SocketDev
diff --git a/‎Cargo.lock‎
Lines changed: 2 additions & 0 deletions b/‎Cargo.lock‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎README.md‎
Lines changed: 4 additions & 1 deletion b/‎README.md‎
Lines changed: 4 additions & 1 deletion
diff --git a/‎crates/socket-patch-cli/CLI_CONTRACT.md‎
Lines changed: 64 additions & 7 deletions b/‎crates/socket-patch-cli/CLI_CONTRACT.md‎
Lines changed: 64 additions & 7 deletions
diff --git a/‎crates/socket-patch-cli/Cargo.toml‎
Lines changed: 3 additions & 0 deletions b/‎crates/socket-patch-cli/Cargo.toml‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎crates/socket-patch-cli/src/args.rs‎
Lines changed: 14 additions & 0 deletions b/‎crates/socket-patch-cli/src/args.rs‎
Lines changed: 14 additions & 0 deletions
diff --git a/‎crates/socket-patch-cli/src/commands/apply.rs‎
Lines changed: 165 additions & 26 deletions b/‎crates/socket-patch-cli/src/commands/apply.rs‎
Lines changed: 165 additions & 26 deletions
@@ -233,7 +233,10 @@ socket-patch scan -g
 # Scan + apply + emit an OpenVEX attestation in one pass
 socket-patch scan --json --sync --yes --vex socket.vex.json
 
-# Vendor every patched dependency (committable; see the vendor command)
+# Vendor every patched dependency (committable; see the vendor command).
+# Works on a completely fresh clone: dependencies listed in the lockfile
+# but not yet installed are fetched pristine from their registry and
+# integrity-verified against the lockfile before vendoring.
 socket-patch scan --json --vendor --yes
 
 # Same, but keep the manifest out of it entirely
 
@@ -59,6 +59,9 @@ setup-e2e = []
 
 [dev-dependencies]
 sha2 = { workspace = true }
+# scan_vendor_e2e builds pristine registry tarballs for the auto-fetch tests.
+tar = { workspace = true }
+flate2 = { workspace = true }
 hex = { workspace = true }
 wiremock = { workspace = true }
 portable-pty = { workspace = true }
 
@@ -144,6 +144,19 @@ pub struct GlobalArgs {
     )]
     pub offline: bool,
 
+    /// Treat a beforeHash mismatch as a hard error. By DEFAULT a file whose
+    /// on-disk content matches neither the patch's beforeHash nor its
+    /// afterHash is overwritten with the full verified patched content and
+    /// surfaced as a stderr warning (`content_mismatch_overwritten`); this
+    /// flag restores the fail-closed behavior. `--force` overrides it.
+    #[arg(
+        long,
+        env = "SOCKET_STRICT",
+        default_value_t = false,
+        value_parser = parse_bool_flag,
+    )]
+    pub strict: bool,
+
     /// Operate on globally-installed packages.
     #[arg(
         long = "global",
@@ -378,6 +391,7 @@ impl Default for GlobalArgs {
             ecosystems: None,
             download_mode: "diff".to_string(),
             offline: false,
+            strict: false,
             global: false,
             global_prefix: None,
             json: false,
 
