GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Refs #1603

Summary

uv's no-binary = true / no-binary-package = [...] make uv install a
package only from an sdist. Every socket-patch PyPI artifact is a wheel, so
when a scan wired a patch for such a package (hosted: the patch-server
.whl URL; vendored: .socket/vendor/pypi/<uuid>/*.whl), it exited 0 and
every later uv sync / uv sync --locked / uv run --locked failed with
"marked as --no-binary but is itself a binary distribution".

Both modes now refuse before writing anything:

• vendored: pypi_uv_no_binary (uv projects and PEP 723 scripts)
• hosted: redirect_uv_project_unsupported /
  redirect_uv_script_unsupported, the same warnings no-sources uses,
  so the package is skipped and the scan still exits 0 for the rest.

Root cause

The wire-time guards (vendor/pypi_uv.rs check_target_guards,
vendor/pypi_lock.rs script lane, and the uv metadata step in
patch/redirect/mod.rs) checked no-sources and ancestor shadowing,
never no-binary. Only hosted restore looked at no-binary*.

Fix

utils/python_script.rs: the no-sources settings reader is now a
generic refuse_package_setting over a (bool key, package-list key) pair,
so no-binary gets exactly uv's precedence for free: a project uv.toml
replaces [tool.uv]; a script's own bool wins over the project's; lists
add up; no-binary = false disables the list; a script whose root sets
nothing takes the nearest parent uv.toml / [tool.uv]. New
refuse_uv_no_binary / refuse_uv_script_no_binary are called at all
three wire sites. The no-sources message text is unchanged.
no-build* allows wheels and is not refused. Docs:
docs/testing/uv-compatibility.md.

No wrapper changes needed (npm/, pypi/, gem/ only dispatch to the
binary).

Why Refs and not Fixes

The issue's follow-up comment adds a hosted uv pip compile --no-binary
pylock.toml lane. That lock records nothing of the filter in its data;
the only signal is the uv header command line and the uv config files
uv pip reads. #1614 adds exactly that parser for the restore side (#1613).
Reusing it for the wire side belongs after #1614 lands, so #1603 stays open
for that lane. The project / uv.toml / script matrix from the issue body
is fully covered here.

Tests (red → green)

Each new test fails with the guard disabled (refuse_uv_*no_binary
short-circuited to Ok(())) and passes with the fix:

Controls (wired, not refused): no-binary-package naming another package,
no-build-package, no-build = true, no-binary = false + list,
a script's no-binary = false over the project's list.

Local (all at 3b0c27e):

• cargo fmt --all -- --check: ok
• cargo clippy --workspace --all-features -- -D warnings: ok
• e2e_redirect_uv_build -- --include-ignored: 23/23 ok (uv 0.11.32)
• e2e_vendor_pypi_build -- --include-ignored: 55/55 ok
• mode_migration_pypi: 65/65 ok
• cargo test --workspace --all-features --no-fail-fast: 233 targets ok;
  10 tests failed for sandbox reasons unrelated to this diff (CI will
  confirm): 9 write-failure tests that rely on read-only permissions,
  which don't bind as root (uid 0) here (e.g. pypi_poetry::tests:: wire_write_failure_maps_error_and_leaves_lock_untouched, repair
  unremovable-lock tests, in_process_redirect write-failure tests), and
  e2e_bun_lockb::binary_shared_bundled_record_hosted_pin_is_managed,
  which needs patches-api.socket.dev (blocked by this sandbox's proxy).

/code-review high

Fixed: refusal text for no-binary = true (now names the package and a
remedy a bool allows); vendored half of the no-build-package control;
stale engine comment; install-machine settings caveat in the docs.
Not fixed:

• Hosted lock-only checkout (uv.lock + uv.toml, no pyproject.toml)
  skips the metadata guards. Pre-existing for no-sources too, and uv
  itself can't uv sync a project without its pyproject.toml, so no
  real install reaches the wired wheel.
• Folding the two guard calls into one: kept as two calls so each keeps
  its own stable error code (pypi_uv_no_sources / pypi_uv_no_binary)
  at every site; the extra TOML parse is a one-off per wired package.

Generated by Claude Code