[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

This PR sweeps crates/socket-patch-core/src/utils/python_lock.rs and python_script.rs, working from their coverage/files.tsv notes. It is part of the architecture refactor routine, whose ledger is discussion #1830; the related findings are A15, A22, A24 and A25. Most of the diff deletes needless layers and duplicated readers.

python_lock.rs

• Dead code deleted: complete_python_lock_metadata and complete_python_lock_metadata_in. Neither had a caller; PythonLockSession::rewrite does the completion.
• PythonLockProbe deleted. The hosted wheel gate (hosted/engine.rs wheel_targets) now asks PythonLockSession::plan directly. Both ran the same plan_python_lock_rewrite and both treated an unparseable lock as "no", so the probe_equivalence_tests module went with the probe. It compared the planner with itself.
• New names and repoint helpers. They replace 5 inline "inline table names name" checks and 4 copies of "remove specifier/url/path, insert the artifact".
• Shared lock-type pick: plan_python_lock_rewrite now uses lock_package_collection instead of its own copy of that rule. legacy is only ever read behind !pep751, so the result is the same.
• New artifact_filename replaces 2 copies of the query/fragment strip.
• python_lock_paths is now one iterator chain, with a shorter version of its why-comments.
• Comments: a section banner and 6 bare issue numbers removed, and the PythonLockSession and MetadataCompletion docs trimmed.
• Tests:
  • user_direct_url_entries_are_refused: the "ours" case asserted only is_ok(), which also passes on Ok(None). It now requires Some and requires the fixture's old digest to be replaced by the artifact's. Red→green: with plan returning Ok(None) for our own artifact, the test fails. With the PEP 751 archive hash left as the old digest, it fails too. On main, both breaks pass.
  • The 5 test modules are folded into one tests module, and the duplicate consts are dropped.

python_script.rs

• New tool_uv(doc) replaces 3 copies of the [tool.uv] lookup chain. pyproject_has_uv_settings keeps its own chain on purpose: it accepts a non-table tool.uv.

• New declares_directly(doc, script, name) replaces 3 copies of the "is this dependency declared directly?" check, in hosted_override_pins, wires_through_override and the two metadata rewriters.

• Inlined: push_hosted_override, which had one caller. Its why-comment stays.

• Narrowed: is_hosted_override is now private.

• Signature change: refuse_uv_no_sources and refuse_uv_no_binary drop their script parameter. Every caller passed None, and scripts use the *_script_* variants. The callers in vendor/pypi_uv.rs and patch/redirect/mod.rs are updated.

• Comments: the SourcesLayout doc is cut from 27 lines to 15 and keeps its why. 15 bare issue numbers removed.

• New test: no_binary_refuses_by_uvs_combine_rules covers refuse_uv_no_binary and refuse_uv_script_no_binary at the unit level:

  • a uv.toml replaces [tool.uv] in both directions;
  • the script's own bool wins over the project's list;
  • package names are canonicalized.

  Red→green: with Some((_, false)) => return Ok(()) removed, both this test and redirect's no_binary_refuses_a_wheel_uv_would_not_install fail.

Size

git diff --stat: 5 files changed, +226 / −531.

• Production: about +171 / −366.
• Tests: about +55 / −165.

Behavior change: none. Output, JSON and error codes are identical.

Risk: low. The change is local to the Python lock and metadata rewriters, all edits are equivalence-preserving, and no platform-specific code is touched.

