Issues

• Share one scoped env-var test guard: EnvGuard is copy-pasted 11 times across core unit and integration tests

  agent:claimedagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1889 · Filter by author mikolalysenko opened on Oct 30, 2026
  2

• Memoize env-keyed subprocess probes through one helper: composer, python and ruby each define the same env key and drifted on when an answer is kept

  agent:claimedagent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1888 · Filter by author mikolalysenko opened on Oct 30, 2026
  3

• Interpolate Maven ${...} properties through one formats::maven helper: five copies drifted on recursion, undefined names and the length cap

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1887 · Filter by author mikolalysenko opened on Oct 30, 2026
  1

• Decide: one hosted redirect JSON block for disk scan and the in-memory engine (today {mode, rewrittenFiles} vs a seven-key block)

  agent:needs-humanagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1881 · Filter by author mikolalysenko opened on Oct 30, 2026

• Render a patch's vulnerability labels through one ui helper: scan, get and list each write the CVE-else-advisory rule, and their order, dedup and severity case drifted

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1880 · Filter by author mikolalysenko opened on Oct 30, 2026

• Carry hosted stale-install and takeover warnings as RunWarning, not serde_json::Value round-tripped through run_warning_of

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1879 · Filter by author mikolalysenko opened on Oct 30, 2026

• Build the Pipenv stale-install remedy in one core helper: hosted scan and vendored pypi each write it, and the copies drifted

  agent:claimedagent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1878 · Filter by author mikolalysenko opened on Oct 30, 2026
  2

• Embed --vex through one helper: the step is hand-written 8 times, and only scan reports vex_skipped_dry_run under --json

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1877 · Filter by author mikolalysenko opened on Oct 30, 2026

• Vendored pip: a six==${SIXV} pin in requirements.txt (pip expands ${VAR} on every line) doesn't contest a pylock.toml wiring, so vendor --check passes and vex attests not_affected while pip install -r installs the unpatched release

  agent:claimedagent:triagedbugbughuntpm:pippriority:p1
  SocketDev/socket-patch#1873 · Filter by author mikolalysenko opened on Oct 30, 2026
  3

• Hosted npm scan doesn't warn about omit-lockfile-registry-resolved=true: the next plain npm install strips the hosted resolved URL but keeps the patched integrity, so every fresh npm ci then fails EINTEGRITY

  agent:claimedagent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#1871 · Filter by author mikolalysenko opened on Oct 30, 2026
  3

• api/client.rs downloads a served artifact through two near-copy GETs and hand-writes four retry loops under two retry policies

  agent:claimedagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1869 · Filter by author mikolalysenko opened on Oct 30, 2026
  2

• Use crate::test_rng::Rng in every randomized test: three more xorshift64* copies sit beside the module that claims to be the only one

  agent:claimedagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1868 · Filter by author mikolalysenko opened on Oct 30, 2026
  2

• Keep civil-date math in one utils::time module: days_from_civil is written twice and vex::time claims to be the only copy

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1867 · Filter by author mikolalysenko opened on Oct 30, 2026

• On a go 1.16 go.mod, Go apply, apply --check and vex trust a stale go.sum zip line left by a downgrade, so they report an inert replace as applied (or refuse a selected version)

  agent:claimedagent:triagedbugbughuntpm:gopriority:p2
  SocketDev/socket-patch#1862 · Filter by author mikolalysenko opened on Oct 29, 2026
  3

• remove and rollback each render VendorRevertStep in their own loop, and the loops drifted (remove --preserve-state --dry-run previews a full revert)

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1861 · Filter by author mikolalysenko opened on Oct 29, 2026

• Filter terminal-unsafe characters through one helper: list and the status printer keep bidi overrides and zero-width characters that core policy::strip_unsafe drops

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1860 · Filter by author mikolalysenko opened on Oct 29, 2026

• scan's nested-project remedy quotes paths POSIX-style on Windows: discovery.rs keeps its own drifted shell_word beside ui::shell_word

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1859 · Filter by author mikolalysenko opened on Oct 29, 2026
  1

• Acquire apply.lock through one lock_cli helper that takes &GlobalArgs; the sequence is open-coded 9 times and renders lock_held 3 ways

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1858 · Filter by author mikolalysenko opened on Oct 29, 2026

• Vendored pip: a pin in a -r include outside the project root is ignored when a pylock.toml exists, so vendor --check passes and vex attests not_affected while pip install -r requirements.txt installs the unpatched release

  agent:claimedagent:triagedbugbughuntpm:pippriority:p1
  SocketDev/socket-patch#1851 · Filter by author mikolalysenko opened on Oct 29, 2026
  3

• Vendored scan / get --dry-run on an already-vendored npm project says it "Would download and vendor N patches", while its own JSON and the wet run say there is nothing to do

  agent:claimedagent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#1850 · Filter by author mikolalysenko opened on Oct 29, 2026
  3

• Keep one URL credential stripper: utils::redact::strip_url_credentials is dead while VEX and upstream npm use vex::product's copy

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1848 · Filter by author mikolalysenko opened on Oct 29, 2026
  1

• Read "poetry.lock written before Poetry 1.4" through one helper; utils::poetry_lock::lock_writer_version is dead

  agent:claimedagent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1847 · Filter by author mikolalysenko opened on Oct 29, 2026
  3

• pnpm workspace membership refuses brace and class globs the shared matcher already reads, and hosted keeps a second reader for them

  agent:claimedagent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1846 · Filter by author mikolalysenko opened on Oct 29, 2026
  3

• Drive pdm.lock and poetry.lock rewrites through one lock_fragments driver instead of two mirrored triads

  agent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1844 · Filter by author mikolalysenko opened on Oct 29, 2026
  1

• Go apply, apply --check and vex still treat a replace-target module as built when the replaced fork is required only by a dependency (go 1.16 module), so the patch is attested while the build stays unpatched

  agent:claimedagent:triagedbugbughuntpm:gopriority:p2
  SocketDev/socket-patch#1840 · Filter by author mikolalysenko opened on Oct 29, 2026
  3