feat(vex): manifest-less VEX from hosted/vendored lockfiles + npm 12 allow-remote auto-config (v5)

.gitattributes

@@ -5,3 +5,8 @@
 crates/socket-patch-core/tests/fixtures/redirect/** -text
 
 crates/socket-patch-core/tests/fixtures/pdm-native/*.lock -text
+
+# The captured pnpm 1-12 locks are byte-real: the hosted/vendored rewriters
+# refuse CRLF by design (vendor_lockfile_crlf_unsupported), and the tests
+# derive their CRLF variants from the LF bytes themselves.
+crates/socket-patch-core/tests/fixtures/pnpm-hosted/** -text

.github/workflows/bun-compatibility.yml

@@ -34,6 +34,12 @@ on:
       - 'crates/socket-patch-core/src/utils/process.rs'
       - 'crates/socket-patch-core/tests/fixtures/redirect/npm/bun/**'
       - 'crates/socket-patch-cli/src/commands/get.rs'
+      - 'crates/socket-patch-core/src/vex/**'
+      - 'crates/socket-patch-cli/src/commands/vex.rs'
+      - 'crates/socket-patch-cli/src/commands/vex_consumed.rs'
+      - 'crates/socket-patch-cli/src/commands/vex_sources.rs'
+      - 'crates/socket-patch-cli/src/commands/apply.rs'
+      - 'crates/socket-patch-cli/tests/vex_e2e_common/**'
       - 'crates/socket-patch-cli/src/commands/scan/**'
       - 'crates/socket-patch-cli/src/commands/rollback.rs'
       - 'crates/socket-patch-cli/src/commands/vendor.rs'
@@ -60,6 +66,12 @@ on:
       - 'crates/socket-patch-core/src/vendor/**'
       - 'crates/socket-patch-core/src/patch/redirect/**'
       - 'crates/socket-patch-cli/src/commands/get.rs'
+      - 'crates/socket-patch-core/src/vex/**'
+      - 'crates/socket-patch-cli/src/commands/vex.rs'
+      - 'crates/socket-patch-cli/src/commands/vex_consumed.rs'
+      - 'crates/socket-patch-cli/src/commands/vex_sources.rs'
+      - 'crates/socket-patch-cli/src/commands/apply.rs'
+      - 'crates/socket-patch-cli/tests/vex_e2e_common/**'
       - 'crates/socket-patch-cli/src/commands/scan/**'
       - 'crates/socket-patch-cli/src/commands/rollback.rs'
       - 'crates/socket-patch-cli/src/commands/vendor.rs'

.github/workflows/go-compatibility.yml

@@ -0,0 +1,77 @@
+name: Go patch compatibility
+
+# Real Go releases (1.18 = first with go.work, 1.21, 1.24 = the CI pin,
+# 1.26 = newest) through the hermetic hosted, vendored, go.work and
+# go-patches capstones, each ending in the manifest-less VEX step. The
+# suites use a file GOPROXY, so no network beyond the toolchain download.
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/go-compatibility.yml'
+      - 'crates/socket-patch-core/src/vendor/go*.rs'
+      - 'crates/socket-patch-core/src/vendor/golang.rs'
+      - 'crates/socket-patch-core/src/patch/redirect/**'
+      - 'crates/socket-patch-core/src/crawlers/go_crawler.rs'
+      - 'crates/socket-patch-core/src/vex/**'
+      - 'crates/socket-patch-cli/src/commands/vex*.rs'
+      - 'crates/socket-patch-cli/src/commands/vendor*'
+      - 'crates/socket-patch-cli/tests/e2e_golang_*build.rs'
+      - 'crates/socket-patch-cli/tests/e2e_vendor_golang_build.rs'
+      - 'crates/socket-patch-cli/tests/golang_e2e_matrix/**'
+      - 'crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs'
+      - 'crates/socket-patch-cli/tests/vex_e2e_common/**'
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: go-compat-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  SOCKET_NO_CONFIG: '1'
+  SOCKET_NO_UPDATE_CHECK: '1'
+
+jobs:
+  go:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        go: ['1.18.10', '1.21.13', '1.24.13', '1.26.3']
+        include:
+          # macOS-latest dyld refuses binaries without LC_UUID (Go < 1.24
+          # linkers; see ci.yml's vexctl step).
+          - {os: macos-latest, go: '1.24.13'}
+          - {os: macos-latest, go: '1.26.3'}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - run: rustup show
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          key: go-compat
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: ${{ matrix.go }}
+          cache: false
+      - name: Real-go hosted + vendored flows with manifest-less VEX
+        env:
+          SOCKET_PATCH_GO_E2E_VERSION: ${{ matrix.go }}
+          SOCKET_PATCH_GO_E2E_REQUIRED: '1'
+        # The hermetic manifest-less VEX cells are the `golang::` module of
+        # the shared `e2e_vex_lockfile` binary; its filter goes in a second
+        # command so it does not also filter the build suites' tests.
+        run: |
+          cargo test -p socket-patch-cli --no-fail-fast \
+            --test e2e_golang_hosted_build --test e2e_vendor_golang_build \
+            --test e2e_golang_build --test e2e_golang_workspace_build -- --nocapture
+          cargo test -p socket-patch-cli --test e2e_vex_lockfile -- golang:: --nocapture

