Bug hunt ledger: PDM

[Mikola Lysenko (mikolalysenko)]

[agent] Progress ledger for the scheduled PDM bug-hunt routine (label pm:pdm).

Last run: 2026-10-01 15:20Z on main 6e7ef74 (latest tag v4.0.0). Linux runs use real PDM against a local mock patch API, because the sandbox blocks the Socket patch hosts. macOS and Windows runs use probe branches.

Coverage matrix

PDM	lock_version	agent (Linux / macOS / Windows)	hosted (Linux)	vendored (Linux)
1.4.5	2	untested	pass on v5 (__pypackages__ sync, legacy [metadata.files], rollback byte-exact); post-rollback install fail #477	untested
2.0.3	4.0	fail #332 w/ install.cache symlink / untested / untested	refused (documented)	refused (documented)
2.8.2	4.3	fail #332 w/ install.cache symlink (all 3 OS)	pass (stale-install warning)	untested
2.10.4	4.4	fail #332 w/ install.cache symlink; pth fails closed	pass (stale-install warning)	untested
2.11.2	4.4.1	fail #332 w/ install.cache symlink	untested	untested
2.12.4	4.4.1	fail #332 w/ install.cache symlink (all 3 OS; re-confirmed on v5 Linux); hardlink pass	pass (v5: #331/#382 fixed); fail #413 (private index static_urls); post-rollback install fail #477	pass on v5 (warm sync patched, vex); post-rollback install fail #477
2.15.4	4.4.1	pass (all 3 OS, symlink + hardlink)	untested	untested
2.20.1	4.5.0	pass	pass (v5: #331/#382 fixed); fail #413	pass (v4)
2.26.9	4.5.0	pass (symlink/hardlink/pth)	pass on v4; untested on v5	untested
2.29.2	4.5.1	pass (all 3 OS)	pass on v5 (lock-only scan, sync, manifest-less rollback byte-exact, VEX); multi-target fork refused (documented); fail #413; post-rollback install fail #477	pass on v5 (warm/fresh/frozen, lock --check, idempotent, vex, rollback byte-exact); post-rollback install fail #477
0.12, 1.0, 1.8 – 1.15	2 / 3.1	untested	untested	untested

Modes × macOS/Windows for hosted and vendored: untested by this routine (the repo's pdm-compatibility.yml covers them).

Global mode (-g, maintainer request)

PDM	global location	scan -g report (Linux)	apply / rollback / vex -g (Linux)	macOS / Windows
2.29.2	system interpreter (default)	pass	pass (apply, idempotent, vex, rollback byte-exact)	untested
2.29.2	pdm use -g → global-project/.venv	fail #451	pass via --global-prefix (incl. space/unicode path, install.cache symlink per-file)	untested
2.29.2	PDM-managed cpython@3.12	fail #451	untested	untested
2.12.4	system interpreter (default)	pass	pass without install.cache; fail #332 with install.cache symlink (writes PDM cache)	untested
2.12.4	pdm use -g <pdm python> (no venv)	fail #451	untested	untested
any	unwritable prefix (non-root)	—	exit 1, file untouched (pass); scan --json drops the reason (#424)	untested
0.12 – 2.0.3	—	untested	untested	untested

-g --mode hosted and --global-prefix --mode hosted refuse with exit 2 (pass). SOCKET_GLOBAL=1 matches -g (pass). --global-prefix <site-packages> finds both #451 locations (pass).

Backlog

1. Maintainer request (global -g), still open: PDM 1.4.5 / 2.0.3 global (PEP 582 global project?); venv.in_project=false global venv (<data>/pdm/venvs/global-project-*); PDM-managed interpreter apply via --global-prefix; macOS / Windows. Done this run: system-global apply/rollback/vex, --global-prefix venv, unicode path, unwritable prefix, install-cache check (Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332).
2. After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477 siblings: remove <purl>, rollback --preserve-state; agent → vendored takeover on v5.
3. Vendored v5 with private index + static_urls (does vendored rollback keep the mirror URLs, unlike Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413?).
4. Hosted pdm update --unconstrained / lock --update-all; groups via pdm sync -G.
5. Non-static private index with different bytes (the hash variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413); PDM 1.x feature.install_cache with agent mode.
6. macOS / Windows probes, once probe-branch deletion works (git push --delete fails through the git proxy; the stale bughunt/pdm/20260930-cache-symlink still needs a maintainer to delete it).

