diff --git a/‎crates/socket-patch-cli/CLI_CONTRACT.md‎
Lines changed: 1 addition & 1 deletion b/‎crates/socket-patch-cli/CLI_CONTRACT.md‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎crates/socket-patch-cli/tests/mode_migration_pypi.rs‎
Lines changed: 56 additions & 0 deletions b/‎crates/socket-patch-cli/tests/mode_migration_pypi.rs‎
Lines changed: 56 additions & 0 deletions
diff --git a/‎crates/socket-patch-core/src/patch/redirect/upstream/pypi.rs‎
Lines changed: 198 additions & 4 deletions b/‎crates/socket-patch-core/src/patch/redirect/upstream/pypi.rs‎
Lines changed: 198 additions & 4 deletions
@@ -917,7 +917,7 @@ v5.0 replaces v4's per-purl reverts and whole-ledger reverse replay (`revert_rem
   * **vlt** — `vlt-lock.json`: slot [2] from the registry's `dist.integrity`, slot [3] per the lock's own convention (see the vlt hosted-mode contract); every hosted instance of the pin together.
   * **cargo** — `Cargo.lock` back on crates.io (source + the sparse index's checksum, `SOCKET_CRATES_INDEX`); every `Cargo.toml` declaration loses its `registry = "socket-patch-<uuid>"` pin (the shorthand the rewriter produced collapses back); the unreferenced `[registries.socket-patch-<uuid>]` block leaves the project cargo config. A declaration it cannot unpin refuses.
   * **golang** — the hosted `replace` and the socket module's go.sum lines go; the upstream module's two go.sum lines come back, hashed from the module proxy (`SOCKET_GOPROXY`, else `GOPROXY` / `GONOPROXY` / `GOPRIVATE` as go reads them) and cross-checked against the checksum database (`SOCKET_GOSUMDB_URL`, else `sum.golang.org` unless `GOSUMDB=off` / `GONOSUMDB` / `GOPRIVATE` say go would not ask it). A `replace` the user had before the hosted run is not recorded anywhere, so the restore lands on the plain upstream module.
-  * **pypi** — `Pipfile.lock`, `requirements.txt` (+ in-root `-r` includes), Hatch PEP 508 direct references (`pyproject.toml` / `hatch.toml`), `poetry.lock`, `pdm.lock`, `uv.lock`, PEP 723 script locks and PEP 751 `pylock*.toml` (+ the paired `pyproject.toml` / script metadata): hashes re-derived from PyPI's JSON API (`SOCKET_PYPI_JSON_API`). Refused: a `pdm.lock` without `cross_platform`, or a uv / script / pylock lock, whose release has a wheel that is not pure Python 3 (which files the lock keeps is not re-derivable); a uv lock whose options filter files (`exclude-newer`, `no-binary`, `no-build`), or whose other registry packages name no registry, several, or one other than PyPI's simple index; a pylock whose other registry packages show neither an `index` nor (as `uv pip compile` writes them) only PyPI files with none, which restores the entry without an `index` too; uv 0.2 `[[distribution]]` locks. Restored artifact fields keep the spelling the lock's other entries show, including the `upload_time` that uv 0.6.15–0.6.17 write. A restored pylock entry's `upload-time`s are whole seconds, as uv writes them, unless the lock's other entries show fractions. Its artifacts come back in the TOML spelling the other entries use: uv's inline `wheels = [{ … }]`, or the standard tables `pip lock` writes (`[[packages.wheels]]` with a `[packages.wheels.hashes]` sub-table, `[packages.sdist]`). A `pip lock` file (`created-by = "pip"`) records only the artifact pip selected, so the entry is restored with only the release's wheel (its sdist when it has none), and a release with several wheels is refused. A transitive `override-dependencies` entry hosted mode added is removed (`upstream_uv_override_removed`).
