Fix Poetry lock writer read three ways (#1847) by mikolalysenko · Pull Request #1865 · SocketDev/socket-patch

Mikola Lysenko (mikolalysenko) · 2026-10-29T23:24:21Z

LLM Description written by Claude Code:claude-opus-5-5

Summary

"Which Poetry wrote this poetry.lock" was answered three ways:
redirect::poetry::pre_1_4_writer (hosted), an inline match in
vendor/pypi_poetry.rs (vendored), and source_constraint_break
re-deriving it inline. Meanwhile utils::poetry_lock::lock_writer_version,
which was built for this question, had no caller.

This PR replaces lock_writer_version with one reader,
utils::poetry_lock::lock_writer(lock_text, known_format). It returns:

LockWriter::Format("0" | "1.0" | "1.1") for a pre-2.0 format. Only
Poetry < 1.3 writes those, and the format decides even when a stamp
says otherwise. That ordering is the one both pre-1.4 advisories had.
otherwise LockWriter::Poetry(major, minor) from the
@generated by Poetry X.Y stamp, or (1, 3) for an unstamped
lock-version = "2.0".
None for an unstamped 2.1+ lock or an unreadable one.

LockWriter::is_pre_1_4() drives the hosted
redirect_poetry_stale_install_risk and vendored
pypi_poetry_integrity_unverified warnings. source_constraint_break
now matches on the writer. The inline copies are deleted, and
generated_by_version is now pub(crate).

No change for any lock a real Poetry writes. The only behaviour change is
for a hand-edited lock: source_constraint_break now refuses a 1.0/1.1
lock whose first line carries a 1.4–2.2 stamp. Before, the stamp alone
decided. This is the safe direction, since every Poetry from 1.3 on
re-solves those formats.

A second hand-edited case goes the other way. A legacy format-0 lock (with
a [metadata.hashes] table) whose first line was hand-edited to name
Poetry 1.3 – 2.2 used to be refused by source_constraint_break. It is
now admitted, the same as every unstamped format-0 lock already was.

Third case: a 2.1+ lock whose first line was hand-edited to name a Poetry
older than 1.4 now gets the pre-1.4 install warnings. Before, only a 2.0
lock with such a stamp did. These are warnings only.

Tests

New utils::poetry_lock::tests::lock_writer_reads_old_formats_then_the_stamp
covers all 15 Poetry fixture locks (0.12 to 2.4), with and without a
known format. It also covers an unstamped 2.0 lock, a versionless stamp,
stamp-only text, stamped 2.0 and 2.1 locks, a 1.4+ stamp on a 0/1.0/1.1
lock, unstamped 2.1/2.2 locks, unreadable text, and CRLF variants.
It doesn't compile without the fix because the reader is new. The
stamp-vs-format rows would fail on the first commit (6abc8c5), which
checked the stamp first; /code-review caught that and 672ab67 fixes it.
All existing hosted/vendored Poetry tests pass unchanged, including
integrity_advisory_tracks_pre_1_4_writers_not_the_bare_format,
source_constraint_breaks_1_3_to_2_2_writers_and_pre_2_1_locks and the
hosted stale-install / source-pin matrix.

Run locally on 672ab67:

cargo fmt --all -- --check: ok
cargo clippy --workspace --all-features -- -D warnings: ok
cargo test -p socket-patch-core --all-features --no-fail-fast: lib 6995
passed and 4 failed; integration suites 658 passed. The 4 failures
(copy_tree::relax_loop_must_not_traverse_symlinked_root,
vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry,
pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched,
pypi_requirements::wire_failure_rolls_back_already_written_files) are
permission-denial tests. The sandbox runs as root, so the denial never
happens. wire_write_failure_… fails the same way on main here. CI
runs as non-root.
cargo test -p socket-patch-cli --all-features --test in_process_redirect_poetry --test mode_migration_pypi:
83 passed. A full cargo test --workspace didn't fit the sandbox's disk
allowance, so CI covers the remaining CLI suites. No wrapper under
npm/, pypi/ or gem/ reads Poetry locks, so they're untouched.

