Locate hosted Maven pom edits and their upstream restore through the formats::maven element scanner

[mikolalysenko]

[agent] Filed by the scheduled architecture audit routine (ecosystems and formats). Register: discussion #560 register.

Kind: refactor (it fixes bugs as a side effect). Source: review Part 5.4, register E10; child of #715.

Problem

The hosted Maven rewriter and its upstream restore find their edit points in the raw pom text:

• patch/redirect/mod.rs#L6052-L6099:`` MAVEN_DEPENDENCY_BLOCK_RE (`(?s)<dependency\b[^>]>.?`) and `maven_tag_inner_range`, which takes the first `` / `` / `` substring in the block.
• L6240 and L6389:`` "already wired" is pom_text.contains("<id>{repo_id}</id>").
• insert_maven_repository / insert_maven_dependency_management L6510-L6545:`` replacen("<repositories>"), `(?s)\s*`, `replacen("")`.
• Restore reuses the same regex in upstream/maven.rs#L59-L111`` (dep_matches, `dm_sections`, `remove_repository`).

None of these skip comments, CDATA, <profiles>, <build><plugins>…<dependencies> or <exclusions>. The reader that hosted VEX uses on the same file, formats::maven::parse_pom, skips all of them, with offsets preserved (blank_non_markup / open_tags / elements).`` So the writer edits elements the reader then refuses to attest.

Symptoms

• Hosted Maven rewriter edits commented-out, plugin and profile markup, so builds either stay unpatched or break #259: edits land in commented-out, plugin and profile markup.
• Maven pom rewrites add a second <repositories> or <dependencyManagement> section when the existing one is self-closed or has a comment before <dependencies>, so Maven refuses the pom #342 (hosted rows): a self-closed <repositories/> / <dependencyManagement/>, or a comment before <dependencies>, gets a duplicate section.
• Hosted Maven adds a dependencyManagement pin that the direct literal overrides when the dependency's groupId/artifactId is a ${property} or <exclusions> come first, so the build stays unpatched while scan reports redirected and VEX attests not_affected #683 (the <exclusions>-first half): the exclusion's <groupId> is read as the dependency's. The ${property} coordinate half needs property resolution and is out of scope here.
• Hosted Maven "redirected" is confirmed by substring, so the scan envelope and ledger claim patches that vex refuses and Maven never enforces #260 is helped (the edit lands where VEX looks), but its substring confirmation is a separate fix.

I'll comment once on each.

Proposed change

1. In formats/maven, expose a small offset-preserving query API over the masked text that parse_pom already builds: project-scope <dependency> elements (with managed / in_profile / in-build flags, <exclusions> blanked), the child-text ranges of groupId / artifactId / version / type, and the project-level <repositories> / <dependencyManagement><dependencies> / </project> anchors (self-closed forms included). parse_pom is rebuilt on the same calls.
2. In the hosted rewriter, replace MavenDependencyMatch / maven_tag_inner_range / MAVEN_DEPENDENCY_BLOCK_RE / find_maven_dependency_matches, the <id> substring checks and the two insert_* anchors with those queries. The byte splices and the warning codes stay.
3. In restore, dep_matches and dm_sections use the same queries, and restore's import of the hosted regex is deleted.

Deleted: MAVEN_DEPENDENCY_BLOCK_RE, maven_tag_inner_range, maven_tag_text_in, find_maven_dependency_matches, restore's dep_matches / dm_sections regexes.

Size and scope

formats/maven/mod.rs (+80), patch/redirect/mod.rs (−70 / +50), patch/redirect/upstream/maven.rs (−40 / +~30), plus tests. About 300 changed production lines. Out of scope: vendored build_repo_edit, the reactor, the CRLF of inserted blocks (#273), and ${property} coordinates.

Acceptance criteria

• Regression tests in redirect for: a commented-out <dependency> with a literal version beside a versionless real one (the pin goes to <dependencyManagement>, the comment is byte-identical); a plugin <dependencies> entry for the same GA (untouched); <exclusions> before <groupId> (the direct literal is rewritten); <repositories/> and <dependencyManagement/> self-closed, and a comment between <dependencyManagement> and <dependencies> (no second section, Maven-parseable output)
• For each case, vex::discover::maven attributes the rewritten pom (a round-trip test: rewrite, then discover)
• The Maven redirect goldens (tests/fixtures/redirect/maven), upstream::maven tests (refusals_change_nothing, crlf_pom_round_trips, …) and the hosted e2e stay green; restore of every new case is byte-exact
• grep -n MAVEN_DEPENDENCY_BLOCK_RE -r crates finds nothing

Dependencies

None blocking. Second child of #715; independent of #716. Should land before the child that moves maven_reactor::Doc into formats/maven, which then swaps the scanner under these queries without touching callers.

[mikolalysenko]

[agent] Triaged as priority:p3 (Maven refactor). Child of #715; not a duplicate, and no open PR covers it.

---

Generated by Claude Code