+  * **pypi** — `Pipfile.lock`, `requirements.txt` (+ in-root `-r` includes), Hatch PEP 508 direct references (`pyproject.toml` / `hatch.toml`), `poetry.lock`, `pdm.lock`, `uv.lock`, PEP 723 script locks and PEP 751 `pylock*.toml` (+ the paired `pyproject.toml` / script metadata): hashes re-derived from PyPI's JSON API (`SOCKET_PYPI_JSON_API`). A restored `requirements.txt` line gets `--hash` options only when the file is in pip's hash-checking mode. The mode is read off the file's other requirement lines (an `-e` / `--editable` line means unhashed). When every requirement is a hosted pin, it is read off the hosted line itself (`--hash` vs a `#sha256=` url fragment) (#410). Refused: a `pdm.lock` without `cross_platform`, or a uv / script / pylock lock, whose release has a wheel that is not pure Python 3 (which files the lock keeps is not re-derivable); a uv lock whose options filter files (`exclude-newer`, `no-binary`, `no-build`), or whose other registry packages name no registry, several, or one other than PyPI's simple index; a pylock whose other registry packages show neither an `index` nor (as `uv pip compile` writes them) only PyPI files with none, which restores the entry without an `index` too; uv 0.2 `[[distribution]]` locks. Restored artifact fields keep the spelling the lock's other entries show, including the `upload_time` that uv 0.6.15–0.6.17 write. A restored pylock entry's `upload-time`s are whole seconds, as uv writes them, unless the lock's other entries show fractions. Its artifacts come back in the TOML spelling the other entries use: uv's inline `wheels = [{ … }]`, or the standard tables `pip lock` writes (`[[packages.wheels]]` with a `[packages.wheels.hashes]` sub-table, `[packages.sdist]`). A `pip lock` file (`created-by = "pip"`) records only the artifact pip selected, so the entry is restored with only the release's wheel (its sdist when it has none), and a release with several wheels is refused. A transitive `override-dependencies` entry hosted mode added is removed (`upstream_uv_override_removed`).
   * **gem** — `Gemfile.lock` / `gems.locked` + `Gemfile` / `gems.rb`: the spec moves back into the upstream `GEM` section (or the Socket remote leaves a merged section), the `source "<patch registry>" do … end` block is undone, the `CHECKSUMS` entry is re-pinned from the rubygems.org compact index (`SOCKET_RUBYGEMS_URL`) and the `DEPENDENCIES` pin loses its `!`. The declaration's original constraint is not recorded, so it comes back as the exact pin `gem "<name>", "<version>"`. A transitive gem (one the manifest never declared) gets an appended block with a blank line before it; the restore removes that block, its blank line and the `DEPENDENCIES` entry, so the pair comes back byte for byte. An appended block with no blank line before it (written by a release before this one) can't be told apart from an in-place rewrite, so it still comes back as the exact pin. Refused: an ambiguous upstream section, an upstream remote other than rubygems.org.
   * **composer** — `composer.lock`: `dist` and the deleted `source` block from packagist's composer v2 metadata (`SOCKET_PACKAGIST_URL`). Refused unless the entry is packagist-sourced and packagist still serves the lock's `dist.reference` for the version.
   * **maven** — `pom.xml` (the `-socket.<hex8>` version suffix, the added `<repository>` / `<dependencyManagement>` entry) and the `.mvn/maven.config` / `.mvn/checksums/checksums.sha256` lines hosted mode writes: **no network**, so it restores under `--offline` too. `.mvn` files holding anything else keep the resolver lines (`maven_trusted_checksums_left`).
 
@@ -397,6 +397,62 @@ async fn requirements_sole_pin_vendored_to_hosted() {
     assert_vendored_to_hosted(&root, &["requirements.txt"]).await;
 }
 
+/// #410: a requirements.txt in which every requirement is the hosted pin
+/// (a lone `six==1.16.0`, or one beside `-e .`) can be unwound again.
+/// Hosted `rollback`, `remove` and the hosted → vendored takeover restore
+/// the pin to its unhashed registry spelling. Before the fix they all
+/// refused: no other line said whether the original used `--hash`.
+async fn assert_all_hosted_requirements_unwind(pristine: &str) {
+    let server = MockServer::start().await;
+    let hosted_url = mount_hosted_api(&server, true).await;
+    let uri = server.uri();
+    for unwind in [
+        vec!["rollback", "--yes", "--offline"],
+        vec!["remove", PURL, "--yes", "--offline"],
+        // The fixture server builds the vendored wheel.
