GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #544
Fixes #524

Summary

After vendoring or a hosted scan, uv projects whose existing [tool.uv] sources aren't written as a plain [tool.uv.sources] table now unwind cleanly:

• Dotted keys (Vendored uv revert and remove half-revert a project whose sources use dotted keys under [tool.uv]: uv.lock is restored but the sources.<pkg> line stays, so uv sync --locked fails (vendor --revert exits 0) #544): vendor --revert and remove no longer report socket-patch's own sources line as "drift". Before, they restored uv.lock but left pyproject.toml routed to the vendored wheel, which broke uv sync --locked and kept six silently patched on a plain uv sync. Affected spellings: [tool.uv] + sources.x = {…}, sources.x.path = …, [tool] + uv.sources.x = …, and a root tool.uv.sources.x = …. The same bug hit the transitive uv.override-dependencies = […] line.
• Sub-table-only sources (uv rollback, remove and vendor --revert leave an empty [tool.uv.sources] header behind when the project's sources are written as [tool.uv.sources.<name>] sub-tables #524): vendored revert and hosted rollback/remove now drop the [tool.uv.sources] header (and, for transitive deps, the [tool.uv] header) that the scan had to make explicit, so the round trip is byte-identical.

Root cause

The uv wiring assumed sources live under an explicit [tool.uv.sources] header as name = {…} lines. toml_edit, though, writes a new key in the spelling its parent already has:

• Vendored mode recorded a hard-coded six = { path = … } in the ledger, while the file held sources.six = { … }. Revert's exact-line splice missed it, and the fragment was treated as user drift.
• A parent that exists only implicitly (implied by [tool.uv.sources.<pkg>] sub-tables) prints its header once a key is added. Vendored mode decided "we didn't create the table" because the table existed, and the hosted restore left it explicit.

Changes

• vendor/pypi_uv.rs: record each added pyproject line exactly as it rendered, dotted prefix included (rendered_key_line). Treat a header-less implicit parent as ours (header_is_ours), so revert removes the header it printed.
• vendor/toml_surgery.rs: remove_table_if_empty keeps the blank lines before a following header, because they are that table's own separator. Previously it ate the sub-table's spacing. The pinned helper test was updated, and a uv rollback, remove and vendor --revert leave an empty [tool.uv.sources] header behind when the project's sources are written as [tool.uv.sources.<name>] sub-tables #524-shaped case added.
• patch/redirect/upstream/uv.rs: restore_metadata makes [tool.uv.sources] / [tool.uv] implicit again once only sub-tables remain (hide_header_over_sub_tables).

Known trade-off: a user who wrote an explicit, key-less [tool.uv.sources] header with only sub-tables beneath it gets that header dropped by a hosted rollback. The hosted path has no ledger, so it can't tell that header apart from one the scan made explicit. The result still parses identically, and that shape is unusual.

An earlier cargo fmt --all had also reformatted 124 unrelated files (main isn't rustfmt-clean, and CI has no fmt check). Those are reverted at f1a45b0, so the diff is just the 4 files above.

No wrapper changes are needed (npm/, pypi/, gem/ only dispatch to the binary).

Test evidence

Each regression test was run red on the pre-fix code and green with the fix:

Commands run locally on bec2311:

• cargo clippy --workspace --all-features -- -D warnings: clean
• cargo test --workspace --all-features --no-fail-fast: all pass except 12 permission-injection tests (chmod/set_permissions read-only fixtures in covgap_commands_vendor, in_process_redirect, repair, and core copy_tree/vlt_heal/pypi_poetry/pypi_requirements). Those can't fail as intended because the sandbox runs as root. None of them is in a file this PR touches, and CI runs as non-root.
• cargo test -p socket-patch-cli --all-features --test e2e_vendor_pypi_build -- --include-ignored (uv 0.8.17): every uv test passes, including the 3 new ones. Re-run on f1a45b0: 23/23 pass.
• cargo test -p socket-patch-cli --all-features --test e2e_redirect_uv_build -- --include-ignored (uv 0.8.17): 16/16 pass (also on f1a45b0).

🤖 Generated with Claude Code

https://claude.ai/code/session_013Lodu4CMs7Cfqq8pEzPXpb

Generated by Claude Code