GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Summary

Adds a way for a service to run hosted-mode patching in-process, with no working directory and no network calls from the engine. depscan's new autopatch worker streams a repository's lockfiles into it and serves patch lookups straight from the patch database.

• hosted_memory engine (crates/socket-patch-cli/src/hosted_memory/): takes a map of repository files (text, binary, presence-only, symlinks), detects project roots, looks up patches once across all roots, and returns rewritten files plus per-root redirect ledgers. The rewrite, pnpm trust and npm allow-remote planning, confirmation and ledger-merge stages are copied as pure functions from run_redirect_selected. The disk scan --mode hosted path is unchanged.
• PatchApi trait (appended in api/client.rs): the five lookups the hosted path makes (batch, by-package, package references, view, artifact download). ApiClient implements it by forwarding to its existing methods.
• ProjectView seam (lock_inventory/view.rs): lockfile readers work over disk or memory. Disk wrappers call the same readers, so behavior is unchanged.
• Hidden hosted-bundle command: runs the engine on a JSON bundle from stdin, for debugging.
• socket-patch-node napi addon (crates/socket-patch-node, napi 3.13): HostedScanSession (pushChunk / endFile / markPresent / finish / cancel), backed by an opaque External handle rather than a napi class (the class glue tripped CodeQL's invalid-pointer rule), selectHostedScanPaths, and a JS provider callback that implements PatchApi. The JS package is private and lives outside the npm/socket-patch-* release glob.

Scope and limits

• Every directory with its own lockfile is a project root; Cargo workspace members are demoted by reading the workspace's members/exclude, so excluded crates are scanned as their own projects.
• Covers npm (npm, pnpm, yarn, bun, including bun.lockb and Rush), pypi, cargo, golang, gem and composer. Maven and NuGet produce ecosystem_unsupported_in_memory, because they have no lockfile inventory without crawlers.
• The engine reads no environment, sends no telemetry and never falls back to the public proxy. Dry runs still request reference grants, as the disk path does.
• Merged with main after Speed up hosted and vendored scans: concurrent API requests, parallel crawl, single-pass rewriters #257 landed. The disk path keeps Speed up hosted and vendored scans: concurrent API requests, parallel crawl, single-pass rewriters #257's memoized Cargo member walk (FACTS_MEMO); the in-memory engine walks the same Tree abstraction over its supplied files and never reads or writes that memo. The engine's copied run_redirect_selected stages still pass the parity suite against a CLI binary built from the merged code. Deduplicating them against Speed up hosted and vendored scans: concurrent API requests, parallel crawl, single-pass rewriters #257's disk path is a follow-up.

Testing

• 20 parity tests run the real CLI binary with a scrubbed environment and compare changed bytes, ledger bytes and the redirect block against the engine, across npm, pnpm v9, yarn classic and berry, bun.lock, bun.lockb, Rush, uv, requirements, poetry, Pipfile, cargo (including workspaces and [patch] paths), composer, Gemfile, golang and a nested monorepo.
• Engine tests cover cross-root lookup dedup, determinism, hostile SOCKET_* environments, malformed and 200k-deep inputs, limits, cancellation, timeouts, no proxy fallback on 401, symlinks, a corrupt ledger and vendored takeover refusal.
• Node smoke test (13 cases) against the built addon: streamed redirect, dry run, provider failures, cancel, limits.
• cargo clippy --workspace --all-features -- -D warnings passes. The addon has only been built on macOS arm64; Linux and Windows CI builds are the first run there.

🤖 Generated with Claude Code