Fix JSON writers dropping CRLF/BOM/indent (#324, #351) - #357

LLM Description written by Claude Code:claude-opus-5-5

Fixes #324
Fixes #351

Summary

npm locks and composer.json now keep their own layout when socket-patch edits them, and the undo commands put the original bytes back.

• npm (npm lock rewrites drop CRLF (and hosted drops tab indent), so rollback and vendor --revert are not byte-exact; BOM locks are refused #324): four paths re-serialized package-lock.json / npm-shrinkwrap.json with LF endings: scan --mode hosted, its rollback, scan --mode vendored and vendor --revert. Hosted mode also forced a 2-space indent. They now render the lock through the existing vendor::common::JsonLayout, which keeps the BOM, indent, line ending and trailer.
  • A UTF-8 BOM lock, which npm installs from, used to be skipped as redirect_npm_lock_unparseable in hosted mode and refused as vendor_lockfile_version_unsupported in vendored mode. Both now read past the BOM and keep it.
  • VEX discovery (vex::discover::parse_json) and the npm lock inventory read BOM locks too, so a wired BOM lock is still attested.
• Composer (Composer setup rewrites a CRLF composer.json as LF (and un-escapes \/ and \uXXXX), so setup --remove does not restore it byte-for-byte #351): setup / setup --remove no longer re-serialize the whole composer.json. A new splice_scripts edits only the top-level scripts value, the way Composer's own JsonManipulator does:
  • The value is rendered in the file's indent, line ending, and slash and unicode escaping. That rendering is render_in_style_of, factored out of the composer.lock entry splicer.
  • A new scripts is appended as the last member, and removing it cuts exactly that span back out. That's why setup + setup --remove is byte-exact.
  • When the root has no member to anchor on, it falls back to JsonLayout.
• Docs: a CHANGELOG Fixed entry. README already promised a byte-for-byte vendor --revert / remove; this makes that true for CRLF, tab and BOM locks.

Root cause

The npm lock writers and Composer setup re-serialized the parsed document through either a fixed 2-space/LF serializer (patch/redirect/mod.rs serialize_json) or detect_indent + serialize_json. Neither keeps line endings or a BOM. serde_json::from_str / from_slice also reject a BOM outright. The layout-preserving JsonLayout already existed for package.json and yarn berry, but these writers never used it. The escape half of #351 needed a span-level edit, because any parse and re-serialize normalizes escapes.

Test evidence

For the npm and VEX rows, red was checked by running the tests before the fix commit, and for VEX by reverting parse_json alone. The Composer tests ran red before splice_scripts was written.

• SOCKET_PATCH_NPM_E2E_REQUIRED=1 cargo test -p socket-patch-cli --all-features --test e2e_vendor_npm_build --test e2e_redirect_npm_build -- --include-ignored: 14 + 15 passed (real npm 10.9.7, Node 22).
• cargo test -p socket-patch-cli --all-features --test e2e_composer --test setup_matrix_composer -- --include-ignored: all passed.
• e2e_vendor_composer_build: 15 passed, 2 failed. The 2 failures (composer_vendor_fast_path_heals_legacy_copy, composer_vendor_keeps_files_mirror_filters_would_drop) are sandbox-only. Composer here fell back to a source install, so the vendored copy carries .git/HEAD. That's the separate Composer vendor copies a --prefer-source package's .git into .socket/vendor, so git commits it as an embedded repo and a fresh clone installs an empty package #355, and this PR doesn't touch that code. Both pass in CI.
• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo fmt --all -- --check: the new code is rustfmt-clean. The remaining diffs are already on main, in files and hunks this PR doesn't touch.
• cargo test --workspace --all-features --no-fail-fast: 10,400 passed and 22 failed. The 22 are the same sandbox-only set reported on Fix #258: state the real Maven Trusted Checksums floor #322, Fix Poetry venv discovery to match Poetry (#327, #329) #330, Fix npm VEX attesting packages with an unpatched bundled copy (#325) #337 and Fix npm rewiring git/URL/file lock entries (#326) #345: write-failure and permission tests that fail because the sandbox runs as root, plus the peak-RSS stage_local_artifact_caps_oversized_artifact_before_buffering.
• The npm, PyPI and gem wrappers only dispatch, so they need no change.
• CI on 0dbe6cc: green. 561 check runs: 559 success, 2 skipped (downgrade and canary). Bugbot's review of 0dbe6cc found no issues.

Notes

• This touches rewrite_one_npm_lock and vendor/npm_lock.rs next to Fix npm rewiring git/URL/file lock entries (#326) #345, but at different lines: the parse and serialize calls here, entry selection there. Whichever lands second should need at most a trivial merge.
• Not changed: the pnpm-path package.json writes and the Pipenv / composer.lock whole-document fallbacks still use detect_indent + serialize_json. No open issue reports them. They're candidates for the same JsonLayout switch in a follow-up.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GZ6Poya3NwsgeV8gN7WL3Q

Generated by Claude Code