Skip to content

Stop downloading vlt artifacts during hosted scans - #2013

Open
Mikola Lysenko (mikolalysenko) wants to merge 1 commit into
mainfrom
refactor/drop-vlt-artifact-probe
Open

Stop downloading vlt artifacts during hosted scans#2013
Mikola Lysenko (mikolalysenko) wants to merge 1 commit into
mainfrom
refactor/drop-vlt-artifact-probe

Conversation

@mikolalysenko

@mikolalysenko Mikola Lysenko (mikolalysenko) commented Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

LLM Description written by Claude Code:claude-opus-5-5

Summary

A hosted scan of a vlt project no longer downloads every granted patch archive just to hash it. That probe guarded against the patch server's CDN re-gzipping archives, which vlt rejects with EINTEGRITY because it hashes the raw response. The server side of that is fixed: depscan #26856 and #26867 send Cache-Control: no-transform on every archive response and 304, and production serves archives unencoded today. On a third-party mirror that still re-encodes, vlt ci fails closed with EINTEGRITY, so nothing installs unpatched bytes.

This is PR 1 of a stack that moves vendored and hosted logic back into core and drops /patches/view from hosted scans.

User-visible changes

  • Hosted scans of vlt projects make no artifact requests: one full download per patched package per run is gone.
  • The redirect_vlt_artifact_unverifiable warning and skip reason no longer exist (contract, docs and vlt-coverage.json updated).
  • The in-memory hosted engine (Node addon, hosted-bundle) used to judge every vlt dependency "offline" and withhold it, because it has no network. It now pins vlt dependencies the way the disk flow does.
  • The warm-tree heal checks the Socket-owned lock instances this run confirmed. With no patch record and no hidden lock it reports the copy as undeterminable and asks for vlt ci, instead of comparing it against downloaded archive bytes; that advisory's wording changed.
  • scripts/backtest-vlt.py still probes the live artifact itself and records blocked-by-server-encoding for a cell whose probe sees an encoded response, without running the CLI.

Changes

  • Deleted core/patch/redirect/vlt_preflight.rs (probe, ArtifactProbe, VLT_ACCEPT_ENCODING, scope planning).
  • core/hosted/vlt.rs keeps only install_state_present and bun_lockb_present. The withheld_everywhere and withheld_from_vlt plumbing is gone from hosted/engine.rs and hosted/memory/stages.rs. rewrite_registry_redirect_withholding_vlt is renamed to rewrite_registry_redirect_with_host, and helpers that only the probe used are removed.
  • CLI: scan/hosted.rs and vlt_heal.rs drop artifact_preflight and the heal's artifact-bytes fallback.

Validation

All of these ran locally:

Command Result
cargo fmt --check ok
cargo clippy --workspace --all-features -- -D warnings ok
core --lib 7123 passed
CLI --lib --bins 865 passed
in_process_redirect 135 passed
scan 248 passed
e2e_vex_lockfile 354 passed
hosted_memory_engine 49 passed (a_vlt_project_is_pinned replaces the withholding test)
in_process_vendor_bun_takeover 44 passed
in_process_rollback_hosted 41 passed
in_process_get_modes 23 passed
in_process_get_hosted_ecosystems 10 passed
e2e_hosted_production 62 passed
e2e_vendored_production 61 passed
e2e_redirect_vlt_build 28 passed
scripts/tests 380 passed

Not run locally: the ignored cases that need a real vlt toolchain or the live service, including the rewritten heal test and the production install proof (its "encoded" branch is removed). A manual probe against production served identity with no-transform and a matching sha512. vlt-serve-watchdog.yml stays continue-on-error.

🤖 Generated with Claude Code

Note

Medium Risk
Changes hosted vlt behavior and removes a safety gate that refused pins when artifacts were content-encoded; misconfigured CDNs would surface as install-time EINTEGRITY instead of scan-time refusal.

Overview
Hosted vlt pinning no longer runs an artifact preflight that downloaded each granted tarball (vlt-style Accept-Encoding, sha512 check) before rewriting vlt-lock.json. The scan pins hosted URLs without any artifact GETs; verification is deferred to vlt ci / install, relying on the patch server serving unencoded archives via Cache-Control: no-transform.

The redirect_vlt_artifact_unverifiable warning/skip path and socket-patch-core vlt_preflight are removed, along with withhold_everywhere / withheld_from_vlt plumbing in the hosted engine and in-memory addon (which previously treated every vlt dep as offline). Warm-tree heal keys off confirmed vlt uuids instead of preflight-downloaded bytes; missing records now yield an undeterminable reinstall advisory rather than byte comparison.

Docs, CLI_CONTRACT, CI comments, production e2e, and tests drop encoding-refusal branches and assert zero artifact hits on hosted scan/get; backtest still records blocked-by-server-encoding at the probe layer when needed.

