feat(bun): support native binary lockfile patching

Author: mikolalysenko

.github/workflows/bun-compatibility.yml

@@ -16,7 +16,10 @@ on:
     paths:
       - '.github/actions/upload-artifact/**'
       - '.github/workflows/bun-compatibility.yml'
-      - 'scripts/backtest-bun.py'
+      - 'scripts/backtest-bun*.py'
+      - 'scripts/bun-historical-shas.json'
+      - 'crates/socket-patch-cli/tests/e2e_bun_lockb.rs'
+      - 'crates/socket-patch-core/tests/fixtures/bun-lockb/**'
       - 'docs/testing/bun-compatibility.md'
       - 'Cargo.lock'
       - 'crates/socket-patch-core/src/vendor/**'
@@ -45,12 +48,13 @@ on:
     branches: [main]
     paths:
       - '.github/workflows/bun-compatibility.yml'
-      - 'scripts/backtest-bun.py'
+      - 'scripts/backtest-bun*.py'
+      - 'scripts/bun-historical-shas.json'
+      - 'crates/socket-patch-cli/tests/e2e_bun_lockb.rs'
+      - 'crates/socket-patch-core/tests/fixtures/bun-lockb/**'
       - 'Cargo.lock'
       - 'crates/socket-patch-core/src/vendor/**'
-      - 'crates/socket-patch-core/src/patch/redirect/mod.rs'
-      - 'crates/socket-patch-core/src/patch/redirect/replay.rs'
-      - 'crates/socket-patch-core/src/patch/redirect/takeover.rs'
+      - 'crates/socket-patch-core/src/patch/redirect/**'
       - 'crates/socket-patch-cli/src/commands/get.rs'
       - 'crates/socket-patch-cli/src/commands/scan/**'
       - 'crates/socket-patch-cli/src/commands/rollback.rs'
@@ -130,7 +134,7 @@ jobs:
         # Every lock-format and behaviour boundary the CLI has to survive:
         #   0.8.1 / 1.0.0 / 1.0.36 / 1.1.0 / 1.1.38  binary bun.lockb only
         #   1.1.39                                   first text lock (lockfileVersion 0, opt-in)
-        #   1.1.43                                   first `--lockfile-only` (the lockb migration recipe)
+        #   1.1.43                                   first `--lockfile-only`
         #   1.1.45                                   last v0 writer
         #   1.2.0 / 1.2.23 / 1.3.0                   text default, lockfileVersion 1
         #   1.3.9 / 1.3.10                           URL/local tarball sha512 enforcement boundary
@@ -327,3 +331,50 @@ jobs:
             native-bun/captures/**/tree/**
             native-bun/captures/**/*.log
           retention-days: 14
+
+
+  binary:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          key: bun-native-binary
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+
+      - name: Setup Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: '3.12'
+
+      - name: Native binary writer and reader acceptance
+        shell: bash
+        run: |
+          versions=()
+          # Windows releases begin at 1.1.0. Unix exercises all binary
+          # schema boundaries, including the earliest format-1 writer.
+          if [ "$RUNNER_OS" = "Windows" ]; then
+            versions=(--versions 1.1.0 1.1.38 1.1.45 1.2.0 1.2.23 1.3.0 1.3.14 1.4.2)
+          fi
+          python3 scripts/backtest-bun-lockb.py \
+            --tools native-binary/tools \
+            --output native-binary/results \
+            --jobs 2 "${versions[@]}"
+
+      - name: Upload binary acceptance results
+        if: always()
+        uses: ./.github/actions/upload-artifact
+        with:
+          name: bun-binary-results-${{ matrix.os }}
+          path: native-binary/results
+          retention-days: 14

README.md

@@ -254,6 +254,15 @@ Mode support varies by ecosystem — e.g. Go can't do hosted, Rush monorepos can
 vendored. See the full **[mode × ecosystem matrix](docs/ecosystems.md#mode--ecosystem-matrix)**
 for details and per-ecosystem caveats.
 
