On Windows, `scan -g` / `get -g` / `vex -g` find no global npm packages because `npm root -g` is spawned as bare `npm`, which never resolves to `npm.cmd`

未關閉

#434 建立於 2026年10月1日 4 則留言 0 個 reaction 已指派 0 人在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度: 3/5
預估耗時: 1-2 天
新手友好度: 76/100

Issue 類型: 缺陷
描述清晰度: 描述清楚
活躍度: 活躍
技術堆疊: node.js, rust
領域: cli, operating-systems, tooling

研究方向

Start with get_npm_global_prefix_with in crates/socket-patch-core/src/crawlers/npm_crawler.rs and the command resolution helpers in crates/socket-patch-core/src/utils/process.rs. Run the Windows reproduction commands from the issue, then verify that global scan, get, and VEX operations detect the npm package without an explicit prefix while Linux and macOS behavior remains unchanged.

由索引模型根據 Issue 內容生成。

描述

agent:claimed agent:triaged bug bughunt pm:npm priority:p1

[agent] Found by the scheduled npm bug-hunt routine (ledger #302).

Summary

On Windows, global mode never finds a globally installed npm package. This holds for the default prefix and for a custom npm_config_prefix, on npm 10 and 12, from Git Bash and from PowerShell. Only an explicit --global-prefix <dir> works.

scan -g -e npm prints "No global packages found." and exits 0 success with scannedPackages: 0, even though npm root -g lists the package.
get <uuid> -g returns partial_failure (exit 1) and patches nothing.
vex -g omits the patch as package_not_found.
SOCKET_GLOBAL=1 behaves the same way.

It's the same mechanism as #421 (RubyGems / gem.cmd), but on the npm path.

Root cause

get_npm_global_prefix_with (crates/socket-patch-core/src/crawlers/npm_crawler.rs:487) runs runner.run("npm", &["root", "-g"]) through SystemCommandRunner. That calls std::process::Command::new("npm") on the bare name (crates/socket-patch-core/src/utils/process.rs:138). On Windows, std resolves a bare program name to .exe only, so the npm.cmd shim is never found. The spawn fails, get_global_node_modules_paths (npm_crawler.rs:1145) adds nothing, and there's no Windows fallback (only macOS has hard-coded fallbacks). The pnpm, yarn and bun probes next to it use the same bare spawn.

The repo already has the right helper: resolve_tool / command_for in utils/process.rs, which honours PATHEXT and spawns .cmd shims safely.

Impact

This is a silent miss on the most common Windows setup. The maintainer checklist for global mode requires that scan -g "must find every globally installed npm package that has a hosted patch: none missing". Instead, a Windows user (or Windows CI) running scan -g is told there's nothing to patch, with exit 0. get -g fails, and a VEX for global tools can't be produced. Linux and macOS pass the identical probe.

Repro (probe runs on GitHub Actions)

The patch API is a local mock serving a free patch for pkg:npm/[email protected]. SPA="--api-url http://127.0.0.1:8765 --org o --api-token fake --patch-server-url http://127.0.0.1:8765".

npm install -g [email protected]
npm root -g                                  # C:\npm\prefix\node_modules  (contains left-pad)
socket-patch scan -g -e npm $SPA --json      # status success, scannedPackages 0, packages []   <- bug
socket-patch scan --global-prefix "$(npm root -g)" -e npm $SPA --json   # packages: [pkg:npm/[email protected]]   <- works
socket-patch get 1732b55e-2d2d-57b9-95b7-ce027791a596 -g $SPA --download-mode file   # partial_failure, exit 1, nothing patched
# custom prefix: npm install -g --prefix D:\…\gp [email protected]; npm_config_prefix=D:\…\gp  -> npm root -g = D:\…\gp\node_modules; scan -g still finds nothing

Same result from pwsh with socket-patch.exe scan -g -e npm … --json: scannedPackages: 0.

Expected vs actual

Expected: CLI_CONTRACT.md documents --global / -g as "Operate on globally-installed packages", with --global-prefix defaulting to "(auto)", i.e. discovered via npm root -g. Auto-detection should find C:\npm\prefix\node_modules (or %APPDATA%\npm\node_modules), just as it does on Linux and macOS. If it can't determine the prefix, it should say so loudly instead of reporting a clean, empty scan.
Actual: auto-detection silently finds nothing on Windows.

Matrix (main `2463257`, Node 24.15.0)

Runner	npm	`scan -g` (default prefix)	`scan -g` (custom `npm_config_prefix`)	`get -g`	`vex -g`	`--global-prefix` scan / get / rollback
windows-latest	10.9.7	FAIL (0 packages, exit 0)	FAIL	FAIL (exit 1)	FAIL	pass
windows-latest	12.1.0	FAIL	FAIL	FAIL	FAIL	pass
windows-2022	10.9.7	FAIL	FAIL	FAIL	n/a	pass
windows-2022	12.1.0	FAIL	FAIL	FAIL	n/a	pass
ubuntu-latest	10.9.7 / 12.1.0	pass	pass	pass	pass	pass
macos-latest	10.9.7 / 12.1.0	n/a	pass	pass	pass	n/a
Linux sandbox	10.9.7 / 12.1.0	pass	pass	pass	pass	pass

Probe runs: https://github.com/SocketDev/socket-patch/actions/runs/36825128447 (3 OS × npm 10/12, the hosted cycle plus global mode) and https://github.com/SocketDev/socket-patch/actions/runs/36826141655 (Windows-focused: default prefix, custom prefix, explicit prefix, PowerShell).

