feat(vex): manifest-less VEX from hosted/vendored lockfiles + npm 12 allow-remote auto-config (v5)

[Mikola Lysenko (mikolalysenko)]

Branch feat/vex-lockfile-inventory: 9 logical commits on main @ 15a6ba6 (#247 + #248); 272 files, +93.7k / −8.3k. The verbatim lock_inventory split (commit 3) accounts for 5.4k of each side, and most of the rest is tests.

Summary

socket-patch vex, and the VEX that apply / scan / vendor --vex generate, now attest hosted and vendored patches with no .socket/manifest.json and no .socket/vendor ledgers. The patch wiring is read straight from the project's root lockfiles and package-manager configs. This covers:

• a depscan-opened PR;
• a clone that never committed its ledgers;
• a lock-only CI checkout;
• Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's manifest-free vendored mode.

A ledger record whose lockfile wiring is gone no longer attests, even under --no-verify. That tightening is the breaking part.

Also in this PR:

• npm 12 hosted mode works out of the box. npm ≥ 12 defaults to allow-remote=none and refuses every hosted redirect (EALLOWREMOTE). The hosted run now writes allow-remote=all to the project .npmrc and warns. Explicit values are respected, there is an opt-out flag, and every reversal removes exactly what was added.
• Seven rewriter bugs the real-toolchain matrices found (composer, gem, cargo v1, yarn 4.0.x, npm dual-lock, npm 6).

Rebased onto #247: what adapted

The branch was squashed onto 09956d9 and re-split by concern. The #247 contracts it now builds on:

• Manifest-free vendored mode. A vendored run writes no manifest, so the "manifest deleted" VEX cells are manifest-free by nature.

  • The npm, uv and poetry vendored matrices gain a legacy-manifest cell: a record that a pre-5.0 vendored run left beside its ledger must attest the same way.
  • --detached twins assert that neither spelling writes a manifest.
  • The yarn 2/3 refusal suite seeds that legacy record explicitly and still requires not_applied.

• Embedded ledger records. Record resolution reads Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's ledger-embedded records (detached entries). The standalone manifest-driven vendor now embeds its record too, as a fallback copy. One ownership rule, commands::vendor_record_is_unowned, is shared by vex, list and setup --check (fold_vendor_records, formerly fold_detached_records). repair keeps preferring a manifest that moved on to a newer uuid. detached still means "no manifest owner", so Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's manifest reconcile, legacy migration and get/scan idempotency are unchanged.

• Corrupt vendor ledger. For vex only, vendor_ledger_corrupt (exit 2, the ledger named and never rewritten) supersedes Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's disclose-then-manifest_not_found posture. setup --check keeps Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's warn_unreadable_vendor_state path.

• Lock window and residue. vex never takes apply.lock, never creates .socket/ and never writes. The hosted .npmrc edit rides rewrite.files / rewrite.edits, so it is written:

  • inside Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's apply-lock window;
  • after Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's whole-run symlink guard;
  • only after the ledger persisted.

  The per-purl unwind flushes through Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's shared staged::flush_staged. Suites that plant a stale ledger after a full rollback recreate .socket/ first, and the hosted rollback suite checks that vex does not recreate it.

• API and fs helpers. Record fetches use Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's uuid-only ApiClient::fetch_patch. select_lockfile and the extractors read through the guarded utils::fs readers. atomic_write_bytes_preserving_mode stays inside Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's commit_stage structure.

• Rewriters. plan_cargo_lock keeps Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's multi-source twin disambiguation (Ambiguous) and hoisted regexes. The v1 [metadata] handling was layered on top of both.

• CLI wording. Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's no-manifest lines ("No patch manifest found; nothing to apply.", "No manifest found, nothing to vendor.") are kept. The bun workflow keeps Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's two modes (the vendored-detached leg is gone). The pdm backtest's refusal check follows the manifest-free footprint.

• CHANGELOG. One [Unreleased] v5 section lists both PRs. Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's "vex discloses an unreadable ledger" bullet now points at the vendor_ledger_corrupt entry.

Rebased onto #248: what adapted

The 7 commits were replayed onto 15a6ba6. Conflicts, per commit:

