Apply /code-review findings on apply fixtures

Gem suites that pin --cwd run their child from the runner's directory
again, so a crawler reading the process cwd still fails them.
apply_invariants runs apply through apply_fixture::run_apply, the
--cwd remedy test stages its blob with stage_blob, and the gem
--check fixture derives its specifications dir from install_gem's
path. bun_global_store and lockfile_only_skip build their records
through one index_js_patches helper. apply_network passes bytes to
one_file instead of precomputed hashes. Stale module docs updated.

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-cli/tests/apply/apply_fixture.rs

@@ -53,6 +53,22 @@ pub fn hashed_file(path: &str, before_hash: &str, after_hash: &str) -> Value {
     json!({ path: { "beforeHash": before_hash, "afterHash": after_hash } })
 }
 
+/// One `package/index.js` record from `before` to `after` per purl, the
+/// i-th with uuid `<prefix>-0000-4000-8000-<i, 12 digits>`.
+pub fn index_js_patches(purls: &[&str], uuid_prefix: &str, before: &[u8], after: &[u8]) -> Value {
+    let files = one_file("package/index.js", before, after);
+    Value::Object(
+        purls
+            .iter()
+            .enumerate()
+            .map(|(i, purl)| {
+                let uuid = format!("{uuid_prefix}-0000-4000-8000-{i:012}");
+                (purl.to_string(), patch_record(&uuid, files.clone()))
+            })
+            .collect(),
+    )
+}
+
 /// Write `.socket/manifest.json`, creating `.socket/blobs/` alongside as
 /// a real project has it.
 pub fn write_manifest(root: &Path, patches: Value) {
@@ -253,7 +269,9 @@ pub fn write_sourceless_npm_patches(root: &Path, n: u32) {
 // ═══════════ gem release-variant mismatch fixtures ═══════════
 //
 // Shared by `cli_gem_variant_mismatch_policy.rs` (the `--json`
-// contracts) and `apply_render.rs` (the human output).
+// contracts) and `apply_render.rs` (the human output). `run_gem` also
+// runs the gem_stale_bundler_plugin, in_process_gem_config_warning and
+// in_process_gem_fallback_home children.
 
 /// The rack singleton's on-disk bytes after a local edit: they match
 /// neither the record's beforeHash nor its afterHash.
@@ -265,7 +283,9 @@ pub const NOKOGIRI_DARWIN_MARKER: &[u8] = b"\n# DARWIN-MARKER\n";
 
 /// Run `socket-patch <args>` in `cwd` like `common::run_with_env`, with
 /// the ambient `BUNDLE_*` also scrubbed so only the argv and `env` decide
-/// what Bundler state the gem crawler reads.
+/// what Bundler state the gem crawler reads. Suites that pin `--cwd`
+/// pass `Path::new(".")` so the child stays in the runner's directory and
+/// a crawler reading the process cwd instead of `--cwd` finds nothing.
 pub fn run_gem(cwd: &Path, args: &[&str], env: &[(&str, &str)]) -> (i32, String, String) {
     let mut cmd = hermetic_command(&binary());
     cmd.args(args).current_dir(cwd);

crates/socket-patch-cli/tests/apply/apply_invariants.rs

@@ -20,7 +20,7 @@ use std::path::Path;
 use serde_json::json;
 
 use super::apply_fixture::{
-    hashed_file, install_npm_pkg, one_file, patch_record, stage_blob, write_manifest,
+    hashed_file, install_npm_pkg, one_file, patch_record, run_apply, stage_blob, write_manifest,
     write_root_package_json,
 };
 use crate::common::{binary, git_sha256, hermetic_command};
@@ -44,20 +44,6 @@ fn write_project(root: &Path) {
     stage_blob(root, "sentinel", b"do not modify me");
 }
 