Reviewed by Cursor Bugbot for commit e9d8e31. Configure here.

Generated by Claude Code

@mikolalysenko
Stop downloading vlt artifacts during hosted scans
e9d8e31 
A hosted scan of a vlt project downloaded every granted patch archive
the way vlt fetches it, and withheld the dependency
(`redirect_vlt_artifact_unverifiable`) when the server re-gzipped it.
That guarded against patch.socket.dev's CDN re-encoding archives,
which vlt rejects with EINTEGRITY. The patch server has sent archives
with `Cache-Control: no-transform` since depscan #26856 and #26867,
and production serves them unencoded today. On any mirror that still
re-encodes, `vlt ci` fails closed with EINTEGRITY, so nothing installs
unpatched bytes.

So the scan no longer fetches the archives. It pins vlt dependencies
directly, without a full download of every patched package per run.
The in-memory hosted engine (the Node addon and `hosted-bundle`) has
no network, so it used to withhold every vlt dependency as "offline";
it now pins them the way the disk flow does.

The warm-tree heal now checks the Socket-owned lock instances this run
confirmed in `vlt-lock.json`. With no patch record and no hidden lock
it reports the copy as undeterminable (asking for `vlt ci`) instead of
comparing it against downloaded archive bytes.

The vlt backtest still probes the live artifact itself: a must-patch
hosted cell records `blocked-by-server-encoding` when its probe sees a
content-encoded response, without running the CLI.

Assisted-by: Claude Code:claude-opus-5-5
This was referenced Nov 4, 2026
Open
Open
@mikolalysenko Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Nov 4, 2026
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Nov 4, 2026

Copy link
Copy Markdown
Collaborator Author

Labeled Ready for review by the burn-down agent.

Generated by Claude Code

@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Nov 4, 2026

Copy link
Copy Markdown
Collaborator Author

Final review brief

What it does. Hosted scans no longer download each vlt artifact before pinning it. That download was a scan-time check for CDN re-encoding, and this PR deletes it along with the redirect_vlt_artifact_unverifiable skip, the withholding paths in the disk and in-memory engines, and the plain_http client. The warm-tree heal now targets the vlt uuids this run confirmed, and when there is no patch record and no hidden lock it reports the copy as undeterminable instead of comparing it to a downloaded tarball.

Risk: medium. The rewriter edits are mechanical, but a fail-closed gate at scan time is gone. If a mirror re-encodes archives, users now find out as EINTEGRITY at vlt ci rather than as a refusal during the scan. That still fails closed, so no unpatched bytes get installed. The in-memory engine goes from withholding every vlt dependency to pinning them.

Look here

  • vlt_heal.rs:291: the heal filter changes from preflight.passed to confirmed_vlt. Already-pinned deps still land in confirmed_vlt_uuids (redirect/vlt.rs:621), so re-runs still heal.
  • patch/redirect/vlt_heal.rs:314:`` bytes_check returns Unknown when there is no record, and the tarball comparison is removed.
  • hosted/engine.rs:1921 and :3438: exempt is now only the takeover uuids, and confirmation uses a single needle group.
  • hosted/memory/stages.rs:183: the in-memory engine now pins vlt deps. hosted_memory_engine::a_vlt_project_is_pinned checks this byte for byte.
  • scan/hosted.rs:1244: the three rewrite call sites and the heal inputs.

Verified

  • Read the full diff (35 files, +267/-2379) against the description.
  • No references to the removed symbols remain in code, docs or workflows, and no debug code was left behind.
  • The deleted tests covered only behaviour that is now gone. Vendored-to-hosted vlt takeover is still covered.
  • The new tests assert zero artifact requests on scan, dry-run scan and get.
  • CHANGELOG.md is untouched.
  • CI: ci-ok and clippy are green, and Bugbot passed.

Changes I made. None.

Open questions (non-blocking)

  • A dry run on a warm tree with no hidden lock now reports "undeterminable", while the wet run (which has the patch record) reports stale. They used to agree. This only shows up when the hidden lock is missing.
  • These removals are not in the description: the SOCKET_PATCH_VLT_HOSTED_PRODUCTION_REQUIRED env var and its guard, and the backtest identity-mirror fallback.
  • Nits that could be a follow-up:
    • The comment at hosted.rs:1248 is 120 columns.
    • The comments at socket-patch-bench/src/fixtures/npm.rs:237 and :861 still describe the vlt artifact preflight.
  • The rewritten heal e2e and the production install proof are #[ignore] tests that need a real vlt toolchain.

Auto-merge is armed, so approving sends this straight to the merge queue. #2015 and #2021 are stacked on this PR.

Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mikolalysenko