From 4a5becbf192c15ca94d542daf8227bc33eeb8f3e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 29 Oct 2026 06:24:55 +0000
Subject: [PATCH 1/4] Start fix for #891

Assisted-by: Claude Code:claude-opus-5-5

From d08036f651cbf8ff5d6e331ab7354cc26adfd2d9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 29 Oct 2026 06:33:02 +0000
Subject: [PATCH 2/4] Preview PyPI vendor refusals in dry runs

`scan --mode vendored --dry-run` and `get --mode vendored --dry-run`
previewed a PyPI package as "would vendor" even when the real run
refuses it, so a CI step gating on the dry run passed and the real
vendoring then failed (#891):

- uv settings that make uv ignore [tool.uv.sources] (`no-sources`,
  `no-sources-package`), on the project lane and the PEP 723 script
  lane, refuse with `pypi_uv_no_sources` in the wet run;
- a symlinked `<script>.py`, `<script>.py.lock`, `pylock.toml` or
  `pylock.<name>.toml` is refused by the commit, but the symlink
  advisory only probed fixed file names.

The preview now runs the PyPI backend's pre-build guards (read-only,
no network) and lists any refusal as would-refuse with the wet run's
code. The symlink advisory, shared with `vendor --dry-run`, also
probes the variable-name lock files and the scripts they pair with.

Assisted-by: Claude Code:claude-opus-5-5
---
 .../src/commands/scan/vendor_flow.rs          | 208 +++++++++++++++++-
 .../socket-patch-cli/src/commands/vendor.rs   |  46 ++--
 crates/socket-patch-core/src/vendor/pypi.rs   |  40 ++++
 3 files changed, 275 insertions(+), 19 deletions(-)

diff --git a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
index 20a35bcc7..793b1b4b0 100644
--- a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
+++ b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
@@ -177,11 +177,13 @@ impl VendorPreview {
 /// [`crate::commands::vlt_preflight`], [`npm_lock_refusal`]) would refuse
 /// before any download, or whose hosted pnpm pin the takeover would fail
 /// to replace ([`hosted_pnpm_refusals`]: the pnpm backend's lock-text
-/// refusal, #853). `origins` are the run's `--patch-server-url` origins.
-/// The preview stays a ledger classification otherwise (engine refusals
-/// outside the preflights are not predicted), and a would-refuse never
-/// flips the run's status or exit code. The preflights (the only disk
-/// access besides the ledger) run only when the selection holds an npm purl.
+/// refusal, #853), and would-refuse for PyPI purls the PyPI backend's
+/// wiring guards refuse ([`pypi_refusals`], #891). `origins` are the
+/// run's `--patch-server-url` origins. The preview stays a ledger
+/// classification otherwise (engine refusals outside the preflights are
+/// not predicted), and a would-refuse never flips the run's status or exit
+/// code. The preflights (the only disk access besides the ledger) run only
+/// when the selection holds an npm or PyPI purl.
 /// `takeover_refusals` adds the hosted→vendored takeover refusals the
 /// caller resolved (the gem gates of
 /// [`crate::commands::vendor::gem_takeover_preview_refusals`]), keyed by
@@ -203,6 +205,7 @@ pub(crate) async fn preview_vendor(
     let npm_lock_refusal = npm_lock_refusal(cwd, selected).await;
     let state = state.unwrap_or_default();
     let pnpm_refusals = hosted_pnpm_refusals(cwd, selected, origins, &state).await;
+    let pypi_refusals = pypi_refusals(cwd, selected, origins).await;
     let refuse = |code: &str, detail: &str| PreviewVerdict::WouldRefuse {
         code: code.to_string(),
         detail: detail.to_string(),
@@ -233,6 +236,10 @@ pub(crate) async fn preview_vendor(
                     let (code, detail) = &takeover_refusals[&p.purl];
                     refuse(code, detail)
                 }
+                _ if pypi_refusals.contains_key(&p.purl) => {
+                    let (code, detail) = &pypi_refusals[&p.purl];
+                    refuse(code, detail)
+                }
                 Some(e) if e.uuid == p.uuid => PreviewVerdict::AlreadyVendored,
                 Some(e) => PreviewVerdict::WouldRevendor {
                     old_uuid: e.uuid.clone(),
@@ -260,6 +267,26 @@ pub(crate) async fn preview_vendor(
     VendorPreview { rows }
 }
 
