Repin live minimist@1.2.2 suites to republished patch 642d7f02 (#1293)

[Mikola Lysenko (mikolalysenko)]

Fixes #1293.

Production withdrew the free minimist@1.2.2 patch 80630680-4da6-45f9-bba8-b888e0ffd58c and republished the CVE-2021-44906 fix as 642d7f02-ebc1-4ab0-99e2-07f5dd8463cb. The live test pins must follow the new artifact to unblock the merge queue.

Changes

• Repin the hosted/vendored production suites, npm and pnpm safety suites, Bun/vlt backtests, and Bun compatibility documentation to the replacement UUID.
• Update the patched index.js Git SHA-256 to ec956dcafb886f14315570bf3981d44aa12c561716abb46eed8b067aaa1f6bdf. The pristine hash is unchanged.
• Fix the vlt backtest's installed-file checks: the replacement record uses index.js and test/proto.js without a package/ prefix. Remove only that optional prefix, preserving nested paths and compatibility with older records. This fixes the nine failing native vlt jobs on the original revision.
• Add a regression test covering both record formats, pristine and patched bytes, and corrupt or missing nested files.

Offline mock UUIDs remain fixture identifiers. No production CLI behavior or CHANGELOG.md changes.

Validation

On macOS with Node 24.21.0:

• python3 -B -m unittest scripts.tests.test_backtest_harnesses -q: 85 tests, OK (one platform skip). The new regression reproduced the original IndexError before the fix.
• backtest-vlt.py --versions 1.2.0 --modes hosted vendored agent --jobs 3: all 36/36 live-production scenarios matched expectations, with no server-encoding blocks.
• cargo test --locked -p socket-patch-cli --test e2e_safety_pnpm --test e2e_hosted_production -- --include-ignored: 65 hosted + 23 pnpm tests passed. The hosted suite's Bun and pinned-vlt legs soft-skipped because their toolchains were not configured; the standalone vlt backtest above exercised vlt directly.
• Recomputed both published files' Git SHA-256 hashes from their patch bytes and verified the pinned index.js assertions match.
• Signed fix commit af6164ca7 is pushed. CI, Bun compatibility, and vlt compatibility all passed: 282 successful checks, 12 conditional skips, zero failures or pending checks. Both required gates (ci-ok and clippy) and all ten checks that failed on the original revision are green.

The original PR validation also recorded v5 expectation drift in the on-demand e2e_npm shortcut/global tests and the vendored Yarn Berry manifest check. Those suites are outside the CI gate and their expectations are unchanged here.

---

Note

Low Risk
Test and documentation constant updates only; no production CLI or runtime behavior changes.

Overview
Production republished the free minimist@1.2.2 patch (same CVE-2021-44906 fix) under a new UUID after withdrawing 80630680-…. This PR repins every live-production and backtest harness that depended on the old artifact.

NPM_UUID / UUID is now 642d7f02-ebc1-4ab0-99e2-07f5dd8463cb in hosted/vendored production e2e (e2e_hosted_production, e2e_vendored_production), npm e2e (e2e_npm, e2e_safety_pnpm), scripts/backtest-bun.py, scripts/backtest-vlt.py, and docs/testing/bun-compatibility.md.

Content assertions for the patched index.js use the new after git-blob hash (ec956dca…); the unpatched before hash is unchanged. Offline mocks and fixtures that only used the old UUID as an opaque string were intentionally left alone.

^{Reviewed by Cursor Bugbot for commit d344040. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent).

• Head: d3440400
• CI: all checks green incl. ci-ok, hosted-e2e and e2e_safety_pnpm, except the vlt native (*) compat legs, which fail the same way on main at a8e9397.
• Bugbot: reviewed this head, no findings; no open review threads.
• No CHANGELOG.md changes.
• Unblocks the merge queue for every PR (Merge queue blocked: production no longer publishes free minimist@1.2.2 patch #1293). Overlaps Follow the republished minimist canary patch #1302 (canary repin); reviewer should pick one or land both.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] Heads-up from #1290, which ports this change: once scripts/backtest-vlt.py changes, the native vlt legs run, and with the new patch 642d7f02 they fail with IndexError at backtest-vlt.py:1072. The new patch keys its files without the package/ prefix, so key.split('/', 1)[1] breaks. #1302 already fixes it with key.removeprefix('package/'), so this PR needs that line too.

---

Generated by Claude Code