v5: remove dead code and v3 compatibility shims (#296)

* Share one hosted-URL check for pdm and poetry

The pdm and poetry lockfile rewriters each carried an identical copy of
the rule that decides whether an existing pin is an earlier hosted
redirect of the same artifact. They now use one copy in python_lock, so
the two rewriters cannot drift apart. No behavior change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018JsczaHn8e6YrCpxs1NznQ

* Remove the never-implemented --one-off flag

`get --one-off` and `rollback --one-off` (and SOCKET_ONE_OFF) never
did anything: they only failed with a "not yet implemented" usage
error. v5.0 drops them. Passing `--one-off` is now an ordinary
unknown-flag error (still exit 2), and SOCKET_ONE_OFF is ignored.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Drop blanket dead-code allow on vlt lock parser

The whole vlt lockfile text module was exempt from dead-code checks,
which hid an unused edge-rendering method. The exemption is gone, the
unused method is deleted, and the macOS-only global node_modules
helper now opts out of the lint only on builds where it is truly
unused. No behavior change for vlt users.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Stop reading never-written package archives

Nothing has written `.socket/packages/<uuid>.tar.gz` for several
releases, yet apply, vendor and repair still probed and overlaid that
directory and the patch pipeline tried it before the diff archive.
v5.0 drops the read path and the `appliedVia: "package"` JSON value.
The GC sweeps (scan --prune, rollback, remove, repair) now remove
any leftover `.socket/packages/` files whole, so old projects are
cleaned up; the `removedPackageArchives` counter keeps reporting them.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Drop v3 env names and legacy scan spellings

v5.0 removes compatibility surface kept since v3/v4:
- The legacy env names SOCKET_PATCH_PROXY_URL, SOCKET_PATCH_DEBUG and
  SOCKET_PATCH_TELEMETRY_DISABLED are no longer read (use SOCKET_*).
- The hidden `scan --redirect` flag (use `--mode hosted`) and the
  hidden no-op `scan --detached` flag are gone; both are now unknown
  flags (exit 2).
- The hidden `--mode` values `host`, `redirect` and `vendor` (scan
  and get) are rejected; only hosted, vendored and agent remain.
The hidden `scan --apply` and `scan --vendor` spellings stay.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Delete uncalled public helpers in core vendor code

Several public functions in the core crate had no callers anywhere in
the workspace: the bun workspace artifact snapshot, the vlt lock sniff
wrapper, the in-memory project's binary/symlink/path helpers, and the
disk snapshot's invalidate, sync text read and disk-root accessors.
They are removed. The in-memory project's text/present/entries helpers
that only tests use are now test-only. No user-visible behavior change.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Drop the never-read berry zip URL from hosted

The hosted engine copied the yarn-berry cache-zip URL into every
redirect entry, but no rewriter ever read it: berry pins only the
zip's checksum, which is still taken from the patch reference. The
field is gone from DepOverride; references that still send it parse
as before.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Note the v5 dead-code removals in the changelog

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Share one service fallback policy across backends

Every service-backed vendor backend (npm tarball and directory, pypi,
cargo, composer, golang, gem, and the frozen maven/nuget path) decided
on its own when a patch-service miss falls back to a local build, when
`--vendor-source=service` refuses, and when tampered bytes are fatal.
Seven hand-copied versions of that policy could drift apart.

The policy now lives once in service_fetch.rs: ServicePolicy maps the
Pending, Unavailable, Failed and IntegrityMismatch outcomes, and each
backend keeps only its own handling of a ready artifact. Warnings,
refusal codes, messages and check order are unchanged, including the
npm tarball backend's wording for a failed request in service mode.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Align tests and docs with package-archive removal

Three integration tests still expected a leftover package archive to
be a patch source or to survive GC; they now pin the v5.0 rule (not a
source, always swept). Also: a rollback --one-off rejection test, test
names that no longer mention the removed --detached flag, a dead
berryZipUrl branch in the hosted memory harness, and contract rows
that still listed `--download-mode package`.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko

