feat(vex): manifest-less VEX from hosted/vendored lockfiles + npm 12 allow-remote auto-config (v5)

[Mikola Lysenko (mikolalysenko)]

Branch feat/vex-lockfile-inventory: 9 logical commits on main @ e0246295 (#247 – #250); 275 files, +94.2k / −8.3k. The verbatim lock_inventory split (commit 3) accounts for 5.4k of each side, and most of the rest is tests.

Summary

socket-patch vex, and the VEX that apply / scan / vendor --vex generate, now attest hosted and vendored patches with no .socket/manifest.json and no .socket/vendor ledgers. The patch wiring is read straight from the project's root lockfiles and package-manager configs. This covers:

• a depscan-opened PR;
• a clone that never committed its ledgers;
• a lock-only CI checkout;
• Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's manifest-free vendored mode.

A ledger record whose lockfile wiring is gone no longer attests, even under --no-verify. That tightening is the breaking part.

Also in this PR:

• npm 12 hosted mode works out of the box. npm ≥ 12 defaults to allow-remote=none and refuses every hosted redirect (EALLOWREMOTE). The hosted run now writes allow-remote=all to the project .npmrc and warns. Explicit values are respected, there is an opt-out flag, and every reversal removes exactly what was added.
• Seven rewriter bugs the real-toolchain matrices found (composer, gem, cargo v1, yarn 4.0.x, npm dual-lock, npm 6).

Rebased onto #247: what adapted

The branch was squashed onto 09956d9 and re-split by concern. The #247 contracts it now builds on:

• Manifest-free vendored mode. A vendored run writes no manifest, so the "manifest deleted" VEX cells are manifest-free by nature.

  • The npm, uv and poetry vendored matrices gain a legacy-manifest cell: a record that a pre-5.0 vendored run left beside its ledger must attest the same way.
  • --detached twins assert that neither spelling writes a manifest.
  • The yarn 2/3 refusal suite seeds that legacy record explicitly and still requires not_applied.

• Embedded ledger records. Record resolution reads Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's ledger-embedded records (detached entries). The standalone manifest-driven vendor now embeds its record too, as a fallback copy. One ownership rule, commands::vendor_record_is_unowned, is shared by vex, list and setup --check (fold_vendor_records, formerly fold_detached_records). repair keeps preferring a manifest that moved on to a newer uuid. detached still means "no manifest owner", so Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's manifest reconcile, legacy migration and get/scan idempotency are unchanged.

• Corrupt vendor ledger. For vex only, vendor_ledger_corrupt (exit 2, the ledger named and never rewritten) supersedes Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's disclose-then-manifest_not_found posture. setup --check keeps Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's warn_unreadable_vendor_state path.

• Lock window and residue. vex never takes apply.lock, never creates .socket/ and never writes. The hosted .npmrc edit rides rewrite.files / rewrite.edits, so it is written:

  • inside Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's apply-lock window;
  • after Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's whole-run symlink guard;
  • only after the ledger persisted.

  The per-purl unwind flushes through Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's shared staged::flush_staged. Suites that plant a stale ledger after a full rollback recreate .socket/ first, and the hosted rollback suite checks that vex does not recreate it.

• API and fs helpers. Record fetches use Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's uuid-only ApiClient::fetch_patch. select_lockfile and the extractors read through the guarded utils::fs readers. atomic_write_bytes_preserving_mode stays inside Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's commit_stage structure.

• Rewriters. plan_cargo_lock keeps Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's multi-source twin disambiguation (Ambiguous) and hoisted regexes. The v1 [metadata] handling was layered on top of both.

• CLI wording. Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's no-manifest lines ("No patch manifest found; nothing to apply.", "No manifest found, nothing to vendor.") are kept. The bun workflow keeps Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's two modes (the vendored-detached leg is gone). The pdm backtest's refusal check follows the manifest-free footprint.

• CHANGELOG. One [Unreleased] v5 section lists both PRs. Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's "vex discloses an unreadable ledger" bullet now points at the vendor_ledger_corrupt entry.

Rebased onto #248: what adapted

The 7 commits were replayed onto 15a6ba6. Conflicts, per commit:

• npm 12 allow-remote (scan/hosted.rs, tests/coverage_fix_scan_hosted_dryrun_vendored.rs). Both sides kept: the .npmrc plumbing and warnings sit beside Consolidated terminal UI and CLI-wide output polish #248's human_warnings / format_warning rendering. The dry-run detail drops its (--dry-run) marker ("allow-remote=all would be written to a new project .npmrc"), following Consolidated terminal UI and CLI-wide output polish #248's pnpm trustLockfile twin: the summary line already says it is a dry run. Both new dry-run tests in the coverage file were kept. The --no-npm-allow-remote-config doc and help heading follow Consolidated terminal UI and CLI-wide output polish #248's help_text_hygiene rules.
• manifest-less VEX (vex.rs, vendor.rs, scan/hosted.rs). vex.rs was rebuilt from Consolidated terminal UI and CLI-wide output polish #248's version with this branch's semantics on top. ui::plural replaces the branch's private plural. Omissions use Consolidated terminal UI and CLI-wide output polish #248's format_omission_warning (Warning: omitting <purl> from VEX: <phrase> (<tag>)), with phrases for the new reasons. The manifest-less apply --vex / vendor --vex lines go through format_vex_written / format_vex_dry_run_skip. Record fetches show a ui::StatusLine progress line. Manifest-less vex honours --dry-run and -O -. The hosted.rs conflicts were comments only.
• tests (e2e_vex.rs, covgap_commands_vex.rs). The omission assertions use Consolidated terminal UI and CLI-wide output polish #248's format. The corrupt-vendor-ledger tests keep this branch's vendor_ledger_corrupt hard error.
• docs (CLI_CONTRACT.md). Two paragraphs were merged word by word: Consolidated terminal UI and CLI-wide output polish #248's plurals plus this branch's embedded-record and detached text. Consolidated terminal UI and CLI-wide output polish #248's CHANGELOG entries are intact.

