e2e_hosted_production.rs

//! Hosted-mode (`scan --mode hosted`) end-to-end tests against **production**.
//!
//! Every other hosted-mode capstone in this repo (`e2e_redirect_*_build.rs`)
//! points the CLI at a wiremock stand-in for `patch.socket.dev`. This suite is
//! the opposite: it contacts the **real** Socket production endpoints and the
//! **real** upstream registries, with **no mocking anywhere**, and proves the
//! full hosted loop for each ecosystem and package manager:
//!
//!   1. install a pinned, known-vulnerable dependency with a real package
//!      manager, from its real upstream registry;
//!   2. assert the installed bytes are **pristine** (anti-vacuity — without
//!      this every "patched" assertion below could pass on a no-op);
//!   3. run `socket-patch scan --mode hosted --json --yes`, which resolves a
//!      hosted patch reference from `patches-api.socket.dev` and rewrites the
//!      lockfile / registry config to point at `patch.socket.dev`;
//!   4. assert the rewrite landed (host + patch UUID present in the lock, and
//!      the integrity pin was replaced);
//!   5. **wipe the install tree and reinstall from the rewritten lock alone**,
//!      letting the package manager itself fetch from `patch.socket.dev` and
//!      verify the integrity pin it was given;
//!   6. assert the reinstalled bytes now carry the patch.
//!
//! Step 5 is the point of the suite. It is the only test in the repo where a
//! third-party package manager — not socket-patch — downloads a Socket-hosted
//! artifact and independently verifies its checksum.
//!
//! # Required production patches
//!
//! These tests are pinned to specific patches that must stay published and
//! **free-tier** on `patches-api.socket.dev`. If Socket unpublishes one, the
//! `preflight_required_patches_are_published` test fails first and names it,
//! rather than letting a downstream leg fail with a confusing symptom.
//!
//! | Ecosystem | PURL | Patch UUID | Advisory |
//! |-----------|------|------------|----------|
//! | npm    | `pkg:npm/minimist@1.2.2`        | `642d7f02-ebc1-4ab0-99e2-07f5dd8463cb` | GHSA-xvch-5gv4-984h (CVE-2021-44906) |
//! | PyPI   | `pkg:pypi/urllib3@1.26.18`      | *any of three* (see [`PYPI_UUIDS`])    | GHSA-gm62-xv2j-4w53 &co |
//! | gem    | `pkg:gem/activestorage@6.0.3`   | *any of* [`GEM_UUIDS`] (six today; the sixth merges three advisories) | GHSA-m42x-37p3-fv5w (CVE-2020-8162), GHSA-w749-p3v6-hccq (CVE-2022-21831), GHSA-9xrj-h377-fr87 (CVE-2026-33195), GHSA-r4mg-4433-c7g3 (CVE-2025-24293), GHSA-xr9x-r78c-5hrm (CVE-2026-66066) |
//!
//! `docs/testing/hosted-production-e2e.md` explains how these were chosen and
//! how to re-pick one if it is ever withdrawn.
//!
//! # Ecosystems with no coverage, and why
//!
//! * **cargo / maven / nuget / composer** — hosted mode is implemented and
//!   documented for all four, but production currently publishes **zero**
//!   free-tier patches for them, so there is nothing real to redirect to.
//!   Rather than silently skipping, [`canary_unpublished_ecosystems`] probes
//!   production every run and tells us the moment that changes. cargo carried
//!   a full sparse-registry install proof until 2026-09-01: production's free
//!   cargo tier emptied on 2026-08-28, so the leg was demoted to the canary
//!   (`docs/testing/hosted-production-e2e.md` says how to re-promote it).
//! * **golang** — hosted mode is supported for free-tier references carrying
//!   a `goproxy` override (`docs/ecosystems.md#go-directory-replaces-and-gosum`), but production
//!   publishes no golang hosted modules yet. Covered as a shape guard that
//!   holds in both worlds.
//! * **deno** — hosted mode is not supported. Covered as a negative assertion.
//!
//! # Prerequisites
//!
//! Toolchains (each leg soft-skips if its own toolchain is absent, unless
//! `SOCKET_PATCH_HOSTED_E2E_STRICT=1`): `npm`, `pnpm`, `yarn` (classic),
//! `corepack` (berry), `bun`, `uv`, `ruby` + `bundle`, `go`.
//!
//! Network egress to: `patches-api.socket.dev`, `patch.socket.dev`,
//! `registry.npmjs.org`, `pypi.org`, `files.pythonhosted.org`,
//! `rubygems.org`.
//!
//! No API token is used or needed — the suite deliberately runs against the
//! **free public proxy**, which is the surface every unauthenticated user
//! gets. `SOCKET_API_TOKEN` is scrubbed from the child environment.
//!
//! # Running
//!
//! ```sh
//! cargo test -p socket-patch-cli --test e2e_hosted_production -- --ignored
//!
//! # CI (required job): turn every soft-skip into a hard failure, so a missing
//! # toolchain can never report green on a required check.
//! SOCKET_PATCH_HOSTED_E2E_STRICT=1 \
//!   cargo test -p socket-patch-cli --test e2e_hosted_production -- --ignored
//! ```

#[path = "common/rollback_json.rs"]
mod rollback_json;

#[path = "common/mod.rs"]
mod common;
use common::{binary, hermetic};

use std::path::{Path, PathBuf};
use std::process::{Command, Output};

#[path = "npm_e2e_common/manifestless.rs"]
mod npm_e2e_common;
#[path = "vex_e2e_common/mod.rs"]
mod vex_e2e_common;
// yarn classic leg: release selection + the manifest-less VEX matrix.
#[path = "common/yarn_classic_vex.rs"]
mod yarn_classic_vex;
// uv legs: release selection + the manifest-less VEX matrix.
#[path = "vex_e2e_common/uv.rs"]
mod uv_vex;
#[path = "vex_pipenv_pip_steps/mod.rs"]
mod vex_pipenv_pip_steps;
#[path = "vlt_e2e_common/mod.rs"]
mod vlt_e2e_common;

use vlt_e2e_common::cache_env;

// ---------------------------------------------------------------------------
// Production endpoints + required-patch catalog
// ---------------------------------------------------------------------------

/// The free public patch proxy. Deliberately hard-coded rather than read from
/// the environment: this suite's entire purpose is to exercise *production*,
/// and an ambient `SOCKET_PROXY_URL` pointing at staging would let it pass
/// while proving nothing.
const PROXY: &str = "https://patches-api.socket.dev";

/// The host every hosted-mode rewrite must point the package manager at.
const PATCH_HOST: &str = "patch.socket.dev";

const NPM_PURL: &str = "pkg:npm/minimist@1.2.2";
const NPM_NAME: &str = "minimist";
const NPM_VERSION: &str = "1.2.2";
const NPM_UUID: &str = "642d7f02-ebc1-4ab0-99e2-07f5dd8463cb";

const PYPI_PURL: &str = "pkg:pypi/urllib3@1.26.18";
const PYPI_NAME: &str = "urllib3";
const PYPI_VERSION: &str = "1.26.18";
/// urllib3 1.26.18 carries **three** distinct free patches (one per advisory).
/// Which one the resolver selects is a server-side ordering detail, so the
/// tests assert "one of these" rather than pinning a single UUID — pinning one
/// would make the suite red on an unrelated server-side reorder.
const PYPI_UUIDS: &[&str] = &[
    "de58c8b8-796c-4b6d-8a48-539b5563db76",
    "26242e35-f867-4da8-8789-f0d2ea49e0f1",
    "e828efa5-5c6d-43f3-9909-03f5ac232b98",
];

/// The gem pin is deliberately UNQUALIFIED. Production publishes the purl as
/// `pkg:gem/activestorage@6.0.3?platform=ruby`, but nothing client-side
/// strips qualifiers — the SERVER normalizes both spellings to the same
/// patch set (verified live against `/patch/by-package`), so this pins the
/// bare spelling the CLI's own crawler synthesizes.
const GEM_PURL: &str = "pkg:gem/activestorage@6.0.3";
const GEM_NAME: &str = "activestorage";
const GEM_VERSION: &str = "6.0.3";
/// Acceptable patch UUIDs for [`GEM_PURL`] — an any-of set, mirroring
/// [`PYPI_UUIDS`]: patch selection is ranked by `api::ranking` (merged
/// patches first, newest first) and scan always auto-selects the top
/// candidate, so pinning a single UUID would red the required check whenever
/// production publishes a newer or merged 6.0.3 patch. The gem leg parses
/// the UUID actually WIRED into the rewritten
/// Gemfile, asserts it is one of these, and content-verifies against that
/// exact patch's `/patch/view` manifest. When production publishes another
/// acceptable 6.0.3 patch, verify it and append its UUID here.
const GEM_UUIDS: &[&str] = &[
    // GHSA-m42x-37p3-fv5w / CVE-2020-8162 (s3_service.rb), from the
    // 2026-08-18 catalog republish.
    "15e960b5-f432-4b6c-b8aa-534a2b419323",
    // GHSA-w749-p3v6-hccq / CVE-2022-21831 (image_processing_transformer.rb),
    // published 2026-08-19T21:19Z — the second advisory.
    "6c4141c5-1535-4fd2-9db1-b5f8e4834bdb",
    // GHSA-9xrj-h377-fr87 / CVE-2026-33195 (disk_service.rb +
    // disk_controller.rb + errors.rb), published 2026-08-20T16:14Z when
    // production extended 6.0.3 with a third advisory.
    "eeb6bf9f-96c0-4963-a0f1-2e88f91f8b1a",
    // GHSA-r4mg-4433-c7g3 / CVE-2025-24293 (image_processing_transformer.rb),
    // published 2026-08-20T20:31Z — the fourth advisory.
    "c1a1cd3c-b670-4e44-b4fa-1a63ecd42db6",
    // GHSA-xr9x-r78c-5hrm / CVE-2026-66066 (image_processing_transformer.rb +
    // NEW lib/active_storage/vips.rb backporting the libvips
    // unfuzzed-operations hardening), published 2026-08-21T19:07Z — the fifth
    // advisory; selected until the 2026-09-04 merged patch below.
    "9c2b4925-b413-4a3a-bb3a-9990440fb446",
    // MERGED patch — the first one production has published for any pinned
    // purl: GHSA-w749-p3v6-hccq / CVE-2022-21831 + GHSA-r4mg-4433-c7g3 /
    // CVE-2025-24293 + GHSA-xr9x-r78c-5hrm / CVE-2026-66066 in one artifact
    // (image_processing_transformer.rb allowlist + unsupported-method guard,
    // engine.rb + active_storage.rb config plumbing, NEW vips.rb libvips
    // backport). Published 2026-09-04T21:23Z; the client-side merge rung in
    // `api::ranking` now selects this one.
    "01019627-b481-4bae-bc09-e93b5a5e4481",
];

/// Header the patch service injects into patched npm / PyPI source files.
const PATCH_MARKER: &str = "Socket Community Patch";

/// Ecosystems where hosted mode is implemented but production has no free
/// patches to exercise it with. [`canary_unpublished_ecosystems`] watches
/// these so coverage can be extended the moment one lights up.
const UNPUBLISHED_ECOSYSTEMS: &[(&str, &[&str])] = &[
    // cargo joined this list on 2026-09-01: production deleted its last free
    // cargo patches on 2026-08-28, retiring the pinned sparse-registry
    // install proof this suite used to carry. Re-promotion procedure:
    // docs/testing/hosted-production-e2e.md.
    (
        "cargo",
        &[
            "pkg:cargo/openssl",
            "pkg:cargo/tokio",
            "pkg:cargo/hyper",
            "pkg:cargo/smallvec",
        ],
    ),
    (
        "maven",
        &[
            "pkg:maven/org.apache.logging.log4j/log4j-core",
            "pkg:maven/com.fasterxml.jackson.core/jackson-databind",
            "pkg:maven/org.yaml/snakeyaml",
            "pkg:maven/commons-io/commons-io",
        ],
    ),
    (
        "nuget",
        &[
            "pkg:nuget/Newtonsoft.Json",
            "pkg:nuget/System.Text.Json",
            "pkg:nuget/SharpZipLib",
            "pkg:nuget/RestSharp",
        ],
    ),
    (
        "composer",
        &[
            "pkg:composer/guzzlehttp/guzzle",
            "pkg:composer/symfony/http-kernel",
            "pkg:composer/laravel/framework",
            "pkg:composer/monolog/monolog",
        ],
    ),
];

// ---------------------------------------------------------------------------
// Strictness + skip policy
// ---------------------------------------------------------------------------

/// In CI this suite backs a **required** status check, so a leg that quietly
/// returns early because a toolchain is missing would report green while
/// proving nothing. `SOCKET_PATCH_HOSTED_E2E_STRICT=1` converts every soft
/// skip into a hard failure. Locally it stays off so a developer without,
/// say, `bun` can still run the rest.
fn strict() -> bool {
    std::env::var("SOCKET_PATCH_HOSTED_E2E_STRICT")
        .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
        .unwrap_or(false)
}

/// Soft-skip a leg: panics under [`strict`], otherwise prints a tagged notice
/// and returns from the calling test.
macro_rules! soft_skip {
    ($leg:expr, $($arg:tt)*) => {{
        let why = format!($($arg)*);
        if strict() {
            panic!(
                "STRICT: {} cannot run: {why}\n\
                 SOCKET_PATCH_HOSTED_E2E_STRICT=1 forbids skipping — a required \
                 CI check must never report green on an unexercised leg. Install \
                 the missing toolchain, or unset the strict flag for local runs.",
                $leg
            );
        }
        println!("SKIP {}: {why}", $leg);
        return;
    }};
}

// ---------------------------------------------------------------------------
// CLI invocation
// ---------------------------------------------------------------------------

fn has_command(cmd: &str) -> bool {
    // `go` has no `--version` — it takes `go version` as a subcommand and
    // errors with "flag provided but not defined: -version" otherwise. Probing
    // it the usual way silently skips the golang leg on a machine that has Go.
    let probe: &[&str] = if cmd == "go" {
        &["version"]
    } else {
        &["--version"]
    };
    let mut probe_cmd = pm_command(cmd);
    probe_cmd
        .args(probe)
        .stdout(std::process::Stdio::null())
        .stderr(std::process::Stdio::null());
    // Where pnpm/yarn are corepack shims, this probe is what actually
    // downloads the package manager — keep that out of the real
    // COREPACK_HOME, and let the probe answer for the same environment
    // the leg's `tool()` invocations run in.
    cache_env::isolate(&mut probe_cmd);
    probe_cmd.status().map(|s| s.success()).unwrap_or(false)
}