主要語言: Rust
星號: 8
分支: 0
平均合併: 18 小時 4 分鐘
30 天內合併 PR: 70

環境準備

沒有 Dockerfile 或 Docker Compose 檔案
沒有 Pull Request 範本
閱讀貢獻指南

從這裡開始

先讀完整個 Issue，再讀專案的貢獻指南。
在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
Fork 儲存庫，在一個分支上完成修改。
送出 Pull Request，並在描述裡引用這個 Issue 編號。

SocketDev/socket-patch 的其他 Issue

Composer vendored repair (and re-vendor) rebuilds a deleted uuid dir without its socket-patch.vendor.json marker, leaving git showing the marker as deleted
未關閉
- 哪裡不對？
agent:triaged bug bughunt pm:composer priority:p2

難度 2/5 1-3 小時新手友好度 90/100

SocketDev/socket-patch#515 · 1 則留言 · 2026年10月1日建立

維護者通常 1 天內回覆
A report-only `scan -g` tells you to run `socket-patch scan --mode agent [PATHS]` without `-g`, so following the hint scans the cwd project instead of the global install
未關閉
- 哪裡不對？
agent:triaged bug bughunt pm:npm priority:p1

難度 2/5 1-3 小時新手友好度 82/100

SocketDev/socket-patch#464 · 1 則留言 · 2026年10月1日建立

維護者通常 1 天內回覆
remove --preserve-state on a manifest-less hosted npm project silently restores the pin without the documented hosted_state_not_preservable note
未關閉
- 哪裡不對？
agent:triaged bug bughunt pm:npm priority:p1

難度 2/5 1-3 小時新手友好度 82/100

SocketDev/socket-patch#433 · 1 則留言 · 2026年10月1日建立

維護者通常 1 天內回覆
Hosted rollback rewrites uv pylock.toml `upload-time` with milliseconds, so the restored file never matches what uv writes
未關閉
- 哪裡不對？
agent:triaged bug bughunt pm:uv priority:p1

難度 2/5 1-3 小時新手友好度 78/100

SocketDev/socket-patch#408 · 1 則留言 · 2026年10月1日建立

維護者通常 1 天內回覆
Yarn berry vendored and hosted modes refuse `compressionLevel: 0 # comment` in .yarnrc.yml as a non-default compression level
未關閉
- 哪裡不對？
agent:triaged bug bughunt pm:yarn-berry priority:p1

難度 2/5 1-3 小時新手友好度 82/100

SocketDev/socket-patch#370 · 2 則留言 · 2026年9月30日建立

維護者通常 1 天內回覆

查看 SocketDev/socket-patch 的全部 Issue

相似的 Issue

HDR decoder accepts RLE scanline marker with width mismatching image width
未關閉
- 哪裡不對？
難度 2/5 1-3 小時新手友好度 84/100

image-rs/image#3119 · 2026年10月2日建立
Build the opentelemetry-collector charm for riscv64
未關閉
- 哪裡不對？
難度 2/5 1-3 小時新手友好度 82/100

canonical/opentelemetry-collector-operator#409 · 2026年10月2日建立

維護者通常 1 天內回覆
codegen: memref.collapse_shape in an mlir! block leaves an affine.apply that is never lowered
未關閉
- 哪裡不對？
bug

難度 2/5 1-3 小時新手友好度 74/100

vx-lang/Vx#995 · 2026年10月2日建立

維護者通常 1 天內回覆
-printf %m and -ls drop setuid/setgid/sticky bits and the file type
未關閉
- 哪裡不對？
難度 2/5 1-3 小時新手友好度 84/100

uutils/findutils#890 · 2026年10月2日建立

維護者通常 1 天內回覆
Shell tool call panics when any environment variable is not valid UTF-8
未關閉
- 哪裡不對？
bug CLI exec tool-calls

難度 2/5 1-3 小時新手友好度 85/100

openai/codex#50149 · 2026年10月2日建立

維護者通常 1 天內回覆

更多 Rust Issue

On Windows, `scan -g` / `get -g` / `vex -g` find no global npm packages because `npm root -g` is spawned as bare `npm`, which never resolves to `npm.cmd`

哪裡不對？

評估

研究方向

描述

Summary

Root cause

Impact

Repro (probe runs on GitHub Actions)

Expected vs actual

Matrix (main 2463257, Node 24.15.0)

環境準備

從這裡開始

SocketDev/socket-patch 的其他 Issue

哪裡不對？

哪裡不對？

哪裡不對？

哪裡不對？

哪裡不對？

相似的 Issue

哪裡不對？

哪裡不對？

哪裡不對？

哪裡不對？

哪裡不對？

把新 issue 寄到你的電子郵件信箱

Matrix (main `2463257`, Node 24.15.0)