Fix open npm issues

[Mikola Lysenko (mikolalysenko)]

Fixes every open pm:npm issue except #933, which #934 already fixed on main. Each fix was written in its own worktree with a regression test, reviewed by a second agent, then cherry-picked here. The three refactors were done after the bug fixes, and the branch is merged with current main.

Bug fixes

Issue	Fix
#898	When a vendored commit is refused (for example, a symlinked lock), the run deletes the artifact dirs it just added and marks the package failed. It no longer prints "Vendored N packages" or "Next steps". A non-pending vendor_commit_failed gets the same treatment.
#1005	When an eject is rolled back, the summary and next steps are not printed. eject_rolled_back goes to stderr, and the rolled-back packages are re-tagged skipped, with JSON summary counts kept in step.
#1004	Agent-mode scan --json and get --json now include content_mismatch_overwritten in warnings[]. The nested apply passes it up through a new ApplyRunReport.warnings.
#969	Reads npm's effective allow-file setting from env, project, user, global and builtin config, and applies npm's rule for which packages count as root. When npm would refuse the vendored file: wiring, scan warns vendor_npm_allow_file and vendor --check fails.
#954	A vendored re-scan keeps the older vendored patch, with a vendor_prebuilt_pending or vendor_prebuilt_unavailable warning, while the superseding patch is pending_build, build_failed or not_found. It no longer exits 1.
#899	On a project with only npm-shrinkwrap.json, scans warn redirect_npm_shrinkwrap_only (hosted) or vendor_npm_shrinkwrap_only (vendored). VEX does not attest from that file alone (vex_npm_shrinkwrap_only).
#879	A legacy dependencies mirror entry with no resolved but the patched integrity no longer counts against the wired packages entry. vex and vendor --check pass again after npm 7–10 re-saves the lock.
#828	A hosted pin next to a bundled copy, or next to an unpatched copy of the same package in the same lock, is kept in a new Discovery::shadowed list. VEX still doesn't attest it, but rollback, remove, list and the vendored takeover can now find and undo it.
#812	Reads replace-registry-host. Hosted scan and get warn when npm would rewrite the hosted pin to the registry and fail with E404.
#753	Lock entries under a hasShrinkwrap dependency are not rewritten. Hosted warns redirect_npm_shrinkwrapped_instance_skipped, vendor --check fails on such a copy, and VEX does not attest it.
#711	Packages that npm 12's own patchedDependencies (npm patch) already patches stay on the registry, with a warning. When such a package is already pinned, the message names the rollback.
#688	A local file: dir or workspace member with the same name@version no longer makes vendored refuse the registry copies. It is skipped with a vendor_workspace_member_skipped warning.
#554	Agent-mode and report-only scans judge each nested npm project against socket.yml include/ignore paths and the built-in test defaults.
#433	Both remove --preserve-state paths now print the hosted_state_not_preservable note and add the code to JSON warnings[].

Performance (#993)

The regression is real. Measured as instructions retired on the bench's 3000-package npm fixture:

	Instructions retired
Base (2463257a)	2.647G
Regressed head	2.755G (+4.1%)
This branch	2.353G (−11% vs base)

JSON output is byte-identical across all three. The hosted path no longer runs extra lockfile discoveries when the vendor ledger has no entries, and it parses each npm lock once.

Refactors

• Walk package-lock entries once for inventory, vendored, hosted and restore #663: one shared walk, npm_lock_entries, now serves inventory, vendored, hosted and restore.
• Build npm-family vendor ledger entries through one constructor instead of seven literal VendorEntry blocks #922: every npm-family ledger entry is built through the VendorEntry::npm and VendorArtifact::{tarball,dir} constructors.
• Tracking: drive the seven npm-family vendor backends through one generic driver #920 (steps 1–5): one NpmLockBackend trait and a generic vendor_npm_family driver.
  • Step 6, the revert half, is left for a follow-up.
  • vlt stays separate; the code records why.
• Resolve VEX npm alias copies through the core resolver and delete vex_consumed's second alias walk #856: VEX resolves npm alias copies through the core resolver. The second alias walk in vex_consumed is deleted.