/// Run the CLI with a hermetically pinned environment.
///
/// The scrub matters more here than in any offline suite. An ambient
/// `SOCKET_PROXY_URL` or `SOCKET_API_URL` would silently point the run at
/// staging — and every assertion below would still pass, proving nothing about
/// production. An ambient `SOCKET_API_TOKEN` would move the run off the free
/// public proxy that this suite exists to cover. The shared builder
/// (`hermetic::binary_command`) seeds each of those with a hostile value and
/// removes it, so if the scrub is ever dropped the seeds turn the suite red
/// immediately instead of letting a developer's ambient shell decide what got
/// tested. The crawler's own ambient inputs are scrubbed too
/// (`hermetic::CRAWLER_EXTRAS`: an activated venv, `BUNDLE_*`,
/// `COMPOSER_*`): the hosted scan discovers packages unscoped under the cwd.
fn run(cwd: &Path, args: &[&str]) -> (i32, String, String) {
    let mut cmd = hermetic::binary_command();
    hermetic::scrub_crawler_inputs(&mut cmd);
    cmd.args(args).current_dir(cwd);
    let out: Output = cmd.output().expect("failed to execute socket-patch binary");
    (
        out.status.code().unwrap_or(-1),
        String::from_utf8_lossy(&out.stdout).to_string(),
        String::from_utf8_lossy(&out.stderr).to_string(),
    )
}

/// `scan --mode hosted --json --yes` in `cwd`, asserting a clean exit and a
/// `"status": "success"` envelope. Returns the parsed envelope.
fn scan_hosted(cwd: &Path, extra: &[&str]) -> serde_json::Value {
    let mut args: Vec<&str> = vec!["scan", "--mode", "hosted", "--json", "--yes"];
    args.extend_from_slice(extra);
    let (code, stdout, stderr) = run(cwd, &args);
    assert_eq!(
        code, 0,
        "scan --mode hosted failed (exit {code}).\nstdout:\n{stdout}\nstderr:\n{stderr}"
    );
    let env: serde_json::Value = serde_json::from_str(&stdout).unwrap_or_else(|e| {
        panic!("scan --mode hosted did not emit JSON ({e}).\nstdout:\n{stdout}\nstderr:\n{stderr}")
    });
    assert_eq!(
        env["status"].as_str(),
        Some("success"),
        // Exit 0 alone is not enough: the envelope carries the real verdict.
        "scan --mode hosted did not report success.\nenvelope:\n{env:#}\nstderr:\n{stderr}"
    );
    // v5 hosted mode keeps no ledger: the lockfile pins are the whole state.
    assert!(
        !cwd.join(".socket/vendor/redirect-state.json").exists(),
        "scan --mode hosted wrote the pre-v5 redirect ledger"
    );
    env
}

/// The production record `GET /patch/view/<uuid>` serves (the public
/// proxy), fetched on a private runtime so the sync legs can call it.
fn published_view_record_blocking(uuid: &str) -> serde_json::Value {
    let url = format!("{PROXY}/patch/view/{uuid}");
    tokio::runtime::Runtime::new()
        .expect("tokio runtime")
        .block_on(async {
            let resp = reqwest::Client::new()
                .get(&url)
                .header("Accept", "application/json")
                .send()
                .await
                .unwrap_or_else(|e| panic!("GET {url}: {e}"));
            let status = resp.status();
            let body = resp
                .text()
                .await
                .unwrap_or_else(|e| panic!("GET {url}: reading body: {e}"));
            assert!(status.is_success(), "GET {url}: HTTP {status}\n{body}");
            serde_json::from_str(&body).unwrap_or_else(|e| panic!("GET {url}: bad JSON ({e})"))
        })
}

/// Assert the hosted redirect actually rewrote something, and return the list
/// of rewritten files.
///
/// At least one hosted pin is the anti-vacuity guard: a run that discovered nothing
/// also exits 0 with `"status": "success"`, so without this a broken crawler
/// would look identical to a working redirect.
fn assert_redirected(env: &serde_json::Value, expect_file: &str) -> Vec<String> {
    let redirect = &env["redirect"];
    assert!(
        !redirect.is_null(),
        "scan --mode hosted emitted no `redirect` sub-object at all. The CLI \
         omits it entirely when discovery found nothing, so this means the \
         crawler did not see the installed dependency.\nenvelope:\n{env:#}"
    );
    assert_eq!(
        redirect["mode"].as_str(),
        Some("hosted"),
        "redirect sub-object missing or not hosted mode:\n{env:#}"
    );
    let n = hosted_pin_count(env);
    assert!(
        n >= 1,
        "hosted redirect rewrote nothing — the patch is published and the \
         package is installed, so 0 means discovery or reference resolution \
         broke.\nenvelope:\n{env:#}"
    );
    let files: Vec<String> = redirect["rewrittenFiles"]
        .as_array()
        .map(|a| {
            a.iter()
                .filter_map(|v| v.as_str().map(str::to_string))
                .collect()
        })
        .unwrap_or_default();
    assert!(
        files.iter().any(|f| f == expect_file),
        "expected `{expect_file}` among rewrittenFiles, got {files:?}\nenvelope:\n{env:#}"
    );
    files
}

/// How many dependencies a hosted run redirected: its `applied` (or, on a
/// dry run, `verified`) events with `details.mode: "hosted"` (v5.0: the
/// retired `redirect.redirected` counter).
///
/// `scan --mode hosted` reports no hosted event when discovery turned up
/// nothing — a plain scan envelope comes back instead. For the
/// documented-unsupported ecosystems (golang, deno) that is the same
/// verdict as zero pins.
fn hosted_pin_count(env: &serde_json::Value) -> u64 {
    env["events"]
        .as_array()
        .into_iter()
        .flatten()
        .filter(|e| {
            e["details"]["mode"] == "hosted"
                && (e["action"] == "applied" || e["action"] == "verified")
        })
        .count() as u64
}

// ---------------------------------------------------------------------------
// Toolchain invocation
// ---------------------------------------------------------------------------

/// A package-manager child (and its liveness probe) with the shared
/// hermetic scrubs, applied before `cache_env::isolate` and the leg's own
/// env so a leg's pins (the uv legs' `VIRTUAL_ENV`) survive: every ambient
/// `SOCKET_*` ([`hermetic::scrub_socket_vars`]), an activated venv (uv
/// would install into the wrong interpreter), bundler's `BUNDLE_*` and
/// `RUBYOPT` ([`hermetic::Extra::Bundle`]; an ambient BUNDLE_PATH or frozen
/// mode changes what `bundle` installs and where) and the yarn/pnpm
/// node-linker overrides. Deliberately not the full `Extra::Yarn` / `Extra::Pnpm`
/// sweeps: those remove every `YARN_*` / `npm_config_*`, including the
/// proxy and CA settings these live-registry suites need behind a proxy.
fn pm_command(program: &str) -> Command {
    let mut cmd = Command::new(program);
    hermetic::scrub_socket_vars(&mut cmd);
    hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv, hermetic::Extra::Bundle]);
    cmd.env_remove("YARN_NODE_LINKER");
    cmd.env_remove("npm_config_node_linker");
    cmd
}

/// Run an external package manager. Returns the `Output` without asserting, so
/// callers can distinguish "the registry was unreachable" (soft-skip material
/// during fixture setup) from "the install of the redirected lock failed"
/// (always a hard failure — that is the thing under test).
fn tool(cwd: &Path, program: &str, args: &[&str], env: &[(&str, &str)]) -> Output {
    let mut cmd = pm_command(program);
    cmd.args(args).current_dir(cwd);
    // Sandbox everything the per-leg `env` below does not name — corepack's
    // downloaded package managers most of all — so a run leaves the caller's
    // home alone.
    cache_env::isolate(&mut cmd);
    // Keep every toolchain's cache inside the fixture so the reinstall leg
    // starts genuinely cold and cannot be satisfied from a warm host cache
    // holding the *pristine* artifact. Applied last, so a leg's own pin
    // (the uv legs' `VIRTUAL_ENV`) survives the scrub.
    for (k, v) in env {
        cmd.env(k, v);
    }
    cmd.output()
        .unwrap_or_else(|e| panic!("failed to spawn `{program}`: {e}"))
}

fn ok(out: &Output) -> bool {
    out.status.success()
}

fn dump(out: &Output) -> String {
    format!(
        "exit={:?}\nstdout:\n{}\nstderr:\n{}",
        out.status.code(),
        String::from_utf8_lossy(&out.stdout),
        String::from_utf8_lossy(&out.stderr)
    )
}

fn read(p: &Path) -> String {
    std::fs::read_to_string(p).unwrap_or_else(|e| panic!("read {}: {e}", p.display()))
}

/// Assert `path` exists and does NOT yet carry a patch marker.
///
/// Every "the reinstall delivered a patched artifact" assertion downstream is
/// vacuous without this: if the upstream registry ever started shipping the
/// patched bytes, or a warm cache leaked them in, the test would pass while
/// proving nothing about hosted mode.
fn assert_pristine(path: &Path, marker: &str, what: &str) {
    assert!(
        path.exists(),
        "{what}: expected the pristine install at {} — fixture setup did not \
         produce the file under test",
        path.display()
    );
    let body = read(path);
    assert!(
        !body.contains(marker),
        "{what}: the freshly-installed upstream artifact at {} ALREADY contains \
         `{marker}` before any redirect ran. Every downstream assertion would be \
         vacuous. Check for a warm package-manager cache leaking patched bytes.",
        path.display()
    );
}

fn assert_patched(path: &Path, marker: &str, what: &str) {
    assert!(
        path.exists(),
        "{what}: reinstall from the redirected lock did not produce {}",
        path.display()
    );
    let body = read(path);
    assert!(
        body.contains(marker),
        "{what}: reinstalled from the redirected lock, but {} does not contain \
         `{marker}` — the package manager fetched something, and it was not the \
         patched artifact.",
        path.display()
    );
}

/// Assert a rewritten lockfile points at the hosted patch server for the
/// expected patch.
///
/// Deliberately does NOT assert the grant token embedded in the URL: the
/// service mints a fresh one per reference request, so pinning it would make
/// the suite red on the second run.
fn assert_hosted_pin(lock_body: &str, uuids: &[&str], what: &str) {
    assert!(
        lock_body.contains(PATCH_HOST),
        "{what}: rewritten lock does not reference {PATCH_HOST}:\n{lock_body}"
    );
    assert!(
        uuids.iter().any(|u| lock_body.contains(u)),
        "{what}: rewritten lock references {PATCH_HOST} but carries none of the \
         expected patch UUIDs {uuids:?} — the redirect resolved a different \
         patch than the catalog pins.\n{lock_body}"
    );
}

// ---------------------------------------------------------------------------
// Production reachability probes (used by the preflight + canary tests)
// ---------------------------------------------------------------------------

/// `GET /patch/by-package/<purl>` against the real proxy. Returns the patch
/// UUIDs published for `purl`, or an `Err` describing a transport failure.
async fn published_uuids(purl: &str) -> Result<Vec<String>, String> {
    let url = format!("{PROXY}/patch/by-package/{}", urlencode(purl));
    let resp = reqwest::Client::new()
        .get(&url)
        .header("Accept", "application/json")
        .send()
        .await
        .map_err(|e| format!("GET {url}: {e}"))?;
    let status = resp.status();
    let body = resp
        .text()
        .await
        .map_err(|e| format!("GET {url}: reading body: {e}"))?;
    if !status.is_success() {
        return Err(format!("GET {url}: HTTP {status}\n{body}"));
    }
    let v: serde_json::Value =
        serde_json::from_str(&body).map_err(|e| format!("GET {url}: bad JSON ({e}):\n{body}"))?;
    Ok(v["patches"]
        .as_array()
        .map(|a| {
            a.iter()
                .filter_map(|p| p["uuid"].as_str().map(str::to_string))
                .collect()
        })
        .unwrap_or_default())
}

/// `GET /patch/by-package/<purl>` returning, per patch, the `(uuid,
/// advisory_count)` pair that drives merge-state inference.
async fn published_patch_advisory_counts(purl: &str) -> Result<Vec<(String, usize)>, String> {
    let url = format!("{PROXY}/patch/by-package/{}", urlencode(purl));
    let resp = reqwest::Client::new()
        .get(&url)
        .header("Accept", "application/json")
        .send()
        .await
        .map_err(|e| format!("GET {url}: {e}"))?;
    let status = resp.status();
    let body = resp
        .text()
        .await
        .map_err(|e| format!("GET {url}: reading body: {e}"))?;
    if !status.is_success() {
        // Without this, a 503/404 surfaces as a misleading "bad JSON" error.
        return Err(format!("GET {url}: HTTP {status}\n{body}"));
    }
    let v: serde_json::Value =
        serde_json::from_str(&body).map_err(|e| format!("GET {url}: bad JSON ({e}):\n{body}"))?;
    Ok(v["patches"]
        .as_array()
        .map(|a| {
            a.iter()
                .filter_map(|p| {
                    Some((
                        p["uuid"].as_str()?.to_string(),
                        p["vulnerabilities"].as_object()?.len(),
                    ))
                })
                .collect()
        })
        .unwrap_or_default())
}

/// `GET /patch/by-package/<purl>` returning `(uuid, publishedAt)` pairs.
/// Sibling of [`published_uuids`] for tests that care about patch metadata
/// rather than just which UUIDs exist.
async fn published_patch_dates(purl: &str) -> Result<Vec<(String, String)>, String> {
    let url = format!("{PROXY}/patch/by-package/{}", urlencode(purl));
    let resp = reqwest::Client::new()
        .get(&url)
        .header("Accept", "application/json")
        .send()
        .await
        .map_err(|e| format!("GET {url}: {e}"))?;
    let status = resp.status();
    let body = resp
        .text()
        .await
        .map_err(|e| format!("GET {url}: reading body: {e}"))?;
    if !status.is_success() {
        return Err(format!("GET {url}: HTTP {status}\n{body}"));
    }
    let v: serde_json::Value =
        serde_json::from_str(&body).map_err(|e| format!("GET {url}: bad JSON ({e}):\n{body}"))?;
    Ok(v["patches"]
        .as_array()
        .map(|a| {
            a.iter()
                .filter_map(|p| {
                    Some((
                        p["uuid"].as_str()?.to_string(),
                        p["publishedAt"].as_str()?.to_string(),
                    ))
                })
                .collect()
        })
        .unwrap_or_default())
}

