Merge origin/main into arch-fix/vex-false-attest

Resolve conflicts in vex/discover: keep main's same-lock contest
(#940) alongside this branch's unwired-copy unattestation, pnpm bundled
copies and berry registry-locator contest.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

.github/workflows/ci.yml

@@ -800,6 +800,19 @@ jobs:
       - name: Run npm dispatch tests
         run: node --test npm/socket-patch/bin/socket-patch.test.mjs
 
+      - name: Run npm schema tests
+        # The `./schema` export's zod tests. `npm install --no-save`, not
+        # `npm ci`, for the reason publish-npm.yml gives (a version-synced
+        # lock can name platform packages not yet on the registry); the
+        # platform binaries are optional and not needed here. The pack
+        # test runs again once `npm test` has built dist/, so it also
+        # checks that the compiled schema ships.
+        working-directory: npm/socket-patch
+        run: |
+          npm install --no-save --ignore-scripts --no-audit --no-fund --omit=optional
+          npm test
+          node --test --test-name-pattern="npm package contents" bin/socket-patch.test.mjs
+
   # Compiles the CLI and every CLI test target once per OS (--all-features,
   # so this is also the feature-gated suites' compile-rot check) and uploads
   # the binaries the e2e, e2e-full and cargo-vex legs run. The legs run the

crates/socket-patch-bench/src/fixtures/npm.rs

@@ -537,7 +537,17 @@ pub fn yarn_classic_lock(g: &Graph) -> String {
 
 pub fn build_yarn_classic(t: &mut Tree, size: Size) -> std::io::Result<Fixture> {
     let g = graph("yarn-classic", size);
-    t.write("project/package.json", g.package_json())?;
+    // Pin yarn 1 as a real classic project does: without the pin a hosted
+    // scan rightly warns `redirect_yarn_classic_berry_migration_risk`
+    // (#907), which the scenario would count as an unexpected warning.
+    t.write(
+        "project/package.json",
+        g.package_json().replacen(
+            "\"private\": true",
+            "\"private\": true,\n  \"packageManager\": \"yarn@1.22.22\"",
+            1,
+        ),
+    )?;
     t.write("project/yarn.lock", yarn_classic_lock(&g))?;
     t.write(
         "project/node_modules/.yarn-integrity",

