fix: 10 prod bugs + 7 test-harness bugs surfaced by a no-fail-fast full-suite sweep

CI has been failing one binary per run (cargo fail-fast hides every later
binary), so a local `cargo test --workspace --all-features --no-fail-fast`
sweep (155 targets) was run to flush the whole backlog at once. Prod fixes:

- scan/hosted.rs: --silent swallowed the redirect-VEX failure ("errors
  only", never "nothing" — exit 1 with no message is undiagnosable), and
  human mode never printed the rewriter's own warnings (JSON already
  carried them; e.g. the no-lockfile warning).
- lock_cli.rs: lock_held/lock_io errors were muted under --silent; the
  error and its remediation hint now always print in human mode.
- get.rs: the selection_required error advised `--id <UUID>`, a
  value-taking form the CLI rejects (--id is a boolean type-tag); it now
  directs re-running with the chosen UUID as the identifier.
- repair_vendor.rs: rebuilds from an installed copy for RECONSTRUCTED
  entries (ledger gone) were never verified against the rewired lockfile's
  integrity — a drifted/tampered copy was blessed into a fresh ledger.
  Register the wired integrity for those candidates (same trust anchor as
  the unverified-registry rung), and snapshot/restore the wiring files so
  a rejected rebuild can't leave the backend's integrity refresh behind.
- cargo_config.rs: wrote into .cargo/config.toml when a legacy
  .cargo/config coexists — cargo reads the extensionless file and warns,
  so the [patch] entry was silently inert; and the atomic write reset the
  destination's permission bits (now mode-preserving, matching the other
  lock writers).
- cargo.rs: re-vendoring a new patch uuid over live wiring failed on the
  already-detached lock entry and unwound the live config entry (bricking
  builds); a detach failure mid-re-vendor dropped the prior socket entry
  instead of restoring it; and an artifact-only rebuild of a wholesale-
  deleted uuid dir never restored the committed marker file.
- pypi.rs/pypi_requirements.rs: the requirements flavor had no in-sync or
  stale-uuid pre-flight (unlike uv/poetry/pdm/pipenv) — every re-run
  appended a duplicate wheel line and clobbered the ledger record. Same
  uuid is now the in-sync/artifact-rebuild path; a different uuid refuses
  (pypi_requirements_already_vendored) before any writes.
- pth_hook/detect.rs + setup.rs: the lockfile refresh ran bare
  `poetry lock` / `pdm lock`, re-resolving the user's whole pinned set on
  Poetry 1.x; the refresh now tries the pin-preserving spelling first
  (`lock --no-update` / `lock --update-reuse`) with bare `lock` as the
  fallback for versions that dropped the flag.

Test-harness fixes (hermeticity/scrub bugs that fail suites on their own):

- cli_parse_vendor/e2e_safety_unlock/remove_rollback_api_overrides: env
  scrub lists were missing SOCKET_VENDOR_SOURCE / SOCKET_VENDOR_URL /
  SOCKET_PATCH_SERVER_URL / SOCKET_STRICT (drift guards demanded them);
  remove_rollback also gains the standard drift-guard test.
- setup_matrix_deno.rs: the roundtrip plants SOCKET_STRICT decoys its own
  fixed-list scrub didn't strip; converted to the prefix scrub its pypi
  sibling uses (with the telemetry force-off).
- e2e_golang.rs: hostile env seeds were added without the paired
  env_remove lines, so SOCKET_ECOSYSTEMS=npm leaked and filtered the go
  crawler out of every scan.
- e2e_vendor_yarn_classic_build.rs: corepack() scrubbed env AFTER applying
  caller overrides, wiping its own YARN_CACHE_FOLDER (the fixture install
  silently used the global cache); scrub-then-seed like the berry sibling.
- scan_vendor_e2e.rs: run_cli_env never scrubbed or disabled telemetry, so
  runs phoned the configured endpoint (and the live API in ambient-env
  shells); prefix scrub + SOCKET_TELEMETRY_DISABLED=1, caller env last.

