chore(crawlers): drop dead NpmPkgManager::as_tag + extend coverage

NpmPkgManager::as_tag() and its corresponding test were dead — apply.rs
matches on the enum variants directly (NpmPkgManager::YarnBerryPnP /
::Pnpm) and the struct never derives Serialize, so the stringified tag
was unreachable from any caller.

While here, extract `parse_bun_bin_output` from `get_bun_global_prefix`
so the path-derivation half of bun discovery is unit-testable without
shelling out to a real `bun` binary, and add integration tests covering:

  * cargo: TOML parser stops at next section / ignores pre-package
    lines, Default impl, CARGO_HOME unset → $HOME/.cargo fallback
  * npm: parse_bun_bin_output happy path, empty stdout, root-only path

Assisted-by: Claude Code:claude-opus-4-7

Author: mikolalysenko

crates/socket-patch-core/src/crawlers/npm_crawler.rs

@@ -155,8 +155,18 @@ pub fn get_bun_global_prefix() -> Option<String> {
     if !output.status.success() {
         return None;
     }
+    parse_bun_bin_output(&String::from_utf8_lossy(&output.stdout))
+}
 
-    let bin_path = String::from_utf8_lossy(&output.stdout).trim().to_string();
+/// Pure parser for `bun pm bin -g` stdout. Extracted so the
+/// derive-the-global-node_modules-path logic is unit-testable
+/// without shelling out.
+///
+/// Given output like `"/Users/foo/.bun/bin\n"` returns
+/// `Some("/Users/foo/.bun/install/global/node_modules")`. Returns
+/// `None` on empty input or a root-only path with no parent.
+pub fn parse_bun_bin_output(stdout: &str) -> Option<String> {
+    let bin_path = stdout.trim().to_string();
     if bin_path.is_empty() {
         return None;
     }

crates/socket-patch-core/src/crawlers/pkg_managers.rs

@@ -44,19 +44,6 @@ pub enum NpmPkgManager {
     Unknown,
 }
 
-impl NpmPkgManager {
-    /// Short lowercase tag, suitable for JSON output.
-    pub fn as_tag(&self) -> &'static str {
-        match self {
-            NpmPkgManager::Npm => "npm",
-            NpmPkgManager::Pnpm => "pnpm",
-            NpmPkgManager::YarnClassic => "yarn-classic",
-            NpmPkgManager::YarnBerryPnP => "yarn-berry-pnp",
-            NpmPkgManager::Unknown => "unknown",
-        }
-    }
-}
-
 /// Detect the package manager that produced the layout under
 /// `project_root`. Inspection is purely path-based — no shell-outs,
 /// no parsing — so the detector is fast and side-effect-free.
@@ -173,13 +160,4 @@ mod tests {
         );
     }
 
-    #[test]
-    fn as_tag_values() {
-        // Pin the tag strings — they're part of the JSON envelope contract.
-        assert_eq!(NpmPkgManager::Npm.as_tag(), "npm");
-        assert_eq!(NpmPkgManager::Pnpm.as_tag(), "pnpm");
-        assert_eq!(NpmPkgManager::YarnClassic.as_tag(), "yarn-classic");
-        assert_eq!(NpmPkgManager::YarnBerryPnP.as_tag(), "yarn-berry-pnp");
-        assert_eq!(NpmPkgManager::Unknown.as_tag(), "unknown");
-    }
 }

crates/socket-patch-core/tests/crawler_cargo_e2e.rs

@@ -70,6 +70,81 @@ fn parse_cargo_toml_malformed_returns_none() {
     assert_eq!(parse_cargo_toml_name_version(toml), None);
 }
 