-fn run_apply(cwd: &Path, extra: &[&str]) -> (i32, String) {
-    let mut args = vec!["apply", "--json"];
-    args.extend_from_slice(extra);
-    let out = hermetic_command(&binary())
-        .args(&args)
-        .current_dir(cwd)
-        .output()
-        .expect("run socket-patch");
-    (
-        out.status.code().unwrap_or(-1),
-        String::from_utf8_lossy(&out.stdout).to_string(),
-    )
-}
-
 /// Every counter in the envelope's `summary` block must be exactly 0.
 /// We enumerate the keys explicitly (rather than "applied == 0") so a
 /// regression that started reporting work on these no-op paths — e.g. a
@@ -119,9 +105,10 @@ fn offline_ecosystems_filter_ignores_out_of_scope_missing_source() {
     let tmp = tempfile::tempdir().expect("tempdir");
     write_mixed_scope_project(tmp.path());
 
-    let (code, stdout) = run_apply(
+    let (code, stdout, _) = run_apply(
         tmp.path(),
-        &["--offline", "--silent", "--ecosystems", "npm"],
+        &["--json", "--offline", "--silent", "--ecosystems", "npm"],
+        &[],
     );
     let v: serde_json::Value =
         serde_json::from_str(&stdout).expect("apply --json must emit valid JSON");
@@ -156,7 +143,7 @@ fn offline_ecosystems_filter_ignores_out_of_scope_missing_source() {
     // still fire — the guard is scoped, not disabled.
     let tmp2 = tempfile::tempdir().expect("tempdir");
     write_mixed_scope_project(tmp2.path());
-    let (code2, stdout2) = run_apply(tmp2.path(), &["--offline", "--silent"]);
+    let (code2, stdout2, _) = run_apply(tmp2.path(), &["--json", "--offline", "--silent"], &[]);
     assert_eq!(
         code2, 1,
         "with no ecosystem filter the sourceless pypi patch is in scope and \
@@ -172,7 +159,7 @@ fn offline_with_missing_source_emits_partial_failure() {
     let tmp = tempfile::tempdir().expect("tempdir");
     write_project(tmp.path());
 
-    let (code, stdout) = run_apply(tmp.path(), &["--offline", "--silent"]);
+    let (code, stdout, _) = run_apply(tmp.path(), &["--json", "--offline", "--silent"], &[]);
 
     // Exit code 1 is contract: any patch without a usable source under
     // `--offline` flips the run to partialFailure.
@@ -215,7 +202,7 @@ fn apply_does_not_mutate_socket_dir_offline() {
 
     let socket = tmp.path().join(".socket");
     let before = snapshot_dir(&socket);
-    let (code, stdout) = run_apply(tmp.path(), &["--offline", "--silent"]);
+    let (code, stdout, _) = run_apply(tmp.path(), &["--json", "--offline", "--silent"], &[]);
     let after = snapshot_dir(&socket);
 
     // The run must have actually taken the failure path we care about —
@@ -243,7 +230,7 @@ fn apply_does_not_mutate_socket_dir_when_no_packages_match() {
 
     let socket = tmp.path().join(".socket");
     let before = snapshot_dir(&socket);
-    let (code, stdout) = run_apply(tmp.path(), &["--silent"]);
+    let (code, stdout, _) = run_apply(tmp.path(), &["--json", "--silent"], &[]);
     let after = snapshot_dir(&socket);
 
     // Pin the bail itself, or a run that died early would leave
@@ -290,7 +277,7 @@ fn apply_does_not_mutate_socket_dir_when_no_packages_match() {
 fn apply_with_no_socket_dir_emits_no_manifest_envelope() {
     let tmp = tempfile::tempdir().expect("tempdir");
     // Note: NO .socket/ directory at all — completely fresh tree.
-    let (code, stdout) = run_apply(tmp.path(), &[]);
+    let (code, stdout, _) = run_apply(tmp.path(), &["--json"], &[]);
     assert_eq!(code, 0, "no-manifest is not an error; stdout=\n{stdout}");
     let v: serde_json::Value = serde_json::from_str(&stdout).expect("envelope must be valid JSON");
     assert_eq!(v["command"], "apply");
@@ -380,7 +367,7 @@ fn apply_with_unreadable_socket_dir_fails_closed() {
         return;
     }
 