• npm 12 allow-remote (scan/hosted.rs, tests/coverage_fix_scan_hosted_dryrun_vendored.rs). Both sides kept: the .npmrc plumbing and warnings sit beside Consolidated terminal UI and CLI-wide output polish #248's human_warnings / format_warning rendering. The dry-run detail drops its (--dry-run) marker ("allow-remote=all would be written to a new project .npmrc"), following Consolidated terminal UI and CLI-wide output polish #248's pnpm trustLockfile twin: the summary line already says it is a dry run. Both new dry-run tests in the coverage file were kept. The --no-npm-allow-remote-config doc and help heading follow Consolidated terminal UI and CLI-wide output polish #248's help_text_hygiene rules.
• manifest-less VEX (vex.rs, vendor.rs, scan/hosted.rs). vex.rs was rebuilt from Consolidated terminal UI and CLI-wide output polish #248's version with this branch's semantics on top. ui::plural replaces the branch's private plural. Omissions use Consolidated terminal UI and CLI-wide output polish #248's format_omission_warning (Warning: omitting <purl> from VEX: <phrase> (<tag>)), with phrases for the new reasons. The manifest-less apply --vex / vendor --vex lines go through format_vex_written / format_vex_dry_run_skip. Record fetches show a ui::StatusLine progress line. Manifest-less vex honours --dry-run and -O -. The hosted.rs conflicts were comments only.
• tests (e2e_vex.rs, covgap_commands_vex.rs). The omission assertions use Consolidated terminal UI and CLI-wide output polish #248's format. The corrupt-vendor-ledger tests keep this branch's vendor_ledger_corrupt hard error.
• docs (CLI_CONTRACT.md). Two paragraphs were merged word by word: Consolidated terminal UI and CLI-wide output polish #248's plurals plus this branch's embedded-record and detached text. Consolidated terminal UI and CLI-wide output polish #248's CHANGELOG entries are intact.

Shared readers: one lockfile traversal layer

Discovery and the lock inventory (vendor::lock_inventory, which backs the scan / get supplement, the vendored fetch inventory and repair's recovery) read each lockfile format through ONE reader. That reader yields every entry, Socket-owned ones included. The inventory's registry views drop the Socket-owned entries, and discovery's extractors classify and validate them. Each consumer still chooses its own files and does its own I/O: discovery reads every present file through its recognizing ctx (rule 11), and the inventory keeps its precedence chains.

lock_inventory is now a directory module with one file per format. Each file has three parts: a pure entry model, a file-selection section that only stats files, and the registry view. Architecture tests enforce three things:

• that layering;
• extractors read file content only through the ctx;
• the npm-family extractors never call the grammar primitives the models wrap.

Format	Shared reader
package-lock / npm-shrinkwrap	lock_inventory::npm_lock_nodes
pnpm-lock.yaml / shrinkwrap.yaml / Rush	lock_inventory::pnpm::pnpm_packages over the hosted rewriter's pnpm grammar (every key generation, CRLF included), classify_pnpm_key, rush_lock_rels
yarn classic / berry	lock_inventory::yarn::{classic_entries, berry_entries}. One berry locator (parse_berry_locator), one cache-key and checksum rule, and one multi-descriptor key splitter, shared by the hosted rewriter, the vendored berry backend and discovery
bun.lock / bun.lockb	lock_inventory::bun::bun_text_entries over the backends' fail-closed vendor::bun_lock_text line grammar; BunLockb::parse_packages (also used by bun_lock's vendor paths and the trust anchor)
Cargo.lock / .cargo/config*	cargo_lock::locked_packages. cargo_config's [patch] and [registries] walks and effective-config probe, which the writers read through too
go.mod / go.sum	go_mod_edit's read helpers (normalize_for_read, block_structure_error, hosted_module_uuid), go_sum_edit::go_sum_lines / is_h1_dirhash
Gemfile.lock / Gemfile	vendor::gemfile_lock, a new model covering sections, checksums, remotes and lock names. vendor::gem::gem_declaration_any and discovery's source-block grammar, now also used for ledger liveness
composer.lock	lock_inventory::composer_lock_packages. The composer writer's lock walks use its array index too
uv / pylock / poetry / pdm / Pipfile.lock / requirements / Hatch	utils::python_lock (uv source fields, script-lock pairing), utils::poetry_lock, lock_inventory::pypi::parse_pipfile_lock, utils::hatch::dependency_specs. utils::requirements, a lexer lifted out of the vendored planner, now provides the exact-pin rule for the inventory, discovery and the planner. There is one hosted pypi URL grammar for the Pipfile.lock inventory and discovery
pom.xml / nuget.config / packages.lock.json	two new readers, vendor::maven_pom and vendor::nuget_config; nuget_feed::nuget_lock_entries, shared by discovery and the feed writer
pins and purls	utils::digest (SRI pin rule, hex digest shapes) and utils::purl's validating builders, shared by discovery, the inventory, ledger recovery and the rewriters

Discovery's own duplicates are gone as well. DiscoverCtx::locate classifies a lock location once for every extractor (vendored path, hosted uuid, decorated leaf). There is one Wired type, one set of vendor-dir predicates and one JSON / TOML parse-and-diagnose helper.

Ledger liveness is one rule, Discovery::{wires_package, vendor_entry_live, redirect_record_live}. Each call site holds it through LedgerLiveness: the sorted redirect-ledger files, plus the lock inventory, loaded lazily and at most once.

• It gates vex attestations.
• It drives scan's takeover classification, hosted_wiring_retained and redirectState.wiringLive.
• It reads every lock's entry for a package. A PEP 723 script lock that resolves the package from PyPI therefore no longer vetoes the project lock's hosted entry.