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -1743,7 +1743,11 @@ type LockRefusals = HashMap<String, (&'static str, String)>;
 /// refusal and the ledger's idempotency skip, which take precedence in the
 /// fetch loop. A purl the lockfiles pin hosted is left to the vendor loop:
 /// its takeover restores the upstream lock entry first, and the restore
-/// rewrites the very text the gates read.
+/// rewrites the very text the gates read. The one exception is a hosted
+/// gem the takeover would refuse ([`gem_takeover_refusals_for`]), which
+/// is refused here with the takeover's code instead of after its fetch.
+///
+/// [`gem_takeover_refusals_for`]: crate::commands::vendor::gem_takeover_refusals_for
 ///
 /// Only a package the vendor loop would hand to its backend is refused
 /// here (see [`crate::commands::vendor::lock_refusals_reaching_backend`]):
@@ -1760,44 +1764,65 @@ async fn lock_text_refusals_for(
     prior: Option<&crate::ecosystem_dispatch::NpmCrawlSnapshot>,
 ) -> LockRefusals {
     let cwd = params.cwd.as_path();
-    let claimed: Vec<String> = socket_patch_core::patch::redirect::upstream::HostedPin::all(
+    let origins: Vec<String> = params
+        .patch_server_url
+        .iter()
+        .filter(|url| !url.trim().is_empty())
+        .cloned()
+        .collect();
+    let pins = socket_patch_core::patch::redirect::upstream::HostedPin::all(
         &socket_patch_core::vex::discover_patched_refs_with(
             cwd,
             &socket_patch_core::vex::DiscoverOptions {
-                patch_server_origins: params
-                    .patch_server_url
-                    .iter()
-                    .filter(|url| !url.trim().is_empty())
-                    .cloned()
-                    .collect(),
+                patch_server_origins: origins.clone(),
             },
         )
         .await,
-    )
-    .into_iter()
-    .map(|pin| canonical_purl(&pin.purl))
-    .collect();
-    let candidates: Vec<(&str, &str)> = selected
+    );
+    let claimed: Vec<String> = pins.iter().map(|pin| canonical_purl(&pin.purl)).collect();
+    let fetchable: Vec<&PatchSearchResult> = selected
         .iter()
         .filter(|sr| bun_refusal.filter(|r| r.applies_to(&sr.purl)).is_none())
         .filter(|sr| {
             detached_ledger_record(RecordStore::Ledger(&ledger.entries), &sr.purl, &sr.uuid)
                 .is_none()
         })
+        .collect();
+    let candidates: Vec<(&str, &str)> = fetchable
+        .iter()
         .filter(|sr| !claimed.contains(&canonical_purl(&sr.purl)))
         .map(|sr| (sr.purl.as_str(), sr.uuid.as_str()))
         .collect();
     let refused = socket_patch_core::vendor::lock_text_refusals(cwd, &candidates).await;
     let options = params.crawler_options();
-    crate::commands::vendor::lock_refusals_reaching_backend(
-        cwd,
-        refused,
-        &ledger.entries,
-        |purls| async move {
-            crate::commands::vendor::installed_purls(&options, &purls, prior).await
-        },
-    )
-    .await
+    let mut refusals =
+        crate::commands::vendor::lock_refusals_reaching_backend(
+            cwd,
+            refused,
+            &ledger.entries,
+            |purls| async move {
+                crate::commands::vendor::installed_purls(&options, &purls, prior).await
+            },
+        )
+        .await;
+    // A hosted gem the takeover will refuse (#775) is refused here too, so
+    // its view is never fetched for a package the run cannot vendor. The
+    // download phase only runs online (`--offline` refuses `get` and `scan`
+    // before it), so the dry-run restore may resolve the registry entry.
+    refusals.extend(
+        crate::commands::vendor::gem_takeover_refusals_for(
+            cwd,
+            fetchable
+                .iter()
+                .filter(|sr| claimed.contains(&canonical_purl(&sr.purl)))
+                .map(|sr| sr.purl.as_str()),
+            &pins,
+            false,
+            origins,
+        )
+        .await,
+    );
+    refusals
 }
 
 /// The record a detached ledger entry already carries for `purl` at
@@ -3759,7 +3784,12 @@ async fn run_get_vendored(
     // Dry run: ledger-classification preview only (scan's posture) — no
     // download, no vendor step, no writes.
     if args.common.dry_run {
-        let preview = super::scan::preview_vendor_json(&args.common.cwd, selected).await;
+        let takeover = super::vendor::gem_takeover_preview_refusals(
+            &args.common,
+            selected.iter().map(|p| p.purl.as_str()),
+        )
+        .await;
+        let preview = super::scan::preview_vendor_json(&args.common.cwd, selected, &takeover).await;
         if args.common.json {
             let mut result = serde_json::json!({
                 "status": "success",

