fix(bun): preserve patch state on refused mode changes

Author: mikolalysenko

CHANGELOG.md

@@ -268,6 +268,13 @@ into the new version's section — see docs/releasing.md.
 
 ### Fixed
 
+- **Bun refusal safety:** hosted compatibility is checked before removing
+  an existing vendored patch, including during dry-run. Vendored preflight
+  exemptions require live local lock tuples; a ledger retained by
+  `rollback --preserve-state` cannot bypass a refusal or hide it in a preview.
+  Symlinked `bun.lockb` files are refused before migration so their links
+  survive, and `vendor --silent` keeps refusal diagnostics on stderr.
+
 - **Bun projects: every text-lock generation is accepted, vendored refusals
   fire before any write, and every mode change unwinds.** `bun.lock`
   `lockfileVersion` 0 — the opt-in text lock Bun 1.1.39–1.1.45 write with

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -19,9 +19,8 @@ use std::collections::{HashMap, HashSet};
 use std::path::Path;
 
 use socket_patch_core::api::types::PatchSearchResult;
-use socket_patch_core::utils::purl::strip_purl_qualifiers;
+use socket_patch_core::vendor::load_state;
 use socket_patch_core::vendor::state::VendorEntry;
-use socket_patch_core::vendor::{load_state, lookup_entry};
 
 /// The vendor ledger as the preflight consumes it: the caller's own
 /// `load_state` outcome, so an UNREADABLE ledger is a fact the refusal can
@@ -32,18 +31,14 @@ pub(crate) type LedgerLoad<'a> = Result<&'a HashMap<String, VendorEntry>, &'a st
 ///
 /// `exempt` holds the selected purls the refusal must NOT pre-empt — they
 /// flow through to the engine, which lets them in exactly as on a non-Bun
-/// project. A purl is exempt when EITHER
+/// project. A purl is exempt only when `bun.lock` wires every instance of
+/// its `name@version` to one of our `.socket/vendor/npm/` tuples, at any
+/// UUID ([`wired_instances_all_ours`]). This matches the engine's workspace
+/// gate: updating an already-local tuple introduces no new relative path,
+/// so in-sync runs, superseding patches and repairs remain supported.
 ///
-/// * the vendor ledger already wires it at the SAME uuid this run selected
-///   (an in-sync re-run: the engine's `already_vendored` skip), OR
-/// * `bun.lock` already wires EVERY instance of its `name@version` to one
-///   of our `.socket/vendor/npm/` tuples, at any uuid
-///   ([`wired_instances_all_ours`]) — the engine's own criterion for
-///   skipping the workspace gate: rewriting an already-local tuple to a
-///   superseding uuid adds no new workspace-relative path, so a patch
-///   UPDATE on a project vendored before it grew a workspace member (or
-///   the same re-run after a wiped `state.json`) re-vendors in place
-///   instead of dying here with a remedy Bun 1.2/1.3 teams cannot follow.
+/// A matching ledger UUID alone is insufficient: `rollback --preserve-state`
+/// retains the entry after removing its wiring.
 ///
 /// An unreadable ledger exempts nothing (fail closed) and the refusal
 /// itself becomes `vendor_state_unreadable` with the io/parse detail:
@@ -78,7 +73,7 @@ impl BunVendorRefusal {
 
 /// Run the Bun preflight once for `selected` — only when it holds at least
 /// one npm purl, since nothing else can be affected — loading the vendor
-/// ledger at `cwd` for the exemption. `None` means nothing to refuse.
+/// ledger at `cwd` to detect corruption. `None` means nothing to refuse.
 pub(crate) async fn bun_vendor_preflight(
     cwd: &Path,
     selected: &[PatchSearchResult],
@@ -142,7 +137,7 @@ fn selection_pairs(selected: &[PatchSearchResult]) -> Vec<(&str, &str)> {
 }
 
