Fix yarn portal copies read as no package (#1579)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1579

Summary

A yarn berry portal: / link: copy is locked at the placeholder version 0.0.0-use.local, so only its package.json says what it installs. Two shapes from #1579 were dropped as "no package copy". Hosted and vendored scans reported a clean success, and in-run and lock-only vex attested not_affected, while yarn linked unpatched left-pad as node_modules/lp2. Both shapes are now treated as possible unpatched copies: hosted warns redirect_copy_unpatched, vendored warns vendor_copy_unpatched, and vex withholds the contested refs.

Root cause

• linked_copy_unknown (vendor/yarn_copies.rs) exempted any non-empty directory with no package.json, for both protocols. That exemption only holds for link: (plain assets). Yarn refuses to install a manifest-less portal:, so a placeholder target (a .gitkeep that a fetch step fills) is not what gets installed. CopyRef::Linked didn't record its protocol, so the two couldn't be told apart.
• A manifest that parsed but had no name or version made CopyRef::identity return None. The manifest_parsed short-circuit then said "not unknown". The file: directory twin already failed closed.

Hosted (through vex discovery), vendored (other_name_copies) and vex (record_copies) share this decision, so the fix sits in that shared code.

Changes

• CopyRef::Linked(dir, LinkKind) records Portal or Link. A portal: whose identity can't be read is always unknown. Only a link: to a non-empty directory with no package.json stays exempt.
• A linked manifest with no (valid) name may be any package. One that names a package but no version may be any version of that package only. UnidentifiedCopy gains a name that scopes the contest, so a versionless link: to an unrelated package doesn't withhold every ref in the lock.
• The vendoring warning for a versionless copy says it names no version, instead of "can't be read".
• docs/ecosystems.md describes the new shapes.
• The existing Yarn berry drops a relative portal: / link: copy whose target directory is missing (e.g. an uninitialized git submodule), so hosted and vendored scans succeed and VEX attests not_affected while that copy installs unpatched #1561 vendored test's portal: → plain-directory control is now a positive case (that's the Yarn berry still drops a portal: copy whose target has no package.json (e.g. a .gitkeep placeholder) or whose package.json lacks name/version, so scans succeed and VEX attests not_affected while that copy installs unpatched #1579 change). The link: control is unchanged.

Test evidence

New regression tests, each run against origin/main with only the tests applied (red) and on this branch (green):

Test	main	branch
vex::discover::yarn::tests::issue_1579_portal_placeholder_and_versionless_linked_manifests_contest	FAILED	ok
vex::discover::yarn::tests::issue_1579_versionless_linked_manifest_contests_only_its_name	FAILED	ok
vendor::yarn_berry_lock::tests::issue_1579_portal_placeholder_and_versionless_linked_manifests_are_named	FAILED	ok
hosted_memory_engine::issue_1579_berry_portal_placeholder_and_versionless_copies_are_named	FAILED	ok
formats::yarn::copy::tests::linked_name_reads_a_valid_name_only	(new API)	ok

Each test covers portal: and link: × {.gitkeep placeholder, manifest without name, manifest naming left-pad without version, manifest naming another package without version (control)}. A link: placeholder remains a control, as the issue's matrix documents.

Per-issue checklist:

• Yarn berry still drops a portal: copy whose target has no package.json (e.g. a .gitkeep placeholder) or whose package.json lacks name/version, so scans succeed and VEX attests not_affected while that copy installs unpatched #1579 shape 1 (portal: target with no package.json): hosted, vendored and vex tests above
• Yarn berry still drops a portal: copy whose target has no package.json (e.g. a .gitkeep placeholder) or whose package.json lacks name/version, so scans succeed and VEX attests not_affected while that copy installs unpatched #1579 shape 2 (portal:/link: manifest without name / version): hosted, vendored and vex tests above

Local runs:

• cargo fmt --all -- --check: ok
• cargo clippy --workspace --all-features -- -D warnings: ok
• cargo check --workspace --all-targets --all-features: ok
• cargo test -p socket-patch-core --all-features --lib: 6532 passed. The 4 failures are permission tests (relax_loop_must_not_traverse_symlinked_root, an_unremovable_hidden_lock_keeps_every_store_entry, wire_write_failure_maps_error_and_leaves_lock_untouched, wire_failure_rolls_back_already_written_files). They can't fail as expected when the sandbox runs as root (uid 0). They're unrelated to this change.
• cargo test -p socket-patch-cli --all-features --test hosted_memory_engine: 45 passed
• A full cargo test --workspace ran out of sandbox disk while linking every e2e binary. scripts/yarn-berry-vex-matrix.sh 4.18.0 couldn't fetch yarn through corepack here (corepack yarn@4.18.0 unavailable). Both are left to CI (yarn-berry-e2e).
• Wrappers (npm/, pypi/, gem/) only dispatch to the binary, so they need no change.

/code-review high: findings not fixed

• A link: to a .gitkeep-only directory is still dropped. Kept on purpose. Yarn installs a link: to any directory, including plain assets, and Yarn berry still drops a portal: copy whose target has no package.json (e.g. a .gitkeep placeholder) or whose package.json lacks name/version, so scans succeed and VEX attests not_affected while that copy installs unpatched #1579 documents this cell as the expected "no package copy" control. Only portal: proves a manifest is required.
• A nameless link: manifest (e.g. {"private":true}) now contests every ref in its lock. This is the fail-closed behavior Yarn berry still drops a portal: copy whose target has no package.json (e.g. a .gitkeep placeholder) or whose package.json lacks name/version, so scans succeed and VEX attests not_affected while that copy installs unpatched #1579 asks for, and it matches the file: directory twin (Yarn classic renamed-copy detection (#1489) misses a file: copy outside the project root and a tarball whose root isn't package/, so scans succeed and VEX attests while that copy installs unpatched #1516). A versionless manifest that names a package contests only that package, which keeps the common named case narrow.
• Three-step classification / the manifest is parsed twice / a new public field on UnidentifiedCopy. These are quality notes. The extra parse only happens for portal:/link: copies, and UnidentifiedCopy is only built inside the crate. I left them so the diff stays focused.
• Fixed: an empty or invalid name is now treated as no name, and the vendoring warning for a versionless copy no longer says "can't be read".

🤖 Generated with Claude Code

https://claude.ai/code/session_01V7mhLTP7oP5FnNRWsDgkHi

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit bca69dd. Configure here.}