-    let (code, stdout) = run_apply(tmp.path(), &[]);
+    let (code, stdout, _) = run_apply(tmp.path(), &["--json"], &[]);
     restore();
 
     assert_ne!(
@@ -451,7 +438,7 @@ fn unmatched_purl_exit_semantics_are_pinned() {
     // with the miss visible only as a skipped event.
     let tmp = tempfile::tempdir().expect("tempdir");
     write_partial_match_project(tmp.path());
-    let (code, stdout) = run_apply(tmp.path(), &["--offline", "--silent"]);
+    let (code, stdout, _) = run_apply(tmp.path(), &["--json", "--offline", "--silent"], &[]);
     let v: serde_json::Value =
         serde_json::from_str(&stdout).expect("apply --json must emit valid JSON");
     assert_eq!(code, 0, "mixed manifest pins exit 0 today; envelope:\n{v}");
@@ -482,7 +469,7 @@ fn unmatched_purl_exit_semantics_are_pinned() {
     let tmp2 = tempfile::tempdir().expect("tempdir");
     write_partial_match_project(tmp2.path());
     std::fs::remove_dir_all(tmp2.path().join("node_modules")).expect("uninstall scopedpkg");
-    let (code2, stdout2) = run_apply(tmp2.path(), &["--offline", "--silent"]);
+    let (code2, stdout2, _) = run_apply(tmp2.path(), &["--json", "--offline", "--silent"], &[]);
     let v2: serde_json::Value =
         serde_json::from_str(&stdout2).expect("apply --json must emit valid JSON");
     assert_eq!(

crates/socket-patch-cli/tests/apply/apply_network.rs

@@ -17,7 +17,7 @@ use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
 use super::apply_fixture::{
-    hashed_file, install_npm_pkg, patch_record, stage_blob, write_manifest, write_root_package_json,
+    install_npm_pkg, one_file, patch_record, stage_blob, write_manifest, write_root_package_json,
 };
 use crate::common::{binary, git_sha256, hermetic};
 
@@ -51,7 +51,6 @@ fn run_apply(cwd: &Path, api_url: &str, extra: &[&str]) -> (i32, String, String)
 async fn apply_online_fetches_missing_blob_and_patches_file() {
     let before = b"before\n";
     let after = b"after\n";
-    let before_hash = git_sha256(before);
     let after_hash = git_sha256(after);
 
     let mock = MockServer::start().await;
@@ -74,7 +73,7 @@ async fn apply_online_fetches_missing_blob_and_patches_file() {
     let socket = tmp.path().join(".socket");
     write_manifest(
         tmp.path(),
-        json!({ purl: patch_record(uuid, hashed_file("package/index.js", &before_hash, &after_hash)) }),
+        json!({ purl: patch_record(uuid, one_file("package/index.js", before, after)) }),
     );
 
     let (code, stdout, stderr) = run_apply(tmp.path(), &mock.uri(), &[]);
@@ -167,8 +166,6 @@ async fn apply_online_fetches_missing_blob_and_patches_file() {
 async fn apply_with_ecosystem_filter_excluding_npm_skips_all_npm_patches() {
     let before = b"before\n";
     let after = b"after\n";
-    let before_hash = git_sha256(before);
-    let after_hash = git_sha256(after);
 
     let mock = MockServer::start().await;
     let purl = "pkg:npm/skipped@1.0.0";
@@ -179,7 +176,7 @@ async fn apply_with_ecosystem_filter_excluding_npm_skips_all_npm_patches() {
     install_npm_pkg(tmp.path(), "skipped", "1.0.0", Some(before));
     write_manifest(
         tmp.path(),
-        json!({ purl: patch_record(uuid, hashed_file("package/index.js", &before_hash, &after_hash)) }),
+        json!({ purl: patch_record(uuid, one_file("package/index.js", before, after)) }),
     );
 
