GeezerVison

What

Adds crates/socket-patch-cli/tests/e2e_vendored_production.rs — the vendored-mode
counterpart to e2e_hosted_production.rs. The synthetic e2e_vendor_*_build.rs
capstones prove the vendoring mechanism with a hand-staged blob and
vendor --offline; they never contact production. This suite drives
scan --mode vendored against the real Socket production service and real
upstream registries, with no mocking anywhere, on the anonymous free public
proxy (no token; SOCKET_NO_CONFIG=true, every SOCKET_* scrubbed with hostile
seeds so a dropped scrub reddens the suite).

Per package manager it proves the full loop: install pristine (asserted pristine —
anti-vacuity) → scan --mode vendored materializes the real free-tier patch
into .socket/vendor/<eco>/<uuid>/ and rewires the lock/manifest → cold reinstall
from ONLY the committable files (empty caches, offline) → the installed bytes are
the vendored (patched) bytes, not the pristine registry bytes → idempotent
re-run (already_vendored, byte-stable lock) → vendor --revert byte-restores.
It proves byte delivery, not CVE efficacy — matching how the capstones assert.

#[ignore]-gated (stays out of the test/e2e jobs), soft-skips absent toolchains
unless SOCKET_PATCH_VENDORED_E2E_STRICT=1, cache-isolated via
common/cache_env.rs. Reuses the hosted suite's pinned patch catalog. Companion doc:
docs/testing/vendored-production-e2e.md.

Coverage

Plus preflight_required_patches_are_published (catalog canary against
patches-api.socket.dev, mirrors the hosted preflight).

cargo uses cargo fetch --offline rather than cargo build: the production
traitobject patch injects a compile_error! unless the allow-unmaintained feature
is set (the patch's intent), so build fails by design — that's patch content, not a
vendoring defect. The leg proves the whole graph resolves from committable files with
zero registry downloads and byte-checks the vendored directory.

How to run

# everything, soft-skipping absent toolchains
cargo test -p socket-patch-cli --test e2e_vendored_production -- --ignored --test-threads=1

# CI: every "toolchain missing" soft-skip becomes a hard failure
SOCKET_PATCH_VENDORED_E2E_STRICT=1 \
  cargo test -p socket-patch-cli --test e2e_vendored_production -- --ignored --test-threads=1

Knobs: SOCKET_PATCH_VENDORED_E2E_GEM_STRICT=1 (promote the gem gap to a hard
failure), SOCKET_PATCH_VENDORED_E2E_CANARY_STRICT=1 (fail when maven/nuget/composer
gain a free patch).

Notes

cargo test -p socket-patch-cli --test e2e_vendored_production --no-run compiles
cleanly (the primary gate — the suite is #[ignore]). Ran the full --ignored set
locally against production, all 13 tests green (npm 11.6.2, pnpm 11.18.0, yarn
4.6.0 / corepack [email protected], bun 1.3.14, uv, python3/pip, cargo, ruby+bundle all
present; composer + deno absent but their legs need no toolchain):

• Ran green — npm, pnpm, yarn classic, yarn berry, bun, pip, uv, cargo,
  preflight, golang (zero-patch), deno (unsupported), canary.
• Soft-skip — none locally; legs soft-skip only when their toolchain is absent.
• CLI bugs surfaced (marked xfail, not fixed — tests-only PR):
  • pnpm ≥ 11 ignores package.json pnpm.overrides (moved to
    pnpm-workspace.yaml), so a frozen install refuses
    ERR_PNPM_LOCKFILE_CONFIG_MISMATCH even though the vendored tarball + lock are
    correct (the lockfile passes pnpm's supply-chain policy). The leg reproduces the
    documented workaround (mirror the override into pnpm-workspace.yaml) to prove
    the artifact IS installable, and fails loudly on any other error. Fix belongs in
    the CLI: emit pnpm-workspace.yaml overrides on pnpm ≥ 11.
  • gem vendoring refuses the platform-qualified purl
    (pkg:gem/[email protected]?platform=ruby) with platform_gem_unsupported
    (status: partial_failure); download succeeds. The leg asserts redirect+download
    and tolerates the vendor failure, failing loudly on any other error and
    auto-upgrading to a full bundle install delivery proof once the CLI vendors
    platform gems.

🤖 Generated with Claude Code