/// `GET /patch/view/<uuid>` against the real proxy — the same route the
/// CLI's free-proxy client fetches patch content from. Returns, per file the
/// patch touches, the `(path, beforeHash, afterHash)` triple (hashes are
/// git-blob sha256, `None` for pure additions/deletions respectively).
async fn published_patch_files(
    uuid: &str,
) -> Result<Vec<(String, Option<String>, Option<String>)>, String> {
    let url = format!("{PROXY}/patch/view/{uuid}");
    let resp = reqwest::Client::new()
        .get(&url)
        .header("Accept", "application/json")
        .send()
        .await
        .map_err(|e| format!("GET {url}: {e}"))?;
    let status = resp.status();
    let body = resp
        .text()
        .await
        .map_err(|e| format!("GET {url}: reading body: {e}"))?;
    if !status.is_success() {
        return Err(format!("GET {url}: HTTP {status}\n{body}"));
    }
    let v: serde_json::Value =
        serde_json::from_str(&body).map_err(|e| format!("GET {url}: bad JSON ({e}):\n{body}"))?;
    Ok(v["files"]
        .as_object()
        .map(|m| {
            m.iter()
                .map(|(path, f)| {
                    (
                        path.clone(),
                        f["beforeHash"].as_str().map(str::to_string),
                        f["afterHash"].as_str().map(str::to_string),
                    )
                })
                .collect()
        })
        .unwrap_or_default())
}

/// The `sha256=` hex value the lock's CHECKSUMS section pins for
/// `<name> (<version>)`, or `None` when the entry is absent. Bundler >= 2.6
/// writes one two-space-indented `  name (version) sha256=<hex>` line per
/// resolved gem.
fn gem_lock_checksum(lock: &str, name: &str, version: &str) -> Option<String> {
    let prefix = format!("  {name} ({version}) sha256=");
    lock.lines()
        .find_map(|l| l.strip_prefix(&prefix).map(|h| h.trim().to_string()))
}

/// The patch UUID the gem rewriter wired into `Gemfile`'s per-dep Socket
/// source block. The block's URL shape is
/// `https://<PATCH_HOST>/patch-registry/gem/<grant>/<patch-uuid>/`; the grant
/// token is itself UUID-shaped, so this takes the SECOND path segment rather
/// than scanning for "something UUID-like".
fn wired_gem_registry_uuid(gemfile: &str) -> Option<String> {
    let marker = format!("https://{PATCH_HOST}/patch-registry/gem/");
    let rest = &gemfile[gemfile.find(&marker)? + marker.len()..];
    let path = &rest[..rest.find('"')?];
    let mut segments = path.split('/').filter(|s| !s.is_empty());
    let _grant = segments.next()?;
    segments.next().map(str::to_string)
}

/// Locate the bundler-installed `gems/<name>-<version>` directory under a
/// `BUNDLE_PATH` root. The `ruby/<x.y.z>` segment in between varies by host
/// interpreter, so walk for it (depth-bounded — the layout is only a few
/// levels deep) instead of hardcoding the version.
fn installed_gem_dir(root: &Path, dir_name: &str, depth: usize) -> Option<PathBuf> {
    for entry in std::fs::read_dir(root).ok()?.flatten() {
        let p = entry.path();
        if !p.is_dir() {
            continue;
        }
        if p.file_name().is_some_and(|n| n == dir_name)
            && p.parent()
                .and_then(|d| d.file_name())
                .is_some_and(|n| n == "gems")
        {
            return Some(p);
        }
        if depth > 0 {
            if let Some(found) = installed_gem_dir(&p, dir_name, depth - 1) {
                return Some(found);
            }
        }
    }
    None
}

/// Percent-encode a PURL for use as a single path segment. `reqwest` will not
/// do this for us — a raw `pkg:npm/...` would be split into path segments and
/// 404.
fn urlencode(s: &str) -> String {
    let mut out = String::with_capacity(s.len() * 3);
    for b in s.as_bytes() {
        match b {
            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'.' | b'_' | b'~' => {
                out.push(*b as char)
            }
            _ => out.push_str(&format!("%{b:02X}")),
        }
    }
    out
}

// ===========================================================================
// Preflight — the catalog canary
// ===========================================================================

/// Verify every patch this suite depends on is still published and free-tier.
///
/// This runs first (alphabetically it sorts under `preflight_`) so that a
/// withdrawn patch produces one clear failure naming the PURL, instead of N
/// confusing downstream failures that look like CLI regressions.
#[tokio::test(flavor = "multi_thread")]
#[ignore = "live production API: contacts patches-api.socket.dev. Run with --ignored."]
async fn preflight_required_patches_are_published() {
    // (purl, acceptable uuids)
    let required: Vec<(&str, Vec<&str>)> = vec![
        (NPM_PURL, vec![NPM_UUID]),
        (PYPI_PURL, PYPI_UUIDS.to_vec()),
        (GEM_PURL, GEM_UUIDS.to_vec()),
    ];

    let mut failures: Vec<String> = Vec::new();
    for (purl, expected) in &required {
        match published_uuids(purl).await {
            Err(e) => failures.push(format!("{purl}: production probe failed: {e}")),
            Ok(found) if found.is_empty() => failures.push(format!(
                "{purl}: production publishes NO free patches for this package \
                 anymore. This suite is pinned to it — pick a replacement and \
                 update both the catalog constants in this file and \
                 docs/testing/hosted-production-e2e.md."
            )),
            Ok(found) => {
                if !expected.iter().any(|u| found.iter().any(|f| f == u)) {
                    failures.push(format!(
                        "{purl}: expected one of {expected:?} but production now \
                         publishes {found:?}. The patch was replaced — update the \
                         catalog constants in this file."
                    ));
                }
            }
        }
    }

    assert!(
        failures.is_empty(),
        "required production patches are no longer available:\n  - {}",
        failures.join("\n  - ")
    );
}

/// Canary: production must keep naming advisories, because advisory count
/// breaks severity ties in the patch ranking.
///
/// `api::ranking` ranks a patch that remediates several advisories above one
/// that remediates a single advisory at the same severity. The signal is the
/// size of the `vulnerabilities` map. If production ever stopped populating
/// it — shipping patches with an empty map, or moving advisory ids somewhere
/// else — every patch would collapse to coverage 0, the advisory-count rung
/// would become inert, and equal-severity selection would silently fall through to recency.
///
/// This asserts only that the signal EXISTS (every patch names >= 1
/// advisory), never how many. Production published its first merged patch on
/// 2026-09-04 (the activestorage 6.0.3 artifact covering three advisories,
/// see [`GEM_UUIDS`]); a count of >= 2 is expected, not a regression, and
/// must never fail this test.
#[tokio::test(flavor = "multi_thread")]
#[ignore = "live production API: contacts patches-api.socket.dev. Run with --ignored."]
async fn canary_patches_name_advisories_so_merge_state_is_inferable() {
    let mut failures: Vec<String> = Vec::new();
    let mut coverage_seen: Vec<(String, String, usize)> = Vec::new();

    let canary_purls = vec![NPM_PURL, PYPI_PURL, GEM_PURL];
    for purl in canary_purls {
        match published_patch_advisory_counts(purl).await {
            Err(e) => failures.push(format!("{purl}: production probe failed: {e}")),
            Ok(patches) if patches.is_empty() => {
                failures.push(format!("{purl}: production publishes no patches"))
            }
            Ok(patches) => {
                for (uuid, count) in patches {
                    if count == 0 {
                        failures.push(format!(
                            "{purl}: patch {uuid} names ZERO advisories — merge-state \
                             inference has no signal to work with, so the merge rung in \
                             api::ranking is dead for this patch"
                        ));
                    }
                    coverage_seen.push((purl.to_string(), uuid, count));
                }
            }
        }
    }

    assert!(
        failures.is_empty(),
        "merge-state inference signal is missing from production:\n  - {}",
        failures.join("\n  - ")
    );

    // Informational: surfaces the day production starts publishing merged
    // patches, without failing when it does.
    let merged: Vec<_> = coverage_seen.iter().filter(|(_, _, c)| *c >= 2).collect();
    if merged.is_empty() {
        eprintln!(
            "[info] production publishes no merged patches yet ({} patches, all single-advisory)",
            coverage_seen.len()
        );
    } else {
        eprintln!("[info] production now publishes merged patches: {merged:?}");
    }
}

/// Canary: production's `publishedAt` must stay a **per-patch** date.
///
/// Patch selection ranks by recency (`socket_patch_core::api::ranking`), and
/// that rung is only meaningful if `publishedAt` describes the patch rather
/// than the upstream package release. If the server ever started emitting the
/// package's release date, every patch for a given PURL would collapse to one
/// value, recency would silently stop discriminating, and selection would
/// quietly fall through to the UUID tiebreak — a wrong answer with no error
/// anywhere. Nothing else in the suite would catch that.
///
/// `PYPI_PURL` is the probe because production publishes three patches for
/// it (see [`PYPI_UUIDS`]). Two assertions:
///
///  1. the dates are not all identical — impossible for a package-level date;
///  2. no patch date equals the package's own upload time on PyPI.
///
/// (2) is skipped, with a note, if pypi.org is unreachable — a PyPI outage is
/// not a socket-patch regression. (1) is unconditional.
#[tokio::test(flavor = "multi_thread")]
#[ignore = "live production API: contacts patches-api.socket.dev + pypi.org. Run with --ignored."]
async fn canary_published_at_is_a_patch_date_not_a_package_date() {
    let patches = published_patch_dates(PYPI_PURL)
        .await
        .unwrap_or_else(|e| panic!("production probe failed for {PYPI_PURL}: {e}"));

    assert!(
        patches.len() >= 2,
        "{PYPI_PURL} must publish >=2 patches for this canary to have teeth; \
         production returned {}. Re-pick a multi-patch PURL and update this test.",
        patches.len()
    );

    let distinct: std::collections::HashSet<&str> =
        patches.iter().map(|(_, d)| d.as_str()).collect();
    assert!(
        distinct.len() > 1,
        "all {} patches for {PYPI_PURL} share one publishedAt ({:?}). That is the \
         signature of a PACKAGE-level date: recency ranking has stopped \
         discriminating and selection is falling through to the UUID tiebreak.\n\
         patches: {patches:#?}",
        patches.len(),
        distinct
    );

    // (2) Cross-check against the real upstream release date.
    let pypi_url = format!("https://pypi.org/pypi/{PYPI_NAME}/json");
    let Ok(resp) = reqwest::Client::new().get(&pypi_url).send().await else {
        eprintln!("[skip] pypi.org unreachable; distinct-dates assertion still enforced");
        return;
    };
    let Ok(body) = resp.text().await else {
        eprintln!("[skip] pypi.org body unreadable; distinct-dates assertion still enforced");
        return;
    };
    let Ok(v) = serde_json::from_str::<serde_json::Value>(&body) else {
        eprintln!("[skip] pypi.org returned non-JSON; distinct-dates assertion still enforced");
        return;
    };
    let uploads: Vec<String> = v["releases"][PYPI_VERSION]
        .as_array()
        .map(|files| {
            files
                .iter()
                .filter_map(|f| f["upload_time_iso_8601"].as_str().map(str::to_string))
                .collect()
        })
        .unwrap_or_default();
    if uploads.is_empty() {
        eprintln!("[skip] pypi.org listed no upload times for {PYPI_NAME} {PYPI_VERSION}");
        return;
    }
    // PyPI stamps ISO-8601; the patch API stamps RFC 2822. They cannot be
    // compared as strings, so compare the calendar DATE via the same parser
    // the ranking uses.
    use socket_patch_core::api::date::parse_timestamp_secs;
    let upload_days: std::collections::HashSet<u64> = uploads
        .iter()
        .filter_map(|u| parse_timestamp_secs(u))
        .map(|s| s / 86_400)
        .collect();
    for (uuid, published) in &patches {
        let Some(secs) = parse_timestamp_secs(published) else {
            panic!(
                "production publishedAt {published:?} (patch {uuid}) does not parse — \
                    api::date must handle every format the API emits"
            );
        };
        assert!(
            !upload_days.contains(&(secs / 86_400)),
            "patch {uuid} reports publishedAt {published:?}, which falls on the same day \
             {PYPI_NAME} {PYPI_VERSION} was uploaded to PyPI ({uploads:?}). That strongly \
             suggests the field switched to the PACKAGE release date."
        );
    }
}

// ===========================================================================
// npm ecosystem — five package managers, five lockfile flavors
// ===========================================================================

/// Shared npm-family fixture: a temp project with `minimist@1.2.2` pinned.
struct NpmFixture {
    _tmp: tempfile::TempDir,
    proj: PathBuf,
    cache: PathBuf,
}

fn npm_fixture(name: &str) -> NpmFixture {
    let tmp = tempfile::tempdir().expect("tempdir");
    let proj = tmp.path().join("proj");
    let cache = tmp.path().join(format!("{name}-cache"));
    std::fs::create_dir_all(&proj).expect("mkdir proj");
    std::fs::create_dir_all(&cache).expect("mkdir cache");
    // Hand-written rather than `npm init -y`, which rejects tempdir names.
    std::fs::write(
        proj.join("package.json"),
        format!(
            r#"{{"name":"hosted-e2e","version":"0.0.0","private":true,"dependencies":{{"{NPM_NAME}":"{NPM_VERSION}"}}}}"#
        ),
    )
    .expect("write package.json");
    NpmFixture {
        _tmp: tmp,
        proj,
        cache,
    }
}

fn minimist_entry(proj: &Path) -> PathBuf {
    proj.join("node_modules").join(NPM_NAME).join("index.js")
}