@@ -6,8 +6,111 @@ use socket_patch_core::crawlers::{
 use socket_patch_core::manifest::operations::read_manifest;
 use socket_patch_core::manifest::schema::PatchRecord;
 use socket_patch_core::patch::apply::{
-    apply_package_patch, verify_file_patch, ApplyResult, PatchSources, VerifyStatus,
+    apply_package_patch, verify_file_patch, ApplyResult, MismatchPolicy, PatchSources, VerifyStatus,
 };
+/// Files whose pre-apply content matched NEITHER hash and were (or would
+/// be) overwritten with the verified patched content — the promoted
+/// verify signature `apply_package_patch` leaves behind under the default
+/// mismatch policy.
+pub(crate) fn mismatch_overwritten_files(result: &ApplyResult) -> Vec<String> {
+    result
+        .files_verified
+        .iter()
+        .filter(|v| {
+            v.status == VerifyStatus::Ready
+                && v.expected_hash.is_some()
+                && v.current_hash != v.expected_hash
+        })
+        .map(|v| v.file.clone())
+        .collect()
+}
+
+/// Surface one mismatch-overwrite per file on stderr (human mode).
+fn warn_mismatch_overwrites(result: &ApplyResult, common: &GlobalArgs) {
+    if common.json || common.silent {
+        return;
+    }
+    for file in mismatch_overwritten_files(result) {
+        eprintln!(
+            "Warning (content_mismatch_overwritten): {} {file} did not match the patch's \
+             expected original content; applied the full verified patched content instead \
+             (pass --strict to fail on mismatches)",
+            socket_patch_core::utils::purl::normalize_purl(&result.package_key)
+        );
+    }
+}
+
+/// The default mismatch policy applies the FULL patched content for
+/// mismatched files — and the full content lives in the afterHash blob,
+/// which the default `--download-mode diff` may not have staged. Probe the
+/// in-scope packages for mismatches and fetch the missing afterHash blobs
+/// by hash (online only) so the apply below can fall through diff → blob.
+async fn ensure_blobs_for_mismatches(
+    args: &ApplyArgs,
+    manifest: &socket_patch_core::manifest::schema::PatchManifest,
+    all_packages: &HashMap<String, std::path::PathBuf>,
+    blobs_path: &Path,
+) {
+    if args.common.strict && !args.force {
+        return; // strict fails on mismatch — nothing to fetch
+    }
+    let mut needed: std::collections::HashSet<String> = std::collections::HashSet::new();
+    for (purl, pkg_path) in all_packages {
+        let Some(record) = manifest.patches.get(purl) else {
+            continue;
+        };
+        for (file_name, info) in &record.files {
+            if info.before_hash.is_empty() {
+                continue;
+            }
+            let verify = verify_file_patch(pkg_path, file_name, info).await;
+            if verify.status == socket_patch_core::patch::apply::VerifyStatus::HashMismatch
+                && tokio::fs::metadata(blobs_path.join(&info.after_hash))
+                    .await
+                    .is_err()
+            {
+                needed.insert(info.after_hash.clone());
+            }
+        }
+    }
+    if needed.is_empty() {
+        return;
+    }
+    if args.common.offline {
+        if !args.common.silent && !args.common.json {
+            eprintln!(
+                "Warning: {} mismatched file(s) need their full patched blob, but --offline \
+                 prevents fetching; those files will fail to apply",
+                needed.len()
+            );
+        }
+        return;
+    }
+    if !args.common.silent && !args.common.json {
+        eprintln!(
+            "Downloading {} full patched blob(s) for mismatched file(s)...",
+            needed.len()
+        );
+    }
+    let (client, _) = get_api_client_with_overrides(args.common.api_client_overrides()).await;
+    let _ = socket_patch_core::api::blob_fetcher::fetch_blobs_by_hash(
+        &needed, blobs_path, &client, None,
+    )
+    .await;
+}
+
+/// The mismatch policy this run applies with: `--force` ⊃ default
+/// (adds the missing-file skip), `--strict` restores fail-closed.
+pub(crate) fn mismatch_policy(force: bool, strict: bool) -> MismatchPolicy {
+    if force {
+        MismatchPolicy::Force
+    } else if strict {
+        MismatchPolicy::Strict
+    } else {
+        MismatchPolicy::Warn
+    }
+}
+
 #[cfg(feature = "golang")]
 use socket_patch_core::patch::go_redirect::{
     apply_go_redirect, reconcile_go_redirects, verify_go_redirect_state,
@@ -102,7 +205,7 @@ async fn try_local_go_apply(
     patch: &PatchRecord,
     sources: &PatchSources<'_>,
     common: &GlobalArgs,
-    force: bool,
+    policy: MismatchPolicy,
 ) -> Option<ApplyResult> {
     if !is_local_go(purl, common) {
         return None;
@@ -126,7 +229,7 @@ async fn try_local_go_apply(
             sources,
             Some(&patch.uuid),
             common.dry_run,
-            force,
+            policy,
         )
         .await,
     )
@@ -139,7 +242,7 @@ async fn try_local_go_apply(
     _patch: &PatchRecord,
     _sources: &PatchSources<'_>,
     _common: &GlobalArgs,
-    _force: bool,
+    _policy: MismatchPolicy,
 ) -> Option<ApplyResult> {
     None
 }
@@ -538,6 +641,21 @@ pub async fn run(args: ApplyArgs) -> i32 {
                 }
                 for result in &results {
                     env.record(result_to_event(result, args.common.dry_run));
+                    // Mismatch overwrites ride as Skipped warning events
+                    // (same pattern as the vendor warnings): the package's
+                    // Applied event stands, the warning is per-file.
+                    for file in mismatch_overwritten_files(result) {
+                        env.record(
+                            PatchEvent::new(PatchAction::Skipped, result.package_key.clone())
+                                .with_reason(
+                                    "content_mismatch_overwritten",
+                                    format!(
+                                        "{file} did not match the patch's expected original \
+                                         content; the full verified patched content was applied"
+                                    ),
+                                ),
+                        );
+                    }
                     // Sidecar records live on the envelope, not on
                     // individual events. Consumers iterate
                     // `envelope.sidecars[]` and JOIN against
@@ -609,9 +727,16 @@ pub async fn run(args: ApplyArgs) -> i32 {
                             } else {
                                 format!(" (via {})", tags.join("+"))
                             };
-                            println!("  {}{}", result.package_key, suffix);
+                            println!(
+                                "  {}{}",
+                                socket_patch_core::utils::purl::normalize_purl(&result.package_key),
+                                suffix
+                            );
                         } else if all_files_already_patched(result) {
-                            println!("  {} (already patched)", result.package_key);
+                            println!(
+                                "  {} (already patched)",
+                                socket_patch_core::utils::purl::normalize_purl(&result.package_key)
+                            );
                         }
                     }
                 }
@@ -888,6 +1013,7 @@ async fn apply_patches_inner(
     }
 
