GeezerVison

What main changed. Two hosted rewriters landed without bench coverage.

Gradle: #646 (0685ba8c) added full Gradle support, including hosted mode. scan now crawls Gradle's modules-2/files-2.1 cache under GRADLE_USER_HOME and pins the suffixed versions in gradle.lockfile. It wires the build through an owned settings script and index under .socket/gradle/. The suite had no Gradle scenario: maven/* only covers the pom.xml + ~/.m2 path.

Hatch: #680/#743 (0475695f) added hosted Hatch. With a Hatch project (hatch.toml, [tool.hatch] or a hatchling.build backend) and no lockfile, scan rewrites each declared dep in place through utils::hatch::plan: it turns pyproject.toml [project] deps and hatch.toml [envs.*] deps into name @ <url>#sha256=… and enables allow-direct-references. hatch.toml is a HOSTED pypi input in formats/registry.rs, but no fixture reached this path.

Suite changes

• Added hatch/hosted and hatch/rescan (commit 5b9ae8ea, 2026-10-07). The project is a lockless hatchling app with 1000 dists and 25 patched. Direct deps go in [project]. A hatch.toml default env (in-project .venv) pins every patched dist, plus every 10th other one, so the planner has to skip non-matching specs. Hosted Hatch only redirects deps a Hatch table declares (a transitive-only dep gets redirect_hatch_unsupported), so these pins are what a real project patching its transitives writes. The scenarios expect hatch.toml and pyproject.toml to be rewritten, and the only allowed warning is the shared redirect_pypi_stale_install.
• Added gradle/hosted and gradle/rescan. The project is a single-project Groovy-DSL build with dependencyLocking: 1000 locked artifacts, 25 of them patched direct deps. Its cache lives under the fixture's GRADLE_USER_HOME, with jar and pom in separate sha1 hash dirs. The scenarios expect these rewrites: .socket/gradle/{.gitattributes,hosted-index.tsv,socket-patch.hosted.settings.gradle}, gradle.lockfile and settings.gradle. The only allowed warning is redirect_gradle_detached_configs_unguarded, which the planner always emits.
• The grant's indexUrl is https://patch.socket.dev/..., not the mock. The Gradle planner refuses non-https repositories (redirect_gradle_override_invalid), and a scan never fetches the index. The artifact URL still points at the mock.
• Refactor, no behavior change. maven and gradle now share the Maven-coordinate generator, the pom writer and the maven2 grant builder. The maven fixture bytes are unchanged: I built maven/hosted with the old and new bench binaries and diff -r showed them identical.
• README: lists gradle and GRADLE_USER_HOME.

Validation, Gradle (all runs against the main CLI 9c43dfc9, on a 4 vCPU Xeon @ 2.10GHz)

• cargo fmt -p socket-patch-bench, cargo clippy -p socket-patch-bench --all-features --all-targets -- -D warnings and cargo test -p socket-patch-bench (29 passed) are all clean.
• run -f '^gradle/' --runs 3: gradle/hosted 170.5 ms (0.17 ms/pkg), gradle/rescan 259.2 ms. Both validate with 53 requests each.
• A/A compare -f '^gradle/' -f '^maven/' (head binary vs a copy of itself): no regressions. gradle/hosted -1.1%, gradle/rescan +4.5%, maven/hosted -1.6%, maven/rescan +1.7%.
• strace -f -e trace=execve on the serve gradle/hosted command: the CLI spawns nothing; the only execves are the shell, env and socket-patch itself. The rewritten gradle.lockfile carries <v>-socket.<uuid8> pins, and settings.gradle gains the apply from: line.

Validation, Hatch (main CLI 9c43dfc9, 4 vCPU Xeon @ 2.80GHz, 2026-10-07)

• cargo fmt -p socket-patch-bench, cargo clippy -p socket-patch-bench --all-features --all-targets -- -D warnings and cargo test -p socket-patch-bench (29 passed) are all clean.
• run -f '^hatch/' --runs 5: hatch/hosted 86.1 ms (0.086 ms/pkg), hatch/rescan 77.0 ms. Both validate with 53 requests and 25 redirected. At 400/12 a scan took about 50 ms, under the suite's ~70 ms floor, so the size was raised to 1000/25.
• A/A compare -f '^hatch/': no regressions. hatch/hosted -2.1%, hatch/rescan +2.5%.
• strace -f -e trace=execve on the serve hatch/hosted command: the only execve is socket-patch itself. The rewritten hatch.toml holds name @ http://…/…whl#sha256=… pins, and pyproject.toml gains [tool.hatch.metadata] allow-direct-references = true.

Time budget: compare grows by about 2 × 0.4 s per pair. A full compare took about 13 min on this runner both before and after, so the change is within noise. Hatch adds about 2 × 0.16 s per pair, roughly 6 s per full compare. Nothing was removed.

🤖 Generated with Claude Code

https://claude.ai/code/session_019rfKYrfN4H9XDnDS8MYaYJ

Generated by Claude Code