GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1621

Summary

socket-patch --update (and the passive update notice) told Bun users that the binary was "managed by npm" and gave them an npm command. For a bun add -g install, npm update -g is a no-op. In a Bun project, npm install …@latest writes a stray package-lock.json, leaves bun.lock stale, and breaks the next bun install --frozen-lockfile. Bun installs are now labelled bun and get Bun's own command:

Root cause

update/channel.rs's node_manager knew only npm, pnpm and vlt ("Anything else is npm, which also covers yarn and Bun (no dedicated hint yet)"). The fix adds Bun / Bunx managers at that boundary. commands/update.rs (the refusal) and update_notifier.rs (the passive notice) both go through upgrade_hint_for / channel_label_for, so they're both fixed. A path's own store component (.pnpm, .bun) now outranks a lockfile left beside the project, and pnpm's lockfile still outranks Bun's when no store names the manager. CLI_CONTRACT.md's managed-install row is updated to match. The npm/PyPI/gem wrappers have no update hints of their own, so they need no change.

Tests

• Unit (crates/socket-patch-core/src/update/channel.rs): bun_global_installs_get_bun_add_g, bun_project_installs_get_bun_add, bunx_cache_gets_bunx_latest. All 3 failed on main 657fce2 (cargo test -p socket-patch-core --lib update::channel: 18 passed, 3 failed) and pass with the fix (21 passed).
• E2E (crates/socket-patch-cli/tests/update/self_update_channels_e2e.rs): bun_project_refuses_with_bun_hint and bun_global_refuses_with_bun_hint spawn the real binary from a staged Bun layout and check the managed by bun refusal and its hint. cargo test -p socket-patch-cli --all-features --test update: 65 passed.
• cargo fmt --all -- --check and cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --all-features --lib: 6537 passed. 4 failed, all permission-injection tests (copy_tree, vlt_heal, pypi_poetry, pypi_requirements) that chmod a dir to 0o555 and expect a write to fail. The agent container runs as root, which ignores that. They're unrelated to this diff, and CI runs as non-root.
• The full cargo test --workspace run didn't fit this container's disk allowance (the target dir passed 20 GB). CI covers it.

Per-issue checklist:

• socket-patch --update on a Bun-installed copy says "managed by npm" and gives an npm command: npm update -g leaves a bun add -g install stale, and npm install …@latest in a Bun project breaks bun install --frozen-lockfile #1621 global (bun add -g): bun_global_installs_get_bun_add_g, bun_global_refuses_with_bun_hint
• socket-patch --update on a Bun-installed copy says "managed by npm" and gives an npm command: npm update -g leaves a bun add -g install stale, and npm install …@latest in a Bun project breaks bun install --frozen-lockfile #1621 project (text/binary lock, isolated linker): bun_project_installs_get_bun_add, bun_project_refuses_with_bun_hint
• socket-patch --update on a Bun-installed copy says "managed by npm" and gives an npm command: npm update -g leaves a bun add -g install stale, and npm install …@latest in a Bun project breaks bun install --frozen-lockfile #1621 bunx cache (scoped and unscoped spec, cache dir missing package.json): bunx_cache_gets_bunx_latest

/code-review high

I fixed two findings in 26461c3. (1) A bunx cache dir without a package.json was read as a global prefix. (2) A leftover pnpm-lock.yaml beat Bun's own .bun store. I tightened the bunx name match to a numeric uid in the same commit. Not fixed, as follow-ups outside this PR's scope:

• A hoisted Bun workspace member's own node_modules copy: the lockfile is only looked for beside the outermost node_modules. pnpm and vlt have the same limit today.
• A Bun workspace root where a member declares the dependency: pnpm gets pnpm update --recursive --latest. I couldn't verify Bun's equivalent here, so Bun keeps bun add …@latest.
• A global dir set with BUN_INSTALL_GLOBAL_DIR / bunfig install.globalDir isn't recognized as global.
• --backend=symlink installs that canonicalize into ~/.bun/install/cache have no node_modules component and read as Standalone. This predates the PR and applies to every channel heuristic.
• Probing each refusal twice (once for the label, once for the hint): this predates the PR.

https://claude.ai/code/session_016akFSbKa8ztJC4jji31cAn

Generated by Claude Code