Align ignored npm/vendored e2e tests with v5 behavior

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Three on-demand live-production tests (#[ignore], not run in CI) fail on main. In each case the test still encodes v4 behavior, and the CLI does what CLI_CONTRACT.md documents for v5. These are test fixes only, so no issue was filed.

Test	Failure on main	Documented v5 behavior	Fix
e2e_npm::test_npm_global_lifecycle	after rollback -g --global-prefix X, apply -g --global-prefix X leaves index.js unpatched	rollback is full-state: it restores files and removes the rolled-back manifest entries (contract: rollback row, and "Global scope never touches the project's state"). apply then has nothing left to apply.	Roll back with --preserve-state, which restores the file and keeps the record, and assert that the record survives. remove -g still checks that the manifest is dropped.
e2e_npm::test_npm_uuid_shortcut	bare socket-patch <uuid> leaves the installed file unpatched	The bare-UUID fallback is get <uuid>, and get defaults to hosted mode in a lockfile project (contract: get row, "Bare-UUID fallback")	Assert the hosted result: package-lock.json pins minimist to https://patch.socket.dev/…<uuid>…, the installed tree is untouched and no manifest exists. Then check that <uuid> --mode agent goes through the shortcut and patches in place with a manifest record.
e2e_vendored_production::yarn_berry_vendored_install_proof	remove_file(.socket/manifest.json) panics	scan --mode vendored is manifest-free, and the ledger embeds each entry's record	Assert that the manifest is absent instead of deleting it. The rest of the manifest-less VEX matrix is unchanged.

Coordination

This PR does not touch the UUID/hash constants. #1301 repins those to the republished minimist patch 642d7f02-…. Its body already lists these three failures as unrelated to the repin. The two PRs touch separate hunks of the same files and merge cleanly in either order.

Verification (macOS, live production, with #1301's repin applied locally on top)

• cargo test -p socket-patch-cli --test e2e_npm -- --ignored: 7/7 pass, including test_npm_global_lifecycle and test_npm_uuid_shortcut
• cargo test -p socket-patch-cli --test e2e_vendored_production -- --include-ignored yarn_berry_vendored_install_proof: pass (yarn@4.6.0, VEX-MATRIX|…|PASS)
• rustfmt is clean on both files

🤖 Generated with Claude Code

---

Note

Low Risk
Test-only updates to ignored live e2e suites; no runtime or CLI logic changes.

Overview
Updates three #[ignore] live e2e tests that still asserted v4 CLI semantics so they match v5 (CLI_CONTRACT.md). No production code changes.

e2e_npm::test_npm_global_lifecycle — Global rollback now uses --preserve-state so the manifest entry remains for the following apply -g; v5 default rollback is full-state and would leave nothing to re-apply. Adds an assertion that the patch record survives rollback.

e2e_npm::test_npm_uuid_shortcut — Bare socket-patch <UUID> is exercised as hosted get: lockfile resolved points at https://patch.socket.dev/…, installed tree and hash stay pristine, no .socket/manifest.json. A second fixture checks <UUID> --mode agent for in-place patch + manifest, matching the prior single-scenario expectation.

e2e_vendored_production (yarn berry manifest-less VEX) — Replaces remove_file(.socket/manifest.json) (which panicked) with an assertion that vendored scan never creates a manifest; the vendor ledger already embeds records in v5.

^{Reviewed by Cursor Bugbot for commit 9fb0100. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9fb0100. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review at 60174255e801.

• CI: required checks ci-ok and clippy green; 5 check suites succeeded. 1 superseded workflow run(s) show as cancelled; the required gates passed on this head.
• Mergeable against main, no CHANGELOG.md change.
• Bugbot reviewed this head; no unresolved review threads.

Labeled Ready for review by the burn-down agent. Slack announcement pending (connector unavailable this run).

---

Generated by Claude Code