fix(yarn-berry): run the new mode's berry gates before a takeover reverts the old one

The reverts keep line endings as they are (a vendored or hosted revert
never refuses on them, so a lock mixed after wiring stays mixed), while the
forward hosted rewriter and vendored backend refuse a mixed file. Neither
takeover checked first:

- `scan`/`get --mode hosted` over a vendored berry purl reverted its
  wiring, ledger entry and artifact (`redirect_takeover_reverted_vendored`:
  "now fully hosted"), then the rewriter refused the mixed lock -
  `redirected: 0`, and the next `yarn install` pulled the unpatched
  registry package.
- `vendor` / `scan --mode vendored` over a hosted berry purl reverted the
  hosted edits and dropped the redirect-ledger record
  (`vendor_takeover_reverted_redirect`), then failed
  `vendor_yarn_berry_mixed_line_endings`.

Extract the rewriter's project gates into
`redirect::preflight_yarn_berry_hosted` (mixed endings, cacheKey,
`.yarnrc.yml` compressionLevel) and the backend's into
`vendor::yarn_berry_vendor_preflight` (both files' endings, cacheKey,
compressionLevel; berry flavor only), and run each before the matching
takeover revert, mirroring the bun preflights - wet and --dry-run alike.
A refused purl keeps the old mode's wiring byte-identical and is skipped /
failed with the new mode's code.

Tests: a hermetic in_process_vendor test drives both directions (mixed
lock, mixed package.json, compressionLevel 9; wet and dry-run) and asserts
the wiring snapshot is unchanged and no takeover is announced (fails on the
pre-fix code in both directions); core unit tests pin that each preflight
matches its forward gate's code and detail.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

CHANGELOG.md

@@ -595,6 +595,18 @@ into the new version's section — see docs/releasing.md.
   4.12.0 (hosted, vendored, workspaces, pnpm linker, both mode takeovers)
   with the fixtures re-spelled CRLF, and on yarn 2.4.3 / 3.8.7 (still
   refused for their cacheKey, never for their endings).
+- **A yarn berry mode takeover no longer strips the old mode's patch before
+  the new mode refuses the project.** `scan` / `get --mode hosted` over a
+  vendored berry purl reverted its vendored wiring, ledger entry and
+  artifact (`redirect_takeover_reverted_vendored`: "now fully hosted") and
+  only then ran the rewriter, which refused a lock with mixed line endings
+  (or an unsupported `cacheKey` / `.yarnrc.yml` `compressionLevel`) —
+  `redirected: 0`, and the next `yarn install` pulled the unpatched registry
+  package. `vendor` / `scan --mode vendored` over a hosted berry purl did the
+  same in reverse (`vendor_takeover_reverted_redirect`, then `failed`
+  `vendor_yarn_berry_mixed_line_endings`). Both takeovers now run the new
+  mode's berry gates first — wet and `--dry-run` alike — and a refused purl
+  keeps the old mode's wiring byte-identical.
 - **`setup` keeps a CRLF `package.json` CRLF.** `setup` and `setup --remove`
   re-serialized `package.json` with bare LF and dropped a leading BOM, so on
   a Windows yarn berry project (yarn pretty-prints the manifest with CRLF) a

