Skip npm lock entries installed from git or URLs

npm installs a git, remote-tarball or file: dependency from the
dependent's spec and ignores the lock entry's resolved. Hosted and
vendored mode rewired those entries anyway, so the scan reported the
package patched and vex attested it while npm ci installed the
original bytes.

Both rewriters now skip such entries with a loud stays-UNPATCHED
warning (vendored refuses when no registry copy is left), and vex no
longer attests a name@version while a non-registry copy of it is in
the lock.

Fixes #326

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-cli/src/commands/get.rs

@@ -7272,8 +7272,11 @@ mod tests {
         let installed = |name: &str, body: &[u8]| {
             let dist = site.path().join(format!("{name}-1.0.0.dist-info"));
             std::fs::create_dir_all(&dist).unwrap();
-            std::fs::write(dist.join("METADATA"), format!("Name: {name}\nVersion: 1.0.0\n"))
-                .unwrap();
+            std::fs::write(
+                dist.join("METADATA"),
+                format!("Name: {name}\nVersion: 1.0.0\n"),
+            )
+            .unwrap();
             std::fs::write(site.path().join(format!("{name}.py")), body).unwrap();
             compute_git_sha256_from_bytes(body)
         };
@@ -7317,7 +7320,10 @@ mod tests {
         mount(uuid("bs"), "beta_sdist.py".into(), "0".repeat(64), 0).await;
         for n in ["gw", "gs"] {
             Mock::given(method("GET"))
-                .and(wm_path(format!("/v0/orgs/test-org/patches/view/{}", uuid(n))))
+                .and(wm_path(format!(
+                    "/v0/orgs/test-org/patches/view/{}",
+                    uuid(n)
+                )))
                 .respond_with(ResponseTemplate::new(500))
                 .expect(0)
                 .mount(&server)

crates/socket-patch-cli/src/commands/scan/discovery.rs

@@ -2094,7 +2094,11 @@ mod tests {
                 "pkg:npm/lockonly@1.0.0",
                 std::path::PathBuf::from("/nonexistent"),
             ),
-            crawled_pkg("alpha", "pkg:npm/alpha@1.0.0", installed("alpha", "alpha.js")),
+            crawled_pkg(
+                "alpha",
+                "pkg:npm/alpha@1.0.0",
+                installed("alpha", "alpha.js"),
+            ),
             crawled_pkg(
                 "embedded",
                 "pkg:npm/embedded@1.0.0",

crates/socket-patch-cli/src/commands/setup.rs

@@ -247,8 +247,7 @@ async fn hooked_vlt_members(found: &PackageJsonFindResult) -> Vec<PathBuf> {
     }
     let mut hooked = Vec::new();
     for loc in found.files.iter().filter(|loc| !loc.is_root) {
-        if let Ok(content) = socket_patch_core::utils::fs::read_regular_to_string(&loc.path).await
-        {
+        if let Ok(content) = socket_patch_core::utils::fs::read_regular_to_string(&loc.path).await {
             let status = is_setup_configured_str(&content);
             if status.postinstall_configured || status.dependencies_configured {
                 hooked.push(loc.path.clone());

crates/socket-patch-cli/src/commands/update.rs

@@ -159,7 +159,11 @@ fn cancelled_message(current: &semver::Version, target: &semver::Version) -> &'s
 
 /// The result line after a successful install, naming the same action as
 /// [`confirm_prompt`].
-fn installed_message(current: &semver::Version, target: &semver::Version, path: &std::path::Path) -> String {
+fn installed_message(
+    current: &semver::Version,
+    target: &semver::Version,
+    path: &std::path::Path,
+) -> String {
     let path = path.display();
     if target < current {
         format!("Downgraded socket-patch {current} \u{2192} {target} ({path})")
@@ -500,9 +504,18 @@ mod tests {
 
     #[test]
     fn cancel_and_result_lines_match_the_prompt() {
-        assert_eq!(cancelled_message(&v("4.0.0"), &v("9.9.9")), "Update cancelled.");
-        assert_eq!(cancelled_message(&v("4.0.0"), &v("3.0.0")), "Downgrade cancelled.");
-        assert_eq!(cancelled_message(&v("4.0.0"), &v("4.0.0")), "Reinstall cancelled.");
+        assert_eq!(
+            cancelled_message(&v("4.0.0"), &v("9.9.9")),
+            "Update cancelled."
+        );
+        assert_eq!(
+            cancelled_message(&v("4.0.0"), &v("3.0.0")),
+            "Downgrade cancelled."
+        );
+        assert_eq!(
+            cancelled_message(&v("4.0.0"), &v("4.0.0")),
+            "Reinstall cancelled."
+        );
         let p = std::path::Path::new("/opt/sp/socket-patch");
         assert_eq!(
             installed_message(&v("4.0.0"), &v("9.9.9"), p),

