Fix vendored JVM/NuGet artifacts dropped by .gitignore (#1061)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1061 (and its Gradle twin #620, closed as a duplicate).

Summary

vendor of a Maven, Gradle or NuGet package exited 0 even when the project's .gitignore dropped the payload from the commit. GitHub's stock Java.gitignore ignores *.jar and VisualStudio.gitignore ignores *.nupkg, so every fresh clone lost the patched artifact (vendor --check exits 1, VEX omits the purl). Vendored JVM and NuGet artifacts now get the same handling npm already had: a !* re-include, plus a refusal when git would still drop the artifact.

Root cause

Only the npm-family sink checked whether git would commit the vendored artifact. npm_common::stage_patch_pack refuses an ignored <uuid>/ and writes a <uuid>/.gitignore re-include. sbt and Coursier own a !* .gitignore at their tree roots. The Maven reactor (.socket/vendor/maven2, which every pom root uses), Gradle (.socket/vendor/gradle) and NuGet (.socket/vendor/nuget/<uuid>) had neither the re-include nor the probe.

Change

• JVM trees. The reactor and Gradle planners now own a !* .gitignore at their tree roots, following the sbt / Coursier pattern:
  • created when absent, adopted when present, and removed with the last entry;
  • registered as an owned file (record_allowed, line-ending-blind compare, group-commit capture);
  • restored by repair (restore_jvm_owned_files).
    The reactor shares sbt's .socket/vendor/maven2/.gitignore.
• Every JVM shape (reactor, Gradle, mixed, sbt, scala-cli) refuses vendor_artifact_gitignored in jvm_prelude when git ignores the tree root itself, for example with a .socket/ rule. No nested .gitignore can override such a rule. This runs before any write, dry run included, and also in the service download plan, so no grant is wasted.
• NuGet.
  • nuget_prelude refuses an ignored <uuid>/ before anything is written.
  • write_nupkg writes <uuid>/.gitignore (!*) next to the nupkg, and the in-sync hot path backfills it for directories vendored before this change.
  • The written nupkg is probed again. If it is still ignored, the run refuses and unwinds the uuid dir. If git can't answer, the run warns vendor_artifact_gitignore_unchecked.
• Review follow-ups: jvm_gate_preflight (run before a hosted->vendored takeover restores upstream) also refuses an ignored tree root, so a Gradle pin stays hosted instead of ending neither; NuGet checks the ignored uuid dir before the empty-patch success return.
• Docs: CLI_CONTRACT.md (nuget/maven artifact rows and the vendor_artifact_gitignored / _unchecked code rows) and docs/ecosystems.md.

The diff stays small around #1279 (crate-bloat cleanup) and #1288 (nuget.config): it adds no parameters to any backend signature.

Per-issue checklist

• Vendored Maven, Gradle and NuGet artifacts can be git-ignored silently, because only npm checks .gitignore #1061 vendored Maven (single-module pom), Maven reactor and Gradle with stock Java.gitignore: maven_repo::tests::a_jar_ignore_rule_is_overridden_by_the_tree_gitignore. Every written .socket/ file is committable, and revert leaves no .gitignore behind.
• Vendored Maven, Gradle and NuGet artifacts can be git-ignored silently, because only npm checks .gitignore #1061 JVM .socket/ / .socket/vendor/ rules refuse with nothing written (wet and dry): maven_repo::tests::a_jvm_tree_directory_ignore_rule_refuses_before_any_write.
• Vendored Maven, Gradle and NuGet artifacts can be git-ignored silently, because only npm checks .gitignore #1061 NuGet with stock VisualStudio.gitignore: nuget_feed::tests::a_nupkg_ignore_rule_is_overridden_by_the_uuid_gitignore.
• Vendored Maven, Gradle and NuGet artifacts can be git-ignored silently, because only npm checks .gitignore #1061 NuGet directory rules refuse with nothing written (wet and dry): nuget_feed::tests::a_directory_ignore_rule_refuses_before_any_write.
• Gradle plan write list (groovy_settings_gets_the_apply_line_and_the_tree), CRLF owned-file test (vendor_jvm_cli) and the real-toolchain capstones' expected file sets (e2e_vendor_jvm_build) are updated for the new owned file.

Red → green

Before the fix, a_jar_ignore_rule_is_overridden_by_the_tree_gitignore failed with left: Some(".gitignore:14:*.jar\t.socket/vendor/maven2/…/commons-text-1.10.0-socket.9f6b2c4e.jar"), and a_nupkg_ignore_rule_is_overridden_by_the_uuid_gitignore failed because no <uuid>/.gitignore existed. Both pass after the fix.

Commands run

• cargo test -p socket-patch-core --lib: 6113 passed.
• cargo test -p socket-patch-cli --all-features with --test set to vendor_jvm_cli, in_process_vendor, e2e_nuget, e2e_sbt_vendor, e2e_scala_cli_vendor, maven_sidecar_cli, vendor_eject, vendor_eject_fresh_checkout, vendor_group_commit_e2e, covgap_commands_vendor, e2e_maven, e2e_vex_vendor and vendor_crash_safety_e2e: all green.
• cargo clippy --workspace --all-features -- -D warnings: clean.
• rustfmt on the changed files.
• The real Maven, Gradle and dotnet capstones run in CI.

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches vendoring write paths and preflight gates for Maven, Gradle, and NuGet; behavior change is additive (new files + fail-closed on uncommittable trees) with broad test coverage.

Overview
Fixes vendored JVM and NuGet payloads being dropped from git when projects use stock ignore rules (*.jar, *.nupkg), aligning them with npm-family behavior.

JVM: Maven reactor (.socket/vendor/maven2) and Gradle (.socket/vendor/gradle) now write a tree-root .gitignore with !* (same content as sbt/Coursier). It is an owned file (plan, revert, repair, group commit). Vendoring refuses vendor_artifact_gitignored when git ignores the tree root itself (e.g. .socket/), including dry runs and hosted→vendored preflight.

NuGet: Each uuid feed dir gets <uuid>/.gitignore (!*); preflight refuses an ignored uuid dir; after writing the nupkg, git is probed again with unwind on failure. In-sync re-runs backfill .gitignore on older vendored dirs.

Shared helper npm_dir::ignored_root_refusal drives the directory-level checks. Docs (CLI_CONTRACT.md, docs/ecosystems.md) and e2e expectations are updated; new git-worktree tests cover Java/Visual Studio ignore templates.

^{Reviewed by Cursor Bugbot for commit 129f1c3. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 129f1c3. Configure here.}