GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #415

Summary

scan -g, apply -g, rollback -g and vex -g now find packages inside pipx's per-app venvs, so the dependencies of a pipx-installed tool such as Hatch (pipx install hatch, one of Hatch's documented install methods) are reported, patched and rolled back like uv-tool installs already are.

Root cause

get_global_python_site_packages (crates/socket-patch-core/src/crawlers/python_crawler.rs) probes uv tool venvs, conda, pyenv, Homebrew, the python.org framework and pip --user, but never probed pipx's venvs.

Change

• New pipx_home_candidates() returns every directory pipx may use as its home: $PIPX_HOME, legacy ~/.local/pipx, and platformdirs' data dir ($XDG_DATA_HOME/pipx, default ~/.local/share/pipx, on Linux; ~/Library/Application Support/pipx on macOS; %USERPROFILE%\pipx and %LOCALAPPDATA%\pipx\pipx on Windows).
• Global discovery scans <home>/venvs/*/{lib,lib64}/python3.*/site-packages (Unix) or <home>\venvs\*\Lib\site-packages (Windows) for each candidate that exists. It scans all of them, not just the one pipx would pick today: an app installed under an older default is still a real install, and the existing seen set removes overlaps.
• No wrapper changes are needed (npm/, pypi/, gem/ only dispatch to the binary).
• The diff is 2 files. The first fix commit accidentally ran cargo fmt --all over the workspace; d391f14 restores the 126 unrelated files to main.

Test evidence

New tests in crates/socket-patch-core/tests/crawler_python_e2e.rs (each stages a venv under a stubbed HOME / PIPX_HOME / XDG_DATA_HOME):

• Red before the fix (Linux): cargo test -p socket-patch-core --all-features --test crawler_python_e2e pipx gave 5 failed, 0 passed.
• Green after: crawler_python_e2e gave 47 passed, 0 failed.
• Real pipx check: pipx==1.7.1 install pycowsay under a scratch HOME, then scan -g --json --ecosystems pypi. scannedPackages was 42 on main and is 43 with this branch (the pipx venv's package).
• cargo clippy --workspace --all-features -- -D warnings is clean. The added code is rustfmt-clean. cargo fmt --all -- --check isn't clean on main itself, and CI doesn't run it, so this PR leaves the rest of the workspace alone.
• cargo test --workspace --all-features --no-fail-fast: everything passes except 16 write-failure tests in covgap_commands_vendor, in_process_redirect, repair and core --lib. They simulate write failures with chmod 0o555, which the root-run sandbox bypasses, and none of them touch the code changed here. They pass in CI, which runs as non-root.
• CI on d391f14: all 6 workflows that ran are green (CI, Audit GHA Workflows, npm, pnpm, Pipenv, vlt). Bugbot reviewed d391f14 and found no issues.

Per-issue checklist

• Global scan (-g) never crawls pipx venvs, so the dependencies of a pipx-installed Hatch are never reported, patched or rolled back on any OS #415: pipx venvs are crawled by global discovery on Linux, macOS and Windows, honouring PIPX_HOME (all of the tests above).

Generated by Claude Code