Fix Poetry CI line endings and stale hosted attestations

Preserve LF/CRLF in the relock simulator and exercise both newline forms. Probe installed Python package hashes after hosted redirects, warn on stale bytes, and exclude them from same-run VEX even when another interpreter is patched. Cover re-scans, ledger fallback, missing files, dry runs, variants, and custom prefixes.

Assisted-by: Codex:gpt-6-astra

Author: mikolalysenko

CHANGELOG.md

@@ -200,6 +200,11 @@ into the new version's section — see docs/releasing.md.
 
 ### Fixed
 
+- Hosted Python redirects now warn when installed files still contain upstream
+  or modified bytes and omit those packages from same-run VEX. The read-only
+  probe covers Poetry virtualenvs, repeats on re-scans, and uses persisted patch
+  records if fetching fresh records fails.
+
 - **Agent mode finds Poetry's out-of-tree virtualenv.** Poetry keeps a
   project's virtualenv under `{cache-dir}/virtualenvs/<name>-<hash>-py<X.Y>`
   by default, so after a plain `poetry install` the crawler saw no

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -140,6 +140,8 @@ The rewriter reads a fixed set of candidate files from the project root: the npm
 
 The hidden alias `--no-apply` on `get --save-only` is **part of the contract** — it does not appear in `--help` but is widely used in existing scripts.
 
+**Python stale-install guard**: after a hosted redirect, `scan` / `get` use the Python crawler to inspect every matching installed package, including Poetry's out-of-tree virtualenvs and `--global-prefix`. A readable file that differs from the patch's `afterHash` emits `redirect_pypi_stale_install` in JSON `redirect.warnings[]` and human stderr. The probe changes no installed files, re-runs on idempotent scans, and falls back to persisted patch records when fresh record fetching fails. Missing/unreadable files alone do not prove staleness; lock-only checkouts stay quiet. Dry runs skip the probe. Same-run VEX excludes positively stale Python packages (qualifier-insensitive), even with `--vex-no-verify` or a healthy copy in another interpreter; if nothing remains to attest, the command exits 1 with `no_applicable_patches`. Reinstall from the rewritten lock in the affected interpreter and verify with `socket-patch vex`.
+
 ### Embedded VEX (`apply --vex` / `scan --vex` / `vendor --vex`)
 
 `--vex <path>` folds OpenVEX 0.2.0 generation into `apply`, `scan`, and `vendor`: on a successful run the command writes the document to `<path>` using the same engine as the standalone `vex` command. The `--vex-*` flags mirror `vex`'s `--product` / `--no-verify` / `--doc-id` / `--compact` knobs (namespaced to avoid colliding with the host command), and reuse the standalone env vars (`SOCKET_VEX_PRODUCT`, etc.). They are inert unless `--vex` is set.
@@ -1069,6 +1071,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `vendor_uuid_mismatch` | `skipped` | repair: the manifest's patch uuid moved past the vendored artifact — a re-vendor (`vendor` / `scan --vendor`) is pending; repair does not cross patch generations. |
 | `content_mismatch_overwritten` | `skipped` (warning) | apply (default policy): a file matched NEITHER beforeHash nor afterHash and was overwritten with the full verified patched content. `--strict` turns this case into a `failed` event instead. |
 | `vendor_lock_checksums_unsupported` / `vendor_stale_lock_checksum` | `failed` | vendor (gem): an ambiguous/platform CHECKSUMS entry, or a v1-wired lock whose stale token blocks the hot path (run `vendor --revert` + re-vendor). |
+| `redirect_pypi_stale_install` | `redirect.warnings[]` (warning) | Hosted Python redirect: readable installed files differ from patched hashes. Read-only, repeated on re-scan, and excludes the package from same-run VEX. See the "Python stale-install guard" section. |
 | `redirect_gem_stale_install` | `redirect.warnings[]` (warning) | scan `--mode hosted` (gem): a stale UNPATCHED materialization (installed gem, or committed `vendor/cache` archive) that `bundle install` will reuse instead of fetching the redirected patch; the detail carries the verified remedy. Full rules and flavors: the "Gem stale-install guard" section. |
 | `pypi_{poetry,pdm,pipenv}_no_lockfile` | `failed` | vendor (pypi): a lock-less tool marker with no `requirements.txt` fallback — run `<tool> lock`. |
 | `pypi_poetry_integrity_unverified` | `skipped` (warning) | vendor (pypi / poetry): the lock was written by Poetry < 1.4 (0.12 `[metadata.hashes]`, lock 1.0/1.1, or a 2.0 lock without a `@generated by Poetry X.Y.Z` header — 1.3 wrote those). That installer does not verify local wheel hashes (the committed wheel bytes are the protection) and does not replace an already-installed package at the same version; recreate the virtualenv or `pip uninstall` the package before `poetry install`, or upgrade Poetry. |

