GeezerVison

Copy link

Copy Markdown

Collaborator

Mikola Lysenko (mikolalysenko) commented Sep 28, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) marked this pull request as ready for review September 28, 2026 11:29

515 of 523 checks passed

Mikola Lysenko (mikolalysenko) deleted the v5/remove-setup-and-ui branch September 28, 2026 19:19

Brings in #279, which removes `setup` and streamlines the patch UI.
Scan keeps `selection_args`, which `get` now calls again. The exit-2
row of the CLI contract keeps the removed-`setup` wording and the
v5.0 socket.yml and SOCKET_MAX_NEW_PATCHES usage errors.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Brings in #279 (setup removed, patch UI streamlined). Conflicts:
- core lib.rs keeps `policy` and drops `setup`.
- scan keeps policy-aware selection (`select_accessible`) and the
  base's `selection_args`, which `get` now uses.
- CLI_CONTRACT exit-code rows take the base's text plus the
  socket.yml rows.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

The staged-rollout and socket.yml flags pushed scan's short help past
nine options once #279 trimmed -h. --max-new-patches and
--no-socket-yml now show only in --help and parse as before.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…to v5/one-hosted-engine

setup.rs goes, with the setup-only fold_vendor_records helper this
branch had moved onto the Ledgers view; vendor_record_is_unowned has no
callers left here (list, vex and scan read Ledgers), so it goes too.
#279's hosted wording lands where this branch moved the code: the pnpm
trust guidance in core hosted::guidance, the record_fetch_failed and
rush repo-state texts in core hosted::engine (shared by the memory
engine), and the human warning/summary text in the CLI scan/hosted.rs,
which also gets the one-line npm allow-remote note and its test. The
CHANGELOG owner-rule entry drops its `setup --check` clauses.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01KHZ8uzdXfkG2zH8ZYDG8ju

* Plan staged patch rollout for v5

Adds the design for rolling Socket patches out gradually: a
`patches:` block in socket.yml that narrows what scan may patch
(paths, ecosystems, packages, severity floor, on/off), and a
severity-ordered per-run cap on new patches so each scan lands the
next few most critical fixes.

The plan splits the work into two parallel items with a frozen
interface, lists every hard-coded filter and where it belongs, and
covers the depscan autopatch follow-up. configuration.md now records
that socket-patch reads socket.yml for selection policy only, with
the trust boundary unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Revise rollout plan after adversarial review

Three independent reviews (ambiguity, churn, trust boundary) found
gaps that would have let the two implementations disagree or let a
repo file widen or stall the rollout. The plan now:

- matches paths against marker files with the backend's top-down
  gitignore rules, so projectIgnorePaths means the same everywhere
- uses one data source for severity, supersession and ordering
- spends the budget only on patches the planning pass proves can
  land, and admits nothing new when a lookup failed
- uses the merged recorded view in every mode and engine
- has depscan read the policy from the base commit for PR jobs
- hardens file handling (regular files, aliases, size, encoding,
  trusted repo root) and reports what a policy hides

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Close interface gaps in the rollout plan

A final consistency pass found places where the two work items
would have produced incompatible code: base purls admitted in one
directory being charged again in the next, no defined hand-off of
the unfiltered offers from the severity filter to classification,
no shared repo-relative path helper, and override sources the JSON
must report but the interface could not carry. The shared contract
now defines each of these, and the parity tests match each engine's
budget scope.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Clarify who shapes scan's selection output

The plan said both that the selector returns the shared offers
struct (work item A) and that it returns admitted/deferred rows
(work item B). The selector now returns the offers, and B adds the
rollout stage after it.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Add the rollout planner for capped scans

A new core module plans a capped scan: rows that already carry a
patch always go through, NEW packages are admitted most critical
first until the budget is spent, and the rest are deferred with
their rank. The order is total and uses no dates, so repeated scans
on an unchanged repo land the same patches and converge.

ranking gains search_result_supersedes, the by-package twin of
batch_supersedes, so ALREADY vs UPGRADE is judged on the same
records that pick the patch.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Add the socket.yml selection policy to core

New socket_patch_core::policy module: the SelectionPolicy, Offers and
repo-root helpers that the staged-rollout plan freezes as the shared
contract between the socket.yml work and the --max-new-patches work.

It reads the repo root's socket.yml/socket.yaml strictly and fails
closed: bad YAML, a misspelled `patches` block, unknown keys (with a
did-you-mean hint), wrong types, empty allowlists, bad globs and
anchors or aliases inside the keys we read are all errors that name
the key path. Path lists match marker files with npm `ignore`
semantics, walked top-down; a golden fixture generated from the npm
package pins that. The built-in test/fixture ignores become
overridable defaults for discovered roots.

