SocketDev
diff --git a/‎crates/socket-patch-cli/CLI_CONTRACT.md‎
Lines changed: 1 addition & 1 deletion b/‎crates/socket-patch-cli/CLI_CONTRACT.md‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎crates/socket-patch-cli/src/commands/scan/hosted.rs‎
Lines changed: 4 additions & 0 deletions b/‎crates/socket-patch-cli/src/commands/scan/hosted.rs‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs‎
Lines changed: 28 additions & 0 deletions b/‎crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs‎
Lines changed: 28 additions & 0 deletions
diff --git a/‎crates/socket-patch-cli/tests/in_process_redirect.rs‎
Lines changed: 57 additions & 0 deletions b/‎crates/socket-patch-cli/tests/in_process_redirect.rs‎
Lines changed: 57 additions & 0 deletions
diff --git a/‎crates/socket-patch-cli/tests/in_process_redirect/vlt.rs‎
Lines changed: 46 additions & 0 deletions b/‎crates/socket-patch-cli/tests/in_process_redirect/vlt.rs‎
Lines changed: 46 additions & 0 deletions
diff --git a/‎crates/socket-patch-core/src/patch/redirect/bun_binary.rs‎
Lines changed: 87 additions & 2 deletions b/‎crates/socket-patch-core/src/patch/redirect/bun_binary.rs‎
Lines changed: 87 additions & 2 deletions
@@ -376,7 +376,7 @@ Recognition rules that hold for every ecosystem:
 
 * **Patch hosts.** A hosted reference counts only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin, with no userinfo. The uuid is the URL's LAST canonical-uuid path segment, because grant tokens may themselves be uuid-shaped. The Go module prefix is fixed. `socket-patch-<uuid>` registry / repository / source names count only through a pin. For a URL on any other host, see **Patch hosts** above.
 * **Pins, not definitions.** A registry, index or source *definition* alone (cargo `[registries]`, nuget `<add>`, pom `<repository>`, uv index tables, `.npmrc`) never makes a reference, because it survives a reverted pin. Sections the package manager ignores are not read: npm's v2 `dependencies` mirror, a `.cargo/config.toml` shadowed by `.cargo/config`. A Socket pin inside a maven `<profile>` is diagnosed, never a reference.
-* **Contested locks.** When one lock wires a package to a patch and another lock resolves the same `name@version` from a non-Socket source, the build's bytes depend on which package manager runs. The reference is then dropped with a `patched_ref_unattributable` diagnostic naming both files. This applies across npm / pnpm / yarn / bun and across uv / pylock / poetry / pdm / Pipfile.lock / requirements. PEP 723 script locks neither contest nor are contested. A **bundled** npm copy (`inBundle: true`, or v1 `bundled: true`) of the same `name@version` contests the reference too, in the same lock, in the other npm lock of a shrinkwrap/package-lock pair, or in any other lock. npm unpacks it from the parent package's tarball, so no rewire reaches it and it stays unpatched.
+* **Contested locks.** When one lock wires a package to a patch and another lock resolves the same `name@version` from a non-Socket source, the build's bytes depend on which package manager runs. The reference is then dropped with a `patched_ref_unattributable` diagnostic naming both files. This applies across npm / pnpm / yarn / bun and across uv / pylock / poetry / pdm / Pipfile.lock / requirements. PEP 723 script locks neither contest nor are contested. A **bundled** npm copy (`inBundle: true`, or v1 `bundled: true`) of the same `name@version` contests the reference too, in the same lock, in the other npm lock of a shrinkwrap/package-lock pair, or in any other lock. npm unpacks it from the parent package's tarball, so no rewire reaches it and it stays unpatched. Bun and vlt unpack bundled copies the same way (#469, #471). For Bun, that is a `bun.lock` entry whose meta is `{ "bundled": true }`, or a `bun.lockb` record that a dependency edge with the `bundled` behavior bit reaches, including one Bun shares with a regular install. Such an entry is never a reference, and it contests the reference the same way. For vlt, the lock records no node for a bundled copy, so the copy is found in the installed store: a real package directory inside a store package's own `node_modules`. Hosted and vendored scans skip these copies with `redirect_bun_bundled_instance_skipped` / `redirect_vlt_bundled_instance_skipped` / `vendor_bundled_instance_skipped`. When a bundled copy is the only instance, vendoring refuses with `vendor_lock_entry_not_rewritable`.
 * **Lockless pins.** With no lock to name a version, a `Cargo.toml` pin (every declaration on `socket-patch-<uuid>`, that registry defined on the patch host for the same uuid) or an exclusive nuget exact-id mapping is never a reference on its own, so v5.0 does not attest it (nor does `list` show it, or `rollback` / `remove` restore it — restore those files from version control). Only a pre-v5 redirect-ledger record naming a version the pin admits keeps it live. The same holds for a gem wired only in the `Gemfile` (the pre-bundler-2.6 mixed state, lock not converged).
 
