SocketDev
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 51 additions & 17 deletions b/‎.github/workflows/ci.yml‎
Lines changed: 51 additions & 17 deletions
diff --git a/‎Cargo.lock‎
Lines changed: 13 additions & 0 deletions b/‎Cargo.lock‎
Lines changed: 13 additions & 0 deletions
diff --git a/‎Cargo.toml‎
Lines changed: 1 addition & 0 deletions b/‎Cargo.toml‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎crates/socket-patch-cli/Cargo.toml‎
Lines changed: 6 additions & 0 deletions b/‎crates/socket-patch-cli/Cargo.toml‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎crates/socket-patch-cli/src/args.rs‎
Lines changed: 22 additions & 0 deletions b/‎crates/socket-patch-cli/src/args.rs‎
Lines changed: 22 additions & 0 deletions
diff --git a/‎crates/socket-patch-cli/src/commands/apply.rs‎
Lines changed: 91 additions & 1 deletion b/‎crates/socket-patch-cli/src/commands/apply.rs‎
Lines changed: 91 additions & 1 deletion
@@ -154,7 +154,7 @@ jobs:
         # separately, and coverage-merge stitches everything together.
         run: |
           cargo llvm-cov --workspace \
-            --features cargo,golang,maven,composer,nuget \
+            --features cargo,golang,maven,composer,nuget,deno \
             --no-report
           cargo llvm-cov report --lcov --output-path coverage-host.lcov
           cargo llvm-cov report --summary-only | tee coverage-summary.txt
@@ -206,7 +206,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ecosystem: [npm, pypi, gem, cargo, golang, maven, composer, nuget]
+        ecosystem: [npm, pypi, gem, cargo, golang, maven, composer, nuget, deno]
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -270,7 +270,7 @@ jobs:
         # cargo llvm-cov manages its own env in the test step).
         run: |
           eval "$(cargo llvm-cov show-env --export-prefix 2>/dev/null)"
-          cargo build --bin socket-patch --features cargo,golang,maven,composer,nuget
+          cargo build --bin socket-patch --features cargo,golang,maven,composer,nuget,deno
 
       - name: Configure docker-e2e coverage hooks
         run: |
@@ -282,7 +282,7 @@ jobs:
       - name: Run ${{ matrix.ecosystem }} Docker e2e test with coverage
         run: |
           cargo llvm-cov \
-            --features docker-e2e,cargo,golang,maven,composer,nuget \
+            --features docker-e2e,cargo,golang,maven,composer,nuget,deno \
             --no-report \
             --test docker_e2e_${{ matrix.ecosystem }}
 