CHANGELOG.md

@@ -79,6 +79,33 @@ into the new version's section — see docs/releasing.md.
   `gem_setup` / `composer_setup` / `pth_hook` aliases are removed from
   `socket-patch-core`, along with the setup-only `npm_family` table column
   (`FileRow::detects_pnpm`) and `VLT_SETUP_MARKERS`.
+- **v3/v4 compatibility spellings are gone.**
+  - The v3.0 legacy env names `SOCKET_PATCH_PROXY_URL`, `SOCKET_PATCH_DEBUG`
+    and `SOCKET_PATCH_TELEMETRY_DISABLED` are no longer read and no longer
+    print a deprecation warning. Use `SOCKET_PROXY_URL`, `SOCKET_DEBUG` and
+    `SOCKET_TELEMETRY_DISABLED`.
+  - The hidden `scan --redirect` flag (use `--mode hosted`) and the hidden
+    no-op `scan --detached` flag (vendored mode is always manifest-free) are
+    removed. Both are now unknown-flag usage errors (exit 2).
+  - The hidden `--mode` values `host`, `redirect` and `vendor` on `scan` and
+    `get` are rejected; only `hosted`, `vendored` and `agent` are accepted.
+    The hidden `scan --apply` and `scan --vendor` spellings stay.
+- **`get --one-off` and `rollback --one-off`** (and `SOCKET_ONE_OFF`) are
+  removed. They were never implemented and only failed with a usage error;
+  `--one-off` is now an unknown-flag error (still exit 2) and
+  `SOCKET_ONE_OFF` is ignored.
+- **`.socket/packages/` package archives are no longer read.** Nothing has
+  written them for several releases. `apply`, `vendor` and `repair` stop
+  probing and staging the directory, and `apply`'s JSON `appliedVia` loses
+  its `"package"` value (`"diff"` or `"blob"` remain). The GC sweeps
+  (`scan --prune`, `rollback`, `remove`, `repair`) delete any leftover
+  `.socket/packages/` files whole (`rollback` and `scan --prune` still
+  report them as `removedPackageArchives`).
+- **Core crate:** removed uncalled public helpers
+  (`bun_lock::snapshot_binary_workspace_artifacts`, `vlt_lock_sniff_ok`,
+  and several `lock_inventory::view` accessors) and the never-read
+  `DepOverride::berry_zip_url` field (a `berryZipUrl` key in a patch
+  reference still parses).
 
 ### Changed (BREAKING): patch UI streamlining
 
@@ -96,10 +123,10 @@ into the new version's section — see docs/releasing.md.
   confirmation, in `--json` too (no `selection_required` outside agent
   mode). Agent-mode `get` keeps its picker and `Download and apply N
   patches?` prompt.
-- **`get` and `rollback` usage errors exit 2** (were 1): `get`'s
-  `--id`/`--cve`/`--ghsa`/`--package` multi-select, `--one-off --save-only`,
-  `--mode hosted|vendored --save-only`, `--one-off`, a malformed forced
-  identifier, and `rollback --one-off`. Every usage error now exits 2.
+- **`get` usage errors exit 2** (were 1): `get`'s
+  `--id`/`--cve`/`--ghsa`/`--package` multi-select,
+  `--mode hosted|vendored --save-only` and a malformed forced identifier.
+  Every usage error now exits 2.
 - **Human output:** warning lines no longer carry the `(code)` tag
   (`Warning: …`, `GC: skipped: …`); the codes stay in the JSON envelope.
   Error lines keep theirs (`Error (<code>): …`). Hosted mode is called "hosted", not "redirect", in human
@@ -502,9 +529,8 @@ into the new version's section — see docs/releasing.md.
   selected patch records are fetched into memory and every vendor-ledger entry
   carries `detached: true` plus the embedded `record` as its verification
   source, so a vendored project's footprint is `.socket/vendor/**` only. The
-  former `--detached` opt-in is now the only vendored posture — the flag is
-  hidden, accepted as a no-op for compatibility, and still a usage error
-  without vendored mode. JSON uses the detached download vocabulary for both
+  former `--detached` opt-in is now the only vendored posture, and the flag
+  itself is removed (see "Removed"). JSON uses the detached download vocabulary for both
   commands (`downloaded: N`, `detached: true`, `patches[].action` =
   `downloaded` | `skipped` | `failed`). The vendor step vendors exactly what
   discovery selected — the "whole manifest is vendored" re-vendor from a