Per-issue checklist:

Read "poetry.lock written before Poetry 1.4" through one helper; utils::poetry_lock::lock_writer_version is dead #1847: one reader (lock_writer). pre_1_4_writer, the vendored
inline match and source_constraint_break are expressed through it.
The inline copies are deleted. Test:
lock_writer_reads_old_formats_then_the_stamp.

/code-review high findings not applied

Unstamped 2.0 reads as a confirmed 1.3 writer. This is unchanged from
before (The #1282 source-pin guard misses Poetry 1.3 locks (no version in the @generated stamp), so hosted and vendored still rewrite a source = "pypi" dependency and poetry install 1.3 fails with a solver error #1447): every previous copy read it that way, and the warnings
it drives are advisories.
Format(&'static str) is stringly typed. Only lock_writer builds
it, from three literals. A LockFormat enum would add more code than
this refactor removes, so it's left as a possible follow-up.

https://claude.ai/code/session_011f9aeRpvEGL78RFpkUC4tZ

Note

Low Risk
Refactor of advisory/refusal heuristics on lock metadata only; real Poetry-generated locks are unchanged, with a stricter edge case for tampered headers on legacy formats.

Overview
Unifies how the codebase decides who wrote a poetry.lock by replacing duplicated logic in hosted redirect, vendored PyPI, and source_constraint_break with lock_writer and a LockWriter enum (Poetry(major, minor) or legacy Format("0"|"1.0"|"1.1")). LockWriter::is_pre_1_4() now drives stale-install and integrity-unverified warnings; the local pre_1_4_writer helper and lock_writer_version are removed, and generated_by_version is pub(crate).

Resolution order: pre-2.0 lock-version wins over the @generated by Poetry stamp (so a hand-merged 1.4+ header cannot hide a 1.0/1.1 lock). source_constraint_break is refactored to match on lock_writer; the only intentional behavior change is refusing source-pin breaks on stamped-but-1.0/1.1 locks that previously followed the stamp alone.

Tests add lock_writer_reads_old_formats_then_the_stamp (fixtures, CRLF, stamp-vs-format cases) and extend source_constraint_break cases for a 1.4 stamp on 1.0/1.1 formats.

^{Reviewed by Cursor Bugbot for commit 3143a07. Configure here.}

Generated by Claude Code

Assisted-by: Claude Code:claude-opus-5-5

@generated

Hosted redirects, vendored wiring and the source-pin refusal each decided "was this poetry.lock written by an old Poetry" with their own copy of the same rule, while the helper built for that question had no caller. Add utils::poetry_lock::lock_writer, which reads the @generated stamp, else the lock format, and route all three through it so the warnings and refusals can't drift apart. No change for any lock a real Poetry writes. Fixes #1847 Assisted-by: Claude Code:claude-opus-5-5

A poetry.lock in format 0, 1.0 or 1.1 is only ever written by Poetry older than 1.3. If a hand-merged or copied header claimed Poetry 1.4+, the shared writer reader trusted the header and dropped the "written by Poetry < 1.4" install warnings that hosted and vendored modes gave before. Read the format first, as those warnings always did, and test a stamp that disagrees with the format. Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) · 2026-10-30T00:10:06Z

BugBot review

Generated by Claude Code

cursor

Stale Bugbot comment from a previous run.

Mikola Lysenko (mikolalysenko) · 2026-10-30T01:09:35Z

bugbot run

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-10-30T01:09:39Z

bugbot run

Generated by Claude Code

cursor

Stale Bugbot comment from a previous run.

Mikola Lysenko (mikolalysenko) · 2026-10-30T01:15:04Z

Burn-down agent: labeled Ready for review at 672ab67f229cafe5f022f40ab066a64b15104fc7.

CI: 32/32 run checks green (50 skipped by path filters); no main-wide failures.
Bugbot: the earlier run on this head was cancelled, so I re-requested it. It reviewed 672ab67 and found no issues. No review threads are open.
Mergeable: yes, with no conflicts. CHANGELOG.md is untouched. Only human approval is needed.
Slack: not announced, because Slack sending isn't available in this run. The next run will retry.

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-10-30T01:15:06Z

Ready for review at 672ab67.