Cargo crates.io provenance is an explicit LockfileEntry::source_kind; it is no longer inferred from the checksum variant. The CLI shares one purl splitter, one vendor-ledger lookup and one npm identity crawl across vex, scan and vendor.

Integration round (after #248). The refactor's second pass removed the last parallel walkers that the duplication maps had found. There are 16 fixups, all folded into commits 4–9:

• bun discovery now uses the strict shared grammar instead of its own lenient JSONC reader;
• the berry key splitter is shared by the rewriter, the vendored backend and discovery;
• requirements exact pins and the Pipfile.lock hosted-URL grammar are each defined once;
• pnpm entry fields are read once;
• Gemfile liveness uses discovery's source-block grammar;
• liveness reads every lock entry.

The same round moved the reason a patch was gated into warnings[], so --json keeps it (see "Behavior changes").

Line counts

Production lines are non-blank lines with tests, #[cfg(test)] items and golden harnesses excluded. "Before" is the pre-refactor head of this branch; "after" is e3d0ca9 (commit 8).

Area	Before	After	Code only (no comments)
vex/discover/*	8,285	7,349 (−936, −11%)	6,120 → 5,223 (−897)
vendor/lock_inventory (main: 2,262 in one file)	2,166	2,696 (+530)	1,643 → 1,961
CLI vex_sources.rs + vex_consumed.rs	1,429	1,422	1,107 → 1,090
new shared readers (maven_pom, nuget_config, utils::digest)	—	566
every changed production file (74)	64,256	65,074 (+818)	48,696 → 48,922 (+226)

The refactor is not a net line reduction. Each format now has one traversal; the duplicated walkers are gone from discovery and the scanners. lock_inventory and the writer modules gained the entry models, which yield every entry kind rather than just the registry ones, plus their docs.

Equivalence proof (golden snapshots)

Before any code moved, the refactor recorded golden snapshots on the pre-refactor tree:

• discovery output for 182 committed fixture projects plus every unit-test call;
• a tap on every lock-inventory entry point;
• the ledger-liveness verdicts;
• the manifest-less vex CLI output (exit code, envelope and document) for every hermetic e2e call.

Every later step had to keep them byte-identical. Old-vs-new differential copies of each consolidated function also ran during the work. Comparing the final tree against those baselines:

Golden set	Baseline files	Byte-identical	Changed
discovery	435	433	2, both bun (below)
lock inventory	514	512	2, the same bun tests
ledger liveness	435	433	2, the same bun tests
CLI vex	244	174	70, each ONLY by an added warnings[] array (checked by deleting every warnings key and comparing)

The only behavioral change is intended. A hand re-indented bun.lock used to be read by discovery's own JSONC parser, while every other command refused it. It is now lockfile_unparseable, the same as everywhere else (reformatted_jsonc_lock_is_still_read became reformatted_lock_is_refused_like_every_other_reader). The CLI warnings[] additions are the new gating-reason warnings. No existing test assertion was loosened.

That scaffolding was about 460k lines of generated JSON, so it is not committed. Commit 9 keeps a compact regression pin instead: discovery output for the 182 committed fixture projects, one JSON file per fixture family (13 files, about 3.8k lines). It is regenerated with SOCKET_PATCH_UPDATE_GOLDEN=1 cargo test -p socket-patch-core --lib vex::discover::testing::golden, and a fixture without an entry (or an entry without a fixture) fails.

Left separate on purpose:

• validation that differs by design: discovery's root-anchored vendor paths and host allowlist versus the writers' ownership checks, discovery's strict go.mod block rule, and maven/nuget version handling;
• the remaining writer-side scanners: the maven_repo / redirect pom regexes, the nuget_feed / redirect key harvesters, wired_vendor_integrity's line windows and vendored_entry_in_use. Moving them onto the shared readers changes writer behavior, so each needs its own commit with a reviewed golden diff (follow-up).

Design

• Discovery (core, vex::discover/). It is read-only, never uses the network and never fails the run: a malformed file becomes a diagnostic. There is one extractor per PM family:

  • npm (package-lock / shrinkwrap, pnpm every lock generation plus Rush);
  • yarn classic and berry;
  • bun (bun.lock / bun.lockb);
  • cargo;
  • golang (go.mod / go.work plus sums);
  • pypi locks (uv, PEP 723 script locks, pylock, poetry, pdm);
  • other pypi sources (Pipfile.lock, requirements plus -r, Hatch / PEP 621 direct refs);
  • gem, composer, maven, nuget;
  • deno, which is explicitly empty.

  The result is Discovery { refs, diagnostics, recognized, unlocked_pins, elsewhere }. Every root file is read; there is no precedence chain, because the hosted rewriter edits every candidate it finds.

