Require server artifacts and exact redownload for vendoring (#300)

* Require server artifacts for vendoring

Download verified complete packages instead of rebuilding archives from
installed files, patch blobs, or registry sources. Repair damaged vendor
copies from the exact recorded server artifact without changing lockfile
or ledger identity.

Retain the N-API crate and hosted in-memory patch application engine for
the GitHub App. Consume server-provided upstream Yarn Berry checksums and
preserve the latest v5 Maven reactor and Gradle support.

Assisted-by: Codex:GPT-6

* Align vendoring coverage and lint metadata

Regenerate the vlt matrix after replacing its local-build leg with the
service alias. Remove orphaned builder documentation and retain the
existing backend argument style for Python distribution downloads.

Assisted-by: Codex:gpt-6-astra

* Serve artifacts in native Bun compatibility tests

Use fixture grants for fresh vendoring and redownload repairs. Match the
installed npm version when building fixture archives so a workspace's
different top-level version cannot replace its nested dependency.

Assisted-by: Codex:gpt-6-astra

* Fix download-based vendoring CI and repair

Exercise served artifacts across the package-manager fixtures while
preserving cold-cache offline install and revert coverage. Repair keeps
Bun lockfiles and artifact identities unchanged.

Record complete Composer inventories after filter normalization, and
use the shared service policy for archive and Go redownload failures.

Assisted-by: Codex:gpt-6-astra

* Assert exact Composer redownload in capstone

Check that restoring modified filter files preserves the complete

artifact inventory, lockfile, and ledger without in-place healing.

Assisted-by: Codex:gpt-6-astra

* Fix: Record file inventory for Composer vendor artifacts (#323)

Composer vendors now compute and persist file_inventory at vendor time,
matching the behavior of Cargo, Go, gem, and vlt. This enables directory
repair and same-UUID vendor restore for Composer packages, preventing
redownload::restore from failing on missing inventory data.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Author: mikolalysenko

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -57,7 +57,7 @@ docker-e2e = []
 # vendor_crash_safety_e2e / vendor_group_commit_e2e crash the binary through
 # its failpoints; with this, `cargo test --release` (the test-release job)
 # builds them in too. Dev-only: resolver 2 keeps it out of normal builds.
-socket-patch-core = { workspace = true, features = ["failpoints"] }
+socket-patch-core = { workspace = true, features = ["failpoints", "test-fixtures"] }
 sha2 = { workspace = true }
 # docker_e2e_vendor_maven's host oracle recomputes the maven2 .jar.sha1 sidecar.
 sha1 = { workspace = true }

crates/socket-patch-cli/Cargo.toml

@@ -161,17 +161,15 @@ pub struct GlobalArgs {
     )]
     pub download_mode: String,
 
-    /// Where `vendor` acquires the installable patched artifact. `auto`
-    /// (default) downloads the prebuilt archive from the patch.socket.dev
-    /// vendoring service and silently falls back to a local build on any miss;
-    /// `service` requires the service and fails closed; `build` always builds
-    /// locally. Only `vendor` and the vendored modes of `scan`/`get` use
-    /// this; other subcommands accept it silently.
+    /// Download installable patched artifacts from the patch service.
+    /// `service` is the default; `auto` is a compatibility alias. Local
+    /// artifact building is no longer supported. Healthy committed artifacts
+    /// can be reused offline; missing or corrupt artifacts require a download.
     #[arg(
         help_heading = GLOBAL_OPTIONS,
         long = "vendor-source",
         env = "SOCKET_VENDOR_SOURCE",
-        default_value = "auto",
+        default_value = "service",
         value_parser = parse_vendor_source,
     )]
     pub vendor_source: String,
@@ -405,9 +403,9 @@ impl GlobalArgs {
     /// empty). The names are validated at parse time, so this is an exact
     /// match.
     pub(crate) fn ecosystem_selected(&self, eco: Ecosystem) -> bool {
-        self.ecosystems.as_ref().is_none_or(|list| {
-            list.is_empty() || list.iter().any(|name| name == eco.cli_name())
-        })
+        self.ecosystems
+            .as_ref()
+            .is_none_or(|list| list.is_empty() || list.iter().any(|name| name == eco.cli_name()))
     }
 
