GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #400
Fixes #402

Summary

After a successful-looking scan --mode hosted or vendor, a project's pnpm-workspace.yaml could stop loading, and every later pnpm install failed. This happened in two cases:

• The file spelled an existing key with quotes or a space before the colon, so socket-patch added a duplicate key (pnpm-workspace.yaml edits miss quoted or space-before-colon top-level keys, append a duplicate trustLockfile/overrides key, and break every install #402). An explicit "trustLockfile": false opt-out was also overridden rather than respected.
• The file was a flow mapping ({packages: [.]}) or ended with ..., so the appended block lines produced invalid YAML or a second document (Hosted trustLockfile and vendored overrides appends corrupt a flow-style or ...-terminated pnpm-workspace.yaml while reporting success #400).

With this change, both editors read the file the way pnpm's YAML parser does. Existing keys are recognised in every spelling, new keys go inside the document (before a ... marker), and shapes a line edit can't safely extend are left untouched with a clear reason.

Root cause

socket-patch edits pnpm-workspace.yaml in two places: the hosted trustLockfile: true write (plan_workspace_trust in hosted/guidance.rs) and the vendored overrides: mirror (check_workspace_override / apply_workspace_override / revert in vendor/pnpm_lock.rs). Both were line splices that:

1. found an existing top-level key only by a literal line prefix (trustLockfile:, overrides:), and
2. appended block-style lines after the last non-empty line, without checking that the document is a single block mapping.

Fix

crates/socket-patch-core/src/formats/pnpm/workspace.rs is a new shared helper:

• top_level_key: parses a column-0 mapping key that is plain, single-quoted ('' escapes) or double-quoted (backslash escapes), allowing blanks before the colon. It returns the key and its inline value with any trailing comment stripped.
• block_insert_point: finds where a new top-level key belongs (after the last content line, before a ... end marker). It returns an error for a flow-style root, a root on the --- line, an indented or sequence root, or a second document.
• block_section_bounds: finds a block section under any key spelling. Column-0 # comments and stray \r lines stay inside the section.

Callers:

• Hosted trust (plan_workspace_trust): uses both helpers. The new TrustPlan::Unsupported(reason) writes nothing and emits the redirect_pnpm_trust_lockfile warning with both manual recoveries (pnpm install --trust-lockfile, or add the key yourself) and the don't-rebuild caution (pnpm_trust_workspace_unsupported_detail).
• Vendored overrides: the pre-flight check refuses unspliceable shapes before any write, and refuses a quoted or spaced inline overrides mapping. The section lookup used by the check, the edit, the revert and the empty-section prune accepts every key spelling, and takes the entries' indent from the first non-comment line. The append is placed by block_insert_point.
• Hosted rollback: the pnpm_trust_lockfile_left check (upstream/npm.rs) recognises the key in any spelling.
• CLI_CONTRACT.md: documents this behaviour.

No wrapper changes are needed. npm/, pypi/ and gem/ only dispatch to the binary.

Test evidence

Red on main (commit d3fb884, tests only), green with the fix:

Red→green: on main, all 8 issue tests in the cli lib and core lib fail (6 vendored + 2 hosted). Each Bugbot test fails without its fix. All pass with the fix. The in-process test was added after the fix and wasn't run against main.

Local commands (Linux, Node 22, pnpm 10.28.0, toolchain 1.93.1):

• cargo fmt --check: the files this PR changes are fmt-clean. main itself isn't fmt-clean under the pinned toolchain (in about 120 files), and CI doesn't run cargo fmt, so this PR doesn't touch those files.
• cargo clippy --workspace --all-features -- -D warnings: ok
• cargo test --workspace --all-features --no-fail-fast: everything passes except tests that rely on chmod to force a write failure (covgap_commands_vendor state-write ×3, in_process_redirect write-failure ×3, repair ×2, core copy_tree / vlt_heal / pypi_poetry / pypi_requirements write-failure ×4). This sandbox runs as uid 0, which ignores read-only modes. None of these tests touch pnpm-workspace.yaml.
• --test e2e_vendor_pnpm_build: 15 passed. --test e2e_redirect_pnpm_build -- --ignored --skip pnpm_pinned_matrix: 8 passed. --test in_process_redirect_pnpm: 11 passed.
• e2e_safety_pnpm --ignored can't run here: the proxy refuses patches-api.socket.dev. CI covers it.

CI on 3c5f8f8: every compatibility workflow is green (npm, pnpm, Bun, vlt, Composer, Go, Poetry, PDM, Pipenv). The Pipenv 2022.12.19 extras and PDM 2.20.1 static-urls cells failed once, in code this PR doesn't touch, and passed on their single re-run. Bugbot found no new issues on 3c5f8f8.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Kmie1ncmqvPzYfYc2ustqm

Generated by Claude Code