.github/workflows/npm-compatibility.yml

@@ -0,0 +1,95 @@
+name: npm hosted/vendored compatibility
+
+# Real npm releases (at least one per major, 6 through 12) through the
+# hermetic hosted (`e2e_redirect_npm_build`) and vendored
+# (`e2e_vendor_npm_build`) capstones, each flow ending in the manifest-less
+# VEX checks. Builds the CLI and both test binaries once; every matrix leg
+# installs one pinned npm and runs them. See docs/testing/npm-compatibility.md.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Compile CLI and npm capstones once
+        run: |
+          cargo test --locked -p socket-patch-cli --test e2e_redirect_npm_build --test e2e_vendor_npm_build --no-run --message-format=json > target-build.json
+          python3 - <<'PY'
+          import json, pathlib, shutil
+          dest = pathlib.Path('target/npm-e2e'); dest.mkdir(parents=True, exist_ok=True)
+          shutil.copy2('target/debug/socket-patch', dest / 'socket-patch')
+          for line in pathlib.Path('target-build.json').read_text().splitlines():
+              item = json.loads(line)
+              name = item.get('target', {}).get('name')
+              if name in ('e2e_redirect_npm_build', 'e2e_vendor_npm_build') and item.get('executable'):
+                  shutil.copy2(item['executable'], dest / name)
+          assert all((dest / n).is_file() for n in ('e2e_redirect_npm_build', 'e2e_vendor_npm_build'))
+          PY
+      - uses: ./.github/actions/upload-artifact
+        with:
+          name: npm-e2e
+          path: target/npm-e2e/
+          if-no-files-found: error
+          retention-days: 7
+
+  install-proof:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # node 16's bundled npm 8 writes the v2 lock for the npm 6 x v2 test.
+          - {npm: '6.14.18', node: '16.20.2'}
+          - {npm: '7.0.0', node: '16.20.2'}
+          - {npm: '7.24.2', node: '16.20.2'}
+          - {npm: '8.19.4', node: '16.20.2'}
+          - {npm: '9.0.0', node: '18.20.8'}
+          - {npm: '9.9.4', node: '18.20.8'}
+          - {npm: '10.9.9', node: '22.22.2'}
+          - {npm: '11.20.0', node: '24.11.1'}
+          - {npm: '12.0.0', node: '24.15.0'}
+          - {npm: '12.1.0', node: '24.15.0'}
+    steps:
+      # Same workspace path as the build job, so the socket-patch path
+      # compiled into the tests (CARGO_BIN_EXE_socket-patch) resolves.
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: npm-e2e*
+          merge-multiple: true
+          path: target/debug
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '24.11.1'
+      - name: Install the pinned npm
+        env:
+          NPM_TEST_VERSION: ${{ matrix.npm }}
+        run: |
+          npm install --prefix "$RUNNER_TEMP/npm-tool" --no-audit --no-fund "npm@$NPM_TEST_VERSION"
+          echo "SOCKET_PATCH_NPM_E2E_BIN=$RUNNER_TEMP/npm-tool/node_modules/.bin/npm" >> "$GITHUB_ENV"
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: ${{ matrix.node }}
+      - name: Hosted + vendored installs, manifest-less VEX
+        env:
+          SOCKET_PATCH_NPM_E2E_VERSION: ${{ matrix.npm }}
+          SOCKET_PATCH_NPM_E2E_REQUIRED: '1'
+          SOCKET_NO_CONFIG: '1'
+          SOCKET_NO_UPDATE_CHECK: '1'
+        run: |
+          chmod +x target/debug/socket-patch target/debug/e2e_redirect_npm_build target/debug/e2e_vendor_npm_build
+          target/debug/e2e_redirect_npm_build --include-ignored --test-threads 4
+          target/debug/e2e_vendor_npm_build --include-ignored --test-threads 4