 /// Turn the engine's project-level refusal into the per-purl verdict: the
-/// ledger-or-lock exemption described on [`BunVendorRefusal`], or the
+/// live-lock exemption described on [`BunVendorRefusal`], or the
 /// `vendor_state_unreadable` refusal when the ledger cannot be read.
 async fn refusal_with_exemptions(
     cwd: &Path,
@@ -151,37 +146,30 @@ async fn refusal_with_exemptions(
     pairs: &[(&str, &str)],
     ledger: LedgerLoad<'_>,
 ) -> BunVendorRefusal {
-    let entries = match ledger {
-        Ok(entries) => entries,
-        Err(e) => {
-            return BunVendorRefusal {
-                code: "vendor_state_unreadable",
-                detail: e.to_string(),
-                exempt: HashSet::new(),
-            };
-        }
-    };
+    if let Err(e) = ledger {
+        return BunVendorRefusal {
+            code: "vendor_state_unreadable",
+            detail: e.to_string(),
+            exempt: HashSet::new(),
+        };
+    }
     // The lock-derived exemption exists only for the workspace gate: every
     // other preflight code means bun.lock could not be read or parsed, so
     // nothing in it can be ours and re-reading it per purl would be wasted
     // (guarded, but still) I/O.
     let lock_parsed = code == "vendor_bun_workspace_unsupported";
     let mut exempt = HashSet::new();
-    for (purl, uuid) in pairs {
+    for (purl, _) in pairs {
         if !purl.starts_with("pkg:npm/") {
             continue;
         }
-        // The ledger is keyed by the manifest purl (possibly qualified) and
-        // `lookup_entry` also resolves base purls; try the selected spelling
-        // first, then its qualifier-free base.
-        let ledger_in_sync = lookup_entry(entries, purl)
-            .or_else(|| lookup_entry(entries, strip_purl_qualifiers(purl)))
-            .is_some_and(|e| e.uuid == *uuid);
+        // A preserved ledger can outlive its wiring (rollback --preserve-state).
+        // Only live lock tuples prove the engine can skip the workspace gate.
         let lock_all_ours = lock_parsed
             && socket_patch_core::vendor::bun_lock::wired_instances_all_ours(cwd, purl)
                 .await
                 .unwrap_or(false);
-        if ledger_in_sync || lock_all_ours {
+        if lock_all_ours {
             exempt.insert((*purl).to_string());
         }
     }
@@ -275,8 +263,8 @@ mod tests {
     }
 
     /// `bun_vendor_preflight` never reads the lock when nothing selected is
-    /// npm (no needless I/O, no spurious refusal for other ecosystems); an
-    /// in-sync ledger entry exempts; an unreadable ledger exempts nothing
+    /// npm (no needless I/O, no spurious refusal for other ecosystems);
+    /// a ledger alone never exempts; an unreadable ledger exempts nothing
     /// (fail closed) AND is reported as the real problem
     /// (`vendor_state_unreadable`), never as a Bun lock remedy.
     #[tokio::test]
@@ -300,11 +288,11 @@ mod tests {
         assert!(refusal.applies_to(PURL));
         assert!(!refusal.applies_to("pkg:pypi/only@1.0.0"));
 
-        // Exempt when the ledger wires this purl at this uuid…
+        // A ledger at this UUID cannot make a binary lock vendorable.
         seed_bun_vendor_entry(tmp.path(), PURL, UUID);
         let refusal = bun_vendor_preflight(tmp.path(), &npm).await.unwrap();
         assert_eq!(refusal.code, "vendor_bun_lockb_unsupported");
-        assert!(!refusal.applies_to(PURL), "in-sync ledger entry is exempt");
+        assert!(refusal.applies_to(PURL), "the live lock must be compatible");
 
         // …but a corrupt ledger exempts nothing and names itself.
         std::fs::write(tmp.path().join(".socket/vendor/state.json"), b"{ not json").unwrap();
@@ -350,10 +338,14 @@ mod tests {
             "a fresh registry instance is refused"
         );
 
