[Mikola Lysenko (mikolalysenko)]

Problem

The nightly e2e-extended (ubuntu-latest, e2e_bun_lockb, 1.4.2, …) leg failed on main on 2026-10-31 (run 41173651959, job 124456920432) in binary_shared_bundled_record_hosted_pin_is_managed. It passed the night before at almost the same code (run 41009903891). The only commit between the two runs was #1796, which touches Python only. Rollback aborted with rollback_failed / missing_blob ("Before blob could not be downloaded … Blob not found on server") where the test expects partialFailure.

Locally (bun 1.4.4, no route to the public patch proxy) the test failed 12/12.

Root cause

In the bundled shape, Bun installs a second minimist@1.2.2 copy inside bparent/node_modules that the patch never touches. Its index.js matches neither patch hash. Rollback's missing-blob gate probes every physical copy, so it queues a download of the before-blob for that copy. That download goes through the patch API client, and --patch-server-url does not redirect it. The test was therefore fetching from the live patches-api.socket.dev, and the result depended on what that server returned that night.

Fix

This is a test-only change in crates/socket-patch-cli/tests/e2e_bun_lockb.rs:

• rollback_refuses_binary_hosted_pin_then_checkout now passes --api-url <mock> --api-token fake --org <ORG>, as the vendor runs in the same file already do.
• mock_api_patch serves the original index.js at /v0/orgs/{ORG}/patches/blob/{beforeHash}.

With the blob available, the bundled copy reports hash_mismatch and the top-level copy reports already_original. That matches what the test's own comments describe. The assertions are unchanged.

Proof

• Before: failed 12/12 locally.
• After: binary_shared_bundled_record_hosted_pin_is_managed and native_binary_hosted_vendored_takeover_roundtrip passed 10/10 together. The full e2e_bun_lockb --include-ignored suite has 22 passing. The two failures, native_binary_alias_and_transitive (bun install of the fixture fails) and workspace_text_migration_heals_on_rerun, fail identically on unmodified main in this sandbox (local bun 1.4.4, no registry access). They are environmental here and both pass in CI.
• The third caller of the helper, native_binary_alias_and_transitive (its copy_already_original=false path), only runs in the 1.0.36 and 1.1.45 e2e-extended legs. I am dispatching CI on this branch so those legs run.
• cargo clippy -p socket-patch-cli --test e2e_bun_lockb -- -D warnings: clean. cargo fmt was run on the touched file only.

Nothing was removed or moved.

Not in this PR

The other two nightly reds on main (Windows crawler_maven_e2e, macOS e2e_golang_workspace_build) are already fixed by #1852 and #1894, which are waiting for review.

A product question I noticed and did not change here: the rollback blob gate's comment says a locally-drifted copy never needs its blob, but verify_file_rollback checks for the blob before it compares the afterHash. As a result, offline rollback aborts on a drifted or bundled copy. Several unit and integration tests deliberately encode the current behaviour, so changing it needs an owner's decision.

---

Generated by Claude Code

---

Note

Low Risk
Test-only harness changes in e2e_bun_lockb.rs; no product code paths modified.

Overview
Fixes flaky/failing e2e_bun_lockb rollback legs where rollback’s before-blob fetch used the patch API (not --patch-server-url), so tests sometimes hit the live blob service and got missing_blob instead of the expected partialFailure.

rollback_refuses_binary_hosted_pin_then_checkout now passes --api-url, --api-token, and --org to the mock, matching other runs in the same file.

mock_api_patch adds a GET handler for /v0/orgs/{ORG}/patches/blob/{beforeHash} that returns the fixture’s original index.js, so the bundled-layout nested minimist copy can satisfy rollback’s missing-blob gate without leaving the mock server.

Production CLI behavior is unchanged; assertions are unchanged.