--package matching moves to core so scan and the policy share it.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Cap new patches per scan, most critical first

scan gains --max-new-patches <N|none> (env SOCKET_MAX_NEW_PATCHES).
Each selected package is classified against the recorded state
(manifest, hosted pins, vendor ledger): packages that already carry a
patch always go through, and an already-applied patch is kept unless
the selection really supersedes it, so re-scans never swap patches.
Packages getting their first patch are admitted most severe first
until the budget is spent; the rest are deferred to the next scan.

Hosted, vendored and agent runs decide eligibility with their own
write-free checks before any budget is spent, so a patch that cannot
land never holds a slot. Several PATH directories share one budget.
--json reports a rollout block, deferred rows show up in
redirect.skipped[] as rollout_deferred, and human output adds a
Rollout line and a Next up list. updates[] now uses the by-package
records.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Test the scan cap end to end in every mode

Nine packages under a cap of three roll forward three per run in
hosted, agent and vendored mode, most severe first, and a fourth run
changes nothing. The dry run predicts the wet run, upgrades land with
a cap of zero, patches that cannot land hold no slot, a failed lookup
admits nothing new, and several project directories share one budget.

A hosted pin on a patch server scan does not recognize still counts
as applied when the lockfile names its patch uuid, so the rollout
cannot stall on a missing --patch-server-url.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Honor socket.yml patch policy in disk scans

scan now reads the repo root's socket.yml before any write and applies
its patches block in hosted, vendored and agent mode, --dry-run
included: path filters on project roots (PATH-glob matches also get
the built-in test/fixture ignores), ecosystem and package filters on
crawled packages, and a severity floor on the patches a package may
receive. An invalid or ambiguous file fails the run with exit 1 and
an errorCode before any request.

Packages that already carry a patch are never removed, upgraded or
replaced by the policy: they are held and reported under
policy.retained. A recorded patch below a new floor stays in place.
patches.enabled: false reports what would be patched and writes
nothing.

New flags: --no-socket-yml / SOCKET_NO_SOCKET_YML and
--min-severity / SOCKET_MIN_SEVERITY. Every successful scan --json
result gains a top-level policy block. A PATH outside the repository
root is a usage error.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Cap new patches in the in-memory hosted engine

The napi engine and hosted-bundle take maxNewPatches (a count or
"none"), maxNewPatchesCap (a server ceiling that only tightens) and
inFlightPatches (ranked first). One budget spans every project root:
the engine classifies each root against its committed manifest,
vendor ledger and the hosted pins its lockfiles name, plans once
after every root's write-free checks, and rewrites a root again
without its deferred rows. Results gain a session-level rollout
block and ProjectResult.deferred; deferred rows also appear in
skipped[] as rollout_deferred.

Parity tests hold disk and memory to the same rollout and redirect
blocks run after run until converged, and show memory's run-wide
budget beside disk's per-directory one.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Document the per-run cap on new patches

CLI_CONTRACT.md gains the limit's semantics (classification,
eligibility, unit, budget scope, order, convergence), the flag and env
rows, the rollout block, rollout_deferred and a jq recipe; "Which
patch gets selected" now describes the by-package supersession and the
separate cross-package order. README adds a gradual-rollout task and
the flag row; CHANGELOG adds both entries. The design doc records the
gaps B decided.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Apply socket.yml policy in the in-memory engine

selectHostedScanPaths now streams the root socket.yml/socket.yaml and
returns them as policyPaths; it drops test and fixture trees through
the policy's built-in default ignores instead of a hard-coded segment
list (structural excludes like node_modules and vendor stay fixed).

The session reads the policy before any root is processed: path
filters run before the project limit, ecosystem and package filters
on each root's packages, and the severity floor before selection. A
listed policy file that arrives without content, or an invalid one,
yields policyError with no root processed and no file changed. New
options noSocketYml, minSeverity and policyPaths; the result gains a
policy block. hosted-bundle and index.d.ts carry the new fields.

get now warns policy_bypassed when the repo's socket.yml would have
skipped the package it patches.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Document the socket.yml patch policy

CLI_CONTRACT.md gains a "socket.yml patch policy" section (grammar,
precedence, paths, lookup, validation, commands, error codes and the
policy JSON block), the flag and env rows, and the "narrow or pace"
half of the trust-boundary rule. README adds a "Roll out gradually"
section with copyable socket.yml recipes, CHANGELOG lists the new
policy and the breaking scan changes, and the design docs record the
decisions made while building it.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Fix rollout review findings