crates/socket-patch-cli/src/commands/get.rs

@@ -137,8 +137,9 @@ fn refuse(
 }
 
 /// The apply lock for a WET hosted run: the same `<manifest dir>/apply.lock`
-/// `apply`/`rollback`/`remove`/`vendor` hold, so the takeover pre-reverts,
-/// the ledger merge and the lockfile writes never race them. `acquire`
+/// `apply`/`rollback`/`remove`/`vendor` hold, so the takeover pre-reverts
+/// (lockfiles + the vendored ledger) and the lockfile writes never race
+/// them. `acquire`
 /// creates a missing `.socket/` and the guard's drop unlinks the lock file
 /// and prunes an otherwise-empty `.socket/`, so a run that ends up writing
 /// nothing leaves no residue. Contention / IO failures render through the
@@ -299,11 +300,10 @@ async fn installed_stale_positive_evidence(
 ///   refuses as a write root is still READ here
 ///   (`verification_only_gem_paths`): bundler installs into it.
 /// * Records are found BY UUID (the fetch key, stable across purl
-///   spellings): this run's fetched records first, then the redirect
-///   ledger's persisted ones — a re-scan whose `/patches/view` fetch failed
-///   transiently still re-fires from the ledger instead of silently
-///   dropping the warning (`record_fetch_failed` covers the fetch failure
-///   itself). Record availability is part of the candidate filter, and the
+///   spellings) among this run's fetched records; v5 keeps no hosted
+///   ledger to fall back on, so a uuid whose `/patches/view` fetch failed
+///   is not judged (`record_fetch_failed` surfaces that failure). Record
+///   availability is part of the candidate filter, and the
 ///   probe returns before any crawler work (or `gem env` subprocess spawn)
 ///   when no judgment is possible.
 /// * PATCHED means [`verify_patch_record`] `Ok` — the one shared oracle
@@ -326,8 +326,7 @@ async fn gem_stale_install_warnings(
     global: bool,
     global_prefix: Option<std::path::PathBuf>,
     confirmed: &[(String, String)],
-    // This run's fetched records MERGED with the ledger's persisted ones
-    // (the caller hands the post-merge ledger map).
+    // This run's fetched records, by uuid.
     records: &std::collections::BTreeMap<String, socket_patch_core::manifest::schema::PatchRecord>,
     gem_artifact_shas: &std::collections::BTreeMap<(String, String), String>,
 ) -> StaleInstallOutcome {
@@ -629,20 +628,20 @@ pub(super) async fn run_redirect(
 /// ([`socket_patch_core::hosted::engine`], over a
 /// [`ProjectView::Disk`](socket_patch_core::vendor::lock_inventory::ProjectView));
 /// what stays here is what needs the host: reference grants and the other
-/// network fetches, the apply lock (wet runs with a grant), the redirect
-/// ledger load, the vendored→hosted takeover pre-revert (symlink-checked
-/// first), the `pipenv --version` probe, the symlink guard, the ledger
-/// merge-then-persist and the file writes, the gem / Python / vlt
+/// network fetches, the apply lock (wet runs with a grant), the
+/// vendored→hosted takeover pre-revert (symlink-checked first), the
+/// `pipenv --version` probe, the symlink guard, the file writes, the gem /
+/// Python / vlt
 /// stale-install probes, and the optional VEX. Shared VERBATIM by `scan
 /// --mode hosted` (its `--json` arm through the `run_redirect` wrapper, its
 /// human arm through [`boxed_run_redirect_selected`] in `scan/mod.rs`; both
 /// select via `discover_selected`, with no prompt) and by `get --mode
 /// hosted` (which pins the advisory-resolved uuid), so all produce
-/// identical on-disk results for the same selection. The redirect ledger
-/// is loaded HERE, under the apply lock whenever this run holds one (never
-/// handed in pre-loaded: a copy read before the lock could merge over a
-/// concurrent writer's edits); a dry run or a zero-grant run reads it
-/// strictly but writes nothing, quarantine included.
+/// identical on-disk results for the same selection. v5 hosted mode keeps
+/// no ledger (the lockfiles are the only record); the VENDORED ledger the
+/// takeover needs is loaded HERE, under the apply lock whenever this run
+/// holds one (never handed in pre-loaded: a copy read before the lock could
+/// be saved over a concurrent writer's edits).
 ///
 /// `scan_result` must be `Some` exactly when `common.json` is set (the
 /// human/JSON split keys on `common.json`; a `--json` caller passing `None`
@@ -1091,10 +1090,10 @@ pub(crate) async fn run_redirect_selected(
         std::collections::BTreeMap::new();
     let mut record_warnings: Vec<socket_patch_core::patch::redirect::RewriteWarning> = Vec::new();
 