• Fail-closed validation. Every value is committed, tamperable data:

  • Hosted URLs: only https://patch.socket.dev or the configured --patch-server-url origin, with no userinfo. The uuid is the last canonical path segment, because grant tokens can be uuid-shaped.
  • Vendored paths: root-anchored .socket/vendor/<eco>/<uuid>/… whose leaf names the entry's own artifact.
  • Pins, not definitions. A registry, index or source definition alone never makes a ref.
  • Contested locks. A lock that resolves the same name@version from a non-Socket source drops the ref (patched_ref_unattributable).
  • Lockless pins. A lockless cargo pin or exclusive nuget mapping (UnlockedPin) can keep a ledger record live but never creates a ref.

• Record resolution (CLI, vex_sources.rs). Sources are tried in order: manifest, redirect ledger, vendor-ledger embedded record, then (online only) the patch API by uuid. Fetches run 10 at a time with get's 401/403 → public-proxy fallback.

  • The uuid the lockfile actually wires beats a stale manifest or ledger uuid.
  • The socket-patch.vendor.json marker is never a record.

• Evidence.

  • Vendored: the committed artifact is hashed.
  • Hosted: the installed copy the build consumes is hashed. That means the Go replacement module, the Socket-registry cargo src dir, or maven's suffixed version, never a pristine sibling. Installed evidence wins.
  • With nothing installed, the lockfile integrity pin is the evidence, the same as in-run scan --mode hosted --vex.
  • Discovered refs bypass the Property 7 ecosystem filter.

• Liveness gates. These run before hashing and are still enforced under --no-verify, which now skips only the hashing:

  • vendor_unwired / redirect_unwired: the ledger record's lockfile wiring is gone. Discovery is authoritative for every uuid a read file mentions, so a rejected mention keeps nothing alive.
  • wiring_conflict: the lockfiles wire one package to several patches.
  • record_mismatch: the record names a different package or uuid.
  • record_unavailable: offline, 404, refused or a transport error. The run continues.

• Product auto-detect. Adds go.mod, composer.json, pom.xml, a single *.csproj and a single *.gemspec, after the existing probes.

npm 12 .npmrc allow-remote auto-config

The decision was: fix the .npmrc and warn; respect explicit values; add an opt-out flag; make it revertible.

• Trigger. A scan --mode hosted / get --mode hosted run that leaves a root package-lock.json / npm-shrinkwrap.json carrying a granted hosted artifact URL. The run then ensures allow-remote=all in the project .npmrc:

  • It creates the file, or appends one line, preserving the BOM, CRLF and every other byte.
  • It records the edit in the redirect ledger as redirect_npmrc_allow_remote (created / added).
  • Every npm hosted run warns redirect_npm_allow_remote with the tradeoff: all admits every url-resolved dependency tree-wide, while each entry's sha512 pin stays enforced.

• Explicit values are respected and named in the warning. Any explicit non-all value in:

  • the project .npmrc;
  • the user, global or builtin npm config, located the way @npmcli/config does;
  • an npm_config_allow_remote env var, which beats every .npmrc.

  A symlinked, unreadable or bare-CR .npmrc is left alone, with a manual-remedy warning.

• Opt-out. --no-npm-allow-remote-config / SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG.

• Grammar. Follows npm's bundled ini exactly, measured on npm 12.1.0 and cross-checked against ini 6.0.0 / 7.0.0:

  • only the exact key allow-remote counts;
  • the last top-level assignment wins, and [section] bodies are not top-level;
  • a bare CR ends a line;
  • a section header only counts on the untrimmed line;
  • the value is case-sensitive.

• Revertible. Every reversal removes exactly what was added, once no package-lock entry needs it:

  • the whole-ledger replay (a new NpmrcAllowRemote inverse);
  • the per-purl npm revert behind scoped rollback / remove / the vendored takeover ("last one out", same transaction);
  • the vendored-supersedes-hosted reconcile.

  A created file the user has since modified keeps the user's lines (redirect_npmrc_allow_remote_modified, surfaced by rollback, remove, vendor and the reconcile). A symlinked .npmrc refuses an unwind at plan time, before anything is written.

• Safety. Never written on --dry-run; the dry run previews the write, including for a vendored → hosted takeover. Mode-preserving atomic writes create the stage with the destination's permission bits, so a 0600 token-bearing .npmrc is never staged world-readable.

Output conventions

The human output this branch adds uses #248's mechanisms:

• The omission line is Consolidated terminal UI and CLI-wide output polish #248's Warning: omitting <purl> from VEX: <phrase> (<tag>), with phrases for the new reasons (record_unavailable, record_mismatch, vendor_unwired, redirect_unwired, wiring_conflict).

• Omissions are sorted by purl, so stderr and the skipped events are deterministic.

• Plan notes are sorted, deduplicated and start with a capital letter.

• Counts use ui::plural. Record fetches show a ui::StatusLine (Fetching patch records... (n/total)), which is silent under --json / --silent.