Verified: full workspace sweep + targeted reruns of every affected binary
(all green), core lib 1895 tests, cli lib 318 tests, clippy -D warnings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/src/commands/get.rs

@@ -587,7 +587,7 @@ pub(crate) fn select_patches(
                         "{}",
                         serde_json::to_string_pretty(&serde_json::json!({
                             "status": "selection_required",
-                            "error": format!("Multiple patches available for {purl}. Specify --id <UUID> to select one."),
+                            "error": format!("Multiple patches available for {purl}. Re-run with the chosen UUID as the identifier (`socket-patch get <uuid>`) to select one."),
                             "purl": purl,
                             "options": options_json,
                         }))

crates/socket-patch-cli/src/commands/lock_cli.rs

@@ -115,12 +115,12 @@ pub(crate) fn acquire_or_emit(
             } else {
                 (held_message(timeout), Hint::UnlockOrBreakLock)
             };
-            emit(command, json, silent, dry_run, "lock_held", &msg, hint);
+            emit(command, json, dry_run, "lock_held", &msg, hint);
             Err(1)
         }
         Err(LockError::Io { path, source }) => {
             let msg = format!("failed to open lock file at {}: {}", path.display(), source);
-            emit(command, json, silent, dry_run, "lock_io", &msg, Hint::None);
+            emit(command, json, dry_run, "lock_io", &msg, Hint::None);
             Err(1)
         }
     }
@@ -203,21 +203,17 @@ enum Hint {
     UnlockOrBreakLock,
 }
 
-fn emit(
-    command: Command,
-    json: bool,
-    silent: bool,
-    dry_run: bool,
-    code: &str,
-    message: &str,
-    hint: Hint,
-) {
+fn emit(command: Command, json: bool, dry_run: bool, code: &str, message: &str, hint: Hint) {
     if json {
         println!(
             "{}",
             error_envelope(command, dry_run, code, message).to_pretty_json()
         );
-    } else if !silent {
+    } else {
+        // Errors print even under --silent ("errors only", never "nothing"
+        // — CLI_CONTRACT.md): exit 1 with no message would be
+        // undiagnosable. The remediation hint is part of the error report,
+        // not informational chatter, so it prints with the error.
         eprintln!("Error: {message}.");
         match hint {
             Hint::None => {}

crates/socket-patch-cli/src/commands/repair_vendor.rs

@@ -504,7 +504,23 @@ pub(crate) async fn repair_vendored_artifacts(
     let mut must_verify: HashMap<String, lock_inventory::LockIntegrity> = HashMap::new();
     for c in &candidates {
         if all_packages.contains_key(&c.purl) {
-            continue; // installed copy: works offline too
+            // Installed copy: works offline too. But for a RECONSTRUCTED
+            // entry the copy is an unverified source — the ledger that
+            // recorded the artifact sha is gone, so the rewired lockfile's
+            // integrity is the ONLY trust anchor. A copy that drifted since
+            // vendoring (build-tool artifacts, edited unpatched files) packs
+            // into a tarball the package manager would reject on its next
+            // install; register the wired integrity so the rebuilt artifact
+            // is verified below, exactly like the unverified-registry rung.
+            if c.reconstructed {
+                if let Some(wired) =
+                    lock_inventory::wired_vendor_integrity(&common.cwd, &c.entry.artifact.path)
+                        .await
+                {
+                    must_verify.insert(c.purl.clone(), wired);
+                }
+            }
+            continue;
         }
         if common.offline {
             fail(
@@ -590,6 +606,31 @@ pub(crate) async fn repair_vendored_artifacts(
         let Some(pkg_path) = all_packages.get(&c.purl).cloned() else {
             continue; // failed above
         };
+        // For an unverified-source rebuild the rewired lockfile is the trust
+        // anchor: snapshot the wiring files so a failed post-verify can put
+        // them back byte-for-byte. The backend's re-wire may refresh the
+        // recorded integrity/checksum to the rebuilt tarball's — blessing
+        // exactly the drifted bytes the verify below is about to reject.
+        let wiring_snapshot: Option<Vec<(std::path::PathBuf, Vec<u8>)>> =
+            if must_verify.contains_key(&c.purl) {
+                let mut snap = Vec::new();
+                for name in [
+                    "package-lock.json",
+                    "npm-shrinkwrap.json",
+                    "pnpm-lock.yaml",
+                    "yarn.lock",
+                    "bun.lock",
+                    "package.json",
+                ] {
+                    let p = common.cwd.join(name);
+                    if let Ok(bytes) = tokio::fs::read(&p).await {
+                        snap.push((p, bytes));
+                    }
+                }
+                Some(snap)
+            } else {
+                None
+            };
         let outcome = dispatch_vendor_one(
             &c.purl,
             &pkg_path,
@@ -652,6 +693,14 @@ pub(crate) async fn repair_vendored_artifacts(
                     };
                     if let Err(detail) = verdict {
                         remove_vendor_dir(&common.cwd, &c.entry.ecosystem, &c.entry.uuid).await;
+                        // Put the trust anchor back exactly as it was: the
+                        // backend's re-wire may have refreshed the recorded
+                        // integrity to the rejected rebuild's.
+                        if let Some(snap) = &wiring_snapshot {
+                            for (path, bytes) in snap {
+                                let _ = tokio::fs::write(path, bytes).await;
+                            }
+                        }
                         fail(
                             env,
                             quiet,