+/// The PyPI purls of `selected` the vendor backend's prelude refuses
+/// before it builds or downloads anything (the wiring guards a standalone
+/// `vendor --dry-run` already reports, such as `pypi_uv_no_sources`), keyed
+/// by purl (#891). Read-only.
+async fn pypi_refusals(
+    cwd: &Path,
+    selected: &[PatchSearchResult],
+    origins: &[String],
+) -> HashMap<String, (&'static str, String)> {
+    let mut refusals = HashMap::new();
+    for p in selected.iter().filter(|p| p.purl.starts_with("pkg:pypi/")) {
+        if let Some(refusal) =
+            socket_patch_core::vendor::pypi::preview_refusal(&p.purl, cwd, &p.uuid, origins).await
+        {
+            refusals.insert(p.purl.clone(), refusal);
+        }
+    }
+    refusals
+}
+
 /// Fold the vendor engine's envelope into a `scan` / `get` envelope (no
 /// nested envelope): its events — each tagged `details.mode: "vendored"`
 /// — are appended with their summary counts as the engine counted them
@@ -1573,6 +1600,12 @@ mod preview_tests {
     async fn preview_marks_would_refuse_for_refused_bun_tree() {
         let tmp = tempfile::tempdir().unwrap();
         std::fs::write(tmp.path().join("bun.lock"), V1_WORKSPACE_LOCK).unwrap();
+        // A PyPI project the PyPI backend can wire (#891 runs its guards).
+        std::fs::write(
+            tmp.path().join("requirements.txt"),
+            "preview-other==1.0.0\n",
+        )
+        .unwrap();
         let preview = preview_vendor_json(
             tmp.path(),
             &[sel(UUID, NPM), sel(UUID, PYPI)],
@@ -1773,6 +1806,171 @@ mod preview_tests {
             "{preview}"
         );
     }
+    const SIX: &str = "pkg:pypi/six@1.16.0";
+    const TWO: &str = "pkg:pypi/two@2";
+
+    const UV_PYPROJECT: &str = "[project]\nname = \"proj\"\nversion = \"0.1.0\"\n\
+        requires-python = \">=3.10\"\ndependencies = [\"six==1.16.0\"]\n";
+    const UV_LOCK: &str = r#"version = 1
+revision = 3
+requires-python = ">=3.10"
+
+[[package]]
+name = "proj"
+version = "0.1.0"
+source = { virtual = "." }
+dependencies = [
+    { name = "six" },
+]
+
+[package.metadata]
+requires-dist = [{ name = "six", specifier = "==1.16.0" }]
+
+[[package]]
+name = "six"
+version = "1.16.0"
+source = { registry = "https://pypi.org/simple" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254", size = 11053, upload-time = "2021-05-05T14:18:17.237Z" },
+]
+"#;
+    /// A PEP 723 script and the `uv lock --script` lock beside it.
+    const SCRIPT: &str = "# /// script\n# dependencies = [\"two==2\"]\n# ///\nimport two\n";
+    const SCRIPT_NO_SOURCES: &str =
+        "# /// script\n# dependencies = [\"two==2\"]\n#\n# [tool.uv]\n# no-sources = true\n# ///\n";
+    const SCRIPT_LOCK: &str = "version = 1\n[[package]]\nname = \"two\"\nversion = \"2\"\n\
+        source = {registry = \"https://pypi.org/simple\"}\n";
+    /// A PEP 751 lock (`uv export --format pylock.toml`).
+    const PYLOCK: &str = "lock-version = \"1.0\"\ncreated-by = \"uv\"\n\n[[packages]]\n\
+        name = \"two\"\nversion = \"2\"\nwheels = [{url = \"https://example.test/two-2-py3-none-any.whl\", \
+        hashes = {sha256 = \"two\"}}]\n";
+
+    /// #891: the preview runs the PyPI backend's wiring guards, so a uv
+    /// project whose settings make uv ignore `[tool.uv.sources]` previews
+    /// the wet run's `pypi_uv_no_sources` refusal instead of `would_vendor`
+    /// — set in pyproject's `[tool.uv]` or in a uv.toml, as `no-sources` or
+    /// as a `no-sources-package` list naming the package.
+    #[tokio::test]
+    async fn preview_refuses_a_uv_project_that_ignores_sources() {
+        for (file, setting) in [
+            ("pyproject.toml", "no-sources = true"),
+            ("pyproject.toml", "no-sources-package = [\"Six\"]"),
+            ("uv.toml", "no-sources = true"),
+            ("uv.toml", "no-sources-package = [\"six\"]"),
+        ] {
+            let tmp = tempfile::tempdir().unwrap();
+            std::fs::write(tmp.path().join("uv.lock"), UV_LOCK).unwrap();
+            if file == "pyproject.toml" {
+                std::fs::write(
+                    tmp.path().join(file),
+                    format!("{UV_PYPROJECT}\n[tool.uv]\n{setting}\n"),
+                )
+                .unwrap();
+            } else {
+                std::fs::write(tmp.path().join("pyproject.toml"), UV_PYPROJECT).unwrap();
+                std::fs::write(tmp.path().join(file), format!("{setting}\n")).unwrap();
+            }
+            let preview =
+                preview_vendor_json(tmp.path(), &[sel(UUID, SIX)], &[], &HashMap::new()).await;
+            let six = action_of(&preview, SIX);
+            assert_eq!(six["action"], "would_refuse", "{file} {setting}: {preview}");
+            assert_eq!(
+                six["errorCode"], "pypi_uv_no_sources",
+                "{file} {setting}: {preview}"
+            );
+            // Read-only: nothing is wired or vendored.
+            assert_eq!(
+                std::fs::read_to_string(tmp.path().join("uv.lock")).unwrap(),
+                UV_LOCK
+            );
+            assert!(!tmp.path().join(".socket").exists(), "{file} {setting}");
+        }
+        // Control: the same project without the setting previews clean.
+        let tmp = tempfile::tempdir().unwrap();
+        std::fs::write(tmp.path().join("uv.lock"), UV_LOCK).unwrap();
+        std::fs::write(tmp.path().join("pyproject.toml"), UV_PYPROJECT).unwrap();
+        let preview =
+            preview_vendor_json(tmp.path(), &[sel(UUID, SIX)], &[], &HashMap::new()).await;
+        assert_eq!(
+            action_of(&preview, SIX)["action"],
+            "would_vendor",
+            "{preview}"
+        );
+    }
+
+    /// #891: the same refusal on the PEP 723 script lane, where the
+    /// script's own `[tool.uv]` block sets `no-sources`.
+    #[tokio::test]
+    async fn preview_refuses_a_script_lock_that_ignores_sources() {
+        for (script, expected) in [
+            (SCRIPT_NO_SOURCES, Some("pypi_uv_no_sources")),
+            (SCRIPT, None),
+        ] {
+            let tmp = tempfile::tempdir().unwrap();
+            std::fs::write(tmp.path().join("job.py"), script).unwrap();
+            std::fs::write(tmp.path().join("job.py.lock"), SCRIPT_LOCK).unwrap();
+            let preview =
+                preview_vendor_json(tmp.path(), &[sel(UUID, TWO)], &[], &HashMap::new()).await;
+            let two = action_of(&preview, TWO);
+            match expected {
+                Some(code) => {
+                    assert_eq!(two["action"], "would_refuse", "{preview}");
+                    assert_eq!(two["errorCode"], code, "{preview}");
+                }
+                None => assert_eq!(two["action"], "would_vendor", "{preview}"),
+            }
+            assert_eq!(
+                std::fs::read_to_string(tmp.path().join("job.py")).unwrap(),
+                script
+            );
+        }
+    }
+
+    /// #891: the symlink advisory covers the PyPI wiring files whose names
+    /// vary — a PEP 723 script and its lock, and PEP 751 `pylock.toml` /
+    /// `pylock.<name>.toml` — not only the registry's fixed names.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn preview_warns_about_symlinked_variable_name_pypi_files() {
+        for (linked, files) in [
+            (
+                "job.py",
+                &[("job.py", SCRIPT), ("job.py.lock", SCRIPT_LOCK)][..],
+            ),
+            (
+                "job.py.lock",
+                &[("job.py", SCRIPT), ("job.py.lock", SCRIPT_LOCK)][..],
+            ),
+            ("pylock.toml", &[("pylock.toml", PYLOCK)][..]),
+            ("pylock.dev.toml", &[("pylock.dev.toml", PYLOCK)][..]),
+        ] {
+            let tmp = tempfile::tempdir().unwrap();
+            let shared = tempfile::tempdir().unwrap();
+            for (name, text) in files {
+                if *name == linked {
+                    std::fs::write(shared.path().join(name), text).unwrap();
+                    std::os::unix::fs::symlink(shared.path().join(name), tmp.path().join(name))
+                        .unwrap();
+                } else {
+                    std::fs::write(tmp.path().join(name), text).unwrap();
+                }
+            }
+            let preview =
+                preview_vendor_json(tmp.path(), &[sel(UUID, TWO)], &[], &HashMap::new()).await;
+            let two = action_of(&preview, TWO);
+            assert_eq!(two["action"], "would_vendor", "{linked}: {preview}");
+            let warnings = two["warnings"].as_array().cloned().unwrap_or_default();
+            assert!(
+                warnings.iter().any(|w| {
+                    w["code"] == "vendor_would_refuse_symlinked_file"
+                        && w["detail"]
+                            .as_str()
+                            .is_some_and(|d| d.starts_with(&format!("{linked} is a symbolic link")))
+                }),
+                "{linked}: {preview}"
+            );
+        }
+    }
 }
 
 #[cfg(test)]
diff --git a/crates/socket-patch-cli/src/commands/vendor.rs b/crates/socket-patch-cli/src/commands/vendor.rs
index 46488779b..ca0477297 100644
--- a/crates/socket-patch-cli/src/commands/vendor.rs
+++ b/crates/socket-patch-cli/src/commands/vendor.rs
@@ -574,27 +574,45 @@ pub(crate) fn ecosystem_in_scope(common: &GlobalArgs, eco: &str) -> bool {
 /// commit refuses to rename over (`redirect_symlinked_file_unsupported`).
 /// Shared by `vendor --dry-run` and the `scan` / `get --mode vendored`
 /// dry-run preview.
+///
+/// Besides the registry's fixed names, PyPI wires files whose names vary
+/// (#891): every Python lock the backend discovers in the project root
+/// (`pylock.toml`, `pylock.<name>.toml`, a PEP 723 `<script>.py.lock`)
+/// and the `<script>.py` a script lock pairs with.
 pub(crate) fn symlinked_wiring_warnings(cwd: &Path, purl: &str) -> Vec<VendorWarning> {
     let Some(eco) = Ecosystem::from_purl(purl) else {
         return Vec::new();
     };
-    socket_patch_core::utils::group_commit::symlinked_paths(
-        cwd,
-        socket_patch_core::formats::registry::wiring_paths(eco.cli_name()),
-    )
-    .into_iter()
-    .map(|linked| {
-        VendorWarning::new(
-            "vendor_would_refuse_symlinked_file",
-            format!(
-                "{linked} is a symbolic link; a non-dry-run vendor refuses with \
+    let mut paths: Vec<String> = socket_patch_core::formats::registry::wiring_paths(eco.cli_name())
+        .into_iter()
+        .map(str::to_string)
+        .collect();
+    if eco == Ecosystem::Pypi {
+        for lock in
+            socket_patch_core::utils::python_lock::python_lock_paths(cwd).unwrap_or_default()
+        {
+            let script = lock.strip_suffix(".lock").filter(|s| s.ends_with(".py"));
+            for path in script.map(str::to_string).into_iter().chain([lock]) {
+                if !paths.contains(&path) {
+                    paths.push(path);
+                }
+            }
+        }
+    }
+    socket_patch_core::utils::group_commit::symlinked_paths(cwd, paths.iter().map(String::as_str))
+        .into_iter()
+        .map(|linked| {
+            VendorWarning::new(
+                "vendor_would_refuse_symlinked_file",
+                format!(
+                    "{linked} is a symbolic link; a non-dry-run vendor refuses with \
                  redirect_symlinked_file_unsupported if it must rewrite it (an atomic \
                  rename would replace the link) — replace the link with a regular file, \
                  or run socket-patch in the directory it points to"
-            ),
-        )
-    })
-    .collect()
+                ),
+            )
+        })
+        .collect()
 }
 
