GeezerVison

(purl or patch uuid; v5 keeps no hosted ledger) restores each matched pin to its default

upstream registry entry — the same restore as `rollback` (see "Hosted unwind coverage"), for every

ecosystem. A hosted-only match works with no manifest at all (mirroring the manifest-less

vendored escape). A pin the restore refuses (`--offline`, a registry that does not answer,

vendored escape). **One owned pin per release**: an identifier that matches a manifest entry

also selects the vendored ledger entry that entry claims and every hosted pin wiring the same

package release, whatever patch uuid (generation) each recorded — so `remove <uuid A>` of a

record a later scan superseded with patch B (vendored or hosted) unwinds B's wiring too. That

hosted restore needs the registry lookups below, so such a remove can refuse offline where the

manifest entry alone would not. A pin the restore refuses (`--offline`, a registry that does not answer,

`bun.lockb`, …) or a failed write is the top-level `hosted_revert_failed` error BEFORE the

manifest mutation (exit 1, manifest not modified; message `could not restore <purl> to its

upstream registry entry: … (`git checkout -- <files>`)`). v4's `hosted_revert_unsupported` is no

`rollback [TARGET]...` — zero or more targets, unioned. `pkg:` tokens are PURLs (base purl matches every release variant; qualified purl exact), other identifier-shaped tokens are UUIDs, and only **path-shaped** tokens (separator, glob metachar `*?[`, `./` prefix, or absolute) are path globs — see the per-subcommand args table for the safety rationale. Identifier matching runs across ALL THREE sources (a hosted pin matches by purl or by the patch uuid in its hosted URL); an identifier matching nothing anywhere is the familiar exit-1 error. Path globs use the same matcher as `scan [PATHS]` (ancestor rule, `require_literal_separator`, absolute-only outside `--cwd`, Windows case-insensitive): installed copies of every candidate purl are discovered and purls with ≥ 1 matching copy are selected. Scoping sentences (shared with scan):

`rollback [TARGET]...` — zero or more targets, unioned. `pkg:` tokens are PURLs (base purl matches every release variant; qualified purl exact), other identifier-shaped tokens are UUIDs, and only **path-shaped** tokens (separator, glob metachar `*?[`, `./` prefix, or absolute) are path globs — see the per-subcommand args table for the safety rationale. Identifier matching runs across ALL THREE sources (a hosted pin matches by purl or by the patch uuid in its hosted URL); an identifier that matches a manifest entry also selects the vendored ledger entry that entry claims and every hosted pin of the same package release under any patch uuid (one owned pin per release — `remove` parity); an identifier matching nothing anywhere is the familiar exit-1 error. Path globs use the same matcher as `scan [PATHS]` (ancestor rule, `require_literal_separator`, absolute-only outside `--cwd`, Windows case-insensitive): installed copies of every candidate purl are discovered and purls with ≥ 1 matching copy are selected. Scoping sentences (shared with scan):

assert!(

envelope["hosted"]["failed"][0]["error"]

.as_str()

.is_some_and(|e| e.contains("installs from git")

&& e.contains("`git checkout -- yarn.lock`")),

.is_some_and(

|e| e.contains("installs from git") && e.contains("`git checkout -- yarn.lock`")

),

"{envelope}"

);

assert_eq!(

"the superseded record is reported:\n{envelope:#}"

);

async fn remove_and_rollback_by_superseded_record_uuid_unhost_the_release() {

for command in ["remove", "rollback"] {

let server = MockServer::start().await;

let tmp = tempfile::tempdir().unwrap();

let pristine = write_superseded_agent_fixture(tmp.path(), &server, B_PATCHED_INDEX).await;

let (code, envelope) = if command == "remove" {

run_remove_subprocess_online(tmp.path(), &server, SUPERSEDED_UUID)

} else {

run_rollback_subprocess_online(tmp.path(), &server, &[SUPERSEDED_UUID])

};

assert_eq!(code, 0, "{command}:\n{envelope:#}");

let restored = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();

assert_eq!(

restored, pristine,

"{command} {SUPERSEDED_UUID} must unwind the hosted pin of the same release:\n{envelope:#}"

);

assert!(

manifest_patch_keys(tmp.path()).is_empty(),

"{command}:\n{envelope:#}"

);

}