Commits on Aug 19, 2026

1. test(vendor): RED — npm-family mode-migration e2e twins of the cargo … …

   …C1-C7 capstones
   
   mode_migration_npm.rs drives the real binary + corepack yarn (classic and
   berry) through hosted -> vendored -> revert, and vendored -> hosted,
   asserting the cross-mode takeover contract #196 shipped for cargo:
   
   - hosted -> vendored must pre-revert the hosted lock edits (so the vendor
     ledger records the PRISTINE registry originals), drop the purl's
     redirect-ledger record+edits, and surface vendor_takeover_reverted_redirect
   - vendor --revert afterwards must land back on REGISTRY state byte-identical
   - vendored -> hosted must revert the vendored wiring per purl first
     (redirect_takeover_reverted_vendored), not leave overlapping ledgers
   
   All three tests FAIL on main (takeover machinery is hard-gated to
   pkg:cargo/ at cli vendor.rs:993 and scan/hosted.rs:336):
   
       test berry_hosted_then_vendored_takeover_round_trips_to_registry ... FAILED
       test classic_hosted_then_vendored_takeover_round_trips_to_registry ... FAILED
       test classic_vendored_then_hosted_takeover_leaves_pure_hosted ... FAILED
       (takeover advisory missing from the vendor envelope /
        takeover warning missing: redirect_supersedes_vendored fired instead)
   
   Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

   

   mikolalysenko and claude committed Aug 19, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for 377799d
   • Browse repository at this point

   Copy the full SHA

   377799d View commit details

   Browse the repository at this point in the history

2. fix(vendor): pre-revert live hosted redirects when vendoring npm-fami… …

   …ly purls
   
   The cross-mode takeover that #196 built for cargo (C1-C7) was hard-gated
   to pkg:cargo/ in BOTH directions:
   
   - cli vendor.rs:993 — the vendor dispatch loop's pre-revert ("Cross-mode
     takeover (cargo)"), so vendoring an npm purl over a LIVE hosted
     redirect (a) recorded the grant-tokenized HOSTED lock fragment as the
     vendor ledger's unrecoverable pre-vendor original, (b) never dropped
     the superseded redirect records/edits — the vendor_supersedes_redirect
     warning's promised auto-reconcile provably never converged — and
     (c) made vendor --revert land back on the expiring hosted URL with no
     CLI path to registry state (adversarially confirmed P1, cells
     convy1-hosted2vendored + E5, yarn 1 and yarn 4).
   - scan/hosted.rs:336/346 — the reverse direction, so a hosted scan over
     live vendored npm wiring either hijacked the vendored resolution while
     the vendored ledger still claimed it (classic) or refused outright
     (berry file: protocol).
   
   Fix, porting the cargo pattern to the npm family:
   
   - core redirect/takeover.rs: revert_npm_redirect_purl replays each
     recorded FileEdit.original over its .new — text-fragment kinds
     (yarn classic / yarn berry / pnpm, keyed name@version) via staged
     replacen, package-lock JSON kinds (redirect_npm_lock_entry /
     redirect_npm_lock_dep, alias entries resolved through the lock's
     name field exactly as the rewriter matched them) via a staged JSON
     replay — with the same fail-closed contract as cargo: every inverse
     resolves against a staged view, drift refuses byte-identically, and
     only a fully clean replay drops the record+edits (caller persists).
     A bun.lock edit for the purl is a hard refusal (no bun replay yet).
     New: redirect_revert_supported + revert_redirect_purl dispatcher;
     CargoRedirectRevert kept as an alias of the renamed RedirectRevert.
   - cli vendor.rs: gate widened from pkg:cargo/ to
     redirect_revert_supported (cargo + npm); the corrupt-ledger refusal
     and dry-run vendor_would_revert_redirect warning now cover npm too;
     ecosystem-appropriate takeover advisory text.
   - cli scan/hosted.rs: reverse takeover gate widened to cargo + npm
     (dispatch_revert_one already handles npm); the no-ledger wired-check
     stays cargo-only; refused-override filtering now keys by
     (ecosystem, coordinate, version).
   
   Ledger transactionality per #192/#187 precedent is preserved: the
   redirect ledger is persisted before vendoring proceeds, and a persist
   failure fails that purl closed.
   
   Unit tests: real-rewriter round-trip fixtures for classic, berry, and a
   lockfileVersion-2 package-lock (both trees), drift refusal, bun
   refusal, gate coverage.
   
   Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

   

   mikolalysenko and claude committed Aug 19, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for b04ad42
   • Browse repository at this point

   Copy the full SHA

   b04ad42 View commit details

   Browse the repository at this point in the history

3. Fix: Check version when claiming npm lock edits in takeover revert …

   The revert_npm_redirect_purl function was claiming redirect_npm_lock_dep
   and redirect_npm_lock_entry edits by package name only, but the rewriter
   that recorded them matched both name AND version. This could cause
   reverting one version to incorrectly claim and replay edits for a
   different version of the same package (e.g., hoisted + nested versions).
   
   Changes:
   - Load disk_locks for both redirect_npm_lock_entry and redirect_npm_lock_dep
   - Add deps_contains_name_version helper to check dependencies tree recursively
   - Update redirect_npm_lock_dep claiming to verify version in dependencies tree
   - Update redirect_npm_lock_entry claiming to verify version in packages map
   
   This ensures version-scoped ownership matching the original rewriter logic.

   

   cursoragent committed Aug 19, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for 46b3bf7
   • Browse repository at this point

   Copy the full SHA

   46b3bf7 View commit details

   Browse the repository at this point in the history