@@ -387,30 +387,55 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            suite: e2e_npm
-          - os: ubuntu-latest
-            suite: e2e_pypi
           - os: ubuntu-latest
             suite: e2e_cargo
           - os: ubuntu-latest
             suite: e2e_golang
           - os: ubuntu-latest
             suite: e2e_maven
-          - os: ubuntu-latest
-            suite: e2e_gem
           - os: ubuntu-latest
             suite: e2e_composer
           - os: ubuntu-latest
             suite: e2e_nuget
+          # The live-API smoke suites (e2e_npm, e2e_pypi, e2e_gem,
+          # e2e_scan) are intentionally NOT in the PR matrix — their
+          # `#[ignore]`-gated tests hit the real public proxy at
+          # patches-api.socket.dev, which intermittently returns
+          # 503 "Service temporarily over capacity" outside this
+          # repo's control. Run on demand:
+          #
+          #   cargo test -p socket-patch-cli --test e2e_npm  -- --ignored
+          #   cargo test -p socket-patch-cli --test e2e_pypi -- --ignored
+          #   cargo test -p socket-patch-cli --test e2e_gem  -- --ignored
+          #   cargo test -p socket-patch-cli --test e2e_scan -- --ignored
+          #
+          # PR-time coverage for the same code paths comes from the
+          # `e2e-docker` matrix below, which runs the same flow
+          # against a hermetic wiremock fixture.
+          # Safety-hardening e2e suites. The fast non-ignored ones
+          # (e2e_safety_lock, e2e_safety_yarn_pnp) run via the
+          # standard `test` job above on all three platforms, so no
+          # matrix entry is needed for them. The two below need real
+          # toolchains and are #[ignore]-gated.
+          - os: ubuntu-latest
+            suite: e2e_safety_cargo_build
           - os: macos-latest
-            suite: e2e_npm
-          - os: macos-latest
-            suite: e2e_pypi
+            suite: e2e_safety_cargo_build
+          - os: windows-latest
+            suite: e2e_safety_cargo_build
           - os: ubuntu-latest
-            suite: e2e_scan
+            suite: e2e_safety_pnpm
           - os: macos-latest
-            suite: e2e_scan
+            suite: e2e_safety_pnpm
+          # pnpm-on-Windows uses junctions for symlinks and copies
+          # (not hardlinks) by default, so the CoW invariant holds
+          # vacuously. Test still runs to verify apply doesn't error
+          # on Windows — semantic Windows nlink coverage is a
+          # follow-up (`std::fs::Metadata` doesn't expose nlink on
+          # Windows; needs `GetFileInformationByHandle` via
+          # `windows-sys`).
+          - os: windows-latest
+            suite: e2e_safety_pnpm
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
@@ -436,11 +461,20 @@ jobs:
           restore-keys: ${{ matrix.os }}-cargo-e2e-
 
       - name: Setup Node.js
-        if: matrix.suite == 'e2e_npm' || matrix.suite == 'e2e_scan'
+        if: matrix.suite == 'e2e_npm' || matrix.suite == 'e2e_scan' || matrix.suite == 'e2e_safety_pnpm'
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '20.20.2'
 
+      - name: Setup pnpm
+        if: matrix.suite == 'e2e_safety_pnpm'
+        # Pin the major version so the store layout the test
+        # asserts on stays stable. `npm install -g` is the simplest
+        # cross-platform install path (works on ubuntu, macos,
+        # windows-runners — they all ship a usable npm via
+        # actions/setup-node).
+        run: npm install -g pnpm@10
+
       - name: Setup Python
         if: matrix.suite == 'e2e_pypi'
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
@@ -483,7 +517,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ecosystem: [npm, pypi, gem, cargo, golang, maven, composer, nuget]
+        ecosystem: [npm, pypi, gem, cargo, golang, maven, composer, nuget, deno]
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -28,6 +28,7 @@ once_cell = "=1.21.3"
 qbsdiff = "=1.4.4"
 tar = "=0.4.45"
 flate2 = "=1.1.9"
+fs2 = "=0.4.3"
 wiremock = "=0.6.5"
 portable-pty = "=0.9.0"
 testcontainers = "=0.27.3"
 
@@ -34,6 +34,7 @@ golang = ["socket-patch-core/golang"]
 maven = ["socket-patch-core/maven"]
 composer = ["socket-patch-core/composer"]
 nuget = ["socket-patch-core/nuget"]
+deno = ["socket-patch-core/deno"]
 # Enables the Docker-driven real-package e2e test suite under
 # `tests/docker_e2e_*.rs`. Tests in this suite require either a running
 # Docker daemon OR `SOCKET_PATCH_TEST_HOST=1` (host-toolchain mode).
@@ -49,3 +50,8 @@ base64 = { workspace = true }
 reqwest = { workspace = true }
 tempfile = { workspace = true }
 serial_test = { workspace = true }
+# Used by `tests/e2e_safety_lock.rs` to externally hold the same
+# `.socket/apply.lock` the binary takes, then spawn the binary and
+# assert the lock_held exit-code contract. Same crate the binary
+# uses internally (`socket-patch-core::patch::apply_lock`).
+fs2 = { workspace = true }
@@ -146,6 +146,26 @@ pub struct GlobalArgs {
     )]
     pub yes: bool,
 
