Guard Bun manifests for explicit patch retrieval

Apply Bun compatibility preflight to get by UUID as well as search.

Exercise both entry points across the native release matrix.

Assisted-by: Codex:gpt-6-astra

Author: mikolalysenko

crates/socket-patch-cli/src/commands/get.rs

@@ -2950,6 +2950,31 @@ async fn run_get_vendored_uuid(
         return 0;
     }
 
+    if patch.purl.starts_with("pkg:npm/") {
+        if let Err((code, message)) =
+            socket_patch_core::vendor::bun_lock::preflight_vendor(&args.common.cwd).await
+        {
+            if args.common.json {
+                print_json(&serde_json::json!({
+                    "status": "error",
+                    "found": 1,
+                    "downloaded": 0,
+                    "failed": 1,
+                    "error": { "code": code, "message": message },
+                    "patches": [{
+                        "purl": patch.purl,
+                        "uuid": patch.uuid,
+                        "action": "failed",
+                        "errorCode": code,
+                    }],
+                }));
+            } else if !args.common.silent {
+                eprintln!("Error ({code}): {message}");
+            }
+            return 1;
+        }
+    }
+
     note_vendored_whole_manifest_scope(&manifest_path, &[patch.purl.as_str()], quiet).await;
 
     let action = match save_patch_record(args, patch, false, false).await {

docs/testing/bun-compatibility.md

@@ -25,6 +25,8 @@ Every supported case verifies:
 
 The runner captures the exact project manifests, lockfiles, optional `.socket/manifest.json`, CLI JSON, file hashes and assertion results. Socket SBOM tests import these captures through their existing fixture validation framework. Vendored artifact contents are verified by the native runner; they are not needed for SBOM lockfile annotation.
 
+The `get-uuid` and `get-search` cases also exercise explicit patch retrieval by UUID and PURL, including refusal before manifest writes on unsupported Bun projects.
+
 ## Boundaries verified by the matrix
 
 | Configuration | Behavior |

scripts/backtest-bun.py

@@ -19,7 +19,8 @@
             '1.2.0', '1.2.23', '1.3.0', '1.3.14', '1.4.0', '1.4.2']
 SHAPES = ['direct', 'dev', 'optional', 'alias', 'transitive', 'two-versions',
           'workspace', 'workspace-nested', 'peer', 'crlf', 'space-unicode',
-          'custom-registry', 'text', 'isolated', 'hoisted', 'lockfile-only', 'production']
+          'custom-registry', 'text', 'isolated', 'hoisted', 'lockfile-only', 'production',
+          'get-uuid', 'get-search']
 PURL = 'pkg:npm/minimist@1.2.2'
 UUID = '80630680-4da6-45f9-bba8-b888e0ffd58c'
 
@@ -183,7 +184,8 @@ def backtest(job):
             checks['installedBefore'] = bool(installed_targets(project))
             if shape == 'lockfile-only':
                 shutil.rmtree(project / 'node_modules')
-            command = [cli, 'scan', '--mode', 'vendored' if mode == 'vendored-detached' else mode, '--cwd', project,
+            verb = ['get', UUID if shape == 'get-uuid' else PURL] if shape.startswith('get-') else ['scan']
+            command = [cli, *verb, '--mode', 'vendored' if mode == 'vendored-detached' else mode, '--cwd', project,
                        '--json', '--yes', '--no-telemetry']
             if mode == 'vendored-detached':
                 command.append('--detached')
@@ -197,6 +199,7 @@ def backtest(job):
             row['refusals'] = [w.get('code', w.get('errorCode')) for w in warnings]
             row['refusals'] += [p['errorCode'] for p in envelope.get('download', {}).get('patches', [])
                                if p.get('errorCode')]
+            row['refusals'] += [p['errorCode'] for p in envelope.get('patches', []) if p.get('errorCode')]
             row['applied'] = applied
             if not checks['installedBefore'] and version in ['0.8.1', '1.0.0'] and shape in ['peer', 'transitive']:
                 row['supported'] = False
@@ -301,7 +304,8 @@ def backtest(job):
 
     jobs = [(v, s, m) for v in args.versions for s in args.shapes for m in args.modes
             if (s not in ('isolated', 'hoisted') or tuple(map(int, v.split('.'))) >= (1, 3, 0))
-            and (s != 'text' or tuple(map(int, v.split('.'))) >= (1, 1, 38))]
+            and (s != 'text' or tuple(map(int, v.split('.'))) >= (1, 1, 38))
+            and (not s.startswith('get-') or m != 'vendored-detached')]
     with concurrent.futures.ThreadPoolExecutor(max_workers=args.jobs) as pool:
         rows = list(pool.map(backtest, jobs))
     save(root / 'summary.json', rows)