Bug hunt ledger: Composer

[Mikola Lysenko (mikolalysenko)]

[agent] Progress ledger for the scheduled Composer bug-hunt routine (label pm:composer).

Last updated: 2026-10-03 (run 11), main 045d7ec (after #555 lockfile-only apply skip, #503 pypi-only takeover), latest release v4.0.0.

Coverage matrix

Cells are "pass", "fail #N" or "untested". Upstream composer-compatibility.yml already covers the plain dist-install hosted/vendored capstones for 1.10 → 2.10 on Ubuntu/Windows/macOS. This ledger tracks the edges it doesn't.

OS	Composer (PHP)	Agent: setup (LF)	Agent: setup CRLF / escapes	Agent: apply (path repo / installed.json)	Scan: custom vendor-dir	Hosted: repo capstones	Hosted: repo options → transport-options	Hosted: warm cache	Vendored: dist / path-copy install + revert	Vendored: source install → git clone
Linux	1.10.28 (8.1/8.3)	untested	untested (OS/version-independent)	pass	untested	CI	fail #399	pass	pass	pass (v5, run 6)
Linux	2.2.30 (8.3)	untested	untested	pass	untested	CI	fail #399	pass	pass	pass (v5, run 6)
Linux	2.8.12 (8.3/8.4)	removed in v5	removed in v5 (#351 closed)	pass	pass	pass (5/5)	fail #399	pass	pass	pass ×2 (v5; #355 closed)
Linux	2.10.3 (8.3/8.5)	untested	untested	pass	untested	pass (run 5)	untested (expected #399)	untested	pass	pass (v5, run 6)
macOS	1.10 / 2.2 / 2.10	untested	untested	pass	untested	CI	untested	untested	pass	untested on v5 (#355 closed)
Windows	1.10 / 2.2 / 2.10	untested	untested	pass (junction)	untested	CI	untested	untested	pass	untested on v5 (#355 closed)

"Vendored: source install" covers both --prefer-source and source-only VCS lock entries (no dist). "Agent: apply (path repo)" means the patch is written through the path-repo link into the sibling directory; see Known non-bugs.

Hosted v5 defaults (run 5, main 61cfb9b, Linux PHP 8.3 unless noted)

Composer	bare scan → reinstall → vex (idempotent re-run)	--package / scan apps/* / get <uuid>	patch upgrade A→B (updates[], --max-new-patches 0)	lockfile-only / packages-dev / CRLF lock	hosted path-repo entry → install
1.10.28	pass	untested	pass	untested	fail #399 (PHP 7.2–8.4, Linux/macOS/Windows)
2.2.30	pass	untested	pass	untested	pass (PHP 7.2 / 8.3)
2.8.12	pass	pass	pass	pass	pass
2.10.3	pass	untested	untested	untested	pass

Vendored v5 edges (run 6, main 61cfb9b, Linux PHP 8.3)

Composer	path-repo entry with existing transport-options → install → revert	require-dev + space/unicode project path → install / --no-dev / vex	deleted uuid dir → repair / re-vendor	concurrent vendor ×4	SIGKILL mid-download → re-run
1.10.28	pass	pass	fail #515	untested	untested
2.2.30	untested	pass	untested (expected #515)	untested	untested
2.10.3	pass	pass	fail #515	pass	pass

Hosted packagist-origin psr/log (lockfile-only, 2.10.3): scan → rollback byte-identical: pass. Hand-added transport-options kept: #399.

Mode takeovers (run 7, main 61cfb9b, Linux PHP 8.3, packagist-origin psr/log 3.0.2)

Composer	hosted → vendored → install → vex	vendored → hosted → install	vendored → hosted → rollback	vendor --revert → hosted (control)
1.10.28	pass	fail #536 (ValueError)	fail #536 (refused)	pass
2.2.30	pass	pass	fail #536	untested
2.8.12	untested	pass	fail #536	untested
2.10.3	pass	pass	fail #536	untested

macOS/Windows: untested (pure lock logic; Composer 1's transport-options crash is cross-OS per #399's probe).

Global (-g) mode — run 3, main 2463257

OS	Composer	scan -g report (default home)	hosted -g refusal	-g apply / vex / rollback	custom global vendor-dir	composer not on PATH
Linux	1.10.28 / 2.2.30 / 2.8.12 / 2.10.3	pass	pass	pass	fail #439	pass (~/.config; XDG_CONFIG_HOME pass on 203e092); fail #586 on 2.x when a stale ~/.composer also exists
macOS	1.10.28 / 2.2.30 / 2.10.3	pass	pass	pass	fail #439	pass (no XDG); #586 XDG variant untested
Windows	1.10.28 / 2.2.30 / 2.10.3	pass (#438 fix verified on 045d7ec)	pass	untested on 045d7ec (was fail #438)	fail #439	pass (045d7ec)

Local agent scan with a user-level $COMPOSER_HOME/config.json vendor-dir: fail #439 (Linux 2.8.12). Hosted on v5: #399 still reproduces.

composer/installers installer-paths (run 4, main 2463257, Linux, installers 1.12.0 / 2.3.0)

Composer	install-path recorded	Agent scan / apply / vex / rollback	Hosted rewrite → fresh install → vex	Hosted vex with pristine live bytes	Vendored → install → vex → rollback
1.10.28	no	fail #463 (skipped "not installed", exit 0)	pass (install)	fail #463 (false not_affected)	pass (hint names the wrong dir, cosmetic)
2.2.30	yes	pass	untested	untested	untested
2.8.12	yes	pass	pass	pass (omits not_applied)	pass
2.10.3	yes (expected)	untested	untested	untested	untested

OS-independent (pure path logic). macOS/Windows: untested.

Re-resolution, install flags, exec bits and plugins (run 8, main 61cfb9b, Linux PHP 8.3)

Composer	hosted → require <other> keeps rewrite	hosted → --prefer-source / reinstall / preferred-install: source	exec bits (bin + non-bin) hosted / vendored	composer-plugin activates patched (hosted / vendored)	get <uuid> --mode hosted over vendored
1.10.28	no (inline repo; Composer 1 behaviour, docs gap)	untested	pass / pass	pass / pass	untested (expected #536)
2.2.30	pass (packagist + inline)	pass	pass / pass	pass / pass	untested (expected #536)
2.10.3	pass (packagist + inline)	pass	pass / pass	pass / pass	fail #536

Lockfile-only agent apply (#555 / #403) — run 11, main 045d7ec, Linux PHP 8.3

Composer	--no-dev dev pkg (v1.2.0 lock): @1.2.0 / @v1.2.0 / @1.2.0.0 / uppercase	ghost / wrong-version control (exit 1)	mixed installed + lock-only	custom vendor-dir	scan lockfileOnlyPackages	rollback mixed
1.10.28	pass	pass	pass	untested	pass	untested
2.2.30	pass (@1.2.0)	untested	untested	untested	untested	untested
2.10.3	pass	pass	pass	pass	pass	pass

Global --global-prefix with a space/unicode path and SOCKET_GLOBAL=1 (2.10.3): pass.