• Manifest-less VEX lines use Consolidated terminal UI and CLI-wide output polish #248's format_vex_written / format_vex_dry_run_skip.

• The npm caveat prints as Warning (redirect_npm_allow_remote): ….

• Failed VEX runs carry the discovery diagnostics into warnings[] (standalone, embedded and scan JSON envelopes). The reason a patch was gated is there too:

  • why a wired patch has no record: vex_record_offline, vex_record_not_found, vex_record_fetch_failed;
  • a stale-credential fallback to the public proxy: api_auth_fallback, the same text as get / scan;
  • vex_wiring_conflict, vex_record_superseded and vex_claim_unwired.

  A failed embedded --vex adds one vex_omitted per omitted patch to the host command's warnings[], and --silent lists the omissions under the error.

Per-PM × version support matrix

Every PM is supported in both hosted and vendored modes, except as noted. "Hermetic" means the wiremock-backed e2e_vex_lockfile_<pm> suite in the default test job on all 3 OSes. "Real-PM" means the gated suites in CI's e2e matrix, the dedicated matrix jobs or the per-PM compatibility workflows; every real-PM flow ends in the manifest-less VEX matrix, with these cells:

• manifest absent;
• ledgers deleted;
• --offline → record_unavailable with zero requests;
• reverted lock, never attested, with or without --no-verify;
• legacy-manifest where vendored.

PM	Hosted	Vendored	Hermetic suite	Real-PM versions (CI)
npm	✓ (npm 12: auto .npmrc; npm 6: fails closed, redirect_npm_legacy_client)	✓ (npm 12 dual-lock: both locks rewired)	e2e_vex_lockfile_npm, redirect_npm_allow_remote	6.14.18, 7.0.0, 7.24.2, 8.19.4, 9.0.0, 9.9.4, 10.9.9, 11.20.0, 12.0.0, 12.1.0 (npm-compatibility.yml)
pnpm	✓	✓	e2e_vex_lockfile_pnpm	e2e_redirect_pnpm_build (3 OS), pinned vendored matrix, pnpm-compatibility.yml, Rush sim
yarn classic	✓	✓	e2e_vex_lockfile_yarn_classic	1.0.2, 1.6.0, 1.7.0, 1.9.4, 1.10.1, 1.22.22 (yarn-classic-matrix)
yarn berry	✓	✓ (needs a resolutions mapping)	e2e_vex_lockfile_yarn_berry	4.0.2, 4.1.0, 4.6.0, 4.12.0, 4.18.0 (+ macOS/Windows); 2.x/3.x refused lanes (yarn-berry-e2e)
bun	✓	✓	e2e_vex_lockfile_bun	1.3.14 redirect/vendor; bun.lockb 1.0.36 / 1.1.45; mode_migration 1.1.45 / 1.2.23 (bun-compatibility.yml)
cargo	✓	✓	e2e_vex_lockfile_cargo	toolchains 1.82.0 / 1.93.1 / stable × Cargo.lock v1–v4 (+ macOS/Windows v1) (cargo-vex-matrix)
golang	✓	✓ (+ go-patches)	e2e_vex_lockfile_golang	1.18.10, 1.21.13, 1.24.13, 1.26.3 (go-compatibility.yml); go.work build suite
uv	✓	✓	e2e_vex_lockfile_uv	16 releases, 0.1.45 → 0.12.17; uv backtest
poetry	✓	✓	e2e_vex_lockfile_poetry	1.0.10, 1.1.15, 1.8.5, 2.0.1, 2.4.3 (poetry-compatibility.yml)
pdm	✓	✓	e2e_vex_lockfile_pdm	1.4.5, 1.15.5, 2.7.4, 2.8.2, 2.25.9, 2.29.2 (lock 3.1 and 4.0–4.2 refused)
hatch	✓	✓	e2e_vex_lockfile_hatch	1.0.0, 1.2.1, 1.9.7, 1.14.2, 1.18.1
pipenv	✓	✓	e2e_vex_lockfile_pipenv	2022.12.19 → 2026.8.0
pip (requirements)	✓	✓	e2e_vex_lockfile_pip	pip 22–26
gem	✓	✓	e2e_vex_lockfile_gem	bundler 1.17.3, 2.1.4, 2.2.33, 2.5.23, 2.6.9, 2.7.2, 4.0.15, 4.0.21; docker vendored gem
composer	✓	✓	e2e_vex_lockfile_composer	composer 1, 2.2 LTS, 2
maven	✓	✓ (jar + .sha1 required)	e2e_vex_lockfile_maven	3.6.3, 3.8.9, 3.9.16, 4.0.0-rc-6
nuget	✓ (needs a packages.lock.json entry or an exclusive mapping)	✓	e2e_vex_lockfile_nuget	dotnet 6, 7, 8, 9, 10
deno	—	—	e2e_vex_lockfile_deno (negative)	1.46.3, 2.9.7 (agent mode + setup.manual only)

Cross-cutting suites: e2e_vex_manifestless_embedded, e2e_vex_redirect, e2e_vex_vendor, vex_e2e_common_selftest, and the core polyglot test (a root with every PM discovers the union).

