style: cargo fmt

Pure rustfmt reflows (rewraps, trailing commas, brace elision) — no logic changes. Normalizes the #116 merge and this branch's test files to plain `cargo fmt` output. Assisted-by: Claude Code:claude-fable-5
Mikola Lysenko (mikolalysenko) · Jul 2, 2026 · Jul 1, 2026 · Jul 1, 2026 · Jul 1, 2026 · Jul 1, 2026
commit b47b9d4a7eae638068dda9e76a043afdf4e4f36a
diff --git a/crates/socket-patch-cli/src/args.rs b/crates/socket-patch-cli/src/args.rs
@@ -19,8 +19,7 @@ use clap::Args;
 
 use socket_patch_core::api::client::ApiClientEnvOverrides;
 use socket_patch_core::constants::{
-    DEFAULT_PATCH_API_PROXY_URL, DEFAULT_PATCH_MANIFEST_PATH,
-    DEFAULT_SOCKET_API_URL,
+    DEFAULT_PATCH_API_PROXY_URL, DEFAULT_PATCH_MANIFEST_PATH, DEFAULT_SOCKET_API_URL,
 };
 use socket_patch_core::crawlers::Ecosystem;
 use socket_patch_core::patch::vendor::VendorSource;

diff --git a/crates/socket-patch-cli/tests/cli_global_args.rs b/crates/socket-patch-cli/tests/cli_global_args.rs
@@ -82,11 +82,9 @@ fn global_flag_cases() -> Vec<(&'static str, Option<&'static str>, fn(&GlobalArg
         ("--vendor-url", Some("https://vendor.example.com"), |c| {
             assert_eq!(c.vendor_url.as_deref(), Some("https://vendor.example.com"))
         }),
-        (
-            "--patch-server-url",
-            Some("http://localhost:4026"),
-            |c| assert_eq!(c.patch_server_url.as_deref(), Some("http://localhost:4026")),
-        ),
+        ("--patch-server-url", Some("http://localhost:4026"), |c| {
+            assert_eq!(c.patch_server_url.as_deref(), Some("http://localhost:4026"))
+        }),
         ("--offline", None, |c| assert!(c.offline)),
         ("--global", None, |c| assert!(c.global)),
         ("--global-prefix", Some("/opt/global"), |c| {

diff --git a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
@@ -322,8 +322,15 @@ fn cargo_vendor_fresh_checkout_locked_offline_build_and_revert() {
     let vex_doc: serde_json::Value =
         serde_json::from_slice(&std::fs::read(&vex_path).unwrap()).unwrap();
     let vex_stmts = vex_doc["statements"].as_array().unwrap();
-    assert_eq!(vex_stmts.len(), 1, "vendored cargo patch must be attested: {vex_doc}");
-    assert_eq!(vex_stmts[0]["vulnerability"]["name"], "GHSA-vend-cargo-real");
+    assert_eq!(
+        vex_stmts.len(),
+        1,
+        "vendored cargo patch must be attested: {vex_doc}"
+    );
+    assert_eq!(
+        vex_stmts[0]["vulnerability"]["name"],
+        "GHSA-vend-cargo-real"
+    );
     assert_eq!(vex_stmts[0]["status"], "not_affected");
     assert_eq!(vex_stmts[0]["products"][0]["subcomponents"][0]["@id"], purl);
     assert!(