.github/workflows/pdm-compatibility.yml

@@ -20,6 +20,11 @@ on:
       - 'crates/socket-patch-cli/src/commands/scan/**'
       - 'crates/socket-patch-cli/src/commands/rollback.rs'
       - 'crates/socket-patch-core/tests/fixtures/pdm-native/**'
+      - 'crates/socket-patch-core/src/vex/**'
+      - 'crates/socket-patch-cli/src/commands/vex*.rs'
+      - 'crates/socket-patch-cli/tests/e2e_vex_build/main.rs'
+      - 'crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs'
+      - 'crates/socket-patch-cli/tests/vex_pypi_real_common/**'
   push:
     branches: [main]
     paths:
@@ -83,7 +88,7 @@ jobs:
         # Every stable PDM major family (0.x, 1.x, 2.x) and each 2.x lock-format
         # boundary, on Linux and Windows; macOS samples the ends of the range.
         os: [ubuntu-latest, windows-latest]
-        pdm: ['0.12.3', '1.15.5', '2.0.3', '2.1.5', '2.3.4', '2.6.1', '2.7.4', '2.8.2', '2.9.3', '2.10.4', '2.11.2', '2.17.3', '2.20.1', '2.25.9', '2.29.2']
+        pdm: ['0.12.3', '1.15.5', '2.0.3', '2.1.5', '2.3.4', '2.6.1', '2.7.4', '2.8.2', '2.9.3', '2.10.4', '2.11.2', '2.17.3', '2.20.1', '2.22.4', '2.25.9', '2.29.2']
         include:
           - { os: macos-latest, pdm: '0.12.3' }
           - { os: macos-latest, pdm: '2.8.2' }
@@ -143,3 +148,35 @@ jobs:
             native-pdm/cases/**/pdm.lock
             native-pdm/cases/**/*.log
           retention-days: 14
+
+  # The hermetic Rust capstone (wiremock Socket API that also serves the
+  # hosted wheel) over every PDM release the backtest covers: real hosted +
+  # vendored flows ending in the manifest-less VEX matrix; refused lock
+  # formats (3.1, 4.0-4.2) must attest nothing.
+  capstone:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        pdm: ['0.12.3', '1.0.0', '1.4.5', '1.8.5', '1.15.5', '2.0.3', '2.7.4', '2.8.2', '2.10.4', '2.11.2', '2.17.3', '2.20.1', '2.22.4', '2.25.9', '2.29.2']
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          key: pdm-vex-capstone
+          # Only main writes the cache: 30 PR matrix cells saving would churn
+          # the repo's 10 GiB budget (ci.yml's rust-cache note).
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: '3.12'
+      - run: python -m pip install uv==0.11.19
+      - name: Real-PDM hosted + vendored flows with manifest-less VEX
+        env:
+          SOCKET_PATCH_PDM_E2E_REQUIRED: '1'
+          SOCKET_PATCH_PDM_E2E_VERSION: ${{ matrix.pdm }}
+        run: cargo test --locked -p socket-patch-cli --test e2e_vex_build -- 'pdm::' --ignored