Rebased onto #249 + #250: what adapted

The 9 commits were replayed onto fce6fe66 (#249) and then e0246295 (#250) with no conflicts and no code changes. After the #250 replay, the branch's diff against its pre-rebase head is exactly main's #250 diff. Checked against the new rules:

• A rebuilt vendored artifact (Harden vendored-mode trust in patch-service artifacts #249) is persisted through persist_vendor_entry, which embeds the patch record on every entry, in both vendor and repair. Harden vendored-mode trust in patch-service artifacts #249's "only persist a rebuilt entry over one with the same patch uuid" filter runs before that.
• Harden vendored-mode trust in patch-service artifacts #249 added no ledger fields. Its refreshed fingerprints (gem file list, maven/nuget sha256, nuget lock pin) are what this branch's verify reads.
• The socket-patch.vendor.json marker a rebuild leaves stale is never a trust input for VEX.
• The branch never builds a service config, so Harden vendored-mode trust in patch-service artifacts #249's service_offline_conflict and Keep vendored re-runs idempotent across patch-service outages #250's outage-idempotence paths are untouched by it.
• CHANGELOG [Unreleased] keeps one section per kind.

Review feedback addressed

Folded into the commit each belongs to:

• Bugbot: workspace-member npm aliases (commit 5). npm_alias_copies only walked <cwd>/node_modules, so a pristine alias install in a workspace member (packages/a/node_modules/lp → left-pad) beside a patched root copy was never hashed and the package attested. It now walks every tree NpmCrawler::get_node_modules_paths returns (root, each workspace member, nested trees); --global-prefix walks the prefix and a plain --global still relies on the identity fallback. New tests: npm_alias_copies_walks_every_workspace_members_tree (unit) and e2e_vex_lockfile::npm::workspace_member_alias_beside_a_patched_root_copy_is_evidence (pristine or tampered member alias → hash_mismatch, exit 1; all copies patched → attested).
• Bugbot: PDM capstone cache (commit 7). The PDM VEX capstone's Swatinem/rust-cache step gains save-if: ${{ github.ref == 'refs/heads/main' }}, like every other cache step this branch adds.
• CodeQL rust/cleartext-logging ×2 (commits 4, 6). Both flagged messages printed a string built from a patch uuid. They, and 11 more uuid/token flows found by scanning every assertion message the branch adds, now name the purl, marker, mode or constant instead.
• Windows: pnpm vendored cells (commits 6, 9). The captured pnpm locks under core/tests/fixtures/pnpm-hosted/** were checked out as CRLF on Windows, which vendor refuses by design (vendor_lockfile_crlf_unsupported). .gitattributes now marks that tree -text, like the other captured fixture trees.
• Windows: outer_npm_config_layers_are_respected (commits 2, 8). The GitHub Windows image sets npm_config_prefix=C:\npm\prefix machine-wide, which outranks the test's PREFIX; the test now pins npm_config_prefix itself. Reading @npmcli/config 12.1.0 for this also found real product gaps, now fixed in npmrc.rs: PREFIX / DESTDIR / HOME are case-insensitive on Windows (home falls back to USERPROFILE); ${VAR} in config paths is expanded (a port of npm's env-replace, so the Windows installer's prefix=${APPDATA}\npm resolves); ~\ expands only on Windows; the builtin npmrc is found beside the node binary, not under PREFIX; and displayed paths drop the \\?\ prefix. Covered by simulated-Windows unit tests with outputs captured from npm's own code.
• test-release timeout (commits 6, 7). Every tests/*.rs file is its own optimized link and the job builds the graph twice; the branch had added 34 test binaries. The new suites now share two multi-module binaries (tests/e2e_vex_lockfile/, tests/e2e_vex_build/), so the branch adds 9, and test-release goes from 30 to 40 minutes. Locally, a cold cargo test --workspace --all-features --profile ci-release --no-run builds 249 test executables (274 before; 240 on main) in 8m32s on a 14-core macOS machine. That run is not comparable to CI's 4-core runner, where the same step took 15m59s for 274 binaries before the change; the first CI run on this head gives the real number.

Shared readers: one lockfile traversal layer

Discovery and the lock inventory (vendor::lock_inventory, which backs the scan / get supplement, the vendored fetch inventory and repair's recovery) read each lockfile format through ONE reader. That reader yields every entry, Socket-owned ones included. The inventory's registry views drop the Socket-owned entries, and discovery's extractors classify and validate them. Each consumer still chooses its own files and does its own I/O: discovery reads every present file through its recognizing ctx (rule 11), and the inventory keeps its precedence chains.

lock_inventory is now a directory module with one file per format. Each file has three parts: a pure entry model, a file-selection section that only stats files, and the registry view. Architecture tests enforce three things:

• that layering;
• extractors read file content only through the ctx;
• the npm-family extractors never call the grammar primitives the models wrap.