Known non-bugs

• lock_version absent / 3.1 / 4.0–4.2 refused; 2.8.0 accepted-but-crashes (documented).
• __pypackages__ (PEP 582) not crawled; agent mode falls through to the PATH interpreter (documented). Hosted mode installs into __pypackages__ fine.
• A plain relock (pdm lock, --refresh, pdm update <pkg>) drops the hosted redirect (documented; re-scan). Rollback still works when the package stays at the same version.
• PDM < 2.11 keeps an already-installed same-version package after a hosted rewrite (redirect_pdm_stale_install_risk, documented).
• Vendored refuses lock-only checkouts (vendor_fetch_unverifiable), by design.
• Hosted never takes over a vendored path (redirect_pdm_refused), by design (hosted-direction takeover is warn-only). Hosted→vendored for PyPI fails closed with pypi_pdm_source_already_exists (the same for uv/poetry): run rollback first.
• A multi-target (pdm lock --append) lock holding the package at two versions is refused (redirect_pdm_refused), documented.
• PDM 2.10 install.cache_method=pth: agent apply fails closed with File not found.
• pdm lock without -G does not lock optional groups (PDM behaviour, not a socket-patch bug).
• The mock-based published 4.0.0 wheel yields redirected: 0 on lock-only projects, so it can't be used to bisect hosted findings.
• v5 hosted rollback/remove after the package left the lock (pdm remove, upgrade): exit 1 Manifest not found is the documented truly-empty result (formerly Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382).
• v5 hosted rollback refuses a non-universal release (binary wheels) on a lock without cross_platform (PDM ≥ 2.17 default inherit_metadata): documented in CLI_CONTRACT "Hosted unwind coverage".
• v5 hosted rollback on a cross_platform lock writes every PyPI release file (e.g. pyyaml 6.0.1: 51), where PDM locked a requires-python-filtered subset (39). Installs and lock --check are unaffected; cosmetic.
• v5 hosted VEX on a lock-only checkout attests the redirect (the lock is the hosted state); a stale installed copy is omitted not_applied.
• A first pdm add -g with no pdm use -g installs into the system interpreter, which scan -g does find; only the venv and PDM-managed interpreter cases are Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451.
• scan -g --mode vendored is accepted (exit 0) while hosted refuses. It isn't PDM-specific, so it's left to maintainers; not filed.
• rollback deletes the manifest entry (documented: it removes local state), so a later apply is a no-op.
• A mode-less scan without -g / --prune defaults to hosted and rewrites pdm.lock (documented default).

[github-actions[bot]]

[agent] 2026-09-30: PDM bug-hunt run

First run. The ledger was empty and there were no earlier pm:pdm issues, so there was nothing to re-triage.

Tested: main f6b7fb9 (latest release tag v4.0.0), release build of socket-patch-cli. The sandbox blocks patches-api.socket.dev and patch.socket.dev, so all Linux work used real PDM releases against a local mock of the authenticated patch API (/patches/batch, /by-package, /view, /blob, /package). The mock serves a real urllib3 1.26.18 wheel with a marker appended to urllib3/response.py, with a correct RECORD and sha256. The mock script is embedded in the probe workflow of run 36735829162.

Filed

• Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332: agent mode writes the patch through PDM 2.0–2.12's directory-symlink install cache (install.cache=true, cache_method=symlink). The shared ~/.cache/pdm/packages gets patched, and so does every other project using it. Reproduced on Linux, macOS and Windows (probe run https://github.com/SocketDev/socket-patch/actions/runs/36735829162). 2.15+ (per-file symlinks) and hardlink are OK; pth fails closed.
• Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331: hosted rollback reports success but leaves the patch url/hash in pdm.lock after pdm add <other> / pdm lock --update-reuse followed by the suggested re-scan. On 2.12/2.20 it leaves the patched hash with no url, and pdm sync then fails. Linux, 2.12.4 / 2.20.1 / 2.26.9 / 2.29.2.

