GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1071
Fixes #942

Summary

A hosted scan / get run from a workspace member now refuses with
redirect_workspace_lockfile_elsewhere (exit 1, nothing written, names the
root to run from) in two layouts where it used to pin nothing and exit 0:

• Hosted scan/get from an npm workspace member still pins nothing and exits 0 when the root's workspaces glob uses braces or a character class (packages/{a,b}, packages/[a-c]), because the #884 refusal's matcher doesn't support them #1071: npm, yarn and Bun roots whose workspaces patterns use brace
  sets or character classes (packages/{a,b}, packages/[a-c]).
• Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942: vlt workspaces, declared in vlt.json and locked by the root's
  vlt-lock.json.

Root cause

Both come from the hosted workspace-member refusal in
crates/socket-patch-core/src/hosted/governing_root.rs. It recognised a
member only through package.json workspaces (there was no vlt.json
case), and only through a matcher that understood *, ? and **
(segment_glob_matches compared { and [ literally). Either way the run
fell through to the "no lockfile" path and reported success.

Changes

• workspaces_include now uses the glob grammar npm (minimatch), yarn and
  Bun share. Braces expand first: nested sets, {1..3} / {a..c} /
  {01..10} sequences, and an empty alternative. A group with no comma or
  sequence stays literal, as in minimatch. Classes [abc], [a-c], [!a]
  and [^a] are matched, with a leading ] as a member; an unclosed [
  is literal. Matching is per character, so ? and classes handle non-ASCII
  names correctly. Expansion is capped at 4096 alternatives.
• New vlt_workspace_refusal: the nearest ancestor vlt.json whose
  workspaces (a string, an array, or an object of groups) match the member
  is its root. The run is refused when that root holds vlt-lock.json. A
  root that was never installed refuses nothing. When both a package.json
  root and a vlt.json root match, the nearer one is named. A lock of the
  "wrong" manager doesn't count: vlt-lock.json under package.json
  workspaces, or package-lock.json under vlt.json.
• CLI_CONTRACT.md: redirect_workspace_lockfile_elsewhere now documents the
  vlt case and the glob grammar.

Out of scope: minimatch extglobs (+(a|b)) and POSIX classes
([[:alpha:]]). Neither issue mentions them.

The npm/PyPI/gem wrappers need no change, since they only dispatch to the binary.

Tests (red → green)

Commands run locally (Linux, as root):

• cargo clippy --workspace --all-features -- -D warnings: clean.
• rustfmt --check on the changed Rust files: clean. CI has no fmt gate, and cargo fmt --all on this toolchain rewrites ~120 files on main, so I didn't run it repo-wide.
• cargo test -p socket-patch-core --all-features --no-fail-fast: 36/36 integration suites pass. The lib has 5619 passed and 4 failed; the 4 (copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_…, pypi_requirements::wire_failure_rolls_back_…) inject write failures through read-only dirs, which root bypasses. They don't touch this change.
• cargo test -p socket-patch-cli --all-features for in_process_redirect_pnpm (22/22), in_process_get_hosted_ecosystems, covgap_commands_scan_hosted, hosted_memory_{engine,parity,rollout} and e2e_redirect_rush_sim: all pass. in_process_redirect has 115 passed and 3 failed; the 3 are the same root-only write-failure injections.
• I couldn't run the full cargo test --workspace here because linking every CLI test binary ran out of the session's disk. CI runs it.

CI on a739151 (contains current main 05ecc6e): 335 success, 5 skipped, 0 failing, ci-ok green. One job, the gradle 6.9.4/jdk11 vendored e2e, failed first time on an infra error: Maven Central cut off a commons-lang3-3.8.1.jar download ("Premature end of Content-Length delimited message body"). This PR doesn't touch JVM code. It passed on one rerun.

Checklist

• Fixes Hosted scan/get from an npm workspace member still pins nothing and exits 0 when the root's workspaces glob uses braces or a character class (packages/{a,b}, packages/[a-c]), because the #884 refusal's matcher doesn't support them #1071: brace and class globs. CLI regression plus a unit test.
• Fixes Hosted scan/get run from a vlt workspace member reports success while pinning nothing: the #598 / #901 member refusal has no vlt.json case #942: vlt.json workspace members. CLI regression plus unit tests.

🤖 Generated with Claude Code