     let (code, stdout, stderr) = run_apply(tmp.path(), &mock.uri(), &["--ecosystems", "pypi"]);
@@ -250,15 +247,14 @@ async fn apply_with_ecosystem_filter_excluding_npm_skips_all_npm_patches() {
 async fn apply_dry_run_emits_verified_event_without_writing() {
     let before = b"before\n";
     let after = b"after\n";
-    let before_hash = git_sha256(before);
     let after_hash = git_sha256(after);
 
     let tmp = tempfile::tempdir().expect("tempdir");
     write_root_package_json(tmp.path());
     install_npm_pkg(tmp.path(), "dryrun-target", "1.0.0", Some(before));
     write_manifest(
         tmp.path(),
-        json!({ "pkg:npm/dryrun-target@1.0.0": patch_record("11111111-1111-4111-8111-111111111111", hashed_file("package/index.js", &before_hash, &after_hash)) }),
+        json!({ "pkg:npm/dryrun-target@1.0.0": patch_record("11111111-1111-4111-8111-111111111111", one_file("package/index.js", before, after)) }),
     );
     // Pre-stage the after blob so we don't need to mock the network
     // path; we just want to verify dry-run reports the action correctly.
@@ -318,14 +314,13 @@ async fn apply_with_force_overrides_hash_mismatch() {
     let after_hash = git_sha256(after);
     let expected_before = b"expected-before\n";
     let actual_before = b"DIFFERENT-CONTENT\n"; // wrong before content
-    let expected_before_hash = git_sha256(expected_before);
 
     let tmp = tempfile::tempdir().expect("tempdir");
     write_root_package_json(tmp.path());
     install_npm_pkg(tmp.path(), "force-target", "1.0.0", Some(actual_before));
     write_manifest(
         tmp.path(),
-        json!({ "pkg:npm/force-target@1.0.0": patch_record("11111111-1111-4111-8111-111111111111", hashed_file("package/index.js", &expected_before_hash, &after_hash)) }),
+        json!({ "pkg:npm/force-target@1.0.0": patch_record("11111111-1111-4111-8111-111111111111", one_file("package/index.js", expected_before, after)) }),
     );
     // Pre-stage the after blob so we don't need the network.
     stage_blob(tmp.path(), &after_hash, after);
@@ -372,15 +367,14 @@ async fn apply_hash_mismatch_opt_in_warns_and_applies_strict_fails() {
     let after_hash = git_sha256(after);
     let expected_before = b"expected-before\n";
     let actual_before = b"DIFFERENT-CONTENT\n";
-    let expected_before_hash = git_sha256(expected_before);
 
     let fixture = || {
         let tmp = tempfile::tempdir().expect("tempdir");
         write_root_package_json(tmp.path());
         install_npm_pkg(tmp.path(), "mismatch", "1.0.0", Some(actual_before));
         write_manifest(
             tmp.path(),
-            json!({ "pkg:npm/mismatch@1.0.0": patch_record("11111111-1111-4111-8111-111111111111", hashed_file("package/index.js", &expected_before_hash, &after_hash)) }),
+            json!({ "pkg:npm/mismatch@1.0.0": patch_record("11111111-1111-4111-8111-111111111111", one_file("package/index.js", expected_before, after)) }),
         );
         stage_blob(tmp.path(), &after_hash, after);
         tmp
@@ -467,7 +461,6 @@ async fn apply_hash_mismatch_opt_in_warns_and_applies_strict_fails() {
 async fn apply_pypi_package_uses_python_crawler() {
     let before = b"def hello():\n    return 'before'\n";
     let after = b"def hello():\n    return 'after'\n";
-    let before_hash = git_sha256(before);
     let after_hash = git_sha256(after);
 