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -1414,10 +1414,62 @@ pub(crate) async fn run_redirect_selected(
         } else {
             None
         };
-        // A bun-refused npm purl is never dispatched (see the loop), so its
-        // wiring is not a write target here.
-        let bun_refused =
-            |c: &Candidate| bun_takeover_refusal.is_some() && c.purl.starts_with("pkg:npm/");
+        // Yarn berry twin of the bun gate: the berry rewriter's project-level
+        // refusals (mixed line endings, cacheKey, `.yarnrc.yml`
+        // compressionLevel) must be known before the takeover reverts a
+        // vendored berry purl — the vendored revert keeps a mixed lock mixed
+        // (it never refuses on line endings), so reverting first stripped
+        // the live vendored patch and then the rewriter refused the lock,
+        // leaving the package unpatched in both modes. Only entries the
+        // vendor ledger wired through the yarn-berry backend are gated (the
+        // lock is read only when one exists); an unreadable lock is left to
+        // the revert's own diagnostics.
+        let berry_entry = |entry: &socket_patch_core::vendor::VendorEntry| {
+            entry.ecosystem == "npm" && entry.flavor.as_deref() == Some("yarn-berry")
+        };
+        let berry_takeover_refusal = if takeover
+            .iter()
+            .any(|(_, entry)| entry.as_ref().is_some_and(berry_entry))
+        {
+            match socket_patch_core::utils::fs::read_regular_to_string(
+                &common.cwd.join("yarn.lock"),
+            )
+            .await
+            {
+                Ok(lock) => {
+                    let yarnrc = socket_patch_core::utils::fs::read_regular_to_string(
+                        &common.cwd.join(".yarnrc.yml"),
+                    )
+                    .await
+                    .ok();
+                    socket_patch_core::patch::redirect::preflight_yarn_berry_hosted(
+                        &lock,
+                        yarnrc.as_deref(),
+                    )
+                    .err()
+                }
+                Err(_) => None,
+            }
+        } else {
+            None
+        };
+        // The takeover refusal (if any) for one candidate: bun gates every
+        // npm purl, berry only its vendored-berry entries. A refused purl is
+        // never dispatched (see the loop), so its wiring is not a write
+        // target here.
+        let takeover_refusal =
+            |c: &Candidate,
+             entry: Option<&socket_patch_core::vendor::VendorEntry>|
+             -> Option<&socket_patch_core::patch::redirect::RewriteWarning> {
+                if !c.purl.starts_with("pkg:npm/") {
+                    return None;
+                }
+                bun_takeover_refusal.as_ref().or_else(|| {
+                    berry_takeover_refusal
+                        .as_ref()
+                        .filter(|_| entry.is_some_and(berry_entry))
+                })
+            };
         // SYMLINK PRE-CHECK for the takeover reverts — the same rule as the
         // SYMLINK GUARD below, applied to the files the reverts rewrite
         // (each ledger entry's recorded wiring): the revert backends stage
@@ -1428,7 +1480,11 @@ pub(crate) async fn run_redirect_selected(
         // (and under --dry-run too) so "nothing was written" stays true.
         let revert_targets = takeover
             .iter()
-            .filter_map(|(c, entry)| entry.as_ref().filter(|_| !bun_refused(c)))
+            .filter_map(|(c, entry)| {
+                entry
+                    .as_ref()
+                    .filter(|e| takeover_refusal(c, Some(e)).is_none())
+            })
             .flat_map(|entry| entry.wiring.iter().map(|w| w.file.as_str()));
         if let Some(linked) =
             socket_patch_core::utils::fs::first_symlink(&common.cwd, revert_targets).await
@@ -1442,10 +1498,7 @@ pub(crate) async fn run_redirect_selected(
             let purl = &candidate.purl;
             let uuid = &candidate.dep.patch_uuid;
             if let Some(entry) = ledger_entry {
-                if let Some(warning) = bun_takeover_refusal
-                    .as_ref()
-                    .filter(|_| bun_refused(candidate))
-                {
+                if let Some(warning) = takeover_refusal(candidate, Some(entry)) {
                     refused.push(purl.clone());
                     if !takeover_pre_warnings
                         .iter()
@@ -1581,10 +1634,8 @@ pub(crate) async fn run_redirect_selected(
             }
         }
         for purl in &refused {
-            if let Some(c) = candidates.iter().find(|c| &c.purl == purl) {
-                let reason = bun_takeover_refusal
-                    .as_ref()
-                    .filter(|_| bun_refused(c))
+            if let Some((c, entry)) = takeover.iter().find(|(c, _)| &c.purl == purl) {
+                let reason = takeover_refusal(c, entry.as_ref())
                     .map_or("vendored_revert_failed", |w| w.code.as_str());
                 skipped.push(serde_json::json!({
                     "purl": purl, "uuid": c.dep.patch_uuid, "reason": reason,

crates/socket-patch-cli/src/commands/scan/hosted.rs

@@ -1459,6 +1459,16 @@ pub(crate) async fn vendor_records(
             Err(corrupt) => (None, Some(corrupt)),
         };
 
+    // Yarn berry takeover preflight (see
+    // `socket_patch_core::vendor::yarn_berry_vendor_preflight`): the berry
+    // backend's project-level refusals (mixed line endings in yarn.lock or
+    // package.json, cacheKey, `.yarnrc.yml` compressionLevel), computed at
+    // most once per run and only when a hosted-claimed npm purl reaches the
+    // takeover below — which must refuse such a purl BEFORE reverting its
+    // hosted edits: a hosted revert keeps a mixed lock mixed, so the backend
+    // then refused it with the redirect already gone.
+    let berry_takeover_refusal: tokio::sync::OnceCell<Option<(&'static str, String)>> =
+        tokio::sync::OnceCell::new();
     let pipenv_version = tokio::sync::OnceCell::new();
     let mut dry_in_sync: u32 = 0;
     // Sorted, so per-package lines print in the same order every run.
@@ -1575,6 +1585,26 @@ pub(crate) async fn vendor_records(
                         .keys()
                         .any(|k| canonical_purl(k) == canonical_purl(candidate))
                 });
+                // The refusal the berry backend would raise after the
+                // revert, raised HERE instead — the same `failed` event,
+                // code and detail, in the dry run and the wet run alike —
+                // so the hosted wiring and redirect ledger stay untouched.
+                if claimed && candidate.starts_with("pkg:npm/") {
+                    let refusal = berry_takeover_refusal
+                        .get_or_init(|| {
+                            socket_patch_core::vendor::yarn_berry_vendor_preflight(&common.cwd)
+                        })
+                        .await;
+                    if let Some((code, detail)) = refusal {
+                        has_errors = true;
+                        env.record(
+                            PatchEvent::new(PatchAction::Failed, candidate.clone())
+                                .with_error(*code, detail.clone()),
+                        );
+                        report_vendor_failure(common, candidate, detail);
+                        continue;
+                    }
+                }
                 if claimed && common.dry_run {
                     // Probe the takeover exactly as the wet run would — the
                     // per-purl revert's dry run resolves every inverse and