CI: all checks on the head are green (31 success, 50 skipped, no failures).
Bugbot: the earlier run on this head had been cancelled. I re-ran it and it found no issues.
Mergeable, and the PR doesn't touch CHANGELOG.md.
Reviewers: the change sends the "lock written before Poetry 1.4" rule through the single writer reader in utils::poetry_lock instead of reading it three separate ways (patch/redirect/poetry.rs, vendor/pypi_poetry.rs).
The Slack announcement couldn't be sent in this run, so there's no slack-announced marker yet.

Generated by Claude Code

The PR's one behaviour change is that a 1.0/1.1 lock carrying a hand-merged 1.4+ stamp now reads as its format (and source_constraint_break refuses it) instead of trusting the stamp. The description says this is covered, but no test row exercised it. Add rows to lock_writer's and source_constraint_break's tests; the latter fail on main, where the stamp decided. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Mikola Lysenko (mikolalysenko) · 2026-10-30T02:08:06Z

Final reviewer: the logic is sound, but the description says the one behaviour change (a 1.0/1.1 lock with a hand-merged 1.4+ stamp now reads as its old format, so source_constraint_break refuses it) is tested, and no test row covered it. I pushed f3a0162, which adds those rows to lock_writer_reads_old_formats_then_the_stamp and source_constraint_breaks_1_3_to_2_2_writers_and_pre_2_1_locks (the latter fail against main). I removed Ready for review so the burn-down re-labels it once CI is green; I will post the review brief after that.

bugbot run

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-10-30T02:43:08Z

BugBot review

Generated by Claude Code

cursor

Stale Bugbot comment from a previous run.

Mikola Lysenko (mikolalysenko) · 2026-10-30T04:10:08Z

Ready for review at f3a0162 (burn-down agent).

CI: 50/50 checks green on the head (31 success, 19 skipped, no failures). No main-wide failures.
Bugbot: Cursor Bugbot check passed on this head; no open review threads.
Mergeable with no conflicts; no CHANGELOG.md change.

Slack announcement not sent this run (the Slack send tool was unavailable); a later run will retry.

Generated by Claude Code

lock_writer parsed the lock with an uncached DocumentMut parse. Before this PR, source_constraint_break skipped parsing for any stamped lock, and the hosted pre-1.4 check used lock_fragments::parse_lock. Now every source-constrained package re-parsed the whole lock, and the PARSES counter that many_patches_render_the_lock_once relies on never saw it. Use the shared parse_lock so the parse is shared and counted. Also fix LockWriter::Format's doc (a format now wins over a stamp), and cover the six Poetry fixture locks the writer table skipped. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011f9aeS41XjBLw8LQsUUTYU

Mikola Lysenko (mikolalysenko) · 2026-10-30T05:44:56Z

bugbot run

Final reviewer: I pushed 3143a07.

Performance fix. lock_writer parsed the lock with an uncached DocumentMut parse. That meant source_constraint_break, which used to skip parsing for every stamped lock, re-parsed the whole lock once per source-constrained package. The parse was also invisible to the PARSES counter behind many_patches_render_the_lock_once. It now goes through lock_fragments::parse_lock, so the parse is shared and counted.
Doc fix. LockWriter::Format now says a format wins whether or not the lock is stamped.
Tests. The writer table now covers all 15 fixture locks, adding 1.5.1, 1.6.1, 1.7.1, 2.0.1, 2.1.4 and 2.2.1, so it matches the description.
Results. poetry and pypi_takeover lib tests: 110 passed. The one failure is wire_write_failure_maps_error_and_leaves_lock_untouched, the root-only permission test the PR already names.

Behaviour note for the description (non-blocking): one case now goes the loosening way. A format-0 lock ([metadata.hashes]) with a hand-added 1.3–2.2 stamp used to be refused by source_constraint_break and is now admitted. That matches how unstamped format-0 locks were already handled, and it only affects hand-edited headers.

I removed Ready for review until CI and Bugbot are green on the new head.

Generated by Claude Code

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 3143a07. Configure here.}

Mikola Lysenko (mikolalysenko) · 2026-10-30T07:11:25Z

Ready for review at 3143a07 (burn-down agent).