#[test]
#[ignore = "live production API + real npm registry. Run with --ignored."]
fn npm_package_lock_hosted_install_proof() {
    const LEG: &str = "npm_package_lock_hosted_install_proof";
    if !has_command("npm") {
        soft_skip!(LEG, "`npm` not on PATH");
    }
    let fx = npm_fixture("npm");
    let cache = fx.cache.display().to_string();
    let env = [("npm_config_cache", cache.as_str())];

    let install = tool(
        &fx.proj,
        "npm",
        &["install", "--no-audit", "--no-fund", "--ignore-scripts"],
        &env,
    );
    if !ok(&install) {
        soft_skip!(LEG, "upstream `npm install` failed:\n{}", dump(&install));
    }

    assert_pristine(&minimist_entry(&fx.proj), PATCH_MARKER, LEG);
    let lock_before = std::fs::read(fx.proj.join("package-lock.json")).unwrap();
    // npm >= 12 refuses non-registry tarball hosts by default (EALLOWREMOTE):
    // the hosted run itself writes `allow-remote=all` to the project `.npmrc`
    // (older npm accepts the key too), so the install below needs no flags.
    let env_json = scan_hosted(&fx.proj, &[]);
    assert_redirected(&env_json, "package-lock.json");
    assert_eq!(
        read(&fx.proj.join(".npmrc")),
        "allow-remote=all\n",
        "{LEG}: the hosted run must auto-configure npm 12's allow-remote"
    );

    let lock = read(&fx.proj.join("package-lock.json"));
    assert_hosted_pin(&lock, &[NPM_UUID], LEG);
    assert!(
        !lock.contains("registry.npmjs.org/minimist/-/minimist-1.2.2.tgz"),
        "{LEG}: the upstream minimist tarball URL survived the rewrite — npm \
         would still install the unpatched artifact:\n{lock}"
    );

    // The proof: wipe node_modules and let npm install from the rewritten lock
    // alone. npm verifies the `integrity` pin it was handed, so a success here
    // means patch.socket.dev served bytes matching the hash the API published.
    std::fs::remove_dir_all(fx.proj.join("node_modules")).expect("rm node_modules");
    let ci = tool(
        &fx.proj,
        "npm",
        &["ci", "--no-audit", "--no-fund", "--ignore-scripts"],
        &env,
    );
    assert!(
        ok(&ci),
        "{LEG}: `npm ci` from the redirected lock failed — npm could not fetch \
         or could not verify the hosted artifact:\n{}",
        dump(&ci)
    );
    assert_patched(&minimist_entry(&fx.proj), PATCH_MARKER, LEG);

    // ROLLBACK on a copy of the committed state: v5 restores the upstream
    // registry entry re-resolved from the REAL npm registry — the lock
    // comes back equal to what npm wrote — and removes the `.npmrc` the
    // hosted run created.
    let copy = fx.proj.parent().unwrap().join("rollback-copy");
    std::fs::create_dir_all(&copy).unwrap();
    for f in ["package.json", "package-lock.json", ".npmrc"] {
        std::fs::copy(fx.proj.join(f), copy.join(f)).unwrap();
    }
    let (code, stdout, stderr) = run(&copy, &["rollback", "--json", "--yes"]);
    assert_eq!(code, 0, "{LEG}: rollback failed:\n{stdout}\n{stderr}");
    let rb: serde_json::Value = serde_json::from_str(&stdout)
        .unwrap_or_else(|e| panic!("{LEG}: rollback --json is not JSON ({e}):\n{stdout}"));
    assert_eq!(
        rollback_json::hosted_reverted(&rb),
        serde_json::json!([NPM_PURL]),
        "{LEG}: rollback restores the hosted pin: {rb:#}"
    );
    let json = |b: &[u8]| serde_json::from_slice::<serde_json::Value>(b).unwrap();
    assert_eq!(
        json(&std::fs::read(copy.join("package-lock.json")).unwrap()),
        json(&lock_before),
        "{LEG}: rollback restores the registry lock"
    );
    assert!(
        !copy.join(".npmrc").exists(),
        "{LEG}: rollback removes the .npmrc the hosted run created"
    );

    // MANIFEST-LESS VEX against production: the installed patched tree is
    // hash-verified against the real patch record — from lockfile discovery
    // + the public proxy (hosted keeps no ledger), never offline, and not
    // once the lock is reverted.
    npm_e2e_common::production_manifestless_vex(
        LEG,
        &fx.proj,
        NPM_PURL,
        NPM_UUID,
        vex_e2e_common::Marker::Redirected,
        "GHSA-xvch-5gv4-984h",
        &[("package-lock.json", lock_before)],
    );
}

#[test]
#[ignore = "live production API + real npm registry. Run with --ignored."]
fn npm_shrinkwrap_hosted_redirect() {
    const LEG: &str = "npm_shrinkwrap_hosted_redirect";
    if !has_command("npm") {
        soft_skip!(LEG, "`npm` not on PATH");
    }
    let fx = npm_fixture("shrinkwrap");
    let cache = fx.cache.display().to_string();
    let env = [("npm_config_cache", cache.as_str())];

    let install = tool(
        &fx.proj,
        "npm",
        &["install", "--no-audit", "--no-fund", "--ignore-scripts"],
        &env,
    );
    if !ok(&install) {
        soft_skip!(LEG, "upstream `npm install` failed:\n{}", dump(&install));
    }
    let shrink = tool(&fx.proj, "npm", &["shrinkwrap"], &env);
    if !ok(&shrink) {
        // npm 12 removed `npm shrinkwrap`; a shrinkwrap repo there is the
        // shrinkwrap plus its package-lock.json twin (both redirected).
        std::fs::copy(
            fx.proj.join("package-lock.json"),
            fx.proj.join("npm-shrinkwrap.json"),
        )
        .expect("npm 12 shrinkwrap twin");
    }
    assert!(
        fx.proj.join("npm-shrinkwrap.json").exists(),
        "{LEG}: npm shrinkwrap did not produce npm-shrinkwrap.json"
    );

    let env_json = scan_hosted(&fx.proj, &[]);
    assert_redirected(&env_json, "npm-shrinkwrap.json");
    assert_hosted_pin(
        &read(&fx.proj.join("npm-shrinkwrap.json")),
        &[NPM_UUID],
        LEG,
    );
}

#[test]
#[ignore = "live production API + real npm registry. Run with --ignored."]
fn pnpm_hosted_install_proof() {
    const LEG: &str = "pnpm_hosted_install_proof";
    if !has_command("pnpm") {
        soft_skip!(LEG, "`pnpm` not on PATH");
    }
    let fx = npm_fixture("pnpm");
    let store = fx.cache.display().to_string();
    let env = [
        ("PNPM_HOME", store.as_str()),
        ("XDG_CACHE_HOME", store.as_str()),
    ];
    let store_arg = format!("--store-dir={store}");

    let install = tool(
        &fx.proj,
        "pnpm",
        &["install", "--ignore-scripts", &store_arg],
        &env,
    );
    if !ok(&install) {
        soft_skip!(LEG, "upstream `pnpm install` failed:\n{}", dump(&install));
    }
    // pnpm's node_modules is a symlink farm over .pnpm/; resolve through it.
    let entry = fx.proj.join("node_modules").join(NPM_NAME).join("index.js");
    assert_pristine(&entry, PATCH_MARKER, LEG);
    let lock_pristine = std::fs::read(fx.proj.join("pnpm-lock.yaml")).expect("pnpm-lock.yaml");

    let env_json = scan_hosted(&fx.proj, &[]);
    assert_redirected(&env_json, "pnpm-lock.yaml");
    assert_hosted_pin(&read(&fx.proj.join("pnpm-lock.yaml")), &[NPM_UUID], LEG);

    std::fs::remove_dir_all(fx.proj.join("node_modules")).expect("rm node_modules");
    let reinstall = tool(
        &fx.proj,
        "pnpm",
        &[
            "install",
            "--frozen-lockfile",
            "--ignore-scripts",
            &store_arg,
        ],
        &env,
    );

    if ok(&reinstall) {
        assert_patched(&entry, PATCH_MARKER, LEG);
        pnpm_hosted_manifestless_vex(&fx.proj, &lock_pristine, LEG);
        return;
    }

    // pnpm 11 added a lockfile supply-chain policy that compares every entry's
    // tarball URL against the registry's published metadata. Hosted mode
    // deliberately rewrites that URL to patch.socket.dev, so the policy
    // rejects the lockfile:
    //
    //   [ERR_PNPM_TARBALL_URL_MISMATCH] minimist@1.2.2 has a tarball URL
    //   (https://patch.socket.dev/...) that does not match the registry's
    //   published metadata (https://registry.npmjs.org/minimist/-/...)
    //
    // `--trust-lockfile` is pnpm's documented opt-out. The CLI warns with
    // `redirect_pnpm_trust_lockfile` and, by default, auto-configures
    // `trustLockfile: true` in pnpm-workspace.yaml; the `--trust-lockfile`
    // retry below is the fallback for layouts that auto-config does not
    // cover. It proves the artifact IS correctly served and installs cleanly
    // once the policy is relaxed — and fails loudly if the failure is
    // anything OTHER than that known policy rejection.
    let detail = dump(&reinstall);
    assert!(
        detail.contains("ERR_PNPM_TARBALL_URL_MISMATCH"),
        "{LEG}: `pnpm install --frozen-lockfile` from the redirected lock \
         failed for an UNEXPECTED reason (not the known pnpm 11 tarball-URL \
         supply-chain policy). This is a new regression:\n{detail}"
    );
    println!(
        "KNOWN COMPAT GAP {LEG}: pnpm 11's lockfile supply-chain policy rejects \
         hosted-mode rewrites with ERR_PNPM_TARBALL_URL_MISMATCH. Retrying with \
         `--trust-lockfile` (pnpm's documented opt-out). socket-patch should \
         warn about this during `scan --mode hosted` on a pnpm project."
    );

    std::fs::remove_dir_all(fx.proj.join("node_modules")).ok();
    let trusted = tool(
        &fx.proj,
        "pnpm",
        &[
            "install",
            "--frozen-lockfile",
            "--ignore-scripts",
            "--trust-lockfile",
            &store_arg,
        ],
        &env,
    );
    assert!(
        ok(&trusted),
        "{LEG}: even `pnpm install --trust-lockfile` failed against the \
         redirected lock — the hosted artifact itself is not installable:\n{}",
        dump(&trusted)
    );
    assert_patched(&entry, PATCH_MARKER, LEG);
    pnpm_hosted_manifestless_vex(&fx.proj, &lock_pristine, LEG);
}

/// Manifest-less VEX over the reinstalled pnpm project, against the REAL
/// public patch proxy: hosted keeps no ledger, so the production
/// `view/<uuid>` record attests `(redirected)` from the lock alone;
/// `--offline` has no record; and with the lock back on the registry
/// nothing names the patch, `--no-verify` included. Only the pinned
/// advisory is asserted — production may add more to the patch later.
fn pnpm_hosted_manifestless_vex(proj: &Path, lock_pristine: &[u8], leg: &str) {
    use vex_e2e_common::{
        assert_absent, assert_not_attested, run_vex, statements_for, strip_manifest, VexRun,
    };
    let bin = binary();
    let attested = |run: &VexRun, cell: &str| {
        let out = run_vex(&bin, proj, run);
        assert_eq!(out.code, Some(0), "{leg} [{cell}]: {out}");
        let marker = format!("Patched via Socket patch {NPM_UUID} (redirected)");
        assert!(
            statements_for(out.doc(), NPM_PURL).iter().any(|st| {
                st["vulnerability"]["name"] == "GHSA-xvch-5gv4-984h"
                    && st["status"] == "not_affected"
                    && st["impact_statement"]
                        .as_str()
                        .is_some_and(|i| i.contains(&marker))
            }),
            "{leg} [{cell}]: minimist must be attested: {out}"
        );
    };
    strip_manifest(proj);
    assert!(
        !proj.join(".socket/vendor/redirect-state.json").exists(),
        "{leg}: v5 hosted mode writes no ledger"
    );
    attested(&VexRun::default(), "lock + public proxy");
    let out = run_vex(&bin, proj, &VexRun::offline());
    assert_eq!(out.code, Some(1), "{leg} [offline]: {out}");
    assert_not_attested(&out.envelope, NPM_PURL, "record_unavailable");
    std::fs::write(proj.join("pnpm-lock.yaml"), lock_pristine).unwrap();
    for no_verify in [false, true] {
        let out = run_vex(
            &bin,
            proj,
            &VexRun {
                no_verify,
                ..VexRun::default()
            },
        );
        assert_eq!(
            out.code,
            Some(2),
            "{leg} [reverted, no_verify={no_verify}]: nothing names the patch: {out}"
        );
        assert_eq!(
            out.envelope["error"]["code"], "manifest_not_found",
            "{leg}: {out}"
        );
        assert_absent(out.doc.as_ref(), NPM_PURL);
    }
}

#[test]
#[ignore = "live production API + real npm registry. Run with --ignored."]
fn yarn_classic_hosted_install_proof() {
    const LEG: &str = "yarn_classic_hosted_install_proof";
    if !has_command("yarn") {
        soft_skip!(LEG, "`yarn` not on PATH");
    }
    let fx = npm_fixture("yarn1");
    // Without an explicit `packageManager` pin, corepack resolves a bare
    // `yarn` to the latest berry (4.x) even when a classic yarn is on PATH —
    // which silently turned this leg into a duplicate of the berry one. The
    // pin is the release under test (`SOCKET_PATCH_YARN_CLASSIC_E2E_VERSION`,
    // default 1.22.22).
    let want = yarn_classic_vex::yarn_classic_version();
    std::fs::write(
        fx.proj.join("package.json"),
        format!(
            r#"{{"name":"hosted-e2e","version":"0.0.0","private":true,"packageManager":"yarn@{want}","dependencies":{{"{NPM_NAME}":"{NPM_VERSION}"}}}}"#
        ),
    )
    .expect("write package.json");

    let cache = fx.cache.display().to_string();
    let env = [
        ("YARN_CACHE_FOLDER", cache.as_str()),
        ("COREPACK_ENABLE_DOWNLOAD_PROMPT", "0"),
    ];

    let version = tool(&fx.proj, "yarn", &["--version"], &env);
    let major = String::from_utf8_lossy(&version.stdout).trim().to_string();
    if !ok(&version) || major != want {
        soft_skip!(
            LEG,
            "could not resolve yarn classic in this fixture (got version \
             {major:?}) — corepack may be unable to fetch yarn@{want}"
        );
    }

    let install = tool(&fx.proj, "yarn", &["install", "--ignore-scripts"], &env);
    if !ok(&install) {
        soft_skip!(
            LEG,
            "upstream classic `yarn install` failed:\n{}",
            dump(&install)
        );
    }
    if !fx.proj.join("yarn.lock").exists() {
        soft_skip!(LEG, "`yarn install` produced no yarn.lock");
    }
    assert_pristine(&minimist_entry(&fx.proj), PATCH_MARKER, LEG);
    let lock_before = std::fs::read(fx.proj.join("yarn.lock")).expect("read yarn.lock");

    let env_json = scan_hosted(&fx.proj, &[]);
    assert_redirected(&env_json, "yarn.lock");
    assert_hosted_pin(&read(&fx.proj.join("yarn.lock")), &[NPM_UUID], LEG);

    std::fs::remove_dir_all(fx.proj.join("node_modules")).expect("rm node_modules");
    std::fs::remove_dir_all(&fx.cache).ok();
    let reinstall = tool(
        &fx.proj,
        "yarn",
        &["install", "--frozen-lockfile", "--ignore-scripts"],
        &env,
    );
    assert!(
        ok(&reinstall),
        "{LEG}: `yarn install --frozen-lockfile` from the redirected lock \
         failed:\n{}",
        dump(&reinstall)
    );
    assert_patched(&minimist_entry(&fx.proj), PATCH_MARKER, LEG);