crates/socket-patch-cli/src/commands/vendor.rs

@@ -1207,6 +1207,209 @@ async fn berry_crlf_takeovers_round_trip_both_directions() {
     );
 }
 
+/// `scan --mode hosted --json --yes <extra...>` through the binary.
+fn hosted_scan_cli_with(root: &Path, api_url: &str, extra: &[&str]) -> (i32, Value) {
+    let mut args = vec![
+        "scan",
+        "--mode",
+        "hosted",
+        "--json",
+        "--yes",
+        "--cwd",
+        root.to_str().unwrap(),
+        "--api-url",
+        api_url,
+        "--org",
+        "test-org",
+        "--api-token",
+        "fake-token",
+    ];
+    args.extend_from_slice(extra);
+    let (code, stdout, stderr) = run_cli(root, &args, &[]);
+    let env: Value = serde_json::from_str(stdout.trim()).unwrap_or_else(|e| {
+        panic!(
+            "scan --mode hosted --json must emit JSON: {e}\nstdout:\n{stdout}\nstderr:\n{stderr}"
+        )
+    });
+    (code, env)
+}
+
+/// The mode wiring a takeover would touch: the berry pair, `.yarnrc.yml`,
+/// and everything under `.socket/vendor/` (vendor ledger, artifact, marker,
+/// redirect ledger), as `(relative path, bytes)`.
+fn berry_wiring_snapshot(root: &Path) -> std::collections::BTreeMap<String, Vec<u8>> {
+    fn walk(root: &Path, dir: &Path, out: &mut std::collections::BTreeMap<String, Vec<u8>>) {
+        let Ok(entries) = std::fs::read_dir(dir) else {
+            return;
+        };
+        for entry in entries.flatten() {
+            let path = entry.path();
+            if path.is_dir() {
+                walk(root, &path, out);
+            } else {
+                let rel = path
+                    .strip_prefix(root)
+                    .unwrap()
+                    .to_string_lossy()
+                    .into_owned();
+                out.insert(rel, std::fs::read(&path).unwrap());
+            }
+        }
+    }
+    let mut out = std::collections::BTreeMap::new();
+    for rel in ["package.json", "yarn.lock", ".yarnrc.yml"] {
+        out.insert(rel.to_string(), std::fs::read(root.join(rel)).unwrap());
+    }
+    walk(root, &root.join(".socket/vendor"), &mut out);
+    out
+}
+
+/// Mode takeovers must refuse a berry project the NEW mode would refuse
+/// BEFORE reverting the OLD mode's wiring. The reverts keep line endings as
+/// they are (a mixed lock stays mixed), while the forward hosted rewriter
+/// and vendored backend refuse a mixed file (and an unsupported
+/// `.yarnrc.yml` compressionLevel) — so reverting first left the package
+/// unpatched in BOTH modes: `scan --mode hosted` reported
+/// `redirect_takeover_reverted_vendored` ("now fully hosted") then
+/// `redirected: 0`; `vendor` reported `vendor_takeover_reverted_redirect`
+/// then failed. Each leg (wet and --dry-run) asserts the old mode's wiring
+/// stays byte-identical, the refusal carries the new mode's code, and no
+/// takeover is announced.
+#[tokio::test]
+async fn berry_takeovers_refuse_before_reverting_the_old_mode() {
+    let server = wiremock::MockServer::start().await;
+    mount_berry_hosted_api(&server).await;
+    let (pkg, lock) = (
+        windows_shape(BERRY_WIN_PKG, true),
+        windows_shape(&berry_win_lock(), false),
+    );
+    // Each breakage lands AFTER the old mode is wired. `mix`: an editor
+    // saves one header line of `rel` with LF. `compression`: the project
+    // opts into a compressionLevel neither mode can reproduce.
+    type Break = fn(&Path, &str);
+    let mix: Break = |root, rel| {
+        let text = std::fs::read_to_string(root.join(rel)).unwrap();
+        std::fs::write(root.join(rel), text.replacen("\r\n", "\n", 1)).unwrap();
+    };
+    let compression: Break = |root, _| {
+        std::fs::write(
+            root.join(".yarnrc.yml"),
+            "nodeLinker: node-modules\r\nenableGlobalCache: false\r\ncompressionLevel: 9\r\n",
+        )
+        .unwrap();
+    };
+
+    // ── vendored → hosted ──
+    for (label, breakage, rel, code) in [
+        (
+            "mixed lock",
+            mix,
+            "yarn.lock",
+            "redirect_yarn_berry_mixed_line_endings",
+        ),
