Fix exact name treated as ambiguous in Target::ambiguity

When a bare package name like 'lodash' matched both an exact full name
(pkg:npm/lodash) and a last-segment hit (pkg:npm/@types/lodash), the
ambiguity check incorrectly flagged it as ambiguous and refused to act.

The fix checks if exactly one package has a full name that exactly
matches the typed name (case-insensitive, with PyPI canonicalization).
When such a unique exact match exists, the name is not ambiguous and
the exact match is preferred over any last-segment hits.

This preserves the existing behavior for truly ambiguous cases:
- 'core' matching both @angular/core and @babel/core (0 exact matches)
- 'six' matching both pkg:pypi/six and pkg:npm/six (2 exact matches)

While fixing the regression for common TypeScript scenarios:
- 'lodash' now correctly selects pkg:npm/lodash, not ambiguous with
  @types/lodash
- 'react' now correctly selects pkg:npm/react, not ambiguous with
  @types/react

Author: cursoragent

crates/socket-patch-cli/src/commands/scan/policy.rs

@@ -237,7 +237,9 @@ impl ScanPolicy {
     }
 
     fn recorded_uuid(&self, purl: &str) -> Option<&str> {
-        self.recorded.get(&PurlKey::new(purl).into_string()).map(String::as_str)
+        self.recorded
+            .get(&PurlKey::new(purl).into_string())
+            .map(String::as_str)
     }
 
     /// Step 3: the root, ecosystem and package filters. Returns whether the
@@ -269,7 +271,10 @@ impl ScanPolicy {
         }
         if self.root_verdict.is_err() {
             // Already reported as the root's one entry.
-        } else if report.filtered_purls.insert(PurlKey::new(purl).into_string()) {
+        } else if report
+            .filtered_purls
+            .insert(PurlKey::new(purl).into_string())
+        {
             report.filtered.push(FilteredEntry {
                 purl: Some(PurlKey::new(purl).into_string()),
                 uuid: None,
@@ -284,7 +289,10 @@ impl ScanPolicy {
     /// Record the purls with a newer patch (`updates[]`), for
     /// `retained[].upgradeAvailable`.
     pub(crate) fn set_update_purls<'a>(&self, purls: impl IntoIterator<Item = &'a str>) {
-        self.report().update_purls = purls.into_iter().map(|p| PurlKey::new(p).into_string()).collect();
+        self.report().update_purls = purls
+            .into_iter()
+            .map(|p| PurlKey::new(p).into_string())
+            .collect();
     }
 
     /// Steps 5-6: group the tier-accessible offers, keep retained packages
@@ -298,7 +306,10 @@ impl ScanPolicy {
         {
             let report = self.report();
             for offer in accessible {
-                if report.retained_purls.contains(&PurlKey::new(&offer.purl).into_string()) {
+                if report
+                    .retained_purls
+                    .contains(&PurlKey::new(&offer.purl).into_string())
+                {
                     continue;
                 }
                 grouped.entry(offer.purl.clone()).or_default().push(offer);

crates/socket-patch-cli/tests/e2e_redirect_yarn_classic_build.rs

@@ -900,7 +900,10 @@ async fn classic_offline_mirror_refuses_hosted_and_keeps_installs_working() {
         return;
     };
     assert!(
-        fx.proj.join("mirror").join(format!("{DEP}-{DEP_VERSION}.tgz")).is_file(),
+        fx.proj
+            .join("mirror")
+            .join(format!("{DEP}-{DEP_VERSION}.tgz"))
+            .is_file(),
         "the fixture install must populate the offline mirror"
     );
     let fresh = fx.tmp.path().join("fresh");
@@ -926,7 +929,11 @@ async fn classic_offline_mirror_refuses_hosted_and_keeps_installs_working() {
             String::from_utf8_lossy(&ci.stderr)
         );
         assert!(
-            !fresh.join("node_modules").join(DEP).join("index.js").exists(),
+            !fresh
+                .join("node_modules")
+                .join(DEP)
+                .join("index.js")
+                .exists(),
             "yarn < 1.7 is expected to install nothing from the mirror"
         );
         return;
@@ -948,7 +955,10 @@ async fn classic_offline_mirror_refuses_hosted_and_keeps_installs_working() {
         );
         let installed =
             std::fs::read(fresh.join("node_modules").join(DEP).join("index.js")).unwrap();
-        assert_eq!(installed, fx.orig, "the untouched lock installs the upstream bytes");
+        assert_eq!(
+            installed, fx.orig,
+            "the untouched lock installs the upstream bytes"
+        );
         std::fs::remove_dir_all(fresh.join("node_modules")).unwrap();
     }
 }