+    /// Seconds to wait for `<.socket>/apply.lock` before giving up.
+    /// Default (`None`) and `0` both mean a single non-blocking try
+    /// — failing immediately if another process holds the lock. A
+    /// positive value retries with a 100 ms backoff until the lock
+    /// frees or the budget elapses. Only meaningful for the mutating
+    /// subcommands (`apply`, `rollback`, `repair`, `remove`); other
+    /// commands accept it silently.
+    #[arg(long = "lock-timeout", env = "SOCKET_LOCK_TIMEOUT")]
+    pub lock_timeout: Option<u64>,
+
+    /// Force-remove `<.socket>/apply.lock` before attempting
+    /// acquisition. Use when you are certain no other socket-patch
+    /// process is running (e.g. a previous run crashed in a way that
+    /// stripped the OS lock but left the file). Emits a
+    /// `lock_broken` warning event in the JSON envelope so the
+    /// action is auditable. Only meaningful for mutating
+    /// subcommands; other commands accept it silently.
+    #[arg(long = "break-lock", env = "SOCKET_BREAK_LOCK", default_value_t = false)]
+    pub break_lock: bool,
+
     /// Emit verbose debug logs to stderr.
     #[arg(long = "debug", env = "SOCKET_DEBUG", default_value_t = false)]
     pub debug: bool,
@@ -235,6 +255,8 @@ impl Default for GlobalArgs {
             silent: false,
             dry_run: false,
             yes: false,
+            lock_timeout: None,
+            break_lock: false,
             debug: false,
             no_telemetry: false,
         }
 
@@ -4,15 +4,20 @@ use socket_patch_core::api::blob_fetcher::{
     get_missing_blobs, DownloadMode,
 };
 use socket_patch_core::api::client::get_api_client_with_overrides;
-use socket_patch_core::crawlers::{CrawlerOptions, Ecosystem};
+use socket_patch_core::crawlers::{
+    detect_npm_pkg_manager, CrawlerOptions, Ecosystem, NpmPkgManager,
+};
 use socket_patch_core::manifest::operations::read_manifest;
 use socket_patch_core::patch::apply::{
     apply_package_patch, verify_file_patch, ApplyResult, PatchSources, VerifyStatus,
 };
+
+use crate::commands::lock_cli::{acquire_or_emit, lock_broken_event};
 use socket_patch_core::utils::purl::strip_purl_qualifiers;
 use socket_patch_core::utils::telemetry::{track_patch_applied, track_patch_apply_failed};
 use std::collections::{HashMap, HashSet};
 use std::path::{Path, PathBuf};
+use std::time::Duration;
 use tempfile::TempDir;
 
 use crate::args::{apply_env_toggles, GlobalArgs};
@@ -129,6 +134,11 @@ pub(crate) fn result_to_event(result: &ApplyResult, dry_run: bool) -> PatchEvent
                 .map(AppliedVia::from_core),
         })
         .collect();
+    // Sidecar data is NOT attached here — it's surfaced at the
+    // envelope level under `Envelope.sidecars[]` by the run loop.
+    // See `Envelope::record_sidecar`. Keeping events clean of
+    // sidecar info means each event describes only the apply
+    // action; sidecar reporting is a separate, JOIN-able list.
     PatchEvent::new(PatchAction::Applied, purl).with_files(files)
 }
 
@@ -154,6 +164,74 @@ pub async fn run(args: ApplyArgs) -> i32 {
         return 0;
     }
 
