GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Fix uv pylock rollback shape (#407, #408) by mikolalysenko · Pull Request #512 · SocketDev/socket-patch

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 1, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Collaborator

LLM Description written by Claude Code:claude-opus-5-5

Fixes #407
Fixes #408

Summary

Hosted rollback, remove and the hosted → vendored takeover now restore a pylock.toml written by uv pip compile. Before, they refused every such lock. A restored pylock entry also now comes back with the bytes uv writes.

Root cause

The PEP 751 branch of the upstream restore (crates/socket-patch-core/src/patch/redirect/upstream/uv.rs, lock_shape / upload_time) applied uv.lock rules to pylock*.toml:

Hosted rollback, remove and vendored takeover always refuse on a uv pip compile pylock.toml because its packages carry no index key #407: it took the registry only from a sibling's index key. uv pip compile --format pylock.toml never writes index, so no sibling counted as a registry package, and the restore refused with "no sibling registry package shows the registry…".
Hosted rollback rewrites uv pylock.toml upload-time with milliseconds, so the restored file never matches what uv writes #408: it formatted upload-time with uv.lock's millisecond rule. uv truncates pylock upload-time to whole seconds (checked against real uv pip compile output on uv 0.8.17), so a rolled-back pylock always showed a diff.

Fix

lock_shape classifies each pylock sibling as Named(index), PypiFiles (no index, and every sdist/wheels url is on files.pythonhosted.org) or Files(host) (no index, another host). A lock whose siblings are all PypiFiles restores against PyPI and writes no index, matching its siblings. Files(host) refuses as "not PyPI". Mixed kinds refuse as ambiguous, as several registries already did. Packages with no registry artifacts (vcs / directory / archive) are skipped, as before.
Shape.whole_seconds: for pylock, upload-time is truncated to whole seconds unless a sibling artifact shows fractional seconds. uv.lock keeps milliseconds.
CLI_CONTRACT.md "Hosted unwind coverage" (pypi) now documents both.

Tests (red → green)

Issue	Test	Before fix	After fix
#407	`upstream_restore_golden::pylock_without_index_round_trips` (LF and CRLF, plus a non-PyPI-host sibling that must still refuse)	FAILED: `Refused("…no sibling registry package shows the registry…")`	ok
#408	`upstream_restore_golden::pylock_whole_second_upload_times_round_trip`	FAILED: restored `upload-time = 2023-10-17T17:46:21.184Z`, expected `…:21Z`	ok
#408	`uv::tests::pylock_upload_times_truncate_to_whole_seconds` (unit)	n/a (new signature)	ok
both	real-uv e2e `e2e_redirect_uv_build` `hosted_uv_{export,pip_compile}_pylock_manifestless_vex`: the lanes now lock a pure-Python PyPI sibling (`idna==3.7`, hosted mode only) and require a byte-exact rollback. Before, they accepted the documented refusal, which hid #407.	FAILED locally: "no sibling registry package" refusal	CI: green on every uv leg (REQUIRED=1, so a refusal or skip would fail)

Commands run locally (Linux, uv 0.8.17):

cargo test -p socket-patch-core --all-features --test upstream_restore_golden: 42 passed
cargo test -p socket-patch-core --all-features --lib upstream: 56 passed; --test uv_hosted: 4 passed
cargo clippy --workspace --all-features -- -D warnings (CI's invocation): clean
e2e_vendor_pypi_build -- --include-ignored (shares the modified lane builder): 20 passed
e2e_redirect_uv_build -- --ignored: 5 passed. The 2 pylock lanes now get past the shape check. Locally they then fail only at GET https://pypi.org/pypi/six/1.16.0/json, because socket-patch's rustls client can't trust this sandbox's egress-proxy CA. CI has direct network for that step.
cargo test --workspace --all-features: the remaining local failures are permission-based write-failure tests (the sandbox runs as root, so read-only dirs don't block writes) plus disk-pressure fallout. None touch uv, pylock or upstream restore code.
cargo fmt --all -- --check: main is not fmt-clean with the pinned 1.93.1 toolchain (126 files differ), and CI doesn't run it. I formatted only the hunks this PR adds.

No wrapper (npm/, pypi/, gem/) changes are needed: this is core restore logic.