Format	Shared reader
package-lock / npm-shrinkwrap	lock_inventory::npm_lock_nodes
pnpm-lock.yaml / shrinkwrap.yaml / Rush	lock_inventory::pnpm::pnpm_packages over the hosted rewriter's pnpm grammar (every key generation, CRLF included), classify_pnpm_key, rush_lock_rels
yarn classic / berry	lock_inventory::yarn::{classic_entries, berry_entries}. One berry locator (parse_berry_locator), one cache-key and checksum rule, and one multi-descriptor key splitter, shared by the hosted rewriter, the vendored berry backend and discovery
bun.lock / bun.lockb	lock_inventory::bun::bun_text_entries over the backends' fail-closed vendor::bun_lock_text line grammar; BunLockb::parse_packages (also used by bun_lock's vendor paths and the trust anchor)
Cargo.lock / .cargo/config*	cargo_lock::locked_packages. cargo_config's [patch] and [registries] walks and effective-config probe, which the writers read through too
go.mod / go.sum	go_mod_edit's read helpers (normalize_for_read, block_structure_error, hosted_module_uuid), go_sum_edit::go_sum_lines / is_h1_dirhash
Gemfile.lock / Gemfile	vendor::gemfile_lock, a new model covering sections, checksums, remotes and lock names. vendor::gem::gem_declaration_any and discovery's source-block grammar, now also used for ledger liveness
composer.lock	lock_inventory::composer_lock_packages. The composer writer's lock walks use its array index too
uv / pylock / poetry / pdm / Pipfile.lock / requirements / Hatch	utils::python_lock (uv source fields, script-lock pairing), utils::poetry_lock, lock_inventory::pypi::parse_pipfile_lock, utils::hatch::dependency_specs. utils::requirements, a lexer lifted out of the vendored planner, now provides the exact-pin rule for the inventory, discovery and the planner. There is one hosted pypi URL grammar for the Pipfile.lock inventory and discovery
pom.xml / nuget.config / packages.lock.json	two new readers, vendor::maven_pom and vendor::nuget_config; nuget_feed::nuget_lock_entries, shared by discovery and the feed writer
pins and purls	utils::digest (SRI pin rule, hex digest shapes) and utils::purl's validating builders, shared by discovery, the inventory, ledger recovery and the rewriters

Discovery's own duplicates are gone as well. DiscoverCtx::locate classifies a lock location once for every extractor (vendored path, hosted uuid, decorated leaf). There is one Wired type, one set of vendor-dir predicates and one JSON / TOML parse-and-diagnose helper.

Ledger liveness is one rule, Discovery::{wires_package, vendor_entry_live, redirect_record_live}. Each call site holds it through LedgerLiveness: the sorted redirect-ledger files, plus the lock inventory, loaded lazily and at most once.

• It gates vex attestations.
• It drives scan's takeover classification, hosted_wiring_retained and redirectState.wiringLive.
• It reads every lock's entry for a package. A PEP 723 script lock that resolves the package from PyPI therefore no longer vetoes the project lock's hosted entry.

Cargo crates.io provenance is an explicit LockfileEntry::source_kind; it is no longer inferred from the checksum variant. The CLI shares one purl splitter, one vendor-ledger lookup and one npm identity crawl across vex, scan and vendor.

Integration round (after #248). The refactor's second pass removed the last parallel walkers that the duplication maps had found. There are 16 fixups, all folded into commits 4–9:

• bun discovery now uses the strict shared grammar instead of its own lenient JSONC reader;
• the berry key splitter is shared by the rewriter, the vendored backend and discovery;
• requirements exact pins and the Pipfile.lock hosted-URL grammar are each defined once;
• pnpm entry fields are read once;
• Gemfile liveness uses discovery's source-block grammar;
• liveness reads every lock entry.

The same round moved the reason a patch was gated into warnings[], so --json keeps it (see "Behavior changes").

Line counts

Production lines are non-blank lines with tests, #[cfg(test)] items and golden harnesses excluded. "Before" is the pre-refactor head of this branch; "after" is e3d0ca9 (commit 8 at the time, before the #249 / #250 rebases, which changed none of these files' production code).

Area	Before	After	Code only (no comments)
vex/discover/*	8,285	7,349 (−936, −11%)	6,120 → 5,223 (−897)
vendor/lock_inventory (main: 2,262 in one file)	2,166	2,696 (+530)	1,643 → 1,961
CLI vex_sources.rs + vex_consumed.rs	1,429	1,422	1,107 → 1,090
new shared readers (maven_pom, nuget_config, utils::digest)	—	566
every changed production file (74)	64,256	65,074 (+818)	48,696 → 48,922 (+226)

The refactor is not a net line reduction. Each format now has one traversal; the duplicated walkers are gone from discovery and the scanners. lock_inventory and the writer modules gained the entry models, which yield every entry kind rather than just the registry ones, plus their docs.

Equivalence proof (golden snapshots)

Before any code moved, the refactor recorded golden snapshots on the pre-refactor tree:

• discovery output for 182 committed fixture projects plus every unit-test call;
• a tap on every lock-inventory entry point;
• the ledger-liveness verdicts;
• the manifest-less vex CLI output (exit code, envelope and document) for every hermetic e2e call.

Every later step had to keep them byte-identical. Old-vs-new differential copies of each consolidated function also ran during the work. Comparing the final tree against those baselines:

Golden set	Baseline files	Byte-identical	Changed
discovery	435	433	2, both bun (below)
lock inventory	514	512	2, the same bun tests
ledger liveness	435	433	2, the same bun tests
CLI vex	244	174	70, each ONLY by an added warnings[] array (checked by deleting every warnings key and comparing)

The only behavioral change is intended. A hand re-indented bun.lock used to be read by discovery's own JSONC parser, while every other command refused it. It is now lockfile_unparseable, the same as everywhere else (reformatted_jsonc_lock_is_still_read became reformatted_lock_is_refused_like_every_other_reader). The CLI warnings[] additions are the new gating-reason warnings. No existing test assertion was loosened.

