Merge origin/main into agent/fix-npm-open-issues

Conflicts resolved:
- vex discover: main's UnattestedKind (#1033) replaces this branch's
  parallel UnattestedWhy; the #899 shrinkwrap case becomes
  UnattestedKind::NpmShrinkwrapOnly, mapped through vex_sources'
  unattested_note like the other kinds.
- scan/policy.rs: the #812 shared-copy keys use PurlKey (#1045) instead
  of the removed canon().
- CLI_CONTRACT.md: main's contested/unattested bullets, plus this
  branch's #828 withheld-ref sentence, #899 shrinkwrap bullet and npm
  warning rows.
- redirect npm.rs / scan mod.rs: imports and key types from both sides.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

.cargo/config.toml

@@ -32,3 +32,10 @@ SOCKET_NO_CONFIG = "1"
 # tests opt back in with SOCKET_NO_UPDATE_CHECK=0 plus a wiremock
 # SOCKET_UPDATE_BASE_URL.
 SOCKET_NO_UPDATE_CHECK = "1"
+
+# No test child (and no dev `cargo run`) may POST telemetry to the real
+# public proxy: an unauthenticated run sends its events to
+# patches-api.socket.dev, and most spawning suites point no proxy URL at a
+# mock. Suites that assert telemetry events opt back in with
+# SOCKET_TELEMETRY_DISABLED=0 (or remove it) plus a wiremock endpoint.
+SOCKET_TELEMETRY_DISABLED = "1"

.github/workflows/bench.yml

@@ -23,7 +23,7 @@ name: Benchmarks
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened, labeled, unlabeled]
+    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
     paths:
       - '.github/workflows/bench.yml'
       - '.cargo/**'
@@ -69,8 +69,10 @@ jobs:
     name: scan performance
     # Labels re-trigger the workflow; only this one changes the outcome.
     if: >-
-      (github.event.action != 'labeled' && github.event.action != 'unlabeled')
-      || github.event.label.name == 'performance-regression-accepted'
+      github.event.pull_request.draft != true && (
+        (github.event.action != 'labeled' && github.event.action != 'unlabeled')
+        || github.event.label.name == 'performance-regression-accepted'
+      )
     # Job-level, so an unrelated label (skipped above) cannot cancel a run
     # in progress. A newer push to the same PR supersedes the older run.
     concurrency:

.github/workflows/bun-compatibility.yml

@@ -15,6 +15,7 @@ name: Bun patch compatibility
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - '.github/actions/upload-artifact/**'
       - '.github/actions/pin-socket-hosts/**'
@@ -111,10 +112,14 @@ env:
 
 jobs:
   build:
+    if: github.event.pull_request.draft != true
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
+        exclude:
+          # macOS legs run on push to main (and nightly where scheduled), not per PR push.
+          - os: ${{ github.event_name == 'pull_request' && 'macos-latest' || '' }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     steps:
@@ -171,6 +176,8 @@ jobs:
           - {os: windows-latest, bun: '0.8.1'}
           - {os: windows-latest, bun: '1.0.0'}
           - {os: windows-latest, bun: '1.0.36'}
+          # macOS legs run on push to main (and nightly where scheduled), not per PR push.
+          - os: ${{ github.event_name == 'pull_request' && 'macos-latest' || '' }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     steps:
@@ -363,10 +370,14 @@ jobs:
 
 
   binary:
+    if: github.event.pull_request.draft != true
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, ubuntu-22.04, macos-latest, windows-latest]
+        exclude:
+          # macOS legs run on push to main (and nightly where scheduled), not per PR push.
+          - os: ${{ github.event_name == 'pull_request' && 'macos-latest' || '' }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     steps:

.github/workflows/ci.yml

@@ -21,6 +21,7 @@ name: Composer patch compatibility
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - '.github/workflows/composer-compatibility.yml'
       - 'tests/docker/Dockerfile.composer'
@@ -77,10 +78,12 @@ concurrency:
 env:
   SOCKET_NO_CONFIG: '1'
   SOCKET_NO_UPDATE_CHECK: '1'
+  SOCKET_TELEMETRY_DISABLED: '1'
 
 jobs:
   native:
     name: composer ${{ matrix.composer }} / php ${{ matrix.php }} / ${{ matrix.os }}
+    if: github.event.pull_request.draft != true
     strategy:
       fail-fast: false
       matrix:
@@ -98,12 +101,9 @@ jobs:
           - {os: windows-latest, composer: '2.2.30', php: '8.3', sha256: 8c2b4478b64f8f7cdf1574838fdb0033b29049ca821dad452db7a3dcfcdbffc2}
           - {os: windows-latest, composer: '2.9.8', php: '8.4', sha256: 59b2c50e10cafa0d8efc19ede9a326d782f096c674a26baf98cf042ce23de890}
           - {os: windows-latest, composer: '2.10.3', php: '8.5', sha256: 7a2d379d5b8ffdaa028580ef26494c36d2feef4b178d3dd1473a4dbc5e17c8d6}
-          - {os: macos-latest, composer: '1.10.28', php: '8.1', sha256: 0915af36eb01e3f0e16cd309adff7051832b9ef014e38371756804b20425cd5a}
-          - {os: macos-latest, composer: '2.2.30', php: '8.3', sha256: 8c2b4478b64f8f7cdf1574838fdb0033b29049ca821dad452db7a3dcfcdbffc2}
-          - {os: macos-latest, composer: '2.10.3', php: '8.5', sha256: 7a2d379d5b8ffdaa028580ef26494c36d2feef4b178d3dd1473a4dbc5e17c8d6}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
-    steps:
+    steps: &native-steps
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
@@ -169,11 +169,29 @@ jobs:
             -- --ignored --nocapture
           cargo test -p socket-patch-cli --test e2e_vex_lockfile -- composer:: --nocapture
 
+  # The macOS rows of `native`: they run on push to main (and nightly
+  # where scheduled), not on every PR push, so PRs stop queueing on the
+  # small macOS runner pool.
+  native-macos:
+    name: composer ${{ matrix.composer }} / php ${{ matrix.php }} / ${{ matrix.os }}
+    if: github.event_name != 'pull_request'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {os: macos-latest, composer: '1.10.28', php: '8.1', sha256: 0915af36eb01e3f0e16cd309adff7051832b9ef014e38371756804b20425cd5a}
+          - {os: macos-latest, composer: '2.2.30', php: '8.3', sha256: 8c2b4478b64f8f7cdf1574838fdb0033b29049ca821dad452db7a3dcfcdbffc2}
+          - {os: macos-latest, composer: '2.10.3', php: '8.5', sha256: 7a2d379d5b8ffdaa028580ef26494c36d2feef4b178d3dd1473a4dbc5e17c8d6}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    steps: *native-steps
+
   docker:
     # The vendored Docker capstone against an exact composer image. Its
     # fixture resolves psr/log from packagist, which no longer serves
     # Composer 1, so 1.10.28 is covered by the native legs only.
     name: docker composer ${{ matrix.composer }}
+    if: github.event.pull_request.draft != true
     runs-on: ubuntu-latest
     timeout-minutes: 35
     strategy:

.github/workflows/composer-compatibility.yml

@@ -7,6 +7,7 @@ name: Go patch compatibility
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - '.github/workflows/go-compatibility.yml'
       - 'crates/socket-patch-core/src/vendor/go*.rs'
@@ -35,22 +36,19 @@ concurrency:
 env:
   SOCKET_NO_CONFIG: '1'
   SOCKET_NO_UPDATE_CHECK: '1'
+  SOCKET_TELEMETRY_DISABLED: '1'
 