+/// Parser must stop scanning when it leaves the `[package]` table.
+/// A `name =` or `version =` line under a later table must NOT be
+/// picked up. Covers the "left package section" early-break arm
+/// (cargo_crawler.rs:34-36).
+#[test]
+fn parse_cargo_toml_stops_at_next_section() {
+    let toml = "[package]\nname = \"foo\"\nversion = \"1.0.0\"\n\n[dependencies]\nname = \"bar\"\n";
+    assert_eq!(
+        parse_cargo_toml_name_version(toml),
+        Some(("foo".to_string(), "1.0.0".to_string()))
+    );
+}
+
+/// Parser must ignore key=value lines that appear BEFORE [package]
+/// (e.g. inside an earlier [profile.release] table).
+#[test]
+fn parse_cargo_toml_ignores_lines_before_package_section() {
+    let toml = "[profile.release]\nname = \"wrong\"\n\n[package]\nname = \"foo\"\nversion = \"1.0.0\"\n";
+    assert_eq!(
+        parse_cargo_toml_name_version(toml),
+        Some(("foo".to_string(), "1.0.0".to_string()))
+    );
+}
+
+/// CargoCrawler's `Default` impl forwards to `new`. Exercise both
+/// for symmetry.
+#[test]
+fn cargo_crawler_default_and_new_construct_cleanly() {
+    let _a = CargoCrawler::default();
+    let _b = CargoCrawler::new();
+}
+
+/// `cargo_home` fallback to `$HOME/.cargo` when CARGO_HOME is unset.
+/// Exercised via `get_crate_source_paths(global=true)` which calls
+/// `Self::get_registry_src_paths` → `cargo_home` internally.
+#[tokio::test]
+#[serial_test::serial]
+async fn cargo_home_fallback_to_home_dot_cargo() {
+    let tmp = tempfile::tempdir().unwrap();
+    // Stage a fake registry tree at $HOME/.cargo/registry/src/.
+    let stamp_dir = tmp
+        .path()
+        .join(".cargo")
+        .join("registry")
+        .join("src")
+        .join("index.crates.io-1949cf8c6b5b557f");
+    tokio::fs::create_dir_all(&stamp_dir).await.unwrap();
+
+    let prev_cargo = std::env::var("CARGO_HOME").ok();
+    let prev_home = std::env::var("HOME").ok();
+    std::env::remove_var("CARGO_HOME");
+    std::env::set_var("HOME", tmp.path());
+
+    let crawler = CargoCrawler;
+    let opts = CrawlerOptions {
+        cwd: tmp.path().to_path_buf(),
+        global: true,
+        global_prefix: None,
+        batch_size: 100,
+    };
+    let paths = crawler.get_crate_source_paths(&opts).await.unwrap();
+
+    if let Some(v) = prev_cargo {
+        std::env::set_var("CARGO_HOME", v);
+    }
+    if let Some(v) = prev_home {
+        std::env::set_var("HOME", v);
+    }
+
+    assert!(
+        paths.iter().any(|p| p == &stamp_dir),
+        "HOME/.cargo fallback registry must be discovered; got {paths:?}"
+    );
+}
+
 // ── find_by_purls ──────────────────────────────────────────────
 
 #[tokio::test]

crates/socket-patch-core/tests/crawler_npm_e2e.rs

@@ -6,7 +6,7 @@
 use std::path::Path;
 
 use socket_patch_core::crawlers::npm_crawler::{
-    build_npm_purl, parse_package_name, read_package_json,
+    build_npm_purl, parse_bun_bin_output, parse_package_name, read_package_json,
 };
 use socket_patch_core::crawlers::types::CrawlerOptions;
 use socket_patch_core::crawlers::NpmCrawler;
@@ -119,6 +119,32 @@ async fn read_package_json_missing_version_returns_none() {
     assert_eq!(result, None);
 }
 
+// ── parse_bun_bin_output ───────────────────────────────────────
+
+/// Bun's global node_modules lives at `<bun-root>/install/global/node_modules`
+/// — the parser strips the trailing `bin` segment and joins the well-known
+/// suffix.
+#[test]
+fn parse_bun_bin_output_well_formed_unix() {
+    let parsed = parse_bun_bin_output("/home/foo/.bun/bin\n");
+    assert_eq!(
+        parsed.as_deref(),
+        Some("/home/foo/.bun/install/global/node_modules")
+    );
+}
+
+#[test]
+fn parse_bun_bin_output_empty_returns_none() {
+    assert_eq!(parse_bun_bin_output(""), None);
+    assert_eq!(parse_bun_bin_output("   \n  "), None);
+}
+
+/// Root-only path has no parent — must yield None instead of panicking.
+#[test]
+fn parse_bun_bin_output_root_path_returns_none() {
+    assert_eq!(parse_bun_bin_output("/"), None);
+}
+
 // ── find_by_purls ──────────────────────────────────────────────
 
 #[tokio::test]