crates/socket-patch-cli/src/commands/scan/hosted.rs

@@ -486,42 +486,53 @@ pub(super) async fn run_redirect(
             result["error"] = serde_json::json!({ "code": code, "message": message });
         }
         println!("{}", serde_json::to_string_pretty(&result).unwrap());
-    } else if !args.common.silent {
-        let verb = if args.common.dry_run {
-            "would rewrite"
-        } else {
-            "rewrote"
-        };
-        println!(
-            "Redirected {} package(s); {verb} {} file(s).",
-            confirmed.len(),
-            rewritten.len()
-        );
-        for s in &skipped {
-            eprintln!("  skipped {} ({})", s["purl"], s["reason"]);
-        }
-        for w in &record_warnings {
-            eprintln!("  warning: {}", w["detail"]);
-        }
-        for w in &migration_warnings {
-            eprintln!("  warning: {}", w["detail"]);
-        }
-        for w in &rush_warnings {
-            eprintln!("  warning: {}", w["detail"]);
-        }
-        if let Some(statements) = vex_statements {
-            eprintln!(
-                "Wrote OpenVEX document with {} statement(s) to {} (redirected patches are \
-                 attested from the ledger, not hash-verified — their bytes are fetched at \
-                 install time; run `socket-patch vex` after installing to verify against \
-                 the installed tree).",
-                statements,
-                args.vex.vex.as_ref().unwrap().display(),
+    } else {
+        if !args.common.silent {
+            let verb = if args.common.dry_run {
+                "would rewrite"
+            } else {
+                "rewrote"
+            };
+            println!(
+                "Redirected {} package(s); {verb} {} file(s).",
+                confirmed.len(),
+                rewritten.len()
             );
-        } else if let Some((_, message)) = &vex_error {
+            for s in &skipped {
+                eprintln!("  skipped {} ({})", s["purl"], s["reason"]);
+            }
+            // Same warning set as the JSON envelope, same order: the
+            // rewriter's own warnings first (e.g. `no package-lock.json`),
+            // then the record/migration/rush extras.
+            for w in &rewrite.warnings {
+                eprintln!("  warning: {}", w.detail);
+            }
+            for w in &record_warnings {
+                eprintln!("  warning: {}", w["detail"]);
+            }
+            for w in &migration_warnings {
+                eprintln!("  warning: {}", w["detail"]);
+            }
+            for w in &rush_warnings {
+                eprintln!("  warning: {}", w["detail"]);
+            }
+            if let Some(statements) = vex_statements {
+                eprintln!(
+                    "Wrote OpenVEX document with {} statement(s) to {} (redirected patches are \
+                     attested from the ledger, not hash-verified — their bytes are fetched at \
+                     install time; run `socket-patch vex` after installing to verify against \
+                     the installed tree).",
+                    statements,
+                    args.vex.vex.as_ref().unwrap().display(),
+                );
+            } else if args.vex.vex.is_some() && args.common.dry_run {
+                eprintln!("Skipping VEX generation (--dry-run).");
+            }
+        }
+        // Errors print even under --silent ("errors only", never
+        // "nothing"): exit 1 with no message would be undiagnosable.
+        if let Some((_, message)) = &vex_error {
             eprintln!("Error: VEX generation failed: {message}");
-        } else if args.vex.vex.is_some() && args.common.dry_run {
-            eprintln!("Skipping VEX generation (--dry-run).");
         }
     }
     vex_code

