Merge remote-tracking branch 'origin/main' into agent/fix-bun-open-issues

# Conflicts:
#	crates/socket-patch-cli/CLI_CONTRACT.md
#	crates/socket-patch-core/src/vendor/bun_lock_text.rs

Author: mikolalysenko

.github/workflows/ci.yml

@@ -800,6 +800,19 @@ jobs:
       - name: Run npm dispatch tests
         run: node --test npm/socket-patch/bin/socket-patch.test.mjs
 
+      - name: Run npm schema tests
+        # The `./schema` export's zod tests. `npm install --no-save`, not
+        # `npm ci`, for the reason publish-npm.yml gives (a version-synced
+        # lock can name platform packages not yet on the registry); the
+        # platform binaries are optional and not needed here. The pack
+        # test runs again once `npm test` has built dist/, so it also
+        # checks that the compiled schema ships.
+        working-directory: npm/socket-patch
+        run: |
+          npm install --no-save --ignore-scripts --no-audit --no-fund --omit=optional
+          npm test
+          node --test --test-name-pattern="npm package contents" bin/socket-patch.test.mjs
+
   # Compiles the CLI and every CLI test target once per OS (--all-features,
   # so this is also the feature-gated suites' compile-rot check) and uploads
   # the binaries the e2e, e2e-full and cargo-vex legs run. The legs run the

crates/socket-patch-bench/src/fixtures/npm.rs

@@ -537,7 +537,17 @@ pub fn yarn_classic_lock(g: &Graph) -> String {
 
 pub fn build_yarn_classic(t: &mut Tree, size: Size) -> std::io::Result<Fixture> {
     let g = graph("yarn-classic", size);
-    t.write("project/package.json", g.package_json())?;
+    // Pin yarn 1 as a real classic project does: without the pin a hosted
+    // scan rightly warns `redirect_yarn_classic_berry_migration_risk`
+    // (#907), which the scenario would count as an unexpected warning.
+    t.write(
+        "project/package.json",
+        g.package_json().replacen(
+            "\"private\": true",
+            "\"private\": true,\n  \"packageManager\": \"yarn@1.22.22\"",
+            1,
+        ),
+    )?;
     t.write("project/yarn.lock", yarn_classic_lock(&g))?;
     t.write(
         "project/node_modules/.yarn-integrity",

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -1743,7 +1743,11 @@ type LockRefusals = HashMap<String, (&'static str, String)>;
 /// refusal and the ledger's idempotency skip, which take precedence in the
 /// fetch loop. A purl the lockfiles pin hosted is left to the vendor loop:
 /// its takeover restores the upstream lock entry first, and the restore
-/// rewrites the very text the gates read.
+/// rewrites the very text the gates read. The one exception is a hosted
+/// gem the takeover would refuse ([`gem_takeover_refusals_for`]), which
+/// is refused here with the takeover's code instead of after its fetch.
+///
+/// [`gem_takeover_refusals_for`]: crate::commands::vendor::gem_takeover_refusals_for
 ///
 /// Only a package the vendor loop would hand to its backend is refused
 /// here (see [`crate::commands::vendor::lock_refusals_reaching_backend`]):
@@ -1760,44 +1764,65 @@ async fn lock_text_refusals_for(
     prior: Option<&crate::ecosystem_dispatch::NpmCrawlSnapshot>,
 ) -> LockRefusals {
     let cwd = params.cwd.as_path();
-    let claimed: Vec<String> = socket_patch_core::patch::redirect::upstream::HostedPin::all(
+    let origins: Vec<String> = params
+        .patch_server_url
+        .iter()
+        .filter(|url| !url.trim().is_empty())
+        .cloned()
+        .collect();
+    let pins = socket_patch_core::patch::redirect::upstream::HostedPin::all(
         &socket_patch_core::vex::discover_patched_refs_with(
             cwd,
             &socket_patch_core::vex::DiscoverOptions {
-                patch_server_origins: params
-                    .patch_server_url
-                    .iter()
-                    .filter(|url| !url.trim().is_empty())
-                    .cloned()
-                    .collect(),
+                patch_server_origins: origins.clone(),
             },
         )
         .await,
-    )
-    .into_iter()
-    .map(|pin| canonical_purl(&pin.purl))
-    .collect();
-    let candidates: Vec<(&str, &str)> = selected
+    );
+    let claimed: Vec<String> = pins.iter().map(|pin| canonical_purl(&pin.purl)).collect();
+    let fetchable: Vec<&PatchSearchResult> = selected
         .iter()
         .filter(|sr| bun_refusal.filter(|r| r.applies_to(&sr.purl)).is_none())
         .filter(|sr| {
             detached_ledger_record(RecordStore::Ledger(&ledger.entries), &sr.purl, &sr.uuid)
                 .is_none()
         })
+        .collect();
+    let candidates: Vec<(&str, &str)> = fetchable
+        .iter()
         .filter(|sr| !claimed.contains(&canonical_purl(&sr.purl)))
         .map(|sr| (sr.purl.as_str(), sr.uuid.as_str()))
         .collect();
     let refused = socket_patch_core::vendor::lock_text_refusals(cwd, &candidates).await;
     let options = params.crawler_options();
-    crate::commands::vendor::lock_refusals_reaching_backend(
-        cwd,
-        refused,
-        &ledger.entries,
-        |purls| async move {
-            crate::commands::vendor::installed_purls(&options, &purls, prior).await
-        },
-    )
-    .await
+    let mut refusals =
+        crate::commands::vendor::lock_refusals_reaching_backend(
+            cwd,
+            refused,
+            &ledger.entries,
+            |purls| async move {
+                crate::commands::vendor::installed_purls(&options, &purls, prior).await
+            },
+        )
+        .await;
+    // A hosted gem the takeover will refuse (#775) is refused here too, so
+    // its view is never fetched for a package the run cannot vendor. The
+    // download phase only runs online (`--offline` refuses `get` and `scan`
+    // before it), so the dry-run restore may resolve the registry entry.
+    refusals.extend(
+        crate::commands::vendor::gem_takeover_refusals_for(
+            cwd,
+            fetchable
+                .iter()
+                .filter(|sr| claimed.contains(&canonical_purl(&sr.purl)))
+                .map(|sr| sr.purl.as_str()),
+            &pins,
+            false,
+            origins,
+        )
+        .await,
+    );
+    refusals
 }
 
 /// The record a detached ledger entry already carries for `purl` at
@@ -3759,7 +3784,12 @@ async fn run_get_vendored(
     // Dry run: ledger-classification preview only (scan's posture) — no
     // download, no vendor step, no writes.
     if args.common.dry_run {
-        let preview = super::scan::preview_vendor_json(&args.common.cwd, selected).await;
+        let takeover = super::vendor::gem_takeover_preview_refusals(
+            &args.common,
+            selected.iter().map(|p| p.purl.as_str()),
+        )
+        .await;
+        let preview = super::scan::preview_vendor_json(&args.common.cwd, selected, &takeover).await;
         if args.common.json {
             let mut result = serde_json::json!({
                 "status": "success",

crates/socket-patch-cli/src/commands/get.rs

@@ -603,6 +603,7 @@ pub async fn run(args: RemoveArgs) -> i32 {
             &manifest,
             &vendored_keys,
             InnerSelection::Identifier(Some(&args.identifier)),
+            &super::rollback::superseded_by_hosted(&manifest, &hosted_pins),
             Some(&telemetry_client),
         )
         .await