 /// A hosted-restore advisory as a takeover reports it. The gem stale-cache
diff --git a/crates/socket-patch-core/src/vendor/pypi.rs b/crates/socket-patch-core/src/vendor/pypi.rs
index a033717ce..2417ee0f8 100644
--- a/crates/socket-patch-core/src/vendor/pypi.rs
+++ b/crates/socket-patch-core/src/vendor/pypi.rs
@@ -1948,6 +1948,46 @@ pub(crate) async fn service_preflight(
     })
 }
 
+/// The refusal a vendor of `purl` (patch `uuid`) would raise before it
+/// builds, downloads or writes anything: the flavor routing and every
+/// wiring guard of [`pypi_prelude`], run as a dry run. `None` when the
+/// prelude gets past them (or answers in sync).
+///
+/// The `scan` / `get --mode vendored --dry-run` preview has no patch
+/// record yet (nothing is downloaded), so the prelude sees one with no
+/// files: none of its refusals reads them. `hosted_origins` are the run's
+/// patch-server origins, as the wet run passes them (#891).
+pub async fn preview_refusal(
+    purl: &str,
+    project_root: &Path,
+    uuid: &str,
+    hosted_origins: &[String],
+) -> Option<(&'static str, String)> {
+    let record = PatchRecord {
+        uuid: uuid.to_string(),
+        exported_at: String::new(),
+        files: std::collections::HashMap::new(),
+        vulnerabilities: std::collections::HashMap::new(),
+        description: String::new(),
+        license: String::new(),
+        tier: String::new(),
+    };
+    match pypi_prelude(
+        purl,
+        project_root,
+        &record,
+        true,
+        &tokio::sync::OnceCell::new(),
+        &InstalledSiteListings::default(),
+        hosted_origins,
+    )
+    .await
+    {
+        Err(VendorOutcome::Refused { code, detail }) => Some((code, detail)),
+        _ => None,
+    }
+}
+
 #[allow(clippy::too_many_arguments)]
 pub async fn vendor_pypi_with_pipenv_version<'a>(
     purl: &str,

From d70cf3f9b803070611c3bdaa11c5dc80bb104274 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 29 Oct 2026 06:33:02 +0000
Subject: [PATCH 3/4] Document PyPI refusals in the vendored preview

Assisted-by: Claude Code:claude-opus-5-5
---
 crates/socket-patch-cli/CLI_CONTRACT.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 54bf2197c..74d12bc3b 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -319,7 +319,7 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 * **Hosted and vendored mode (bare `scan` included) — project directories** (`run_project_dirs`). Each PATH is a directory, or a glob (`*?[`) matching directories, relative to `--cwd`; the set is sorted and deduplicated, and each directory is scanned on its own exactly as if it were `--cwd` (its own lockfiles, ledgers and `.socket/`). With more than one directory, each run is headed `== <dir> ==` on stdout (unless `--silent`), and the exit code is the worst of the runs. Usage errors (exit 2, stderr only, before any scan): a PATH that is not a directory (`` `X` is not a directory``), a glob matching no directory (`` `X` matches no directory``), an invalid glob, and `--json` with more than one directory (`--json takes one project directory (N given); run one scan per directory`), so stdout stays one document. Likewise `--vex` with more than one directory (`--vex takes one project directory (N given); run one scan per directory`): the one output path would be overwritten by each run.
 * **Agent mode (and a mode-less `--prune`/`--global` report) — installed-path globs** scoping DISCOVERY at the **purl level**: a package is in scope iff ANY of its crawled installed copies sits under a matching path (every copy, enumerated the way `rollback`'s path targets enumerate them: any package link in a `node_modules` root, such as a pnpm workspace member's link into the root `.pnpm` store (or npm's linked `.store`), alias links included (`packages/a/node_modules/lp` for `"lp": "npm:left-pad@1.3.0"`, matched by its target's own `package.json` name@version), and a nested member copy count, not just the one copy the crawl records per purl), and a selected package is then handled with ALL its copies (scoping selects which packages are considered, never which copies). Glob semantics (shared with `rollback`'s path targets, `src/path_scope.rs`): Unix-shell globs with `require_literal_separator` — `*`/`?` never cross a `/`, `**` spans directories; a pattern matching any **ancestor** directory of the copy path also matches, so a bare `scan packages/foo` scopes the whole subtree without `/**`; relative patterns match against the copy path relativized to `--cwd`, absolute patterns against the absolute path (the ONLY way to reach paths outside the project tree, e.g. `--global` stores — a relative pattern never matches outside `--cwd`); leading `./` and trailing `/` are normalized away, matching is purely textual (no filesystem access or symlink resolution), case-sensitive except on Windows (whose filesystems are not); an unparseable or empty pattern is a usage error (exit 2). **The prune universe is never narrowed**: the path filter is applied strictly AFTER the `scanned_purls` capture (and after `--ecosystems`), so `scan PATHS --prune` prunes exactly what an unscoped `scan --prune` would — a scoped scan can never treat an out-of-scope package as uninstalled (the same fail-safe as the `--ecosystems` filter). Lockfile-only and vendor-ledger supplement records have no installed path and are EXCLUDED from a path-scoped scan, surfaced as one run-level `path_scope_excluded_supplements` warning carrying the count. A scope matching nothing is a normal empty scan — exit 0, zero packages, **no GC** (the zero-package early return fires before any GC). `PATHS` combine with `--mode agent`/`--sync`/`--prune`/`--global`. Every scan JSON envelope past the argument checks (success, zero-package, all-batches-failed) carries a `paths` key echoing the patterns verbatim (empty array when unscoped; a hosted/vendored per-directory run is unscoped, so it is `[]`). One-sentence duality rule: **a target that selects nothing is an error on `rollback` (exit 1) and an empty scan on an agent-mode `scan` (exit 0)**.
 