     let tmp = tempfile::tempdir().expect("tempdir");
@@ -503,7 +496,7 @@ async fn apply_pypi_package_uses_python_crawler() {
 
     write_manifest(
         tmp.path(),
-        json!({ "pkg:pypi/pypi_target@1.0.0": patch_record("11111111-1111-4111-8111-111111111111", hashed_file("package/index.js", &before_hash, &after_hash)) }),
+        json!({ "pkg:pypi/pypi_target@1.0.0": patch_record("11111111-1111-4111-8111-111111111111", one_file("package/index.js", before, after)) }),
     );
     stage_blob(tmp.path(), &after_hash, after);
 
@@ -552,7 +545,6 @@ async fn apply_pypi_package_uses_python_crawler() {
 async fn apply_uses_locally_cached_blob_without_fetching() {
     let before = b"before\n";
     let after = b"after\n";
-    let before_hash = git_sha256(before);
     let after_hash = git_sha256(after);
 
     let tmp = tempfile::tempdir().expect("tempdir");
@@ -561,7 +553,7 @@ async fn apply_uses_locally_cached_blob_without_fetching() {
     let socket = tmp.path().join(".socket");
     write_manifest(
         tmp.path(),
-        json!({ "pkg:npm/cached@1.0.0": patch_record("22222222-2222-4222-8222-222222222222", hashed_file("package/index.js", &before_hash, &after_hash)) }),
+        json!({ "pkg:npm/cached@1.0.0": patch_record("22222222-2222-4222-8222-222222222222", one_file("package/index.js", before, after)) }),
     );
     stage_blob(tmp.path(), &after_hash, after);
 
@@ -613,7 +605,6 @@ async fn apply_uses_locally_cached_blob_without_fetching() {
 async fn apply_mismatch_redownloads_full_blob_and_applies() {
     let after = b"after\n";
     let after_hash = git_sha256(after);
-    let expected_before_hash = git_sha256(b"expected-before\n");
 
     let mock = MockServer::start().await;
     Mock::given(method("GET"))
@@ -636,7 +627,10 @@ async fn apply_mismatch_redownloads_full_blob_and_applies() {
     let socket = tmp.path().join(".socket");
     write_manifest(
         tmp.path(),
-        json!({ "pkg:npm/mismatch@1.0.0": patch_record(uuid, hashed_file("package/index.js", &expected_before_hash, &after_hash)) }),
+        json!({ "pkg:npm/mismatch@1.0.0": patch_record(
+            uuid,
+            one_file("package/index.js", b"expected-before\n", after),
+        )}),
     );
     // A leftover LOCAL package archive exists, but nothing reads it: only
     // the blob can produce the patched bytes, and no blob is cached.
@@ -705,7 +699,6 @@ async fn apply_mismatch_redownloads_full_blob_and_applies() {
 async fn offline_apply_with_token_makes_zero_network_requests() {
     let before = b"offline airgap before\n";
     let after = b"offline airgap after\n";
-    let before_hash = git_sha256(before);
     let after_hash = git_sha256(after);
 
     // No mocks mounted: every request is a violation, and all are recorded.
@@ -716,7 +709,7 @@ async fn offline_apply_with_token_makes_zero_network_requests() {
     install_npm_pkg(tmp.path(), "airgap-test", "1.0.0", Some(before));
     write_manifest(
         tmp.path(),
-        json!({ "pkg:npm/airgap-test@1.0.0": patch_record("33333333-3333-4333-8333-333333333333", hashed_file("package/index.js", &before_hash, &after_hash)) }),
+        json!({ "pkg:npm/airgap-test@1.0.0": patch_record("33333333-3333-4333-8333-333333333333", one_file("package/index.js", before, after)) }),
     );
     stage_blob(tmp.path(), &after_hash, after);
 
