GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Refs #757

Root cause

Hosted cargo plans Cargo.toml pins with a line scanner that treated every inline table as one line (plan_cargo_toml in crates/socket-patch-core/src/patch/redirect/mod.rs). It refused a valid TOML 1.0 declaration whose array value wraps, which is rustfmt's style for a long feature list:

serde = { version = "1.0.0", features = [
    "derive",
] }

scan --mode hosted warned redirect_cargo_toml_dep_unrewritable and left the crate unpatched, although the same project vendors fine. The pin readers (CargoRegistryPins and its test oracle cargo_socket_registry_pin) and upstream restore's unpin_line made the same one-line assumption.

Changes

• cargo_inline_table: one brace-, bracket-, string- and comment-aware reader for an inline table. It returns the closing line and the text between the braces, borrowed when the table closes on its own line. It allows a line break only inside an array or a multi-line string, as TOML 1.0 does, so {⏎ version = … } is still refused. Comment text is left out, so a key named only in a comment is not read as one.
• Planner: every inline table goes through that reader. A wrapped table is classified on its whole text with the existing rules and pinned on its opening line ( registry = "<reg>", straight after {). An earlier Socket pin in that spelling is superseded in place. An explicit registry = "crates-io" (Hosted cargo redirect refuses a crates.io dependency declared with an explicit registry = "crates-io", treating crates.io as "another registry" #386) anywhere in the wrapped table is dropped and the pin written in that spelling, so remove leaves the declaration without the redundant key, as it does for one-line tables. Any other registry already named in a wrapped table is still refused, because restore could not unpin it. Lines inside a wrapped table are skipped, so they are never read as entries or headers.
• CargoRegistryPins and the oracle read pins out of the same span.
• Upstream restore drops exactly the inserted text from the opening line, so rollback / remove leave the manifest byte-identical.

Not in this PR (why Refs, not Fixes)

#757's acceptance table also lists serde.version = "1.0.0" (dotted keys) and serde = '1.0.0' (literal string). Both stay refused. Supporting them, and deleting the regex scanner, is the larger toml_edit planner rewrite the issue proposes. I'm leaving the issue open for that.

Tests (red → green)

Before the fix, run against origin/main's core:

• patch::redirect::tests::cargo_multiline_inline_table_is_pinned_on_its_opening_line (LF and CRLF; comments in the array; a rename): red, refused.
• patch::redirect::tests::cargo_multiline_inline_table_is_classified_by_its_whole_text (path key after the array; renamed-away table; keys and braces only in comments; "a}" and """q"""" strings; already pinned): red.
• patch::redirect::tests::cargo_socket_registry_pin_reads_back_every_written_shape with two new multi-line shapes: red.
• patch::redirect::tests::cargo_supersede_replaces_previous_multiline_pin: re-pin to a newer patch.
• upstream::cargo::tests::multiline_inline_table_opening_line_loses_only_the_pin and restore_unpins_a_multiline_inline_table_byte_exact (LF, CRLF, BOM, CRLF+BOM): red, restore refused.
• Real cargo, e2e_redirect_cargo_shapes::cargo_hosted_multiline_inline_table_is_pinned (LF and CRLF; cargo 1.93.1): red on main (skipped: no lockfile entry pinning it could be rewritten). Green with the fix: scan, fresh-checkout cargo fetch --locked + offline cargo build --locked links the patched symbol, vex attests, remove is byte-identical.
• I also checked by hand that cargo 1.97.0 metadata reads a pinned wrapped declaration (with comments and default-features = false) as serde from the Socket registry, with its features kept.

mode_migration_cargo::takeover_over_unrewritable_spelling_keeps_vendored listed the wrapped table as a spelling hosted mode refuses. Now that it's pinned, I removed that row. The dotted and literal rows stay.

Per issue:

• Hosted cargo redirect refuses a dependency whose inline table has a multi-line features array, because it plans Cargo.toml pins with a line scanner #757 multi-line features array (title case): pinned, read back, superseded, restored byte-exact. Covered by the tests above.
• Hosted cargo redirect refuses a dependency whose inline table has a multi-line features array, because it plans Cargo.toml pins with a line scanner #757 dotted keys / literal strings: out of scope, see above.

Local gates

• cargo fmt --all -- --check: clean.
• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --all-features --lib: 6795 passed, 4 failed. All 4 are chmod/unremovable-file tests that can't fail as root, which this container runs as: copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_… and pypi_requirements::wire_failure_…. Fix berry unwind under a user yarn patch (#962) #1733 lists the same tests. None of them touch this diff.
• CLI suites, with SOCKET_PATCH_CARGO_E2E_REQUIRED=1: e2e_redirect_cargo_shapes 34/34, e2e_redirect_cargo_build 23/23, e2e_vendor_cargo_build 40/40, mode_migration_cargo 30/30, in_process_cargo_apply 23/23, e2e_cargo 25/25.
• I didn't run the full cargo test --workspace: building every CLI test binary ran this container out of disk. CI runs the rest.
• No wrapper changes (npm/, pypi/, gem/ only dispatch the binary).

/code-review high

Fixed in 20f1ef5:

• comment text leaking into classification;
• the find('}') dispatch, which a } in a comment or string broke, in planner, readers and restore;
• no supersede for an earlier multi-line pin;
• multi-line strings that end in extra quotes;
• the dispatch block repeated three times, now one helper;
• a new allocation per single-line table, now Cow.

Nothing was left unfixed.

CI

All checks green on 319351f (37 success, the rest skipped). Cursor Bugbot found no new issues on 319351f.

Bugbot

• 20f1ef5: wrapped tables naming crates-io were refused. Fixed in bde22cd, with unit tests for three placements and a crates-io-wrapped real-cargo e2e row. Thread resolved.
• bde22cd: the wrapped crates-io matcher missed 'crates-io' and "registry" spellings. Fixed in 319351f, with tests. Thread resolved.

https://claude.ai/code/session_011f9aeSkjzuMR7wJ9h5JWZd

Generated by Claude Code