diff --git a/crates/socket-patch-cli/tests/e2e_vendor_golang_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_golang_build.rs
@@ -332,9 +332,19 @@ fn go_vendor_fresh_checkout_offline_build_and_revert() {
     let vex_doc: serde_json::Value =
         serde_json::from_slice(&std::fs::read(&vex_path).unwrap()).unwrap();
     let vex_stmts = vex_doc["statements"].as_array().unwrap();
-    assert_eq!(vex_stmts.len(), 1, "vendored go patch must be attested: {vex_doc}");
-    assert_eq!(vex_stmts[0]["vulnerability"]["name"], "GHSA-vend-golang-real");
-    assert_eq!(vex_stmts[0]["products"][0]["subcomponents"][0]["@id"], UPURL);
+    assert_eq!(
+        vex_stmts.len(),
+        1,
+        "vendored go patch must be attested: {vex_doc}"
+    );
+    assert_eq!(
+        vex_stmts[0]["vulnerability"]["name"],
+        "GHSA-vend-golang-real"
+    );
+    assert_eq!(
+        vex_stmts[0]["products"][0]["subcomponents"][0]["@id"],
+        UPURL
+    );
     assert!(
         vex_stmts[0]["impact_statement"]
             .as_str()

diff --git a/crates/socket-patch-cli/tests/e2e_vendor_npm_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_npm_build.rs
@@ -448,9 +448,18 @@ fn npm_vendor_vex_attests_against_vendored_tarball() {
     // Vendor (offline: blob staged locally).
     let (code, stdout, stderr) = run_socket(
         &proj,
-        &["vendor", "--json", "--offline", "--cwd", proj.to_str().unwrap()],
+        &[
+            "vendor",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+    );
+    assert_eq!(
+        code, 0,
+        "vendor failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
     );
-    assert_eq!(code, 0, "vendor failed.\nstdout:\n{stdout}\nstderr:\n{stderr}");
 
     // VEX against the vendored tarball (default verify mode).
     let vex_path = proj.join("out.vex.json");
@@ -471,7 +480,11 @@ fn npm_vendor_vex_attests_against_vendored_tarball() {
     let doc: serde_json::Value =
         serde_json::from_slice(&std::fs::read(&vex_path).unwrap()).unwrap();
     let stmts = doc["statements"].as_array().unwrap();
-    assert_eq!(stmts.len(), 1, "the vendored npm patch must be attested: {doc}");
+    assert_eq!(
+        stmts.len(),
+        1,
+        "the vendored npm patch must be attested: {doc}"
+    );
     assert_eq!(stmts[0]["vulnerability"]["name"], GHSA);
     assert_eq!(stmts[0]["status"], "not_affected");
     assert_eq!(stmts[0]["products"][0]["subcomponents"][0]["@id"], purl);

diff --git a/crates/socket-patch-cli/tests/e2e_vendor_pnpm_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_pnpm_build.rs
@@ -290,11 +290,18 @@ fn run_pnpm_capstone(pm: &str) {
             "pkg:npm/app@1.0.0",
         ],
     );
-    assert_eq!(code, 0, "vex failed ({pm}).\nstdout:\n{stdout}\nstderr:\n{stderr}");
+    assert_eq!(
+        code, 0,
+        "vex failed ({pm}).\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
     let vex_doc: serde_json::Value =
         serde_json::from_slice(&std::fs::read(&vex_path).unwrap()).unwrap();
     let vex_stmts = vex_doc["statements"].as_array().unwrap();
-    assert_eq!(vex_stmts.len(), 1, "vendored patch must be attested: {vex_doc}");
+    assert_eq!(
+        vex_stmts.len(),
+        1,
+        "vendored patch must be attested: {vex_doc}"
+    );
     assert_eq!(vex_stmts[0]["vulnerability"]["name"], "GHSA-vend-pnpm-real");
     assert_eq!(vex_stmts[0]["products"][0]["subcomponents"][0]["@id"], purl);
     assert!(

diff --git a/crates/socket-patch-cli/tests/e2e_vendor_pypi_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_pypi_build.rs
@@ -341,7 +341,11 @@ fn uv_vendor_fresh_checkout_frozen_offline_and_revert() {
     let vex_doc: serde_json::Value =
         serde_json::from_slice(&std::fs::read(&vex_path).unwrap()).unwrap();
     let vex_stmts = vex_doc["statements"].as_array().unwrap();
-    assert_eq!(vex_stmts.len(), 1, "vendored pypi patch must be attested: {vex_doc}");
+    assert_eq!(
+        vex_stmts.len(),
+        1,
+        "vendored pypi patch must be attested: {vex_doc}"
+    );
     assert_eq!(vex_stmts[0]["vulnerability"]["name"], "GHSA-vend-pypi-real");
     assert_eq!(vex_stmts[0]["products"][0]["subcomponents"][0]["@id"], PURL);
     assert!(