-        // Vendored at UUID, ledger in sync: exempt (both rules agree).
-        std::fs::write(tmp.path().join("bun.lock"), vendored_lock(UUID)).unwrap();
+        // A preserved ledger does not make registry wiring exempt.
         seed_bun_vendor_entry(tmp.path(), PURL, UUID);
         let refusal = bun_vendor_preflight(tmp.path(), &fresh).await.unwrap();
+        assert!(refusal.applies_to(PURL));
+
+        // Live vendored tuples remain exempt.
+        std::fs::write(tmp.path().join("bun.lock"), vendored_lock(UUID)).unwrap();
+        let refusal = bun_vendor_preflight(tmp.path(), &fresh).await.unwrap();
         assert!(!refusal.applies_to(PURL), "in-sync re-run is exempt");
 
         // Superseding uuid: the ledger disagrees, the lock says ours → exempt.

crates/socket-patch-cli/src/commands/bun_preflight.rs

@@ -5324,13 +5324,11 @@ mod tests {
         );
     }
 
-    /// Already-vendored exemption: a ledger entry at the SAME uuid the run
-    /// selected is not refused (it proceeds to the fetch — unmounted here,
-    /// so it surfaces as a fetch miss), while a second purl the ledger
-    /// wires at an OLDER uuid is still refused before fetching.
+    /// Ledger entries at either the selected or an older UUID must not
+    /// bypass the refusal when the live lock contains registry wiring.
     #[tokio::test]
     #[serial_test::serial]
-    async fn download_patch_records_bun_refusal_exempts_ledger_entry_at_same_uuid() {
+    async fn download_patch_records_bun_refusal_rejects_unwired_ledger_entries() {
         use wiremock::MockServer;
 
         let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
@@ -5379,12 +5377,11 @@ mod tests {
                 .cloned()
                 .unwrap_or_else(|| panic!("no record for {purl}: {json}"))
         };
-        let exempt = by_purl(in_sync);
+        let refused_same = by_purl(in_sync);
         assert_eq!(
-            exempt["error"], "could not fetch details",
-            "the in-sync purl must be exempt from the refusal; json={json}"
+            refused_same["errorCode"], "vendor_bun_workspace_unsupported",
+            "UUID equality alone cannot bypass the refusal; json={json}"
         );
-        assert!(exempt.get("errorCode").is_none(), "json={json}");
         let refused = by_purl(stale);
         assert_eq!(
             refused["errorCode"], "vendor_bun_workspace_unsupported",
@@ -5397,8 +5394,7 @@ mod tests {
             .iter()
             .map(|r| r.url.path().to_string())
             .collect();
-        assert_eq!(paths.len(), 1, "only the exempt purl may fetch: {paths:?}");
-        assert!(paths[0].ends_with(same), "{paths:?}");
+        assert!(paths.is_empty(), "no refused purl may fetch: {paths:?}");
     }
 
     /// An unreadable vendor ledger silences the drift warning (the main

crates/socket-patch-cli/src/commands/get.rs

@@ -1135,6 +1135,31 @@ pub(crate) async fn run_redirect_selected(
         .map(|l| l.records.clone())
         .unwrap_or_default();
 
