Keep unwired-entry advice to a safe command

The previous wording told users to restore the pre-vendor lockfile
and prune again. That lock has no .socket/vendor paths, so the prune
would revert every vendored entry, not just the stale ones.

The warning now names only scan --prune. A prune that drift-keeps an
entry already explains it on its own GC: kept line, so the warning
points there instead of suggesting a lock edit whose reach it cannot
bound.

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -1149,7 +1149,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `reinstall_required`      | rollback `warnings[]` | rollback (v5.0): vendored/hosted wiring was unwound, but installed trees keep their patched bytes until the next package-manager install — the stale-install advisory. |
 | `hosted_state_not_preservable` | rollback `warnings[]` | rollback `--preserve-state` (v5.0): hosted pins were restored to upstream anyway — the lockfile pins are hosted mode's only record, so there is no local state to preserve; re-run `scan --mode hosted` to re-wire. (`remove --preserve-state` prints the same note on stderr.) |
 | `out_of_scope_copies_restored` | rollback `warnings[]` | path-scoped rollback (v5.0): a selected patch had installed copies outside the given patterns; ALL copies were restored (patches are per-package). Informational — never flips the exit. |
-| `vendor_ledger_entry_unwired` | scan `warnings[]` | a vendored entry's dependency left the lockfile (upgraded or removed), so the ledger supplement skipped it; the detail names the purls and points at `scan --prune`, which reverts them (no warning on a pruning non-hosted run). For an entry that prune drift-keeps because its lock entries were re-resolved since vendoring, it names the convergent way out: restore the lockfile from before vendoring, `scan --prune` again (the reverts then converge), and re-run the package manager's install. |
+| `vendor_ledger_entry_unwired` | scan `warnings[]` | a vendored entry's dependency left the lockfile (upgraded or removed), so the ledger supplement skipped it; the detail names the purls and points at `scan --prune`, which reverts them (no warning on a pruning non-hosted run). An entry that prune drift-keeps (its lock entries were re-resolved since vendoring, e.g. an npm uninstall re-locked it away) is reported on the prune's `GC: kept` line and keeps being warned about. |
 | `path_scope_excluded_supplements` | scan `warnings[]` | path-scoped scan (v5.0): lockfile-only / vendor-ledger supplement packages have no installed path and were excluded from the scoped scan; the detail carries the count. |
 | `vendor_commit_failed` | top-level error (`vendor`, and the nested vendor envelope of `scan` / `get --mode vendored`) | v5.0 group commit: the run's lockfile / manifest / ledger edits could not be written (the detail names the I/O error). Exit 1; the project's lockfiles and `.socket/vendor/state.json` are left as they were before the run (a partially-applied commit is put back), and the per-package events describe the uncommitted outcome. When putting a partially-applied commit back fails too, the journal is kept instead and the detail says the next socket-patch command in the project finishes the commit. |
 | `vendor_state_unreadable` | rollback `warnings[]`; remove top-level error | corrupt-ledger containment (v5.0). Rollback: an unreadable vendor ledger skips the vendored leg + manifest cleanup + GC and drives `partial_failure` exit 1 while the agent and hosted legs still run. Remove: a hard top-level error before any mutation. Also the Bun vendored preflight's refusal code: `get` / `scan --mode vendored`, `vendor`'s pre-takeover check and the `--dry-run` `would_refuse` preview report an unreadable `.socket/vendor/state.json` as itself (`errorCode` in `patches[]` / `download.patches[]`, or `get <uuid>`'s top-level `error.code`), fail-closed — nothing is exempt — instead of a Bun lock code. (v4's `redirect_state_unreadable` is no longer emitted: v5 never reads the redirect ledger on these paths.) |

crates/socket-patch-cli/src/commands/scan/render.rs

@@ -225,19 +225,18 @@ pub(super) const PRUNE_SKIPPED_EMPTY: &str = "Warning: --prune skipped: no insta
 
