Merge origin/main into agent/fix-hosted-unreadable-candidate

Brings in the vex_consumed alias test fix (#849) that main's red
test/test-release/coverage jobs were waiting on.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: mikolalysenko

.github/workflows/ci.yml

@@ -1017,6 +1017,9 @@ jobs:
           - {os: ubuntu-latest, suite: mode_migration_bun, bun: '1.2.23', test_filter: --include-ignored}
           - {os: ubuntu-latest, suite: e2e_bun_lockb, bun: '1.0.36', test_filter: --include-ignored}
           - {os: ubuntu-latest, suite: e2e_bun_lockb, bun: '1.1.45', test_filter: --include-ignored}
+          # Bun >= 1.4 migrating a hosted workspace bun.lockb to bun.lock
+          # (#803): the only binary-lock test whose reader must be 1.4+.
+          - {os: ubuntu-latest, suite: e2e_bun_lockb, bun: '1.4.2', test_filter: --include-ignored workspace_text_migration_heals_on_rerun}
           # Real-vlt capstones (DESIGN §8.4): wiremock patch service and a local
           # npm registry fed from npmjs, driven by the pinned vlt release
           # (`node vlt.js`, installed below from a sha512-checked `npm pack`).

AGENTS.md

@@ -0,0 +1,13 @@
+# Agent instructions
+
+## CHANGELOG.md is written only at release time
+
+Don't add, edit or delete entries in `CHANGELOG.md` in a feature, fix,
+refactor, CI or docs PR, even if a doc, template or reviewer asks for one.
+The `[Unreleased]` section is written when a release is cut, by the release
+agent, from the PRs merged since the last tag and the code itself. Put the
+details of a change in its commit messages and PR description instead.
+
+If a PR you work on already changes `CHANGELOG.md`, restore that file to its
+merge-base version. The only exceptions are release PRs: a `release/v*`
+branch, or the release train's `release-sync` PR.

CHANGELOG.md

@@ -9,9 +9,11 @@ Pre-v3.0 entries are concise summaries derived from each tag's commit
 history. For full per-release detail, see the
 [GitHub releases page](https://github.com/SocketDev/socket-patch/releases).
 
-Add entries under `[Unreleased]`; its `###` headings set the next version's
-bump (Breaking/Removed → major, Added/Changed/Deprecated → minor, anything
-else → patch). Releases are cut by the release train
+PRs never edit this file. Only the release agent writes `[Unreleased]`, at
+release time, from the PRs merged since the last tag and the code they
+changed. Its `###` headings set the next version's bump (Breaking/Removed →
+major, Added/Changed/Deprecated → minor, anything else → patch). Releases
+are cut by the release train
 ([docs/release-train/DESIGN.md](docs/release-train/DESIGN.md)) with
 `scripts/release.py`: a release candidate's `[Unreleased]` entries become a
 `## [X.Y.Z-rc.N]` section, the rolling `release-sync` PR brings each cut

CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -898,6 +898,32 @@ pub(crate) async fn run_redirect_selected(
             }
         }
     }
+    // A yarn berry pin takes its `bin:` map from the served tarball's own
+    // package.json, the way yarn builds a tarball entry (#718). Only the
+    // berry entries that carry a `bin:` map need it; a tarball that cannot
+    // be fetched or read drops its patch rather than pin an entry yarn
+    // would rewrite on the next install.
+    for dep in engine::yarn_berry_manifest_targets(&candidates, &read.files) {
+        status.set(format!(
+            "Fetching hosted package manifest for {}...",
+            dep.name
+        ));
+        match socket_patch_core::hosted::npm_manifest::fetch_hosted_npm_manifest(
+            api_client,
+            &dep.artifact_url,
+            dep.integrity.sha512.as_deref(),
+        )
+        .await
+        {
+            Ok(manifest) => {
+                python_metadata.insert(dep.artifact_url.clone(), manifest);
+            }
+            Err(detail) => {
+                unavailable_python_artifacts.insert(dep.artifact_url.clone());
+                skipped.push(engine::npm_manifest_unavailable(dep, &detail));
+            }
+        }
+    }
     status.finish();
     candidates.retain(|c| !unavailable_python_artifacts.contains(&c.dep.artifact_url));
     // The Pipfile.lock reference shape depends on the installing Pipenv
@@ -1152,6 +1178,11 @@ pub(crate) async fn run_redirect_selected(
             common,
             &confirmed,
             &rewrite.confirmed_pipenv_uuids,
+            rewrite
+                .files
+                .get("Pipfile.lock")
+                .or_else(|| done.files.get("Pipfile.lock"))
+                .map(String::as_str),
             &records,
         )
         .await
@@ -2236,6 +2267,9 @@ fn describe_skip_reason(reason: &str) -> String {
             "its vendored state could not be reverted (see the warning)".into()
         }
         "python_metadata_unavailable" => "the hosted wheel's metadata could not be fetched".into(),
+        "npm_manifest_unavailable" => {
+            "the hosted tarball's package.json could not be fetched".into()
+        }
         "redirect_bun_lock_unsupported" | "redirect_bun_lockb_invalid" => {
             "the Bun lockfile blocks the vendored-to-hosted migration (see the warning)".into()
         }