crates/socket-patch-cli/src/commands/vendor.rs

@@ -3864,7 +3864,11 @@ mod plan_gate_tests {
         .unwrap();
         let packages = [
             ("pkg:composer/psr/cache@1.0.0", "psr/cache", UUID_A),
-            ("pkg:composer/psr/http-message@1.1.0", "psr/http-message", UUID_B),
+            (
+                "pkg:composer/psr/http-message@1.1.0",
+                "psr/http-message",
+                UUID_B,
+            ),
             ("pkg:composer/psr/log@3.0.2", "psr/log", UUID_C),
         ];
         let mut all_packages: Vec<(String, StagedSource)> = Vec::new();

crates/socket-patch-cli/src/hosted_memory/redirect.rs

@@ -19,8 +19,7 @@ use socket_patch_core::patch::redirect::npmrc::{
     NPMRC_REL,
 };
 use socket_patch_core::patch::redirect::{
-    rewrite_registry_redirect_withholding_vlt, DepOverride, FileEdit, RewriteResult,
-    RewriteWarning,
+    rewrite_registry_redirect_withholding_vlt, DepOverride, FileEdit, RewriteResult, RewriteWarning,
 };
 use socket_patch_core::utils::purl::{purl_parts, strip_purl_qualifiers};
 use socket_patch_core::vendor::lock_inventory::{MemoryEntry, MemoryProject};

crates/socket-patch-cli/tests/apply_network.rs

@@ -1075,10 +1075,7 @@ async fn mismatch_blob_topup_probes_every_copy_of_a_duplicated_package() {
         v["summary"]["applied"], 1,
         "the drifted nested copy must be warn-overwritten.\nstdout={v:#}"
     );
-    assert_eq!(
-        v["summary"]["failed"], 0,
-        "no copy may fail.\nstdout={v:#}"
-    );
+    assert_eq!(v["summary"]["failed"], 0, "no copy may fail.\nstdout={v:#}");
 
     // The nested copy's blob was fetched on demand…
     let requests = mock.received_requests().await.unwrap();

crates/socket-patch-cli/tests/cli_config_fallback.rs

@@ -59,8 +59,7 @@ fn scan_cmd(project: &Path, data_dir: &Path) -> Command {
     let mut cmd = Command::new(BINARY);
     // Human mode: core's proxy advisory (the oracle below) is muted under
     // `--json`/`--silent`.
-    cmd.args(["scan", "-e", "npm", "--cwd"])
-        .arg(project);
+    cmd.args(["scan", "-e", "npm", "--cwd"]).arg(project);
     for (key, _) in std::env::vars_os() {
         let name = key.to_string_lossy();
         if name.starts_with("SOCKET_") {
@@ -298,7 +297,9 @@ async fn corrupt_config_warns_and_keeps_json_stdout_clean() {
     json_cmd.arg("--json");
     let json_out = run(json_cmd);
     assert!(
-        json_out.stderr.contains("could not parse socket-cli config"),
+        json_out
+            .stderr
+            .contains("could not parse socket-cli config"),
         "the parse warning must reach stderr under --json too; got:\n{}",
         json_out.stderr
     );

crates/socket-patch-cli/tests/cli_parse_list.rs

@@ -1202,7 +1202,10 @@ fn missing_manifest_with_corrupt_ledger_keeps_warning_in_error_envelope_via_bina
     assert_eq!(v["error"]["code"], "manifest_not_found", "envelope={v}");
     let warnings = v["warnings"].as_array().expect("warnings[] present");
     assert_eq!(warnings.len(), 1, "envelope={v}");
-    assert_eq!(warnings[0]["code"], "redirect_ledger_corrupt", "envelope={v}");
+    assert_eq!(
+        warnings[0]["code"], "redirect_ledger_corrupt",
+        "envelope={v}"
+    );
     assert!(
         out.stderr.is_empty(),
         "--json must keep stderr clean: {}",
@@ -1214,7 +1217,10 @@ fn missing_manifest_with_corrupt_ledger_keeps_warning_in_error_envelope_via_bina
     let stderr = String::from_utf8_lossy(&out.stderr);
     assert_eq!(out.status.code(), Some(1));
     assert!(stderr.contains("Warning: "), "stderr={stderr}");
-    assert!(stderr.contains("Error: Manifest not found at "), "stderr={stderr}");
+    assert!(
+        stderr.contains("Error: Manifest not found at "),
+        "stderr={stderr}"
+    );
 }
 
 #[test]

crates/socket-patch-cli/tests/cli_parse_rollback.rs

@@ -378,7 +378,11 @@ fn bare_bool_does_not_consume_next_token() {
 /// relied on the rejection get a test-visible flip instead of a silent one.
 #[test]
 fn multiple_targets_parse_in_order() {
-    let args = parse_rollback(&["pkg:npm/foo@1", "packages/api/**", "b0630680-4da6-45f9-bba8-b888e0ffd58c"]);
+    let args = parse_rollback(&[
+        "pkg:npm/foo@1",
+        "packages/api/**",
+        "b0630680-4da6-45f9-bba8-b888e0ffd58c",
+    ]);
     assert_eq!(
         args.targets,
         vec![