Fix uv dry run missing inline [tool.uv] refusal (#979)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #979
Refs #944 (only its remaining dry-run preview piece; that issue stays with #963's claim)

Summary

On a uv project whose [tool.uv] or [tool.uv.sources] is written as an inline table, vendor --dry-run previewed a clean vendor (exit 0), but the real run refused with pypi_uv_lock_parse_failed (exit 1), and only after downloading the prebuilt wheel. With this PR the dry run previews the same refusal, and the real run refuses before any download or write.

Root cause

The uv vendored backend can't add keys to a [tool], [tool.uv] or [tool.uv.sources] that is an inline table or a non-table value, so it refuses with pyproject.toml [<path>] is not a standard table. That refusal was raised only by ensure_table inside wire_uv. The preflight check_target_guards, which pypi.rs runs before the prebuilt download and before the dry run returns, never checked the table chain.

Fix

• check_target_guards (crates/socket-patch-core/src/vendor/pypi_uv.rs) now runs a read-only check_standard_tables over the same chain wire_uv edits, in the same order: tool.uv for a transitive package (the override-dependencies path), then tool.uv.sources. It returns the same code and detail. A missing link is fine (wire creates it). Header-less tables implied by a sub-table and dotted-key tables (uv.package = true) still count as standard tables and stay wireable.
• ensure_table and the preflight share one not_a_standard_table constructor, so the two messages can't drift apart.
• Applies to vendor, scan --mode vendored and get --mode vendored, because all of them go through the same pypi.rs preflight. It also gives Keep the hosted pin when a vendored takeover is refused (#853, #944) #963's takeover dry-run preview the uv inline-sources gate that uv hosted → vendored takeover (scan / get --mode vendored) restores the package to PyPI before the uv vendored refusals run, so an inline [tool.uv] sources = {…} table (or a #928 marker split) leaves it unpatched in both modes, while --dry-run previews would_vendor #944 still needs.

CI fix carried for main: stale digest pending list

main (db83f01) is red on test (macos/windows), test-release and coverage. utils::digest::tests::production_digests_go_through_the_helpers fails because #690 moved crawlers/gradle_cache.rs, patch/jvm_jar.rs and patch/sidecars/maven.rs onto the utils::digest helpers but left them on PENDING_INLINE_DIGESTS, and the guard fails on a stale entry. This PR's earlier port of #878 (Route Gradle digests through utils::digest) is now a no-op after merging main. Commit d456e5b drops the three stale entries. It is test-only and no-ops once main carries the same change. Other open PRs based on main will hit the same failure until it does.

Reproduced on main 1c6c509 locally: the guard test fails with left = the 6 real inline files, right = those 6 plus the 3 Gradle files. After d456e5b it passes, and CI coverage and test (macos-latest) are green on ef589a6.

Test evidence

Red before the fix, on main + tests only:

• vendor::pypi_uv::tests::guards_refuse_non_standard_uv_tables_like_wire failed with unwrap_err() on an Ok value: Fresh (the preflight accepted the inline table).
• vendor::pypi::tests::uv_inline_sources_table_refused_in_dry_and_wet_runs failed with dry_run=true: expected Refused, got Done { … success: true … vendor_prebuilt_downloaded … }. This reproduces the issue: the dry run reported success.

Green after the fix: both pass.

Per-issue checklist:

• Vendored vendor --dry-run previews success on a uv project with an inline [tool.uv] / sources table, but the real run refuses pypi_uv_lock_parse_failed (exit 1) #979 inline [tool.uv] sources = {…}: unit test (preflight == wire error, files untouched) plus an orchestrator test (dry and wet runs both Refused pypi_uv_lock_parse_failed, no .socket/vendor dir, pair byte-identical)
• Vendored vendor --dry-run previews success on a uv project with an inline [tool.uv] / sources table, but the real run refuses pypi_uv_lock_parse_failed (exit 1) #979 [tool] uv = { sources = {…}, index = […] }: unit test
• Vendored vendor --dry-run previews success on a uv project with an inline [tool.uv] / sources table, but the real run refuses pypi_uv_lock_parse_failed (exit 1) #979 dotted [tool] uv.sources = {…}: unit test
• Vendored vendor --dry-run previews success on a uv project with an inline [tool.uv] / sources table, but the real run refuses pypi_uv_lock_parse_failed (exit 1) #979 transitive + [tool] uv = { constraint-dependencies = […] } names [tool.uv]: unit test
• standard, header-less and dotted tables are still wireable: unit test

Local runs (Linux, toolchain 1.93.1, on the merge with main db83f01):

• cargo clippy --workspace --all-features -- -D warnings: clean
• cargo test --workspace --all-features --no-fail-fast: everything passes except 12 tests that make a path read-only (0o555) or unremovable and expect a write to fail. This container runs as root, and root ignores those permissions: covgap_commands_vendor::{vendor,revert,reconcile}_state_write_failure_*, 3 in_process_redirect write-failure tests, 2 repair cleanup-failure tests, copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_* and pypi_requirements::wire_failure_rolls_back_already_written_files. None of them touch this change, and CI runs as a non-root user.
• cargo fmt: the changed files are rustfmt-clean.
• Wrapper tests (npm/, pypi/, gem/): not affected. This is a Rust-only change.

Why this cluster

#979 was the only untriaged issue this run, and its fix is small and self-contained. It also closes the preview gap that #963 leaves open on #944, so one change helps two issues.

🤖 Generated with Claude Code

https://claude.ai/code/session_01S9NhAHzAgkz5oUuRrbkyV3

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

[agent] Ready for review at 5f01753.