-`scan --mode vendored` swaps the in-place apply for the vendor pipeline: discover → download the selected patch records **into memory** (no manifest write) → vendor every selected dependency via the same engine as the `vendor` command (under the same lock). Vendored mode is **manifest-free (v5.0)**: `.socket/manifest.json` is never written or read by a vendored run; each ledger entry carries `detached: true` plus an embedded copy of the patch record (`record`) as its verification source, and the run's footprint is `.socket/vendor/**` only. The vendor step's scope is what discovery selected — the former "whole manifest is vendored" re-vendor on an empty discovery is retired (`repair` verifies and redownloads committed vendored state; `scan --prune` reconciles ledger entries whose dependency left the lockfile). The vendor-ledger discovery supplement (the fresh-clone rule: a ledger entry with no installed copy stays discoverable because its committed artifact IS the dependency) holds only while the lockfile still resolves through that artifact: an entry the lockfile in-use probe (the one `--prune` reverts by) proves unwired, because the dependency was upgraded or removed, is NOT discovered and so is never re-vendored. A run without a non-hosted `--prune` reports it through the run-level `vendor_ledger_entry_unwired` warning; a `--prune` run reverts it in its GC and exits 0. That GC runs even when the crawl found no packages, as its vendored half alone (the manifest prune stays skipped there). A package the ledger holds at an older patch uuid is still **re-vendored automatically** when discovery selects the newer patch (its old uuid dir is removed — `vendor_stale_artifact_removed`) — unless the patch service has no prebuilt artifact for the newer patch yet (or at all): the package then keeps the older patch and is a `skipped` `vendor_prebuilt_pending` / `vendor_prebuilt_unavailable` event, not a failure, in every ecosystem (#954, #1235); same-uuid re-runs reuse the embedded record, skip the patch-view fetch, and are `already_vendored` skips. **Legacy manifest-mode entries**: when a vendored run vendors a purl that also has a `.socket/manifest.json` record (a project vendored by a pre-5.0 binary, or by standalone `vendor` from an agent-mode manifest), that manifest record is dropped in the same run — the ledger becomes the owner (migration write); an emptied manifest is left as `{"patches": {}}`, never deleted. The migration is reported through the run-level `warnings[]` (stderr in human mode), never as a run error: `vendor_manifest_record_migrated` (`N manifest records moved to the vendor ledger (vendored mode is manifest-free): <purls>`) or `vendor_manifest_migration_failed` (the manifest or the ledger could not be read or rewritten; the legacy records were left in place) — so a corrupt `.socket/manifest.json` no longer fails a vendored run (standalone `vendor`, the one manifest-driven writer, still fails closed on it). With `--prune`, GC runs **after** the vendor step (the step never reads the manifest, and running the sweep last lets it reclaim what the run itself orphaned — a migrated legacy record's blobs, a superseded uuid dir). Under `--json` (v5.0, MAJOR) the download phase and the vendor engine record into the ONE scan envelope (no nested `download` / `vendor` objects): a fetched patch is a `downloaded` event (the patch metadata in `details`, plus `details.oldUuid` when the ledger holds the purl at another uuid — the re-vendor the vendor step then performs — whose human `[fetch]` line reads `<purl> (replacing <short uuid>)`), a refused or failed one a `failed` event with its code, a patch the ledger already holds at the selected uuid no download event at all (reused, no fetch); then the vendor engine's events (`applied`, `rebuilt`, `skipped`, `failed`, `removed`, its uncounted advisories) follow with their warnings and sidecars. Every one of these events carries `details.mode: "vendored"`. Patch blobs are held in memory (see "Patch sources stay in memory" under the vendor contract). `--dry-run` previews per patch: `verified` (to vendor; `oldUuid` on a re-vendor), `skipped` / `already_vendored` (in sync), or `skipped` with the refusal code for an npm purl the wet run's Bun preflight (see the `get --mode vendored` bullet below) would refuse, or whose hosted pnpm pin the takeover would be refused on (see "Takeover reconciliation") — without network downloads or disk writes; the preview never flips status or exit (the human path — `scan` and `get` alike, through one shared printer — prints `[would-refuse] <purl> (<code>): <detail>` lines behind the `--silent` gate). Interactive mode prompts "Download and vendor N patches?" (singular for one).
+`scan --mode vendored` swaps the in-place apply for the vendor pipeline: discover → download the selected patch records **into memory** (no manifest write) → vendor every selected dependency via the same engine as the `vendor` command (under the same lock). Vendored mode is **manifest-free (v5.0)**: `.socket/manifest.json` is never written or read by a vendored run; each ledger entry carries `detached: true` plus an embedded copy of the patch record (`record`) as its verification source, and the run's footprint is `.socket/vendor/**` only. The vendor step's scope is what discovery selected — the former "whole manifest is vendored" re-vendor on an empty discovery is retired (`repair` verifies and redownloads committed vendored state; `scan --prune` reconciles ledger entries whose dependency left the lockfile). The vendor-ledger discovery supplement (the fresh-clone rule: a ledger entry with no installed copy stays discoverable because its committed artifact IS the dependency) holds only while the lockfile still resolves through that artifact: an entry the lockfile in-use probe (the one `--prune` reverts by) proves unwired, because the dependency was upgraded or removed, is NOT discovered and so is never re-vendored. A run without a non-hosted `--prune` reports it through the run-level `vendor_ledger_entry_unwired` warning; a `--prune` run reverts it in its GC and exits 0. That GC runs even when the crawl found no packages, as its vendored half alone (the manifest prune stays skipped there). A package the ledger holds at an older patch uuid is still **re-vendored automatically** when discovery selects the newer patch (its old uuid dir is removed — `vendor_stale_artifact_removed`) — unless the patch service has no prebuilt artifact for the newer patch yet (or at all): the package then keeps the older patch and is a `skipped` `vendor_prebuilt_pending` / `vendor_prebuilt_unavailable` event, not a failure, in every ecosystem (#954, #1235); same-uuid re-runs reuse the embedded record, skip the patch-view fetch, and are `already_vendored` skips. **Legacy manifest-mode entries**: when a vendored run vendors a purl that also has a `.socket/manifest.json` record (a project vendored by a pre-5.0 binary, or by standalone `vendor` from an agent-mode manifest), that manifest record is dropped in the same run — the ledger becomes the owner (migration write); an emptied manifest is left as `{"patches": {}}`, never deleted. The migration is reported through the run-level `warnings[]` (stderr in human mode), never as a run error: `vendor_manifest_record_migrated` (`N manifest records moved to the vendor ledger (vendored mode is manifest-free): <purls>`) or `vendor_manifest_migration_failed` (the manifest or the ledger could not be read or rewritten; the legacy records were left in place) — so a corrupt `.socket/manifest.json` no longer fails a vendored run (standalone `vendor`, the one manifest-driven writer, still fails closed on it). With `--prune`, GC runs **after** the vendor step (the step never reads the manifest, and running the sweep last lets it reclaim what the run itself orphaned — a migrated legacy record's blobs, a superseded uuid dir). Under `--json` (v5.0, MAJOR) the download phase and the vendor engine record into the ONE scan envelope (no nested `download` / `vendor` objects): a fetched patch is a `downloaded` event (the patch metadata in `details`, plus `details.oldUuid` when the ledger holds the purl at another uuid — the re-vendor the vendor step then performs — whose human `[fetch]` line reads `<purl> (replacing <short uuid>)`), a refused or failed one a `failed` event with its code, a patch the ledger already holds at the selected uuid no download event at all (reused, no fetch); then the vendor engine's events (`applied`, `rebuilt`, `skipped`, `failed`, `removed`, its uncounted advisories) follow with their warnings and sidecars. Every one of these events carries `details.mode: "vendored"`. Patch blobs are held in memory (see "Patch sources stay in memory" under the vendor contract). `--dry-run` previews per patch: `verified` (to vendor; `oldUuid` on a re-vendor), `skipped` / `already_vendored` (in sync), or `skipped` with the refusal code for an npm purl the wet run's Bun preflight (see the `get --mode vendored` bullet below) would refuse, or whose hosted pnpm pin the takeover would be refused on (see "Takeover reconciliation"), or for a PyPI purl the PyPI vendored backend's wiring guards would refuse before building anything (the project routing and lock guards a standalone `vendor --dry-run` reports, such as `pypi_no_requirements` or `pypi_uv_no_sources`, on the project lane and the PEP 723 script lane alike, #891) — without network downloads or disk writes; the preview never flips status or exit (the human path — `scan` and `get` alike, through one shared printer — prints `[would-refuse] <purl> (<code>): <detail>` lines behind the `--silent` gate). Interactive mode prompts "Download and vendor N patches?" (singular for one).
 
 **Vendored entries and the rest of the CLI.** Because nothing is in the manifest, vendored patches are invisible to `apply` (nothing to apply in place) but fully visible to `list` (listed from the ledger, labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode, exit 0 on a vendored-only project), `vex` (attested from the embedded records while a lockfile still wires the artifact — see "Manifest-less VEX"), `repair` (health-checked and rebuilt from the ledger), and `scan --prune` (lockfile-driven reconcile). They are exempt from standalone `vendor`'s manifest reconcile (`reconcile_dropped` never touches `detached` entries) and exit via `remove <purl>` (which reverts them), `vendor --revert`, or `rollback`, whose vendored leg reverts every in-scope ledger entry (unscoped and identifier-scoped runs; path-scoped runs reach them only when an installed copy matches).
 
