GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Only warn berry migration risk when the classic lock holds a pin by mikolalysenko · Pull Request #1077 · SocketDev/socket-patch

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Collaborator

Follow-up to #917 (merged), fixing a Cursor Bugbot finding that landed after the merge.

Bugbot finding (Low severity, on #917)

Berry warning fires without a pin. any_pinned is set from matched_any after a classic entry matches, including when an offline-mirror refusal then skips the rewrite. The advisory still claims the lock carries hosted pins, so a first run that writes nothing reports redirect_yarn_classic_berry_migration_risk alongside redirect_yarn_classic_offline_mirror.

Fix

rewrite_yarn_classic (crates/socket-patch-core/src/patch/redirect/mod.rs) now tracks a separate pinned_any per dependency:

An entry that is rewritten counts as pinned.
An entry skipped by the offline-mirror refusal counts as pinned only if its block already contains the hosted artifact URL (an earlier run wrote the pin, so the berry-migration risk is real).
any_pinned (which gates redirect_yarn_classic_berry_migration_risk) is now fed from pinned_any instead of matched_any.

Tests

New unit test yarn_classic_berry_risk_follows_pins_under_offline_mirror_refusal:

first hosted run under an offline mirror: only redirect_yarn_classic_offline_mirror is emitted (no berry-risk warning);
re-run under the mirror on a lock that already holds the hosted pin: nothing written, berry-risk warning still emitted once.

Locally: cargo test -p socket-patch-core --lib redirect 656 passed. Branch has current main merged in.

🤖 Generated with Claude Code

Note

Low Risk
Narrows when a redirect advisory is emitted in yarn.lock rewriting; behavior change is limited to warning accuracy under offline-mirror refusal.

Overview
Fixes redirect_yarn_classic_berry_migration_risk firing when Yarn classic entries match but no hosted pin is actually present—e.g. first run under offline-mirror refusal, which skips rewriting resolved URLs.

rewrite_yarn_classic now tracks pinned_any separately from matched_any: a dependency counts toward berry-migration risk only when a pin is written this run, or when a refused block already contains a patch-server hosted URL from an earlier run (berry_hosted_pin_is_ours). any_pinned is updated from pinned_any instead of matched_any.

Adds yarn_classic_berry_risk_follows_pins_under_offline_mirror_refusal to assert mirror-only warnings on first refusal, berry-risk when re-running on an already-pinned lock, and correct behavior for old grant URLs vs unrelated mirrors.

^{Reviewed by Cursor Bugbot for commit f0062e5. Configure here.}

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Mikola Lysenko (mikolalysenko) and others added 2 commits

October 7, 2026 12:26


          Only warn berry migration risk when the classic lock holds a pin

efc7c38

An offline-mirror refusal leaves the matched classic entries untouched,
but the matched entry still set any_pinned, so a first hosted run that
wrote nothing reported redirect_yarn_classic_berry_migration_risk next to
redirect_yarn_classic_offline_mirror. Count a refused entry as pinned only
when an earlier run already wrote its hosted URL into the block.

Reported by Cursor Bugbot on #917.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>


          Merge remote-tracking branch 'origin/main' into prfix2/917

5ffe66b

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Copy link

Copy Markdown

Collaborator Author

bugbot run

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 7, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

crates/socket-patch-core/src/patch/redirect/mod.rs Resolved

Uh oh!

There was an error while loading. Please reload this page.


          Count same-server hosted pins from earlier runs as berry migration risk

f0062e5

Under an offline-mirror refusal the prior-pin check matched only this
run's exact artifact URL, so a lock still holding a hosted pin from an
earlier grant token or patch uuid on the same patch server stayed silent
about the berry migration risk. Reuse berry_hosted_pin_is_ours on the
entry's resolved URL (fragment stripped) so any same-origin hosted pin
naming the package version counts, while a user's own mirror does not.

Reported by Cursor Bugbot on #1077.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Copy link

Copy Markdown

Collaborator Author

bugbot run

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 7, 2026

View reviewed changes

cursor Bot left a comment

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f0062e5. Configure here.}

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Tanmay Singla (Tanmay182003) approved these changes

Oct 7, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 7, 2026

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Copy link

Copy Markdown

Collaborator Author

[agent] Ready for review at f0062e5.

CI on f0062e5: 554 success, 6 skipped, 0 failing/pending; ci-ok green. Mergeable: clean.
Changes: opened this PR from the never-opened Fix hosted yarn classic pins missing berry warning (#907) #917 Bugbot follow-up branch; merged current main (5ffe66b); fixed a second Bugbot finding (f0062e5): the offline-mirror prior-pin check now accepts any same-origin hosted pin naming the package version (earlier grant token / uuid) via berry_hosted_pin_is_ours, not only this run's exact URL. Unit test covers rotated same-server pin (warned) and a user mirror on another origin (not warned).
Bugbot: re-run on f0062e5 found no new issues; the earlier thread is resolved.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) added this pull request to the merge queue

Oct 7, 2026

Merged via the queue into main with commit 72ef1e2

Oct 8, 2026

561 checks passed

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) deleted the agent/followup-917-berry-risk-mirror branch

October 8, 2026 01:18

Mikola Lysenko (mikolalysenko) added a commit that referenced this pull request

Oct 8, 2026


          Merge origin/main into arch-fix/yarn-grammar

1d697ea

Resolve the redirect import and berry_reposition_blocks conflicts in
favor of this branch's formats/yarn grammar, and read the classic
resolved URL through classic_field in main's #1077 refused-pin check.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Mikola Lysenko (mikolalysenko) added a commit that referenced this pull request

Oct 8, 2026


          Merge origin/main into arch-fix/takeover-atomic

c166766

Resolve conflicts with main's #946 (PyPI takeover pre-gate), #1042
(containment helper) and #1077 (classic berry-migration warning):

- hosted.rs: keep this PR's staged takeover; main's new
  `preflight_pypi_takeover` pre-gate inside the deleted
  `vendored_takeover` is dropped. The staged takeover's `explain` now
  calls `preflight_pypi_takeover` (instead of only the requirements
  check), so a retracted uv pin-down (#723) or Poetry 0.x (#945)
  takeover is still skipped with `redirect_uv_takeover_version_unreachable`
  / `redirect_poetry_lock_unsupported`, as main's tests expect.
- socket_dir.rs: use main's `containment::ensure_unlinked` guard, then
  this PR's deferred removal.
- redirect/mod.rs: take main's `pinned_any` (a mirror-refused entry
  counts only when it already carries our hosted pin), which subsumes
  this PR's mirror fix.
- CLI_CONTRACT.md: describe the uv/Poetry cases as retractions.
- mode_migration_pypi.rs: keep both sides' tests.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Reviewers

cursor[bot]

cursor[bot] left review comments

Tanmay Singla (Tanmay182003)

Tanmay182003 approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

Ready for review

Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bugbot finding (Low severity, on #917)

Fix

Tests

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.