@@ -798,7 +791,6 @@ fn write_package_archive(packages: &Path, uuid: &str, entries: &[(&str, &[u8])])
 async fn apply_online_ignores_legacy_package_archive_when_downloads_fail() {
     let before = b"pkgcache before\n";
     let after = b"pkgcache after\n";
-    let before_hash = git_sha256(before);
     let after_hash = git_sha256(after);
     let uuid = "44444444-4444-4444-8444-444444444444";
 
@@ -812,7 +804,7 @@ async fn apply_online_ignores_legacy_package_archive_when_downloads_fail() {
     let socket = tmp.path().join(".socket");
     write_manifest(
         tmp.path(),
-        json!({ "pkg:npm/pkgcache@1.0.0": patch_record(uuid, hashed_file("package/index.js", &before_hash, &after_hash)) }),
+        json!({ "pkg:npm/pkgcache@1.0.0": patch_record(uuid, one_file("package/index.js", before, after)) }),
     );
     write_package_archive(
         &socket.join("packages"),
@@ -857,7 +849,6 @@ async fn apply_online_ignores_legacy_package_archive_when_downloads_fail() {
 async fn mismatch_overwrites_every_copy_of_a_duplicated_package() {
     let before = b"before\n";
     let after = b"after\n";
-    let before_hash = git_sha256(before);
     let after_hash = git_sha256(after);
 
     let mock = MockServer::start().await;
@@ -889,7 +880,7 @@ async fn mismatch_overwrites_every_copy_of_a_duplicated_package() {
     let socket = tmp.path().join(".socket");
     write_manifest(
         tmp.path(),
-        json!({ purl: patch_record(uuid, hashed_file("package/index.js", &before_hash, &after_hash)) }),
+        json!({ purl: patch_record(uuid, one_file("package/index.js", before, after)) }),
     );
     let (code, stdout, stderr) = run_apply(tmp.path(), &mock.uri(), &["--allow-patch-conflicts"]);
     let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");

crates/socket-patch-cli/tests/apply/apply_render.rs

@@ -7,7 +7,7 @@
 //! `Would remove` announcement, "No patches to apply.", the
 //! no-matching-package error block, the dry-run summary counts,
 //! `--verbose` per-file labels, the pnpm/bun/vlt layout notes, the
-//! yarn-PnP refusal, the gem fallback-home skip warning, the gem
+//! yarn-PnP refusal, the gem
 //! variant mismatch warning and no-matching-variant error, the
 //! `--dry-run --vex` skip line, and the staging layer's offline
 //! no-local-source report and download result line.

crates/socket-patch-cli/tests/apply/bun_global_store.rs

@@ -12,7 +12,7 @@ use std::path::{Path, PathBuf};
 
 use serde_json::Value;
 
-use super::apply_fixture::{link_dir, one_file, patch_record, stage_blob, write_manifest};
+use super::apply_fixture::{index_js_patches, link_dir, stage_blob, write_manifest};
 use crate::common::envelope::event_for;
 use crate::common::{git_sha256, parse_json_envelope, run_with_env};
 
@@ -71,16 +71,7 @@ fn stage(tmp: &Path, bytes: &[u8]) -> (PathBuf, PathBuf, PathBuf) {
 }
 
 fn write_patches(root: &Path, purls: &[&str]) {
-    let patches = purls
-        .iter()
-        .enumerate()
-        .map(|(i, purl)| {
-            let uuid = format!("63563563-0000-4000-8000-00000000000{i}");
-            let record = patch_record(&uuid, one_file("package/index.js", BEFORE, AFTER));
-            (purl.to_string(), record)
-        })
-        .collect();
-    write_manifest(root, Value::Object(patches));
+    write_manifest(root, index_js_patches(purls, "63563563", BEFORE, AFTER));
     for bytes in [BEFORE, AFTER] {
         stage_blob(root, &git_sha256(bytes), bytes);
     }