Fix Bun 1.3+ bun.lockb read as pre-1.3 (#1492)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1492

Summary

A Bun 1.3+ project that keeps a binary bun.lockb (saveTextLockfile = false) and excludes a member with "!packages/b" can patch that member again in hosted and vendored mode. Since 5.0.1, socket-patch treated the excluded member as a workspace member. It refused with redirect_workspace_lockfile_elsewhere (hosted) or vendor_lockfile_missing (vendored) and named a root lock Bun never reads for that member.

Root cause

lock_dialect in crates/socket-patch-core/src/hosted/governing_root.rs (#1097, #1480) picks how a root's workspaces globs are read from the lock at that root. Every lone bun.lockb was read with the pre-1.3 Bun rules, which ignore !. Bun 1.3+ applies ! whichever lock format it writes. It marks a bun.lockb with a cNfGvRsN extension that carries configVersion, the binary twin of the text lock's top-level key, which the bun.lock branch already checks.

Fix

• vendor/bun_lockb.rs: read_config_version walks only the lock's structure (header, the six buffer descriptors, the extension tags), seeking past every array, and returns the tag wherever Bun writes it. With nested overrides, Bun writes sCoPdOvR after it.
• lock_dialect calls it through the FIFO-safe opener on the blocking pool. It never reads package records, so a lock the full codec rejects still gets its tag read, and a large monorepo lock costs a few small reads. A lock that is untagged, unreadable or not binary keeps the wider pre-1.3 reading, as before.
• Docs: the CLI_CONTRACT.md line for redirect_workspace_lockfile_elsewhere and the Hosted scan from a yarn classic workspace member still pins nothing and exits 0 when the root's workspaces use a ! pattern (yarn 1 ignores it) or an extglob like packages/@(a|b) #1097 CLI test comment.

Test evidence

• New hosted::governing_root::tests::bun_lockb_with_a_config_version_tag_honours_negated_workspaces uses real Bun 1.3.14, 1.4.2 workspace-root and 1.4.2 scoped-overrides locks (the last is the new bun-lockb/1.4.2-scoped-overrides fixture, written on Linux) (no refusal, member lock not a stray), plus 1.2.23 and a non-binary lock (still refused).
  • Red before the fix: assertion left == right failed: bun.lockb of 1646 bytes; left: Some("redirect_workspace_lockfile_elsewhere"), right: None.
  • Green after: cargo test -p socket-patch-core --all-features --lib -- governing_root bun_lockb → 67 passed.
• New vendor::bun_lockb::tests::config_version_is_read_from_tagged_locks_only checks every historical fixture 0.1.1 to 1.4.2, plus workspace "late-dependent" locks.
• cargo fmt --all -- --check: clean. cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --all-features --lib: 6453 passed and 4 failed. All 4 are permission-denial tests (copy_tree symlinked root, vlt_heal unremovable lock, poetry/requirements write failure) that cannot fail as intended when the sandbox runs as root. They are unrelated to this diff, and CI runs as non-root.
• I did not run the full cargo test --workspace locally: the sandbox ran out of disk building every CLI test binary. CI runs the full suite.

Per-issue checklist

• Bun 1.3+ bun.lockb root is read as pre-1.3, so a "!"-excluded member can't be patched in hosted or vendored mode (regression in 5.0.1) #1492: hosted (refusal) and vendored (same lock_dialect → member_stray_lock path), covered by bun_lockb_with_a_config_version_tag_honours_negated_workspaces.

Notes / not changed

• Bun 1.3.0 writes no cNfGvRsN tag (fixture bun-lockb/1.3.0), so its binary lock still reads as older Bun. Its text bun.lock without configVersion already does the same today. This fails closed: a refusal, never a wrong pin.
• /code-review high suggested a different approach: decide membership from the lock's own workspace list (workspace_paths()) instead of the Bun version. I didn't take it. The text-lock branch decides by configVersion too, and the lock's list is stale for a member added since the last install. Moving both branches would be a separate change to the Hosted scan from a yarn classic workspace member still pins nothing and exits 0 when the root's workspaces use a ! pattern (yarn 1 ignores it) or an extglob like packages/@(a|b) #1097 design. Every other finding (full-parse dependence, unknown-extension stop, unbounded read, 1.3.0 doc claim, stale CLI test comment, missing workspace-root fixture) is fixed in 7d05f17. A reviewer's finding on scoped overrides is fixed in 13f02d6 (fixture fitted to the VEX corpus in e509c25).

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes workspace membership and refusal logic for hosted/vendored npm flows when only bun.lockb is present; mis-detection could refuse or allow runs from the wrong directory, but untagged or invalid locks still fall back to pre-1.3 behavior.

Overview
Fixes #1492: lone binary bun.lockb locks were always interpreted with pre–Bun 1.3 workspace rules (negated ! patterns ignored), so excluded workspace members were wrongly refused with redirect_workspace_lockfile_elsewhere / stray-lock handling when only a tagged bun.lockb existed at the root.

read_config_version in bun_lockb.rs reads Bun’s cNfGvRsN extension (binary twin of text configVersion) via a structural walk, including when sCoPdOvR follows the tag. lock_dialect uses that for standalone bun.lockb (FIFO-safe sync read on the blocking pool) to pick Bun 1.3+ vs pre-1.3 glob semantics, matching the existing bun.lock path.

Docs (CLI_CONTRACT.md), CLI test comments, a 1.4.2-scoped-overrides fixture, VEX golden updates, and unit/integration tests cover tagged vs untagged locks and negated workspaces.

^{Reviewed by Cursor Bugbot for commit e509c25. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e509c25. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent)

• Head: e509c258fe44c8ad0e88c43bef31938829a5f844
• CI: 53/53 settled green on this head (34 success, 19 path-skipped); no main-wide failures
• Bugbot: reviewed e509c25 and found no new issues; no open review threads
• Mergeable: clean, already one human approval on this head
• What to look at: lock_dialect now recognises the Bun 1.3+ config-version tag in bun.lockb instead of treating every lone lockb as pre-1.3 (Bun 1.3+ bun.lockb root is read as pre-1.3, so a "!"-excluded member can't be patched in hosted or vendored mode (regression in 5.0.1) #1492)

---

Generated by Claude Code