SocketDev
diff --git a/‎crates/socket-patch-cli/src/args.rs‎
Lines changed: 5 additions & 2 deletions b/‎crates/socket-patch-cli/src/args.rs‎
Lines changed: 5 additions & 2 deletions
diff --git a/‎crates/socket-patch-cli/src/commands/apply.rs‎
Lines changed: 83 additions & 13 deletions b/‎crates/socket-patch-cli/src/commands/apply.rs‎
Lines changed: 83 additions & 13 deletions
diff --git a/‎crates/socket-patch-cli/src/commands/list.rs‎
Lines changed: 97 additions & 5 deletions b/‎crates/socket-patch-cli/src/commands/list.rs‎
Lines changed: 97 additions & 5 deletions
@@ -188,8 +188,11 @@ pub struct GlobalArgs {
     /// Override the host of the prebuilt-archive download URL the vendoring
     /// service returns. When set, the CLI rewrites the
     /// scheme + host (+ port) of the returned URL to this base, preserving the
-    /// path. Mainly for local-dev / testing, where the host the server bakes
-    /// into the URL is not the one to actually fetch from.
+    /// path. `vex` and `scan` also accept lockfile URLs on this origin as
+    /// hosted patch references (attested, and counted as live hosted wiring)
+    /// next to patch.socket.dev. Mainly for local-dev / testing, where the
+    /// host the server bakes into the URL is not the one to actually fetch
+    /// from.
     // A dev/testing knob: listed in `--help`, left out of the `-h` summary.
     #[arg(
         help_heading = GLOBAL_OPTIONS,
 
@@ -24,7 +24,9 @@ use std::time::Duration;
 use crate::args::{apply_env_toggles, GlobalArgs};
 use crate::commands::fetch_stage::{stage_patch_sources, StageOutcome, StagedSources};
 use crate::commands::lock_cli::acquire_or_emit;
-use crate::commands::vex::{generate_vex_from_manifest_path, VexEmbedArgs};
+use crate::commands::vex::{
+    generate_vex_from_manifest_path, generate_vex_without_manifest, ManifestlessVex, VexEmbedArgs,
+};
 use crate::ecosystem_dispatch::{find_all_packages_for_purls, partition_purls};
 use crate::json_envelope::{
     AppliedVia, Command, Envelope, EnvelopeError, PatchAction, PatchEvent, PatchEventFile,
@@ -791,18 +793,90 @@ pub async fn run(args: ApplyArgs) -> i32 {
         {
             return refuse_yarn_pnp(&args);
         }
+        // Nothing to apply — but `--vex` may still have something to
+        // attest: hosted / vendored patches are wired by the lockfiles (and
+        // the `.socket/vendor` ledgers), not the manifest, and a
+        // `scan --mode hosted|vendored` or depscan checkout (both modes are
+        // manifest-free) has none. Before, this branch returned before VEX
+        // generation, so `apply --vex` exited 0 having written NO document
+        // (and left a previous run's at the path). Nothing referenced
+        // anywhere keeps the historical calm exit 0 (a stale document is
+        // still removed); any other VEX failure flips the exit like the
+        // with-manifest path. A dry run applies nothing, so it skips
+        // generation (main-path parity), and so does `--check`: it is
+        // read-only, lock-free and offline-safe — it never crawls, fetches
+        // or writes — and the with-manifest path returns from it before any
+        // VEX work (an ambient `SOCKET_VEX` must not turn an audit job's
+        // `apply --check` into a VEX run).
+        // The host line first: the VEX run below prints its own warnings to
+        // stderr as it goes, and they read as part of the `--vex` side
+        // effect only after the command has said what it did.
+        if !args.common.json && !args.common.silent {
+            // Names the manifest, not the folder: hosted- and vendored-mode
+            // projects have a `.socket/` (their ledgers live under
+            // `.socket/vendor/`) and still nothing for `apply` to do.
+            println!("No patch manifest found; nothing to apply.");
+        }
+        let vex_result = if !args.common.dry_run && !args.check && args.vex.vex.is_some() {
+            let params = args.vex.to_build_params();
+            Some(generate_vex_without_manifest(&args.common, &params, &manifest_path).await)
+        } else {
+            None
+        };
+        let vex_path = || {
+            args.vex
+                .vex
+                .as_ref()
+                .expect("vex_result is Some only when --vex was given")
+        };
         if args.common.json {
             let mut env = Envelope::new(Command::Apply);
             env.status = Status::NoManifest;
             env.dry_run = args.common.dry_run;
+            match &vex_result {
+                Some(ManifestlessVex::Written(summary)) => {
+                    env.vex = Some(VexSummary {
+                        path: vex_path().display().to_string(),
+                        statements: summary.statements,
+                        format: "openvex-0.2.0".to_string(),
+                        warnings: summary.warnings.clone(),
+                    });
+                }
+                Some(ManifestlessVex::Failed(e)) => {
+                    // The discovery diagnostics and the omitted patches are
+                    // the only explanation of the failure (why a lockfile
+                    // mention is not live wiring, which gate refused what):
+                    // same channel as the success path's advisories.
+                    env.warnings.extend(e.embedded_warnings());
+                    env.mark_error(EnvelopeError::new(e.code, e.message.clone()));
+                }
+                Some(ManifestlessVex::NothingToAttest(warnings)) => {
+                    env.warnings.extend(warnings.iter().cloned());
+                }
+                None => {}
+            }
             println!("{}", env.to_pretty_json());
-        } else if !args.common.silent {
-            // Names the manifest, not the folder: hosted- and vendored-mode
-            // projects have a `.socket/` (their ledgers live under
-            // `.socket/vendor/`) and still nothing for `apply` to do.
-            println!("No patch manifest found; nothing to apply.");
+        } else {
+            match &vex_result {
+                Some(ManifestlessVex::Written(summary)) if !args.common.silent => println!(
+                    "{}",
+                    crate::commands::vex::format_vex_written(summary.statements, vex_path())
+                ),
+                // Errors print even under --silent (same as the main path).
+                Some(ManifestlessVex::Failed(e)) => e.print_embedded(&args.common),
+                Some(ManifestlessVex::NothingToAttest(_)) if !args.common.silent => {
+                    println!("{}", crate::commands::vex::format_vex_nothing_to_attest())
+                }
+                None if !args.common.silent && args.common.dry_run && args.vex.vex.is_some() => {
+                    println!(
+                        "{}",
+                        crate::commands::vex::format_vex_dry_run_skip("applied")
+                    );
+                }
+                _ => {}
+            }
         }
-        return 0;
+        return i32::from(matches!(vex_result, Some(ManifestlessVex::Failed(_))));
     }
 
