GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Refs #748 (the #630 item, crawler coordinate guards). #748 is a tracker, so this PR doesn't close it.

Summary

The cargo, gem and NuGet crawlers each had their own copy of one coordinate guard: both name and version must be a single safe path segment. The cargo/gem/nuget and PyPI purl builders also wrote the same check inline. This PR adds patch::path_safety::is_safe_name_version, routes all of those callers through it, and deletes the three copies along with their three duplicated test tables.

Why

• Register row E37 (register); living document doc/06-discovery-vex.md, "The crawlers re-implement the validators".
• Leverage: B 0, U 0, D 3 (five implementations of one rule become one), R low. This was the best eligible item. Every higher-ranked candidate (Tracking: revert every vendored backend through one record-revert engine instead of nine hand-written mechanisms #989 finish blocks, Read and splice nuget.config through formats::nuget in hosted, vendored and restore #594/Locate hosted Maven pom edits and their upstream restore through the formats::maven element scanner #717, Agent-mode JVM crawl finds no Coursier cache for a scala-cli or sbt root that only SCALA_TOOL_MARKERS recognizes, because six marker lists disagree #1014, C69, pnpm node-linker=pnp with a modulesDir is refused as yarn Plug'n'Play, because the layout detector ignores the modulesDir the crawler honors #1129) changes files that open arch-refactor/* or agent/fix-* PRs also change.

What changed

• patch/path_safety.rs: new is_safe_name_version(name, version).
• crawlers/{cargo,ruby,nuget}_crawler.rs (plus NuGet's test-only oracle): the find_by_purls paths call it.
• utils/purl.rs: simple_purl and pypi_purl call it.

Deleted

• is_safe_cargo_coordinate, is_safe_gem_coordinate, is_safe_nuget_coordinate and their doc blocks.
• test_is_safe_{cargo,gem,nuget}_coordinate.
• Production lines: about +19 / −49. Test lines: about +78 / −92 (git diff --stat: 6 files, +97 / −141).

Remaining in the #630 item

• Composer's normalize_version should become composer_version::strip_leading_v. That waits for Pick inserted line terminators through line_endings::terminator (#815) #1108, which touches patch/redirect/upstream/composer.rs.
• The Maven guard already lives in formats::maven::is_maven_coordinate.

Behavior

None. The new function's body is the same expression the deleted copies had.

Tests

• path_safety::name_version_accepts_real_coordinates_and_fails_closed: one table covering the union of the three crawler test cases (traversal, separators, NUL, empty, C: drive-relative).
• path_safety::purl_builders_agree_with_the_name_version_guard: runs simple_purl for cargo, gem and nuget, and pypi_purl, over every row of that table. Each must build exactly the pairs the guard accepts.
• The crawlers' existing find_by_purls traversal regressions still pass.

Evidence

• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --lib: 5777 passed, 4 failed. The 4 failures are the known root-only sandbox tests (copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched, pypi_requirements::wire_failure_rolls_back_already_written_files), and they fail on main too.
• crawler_cargo_e2e 34/34, crawler_nuget_e2e 28/28, crawler_ruby_e2e 29/29.

Risk

Low. This is a mechanical change with the same predicate. The wrappers (npm/, pypi/, gem/) are unaffected.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AycK5PbbP2GwCwLL4xsdFV

Generated by Claude Code