[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1268

What was wrong

In a pnpm workspace with sharedWorkspaceLockfile: false (or pnpm 9's .npmrc shared-workspace-lockfile=false), hosted mode pins each member's own packages/<m>/pnpm-lock.yaml (#1007) and adds trustLockfile: true to the root pnpm-workspace.yaml. rollback / remove then decided whether that setting was still needed by looking at the root pnpm-lock.yaml only (cleanup_side_config in patch/redirect/upstream/npm.rs):

• restoring a member lock never entered the trust-cleanup branch, so pnpm_trust_lockfile_left never fired and pnpm's lockfile tarball check stayed off with no warning (the reported bug);
• restoring the root lock while a member lock stayed hosted reported the setting as unneeded (or would delete an exact scaffold), even though the member still needs it.

Fix

New trusted_pnpm_locks_restored treats the root lock plus every member lock that pnpm_workspace::member_locks lists (the same listing the hosted engine pins from) as the locks the root file trusts. The cleanup runs when the restore staged any of them and none is still hosted. If the member locks can't be listed, it fails closed and leaves the setting alone. The member walk runs only when a pnpm-lock.yaml was actually restored. The CLI_CONTRACT.md side-settings sentence now names member locks.

Tests (crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs)

Issue shape	Test	Without fix	With fix
#1268: member-lock rollback, setting in pnpm-workspace.yaml and in .npmrc (pnpm 9)	issue_1268_rollback_of_a_member_lock_warns_trust_lockfile_left (real scan --mode hosted, then rollback --json)	FAIL: warnings only [reinstall_required]	pass
#1268: root lock restored while a member lock stays hosted	issue_1268_member_lock_still_hosted_keeps_trust_without_warning (scoped rollback)	FAIL: wrongly warns pnpm_trust_lockfile_left	pass

Local evidence

• cargo fmt --all -- --check, cargo clippy --workspace --all-features -- -D warnings: clean
• cargo test -p socket-patch-cli --all-features --test in_process_redirect_pnpm: 41 passed
• cargo test -p socket-patch-cli --all-features --test in_process_rollback_hosted: 41 passed
• cargo test -p socket-patch-cli --all-features --test e2e_redirect_pnpm_build -- --ignored --skip pnpm_pinned_matrix (real pnpm 7–11 via corepack): 11 passed
• cargo test -p socket-patch-core --all-features --lib: 6800 passed. The 4 failures, and 3 in in_process_redirect, are chmod-based write-failure tests that can't fail when the sandbox runs as root (uid 0). They don't touch this code. The full cargo test --workspace ran out of sandbox disk, so CI covers the rest.

/code-review high findings not fixed here

• rollback run with --cwd packages/<m>: the cleanup then reads the member directory's pnpm-workspace.yaml, not the root file. This was already the case before this PR, for the root-lock case too. It's a separate shape (resolving the governing root for side settings), so I left it as a follow-up.
• Rush repos: discovery skips member locks there, so cleanup may also check member locks that were never pinned. Those locks carry no hosted URLs, so the result doesn't change.
• No vendor-takeover test: vendor takeovers call the same restore_upstream, so they now report the warning for member locks too. That's intended and the same code path, so there's no separate test.

https://claude.ai/code/session_011f9aeQF4jrBX48TtNJKzzB

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Bugbot is paused — your team has an unpaid invoice

Bugbot is paused because your team has an unpaid invoice.

Pay it from the billing page in the Cursor dashboard and Bugbot resumes automatically.

(requestId: d85e8278-a4c0-408e-b521-b68aa77bce76)

[cursor]

Bugbot is paused — your team has an unpaid invoice

Bugbot is paused because your team has an unpaid invoice.

Pay it from the billing page in the Cursor dashboard and Bugbot resumes automatically.

(requestId: 309630ee-4b7e-4d75-9859-43ea820c2eb5)

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Bugbot is paused — your team has an unpaid invoice

Bugbot is paused because your team has an unpaid invoice.

Pay it from the billing page in the Cursor dashboard and Bugbot resumes automatically.

(requestId: 8bbd68d4-d09f-43f4-8996-036914c1c1bb)