+        vec!["vendor"],
+    ] {
+        let (_tmp, root) = project();
+        std::fs::write(root.join("requirements.txt"), pristine).unwrap();
+        let (code, env) = hosted_scan(&root, &server);
+        assert_eq!(code, 0, "hosted scan: {env:#}");
+        assert_eq!(env["redirect"]["redirected"], 1, "{env:#}");
+        let wired = std::fs::read_to_string(root.join("requirements.txt")).unwrap();
+        assert!(wired.contains(&hosted_url), "hosted first:\n{wired}");
+
+        if unwind[0] == "vendor" {
+            stage_manifest(&root);
+            // `--patch-server-url` (which names the hosted origin to take
+            // over) also moves the vendored download onto this server.
+            prebuilt_common::mount_project(&server, &root).await;
+        }
+        let mut args = unwind.clone();
+        args.extend(["--patch-server-url", uri.as_str()]);
+        let (code, env) = run_cli(&root, &args, &[]);
+        assert_eq!(code, 0, "{unwind:?} over {pristine:?}: {env:#}");
+        let after = std::fs::read_to_string(root.join("requirements.txt")).unwrap();
+        if unwind[0] == "vendor" {
+            assert!(
+                after.contains(&format!(".socket/vendor/pypi/{UUID}/"))
+                    && !after.contains(&hosted_url),
+                "the takeover leaves the project vendored:\n{after}"
+            );
+        } else {
+            assert_eq!(after, pristine, "{unwind:?} restores the pristine file");
+        }
+    }
+}
+
+#[tokio::test]
+async fn requirements_sole_hosted_pin_unwinds() {
+    assert_all_hosted_requirements_unwind("six==1.16.0\n").await;
+}
+
+#[tokio::test]
+async fn requirements_editable_beside_hosted_pin_unwinds() {
+    assert_all_hosted_requirements_unwind("-e .\nsix==1.16.0\n").await;
+}
+
 /// A Poetry project; returns its wiring files.
 fn stage_poetry(root: &Path) -> &'static [&'static str] {
     std::fs::write(
 
@@ -443,6 +443,17 @@ fn has_hash_option(tokens: &[&str]) -> bool {
         .any(|t| *t == "--hash" || t.starts_with("--hash="))
 }
 
+/// Whether a requirements line is an editable (`-e <path>`, `-e<path>`,
+/// `--editable <path>`, `--editable=<path>`), which pip refuses in
+/// hash-checking mode.
+fn is_editable(tokens: &[&str]) -> bool {
+    tokens.first().is_some_and(|t| {
+        (t.starts_with("-e") && !t.starts_with("--"))
+            || *t == "--editable"
+            || t.starts_with("--editable=")
+    })
+}
+
 /// A hosted requirement line, cut into what its registry spelling keeps.
 struct HostedLine {
     uuid: String,
@@ -454,6 +465,10 @@ struct HostedLine {
     marker: String,
     options: String,
     comment: String,
+    /// The hosted line carries `--hash`: the requirements rewriter writes
+    /// it only into a file already in pip's hash-checking mode (#376),
+    /// else it pins by the url's `#sha256=` fragment.
+    hashed: bool,
 }
 
 /// The in-scope hosted line `requirement` is, if any: `Err((uuid, why))`
@@ -489,6 +504,7 @@ fn hosted_line(
     let tokens = requirement_tokens(body);
     let marker_len = tokens.iter().take_while(|t| !t.starts_with("--")).count();
     let marker = tokens[..marker_len].join(" ");
+    let hashed = has_hash_option(&tokens[marker_len..]);
     let mut options = Vec::new();
     let mut rest_tokens = tokens[marker_len..].iter();
     while let Some(token) = rest_tokens.next() {
@@ -517,6 +533,7 @@ fn hosted_line(
         marker,
         options: options.join(" "),
         comment: comment.trim().to_string(),
+        hashed,
     }))
 }
 
@@ -562,6 +579,12 @@ pub(crate) async fn restore_requirements(
             if tokens.contains(&"--require-hashes") {
                 require_hashes = true;
             }
+            // pip refuses an editable in hash-checking mode, so one settles
+            // the file as unhashed (#410).