Backlog

1. macOS Composer global-home fallback checks ~/.composer before the XDG home, so scan -g finds no Composer 2 global packages when a stale ~/.composer exists and composer isn't on PATH #586 variant: create $XDG_CONFIG_HOME/composer with the global install, keep a stale ~/.composer, and run scan -g with composer off PATH (run 11's probe never created the XDG dir). Re-run Composer global-home fallback checks ~/.composer before the XDG home, so scan -g finds no Composer 2 global packages when a stale ~/.composer exists and composer isn't on PATH #586 once fixed.
2. Re-run Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536 once Composer joins the vendored → hosted takeover_capable set (still missing on 045d7ec). Cover both scan and get <uuid> --mode hosted.
3. Hosted/vendored vex and vendored scan --vendor on a --no-dev project with a lock-only v-prefixed dev package.
4. Global -g leftovers: a non-writable global dir must fail loudly (non-root probe), and Fix -g touching the cwd project's state (#436, #445) #446's -g scoping inside a hosted Composer project. Windows -g apply/rollback re-check on the On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438 fix.
5. macOS/Windows probe of vendored path-repo + source-install revert (a Windows junction path repo with existing transport-options), plus the Windows long-path depth of .socket/vendor/composer/<uuid>/<v>/<n>@<ver>.
6. Re-run the Composer 1 installers cells when On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463 is fixed, and add 2.10.3 installers cells. Re-run Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 and Composer vendored repair (and re-vendor) rebuilds a deleted uuid dir without its socket-patch.vendor.json marker, leaving git showing the marker as deleted #515 when they're fixed.
7. Ask maintainers whether to document COMPOSER=<other>.json and Composer 1's composer require <other> re-resolving custom-repo entries.
8. PHP 7.2 / 7.4 cells for Composer 2.2 LTS (probe with setup-php).
9. Delete the leftover probe branches bughunt/composer/20260930-srconly-probe, bughunt/composer/20261001-global-probe, bughunt/composer/20261001-c1-topts and bughunt/composer/20261003-home-probe (the sandbox git proxy refuses deletes). Needs a maintainer.

Known non-bugs

• A BOM composer.json: Composer itself rejects it, so a socket-patch refusal is correct.
• Composer 1.10 can't download on PHP 8.5 (documented). Pair it with PHP ≤ 8.4.
• composer update <pkg> drops the wiring (documented). Re-run scan.
• Composer 1.x keeps an already-installed package on composer install after rewiring (documented). Remove vendor/<v>/<n> first.
• A "packages-dev": null lock: Composer 2.8 itself can't install from it.
• Agent apply follows a path repository's symlink/junction and patches the sibling source. This matches the npm npm link / file: posture, and Composer created the link from the user's own composer.json.
• Vendored refuses a / in a dev branch version (dev-feature/foo) with unsafe_coordinates: an explicit fail-closed refusal on a shape Socket patches don't target.
• setup (and its --check / CRLF issues) is gone in v5 (v5 prerelease: scan → vex → vendor workflow, hosted by default #277/v5: remove setup (WS7) + patch UI streamlining (WS8) #279). Don't file setup bugs against main.
• Sandbox: GitHub zipball downloads and getcomposer.org fail. Composer installs from source, and the phars come from GitHub releases. Prefer local path/VCS/composer-repo fixtures and a mock patch API.
• Repro hygiene: a vendor/ .gitignore pattern also ignores .socket/vendor/. Use /vendor/.
• Agent mode under -g keeps .socket/manifest.json in the cwd, so run rollback -g from the same directory. This is per-cwd manifest design.
• Mock hygiene: a rollback mock needs beforeBlobContent or a /patches/blob/<hash> route, or rollback fails with "Before blob could not be downloaded".
• Windows probe hygiene: composer global config <key> '<json>' through composer.bat mangles the quotes. Write $COMPOSER_HOME/composer.json directly.
• A COMPOSER=<other>.json renamed manifest/lock isn't read (docs/testing/composer-compatibility.md "Not covered", stated for vex). Scan then reports 0 packages.
• Vendored vex still attests when the live installed tree is pristine, with the vendored_tree_out_of_sync warning: the committed .socket/vendor artifact that the lock consumes is the evidence (docs/usage.md VEX table).
• Hosted → vendored takeover refuses an entry from an inline package/custom repository ("does not record packagist as its origin"; restore with git checkout -- composer.lock). That's documented fail-closed behaviour, so use a packagist-origin fixture to test takeovers.
• Mock hygiene: manifestless hosted vex only recognizes archive URLs in the canonical /patch/composer/<name>/<ver>/<token>/<uuid>/<leaf>.zip shape. Vendored mode needs a /patch/package route serving a single-top-dir dist zip.
• scan --package tool matching acme/tool is documented (last-segment, case-insensitive matching). Prefer purls.
• Hosted vex attests an uninstalled entry (--no-dev, lockfile-only) from the lock's pinned shasum (CLI_CONTRACT "Hosted … With nothing installed … attests from that pin").
• A hosted pin on a loopback mock origin counts as NEW (not UPGRADE/ALREADY) unless --patch-server-url names it. Pass --patch-server-url in mock repros of upgrades, rollback and vex.
• Probe hygiene: shell: bash on Actions runs bash -e. Put set +e in probes that record failing exit codes.
• Vendored mode is service-only in v5: vendor --offline without a committed artifact is vendor_service_offline_conflict. Mock POST …/patches/package (granted, sha512 SRI) plus a single-top-dir zip.
• Hosted rollback restores dist/source from packagist metadata (SOCKET_PACKAGIST_URL), not from the pre-rewrite lock, so hand-added fields such as dist.mirrors on a packagist-origin entry aren't restored. Documented. Packagist.org entries carry no mirrors.
• Mock hygiene: agent-mode repair fetches /patches/diff/<uuid>. Without that route it reports download_failed.
• A hosted rewrite of a dist-only entry (no source) doesn't reinstall over an existing vendor/ on Composer 2 (Composer compares only version and dist/source references). The CLI's next steps say to remove vendor/<v>/<n> first, and vex omits it as not_applied.
• Mock hygiene: on Composer 2, a loopback http:// mock needs secure-http: false. Put it in $COMPOSER_HOME/config.json, not composer.json.
• Composer 1 composer require <other> re-resolves unchanged custom-repo (inline package) entries from composer.json and drops a hosted rewrite. That's Composer 1 behaviour; Composer 2 keeps it. Re-run scan. (Not yet in the docs; see Backlog 5.)
• Composer 2.10 disables plugins for root in non-interactive sessions. Set COMPOSER_ALLOW_SUPERUSER=1 in plugin repros.
• Hosted rollback of an inline/custom-repo entry is refused ("restore it from version control"): documented fail-closed behaviour.
• Packagist's Composer 1 metadata is frozen: Composer 1.10 can't resolve new packagist packages (require reports "Did you mean…"). Use inline/local repos for Composer 1 update cells.
• Composer 1.x prefers ~/.composer over the XDG home even when both exist (global config home on 1.10.28). socket-patch's ~/.composer-first fallback is correct for Composer 1. Composer global-home fallback checks ~/.composer before the XDG home, so scan -g finds no Composer 2 global packages when a stale ~/.composer exists and composer isn't on PATH #586 is about Composer 2 only.
• --global-prefix names the package root (Composer's global vendor/ dir), not COMPOSER_HOME, the same way it takes node_modules or site-packages for other ecosystems. Pointing it at the home dir scans 0 packages by design.
• Agent apply exits 0 for a manifest purl that composer.lock resolves but that isn't installed (--no-dev, or no composer install yet). That's Fix apply failing when patched deps are skipped (#403) #555's documented lockfile-only skip. A purl that isn't in the lock still exits 1.

[github-actions[bot]]

[agent] 2026-09-30: Composer bug-hunt run

This is the first run, so the ledger started empty and there were no pm:composer issues to re-triage.

Tested: main f6b7fb9 (CLI 4.0.0 = latest release). Composer 2.8.12 on PHP 8.4.19, Linux only. No probe branches this run: both defects are OS-independent file/text logic.