Verification

• cargo clippy --workspace --all-features -- -D warnings is clean.
• cargo test -p socket-patch-core --lib: 6,995 pass. The 4 failures are the known root-sandbox ones, which pass in CI: copy_tree symlinked-root, vlt_heal unremovable-lock, and the pypi_poetry/pypi_requirements wire-failure tests.
• git merge-tree against the 10 open PRs that touch hosted/engine.rs or patch/redirect/mod.rs reports no conflicts: Fix yarn classic copy identity read two ways (#1951) #1984, Fix npm overrides to a URL treated as registry (#1965) #1966, Fix pnpm lock readers skipping main doc (#1949, #1952) #1960, Fix Go stale go.sum line after a downgrade (#1862) #1893, Fix Maven 4 implicit subprojects missed outside vendored (#1809) #1886, Fix silent PyPI hosted scan with no lockfile (#638) #1885, Fix hosted npm ignoring omit-lockfile-registry-resolved (#1871) #1872, Fix Cargo member globs with [..] classes (#1833) #1866, Fix Go replace target missed in go 1.16 graphs (#1840) #1843 and Fix hosted gem block mixing CRLF Gemfile endings (#1831) #1841. No open PR adds a caller of a removed or changed item.

/code-review high

It reported no correctness bugs and 9 other findings. 3 are fixed:

• the weak "ours" assertion;
• the local that shadowed tool_uv;
• the restored SourcesLayout caveat on transitive override reverts.

6 are not fixed:

• Public API break: socket-patch-core is the CLI's internal crate, and earlier sweeps removed pub items the same way.
• declares_directly runs once per marked override: a marked override is a hosted pin, so there are usually 0–2 of them.
• artifact_filename vs pypi_locks::basename and two other copies: unifying them crosses into VEX and the API client. That is recorded as a leftover rather than widened here.
• Error clone on an unparseable lock in the wheel gate: a cold path.
• plan takes text beside the session: this is the existing API, unchanged by this PR. Moving the rendering into the session is a separate change.
• Deleting the equivalence test: rewrite_python_lock is now parse plus the same plan_python_lock_rewrite, so a session-vs-text test would compare the function with itself.

Left for later

• check_python_lock_source_scope's only caller is a #[cfg(test)] helper in redirect/mod.rs, which 7 PRs hold.
• The ancestor_uv_config_files normalization could reuse relpath (A19).
• source_identity is still a second uv-source reader beside UvSource. Its precedence differs (registry first, legacy tag), so it was kept.

🤖 Generated with Claude Code

https://claude.ai/code/session_011f9aeSihx4ZNBYZDYvqBqw

---

Note

Low Risk
Local refactor in Python lock/metadata rewriting with equivalence-preserving edits and no auth or platform-specific changes; one test assertion was strengthened without changing production paths.

Overview
Refactors the Python lock and uv metadata helpers by removing dead layers (PythonLockProbe, complete_python_lock_metadata, and the probe equivalence tests) and routing the hosted wheel gate through PythonLockSession::plan instead.

python_lock.rs adds shared helpers (names, repoint, artifact_filename), reuses lock_package_collection in planning, simplifies python_lock_paths, merges test modules, and tightens the user-direct-URL test so a successful rewrite must replace the old hash—not merely return Ok.

python_script.rs centralizes tool_uv / declares_directly, inlines hosted override pushing, drops the unused script argument from refuse_uv_no_sources / refuse_uv_no_binary (call sites updated), and adds unit tests for no-binary combine rules.

Comment-only issue references are trimmed; behavior is intended to stay the same aside from the stronger test assertion.

^{Reviewed by Cursor Bugbot for commit 82ac6bc. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 82ac6bc. Configure here.}

[Wenxin Jiang (Wenxin-Jiang)]

[agent] Reviewed 82ac6bc5cff596db23f17d6eb5c78f04df187e7f. Checked Python lock session/probe equivalence, metadata rewriting, canonical name matching and uv/script guard call sites. No major correctness issues found. Validation: The focused core utils::python_ tests passed locally (37 tests). Source and regression-test review plus available exact-head CI checks; broader local suites were not run.

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review.

• Head: 82ac6bc5cff596db23f17d6eb5c78f04df187e7f, mergeable, no conflicts with main.
• CI: all checks on the head passed or were skipped (merge state clean).
• Bugbot: reviewed this head, no findings. No open review threads.
• Already approved on this head; needs a maintainer to merge.

---

Generated by Claude Code