fix(vendor): refuse catalog-consumed deps in pnpm vendoring - #184

Problem

Audit finding (2026-08-13, vendored/pnpm, high): pnpm catalogs unguarded — a catalog-consumed dep's specifier: catalog: is rewritten to file:, breaking frozen installs.

For a dep consumed through a pnpm catalog (pnpm >= 9.5: pnpm-workspace.yaml catalog:), the lock importer entry is specifier: 'catalog:' / version: 1.3.0, mirrored by a top-level catalogs: snapshot section. edit_importers targeted on the version alone, so vendoring rewrote both importer fields to the file: spec while package.json kept its "left-pad": "catalog:" declaration and the catalogs: snapshot stayed stale. Vendoring reported success, but the very next pnpm install --frozen-lockfile rejected the lock with ERR_PNPM_OUTDATED_LOCKFILE (reproduced with real pnpm v11.21.0) — the user was handed a broken project with no warning. check_rewritable_refs already refused the sibling aliased and peer-suffixed spellings, but never looked at catalog wiring.

Fix

Refuse fail-closed rather than attempt a rewrite: the catalog range lives in pnpm-workspace.yaml, outside the package.json + pnpm-lock.yaml pair the surgery owns, so a consistent rewrite is out of reach at this boundary. check_rewritable_refs gains two guards, both firing pre-flight (vendor_lock_entry_unsupported) before anything is staged or written:

1. A scan of the top-level catalogs: snapshot section, refusing when any catalog resolves the target name to the target version (peer-suffixed versions included).
2. An importer-level check refusing when the dep entry at the target version carries a catalog: specifier — covering both the quoted default ('catalog:') and bare named (catalog:tools) spellings via a new unquote_value helper — so importer-only drifted locks refuse too.

The refusal detail names the catalog wiring and pnpm-workspace.yaml so the user knows why. Sibling versions resolved by a catalog do not block vendoring a plainly-consumed target.

No skipped findings — this lane had one finding and it is fully addressed.

Testing

• New catalog_consumed_target_refuses_fail_closed: default-catalog, named-catalog, and importer-only drifted shapes (lock oracles generated by real pnpm v11.21.0); asserts the refusal code and detail, both files byte-untouched, and nothing staged under .socket/vendor. Red-verified against pre-fix code: without the guards the fixture vendors with Done (success=true) — the exact fail-broken success the audit described (independently re-verified during review).
• New sibling_version_catalog_entry_does_not_block_vendoring: a catalog pinning 1.2.0 does not refuse a plainly-consumed 1.3.0 target, while the catalog-consumed 1.2.0 itself refuses.
• Suites green: cargo test -p socket-patch-core --lib (2077 passed), cargo test -p socket-patch-cli --test e2e_vendor_pnpm_build (6 passed), cargo test -p socket-patch-cli --test in_process_vendor (27 passed). cargo fmt --check clean.

🤖 Generated with Claude Code