GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1492

Summary

A Bun 1.3+ project that keeps a binary bun.lockb (saveTextLockfile = false) and excludes a member with "!packages/b" can patch that member again in hosted and vendored mode. Since 5.0.1, socket-patch treated the excluded member as a workspace member. It refused with redirect_workspace_lockfile_elsewhere (hosted) or vendor_lockfile_missing (vendored) and named a root lock Bun never reads for that member.

Root cause

lock_dialect in crates/socket-patch-core/src/hosted/governing_root.rs (#1097, #1480) picks how a root's workspaces globs are read from the lock at that root. Every lone bun.lockb was read with the pre-1.3 Bun rules, which ignore !. Bun 1.3+ applies ! whichever lock format it writes. It marks a bun.lockb with a cNfGvRsN extension that carries configVersion, the binary twin of the text lock's top-level key, which the bun.lock branch already checks.

Fix

• vendor/bun_lockb.rs: read_config_version walks only the lock's structure (header, the six buffer descriptors, the extension tags), seeking past every array, and returns the tag wherever Bun writes it. With nested overrides, Bun writes sCoPdOvR after it.
• lock_dialect calls it through the FIFO-safe opener on the blocking pool. It never reads package records, so a lock the full codec rejects still gets its tag read, and a large monorepo lock costs a few small reads. A lock that is untagged, unreadable or not binary keeps the wider pre-1.3 reading, as before.
• Docs: the CLI_CONTRACT.md line for redirect_workspace_lockfile_elsewhere and the Hosted scan from a yarn classic workspace member still pins nothing and exits 0 when the root's workspaces use a ! pattern (yarn 1 ignores it) or an extglob like packages/@(a|b) #1097 CLI test comment.

Test evidence

• New hosted::governing_root::tests::bun_lockb_with_a_config_version_tag_honours_negated_workspaces uses real Bun 1.3.14, 1.4.2 workspace-root and 1.4.2 scoped-overrides locks (the last is the new bun-lockb/1.4.2-scoped-overrides fixture, written on Linux) (no refusal, member lock not a stray), plus 1.2.23 and a non-binary lock (still refused).
  • Red before the fix: assertion left == right failed: bun.lockb of 1646 bytes; left: Some("redirect_workspace_lockfile_elsewhere"), right: None.
  • Green after: cargo test -p socket-patch-core --all-features --lib -- governing_root bun_lockb → 67 passed.
• New vendor::bun_lockb::tests::config_version_is_read_from_tagged_locks_only checks every historical fixture 0.1.1 to 1.4.2, plus workspace "late-dependent" locks.
• cargo fmt --all -- --check: clean. cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --all-features --lib: 6453 passed and 4 failed. All 4 are permission-denial tests (copy_tree symlinked root, vlt_heal unremovable lock, poetry/requirements write failure) that cannot fail as intended when the sandbox runs as root. They are unrelated to this diff, and CI runs as non-root.
• I did not run the full cargo test --workspace locally: the sandbox ran out of disk building every CLI test binary. CI runs the full suite.

Per-issue checklist

• Bun 1.3+ bun.lockb root is read as pre-1.3, so a "!"-excluded member can't be patched in hosted or vendored mode (regression in 5.0.1) #1492: hosted (refusal) and vendored (same lock_dialect → member_stray_lock path), covered by bun_lockb_with_a_config_version_tag_honours_negated_workspaces.

Notes / not changed

• Bun 1.3.0 writes no cNfGvRsN tag (fixture bun-lockb/1.3.0), so its binary lock still reads as older Bun. Its text bun.lock without configVersion already does the same today. This fails closed: a refusal, never a wrong pin.
• /code-review high suggested a different approach: decide membership from the lock's own workspace list (workspace_paths()) instead of the Bun version. I didn't take it. The text-lock branch decides by configVersion too, and the lock's list is stale for a member added since the last install. Moving both branches would be a separate change to the Hosted scan from a yarn classic workspace member still pins nothing and exits 0 when the root's workspaces use a ! pattern (yarn 1 ignores it) or an extglob like packages/@(a|b) #1097 design. Every other finding (full-parse dependence, unknown-extension stop, unbounded read, 1.3.0 doc claim, stale CLI test comment, missing workspace-root fixture) is fixed in 7d05f17. A reviewer's finding on scoped overrides is fixed in 13f02d6 (fixture fitted to the VEX corpus in e509c25).

🤖 Generated with Claude Code

Generated by Claude Code