 **Record resolution.** A candidate's record must carry the patch uuid the lockfile actually **wires**. It is taken from the first source that has one: the manifest (matched qualifier-insensitively), the hosted records above (this run's, then a pre-v5 ledger's), then the vendor ledger's embedded records. If none has it and the run is online, `vex` fetches the patch view by uuid from the patch API — for a v5 hosted checkout this is the normal path. The fetch uses `get`'s API client: the public proxy when no token is configured, and a one-shot 401/403 fallback to the proxy (free patches only). At most 10 fetches run concurrently. Fetched records stay in memory: `vex` never writes the manifest. A candidate still has no record under `--offline`, after a transport error or a 404, or when the patch is refused (paid without an entitled token); it is then omitted as `record_unavailable`, and the run is not aborted. A record whose uuid or package disagrees with the wiring is omitted as `record_mismatch`. The informational `socket-patch.vendor.json` marker is never a record source. When the lockfile wires a package to patch U, a manifest or ledger record for that package under another uuid is superseded, and a human-mode `Note:` says so.
 
@@ -1244,8 +1244,12 @@ pub(crate) async fn run_redirect_selected(
         // installed materialization unpatched, so attesting that purl from
         // the ledger would contradict the run's own warning. Excluded purls
         // fall back to `vex`'s normal installed-tree verification.
+        // A confirmed uuid whose bundled instance the rewriter had to skip
+        // (#469) leaves that copy unpatched, so it too is verified, never
+        // assumed.
         params.assume_applied = confirmed
             .iter()
+            .filter(|(_, uuid)| !rewrite.bundled_skipped_uuids.contains(uuid))
             .map(|(purl, _)| purl.clone())
             .filter(|purl| {
                 !gem_stale.stale_purls.contains(purl)
 
@@ -19,6 +19,8 @@ use socket_patch_core::vendor::lock_inventory::ProjectView;
 use super::StaleInstallOutcome;
 
 pub(super) const REINSTALL_REQUIRED: &str = "redirect_vlt_reinstall_required";
+/// A bundled copy of a redirected package that no rewire reaches (#471).
+pub(super) const BUNDLED_INSTANCE_SKIPPED: &str = "redirect_vlt_bundled_instance_skipped";
 