That scaffolding was about 460k lines of generated JSON, so it is not committed. Commit 9 keeps a compact regression pin instead: discovery output for the 182 committed fixture projects, one JSON file per fixture family (13 files, about 3.8k lines). It is regenerated with SOCKET_PATCH_UPDATE_GOLDEN=1 cargo test -p socket-patch-core --lib vex::discover::testing::golden, and a fixture without an entry (or an entry without a fixture) fails.

Left separate on purpose:

• validation that differs by design: discovery's root-anchored vendor paths and host allowlist versus the writers' ownership checks, discovery's strict go.mod block rule, and maven/nuget version handling;
• the remaining writer-side scanners: the maven_repo / redirect pom regexes, the nuget_feed / redirect key harvesters, wired_vendor_integrity's line windows and vendored_entry_in_use. Moving them onto the shared readers changes writer behavior, so each needs its own commit with a reviewed golden diff (follow-up).

Design

• Discovery (core, vex::discover/). It is read-only, never uses the network and never fails the run: a malformed file becomes a diagnostic. There is one extractor per PM family:

  • npm (package-lock / shrinkwrap, pnpm every lock generation plus Rush);
  • yarn classic and berry;
  • bun (bun.lock / bun.lockb);
  • cargo;
  • golang (go.mod / go.work plus sums);
  • pypi locks (uv, PEP 723 script locks, pylock, poetry, pdm);
  • other pypi sources (Pipfile.lock, requirements plus -r, Hatch / PEP 621 direct refs);
  • gem, composer, maven, nuget;
  • deno, which is explicitly empty.

  The result is Discovery { refs, diagnostics, recognized, unlocked_pins, elsewhere }. Every root file is read; there is no precedence chain, because the hosted rewriter edits every candidate it finds.

• Fail-closed validation. Every value is committed, tamperable data:

  • Hosted URLs: only https://patch.socket.dev or the configured --patch-server-url origin, with no userinfo. The uuid is the last canonical path segment, because grant tokens can be uuid-shaped.
  • Vendored paths: root-anchored .socket/vendor/<eco>/<uuid>/… whose leaf names the entry's own artifact.
  • Pins, not definitions. A registry, index or source definition alone never makes a ref.
  • Contested locks. A lock that resolves the same name@version from a non-Socket source drops the ref (patched_ref_unattributable).
  • Lockless pins. A lockless cargo pin or exclusive nuget mapping (UnlockedPin) can keep a ledger record live but never creates a ref.

• Record resolution (CLI, vex_sources.rs). Sources are tried in order: manifest, redirect ledger, vendor-ledger embedded record, then (online only) the patch API by uuid. Fetches run 10 at a time with get's 401/403 → public-proxy fallback.

  • The uuid the lockfile actually wires beats a stale manifest or ledger uuid.
  • The socket-patch.vendor.json marker is never a record.

• Evidence.

  • Vendored: the committed artifact is hashed.
  • Hosted: the installed copy the build consumes is hashed. That means the Go replacement module, the Socket-registry cargo src dir, or maven's suffixed version, never a pristine sibling. Installed evidence wins.
  • With nothing installed, the lockfile integrity pin is the evidence, the same as in-run scan --mode hosted --vex.
  • Discovered refs bypass the Property 7 ecosystem filter.

• Liveness gates. These run before hashing and are still enforced under --no-verify, which now skips only the hashing:

  • vendor_unwired / redirect_unwired: the ledger record's lockfile wiring is gone. Discovery is authoritative for every uuid a read file mentions, so a rejected mention keeps nothing alive.
  • wiring_conflict: the lockfiles wire one package to several patches.
  • record_mismatch: the record names a different package or uuid.
  • record_unavailable: offline, 404, refused or a transport error. The run continues.

• Product auto-detect. Adds go.mod, composer.json, pom.xml, a single *.csproj and a single *.gemspec, after the existing probes.

npm 12 .npmrc allow-remote auto-config

The decision was: fix the .npmrc and warn; respect explicit values; add an opt-out flag; make it revertible.

• Trigger. A scan --mode hosted / get --mode hosted run that leaves a root package-lock.json / npm-shrinkwrap.json carrying a granted hosted artifact URL. The run then ensures allow-remote=all in the project .npmrc:

  • It creates the file, or appends one line, preserving the BOM, CRLF and every other byte.
  • It records the edit in the redirect ledger as redirect_npmrc_allow_remote (created / added).
  • Every npm hosted run warns redirect_npm_allow_remote with the tradeoff: all admits every url-resolved dependency tree-wide, while each entry's sha512 pin stays enforced.

• Explicit values are respected and named in the warning. Any explicit non-all value in:

  • the project .npmrc;
  • the user, global or builtin npm config, located the way @npmcli/config does;
  • an npm_config_allow_remote env var, which beats every .npmrc.

  A symlinked, unreadable or bare-CR .npmrc is left alone, with a manual-remedy warning.

• Opt-out. --no-npm-allow-remote-config / SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG.

• Grammar. Follows npm's bundled ini exactly, measured on npm 12.1.0 and cross-checked against ini 6.0.0 / 7.0.0:

  • only the exact key allow-remote counts;
  • the last top-level assignment wins, and [section] bodies are not top-level;
  • a bare CR ends a line;
  • a section header only counts on the untrimmed line;
  • the value is case-sensitive.