@@ -1568,7 +1568,7 @@ command's integration tests check its output.
 | `path_scope_excluded_supplements` | scan `warnings[]` | path-scoped scan (v5.0): lockfile-only / vendor-ledger supplement packages have no installed path and were excluded from the scoped scan; the detail carries the count. |
 | `vendor_commit_failed` | top-level error (`vendor`, and the nested vendor envelope of `scan` / `get --mode vendored`); also `failed` (per package) | v5.0 group commit: the run's lockfile / manifest / ledger edits could not be written (the detail names the I/O error). Exit 1; the project's lockfiles and `.socket/vendor/state.json` are left as they were before the run (a partially-applied commit is put back). As for `redirect_symlinked_file_unsupported` (#898), the artifact dirs the run added under `.socket/vendor/` are removed (any that cannot be are named in the detail), each package the run vendored is a `failed` event with this code, not `applied`, its `skipped` advisories from the run are dropped, and the human run prints no "Vendored N packages" count for them and no "Next steps:". When putting a partially-applied commit back fails too, the journal is kept instead, the detail says the next socket-patch command in the project finishes the commit, and the per-package events stand (that commit does complete). |
 | `redirect_symlinked_file_unsupported` (vendored) | top-level error (`vendor`, and the nested vendor envelope of `scan` / `get --mode vendored`) | v5.0 group commit (#627): a file the run would rewrite — a lockfile, `package.json`, `pnpm-workspace.yaml`, `nuget.config`, … — is a symbolic link. The commit stages each file and renames it over the path, which would replace the link with a detached copy and leave its target (the lock other checkouts read) unpatched, so it refuses before writing anything — the same code and message as the hosted guard. Exit 1; the link, its target and `.socket/vendor/state.json` are left as they were, the artifact dirs the run added under `.socket/vendor/` are removed (any that cannot be are named in the message, with `vendor --revert` as the remedy), and each package the run vendored is a `failed` event with this code, not `applied` (`summary.applied` does not count it); the `skipped` advisories the run recorded for it (`vendor_prebuilt_downloaded`, `vendor_artifact_reused`, …) are dropped, since they describe the vendoring that was refused. The human run prints no "Vendored N packages" count for them and no "Next steps:" (#898). Backends that check their own targets first (Hatch, uv, Poetry, PDM, Pipenv, requirements, PEP 751 locks, Cargo) refuse per package with this same code (see the per-package row below); a symlinked `bun.lockb` keeps `vendor_bun_lockb_invalid`. |
-| `vendor_would_refuse_symlinked_file` | `skipped` (advisory event) under `vendor --dry-run`; a top-level `warnings[]` entry (detail prefixed `<purl>: `) for each package the `scan` / `get --mode vendored --dry-run` preview would vendor (human: an `[warning] <purl> (<code>): <detail>` line) | dry run (#627): a dry run captures no writes, so for each package it would vendor (not one previewed as in sync, whose re-run writes nothing) it names every symlinked file of that package's ecosystem a vendored run may rewrite (the registry's vendored rewrite targets plus `pnpm-workspace.yaml`, `nuget.config`, `packages.lock.json`, the root `pom.xml`, `.mvn/maven.config` and `hatch.toml`; files a vendored run only reads, such as `.yarnrc.yml` or `vlt.json`, are never named); the wet run refuses with `redirect_symlinked_file_unsupported` if it must rewrite one. Does not change the exit code. |
+| `vendor_would_refuse_symlinked_file` | `skipped` (advisory event) under `vendor --dry-run`; a top-level `warnings[]` entry (detail prefixed `<purl>: `) for each package the `scan` / `get --mode vendored --dry-run` preview would vendor (human: an `[warning] <purl> (<code>): <detail>` line) | dry run (#627): a dry run captures no writes, so for each package it would vendor (not one previewed as in sync, whose re-run writes nothing) it names every symlinked file of that package's ecosystem a vendored run may rewrite (the registry's vendored rewrite targets plus `pnpm-workspace.yaml`, `nuget.config`, `packages.lock.json`, the root `pom.xml`, `.mvn/maven.config` and `hatch.toml`; for PyPI also every variable-name lock in the project root — `pylock.toml`, `pylock.<name>.toml`, a PEP 723 `<script>.py.lock` — and the `<script>.py` a script lock pairs with, #891; files a vendored run only reads, such as `.yarnrc.yml` or `vlt.json`, are never named); the wet run refuses with `redirect_symlinked_file_unsupported` if it must rewrite one. Does not change the exit code. |
 | `vendor_state_unreadable` | rollback `warnings[]`; remove top-level error | corrupt-ledger containment (v5.0). Rollback: an unreadable vendor ledger skips the vendored leg + manifest cleanup + GC and drives `partialFailure` exit 1 while the agent and hosted legs still run. Remove: a hard top-level error before any mutation. Also the Bun vendored preflight's refusal code: `get` / `scan --mode vendored`, `vendor`'s pre-takeover check and the `--dry-run` `would_refuse` preview report an unreadable `.socket/vendor/state.json` as itself (the `errorCode` of the package's event, or `get <uuid>`'s top-level `error.code`), fail-closed — nothing is exempt — instead of a Bun lock code. (v4's `redirect_state_unreadable` is no longer emitted: v5 never reads the redirect ledger on these paths.) |
 | `manifest_write_failed`   | rollback `warnings[]` | rollback (v5.0): the post-rollback manifest update could not be written; no entries were removed (no `removed` event) and the run exits `partialFailure` 1. |
 | `npm_allow_remote_left` / `pnpm_trust_lockfile_left` | rollback/remove `warnings[]`; vendor advisory event (takeover) | upstream restore (v5.0): no npm-family lock entry is hosted any more, but the project `.npmrc` keeps a top-level `allow-remote=all` (resp. `pnpm-workspace.yaml` keeps `trustLockfile: true`) in a file that is not exactly what hosted mode creates; the file is left untouched (v5 records no provenance), remove the line if nothing else needs it. A file that is exactly hosted mode's own is deleted silently, and a file that is a keyless document plus exactly the `packages:` scaffold and `trustLockfile: true` lines hosted mode splices into one (#1096) gets those lines removed, restoring it byte for byte. |
@@ -1612,7 +1612,7 @@ command's integration tests check its output.
 | `vendor_bun_workspace_unsupported` | `failed` | vendor / scan / get `--mode vendored` (bun): the text lock holds `workspace:` packages and its `lockfileVersion` is below 2 — Bun 1.2–1.3 resolve a workspace member's local-tarball path relative to the member; a committed version-2 lock is the proof every consumer runs Bun ≥ 1.4 (deliberate over-approximation: root-only declared packages would install on version 1 too). Detail names the version integer and a version-specific remedy: delete `bun.lock` and re-lock with Bun ≥ 1.4 (an in-place `bun install` keeps the existing version) — then, for a version-1 lock, "or use `--mode hosted`, which accepts version-1 workspace locks"; for a version-0 lock, "or delete `bun.lock`, re-lock with Bun ≥ 1.2 (which writes lockfileVersion 1) and use `--mode hosted`" (hosted refuses version-0 workspace locks, so a bare hosted pointer would send the user into a second refusal). Refused before any write — in the pre-download preflight on `get`/`scan` (see `vendor_bun_lockb_invalid` for the placements); in the shared preflight that `vendor` and the vendor step run BEFORE a hosted → vendored takeover's revert (a hosted-redirected purl stays hosted-wired, ledger and lock untouched; `vendor --dry-run` previews the same `failed` code); and in the engine when the run would write a NEW local tuple. Exempt: purls the vendor ledger wires at the selected uuid, purls whose every `bun.lock` instance is already a `.socket/vendor/npm/` tuple (any uuid), in-sync re-runs and `repair` redownloads. |
 | `vendor_lockfile_missing` / `vendor_lockfile_version_unsupported` (bun preflight placement) | `failed` | scan / get `--mode vendored` (bun): the pre-download preflight found `bun.lock` unreadable / at a `lockfileVersion` other than 0, 1 or 2 (a newer version: update socket-patch; no integer: re-lock with Bun ≥ 1.2 — the same text as hosted's `redirect_bun_lock_unsupported`) or outside bun's single-line `packages` grammar. Same placements as `vendor_bun_lockb_invalid`; nothing fetched, no patch record. An unreadable `.socket/vendor/state.json` met by the same preflight is `vendor_state_unreadable` (see that row), never one of these. |
 | `bun_lockb_invalid` | scan `warnings[]` (run-level) | scan (every mode): the native binary inventory could not parse or read `bun.lockb`; detail names the format or filesystem error. Also printed as `Warning: …` on stderr. Exit and status remain unchanged. The warning is retained on empty and non-empty scans; valid binary locks are inventoried normally without a runtime or install. |
-| (Bun / pnpm-takeover refusal codes) | `skipped` (dry-run preview, `details.mode: "vendored"`) | scan `--mode vendored --dry-run` / get `--mode vendored --dry-run`: the wet run's Bun preflight would refuse this npm purl (`errorCode` one of the four Bun lock codes above, or `vendor_state_unreadable` for an unreadable vendor ledger), or the pnpm backend would refuse the takeover of its hosted pin (`errorCode` that backend's lock-text code, #853); `reason` carries the detail. Exit 0 / `status: "success"`, nothing written. (v5.0: replaces the `would_refuse` preview action.) |
+| (Bun / pnpm-takeover / PyPI refusal codes) | `skipped` (dry-run preview, `details.mode: "vendored"`) | scan `--mode vendored --dry-run` / get `--mode vendored --dry-run`: the wet run's Bun preflight would refuse this npm purl (`errorCode` one of the four Bun lock codes above, or `vendor_state_unreadable` for an unreadable vendor ledger), or the pnpm backend would refuse the takeover of its hosted pin (`errorCode` that backend's lock-text code, #853), or the PyPI vendored backend's wiring guards would refuse this PyPI purl (`errorCode` that backend's code, #891); `reason` carries the detail. Exit 0 / `status: "success"`, nothing written. (v5.0: replaces the `would_refuse` preview action.) |
 | `cargo_wiring_migrated` | `skipped` (advisory note) | vendor / scan / get `--mode vendored` / repair (v5.0): a pre-v5 `.cargo/config.toml` / `.cargo/config` vendored `[patch.crates-io]` entry was moved into the workspace-root `Cargo.toml` (dry run: "would move"); the ledger entry is rewritten to name `Cargo.toml` (lock originals kept). A vendor re-run that migrates reports the package `applied`, not `already_vendored`. |
 | `cargo_legacy_wiring_kept` | vendor: `failed`; repair: `skipped` (warning) | vendor / scan / get `--mode vendored` (v5.0): the pre-v5 config entry could not be removed after the manifest took the wiring — the run is unwound (manifest, lock and copy as before) and the package fails, since a kept entry would double-wire the crate and, on a uuid bump, point at a copy the stale sweep deletes; the code prefixes the error detail. repair: the move was refused (e.g. an unparseable `Cargo.toml`, a user entry for the crate, or an unremovable legacy entry — the manifest edit is unwound); left in place. |
 | `cargo_version_tagged` | `skipped` (advisory note) | vendor / scan / get `--mode vendored` / repair (v5.0): a vendored copy and its detached Cargo.lock entry were (re)tagged `<version>+socket.<uuid>` — a copy vendored before tagged versions, or a lock entry tagged for another uuid while the wiring points at this copy (dry run: "would tag"). A vendor re-run that tags reports the package `applied`. |

