GLOBAL_DIR case: $HOME/gdir/node_modules/semver)

socket-patch scan -g --json         # status success, packages []                 <- bug
socket-patch scan -g --mode agent   # exit 0, "No patches available for installed packages."  <- bug
socket-patch get -g 11111111-1111-4111-8111-111111111111   # exit 1, "targeted manifest patch matched no installed package"
socket-patch scan --global-prefix $BUN_INSTALL/install/global/node_modules --mode agent   # patched, works

Without either variable, the same steps find the package, patch it, and vex -g / rollback -g (byte-exact) pass.

Expected vs actual

  • Expected: CLI_CONTRACT.md documents --global / -g as "Operate on globally-installed packages", with --global-prefix defaulting to (auto). Auto-detection should find the directory Bun actually installs global packages into, the same one bun add -g writes and bun pm ls -g reports (<globalDir> node_modules (N installed) on 1.4.2). If it can't determine that directory, it should say so instead of returning a clean, empty scan.
  • Actual: the global node_modules path is guessed from the bin dir, so any non-default BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR makes every Bun global package disappear, with exit 0.

Matrix (main 2463257)

bun add -g [email protected] [email protected], then scan -g report / scan -g --mode agent / get -g / vex -g:

OS Bun default layout BUN_INSTALL_BIN set BUN_INSTALL_GLOBAL_DIR set
Linux (sandbox + ubuntu-latest) 1.1.45, 1.2.23, 1.3.14, 1.4.2 pass FAIL FAIL
macos-latest 1.1.45, 1.2.23, 1.3.14, 1.4.2 pass FAIL FAIL
windows-latest 1.3.14, 1.4.2 pass FAIL FAIL
windows-latest 1.1.45, 1.2.23 blocked (bun add -g itself failed in the probe's space + unicode temp dir) blocked blocked

Release 4.0.0 (Linux, Bun 1.4.2, BUN_INSTALL_BIN): same failure. It's not a regression.

The paths contained a space and ü on every runner. scan -g --mode hosted refused correctly (exit 2) in every cell.

Suspect code

  • crates/socket-patch-core/src/crawlers/npm_crawler.rs:583 (parse_bun_bin_output) derives <bin>/../install/global/node_modules from the bun pm bin -g output.
  • crates/socket-patch-core/src/crawlers/npm_crawler.rs:1154 adds that path only if it exists, so a wrong guess is dropped silently.

Possible fixes: honour BUN_INSTALL_GLOBAL_DIR, then $BUN_INSTALL/install/global, then ~/.bun/install/global, the way Bun resolves it. Or parse the directory from the first line of bun pm ls -g. Also warn when a detected package manager's global dir can't be found.

Open PR #442 changes how this probe is spawned (GlobalProbeRunner), but it leaves this path derivation unchanged.

Probe run

https://github.com/SocketDev/socket-patch/actions/runs/36830650075 (3 OS × Bun 1.1.45 / 1.2.23 / 1.3.14 / 1.4.2; layouts: default, BUN_INSTALL_BIN, BUN_INSTALL_GLOBAL_DIR, npm-installed bun)

Vorherrschende Sprache
Rust
Sterne
8
Forks
0
Ø Merge
18 Std. 4 Min.
Gemergte PRs (30 T.)
70

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus SocketDev/socket-patch

Alle Issues in SocketDev/socket-patch

Ähnliche Issues

Weitere Issues zu Rust

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.