Cells

• Agent, setup on a CRLF composer.json: fail → Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351. setup rewrites the whole file as LF, and setup --remove doesn't restore the CRLF bytes (CLI_CONTRACT §8). The same serde round trip also un-escapes \/ and \uXXXX. Composer's own composer config keeps CRLF.
• Agent, setup + real composer install / install --no-dev: pass. The hook runs socket-patch apply --offline --silent --ecosystems composer with exit 0 and leaves no .socket/ residue when there's no manifest.
• Agent, BOM composer.json: not a bug. Composer itself rejects it ("does not contain valid JSON").
• Scan, custom config.vendor-dir: lib/deps (plus COMPOSER_VENDOR_DIR) with require-dev: pass (2 packages discovered).
• Vendored, installed from source (--prefer-source / preferred-install: source) → git commit → fresh clone → composer install: fail → Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355. The copy carries .git/, git records a gitlink to the pristine upstream commit, and the fresh clone installs an empty package with exit 0. VEX correctly refuses on the fresh clone.
• Repo capstones (e2e_redirect_composer_build, e2e_vendor_composer_build) on 2.8.12 / PHP 8.4: hosted 5/5 pass. Vendored 4/6 pass. The 2 failures (…mirror_filters_would_drop, …fast_path_heals_legacy_copy) are the same .git copy as Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355: the sandbox can't download GitHub zipballs, so Composer falls back to source.

Issues

• Filed Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351: Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351
• Filed Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355: Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355

False positives ruled out

• A BOM composer.json is rejected by Composer itself, so socket-patch's refusal matches.
• vendor/-style .gitignore patterns also match .socket/vendor/. That was my own repro bug; use /vendor/.
• The sandbox always installs from source (zipball downloads fail), so a local "dist" control isn't possible. Upstream CI is the dist control.

Next

1. Probe branch: Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355 on Composer 1.10 and 2.2 (macOS/Windows), plus a --prefer-source hosted cell (does a source install over a rewritten lock ever keep the pristine code on Composer 1?).
2. setup on composer.json with floats/exponents (1e3), duplicate keys, and scripts referencing @php/@putenv. Also setup --check when the hook exists only in post-update-cmd.
3. Hosted/vendored with path-repository siblings (dist.type: path), dev-* versions, packages-dev-only targets, and a lock with "packages-dev": null (old Composer 1 writers).
4. Composer/installers custom install-path (e.g. a WordPress plugin) for agent apply and vendored copy discovery.
5. The Composer 1.x reinstall-over-existing-vendor hint and composer install --no-scripts (hook skipped) docs coverage.

[github-actions[bot]]

[agent] 2026-10-01: Composer bug-hunt run

Tested: main f6b7fb9 (unchanged since run 1; CLI 4.0.0 = latest release). Locally on Linux: Composer 2.8.12, 2.2.30 and 1.10.28 (the phars come from GitHub releases; getcomposer.org is blocked in the sandbox), all on PHP 8.3. There was one probe run over ubuntu/macos/windows × Composer 1.10.28 / 2.2.30 / 2.10.3: https://github.com/SocketDev/socket-patch/actions/runs/36793579033 (9/9 jobs completed).

All fixtures were offline (path repositories, local VCS repos, a local Composer repository, and a local mock of the patch API). The sandbox's GitHub zipball problem doesn't affect any cell.

Re-triage

• Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351 and Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355: main hasn't moved, so both are still open. Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351 has a draft fix in Fix JSON writers dropping CRLF/BOM/indent (#324, #351) #357. No change.

Cells

• Hosted, a package from a Composer repo that has options.http.header: fail → Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 (filed). Composer copies repo options into the lock as transport-options. The hosted rewrite keeps them, so composer install sends the private header to the hosted patch URL. Reproduced on 1.10.28, 2.2.30 and 2.8.12 (twice).
• Hosted, warm Composer cache from the pristine install (dist keeps reference): pass on 1.10.28 / 2.2.30 / 2.8.12. Composer re-downloads, and the patched bytes install.
• Hosted → vendored takeover (scan --mode vendored --vendor-source build over a hosted lock): pass.
• Vendored, source-only lock entry (a type: vcs repo with no dist): fail, same bug as Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355. No --prefer-source is needed. The probe shows it fails on all 9 OS × version cells: the gitlink is committed, and the fresh clone's composer install exits 0 without the patched package. I added two comments to Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355.
• Vendored, path repo symlink: false → fresh install → vendor --revert: pass on all 9 probe cells, plus locally on Composer 1.10.28.
• Vendored, path repo (default symlink), transport-options {relative: true} → revert: the lock is restored byte for byte. Pass.
• Vendored, dev-main version → fresh install → repair (copy deleted) → remove <purl>: pass. The lock is restored, including transport-options.
• Vendored, dev-feature/foo (slash in the version): refused with unsafe_coordinates, fail-closed. Agent mode applies fine. Not filed (see below).
• Agent apply, Composer 1.10.28 installed.json (no install-path): pass.
• Agent apply, path-repo package installed as a symlink/junction: writes through the link into ../sib, outside the project. Same in all 9 probe cells. Not filed (see below).
• setup --check with the hook in only one of post-install-cmd / post-update-cmd: it reports configured (exit 0) while setup --dry-run reports wouldUpdate: 1, and a fresh composer install leaves the package unpatched. Confirmed twice. Not filed: setup is deleted on release/v5-prerelease (v5: remove setup (WS7) + patch UI streamlining (WS8) #279, merged), so a fix is unlikely to be worth it. Recorded below.

Issues

• Filed Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399: Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399
• Commented on Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355 twice (source-only trigger; 9-cell probe matrix): Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355

False positives ruled out

• A "packages-dev": null lock: Composer 2.8 itself fails to install from it (Locker.php), with or without socket-patch. Not a socket-patch bug.
• Path-repo symlink write-through: the npm crawler deliberately accepts npm link / file: symlinks too, and Composer created the link from the user's own composer.json. It's a design question, not a contract violation.
• unsafe_coordinates for a / in a dev branch version: an explicit fail-closed refusal on a shape Socket patches don't target (released versions).

Housekeeping

• I couldn't delete the probe branch bughunt/composer/20260930-srconly-probe: git push --delete gets a 403 from the sandbox git proxy policy. It holds only the probe workflow, which fires only on pushes to bughunt/composer/**. A maintainer can delete it.

Next

1. Hosted: other repo-scoped lock fields that follow the package to the new origin (notification-url, ssl transport options, http.proxy), and whether rollback / the vendored takeover restore transport-options.
2. Vendored and hosted on the release/v5-prerelease branch (v5 prerelease: scan → vex → vendor workflow, hosted by default #277), where the hosted ledger is gone: re-check Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 and Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355 there.
3. composer/installers custom install-path (a WordPress plugin) for agent apply and vendored copy discovery, Composer 2 vs Composer 1.
4. A COMPOSER=<other>.json project: crawler vendor-dir resolution reads only composer.json.
5. Concurrent vendor + composer install, and an interrupted vendor (kill mid-copy) followed by repair.

[github-actions[bot]]

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major Composer version and on Linux, macOS and Windows.

Where Composer puts global installs: composer global require (composer global config home, COMPOSER_HOME: ~/.config/composer or ~/.composer on Linux/macOS, %APPDATA%\Composer on Windows).

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed Composer package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a Composer project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × Composer version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

[github-actions[bot]]

[agent] 2026-10-01: Composer bug-hunt run

Tested: main 2463257 (the v5 consolidation, #277, landed since the last run; the CLI still reports 4.0.0). The latest release is v4.0.0, whose binary I used for the regression check. Locally on Linux: Composer 1.10.28, 2.2.30, 2.8.12 and 2.10.3 on PHP 8.3. The probe branch bughunt/composer/20261001-global-probe covered ubuntu/macos/windows × Composer 1.10.28 / 2.2.30 / 2.10.3 in runs https://github.com/SocketDev/socket-patch/actions/runs/36823671080 (the macOS cells hung in a probe-script PATH loop; ubuntu and Windows are valid) and https://github.com/SocketDev/socket-patch/actions/runs/36827949605 (macOS + Windows, all 6 jobs). An earlier run, 36822144647, was invalid on Windows because composer.bat mangled the JSON quoting. All fixtures were offline: a path-repo package acme/tool@1.0.0 installed with composer global require, plus a local mock patch API.

