[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1902

Summary

If you run socket-patch from a project or workspace member without --cwd, scan, apply and vex now read the config files in parent directories, just as they do with an absolute --cwd. Before this fix, three lookups never looked above the working directory:

• A parent .yarnrc with --modules-folder: the packages installed there were reported as not installed.
• A yarn workspace root's relocated pnpm-linker store (pnpmStoreFolder), when run from a member: its transitive packages were reported as not installed.
• pnpm modulesDir set in the workspace root's pnpm-workspace.yaml or .npmrc, when run from a member: the same symptom. This one isn't listed in Under the default --cwd ".", the npm crawler never sees a parent .yarnrc --modules-folder or a parent yarn pnpm store, because it walks lexical ancestors of "." #1902. The review found it, and it has the same cause.

Root cause

--cwd defaults to . and reaches the crawlers as typed. Upward config lookups walked Path::ancestors(), which for . yields only . and "". So they never reached a real parent directory. pkg_managers (std::path::absolute) and enclosing_pnpm_modules_yaml_sync (canonicalize) already worked around this. The three lookups above didn't.

Fix

• utils::relpath::absolute_lexically: makes a path absolute against the working directory and folds ./... It doesn't resolve symlinks, and it treats the empty path (the parent of a bare node_modules) as the working directory. yarnrc_modules_folder and pnpm_layout::modules_dir_setting now walk from it. Both return only a project-relative string, so their output keeps the same spelling.
• utils::relpath::ancestors_keeping_spelling: a lazy upward walk that pairs each absolute level with a spelling in the start path's own terms. It keeps the lexical ancestors and spells each level above the working directory with .. (./..). relocated_yarn_pnpm_store_sync uses it, so a store found from ./packages/a/node_modules and one found from ./node_modules get the same spelling. The store is still read from the absolute project path.

Why not make --cwd absolute in GlobalArgs::crawler_options, as the issue proposes?

The CLI depends on crawler paths keeping the relative spelling under the default --cwd .. ui::display_copy_path strips the raw cwd prefix to print node_modules/x, and path_scope::BoundScope documents that "crawler paths are NOT absolutized". Absolute crawler paths would change every relative path the CLI prints or matches. Fixing the lookups that walk upward keeps those outputs the same.

Tests

New regression tests in crates/socket-patch-core/tests/crawler_npm_e2e.rs are #[serial] and use a shared CwdGuard, which replaces the inline copy that was there. Each test crawls once with an absolute cwd as a control, then again with . from inside the project:

Case	Test	Without the fix	With the fix
#1902 .yarnrc --modules-folder above cwd	parent_yarnrc_modules_folder_is_read_from_a_relative_cwd	FAILED: roots [], want ["./deps"]	ok
#1902 yarn pnpm store above a member	parent_yarn_pnpm_store_is_found_from_a_relative_member_cwd (unix)	FAILED: only is-odd, transitive is-number missing	ok
same cause: pnpm modulesDir in the root yaml	parent_pnpm_modules_dir_is_read_from_a_relative_member_cwd	FAILED: []	ok
spelling and laziness of the walk	utils::relpath::tests::ancestors_keeping_spelling_climbs_past_the_working_directory	(new helper)	ok

To get the "without the fix" column, I made absolute_lexically return its input unchanged and reran the tests.

Local runs:

• cargo fmt --all -- --check: ok
• cargo clippy --workspace --all-features -- -D warnings: ok
• cargo test -p socket-patch-core --all-features --no-fail-fast: 7657 passed. 4 failed, all permission-denial tests in other modules (copy_tree, vlt_heal, pypi_poetry, pypi_requirements). They can't fail closed when run as root, which is how this container runs. CI runs them as a normal user.
• cargo test -p socket-patch-cli --all-features --lib: 940 passed
• SOCKET_PATCH_NPM_E2E_REQUIRED=1 cargo test -p socket-patch-cli --all-features --test e2e_redirect_npm_build -- --ignored: 9 passed (run on the first commit)
• The full cargo test --workspace ran out of disk in this container, so CI is the check for the remaining CLI suites.

