GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #563

Summary

Hosted and vendored Pipenv each had their own private grammar for deciding whether a Pipfile.lock URL is a Socket-hosted PyPI patch reference. This PR moves both onto one shared recognizer, lock_inventory::pypi::hosted_pypi_reference, and deletes the two copies.

Why (leverage)

• Issue #563 (p1), register rows E04 and E49 (register), living document Part 5.4, "Hosted-URL recognition is duplicated".
• B=1, U=0, D=2 (two grammars deleted, net −17 production lines), R=L. Score 5, the top eligible candidate. Its files don't overlap any open arch-refactor/* or agent/fix-* PR. Hosted NuGet mapping reads commented-out package sources #561 ranked close behind but touches redirect/mod.rs, which four open PRs also change.

What changed

• New: hosted_pypi_reference(url, origins). It applies the redirect::hosted_patch_url_uuids origin policy (patch.socket.dev or a configured origin, no userinfo), then the hosted_artifact_url tail grammar (…/patch/pypi/<n>/<v>/<grant>/<uuid>/<wheel-or-sdist>, matched from the end), and requires a non-empty uuid level.
• Hosted redirect::pipenv::owned_url = the shared recognizer on the grant's own origin, plus a check that the name and version match the dep.
• Vendored pypi_pipenv::check_target_guards / wire_pipenv take hosted_origins. vendor_pypi_with_pipenv_version passes the run's VendorServiceConfig.patch_server_url. service_preflight passes &[]: only the verdict matters there, and both refusal branches carry the same code.

Deleted

• The segment-count grammar in owned_url (≈30 lines).
• vendor/pypi_pipenv.rs::is_socket_hosted_reference (≈10 lines).
• Diff (approximate split at #[cfg(test)]): production +31 / −48, tests +174 / −37.

Behavior

These changes are intended. They are what #563 asks for:

• Hosted Pipenv now treats its own pin on a path-prefixed --patch-server-url origin, and a hosted sdist pin, as ours. Rotation works where it used to return Conflict("Pipenv source for … already exists").
• Vendored Pipenv gives a foreign host's /patch/pypi/… URL the "user-declared" remedy, where it used to say "HOSTED … run rollback". A hosted sdist or path-prefixed pin on an accepted origin now gets the HOSTED remedy. The error code is pypi_pipenv_source_already_exists in every case, unchanged.
• Small edge: hosted owned_url used to reject a URL with a ?query. The shared recognizer ignores the query, the same as hosted_patch_uuid. Socket never writes one.
• No JSON, exit-code or contract changes. The wrappers (npm/, pypi/, gem/) need nothing.
• Poetry, pdm and uv have no private /patch/pypi/ grammar of their own (checked with grep), so nothing more to unify there.

Test evidence

• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --lib: 4756 passed, 4 failed. The 4 fail identically on origin/main because the sandbox runs as root (permission-dependent tests): copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched, pypi_requirements::wire_failure_rolls_back_already_written_files.
• cargo test -p socket-patch-cli --all-features --test in_process_redirect_pipenv --test hosted_memory_engine --test hosted_memory_parity: 6 + 28 + 31 passed.
• Red→green:
  • redirect::pipenv::tests::owned_url_accepts_path_prefixed_origins_and_sdists fails with the old owned_url swapped back in and passes now.
  • vendor::pypi_pipenv::tests::hosted_reference_remedy_follows_the_shared_recognizer fails with the old is_socket_hosted_reference swapped back in (the evil.example URL was called HOSTED) and passes now.
  • Together these run both former callers through the shared code on the inputs where the copies differed.
• owned_url_follows_the_grant_origin and the vendored Pipenv suite stay green.
• CodeQL flagged the new test's assert message for printing the refusal detail. ff3ef3e prints only the URL and the expected phrase, and the pypi_pipenv tests are still green (27 passed).
• The PDM compatibility cell platform-windows hosted failed once and passed on re-run. It isn't on a path this PR touches (see comment).

Risk

Low. The change is confined to Pipenv ownership and remedy selection, and every refusal keeps its code.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WhtPehwinReW5U3cPmhccc

Generated by Claude Code