GeezerVison

BugBot review

Generated by Claude Code

Ready for review at head 193e195481c1f6d9e6ab95ed14772946d7ff4d13.

• CI: 488/488 check runs green on this head (6 skipped, none failed).
• Bugbot: reviewed 193e195 and found no new issues. There are no review threads open.
• Reviewer focus: the hosted uv unwind now matches lock requirement entries against pyproject declarations with extras, markers and include-group taken into account, where before it matched by bare name over a flattened set.

Generated by Claude Code

Review updated for cfae77e3e4a5a25c1d8bab28b123fc8c56808c45: Ready to merge as-is from this review. Final-head CI is complete: 482 successful checks, 7 skipped; no failures or pending checks. Bugbot passed, there are no unresolved review threads, and the PR is mergeable.

The unwind preserves unambiguous simple extra == 'name' declarations and the per-package rollback. Other declaration-owned extra expressions, including reversed equality, now refuse when their version clauses differ, preventing two native lock entries from being restored to one incorrect constraint. The supported subset is documented.

All 87 focused tests and both real uv 0.11.19 capstones passed on 7f46a948; the tested source and native-fixture files are byte-identical in cfae77e3. The capstones include fresh/plain installs, VEX, online PyPI reconstruction and byte-exact rollback for ordinary extras and include-groups. The new transaction regression uses native-generated fixtures and verifies both forward and reversed collision cases across LF/CRLF and normal/dry-run modes, preserving both files on refusal. The reversed case fails on parent 413ffb38 and passes after the correction; native uv independently rejects the previously corrupted lock.

The author added the required discovery golden in 48bd2391. It exactly matches the independently generated snapshot: the pristine fixture contains two registry packages and no patched references. All four golden tests passed again on cfae77e3 with updates disabled, all 17 existing snapshots are unchanged, and Bugbot passed.

Windows CI exposed a separate fixture checkout issue: Git converted LF to CRLF, then the regression test created invalid double-CRLF bytes. The author added the existing repo convention of -text protection for this native fixture family in cfae77e3. An isolated core.autocrlf=true Git checkout reproduced the exact failing bytes before the rule and preserved the committed fixture bytes after it. All 43 upstream restore fixture tests passed both locally and in Windows CI on this commit. No production or test-source change was needed, and no retry of the known-broken commit was requested.

Independent marker and rollback reviews are clear. The committed sources match the tested files; core clippy and diff checks pass, and new production/test blocks match rustfmt, with the existing unrelated macOS warning recorded. The commit merges cleanly with current main. No remaining actionable finding from this review.

The Ready label is restored after all checks completed on the corrected commit.

CI note: macOS Bun 1.3.10 initially hit a patch-service connection timeout before the expected workspace refusal; its other 52 cases passed and the harness recorded no project-file changes. One targeted job retry passed all 53 cases, including the correct refusal. No source change was needed for that network failure.

[agent] Confirmed the P2 finding and fixed it in 413ffb3. A dependencies declaration whose own marker has extra == '<x>' now stays a candidate for lock entries whose marker names x. When it and extra x's member declare different specifiers, the unwind refuses ("different specifiers … not derivable") instead of restoring both from the optional declaration. A refused hit also now rolls uv.lock back to its state before that hit (doc snapshot in restore_lock), so a partial restore can't be written alongside another hit.

Tests (red without the narrowing fix, green with it): dependency_with_its_own_extra_marker_is_ambiguous is your case and must refuse; dependency_with_its_own_extra_marker is the unambiguous variant and still restores. All 19 upstream::uv tests pass, and clippy is clean.

Generated by Claude Code

BugBot review

Generated by Claude Code

BugBot review

Please review the corrected commit 7f46a948ea4a79b0a2cb81f95060c2398783db11.

[agent] CI: native (macos-latest, 2.1.4) (Poetry patch compatibility) failed on 7f46a94 with one cell, 2.1.4 direct hosted FAIL appliedExactlyOne. The other four cells passed. This PR changes only the uv hosted unwind (upstream/uv.rs), which the Poetry hosted apply never calls. It matches the earlier one-cell appliedExactlyOne failure in the PDM macOS hosted lane on 658bc04, which passed on the next head, and the transport blips that open PRs #596 and #610 target. I re-ran the failed job once.

Generated by Claude Code

[agent] CI: native (ubuntu-latest, 2.29.2) (PDM patch compatibility) failed on 7f46a94 with one cell, platform-windows vendored FAIL rescanIdempotent; the other 46 rows passed. That's PDM vendored mode, which never calls the uv hosted unwind this PR changes. The same job passed on 193e195, and between the two commits only the declaration matching in upstream/uv.rs changed. I re-ran the failed job once.

Generated by Claude Code

[agent] Update on the PDM run for 7f46a94: 40 of its 43 jobs passed, and 3 failed with one cell each, all different: ubuntu 2.29.2 platform-windows vendored (rescanIdempotent), macos 2.29.2 static-urls vendored, ubuntu 2.22.4 optional agent. The failures are spread across vendored and agent modes, neither of which reaches the uv hosted unwind this PR changes, and the same workflow passed on 193e195. I re-ran the three failed jobs once now that the run has finished.

Generated by Claude Code

BugBot review

Generated by Claude Code

[agent] CI: test (ubuntu-latest) failed on 7f46a94 in vex::discover::testing::golden::tests::committed_fixture_corpus_matches_golden with upstream: no golden. The new tests/fixtures/upstream/uv-explicit-extra directory joined the VEX discovery golden corpus, which needs a golden for every fixture directory. Fixed in 48bd239 by regenerating with SOCKET_PATCH_UPDATE_GOLDEN=1. The new upstream.json records no hosted refs, only the pristine lock's idna/six registry entries. That golden test now passes locally.

Generated by Claude Code

BugBot review

Generated by Claude Code

[agent] CI: test (windows-latest) failed on 48bd239 in -p socket-patch-core --test upstream_restore_golden. The Windows checkout applies core.autocrlf, so tests/fixtures/upstream/uv-explicit-extra/* arrived as CRLF. uv_explicit_extra_collision_refuses_without_writing then built its CRLF variant with .replace('\n', "\r\n") and got \r\r\n. Fixed in cfae77e: .gitattributes now marks tests/fixtures/upstream/** -text, the same rule the poetry/pipenv/pdm-native lock fixtures use. The files are LF in the repo, so nothing else changes.

Generated by Claude Code

[agent] CI: native (macos-latest, 1.3.10) (Bun patch compatibility) failed on cfae77e. Bun's npm-family code paths aren't touched by this PR, which changes only the uv hosted unwind (upstream/uv.rs), a uv fixture, its VEX golden and .gitattributes. That job passed on 193e195. I'll re-run the failed job once when the run finishes.

Generated by Claude Code