From cf4d89f6e29a87b3904fa54791e7b7cb4cd6b7b7 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 30 Sep 2026 14:17:51 +0000 Subject: [PATCH] Fix: Record file inventory for Composer vendor artifacts Composer vendors now compute and persist file_inventory at vendor time, matching the behavior of Cargo, Go, gem, and vlt. This enables directory repair and same-UUID vendor restore for Composer packages, preventing redownload::restore from failing on missing inventory data. --- crates/socket-patch-core/src/vendor/composer_lock.rs | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/crates/socket-patch-core/src/vendor/composer_lock.rs b/crates/socket-patch-core/src/vendor/composer_lock.rs index 21fbcac40..e8e44f248 100644 --- a/crates/socket-patch-core/src/vendor/composer_lock.rs +++ b/crates/socket-patch-core/src/vendor/composer_lock.rs @@ -435,7 +435,16 @@ pub async fn vendor_composer<'a>( let marker = VendorMarker::new("composer", &base_purl, record, vendored_at); write_marker_or_warn(&uuid_dir, &marker, &mut warnings).await; - let entry = VendorEntry { + let file_inventory = match super::verify::compute_dir_inventory(©_dir).await { + Ok(inventory) => inventory, + Err(error) => { + let _ = remove_tree(&uuid_dir).await; + prune_empty_vendor_dirs(©_dir).await; + return refused("vendor_inventory_unavailable", error); + } + }; + + let mut entry = VendorEntry { ecosystem: "composer".to_string(), base_purl, uuid: record.uuid.clone(), @@ -466,6 +475,7 @@ pub async fn vendor_composer<'a>( pdm: None, pipenv: None, }; + entry.artifact.file_inventory = Some(file_inventory); done(result, Some(entry), warnings) }