Cells covered (Linux unless noted)

Cell	Result
agent, install.cache symlink, 2.0.3 / 2.8.2 / 2.10.4 / 2.11.2 / 2.12.4	fail #332 (2.8.2 and 2.12.4 also fail on macOS and Windows)
agent, install.cache symlink (per-file), 2.15.4 / 2.20.1 / 2.26.9 / 2.29.2	pass (all 3 OS for 2.15.4 and 2.29.2)
agent, install.cache hardlink, 2.12.4 / 2.15.4 / 2.26.9 / 2.29.2	pass (all 3 OS)
agent, install.cache pth, 2.10.4 / 2.26.9	2.10.4 fails closed (File not found, exit 1); 2.26.9 pass
hosted 2.29.2: default / --static-urls / direct_minimal_versions / --platform linux / no_cross_platform / no_static_urls,no_cross_platform → pdm sync + pdm lock --check	pass
hosted 2.8.2 / 2.10.4 / 2.12.4: rewrite + warnings (redirect_pdm_stale_install_risk)	pass (documented)
hosted groups: dev group + sync --prod, optional group -G http	pass (VEX omits the not-installed package)
VEX on hosted lock before reinstall (stale install)	pass (not_applied omitted)
vendored 2.29.2: scan, sync --clean, install --frozen-lockfile, lock --check, idempotent re-scan, rollback byte-exact	pass
takeover vendored→hosted	refused redirect_pdm_refused (hosted direction is warn-only by design)
takeover hosted→vendored	fails pypi_pdm_source_already_exists, exit 1 (the same for uv/poetry; redirect_revert_supported has no pypi)
hosted relock pdm lock → re-scan → rollback	pass
hosted pdm add / lock --update-reuse → re-scan → rollback	fail #331

Ruled out / not filed

• Vendored lock-only checkout refused (vendor_fetch_unverifiable): by design (lock_inventory/pypi.rs:531).
• static_urls hosted rewrite emits {file, hash} rather than the {url, hash} shape the doc claims. PDM installs it fine, so this is at most a doc nit.
• The empty-venv hosted scan crawls the PATH interpreter (119 packages): documented fall-through.
• 2.22.4 / 2.25.9 are SKIP in results.json. That is a harness artifact on the doc's run, and the CI matrix covers them.

Housekeeping

• Probe branch bughunt/pdm/20260930-cache-symlink could not be deleted: the sandbox git proxy disconnects on ref-delete pushes (tried 5×). A maintainer should delete it. It only adds .github/workflows/bughunt-pdm.yml.
• The GitHub issue search API returns 0 results for every query in this sandbox, so dedup used a full REST listing of issues and PRs (308) grepped locally.

Next

1. PDM 1.x feature.install_cache (symlink/pth) with agent mode, on python.use_venv=true.
2. Hosted after pdm update urllib3 / pdm remove / pdm lock --refresh, plus the rollback invariants (sibling of Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331).
3. CRLF + pdm add rebase; pdm lock -L custom.lock with a later rename to pdm.lock.
4. Windows long-path and unicode project dirs for hosted and vendored (probe).
5. inherit_metadata multi-target lock (pdm lock --append --python) with a forked package vs a single version: refusal and VEX.

[github-actions[bot]]

[agent] 2026-09-30: PDM bug-hunt run

Tested: main f6b7fb9 (v4.0.0-33), release build of socket-patch-cli, plus the published PyPI socket-patch 4.0.0 for comparison. Linux only, with real PDM releases against a local mock of the authenticated patch API (batch, by-package, view, blob, package), which serves a real urllib3 1.26.18 wheel with a marker line appended to urllib3/response.py.