This run took up the maintainer backlog item: global (-g) mode.

Re-triage

• Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351 (setup CRLF): closed. setup was removed in v5 (unrecognized subcommand 'setup', docs/migrating-to-v5.md). Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351
• Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 (hosted keeps transport-options headers): still reproduces on v5 main, and I commented with the rewritten lock entry. Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 (comment)

Cells (global mode)

• scan -g report-only, default home: pass on Linux (1.10–2.10) and macOS (1.10/2.2/2.10). Fail on Windows (all 3 versions) → On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438: %APPDATA%\Composer is never found. composer.bat isn't spawned (Command::new without resolve_tool), and the fallback doesn't list APPDATA.
• scan -g --mode hosted / --global-prefix … --mode hosted: pass on every OS and version (exit 2, nothing written).
• scan -g --mode agent → global file patched; vex -g attests 1; rollback -g restores byte for byte: pass on Linux and macOS, and on Windows with an explicit COMPOSER_HOME. Fail on Windows with the default home (On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438).
• vex -g after composer global reinstall (pristine bytes): it omits with not_applied, which is correct. apply -g then re-patches. Pass (Linux, 2.8.12).
• -g from inside a Composer project touches only the global copy, and a scan without -g touches only the project copy: pass (Linux, 2.8.12).
• scan -g with composer not on PATH (phar) and XDG_CONFIG_HOME set: fail, folded into On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438.
• Custom global vendor-dir (composer global config vendor-dir deps, or COMPOSER_VENDOR_DIR): fail on all 3 OS × all versions → Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439. --global-prefix <home>/deps works around it.
• Local agent scan with a user-level composer config -g vendor-dir lib ($COMPOSER_HOME/config.json): fail → Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439 (Linux, 2.8.12, twice).
• Regression check: both On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438's fallback gap and Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439 behave identically on the v4.0.0 binary, so neither is a v5 regression.

Issues

• Filed On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438: On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438
• Filed Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439: Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439
• Closed Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351, and commented on Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399.
• Handed the bundler routine a lead: ruby_crawler.rs:549 spawns gem env through the same non-PATHEXT runner (unverified on Windows).

False positives ruled out

• The first rollback -g failure ("Before blob could not be downloaded") came from my mock missing beforeBlobContent and the blob route. With both present, it passes.
• Agent mode under -g writes .socket/manifest.json in the cwd, so rollback -g must run from the same directory. That's per-cwd manifest design, not a bug.
• The ubuntu "composer not on PATH" pass was invalid: stripping /usr/bin also removed bash. The local Linux run, which removed only /usr/local/bin, is valid and passes (the ~/.config/composer fallback).

Housekeeping

• The git proxy refused to delete the probe branches bughunt/composer/20261001-global-probe and bughunt/composer/20260930-srconly-probe (the remote hung up). Both only hold the probe workflow. A maintainer needs to delete them.

Next

1. A non-writable global dir (a root-owned prefix, Program Files) must fail loudly. This needs a non-root runner, so use a probe.
2. Re-run the -g matrix once On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438 and Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439 are fixed (Windows default home, vendor-dir), and add SOCKET_GLOBAL=1 and space/unicode --global-prefix cells.
3. Hosted: other repo-scoped lock fields (notification-url, ssl transport options) on v5. Re-check Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355 on v5 vendored.
4. composer/installers custom install-path (a WordPress plugin) for agent apply and vendored discovery.
5. COMPOSER=<other>.json projects, and concurrent vendor + composer install.

[github-actions[bot]]

[agent] 2026-10-01: Composer bug-hunt run

Tested: main 2463257 (unchanged since the last run; the CLI still reports 4.0.0), and the latest release v4.0.0 (x86_64-linux-gnu binary) for the regression check. Linux only: Composer 1.10.28 and 2.2.30 phars, and the system 2.8.12, on PHP 8.3. No probe branches this run, because both findings are OS-independent path logic. Fixtures: a local zip acme/tool@1.0.0, real composer/installers 1.12.0 / 2.3.0 cloned from GitHub, and a local Python mock of the public patch proxy (/patch/batch, by-package, view, blob, package, plus the archive at the canonical /patch/composer/<name>/<ver>/<token>/<uuid>/<leaf>.zip path).

Re-triage

• Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355 (a --prefer-source .git copied into .socket/vendor): fixed and closed. v5 vendoring extracts the service's prebuilt zip (v5 prerelease: scan → vex → vendor workflow, hosted by default #277/Require server artifacts and exact redownload for vendoring #300). Both the --prefer-source and the source-only type: vcs variants produced no .git, no 160000 gitlink, and a fresh clone that installs patched. Each ran twice. Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355 (comment)
• Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 (hosted keeps transport-options): not re-run (it was re-confirmed on 2463257 last run, and main hasn't moved).

Cells

• composer/installers installer-paths (type: wordpress-plugin → wp-content/plugins/{$name}):
  • Composer 2.8.12 / 2.2.30, agent scan → patched at the install-path; vex attests; reinstall pristine → vex omits not_applied; rollback restores: pass.
  • Composer 2.8.12, vendored: lock → dist: path + transport-options.symlink:false; composer install and a fresh clone mirror the patched copy into wp-content/plugins/tool; vex attests; rollback restores the lock byte for byte: pass. With pristine live bytes, vex still attests with vendored_tree_out_of_sync. That's by design (see Known non-bugs).
  • Composer 2.8.12, hosted: lock dist url + shasum rewritten; a fresh clone installs patched; vex attests, and omits not_applied on pristine bytes: pass.
  • Composer 1.10.28, agent: fail → On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463. No install-path in installed.json, so the crawler looks only in vendor/acme/tool: [skip] … not installed, exit 0, left unpatched. get --mode agent reports "1 not found on disk". Same on v4.0.0 (not a regression).
  • Composer 1.10.28, hosted vex: fail → On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463 (comment). With the pristine bytes back in wp-content/plugins/tool, vex still emits not_affected (redirected). The control on 2.8 omits it correctly.
  • Composer 1.10.28, vendored: vendor → composer install mirrors the patched copy: pass. Cosmetic: the next-steps hint says "remove vendor/acme/tool first", which isn't where an installers package lives. Not filed.
• COMPOSER=app.json project (only app.json / app.lock): scan finds 0 packages. Not filed, because docs/testing/composer-compatibility.md "Not covered" lists COMPOSER=<other>.json renamed locks (only for vex; the crawler isn't mentioned). Recorded as a limitation.
• Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355 re-check, vendored --prefer-source / source-only VCS (2.8.12): pass ×2.
• Hosted → vendored takeover on an inline package repo entry: refused with the documented git checkout -- composer.lock remedy (custom repositories, origin not packagist). Fixture-induced, so it's correct fail-closed behaviour. Vendored re-run after the refusal leaves the lock byte-identical.

Issues

• Filed On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463: On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463 (plus a VEX comment: On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463 (comment))
• Closed Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355 as fixed.

False positives ruled out

• Manifestless hosted vex first found "no hosted references". My mock's archive URL (/archive/x.zip) wasn't in the canonical /patch/composer/…/<uuid>/… shape. With the real shape it attests.
• Vendored vex attesting while the live tree is pristine is the documented vendored_tree_out_of_sync warning (the committed artifact is what the lock consumes).
• My first repro script resolved $S relatively and broke the zip URL, so installs failed. Fixed with an absolute path.

Housekeeping

• The git proxy still refuses to delete bughunt/composer/20260930-srconly-probe and bughunt/composer/20261001-global-probe (the remote hung up). A maintainer needs to delete them.

Next

1. A probe branch for On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463 is only needed if a fix lands (the logic is OS-independent). Re-run the C1 installers cells on the fix PR.
2. Global -g leftovers: a non-root, non-writable global dir (probe), SOCKET_GLOBAL=1, space/unicode --global-prefix, and a re-run after On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438/Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439 are fixed (PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 is open for On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438).
3. Hosted: notification-url and ssl transport options kept on the rewritten entry (Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 family). Hosted → vendored takeover on a packagist-origin entry (needs a non-sandboxed zipball download, so use a probe).
4. Concurrent vendor + composer install; an interrupted vendor followed by repair.
5. COMPOSER=<other>.json: ask maintainers whether the crawler/hosted gap should be documented alongside the vex one.

[github-actions[bot]]

[agent] 2026-10-01: Composer bug-hunt run

Tested: main 61cfb9b. Since the last run, main took in 20 commits, including #358 (a member-aware Composer dist/source lookup; bare scan/get now default to hosted; --package; directory PATHs) and #446 (-g scoping). The CLI still reports 4.0.0. The latest release, v4.0.0 (x86_64-linux-gnu), was the regression baseline. Local Linux: Composer 1.10.28, 2.2.30, 2.8.12 and 2.10.3 phars on PHP 8.3. One probe branch, bughunt/composer/20261001-c1-topts, ran https://github.com/SocketDev/socket-patch/actions/runs/36903408294 (ubuntu PHP 7.2/7.4/8.0/8.1/8.4, macOS and Windows PHP 8.1, all on Composer 1.10.28, plus a 2.2.30/PHP 7.2 control). Run 36903152237 on the same branch is invalid: GitHub's bash -e aborted it before it printed results. Fixtures were local inline-package / path / type: composer repositories and a local Python mock of the patch API (batch, by-package, view, blob, package, plus the canonical archive path).

Re-triage

• Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 (hosted keeps transport-options): still reproduces on 61cfb9b, both with the header leak from a type: composer repo options. A new impact also surfaced (see below). Commented: Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 (comment)
• Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439 (vendor-dir from the global config): still reproduces on 61cfb9b. With $COMPOSER_HOME/config.json vendor-dir lib, the agent scan reports the package as lockfile-only and leaves lib/acme/tool unpatched. The composer crawler is unchanged since 2463257. No comment (nothing new).
• On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438 (PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 is open), On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463: crawler unchanged, not re-run.

Cells (all on 61cfb9b)

• Bare scan (now hosted by default) → lock dist url + shasum rewritten → re-run is byte-identical (idempotent) → rm -rf vendor && composer install installs patched → vex --patch-server-url attests (redirected): pass on 1.10.28, 2.2.30, 2.8.12 and 2.10.3.
• rollback / remove of an inline-repository entry: the documented custom-repository refusal (git checkout -- composer.lock), on all 4 versions: pass (fail-closed by design).
• scan --package with acme/tool, pkg:composer/acme/tool[@1.0.0], Acme/Tool and tool matches; nothere, other/tool and pkg:npm/acme/tool match nothing: pass (last-segment and case-insensitive matching is documented).
• scan 'apps/*' across two Composer projects (per-directory runs): pass.
• get <uuid> (now hosted by default): the same lock bytes as scan, and idempotent: pass.
• Hosted upgrade: the lock pins uuid A and the API offers a newer B → updates[] names A→B, rollout.upgrade: 1, the lock is repinned, and --max-new-patches 0 still upgrades. A stale install (A bytes) → vex reports hash_mismatch and omits; after a reinstall it attests B. Composer 1.10.28 / 2.2.30 / 2.8.12: pass. Without --patch-server-url, a loopback pin counts as NEW, which is expected (an unrecognized origin).
• Lockfile-only checkout (no vendor/): bare scan redirects from composer.lock: pass.
• require-dev + project vendor-dir: lib: agent apply and hosted rewrite of packages-dev: pass.
• CRLF composer.lock: the hosted rewrite keeps all CRLF, and composer install installs patched: pass.
• config.lock: false (no lock): redirect_composer_no_lockfile warning, exit 0: pass (documented posture).
• Hosted rewrite of a path-repository entry → Composer 1 install fails: fail → Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 (comment). The rewrite turns dist.type: path into zip but keeps transport-options: {"relative": true}. Composer 1.10.28 then hits a fatal in StreamContextFactory.php:153 (ValueError on PHP 8.x, ErrorException on PHP 7.x) on every OS. Stripping only transport-options installs patched. Composer 2.2/2.8/2.10: installs patched. Same on v4.0.0, so not a regression. Reproduced ×3 locally and in 7/7 probe cells.

Issues

• Commented on Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 with the Composer 1 path-repo crash matrix. No new issues: that crash has the same root cause as Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 and the same fix (drop transport-options in the hosted rewrite).

False positives ruled out

• vex attesting a --no-dev / uninstalled hosted entry from the lock pin is documented (CLI_CONTRACT "Hosted … With nothing installed … attests from that pin").
• A lockfile-only hosted scan doesn't redirect a dist.type: path entry (redirected: 0). Path entries aren't registry pins, so I didn't pursue it.
• My first local Composer 2 install of the path-repo lock failed on secure-http (fixture config), not on socket-patch.
• pkill -f mock.py killed my own shell. Use pgrep -f '^python3 mock'.

Housekeeping

• The git proxy still refuses branch deletes ("remote end hung up"). A maintainer needs to delete bughunt/composer/20261001-c1-topts, bughunt/composer/20261001-global-probe and bughunt/composer/20260930-srconly-probe. They only hold the probe workflow.

Next

1. Global -g leftovers: a non-root, non-writable global dir (probe), SOCKET_GLOBAL=1, space/unicode --global-prefix, and a re-run once Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 (On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438) merges, including the Fix -g touching the cwd project's state (#436, #445) #446 -g scoping on a hosted Composer project.
2. Hosted rollback on a packagist-origin entry with a non-default notification-url or ssl transport option (Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 family). Packagist metadata is reachable from the sandbox, but zipballs aren't.
3. Re-run the Composer 1 installers cells when a fix for On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463 lands, and add 2.10.3 installers cells.
4. Concurrent vendor + composer install; an interrupted vendor followed by repair.
5. COMPOSER=<other>.json: ask maintainers whether to document the crawler/hosted gap.

[github-actions[bot]]

[agent] 2026-10-01: Composer bug-hunt run

Tested: main 61cfb9b (unchanged since run 5; the CLI reports 4.0.0). The latest release, v4.0.0 (x86_64-linux-gnu), was the regression baseline. Local Linux: Composer 1.10.28, 2.2.30 and 2.10.3 phars on PHP 8.3. Fixtures were an inline package repository with a file:// zip dist, a path repository, a local git vcs repository (source-only lock entries), and a real packagist-origin psr/log 3.0.2 lock (lockfile-only). A local Python mock served the patch API: batch, by-package, view, patches/package with sha1 + sha512 integrity, the archive path, and an optional download delay. No probe branches this run: everything tested is OS-independent path/lock logic.

Re-triage

• Main and the Composer crawler/rewriter haven't changed since run 5, so Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399, On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438, Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439 and On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463 stand as last verified. PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 (for On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438) is still open. No comments.

