GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #636
Fixes #670

Summary

After two or more packages are vendored into a pnpm or uv project, a full vendor --revert, a rollback, or a remove sequence now removes the scaffolding vendoring created. Before, depending on revert order, it could leave an empty "pnpm": { "overrides": {} }, a scaffolded pnpm-workspace.yaml / empty overrides: section, or an empty [tool.uv.sources] header behind.

Root cause

When vendored mode wires two or more packages into a project, the first one creates any shared scaffolding: the pnpm package.json pnpm / pnpm.overrides tables, a pnpm-workspace.yaml (or its overrides: section), or uv's [tool.uv.sources] table. Whether vendoring created that scaffolding is recorded only on the first package's ledger entry (PnpmMeta.created_*, UvMeta.created_sources_table). Each later package finds the scaffolding already there and records false.

Revert removes an emptied scaffold only when the entry being reverted carries the flag. So cleanup happened only when the creator entry was reverted last. vendor --revert goes in purl order, which reverts the creator first in both reported fixtures.

Fix

"Vendor created this scaffold" is now a property of the shared files rather than of one ledger entry. VendorState::share_scaffold_flags takes the union of the flags across every entry that wires the same project-root files: all pnpm entries share package.json / pnpm-workspace.yaml, and all uv entries share pyproject.toml. It is applied:

• when the ledger is written (ledger_value, covering both save_state and the group-commit render), so new ledgers persist the shared flags;
• when it is read (parse_state, plus both group-commit value paths), so ledgers written by earlier releases are repaired, in memory and on their next save. A no-op re-vendor still writes nothing.

Whichever entry empties the scaffold now removes it, in any order. Revert's existing emptiness and scaffold-match checks are unchanged, so scaffolding holding anything else is kept: user keys in pnpm, a user-authored [tool.uv.sources], or a workspace file that has drifted. This uses the same OR-merge reasoning carry_forward_wiring already applies to a same-package re-vendor. The fix lives in one place in the ledger, and no backend revert code changed. The npm/, pypi/ and gem/ wrappers only dispatch to the binary, so they need no change.

Goldens that recorded the bug

• tests/fixtures/legacy-ledgers/pnpm/reverted/ recorded the earlier binary's two-package revert, residue included. The fixture now holds the restored package.json with no pnpm table, and no pnpm-workspace.yaml. pnpm stays out of that suite's byte-exact assertion only because the fixture's minified package.json comes back re-indented, which is a separate limitation that predates this PR.
• vendor_group_commit_e2e: its comment called the residue expected behavior. It now asserts pnpm leaves no workspace file and no pnpm table.

Tests (red → green)

The core tests vendor two packages through the real backend, persist the ledger after each one as the vendor loop does, then revert one entry at a time from a freshly loaded ledger, saving after each removal. That is the shape of vendor --revert, rollback and successive remove runs. The CLI test runs the real binary end to end.

The #670 coverage is at the backend level: real wire_uv / revert_uv plus the ledger round trip. Producing a two-package uv CLI fixture would need the patch service to build two wheels.

Local checks

• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --all-features --lib: 4852 passed. 4 failed, all permission-mode tests (chmod 0o555/0o444) that can't fail as root in this sandbox (copy_tree, vlt_heal, pypi_poetry, pypi_requirements). None of them touches this change.
• cargo test -p socket-patch-cli --all-features --lib: 834 passed.
• --test e2e_vendor_pnpm_build: 16 passed. --test e2e_vendor_pypi_build (real uv 0.8.17): 17 passed. --test mode_migration_pypi: 12 passed. --test vendor_ledger_schema_e2e: 3 passed. --test vendor_group_commit_e2e: 7 passed.
• --test covgap_commands_vendor: 41 passed. 3 *_state_write_failure_* tests failed because they rely on a read-only .socket/vendor dir, which root bypasses (same environment limit as above).
• node --test npm/socket-patch/bin/socket-patch.test.mjs: 4 passed.
• The full cargo test --workspace couldn't finish locally because the sandbox ran out of disk while linking test binaries. CI runs the full matrix.
• cargo fmt: main itself isn't rustfmt-clean (CI has no fmt gate). Every file this PR touches was clean on main and is still clean.

CI notes

On 8cd72d7, test (ubuntu-latest) and coverage failed on the outdated pnpm golden above, fixed in 8212cc8. native (ubuntu-latest, 2.29.2) (PDM backtest) failed one agent-mode cell (marker / appliedExactlyOne). Agent mode never reads the vendor ledger. That cell passes on main and on other open PRs, and it passed on the re-run on 0167c0b.

On 0167c0b, binary (macos-latest) (Bun lockb backtest) failed 1 of 25 cells (0.5.9 writer=0.1.6). Bun entries carry no pnpm/uv metadata, so this change can't affect them. The same job passed on 8cd72d7, which already contained the fix, and it passes on main. It passed on re-run (job 111191290748), so all CI is green on 0167c0b.

🤖 Generated with Claude Code

https://claude.ai/code/session_013yeY9QVvU6wJNVtWQi5MjY

Generated by Claude Code