crates/socket-patch-cli/src/commands/scan/hosted.rs

@@ -11,6 +11,8 @@ use crate::commands::vex::generate_vex_from_manifest_path;
 
 use super::{discover_selected, ScanArgs};
 
+mod python;
+
 /// Candidate lockfiles / registry configs the redirect rewriters may touch —
 /// read from the project when present and handed to `rewrite_registry_redirect`.
 /// Fragment-edit kinds whose lockfile the package manager re-lays in place
@@ -392,14 +394,13 @@ fn build_redirect_json_envelope(
     result
 }
 
-/// The gem stale-install probe's outcome: warnings for both output channels,
+/// The installed-tree probes' outcome: warnings for both output channels,
 /// plus the stale purls STRUCTURALLY, so the same-run `--vex` can exclude
 /// them from `assume_applied` — an envelope must never attest a CVE its own
-/// warnings say is live. Excluded purls fall back to `vex`'s normal
-/// installed-tree verification: a patched install still attests (with hash
-/// evidence), a stale one is omitted.
+/// warnings say is live. Python also carries positive evidence through VEX
+/// so a different, healthy interpreter cannot mask a stale installation.
 #[derive(Default)]
-struct GemStaleOutcome {
+struct StaleInstallOutcome {
     warnings: Vec<serde_json::Value>,
     stale_purls: std::collections::BTreeSet<String>,
 }
@@ -493,13 +494,13 @@ fn gem_stale_cache_warning(purl: &str, cache_path: &Path) -> serde_json::Value {
 /// already-patched install must not produce a delete prescription.
 /// (`current_hash` is `Some` only when the bytes were really hashed, which
 /// also excludes the absent-new-file `Ready`.)
-async fn gem_stale_positive_evidence(
-    gem_dir: &Path,
+async fn installed_stale_positive_evidence(
+    package_dir: &Path,
     record: &socket_patch_core::manifest::schema::PatchRecord,
 ) -> bool {
     use socket_patch_core::patch::apply::{verify_file_patch, VerifyStatus};
     for (file_name, info) in &record.files {
-        let result = verify_file_patch(gem_dir, file_name, info).await;
+        let result = verify_file_patch(package_dir, file_name, info).await;
         if matches!(
             result.status,
             VerifyStatus::Ready | VerifyStatus::HashMismatch
@@ -533,7 +534,7 @@ async fn gem_stale_positive_evidence(
 ///   Judgments are grouped BY INSTALLED DIR: platform-variant purls of one
 ///   gem resolve to the same dir, and if ANY variant's record proves the
 ///   dir patched, the dir is patched — never warned.
-/// * STALE requires [`gem_stale_positive_evidence`] — never inferred from
+/// * STALE requires [`installed_stale_positive_evidence`] — never inferred from
 ///   missing/unreadable files.
 /// * A committed `vendor/cache/<leaf>.gem` whose sha256 differs from the
 ///   patched artifact's is stale too (bundler installs from it first, fresh
@@ -553,14 +554,14 @@ async fn gem_stale_install_warnings(
         socket_patch_core::manifest::schema::PatchRecord,
     >,
     gem_artifact_shas: &std::collections::BTreeMap<(String, String), String>,
-) -> GemStaleOutcome {
+) -> StaleInstallOutcome {
     use socket_patch_core::crawlers::types::CrawlerOptions;
     use socket_patch_core::crawlers::RubyCrawler;
     use socket_patch_core::manifest::schema::PatchRecord;
     use socket_patch_core::vendor::file_sha256_hex;
     use socket_patch_core::vex::verify::verify_patch_record;
 
