Only warn berry migration risk when the classic lock holds a pin

[Mikola Lysenko (mikolalysenko)]

Follow-up to #917 (merged), fixing a Cursor Bugbot finding that landed after the merge.

Bugbot finding (Low severity, on #917)

Berry warning fires without a pin. any_pinned is set from matched_any after a classic entry matches, including when an offline-mirror refusal then skips the rewrite. The advisory still claims the lock carries hosted pins, so a first run that writes nothing reports redirect_yarn_classic_berry_migration_risk alongside redirect_yarn_classic_offline_mirror.

Fix

rewrite_yarn_classic (crates/socket-patch-core/src/patch/redirect/mod.rs) now tracks a separate pinned_any per dependency:

• An entry that is rewritten counts as pinned.
• An entry skipped by the offline-mirror refusal counts as pinned only if its block already contains the hosted artifact URL (an earlier run wrote the pin, so the berry-migration risk is real).
• any_pinned (which gates redirect_yarn_classic_berry_migration_risk) is now fed from pinned_any instead of matched_any.

Tests

New unit test yarn_classic_berry_risk_follows_pins_under_offline_mirror_refusal:

• first hosted run under an offline mirror: only redirect_yarn_classic_offline_mirror is emitted (no berry-risk warning);
• re-run under the mirror on a lock that already holds the hosted pin: nothing written, berry-risk warning still emitted once.

Locally: cargo test -p socket-patch-core --lib redirect 656 passed. Branch has current main merged in.

🤖 Generated with Claude Code

---

Note

Low Risk
Narrows when a redirect advisory is emitted in yarn.lock rewriting; behavior change is limited to warning accuracy under offline-mirror refusal.

Overview
Fixes redirect_yarn_classic_berry_migration_risk firing when Yarn classic entries match but no hosted pin is actually present—e.g. first run under offline-mirror refusal, which skips rewriting resolved URLs.

rewrite_yarn_classic now tracks pinned_any separately from matched_any: a dependency counts toward berry-migration risk only when a pin is written this run, or when a refused block already contains a patch-server hosted URL from an earlier run (berry_hosted_pin_is_ours). any_pinned is updated from pinned_any instead of matched_any.

Adds yarn_classic_berry_risk_follows_pins_under_offline_mirror_refusal to assert mirror-only warnings on first refusal, berry-risk when re-running on an already-pinned lock, and correct behavior for old grant URLs vs unrelated mirrors.

^{Reviewed by Cursor Bugbot for commit f0062e5. Configure here.}

[Mikola Lysenko (mikolalysenko)]

bugbot run

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f0062e5. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[agent] Ready for review at f0062e5.

• CI on f0062e5: 554 success, 6 skipped, 0 failing/pending; ci-ok green. Mergeable: clean.
• Changes: opened this PR from the never-opened Fix hosted yarn classic pins missing berry warning (#907) #917 Bugbot follow-up branch; merged current main (5ffe66b); fixed a second Bugbot finding (f0062e5): the offline-mirror prior-pin check now accepts any same-origin hosted pin naming the package version (earlier grant token / uuid) via berry_hosted_pin_is_ours, not only this run's exact URL. Unit test covers rotated same-server pin (warned) and a user mirror on another origin (not warned).
• Bugbot: re-run on f0062e5 found no new issues; the earlier thread is resolved.

Generated by Claude Code