+            if is_editable(&tokens) {
+                unhashed += 1;
+                continue;
+            }
             if code.starts_with('-') {
                 continue;
             }
@@ -597,10 +620,10 @@ pub(crate) async fn restore_requirements(
                 "{rel} mixes hashed and unhashed requirements, so whether the original line \
                  carried `--hash` options is not derivable"
             )),
-            (false, false) => Err(format!(
-                "every requirement in {rel} is a hosted pin, so whether the original used pip's \
-                 hash-checking mode (`--hash`) is not derivable"
-            )),
+            // Every requirement is a hosted pin (#410): nothing else in the
+            // file can conflict with either form, so follow the hosted lines'
+            // own shape, which records the mode the rewrite found.
+            (false, false) => Ok(hits.iter().any(|(_, line)| line.hashed)),
         };
         let hash_mode = match hash_mode {
             Ok(mode) => mode,
@@ -993,4 +1016,175 @@ mod tests {
         assert_eq!(multiline_toml_array(&[]), "[]");
         assert_eq!(toml_quote("a\"b\\"), "\"a\\\"b\\\\\"");
     }
+
+    // ── requirements.txt: pip's hash-checking mode (#410) ──────────────────
+
+    use super::super::{restore_upstream, HostedPin, PinStatus, RestoreOptions, RestoreOutcome};
+    use wiremock::matchers::{method, path};
+    use wiremock::{Mock, MockServer, ResponseTemplate};
+
+    const SIX_UUID: &str = "41041041-0410-4410-8410-410410410410";
+    const SIX_PATCHED: &str = "1111111111111111111111111111111111111111111111111111111111111111";
+    const SIX_WHEEL: &str = "2222222222222222222222222222222222222222222222222222222222222222";
+    const SIX_SDIST: &str = "3333333333333333333333333333333333333333333333333333333333333333";
+
+    fn six_url() -> String {
+        format!(
+            "https://patch.socket.dev/patch-registry/pypi/11111111-1111-1111-1111-111111111111/{SIX_UUID}/six-1.16.0-py2.py3-none-any.whl"
+        )
+    }
+
+    /// The hosted line the requirements rewriter writes for six into an
+    /// unhashed file (url `#sha256=` fragment, no `--hash` option).
+    fn fragment_line() -> String {
+        format!("six @ {}#sha256={SIX_PATCHED}", six_url())
+    }
+
+    /// The hosted line it writes into a hashed file (and that every pre-#383
+    /// v5 rewrite wrote, whatever the file's mode).
+    fn hashed_line() -> String {
+        format!("six @ {} --hash=sha256:{SIX_PATCHED}", six_url())
+    }
+
+    async fn pypi_json() -> MockServer {
+        let server = MockServer::start().await;
+        Mock::given(method("GET"))
+            .and(path("/pypi/six/1.16.0/json"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                "urls": [
+                    { "filename": "six-1.16.0-py2.py3-none-any.whl",
+                      "url": "https://files.example/six-1.16.0-py2.py3-none-any.whl",
+                      "digests": { "sha256": SIX_WHEEL } },
+                    { "filename": "six-1.16.0.tar.gz",
+                      "url": "https://files.example/six-1.16.0.tar.gz",
+                      "digests": { "sha256": SIX_SDIST } },
+                ]
+            })))
+            .mount(&server)
+            .await;
+        server
+    }
+
+    /// Restore six's hosted pin in `requirements` (online against a mocked
+    /// PyPI JSON API); the outcome and the file afterwards.
+    async fn restore_six(requirements: &str) -> (RestoreOutcome, String) {
+        let server = pypi_json().await;
+        std::env::set_var("SOCKET_PYPI_JSON_API", format!("{}/pypi", server.uri()));
+        let tmp = tempfile::tempdir().unwrap();
+        std::fs::write(tmp.path().join("requirements.txt"), requirements).unwrap();
+        let pins = [HostedPin {
+            purl: "pkg:pypi/six@1.16.0".into(),
+            uuid: SIX_UUID.into(),
+            files: vec!["requirements.txt".into()],
+        }];
+        let outcome = restore_upstream(tmp.path(), &pins, &RestoreOptions::default()).await;
+        std::env::remove_var("SOCKET_PYPI_JSON_API");
+        let after = std::fs::read_to_string(tmp.path().join("requirements.txt")).unwrap();
+        (outcome, after)
+    }
+
+    fn assert_restored(outcome: &RestoreOutcome) {
+        assert_eq!(
+            outcome.pins[0].status,
+            PinStatus::Restored,
+            "{:?}",
+            outcome.pins
+        );
+    }
+
+    /// #410: a file whose only requirement is the hosted pin restores. The
+    /// hosted line's own shape records the original mode: a `#sha256=`
+    /// fragment means the file was unhashed.