 jobs:
   go:
+    if: github.event.pull_request.draft != true
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
         go: ['1.18.10', '1.21.13', '1.24.13', '1.26.3']
-        include:
-          # macOS-latest dyld refuses binaries without LC_UUID (Go < 1.24
-          # linkers; see ci.yml's vexctl step).
-          - {os: macos-latest, go: '1.24.13'}
-          - {os: macos-latest, go: '1.26.3'}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 45
-    steps:
+    steps: &go-steps
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
@@ -75,3 +73,19 @@ jobs:
             --test e2e_golang_hosted_build --test e2e_vendor_golang_build \
             --test e2e_golang_build --test e2e_golang_workspace_build -- --nocapture
           cargo test -p socket-patch-cli --test e2e_vex_lockfile -- golang:: --nocapture
+
+  # The macOS rows of `go`: they run on push to main (and nightly
+  # where scheduled), not on every PR push, so PRs stop queueing on the
+  # small macOS runner pool.
+  go-macos:
+    if: github.event_name != 'pull_request'
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest]
+        # macOS-latest dyld refuses binaries without LC_UUID (Go < 1.24
+        # linkers; see ci.yml's vexctl step).
+        go: ['1.24.13', '1.26.3']
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    steps: *go-steps

.github/workflows/go-compatibility.yml

@@ -40,6 +40,7 @@ name: Gradle patch compatibility
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - '.github/workflows/gradle-compatibility.yml'
       - 'scripts/ci-e2e-bundle.py'
@@ -94,14 +95,19 @@ concurrency:
 env:
   SOCKET_NO_CONFIG: '1'
   SOCKET_NO_UPDATE_CHECK: '1'
+  SOCKET_TELEMETRY_DISABLED: '1'
 
 jobs:
   build:
     name: build ${{ matrix.os }}
+    if: github.event.pull_request.draft != true
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
+        exclude:
+          # macOS legs run on push to main (and nightly where scheduled), not per PR push.
+          - os: ${{ github.event_name == 'pull_request' && 'macos-latest' || '' }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     env:
@@ -174,6 +180,9 @@ jobs:
           - {gradle: '7.6.6', java: '17', label: '', gradle_args: '', real_central: '', suites: '', test_filter: ''}
           - {gradle: '8.14.3', java: '21', label: '', gradle_args: '', real_central: '', suites: '', test_filter: ''}
           - {gradle: '9.8.0', java: '21', label: '', gradle_args: '', real_central: '', suites: '', test_filter: ''}
+        exclude:
+          # macOS legs run on push to main (and nightly where scheduled), not per PR push.
+          - os: ${{ github.event_name == 'pull_request' && 'macos-latest' || '' }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     steps: &cell-steps

.github/workflows/gradle-compatibility.yml

@@ -11,6 +11,7 @@ on:
   # compile (a later `!` pattern excludes, a later plain one re-includes).
   # Main pushes stay unfiltered.
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - '.github/actions/upload-artifact/**'
       - 'Cargo.lock'
@@ -45,6 +46,7 @@ concurrency:
 
 jobs:
   build:
+    if: github.event.pull_request.draft != true
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
@@ -117,6 +119,7 @@ jobs:
           SOCKET_PATCH_NPM_E2E_REQUIRED: '1'
           SOCKET_NO_CONFIG: '1'
           SOCKET_NO_UPDATE_CHECK: '1'
+          SOCKET_TELEMETRY_DISABLED: '1'
         run: |
           chmod +x target/debug/socket-patch target/debug/e2e_redirect_npm_build target/debug/e2e_vendor_npm_build
           target/debug/e2e_redirect_npm_build --include-ignored --test-threads 4

.github/workflows/npm-compatibility.yml

@@ -9,6 +9,7 @@ name: PDM patch compatibility
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - '.github/actions/upload-artifact/**'
       - '.github/workflows/pdm-compatibility.yml'
@@ -56,14 +57,19 @@ concurrency:
 env:
   SOCKET_NO_CONFIG: '1'
   SOCKET_NO_UPDATE_CHECK: '1'
+  SOCKET_TELEMETRY_DISABLED: '1'
   PDM_CHECK_UPDATE: 'false'
 
