sbt, Mill and scala-cli support in agent, hosted and vendored modes

[Mikola Lysenko (mikolalysenko)]

This adds sbt, Mill and scala-cli support for pkg:maven patches in agent, hosted and vendored modes. It is stacked on #646 (Gradle), so review and merge #646 first; this PR's diff is against feat/gradle-support.

In every mode the user's own build files (build.sbt and friends) are left untouched. socket-patch only writes files it owns.

How each mode works

Mode	sbt (0.13.18, 1.x, 2.x)	Mill	scala-cli
Agent	Patches jars in place in the Coursier cache (sbt 1.3+) and the Ivy cache (sbt 0.13–1.2, or useCoursier := false). Coursier's checksum sidecars are resynced.	In place (Coursier)	In place (Coursier)
Hosted	Writes one owned root file, socket-patch.sbt	Guidance snippet	Guidance snippet
Vendored	Writes socket-patch-vendor.sbt and a committed .socket/vendor/maven2 tree	Guidance only (wiring it means editing user files)	Owned socket-patch.scala plus a same-GAV Coursier tree (directory builds)

Hosted and vendored sbt. Both modes use a generated file with these properties, all verified by probe on every sbt line:

• Scope. It works through inThisBuild, so it reaches every subproject and transitive dependency, and never adds a dependency.
• Version. It pins the suffixed <v>-socket.<hex8> version with dependencyOverrides. This is needed because Ivy and Coursier both rank the plain release above the suffix.
• Integrity at load. It checks a sha256 for every patched jar and pom when sbt loads. A wrong hash fails the load.
• Integrity after resolution. A post-resolution check fails the build if a resolved jar's bytes aren't pinned, or if a project declares a newer version of a patched package.
• Repository order. On 0.13 and 1.x it puts its repository first, so offline builds resolve.

Scoping. sbt has no lockfile, and dependencyOverrides would downgrade a project that resolves a newer version. Hosted and vendored modes therefore pin a package only when sbt's own resolution records under target/ show the project resolves exactly the patched base version.

• With no records, or stale ones, the run warns once and wires nothing.
• socket-patch never runs sbt.

Background: docs/design/sbt-support.md, docs/design/sbt-template-probe.md and docs/design/sbt-evidence-probe.md. New codes are listed in CLI_CONTRACT.md.

Test coverage

These are the real-tool docker runs (scripts/sbt-compat-matrix.sh):

Group	Versions	Result
hosted	sbt 0.13.18, 1.2.8, 1.3.13 (JDK 8); 1.9.9, 1.13.0, 2.0.9 (JDK 17); 2.0.9 (JDK 21)	14/14 tests per cell
vendored	same	8/8 tests per cell
agent	sbt 0.13.18, 1.2.8, 1.13.0, 2.0.9; useCoursier := false	pass
Mill agent	0.11.13, 0.12.17, 1.1.10	pass
scala-cli	1.17.1, agent and vendored	pass

Before this rebase, the full matrix also passed with JDK 21 legs for 1.13.0 and 2.0.9.

The hermetic suites (e2e_sbt, e2e_sbt_hosted, e2e_sbt_vendor, e2e_scala_cli_vendor), the golden harness redirect_sbt_golden and the vendored VEX cells all pass.

CI changes:

• New sbt-compatibility.yml: a docker matrix, scala-tools legs, and native macOS and Windows legs.
• New blocking sbt rows in ci.yml.

Known limits

• Untested legs. The native macOS and Windows legs have not run on GitHub before this PR.
• Agent mode. It inherits Full Gradle support in agent, hosted and vendored modes #646's every-copy fan-out and whole-jar swap. Coursier and Ivy copies plug into installed_copies.
• Unrelated failing test. mode_migration_npm::berry_vendored_then_hosted_takeover_leaves_pure_hosted fails locally on main as well. Fix yarn berry hosted pin leaking npm auth (#404) #465 changed the hosted Berry pin and the test was never updated. It only runs when real yarn is installed.

🤖 Generated with Claude Code

---

Note

Medium Risk
Large new JVM integration touching apply, hosted redirect, vendoring, and VEX across multiple cache layouts; risk is mitigated by extensive CI matrices but native OS legs and offline resolution gating add operational complexity.

Overview
Adds sbt, Mill, and scala-cli as first-class JVM build targets for pkg:maven patches across agent (in-place patches in Coursier/Ivy caches with checksum sidecar resync), hosted (generated socket-patch.sbt with resolution-evidence gating), and vendored (socket-patch-vendor.sbt / scala-cli Coursier tree) modes—without editing user build.sbt files.