🤖 Generated with Claude Code

https://claude.ai/code/session_01C2RLuAmoRAnZpABj1eX1rE

Generated by Claude Code

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Start fix for #407, #408

815beb6

Assisted-by: Claude Code:claude-opus-5-5

This was referenced Oct 1, 2026

Hosted rollback, remove and vendored takeover always refuse on a uv pip compile pylock.toml because its packages carry no index key #407

Closed

Hosted rollback rewrites uv pylock.toml upload-time with milliseconds, so the restored file never matches what uv writes #408

Closed

Claude (claude) added 2 commits

October 1, 2026 23:31


          Add failing tests for uv pylock rollback shape

1c3f502

A uv pip compile pylock (no index key) refuses to roll back (#407),
and a restored pylock entry gets millisecond upload-time values where
uv writes whole seconds (#408).

Assisted-by: Claude Code:claude-opus-5-5


          Fix uv pylock rollback refusing and drifting

116d022

Hosted rollback, remove and the vendored takeover refused every
pylock.toml written by `uv pip compile`, because that command records
no `index` key and the restore only read the registry from one (#407).
Packages without an `index` whose files are all on PyPI now show the
registry, and the entry is restored without an `index` too.

A rolled-back pylock also never matched what uv writes: restored
`upload-time` values kept milliseconds, while uv writes whole seconds
in pylock files (#408). The restore now follows the lock's own
precision.

The real-uv hosted e2e lanes for `uv export` and `uv pip compile`
pylocks now lock a PyPI sibling and require a byte-exact rollback.

Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) marked this pull request as ready for review

October 2, 2026 00:09

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Copy link

Copy Markdown

Collaborator Author

BugBot review

Generated by Claude Code

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 2, 2026

View reviewed changes

cursor Bot left a comment

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 116d022. Configure here.}

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 2, 2026

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Copy link

Copy Markdown

Collaborator Author

Ready for review — burn-down agent.

Head: 116d02272a
CI: 484/484 non-skipped check runs green (3 skipped), no failing commit statuses
Mergeable: no conflicts, 0 commits behind main
Bugbot: reviewed 116d02272a, 0 unresolved threads
Reviewer focus: lock_shape classification of pylock siblings (Named / PypiFiles / Files(host)) in crates/socket-patch-core/src/patch/redirect/upstream/uv.rs, and the whole-seconds upload-time rule.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Tanmay Singla (Tanmay182003) approved these changes

Oct 2, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Copy link

Copy Markdown

Collaborator Author

Reviewed 116d02272aff362b7b83185196a44c7aa7c309bf. Recommendation: ready to merge from code review. No actionable correctness or security regressions found. Checked unindexed PyPI sibling inference, mixed/foreign registry refusal, preservation of omitted index, timestamp precision, and the restore callers.

Validation: all 42 upstream_restore_golden tests and all 56 core unit tests matching upstream passed (cargo test -p socket-patch-core --all-features). The real-uv CLI matrix and full workspace suite were not rerun.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) merged commit 7825622 into main

Oct 2, 2026

487 checks passed

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) deleted the agent/fix-uv-pylock-restore-shape branch

October 2, 2026 14:28

This was referenced Oct 4, 2026

Hosted uv rollback, remove and vendored takeover always refuse locks written by uv 0.6.15–0.6.17, which spell the artifact field upload_time instead of upload-time #788

Closed

Hosted rollback and remove always refuse a pip lock pylock.toml ("no sibling registry package shows the registry and artifact fields"), because pip writes [[packages.wheels]] tables, not uv's inline wheels = [...] #804

Closed

Reviewers

cursor[bot]

cursor[bot] left review comments

Tanmay Singla (Tanmay182003)

Tanmay182003 approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

Ready for review

Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Hosted rollback rewrites uv pylock.toml upload-time with milliseconds, so the restored file never matches what uv writes Hosted rollback, remove and vendored takeover always refuse on a uv pip compile pylock.toml because its packages carry no index key

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

LLM Description written by Claude Code:claude-opus-5-5

Summary

Root cause

Fix

Tests (red → green)

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 2, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Mikola Lysenko (mikolalysenko) commented Oct 1, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.