Match yarn 4's real patch-commit output in tests

yarn patch-commit -s rewrites the dependency itself, not resolutions;
the remedies now say to put the registry range back in its place.

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -194,7 +194,7 @@ A missing referenced diff does not remove that protection.
   `rollback`, `remove` and `vendor --revert` refuse that package before
   writing (hosted: a refused pin, exit 1; vendored:
   `vendor_lock_still_wired_revert_blocked`, dry runs included) and ask for the
-  `patch:` resolution to be dropped first.
+  `patch:` descriptor to be replaced by the registry range first.
 
 Detection covers root and declared npm workspace manifests, ancestor workspace
 settings, and the following evidence:

crates/socket-patch-cli/tests/in_process_redirect.rs

@@ -1172,33 +1172,39 @@ async fn yarn_berry_rollback_refuses_a_pin_wrapped_by_a_user_yarn_patch() {
         );
         assert_eq!(vlt_hosted_common::redirected(&env), 1, "{env:#}");
 
-        // What `yarn patch-commit -s` writes over the hosted pin: a
-        // `resolutions` entry routing the tarball descriptor to a `patch:`
-        // descriptor (the inner one with yarn's `%3A` escapes), the lock
-        // entry it resolves to, and the workspace dependency through it.
+        // What yarn 4.18 `yarn patch-commit -s` writes over the hosted pin:
+        // the dependency becomes a `patch:` descriptor wrapping the tarball
+        // URL (with yarn's `%3A` escapes), locked by a `patch:` entry next to
+        // the hosted one, which stays (the `resolutions` selector is kept).
         let wrapped = format!(
-            "patch:{NAME}@{}#~/.yarn/patches/{NAME}-http-7f4bf328bd.patch",
+            "patch:{NAME}@{}#~/.yarn/patches/{NAME}-http-735c2bb24a.patch",
             hosted_url.replace(':', "%3A")
         );
         let pkg_path = tmp.path().join("package.json");
         let mut pkg: serde_json::Value =
             serde_json::from_str(&std::fs::read_to_string(&pkg_path).unwrap()).unwrap();
-        pkg["resolutions"][format!("{NAME}@{hosted_url}")] = serde_json::json!(wrapped);
+        pkg["dependencies"][NAME] = serde_json::json!(wrapped);
         std::fs::write(
             &pkg_path,
             serde_json::to_string_pretty(&pkg).unwrap() + "\n",
         )
         .unwrap();
         let lock_path = tmp.path().join("yarn.lock");
-        let lock = std::fs::read_to_string(&lock_path).unwrap().replace(
-            &format!("    {NAME}: \"npm:^{VERSION}\"\n"),
-            &format!("    {NAME}: \"{wrapped}\"\n"),
-        ) + &format!(
-            "\n\"{NAME}@{wrapped}\":\n  version: {VERSION}\n  \
-                 resolution: \"{NAME}@{wrapped}::version={VERSION}&hash=0d6d28\"\n  \
-                 checksum: 10c0/{}\n  languageName: node\n  linkType: hard\n",
+        let pinned = std::fs::read_to_string(&lock_path).unwrap();
+        let patched_entry = format!(
+            "\"{NAME}@{wrapped}\":\n  version: {VERSION}\n  \
+             resolution: \"{NAME}@{wrapped}::version={VERSION}&hash=e516cc\"\n  \
+             checksum: 10c0/{}\n  languageName: node\n  linkType: hard\n\n",
             "4".repeat(128)
         );
+        let workspace = "\"consumer@workspace:.\":";
+        assert!(pinned.contains(workspace), "{pinned}");
+        let lock = pinned
+            .replace(
+                &format!("    {NAME}: \"npm:^{VERSION}\"\n"),
+                &format!("    {NAME}: \"{wrapped}\"\n"),
+            )
+            .replace(workspace, &format!("{patched_entry}{workspace}"));
         std::fs::write(&lock_path, &lock).unwrap();
         let pkg_before = std::fs::read_to_string(&pkg_path).unwrap();
 

crates/socket-patch-core/src/patch/redirect/upstream/npm.rs

@@ -780,9 +780,9 @@ async fn restore_berry(
                 format!(
                     "{name}@{version}: a `patch:` entry from `yarn patch` still wraps the \
                      hosted tarball in {rel}, and restoring the registry entry under it would \
-                     leave a lock `yarn install --immutable` rejects — remove the `patch:` \
-                     resolution from {pkg_rel}, run `yarn install`, roll back, then re-run \
-                     `yarn patch` on the registry version"
+                     leave a lock `yarn install --immutable` rejects — put the registry range \
+                     back in place of the `patch:` descriptor in {pkg_rel}, run `yarn install`, \
+                     roll back, then re-run `yarn patch` on the registry version"
                 ),
             );
             continue;

crates/socket-patch-core/src/vendor/yarn_berry_lock.rs

@@ -849,9 +849,9 @@ pub async fn revert_yarn_berry_opts(
         let detail = format!(
             "refusing to revert {uuid_dir_rel}: a `patch:` entry from `yarn patch` in {wired} \
              still wraps the vendored tarball, and restoring the registry entry under it would \
-             leave a lock `yarn install --immutable` rejects — remove the `patch:` resolution \
-             from {PACKAGE_JSON}, run `yarn install`, re-run `vendor --revert`, then re-run \
-             `yarn patch` on the registry version"
+             leave a lock `yarn install --immutable` rejects — put the registry range back in \
+             place of the `patch:` descriptor in {PACKAGE_JSON}, run `yarn install`, re-run \
+             `vendor --revert`, then re-run `yarn patch` on the registry version"
         );
         return RevertOutcome {
             success: false,
@@ -3987,7 +3987,7 @@ __metadata:
     }
 
     /// #962: the user ran `yarn patch` / `yarn patch-commit -s` over the
-    /// vendored package, so a `patch:` lock entry and `resolutions` value
+    /// vendored package, so a `patch:` lock entry and dependency descriptor
     /// wrap the vendored tarball. Restoring the recorded entry would leave
     /// that wrapper naming a descriptor no entry resolves: every
     /// `yarn install --immutable` rejects the lock (YN0028). The revert must
@@ -4017,7 +4017,8 @@ __metadata:
         tokio::fs::write(fx.lock_path(), &lock).await.unwrap();
         let pkg_text = tokio::fs::read_to_string(fx.pkg_path()).await.unwrap();
         let mut pkg: Value = serde_json::from_str(&pkg_text).unwrap();
-        pkg["resolutions"][format!("left-pad@{resolution}")] = Value::String(wrapped);
+        // yarn 4.18 `patch-commit -s` rewrites the dependency itself.
+        pkg["dependencies"]["left-pad"] = Value::String(wrapped);
         let pkg_text = serde_json::to_string_pretty(&pkg).unwrap() + "\n";
         tokio::fs::write(fx.pkg_path(), &pkg_text).await.unwrap();