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn requirements_with_only_a_hosted_pin_restores_unhashed() {
+        for eol in ["\n", "\r\n"] {
+            let (outcome, after) = restore_six(&format!("{}{eol}", fragment_line())).await;
+            assert_restored(&outcome);
+            assert_eq!(after, format!("six==1.16.0{eol}"));
+        }
+        // Comments, options and blank lines don't settle the mode either.
+        let (outcome, after) = restore_six(&format!(
+            "# pinned\n--index-url https://pypi.org/simple\n\n{} # via app\n",
+            fragment_line()
+        ))
+        .await;
+        assert_restored(&outcome);
+        assert_eq!(
+            after,
+            "# pinned\n--index-url https://pypi.org/simple\n\nsix==1.16.0 # via app\n"
+        );
+    }
+
+    /// #410: an all-hosted file whose hosted line carries `--hash` restores
+    /// in hash-checking mode, with every upstream release file's hash. With
+    /// no other requirement in the file there is nothing for it to conflict
+    /// with.
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn requirements_with_only_a_hashed_hosted_pin_restores_hashed() {
+        let (outcome, after) = restore_six(&format!("{}\n", hashed_line())).await;
+        assert_restored(&outcome);
+        assert_eq!(
+            after,
+            format!("six==1.16.0 --hash=sha256:{SIX_WHEEL} --hash=sha256:{SIX_SDIST}\n")
+        );
+    }
+
+    /// #410: pip refuses an editable requirement in hash-checking mode, so an
+    /// `-e` line settles the file as unhashed, even beside a hosted line
+    /// that carries `--hash` (the pre-#383 shape).
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn an_editable_line_settles_requirements_as_unhashed() {
+        for editable in ["-e .", "-e ./lib", "--editable .", "--editable=.", "-e."] {
+            for hosted in [fragment_line(), hashed_line()] {
+                let (outcome, after) = restore_six(&format!("{editable}\n{hosted}\n")).await;
+                assert_restored(&outcome);
+                assert_eq!(after, format!("{editable}\nsix==1.16.0\n"), "{hosted}");
+            }
+        }
+    }
+
+    /// Other requirement lines still decide, and genuinely mixed files are
+    /// still refused rather than guessed.
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn other_requirement_lines_still_settle_the_mode() {
+        let (outcome, after) = restore_six(&format!("idna==3.7\n{}\n", hashed_line())).await;
+        assert_restored(&outcome);
+        assert_eq!(after, "idna==3.7\nsix==1.16.0\n");
+
+        let hashed_idna = "idna==3.7 --hash=sha256:aaaa\n";
+        let (outcome, after) = restore_six(&format!("{hashed_idna}{}\n", fragment_line())).await;
+        assert_restored(&outcome);
+        assert_eq!(
+            after,
+            format!(
+                "{hashed_idna}six==1.16.0 --hash=sha256:{SIX_WHEEL} --hash=sha256:{SIX_SDIST}\n"
+            )
+        );
+
+        let mixed = format!(
+            "idna==3.7 --hash=sha256:aaaa\ncertifi==2024.2.2\n{}\n",
+            fragment_line()
+        );
+        let (outcome, after) = restore_six(&mixed).await;
+        assert!(
+            matches!(&outcome.pins[0].status, PinStatus::Refused(why) if why.contains("mixes hashed and unhashed")),
+            "{:?}",
+            outcome.pins
+        );
+        assert_eq!(after, mixed);
+
+        // `-e` beside `--require-hashes` is a file pip can't install at all.
+        let broken = format!("--require-hashes\n-e .\n{}\n", hashed_line());
+        let (outcome, after) = restore_six(&broken).await;
+        assert!(
+            matches!(&outcome.pins[0].status, PinStatus::Refused(_)),
+            "{:?}",
+            outcome.pins
+        );
+        assert_eq!(after, broken);
+    }
 }