    // Manifest-less VEX against the REAL public proxy: the record for the
    // production patch comes from `patches-api.socket.dev` (hosted keeps no
    // ledger); `--offline` is pointed at an empty local stand-in so its
    // zero-request claim is observable.
    let empty = vex_e2e_common::PatchApi::empty();
    let reinstall_env = env;
    yarn_classic_vex::ManifestlessVex {
        leg: LEG,
        wiring: yarn_classic_vex::Wiring::Hosted,
        purl: NPM_PURL,
        uuid: NPM_UUID,
        vulns: &[],
        api: &empty,
        proxy_override: Some(PROXY.to_string()),
        patch_server_url: None,
        registry_lock: lock_before,
        reinstall: Some(Box::new(move |dir: &Path| {
            std::fs::remove_dir_all(dir.join("node_modules")).expect("rm node_modules");
            let out = tool(
                dir,
                "yarn",
                &["install", "--frozen-lockfile", "--ignore-scripts"],
                &reinstall_env,
            );
            assert!(
                ok(&out),
                "{LEG}: reverted-lock install failed:\n{}",
                dump(&out)
            );
            assert_pristine(&minimist_entry(dir), PATCH_MARKER, LEG);
        })),
        embedded: vec![
            ("apply --vex", yarn_classic_vex::via_apply()),
            // The command the leg itself ran, re-run manifest-less.
            (
                "scan --mode hosted --vex",
                Box::new(|run: vex_e2e_common::VexRun| {
                    run.via(vex_e2e_common::VexVia::Scan)
                        .arg("--mode")
                        .arg("hosted")
                        .arg("--yes")
                }),
            ),
        ],
    }
    .run(&fx.proj);
}

#[test]
#[ignore = "live production API + real npm registry. Run with --ignored."]
fn yarn_berry_hosted_install_proof() {
    const LEG: &str = "yarn_berry_hosted_install_proof";
    if !has_command("corepack") {
        soft_skip!(LEG, "`corepack` not on PATH (needed to pin yarn berry)");
    }
    let fx = npm_fixture("berry");
    // Berry needs an explicit packageManager pin plus the node-modules linker
    // (PnP is documented as untested for hosted mode) and compressionLevel 0,
    // which is what the redirect's 10c0 checksum is computed against.
    std::fs::write(
        fx.proj.join("package.json"),
        format!(
            r#"{{"name":"hosted-e2e","version":"0.0.0","private":true,"packageManager":"yarn@4.6.0","dependencies":{{"{NPM_NAME}":"{NPM_VERSION}"}}}}"#
        ),
    )
    .expect("write package.json");
    std::fs::write(
        fx.proj.join(".yarnrc.yml"),
        "nodeLinker: node-modules\ncompressionLevel: 0\nenableGlobalCache: false\n",
    )
    .expect("write .yarnrc.yml");

    let cache = fx.cache.display().to_string();
    let env = [
        ("YARN_CACHE_FOLDER", cache.as_str()),
        ("YARN_GLOBAL_FOLDER", cache.as_str()),
        ("COREPACK_ENABLE_DOWNLOAD_PROMPT", "0"),
    ];

    // `--no-immutable` on the FIXTURE install only. Berry auto-enables
    // hardened mode on a public-PR CI run, which implies `--immutable` and
    // refuses the lockfile this first install has to create (`YN0028: The
    // lockfile would have been created by this install, which is explicitly
    // forbidden`). The reinstall below keeps `--immutable` — that leg is the
    // actual proof, and it must stay strict.
    let install = tool(&fx.proj, "yarn", &["install", "--no-immutable"], &env);
    if !ok(&install) {
        soft_skip!(
            LEG,
            "berry `yarn install` failed (corepack may be unable to download \
             yarn@4.6.0):\n{}",
            dump(&install)
        );
    }
    assert_pristine(&minimist_entry(&fx.proj), PATCH_MARKER, LEG);
    let registry_lock = std::fs::read(fx.proj.join("yarn.lock")).expect("registry yarn.lock");
    // The hosted pin also routes through package.json `resolutions` (#404),
    // so a revert to the registry restores both files.
    let registry_pkg = std::fs::read(fx.proj.join("package.json")).expect("registry package.json");

    let env_json = scan_hosted(&fx.proj, &[]);
    assert_redirected(&env_json, "yarn.lock");
    let lock = read(&fx.proj.join("yarn.lock"));
    // Berry pins the hosted artifact as a plain tarball-URL locator — never
    // an `npm:` one (`::__archiveUrl=`), whose fetcher would send the npm
    // registry token to the patch host (#404).
    assert!(
        lock.contains("@https://patch.socket.dev/") && !lock.contains("__archiveUrl"),
        "{LEG}: berry lock carries no tarball locator pointing at the patch \
         host:\n{lock}"
    );
    assert!(
        lock.contains(NPM_UUID),
        "{LEG}: berry lock does not reference patch {NPM_UUID}:\n{lock}"
    );

    std::fs::remove_dir_all(fx.proj.join("node_modules")).ok();
    std::fs::remove_dir_all(fx.proj.join(".yarn")).ok();
    std::fs::remove_dir_all(&fx.cache).ok();
    let reinstall = tool(&fx.proj, "yarn", &["install", "--immutable"], &env);
    assert!(
        ok(&reinstall),
        "{LEG}: `yarn install --immutable` from the redirected lock failed — \
         berry could not fetch the hosted artifact or its 10c0 checksum did \
         not match:\n{}",
        dump(&reinstall)
    );
    assert_patched(&minimist_entry(&fx.proj), PATCH_MARKER, LEG);

    yarn_berry_hosted_manifestless_vex(&fx, &registry_lock, &registry_pkg, &env);
}

/// One `vex --json --output <tmp>/berry.vex.json` run in `proj` (production
/// public proxy, hermetic env). Returns (exit, envelope, document).
fn yarn_berry_vex(
    proj: &Path,
    extra: &[&str],
) -> (i32, serde_json::Value, Option<serde_json::Value>) {
    let out = proj.parent().unwrap().join("berry.vex.json");
    let _ = std::fs::remove_file(&out);
    let out_s = out.to_str().unwrap().to_string();
    let mut args = vec![
        "vex",
        "--json",
        "--output",
        out_s.as_str(),
        "--product",
        "pkg:npm/hosted-e2e@0.0.0",
    ];
    args.extend_from_slice(extra);
    let (code, stdout, stderr) = run(proj, &args);
    let env: serde_json::Value = serde_json::from_str(&stdout).unwrap_or_else(|e| {
        panic!("vex --json is not JSON ({e}).\nstdout:\n{stdout}\nstderr:\n{stderr}")
    });
    let doc = std::fs::read(&out)
        .ok()
        .map(|b| serde_json::from_slice(&b).expect("VEX document is JSON"));
    (code, env, doc)
}

/// The production patch attested `(redirected)` for [`NPM_PURL`].
fn assert_berry_redirected_attestation(
    code: i32,
    env: &serde_json::Value,
    doc: Option<serde_json::Value>,
    cell: &str,
) {
    assert_eq!(code, 0, "{cell}: {env:#}");
    let doc = doc.unwrap_or_else(|| panic!("{cell}: no VEX document: {env:#}"));
    let stmts: Vec<&serde_json::Value> = doc["statements"]
        .as_array()
        .into_iter()
        .flatten()
        .filter(|st| {
            st["products"][0]["subcomponents"]
                .as_array()
                .is_some_and(|subs| subs.iter().any(|s| s["@id"] == NPM_PURL))
        })
        .collect();
    assert!(
        !stmts.is_empty(),
        "{cell}: {NPM_PURL} not attested: {doc:#}"
    );
    for st in stmts {
        assert_eq!(st["status"], "not_affected", "{cell}: {st:#}");
        assert!(
            st["impact_statement"]
                .as_str()
                .is_some_and(|s| s.contains(&format!("Socket patch {NPM_UUID} (redirected)"))),
            "{cell}: {st:#}"
        );
    }
}

/// `errorCode` of the skipped event for [`NPM_PURL`].
fn berry_skip_code(env: &serde_json::Value) -> String {
    env["events"]
        .as_array()
        .into_iter()
        .flatten()
        .find(|e| e["action"] == "skipped" && e["purl"] == NPM_PURL)
        .and_then(|e| e["errorCode"].as_str())
        .unwrap_or_else(|| panic!("no skipped event for {NPM_PURL}: {env:#}"))
        .to_string()
}

/// Manifest-less VEX against PRODUCTION for the berry hosted leg (a hosted
/// checkout carries no `.socket/manifest.json` by design): after the
/// `--immutable` reinstall served the patched bytes, standalone `vex`
/// attests the production patch from the lockfile alone (the record fetched
/// from the public proxy — v5 hosted keeps no ledger), not at all
/// `--offline` (`record_unavailable`), and not once the lock is reverted to
/// the registry and reinstalled (nothing names the patch, even with
/// `--no-verify`).
fn yarn_berry_hosted_manifestless_vex(
    fx: &NpmFixture,
    registry_lock: &[u8],
    registry_pkg: &[u8],
    env: &[(&str, &str)],
) {
    const LEG: &str = "yarn_berry_hosted_install_proof (manifest-less vex)";
    let proj = &fx.proj;
    assert!(
        !proj.join(".socket/manifest.json").exists(),
        "{LEG}: hosted mode writes no manifest"
    );
    assert!(
        !proj.join(".socket/vendor/redirect-state.json").exists(),
        "{LEG}: v5 hosted mode writes no ledger"
    );
    let (code, env_json, doc) = yarn_berry_vex(proj, &[]);
    assert_berry_redirected_attestation(code, &env_json, doc, &format!("{LEG}: lockfile only"));
    let (code, env_json, doc) = yarn_berry_vex(proj, &["--offline"]);
    assert_eq!(code, 1, "{LEG}: lockfile only, offline: {env_json:#}");
    assert_eq!(berry_skip_code(&env_json), "record_unavailable", "{LEG}");
    assert!(doc.is_none(), "{LEG}: no document");

    // Revert the lock and the package.json `resolutions` pin to the
    // registry and reinstall.
    std::fs::write(proj.join("yarn.lock"), registry_lock).unwrap();
    std::fs::write(proj.join("package.json"), registry_pkg).unwrap();
    std::fs::remove_dir_all(proj.join("node_modules")).ok();
    let reinstall = tool(proj, "yarn", &["install", "--immutable"], env);
    assert!(
        ok(&reinstall),
        "{LEG}: reverted reinstall:\n{}",
        dump(&reinstall)
    );
    assert_pristine(&minimist_entry(proj), PATCH_MARKER, LEG);
    for extra in [
        &["--offline"][..],
        &["--offline", "--no-verify"][..],
        &[][..],
    ] {
        let (code, env_json, doc) = yarn_berry_vex(proj, extra);
        assert_eq!(
            code, 2,
            "{LEG}: reverted {extra:?}: nothing names the patch: {env_json:#}"
        );
        assert_eq!(
            env_json["error"]["code"], "manifest_not_found",
            "{LEG}: reverted {extra:?}: {env_json:#}"
        );
        assert!(doc.is_none(), "{LEG}: reverted {extra:?}: no document");
    }
    println!(
        "VEX-MATRIX|yarn@4.6.0|production|hosted|manifest-less+lockfile-only+offline+reverted|PASS"
    );
}

#[test]
#[ignore = "live production API + real npm registry. Run with --ignored."]
fn bun_hosted_install_proof() {
    const LEG: &str = "bun_hosted_install_proof";
    if !has_command("bun") {
        soft_skip!(LEG, "`bun` not on PATH");
    }
    let fx = npm_fixture("bun");
    let cache = fx.cache.display().to_string();
    let env = [("BUN_INSTALL_CACHE_DIR", cache.as_str())];

    // Text `bun.lock` only — the binary `bun.lockb` is a separate (documented)
    // auto-migration path, not what this leg covers.
    let install = tool(
        &fx.proj,
        "bun",
        &["install", "--ignore-scripts", "--save-text-lockfile"],
        &env,
    );
    if !ok(&install) {
        soft_skip!(LEG, "upstream `bun install` failed:\n{}", dump(&install));
    }
    if !fx.proj.join("bun.lock").exists() {
        soft_skip!(
            LEG,
            "`bun install --save-text-lockfile` produced no bun.lock (bun too old?)"
        );
    }
    assert_pristine(&minimist_entry(&fx.proj), PATCH_MARKER, LEG);
    let lock_before = std::fs::read(fx.proj.join("bun.lock")).unwrap();

    let env_json = scan_hosted(&fx.proj, &[]);
    assert_redirected(&env_json, "bun.lock");
    assert_hosted_pin(&read(&fx.proj.join("bun.lock")), &[NPM_UUID], LEG);

    std::fs::remove_dir_all(fx.proj.join("node_modules")).expect("rm node_modules");
    std::fs::remove_dir_all(&fx.cache).ok();
    let reinstall = tool(
        &fx.proj,
        "bun",
        &["install", "--frozen-lockfile", "--ignore-scripts"],
        &env,
    );
    assert!(
        ok(&reinstall),
        "{LEG}: `bun install --frozen-lockfile` from the redirected lock \
         failed:\n{}",
        dump(&reinstall)
    );
    assert_patched(&minimist_entry(&fx.proj), PATCH_MARKER, LEG);
    // v5 hosted keeps no ledger: the record the attestation must match is
    // production's own (`/patch/view/<uuid>` on the public proxy).
    let record = published_view_record_blocking(NPM_UUID);
    bun_manifestless_vex_production(&fx.proj, &record, "redirected", &lock_before, LEG);
}

