[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1581

Summary

socket-patch repair now restores the .socket/vendor/npm/<uuid>/.gitignore
and .gitattributes for every npm-family vendored entry (npm, pnpm, yarn,
bun text, bun.lockb, vlt), both when the artifact is healthy and after a
redownload. It then checks that git would actually commit the artifact. A
rule that the uuid .gitignore can't override (such as .socket/) now
fails with vendor_artifact_gitignored, the same refusal vendor gives,
on every run until the rule is fixed.

Root cause

repair only rewrote the uuid-dir metadata for vlt and JVM entries
(commands/vendored_backend/repair.rs). The npm tarball flavors only got
it from a vendored scan (npm_common.rs keep_pack_committable). So:

1. A project vendored before Vendored Bun tarballs go into Git LFS when .gitattributes tracks *.tgz with LFS, so a checkout without LFS fails bun install --frozen-lockfile #1541 kept the legacy * -text
.gitattributes. A repository *.tgz filter=lfs rule still applied,
   and the repaired tarball went back into LFS on the next commit.
2. When the whole <uuid>/ dir was lost, repair restored only the .tgz.
   With a stock *.tgz ignore rule, git ignored the redownloaded tarball,
   so "commit it" committed nothing (the second symptom reported on repair leaves a pre-#1541 root <uuid>/.gitattributes as * -text, so the repaired Bun tarball goes back into Git LFS on the next commit #1581).

Changes

• core vendor::redownload::restore_npm_uuid_metadata replaces the
  vlt-only vlt_lock::restore_vlt_uuid_metadata and covers every npm
  entry. It skips a vendor dir reached through a symlink (Vendored yarn classic writes and deletes through a symlinked .socket/vendor/npm dir, so rollback in one project deletes another project's vendored tarballs and breaks its frozen install #664).
  redownload::restore calls it after every npm redownload. This also
  covers vendor's own redownload path.
• core vendor::redownload::npm_artifact_commit_check runs the git
  ignore probe over the artifact (a vlt dir is probed as a directory) and
  both metadata files.
• repair runs both on healthy and workspace-mirror entries before the
  bun mirror repair, and runs the check after a redownload.
• npm_dir::restore_uuid_metadata now reports whether it rewrote
  anything.
• Docs: CLI_CONTRACT.md and docs/ecosystems.md now say repair also
  rewrites a pre-Vendored Bun tarballs go into Git LFS when .gitattributes tracks *.tgz with LFS, so a checkout without LFS fails bun install --frozen-lockfile #1541 .gitattributes.

Test evidence

Red → green. The new CLI tests were run against origin/main with only
the test file changed, in a separate worktree:

cargo test -p socket-patch-cli --all-features --test in_process_vendor repair_
main:   repair_of_a_lost_uuid_dir_under_an_ignored_socket_dir_fails ... FAILED
        repair_upgrades_a_legacy_uuid_gitattributes ... FAILED
        repair_of_a_lost_uuid_dir_restores_its_gitignore_and_gitattributes ... FAILED
branch: 4 passed; 0 failed

Per-issue checklist for #1581:

• Legacy * -text survives repair (healthy artifact, and an LFS
  pointer redownload) → repair_upgrades_a_legacy_uuid_gitattributes
  (also asserts git check-attr filter = unset under a repo
  *.tgz filter=lfs rule).
• Lost uuid dir comes back without .gitignore/.gitattributes, so
  the tarball is ignored by *.tgz →
  repair_of_a_lost_uuid_dir_restores_its_gitignore_and_gitattributes
  (asserts git check-ignore is empty).
• Unoverridable .socket/ rule reports success →
  repair_of_a_lost_uuid_dir_under_an_ignored_socket_dir_fails, which
  fails with vendor_artifact_gitignored on both the first and the
  second run.
• Core units in redownload.rs:
  npm_redownload_restores_the_uuid_metadata,
  npm_uuid_metadata_upgrades_a_legacy_gitattributes,
  npm_commit_check_refuses_only_an_unoverridable_rule.

Local runs:

• cargo fmt --all -- --check and
  cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test --workspace --all-features --no-fail-fast: everything
  passes except tests that can't pass in this sandbox. Those fail the same
  way independent of this diff:
  • chmod-based write-failure tests, because the sandbox runs as uid 0
    (repair_invariants::repair_cleanup_failure_is_reported_in_json_and_silent_modes,
    repair_render::repair_exits_zero_and_stays_quiet_when_lock_file_unremovable,
    in_process_redirect write-failure tests, core
    copy_tree/vlt_heal/pypi_* write-failure tests).
  • e2e_bun_lockb::binary_shared_bundled_record_hosted_pin_is_managed,
    which reaches the real patches-api.socket.dev through a blocked proxy.
• No wrapper changes are needed: npm/, pypi/ and gem/ only
  dispatch to the binary.

/code-review high

The review found 8 candidates. Fixed here:

• symlinked vendor dir
• check only on the rewrite run
• workspace-mirror continue skipping the metadata step
• error wording
• vlt dir probe

Not fixed:

• No rebuilt event for a metadata-only rewrite: the existing vlt
  contract test (vlt_repair_restores_the_uuid_gitignore) says it is
  not a rebuild.
• --dry-run preview of the metadata rewrite: the existing vlt
  behavior, out of scope.
• Folding the three gitignore-probe call sites into one helper: a
  refactor, left for Tracking: revert every vendored backend through one record-revert engine instead of nine hand-written mechanisms #989/Tracking: drive the seven npm-family vendor backends through one generic driver #920.

Follow-ups

• socket-patch.vendor.json (the informational marker) isn't restored
  when the uuid dir is lost. It is never a trust input.

https://claude.ai/code/session_01WMCn4ztc3DCiDDSBZDtjHd

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1d7c6ad. Configure here.}