From e5bf5da3bc2b76f6d7b2849c9cffc157ef32e0d2 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 29 Oct 2026 06:59:28 +0000
Subject: [PATCH 4/4] Skip hosted PyPI pins in the vendored preview

A PyPI package with a live hosted pin is restored to its upstream pin
before the vendored backend runs, so judging the still-hosted
requirements.txt, Pipfile.lock or uv.lock would preview a refusal
(such as `pypi_requirement_not_pinned`) the real run never raises.
The preview now leaves those packages as "would vendor", like the
takeovers of other ecosystems.

The preview also probes the Pipenv release and lists site-packages
once per run instead of once per package, and skips packages the
takeover gates already refuse.

Assisted-by: Claude Code:claude-opus-5-5
---
 crates/socket-patch-cli/CLI_CONTRACT.md       |  2 +-
 .../src/commands/scan/vendor_flow.rs          | 80 ++++++++++++++-----
 crates/socket-patch-core/src/vendor/pypi.rs   | 71 ++++++++--------
 3 files changed, 102 insertions(+), 51 deletions(-)

diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 74d12bc3b..af828cf20 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -319,7 +319,7 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 * **Hosted and vendored mode (bare `scan` included) — project directories** (`run_project_dirs`). Each PATH is a directory, or a glob (`*?[`) matching directories, relative to `--cwd`; the set is sorted and deduplicated, and each directory is scanned on its own exactly as if it were `--cwd` (its own lockfiles, ledgers and `.socket/`). With more than one directory, each run is headed `== <dir> ==` on stdout (unless `--silent`), and the exit code is the worst of the runs. Usage errors (exit 2, stderr only, before any scan): a PATH that is not a directory (`` `X` is not a directory``), a glob matching no directory (`` `X` matches no directory``), an invalid glob, and `--json` with more than one directory (`--json takes one project directory (N given); run one scan per directory`), so stdout stays one document. Likewise `--vex` with more than one directory (`--vex takes one project directory (N given); run one scan per directory`): the one output path would be overwritten by each run.
 * **Agent mode (and a mode-less `--prune`/`--global` report) — installed-path globs** scoping DISCOVERY at the **purl level**: a package is in scope iff ANY of its crawled installed copies sits under a matching path (every copy, enumerated the way `rollback`'s path targets enumerate them: any package link in a `node_modules` root, such as a pnpm workspace member's link into the root `.pnpm` store (or npm's linked `.store`), alias links included (`packages/a/node_modules/lp` for `"lp": "npm:left-pad@1.3.0"`, matched by its target's own `package.json` name@version), and a nested member copy count, not just the one copy the crawl records per purl), and a selected package is then handled with ALL its copies (scoping selects which packages are considered, never which copies). Glob semantics (shared with `rollback`'s path targets, `src/path_scope.rs`): Unix-shell globs with `require_literal_separator` — `*`/`?` never cross a `/`, `**` spans directories; a pattern matching any **ancestor** directory of the copy path also matches, so a bare `scan packages/foo` scopes the whole subtree without `/**`; relative patterns match against the copy path relativized to `--cwd`, absolute patterns against the absolute path (the ONLY way to reach paths outside the project tree, e.g. `--global` stores — a relative pattern never matches outside `--cwd`); leading `./` and trailing `/` are normalized away, matching is purely textual (no filesystem access or symlink resolution), case-sensitive except on Windows (whose filesystems are not); an unparseable or empty pattern is a usage error (exit 2). **The prune universe is never narrowed**: the path filter is applied strictly AFTER the `scanned_purls` capture (and after `--ecosystems`), so `scan PATHS --prune` prunes exactly what an unscoped `scan --prune` would — a scoped scan can never treat an out-of-scope package as uninstalled (the same fail-safe as the `--ecosystems` filter). Lockfile-only and vendor-ledger supplement records have no installed path and are EXCLUDED from a path-scoped scan, surfaced as one run-level `path_scope_excluded_supplements` warning carrying the count. A scope matching nothing is a normal empty scan — exit 0, zero packages, **no GC** (the zero-package early return fires before any GC). `PATHS` combine with `--mode agent`/`--sync`/`--prune`/`--global`. Every scan JSON envelope past the argument checks (success, zero-package, all-batches-failed) carries a `paths` key echoing the patterns verbatim (empty array when unscoped; a hosted/vendored per-directory run is unscoped, so it is `[]`). One-sentence duality rule: **a target that selects nothing is an error on `rollback` (exit 1) and an empty scan on an agent-mode `scan` (exit 0)**.
 