 /// The uuids of `deps` whose purl a vlt vendored ledger entry claims: a
 /// hosted takeover reverts them to a registry node before the rewrite.
@@ -368,6 +370,32 @@ pub(super) async fn heal_after_rewrite(
             out.stale_purls.insert(purl.clone());
         }
     }
+    // A bundled copy of a patched package (#471) has no lock node, so the
+    // redirect never reaches it: say so, and keep its purl out of the
+    // in-run attestation (lockfile discovery contests it the same way).
+    if inputs.final_lock.is_some() {
+        let copies = socket_patch_core::vendor::vlt_bundled::bundled_copies(&common.cwd).await;
+        for purl in inputs.records.keys() {
+            let base = socket_patch_core::utils::purl::strip_purl_qualifiers(purl);
+            let Some(location) = copies.get(base) else {
+                continue;
+            };
+            let Some((name, version)) = base
+                .strip_prefix("pkg:npm/")
+                .and_then(|rest| rest.rsplit_once('@'))
+            else {
+                continue;
+            };
+            let name = socket_patch_core::utils::purl::percent_decode_purl_component(name);
+            out.warnings.push(serde_json::json!({
+                "code": BUNDLED_INSTANCE_SKIPPED,
+                "detail": socket_patch_core::vendor::vlt_bundled::bundled_copy_detail(
+                    &name, version, location,
+                ),
+            }));
+            out.stale_purls.insert(purl.clone());
+        }
+    }
     out
 }
 
 
@@ -1033,6 +1033,63 @@ async fn scan_redirect_rewrites_bun_lock() {
     bun_manifestless_vex(tmp.path(), &lock_before, "bun-v1");
 }
 
+/// REGRESSION (#469): the project also gets a BUNDLED copy of the patched
+/// `name@version` (`parent` bundles it; Bun unpacks it from parent's
+/// tarball, so no rewire reaches it). The regular entry is redirected, but
+/// the in-run `--vex` must not attest the purl while that copy stays
+/// unpatched, exactly like a standalone `vex` run.
+#[tokio::test]
+#[serial]
+async fn scan_redirect_bun_bundled_copy_is_not_attested_in_run() {
+    let server = MockServer::start().await;
+    mock_discovery(&server).await;
+    mock_reference(&server).await;
+    mock_view(&server).await;
+
+    let tmp = tempfile::tempdir().unwrap();
+    write_bun_project(tmp.path(), 1);
+    let lock = std::fs::read_to_string(tmp.path().join("bun.lock")).unwrap();
+    let bundled = format!(
+        "    \"parent/{NAME}\": [\"{NAME}@{VERSION}\", \"\", {{ \"bundled\": true }},          \"sha512-UPSTREAMupstream==\"],\n  }}\n}}\n"
+    );
+    let lock = lock.replacen("  }\n}\n", &bundled, 1);
+    std::fs::write(tmp.path().join("bun.lock"), &lock).unwrap();
+    let copy = tmp
+        .path()
+        .join("node_modules/parent/node_modules")
+        .join(NAME);
+    std::fs::create_dir_all(&copy).unwrap();
+    std::fs::write(
+        copy.join("package.json"),
+        format!(r#"{{ "name": "{NAME}", "version": "{VERSION}" }}"#),
+    )
+    .unwrap();
+
+    let out = tmp.path().join("out.vex.json");
+    let mut args = redirect_args(tmp.path(), server.uri());
+    args.vex.vex = Some(out.clone());
+    args.vex.vex_product = Some("pkg:npm/consumer@0.0.0".into());
+    let _ = run(args).await;
+
+    let rewritten = std::fs::read_to_string(tmp.path().join("bun.lock")).unwrap();
+    assert!(
+        rewritten.contains(&format!("\"{NAME}@{HOSTED_URL}\"")),
+        "the regular entry is redirected"
+    );
+    assert!(
+        rewritten.contains(&format!("\"parent/{NAME}\": [\"{NAME}@{VERSION}\"")),
+        "the bundled entry keeps its registry spec"
+    );
+    let attested = std::fs::read_to_string(&out)
+        .ok()
+        .and_then(|text| serde_json::from_str::<serde_json::Value>(&text).ok())
+        .is_some_and(|doc| doc.to_string().contains(PURL));
+    assert!(
+        !attested,
+        "in-run VEX must not attest a purl whose bundled copy stays unpatched"
+    );
+}
+
 /// The bun 1.4 leg: `"lockfileVersion": 2` is the SAME emitted grammar as 1
 /// (bun 1.4 bumped the integer to gate stricter parse checks — oven-sh/bun
 /// PR #31539 — same-fixture locks are byte-identical except the integer), so
 