README.md

@@ -644,16 +644,15 @@ socket-patch scan [PATHS]... [options]
 |------|---------|-------------|
 | `--mode <hosted\|vendored\|agent>` | — | Selects one of the three [patch modes](#three-patch-modes) (default: `hosted`). Combining `--mode` with a legacy boolean flag of a *different* mode is an error (exit 2); the same mode spelled both ways is accepted. |
 | `--package <name\|purl>` | `SOCKET_SCAN_PACKAGES` | Only scan these packages: a name (`lodash`, `@scope/pkg`, `requests`; case-insensitive) or a purl with or without its version (`pkg:npm/lodash`, `pkg:pypi/requests@2.31.0`). Repeat the flag or separate with commas. |
-| `--prune` | — | Agent-mode garbage collection after the scan: remove manifest entries for packages no longer present in the crawl (installed trees + lockfiles — a wiped `node_modules` alone doesn't prune lockfile-listed entries) and delete orphan blob/diff/package-archive files. [Vendored](#vendor) packages are exempt from the crawl-based prune, but a vendored entry whose dependency has left the lockfile is reverted. Ignored, with a `redirect_prune_ignored` warning, in hosted mode; without a mode the scan is report-only. |
+| `--prune` | — | Agent-mode garbage collection after the scan: remove manifest entries for packages no longer present in the crawl (installed trees + lockfiles — a wiped `node_modules` alone doesn't prune lockfile-listed entries) and delete orphan blob/diff-archive files (plus any legacy package archives). [Vendored](#vendor) packages are exempt from the crawl-based prune, but a vendored entry whose dependency has left the lockfile is reverted. Ignored, with a `redirect_prune_ignored` warning, in hosted mode; without a mode the scan is report-only. |
 | `--sync` | — | Shorthand for `--mode agent --prune`: the one-flag agent-mode auto-update run. |
 | `--batch-size <n>` | `SOCKET_BATCH_SIZE` | Packages per API request (default: `500` on the authenticated API, `100` on the public proxy). A request whose body would exceed 256 KiB is split into smaller ones. |
 | `--all-releases` | `SOCKET_ALL_RELEASES` | Store patches for every release/distribution variant, not just the installed one — PyPI wheel/sdist, RubyGems platform, Maven classifier. Makes the manifest portable across environments (e.g. cross-platform CI caches). |
 | `--vex <path>` | `SOCKET_VEX` | On a successful scan, also write an OpenVEX 0.2.0 document to this path. See [Inline VEX](#inline-vex-on-apply--scan--vendor). |
 | `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_*` | Passthrough to the embedded VEX builder; mirror the standalone [`vex`](#vex) knobs. Inert unless `--vex` is set. |
 
 > Deprecated, hidden spellings (still accepted): `--apply` (== `--mode agent`) and
-> `--vendor` (== `--mode vendored`). `--detached` is a hidden no-op kept for compatibility (vendored mode is
-> always manifest-free); it is still an error without vendored mode.
+> `--vendor` (== `--mode vendored`).
 
 **Examples:**
 ```bash
@@ -901,7 +900,6 @@ socket-patch get <identifier> [options]
 | `--ghsa` | — | Force identifier to be treated as a GHSA ID. |
 | `-p, --package` | — | Force identifier to be treated as a package name. |
 | `--save-only` | `SOCKET_SAVE_ONLY` | Download the patch without applying it (alias: `--no-apply`). |
-| `--one-off` | `SOCKET_ONE_OFF` | Reserved (hidden from `--help`): apply the patch immediately without saving to the `.socket` folder. **Not yet implemented** — the command currently errors up front. |
 | `--all-releases` | `SOCKET_ALL_RELEASES` | Download patches for every release/distribution variant of a matched package (PyPI wheel/sdist, RubyGems platform, Maven classifier), not just the installed one. |
 | `--mode <hosted\|vendored\|agent>` | — | How to consume the patch; the same modes as `scan --mode` (default: `agent`). |
 
@@ -1020,7 +1018,6 @@ socket-patch rollback [targets]... [options]
 | Flag | Env var | Description |
 |------|---------|-------------|
 | `--preserve-state` | `SOCKET_PRESERVE_STATE` | Unpatch the system but keep the local patch state — manifest entries, vendored artifacts + ledger entries — for a later re-apply, and skip GC. Hosted patches have no preservable state (the lockfile is their only record) and are restored to upstream either way. |
-| `--one-off` | `SOCKET_ONE_OFF` | Reserved: rollback by fetching original (`beforeHash`) files from the API, no manifest required. **Not yet implemented** — the command currently errors up front. |
 
 **Examples:**
 ```bash