Filed / commented

• Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 (new): hosted rollback and remove <purl> fail permanently (exit 1, "the file drifted; re-run scan") once the patched package leaves pdm.lock through pdm remove, a transitive removal, or an upgrade to another version. The recommended re-scan (redirected: 0) never prunes the stale ledger edit. Reproduced 2/2 on 2.12.4, 2.20.1 and 2.29.2, plus 1.4.5 (commented). VEX correctly omits the package (redirect_unwired). Not covered by Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 / PR Fix PDM rollback leaving the patch after a re-scan (#331) #375.
• Handover to uv (entries/uv/…-from-pdm.md): the same flow fails with uv remove, possibly already covered by Hosted uv rollback and remove are stuck after any unrelated pyproject.toml edit or uv add, and the suggested re-scan doesn't fix it #379.

Re-triage

• Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 and Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332: main is unchanged since the last run (f6b7fb9), so no re-check was needed. Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 has fix PR Fix PDM rollback leaving the patch after a re-scan (#331) #375 (open, draft), which doesn't cover Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382's case.

Cells covered (Linux)

Cell	Result
hosted pdm remove → rollback / re-scan+rollback / remove <purl>, 2.12.4 / 2.20.1 / 2.29.2 / 1.4.5	fail #382
hosted, upgrade to urllib3 1.26.19 + pdm lock → re-scan → rollback, 2.20.1 / 2.29.2	fail #382
hosted, transitive removal (pdm remove requests), 2.29.2	fail #382
vendored 2.12.4 / 2.20.1: scan, fresh sync, install --frozen-lockfile, lock --check, idempotent re-scan, byte-exact rollback	pass
multi-target --append lock (1.26.18 for <3.10, 2.0.7 for >=3.10), 2.29.2 hosted	refused redirect_pdm_refused, lock unchanged (documented)
CRLF lock hosted → sync → pdm lock (re-renders LF) → re-scan → rollback, 2.29.2	pass (lands on the relocked registry lock)
PDM 1.4.5 lock_version 2 ([metadata.files]) hosted: rewrite, both warnings, pdm sync into __pypackages__ installs patched bytes, idempotent, byte-exact rollback	pass
VEX after the package left the lock	pass (omitted, redirect_unwired)

Ruled out / not filed

• The multi-target fork refusal is documented.
• The published 4.0.0 wheel doesn't produce a hosted redirect for a lock-only project against the mock (redirected: 0), so Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 can't be bisected against it. That's not a finding: it's a mock/route difference.
• PDM 1.x bootstrap needs the era pins from scripts/backtest-pdm.py:pins_for (pythonfinder 1.2.10 etc.). That's an environment issue, not a bug.

Housekeeping

• The old probe branch bughunt/pdm/20260930-cache-symlink still can't be deleted: git push --delete gets "remote end hung up" from the sandbox proxy again. A maintainer should delete it. For that reason I didn't create a new probe branch this run, and Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 is platform-independent logic anyway.

Next

1. pdm update --unconstrained / pdm lock --update-all on hosted (does it keep the url, like --update-reuse in Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331?).
2. PDM 1.x feature.install_cache with agent mode (sibling of Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332); 1.4.5 now bootstraps with the backtest pins.
3. Hosted with a private [[tool.pdm.source]] index and respect-source-order; pdm export of a hosted lock.
4. Windows long-path / unicode dirs (probe, once branch deletion works).
5. Re-triage Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 when PR Fix PDM rollback leaving the patch after a re-scan (#331) #375 merges; Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332.

[github-actions[bot]]

[agent] 2026-10-01: PDM bug-hunt run

Tested: main 2463257 (#277, "consolidate the v5 patching workflow"; latest tag v4.0.0), release build, plus a build of f6b7fb9 (v4) to bisect. Linux only. Real PDM 2.12.4 / 2.20.1 / 2.29.2 against a local mock of the v5 patch API (batch, by-package, package grant, view, hosted wheel), with SOCKET_PATCH_SERVER_URL set to the mock origin. Hosted rollback in v5 re-derives files from PyPI's JSON API. The Rust client can't reach pypi.org through the sandbox proxy, so SOCKET_PYPI_JSON_API pointed at a local pass-through to pypi.org.

Filed / closed

• Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 (new): hosted rollback and remove rewrite a private-index static_urls lock's file URLs to files.pythonhosted.org. PDM 2.20/2.29 then bypass the mirror (0 mirror hits), and PDM 2.12.4 fails pdm sync on a mirror-only network. The uv and Pipenv restores refuse a non-PyPI index; restore_pdm doesn't check. First bad commit is 2463257; v4 f6b7fb9 round-trips byte-exactly.
• Hosted PDM rollback reports success but leaves the patch url/hash in pdm.lock after pdm add or pdm lock --update-reuse and a re-scan #331 closed (fixed by v5 prerelease: scan → vex → vendor workflow, hosted by default #277): pdm add / --update-reuse → re-scan → rollback leaves 0 patch refs, and pdm sync / lock --check pass (2.12.4, 2.20.1, 2.29.2).
• Hosted PDM rollback and remove fail permanently once the patched package leaves pdm.lock (pdm remove, or an upgrade to another version), and the suggested re-scan doesn't help #382 closed (fixed by v5 prerelease: scan → vex → vendor workflow, hosted by default #277): with no v5 ledger there's no stale state. After pdm remove or an upgrade, rollback / remove exit 1 with Manifest not found, the documented truly-empty project result.

Cells covered (Linux)

Cell	Result
hosted 2.29.2 lock-only: scan → pdm sync (patched bytes) → idempotent re-scan → manifest-less rollback (byte-exact)	pass
hosted #331 flows, 2.12.4 / 2.20.1 / 2.29.2	pass (fixed)
hosted #382 flows (remove, upgrade), 2.12.4 / 2.20.1 / 2.29.2	pass (documented exit 1)
hosted private index + static_urls, rollback / remove, 2.12.4 / 2.20.1 / 2.29.2	fail #413
hosted pyyaml (binary wheels), 2.29.2 default inherit_metadata: rollback	refused (documented in CLI_CONTRACT)
hosted pyyaml, 2.12.4 cross_platform: rollback	success, but writes all 51 PyPI files where PDM had locked 39 (it drops the cp36/cp37 wheels by requires-python). Installs fine. Cosmetic, not filed.
VEX manifest-less, 2.29.2: stale install omitted (not_applied); after pdm sync attests; lock-only attests	pass

Ruled out / not filed

• The 2.29 default-strategy rollback refusal for non-universal releases is documented ("a pdm.lock without cross_platform …").
• The cross_platform file-superset restore: pdm sync and lock --check are unaffected, so it isn't a functional break. It's noted under Known non-bugs.

Housekeeping

• git push --delete of the stale probe branch bughunt/pdm/20260930-cache-symlink was denied by the session's permission classifier this run. A maintainer should delete it. No new probe branches were created, since they couldn't be cleaned up.

Next

1. Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 re-triage on v5 (agent mode, install.cache symlink, PDM 2.0–2.12).
2. Vendored mode on v5 (vendored_backend): 2.29.2 / 2.12.4 / 1.4.5, plus private index + static_urls (does vendored rollback keep the mirror URLs?).
3. Hosted on lock_version 2 (PDM 0.12 / 1.4.5) through the v5 upstream restore ([metadata.files] full-release assumption).
4. Hosted → vendored takeover on v5 (now through the upstream restore).
5. A non-static_urls private index serving different bytes for the same name and version (the hash variant of Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413).

[github-actions[bot]]

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major PDM version and on Linux, macOS and Windows.

Where PDM puts global installs: pdm -g global project (~/.pdm/global-project, or ~/.local/share/pdm/global-project) plus the global interpreter's site-packages. Check that -g doesn't patch PDM's shared install cache (see #332).

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed PDM package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a PDM project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × PDM version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

[github-actions[bot]]

[agent] 2026-10-01: PDM bug-hunt run

Tested: main 2463257 (#277, v5 consolidation; latest tag v4.0.0, unchanged since the last run), release build. Linux only, real PDM 2.12.4 and 2.29.2. Global-mode discovery was checked with a logging mock of POST /patch/batch (SOCKET_PROXY_URL), which records every PURL the CLI queries. #332 was re-checked with the issue's own probe.py (a v4-shaped mock, which v5 agent mode still accepts).

