GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1937

Summary

After vendoring an npm lockfileVersion 2 project, a plain npm install (npm 7-12) re-saves the lock and drops resolved from the legacy dependencies mirror node. rollback, remove and vendor --revert then half-reverted the lock and kept the vendored state. With this PR they restore both halves of the lock and delete the artifact. When something really did drift, they leave both halves alone, so the lock always stays consistent with itself.

Root cause

revert_one_record (crates/socket-patch-core/src/vendor/npm_lock.rs) only treated a live fragment as "ours" when its resolved was the vendored one. npm never writes resolved for a file: resolution in the v2 mirror, so the node keeps only version and the patched integrity. #879 taught vex and vendor --check that this shape is still wired, but the revert engine still called it drift. Each record was also reverted on its own, so the packages entry was restored to the registry while its mirror twin was kept. npm 6 then failed EINTEGRITY, and the run said "vendored state left untouched".

The vendor side had the same blind spot (found in review). Re-running vendor/scan, which was the printed remedy, treated the resolved-less node as not vendored and recorded the patched node as its pre-vendor original. A later revert would put the patched integrity back.

Changes

• Revert ownership: a legacy mirror node with no resolved and the recorded vendored integrity counts as ours (legacy_node_lost_our_resolved, the Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879 rule).
• Twin gate: a dry pass (TwinGate) finds packages with a drift-kept record. Their other records that would be rewritten are left alone, with a vendor_lock_entry_drifted warning naming the drifted twin. A converged, removed or moved-off twin is not blamed. Locks with no mirror records (v3, v1-free) skip the dry pass.
• Vendor: a resolved-less mirror node carrying our integrity counts as already vendored. Its record gets original: None, which carry_forward_wiring fills from the previous record.

Tests (red → green)

Commands run locally:

• cargo fmt --all -- --check: clean
• cargo clippy --workspace --all-features -- -D warnings: clean
• cargo test -p socket-patch-core --all-features --lib vendor::npm_lock: 122 passed
• cargo test -p socket-patch-cli --all-features --test e2e_vendor_npm_build -- npm_v2_revert_after_npm_install: passed. Red on the base code: rollback_failed; red without the vendor-side change: the mirror node was left on the patched integrity.
• cargo test -p socket-patch-core --all-features: 7000 passed, 4 failed. The 4 also fail on main in this container, because it runs as root and root ignores read-only and unremovable permissions: pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched, pypi_requirements::wire_failure_rolls_back_already_written_files, copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry.
• cargo test -p socket-patch-cli --all-features --lib --test e2e_vendor_npm_build: 940 + 44 passed
• cargo test --workspace --all-features could not finish locally: building every integration-test binary ran out of this session's disk allowance (No space left on device). CI runs the full matrix.

Per-issue checklist:

• Vendored npm rollback / remove / vendor --revert on a lockfileVersion 2 lock fail after any npm install, yet half-revert the lock: packages goes back to the registry while the legacy mirror keeps the patched integrity, and npm 6 then fails EINTEGRITY #1937: rollback / remove / vendor --revert after npm install on a v2 lock (e2e plus unit test); no half-revert when one half really drifted (two unit tests); re-vendor remedy path (unit plus e2e).

Review notes (/code-review high), not changed

• SRI comparison: the new rule compares integrity as an exact string. That is what Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression) #879's vex rule does too (pins_a_wired_ref compares the SRI strings exactly), so revert and vex agree.
• Workspace members' mirror pairing: legacy_pointer_packages_key maps /dependencies/ws/dependencies/x to node_modules/ws/node_modules/x, not packages/ws/node_modules/x. lock_inventory uses the same pre-existing convention. For a nested dependency of a workspace member, the twin gate falls back to the previous per-record behavior: no regression, but no gate either. Possible follow-up.
• Wiring the gate to the warning code: the gate keys on the vendor_lock_entry_drifted code. That is the same code RevertOutcome::drift_skipped uses to keep state, so the two can't disagree.

Wrappers

Only Rust core and CLI tests change. The npm, PyPI and gem wrappers only dispatch the binary.

https://claude.ai/code/session_011f9aeNkhAFT7jRyt8GURGB

Generated by Claude Code