/// Manifest-less VEX over a PRODUCTION bun checkout (`checkout` holds the
/// committed state plus a real frozen install of the patched bytes):
/// with `.socket/manifest.json` deleted, standalone `vex` against the public
/// patch API attests minimist under the production record's uuid with
/// `marker` and exactly the record's vulnerability ids (lockfile discovery
/// plus the API: v5 hosted keeps no ledger); `--offline` omits it as
/// `record_unavailable`; and with `bun.lock` reverted to `registry_lock`
/// nothing names the patch any more, verified or not. The hermetic twins
/// (mock API, zero-request oracle) run in `e2e_redirect_bun_build` /
/// `e2e_vendor_bun_build`.
fn bun_manifestless_vex_production(
    checkout: &Path,
    record: &serde_json::Value,
    marker: &str,
    registry_lock: &[u8],
    leg: &str,
) {
    let uuid = record["uuid"].as_str().expect("record uuid").to_string();
    let mut want: Vec<String> = record["vulnerabilities"]
        .as_object()
        .map(|m| m.keys().cloned().collect())
        .unwrap_or_default();
    want.sort();
    assert!(
        !want.is_empty(),
        "{leg}: the production record lists no vulnerability: {record}"
    );
    let vex = |extra: &[&str]| -> (Option<i32>, serde_json::Value, Option<serde_json::Value>) {
        let out_path = checkout.join("out.vex.json");
        let _ = std::fs::remove_file(&out_path);
        let out = hermetic::binary_command()
            .env("SOCKET_NO_API_TOKEN", "1")
            .current_dir(checkout)
            .args(["vex", "--json", "--output"])
            .arg(&out_path)
            .args(["--product", "pkg:npm/app@1.0.0", "--cwd"])
            .arg(checkout)
            .args(extra)
            .output()
            .expect("spawn socket-patch vex");
        let envelope = serde_json::from_slice(&out.stdout).unwrap_or_else(|e| {
            panic!(
                "{leg}: vex --json output is not JSON ({e}):\n{}",
                String::from_utf8_lossy(&out.stdout)
            )
        });
        let doc = std::fs::read(&out_path)
            .ok()
            .map(|b| serde_json::from_slice(&b).unwrap());
        (out.status.code(), envelope, doc)
    };
    let attested = |doc: &Option<serde_json::Value>| -> Vec<String> {
        let part = format!("Patched via Socket patch {uuid} ({marker})");
        let mut ids: Vec<String> = doc
            .as_ref()
            .and_then(|d| d["statements"].as_array().cloned())
            .unwrap_or_default()
            .into_iter()
            .filter(|st| {
                st["products"][0]["subcomponents"][0]["@id"] == NPM_PURL
                    && st["status"] == "not_affected"
                    && st["impact_statement"]
                        .as_str()
                        .is_some_and(|s| s.split("; ").any(|p| p == part))
            })
            .filter_map(|st| st["vulnerability"]["name"].as_str().map(str::to_string))
            .collect();
        ids.sort();
        ids
    };
    let skip = |env: &serde_json::Value| -> Option<String> {
        env["events"].as_array()?.iter().find_map(|e| {
            (e["action"] == "skipped" && e["purl"] == NPM_PURL)
                .then(|| e["errorCode"].as_str().unwrap_or_default().to_string())
        })
    };
    let _ = std::fs::remove_file(checkout.join(".socket/manifest.json"));
    assert!(
        !checkout.join(".socket/vendor/redirect-state.json").exists(),
        "{leg}: v5 hosted mode writes no ledger"
    );
    let (code, env, doc) = vex(&[]);
    assert_eq!(code, Some(0), "{leg}: manifest-less vex: {env:#}");
    assert_eq!(attested(&doc), want, "{leg}: manifest-less vex: {env:#}");
    let (code, env, doc) = vex(&["--offline"]);
    assert_eq!(code, Some(1), "{leg}: offline vex: {env:#}");
    assert_eq!(
        skip(&env).as_deref(),
        Some("record_unavailable"),
        "{leg}: {env:#}"
    );
    assert!(attested(&doc).is_empty(), "{leg}: offline vex: {env:#}");
    std::fs::write(checkout.join("bun.lock"), registry_lock).unwrap();
    for extra in [&[][..], &["--no-verify"][..]] {
        let (code, env, doc) = vex(extra);
        assert_eq!(
            code,
            Some(2),
            "{leg}: reverted vex {extra:?}: nothing names the patch: {env:#}"
        );
        assert_eq!(
            env["error"]["code"], "manifest_not_found",
            "{leg}: reverted {extra:?}: {env:#}"
        );
        assert!(
            attested(&doc).is_empty(),
            "{leg}: reverted vex {extra:?}: {env:#}"
        );
    }
    eprintln!("BUN-VEX production {marker} manifest-deleted/offline/reverted ok");
}

// ===========================================================================
// PyPI ecosystem — requirements.txt and uv.lock
// ===========================================================================

/// Locate `site-packages` inside a venv, across platforms and Python minors.
fn site_packages(venv: &Path) -> Option<PathBuf> {
    if cfg!(windows) {
        let p = venv.join("Lib").join("site-packages");
        return p.exists().then_some(p);
    }
    let lib = venv.join("lib");
    let entries = std::fs::read_dir(lib).ok()?;
    for e in entries.flatten() {
        let p = e.path().join("site-packages");
        if p.exists() {
            return Some(p);
        }
    }
    None
}

/// The urllib3 patches rewrite files under the package directory; which file
/// depends on which of the three advisories the resolver picked, so look for
/// the marker anywhere in the package rather than pinning one filename.
fn urllib3_patched(site: &Path) -> bool {
    let dir = site.join(PYPI_NAME);
    let Ok(entries) = std::fs::read_dir(&dir) else {
        return false;
    };
    for e in entries.flatten() {
        let is_py = e.path().extension().and_then(|s| s.to_str()) == Some("py");
        if is_py
            && std::fs::read_to_string(e.path())
                .map(|b| b.contains(PATCH_MARKER))
                .unwrap_or(false)
        {
            return true;
        }
    }
    false
}

/// The manifest-less VEX steps over an installed checkout wired to one of
/// [`PYPI_UUIDS`] (whichever `wiring` names), records from the LIVE public
/// proxy (vuln ids: whatever production's record carries), `revert`
/// putting requirements.txt back on the registry pin.
fn pypi_manifestless_vex(
    project: &Path,
    leg: &str,
    wiring: &str,
    marker: vex_e2e_common::Marker,
    revert: &(dyn Fn(&Path) + Sync),
) {
    let uuid = PYPI_UUIDS
        .iter()
        .find(|u| wiring.contains(**u))
        .unwrap_or_else(|| panic!("{leg}: no known urllib3 patch uuid is wired:\n{wiring}"));
    vex_pipenv_pip_steps::run_manifestless_steps(&vex_pipenv_pip_steps::Steps {
        what: format!("{leg} manifest-less vex"),
        project,
        purl: PYPI_PURL,
        uuid,
        marker,
        vulns: None,
        records: vex_pipenv_pip_steps::Records::Live(PROXY.to_string()),
        patch_server_url: None,
        product: "pkg:pypi/app@1.0.0",
        revert,
        envs: Vec::new(),
        on_step: None,
        expect_verified: true,
    });
}

#[test]
#[ignore = "live production API + real PyPI. Run with --ignored."]
fn pypi_requirements_txt_hosted_install_proof() {
    const LEG: &str = "pypi_requirements_txt_hosted_install_proof";
    if !has_command("uv") {
        soft_skip!(LEG, "`uv` not on PATH");
    }
    let tmp = tempfile::tempdir().expect("tempdir");
    let proj = tmp.path().join("proj");
    std::fs::create_dir_all(&proj).expect("mkdir proj");
    let uv_cache = tmp.path().join("uv-cache").display().to_string();
    let venv = proj.join(".venv");
    let venv_s = venv.display().to_string();
    let env = [
        ("UV_CACHE_DIR", uv_cache.as_str()),
        ("VIRTUAL_ENV", venv_s.as_str()),
    ];

    std::fs::write(
        proj.join("requirements.txt"),
        format!("{PYPI_NAME}=={PYPI_VERSION}\n"),
    )
    .expect("write requirements.txt");

    if !ok(&tool(&proj, "uv", &["venv", "--quiet", ".venv"], &env)) {
        soft_skip!(LEG, "`uv venv` failed");
    }
    let install = tool(
        &proj,
        "uv",
        &["pip", "install", "--quiet", "-r", "requirements.txt"],
        &env,
    );
    if !ok(&install) {
        soft_skip!(LEG, "upstream `uv pip install` failed:\n{}", dump(&install));
    }
    let Some(site) = site_packages(&venv) else {
        soft_skip!(LEG, "could not locate site-packages under {venv_s}");
    };
    assert!(
        !urllib3_patched(&site),
        "{LEG}: the freshly-installed upstream urllib3 already carries \
         `{PATCH_MARKER}` — every downstream assertion would be vacuous"
    );

    let env_json = scan_hosted(&proj, &[]);
    assert_redirected(&env_json, "requirements.txt");
    let reqs = read(&proj.join("requirements.txt"));
    assert_hosted_pin(&reqs, PYPI_UUIDS, LEG);
    // An unhashed file is pinned by the url's `#sha256=` fragment, which
    // pip and uv both verify; a `--hash` would put pip in hash-checking
    // mode for every other requirement (#376).
    assert!(
        reqs.contains(".whl#sha256=") && !reqs.contains("--hash"),
        "{LEG}: rewritten requirements.txt must pin the hosted wheel by its \
         url fragment (and add no --hash), or pip/uv would install it \
         unverified:\n{reqs}"
    );

    std::fs::remove_dir_all(&venv).expect("rm venv");
    assert!(
        ok(&tool(&proj, "uv", &["venv", "--quiet", ".venv"], &env)),
        "{LEG}: re-creating the venv failed"
    );
    let reinstall = tool(
        &proj,
        "uv",
        &["pip", "install", "--quiet", "-r", "requirements.txt"],
        &env,
    );
    assert!(
        ok(&reinstall),
        "{LEG}: `uv pip install` from the redirected requirements.txt failed — \
         the hosted wheel could not be fetched or failed its hash check:\n{}",
        dump(&reinstall)
    );
    let site = site_packages(&venv).expect("site-packages after reinstall");
    assert!(
        urllib3_patched(&site),
        "{LEG}: reinstalled from the redirected requirements.txt, but no urllib3 \
         source file carries `{PATCH_MARKER}`"
    );

    // Manifest-less VEX over the installed, redirected checkout (hosted
    // writes no manifest, and v5 no redirect ledger either).
    let original = format!("{PYPI_NAME}=={PYPI_VERSION}\n");
    pypi_manifestless_vex(
        &proj,
        LEG,
        &reqs,
        vex_e2e_common::Marker::Redirected,
        &|p: &Path| std::fs::write(p.join("requirements.txt"), &original).unwrap(),
    );
}

#[test]
#[ignore = "live production API + real PyPI. Run with --ignored."]
fn pypi_uv_lock_hosted_install_proof() {
    const LEG: &str = "pypi_uv_lock_hosted_install_proof";
    // The uv under test (`SOCKET_PATCH_UV_E2E_BIN`, default `uv` on PATH).
    let uv = uv_vex::uv_program();
    if !has_command(&uv) {
        soft_skip!(LEG, "`{uv}` not on PATH");
    }
    if let Err(why) = uv_vex::production_supported(&uv, uv_vex::Mode::Hosted) {
        println!(
            "UV-VEX uv={} mode={} lane=production({LEG}) step=all result=n/a ({why})",
            uv_vex::version_of(&uv),
            uv_vex::Mode::Hosted.name()
        );
        return;
    }
    let tmp = tempfile::tempdir().expect("tempdir");
    let proj = tmp.path().join("proj");
    std::fs::create_dir_all(&proj).expect("mkdir proj");
    let uv_cache = tmp.path().join("uv-cache").display().to_string();
    let env = [("UV_CACHE_DIR", uv_cache.as_str())];

    std::fs::write(
        proj.join("pyproject.toml"),
        format!(
            "[project]\nname = \"hosted-e2e\"\nversion = \"0.1.0\"\n\
             requires-python = \">=3.9\"\ndependencies = [\"{PYPI_NAME}=={PYPI_VERSION}\"]\n"
        ),
    )
    .expect("write pyproject.toml");

    if !ok(&tool(&proj, &uv, &["lock", "--quiet"], &env)) {
        soft_skip!(LEG, "`uv lock` failed");
    }
    let sync = tool(&proj, &uv, &["sync", "--quiet"], &env);
    if !ok(&sync) {
        soft_skip!(LEG, "upstream `uv sync` failed:\n{}", dump(&sync));
    }
    let venv = proj.join(".venv");
    let Some(site) = site_packages(&venv) else {
        soft_skip!(
            LEG,
            "could not locate site-packages under {}",
            venv.display()
        );
    };
    assert!(
        !urllib3_patched(&site),
        "{LEG}: upstream urllib3 already carries `{PATCH_MARKER}` — vacuous"
    );

    let registry = uv_vex::snapshot(&proj, &["pyproject.toml", "uv.lock"]);

    let env_json = scan_hosted(&proj, &[]);
    assert_redirected(&env_json, "uv.lock");
    let lock = read(&proj.join("uv.lock"));
    assert_hosted_pin(&lock, PYPI_UUIDS, LEG);
    // The ONE uuid the resolver granted (and the lock now pins). The VEX
    // stand-in below serves exactly that record: v5 hosted keeps no local
    // record, so `production_record` resolves it from the public proxy, and
    // handing it all of PYPI_UUIDS would let it serve the first one the
    // proxy answers for — a different patch than the lock wires, which the
    // manifest-less `vex` then (rightly) reports `record_unavailable` for.
    let wired_uuid: &str = PYPI_UUIDS
        .iter()
        .copied()
        .find(|u| lock.contains(u))
        .unwrap_or_else(|| panic!("{LEG}: the uv.lock pins none of PYPI_UUIDS"));

    std::fs::remove_dir_all(&venv).expect("rm venv");
    let resync = tool(&proj, &uv, &["sync", "--frozen", "--quiet"], &env);
    assert!(
        ok(&resync),
        "{LEG}: `uv sync --frozen` from the redirected uv.lock failed:\n{}",
        dump(&resync)
    );
    let site = site_packages(&venv).expect("site-packages after resync");
    assert!(
        urllib3_patched(&site),
        "{LEG}: resynced from the redirected uv.lock, but no urllib3 source \
         file carries `{PATCH_MARKER}`"
    );