diff --git a/crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_build.rs
@@ -292,7 +292,11 @@ fn yarn_classic_vendor_fresh_checkout_frozen_offline_install_and_revert() {
     let vex_doc: serde_json::Value =
         serde_json::from_slice(&std::fs::read(&vex_path).unwrap()).unwrap();
     let vex_stmts = vex_doc["statements"].as_array().unwrap();
-    assert_eq!(vex_stmts.len(), 1, "vendored patch must be attested: {vex_doc}");
+    assert_eq!(
+        vex_stmts.len(),
+        1,
+        "vendored patch must be attested: {vex_doc}"
+    );
     assert_eq!(vex_stmts[0]["vulnerability"]["name"], "GHSA-vend-yarn-real");
     assert_eq!(vex_stmts[0]["products"][0]["subcomponents"][0]["@id"], purl);
     assert!(

diff --git a/crates/socket-patch-cli/tests/e2e_vex_redirect.rs b/crates/socket-patch-cli/tests/e2e_vex_redirect.rs
@@ -128,7 +128,11 @@ fn redirected_purl_attested_against_installed_tree() {
     let patched = b"redirected patched index\n";
     let after = compute_git_sha256_from_bytes(patched);
     let purl = scaffold_npm(cwd, "left-pad", "1.3.0", patched);
-    write_redirect_state(cwd, &purl, make_record(UUID, &after, "GHSA-rdir-1111", &["CVE-2024-1"]));
+    write_redirect_state(
+        cwd,
+        &purl,
+        make_record(UUID, &after, "GHSA-rdir-1111", &["CVE-2024-1"]),
+    );
     assert!(
         !cwd.join(".socket/manifest.json").exists(),
         "fixture sanity: a redirect project has no manifest"
@@ -146,7 +150,11 @@ fn redirected_purl_attested_against_installed_tree() {
 
     let doc: Value = serde_json::from_slice(&out.stdout).expect("VEX JSON on stdout");
     let stmts = doc["statements"].as_array().unwrap();
-    assert_eq!(stmts.len(), 1, "the redirected patch must be attested: {doc}");
+    assert_eq!(
+        stmts.len(),
+        1,
+        "the redirected patch must be attested: {doc}"
+    );
     assert_eq!(stmts[0]["vulnerability"]["name"], "GHSA-rdir-1111");
     assert_eq!(stmts[0]["status"], "not_affected");
     assert_eq!(stmts[0]["products"][0]["subcomponents"][0]["@id"], purl);
@@ -170,7 +178,11 @@ fn redirected_purl_bypasses_property7_filter() {
     let patched = b"redirected patched index\n";
     let after = compute_git_sha256_from_bytes(patched);
     let purl = scaffold_npm(cwd, "left-pad", "1.3.0", patched);
-    write_redirect_state(cwd, &purl, make_record(UUID, &after, "GHSA-rdir-keep", &["CVE-2024-2"]));
+    write_redirect_state(
+        cwd,
+        &purl,
+        make_record(UUID, &after, "GHSA-rdir-keep", &["CVE-2024-2"]),
+    );
 
