GeezerVison

Adds two new optional patch pathways to the socket-patch CLI alongside the existing per-file blob path:

• Per-package archives at .socket/packages/<uuid>.tar.gz — a tarball of patched files for a single patch, extracted in one shot.
• Per-file bsdiff archives at .socket/diffs/<uuid>.tar.gz — bsdiff deltas that transform before_hash content into after_hash content.

The apply pipeline tries sources in order package → diff → blob, falling through on any failure. Every strategy still post-write-verifies file git-sha256 against after_hash, so the existing safety invariant is unchanged.

A new --download-mode {diff,package,file} flag (default: diff) controls what apply, get, scan, and repair fetch when local artifacts are missing.

Why?

• Smaller downloads — a one-line fix to a large minified bundle no longer ships the whole file (diff mode), and multi-file patches can ship as one archive (package mode).
• One round-trip per patch instead of one per file, for users with many patches applied.

Backwards compatibility

• Manifest schema is unchanged. Archives are keyed by the existing PatchRecord.uuid, so legacy .socket/manifest.json files Just Work.
• The new pathways are opt-in via PatchSources; tests prove uuid = None restores the pre-2.2 behavior exactly.
• Server-side /patch/diff/<uuid> and /patch/package/<uuid> endpoints are not live yet — 404s fall through gracefully to the file-blob path, so this is safe to ship ahead of server support.

What's in the diff

• New core modules:
  • patch/diff.rs — qbsdiff::Bspatch wrapper plus round-trip + malformed-delta tests.
  • patch/package.rs — tar + flate2 reader with path-traversal guards, whitelist filtering against expected_files, and hard caps on cumulative decompressed bytes (MAX_TOTAL_DECOMPRESSED_BYTES = 64 MiB), per-entry size (MAX_ENTRY_BYTES = 16 MiB), and entry count (MAX_ENTRIES = 10_000) to defuse gzip-bomb / Vec::with_capacity DoS.
• patch/apply.rs: PatchSources struct, AppliedVia enum, try_apply_from_archive / try_apply_from_diff helpers; apply_package_patch takes a PatchSources and optional uuid. try_apply_from_diff gates on the captured pre-apply current_hash so --force cannot run a diff against unexpected content.
• api/client.rs: fetch_diff(uuid) and fetch_package(uuid) mirror fetch_blob(hash) via a new private fetch_binary helper that dedupes the proxy/auth client split and HTTP handling. is_valid_uuid validator added.
• api/blob_fetcher.rs: DownloadMode enum + fetch_missing_sources dispatch by kind. get_missing_archives parallels get_missing_blobs.
• utils/cleanup_blobs.rs: cleanup_unused_archives reaps orphan .tar.gzs in .socket/packages/ and .socket/diffs/, invoked from repair.
• CLI: apply, get, scan, repair all accept --download-mode; apply's offline guard now reports per-patch source availability (one bucket per PURL) rather than a global blobs/diffs/packages count.
• Cargo deps added: qbsdiff = "1", tar = "0.4", flate2 = "1".

Tests

• 307 unit tests + 2 e2e gem pass (was 263 + 2). 42 new tests added across modules.
• New coverage: diff round-trips (text + binary), package extraction safety (traversal, oversize-header, too-many-entries, decompression-bomb truncation), fallback ordering (via package/diff/blob), force-mode + diff regression (test_apply_via_diff_falls_through_when_before_hash_mismatch), dry-run safety, UUID validation, archive download/cleanup helpers.
• All previously existing tests pass unchanged.
• cargo clippy --all-targets --workspace is clean for code I touched (4 pre-existing map_or warnings in e2e test files remain).

Review summary

Pre-merge security + quality review run by automated reviewers. Findings:

CRITICAL fixed: tarball decompression bomb (CWE-409) — added cumulative-bytes cap via Read::take, per-entry size check, entry-count cap, and Vec::with_capacity clamp.
HIGH fixed: force-mode + diff-strategy loophole (now gated on real current_hash == before_hash), offline guard rewritten per-patch, empty-archive-fetch round eliminated when blobs are already local, cleanup_unused_archives doc reconciled with behavior.

Three new bomb-defense tests verify each cap fires before allocation.

Test plan

• cargo test --workspace (307 unit + 2 e2e gem, 0 failures)
• cargo clippy --all-targets --workspace (no new warnings)
• cargo build --release
• Smoke test: blob-only manifest → apply --offline --verbose reports (via blob) and content matches
• Smoke test: manifest + package archive → apply --offline reports (via package)
• Smoke test: offline + no sources → fails with per-patch report listing affected PURL

Assisted-by: Claude Code:claude-opus-4-7