-    // SYMLINK GUARD (see `engine::guard`) — before the ledger and before any
-    // write, dry runs included, so a dry run predicts the refusal. The
-    // revert side (replay.rs) already refuses linked files, so the write
-    // side must too.
+    // SYMLINK GUARD (see `engine::guard`) — before any write, dry runs
+    // included, so a dry run predicts the refusal. The revert side (the
+    // hosted → upstream restore's staged flush) already refuses linked
+    // files, so the write side must too.
     if let Some(refusal) = engine::guard(&view, &done, &candidates) {
         return refuse(common, scan_result.take(), &refusal);
     }
@@ -1176,8 +1175,8 @@ pub(crate) async fn run_redirect_selected(
     // the writes so the warning describes the project as this run leaves it.
     // Idempotent re-scans re-confirm and re-probe, so the warning keeps
     // firing until the stale materialization is actually gone. Skipped
-    // EXPLICITLY on --dry-run: the probe's ledger-record fallback would
-    // otherwise judge state the run did not (re)create.
+    // EXPLICITLY on --dry-run: nothing was written, so the probe would
+    // judge state the run did not (re)create.
     let gem_stale: StaleInstallOutcome = if common.dry_run {
         StaleInstallOutcome::default()
     } else {
@@ -1330,7 +1329,7 @@ pub(crate) async fn run_redirect_selected(
         // Stale-flagged purls are EXCLUDED from assume_applied: the same-run
         // envelope carries a redirect_gem_stale_install warning proving the
         // installed materialization unpatched, so attesting that purl from
-        // the ledger would contradict the run's own warning. Excluded purls
+        // this run's records would contradict the run's own warning. Excluded purls
         // fall back to `vex`'s normal installed-tree verification.
         // A confirmed uuid whose bundled instance the rewriter had to skip
         // (#469) leaves that copy unpatched, so it too is verified, never
@@ -1745,8 +1744,8 @@ async fn vendored_takeover(
         None
     };
     // Yarn berry twin of the bun gate: the berry rewriter's project-level
-    // refusals (mixed line endings, cacheKey, `.yarnrc.yml`
-    // compressionLevel) must be known before the takeover reverts a
+    // refusals (mixed yarn.lock / package.json line endings, cacheKey,
+    // `.yarnrc.yml` compressionLevel) must be known before the takeover reverts a
     // vendored berry purl, or the revert strips the live vendored patch
     // and the rewriter then refuses the lock. Only entries the
     // vendor ledger wired through the yarn-berry backend are gated (the
@@ -1768,8 +1767,14 @@ async fn vendored_takeover(
                 )
                 .await
                 .ok();
+                let manifest = socket_patch_core::utils::fs::read_regular_to_string(
+                    &common.cwd.join("package.json"),
+                )
+                .await
+                .ok();
                 socket_patch_core::patch::redirect::preflight_yarn_berry_hosted(
                     &lock,
+                    manifest.as_deref(),
                     yarnrc.as_deref(),
                 )
                 .err()
@@ -3382,8 +3387,8 @@ mod tests {
 
     /// Probe invocation with the default surface (project-local discovery,
     /// no artifact shas) — tests override the knobs they exercise.
-    /// `records` is the merged map production hands over (this run's
-    /// fetched records plus the ledger's persisted ones).
+    /// `records` is the map production hands over: this run's fetched
+    /// records, by uuid.
     async fn probe(
         cwd: &std::path::Path,
         confirmed: &[(String, String)],
@@ -3712,25 +3717,22 @@ mod tests {
         );
     }
 
-    /// RE-FIRE guarantee: when this run's record fetch failed (no fresh
-    /// records), the merged map the caller hands over still carries the
-    /// redirect ledger's PERSISTED record under whatever purl key the
-    /// ledger used — and the probe's uuid lookup judges from it, so a
-    /// transient /patches/view failure cannot silently retire the warning
-    /// while the stale materialization is still there.
+    /// The probe links a record to a confirmed purl by uuid alone: a
+    /// record keyed under the API's qualified purl spelling (not the
+    /// confirmed purl) must still judge the stale materialization.
     #[tokio::test]
-    async fn gem_stale_probe_judges_from_persisted_ledger_records() {
+    async fn gem_stale_probe_matches_records_by_uuid_not_purl_key() {
         let stale = tempfile::tempdir().unwrap();
         materialize_gem(stale.path(), GEM_UPSTREAM);
-        // Persisted under the API's qualified spelling, not the confirmed
+        // Keyed under the API's qualified spelling, not the confirmed
         // purl: only the uuid links them.
-        let mut ledger_only = std::collections::BTreeMap::new();
-        ledger_only.insert(format!("{GEM_PURL}?platform=ruby"), gem_record());
-        let out = probe(stale.path(), &one_confirmed(), &ledger_only).await;
+        let mut qualified = std::collections::BTreeMap::new();
+        qualified.insert(format!("{GEM_PURL}?platform=ruby"), gem_record());
+        let out = probe(stale.path(), &one_confirmed(), &qualified).await;
         assert_eq!(
             out.warnings.len(),
             1,
-            "the ledger records must keep the warning firing across flaky fetches"
+            "a record keyed under another purl spelling must still match by uuid"
         );
     }