+    // Serialize against concurrent socket-patch runs targeting the same
+    // `.socket/` directory. The guard releases on function return; see
+    // `socket_patch_core::patch::apply_lock`.
+    let socket_dir = manifest_path.parent().unwrap_or(Path::new("."));
+    let acquired = match acquire_or_emit(
+        socket_dir,
+        Command::Apply,
+        args.common.json,
+        args.common.silent,
+        args.common.dry_run,
+        Duration::from_secs(args.common.lock_timeout.unwrap_or(0)),
+        args.common.break_lock,
+    ) {
+        Ok(acquired) => acquired,
+        Err(code) => return code,
+    };
+    let _lock = acquired.guard;
+    let lock_was_broken = acquired.broke_lock;
+
+    // Package-manager layout detection. yarn-berry PnP keeps packages
+    // inside `.yarn/cache/*.zip` and resolves them via `.pnp.cjs` —
+    // the npm crawler can't reach them and rewriting zips is a
+    // different operation entirely. Refuse with a clear pointer to
+    // `yarn patch`. pnpm gets an informational event; the CoW guard
+    // in `apply_file_patch` does the substantive safety work.
+    let pkg_manager = detect_npm_pkg_manager(&args.common.cwd);
+    match pkg_manager {
+        NpmPkgManager::YarnBerryPnP => {
+            if args.common.json {
+                let mut env = Envelope::new(Command::Apply);
+                env.dry_run = args.common.dry_run;
+                env.mark_error(EnvelopeError::new(
+                    "yarn_pnp_unsupported",
+                    "yarn-berry Plug'n'Play layout is not supported by socket-patch (packages live inside .yarn/cache zips). Use `yarn patch <pkg>` instead.",
+                ));
+                println!("{}", env.to_pretty_json());
+            } else if !args.common.silent {
+                eprintln!("Error: yarn-berry Plug'n'Play layout is not supported.");
+                eprintln!(
+                    "  Packages live inside .yarn/cache/*.zip — socket-patch cannot rewrite them in place."
+                );
+                eprintln!("  Use `yarn patch <pkg>` instead.");
+            }
+            return 1;
+        }
+        NpmPkgManager::Pnpm => {
+            if !args.common.json && !args.common.silent {
+                eprintln!(
+                    "Note: pnpm layout detected. Copy-on-write will keep the global store untouched."
+                );
+            }
+            // Non-fatal — CoW handles the safety. JSON consumers see
+            // the layout-detected info in the apply envelope's
+            // existing events (no separate event added here yet).
+        }
+        NpmPkgManager::Bun => {
+            if !args.common.json && !args.common.silent {
+                eprintln!(
+                    "Note: bun layout detected. Copy-on-write will keep ~/.bun/install/cache/ untouched."
+                );
+            }
+            // Same shape as pnpm: bun hard-links from its global
+            // install cache by default. The CoW guard handles the
+            // safety; this is informational only.
+        }
+        _ => {}
+    }
+
     match apply_patches_inner(&args, &manifest_path).await {
         Ok((success, results, unmatched)) => {
             let patched_count = results
@@ -164,8 +242,18 @@ pub async fn run(args: ApplyArgs) -> i32 {
             if args.common.json {
                 let mut env = Envelope::new(Command::Apply);
                 env.dry_run = args.common.dry_run;
+                if lock_was_broken {
+                    env.record(lock_broken_event(socket_dir));
+                }
                 for result in &results {
                     env.record(result_to_event(result, args.common.dry_run));
+                    // Sidecar records live on the envelope, not on
+                    // individual events. Consumers iterate
+                    // `envelope.sidecars[]` and JOIN against
+                    // `events[]` by `purl` for per-package context.
+                    if let Some(ref sidecar) = result.sidecar {
+                        env.record_sidecar(sidecar.clone());
+                    }
                 }
                 // Manifest entries that targeted in-scope ecosystems but
                 // had no installed package on disk — emit one Skipped
@@ -705,6 +793,7 @@ mod tests {
             files_patched: vec!["package/index.js".to_string()],
             applied_via,
             error: None,
+            sidecar: None,
         }
     }
 
@@ -779,6 +868,7 @@ mod tests {
             ],
             applied_via,
             error: None,
+            sidecar: None,
         };
 
         let event = result_to_event(&result, false);