• CI: 541/541 check runs on 5f01753 are green or skipped.
• Bugbot: found no issues on 5f01753, and there are no open review threads.
• Scope: fixes Vendored vendor --dry-run previews success on a uv project with an inline [tool.uv] / sources table, but the real run refuses pypi_uv_lock_parse_failed (exit 1) #979 (a uv vendor --dry-run previewed success for an inline [tool.uv] / [tool.uv.sources] table that the real run refuses). It also gives Keep the hosted pin when a vendored takeover is refused (#853, #944) #963's takeover preview for uv hosted → vendored takeover (scan / get --mode vendored) restores the package to PyPI before the uv vendored refusals run, so an inline [tool.uv] sources = {…} table (or a #928 marker split) leaves it unpatched in both modes, while --dry-run previews would_vendor #944 the uv inline-sources gate it still needed.
• Carried commit: Route Gradle digests through utils::digest #878's Route Gradle digests through utils::digest is included unchanged, because main is red on production_digests_go_through_the_helpers. It becomes a no-op once Route Gradle digests through utils::digest #878 merges.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] coverage on 2544b31 (the main merge) fails in socket-patch-core --lib, on utils::digest::tests::production_digests_go_through_the_helpers. This comes from main, not this PR:

• On main, crawlers/gradle_cache.rs, patch/jvm_jar.rs and patch/sidecars/maven.rs already use the utils::digest helpers. sbt, Mill and scala-cli support in agent, hosted and vendored modes #690 brought in what Route Gradle digests through utils::digest #878 did; Route Gradle digests through utils::digest #878 itself was closed.
• But Fix scan/get --json dropping apply failures (#424) #955 added those same three files to PENDING_INLINE_DIGESTS. The test fails on a stale entry, so main's own lib tests are red too. This PR's diff against main touches only vendor/pypi.rs and vendor/pypi_uv.rs.
• No fix exists yet. Open Bound registry downloads by ApiTimeouts instead of a 60 s total deadline (#872) #876 and Honor HTTP-date Retry-After on vendor-service retries through api::retry (#677) #889 only add entries to that list.

Proposed patch for main (I checked locally that the test passes with it on this head):

--- a/crates/socket-patch-core/src/utils/digest.rs
+++ b/crates/socket-patch-core/src/utils/digest.rs
@@ const PENDING_INLINE_DIGESTS: &[&str] = &[
-        "crawlers/gradle_cache.rs",
-        "patch/jvm_jar.rs",
-        "patch/sidecars/maven.rs",
         "utils/group_commit.rs",

Once that's on main, merging main here clears the failure. I haven't re-run the job, because it fails the same way until main changes.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ef589a6. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[agent] native (ubuntu-latest, 2.17.3) failed on ef589a6, and I don't think this PR caused it:

• What failed: the PDM backtest ran 44 cases. Only one failed: 2.17.3 transitive hosted, where rollbackExit0 came back empty and rollbackRestoresLockBytes failed. All other 2.17.3 cases passed, and so did every other PDM version that has finished.
• Why it's outside this PR: against main, this PR changes only the uv vendored preflight (vendor/pypi.rs, vendor/pypi_uv.rs) and the digest test's pending list. PDM hosted rollback goes through none of that code.
• Why it looks intermittent: the same job passed on Fix quoted and ${VAR} requirements includes (#994) #995's head, which was merged into main just before this head was built.

No fix exists for it. I'll re-run the failed job once when the workflow run finishes. If it fails the same way a second time, I'll treat it as a real failure and look into it.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] native (macos-latest, 1.3.0) failed on ef589a6. This PR didn't cause it:

• What failed: the Bun backtest passed 52 of 53 cases. The one failure is 1.3.0 isolated vendored, where bun install --ignore-scripts (Bun itself) hung past the harness's 180-second timeout. No assertion about socket-patch's output failed.
• Why it's outside this PR: this PR changes only the uv vendored preflight and the digest test's pending list. No Bun or npm-family code is touched.
• Update on the PDM failure: the one re-run of native (ubuntu-latest, 2.17.3) passed.

No fix exists for a hung bun install. I'll re-run this failed job once when its workflow run finishes. If it fails the same way a second time, I'll treat it as a real failure.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] Ready for review at ef589a6.

• CI on head: 498 checks succeeded, 6 skipped, 0 failing. The only failure, native (macos-latest, 1.3.0), was bun install --ignore-scripts (Bun itself) timing out after 180 s in the 1.3.0 isolated vendored case. It passed on re-run (attempt 2), so it was a flake.
• Conflicts: none. The branch already contains main (db83f01), and GitHub reports it MERGEABLE/CLEAN.
• Fixes made in this sweep: none needed.
• Bugbot: clean on ef589a6 ("found no new issues"). No unresolved review threads.
• For reviewers: this PR's utils/digest.rs change (dropping 3 stale PENDING_INLINE_DIGESTS entries) is byte-identical to Fix main CI red on stale digest pending-list entries #1016 (same blob 630adefa). These two PRs merge cleanly in either order, so this one doesn't need to wait for Fix main CI red on stale digest pending-list entries #1016.

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] Ready to merge at ef589a6:

• CI: all 504 checks on ef589a6 passed or were skipped.
• Re-runs: the PDM 2.17.3 job and the macOS Bun 1.3.0 job each failed once on a hang in the package-manager tool, and each passed on its single re-run.
• Merge state: clean. Bugbot found no issues, and there's an approval.

It's waiting only on a maintainer to merge it.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent). Head ef589a6. CI: all latest check runs green (480 success, 6 skipped, 0 failing). Bugbot reviewed ef589a6: no new issues; no unresolved review threads. Branch is 1 commit behind main (#1016, whose digest-list fix this PR already carries), mergeable. Reviewer focus: check_standard_tables in crates/socket-patch-core/src/vendor/pypi_uv.rs mirrors wire_uv's table-chain order.

---

Generated by Claude Code