-    let mut out = GemStaleOutcome::default();
+    let mut out = StaleInstallOutcome::default();
     let find_record = |uuid: &str| -> Option<&PatchRecord> {
         records
             .values()
@@ -624,7 +625,7 @@ async fn gem_stale_install_warnings(
                 });
             if verify_patch_record(&pkg.path, record).await.is_ok() {
                 entry.patched = true;
-            } else if !entry.positive && gem_stale_positive_evidence(&pkg.path, record).await {
+            } else if !entry.positive && installed_stale_positive_evidence(&pkg.path, record).await {
                 entry.positive = true;
                 entry.purl = (*purl).to_string();
             }
@@ -1933,8 +1934,8 @@ pub(crate) async fn run_redirect_selected(
     // the probe's ledger-record fallback could still judge an
     // already-redirected project, so without this gate a dry-run would warn
     // about state the run did not (re)create.
-    let gem_stale: GemStaleOutcome = if common.dry_run {
-        GemStaleOutcome::default()
+    let gem_stale: StaleInstallOutcome = if common.dry_run {
+        StaleInstallOutcome::default()
     } else {
         // purl-coordinate → the PATCHED .gem artifact's sha256 (registry
         // override identifier, tarball integrity fallback) — judges a
@@ -1963,6 +1964,12 @@ pub(crate) async fn run_redirect_selected(
         .await
     };
 
+    let python_stale = if common.dry_run {
+        StaleInstallOutcome::default()
+    } else {
+        python::stale_install_warnings(common, &confirmed, &records, &ledger_records).await
+    };
+
     // Cross-mode takeover: a committed vendored ledger (`.socket/vendor/state.json`)
     // may still claim package(s) this project also has a hosted redirect ledger
     // for — their tarballs would then be orphaned and that ledger stale. But the
@@ -2022,8 +2029,13 @@ pub(crate) async fn run_redirect_selected(
         params.assume_applied = confirmed
             .iter()
             .map(|(purl, _)| purl.clone())
-            .filter(|purl| !gem_stale.stale_purls.contains(purl))
+            .filter(|purl| {
+                !gem_stale.stale_purls.contains(purl) && !python_stale.stale_purls.contains(purl)
+            })
             .collect();
+        // A healthy copy in another interpreter must not override a stale
+        // Python tree found by the probe, including with --vex-no-verify.
+        params.known_stale = python_stale.stale_purls.iter().cloned().collect();
         let manifest_path = common.resolved_manifest_path();
         match generate_vex_from_manifest_path(common, &params, &manifest_path).await {
             Ok(summary) => vex_statements = Some(summary.statements),
@@ -2049,6 +2061,7 @@ pub(crate) async fn run_redirect_selected(
         warnings.extend(rush_warnings.iter().cloned());
         warnings.extend(pnpm_warnings.iter().cloned());
         warnings.extend(gem_stale.warnings.iter().cloned());
+        warnings.extend(python_stale.warnings.iter().cloned());
         warnings.extend(takeover_pre_warnings.iter().cloned());
         warnings.extend(takeover_warnings.iter().cloned());
         warnings.extend(prune_warnings.iter().cloned());
@@ -2126,7 +2139,7 @@ pub(crate) async fn run_redirect_selected(
             for w in &pnpm_warnings {
                 eprintln!("  warning: {}", w["detail"].as_str().unwrap_or_default());
             }
-            for w in &gem_stale.warnings {
+            for w in gem_stale.warnings.iter().chain(&python_stale.warnings) {
                 // Code included: the stale-install hazard is a silent-CVE
                 // state, so the stderr line must be greppable by its stable
                 // code in CI logs, same as the JSON envelope.
@@ -2196,7 +2209,7 @@ pub(crate) fn boxed_run_redirect_selected<'a>(
 mod tests {
     use super::{
         build_redirect_json_envelope, gem_stale_cache_warning, gem_stale_install_warning,
-        gem_stale_install_warnings, gem_stale_positive_evidence, parse_purl_simple,
+        gem_stale_install_warnings, installed_stale_positive_evidence, parse_purl_simple,
         plan_workspace_trust, pnpm_heal_root, pnpm_lock_carries_hosted_redirect,
         pnpm_lock_version_major, pnpm_trust_configured_detail, pnpm_trust_legacy_detail,
         pnpm_trust_manual_guidance, pnpm_trust_workspace_unreadable_detail,
@@ -2748,7 +2761,7 @@ mod tests {
         cwd: &std::path::Path,
         confirmed: &[(String, String)],
         records: &std::collections::BTreeMap<String, PatchRecord>,
-    ) -> super::GemStaleOutcome {
+    ) -> super::StaleInstallOutcome {
         gem_stale_install_warnings(
             cwd,
             false,
@@ -2856,38 +2869,38 @@ mod tests {
     /// transiently unreadable file in a patched install must not produce
     /// a delete prescription.
     #[tokio::test]
-    async fn gem_stale_positive_evidence_requires_readable_mismatched_bytes() {
+    async fn installed_stale_positive_evidence_requires_readable_mismatched_bytes() {
         let tmp = tempfile::tempdir().unwrap();
         let record = gem_record();
 