crates/socket-patch-cli/tests/e2e_vendor_yarn_berry_build.rs

@@ -729,7 +729,14 @@ async fn run_berry_capstone(driver: VendorDriver, yarnrc_extra: &str) {
 
 fn git(cwd: &Path, args: &[&str]) -> Output {
     let out = Command::new("git")
-        .args(["-c", "user.name=t", "-c", "user.email=t@t", "-c", "init.defaultBranch=main"])
+        .args([
+            "-c",
+            "user.name=t",
+            "-c",
+            "user.email=t@t",
+            "-c",
+            "init.defaultBranch=main",
+        ])
         .args(args)
         .current_dir(cwd)
         .output()
@@ -810,16 +817,30 @@ fn yarn_berry_vendored_tarball_survives_a_tgz_gitignore_rule() {
     };
     let (code, stdout, stderr) = run_socket(
         &proj,
-        &["vendor", "--json", "--offline", "--cwd", proj.to_str().unwrap()],
+        &[
+            "vendor",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+    );
+    assert_eq!(
+        code, 0,
+        "vendor failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
     );
-    assert_eq!(code, 0, "vendor failed.\nstdout:\n{stdout}\nstderr:\n{stderr}");
 
     git(&proj, &["add", "-A"]);
     git(&proj, &["commit", "-qm", "vendored"]);
     let fresh = tmp.path().join("fresh");
     git(
         tmp.path(),
-        &["clone", "-q", proj.to_str().unwrap(), fresh.to_str().unwrap()],
+        &[
+            "clone",
+            "-q",
+            proj.to_str().unwrap(),
+            fresh.to_str().unwrap(),
+        ],
     );
     let fresh_global = tmp.path().join("fresh-yarn-global");
     let ci = corepack(
@@ -854,14 +875,26 @@ fn yarn_berry_vendor_refuses_a_gitignored_socket_dir() {
     let pkg_before = std::fs::read(proj.join("package.json")).unwrap();
     let (code, stdout, stderr) = run_socket(
         &proj,
-        &["vendor", "--json", "--offline", "--cwd", proj.to_str().unwrap()],
+        &[
+            "vendor",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+    );
+    assert_eq!(
+        code, 1,
+        "vendor must fail.\nstdout:\n{stdout}\nstderr:\n{stderr}"
     );
-    assert_eq!(code, 1, "vendor must fail.\nstdout:\n{stdout}\nstderr:\n{stderr}");
     assert!(
         stdout.contains("vendor_artifact_gitignored"),
         "refusal code expected:\n{stdout}"
     );
     assert_eq!(std::fs::read(proj.join("yarn.lock")).unwrap(), lock_before);
-    assert_eq!(std::fs::read(proj.join("package.json")).unwrap(), pkg_before);
+    assert_eq!(
+        std::fs::read(proj.join("package.json")).unwrap(),
+        pkg_before
+    );
     assert!(!proj.join(format!(".socket/vendor/npm/{UUID}")).exists());
 }

crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs

@@ -556,8 +556,7 @@ async fn live_pipfile_lock_conflict_vetoes_the_requirements_redirect() {
 #[tokio::test]
 #[serial]
 async fn platform_wheel_is_not_pinned_into_the_lock() {
-    assert_wheel_tag_is_not_pinned("cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64")
-        .await;
+    assert_wheel_tag_is_not_pinned("cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64").await;
 }
 