Real-PM spot checks on the final code (before the whitespace-only fmt fixups and the test-only golden slimming; local macOS, all green):

PM	Version(s)	Result
npm	12.1.0	hosted + vendored capstones (e2e_redirect_npm_build, e2e_vendor_npm_build) 24/24
pnpm	10.34.5	pinned matrix: hosted and vendored 3/3
yarn berry	4.12.0, plus 2.4.3 / 3.8.7 refusal lanes	103/103 cells
yarn classic	1.22.22	65/65 cells
bun	1.3.14	hosted + vendored 26/26
cargo	1.93.1	lock v1 10/10, lock v4 10/10 (redirect, vendor, mode migration)
go	1.26.3	53/53 (build, hosted, workspace, vendored)
uv	0.11.19 (Python 3.12)	hosted 14/14, vendored 18/18
bundler	4.0.15	hosted + vendored 25/25
maven	3.9.16	hosted and vendored builds 2/2
dotnet	8.0	nuget build 2/2

The uv leg needs SOCKET_PATCH_UV_E2E_PYTHON set to a Python ≥ 3.9. Without it, uv picked this machine's Python 3.8 and hosted_uv_export_pylock_manifestless_vex stopped at setup (pylock.toml requires >=3.9). That is an environment issue, not a product one.

Earlier rounds (local macOS, all green): after the first refactor pass, the same eleven PMs. After the #248 rebase, npm 12.1.0 and pnpm 10.34.5. After the #247 rebase, npm 10.9.9 / 12.1.0, pnpm, both yarns, cargo, go, uv and bundler. Before the rebases, the full per-version matrices above were run per PM. At this HEAD they run in CI.

Behavior changes

• BREAKING (v5): a ledger record attests only while a lockfile still wires it, even under --no-verify / --vex-no-verify. Those flags now skip only the hashing.
• BREAKING: a malformed or unreadable .socket/vendor/state.json is vendor_ledger_corrupt for vex (exit 2; the host command fails under --vex).
• New: hosted npm runs write allow-remote=all to the project .npmrc (or respect and name an explicit value) and always warn redirect_npm_allow_remote. New flag --no-npm-allow-remote-config / SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG. New ledger kind redirect_npmrc_allow_remote and warning redirect_npmrc_allow_remote_modified. Commit the .npmrc with the lock.
• New skip reasons: record_unavailable, record_mismatch, vendor_unwired, redirect_unwired, wiring_conflict.
• New run-warning codes: lockfile_unreadable, lockfile_unparseable, patched_ref_invalid, patched_ref_unattributable, vex_record_offline, vex_record_not_found, vex_record_fetch_failed, vex_wiring_conflict, vex_record_superseded, vex_claim_unwired, vex_omitted; also api_auth_fallback on vex.
• The shared readers change a few edge cases, each named in the CHANGELOG:
  • Lock inventory:
    • a v1 Cargo.lock's [metadata] checksums now verify a crates.io fetch;
    • requirements.txt is read as pip's logical lines;
    • a wildcard pin (six==1.*) is not an exact version;
    • a Pipfile.lock hosted reference to an sdist, an http:// origin or a path-prefixed origin stays inventoried;
    • a CRLF pnpm-lock.yaml is inventoried;
    • a poetry.lock / pdm.lock / Cargo.lock that is not valid TOML contributes nothing.
  • Discovery: a hand re-indented bun.lock is lockfile_unparseable.
  • Vendored berry backend: a multi-descriptor key that mixes the patched package with another descriptor is refused as vendor_override_conflict.
  • scan liveness: a commented-out Gemfile source … do block no longer keeps a reverted record alive.
• manifest_not_found (exit 2) now means no manifest AND nothing wired.
• apply --vex / vendor --vex without a manifest now attest what the lockfiles and ledgers wire. A project with nothing wired keeps the calm exit 0 and removes a stale document. apply --check and --dry-run never generate.
• Discovery also runs under --global / --global-prefix, because it gates the ledgers read from --cwd.
• The standalone vendor embeds the patch record in every ledger entry.
• Rewriter fixes (each pinned by a core regression test):
  • composer hosted drops a source block that precedes dist; otherwise composer 1 / 2.2 silently installed the pristine commit from git. A hand-ordered source that can't be dropped warns redirect_composer_source_kept.
  • gem hosted puts the GEM section in bundler's source order (frozen installs on bundler ≥ 4.0.19).
  • cargo hosted and vendored now handle a v1 Cargo.lock.
  • yarn 4.0.0–4.0.2 checksums keep the lock's own spelling (YN0028 otherwise).
  • npm 12 dual-lock vendoring, with the new warning vendor_npm_sibling_lock_unwired.
  • npm lockfileVersion 1 hosted warns redirect_npm_legacy_client.