crates/socket-patch-cli/src/commands/setup.rs

@@ -472,8 +472,13 @@ async fn finalize_python(plan: &PythonPlan, edits: &[PthEditResult], cwd: &Path)
         return warnings;
     }
     // Lockfile refresh (broad auto-edit): only when the manager uses a lockfile
-    // that exists. Best-effort — never fatal.
-    if let Some((program, args)) = plan.pm.lock_command() {
+    // that exists. Best-effort — never fatal. The spellings are tried in
+    // order: pin-preserving first (`poetry lock --no-update`,
+    // `pdm lock --update-reuse`), bare `lock` as the fallback for versions
+    // that dropped the flag (Poetry 2.x, where bare `lock` is already
+    // pin-preserving). A successful fallback is not a failure — only warn
+    // when every spelling failed.
+    if let Some((program, spellings)) = plan.pm.lock_commands() {
         let lockfile = match plan.pm {
             PythonPackageManager::Uv => Some("uv.lock"),
             PythonPackageManager::Poetry => Some("poetry.lock"),
@@ -485,22 +490,39 @@ async fn finalize_python(plan: &PythonPlan, edits: &[PthEditResult], cwd: &Path)
             None => false,
         };
         if lock_present {
-            match tokio::process::Command::new(program)
-                .args(args)
-                .current_dir(cwd)
-                .output()
-                .await
-            {
-                Ok(o) if o.status.success() => {}
-                Ok(o) => warnings.push(format!(
-                    "`{program} {}` failed ({}); update the lockfile manually",
-                    args.join(" "),
-                    o.status
-                )),
-                Err(e) => warnings.push(format!(
-                    "could not run `{program} {}`: {e}; update the lockfile manually",
-                    args.join(" ")
-                )),
+            let mut failure: Option<String> = None;
+            for args in spellings {
+                match tokio::process::Command::new(program)
+                    .args(*args)
+                    .current_dir(cwd)
+                    .output()
+                    .await
+                {
+                    Ok(o) if o.status.success() => {
+                        failure = None;
+                        break;
+                    }
+                    Ok(o) => {
+                        failure = Some(format!(
+                            "`{program} {}` failed ({}); update the lockfile manually",
+                            args.join(" "),
+                            o.status
+                        ));
+                    }
+                    Err(e) => {
+                        // The program itself didn't spawn (not installed /
+                        // not on PATH): retrying another spelling of the
+                        // same program is pointless.
+                        failure = Some(format!(
+                            "could not run `{program} {}`: {e}; update the lockfile manually",
+                            args.join(" ")
+                        ));
+                        break;
+                    }
+                }
+            }
+            if let Some(w) = failure {
+                warnings.push(w);
             }
         }
     }

crates/socket-patch-cli/tests/cli_parse_vendor.rs

@@ -43,7 +43,11 @@ const SOCKET_ENV_VARS: &[&str] = &[
     "SOCKET_PROXY_URL",
     "SOCKET_ECOSYSTEMS",
     "SOCKET_DOWNLOAD_MODE",
+    "SOCKET_VENDOR_SOURCE",
+    "SOCKET_VENDOR_URL",
+    "SOCKET_PATCH_SERVER_URL",
     "SOCKET_OFFLINE",
+    "SOCKET_STRICT",
     "SOCKET_GLOBAL",
     "SOCKET_GLOBAL_PREFIX",
     "SOCKET_JSON",

crates/socket-patch-cli/tests/e2e_golang.rs

@@ -88,6 +88,11 @@ async fn run(args: &[&str], cwd: &Path, gomodcache: &Path, api_url: &str) -> Out
             .env("SOCKET_GLOBAL_PREFIX", "/nonexistent")
             .env("SOCKET_JSON", "true")
             .env("SOCKET_SILENT", "true")
+            .env_remove("SOCKET_ECOSYSTEMS")
+            .env_remove("SOCKET_GLOBAL")
+            .env_remove("SOCKET_GLOBAL_PREFIX")
+            .env_remove("SOCKET_JSON")
+            .env_remove("SOCKET_SILENT")
             .env_remove("GOPATH")
             .env_remove("SOCKET_OFFLINE")
             .env_remove("SOCKET_PROXY_URL")