Filed / commented

• Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 (new): scan -g never crawls PDM's global locations: the global-project venv that pdm use -g creates (<config>/pdm/global-project/.venv), and PDM-managed interpreters (<data>/pdm/python/cpython@X/…/site-packages, which pdm add -g uses directly on 2.12). It exits 0 and the packages are never queried. --global-prefix <site-packages> finds them.
• Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 commented: it still reproduces on v5 2463257. With PDM 2.12.4 symlink cache, both the PDM cache and a never-scanned project get the patch (2/2 runs); the 2.29.2 control is OK.

Cells covered (Linux)

Cell	Result
scan -g report, PDM 2.29.2 / 2.12.4 default global (system interpreter → /usr/local/lib/python3.11/dist-packages)	pass
scan -g, 2.29.2 pdm use -g → global-project/.venv	fail #451
scan -g, PDM-managed cpython@3.12 (2.29.2 pdm python install; 2.12.4 pdm use -g without a venv)	fail #451
scan -g run from inside the global project dir	fail (same as #451)
--global-prefix <dir> on both locations	pass (finds them)
SOCKET_GLOBAL=1 parity with -g	pass
scan -g --mode hosted, --global-prefix … --mode hosted	pass (exit 2, loud refusal, nothing written)
#332 agent mode + install.cache symlink, 2.12.4 / 2.29.2 on v5	fail #332 / pass

Ruled out / not filed

• scan -g --mode vendored is accepted (exit 0, crawls 108 global packages, nothing to vendor), while hosted refuses. It isn't PDM-specific and isn't documented either way, so I didn't file it. A sibling or maintainer may want to decide whether vendored should refuse like hosted.
• The first pdm add -g without pdm use -g uses the system interpreter, and that is found. Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 is limited to pdm use -g / pdm python install setups.

Housekeeping

• git push origin --delete bughunt/pdm/20260930-cache-symlink fails again ("unexpected disconnect while reading sideband packet"). The git proxy appears to reject ref deletion. A maintainer still needs to delete that branch. I created no new probe branches, so macOS and Windows weren't covered.
• Side effect: the sandbox's first pdm add -g installed pip/setuptools/wheel/six/packaging into the container's system interpreter (ephemeral container, no impact on the repo).

Next

1. Global mode, rest of the maintainer checklist: scan -g --mode agent / apply -g / rollback -g / vex -g against a real global install (needs a v5-shaped mock serving a patch for a package in /usr/local/.../dist-packages and in global-project/.venv via --global-prefix). Also check that -g never writes into PDM's install cache (a Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 variant: global project with install.cache=true).
2. Global mode on PDM 1.4.5 / 2.0.3 (where does -g install? PEP 582 __pypackages__ in the global project?), and with venv.in_project=false (<data>/pdm/venvs/global-project-*).
3. Vendored on v5 (vendored_backend): 2.29.2 / 2.12.4 / 1.4.5, incl. private index + static_urls.
4. Hosted lock_version 2 (0.12, 1.4.5) through the v5 upstream restore.
5. macOS / Windows probes for Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 and the global checklist, once branch deletion works.

[github-actions[bot]]

[agent] 2026-10-01: PDM bug-hunt run

Tested: main 6e7ef74 (4 commits since 2463257: npm, poetry and maven fixes; none touch PDM code; latest tag v4.0.0), release build. Linux only. Real PDM 1.4.5 / 2.12.4 / 2.29.2 against a local mock of the patch API (batch, by-package, view, blob, package grant plus the patched-wheel download, with SOCKET_PATCH_SERVER_URL set to the mock). Hosted restores used SOCKET_PYPI_JSON_API pointed at a local pass-through to pypi.org.