+### Bun compatibility
+
+Both text `bun.lock` and binary `bun.lockb` support hosted and vendored
+patches, mode switching, repair, and rollback. Binary locks are read and
+patched natively: Socket Patch does not need Bun installed to discover or
+rewrite them, and does not convert them to text. If both filenames exist,
+`bun.lock` takes precedence. See [Bun compatibility](docs/testing/bun-compatibility.md)
+for the tested versions, workspace behavior, and installer integrity limits.
+
 ### Pipenv compatibility
 
 Hosted mode rewrites every `Pipfile.lock` category that pins the patched

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -7,7 +7,7 @@
 //!
 //! One read-only [`preflight_vendor`] per run, evaluated before any
 //! `/patches/view/` fetch and before any write, so an incompatible Bun
-//! project (binary `bun.lockb` without a text lock, an unreadable lock, an
+//! project (malformed binary `bun.lockb`, an unreadable lock, an
 //! unsupported `lockfileVersion`, a pre-version-2 `workspace:` lock) never
 //! has a patch downloaded on its behalf — let alone recorded in the
 //! manifest, or its live hosted redirect stripped — and every entry point
@@ -50,7 +50,7 @@ pub(crate) type LedgerLoad<'a> = Result<&'a HashMap<String, VendorEntry>, &'a st
 ///
 /// [`wired_instances_all_ours`]: socket_patch_core::vendor::bun_lock::wired_instances_all_ours
 pub(crate) struct BunVendorRefusal {
-    /// The stable vendor error code (`vendor_bun_lockb_unsupported`,
+    /// The stable vendor error code (`vendor_bun_lockb_invalid`,
     /// `vendor_lockfile_missing`, `vendor_lockfile_version_unsupported`,
     /// `vendor_bun_workspace_unsupported`) — the same string the vendor
     /// engine would have emitted as a `failed` event — or
@@ -283,15 +283,15 @@ mod tests {
         let npm = vec![sel(UUID, PURL)];
         let refusal = bun_vendor_preflight(tmp.path(), &npm)
             .await
-            .expect("lockb-only project is refused");
-        assert_eq!(refusal.code, "vendor_bun_lockb_unsupported");
+            .expect("malformed lockb project is refused");
+        assert_eq!(refusal.code, "vendor_bun_lockb_invalid");
         assert!(refusal.applies_to(PURL));
         assert!(!refusal.applies_to("pkg:pypi/only@1.0.0"));
 
-        // A ledger at this UUID cannot make a binary lock vendorable.
+        // A ledger at this UUID cannot make a malformed binary lock vendorable.
         seed_bun_vendor_entry(tmp.path(), PURL, UUID);
         let refusal = bun_vendor_preflight(tmp.path(), &npm).await.unwrap();
-        assert_eq!(refusal.code, "vendor_bun_lockb_unsupported");
+        assert_eq!(refusal.code, "vendor_bun_lockb_invalid");
         assert!(refusal.applies_to(PURL), "the live lock must be compatible");
 
         // …but a corrupt ledger exempts nothing and names itself.

crates/socket-patch-cli/src/commands/bun_preflight.rs

@@ -5198,7 +5198,7 @@ mod tests {
 
     #[tokio::test]
     #[serial_test::serial]
-    async fn download_patch_records_bun_lockb_refuses_before_fetch() {
+    async fn download_patch_records_malformed_bun_lockb_refuses_before_fetch() {
         use wiremock::matchers::{method, path as wm_path};
         use wiremock::{Mock, MockServer, ResponseTemplate};
 
@@ -5234,7 +5234,7 @@ mod tests {
         assert_eq!(json["failed"], 1, "json={json}");
         assert_eq!(json["patches"][0]["action"], "failed", "json={json}");
         assert_eq!(
-            json["patches"][0]["errorCode"], "vendor_bun_lockb_unsupported",
+            json["patches"][0]["errorCode"], "vendor_bun_lockb_invalid",
             "json={json}"
         );
         assert!(