@@ -513,6 +513,52 @@ async fn scan_redirect_vlt_artifact_ambiguous_earlier_pin_is_not_confirmed() {
     );
 }
 
+/// REGRESSION (#471): `bund` bundles left-pad@1.3.0, which vlt unpacks
+/// into bund's own store entry with no `vlt-lock.json` node. The hosted
+/// redirect still pins the regular node, but the scan must say loudly that
+/// the bundled copy stays unpatched instead of reporting a clean success.
+#[tokio::test]
+async fn scan_redirect_vlt_bundled_store_copy_warns() {
+    let server = MockServer::start().await;
+    mock_all(&server).await;
+    let tmp = tempfile::tempdir().unwrap();
+    write_vlt_project(tmp.path(), Era::V1);
+    let bund = "\"~npm~bund@1.0.0\": [0,\"bund\",\"sha512-BUND==\"]";
+    std::fs::write(
+        tmp.path().join("vlt-lock.json"),
+        lock_with(Era::V1, &[bund.to_string(), registry_node(TILDE_ID)]),
+    )
+    .unwrap();
+    let parent = tmp
+        .path()
+        .join("node_modules/.vlt/~npm~bund@1.0.0/node_modules/bund");
+    std::fs::create_dir_all(parent.join("node_modules/left-pad")).unwrap();
+    std::fs::write(
+        parent.join("package.json"),
+        r#"{"name":"bund","version":"1.0.0","bundleDependencies":["left-pad"]}"#,
+    )
+    .unwrap();
+    std::fs::write(
+        parent.join("node_modules/left-pad/package.json"),
+        PACKAGE_JSON,
+    )
+    .unwrap();
+    std::fs::write(parent.join("node_modules/left-pad/index.js"), PRISTINE).unwrap();
+
+    let (_, doc) = scan_hosted(tmp.path(), &server, &[], &[]);
+
+    assert_eq!(redirected(&doc), 1, "{doc:#}");
+    assert!(
+        warning_codes(&doc).contains(&"redirect_vlt_bundled_instance_skipped".to_string()),
+        "{doc:#}"
+    );
+    let detail = warning_detail(&doc, "redirect_vlt_bundled_instance_skipped");
+    assert!(
+        detail.contains("~npm~bund@1.0.0") && detail.contains("UNPATCHED"),
+        "{detail}"
+    );
+}
+
 /// A real `node_modules/.vlt` store with no hidden lock (0.0.0-1 and
 /// 0.0.0-32 write none) is vlt's install state too: vlt drives beside a
 /// package-lock.json, so there is no sibling warning and a failed preflight
 