+    // The migration unlinks its input, so check links before any takeover
+    // can mutate another dependency in this run as well as before Bun runs.
+    if overrides.iter().any(|o| o.ecosystem == "npm")
+        && !common.cwd.join("bun.lock").exists()
+        && present_lockb_sibling_locks(&common.cwd).is_empty()
+        && socket_patch_core::utils::fs::first_symlink(&common.cwd, ["bun.lockb"])
+            .await
+            .is_some()
+    {
+        // Neither Bun's migration nor our byte-only backup can restore
+        // a link. Refuse before spawning Bun, including during preview.
+        let message = "bun.lockb is a symbolic link; replace it with a regular file (or run \
+                       socket-patch in the directory it points to) before migrating; nothing \
+                       was written";
+        eprintln!("Error (redirect_symlinked_file_unsupported): {message}");
+        if common.json {
+            emit_json_error_with_code(
+                scan_result.take(),
+                Some("redirect_symlinked_file_unsupported"),
+                message,
+            );
+        }
+        return 1;
+    }
+
     // Cross-mode takeover: a purl this run is about to redirect may still be
     // VENDORED — for cargo a committed `[patch.crates-io]` path entry, a
     // detached Cargo.lock entry, a committed copy, and a vendored ledger
@@ -1169,6 +1194,25 @@ pub(crate) async fn run_redirect_selected(
         use socket_patch_core::utils::purl::{normalize_purl, strip_purl_qualifiers};
         let canon = |p: &str| normalize_purl(strip_purl_qualifiers(p)).into_owned();
         let vendor_state = socket_patch_core::vendor::load_state(&common.cwd).await;
+        // Compatibility must be known before the takeover removes a live
+        // patch. In particular, a v0 workspace can keep an existing local
+        // tuple even though hosted mode cannot replace it with a URL.
+        let bun_takeover_refusal = if candidates.iter().any(|(p, ..)| p.starts_with("pkg:npm/")) {
+            match socket_patch_core::utils::fs::read_regular_to_string(&common.cwd.join("bun.lock"))
+                .await
+            {
+                Ok(content) => {
+                    socket_patch_core::patch::redirect::preflight_bun_hosted(&content).err()
+                }
+                Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
+                Err(e) => Some(socket_patch_core::patch::redirect::RewriteWarning {
+                    code: "redirect_bun_lock_unsupported".into(),
+                    detail: format!("cannot read bun.lock before mode takeover: {e}"),
+                }),
+            }
+        } else {
+            None
+        };
         let patch_entries =
             socket_patch_core::vendor::cargo_config::read_patch_entries(&common.cwd).await;
         let mut refused: Vec<String> = Vec::new();
@@ -1183,6 +1227,19 @@ pub(crate) async fn run_redirect_selected(
                 .and_then(|s| socket_patch_core::vendor::lookup_entry(&s.entries, stripped))
                 .cloned();
             if let Some(entry) = ledger_entry {
+                if let Some(warning) = bun_takeover_refusal
+                    .as_ref()
+                    .filter(|_| purl.starts_with("pkg:npm/"))
+                {
+                    refused.push(purl.clone());
+                    if !takeover_pre_warnings
+                        .iter()
+                        .any(|w| w["code"] == warning.code)
+                    {
+                        takeover_pre_warnings.push(serde_json::json!(warning));
+                    }
+                    continue;
+                }
                 if common.dry_run {
                     // Preview through the same per-purl revert machinery the
                     // wet run dispatches (write-free under dry_run): a
@@ -1314,8 +1371,12 @@ pub(crate) async fn run_redirect_selected(
         if !refused.is_empty() {
             for purl in &refused {
                 if let Some((_, uuid, ..)) = candidates.iter().find(|(p, ..)| p == purl) {
+                    let reason = bun_takeover_refusal
+                        .as_ref()
+                        .filter(|_| purl.starts_with("pkg:npm/"))
+                        .map_or("vendored_revert_failed", |w| w.code.as_str());
                     skipped.push(serde_json::json!({
-                        "purl": purl, "uuid": uuid, "reason": "vendored_revert_failed",
+                        "purl": purl, "uuid": uuid, "reason": reason,
                     }));
                 }
             }