 /// The `vendor_ledger_entry_unwired` warning: vendored entries whose
 /// dependency left the lockfile (upgraded or removed), so the scan no
-/// longer discovers them. `--prune` reverts them, unless their lock entries
-/// were re-resolved since vendoring: the GC then drift-keeps them, and only
-/// restoring the pre-vendor lock lets the same prune converge (the
-/// drift-keep contract), so the detail names that way out too.
+/// longer discovers them, and `--prune` reverts them. A prune that
+/// drift-keeps an entry (its lock entries were re-resolved since vendoring)
+/// explains that on its own `GC: kept` line, so the detail points there
+/// rather than suggesting a lock edit whose reach it cannot bound.
 pub(super) fn unwired_vendored_detail(purls: &[String]) -> String {
     let one = purls.len() == 1;
     let them = if one { "it" } else { "them" };
     format!(
         "{} no longer used by the lockfile (the dependency was upgraded or removed) and {} \
-         skipped ({}); run `socket-patch scan --prune` to revert {them}. If that run keeps \
-         {them} because the lock entries were re-resolved since vendoring, restore the lockfile \
-         from before vendoring, run `socket-patch scan --prune` again, then re-run your package \
-         manager's install",
+         skipped ({}); run `socket-patch scan --prune` to revert {them} (a prune that keeps \
+         {them} because the lock entries were re-resolved since vendoring says so on its \
+         `GC: kept` line)",
         crate::ui::plural(purls.len(), "vendored entry is", "vendored entries are"),
         if one { "was" } else { "were" },
         purls.join(", "),

crates/socket-patch-cli/tests/scan_vendor_e2e.rs

@@ -1254,7 +1254,6 @@ async fn scan_vendor_prune_reconciles_unwired_entry_on_an_empty_crawl() {
     mount_patch_api(&mock, UUID).await;
     let tmp = tempfile::tempdir().unwrap();
     write_fixture(tmp.path());
-    let original_lock = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
     let (code, stdout, stderr) = run_scan_vendor(tmp.path(), &mock.uri(), &[]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
 
@@ -1268,8 +1267,11 @@ async fn scan_vendor_prune_reconciles_unwired_entry_on_an_empty_crawl() {
             "": { "name": "scan-vendor-test", "version": "0.0.0" }
         }
     });
-    let uninstalled_lock = serde_json::to_vec_pretty(&lock).unwrap();
-    std::fs::write(tmp.path().join("package-lock.json"), &uninstalled_lock).unwrap();
+    std::fs::write(
+        tmp.path().join("package-lock.json"),
+        serde_json::to_vec_pretty(&lock).unwrap(),
+    )
+    .unwrap();
     std::fs::remove_dir_all(tmp.path().join("node_modules/left-pad")).unwrap();
     let unwired = |v: &serde_json::Value| {
         v["warnings"]
@@ -1301,8 +1303,8 @@ async fn scan_vendor_prune_reconciles_unwired_entry_on_an_empty_crawl() {
     );
 
     // The drift-kept entry is still unwired, so the next plain rescan warns
-    // again, and its detail names the way out a drift-keep needs: `--prune`
-    // alone cannot clear it.
+    // again; its detail names the purl and the prune's `GC: kept` report
+    // instead of a lock edit that could unwire other vendored entries.
     let (code, stdout, stderr) = run_scan_vendor(tmp.path(), &mock.uri(), &[]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
@@ -1315,50 +1317,9 @@ async fn scan_vendor_prune_reconciles_unwired_entry_on_an_empty_crawl() {
         .unwrap_or_else(|| panic!("envelope={v}"))
         .to_string();
     assert!(
-        detail.contains(&format!("({PURL})")) && detail.contains("from before vendoring"),
+        detail.contains(&format!("({PURL})")) && detail.contains("`GC: kept`"),
         "{detail}"
     );
-
-    // Following that advice converges: restore the pre-vendor lock, prune
-    // (report mode, so the restored dependency is not re-vendored), then
-    // the package manager's install drops the dependency again. No entry,
-    // no artifact, no warning.
-    std::fs::write(tmp.path().join("package-lock.json"), &original_lock).unwrap();
-    let out = Command::new(binary())
-        .args([
-            "scan",
-            "--json",
-            "--prune",
-            "--yes",
-            "--api-url",
-            &mock.uri(),
-            "--api-token",
-            "fake-token",
-            "--org",
-            ORG_SLUG,
-        ])
-        .current_dir(tmp.path())
-        .output()
-        .expect("run");
-    let stdout = String::from_utf8_lossy(&out.stdout).into_owned();
-    assert_eq!(out.status.code(), Some(0), "stdout={stdout}");
-    let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
-    assert_eq!(
-        v["gc"]["revertedVendoredEntries"],
-        serde_json::json!([PURL]),
-        "envelope={v}"
-    );
-    std::fs::write(tmp.path().join("package-lock.json"), &uninstalled_lock).unwrap();
-    assert!(
-        !tmp.path()
-            .join(format!(".socket/vendor/npm/{UUID}"))
-            .exists(),
-        "artifact dir removed"
-    );
-    let (code, stdout, stderr) = run_scan_vendor(tmp.path(), &mock.uri(), &[]);
-    assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
-    let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
-    assert_eq!(unwired(&v), 0, "converged: {v}");
 }
 
 /// Interactive (non-JSON) `scan --vendor` pre-verifies patch baselines: