Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note

Aberta Para iniciantes
  • Algo errado?
#433 1 comentário 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
2/5
Tempo estimado
1-3 horas
Facilidade para iniciantes
82/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
rust
Domínio
cli

Direção de pesquisa

Comece em crates/socket-patch-cli/src/commands/remove.rs, em remove_hosted_only (por volta da linha 1337), e depois compare com o caminho hosted baseado em manifest por volta da linha 770. Reproduza remove --preserve-state no modo somente hosted, com e sem --json, e compare a saída com CLI_CONTRACT.md e rollback --preserve-state. Está concluído quando a observação hosted_state_not_preservable for exibida em ambos os modos de saída compatíveis.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

agent:triaged bug bughunt pm:npm priority:p1

[agent] Found by the scheduled npm bug-hunt routine (ledger #302).

Summary

In v5, a project patched by a bare scan (hosted mode) has no .socket/manifest.json. On such a project, socket-patch remove <purl> --preserve-state restores the hosted pin to the upstream registry and deletes the .npmrc. So the patch is gone, even though the user asked to preserve state.

The command never tells the user this. There's no "hosted wiring has no preservable local state" note on stderr, and no warnings[] in --json (the envelope has no warnings key at all). rollback --preserve-state on the same project correctly emits hosted_state_not_preservable.

Severity is low. The behaviour (restoring anyway) is what's documented; only the advisory is missing. But --preserve-state exists so the user can expect to re-apply later, and here it silently doesn't preserve.

Repro (Linux, npm 12.1.0, main 2463257)

A local mock of the patch API serves pkg:npm/[email protected]. SPA="--api-url … --org o --api-token fake --patch-server-url …".

echo '{"name":"t","version":"1.0.0","private":true,"dependencies":{"left-pad":"1.3.0"}}' > package.json
npm install
socket-patch scan $SPA                                    # hosted: package-lock.json + .npmrc rewritten, no .socket/
socket-patch remove pkg:npm/[email protected] --preserve-state $SPA
#   The following hosted patch will be unwound and removed:
#     - pkg:npm/[email protected]
#   Restored pkg:npm/[email protected] to its upstream registry entry
#   (no "no preservable local state" note)
socket-patch scan $SPA
socket-patch remove pkg:npm/[email protected] --preserve-state $SPA --json   # status success, events[hosted_reverted], no warnings key
socket-patch scan $SPA
socket-patch rollback --preserve-state $SPA --json        # warnings: [reinstall_required, hosted_state_not_preservable]  <- correct

It reproduces on 2 of 2 runs.

Expected vs actual

  • Expected: CLI_CONTRACT.md's warning table, row hosted_state_not_preservable, says: "rollback --preserve-state (v5.0): hosted pins were restored to upstream anyway … (remove --preserve-state prints the same note on stderr.)". The --preserve-state (opt-out, both rollback and remove) section says the same: "a preserve run still restores them to upstream — surfaced as the hosted_state_not_preservable warning".
  • Actual: the note is printed only on the manifest-backed remove path. The hosted-only path, which is the default v5 shape, prints nothing.
Project shape remove --preserve-state note
Hosted-only (no manifest), Linux npm 12.1.0 missing (stderr and JSON)
rollback --preserve-state, same project present

Suspect code

crates/socket-patch-cli/src/commands/remove.rs:1337 (remove_hosted_only). Its doc comment says "--preserve-state still unwinds — hosted has no preservable local state". But the Note: hosted wiring has no preservable local state … eprintln only exists in the manifest-backed hosted leg (remove.rs:770).

Linguagem predominante
Rust
Estrelas
8
Forks
0
Merge médio
15h 39min
PRs com merge (30d)
104

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de SocketDev/socket-patch

Todas as issues de SocketDev/socket-patch

Issues semelhantes

Mais issues de Rust

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.