     /// [`Self::ecosystem_selected`] for the ecosystem of `purl`; a purl of
@@ -680,7 +678,7 @@ impl Default for GlobalArgs {
             proxy_url: None,
             ecosystems: None,
             download_mode: "diff".to_string(),
-            vendor_source: "auto".to_string(),
+            vendor_source: "service".to_string(),
             maven_config: None,
             vendor_url: None,
             patch_server_url: None,
@@ -937,7 +935,7 @@ mod tests {
             assert!(cli.common.ecosystems.is_none());
             assert_eq!(cli.common.download_mode, "diff");
             assert_eq!(
-                cli.common.vendor_source, "auto",
+                cli.common.vendor_source, "service",
                 "empty SOCKET_VENDOR_SOURCE must fall back to the `auto` default"
             );
             assert_eq!(cli.common.manifest_path, "keep.json");
@@ -952,7 +950,7 @@ mod tests {
         with_clean_socket_env(|| {
             // Default when unset.
             let cli = TestCli::try_parse_from(["socket-patch"]).unwrap();
-            assert_eq!(cli.common.vendor_source, "auto");
+            assert_eq!(cli.common.vendor_source, "service");
 
             // CLI value, case-normalized to the canonical tag.
             let cli =
@@ -961,8 +959,7 @@ mod tests {
 
             // Env var honored.
             std::env::set_var("SOCKET_VENDOR_SOURCE", "build");
-            let cli = TestCli::try_parse_from(["socket-patch"]).unwrap();
-            assert_eq!(cli.common.vendor_source, "build");
+            assert!(TestCli::try_parse_from(["socket-patch"]).is_err());
             std::env::remove_var("SOCKET_VENDOR_SOURCE");
 
             // Garbage is rejected at parse time.
@@ -985,27 +982,20 @@ mod tests {
         }
     }
 
-    /// Regression: scan's vendored flow must build its service config FROM
-    /// `--vendor-source`, not hardcode build-only. Under the default (`auto`), the config must permit the
-    /// vendoring service exactly as the `vendor` command's default does —
-    /// otherwise `scan --mode vendored` silently builds locally while a
-    /// plain `vendor` service-downloads, and the two commit different bytes /
-    /// lock integrity for the same patch (lock churn / merge conflicts).
     #[test]
     fn vendor_service_config_default_source_permits_service() {
         let cfg = common_with_source("auto").vendor_service_config(None, false);
-        assert_eq!(cfg.source, VendorSource::Auto);
+        assert_eq!(cfg.source, VendorSource::Service);
         assert!(
             cfg.source.may_use_service(),
             "the default must be able to use the service (matching `vendor`)"
         );
-        assert!(!cfg.source.requires_service());
+        assert!(cfg.source.requires_service());
         assert!(cfg.client.is_none());
         assert!(!cfg.use_public_proxy);
     }
 
-    /// `--vendor-source service` reaches the fail-closed service path and
-    /// `--vendor-source build` never contacts the service.
+    /// The assembler fails closed even if a caller bypasses argument validation.
     #[test]
     fn vendor_service_config_honors_service_and_build_sources() {
         let cfg = common_with_source("service").vendor_service_config(None, true);
@@ -1017,8 +1007,8 @@ mod tests {
         );
 
         let cfg = common_with_source("build").vendor_service_config(None, false);
-        assert_eq!(cfg.source, VendorSource::Build);
-        assert!(!cfg.source.may_use_service());
+        assert_eq!(cfg.source, VendorSource::Service);
+        assert!(cfg.source.requires_service());
     }
 
     /// The service overrides (`--vendor-url` / `--patch-server-url` /