Cells (all on 61cfb9b)

• Vendored, zip-dist entry: vendor → lock dist: path + transport-options {symlink:false} → fresh install patched → vendor --revert restores the lock: pass (2.10.3).
• Vendored, path-repo entry that already has transport-options {"symlink":true,"relative":false}: replaced by {symlink:false} (no duplicate key), installs patched, revert restores the lock byte for byte: pass on 1.10.28 and 2.10.3.
• Vendored, source-only VCS entry with preferred-install: source → commit → clone → composer install --prefer-source mirrors the patched copy: pass on 1.10.28, 2.2.30 and 2.10.3 (Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355 stays fixed). Reinstall over an existing source checkout: 2.2/2.10 patched; 1.10 keeps pristine (documented Composer 1 posture). Revert restores the lock: pass.
• Vendored require-dev entry in a project path with spaces + unicode (sp ü 漢/): wired in packages-dev, installs patched, --no-dev skips it, vex attests from the committed artifact: pass on 1.10.28, 2.2.30 and 2.10.3.
• Vendored unit with its uuid dir deleted → repair / a vendor re-run: fail → Composer vendored repair (and re-vendor) rebuilds a deleted uuid dir without its socket-patch.vendor.json marker, leaving git showing the marker as deleted #515. The copy is redownloaded, but socket-patch.vendor.json is never restored (git shows it deleted for good). Cargo restores it on the same path. Reproduced on 2.10.3 (×2) and 1.10.28. v4.0.0 behaves the same, so not a regression. Low impact: installs stay patched, and vex doesn't read the marker.
• 4 concurrent vendor runs: one wins, three get lock_held, and the lock and ledger come out consistent: pass.
• vendor SIGKILLed during the artifact download: only .socket/apply.lock is left (documented, reclaimed); the lock is untouched; a re-run vendors cleanly and installs patched: pass.
• Hosted, packagist-origin psr/log (lockfile-only): scan → source removed, dist rewritten → rollback restores the lock byte-identical from packagist metadata: pass. The same entry with a hand-added dist.mirrors + transport-options.ssl: the hosted rewrite removes mirrors (warned) and keeps transport-options (Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 family, already filed); rollback restores dist/source from packagist, so the hand-added mirrors isn't restored (documented SOCKET_PACKAGIST_URL upstream restore; packagist.org metadata carries no mirrors).

Issues

• Filed Composer vendored repair (and re-vendor) rebuilds a deleted uuid dir without its socket-patch.vendor.json marker, leaving git showing the marker as deleted #515: Composer vendored repair (and re-vendor) rebuilds a deleted uuid dir without its socket-patch.vendor.json marker, leaving git showing the marker as deleted #515 (Composer vendored rebuild drops the socket-patch.vendor.json marker).

False positives ruled out

• repair → download_failed "1 diff archive failed to download" on the agent-mode manifest: my mock lacked the /patches/diff/<uuid> route.
• vendor --offline → vendor_service_offline_conflict: vendored mode is service-only in v5 (documented in --vendor-source). Mock patches/package plus a single-top-dir zip instead.
• Hosted rollback not restoring hand-added dist.mirrors on a packagist-origin entry: restore comes from upstream packagist metadata (documented).

Housekeeping

• The git proxy still refuses branch deletes (Everything up-to-date, branches remain). A maintainer needs to delete bughunt/composer/20260930-srconly-probe, bughunt/composer/20261001-global-probe and bughunt/composer/20261001-c1-topts.

Next

1. Global -g leftovers: a non-root, non-writable global dir (probe), SOCKET_GLOBAL=1, space/unicode --global-prefix, and a re-run once Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 (On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438) merges.
2. macOS/Windows probe of vendored path-repo + source-install revert (a Windows junction path repo with existing transport-options).
3. Re-run the Composer 1 installers cells when a fix for On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463 lands, and add 2.10.3 installers cells. Re-run Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399's path-repo cell when it's fixed.
4. Hosted ↔ vendored takeover on the packagist-origin psr/log fixture (lockfile-only), including the mirrors / transport-options entry.
5. COMPOSER=<other>.json: ask maintainers whether to document the crawler/hosted gap.

[github-actions[bot]]

[agent] 2026-10-02: Composer bug-hunt run

Tested: main 61cfb9b (unchanged since run 5; the CLI reports 4.0.0). Regression baseline: v4.0.0 (x86_64-linux-gnu). Local Linux: Composer 1.10.28, 2.2.30, 2.8.12 and 2.10.3 phars on PHP 8.3. Fixtures: an inline package repository with a file:// zip dist (dist-only), and a real packagist-origin psr/log 3.0.2 lock (composer update --no-install), with a single-top-dir patched zip built from a git clone. A local Python mock served the patch API: batch, by-package, view, patches/package with sha1 + sha512 integrity, and the canonical archive path. No probe branches this run: the new finding is pure lock logic, and #399's probe already covers Composer 1's cross-OS transport-options crash.

Re-triage

• Main and the Composer code haven't changed since run 5, so Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399, On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438, Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439, On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463 and Composer vendored repair (and re-vendor) rebuilds a deleted uuid dir without its socket-patch.vendor.json marker, leaving git showing the marker as deleted #515 stand as last verified. PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 (for On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438) is still open. No comments.

Cells (all on 61cfb9b)

• Hosted, dist-only inline entry (no source) over an existing vendor/ → composer install on 2.10.3 says "Nothing to install" and keeps the pristine bytes (Composer 2 compares only version, dist.reference and source.reference). pass (handled): the human next-steps already say "first remove vendor/acme/tool — Composer does not reinstall a package whose lock entry has no source". vex omits it as not_applied. After rm -rf vendor, install is patched.
• Hosted → vendored takeover on packagist-origin psr/log: restores the upstream entry first (vendor_takeover_reverted_redirect), vendors, and installs patched on 1.10.28, 2.2.30 and 2.10.3. vex attests. pass.
• Vendored → hosted takeover on the same fixture: fail → Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536. The vendored entry is rewritten in place (no redirect_takeover_reverted_vendored), keeping dist.reference: <patch uuid> and transport-options {symlink:false}. Composer 1.10.28 install fatals (ValueError, StreamContextFactory.php:153). 2.2.30, 2.8.12 and 2.10.3 install patched. rollback refuses (reference mismatch with packagist), and remove <purl> leaves the lock alone. Reproduced ×3. Control: vendor --revert → hosted gives the same lock as a direct hosted scan, which installs on 1.10.28.
• Mirror-filter neutralization (code review against Composer 2.8's ArchivableFilesFinder / GitExcludeFilter): Composer only reads the copy-root .gitattributes (exactly-two-token export-ignore lines) and, on 1.x, the root .gitignore/.hgignore; PathDownloader passes empty archive.exclude. socket-patch strips a superset. Nothing to file.

Issues

• Filed Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536: Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536 (Composer vendored → hosted takeover keeps the vendored reference + transport-options; Composer 1 install crashes and rollback refuses).

False positives ruled out

• The dist-only hosted entry not reinstalling over an existing vendor/ on Composer 2: documented in the CLI's next steps (see above). It isn't in the JSON envelope, but the human path covers it.
• My first takeover installs on Composer 2 failed on secure-http (fixture). Set secure-http: false in $COMPOSER_HOME/config.json for a loopback mock, not in composer.json.
• v4.0.0 gives no takeover baseline: its vendored scan --mode vendored exits 1 with these flags.

Housekeeping

• Leftover probe branches bughunt/composer/20260930-srconly-probe, bughunt/composer/20261001-global-probe and bughunt/composer/20261001-c1-topts still need a maintainer to delete them (the sandbox git proxy refuses deletes).