The recorded view is now an index built once per project and keyed
like discovery (case-folded nuget/composer, PEP 503 pypi names), and it
keeps every hosted pin, so a case-folded pin or a pair of pinned
qualifier twins no longer reads as NEW or as a phantom upgrade. The
hosted gate uses key sets instead of linear scans, takes the apply lock
for rows an earlier directory admitted, and error envelopes drop the
rollout block. The in-memory engine keeps the first pass's skips when
it rewrites a root again, and a root whose lookups all failed freezes
new admissions. Human output words dry runs, incomplete lookups, zero
caps and shared budgets correctly, an explicit flag no longer reads
the env value, and the docs say the socket.yml layer arrives with the
patch policy. New tests cover reference failures, upgrades under a cap
of zero in hosted mode, recorded packages with failed lookups, and
stronger dry-run and parity checks.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Harden the socket.yml policy after review

Fixes from an adversarial self-review of the policy work:

- A non-ASCII package spec no longer panics validation, and error
  text, warnings and verbose lines drop terminal escapes and bidi or
  zero-width characters.
- Ignore lists that fail to compile together are an error instead of
  silently matching nothing, and the policy file is opened by its
  resolved path without following a swapped-in symlink.
- A top-level key that looks like a misspelled `patches` (`patchs`),
  a top-level merge key or an aliased key now fails closed.
- Repo-root lookup follows a `.git` symlink and trusts the checkout
  owner under root and sudo, so CI containers keep the policy.
- The severity floor always reports the patch it held back, report-
  only --json runs report what a floor or `enabled: false` hides, a
  root skipped as a whole is always one entry and no longer prints
  "No packages found", warnings print once per invocation, and the
  policy line is omitted when there is nothing to say.
- policy entries are sorted and use canonical purls on disk and in
  memory; the in-memory engine applies a socket.yml negation of a
  built-in ignore to roots it was given, and policyError carries no
  CLI-only remedy.
- A lockfile-less disk root matches path filters by its manifests.

Tests cover each fix, plus the prune universe, agent path filters, a
vendored package held byte-identical, and tighter oracles; docs are
corrected where they overstated what the human output names.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Match zero-cap test to dry-run wording

The dry-run tense fix changed the deferred line to "would be
deferred"; the unit test still expected the wet-run wording.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Give the release test job more time

The optimized test job now has to build two more crates and one more
test binary for the socket.yml policy. It ran out of time on its last
40 minutes, about a minute short, and a docs-only change already takes
38. Raise the limit to 50 minutes so it can finish.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Apply socket.yml paths during memory selection

The merged plan makes in-memory path selection two-phase: the host
fetches the root socket.yml first and passes its text to
selectHostedScanPaths. Selection now applies the full path policy, so
a negation such as `!/e2e/tests/` brings a test tree back in memory
exactly as on disk. A listed policy file that is missing, symlinked
or invalid returns policyError with nothing selected.

Selection returns policySha256, and the session fails closed when the
policy it reads differs. Roots the policy excludes keep their marker
files presence-only, so the session still lists them as filtered.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Keep excluded roots out of the memory stream

Review follow-ups to two-phase selection:

- Roots the policy excludes are reported in ignoredSample instead of
  streamed presence-only, so a repo with many fixture lockfiles no
  longer runs into the session's file limit.
- A session that bypasses socket.yml while selection applied it now
  fails closed instead of processing roots it never fetched.
- The docs say policy text must decode losslessly (TextDecoder drops
  a BOM) and when policySha256 is null.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Keep scan -h short with the policy flags

The v5 help rules cap each command's short help at about eight
options. `--no-socket-yml` and `--min-severity` pushed `scan -h` to
ten, so they now appear only in `scan --help`, like the other
advanced scan flags.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3

* v5: keep scan -h within the option budget

The staged-rollout and socket.yml flags pushed scan's short help past
nine options once #279 trimmed -h. --max-new-patches and
--no-socket-yml now show only in --help and parse as before.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Fail report-only JSON when detail queries fail

A report-only `scan --json` (`--prune` with no mode) with a severity
floor or `enabled: false` fetches patch details to fill
`policy.filtered[]`. If every query failed it still printed a success
envelope and exited 0. It now reports the error and exits 1, like the
agent and vendored runs.

Human-mode policy warnings now print `Warning: <detail>` like the rest
of `scan`; the code stays in the JSON `warnings[]` entry.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3

---------

Co-authored-by: Claude <[email protected]>