fix(npm): discover pnpm virtual-store packages — transitive deps were invisible to apply and scan

[Mikola Lysenko (mikolalysenko)]

Problem

Under pnpm's isolated linker (the default on every pnpm major), a transitive-only dependency lives solely inside node_modules/.pnpm/<entry>/node_modules/<name> — there is no importer-root symlink for it. The npm crawler skipped .pnpm as a hidden directory and never traversed symlinked packages, so:

• apply reported package_not_installed for packages that were physically installed and runtime-loaded (the classic minimist-behind-mkdirp CVE shape), exiting as if the project were clean;
• scan never included those packages in the patch-API batch query, so their patches could never surface.

Confirmed empirically on pnpm 7.33.5, 8.15.9, 9.15.9, 10.34.5, 11.22.0, and 12.0.0-rc.7 (2026-08-18 e2e matrix, 18 legs, real corepack installs).

Fix

• find_by_purls now probes .pnpm store entries (real dirs only; BFS keeps root-install-wins). Store entries whose dir name decodes as name@version are filtered against the pending-target set so large monorepo stores aren't walked wholesale; undecodable names (truncated/hash-suffixed dirs) ride a conservative fallback and stay probeable.
• crawl_all inventories the virtual store after the root pass; identity re-reads are skipped for already-seen name@version entries while bundled deps inside store entries still walk.
• One shared store-entry enumerator; the scan helpers are parameterized by a ScanPolicy bit instead of a ~55-line parallel copy.
• Multi-version installs of one package become individually discoverable (each store entry probes independently; the name+version match keeps them distinct).

The no-symlink-traversal policy is unchanged everywhere else; .pnpm is the one documented exception because the virtual store is the only physical home of transitive deps under the isolated linker.

Verification

• New hand-built pnpm-farm tests: transitive-only dep, second version of the same package, scoped store entry, decoy entries planted in the hoist dir and hidden children, truncated-name fallback, decoder unit tests (plain / +-escaped scope / v9 peer paren / legacy _ suffix / non-package names → None).
• New real-pnpm e2e in in_process_alternate_installers.rs: pnpm install of mkdirp@0.5.5 in two sibling projects sharing one hardlink-imported store; offline apply of a hand-staged minimist manifest must patch the canonical .pnpm path (exact bytes + git-sha256), break the hardlink (inode diverges), and leave the sibling + global store byte-pristine.
• Live re-verified with the release binary on corepack pnpm@10.34.5: before — apply exit 1 package_not_installed, scan batch body [mkdirp] only; after — apply exit 0 applied=1 with marker bytes at the canonical path, store clean, scan batch body includes minimist@1.2.8.
• Production store-safety suite (e2e_safety_pnpm) re-run green on PATH pnpm 11 (4/4).

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes core npm package discovery and resolution paths used by apply and scan; behavior is well covered by new unit and e2e tests, but incorrect traversal could still miss packages or patch wrong paths.

Overview
Fixes a gap where pnpm isolated-linker transitive dependencies (only under node_modules/.pnpm/…, often with no importer-root symlink) were skipped because .pnpm was treated like other hidden dirs and store symlinks were not walked correctly. Apply could report package_not_installed; scan could omit those packages from batch discovery.

The npm crawler now defers a .pnpm virtual-store pass after the importer node_modules walk, with a ScanPolicy separating importer trees (record symlinks, defer store) from store-entry trees (real dirs only, skip redundant package.json when already seen). find_by_purls enqueues store entries during BFS, filtering by pending package names via decode_pnpm_store_entry_name (peer suffixes, scoped + escaping, conservative None for truncated/git entries that stay probeable). Shared list_pnpm_store_entries centralizes store layout rules.

Coverage adds decoder unit tests, hand-built pnpm-farm e2e for resolve/scan/filter/bundled deps, and a real pnpm install test (mkdirp → transitive minimist) asserting patch at the canonical store path and CoW (hardlink break) so a sibling project sharing the store stays pristine.

^{Reviewed by Cursor Bugbot for commit bd4bd19. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit bd4bd19. Configure here.}