     // Apply patches
+    ensure_blobs_for_mismatches(args, &manifest, &all_packages, &blobs_path).await;
     let mut has_errors = false;
 
     // Group release-variant PURLs by base. PyPI (`?artifact_id=`),
@@ -969,6 +1095,7 @@ async fn apply_patches_inner(
                     blobs_path: &blobs_path,
                     packages_path: Some(&packages_path),
                     diffs_path: Some(&diffs_path),
+                    mem_blobs: None,
                 };
                 let result = apply_package_patch(
                     variant_purl,
@@ -977,10 +1104,11 @@ async fn apply_patches_inner(
                     &sources,
                     Some(&patch.uuid),
                     args.common.dry_run,
-                    args.force,
+                    mismatch_policy(args.force, args.common.strict),
                 )
                 .await;
 
+                warn_mismatch_overwrites(&result, &args.common);
                 // A variant that reached apply is the installed distribution
                 // (it passed the first-file check, or `--force` bypassed it),
                 // so record it as matched whether or not the patch succeeded.
@@ -1052,32 +1180,40 @@ async fn apply_patches_inner(
                 blobs_path: &blobs_path,
                 packages_path: Some(&packages_path),
                 diffs_path: Some(&diffs_path),
+                mem_blobs: None,
             };
             // Local go redirects to a project-local patched copy under
             // `.socket/go-patches/` wired via a `go.mod` `replace` (the module
             // cache is `go.sum`-verified, so in-place patching can't build).
             // Everything else — npm/pypi/gem and cargo (vendored or registry
             // cache) — patches in place via `apply_package_patch`. Without the
             // `golang` feature `try_local_go_apply` is an inert `None`.
-            let result =
-                match try_local_go_apply(purl, pkg_path, patch, &sources, &args.common, args.force)
+            let result = match try_local_go_apply(
+                purl,
+                pkg_path,
+                patch,
+                &sources,
+                &args.common,
+                mismatch_policy(args.force, args.common.strict),
+            )
+            .await
+            {
+                Some(r) => r,
+                None => {
+                    apply_package_patch(
+                        purl,
+                        pkg_path,
+                        &patch.files,
+                        &sources,
+                        Some(&patch.uuid),
+                        args.common.dry_run,
+                        mismatch_policy(args.force, args.common.strict),
+                    )
                     .await
-                {
-                    Some(r) => r,
-                    None => {
-                        apply_package_patch(
-                            purl,
-                            pkg_path,
-                            &patch.files,
-                            &sources,
-                            Some(&patch.uuid),
-                            args.common.dry_run,
-                            args.force,
-                        )
-                        .await
-                    }
-                };
+                }
+            };
 
+            warn_mismatch_overwrites(&result, &args.common);
             if !result.success {
                 has_errors = true;
                 if !args.common.silent && !args.common.json {
@@ -1111,7 +1247,10 @@ async fn apply_patches_inner(
             unmatched.len()
         );
         for purl in &unmatched {
-            eprintln!("  - {}", purl);
+            eprintln!(
+                "  - {}",
+                socket_patch_core::utils::purl::normalize_purl(purl)
+            );
         }
     }
 
@@ -1289,7 +1428,7 @@ mod tests {
             .enumerate()
             .map(|(i, status)| VerifyResult {
                 file: format!("package/f{i}.js"),
-                status: status.clone(),
+                status: *status,
                 message: None,
                 current_hash: None,
                 expected_hash: None,