• Revertible. Every reversal removes exactly what was added, once no package-lock entry needs it:

  • the whole-ledger replay (a new NpmrcAllowRemote inverse);
  • the per-purl npm revert behind scoped rollback / remove / the vendored takeover ("last one out", same transaction);
  • the vendored-supersedes-hosted reconcile.

  A created file the user has since modified keeps the user's lines (redirect_npmrc_allow_remote_modified, surfaced by rollback, remove, vendor and the reconcile). A symlinked .npmrc refuses an unwind at plan time, before anything is written.

• Safety. Never written on --dry-run; the dry run previews the write, including for a vendored → hosted takeover. Mode-preserving atomic writes create the stage with the destination's permission bits, so a 0600 token-bearing .npmrc is never staged world-readable.

Output conventions

The human output this branch adds uses #248's mechanisms:

• The omission line is Consolidated terminal UI and CLI-wide output polish #248's Warning: omitting <purl> from VEX: <phrase> (<tag>), with phrases for the new reasons (record_unavailable, record_mismatch, vendor_unwired, redirect_unwired, wiring_conflict).

• Omissions are sorted by purl, so stderr and the skipped events are deterministic.

• Plan notes are sorted, deduplicated and start with a capital letter.

• Counts use ui::plural. Record fetches show a ui::StatusLine (Fetching patch records... (n/total)), which is silent under --json / --silent.

• Manifest-less VEX lines use Consolidated terminal UI and CLI-wide output polish #248's format_vex_written / format_vex_dry_run_skip.

• The npm caveat prints as Warning (redirect_npm_allow_remote): ….

• Failed VEX runs carry the discovery diagnostics into warnings[] (standalone, embedded and scan JSON envelopes). The reason a patch was gated is there too:

  • why a wired patch has no record: vex_record_offline, vex_record_not_found, vex_record_fetch_failed;
  • a stale-credential fallback to the public proxy: api_auth_fallback, the same text as get / scan;
  • vex_wiring_conflict, vex_record_superseded and vex_claim_unwired.

  A failed embedded --vex adds one vex_omitted per omitted patch to the host command's warnings[], and --silent lists the omissions under the error.

Per-PM × version support matrix

Every PM is supported in both hosted and vendored modes, except as noted. "Hermetic" means the wiremock-backed <pm> module of the one e2e_vex_lockfile test binary (tests/e2e_vex_lockfile/<pm>.rs; run one with cargo test -p socket-patch-cli --test e2e_vex_lockfile <pm>::), in the default test job on all 3 OSes. "Real-PM" means the gated suites in CI's e2e matrix, the dedicated matrix jobs or the per-PM compatibility workflows; every real-PM flow ends in the manifest-less VEX matrix, with these cells:

• manifest absent;
• ledgers deleted;
• --offline → record_unavailable with zero requests;
• reverted lock, never attested, with or without --no-verify;
• legacy-manifest where vendored.

PM	Hosted	Vendored	Hermetic suite	Real-PM versions (CI)
npm	✓ (npm 12: auto .npmrc; npm 6: fails closed, redirect_npm_legacy_client)	✓ (npm 12 dual-lock: both locks rewired)	e2e_vex_lockfile::npm, redirect_npm_allow_remote	6.14.18, 7.0.0, 7.24.2, 8.19.4, 9.0.0, 9.9.4, 10.9.9, 11.20.0, 12.0.0, 12.1.0 (npm-compatibility.yml)
pnpm	✓	✓	e2e_vex_lockfile::pnpm	e2e_redirect_pnpm_build (3 OS), pinned vendored matrix, pnpm-compatibility.yml, Rush sim
yarn classic	✓	✓	e2e_vex_lockfile::yarn_classic	1.0.2, 1.6.0, 1.7.0, 1.9.4, 1.10.1, 1.22.22 (yarn-classic-matrix)
yarn berry	✓	✓ (needs a resolutions mapping)	e2e_vex_lockfile::yarn_berry	4.0.2, 4.1.0, 4.6.0, 4.12.0, 4.18.0 (+ macOS/Windows); 2.x/3.x refused lanes (yarn-berry-e2e)
bun	✓	✓	e2e_vex_lockfile::bun	1.3.14 redirect/vendor; bun.lockb 1.0.36 / 1.1.45; mode_migration 1.1.45 / 1.2.23 (bun-compatibility.yml)
cargo	✓	✓	e2e_vex_lockfile::cargo	toolchains 1.82.0 / 1.93.1 / stable × Cargo.lock v1–v4 (+ macOS/Windows v1) (cargo-vex-matrix)
golang	✓	✓ (+ go-patches)	e2e_vex_lockfile::golang	1.18.10, 1.21.13, 1.24.13, 1.26.3 (go-compatibility.yml); go.work build suite
uv	✓	✓	e2e_vex_lockfile::uv	16 releases, 0.1.45 → 0.12.17; uv backtest
poetry	✓	✓	e2e_vex_lockfile::poetry	1.0.10, 1.1.15, 1.8.5, 2.0.1, 2.4.3 (poetry-compatibility.yml)
pdm	✓	✓	e2e_vex_lockfile::pdm	1.4.5, 1.15.5, 2.7.4, 2.8.2, 2.25.9, 2.29.2 (lock 3.1 and 4.0–4.2 refused)
hatch	✓	✓	e2e_vex_lockfile::hatch	1.0.0, 1.2.1, 1.9.7, 1.14.2, 1.18.1
pipenv	✓	✓	e2e_vex_lockfile::pipenv	2022.12.19 → 2026.8.0
pip (requirements)	✓	✓	e2e_vex_lockfile::pip	pip 22–26
gem	✓	✓	e2e_vex_lockfile::gem	bundler 1.17.3, 2.1.4, 2.2.33, 2.5.23, 2.6.9, 2.7.2, 4.0.15, 4.0.21; docker vendored gem
composer	✓	✓	e2e_vex_lockfile::composer	composer 1, 2.2 LTS, 2
maven	✓	✓ (jar + .sha1 required)	e2e_vex_lockfile::maven	3.6.3, 3.8.9, 3.9.16, 4.0.0-rc-6
nuget	✓ (needs a packages.lock.json entry or an exclusive mapping)	✓	e2e_vex_lockfile::nuget	dotnet 6, 7, 8, 9, 10
deno	—	—	e2e_vex_lockfile::deno (negative)	1.46.3, 2.9.7 (agent mode + setup.manual only)