crates/socket-patch-cli/tests/e2e_safety_unlock.rs

@@ -40,7 +40,11 @@ const SOCKET_ENV_VARS: &[&str] = &[
     "SOCKET_PROXY_URL",
     "SOCKET_ECOSYSTEMS",
     "SOCKET_DOWNLOAD_MODE",
+    "SOCKET_VENDOR_SOURCE",
+    "SOCKET_VENDOR_URL",
+    "SOCKET_PATCH_SERVER_URL",
     "SOCKET_OFFLINE",
+    "SOCKET_STRICT",
     "SOCKET_GLOBAL",
     "SOCKET_GLOBAL_PREFIX",
     "SOCKET_JSON",

crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_build.rs

@@ -63,14 +63,16 @@ fn has_corepack_pm(pm: &str) -> bool {
 /// prompt disabled, and every `SOCKET_*` var scrubbed.
 fn corepack(cwd: &Path, pm: &str, args: &[&str], extra_env: &[(&str, &str)]) -> Output {
     let mut cmd = Command::new("corepack");
-    cmd.arg(pm)
-        .args(args)
-        .current_dir(cwd)
-        .env("COREPACK_ENABLE_DOWNLOAD_PROMPT", "0");
+    cmd.arg(pm).args(args).current_dir(cwd);
+    // Scrub FIRST (it removes YARN_CACHE_FOLDER / SOCKET_* from the inherited
+    // env), then seed the hermetic flags so they survive (Command: last env
+    // call wins). Scrubbing last wiped the caller's private cache override,
+    // so the fixture install silently used the developer's global cache.
+    scrub_socket_env(&mut cmd);
+    cmd.env("COREPACK_ENABLE_DOWNLOAD_PROMPT", "0");
     for (k, v) in extra_env {
         cmd.env(k, v);
     }
-    scrub_socket_env(&mut cmd);
     cmd.output().expect("failed to run corepack")
 }
 

crates/socket-patch-cli/tests/remove_rollback_api_overrides.rs

@@ -40,7 +40,11 @@ const SOCKET_ENV_VARS: &[&str] = &[
     "SOCKET_PROXY_URL",
     "SOCKET_ECOSYSTEMS",
     "SOCKET_DOWNLOAD_MODE",
+    "SOCKET_VENDOR_SOURCE",
+    "SOCKET_VENDOR_URL",
+    "SOCKET_PATCH_SERVER_URL",
     "SOCKET_OFFLINE",
+    "SOCKET_STRICT",
     "SOCKET_GLOBAL",
     "SOCKET_GLOBAL_PREFIX",
     "SOCKET_JSON",
@@ -56,6 +60,21 @@ const SOCKET_ENV_VARS: &[&str] = &[
     "SOCKET_SKIP_ROLLBACK",
 ];
 
+/// Drift guard: the scrub must cover every env var `GlobalArgs` binds — the
+/// production `GLOBAL_ARG_ENV_VARS` list is the source of truth. A var
+/// missing here escapes the scrub, so an ambient value in the developer's
+/// shell or CI (e.g. `SOCKET_STRICT=garbage`) aborts every invocation in
+/// this file. Mirrors `cli_parse_vendor.rs`.
+#[test]
+fn env_scrub_covers_every_global_arg_env_var() {
+    for var in socket_patch_cli::args::GLOBAL_ARG_ENV_VARS {
+        assert!(
+            SOCKET_ENV_VARS.contains(var),
+            "{var} is bound by GlobalArgs but missing from SOCKET_ENV_VARS — the scrub won't strip it",
+        );
+    }
+}
+
 /// Git-SHA256: SHA256("blob <len>\0" ++ content).
 fn git_sha256(content: &[u8]) -> String {
     let header = format!("blob {}\0", content.len());