Next

1. Re-run Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536 when Composer joins takeover_capable, and check that Fix PyPI vendored to hosted takeover being refused (#328) #503's pypi change doesn't touch Composer. Also try get <uuid> --mode hosted over a vendored entry (same path, expected Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536).
2. Global -g leftovers: a non-root, non-writable global dir (probe), SOCKET_GLOBAL=1, space/unicode --global-prefix, and a re-run once Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 (On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438) merges.
3. macOS/Windows probe of the vendored path-repo + source-install revert (a Windows junction path repo with existing transport-options).
4. Re-run the Composer 1 installers cells when a fix for On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463 lands, plus Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399 and Composer vendored repair (and re-vendor) rebuilds a deleted uuid dir without its socket-patch.vendor.json marker, leaving git showing the marker as deleted #515 when they're fixed.
5. COMPOSER=<other>.json: ask maintainers whether to document the crawler/hosted gap.

[github-actions[bot]]

[agent] 2026-10-02: Composer bug-hunt run

Tested: main 61cfb9b (unchanged since run 5; latest release v4.0.0). Local Linux: Composer 1.10.28, 2.2.30 and 2.10.3 phars on PHP 8.3. Fixtures: a real packagist-origin psr/log 3.0.2 lock (patched zip built from a git clone), plus inline package-repository fixtures with file:// zip dists (a library, a package with an exec bit on a bin file and on a non-bin script, and a composer-plugin). A local Python mock served the patch API. No probe branches this run: every cell is lock/path logic, and the OS-sensitive parts (exec bits) are Unix-only.

Re-triage

• Main and the Composer code are unchanged, so Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399, On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438, Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439, On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463, Composer vendored repair (and re-vendor) rebuilds a deleted uuid dir without its socket-patch.vendor.json marker, leaving git showing the marker as deleted #515 and Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536 stand as last verified. No new human comments on Bug hunt ledger: Composer #321.
• Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536: added a comment saying get <uuid> --mode hosted over a vendored entry takes the same path (success, no redirect_takeover_reverted_vendored, keeps reference: <uuid> + transport-options). Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536 (comment)

Cells (all on 61cfb9b, Linux)

• Hosted psr/log → composer require psr/container:2.0.2 --no-install (partial update of a different package): the rewritten psr/log entry is kept on 2.2.30 and 2.10.3. pass. Composer 1.10.28 can't resolve new packagist packages any more (packagist's Composer 1 metadata is frozen), so it was tested on an inline-repo fixture instead (next bullet).
• Hosted inline-repo acme/tool → composer require acme/other:1.0.0 → install: 2.2.30 and 2.10.3 keep the rewrite and install patched (pass). 1.10.28 re-resolves acme/tool from composer.json's inline repository, restores the upstream file:// dist, drops the shasum and installs unpatched. That's Composer 1 partial-update behaviour, not a socket-patch defect, and it's limited to Composer 1 + custom repos. Not filed. docs/testing/composer-compatibility.md "What undoes the wiring" doesn't list composer require <other> on Composer 1. Candidate docs gap; see Backlog.
• Hosted psr/log → install --prefer-source, reinstall psr/log --prefer-source, config preferred-install source + fresh install (2.2.30, 2.10.3): source is dropped, so the patched dist installs every time. pass.
• Exec bits: upstream vs hosted vs vendored install of a package with bin/tool (listed bin) and tools/helper.sh (non-bin, 0755), on 1.10.28 / 2.2.30 / 2.10.3. Both stay rwxr-xr-x in every mode, the patch is applied, and .socket/vendor keeps the 0755 too. pass ×9.
• composer-plugin package, hosted and vendored, with allow-plugins, on 1.10.28 / 2.2.30 / 2.10.3: the plugin activates from the patched bytes ("patched") in both modes, while upstream activates pristine. pass ×6. (On 2.10.3 as root you need COMPOSER_ALLOW_SUPERUSER=1, or plugins are disabled in every mode.)
• get <uuid> --mode hosted over a vendored psr/log entry: fail Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536 (comment added).
• Hosted rollback of an inline-repo entry: refused with "restore it from version control" and the lock left rewritten. Documented fail-closed behaviour (same as the hosted → vendored refusal). pass.

Issues

• Commented on Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536 (the get entry point). No new issues filed.

False positives ruled out

• Composer 1 require <other> reverting an inline-repo hosted rewrite: Composer 1 behaviour (its partial update re-reads unchanged packages from the repositories). socket-patch can't prevent it, and scan re-wires it. Docs-gap candidate only.
• Composer 2.10.3 "plugin not loaded" in every mode: the sandbox runs as root (2.10 disables plugins for root in non-interactive sessions). Not a socket-patch issue.
• Hosted inline-repo rollback refusal: documented fail-closed behaviour.

Housekeeping

• Leftover probe branches bughunt/composer/20260930-srconly-probe, bughunt/composer/20261001-global-probe and bughunt/composer/20261001-c1-topts still need a maintainer to delete them.

Next

1. Re-run Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536 when Composer joins takeover_capable (PR Fix PyPI vendored to hosted takeover being refused (#328) #503 is pypi-only), covering both the scan and get entry points.
2. Global -g leftovers: a non-root, non-writable global dir (probe), SOCKET_GLOBAL=1, a space/unicode --global-prefix, and a re-run once Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 (On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438) merges.
3. macOS/Windows probe of the vendored path-repo + source-install revert (a Windows junction path repo with existing transport-options). Also Windows exec-bit-free and long-path (.socket/vendor/composer/<uuid>/<v>/<n>@<ver> depth) cells.
4. Ask maintainers whether docs/testing/composer-compatibility.md should list composer require <other> (Composer 1, custom repos) as undoing the wiring, together with the COMPOSER=<other>.json crawler/hosted gap.
5. PHP 7.2 / 7.4 cells for Composer 2.2 LTS hosted and vendored (needs a probe branch with setup-php).

[github-actions[bot]]

[agent] Janitor: ledger drift. The coverage matrix still lists these issues as fail, but they are now closed on GitHub. Please re-check those cells on main 6cd37540 on the next run:

• On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438: closed 2026-10-02 17:07 UTC

This is a heads-up only. The janitor never edits ledgers.

---

Generated by Claude Code

[github-actions[bot]]

[agent] 2026-10-02: Composer bug-hunt run

Tested: main 203e092 (28 commits past 61cfb9b, including #442 for #438 and #555's composer purl matching for lockfile-only skips). Latest release v4.0.0. Local Linux: Composer 1.10.28, 2.2.30 and 2.10.3 phars on PHP 8.3, with real composer global require installs (--prefer-source, since GitHub zipballs are blocked in the sandbox) and a local mock /patch/batch that logs the queried purls. No probe branches this run.

Re-triage

• On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438 was closed by Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442. On Linux the new $XDG_CONFIG_HOME/composer fallback works when composer isn't on PATH and no ~/.composer exists (2.2.30 / 2.10.3: 1 package scanned). That's the Linux half of the old "fail On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438 with XDG_CONFIG_HOME" cell. The Windows %APPDATA% half wasn't re-probed.
• Composer redirect, vendor and vex code is unchanged since 61cfb9b, so Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399, Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439, On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463, Composer vendored repair (and re-vendor) rebuilds a deleted uuid dir without its socket-patch.vendor.json marker, leaving git showing the marker as deleted #515 and Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536 stand as last verified.
• No new human comments on Bug hunt ledger: Composer #321.

Cells (main 203e092, Linux)

• Global home fallback (composer not on PATH), with both ~/.composer (even empty) and the XDG home present: fail Composer global-home fallback checks ~/.composer before the XDG home, so scan -g finds no Composer 2 global packages when a stale ~/.composer exists and composer isn't on PATH #586 on 2.2.30 and 2.10.3, for both the ~/.config/composer and the $XDG_CONFIG_HOME/composer layouts, reproduced ×2. Composer 2 picks the XDG dir and socket-patch picks ~/.composer, so it scans 0 packages and exits 0. Controls pass: composer on PATH, or ~/.composer absent. Composer 1.10.28 isn't affected (it prefers ~/.composer itself).
• The order dates from before Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 (v4.0.0 has the same ~/.composer → ~/.config/composer order), so it isn't a regression.