     // Read-only Go `replace`-redirect verification for CI / GitHub-App auditing.
@@ -1094,6 +1168,7 @@ pub(crate) async fn run_locked(
                         });
                     }
                     Some(Err(e)) => {
+                        env.warnings.extend(e.embedded_warnings());
                         env.mark_error(EnvelopeError::new(e.code, e.message.clone()));
                     }
                     None => {}
@@ -1119,12 +1194,7 @@ pub(crate) async fn run_locked(
                             );
                         }
                     }
-                    Some(Err(e)) => {
-                        // Errors print even under --silent ("errors only",
-                        // never "nothing"): exit 1 with no message would be
-                        // undiagnosable.
-                        eprintln!("Error: VEX generation failed: {}", e.message);
-                    }
+                    Some(Err(e)) => e.print_embedded(&args.common),
                     None => {
                         // Only a dry run that itself succeeded skips VEX
                         // *because* of --dry-run; a failed one would have
 
@@ -36,6 +36,8 @@ enum Source {
     /// `scan`/`get --mode vendored` patch lives ONLY in
     /// `.socket/vendor/state.json`, as a `detached` entry's embedded record
     /// (the hosted rule again — a vendored-only project lists and exits 0).
+    /// A standalone `vendor` entry's fallback copy lists here too once no
+    /// manifest entry covers it — the checkout `vex` attests from it.
     Vendored,
 }
 