Filed / commented

• After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477 (new): after a hosted or vendored rollback, pdm sync, pdm install and pdm install --frozen-lockfile keep the patched build installed (All complete! 0/0; direct_url.json still points at the patch server, or at the deleted .socket/vendor wheel). Rollback's note says the bytes stay "until the next package-manager install", which is false on PDM. Only pdm sync --reinstall restores upstream. Reproduced on 1.4.5, 2.12.4 and 2.29.2, vendored and hosted.
• Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 commented: global mode hits it too. With PDM 2.12.4 install.cache + symlink, pdm add -g links the global interpreter's urllib3 directory into the cache. scan -g --mode agent then patches PDM's cache and, through it, a never-scanned project (2/2 runs). rollback -g un-patches both. The 2.29.2 control is clean.
• scan/get --json drop the agent-mode apply failure: exit 1 with failed: 0, the patch shown as "added", and no error anywhere (e.g. a read-only global ~/.m2) #424 commented (Maven-labelled, generic): the same scan --json agent-apply failure drop reproduces for PyPI. A root-owned --global-prefix, run as uid 65534, gives exit 1 with failed: 0 and no error, while apply --json gives apply_failed / "Permission denied".

Re-triage

• Global scan (-g) never crawls PDM's global project venv or PDM-managed interpreters, so pdm add -g packages are silently left out with exit 0 #451 still reproduces on 6e7ef74: scan -g with a 2.29.2 pdm use -g venv crawls 15 packages and finds 0 patches. Unchanged code, so no comment.
• Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413 and Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332: no PDM-relevant change on main. Agent mode writes the patch into PDM's shared install cache when PDM 2.0–2.12 installs packages as directory symlinks (install.cache + symlink) #332 was re-confirmed via -g (above).

Cells covered (Linux)

Cell	Result
-g agent, 2.29.2 default global (system dist-packages): scan -g --mode agent, apply -g idempotent, vex -g --product, rollback -g byte-exact; mode-less scan -g report-only	pass
-g agent, 2.12.4 install.cache symlink global	fail #332
--global-prefix <global-project/.venv site-packages> agent apply → import sees the patch → vex → rollback byte-exact, 2.29.2 with install.cache symlink (per-file links, cache pristine)	pass
--global-prefix with a space + unicode path, apply / rollback	pass
Unwritable global prefix (non-root user): exit 1, file untouched; apply reports clearly; scan --json drops the reason	fail #424 (JSON only)
vendored v5 2.29.2: scan → warm pdm sync installs the patch → lock --check → fresh install --frozen-lockfile → idempotent re-scan → vex → rollback byte-exact	pass
vendored v5 2.12.4: scan → warm sync / install patched → vex	pass
rollback (vendored + hosted) → pdm sync / install --frozen-lockfile, 2.29.2 / 2.12.4 / 1.4.5	fail #477
hosted lock_version 2 (1.4.5, [metadata.files]) via the v5 upstream restore: rewrite + both legacy warnings, pdm sync into __pypackages__ patched, idempotent, rollback byte-exact	pass

Ruled out / not filed

• Rollback deletes the manifest entry, so a later apply has nothing to do. That's documented (usage.md: rollback "remove[s] their local state").
• A mode-less scan (not -g) defaults to hosted and rewrites the lock. That's documented. My own run tripped on it mid-test; the affected observation was discarded and redone.
• vex needs --product outside a packaged project (documented error).

Housekeeping

• git push origin --delete bughunt/pdm/20260930-cache-symlink still fails ("remote end hung up"). A maintainer needs to delete it. I created no new probe branches, so macOS and Windows weren't covered.
• Side effect: pdm add -g / pdm remove -g against the container's system interpreter also synced away unrelated packages in /usr/local/lib/python3.11/dist-packages (ephemeral container, so no repo impact).

Next

1. Global -g on PDM 1.4.5 / 2.0.3 (where does -g install: __pypackages__ in the global project?), and venv.in_project=false global venvs (<data>/pdm/venvs/global-project-*).
2. After a hosted or vendored PDM rollback, pdm sync / pdm install keep the patched build installed, though rollback says the next install restores it #477 siblings: remove <purl> and rollback --preserve-state on PDM; agent → vendored takeover on v5.
3. Vendored v5 with a private index + static_urls (does vendored rollback keep the mirror URLs, unlike Hosted PDM rollback and remove replace a private index's static_urls with files.pythonhosted.org, so PDM bypasses the mirror (or fails on 2.12 behind a firewall) #413?).
4. pdm update --unconstrained / lock --update-all on hosted; groups / dev-dependencies via pdm sync -G.
5. macOS / Windows probes, once branch deletion works.