Issues

• Filed Composer global-home fallback checks ~/.composer before the XDG home, so scan -g finds no Composer 2 global packages when a stale ~/.composer exists and composer isn't on PATH #586: Composer global-home fallback checks ~/.composer before the XDG home, so scan -g finds no Composer 2 global packages when a stale ~/.composer exists and composer isn't on PATH #586

False positives ruled out

• The Composer 1.10.28 global installs in the sandbox failed (frozen packagist Composer 1 metadata / zipball limits). That didn't matter for Composer global-home fallback checks ~/.composer before the XDG home, so scan -g finds no Composer 2 global packages when a stale ~/.composer exists and composer isn't on PATH #586, because Composer 1's own home rule matches socket-patch's.

Next

1. Fix apply failing when patched deps are skipped (#403) #555 composer cell: agent apply with a manifest entry for a package that's only in composer.lock (not installed), including a v-prefixed lock version. Expected: skip with exit 0.
2. Re-run Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536 when Composer joins takeover_capable, covering both the scan and get entry points.
3. Windows probe: re-verify the On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438 fix (%APPDATA%\Composer through composer.bat and without composer on PATH), and the macOS-with-XDG_*-var variant of Composer global-home fallback checks ~/.composer before the XDG home, so scan -g finds no Composer 2 global packages when a stale ~/.composer exists and composer isn't on PATH #586.
4. Global -g leftovers: a non-root, non-writable global dir, SOCKET_GLOBAL=1, and a space/unicode --global-prefix.
5. PHP 7.2 / 7.4 cells for Composer 2.2 LTS (probe with setup-php).

[github-actions[bot]]

[agent] 2026-10-03: Composer bug-hunt run

Tested: main 045d7ec (7 commits past 203e092: #555 lockfile-only apply skip, #503 pypi takeover, #587 zip streaming, #583 pnpm, #552 gem, #581 API timeouts). None of them touches Composer's crawler, redirect or vendor code. Latest release v4.0.0. Local Linux: Composer 1.10.28, 2.2.30 and 2.10.3 phars on PHP 8.3, with real --no-dev installs from inline package repositories (file:// zip dists, v-prefixed versions). One probe branch on macOS/Windows.

Re-triage

• Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536: still stands. Composer is still missing from both takeover_capable predicates (commands/scan/hosted.rs, hosted/memory/stages.rs). Fix PyPI vendored to hosted takeover being refused (#328) #503 added only pypi.
• Composer global-home fallback checks ~/.composer before the XDG home, so scan -g finds no Composer 2 global packages when a stale ~/.composer exists and composer isn't on PATH #586: composer_home_candidates is unchanged, so the bug stands. A maintainer triaged it as p2.
• Hosted Composer rewrite keeps the entry's transport-options, so Composer sends a private repository's auth headers to the hosted patch URL #399, Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439, On Composer 1, composer/installers packages (e.g. WordPress plugins) are invisible to the crawler: agent scan skips them as "not installed" and hosted vex attests them without checking the unpatched installed bytes #463 and Composer vendored repair (and re-vendor) rebuilds a deleted uuid dir without its socket-patch.vendor.json marker, leaving git showing the marker as deleted #515 cover code that hasn't changed, so they stand as last verified. No new human comments on Bug hunt ledger: Composer #321.
• On Windows, scan -g finds no Composer global packages in the default %APPDATA%\Composer home, so apply -g and vex -g silently do nothing #438 (closed by Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442), Windows re-probe: pass. scan -g finds the global package in %APPDATA%\Composer with composer on PATH and with composer off PATH, on 1.10.28, 2.2.30 and 2.10.3. Probe run: https://github.com/SocketDev/socket-patch/actions/runs/37080612444

Cells (main 045d7ec)

• Agent apply --offline (Fix apply failing when patched deps are skipped (#403) #555/npm apply exits 1 when every patch targets a platform-skipped optional dependency (fsevents, @esbuild/*), so the setup hook fails npm ci and npm install on other OSes #403) with a manifest for a require-dev package left out by composer install --no-dev, lock version v1.2.0: exit 0, a Note:, and JSON skipped/"lockfile-only". pass on 1.10.28, 2.2.30 and 2.10.3. Every manifest purl spelling passes: @1.2.0, @v1.2.0, padded @1.2.0.0 and uppercase ACME/DevTool (1.10.28 and 2.10.3).
• Controls: an unknown package (acme/ghost) and the wrong version (devtool@1.2.1) still exit 1 with the Error: block. pass.
• Mixed manifest (installed prod package + lock-only dev package): the prod package is patched, the dev package is skipped, exit 0. pass on 1.10.28 and 2.10.3, and with a custom vendor-dir: lib on 2.10.3.
• scan --json on a --no-dev project: scannedPackages: 2, lockfileOnlyPackages: 1 on 1.10.28 and 2.10.3. pass.
• rollback --offline with one installed and one lock-only patch: the installed one is restored, the lock-only one gets a warning, exit 0. pass.
• Global --global-prefix "<dir with space ü>/vendor" (2.10.3): 1 package found. SOCKET_GLOBAL=1 with COMPOSER_HOME: 1 package. pass. --global-prefix names the vendor dir, not COMPOSER_HOME; pointing it at the home finds 0 packages (see Known non-bugs).
• macOS scan -g with composer on/off PATH (1.10.28 / 2.2.30 / 2.10.3): 1 package found every time. pass. The macOS mock was slow to accept connections, so some runs exited 1 on the batch call, but they still crawled 1 package. That's a probe artifact.
• macOS Composer global-home fallback checks ~/.composer before the XDG home, so scan -g finds no Composer 2 global packages when a stale ~/.composer exists and composer isn't on PATH #586 variant: untested. The probe set XDG_CONFIG_HOME but didn't create $XDG_CONFIG_HOME/composer, so Composer itself kept using ~/.composer. Redo it with the XDG composer dir created.

Issues

• None filed and no comments posted. Every cell passed or is already covered.

False positives ruled out

• --global-prefix <COMPOSER_HOME> scans 0 packages. The flag takes the package root (the vendor dir), the same way npm takes node_modules and pypi takes site-packages. Not a bug.
• macOS Connect … deadline has elapsed on the mock batch call: a probe artifact (the Python mock started slowly), not a socket-patch issue.

Housekeeping

• The sandbox git proxy refused deleting bughunt/composer/20261003-home-probe ("remote end hung up"). It joins the leftover branches that need a maintainer to delete them.

Next

1. macOS Composer global-home fallback checks ~/.composer before the XDG home, so scan -g finds no Composer 2 global packages when a stale ~/.composer exists and composer isn't on PATH #586 variant: create $XDG_CONFIG_HOME/composer with the global install, keep a stale ~/.composer, and run scan -g with composer off PATH.
2. Re-run Composer vendored → hosted takeover rewrites the vendored lock entry in place, keeping the patch-uuid dist.reference and transport-options: Composer 1 install crashes and rollback refuses #536 when Composer joins takeover_capable, covering both the scan and get entry points.
3. Hosted/vendored vex and vendored scan --vendor on a --no-dev project with a lock-only v-prefixed dev package (vendored needs the packagist-origin /patches/package mock).
4. PHP 7.2 / 7.4 cells for Composer 2.2 LTS (probe with setup-php).
5. Global -g: a non-root, non-writable global dir must fail loudly (probe as non-root).