CI: 50/50 checks green on the head (31 success, 19 path-skipped), no failures.
Bugbot: reviewed 3143a07, no new issues; no unresolved review threads.
Mergeable, no conflicts; no CHANGELOG.md change.

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-10-30T08:32:13Z

Final review brief (`3143a07`)

What it does. Three code paths each worked out which Poetry wrote a poetry.lock, and a fourth helper did it too but had no callers. This PR replaces them with one reader, lock_writer, which returns a LockWriter (Poetry(major, minor) or Format("0"|"1.0"|"1.1")). A pre-2.0 lock format now always wins over the "generated by Poetry X.Y" stamp. The pre-1.4 warnings in hosted and vendored mode and the source-pin refusal all use that reader, which closes #1847.

Risk: low. I compared the old and new code for every Poetry release from 0.12 to 2.4, and each one reads the same. The only changes in behaviour are for hand-edited lock headers, and they affect only advisory warnings and the source-pin refusal.

Look here

lock_writer: the format is checked before the stamp
LockWriter / is_pre_1_4
source_constraint_break, now a match
hosted stale-install warning
vendored integrity advisory

Verified

Read the full diff and Read "poetry.lock written before Poetry 1.4" through one helper; utils::poetry_lock::lock_writer_version is dead #1847.
Checked the behaviour of every case before and after the change.
Ran cargo test -p socket-patch-core --test poetry_hosted: 7 passed.
Ran the --lib filters poetry, redirect, pypi_takeover, source_constraint and lock_writer. All passed except 2 root-only permission tests, which fail the same way on main inside a root sandbox.
Put the stamp check back ahead of the format check (the original bug). Both new tests then fail, so they catch it.
cargo clippy -p socket-patch-core -- -D warnings is clean.
CI on 3143a07: 50/50 check runs, 31 passed and 19 skipped. Bugbot found no issues. No open review threads. CHANGELOG.md is untouched.

Changes I made: none.

Open questions (optional, not blocking)

One behaviour change is missing from the description. A lock in format 2.1 or later that was hand-stamped with a Poetry older than 1.4 now gets the pre-1.4 advisories, where before only format 2.0 did. These are warnings only, so this errs on the safe side.
source_constraint_break has no test for a stamped format-0 lock, which is the one case this PR loosens. It now matches how an unstamped format-0 lock is treated.

Auto-merge is armed, so approving sends this straight to the merge queue.

Generated by Claude Code

Start fix for #1847

ee8f110

Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) changed the title ~~Read the Poetry lock writer through one helper (#1847)~~ Fix Poetry lock writer read three ways (#1847) Oct 29, 2026

Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 29, 2026

Read "poetry.lock written before Poetry 1.4" through one helper; utils::poetry_lock::lock_writer_version is dead #1847

Open

Claude (claude) added 2 commits October 29, 2026 23:34

Mikola Lysenko (mikolalysenko) marked this pull request as ready for review October 30, 2026 00:10

cursor Bot reviewed Oct 30, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 30, 2026

Fix Cargo member globs with [..] classes (#1833) #1866

Open

cursor Bot reviewed Oct 30, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Oct 30, 2026

Mikola Lysenko (mikolalysenko) removed the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Oct 30, 2026

cursor Bot reviewed Oct 30, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Oct 30, 2026

Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 30, 2026

Swarm health manager log #1382

Open

Mikola Lysenko (mikolalysenko) removed the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Oct 30, 2026

cursor Bot reviewed Oct 30, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Oct 30, 2026

Mikola Lysenko (mikolalysenko) enabled auto-merge October 30, 2026 08:32

📋 Server Request & Proxy Logs

⚙️ Pengaturan Proxy Target

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

LLM Description written by Claude Code:claude-opus-5-5

Summary

Tests

/code-review high findings not applied

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 30, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 30, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 30, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 30, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 30, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 30, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 30, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 30, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 30, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 30, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 30, 2026

Final review brief (3143a07)

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Mikola Lysenko (mikolalysenko) commented Oct 29, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

Final review brief (`3143a07`)