Write shared Go patch replaces into go.work

crates/socket-patch-cli/src/commands/scan/hosted.rs

@@ -1867,12 +1867,13 @@ async fn run_redirect_selected_untracked(
     engine_warnings.extend(done.pnpm_warnings.iter().cloned());
     engine_warnings.extend(done.npm_warnings.iter().cloned());
     // A hosted Go `replace` breaks a committed vendor/ directory until
-    // `go mod vendor` re-records it in vendor/modules.txt (#343).
+    // `go mod vendor` (`go work vendor`) re-records it in
+    // vendor/modules.txt (#343).
     if !common.dry_run
         && done
             .rewritten
             .iter()
-            .any(|f| f == "go.mod" || f.ends_with("/go.mod"))
+            .any(|f| f == "go.mod" || f == "go.work" || f.ends_with("/go.mod"))
     {
         for (code, detail) in socket_patch_core::vendor::go_consumer_sync::audit_warnings(
             &common.cwd,
@@ -4304,6 +4305,8 @@ mod tests {
                 "gems.locked",
                 "go.mod",
                 "go.sum",
+                "go.work",
+                "go.work.sum",
                 "pom.xml",
                 ".mvn/maven.config",
                 ".mvn/checksums/checksums.sha256",

crates/socket-patch-cli/src/commands/vex.rs

@@ -958,11 +958,20 @@ async fn generate_vex(
             let socket_patch_core::vendor::go_consumer_sync::GoSyncIssue::Workspace {
                 module,
                 version,
-                ..
+                conflict,
             } = &issue
             else {
                 continue;
             };
+            // Socket's own go.work replace overriding a leftover member pin
+            // is what the build links; it passes its own selection gate
+            // below, like any go.work replace.
+            if matches!(
+                conflict,
+                socket_patch_core::vendor::go_workspace::WorkspaceConflict::WorkHosted { .. }
+            ) {
+                continue;
+            }
             // PurlKey, not string equality: go.mod spells `+incompatible`
             // with a literal `+`, the manifest key with `%2B` (#484). Report
             // each omission under the record's own spelling.
@@ -993,7 +1002,14 @@ async fn generate_vex(
         use socket_patch_core::utils::purl_key::PurlKey;
         use socket_patch_core::vendor::go_build_list::{project_selection, Selection};
         let mut entries = Vec::new();
-        for root in socket_patch_core::vendor::go_workspace::module_roots(&common.cwd).await {
+        let mut roots = socket_patch_core::vendor::go_workspace::module_roots(&common.cwd).await;
+        // A go.work root's own replaces live in its go.work.
+        if !roots.contains(&common.cwd)
+            && socket_patch_core::vendor::go_workspace::root_work_file(&common.cwd).is_some()
+        {
+            roots.push(common.cwd.clone());
+        }
+        for root in roots {
             for entry in socket_patch_core::vendor::go_mod_edit::read_replace_entries(&root).await {
                 entries.push((root.clone(), entry));
             }

crates/socket-patch-cli/tests/e2e_golang_build.rs

@@ -981,7 +981,9 @@ fn go_work_replace_overrides_the_socket_replace() {
 }
 
 /// #458: a go.work that doesn't `use` the project makes every workspace
-/// build ignore the project's go.mod, replace included.
+/// build ignore the project's go.mod, replace included. Run beside that
+/// go.work, apply still refuses: a go.work replace would patch its member,
+/// never the project.
 #[test]
 fn go_work_without_the_project_ignores_its_replace() {
     if !golang_e2e_matrix::toolchain_ready("e2e_golang_build(go-work-not-member)") {
@@ -1005,6 +1007,11 @@ fn go_work_without_the_project_ignores_its_replace() {
     assert_ne!(code, 0, "apply must refuse an ignored replace:\n{so}\n{se}");
     assert!(so.contains("does not `use` this module"), "{so}");
     assert!(replace_lines(&consumer.join("go.mod")).is_empty());
+    assert_eq!(
+        std::fs::read_to_string(consumer.join("go.work")).unwrap(),
+        go_work
+    );
+    assert!(go_out(&svc, &env).contains("OUT: PRISTINE"));
 
     // Applied before the go.work existed.
     std::fs::remove_file(consumer.join("go.work")).unwrap();