Cross-cutting suites: e2e_vex_lockfile::manifestless_embedded, e2e_vex_redirect, e2e_vex_vendor, e2e_vex_lockfile::common_selftest, and the core polyglot test (a root with every PM discovers the union).

Real-PM spot checks (local macOS, all green). At this HEAD (78a9f557), after the review fixes: npm 12.1.0 hosted + vendored capstones (e2e_redirect_npm_build, e2e_vendor_npm_build) 24/24. The rest are from the final code before the whitespace-only fmt fixups and the test-only golden slimming:

PM	Version(s)	Result
npm	12.1.0	hosted + vendored capstones (e2e_redirect_npm_build, e2e_vendor_npm_build) 24/24
pnpm	10.34.5	pinned matrix: hosted and vendored 3/3
yarn berry	4.12.0, plus 2.4.3 / 3.8.7 refusal lanes	103/103 cells
yarn classic	1.22.22	65/65 cells
bun	1.3.14	hosted + vendored 26/26
cargo	1.93.1	lock v1 10/10, lock v4 10/10 (redirect, vendor, mode migration)
go	1.26.3	53/53 (build, hosted, workspace, vendored)
uv	0.11.19 (Python 3.12)	hosted 14/14, vendored 18/18
bundler	4.0.15	hosted + vendored 25/25
maven	3.9.16	hosted and vendored builds 2/2
dotnet	8.0	nuget build 2/2

The uv leg needs SOCKET_PATCH_UV_E2E_PYTHON set to a Python ≥ 3.9. Without it, uv picked this machine's Python 3.8 and hosted_uv_export_pylock_manifestless_vex stopped at setup (pylock.toml requires >=3.9). That is an environment issue, not a product one.

Earlier rounds (local macOS, all green): after the first refactor pass, the same eleven PMs. After the #248 rebase, npm 12.1.0 and pnpm 10.34.5. After the #247 rebase, npm 10.9.9 / 12.1.0, pnpm, both yarns, cargo, go, uv and bundler. Before the rebases, the full per-version matrices above were run per PM. At this HEAD they run in CI.

Behavior changes

• BREAKING (v5): a ledger record attests only while a lockfile still wires it, even under --no-verify / --vex-no-verify. Those flags now skip only the hashing.
• BREAKING: a malformed or unreadable .socket/vendor/state.json is vendor_ledger_corrupt for vex (exit 2; the host command fails under --vex).
• New: hosted npm runs write allow-remote=all to the project .npmrc (or respect and name an explicit value) and always warn redirect_npm_allow_remote. New flag --no-npm-allow-remote-config / SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG. New ledger kind redirect_npmrc_allow_remote and warning redirect_npmrc_allow_remote_modified. Commit the .npmrc with the lock.
• New skip reasons: record_unavailable, record_mismatch, vendor_unwired, redirect_unwired, wiring_conflict.
• New run-warning codes: lockfile_unreadable, lockfile_unparseable, patched_ref_invalid, patched_ref_unattributable, vex_record_offline, vex_record_not_found, vex_record_fetch_failed, vex_wiring_conflict, vex_record_superseded, vex_claim_unwired, vex_omitted; also api_auth_fallback on vex.
• The shared readers change a few edge cases, each named in the CHANGELOG:
  • Lock inventory:
    • a v1 Cargo.lock's [metadata] checksums now verify a crates.io fetch;
    • requirements.txt is read as pip's logical lines;
    • a wildcard pin (six==1.*) is not an exact version;
    • a Pipfile.lock hosted reference to an sdist, an http:// origin or a path-prefixed origin stays inventoried;
    • a CRLF pnpm-lock.yaml is inventoried;
    • a poetry.lock / pdm.lock / Cargo.lock that is not valid TOML contributes nothing.
  • Discovery: a hand re-indented bun.lock is lockfile_unparseable.
  • Vendored berry backend: a multi-descriptor key that mixes the patched package with another descriptor is refused as vendor_override_conflict.
  • scan liveness: a commented-out Gemfile source … do block no longer keeps a reverted record alive.
• manifest_not_found (exit 2) now means no manifest AND nothing wired.
• apply --vex / vendor --vex without a manifest now attest what the lockfiles and ledgers wire. A project with nothing wired keeps the calm exit 0 and removes a stale document. apply --check and --dry-run never generate.
• Discovery also runs under --global / --global-prefix, because it gates the ledgers read from --cwd.
• The standalone vendor embeds the patch record in every ledger entry.
• Rewriter fixes (each pinned by a core regression test):
  • composer hosted drops a source block that precedes dist; otherwise composer 1 / 2.2 silently installed the pristine commit from git. A hand-ordered source that can't be dropped warns redirect_composer_source_kept.
  • gem hosted puts the GEM section in bundler's source order (frozen installs on bundler ≥ 4.0.19).
  • cargo hosted and vendored now handle a v1 Cargo.lock.
  • yarn 4.0.0–4.0.2 checksums keep the lock's own spelling (YN0028 otherwise).
  • npm 12 dual-lock vendoring, with the new warning vendor_npm_sibling_lock_unwired.
  • npm lockfileVersion 1 hosted warns redirect_npm_legacy_client.