.github/workflows/pipenv-compatibility.yml

@@ -23,6 +23,9 @@ on:
       - 'crates/socket-patch-cli/src/commands/vex.rs'
       - 'crates/socket-patch-core/src/patch/redirect/replay.rs'
       - 'scripts/backtest-pipenv.py'
+      - 'scripts/tests/test_backtest_harnesses.py'
+      - 'crates/socket-patch-core/src/vex/**'
+      - 'crates/socket-patch-cli/src/commands/vex_sources.rs'
       - '.github/workflows/pipenv-compatibility.yml'
   push:
     branches: [main]
@@ -70,6 +73,8 @@ jobs:
           cargo build --locked -p socket-patch-cli
           mkdir -p "$RUNNER_TEMP/bin"
           cp target/debug/socket-patch "$RUNNER_TEMP/bin/socket-patch"
+      - name: Harness unit tests
+        run: python3 -m unittest scripts/tests/test_backtest_harnesses.py
       - name: Run the Pipenv matrix
         env:
           SOCKET_NO_CONFIG: '1'

.github/workflows/pnpm-compatibility.yml

@@ -17,19 +17,22 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - name: Compile CLI and pnpm integration test once
+      - name: Compile CLI and pnpm integration tests once
         run: |
-          cargo test --locked -p socket-patch-cli --test e2e_redirect_pnpm_build --no-run --message-format=json > target-build.json
+          cargo test --locked -p socket-patch-cli --test e2e_redirect_pnpm_build --test e2e_vendor_pnpm_build --no-run --message-format=json > target-build.json
           python3 - <<'PY'
           import json, pathlib, shutil
           dest = pathlib.Path('target/pnpm-e2e')
           dest.mkdir(parents=True, exist_ok=True)
           shutil.copy2('target/debug/socket-patch', dest / 'socket-patch')
+          names = {'e2e_redirect_pnpm_build': 'pnpm-e2e', 'e2e_vendor_pnpm_build': 'pnpm-vendor-e2e'}
           for line in pathlib.Path('target-build.json').read_text().splitlines():
               item = json.loads(line)
-              if item.get('target', {}).get('name') == 'e2e_redirect_pnpm_build' and item.get('executable'):
-                  shutil.copy2(item['executable'], dest / 'pnpm-e2e')
-          assert (dest / 'pnpm-e2e').is_file()
+              name = item.get('target', {}).get('name')
+              if name in names and item.get('executable'):
+                  shutil.copy2(item['executable'], dest / names[name])
+          for n in names.values():
+              assert (dest / n).is_file(), n
           PY
       - uses: ./.github/actions/upload-artifact
         with:
@@ -41,7 +44,7 @@ jobs:
   install-proof:
     needs: build
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -100,3 +103,15 @@ jobs:
           chmod +x bin/socket-patch bin/pnpm-e2e
           export SOCKET_PATCH_PNPM_E2E_SOCKET_BIN="$PWD/bin/socket-patch"
           bin/pnpm-e2e pnpm_pinned_matrix --ignored --nocapture
+      - name: Require vendored lifecycle and manifest-less VEX
+        # pnpm >= 9: full vendored capstone (vendor + get --mode vendored);
+        # 7-8: the legacy lifecycle; 1-6: vendoring refused, nothing attested.
+        env:
+          SOCKET_PATCH_PNPM_E2E_VERSION: ${{ matrix.pnpm }}
+          SOCKET_PATCH_PNPM_E2E_REQUIRED: '1'
+          SOCKET_NO_CONFIG: '1'
+          SOCKET_NO_UPDATE_CHECK: '1'
+        run: |
+          chmod +x bin/socket-patch bin/pnpm-vendor-e2e
+          export SOCKET_PATCH_PNPM_E2E_SOCKET_BIN="$PWD/bin/socket-patch"
+          bin/pnpm-vendor-e2e pnpm_pinned_matrix --ignored --nocapture