^{Reviewed by Cursor Bugbot for commit 6286b0c. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6286b0c. Configure here.}

[Mikola Lysenko (mikolalysenko)]

CI status for head 6286b0c:

• The PR's own CI run (pull_request, run 41259485863) passed, including ci-ok.

• I also dispatched CI on this branch (run 41259490411) so the schedule-only e2e-extended legs would run. All four e2e_bun_lockb legs (1.0.36, 1.1.45, 1.3.14 and 1.4.2) pass. The 1.4.2 leg covers the test that failed on main.

• In that dispatched run, e2e-macos (macos-latest, e2e_redirect_npm_build, 1) failed in npm_agent_keeps_crlf_shebang_of_bin_npm_did_not_link: npm 11 rewrote the CRLF shebang to LF. This failure is not caused by this PR. The diff only touches tests/e2e_bun_lockb.rs, and the same failure is the subject of Fix CRLF bin e2e failing under npm 11 on macOS #1896, which fixes it. I'm not porting that fix here so this PR stays one topic. The leg is not part of the pull_request run, so it doesn't block this PR.

• Also in that dispatched run, test (macos-latest, 2) failed in e2e_golang_workspace_build::apply_never_writes_go_work_when_gowork_names_a_sibling_file. That test has failed on every macOS nightly on main, and Fix Go GOWORK test failing on macOS nightly #1894 fixes it. It is not caused by this PR and is not part of the pull_request run.

• Also in that dispatched run, test (windows-latest, 1) failed in crawler_maven_e2e::get_maven_repo_paths_home_dot_m2_fallback. That test has failed on every Windows nightly on main, and Fix Maven home tests failing on Windows nightly #1852 fixes it. It is not caused by this PR and is not part of the pull_request run.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[burn-down agent] Labeled Ready for review at 6286b0c.

• CI: PR checks green on 6286b0c (ci-ok passes). The dispatched full run's red legs are main-wide, not from this PR: e2e-macos (macos-latest, e2e_redirect_npm_build, 1) (fixed by Fix CRLF bin e2e failing under npm 11 on macOS #1896) and ci-ok from that dispatch. All four e2e_bun_lockb legs pass.
• Bugbot: reviewed 6286b0c, no findings; no unresolved review threads.
• Reviewer note: the diff only touches tests/e2e_bun_lockb.rs; the mock now serves the rollback blob so the test no longer reaches the live API.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does: Test-only fix for the nightly e2e_bun_lockb red. rollback_refuses_binary_hosted_pin_then_checkout downloaded the before-blob for Bun's nested, untouched minimist copy through the patch API, and --patch-server-url doesn't redirect that call, so the test was hitting the live server. The test now passes --api-url/--api-token/--org pointing at the mock, and the mock serves the original index.js blob. The assertions are unchanged.

Risk: low. One test file. The other tests in this file already pass the same flags.

Look here:

• crates/socket-patch-cli/tests/e2e_bun_lockb.rs:156: the added API flags on the rollback call
• crates/socket-patch-cli/tests/e2e_bun_lockb.rs:892: the new blob mock at /v0/orgs/{ORG}/patches/blob/{beforeHash}

Verified: Read the full diff. The blob route matches the client's /v0/orgs/<org>/patches/blob/<hash> path. The PR's CI run is green (ci-ok and clippy pass). The author's workflow_dispatch full run passed all four e2e-extended e2e_bun_lockb legs (1.0.36, 1.1.45, 1.3.14, 1.4.2). That dispatch run is red only on known nightly failures this PR doesn't touch: macOS e2e_redirect_npm_build (fixed by #1896), macOS Go GOWORK (#1894) and a Windows test leg (#1852). Bugbot found no issues on this head. CHANGELOG.md is untouched.

Changes I made: none.

Open questions: the dispatch run left a failed ci-ok check on this head next to the green PR one. If the queue reads the failed one, a re-run of the PR's CI will clear it.

Auto-merge is armed, so approving sends it straight to the merge queue.

---

Generated by Claude Code