GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #994

Summary

Lock-only discovery now follows a -r / --requirement include the way pip does. Covered forms: a quoted path (-r "dev reqs.txt", -r 'dev reqs.txt', -r "dev.txt"), a backslash-escaped path (-r dev\ reqs.txt), a quoted long form (--requirement "dev.txt", --requirement="dev.txt"), an attached quoted short form (-r"dev reqs.txt"), and an env-var path (-r ${REQDIR}/dev.txt). Before this change, scan exited 0 with "No patches available" (lockfileOnlyPackages: 0) while pip installed the include's unpatched pins. The vendored planner, the in-use / prune probe, repair and lock-only vex use the same grammar, so they now see these includes too.

Root cause

include_target (crates/socket-patch-core/src/vendor/pypi_requirements.rs) is the single include grammar behind lock-only discovery (lock_inventory::pypi::requirements_tree), the vendored planner (requirements_includes) and the in-use / prune / repair / lock-only VEX probe (requirements_include_names). It splits an include line on whitespace and keeps the target as written. pip parses the same line differently:

1. it expands ${NAME} ([A-Z0-9_]+) from the environment, then
2. it shlex.splits the option part (POSIX quoting and backslash escapes).

So pip follows -r "dev reqs.txt", -r 'dev reqs.txt', -r "dev.txt", -r dev\ reqs.txt, -r ${REQDIR}/dev.txt, --requirement "dev.txt" and --requirement="dev.txt", while socket-patch resolves each one to a file that doesn't exist and skips it silently.

Fix

include_target now reads an include line the way pip's req_file.py does:

1. strip the comment;
2. expand ${NAME} ([A-Z0-9_]+, from the environment; an unset or empty variable stays as written);
3. shlex.split the line in POSIX mode;
4. read the -r X / -rX / --requirement X / --requirement=X forms.

Two helpers, expand_env_vars and shlex_split, live in utils::requirements with the rest of the shared pip grammar. Their unit tests are checked against Python's shlex.split.

The absolute-include refusal test (pin_in_absolute_include_refuses) now writes its Windows temp path quoted, since pip needs it quoted on Windows. The unquoted form failed test (windows-latest) on 65112a8.

Behaviour change worth noting: -r sub\dev.txt (an unquoted Windows-style separator) now resolves to subdev.txt, which is what pip reads on every OS, since shlex drops the backslash. Before, it resolved to sub/dev.txt, which pip itself doesn't open. --requirement= dev.txt (a space after =) still reads dev.txt, as before.

The commit 65112a8 is #878's fix for the main-red production_digests_go_through_the_helpers guard, ported unchanged. It becomes a no-op once #878 lands.

Test evidence

Local checks:

• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test --workspace --all-features: 226 suites green.
  • The sandbox runs as root, so 12 tests that need a write to fail on a read-only directory fail there, on main as well. All 12 pass when re-run as a non-root user.
• cargo fmt on the touched files is clean. CI has no fmt job, and main already has rustfmt drift in other files, which I left alone.
• No wrapper (npm/, pypi/, gem/) changes are needed: they only dispatch to the binary.

Follow-up, not in this PR: the issue also suggests warning when an include can't be resolved, instead of skipping it silently. This PR fixes the misreading itself, so pip-valid includes are followed. A warning for genuinely broken includes would be a separate change.

🤖 Generated with Claude Code

Generated by Claude Code