     // Control: a plain manifest npm patch that VERIFIES against node_modules
     // but is neither redirected nor set up / manual — property 7 must drop it,
@@ -243,7 +255,11 @@ fn tampered_installed_file_omits_redirected_patch() {
     // The installed file does NOT hash to the record's afterHash.
     let after = compute_git_sha256_from_bytes(b"what the patch should contain\n");
     let purl = scaffold_npm(cwd, "left-pad", "1.3.0", b"tampered installed bytes\n");
-    write_redirect_state(cwd, &purl, make_record(UUID, &after, "GHSA-rdir-bad", &["CVE-2024-4"]));
+    write_redirect_state(
+        cwd,
+        &purl,
+        make_record(UUID, &after, "GHSA-rdir-bad", &["CVE-2024-4"]),
+    );
 
     let vex_path = cwd.join("out.vex.json");
     let out = cli()
@@ -324,7 +340,11 @@ fn redirected_no_verify_attests_without_installed_tree() {
 
     let doc: Value = serde_json::from_slice(&out.stdout).expect("VEX JSON on stdout");
     let stmts = doc["statements"].as_array().unwrap();
-    assert_eq!(stmts.len(), 1, "the redirected patch must be attested: {doc}");
+    assert_eq!(
+        stmts.len(),
+        1,
+        "the redirected patch must be attested: {doc}"
+    );
     assert_eq!(stmts[0]["vulnerability"]["name"], "GHSA-rdir-nv");
     assert_eq!(
         stmts[0]["impact_statement"].as_str().unwrap(),
@@ -362,9 +382,10 @@ fn no_verify_attests_redirected_patches_across_ecosystems() {
 
     let mut state = RedirectState::new();
     for (purl, ghsa) in cases {
-        state
-            .records
-            .insert(purl.to_string(), make_record(UUID, &"b".repeat(64), ghsa, &["CVE-2024-1"]));
+        state.records.insert(
+            purl.to_string(),
+            make_record(UUID, &"b".repeat(64), ghsa, &["CVE-2024-1"]),
+        );
     }
     let dir = cwd.join(".socket/vendor");
     std::fs::create_dir_all(&dir).unwrap();

diff --git a/crates/socket-patch-core/src/api/client.rs b/crates/socket-patch-core/src/api/client.rs
@@ -727,7 +727,10 @@ impl ApiClient {
         }
 
         // ── Step 1: resolve the grant URL + integrity ──────────────────────
-        let result = match self.request_vendor_package(uuid, free_only, vendor_url).await {
+        let result = match self
+            .request_vendor_package(uuid, free_only, vendor_url)
+            .await
+        {
             Ok(r) => r,
             Err(e) => return VendorServiceOutcome::Failed(e),
         };
@@ -743,9 +746,7 @@ impl ApiClient {
                     "Forbidden: not entitled to this patch (paid tier or no org access).".into(),
                 ))
             }
-            other => {
-                return VendorServiceOutcome::Unavailable(format!("unknown status `{other}`"))
-            }
+            other => return VendorServiceOutcome::Unavailable(format!("unknown status `{other}`")),
         }
 
