[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #783

Summary

When a yarn berry project has a parent-scoped resolutions entry for a package (for example "pkg-a/left-pad": "1.3.0"), vendored mode used to add its own bare pin next to it and report success. The lock it left behind failed every yarn install --immutable with YN0028, and a plain yarn install quietly dropped the patch. Vendored mode now refuses with vendor_override_conflict and writes nothing, which is what hosted mode already did for these selectors.

Root cause

resolutions_gate (vendor/yarn_berry_lock.rs) got each selector's package name from split_pattern, which only understands a bare name@range descriptor. For pkg-a/left-pad, pkg-a/left-pad@^1.3.0, <root>/left-pad, @scope/parent/left-pad and **/left-pad it returned the whole string, which never equals left-pad, so the gate skipped the selector. The gate now uses resolution_selector_target, the same helper that hosted mode and the vendored revert and prune paths already use. The bare exact-version takeover ("left-pad": "1.3.0") works as before.

Review follow-up: the gate also treated any selector whose value pointed into .socket/vendor as our own entry. Vendoring only ever writes the bare key, so a parent-scoped selector with a vendor path now refuses too. The refusal message now says that only a bare exact-version pin is taken over.

Tests (red → green)

Issue	Test	Without fix	With fix
#783	unit vendor::yarn_berry_lock::tests::parent_scoped_resolutions_selector_is_refused (5 selector shapes refuse and write nothing; a parent-scoped vendor-path selector refuses; left-pad/is-odd still vendors)	FAIL: expected Refused vendor_override_conflict, got Done (success=true)	pass
#783	e2e e2e_vendor_yarn_berry_build::issue_783_parent_scoped_resolution_refuses_vendoring (real yarn 4.18.0, pkg-a/left-pad and pkg-a/left-pad@^1.3.0: vendor exits 1, package.json and yarn.lock are byte-identical, and yarn install --immutable still passes)	FAIL: pkg-a/left-pad: vendor must refuse	pass

Commands run locally:

• cargo fmt --all -- --check passed. cargo clippy --workspace --all-features -- -D warnings passed.
• cargo test -p socket-patch-core --all-features --lib: 6721 passed, 4 failed. The 4 failures (copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched, pypi_requirements::wire_failure_rolls_back_already_written_files) are only in this sandbox. They inject write failures with chmod 0o555, and the sandbox runs as root, which ignores that. None of them touch yarn.
• cargo test -p socket-patch-cli --all-features --lib: 933 passed.
• With SOCKET_PATCH_YARN_BERRY_VERSION=4.18.0 and SOCKET_PATCH_YARN_E2E_REQUIRED=1: e2e_vendor_yarn_berry_build 45 passed, e2e_redirect_yarn_berry_build 37 passed.
• I couldn't run cargo test --workspace all the way here: linking every integration-test binary used up the sandbox's disk allowance. CI runs the full suite.

The npm, pypi and gem wrappers only dispatch to the binary, so none of them needed a change.

Review notes (/code-review high)

Fixed:

• A parent-scoped vendor-path selector was treated as ours.
• The return inside the e2e selector loop is now continue.
• The refusal hint was misleading.

Not fixed:

• Version-qualified parent selector (left-pad@npm:1.3.0/is-odd): this overrides a different package beneath the vendored one. Once vendoring rewires left-pad to a file: locator, yarn may stop applying it. That behaviour predates this PR and is a different selector shape from Vendored yarn berry misses a parent-scoped user resolutions entry (pkg-a/left-pad), reports success, and every yarn install --immutable fails YN0028 #783, so it is left for a follow-up.
• Whitespace-padded keys (" left-pad"): yarn never applies these. Refusing one is harmless and very unlikely to happen in practice.
• One shared "selector overrides name" helper for the hosted, vendor and revert gates: a refactor outside this fix.

https://claude.ai/code/session_0159LsG26iAJ1u2wK477EeVu

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c5524a1. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent).

• Head: c5524a1
• CI: 87/87 checks passed or skipped (37 success, 50 skipped); no main-wide failures.
• Bugbot: reviewed c5524a1, no new issues; no unresolved review threads.
• Reviewer focus: resolutions_gate in crates/socket-patch-core/src/vendor/yarn_berry_lock.rs now uses resolution_selector_target, so parent-scoped selectors refuse with vendor_override_conflict. The follow-ups that were deliberately not fixed are listed in the description.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Labeled Ready for review (burn-down agent).

• Head: c5524a1719856dc6ef01f55572d7364f31ccbacc. It merges into main with no conflicts and doesn't change CHANGELOG.md.
• CI: 37/37 non-skipped checks green (50 skipped). No main-wide failures.
• Bugbot: reviewed c5524a1, no findings.
• For reviewers: the refusal now also covers parent-scoped selectors whose value points into .socket/vendor. The PR description lists the follow-ups that were deliberately left out (version-qualified parent selectors, a shared selector helper).

---

Generated by Claude Code