crates/socket-patch-cli/src/commands/scan/hosted.rs

@@ -18,11 +18,16 @@ pub(super) async fn stale_install_warnings(
     common: &crate::args::GlobalArgs,
     confirmed: &[(String, String)],
     pipenv_uuids: &BTreeSet<String>,
+    // The run's final Pipfile.lock text: the remedy's `pipenv sync`
+    // arguments follow the categories that pin each package.
+    pipenv_lock: Option<&str>,
     // This run's fetched records MERGED with the ledger's persisted ones
     // (the caller hands the post-merge ledger map), looked up by uuid.
     records: &BTreeMap<String, PatchRecord>,
 ) -> StaleInstallOutcome {
     let mut out = StaleInstallOutcome::default();
+    let pipenv_lock: Option<serde_json::Value> =
+        pipenv_lock.and_then(|text| serde_json::from_str(text.trim_start_matches('\u{feff}')).ok());
     let candidates: Vec<_> = confirmed
         .iter()
         .filter(|(purl, _)| purl.starts_with("pkg:pypi/"))
@@ -111,15 +116,15 @@ pub(super) async fn stale_install_warnings(
                     .and_then(|rest| rest.split('@').next())
                     .unwrap_or("<package>")
                     .to_string();
+                let remedy = socket_patch_core::vendor::pypi_pipenv::stale_install_remedy(
+                    pipenv_lock.as_ref(),
+                    &name,
+                );
                 format!(
                     "Pipenv does not reinstall a release that is already present (`pipenv \
                      install`, `pipenv install --deploy` and `pipenv sync` all keep those \
                      bytes), so the rewritten Pipfile.lock only protects fresh installs. \
-                     Reinstall it from the lock without touching the Pipfile: `pipenv run pip \
-                     uninstall -y {name} && pipenv sync` (`pipenv install --deploy` before \
-                     Pipenv 2018), or `pipenv --rm && pipenv sync` for a clean virtualenv — \
-                     NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the \
-                     patch away; then `socket-patch vex --product <purl>` re-verifies the \
+                     {remedy}; then `socket-patch vex --product <purl>` re-verifies the \
                      installed files."
                 )
             } else {
@@ -194,7 +199,8 @@ mod tests {
             ("one".into(), record("first-uuid", "first.py", b"patched")),
             ("two".into(), record("second-uuid", "second.py", b"patched")),
         ]);
-        let out = stale_install_warnings(&common, &confirmed, &BTreeSet::new(), &ledger).await;
+        let out =
+            stale_install_warnings(&common, &confirmed, &BTreeSet::new(), None, &ledger).await;
         assert_eq!(out.stale_purls, BTreeSet::from([first.to_string()]));
         assert_eq!(out.warnings.len(), 1);
         assert!(out.warnings[0]["detail"]
@@ -209,7 +215,8 @@ mod tests {
             "variant".into(),
         ));
         ledger.insert("three".into(), record("variant", "first.py", b"upstream"));
-        let out = stale_install_warnings(&common, &confirmed, &BTreeSet::new(), &ledger).await;
+        let out =
+            stale_install_warnings(&common, &confirmed, &BTreeSet::new(), None, &ledger).await;
         assert!(out.stale_purls.is_empty());
         assert!(out.warnings.is_empty());
     }
@@ -233,8 +240,66 @@ mod tests {
         let purl = "pkg:pypi/six@1.16.0";
         let confirmed = vec![(purl.to_string(), "six-uuid".to_string())];
         let ledger = BTreeMap::from([("k".into(), record("six-uuid", "six.py", b"patched"))]);
-        let out = stale_install_warnings(&common, &confirmed, &BTreeSet::new(), &ledger).await;
+        let out =
+            stale_install_warnings(&common, &confirmed, &BTreeSet::new(), None, &ledger).await;
         assert_eq!(out.stale_purls, BTreeSet::from([purl.to_string()]));
         assert_eq!(out.warnings[0]["code"], "redirect_pypi_stale_install");
     }
+
+    /// #790: the Pipenv remedy names the lock category that pins the
+    /// package. Plain `pipenv sync` installs only `default`, so for a
+    /// `[dev-packages]` entry it uninstalled the package and left it
+    /// uninstalled.
+    #[tokio::test]
+    async fn pipenv_remedy_resyncs_the_category_that_pins_the_package() {
+        let tmp = tempfile::tempdir().unwrap();
+        let site = tmp.path().join("site-packages");
+        std::fs::create_dir_all(site.join("six-1.16.0.dist-info")).unwrap();
+        std::fs::write(site.join("six.py"), b"upstream").unwrap();
+        let common = crate::args::GlobalArgs {
+            cwd: tmp.path().to_path_buf(),
+            global_prefix: Some(site.clone()),
+            ..Default::default()
+        };
+        let purl = "pkg:pypi/six@1.16.0";
+        let confirmed = vec![(purl.to_string(), "six-uuid".to_string())];
+        let ledger = BTreeMap::from([("k".into(), record("six-uuid", "six.py", b"patched"))]);
+        let pipenv = BTreeSet::from(["six-uuid".to_string()]);
+        let detail = |lock: &str| {
+            let lock = lock.to_string();
+            let (common, confirmed, ledger, pipenv) = (&common, &confirmed, &ledger, &pipenv);
+            async move {
+                let out =
+                    stale_install_warnings(common, confirmed, pipenv, Some(&lock), ledger).await;
+                assert_eq!(out.warnings.len(), 1);
+                out.warnings[0]["detail"].as_str().unwrap().to_string()
+            }
+        };
+
+        let develop = detail(
+            r#"{"_meta": {"pipfile-spec": 6}, "default": {}, "develop": {"six": {"file": "x"}}}"#,
+        )
+        .await;
+        assert!(
+            develop.contains("`pipenv run pip uninstall -y six && pipenv sync --dev`"),
+            "{develop}"
+        );
+        assert!(
+            develop.contains("`pipenv --rm && pipenv sync --dev`"),
+            "{develop}"
+        );
+
+        let docs = detail(
+            r#"{"_meta": {"pipfile-spec": 6}, "default": {"requests": {}}, "docs": {"six": {}}}"#,
+        )
+        .await;
+        assert!(
+            docs.contains("-y six && pipenv sync --categories \"docs\"`"),
+            "{docs}"
+        );
+        assert!(
+            docs.contains("`pipenv --rm && pipenv sync --categories \"packages docs\"`"),
+            "{docs}"
+        );
+    }
 }