Known residuals

• Vendored ecosystems outside the npm family still fail hard when a superseding patch is unbuilt (the Vendored npm re-scan exits 1 ("Failed to vendor", "1 failed") on every run while a superseding patch's artifact is pending_build / build_failed / not_found, although the vendored older patch is intact; hosted skips the same upgrade with exit 0 #954 pattern).
• Lockfile-only vex does not yet consider allow-file (Vendored npm scan wires file: tarballs that npm ≥ 11.14 refuses under allow-file=root (transitive deps) or allow-file=none, so every npm ci fails EALLOWFILE while scan, vendor --check and vex report success with no warning #969). The issue asked only for the scan warning, the vendor --check failure and the doc fix.
• mode_migration_npm::berry_vendored_then_hosted_takeover_leaves_pure_hosted fails on main too. It is not caused by this branch.

Testing

Ran locally:

• cargo test --locked --workspace: 11451 passed. 3 failed, none caused by this branch:
  • the berry test above;
  • two x86-only cargo old-toolchain tests that can't run on the arm Mac.
• cargo clippy --workspace --all-features -D warnings: clean.

Fixes #1005
Fixes #1004
Fixes #993
Fixes #969
Fixes #954
Fixes #922
Fixes #899
Fixes #898
Fixes #879
Fixes #856
Fixes #828
Fixes #812
Fixes #753
Fixes #711
Fixes #688
Fixes #663
Fixes #554
Fixes #433
Part of #920

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes lockfile discovery, vendoring commits, and attestation rules across npm installs; behavior is mostly fail-closed with new warnings, but mistakes could affect rollback/VEX correctness on contested or shrinkwrap-only projects.

Overview
This PR tightens npm-family behavior across hosted redirect, vendored wiring, VEX, rollback/remove, and agent scans, and documents the contracts in CLI_CONTRACT.md.

Hosted / lockfile edge cases: Skips or warns when npm's own patchedDependencies (#711), nested hasShrinkwrap installs (#753), shrinkwrap-only locks (#899), or replace-registry-host would break hosted pins (#812). Contested pins beside bundled/unreachable copies are tracked so lifecycle commands can still unwind them even when VEX won't attest (#828).

Vendored mode: Honors npm allow-file with vendor_npm_allow_file / --check failures (#969); keeps the old vendored patch when a superseding prebuild isn't ready (#954); skips workspace file: members with a warning (#688); on failed group commits, tears down artifact dirs and reports packages as failed instead of success text (#898).

Agent / policy: Nested lockfile roots respect socket.yml path policy (#554) with policy_shared_copy; agent get/scan --json now surfaces apply content_mismatch_overwritten in warnings[] (#1004). Eject rollback messaging and per-package skipped tagging are aligned (#1005, #433).

Internals: Shared npm_lock_entries parsing and npm-family vendor refactors (#663, #920, #922); hosted scan perf work (#993); VEX npm alias resolution consolidated (#856).

^{Reviewed by Cursor Bugbot for commit 800fa07. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Closing (burn-down agent): this draft has no changes. Its only commit is an empty placeholder ("Start npm open-issue sweep"), the diff against main is 0 files, and nothing has been pushed in about 2.5 hours with no agent heartbeat. The linked issues stay open and untouched. The branch is kept: reopen this PR, or open a new one, once fixes are pushed.

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

Merged main (03b9418) to clear conflicts; head is now 800fa07. Main's #1058 moved takeover classification onto a caller-passed discovery; this PR's #993 short-circuit (no lockfile discovery when the vendored ledger is empty) is re-applied on top in both classify_overlap_takeover and scan/hosted.rs, and takeover_classifier_discovers_at_most_once was adapted to the new signature. Discovery keeps both this PR's shadowed and main's vlt_bundled_copies; hosted_inventory keeps both sides' new tests. Local: workspace check clean; core lib 5865 pass, cli 6153 pass, hosted_inventory 12/12; remaining failures are sandbox-only (root ignores read-only perms; one pypi.org network test).

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 800fa07. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[burn-down agent] Labeled Ready for review at 800fa07b4e.

• CI: all 465 check runs on the head are success/skipped (ci-ok green).
• Bugbot: Cursor Bugbot passed on 800fa07 (re-requested after the main merge 03b9418); no unresolved review threads.
• Mergeable, no CHANGELOG.md change. The reviewer should check the takeover-classification port onto Decide whether a hosted patch is pinned through lockfile discovery alone #1058's callee in that merge.

---

Generated by Claude Code