    // Manifest-less VEX over a fresh checkout (pyproject + uv.lock + .socket,
    // reinstalled by uv from an empty cache through patch.socket.dev): v5
    // hosted keeps no ledger, so the record comes from a local stand-in
    // serving the SAME production record (hermetic, so a proxy 503 cannot
    // flake the matrix); `--offline` makes zero requests; `apply --vex` and
    // the leg's own `scan --mode hosted --vex` (live) attest; the reverted
    // pair, reinstalled pristine, does not.
    uv_vex::production_manifestless(&uv_vex::Production {
        leg: LEG,
        proj: &proj,
        tmp: tmp.path(),
        mode: uv_vex::Mode::Hosted,
        purl: PYPI_PURL,
        uuids: &[wired_uuid],
        registry: &registry,
        uv: &uv,
        patched: &|dir: &Path| {
            site_packages(&dir.join(".venv")).is_some_and(|s| urllib3_patched(&s))
        },
        embedded: vec![(
            "scan --mode hosted --vex",
            vex_e2e_common::VexRun::default()
                .via(vex_e2e_common::VexVia::Scan)
                .arg("--mode")
                .arg("hosted")
                .arg("--yes"),
        )],
    });
}

// ===========================================================================
// RubyGems — full hosted install proof
// ===========================================================================

/// Full hosted install proof for RubyGems: the redirect rewrites `Gemfile`
/// with a per-dep Socket source block and swaps the lock's CHECKSUMS pin to
/// the patched artifact's sha256, then a real `bundle install` from the
/// rewritten files alone fetches through `patch.socket.dev` and every file
/// the patch rewrites is verified on disk against the `/patch/view`
/// afterHash.
///
/// The patch-registry's `/info/<gem>` line must declare the served `.gem`'s
/// runtime dependencies, or bundler's `ensure_same_dependencies` check fails
/// closed with `Bundler::APIResponseMismatchError` (production's defect until
/// the 2026-08-18 gem catalog republish).
///
/// NOTE (latent, server-side): the registry's `/api/v1/dependencies` route
/// still answers 200 with an empty body. That bug is unreachable today —
/// bundler only falls back to the Dependency fetcher when the compact index
/// is unavailable — but it would resurface as a confusing Marshal error if
/// the compact index ever broke again.
#[tokio::test(flavor = "multi_thread")]
#[ignore = "live production API + real rubygems.org. Run with --ignored."]
async fn gem_bundler_hosted_install_proof() {
    const LEG: &str = "gem_bundler_hosted_install_proof";
    if !has_command("ruby") || !has_command("bundle") {
        soft_skip!(LEG, "`ruby` and/or `bundle` not on PATH");
    }
    let tmp = tempfile::tempdir().expect("tempdir");
    let proj = tmp.path().join("proj");
    std::fs::create_dir_all(&proj).expect("mkdir proj");
    let bundle_path = tmp.path().join("bundle").display().to_string();
    let env = [
        ("BUNDLE_PATH", bundle_path.as_str()),
        ("BUNDLE_APP_CONFIG", bundle_path.as_str()),
        // mimemagic (pulled via activestorage → marcel) builds against the
        // system shared-mime-info DB, which no workflow installs — use the
        // gem's bundled placeholder instead of depending on a host package.
        ("USE_FREEDESKTOP_PLACEHOLDER", "true"),
    ];

    std::fs::write(
        proj.join("Gemfile"),
        format!("source \"https://rubygems.org\"\ngem \"{GEM_NAME}\", \"{GEM_VERSION}\"\n"),
    )
    .expect("write Gemfile");
    let pristine_gemfile = std::fs::read(proj.join("Gemfile")).expect("read Gemfile");

    // `--add-checksums` produces the CHECKSUMS section the hosted rewrite pins
    // into; it needs bundler >= 2.6.
    if !ok(&tool(&proj, "bundle", &["lock", "--add-checksums"], &env)) {
        soft_skip!(
            LEG,
            "`bundle lock --add-checksums` failed (bundler < 2.6 has no \
             CHECKSUMS section)"
        );
    }
    // Capture the UPSTREAM checksum pin before any redirect. Bundler installs
    // whatever matches this pin, so the redirect must replace it with the
    // patched artifact's digest — the assertion after the redirect below is
    // what makes an inert rewrite (URL repointed, upstream digest kept, so
    // bundler verify-and-installs the UNPATCHED gem) go red instead of green.
    let pristine_lock = read(&proj.join("Gemfile.lock"));
    let upstream_sha =
        gem_lock_checksum(&pristine_lock, GEM_NAME, GEM_VERSION).unwrap_or_else(|| {
            panic!(
                "{LEG}: `bundle lock --add-checksums` wrote no sha256 CHECKSUMS \
                 entry for {GEM_NAME} ({GEM_VERSION}):\n{pristine_lock}"
            )
        });
    let install = tool(&proj, "bundle", &["install", "--quiet"], &env);
    if !ok(&install) {
        soft_skip!(LEG, "upstream `bundle install` failed:\n{}", dump(&install));
    }

    let env_json = scan_hosted(&proj, &[]);
    assert_redirected(&env_json, "Gemfile.lock");

    // Hard assertions: the redirect itself must be correct. The wired patch
    // UUID is parsed back out of the rewritten Gemfile rather than assumed:
    // selection is ranked client-side by `api::ranking` and scan always
    // auto-selects the top candidate, so the leg accepts any UUID in the
    // pinned any-of set and then content-verifies against the one bundler
    // was actually given.
    let gemfile = read(&proj.join("Gemfile"));
    let wired_uuid = wired_gem_registry_uuid(&gemfile).unwrap_or_else(|| {
        panic!(
            "{LEG}: Gemfile carries no per-dep Socket source block \
             (`source \"https://{PATCH_HOST}/patch-registry/gem/<grant>/<uuid>/\" do`):\n{gemfile}"
        )
    });
    assert!(
        GEM_UUIDS.contains(&wired_uuid.as_str()),
        "{LEG}: the redirect wired patch {wired_uuid}, which is not in the \
         pinned any-of set {GEM_UUIDS:?}. If production replaced or extended \
         the {GEM_VERSION} patches, verify the new patch and extend \
         GEM_UUIDS.\n{gemfile}"
    );
    let lock = read(&proj.join("Gemfile.lock"));
    assert!(
        lock.contains("CHECKSUMS"),
        "{LEG}: Gemfile.lock lost its CHECKSUMS section:\n{lock}"
    );
    // Converged-lock proof: a rewrite that only moved the
    // CHECKSUMS pin would leave the lock's GEM section on rubygems.org — a
    // mixed state an unfrozen install can silently paper over. The GEM
    // section must carry a patch-registry remote and DEPENDENCIES must
    // source-pin the gem.
    assert!(
        lock.contains(&format!(
            "  remote: https://{PATCH_HOST}/patch-registry/gem/"
        )),
        "{LEG}: rewritten Gemfile.lock has no GEM-section `remote:` on the \
         patch registry — the lock was not converged:\n{lock}"
    );
    assert!(
        lock.contains(&format!("\n  {GEM_NAME} (= {GEM_VERSION})!")),
        "{LEG}: DEPENDENCIES pin `  {GEM_NAME} (= {GEM_VERSION})!` missing — \
         the lock does not source-pin the redirected gem:\n{lock}"
    );
    let redirected_sha = gem_lock_checksum(&lock, GEM_NAME, GEM_VERSION).unwrap_or_else(|| {
        panic!(
            "{LEG}: redirected Gemfile.lock carries no sha256 CHECKSUMS entry \
             for {GEM_NAME} ({GEM_VERSION}):\n{lock}"
        )
    });
    assert_ne!(
        redirected_sha, upstream_sha,
        "{LEG}: the redirect left {GEM_NAME}'s CHECKSUMS pin at the UPSTREAM \
         sha256 — bundler would verify and install the unpatched artifact, so \
         the hosted patch is inert (the same blindspot that let an inert npm \
         patch stay green).\nGemfile.lock:\n{lock}"
    );

    // THE point of the leg: reinstall from the redirected Gemfile alone,
    // letting bundler fetch through patch.socket.dev and verify the swapped
    // CHECKSUMS pin itself. The wipe must be COMPLETE — a partial wipe lets
    // bundler reuse the stale pristine install, and the leg would then
    // misattribute that as a published-patch regression (seen under
    // --test-threads=4).
    std::fs::remove_dir_all(&bundle_path)
        .unwrap_or_else(|e| panic!("{LEG}: wiping BUNDLE_PATH {bundle_path} failed: {e}"));
    assert!(
        !Path::new(&bundle_path).exists(),
        "{LEG}: BUNDLE_PATH {bundle_path} still exists after the wipe"
    );
    // BUNDLE_FROZEN=true is the deployment-mode contract production users
    // run under: the committed Gemfile + lock pair must satisfy bundler
    // as-is. A rewrite that diverged the pair (Gemfile repointed, lock not
    // converged, or vice versa) fails here instead of being silently
    // re-resolved away.
    let reinstall_env = [
        ("BUNDLE_PATH", bundle_path.as_str()),
        ("BUNDLE_APP_CONFIG", bundle_path.as_str()),
        ("BUNDLE_FROZEN", "true"),
        ("USE_FREEDESKTOP_PLACEHOLDER", "true"),
    ];
    let reinstall = tool(&proj, "bundle", &["install"], &reinstall_env);
    assert!(
        ok(&reinstall),
        "{LEG}: frozen `bundle install` from the redirected Gemfile failed — \
         the redirect assertions above all passed, so the rewrite itself is \
         fine and the regression is in the hosted install path (CLI rewrite \
         shape or the gem patch-registry).\n{}",
        dump(&reinstall)
    );

    // Exit 0 proves only that bundler fetched an artifact matching the
    // CHECKSUMS pin. Close the loop on CONTENT: fetch the patch's file
    // manifest from the proxy and assert every file it rewrites landed
    // on disk byte-exact (afterHash is the git-blob sha256 the patch
    // service publishes — the same digest the CLI's apply verifies).
    let patch_files = published_patch_files(&wired_uuid)
        .await
        .unwrap_or_else(|e| {
            panic!(
                "{LEG}: `bundle install` from the redirected Gemfile succeeded \
                 but the patch file manifest could not be fetched to verify \
                 the installed content: {e}"
            )
        });
    let gem_dir = installed_gem_dir(
        Path::new(&bundle_path),
        &format!("{GEM_NAME}-{GEM_VERSION}"),
        4,
    )
    .unwrap_or_else(|| {
        panic!(
            "{LEG}: `bundle install` succeeded but no \
             gems/{GEM_NAME}-{GEM_VERSION} directory exists under \
             {bundle_path}"
        )
    });
    use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes;
    let mut verified = 0usize;
    let mut rewritten = 0usize;
    for (path, before, after) in &patch_files {
        // No afterHash = the patch deletes the file; nothing to hash.
        let Some(after) = after else { continue };
        let rel = path.strip_prefix("package/").unwrap_or(path.as_str());
        let installed = gem_dir.join(rel);
        let bytes = std::fs::read(&installed).unwrap_or_else(|e| {
            panic!(
                "{LEG}: patch {wired_uuid} rewrites `{path}` but the \
                 installed gem has no readable {}: {e}",
                installed.display()
            )
        });
        assert_eq!(
            compute_git_sha256_from_bytes(&bytes),
            *after,
            "{LEG}: installed {} does not hash to the patch's afterHash — \
             bundler fetched an artifact whose content is NOT the \
             published patch",
            installed.display()
        );
        verified += 1;
        if before.as_deref() != Some(after.as_str()) {
            rewritten += 1;
        }
    }
    assert!(
        verified >= 1,
        "{LEG}: patch {wired_uuid} names no files with an afterHash, so \
         nothing was content-verified — the install success is vacuous"
    );
    assert!(
        rewritten >= 1,
        "{LEG}: every file in patch {wired_uuid} has afterHash == \
         beforeHash — the published patch is inert and this install \
         proved nothing"
    );
    println!(
        "{LEG}: verified {verified} patched file(s) on disk against the \
         published afterHash ({rewritten} differ from upstream)"
    );

    // Manifest-less VEX (hosted never writes a manifest) over the frozen
    // reinstall, against the real public patch proxy.
    gem_manifestless_vex(
        LEG,
        &proj,
        &wired_uuid,
        "redirected",
        (&pristine_gemfile, pristine_lock.as_bytes()),
        &[
            ("BUNDLE_PATH", bundle_path.as_str()),
            ("BUNDLE_APP_CONFIG", bundle_path.as_str()),
        ],
    );
}

