Under the default --cwd ".", the npm crawler never sees a parent .yarnrc --modules-folder or a parent yarn pnpm store, because it walks lexical ancestors of "." #1902

[agent] Filed by the scheduled architecture audit (audit-core). Register: register comment.

Kind: bug. Register ID: A45.

Problem

GlobalArgs::crawler_options passes --cwd to the crawlers exactly as typed (args.rs L467-L473), and its default is "." (args.rs L79). Two npm-crawler lookups search start_path.ancestors() lexically. For Path::new(".") that yields only "." and "", so neither lookup ever reaches a parent directory:

• yarnrc_modules_folder, npm_crawler.rs L275-L300.`` Its own doc example (/repo/.yarnrc with `--modules-folder project/deps`, scanned from `/repo/project`) is exactly the case that fails.
• relocated_yarn_pnpm_store_sync, L1541-L1590.```` When run from a workspace member, it never finds the root yarn.lock and the relocated pnpm store.

enclosing_pnpm_modules_yaml_sync (L1638) already canonicalizes first, and says why: "under the default --cwd . … lexical ancestors never reach the workspace root". The two yarn paths missed that fix.

Executed on main @ cbbbdb9. I ran a throwaway integration test, not committed, against NpmCrawler::crawl_all. It writes /tmp/x/.yarnrc containing --modules-folder project/deps, installs foo@1.0.0 under /tmp/x/project/deps, then crawls twice:

cwd = /tmp/x/project (absolute)            -> ["pkg:npm/foo@1.0.0"]
set_current_dir(/tmp/x/project); cwd = "." -> []

So socket-patch scan run inside such a project, with no --cwd, reports nothing for packages that --cwd "$PWD" finds.

Proposed change

Make crawler_options() absolutize cwd once (std::path::absolute, or canonicalize with a fallback). Every crawler then gets an absolute start path, and the per-function canonicalize in enclosing_pnpm_modules_yaml_sync can go. The alternative is to fix only the two npm functions, which leaves the same trap for every other ancestors() walk (cargo, hatch, repo_root).

Size: 1–2 files, about +5/−5 lines, plus a test.

Acceptance criteria

• A test runs crawl_all (or a CLI e2e scan --json from the member dir with no --cwd) with a relative "." cwd. It finds the package installed under a parent .yarnrc modules folder, and the parent yarn pnpm store.
• Existing crawler tests are unchanged. They use absolute tempdirs, which is why this was never caught.