GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #367

Summary

A project that patches a dependency itself with bun patch no longer loses that patch when socket-patch rewires Bun locks. Hosted mode leaves the package on its registry entry and warns. Vendored mode refuses before writing anything. Before this change, both modes reported success, and every later bun install silently dropped the user's patch.

Root cause

bun patch --commit records patchedDependencies keyed on the registry name@version, in the root package.json and mirrored at the top of a text bun.lock. Bun applies the patch only while the lock resolves the package to that registry name@version. The hosted rewriters (rewrite_bun_lock and rewrite_bun_binary) and the vendored Bun backends (vendor/bun_lock.rs and vendor/bun_binary.rs) moved that entry to a hosted URL or a .socket/vendor tarball without reading patchedDependencies. Bun then stops applying the user's patch, and install still exits 0.

Changes

• Shared reader (vendor/bun_lock_text.rs): patched_dependency_keys merges the keys from the root manifest and from bun.lock's mirror. patched_dependency_key matches the exact name@version, scoped names included, and also a bare name so that a key without a version can't slip past. patched_dependency_detail is the one user-facing message both modes use.
• Hosted, bun.lock: rewrite_bun_lock skips the dep through skip_bun_user_patched and warns redirect_bun_patched_dependency_skipped with the key and a remedy. It also adds the uuid to bundled_skipped_uuids, so the in-run VEX never assumes the patch applied. Other packages in the lock are still rewired.
• Hosted, bun.lockb: the engine now reads the root package.json as advisory input for a binary-only project. It removes user-patched deps from the overrides passed to rewrite_bun_binary, with the same warning and VEX exclusion.
• Vendored, bun.lock and bun.lockb: read_project loads the keys and preflight_package refuses with vendor_lock_entry_unsupported before any write. The download plan's preflight_packages goes through the same gate, so it refuses before any download.
• Docs: a new row in docs/testing/bun-compatibility.md and a redirect_bun_patched_dependency_skipped row in CLI_CONTRACT.md.

I chose to refuse instead of re-keying. Bun has no measured way to key a patch on a non-registry resolution, so carrying the user's patch forward would mean writing a lock shape nobody has tested. Refusing keeps the user's patch working, and the message says how to combine the two: fold the Socket fix into their own patch, or drop the patchedDependencies entry and re-run.

Related but out of scope: #711 (npm 12's native patchedDependencies). It's a different package manager and code path, and earlier triage deliberately kept it separate. The reader added here is Bun-specific.

Test evidence

For the red runs I made patched_dependency_key always return None: all 4 regression tests failed, and they pass with the real matcher.

Real Bun 1.3.14 check: bun patch --commit writes exactly the keys and mirror the reader parses, scoped included ("@types/[email protected]": "patches/@types%[email protected]" under "patchedDependencies": { in bun.lock).

Commands run locally:

• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --all-features --lib: 5055 passed, 4 failed. The 4 failures (copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_…, pypi_requirements::wire_failure_rolls_back_…) are chmod-based tests that can't fail as uid 0 in this sandbox. They are in untouched modules and run as non-root in CI.
• SOCKET_PATCH_BUN_E2E_REQUIRED=1 cargo test -p socket-patch-cli --all-features --test e2e_redirect_bun_build --test e2e_vendor_bun_build --test mode_migration_bun -- --include-ignored with real Bun 1.3.14: 16 + 14 + 14 passed.
• cargo test -p socket-patch-cli --all-features --test e2e_bun_lockb --test in_process_vendor_bun_takeover --test vendor_eject_bun_lockb -- --include-ignored: 13 + 22 + 5 passed.
• cargo fmt: the new hunks are rustfmt-clean. The repo isn't fmt-clean on main (130 files) and CI has no fmt step, so I didn't reformat untouched code.

Bugbot round 1 (fixed in 71c0421)

• The engine now reads the root package.json beside either Bun lock. Before, a text bun.lock reached the manifest only through a parseable workspaces section.
• A user-patched Bun dep is recorded in the new RewriteResult::refused_bun_uuids and is never confirmed, even when a sibling package-lock.json takes the hosted URL.
• Regression hosted::engine::tests::issue_367_bun_lock_user_patched_package_is_never_confirmed: fails at the manifest-read assertion without the first fix, and at confirmed.is_empty() without the second. Passes with both. 129 Bun-area core tests pass, and clippy -D warnings is clean.

Golden stability (e5c0c35)

The new refused_bun_uuids set is skipped during serialization when empty, like the other per-ecosystem uuid sets, so the hashed rewrite goldens don't change.

Merge with main and inherited failure (148ef3b, e5dfad6)

• Merged main to clear a conflict that was only in two re-blessed goldens. Main's versions pass with this branch: 48/48 equivalence tests.
• main is red on coverage (utils::digest::tests::production_digests_go_through_the_helpers flags three Gradle files). I ported Route Gradle digests through utils::digest #878's fix (659ac2c → e5dfad6); it becomes a no-op once Route Gradle digests through utils::digest #878 lands.
• On e5dfad6, coverage, clippy and test (macOS, Windows) were green. Six Ubuntu Bun-compat cells failed with HTTP Error 503 from the patch service, all inside one 40 s window (18:55:41–18:56:20). Every cell that started after it passed, including 1.1.43 and 1.1.45 on the same lock formats. The CodeQL Analyze (rust) runner received a shutdown signal. The next push re-runs both.

Bugbot round 2 (fixed in 0b6121c)

• The patchedDependencies reader now accepts a JSONC package.json (comments, trailing commas), as Bun does. Before, it found no keys there, which mattered most for bun.lockb projects that have no lock mirror. The JSONC case in patched_dependency_keys_read_manifest_and_lock fails with the fallback disabled and passes with it.
• (21da460) A leading UTF-8 BOM is stripped before parsing, using utils::serde::strip_bom. The BOM case in the same test fails without the strip.

Wrappers under npm/, pypi/ and gem/ only dispatch to the binary, so they need no change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UMfrUU5yGZgTxSnrSsKLoL

Generated by Claude Code