Require server artifacts and exact redownload for vendoring

[Mikola Lysenko (mikolalysenko)]

Vendoring now downloads complete server artifacts. Missing or damaged committed artifacts are redownloaded only when their bytes or complete directory inventory match the existing ledger; repair preserves lockfiles and ledger identity.

Based on #277, including the latest v5 Maven reactor and Gradle changes. Companion server PR: depscan#27070.

• Remove local npm/wheel/NuGet/JAR repacking, the vendoring blob/diff staging pipeline, registry source acquisition, and local-build fallbacks. service is the default; auto is an alias and build is rejected.
• Verify transfer integrity and patched members before committing server artifacts. Record complete inventories for new directory artifacts, including Cargo and Go. Refuse changed archives, changed inventories, or missing identity records without rewriting the existing project state.
• Obtain upstream Yarn Berry cache checksums from depscan, eliminating the CLI's remaining production cache ZIP builder.
• Retain socket-patch-node N-API and hosted in-memory patch application for the future GitHub App. Agent patch application remains supported.
• Migrate vendoring fixtures to served artifacts and cover offline reuse, redownload, failed repair, lockfile preservation, package-manager installs, and crash recovery.

Validation: workspace Clippy with warnings denied; 87 Composer tests and six exact-redownload tests, including fresh Composer inventory persistence and Go service failures; both Yarn 4 suites and 103 in-process vendoring tests; real vlt, Maven, Ruby, uv, Hatch, PDM, pip, pipenv, Poetry, and Bun compatibility tests (1.4.2 and 1.1.45); Docker npm, Composer, Maven, Ruby, and Python lifecycle tests. Linux CI verifies NuGet: Docker Desktop on this case-insensitive macOS volume reports stale stat results for deleted NuGet.config aliases. Earlier N-API validation rebuilt the addon and passed all 14 smoke tests. The full CI matrix is running on the latest commit.

Rollout: deploy the companion depscan migration, converter/backfill, and upstream metadata endpoint before this CLI. Berry rollback requires that metadata to be ready. Old locally built archives that differ from the server artifact, or legacy directory ledgers without an inventory, cannot be repaired by guessing new identity: restore them from version control or revert and explicitly vendor again.

---

Note

High Risk
This is a breaking vendoring model change (no offline/local rebuild path) that touches lockfile integrity, repair, and all ecosystem vendor flows; mis-deployed server artifacts or legacy locally-built vendor trees can fail closed until re-vendored.

Overview
Vendoring is server-only: --vendor-source defaults to service, auto is a compatibility alias, and build is rejected at parse time. The CLI contract and help text drop pristine-registry fetches, local patch application to vendor trees, blob/diff staging, and auto→local fallback ladders in favor of downloading integrity-verified patched archives from the patch service.

scan/get --mode vendored still fetch patch records in memory but no longer seed a blob map for the vendor step (DetachedDownload loses the blob HashMap; .socket/blobs is not written on detached download). repair language and behavior are framed as exact same-UUID redownload (human “Redownloaded”, stricter ledger fingerprint checks) rather than rebuilding from installed copies or lockfile-verified pristine sources. Docs also note Berry cache checksums and hosted rollback metadata come from the server, not CLI-built cache zips.

Dev dependency adds test-fixtures on socket-patch-core for updated vendoring tests.

^{Reviewed by Cursor Bugbot for commit 50af61b. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Claude (@claude) review

[Mikola Lysenko (mikolalysenko)]

BugBot review

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Composer vendors omit file inventory
  • Added compute_dir_inventory call to persist file_inventory for Composer vendor artifacts, enabling directory repair and same-UUID vendor restore.

Or push these changes by commenting:

@cursor push cf4d89f6e2

Preview (cf4d89f6e2)

diff --git a/crates/socket-patch-core/src/vendor/composer_lock.rs b/crates/socket-patch-core/src/vendor/composer_lock.rs
--- a/crates/socket-patch-core/src/vendor/composer_lock.rs
+++ b/crates/socket-patch-core/src/vendor/composer_lock.rs
@@ -435,7 +435,16 @@
     let marker = VendorMarker::new("composer", &base_purl, record, vendored_at);
     write_marker_or_warn(&uuid_dir, &marker, &mut warnings).await;
 
-    let entry = VendorEntry {
+    let file_inventory = match super::verify::compute_dir_inventory(&copy_dir).await {
+        Ok(inventory) => inventory,
+        Err(error) => {
+            let _ = remove_tree(&uuid_dir).await;
+            prune_empty_vendor_dirs(&copy_dir).await;
+            return refused("vendor_inventory_unavailable", error);
+        }
+    };
+
+    let mut entry = VendorEntry {
         ecosystem: "composer".to_string(),
         base_purl,
         uuid: record.uuid.clone(),
@@ -466,6 +475,7 @@
         pdm: None,
         pipenv: None,
     };
+    entry.artifact.file_inventory = Some(file_inventory);
 
     done(result, Some(entry), warnings)
 }

_{You can send follow-ups to the cloud agent here.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 50af61b. Configure here.}