No wrapper changes are needed: npm/, pypi/ and gem/ only forward --cwd.

Review notes (/code-review high)

Fixed:

• A store could be reported under two spellings (./store and store). The walk now keeps the lexical spelling.
• The pnpm modulesDir lookup had the same bug.
• The cwd-changing tests were in the lib test binary, where other tests read the cwd without serializing. They moved to the integration suite.
• The walk helpers are now shared and lazy.

Not changed, with reasons:

• With a relative cwd, the store walk now looks above --cwd for a yarn.lock. An absolute --cwd has always done this. It's how a member finds its workspace root's store, and the store must still lie inside that project. This brings . in line with the absolute spelling.
• An absolute --cwd that contains .. still walks its lexical ancestors. That's unchanged behaviour and outside Under the default --cwd ".", the npm crawler never sees a parent .yarnrc --modules-folder or a parent yarn pnpm store, because it walks lexical ancestors of "." #1902.
• enclosing_pnpm_modules_yaml_sync still canonicalizes. It reads only the absolute file, and swapping its helper isn't needed for this fix.

https://claude.ai/code/session_011f9aeS6qCCCE8PZfZcJW4k

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 378c581. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review at head 378c581.

• CI: 32/32 executed checks green (50 skipped by path filters), mergeable, no conflicts.
• Bugbot: reviewed 378c581, no findings; no open review threads.
• Reviewer focus: the shared upward walk for a relative --cwd in the crawlers (fixes Under the default --cwd ".", the npm crawler never sees a parent .yarnrc --modules-folder or a parent yarn pnpm store, because it walks lexical ancestors of "." #1902).

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does: Under the default --cwd . (or any relative --cwd), three upward config lookups in the npm crawler only walked the lexical ancestors of ., so they never reached a parent directory: a parent .yarnrc --modules-folder, a yarn workspace root's relocated pnpm-linker store, and pnpm modulesDir in the workspace root. This walks them from the absolute path, and keeps the relative spelling of the paths the CLI prints.

Risk: low. The fix is confined to three lookup helpers. With an absolute --cwd they behave as before (the new tests use it as the control), and output paths keep their relative spelling.

Look here

• relpath.rs:159: absolute_lexically (empty path → cwd, no symlink resolution)
• relpath.rs:177: ancestors_keeping_spelling, which pairs each absolute level with a ./..-style spelling
• npm_crawler.rs:1544: the store lookup now checks yarn.lock on the absolute path and builds the result from the spelled one
• npm_crawler.rs:275 and pnpm_layout.rs:121: the other two walks
• crawler_npm_e2e.rs:5072: three #[serial] regression tests (absolute control, then relative)

Verified

• Read the full diff. I traced the spelled walk for ., "", ./packages/a, ../x, a/../b and ./a/.., and the spelled level matches the absolute level in every case.
• yarnrc_modules_folder's strip_prefix(rc_dir) now compares two absolute paths, so it is consistent. The lookups are per project, not a hot path.
• The tests change the process cwd only under #[serial] with a restoring guard, like the existing deno test.
• Ran cargo test -p socket-patch-core --lib relpath and the parent_* tests in crawler_npm_e2e locally: 9 passed (6 relpath lib tests, 3 parent_* e2e tests), 0 failed.
• CI: 32/32 executed checks green (50 skipped by path filters). Bugbot: success. CHANGELOG.md untouched. No unresolved threads.

Changes I made: none.

Open questions: none blocking. Note that, as with an absolute --cwd today, the walk now reads .yarnrc/.npmrc files above the project (up to /) under --cwd . too. That is the intended parity.

Auto-merge is armed, so approving sends it straight to the merge queue.

---

Generated by Claude Code