-`scan --mode vendored` swaps the in-place apply for the vendor pipeline: discover → download the selected patch records **into memory** (no manifest write) → vendor every selected dependency via the same engine as the `vendor` command (under the same lock). Vendored mode is **manifest-free (v5.0)**: `.socket/manifest.json` is never written or read by a vendored run; each ledger entry carries `detached: true` plus an embedded copy of the patch record (`record`) as its verification source, and the run's footprint is `.socket/vendor/**` only. The vendor step's scope is what discovery selected — the former "whole manifest is vendored" re-vendor on an empty discovery is retired (`repair` verifies and redownloads committed vendored state; `scan --prune` reconciles ledger entries whose dependency left the lockfile). The vendor-ledger discovery supplement (the fresh-clone rule: a ledger entry with no installed copy stays discoverable because its committed artifact IS the dependency) holds only while the lockfile still resolves through that artifact: an entry the lockfile in-use probe (the one `--prune` reverts by) proves unwired, because the dependency was upgraded or removed, is NOT discovered and so is never re-vendored. A run without a non-hosted `--prune` reports it through the run-level `vendor_ledger_entry_unwired` warning; a `--prune` run reverts it in its GC and exits 0. That GC runs even when the crawl found no packages, as its vendored half alone (the manifest prune stays skipped there). A package the ledger holds at an older patch uuid is still **re-vendored automatically** when discovery selects the newer patch (its old uuid dir is removed — `vendor_stale_artifact_removed`) — unless the patch service has no prebuilt artifact for the newer patch yet (or at all): the package then keeps the older patch and is a `skipped` `vendor_prebuilt_pending` / `vendor_prebuilt_unavailable` event, not a failure, in every ecosystem (#954, #1235); same-uuid re-runs reuse the embedded record, skip the patch-view fetch, and are `already_vendored` skips. **Legacy manifest-mode entries**: when a vendored run vendors a purl that also has a `.socket/manifest.json` record (a project vendored by a pre-5.0 binary, or by standalone `vendor` from an agent-mode manifest), that manifest record is dropped in the same run — the ledger becomes the owner (migration write); an emptied manifest is left as `{"patches": {}}`, never deleted. The migration is reported through the run-level `warnings[]` (stderr in human mode), never as a run error: `vendor_manifest_record_migrated` (`N manifest records moved to the vendor ledger (vendored mode is manifest-free): <purls>`) or `vendor_manifest_migration_failed` (the manifest or the ledger could not be read or rewritten; the legacy records were left in place) — so a corrupt `.socket/manifest.json` no longer fails a vendored run (standalone `vendor`, the one manifest-driven writer, still fails closed on it). With `--prune`, GC runs **after** the vendor step (the step never reads the manifest, and running the sweep last lets it reclaim what the run itself orphaned — a migrated legacy record's blobs, a superseded uuid dir). Under `--json` (v5.0, MAJOR) the download phase and the vendor engine record into the ONE scan envelope (no nested `download` / `vendor` objects): a fetched patch is a `downloaded` event (the patch metadata in `details`, plus `details.oldUuid` when the ledger holds the purl at another uuid — the re-vendor the vendor step then performs — whose human `[fetch]` line reads `<purl> (replacing <short uuid>)`), a refused or failed one a `failed` event with its code, a patch the ledger already holds at the selected uuid no download event at all (reused, no fetch); then the vendor engine's events (`applied`, `rebuilt`, `skipped`, `failed`, `removed`, its uncounted advisories) follow with their warnings and sidecars. Every one of these events carries `details.mode: "vendored"`. Patch blobs are held in memory (see "Patch sources stay in memory" under the vendor contract). `--dry-run` previews per patch: `verified` (to vendor; `oldUuid` on a re-vendor), `skipped` / `already_vendored` (in sync), or `skipped` with the refusal code for an npm purl the wet run's Bun preflight (see the `get --mode vendored` bullet below) would refuse, or whose hosted pnpm pin the takeover would be refused on (see "Takeover reconciliation"), or for a PyPI purl the PyPI vendored backend's wiring guards would refuse before building anything (the project routing and lock guards a standalone `vendor --dry-run` reports, such as `pypi_no_requirements` or `pypi_uv_no_sources`, on the project lane and the PEP 723 script lane alike, #891) — without network downloads or disk writes; the preview never flips status or exit (the human path — `scan` and `get` alike, through one shared printer — prints `[would-refuse] <purl> (<code>): <detail>` lines behind the `--silent` gate). Interactive mode prompts "Download and vendor N patches?" (singular for one).
+`scan --mode vendored` swaps the in-place apply for the vendor pipeline: discover → download the selected patch records **into memory** (no manifest write) → vendor every selected dependency via the same engine as the `vendor` command (under the same lock). Vendored mode is **manifest-free (v5.0)**: `.socket/manifest.json` is never written or read by a vendored run; each ledger entry carries `detached: true` plus an embedded copy of the patch record (`record`) as its verification source, and the run's footprint is `.socket/vendor/**` only. The vendor step's scope is what discovery selected — the former "whole manifest is vendored" re-vendor on an empty discovery is retired (`repair` verifies and redownloads committed vendored state; `scan --prune` reconciles ledger entries whose dependency left the lockfile). The vendor-ledger discovery supplement (the fresh-clone rule: a ledger entry with no installed copy stays discoverable because its committed artifact IS the dependency) holds only while the lockfile still resolves through that artifact: an entry the lockfile in-use probe (the one `--prune` reverts by) proves unwired, because the dependency was upgraded or removed, is NOT discovered and so is never re-vendored. A run without a non-hosted `--prune` reports it through the run-level `vendor_ledger_entry_unwired` warning; a `--prune` run reverts it in its GC and exits 0. That GC runs even when the crawl found no packages, as its vendored half alone (the manifest prune stays skipped there). A package the ledger holds at an older patch uuid is still **re-vendored automatically** when discovery selects the newer patch (its old uuid dir is removed — `vendor_stale_artifact_removed`) — unless the patch service has no prebuilt artifact for the newer patch yet (or at all): the package then keeps the older patch and is a `skipped` `vendor_prebuilt_pending` / `vendor_prebuilt_unavailable` event, not a failure, in every ecosystem (#954, #1235); same-uuid re-runs reuse the embedded record, skip the patch-view fetch, and are `already_vendored` skips. **Legacy manifest-mode entries**: when a vendored run vendors a purl that also has a `.socket/manifest.json` record (a project vendored by a pre-5.0 binary, or by standalone `vendor` from an agent-mode manifest), that manifest record is dropped in the same run — the ledger becomes the owner (migration write); an emptied manifest is left as `{"patches": {}}`, never deleted. The migration is reported through the run-level `warnings[]` (stderr in human mode), never as a run error: `vendor_manifest_record_migrated` (`N manifest records moved to the vendor ledger (vendored mode is manifest-free): <purls>`) or `vendor_manifest_migration_failed` (the manifest or the ledger could not be read or rewritten; the legacy records were left in place) — so a corrupt `.socket/manifest.json` no longer fails a vendored run (standalone `vendor`, the one manifest-driven writer, still fails closed on it). With `--prune`, GC runs **after** the vendor step (the step never reads the manifest, and running the sweep last lets it reclaim what the run itself orphaned — a migrated legacy record's blobs, a superseded uuid dir). Under `--json` (v5.0, MAJOR) the download phase and the vendor engine record into the ONE scan envelope (no nested `download` / `vendor` objects): a fetched patch is a `downloaded` event (the patch metadata in `details`, plus `details.oldUuid` when the ledger holds the purl at another uuid — the re-vendor the vendor step then performs — whose human `[fetch]` line reads `<purl> (replacing <short uuid>)`), a refused or failed one a `failed` event with its code, a patch the ledger already holds at the selected uuid no download event at all (reused, no fetch); then the vendor engine's events (`applied`, `rebuilt`, `skipped`, `failed`, `removed`, its uncounted advisories) follow with their warnings and sidecars. Every one of these events carries `details.mode: "vendored"`. Patch blobs are held in memory (see "Patch sources stay in memory" under the vendor contract). `--dry-run` previews per patch: `verified` (to vendor; `oldUuid` on a re-vendor), `skipped` / `already_vendored` (in sync), or `skipped` with the refusal code for an npm purl the wet run's Bun preflight (see the `get --mode vendored` bullet below) would refuse, or whose hosted pnpm pin the takeover would be refused on (see "Takeover reconciliation"), or for a PyPI purl the PyPI vendored backend's wiring guards would refuse before building anything (the project routing and lock guards a standalone `vendor --dry-run` reports, such as `pypi_no_requirements` or `pypi_uv_no_sources`, on the project lane and the PEP 723 script lane alike, #891; a PyPI purl with a live hosted pin is not judged, since the wet run restores its upstream entry before those guards run) — without network downloads or disk writes; the preview never flips status or exit (the human path — `scan` and `get` alike, through one shared printer — prints `[would-refuse] <purl> (<code>): <detail>` lines behind the `--silent` gate). Interactive mode prompts "Download and vendor N patches?" (singular for one).
 
 **Vendored entries and the rest of the CLI.** Because nothing is in the manifest, vendored patches are invisible to `apply` (nothing to apply in place) but fully visible to `list` (listed from the ledger, labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode, exit 0 on a vendored-only project), `vex` (attested from the embedded records while a lockfile still wires the artifact — see "Manifest-less VEX"), `repair` (health-checked and rebuilt from the ledger), and `scan --prune` (lockfile-driven reconcile). They are exempt from standalone `vendor`'s manifest reconcile (`reconcile_dropped` never touches `detached` entries) and exit via `remove <purl>` (which reverts them), `vendor --revert`, or `rollback`, whose vendored leg reverts every in-scope ledger entry (unscoped and identifier-scoped runs; path-scoped runs reach them only when an installed copy matches).
 
diff --git a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
index 793b1b4b0..8c16f1962 100644
--- a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
+++ b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
@@ -182,8 +182,10 @@ impl VendorPreview {
 /// run's `--patch-server-url` origins. The preview stays a ledger
 /// classification otherwise (engine refusals outside the preflights are
 /// not predicted), and a would-refuse never flips the run's status or exit
-/// code. The preflights (the only disk access besides the ledger) run only
-/// when the selection holds an npm or PyPI purl.
+/// code. The preflights (the only disk access besides the ledger; the PyPI
+/// one may also probe `pipenv --version` and list Hatch environments, as
+/// the wet run's guards do) run only when the selection holds an npm or
+/// PyPI purl.
 /// `takeover_refusals` adds the hosted→vendored takeover refusals the
 /// caller resolved (the gem gates of
 /// [`crate::commands::vendor::gem_takeover_preview_refusals`]), keyed by
@@ -205,7 +207,7 @@ pub(crate) async fn preview_vendor(
     let npm_lock_refusal = npm_lock_refusal(cwd, selected).await;
     let state = state.unwrap_or_default();
     let pnpm_refusals = hosted_pnpm_refusals(cwd, selected, origins, &state).await;
-    let pypi_refusals = pypi_refusals(cwd, selected, origins).await;
+    let pypi_refusals = pypi_refusals(cwd, selected, origins, takeover_refusals).await;
     let refuse = |code: &str, detail: &str| PreviewVerdict::WouldRefuse {
         code: code.to_string(),
         detail: detail.to_string(),
@@ -268,23 +270,35 @@ pub(crate) async fn preview_vendor(
 }
 
