fix(vendor): accurate refusals for bundled/alias/CRLF lock shapes - #185

Problem

Three vendored-mode diagnostics defects from the 2026-08-13 audit sent users down the wrong remediation path or silently hid security-relevant facts:

1. npm: all-bundled/all-link target refuses with a misleading "not found" and drops the UNPATCHED advisories (medium). When every lock instance of the target is bundled inside a parent's tarball (inBundle) or a link, scan_lock_matches returns zero rewritable matches and vendor_npm refused with the generic vendor_lock_entry_not_found ("make sure the package is installed and locked (npm install)"). The entry IS in the lock, npm install cannot help, and because VendorOutcome::Refused has no warnings channel, the per-instance "that copy stays UNPATCHED" advisories were silently discarded. Concrete scenario: a lock whose only left-pad@1.3.0 entries are an inBundle: true nested copy and a workspace link — the user is told the package isn't installed instead of being told it cannot be patched by vendoring and remains vulnerable.

2. npm v2 legacy dependencies mirror: bundled nodes wrongly rewritten, alias consumers silently unpatched (low). rewrite_legacy_tree rewrote bundled: true nodes (the packages scan skips their inBundle twins, so the two lock halves desynced — npm never installs a bundled copy from resolved), and alias consumers ("alias": {"version": "npm:left-pad@1.3.0"}) matched neither key nor version, so npm 6 clients reading the mirror keep installing the unpatched registry bytes through the alias with zero warning.

3. pnpm: CRLF lockfile refuses with a misleading "not found" (low). A CRLF pnpm-lock.yaml (Windows autocrlf checkout) passes check_lock_version (str::lines strips \r) but breaks every structural probe (split_lines keeps the trailing \r, so packages: never matches "packages:\r"), surfacing as vendor_lock_entry_not_found — wrong diagnosis for a lock pnpm itself accepts.

Fix

• vendor_npm: when matches is empty but the scan pushed vendor_bundled_instance_skipped / vendor_link_entry_skipped warnings, refuse with the new vendor_lock_entry_not_rewritable code whose detail carries the per-instance stays-UNPATCHED advisories verbatim and explicitly says npm install will not help. The genuinely-absent case keeps the existing vendor_lock_entry_not_found. Both codes remain non-benign (refusal_is_benign unchanged), so exit behavior is unchanged.
• rewrite_legacy_tree: skips bundled: true nodes (parity with the packages scan's inBundle skip) and emits a loud vendor_legacy_alias_skipped warning for alias consumers, naming the JSON-pointer node and that npm 6 still installs UNPATCHED bytes through it. Aliases are warned rather than rewritten because the legacy alias spelling has no proven equivalent rewrite — fail loud, not fail open.
• vendor_pnpm: fails closed immediately after the version sniff with the new vendor_lockfile_crlf_unsupported refusal, naming the CRLF line endings and the LF-normalization remedy, before any structural probe can produce the wrong diagnosis.

Skipped (out of lane scope, third gap of the low-severity legacy-mirror finding): recomputing the legacy node's requires map from the patched manifest. A correct recompute needs the staged patched package.json plumbed into rewrite_legacy_tree plus a proven mapping to npm 6's requires grammar; doing it without a spike risks corrupting v2 locks for a purely npm-6-era reader.

Testing

• New regression tests, each verified red against the pre-fix behavior (guards temporarily neutralized) before going green:
  • npm_lock.rs::tests::all_bundled_or_link_instances_refuse_with_accurate_reason
  • npm_lock.rs::tests::v2_legacy_bundled_node_is_not_rewritten
  • npm_lock.rs::tests::v2_legacy_alias_node_warns_and_keeps_registry_resolution
  • pnpm_lock.rs::tests::crlf_lock_refuses_naming_line_endings
• cargo test -p socket-patch-core --lib — 2079 passed
• cargo test -p socket-patch-cli --test in_process_vendor — 27 passed
• cargo test -p socket-patch-cli --test e2e_vendor_npm_build — 7 passed
• cargo test -p socket-patch-cli --test e2e_vendor_pnpm_build — passed

🤖 Generated with Claude Code