 /// #1048: a pure wheel bound to one interpreter (`cp311-none-any`) fails

crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs

@@ -434,7 +434,10 @@ async fn hosted_bom_lock_and_workspace_read_like_their_plain_twins() {
     assert_eq!(code, 0, "scan --mode hosted should succeed on a BOM lock");
     let lock = std::fs::read_to_string(&lock_path).unwrap();
     assert!(lock.starts_with("\u{feff}lockfileVersion:"), "{lock}");
-    assert!(lock.contains(HOSTED_URL), "the BOM lock is redirected: {lock}");
+    assert!(
+        lock.contains(HOSTED_URL),
+        "the BOM lock is redirected: {lock}"
+    );
     let ws_path = tmp.path().join("pnpm-workspace.yaml");
     assert_eq!(
         std::fs::read_to_string(&ws_path).ok().as_deref(),
@@ -449,7 +452,10 @@ async fn hosted_bom_lock_and_workspace_read_like_their_plain_twins() {
         pristine,
         "rollback restores the BOM lock byte for byte"
     );
-    assert!(!ws_path.exists(), "the auto-created workspace file goes too");
+    assert!(
+        !ws_path.exists(),
+        "the auto-created workspace file goes too"
+    );
 
     // A BOM workspace file whose first key is the user's opt-out: left
     // byte-identical (no duplicate `trustLockfile`), lock still redirected.
@@ -475,7 +481,11 @@ async fn hosted_bom_lock_and_workspace_read_like_their_plain_twins() {
             "the lock is still redirected for {user_ws:?}"
         );
         let ws = std::fs::read_to_string(tmp.path().join("pnpm-workspace.yaml")).unwrap();
-        assert_eq!(ws, want.unwrap_or(user_ws), "workspace file for {user_ws:?}");
+        assert_eq!(
+            ws,
+            want.unwrap_or(user_ws),
+            "workspace file for {user_ws:?}"
+        );
         assert_eq!(ws.matches("trustLockfile").count(), 1, "{ws:?}");
     }
 }

crates/socket-patch-cli/tests/mode_migration_pypi.rs

@@ -1195,9 +1195,18 @@ async fn ledger_update_failure_changes_nothing() {
     set_mode(0o755);
     assert_eq!(code, 1, "{env:#}");
     assert_eq!(env["status"], "error", "{env:#}");
-    assert!(!env.to_string().contains("redirect_takeover_unpatched"), "{env:#}");
-    assert_eq!(std::fs::read(root.join("requirements.txt")).unwrap(), vendored);
-    assert_eq!(std::fs::read(root.join(".socket/vendor/state.json")).unwrap(), state);
+    assert!(
+        !env.to_string().contains("redirect_takeover_unpatched"),
+        "{env:#}"
+    );
+    assert_eq!(
+        std::fs::read(root.join("requirements.txt")).unwrap(),
+        vendored
+    );
+    assert_eq!(
+        std::fs::read(root.join(".socket/vendor/state.json")).unwrap(),
+        state
+    );
     assert!(root.join(format!(".socket/vendor/pypi/{UUID}")).exists());
 }
 

crates/socket-patch-core/src/crawlers/cargo_crawler.rs

@@ -300,8 +300,7 @@ fn read_crate_cargo_toml(crate_path: &Path, dir_name: &str) -> Option<(String, S
     let content = crate::utils::fs::read_regular_to_string_sync(&cargo_toml_path).ok()?;
 
     // Fallback: parse directory name as <name>-<version>
-    package_name_version(&content)
-        .or_else(|| CargoCrawler::parse_dir_name_version(dir_name))
+    package_name_version(&content).or_else(|| CargoCrawler::parse_dir_name_version(dir_name))
 }
 
 /// SECURITY: `find_by_purls` formats name/version into a `<name>-<version>`

crates/socket-patch-core/src/formats/mod.rs

@@ -29,8 +29,8 @@
 pub(crate) mod bun;
 pub mod cargo;
 pub mod composer;
-pub mod governing_locks;
 pub mod gem;
+pub mod governing_locks;
 pub(crate) mod maven;
 pub(crate) mod nuget;
 pub mod pnpm;

crates/socket-patch-core/src/hosted/memory/mod.rs

@@ -66,9 +66,9 @@ use crate::rollout::stage::{
     classify, lookup_incomplete, mentioned_uuids, offers_from_results, Offers, RecordedIndex, Row,
     Stage, ROLLOUT_DEFERRED,
 };
+use crate::utils::purl_key::PurlKey;
 use discover::Provider;
 use stages::{Planned, RewriteRefused, Rewritten, StageOptions};
-use crate::utils::purl_key::PurlKey;
 