crates/socket-patch-cli/src/commands/scan/hosted.rs

@@ -62,22 +62,18 @@ pub(crate) async fn preview_vendor_json(
     let mut patches: Vec<serde_json::Value> = selected
         .iter()
         .map(|p| match lookup_entry(&state.entries, &p.purl) {
-            Some(e) if e.uuid == p.uuid => serde_json::json!({
-                "purl": p.purl, "uuid": p.uuid, "action": "already_vendored",
-            }),
-            // An in-sync ledger entry is exactly the preflight's ledger
-            // exemption, so this arm never shadows `already_vendored`. A
-            // stale entry is refused by the wet run like a fresh one when
-            // the lock still holds a registry instance of the purl; when
-            // every instance is already ours the preflight exempts it (the
-            // engine re-vendors in place) and it previews `would_revendor`.
+            // Refusal takes priority: a preserved ledger can name this
+            // UUID even after rollback has removed its live wiring.
             _ if refusal.as_ref().is_some_and(|r| r.applies_to(&p.purl)) => {
                 let r = refusal.as_ref().expect("checked by the guard");
                 serde_json::json!({
                     "purl": p.purl, "uuid": p.uuid, "action": "would_refuse",
                     "errorCode": r.code, "error": r.detail,
                 })
             }
+            Some(e) if e.uuid == p.uuid => serde_json::json!({
+                "purl": p.purl, "uuid": p.uuid, "action": "already_vendored",
+            }),
             Some(e) => serde_json::json!({
                 "purl": p.purl, "uuid": p.uuid,
                 "action": "would_revendor", "oldUuid": e.uuid,
@@ -941,19 +937,18 @@ mod preview_tests {
         );
     }
 
-    /// The already-vendored exemption: an in-sync ledger entry keeps
-    /// `already_vendored` (the wet run's engine skip), while a stale entry
-    /// is `would_refuse` — the wet run refuses re-vendoring at a new uuid.
+    /// A ledger cannot override the live-lock refusal. Already-vendored
+    /// classification remains available when the lock is actually wired.
     #[tokio::test]
-    async fn preview_already_vendored_wins_over_refusal_stale_entry_is_refused() {
+    async fn preview_bun_refusal_requires_live_wiring_even_at_the_same_uuid() {
         let tmp = tempfile::tempdir().unwrap();
         std::fs::write(tmp.path().join("bun.lock"), V1_WORKSPACE_LOCK).unwrap();
 
         seed_entry(tmp.path(), NPM, UUID);
         let preview = preview_vendor_json(tmp.path(), &[sel(UUID, NPM)]).await;
         assert_eq!(
             action_of(&preview, NPM)["action"],
-            "already_vendored",
+            "would_refuse",
             "{preview}"
         );
 
@@ -965,6 +960,19 @@ mod preview_tests {
             rec.get("oldUuid").is_none(),
             "a refused record is not a revendor preview: {preview}"
         );
+
+        let wired = V1_WORKSPACE_LOCK.replace(
+            r#"["preview-bun@1.0.0", "", {}, "sha512-AAAA=="]"#,
+            &format!(r#"["preview-bun@.socket/vendor/npm/{UUID}/preview-bun-1.0.0.tgz", {{}}, "sha512-AAAA=="]"#),
+        );
+        std::fs::write(tmp.path().join("bun.lock"), wired).unwrap();
+        seed_entry(tmp.path(), NPM, UUID);
+        let preview = preview_vendor_json(tmp.path(), &[sel(UUID, NPM)]).await;
+        assert_eq!(
+            action_of(&preview, NPM)["action"],
+            "already_vendored",
+            "{preview}"
+        );
     }
 
     /// bun.lockb without a text lock: `would_refuse` with the lockb code.

crates/socket-patch-cli/src/commands/scan/vendor_flow.rs

@@ -1071,7 +1071,7 @@ pub(crate) async fn vendor_records(
                     PatchEvent::new(PatchAction::Failed, candidate.clone())
                         .with_error(refusal.code, refusal.detail.clone()),
                 );
-                if !common.silent && !common.json {
+                if !common.json {
                     eprintln!(
                         "Cannot vendor {}: {}",
                         normalize_purl(candidate),