+        (
+            "compressionLevel",
+            compression,
+            "",
+            "redirect_yarn_berry_cache_unsupported",
+        ),
+    ] {
+        for dry in [true, false] {
+            let ctx = format!("vendored→hosted {label} dry={dry}");
+            let tmp = tempfile::tempdir().unwrap();
+            let root = tmp.path();
+            stage_berry_project(root, &pkg, &lock);
+            let (exit, env) = vendor_cli(root, &[]);
+            assert_eq!(exit, 0, "{ctx}: vendor: {env:#}");
+            breakage(root, rel);
+            let before = berry_wiring_snapshot(root);
+            let extra: &[&str] = if dry { &["--dry-run"] } else { &[] };
+            let (_, env) = hosted_scan_cli_with(root, &server.uri(), extra);
+            let text = env.to_string();
+            assert!(text.contains(code), "{ctx}: refused with {code}: {env:#}");
+            for announced in [
+                "redirect_takeover_reverted_vendored",
+                "redirect_would_revert_vendored",
+            ] {
+                assert!(
+                    !text.contains(announced),
+                    "{ctx}: no takeover ({announced}): {env:#}"
+                );
+            }
+            assert_eq!(env["redirect"]["redirected"], 0, "{ctx}: {env:#}");
+            let skipped = env["redirect"]["skipped"]
+                .as_array()
+                .cloned()
+                .unwrap_or_default();
+            assert!(
+                skipped
+                    .iter()
+                    .any(|s| s["purl"] == PURL && s["reason"] == code),
+                "{ctx}: the purl is skipped with the refusal's code: {env:#}"
+            );
+            assert_eq!(
+                berry_wiring_snapshot(root),
+                before,
+                "{ctx}: the vendored wiring, ledger and artifact stay byte-identical"
+            );
+        }
+    }
+
+    // ── hosted → vendored ──
+    for (label, breakage, rel, code) in [
+        (
+            "mixed lock",
+            mix,
+            "yarn.lock",
+            "vendor_yarn_berry_mixed_line_endings",
+        ),
+        (
+            "mixed package.json",
+            mix,
+            "package.json",
+            "vendor_yarn_berry_mixed_line_endings",
+        ),
+        (
+            "compressionLevel",
+            compression,
+            "",
+            "vendor_yarn_berry_cache_unsupported",
+        ),
+    ] {
+        for dry in [true, false] {
+            let ctx = format!("hosted→vendored {label} dry={dry}");
+            let tmp = tempfile::tempdir().unwrap();
+            let root = tmp.path();
+            stage_berry_project(root, &pkg, &lock);
+            let (exit, env) = hosted_scan_cli_with(root, &server.uri(), &[]);
+            assert_eq!(exit, 0, "{ctx}: hosted scan: {env:#}");
+            assert_eq!(env["redirect"]["redirected"], 1, "{ctx}: {env:#}");
+            breakage(root, rel);
+            let before = berry_wiring_snapshot(root);
+            let extra: &[&str] = if dry { &["--dry-run"] } else { &[] };
+            let (exit, env) = vendor_cli(root, extra);
+            assert_eq!(exit, 1, "{ctx}: the refusal fails the run: {env:#}");
+            let failed = find_event(&env, "failed", Some(code));
+            assert_eq!(failed["purl"], PURL, "{ctx}: {failed}");
+            let text = env.to_string();
+            for announced in [
+                "vendor_takeover_reverted_redirect",
+                "vendor_would_revert_redirect",
+            ] {
+                assert!(
+                    !text.contains(announced),
+                    "{ctx}: no takeover ({announced}): {env:#}"
+                );
+            }
+            assert_eq!(
+                berry_wiring_snapshot(root),
+                before,
+                "{ctx}: the hosted lock edits and redirect ledger stay byte-identical"
+            );
+        }
+    }
+}
+
 // ─────────────────────────────────────────────────────────────────────
 // 9. offline with no local source
 // ─────────────────────────────────────────────────────────────────────