From b5fad7279b2a96a274aba0051c9ffbb763308689 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 28 Oct 2026 07:13:43 +0000 Subject: [PATCH] Fix nightly bun.lockb e2e for hosted-pin eject #1648 made plain `vendor` with a hosted pin in scope eject the lockfile's hosted patch: it fetches the patch record from the API and refuses an --offline run up front with `offline_eject_unavailable`. It updated the PR-tier tests (vendor_eject_bun_lockb.rs) but not e2e_bun_lockb.rs, whose tests are #[ignore] and run only in the nightly e2e-extended legs, so the 1.0.36, 1.1.45 and 1.4.2 e2e_bun_lockb legs have failed on main since it landed. Assert the new contract: the offline vendor is refused with `offline_eject_unavailable`; the online vendor is pointed at the mock API (--api-url/--org/--api-token) so the eject can fetch the record, and it reports no per-purl takeover advisory. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_011f9aeSVRFUn2uamhKgw5V5 --- .../socket-patch-cli/tests/e2e_bun_lockb.rs | 69 +++++++++++-------- 1 file changed, 40 insertions(+), 29 deletions(-) diff --git a/crates/socket-patch-cli/tests/e2e_bun_lockb.rs b/crates/socket-patch-cli/tests/e2e_bun_lockb.rs index 5473397ac..955c61200 100644 --- a/crates/socket-patch-cli/tests/e2e_bun_lockb.rs +++ b/crates/socket-patch-cli/tests/e2e_bun_lockb.rs @@ -899,14 +899,15 @@ async fn native_binary_hosted_vendored_takeover_roundtrip() { ); std::fs::rename(&modules, project.join("node_modules")).unwrap(); - // Hosted -> vendored: v5 restores a hosted pin's upstream entry before - // vendoring over it, re-resolving the registry record from the npm - // registry — which an OFFLINE takeover cannot do, so it is REFUSED (dry - // and wet alike, nothing written) with the checkout remedy. Online, the - // takeover rebuilds the binary registry record exactly and vendors over - // it; `vendor --revert` then gives back the original bytes. After that - // (equivalently, after `git checkout -- bun.lockb`) the offline vendor - // proceeds, with a truthful dry run and exact rerun state. + // Hosted -> vendored: plain `vendor` ejects the hosted pin, fetching its + // patch record from the API and re-resolving the registry record from + // the npm registry — which an OFFLINE run cannot do, so it is REFUSED up + // front (`offline_eject_unavailable`, dry and wet alike, nothing + // written). Online, the eject rebuilds the binary registry record + // exactly and vendors over it; `vendor --revert` then gives back the + // original bytes. After that (equivalently, after `git checkout -- + // bun.lockb`) the offline vendor proceeds, with a truthful dry run and + // exact rerun state. fixture.stage(); let uri = server.uri(); let before = snapshot(project); @@ -918,20 +919,14 @@ async fn native_binary_hosted_vendored_takeover_roundtrip() { code, 1, "vendor {extra:?} over a binary hosted pin: {refused}" ); - let failed = refused["events"] - .as_array() - .and_then(|events| { - events - .iter() - .find(|e| e["errorCode"] == "redirect_revert_failed") - }) - .unwrap_or_else(|| panic!("expected redirect_revert_failed: {refused}")); - assert_eq!(failed["purl"], PURL, "{refused}"); + assert_eq!( + refused["error"]["code"], "offline_eject_unavailable", + "{refused}" + ); assert!( - failed["error"].as_str().is_some_and(|e| { - e.contains("cannot vendor over the live hosted pin") - && e.contains("git checkout -- bun.lockb") - }), + refused["error"]["message"] + .as_str() + .is_some_and(|e| e.contains("re-run without --offline")), "{refused}" ); assert_eq!( @@ -966,6 +961,12 @@ async fn native_binary_hosted_vendored_takeover_roundtrip() { "vendor", "--patch-server-url", &uri, + "--api-url", + &uri, + "--api-token", + "fake", + "--org", + ORG, "--vendor-source", "service", ], @@ -975,11 +976,13 @@ async fn native_binary_hosted_vendored_takeover_roundtrip() { taken_over["summary"]["applied"], 1, "online vendor over the binary hosted pin: {taken_over}" ); + // An eject, not the retired per-purl takeover: no takeover advisory. assert!( - taken_over["events"].as_array().is_some_and(|events| events - .iter() - .any(|e| e["errorCode"] == "vendor_takeover_reverted_redirect")), - "the takeover is reported: {taken_over}" + !taken_over + .to_string() + .contains("vendor_takeover_reverted_redirect") + && !taken_over.to_string().contains("redirect_revert_failed"), + "{taken_over}" ); let vendor_lock = fixture.lock(); assert!( @@ -1178,6 +1181,12 @@ async fn binary_shared_bundled_record_hosted_pin_is_managed() { "vendor", "--patch-server-url", &uri, + "--api-url", + &uri, + "--api-token", + "fake", + "--org", + ORG, "--vendor-source", "service", ], @@ -1187,11 +1196,13 @@ async fn binary_shared_bundled_record_hosted_pin_is_managed() { taken_over["summary"]["applied"], 1, "online vendor over the shared hosted pin: {taken_over}" ); + // An eject, not the retired per-purl takeover: no takeover advisory. assert!( - taken_over["events"].as_array().is_some_and(|events| events - .iter() - .any(|e| e["errorCode"] == "vendor_takeover_reverted_redirect")), - "the takeover is reported: {taken_over}" + !taken_over + .to_string() + .contains("vendor_takeover_reverted_redirect") + && !taken_over.to_string().contains("redirect_revert_failed"), + "{taken_over}" ); assert!( !taken_over