         // Pristine upstream bytes → evidence.
         let upstream = tmp.path().join("upstream");
         std::fs::create_dir_all(upstream.join("lib")).unwrap();
         std::fs::write(upstream.join("lib").join("stale_unit.rb"), GEM_UPSTREAM).unwrap();
-        assert!(gem_stale_positive_evidence(&upstream, &record).await);
+        assert!(installed_stale_positive_evidence(&upstream, &record).await);
 
         // Tampered bytes (neither hash) → evidence.
         let tampered = tmp.path().join("tampered");
         std::fs::create_dir_all(tampered.join("lib")).unwrap();
         std::fs::write(tampered.join("lib").join("stale_unit.rb"), b"other").unwrap();
-        assert!(gem_stale_positive_evidence(&tampered, &record).await);
+        assert!(installed_stale_positive_evidence(&tampered, &record).await);
 
         // Patched bytes → no evidence.
         let patched = tmp.path().join("patched");
         std::fs::create_dir_all(patched.join("lib")).unwrap();
         std::fs::write(patched.join("lib").join("stale_unit.rb"), GEM_PATCHED).unwrap();
-        assert!(!gem_stale_positive_evidence(&patched, &record).await);
+        assert!(!installed_stale_positive_evidence(&patched, &record).await);
 
         // Missing file → no evidence (never a guess).
         let hollow = tmp.path().join("hollow");
         std::fs::create_dir_all(hollow.join("lib")).unwrap();
-        assert!(!gem_stale_positive_evidence(&hollow, &record).await);
+        assert!(!installed_stale_positive_evidence(&hollow, &record).await);
 
         // A DIRECTORY at the file path (the unreadable-NotFound class) →
         // no evidence.
         let blocked = tmp.path().join("blocked");
         std::fs::create_dir_all(blocked.join("lib").join("stale_unit.rb")).unwrap();
-        assert!(!gem_stale_positive_evidence(&blocked, &record).await);
+        assert!(!installed_stale_positive_evidence(&blocked, &record).await);
 
         // Absent new-file (empty beforeHash routes to Ready with NO
         // current_hash) → no evidence.
@@ -2897,7 +2910,7 @@ mod tests {
             .get_mut("lib/stale_unit.rb")
             .expect("fixture file entry")
             .before_hash = String::new();
-        assert!(!gem_stale_positive_evidence(&hollow, &new_file).await);
+        assert!(!installed_stale_positive_evidence(&hollow, &new_file).await);
     }
 
     /// The probe end to end over a real deployment layout: a STALE