Refuse an unreadable include outside the root

Final-review follow-up for #1851. If an out-of-root -r include
existed but couldn't be read or decoded, the planner skipped it and
wired the lock anyway, while discovery reported the same file as
unreadable. pip may still install pins from that file, so vendor
now refuses the package with pypi_requirements_outside_root and
names the file.

The vendor-dir check for direct references also normalizes Windows
backslashes now, matching discovery.

Refs #1851

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-core/src/vendor/pypi.rs

@@ -258,7 +258,7 @@ async fn refuse_pin_outside_root(
         return Ok(());
     };
     match super::pypi_requirements::pin_outside_root(project_root, name, version).await {
-        Some(rel) => Err(super::pypi_requirements::outside_root_refusal(&rel, name)),
+        Some(refusal) => Err(refusal),
         None => Ok(()),
     }
 }
@@ -4242,6 +4242,24 @@ mod tests {
             );
         }
 
+        // An include pip may read but this walk can't decode: its pins are
+        // unknowable, so it refuses too.
+        {
+            let tmp = tempfile::tempdir().unwrap();
+            let root = tmp.path().join("app");
+            tokio::fs::create_dir_all(&root).await.unwrap();
+            tokio::fs::write(tmp.path().join("base.txt"), b"\x80\x81six==1.16.0\n")
+                .await
+                .unwrap();
+            touch(&root, "pylock.toml", &pylock).await;
+            touch(&root, "requirements.txt", "-r ../base.txt\n").await;
+            let (code, detail) = detect_pypi_flavor(&root, Some(("six", "1.16.0")))
+                .await
+                .unwrap_err();
+            assert_eq!(code, "pypi_requirements_outside_root", "{detail}");
+            assert!(detail.contains("cannot be read"), "{detail}");
+        }
+
         // A bare artifact of another release, or of another package, is
         // not this pin.
         for other in [

crates/socket-patch-core/src/vendor/pypi_requirements.rs

@@ -459,25 +459,45 @@ pub(super) async fn sibling_pin_wirable(root: &Path, canon_name: &str, version:
 /// per-requirement options allowed), a direct reference or editable
 /// checkout naming the package (any version: its artifact is not ours),
 /// and a bare url / VCS / path line whose artifact filename or `#egg=`
-/// names it (at the filename's version, else any).
+/// names it (at the filename's version, else any). An out-of-root include
+/// that exists but can't be read or decoded refuses too: its pins are
+/// unknowable. `Some` is the refusal to return.
 pub(super) async fn pin_outside_root(
     root: &Path,
     canon_name: &str,
     version: &str,
-) -> Option<String> {
+) -> Option<(&'static str, String)> {
     let view = crate::vendor::lock_inventory::ProjectView::Disk(root);
     let mut found = None;
     let _ = walk_requirements_tree(view, decode_requirements, |rel, read| {
-        let Ok(content) = read else {
+        if found.is_some() {
             return Ok::<bool, std::convert::Infallible>(false);
-        };
-        if found.is_none()
-            && !is_in_root_rel(rel)
-            && installs_outside_vendor(&content, canon_name, version)
-        {
-            found = Some(rel.to_string());
         }
-        Ok(true)
+        let outside = !is_in_root_rel(rel);
+        match read {
+            Ok(content) => {
+                if outside && installs_outside_vendor(&content, canon_name, version) {
+                    found = Some(outside_root_refusal(rel, canon_name));
+                }
+                Ok(true)
+            }
+            // pip reads an include this walk can't (or fails the install):
+            // its pins are unknowable, so fail closed rather than wire the
+            // lock beside it. Discovery diagnoses the same file.
+            Err(e) if outside && e.kind() != std::io::ErrorKind::NotFound => {
+                found = Some((
+                    "pypi_requirements_outside_root",
+                    format!(
+                        "{rel}: a requirements include outside the project root cannot be \
+                         read ({e}), so vendor cannot tell whether pip installs {canon_name} \
+                         from it; make it readable UTF-8 text or use agent mode (`scan --mode \
+                         agent` + `socket-patch apply`) instead"
+                    ),
+                ));
+                Ok(false)
+            }
+            Err(_) => Ok(false),
+        }
     })
     .await;
     found
@@ -504,7 +524,7 @@ fn installs_outside_vendor(content: &str, canon_name: &str, version: &str) -> bo
             return false;
         };
         req.direct_reference
-            .is_some_and(|location| !location.contains(".socket/vendor/"))
+            .is_some_and(|location| !location.replace('\\', "/").contains(".socket/vendor/"))
             || req
                 .exact_version()
                 .is_some_and(|pinned| crate::utils::pep440::versions_equal(pinned, version))