Limitations and follow-ups

• Root only. Not read:
  • nested workspace-member locks (Rush pnpm locks are the exception);
  • maven parent poms or submodules;
  • Gradle;
  • $CARGO_HOME or parent cargo configs;
  • user-level nuget configs.
• Online fetch. A record must be fetched online when neither the manifest nor the ledgers are committed. --offline gives record_unavailable.
• Bun < 1.3.10. A hosted entry re-saved without its digest attests only after install.
• Unsupported shapes.
  • gem platform gems;
  • composer installed.json and COMPOSER=-renamed locks;
  • legacy same-GAV maven hosted repositories.
• Lockless cargo / nuget pins only keep an existing redirect-ledger record alive; they never create a ref on their own.
• npm allow-remote=all is tree-wide, which is npm's granularity; the per-entry sha512 pins stay enforced. A user-level allow-remote=none is respected, so npm 12 then refuses the hosted install until the user changes it (the warning says so).
• Follow-ups:
  • --vex on get --mode hosted|vendored;
  • member-lock discovery;
  • Gradle;
  • regenerating the pdm / pipenv / poetry backtest results tables for Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247's footprint (carried over from Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode #247).

Test evidence

Final local gate on feat/vex-lockfile-inventory (HEAD faf9ed3) (macOS arm64, CARGO_INCREMENTAL=0). The branch is based on origin/main = 15a6ba6 (re-fetched after the gate; main has not moved) and the tree is clean.

Check	Result
cargo clippy --workspace --all-features -- -D warnings (CI's step)	clean
cargo clippy --workspace --all-features --all-targets -- -D warnings	clean at HEAD, and on every one of the 9 commits on its own (run on the pre-fmt chain; the fmt fixups only change whitespace)
cargo test --workspace --all-features --no-run	builds
cargo test --workspace --no-fail-fast (vexctl v0.3.0 on PATH, SOCKET_PATCH_GO_E2E_REQUIRED=1, like CI)	exit 0, 8,503 passed, 0 failed, 135 ignored, across 276 test binaries. core: 4,575 passed (30 binaries, 1 ignored; lib 4,134). cli: 3,928 passed (244 binaries, 133 ignored, which are the gated real-PM / network suites; lib 785). doc-tests: 0 run, 1 ignored. Run just before the whitespace-only fmt fixups; after them the touched suites were re-run (cli lib 785, coverage_fix_scan_hosted_dryrun_vendored, in_process_redirect_pipenv)
rustfmt	every new file is formatted. In the 4 changed files where this branch had added unformatted hunks, those hunks were fixed (8 hunks, folded into their commits); the other hunks in those files are main's own, untouched as the repo rules require
golden snapshots	see "Equivalence proof". After slimming commit 9: clippy --all-targets -D warnings clean; cargo test -p socket-patch-core 4,570 passed, 0 failed; cargo test -p socket-patch-cli --no-fail-fast 3,928 passed, 0 failed, 133 ignored (245 binaries)
scripts/release-lint.sh --sync-only	OK (4.0.0 everywhere)
npm dispatch tests (node --test npm/socket-patch/bin/socket-patch.test.mjs)	4/4
pypi dispatch tests (python3 pypi/socket-patch/test_dispatch.py)	9/9
python3 -B -m unittest discover -s scripts/tests	15 OK, 1 skipped
shellcheck: --shell=sh scripts/install.sh, the release scripts, and the new scripts/{uv,yarn-berry,yarn-classic}-vex-matrix.sh	clean
actionlint	same 8 findings as main (pre-existing ci.yml shellcheck infos; one line number shifts)

Not run locally, left to CI: the Linux and Windows test legs, test-release, coverage, e2e-docker, hosted-e2e (production credentials), and the full per-version matrices.

How to review

The commits are meant to be read in order, oldest first. Each one builds on its own:

1. 75128f4 fix(core): hosted/vendored rewriter fixes found by the real-PM matrices. Seven independent rewriter bugs, each with a core regression test. It is small and has no VEX code, so it is a good warm-up.
2. 0c5d370 feat(hosted): auto-configure npm 12 allow-remote in the project .npmrc. Start at core/src/patch/redirect/npmrc.rs (the grammar, the plan and the unwind). Then read replay.rs / takeover.rs, then cli/src/commands/scan/hosted.rs and remove.rs. Tests: tests/redirect_npm_allow_remote.rs.
3. c8a97de refactor(core/vendor): split lock_inventory into per-format submodules. A verbatim move of main's file. Only imports, visibility, module docs and section banners change, and git show --color-moved shows everything else as moved. It exists so that the next commit's inventory changes can be read per format.
4. 85dd900 feat(core/vex): discover hosted and vendored patch references from lockfiles.
   • Start at core/src/vex/discover/mod.rs: the types, the orchestrator, DiscoverCtx::locate, contested locks, recognized, and the liveness rule with LedgerLiveness.
   • Then read one extractor per family; npm.rs and pypi_locks.rs are the largest. Also read patch::redirect::hosted_patch_uuid.
   • This is the security-sensitive surface. Look for anything that turns a definition, a foreign host or an out-of-root path into a ref.
   • The shared readers are the entry models in vendor/lock_inventory/*, plus vendor/{gemfile_lock, maven_pom, nuget_config, cargo_config, go_mod_edit, go_sum_edit, yarn_berry_lock, yarn_classic_lock, bun_lock_text}.rs and utils/{digest, purl, requirements, python_lock, hatch}.rs.
5. df672b6 feat(vex): manifest-less VEX.
   • cli/src/commands/vex_sources.rs: the record view, the API fetch and the gating-reason warnings.
   • vex_consumed.rs: hosted evidence.
   • vex.rs: the liveness gates and the output.
   • The embedded paths in apply.rs / vendor.rs / scan.
   • Also vendor_record_is_unowned, the product probes, and scan/mod.rs's classify_overlap_takeover / hosted_wiring_retained_purls, which now use the core liveness rule through commands::discover_wiring and LedgerLiveness.
6. a9796f2 test(cli): the suites. Mostly mechanical. Worth reading: tests/vex_e2e_common/ (the shared omission oracle) and one hermetic suite, for example e2e_vex_lockfile_npm.rs.
7. 164f594 ci: the matrices and backtest steps. Covers ci.yml, the new npm / go / poetry compatibility workflows and the scripts/*-vex-matrix.sh drivers.
8. e3d0ca9 docs. The CLI_CONTRACT.md sections "Manifest-less VEX (lockfile discovery)" and "Additive warnings", the README, the CHANGELOG [Unreleased] section and docs/testing/npm-compatibility.md.
9. faf9ed3 test(vex): golden snapshot of discovery over committed fixtures. The harness is core/src/vex/discover/testing/golden.rs; the JSON under core/tests/fixtures/vex-discover-golden/ is generated, so skim it.

🤖 Generated with Claude Code

---

Note

High Risk
Changes security-sensitive attestation rules, hosted npm install policy (.npmrc), and lockfile parsing used by scan/vex across every ecosystem; extensive CI coverage mitigates but the behavioral surface is large.

Overview
This is a v5 breaking release centered on manifest-less OpenVEX: vex (and embedded --vex on apply / scan / vendor) can attest hosted and vendored patches by reading patch wiring from root lockfiles and configs, with records resolved from manifest, ledgers, or the API. Ledger liveness is tightened: redirect/vendor ledger entries attest only while a lockfile still wires that patch—even under --no-verify (hash-only skip)—and corrupt .socket/vendor/state.json becomes vendor_ledger_corrupt for vex.

Hosted npm on npm 12 auto-writes allow-remote=all to the project .npmrc (ledgered, revertible, opt-out via --no-npm-allow-remote-config), with grammar aligned to npm’s ini and explicit user/env overrides respected.

Core work adds vex::discover plus shared per-format lock readers (split lock_inventory, unified liveness with scan). CLI adds vex_sources / vex_consumed, embeds patch records in all vendor ledger entries, and fixes several hosted/vendored rewriters (composer git fallback, gem source order, cargo v1, yarn 4.0.x checksums, npm dual-lock).

CI/docs expand massively: per-toolchain e2e matrices (uv, poetry, pdm, maven, dotnet, bundler eras, yarn/cargo/npm/go workflows), Docker vendor suites for pypi, and README/CHANGELOG/CLI contract updates for the new VEX and npm 12 behavior.

^{Reviewed by Cursor Bugbot for commit faf9ed3. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​denoland/​setup-deno@​22d081ff2d3a40755e97629de92e3bcbfa7cf2ed
	github/​actions/​setup-dotnet@​a98b56852c35b8e3190ac28c8c2271da59106c68

View full report

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit faf9ed3. Configure here.}

[cursor]

Workspace npm aliases skip VEX hashing

Medium Severity

Hosted npm VEX claims every consumed copy is hashed, but the alias walk only starts at the root node_modules and never visits workspace-member trees. The identity fallback that would find those aliases runs only when no copy was found at all, so a root or hoisted install causes member aliases to be skipped. A stale or tampered workspace alias can then stay unhashed while the document attests from the good copy.

Additional Locations (1)

• crates/socket-patch-cli/src/commands/vex_consumed.rs#L91-L109

 

^{Reviewed by Cursor Bugbot for commit faf9ed3. Configure here.}

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​denoland/​setup-deno@​22d081ff2d3a40755e97629de92e3bcbfa7cf2ed

View full report