 jobs:
   build:
+    if: github.event.pull_request.draft != true
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest]
+        exclude:
+          # macOS legs run on push to main (and nightly where scheduled), not per PR push.
+          - os: ${{ github.event_name == 'pull_request' && 'macos-latest' || '' }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     steps:
@@ -107,13 +113,9 @@ jobs:
         # every Windows cell skipped; backtest-pdm.py now fails such a cell.
         os: [ubuntu-latest]
         pdm: ['0.12.3', '1.15.5', '2.0.3', '2.1.5', '2.3.4', '2.6.1', '2.7.4', '2.8.2', '2.9.3', '2.10.4', '2.11.2', '2.17.3', '2.20.1', '2.22.4', '2.25.9', '2.29.2']
-        include:
-          - { os: macos-latest, pdm: '0.12.3' }
-          - { os: macos-latest, pdm: '2.8.2' }
-          - { os: macos-latest, pdm: '2.29.2' }
     runs-on: ${{ matrix.os }}
     timeout-minutes: 45
-    steps:
+    steps: &native-steps
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
@@ -174,6 +176,23 @@ jobs:
   # formats (3.1, 4.0-4.2) must attest nothing. The cells ci.yml's `e2e`
   # job runs on every PR and main push are excluded here
   # (scripts/tests/test_ci_e2e_tiers.py keeps the two lists in step).
+
+  # The macOS rows of `native`: they run on push to main (and nightly
+  # where scheduled), not on every PR push, so PRs stop queueing on the
+  # small macOS runner pool.
+  native-macos:
+    if: github.event_name != 'pull_request'
+    needs: build
+    strategy:
+      fail-fast: false
+      matrix:
+        # The ends of the range and the 2.8 lock-format boundary.
+        os: [macos-latest]
+        pdm: ['0.12.3', '2.8.2', '2.29.2']
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    steps: *native-steps
+
   capstone:
     needs: build
     strategy:
@@ -189,6 +208,8 @@ jobs:
           - {os: ubuntu-latest, pdm: '2.25.9'}
           - {os: ubuntu-latest, pdm: '2.29.2'}
           - {os: macos-latest, pdm: '2.29.2'}
+          # macOS legs run on push to main (and nightly where scheduled), not per PR push.
+          - os: ${{ github.event_name == 'pull_request' && 'macos-latest' || '' }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     steps:

.github/workflows/pdm-compatibility.yml

@@ -9,6 +9,7 @@ name: Pipenv compatibility
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - '.github/actions/upload-artifact/**'
       - 'crates/socket-patch-core/src/patch/redirect/pipenv.rs'
@@ -43,6 +44,7 @@ concurrency:
 
 jobs:
   matrix:
+    if: github.event.pull_request.draft != true
     strategy:
       fail-fast: false
       matrix:
@@ -55,12 +57,9 @@ jobs:
           - os: ubuntu-latest
             versions: 2022.12.19 2026.8.0
             shapes: crlf marker-excluded extras category
-          - os: macos-latest
-            versions: 2018.11.26 2022.12.19 2023.12.1 2026.8.0
-            shapes: direct
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
-    steps:
+    steps: &matrix-steps
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
@@ -86,6 +85,7 @@ jobs:
         env:
           SOCKET_NO_CONFIG: '1'
           SOCKET_NO_UPDATE_CHECK: '1'
+          SOCKET_TELEMETRY_DISABLED: '1'
           # The runners carry whatever patch release uv ships; the harness
           # only needs one 3.8 and one 3.12.
           BACKTEST_PY38: '3.8'
@@ -111,3 +111,19 @@ jobs:
             ${{ runner.temp }}/pipenv-compat/summary.md
           if-no-files-found: warn
           retention-days: 7
+
+  # The macOS rows of `matrix`: they run on push to main (and nightly
+  # where scheduled), not on every PR push, so PRs stop queueing on the
+  # small macOS runner pool.
+  matrix-macos:
+    if: github.event_name != 'pull_request'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            versions: 2018.11.26 2022.12.19 2023.12.1 2026.8.0
+            shapes: direct
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    steps: *matrix-steps