 /// `"<crate version>+<git sha or 'unknown'>"`; the sha comes from the
 /// `SOCKET_PATCH_GIT_SHA` build-time variable.

crates/socket-patch-core/src/patch/redirect/mod.rs

@@ -77,9 +77,9 @@ use crate::formats::yarn::patterns::{
 use crate::formats::yarn::source::{classic_copy_source, CopySource};
 use crate::formats::yarn::stanzas::{stanza_key, BerryStanzas};
 #[cfg(test)]
-mod pnpm_equivalence_tests;
-#[cfg(test)]
 mod platform_wheel_tests;
+#[cfg(test)]
+mod pnpm_equivalence_tests;
 mod poetry;
 mod pypi_takeover;
 pub use pypi_takeover::preflight_pypi_takeover;
@@ -565,7 +565,7 @@ pub fn rewrite_registry_redirect_with_pipenv_version(
         bun_lockb_present,
         &std::collections::BTreeSet::new(),
         &std::collections::BTreeSet::new(),
-     &yarnrc::OuterYarnMirror::default(),
+        &yarnrc::OuterYarnMirror::default(),
     )
 }
 
@@ -6760,8 +6760,10 @@ fn rewrite_maven_pom(
     // One pass over the pom's repositories: `(id, url)` of each, which also
     // answers the per-dep URL-refresh check below while the pom is still
     // unchanged (a no-op rescan then never re-scans the pom per dep).
-    let original_repos: Vec<(String, Option<String>)> =
-        pom.as_deref().map(maven_repository_ids_and_urls).unwrap_or_default();
+    let original_repos: Vec<(String, Option<String>)> = pom
+        .as_deref()
+        .map(maven_repository_ids_and_urls)
+        .unwrap_or_default();
     let hosted_repo_generations: std::collections::BTreeSet<String> = original_repos
         .iter()
         .filter_map(|(id, _)| generation::pin_name_uuid(id, false).map(str::to_string))
@@ -10833,7 +10835,10 @@ mod tests {
             &[(YARNRC_REL, "yarn-offline-mirror: false\n")],
             &[(YARNRC_REL, "yarn-offline-mirror:\n")],
             &[(YARNRC_REL, "yarn-offline-mirror \"\"\n")],
-            &[(YARNRC_REL, "yarn-offline-mirror-pruning true\n# yarn-offline-mirror ./m\n")],
+            &[(
+                YARNRC_REL,
+                "yarn-offline-mirror-pruning true\n# yarn-offline-mirror ./m\n",
+            )],
             &[(npmrc::NPMRC_REL, "[scope]\nyarn-offline-mirror=./m\n")],
             &[
                 (YARNRC_REL, "yarn-offline-mirror false\n"),
@@ -10849,7 +10854,10 @@ mod tests {
             let mut r = RewriteResult::default();
             rewrite_yarn_classic(&files, std::slice::from_ref(&ovr), &mut r);
             assert!(r.warnings.is_empty(), "{rcs:?}: {:?}", r.warnings);
-            assert!(r.files["yarn.lock"].contains("http://p.test/lp.tgz"), "{rcs:?}");
+            assert!(
+                r.files["yarn.lock"].contains("http://p.test/lp.tgz"),
+                "{rcs:?}"
+            );
             assert!(r.refused_yarn_classic_uuids.is_empty(), "{rcs:?}");
         }
     }
@@ -10874,7 +10882,10 @@ mod tests {
         rewrite_yarn_classic(&files, std::slice::from_ref(&other), &mut r);
         assert!(r.refused_yarn_classic_uuids.is_empty());
         assert_eq!(
-            r.warnings.iter().map(|w| w.code.as_str()).collect::<Vec<_>>(),
+            r.warnings
+                .iter()
+                .map(|w| w.code.as_str())
+                .collect::<Vec<_>>(),
             ["redirect_yarn_classic_entry_not_found"]
         );
     }