Limitations and follow-ups

• Root only. Not read:
  • nested workspace-member locks (Rush pnpm locks are the exception);
  • maven parent poms or submodules;
  • Gradle;
  • $CARGO_HOME or parent cargo configs;
  • user-level nuget configs.
• Online fetch. A record must be fetched online when neither the manifest nor the ledgers are committed. --offline gives record_unavailable.
• Bun < 1.3.10. A hosted entry re-saved without its digest attests only after install.
• Unsupported shapes.
  • gem platform gems;
  • composer installed.json and COMPOSER=-renamed locks;
  • legacy same-GAV maven hosted repositories.
• Lockless cargo / nuget pins only keep an existing redirect-ledger record alive; they never create a ref on their own.
• npm allow-remote=all is tree-wide, which is npm's granularity; the per-entry sha512 pins stay enforced. A user-level allow-remote=none is respected, so npm 12 then refuses the hosted install until the user changes it (the warning says so).
• Follow-ups:
  • --vex on get --mode hosted|vendored;
  • member-lock discovery;
  • Gradle;
  • regenerating the pdm / pipenv / poetry backtest results tables for Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's footprint (carried over from Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247).

Test evidence

Final local gate on feat/vex-lockfile-inventory (HEAD 78a9f557, after the review fixes and the #249 / #250 rebase) (macOS arm64, CARGO_INCREMENTAL=0). The branch is based on origin/main = e0246295 and the tree is clean.

Check	Result
cargo clippy --workspace --all-features --all-targets -- -D warnings	clean
cargo test --workspace --all-features --profile ci-release --no-run	builds: 249 test executables (274 before the consolidation, 240 on main), 8m32s cold
cargo test --workspace --no-fail-fast	exit 0, 8,682 passed, 0 failed, 135 ignored, across 251 test binaries. core: 4,744 passed (30 binaries, 1 ignored; lib 4,303 including #249 / #250's). cli: 3,938 passed (219 binaries, 133 ignored, which are the gated real-PM / network suites; lib 786). doc-tests: 0 run, 1 ignored. vexctl was not on PATH for this run, so the vexctl conformance step self-skipped (it ran in the earlier gate below and runs in CI)
rustfmt	the review fixes changed only their own hunks; no cargo fmt --all
CodeQL guard	a scan of every macro message the branch adds finds no uuid / token flow into assert! / panic! / println! / eprintln! (4 hits, all checked by hand: string literals only)
per-commit build	cargo check --workspace --all-features --all-targets passes on commits 2, 5 and 6, the ones the review fixups changed code in

Earlier gate (HEAD faf9ed3, on 15a6ba6). The rows below were not re-run at this HEAD; the review fixes touch none of the scripts or dispatch files, and actionlint was re-run on the edited workflows with the same result:

Check	Result
cargo test --workspace --no-fail-fast (vexctl v0.3.0 on PATH, SOCKET_PATCH_GO_E2E_REQUIRED=1, like CI)	exit 0, 8,503 passed, 0 failed, 135 ignored, across 276 test binaries
rustfmt	every new file is formatted. In the 4 changed files where this branch had added unformatted hunks, those hunks were fixed (8 hunks, folded into their commits); the other hunks in those files are main's own, untouched as the repo rules require
golden snapshots	see "Equivalence proof"
scripts/release-lint.sh --sync-only	OK (4.0.0 everywhere)
npm dispatch tests (node --test npm/socket-patch/bin/socket-patch.test.mjs)	4/4
pypi dispatch tests (python3 pypi/socket-patch/test_dispatch.py)	9/9
python3 -B -m unittest discover -s scripts/tests	15 OK, 1 skipped
shellcheck: --shell=sh scripts/install.sh, the release scripts, and the new scripts/{uv,yarn-berry,yarn-classic}-vex-matrix.sh	clean
actionlint	same 8 findings as main (pre-existing ci.yml shellcheck infos; one line number shifts)

Not run locally, left to CI: the Linux and Windows test legs, test-release, coverage, e2e-docker, hosted-e2e (production credentials), and the full per-version matrices.

How to review

The commits are meant to be read in order, oldest first. Each one builds on its own:

1. e31da367 fix(core): hosted/vendored rewriter fixes found by the real-PM matrices. Seven independent rewriter bugs, each with a core regression test. It is small and has no VEX code, so it is a good warm-up.
2. 60ddaf82 feat(hosted): auto-configure npm 12 allow-remote in the project .npmrc. Start at core/src/patch/redirect/npmrc.rs (the grammar, the plan and the unwind). Then read replay.rs / takeover.rs, then cli/src/commands/scan/hosted.rs and remove.rs. Tests: tests/redirect_npm_allow_remote.rs.
3. 56d791fa refactor(core/vendor): split lock_inventory into per-format submodules. A verbatim move of main's file. Only imports, visibility, module docs and section banners change, and git show --color-moved shows everything else as moved. It exists so that the next commit's inventory changes can be read per format.
4. 52e71ee4 feat(core/vex): discover hosted and vendored patch references from lockfiles.
   • Start at core/src/vex/discover/mod.rs: the types, the orchestrator, DiscoverCtx::locate, contested locks, recognized, and the liveness rule with LedgerLiveness.
   • Then read one extractor per family; npm.rs and pypi_locks.rs are the largest. Also read patch::redirect::hosted_patch_uuid.
   • This is the security-sensitive surface. Look for anything that turns a definition, a foreign host or an out-of-root path into a ref.
   • The shared readers are the entry models in vendor/lock_inventory/*, plus vendor/{gemfile_lock, maven_pom, nuget_config, cargo_config, go_mod_edit, go_sum_edit, yarn_berry_lock, yarn_classic_lock, bun_lock_text}.rs and utils/{digest, purl, requirements, python_lock, hatch}.rs.
5. 4868030a feat(vex): manifest-less VEX.
   • cli/src/commands/vex_sources.rs: the record view, the API fetch and the gating-reason warnings.
   • vex_consumed.rs: hosted evidence.
   • vex.rs: the liveness gates and the output.
   • The embedded paths in apply.rs / vendor.rs / scan.
   • Also vendor_record_is_unowned, the product probes, and scan/mod.rs's classify_overlap_takeover / hosted_wiring_retained_purls, which now use the core liveness rule through commands::discover_wiring and LedgerLiveness.
6. 4f595bce test(cli): the suites. Mostly mechanical. Worth reading: tests/vex_e2e_common/ (the shared omission oracle) and one hermetic module, for example tests/e2e_vex_lockfile/npm.rs.
7. 75c80e88 ci: the matrices and backtest steps. Covers ci.yml, the new npm / go / poetry compatibility workflows and the scripts/*-vex-matrix.sh drivers.
   • Test-binary budget: every tests/ target is its own optimized link in test-release, so the new suites share two multi-module binaries: tests/e2e_vex_lockfile/ (the 19 hermetic per-PM suites plus manifestless_embedded and common_selftest, a module each) and tests/e2e_vex_build/ (the Poetry / PDM / Hatch / Pipenv / pip / deno real-PM capstones; each e2e matrix leg and pdm-compatibility.yml pick their module with a test_filter such as pdm:: --ignored). The branch adds 9 test binaries instead of 34 (cargo test --workspace --no-run: 249, against 240 on main and 274 before the suites were merged).
   • test-release goes from timeout-minutes: 30 to 40: it builds the graph twice and took ~25m on main already.
   • Every rust-cache step this branch adds saves only on main (save-if), including the PDM VEX capstone.
8. 780d76e5 docs. The CLI_CONTRACT.md sections "Manifest-less VEX (lockfile discovery)" and "Additive warnings", the README, the CHANGELOG [Unreleased] section and docs/testing/npm-compatibility.md.
9. 78a9f557 test(vex): golden snapshot of discovery over committed fixtures. The harness is core/src/vex/discover/testing/golden.rs; the JSON under core/tests/fixtures/vex-discover-golden/ is generated, so skim it.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​denoland/​setup-deno@​22d081ff2d3a40755e97629de92e3bcbfa7cf2ed
	github/​actions/​setup-dotnet@​a98b56852c35b8e3190ac28c8c2271da59106c68

View full report

[cursor]

Stale Bugbot comment from a previous run.

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​denoland/​setup-deno@​22d081ff2d3a40755e97629de92e3bcbfa7cf2ed

View full report

[Mikola Lysenko (mikolalysenko)]

BugBot review

[Mikola Lysenko (mikolalysenko)]

Claude (@claude) review

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit faf9ed3. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Pushed 78a9f557: rebased onto main @ e0246295 (#249 + #250, no conflicts; #249's vendored-trust changes checked against the vex/vendor paths, no code changes needed). The review threads are answered inline. The two failing CI jobs on the previous head:

test (windows-latest)

• e2e_vex_lockfile_pnpm: the captured locks under crates/socket-patch-core/tests/fixtures/pnpm-hosted/** had no -text attribute, so the Windows checkout converted them to CRLF and vendor refused them (vendor_lockfile_crlf_unsupported, by design). .gitattributes now marks that tree -text like the other captured fixture trees. The product's CRLF refusal is unchanged.

• redirect_npm_allow_remote::outer_npm_config_layers_are_respected: a test-isolation issue. The runner image sets npm_config_prefix machine-wide, which outranks the test's PREFIX. The test now pins it. Checking against @npmcli/config 12.1.0 also turned up real Windows gaps in the .npmrc layer lookup, now fixed:

  • case-insensitive PREFIX / DESTDIR / HOME, with a USERPROFILE fallback;
  • ${VAR} expansion, a port of npm's env-replace;
  • ~\ expanded only on Windows;
  • the builtin npmrc found beside node;
  • no \\?\ prefix in warnings.

  These are unit-tested against outputs captured from npm's own code, including a simulated Windows resolution. This CI run is the first on real Windows.

test-release (timed out at 30m)

• The job builds the test binaries twice under ci-release, and this PR had added 34 binaries.
• The new suites are now two multi-module binaries: tests/e2e_vex_lockfile/ (one module per PM) and tests/e2e_vex_build/ (real-PM capstones, selected per CI leg by filter). The PR now adds 9 binaries instead of 34 (249 vs 240 on main).
• timeout-minutes goes to 40 as headroom until this run gives a real timing.

Local gate: clippy --all-targets -D warnings clean; cargo test --workspace --no-fail-fast 8,682 passed / 0 failed; npm 12.1.0 hosted and vendored capstones 24/24. No test was dropped by the consolidation: the before/after test-name diff shows only the 5 new tests.