@@ -47,6 +47,7 @@ pub fn rewrite_bun_binary(content: &[u8], overrides: &[DepOverride], result: &mu
             Ok(v) => v,
             Err(_) => unreachable!("validated lock"),
         };
+        let mut skipped: Vec<RewriteWarning> = Vec::new();
         let attempt = (|| {
             let mut edits = Vec::new();
             let packages = candidate.packages()?;
@@ -69,7 +70,29 @@ pub fn rewrite_bun_binary(content: &[u8], overrides: &[DepOverride], result: &mu
                     dep.version
                 ));
             }
+            let mut wired = false;
             for p in matching {
+                // A bundled edge's copy is unpacked from its parent's
+                // tarball, which no redirect reaches (#469). A record ONLY
+                // bundled edges reach is skipped; one Bun shares with a
+                // regular install is still redirected for that install.
+                if p.bundled {
+                    skipped.push(RewriteWarning {
+                        code: "redirect_bun_bundled_instance_skipped".into(),
+                        detail: format!(
+                            "bun.lockb package #{} ({name}@{}) is {}bundled inside its \
+                             parent's tarball and CANNOT be redirected there — that copy \
+                             stays UNPATCHED; vendor or update the bundling parent to cover it",
+                            p.id,
+                            dep.version,
+                            if p.bundled_only { "" } else { "also " },
+                        ),
+                    });
+                    if p.bundled_only {
+                        continue;
+                    }
+                }
+                wired = true;
                 if p.resolution == dep.artifact_url && p.integrity.as_deref() == Some(integrity) {
                     continue;
                 }
@@ -84,10 +107,15 @@ pub fn rewrite_bun_binary(content: &[u8], overrides: &[DepOverride], result: &mu
                     new: Some(candidate.snapshot(p.id)?),
                 });
             }
-            Ok::<_, String>(edits)
+            Ok::<_, String>((edits, wired))
         })();
+        if !skipped.is_empty() {
+            result.bundled_skipped_uuids.insert(dep.patch_uuid.clone());
+        }
+        result.warnings.append(&mut skipped);
         match attempt {
-            Ok(edits) => {
+            Ok((_, false)) => {}
+            Ok((edits, true)) => {
                 lock = candidate;
                 result.edits.extend(edits);
                 result
@@ -134,6 +162,63 @@ mod tests {
         }
     }
 
+    fn bundled_fixture(shape: &str) -> Vec<u8> {
+        std::fs::read(
+            std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+                .join("tests/fixtures/bun-lockb-bundled")
+                .join(shape)
+                .join("bun.lockb"),
+        )
+        .unwrap()
+    }
+
+    fn is_number() -> DepOverride {
+        DepOverride {
+            name: "is-number".into(),
+            artifact_url: "https://patch.example.test/7.0.0/is-number-7.0.0.tgz".into(),
+            ..dep("7.0.0")
+        }
+    }
+
+    /// REGRESSION (#469): a record only a bundled edge reaches is unpacked
+    /// from the parent's tarball, so redirecting it installs nothing: it is
+    /// skipped loudly, not counted, and the uuid is not confirmed. A record
+    /// Bun shares between a regular and a bundled install IS redirected
+    /// (the regular copy gets the patch) with the same loud warning, since
+    /// the bundled copy stays unpatched.
+    #[test]
+    fn bundled_records_are_not_redirected_silently() {
+        let only = bundled_fixture("only");
+        let mut result = RewriteResult::default();
+        rewrite_bun_binary(&only, &[is_number()], &mut result);
+        assert!(result.binary_files.is_empty(), "lock untouched");
+        assert!(result.edits.is_empty(), "{:?}", result.edits);
+        assert!(result.confirmed_bun_binary_uuids.is_empty());
+        let codes: Vec<_> = result.warnings.iter().map(|w| w.code.as_str()).collect();
+        assert_eq!(
+            codes,
+            ["redirect_bun_bundled_instance_skipped"],
+            "{:?}",
+            result.warnings
+        );
+        assert!(result.warnings[0].detail.contains("UNPATCHED"));
+        assert!(result.bundled_skipped_uuids.contains("7.0.0"));
+
+        let both = bundled_fixture("both");
+        let mut result = RewriteResult::default();
+        rewrite_bun_binary(&both, &[is_number()], &mut result);
+        assert_eq!(result.edits.len(), 1, "{:?}", result.edits);
+        assert!(result.binary_files.contains_key("bun.lockb"));
+        let codes: Vec<_> = result.warnings.iter().map(|w| w.code.as_str()).collect();
+        assert_eq!(
+            codes,
+            ["redirect_bun_bundled_instance_skipped"],
+            "{:?}",
+            result.warnings
+        );
+        assert!(result.bundled_skipped_uuids.contains("7.0.0"));
+    }
+
     #[test]
     fn malformed_metahash_cannot_confirm_an_existing_binary_redirect() {
         let mut result = RewriteResult::default();