@@ -62,10 +64,14 @@ struct ListEntry<'a> {
 /// PURL, then manifest < hosted < vendored when one purl appears in more
 /// than one. The record maps (`HashMap` manifest and vendor ledger /
 /// `BTreeMap` redirect ledger) never impose an order shared consumers could
-/// diff, so the sort here is the contract. Only vendor entries that carry
-/// an embedded record fold in — a legacy manifest-tracked entry has no
-/// record of its own (the manifest's IS the record) and would otherwise
-/// double-list its purl.
+/// diff, so the sort here is the contract. Only vendor entries whose
+/// embedded record stands on its own fold in
+/// ([`crate::commands::vendor_record_is_unowned`], the rule `vex` attests
+/// by): a `detached` entry always (coexisting with a manifest entry is real
+/// state, shown labeled apart), a standalone `vendor` entry's fallback copy
+/// only when the manifest does not cover it — while it does, the manifest's
+/// record IS that entry's record and listing the copy would double-list the
+/// purl. A legacy entry with no embedded record never folds in.
 fn combined_entries<'a>(
     manifest: Option<&'a PatchManifest>,
     redirect: Option<&'a RedirectState>,
@@ -88,7 +94,10 @@ fn combined_entries<'a>(
     }
     if let Some(vendor) = vendor {
         entries.extend(vendor.iter().filter_map(|(purl, entry)| {
-            let record = entry.record.as_ref().filter(|_| entry.detached)?;
+            let record = entry
+                .record
+                .as_ref()
+                .filter(|_| crate::commands::vendor_record_is_unowned(purl, entry, manifest))?;
             Some(ListEntry {
                 purl,
                 record,
@@ -817,6 +826,89 @@ mod tests {
         assert_eq!(v["summary"]["discovered"], 2, "{v}");
     }
 
+    /// The ledger entry the manifest-driven standalone `vendor` writes: NOT
+    /// detached, with the record embedded as a fallback copy.
+    fn standalone_vendor_entry(base_purl: &str, record: PatchRecord) -> VendorEntry {
+        let mut entry = vendor_entry(base_purl, Some(record));
+        entry.detached = false;
+        entry
+    }
+
+    /// A standalone `vendor` entry's embedded fallback record lists exactly
+    /// when `vex` would attest from it — no manifest entry covers the entry
+    /// (by ledger key or base purl). With no manifest at all it lists
+    /// labeled `vendored`, so a manifest-less checkout never reads "no
+    /// patches" while its VEX document attests the patch; while the manifest
+    /// covers it, the manifest's record IS its record (no double listing).
+    #[test]
+    fn standalone_vendor_fallback_record_lists_only_when_the_manifest_does_not_cover_it() {
+        let manifest = sample_manifest();
+        let record = manifest.patches["pkg:npm/minimist@1.2.2"].clone();
+        let mut other = record.clone();
+        other.uuid = "55555555-5555-4555-8555-555555555555".to_string();
+        let mut vendor = HashMap::new();
+        // Covered by the manifest's exact key.
+        vendor.insert(
+            "pkg:npm/minimist@1.2.2".to_string(),
+            standalone_vendor_entry("pkg:npm/minimist@1.2.2", record.clone()),
+        );
+        // Covered through its base purl (a qualified ledger key).
+        vendor.insert(
+            "pkg:npm/minimist@1.2.2?variant=x".to_string(),
+            standalone_vendor_entry("pkg:npm/minimist@1.2.2", record.clone()),
+        );
+        // Dropped from the manifest while the ledger still holds it.
+        vendor.insert(
+            "pkg:npm/left-pad@1.3.0".to_string(),
+            standalone_vendor_entry("pkg:npm/left-pad@1.3.0", other),
+        );
+
+        let listed = |entries: &[ListEntry<'_>]| -> Vec<(String, String, String)> {
+            let env = build_list_envelope(entries);
+            let v: serde_json::Value = serde_json::from_str(&env.to_pretty_json()).unwrap();
+            v["events"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .map(|e| {
+                    (
+                        e["purl"].as_str().unwrap().to_string(),
+                        e["details"]["mode"]
+                            .as_str()
+                            .unwrap_or("manifest")
+                            .to_string(),
+                        e["uuid"].as_str().unwrap().to_string(),
+                    )
+                })
+                .collect()
+        };
+
+        assert_eq!(
+            listed(&combined_entries(Some(&manifest), None, Some(&vendor))),
+            vec![
+                (
+                    "pkg:npm/left-pad@1.3.0".to_string(),
+                    "vendored".to_string(),
+                    "55555555-5555-4555-8555-555555555555".to_string(),
+                ),
+                (
+                    "pkg:npm/minimist@1.2.2".to_string(),
+                    "manifest".to_string(),
+                    "11111111-1111-4111-8111-111111111111".to_string(),
+                ),
+            ],
+            "covered fallback copies stay behind the manifest record; the uncovered one lists"
+        );
+
+        // No manifest at all: every fallback copy stands on its own.
+        let only = listed(&combined_entries(None, None, Some(&vendor)));
+        assert_eq!(only.len(), 3, "{only:?}");
+        assert!(
+            only.iter().all(|(_, mode, _)| mode == "vendored"),
+            "{only:?}"
+        );
+    }
+
     #[test]
     fn ordering_is_deterministic_across_builds() {
         // Two independent builds of the same manifest must be byte-identical.