Agent / rollback / VEX paths are extended so Maven apply treats Coursier and Ivy cache copies like Gradle’s expanded dirs (gradle_cache::expands), fixes Gradle-only mavenLocal() warnings when only ~/.m2 is patched, and crawls hosted sbt download dirs for VEX. Vendor/eject runs sbt/scala-cli preflight gates before hosted takeover, tightens commit/reinstall hints for generated root files, and hardens eject snapshots (FIFO-safe reads, eject_incomplete backstop).

CI and testing: new sbt-compatibility.yml (Docker matrix across sbt versions/JDKs × agent/hosted/vendored, Mill/scala-cli, macOS/Windows native legs), sbt ecosystem in coverage-docker / e2e-docker with version filters and longer timeouts, e2e ubuntu legs for hosted/vendored 1.13.0, warm-seed scripts, docker_e2e_sbt, hermetic e2e_sbt / vendored VEX cells, and .gitattributes / .gitignore for byte-exact sbt fixtures. Docs/README/CLI contract document hosted sbt rules, resolution evidence, and new warning codes.

^{Reviewed by Cursor Bugbot for commit d836a59. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review.

• Head: 650f56144a9459a52f38b2ed0cab81d796f472ea
• CI: 579/579 green (6 skipped) on this head; branch not behind its base, no conflicts
• Bugbot: reviewed 650f561, no new issues; all review threads resolved
• Reviewer note: Stacked on Full Gradle support in agent, hosted and vendored modes #646 (base feat/gradle-support) — merge Full Gradle support in agent, hosted and vendored modes #646 first, then retarget this to main.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

Autofix Details

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Maven scans Coursier and Ivy
  • Restricted Coursier/Ivy cache crawling to scala-tool projects only, preventing Maven and Gradle builds from scanning them
• ✅ Fixed: Unreadable vendor file can be replaced
  • Added filesystem checks to detect and adopt unreadable vendored files instead of replacing them

Or push these changes by commenting:

@cursor push 14924aee3d

Preview (14924aee3d)

diff --git a/crates/socket-patch-core/src/crawlers/maven_crawler.rs b/crates/socket-patch-core/src/crawlers/maven_crawler.rs
--- a/crates/socket-patch-core/src/crawlers/maven_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/maven_crawler.rs
@@ -872,10 +872,10 @@
         }
         // sbt / Mill / scala-cli: Coursier's per-repository roots, the Ivy
         // caches, then the caches local sbt evidence points into (the
-        // directory walks are blocking). The first root holding a PURL wins
-        // the crawl dedup. Locally only for a Scala-tool project: a Maven or
+        // directory walks are blocking). Locally only for a Scala-tool project: a Maven or
         // Gradle build never reads those caches.
-        if !options.global && !scala_tool_project(&options.cwd).await {
+        let is_scala_tool = scala_tool_project(&options.cwd).await;
+        if !is_scala_tool {
             return roots;
         }
         let cwd = options.cwd.clone();

diff --git a/crates/socket-patch-core/src/vendor/jvm/coursier_tree.rs b/crates/socket-patch-core/src/vendor/jvm/coursier_tree.rs
--- a/crates/socket-patch-core/src/vendor/jvm/coursier_tree.rs
+++ b/crates/socket-patch-core/src/vendor/jvm/coursier_tree.rs
@@ -160,8 +160,13 @@
         bytes: render_index_like(&all, crlf).into_bytes(),
         tree: false,
     });
+    // ReadFn returns None for both missing AND unreadable files. Check if
+    // the index exists on disk; if it does but was unreadable, adopt it
+    // rather than replacing it (matching the owned_file_with guard).
+    let index_exists_on_disk = existing_index.is_some()
+        || std::path::Path::new(INDEX_REL).exists();
     Ok(vec![
-        if existing_index.is_some() {
+        if index_exists_on_disk {
             adopt(INDEX_REL, COURSIER_INDEX_KIND, "index")
         } else {
             fragment(

diff --git a/crates/socket-patch-core/src/vendor/jvm/mod.rs b/crates/socket-patch-core/src/vendor/jvm/mod.rs
--- a/crates/socket-patch-core/src/vendor/jvm/mod.rs
+++ b/crates/socket-patch-core/src/vendor/jvm/mod.rs
@@ -471,6 +471,14 @@
     if read(rel).is_some() {
         return adopt(rel, OWNED_FILE_KIND, "owned");
     }
+    // ReadFn returns None for both missing AND unreadable files (permission
+    // error, FIFO, invalid UTF-8). Check if the file exists on disk; if it
+    // does but was unreadable, adopt it rather than creating over it (the
+    // unreadable file should not be replaced and later deleted on revert).
+    // This mirrors the hosted guard in `created_settings_over_existing`.
+    if std::path::Path::new(rel).exists() {
+        return adopt(rel, OWNED_FILE_KIND, "owned");
+    }
     writes.push(FileWrite {
         rel: rel.to_string(),
         bytes: bytes.to_vec(),

_{You can send follow-ups to the cloud agent here.}

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit d836a59. Configure here.}