/// Manifest-less VEX over a gem production leg's installed checkout `dir`
/// (the real public patch proxy supplies records; `envs` point the crawler
/// at the leg's BUNDLE_PATH so the installed tree is hash-verified):
/// attested from the lockfile wiring alone (v5 hosted keeps no ledger) →
/// `record_unavailable` offline → nothing names the patch once the Gemfile
/// and lock are reverted to `pristine`, with and without `--no-verify`. Production's
/// vulnerability set is not pinned here: every statement for the purl must
/// be `not_affected` via `uuid` with `marker`.
fn gem_manifestless_vex(
    leg: &str,
    dir: &Path,
    uuid: &str,
    marker: &str,
    pristine: (&[u8], &[u8]),
    envs: &[(&str, &str)],
) {
    use vex_e2e_common::{assert_not_attested, run_vex, statements_for, strip_manifest, VexRun};
    let purl = format!("pkg:gem/{GEM_NAME}@{GEM_VERSION}");
    let mut base = VexRun {
        product: Some("pkg:gem/app@1.0.0".into()),
        ..VexRun::default()
    };
    for (k, v) in envs {
        base = base.env(*k, *v);
    }
    let attested = |run: &VexRun, cell: &str| {
        let out = run_vex(&vex_e2e_common::binary(), dir, run);
        assert_eq!(out.code, Some(0), "{leg} manifest-less vex ({cell}): {out}");
        let statements = statements_for(out.doc(), &purl);
        assert!(
            !statements.is_empty(),
            "{leg} ({cell}): {purl} not attested: {out}"
        );
        let part = format!("Patched via Socket patch {uuid} ({marker})");
        for st in statements {
            assert_eq!(st["status"], "not_affected", "{leg} ({cell}): {st:#}");
            let impact = st["impact_statement"].as_str().unwrap_or_default();
            // The expected clause embeds the patch uuid: name it, never print
            // it (CodeQL rust/cleartext-logging).
            assert!(
                impact.split("; ").any(|p| p == part),
                "{leg} ({cell}): impact {impact:?} lacks the wired patch's ({marker}) clause"
            );
        }
    };
    strip_manifest(dir);
    assert!(
        !dir.join(".socket/vendor/redirect-state.json").exists(),
        "{leg}: v5 hosted mode writes no ledger"
    );
    attested(&base, "lockfile wiring + public proxy");
    let mut offline = base.clone();
    offline.offline = true;
    let out = run_vex(&vex_e2e_common::binary(), dir, &offline);
    assert_eq!(out.code, Some(1), "{leg} offline: {out}");
    assert_not_attested(&out.envelope, &purl, "record_unavailable");
    std::fs::write(dir.join("Gemfile"), pristine.0).unwrap();
    std::fs::write(dir.join("Gemfile.lock"), pristine.1).unwrap();
    for no_verify in [false, true] {
        let mut run = base.clone();
        run.no_verify = no_verify;
        let out = run_vex(&vex_e2e_common::binary(), dir, &run);
        assert_eq!(
            out.code,
            Some(2),
            "{leg} reverted no_verify={no_verify}: nothing names the patch: {out}"
        );
        assert_eq!(
            out.envelope["error"]["code"], "manifest_not_found",
            "{leg}: {out}"
        );
        assert!(
            statements_for_opt(out.doc.as_ref(), &purl) == 0,
            "{leg} reverted: {out}"
        );
    }
}

/// How many statements `doc` (if any) carries for `purl`.
fn statements_for_opt(doc: Option<&serde_json::Value>, purl: &str) -> usize {
    doc.map_or(0, |d| vex_e2e_common::statements_for(d, purl).len())
}

// ===========================================================================
// Documented negative cases
// ===========================================================================

/// Go hosted mode: supported for free-tier references that carry a `goproxy`
/// override (`docs/ecosystems.md#go-directory-replaces-and-gosum`); refused with
/// `redirect_golang_unsupported` otherwise (`golang-hosted-no-go.md`, the
/// paid-tier analysis).
///
/// Production publishes no golang hosted modules today, so this guards BOTH
/// worlds without edits: while prod ships no `goproxy` overrides, nothing may
/// be redirected (an empty-project scan must not invent a redirect); the day
/// prod starts shipping them, any redirect this scan performs must be the
/// documented shape — a socket-namespace replace in go.mod plus go.sum lines.
#[test]
#[ignore = "live production API. Run with --ignored."]
fn golang_hosted_redirects_only_via_goproxy_override() {
    const LEG: &str = "golang_hosted_redirects_only_via_goproxy_override";
    if !has_command("go") {
        soft_skip!(LEG, "`go` not on PATH");
    }
    let tmp = tempfile::tempdir().expect("tempdir");
    let proj = tmp.path().join("proj");
    std::fs::create_dir_all(&proj).expect("mkdir proj");
    std::fs::write(
        proj.join("go.mod"),
        "module example.com/hosted-e2e\n\ngo 1.21\n",
    )
    .expect("write go.mod");

    let env_json = scan_hosted(&proj, &["--ecosystems", "golang"]);
    let redirected = hosted_pin_count(&env_json);
    if redirected == 0 {
        println!(
            "{LEG}: production publishes no golang hosted modules (or none \
             matched an empty project); nothing redirected, as documented."
        );
    } else {
        // The moment prod ships goproxy overrides, every golang redirect must
        // be the committable fork-replace shape.
        let go_mod = std::fs::read_to_string(proj.join("go.mod")).expect("read go.mod");
        assert!(
            go_mod.contains("patch.socket.dev/gopatch/"),
            "{LEG}: {redirected} golang redirect(s) reported but go.mod has no \
             socket-namespace replace:\n{go_mod}\n{env_json:#}"
        );
        assert!(
            proj.join("go.sum").is_file(),
            "{LEG}: golang redirect without a go.sum pin bricks -mod=readonly \
             builds:\n{env_json:#}"
        );
        println!("{LEG}: production now serves golang hosted modules; shape verified.");
    }
}

/// Deno hosted mode is not supported. Same shape as the golang guard.
#[test]
#[ignore = "live production API. Run with --ignored."]
fn deno_hosted_is_unsupported() {
    const LEG: &str = "deno_hosted_is_unsupported";
    let tmp = tempfile::tempdir().expect("tempdir");
    let proj = tmp.path().join("proj");
    std::fs::create_dir_all(&proj).expect("mkdir proj");
    std::fs::write(
        proj.join("deno.json"),
        r#"{"imports":{"minimist":"npm:minimist@1.2.2"}}"#,
    )
    .expect("write deno.json");

    let env_json = scan_hosted(&proj, &["--ecosystems", "deno"]);
    assert_eq!(
        hosted_pin_count(&env_json),
        0,
        "{LEG}: deno hosted mode redirected something, but hosted mode is \
         documented as unsupported for deno:\n{env_json:#}"
    );

    // Manifest-less VEX: nothing was wired for deno, so without a manifest
    // there is nothing to attest (exit 2, `manifest_not_found`) — offline,
    // no document written.
    let _ = std::fs::remove_file(proj.join(".socket/manifest.json"));
    let out = vex_e2e_common::run_vex(
        &binary(),
        &proj,
        &vex_e2e_common::VexRun {
            product: Some("pkg:npm/deno-app@1.0.0".to_string()),
            ..vex_e2e_common::VexRun::offline()
        },
    );
    assert_eq!(out.code, Some(2), "{LEG}: manifest-less vex: {out}");
    assert_eq!(
        out.envelope["error"]["code"], "manifest_not_found",
        "{LEG}: {out}"
    );
    assert!(out.doc.is_none(), "{LEG}: no document: {out}");
}

// ===========================================================================
// Canary — ecosystems whose hosted support has nothing to test against
// ===========================================================================

/// cargo, maven, nuget and composer all implement hosted mode, but production
/// publishes no free-tier patches for them, so there is no honest end-to-end
/// leg to write. (cargo used to have one — the pinned sparse-registry install
/// proof retired 2026-09-01 when production's free cargo tier emptied.) This
/// probes production every run and reports the moment that changes, so
/// coverage can be extended deliberately rather than by accident.
///
/// It deliberately does NOT fail when patches appear: production publishing a
/// new patch is not a socket-patch regression, and a required check must not
/// go red for it. `SOCKET_PATCH_HOSTED_E2E_CANARY_STRICT=1` makes it fail, for
/// use in a scheduled run where a nag is the point.
#[tokio::test(flavor = "multi_thread")]
#[ignore = "live production API. Run with --ignored."]
async fn canary_unpublished_ecosystems() {
    let mut newly_published: Vec<String> = Vec::new();
    let mut probe_errors: Vec<String> = Vec::new();

    for (eco, candidates) in UNPUBLISHED_ECOSYSTEMS {
        for purl in *candidates {
            match published_uuids(purl).await {
                Ok(uuids) if !uuids.is_empty() => {
                    newly_published.push(format!("{eco}: {purl} -> {uuids:?}"));
                }
                Ok(_) => {}
                Err(e) => probe_errors.push(format!("{eco}: {purl}: {e}")),
            }
        }
    }

    assert!(
        probe_errors.is_empty(),
        "production probe failed (the endpoint itself may be down, which IS a \
         real signal for this suite):\n  - {}",
        probe_errors.join("\n  - ")
    );

    if newly_published.is_empty() {
        println!(
            "canary_unpublished_ecosystems: cargo / maven / nuget / composer \
             still have no free-tier published patches — their hosted-mode legs \
             remain untestable end-to-end against production."
        );
        return;
    }

    let msg = format!(
        "production now publishes free patches for previously-empty \
         ecosystems:\n  - {}\nExtend this suite with real install proofs for \
         them (see docs/testing/hosted-production-e2e.md).",
        newly_published.join("\n  - ")
    );
    if std::env::var("SOCKET_PATCH_HOSTED_E2E_CANARY_STRICT").as_deref() == Ok("1") {
        panic!("{msg}");
    }
    println!("NOTE canary_unpublished_ecosystems: {msg}");
}

// ---------------------------------------------------------------------------
// vlt (suite `production`, DESIGN §8.3)
// ---------------------------------------------------------------------------

/// `SOCKET_PATCH_VLT_HOSTED_PRODUCTION_REQUIRED=1`: the serve fix is
/// deployed, so a content-encoded artifact is a failure, not a pinned
/// refusal.
fn vlt_hosted_production_required() -> bool {
    std::env::var("SOCKET_PATCH_VLT_HOSTED_PRODUCTION_REQUIRED").is_ok_and(|v| v == "1")
}

/// The vlt install proof against production. The artifact is fetched the
/// way vlt fetches it (`fetch_artifact_probe`): while patch.socket.dev
/// re-encodes it, the scan must refuse cleanly
/// (`redirect_vlt_artifact_unverifiable`, nothing written); once it serves
/// identity bytes, the lock pins it and a fresh checkout's `vlt ci`
/// installs the patched minimist. So the test neither breaks nor goes
/// vacuous when the serve fix deploys.
#[tokio::test(flavor = "multi_thread")]
#[ignore = "live production API + real npm registry + real vlt. Run with --ignored."]
async fn vlt_pinned_matrix_production_hosted_install_proof() {
    use vlt_e2e_common::*;
    if strict() && std::env::var_os("SOCKET_PATCH_VLT_E2E_JS").is_none() {
        panic!("STRICT: vlt_pinned_matrix_production_hosted_install_proof needs SOCKET_PATCH_VLT_E2E_JS");
    }
    let Some(leg) = Leg::start("production", "hosted_install_proof") else {
        return;
    };
    let npmjs = "https://registry.npmjs.org/";
    let proj = leg.dir("proj");
    write(
        &proj.join("package.json"),
        package_json("vlt-prod", &[(NPM_NAME, NPM_VERSION)]),
    );
    write_vlt_json(&proj, leg.version(), npmjs, &VltJson::default());
    leg.vlt_ok(&proj, &["install"]);
    assert_pristine(
        &minimist_entry(&proj),
        PATCH_MARKER,
        "vlt hosted production",
    );
    let lock_before = lock_bytes(&proj);
    std::fs::remove_dir_all(proj.join("node_modules")).unwrap();
    let cwd = proj.to_str().unwrap().to_string();
    let out = socket(
        &proj,
        &["scan", "--mode", "hosted", "--json", "--yes", "--cwd", &cwd],
        &[],
    );
    let doc = out.json();
    let lock = read_lock(&proj);
    let id = node_id(&lock, NPM_NAME, NPM_VERSION);
    let pinned_url = lock["nodes"][&id][3].as_str().map(str::to_string);
    // A refusal quotes the artifact URL with its grant token redacted, so
    // the URL to probe comes from the public reference endpoint scan used.
    let url = match pinned_url.filter(|u| u.contains(PATCH_HOST)) {
        Some(u) => u,
        None => public_reference_url(NPM_UUID).await,
    };
    assert!(url.contains(NPM_UUID), "{url}");
    let client = reqwest::Client::builder().build().unwrap();
    let probe =
        socket_patch_core::patch::redirect::vlt_preflight::fetch_artifact_probe(&client, &url)
            .await;
    let encoded = probe
        .content_encoding
        .as_deref()
        .is_some_and(|e| !e.trim().is_empty() && !e.trim().eq_ignore_ascii_case("identity"));
    if encoded {
        assert!(
            !vlt_hosted_production_required(),
            "patch.socket.dev still serves {url} content-encoded ({:?}) but \
             SOCKET_PATCH_VLT_HOSTED_PRODUCTION_REQUIRED=1",
            probe.content_encoding
        );
        let detail = warning_detail(&doc, "redirect_vlt_artifact_unverifiable");
        assert!(
            detail.contains("content-encoding") && detail.contains("nothing was written"),
            "{detail}"
        );
        assert_eq!(lock_bytes(&proj), lock_before, "the refusal writes nothing");
        assert!(!proj.join(".socket/vendor/redirect-state.json").exists());
        eprintln!("vlt hosted production: artifact content-encoded; clean refusal pinned");
    } else {
        assert_eq!(out.code, 0, "{out}");
        assert_eq!(
            lock["nodes"][&id][2].as_str(),
            probe.sha512.as_deref(),
            "{lock:#}"
        );
        let co = fresh_checkout(&proj, &leg.root.join("fresh"));
        leg.vlt_ok_with(&co, &leg.locked_install_args(), &VltRun::profile("fresh"));
        assert_patched(&minimist_entry(&co), PATCH_MARKER, "vlt hosted production");
    }
    leg.ran();
}

/// The hosted artifact URL the public proxy grants for `uuid` — the
/// reference `scan --mode hosted` resolves on a token-less run.
async fn public_reference_url(uuid: &str) -> String {
    use socket_patch_core::api::client::{ApiClient, ApiClientOptions};
    let client = ApiClient::new(ApiClientOptions {
        api_url: PROXY.to_string(),
        api_token: None,
        route: socket_patch_core::api::client::ApiRoute::Proxy,
    });
    let references = client
        .fetch_registry_references(&[uuid.to_string()])
        .await
        .expect("the public proxy answers the reference request");
    references
        .get(uuid)
        .and_then(|r| r.url.clone())
        .expect("the public proxy grants the free patch's artifact URL")
}