 /// The PyPI purls of `selected` the vendor backend's prelude refuses
-/// before it builds or downloads anything (the wiring guards a standalone
-/// `vendor --dry-run` already reports, such as `pypi_uv_no_sources`), keyed
-/// by purl (#891). Read-only.
+/// before it builds or downloads anything (the routing and wiring guards a
+/// standalone `vendor --dry-run` already reports, such as
+/// `pypi_no_requirements` or `pypi_uv_no_sources`), keyed by purl (#891).
+/// Read-only. A purl the caller's takeover gates already refuse is not
+/// asked again, and neither is one with a live hosted pin: the wet run
+/// restores its upstream entry before the backend runs, so its guards
+/// would judge text this preview never stages (as for the takeovers of
+/// every ecosystem but pnpm, see [`hosted_pnpm_refusals`]).
 async fn pypi_refusals(
     cwd: &Path,
     selected: &[PatchSearchResult],
     origins: &[String],
+    takeover_refusals: &HashMap<String, (&'static str, String)>,
 ) -> HashMap<String, (&'static str, String)> {
-    let mut refusals = HashMap::new();
-    for p in selected.iter().filter(|p| p.purl.starts_with("pkg:pypi/")) {
-        if let Some(refusal) =
-            socket_patch_core::vendor::pypi::preview_refusal(&p.purl, cwd, &p.uuid, origins).await
-        {
-            refusals.insert(p.purl.clone(), refusal);
-        }
+    let pypi: Vec<&PatchSearchResult> = selected
+        .iter()
+        .filter(|p| p.purl.starts_with("pkg:pypi/") && !takeover_refusals.contains_key(&p.purl))
+        .collect();
+    if pypi.is_empty() {
+        return HashMap::new();
     }
-    refusals
+    let claimed =
+        crate::commands::agent_download::hosted_claimed_purls(cwd, origins.to_vec()).await;
+    let candidates: Vec<(&str, &str)> = pypi
+        .into_iter()
+        .filter(|p| !claimed.contains(&PurlKey::new(&p.purl)))
+        .map(|p| (p.purl.as_str(), p.uuid.as_str()))
+        .collect();
+    socket_patch_core::vendor::pypi::preview_refusals(cwd, &candidates, origins).await
 }
 
 /// Fold the vendor engine's envelope into a `scan` / `get` envelope (no
@@ -1563,6 +1577,13 @@ mod preview_tests {
     async fn preview_warns_about_a_symlinked_wiring_file() {
         let tmp = tempfile::tempdir().unwrap();
         let shared = tempfile::tempdir().unwrap();
+        // A PyPI project the PyPI backend can wire, so its row is a
+        // would-vendor row whose advisories are computed (#891).
+        std::fs::write(
+            tmp.path().join("requirements.txt"),
+            "preview-other==1.0.0\n",
+        )
+        .unwrap();
         std::fs::write(shared.path().join("yarn.lock"), "# yarn lockfile v1\n").unwrap();
         std::os::unix::fs::symlink(
             shared.path().join("yarn.lock"),
@@ -1588,10 +1609,9 @@ mod preview_tests {
                 .is_some_and(|d| d.starts_with("yarn.lock is a symbolic link")),
             "{preview}"
         );
-        assert!(
-            action_of(&preview, PYPI).get("warnings").is_none(),
-            "{preview}"
-        );
+        let pypi = action_of(&preview, PYPI);
+        assert_eq!(pypi["action"], "would_vendor", "{preview}");
+        assert!(pypi.get("warnings").is_none(), "{preview}");
     }
 
     /// A refused Bun tree flips npm purls to the additive `would_refuse`
@@ -1898,6 +1918,30 @@ wheels = [
         );
     }
 
+    /// #891: a PyPI purl with a live hosted pin is not judged by the PyPI
+    /// guards on the still-hosted text: the wet run restores the upstream
+    /// pin first, so the preview keeps it `would_vendor`.
+    #[tokio::test]
+    async fn preview_does_not_refuse_a_hosted_pypi_pin() {
+        let tmp = tempfile::tempdir().unwrap();
+        std::fs::write(
+            tmp.path().join("requirements.txt"),
+            format!(
+                "six @ https://patch.socket.dev/patch/pypi/six/1.16.0/g/{UUID}/\
+                 six-1.16.0-py2.py3-none-any.whl --hash=sha256:{}\n",
+                "a".repeat(64)
+            ),
+        )
+        .unwrap();
+        let preview =
+            preview_vendor_json(tmp.path(), &[sel(UUID, SIX)], &[], &HashMap::new()).await;
+        assert_eq!(
+            action_of(&preview, SIX)["action"],
+            "would_vendor",
+            "{preview}"
+        );
+    }
+
     /// #891: the same refusal on the PEP 723 script lane, where the
     /// script's own `[tool.uv]` block sets `no-sources`.
     #[tokio::test]
diff --git a/crates/socket-patch-core/src/vendor/pypi.rs b/crates/socket-patch-core/src/vendor/pypi.rs
index 2417ee0f8..5d6d1c44b 100644
--- a/crates/socket-patch-core/src/vendor/pypi.rs
+++ b/crates/socket-patch-core/src/vendor/pypi.rs
@@ -1948,44 +1948,51 @@ pub(crate) async fn service_preflight(
     })
 }
 
-/// The refusal a vendor of `purl` (patch `uuid`) would raise before it
-/// builds, downloads or writes anything: the flavor routing and every
-/// wiring guard of [`pypi_prelude`], run as a dry run. `None` when the
-/// prelude gets past them (or answers in sync).
+/// The refusals a vendor of each `(purl, uuid)` candidate would raise
+/// before it builds, downloads or writes anything: the flavor routing and
+/// every wiring guard of [`pypi_prelude`], run as a dry run, keyed by
+/// purl. A candidate the prelude gets past (or answers in sync) is absent.
+/// One Pipenv-release probe and one set of site listings serve every
+/// candidate, as in the vendor loop.
 ///
 /// The `scan` / `get --mode vendored --dry-run` preview has no patch
 /// record yet (nothing is downloaded), so the prelude sees one with no
-/// files: none of its refusals reads them. `hosted_origins` are the run's
-/// patch-server origins, as the wet run passes them (#891).
-pub async fn preview_refusal(
-    purl: &str,
+/// files: its routing and wiring refusals read only the purl, the uuid
+/// and the project. `hosted_origins` are the run's patch-server origins,
+/// as the wet run passes them (#891).
+pub async fn preview_refusals(
     project_root: &Path,
-    uuid: &str,
+    candidates: &[(&str, &str)],
     hosted_origins: &[String],
-) -> Option<(&'static str, String)> {
-    let record = PatchRecord {
-        uuid: uuid.to_string(),
-        exported_at: String::new(),
-        files: std::collections::HashMap::new(),
-        vulnerabilities: std::collections::HashMap::new(),
-        description: String::new(),
-        license: String::new(),
-        tier: String::new(),
-    };
-    match pypi_prelude(
-        purl,
-        project_root,
-        &record,
-        true,
-        &tokio::sync::OnceCell::new(),
-        &InstalledSiteListings::default(),
-        hosted_origins,
-    )
-    .await
-    {
-        Err(VendorOutcome::Refused { code, detail }) => Some((code, detail)),
-        _ => None,
+) -> std::collections::HashMap<String, (&'static str, String)> {
+    let pipenv_version = tokio::sync::OnceCell::new();
+    let installed_sites = InstalledSiteListings::default();
+    let mut refusals = std::collections::HashMap::new();
+    for &(purl, uuid) in candidates {
+        let record = PatchRecord {
+            uuid: uuid.to_string(),
+            exported_at: String::new(),
+            files: std::collections::HashMap::new(),
+            vulnerabilities: std::collections::HashMap::new(),
+            description: String::new(),
+            license: String::new(),
+            tier: String::new(),
+        };
+        if let Err(VendorOutcome::Refused { code, detail }) = pypi_prelude(
+            purl,
+            project_root,
+            &record,
+            true,
+            &pipenv_version,
+            &installed_sites,
+            hosted_origins,
+        )
+        .await
+        {
+            refusals.insert(purl.to_string(), (code, detail));
+        }
     }
+    refusals
 }
 
 #[allow(clippy::too_many_arguments)]