         // Select the native tarball artifact and its sha512 (the universal
@@ -786,8 +787,7 @@ impl ApiClient {
                 if a.kind == "tarball" {
                     continue;
                 }
-                let (Some(url), Some(sha512)) =
-                    (a.url.as_deref(), a.integrity.sha512.as_deref())
+                let (Some(url), Some(sha512)) = (a.url.as_deref(), a.integrity.sha512.as_deref())
                 else {
                     continue;
                 };
@@ -876,9 +876,10 @@ impl ApiClient {
         let resp = resp.map_err(|e| ApiError::Network(format!("Network error: {e}")))?;
         let status = resp.status();
         if status == StatusCode::OK {
-            let parsed = resp.json::<PackageVendorResponse>().await.map_err(|e| {
-                ApiError::Parse(format!("Failed to parse package response: {e}"))
-            })?;
+            let parsed = resp
+                .json::<PackageVendorResponse>()
+                .await
+                .map_err(|e| ApiError::Parse(format!("Failed to parse package response: {e}")))?;
             return parsed.results.get(uuid).cloned().ok_or_else(|| {
                 ApiError::Other(format!("package response missing a result for {uuid}"))
             });
@@ -949,9 +950,7 @@ impl ApiClient {
     pub async fn download_artifact(&self, url: &str) -> Result<Vec<u8>, ApiError> {
         match self.download_vendor_archive(url).await {
             ServeDownload::Ok(bytes) => Ok(bytes),
-            ServeDownload::NotFound => {
-                Err(ApiError::Other(format!("artifact not found: {url}")))
-            }
+            ServeDownload::NotFound => Err(ApiError::Other(format!("artifact not found: {url}"))),
             ServeDownload::Pending => {
                 Err(ApiError::Other(format!("artifact still building: {url}")))
             }
@@ -2546,7 +2545,10 @@ mod vendor_package_tests {
         Mock::given(method("POST"))
             .and(path("/v0/orgs/acme/patches/package"))
             .and(body_partial_json(json!({ "uuids": [UUID] })))
-            .respond_with(ResponseTemplate::new(200).set_body_json(granted_body(&serve_url, "sha512-ABC123==")))
+            .respond_with(
+                ResponseTemplate::new(200)
+                    .set_body_json(granted_body(&serve_url, "sha512-ABC123==")),
+            )
             .expect(1)
             .mount(&server)
             .await;
@@ -2579,8 +2581,12 @@ mod vendor_package_tests {
         Mock::given(method("POST"))
             .and(path("/patch/package"))
             .and(NoAuthorizationHeader)
-            .and(body_partial_json(json!({ "uuids": [UUID], "freeOnly": true })))
-            .respond_with(ResponseTemplate::new(200).set_body_json(granted_body(&serve_url, "sha512-ZZ==")))
+            .and(body_partial_json(
+                json!({ "uuids": [UUID], "freeOnly": true }),
+            ))
+            .respond_with(
+                ResponseTemplate::new(200).set_body_json(granted_body(&serve_url, "sha512-ZZ==")),
+            )
             .expect(1)
             .mount(&server)
             .await;
@@ -2604,7 +2610,9 @@ mod vendor_package_tests {
         let serve_url = format!("{}{SERVE_PATH}", server.uri());
         Mock::given(method("POST"))
             .and(path("/v0/orgs/acme/patches/package"))
-            .respond_with(ResponseTemplate::new(200).set_body_json(granted_body(&serve_url, "BAREB64==")))
+            .respond_with(
+                ResponseTemplate::new(200).set_body_json(granted_body(&serve_url, "BAREB64==")),
+            )
             .mount(&server)
             .await;
         Mock::given(method("GET"))
@@ -2630,7 +2638,9 @@ mod vendor_package_tests {
         let baked = format!("https://patch.socket.dev{SERVE_PATH}");
         Mock::given(method("POST"))
             .and(path("/v0/orgs/acme/patches/package"))
-            .respond_with(ResponseTemplate::new(200).set_body_json(granted_body(&baked, "sha512-AA==")))
+            .respond_with(
+                ResponseTemplate::new(200).set_body_json(granted_body(&baked, "sha512-AA==")),
+            )
             .mount(&server)
             .await;
         Mock::given(method("GET"))
@@ -2670,7 +2680,9 @@ mod vendor_package_tests {
         let serve_url = format!("{}{SERVE_PATH}", server.uri());
         Mock::given(method("POST"))
             .and(path("/v0/orgs/acme/patches/package"))
-            .respond_with(ResponseTemplate::new(200).set_body_json(granted_body(&serve_url, "sha512-AA==")))
+            .respond_with(
+                ResponseTemplate::new(200).set_body_json(granted_body(&serve_url, "sha512-AA==")),
+            )
             .mount(&server)
             .await;
         Mock::given(method("GET"))
@@ -2721,7 +2733,8 @@ mod vendor_package_tests {
             Mock::given(method("POST"))
                 .and(path("/v0/orgs/acme/patches/package"))
                 .respond_with(
-                    ResponseTemplate::new(200).set_body_json(granted_body(&serve_url, "sha512-AA==")),
+                    ResponseTemplate::new(200)
+                        .set_body_json(granted_body(&serve_url, "sha512-AA==")),
                 )
                 .mount(&server)
                 .await;