René's URL Explorer Experiment

Title: cleanup: CLI simplify pass, correctness fixes, core dedups, scan split, docs sync (−587 net lines) by mikolalysenko · Pull Request #120 · SocketDev/socket-patch · GitHub

Open Graph Title: cleanup: CLI simplify pass, correctness fixes, core dedups, scan split, docs sync (−587 net lines) by mikolalysenko · Pull Request #120 · SocketDev/socket-patch

X Title: cleanup: CLI simplify pass, correctness fixes, core dedups, scan split, docs sync (−587 net lines) by mikolalysenko · Pull Request #120 · SocketDev/socket-patch

Description: Summary Combined cleanup PR from the full architecture review — supersedes the #118 → #119 → #120 stack (all commits preserved here; the two inner PRs are closed unmerged). Net −587 lines across 71 files with no user-visible behavior change except the correctness fixes and three deliberate fail-closed tightenings noted below. 1. CLI simplify pass (was #118) Behavior-preserving dedup across all 14 command files + args.rs (−576 lines): shared patch_matches/short_uuid/error_envelope/DownloadParams/offline-diagnostic helpers, merged duplicate emit blocks, deleted write-only structs and dead fields, pub → pub(crate) for the internal fetch_stage/lock_cli/repair_vendor libraries. Core: are_safe_redirect_coords widened to pub so the CLI VEX go-patches synthesis applies the exact core guard instead of a drift-prone local mirror. 2. Correctness fixes (was #119) Env-bool parse unification — parse_bool_flag everywhere: fixes the crash class where SOCKET_SAVE_ONLY=1 / SOCKET_ONE_OFF= / SOCKET_SKIP_ROLLBACK=1 aborted get/remove (and SOCKET_ALL_RELEASES= via BoolishValueParser). Adds LOCAL_ARG_ENV_VARS (the global list was also missing SOCKET_STRICT), widens main's empty-var scrub, and adds two table-driven invariant tests that parse every env binding against its owning subcommand so the policy self-enforces. RED-verified. remove --dry-run implemented — the one mutating command that silently ignored the global --dry-run contract row ("Preview, no mutations") and deleted anyway. Preview flips would-be Removed events to Verified (the apply/vendor/repair convention); manifest removal simulated in memory so the blob sweep previews accurately. RED-verified. get --one-off fails honestly — was a silent no-op that saved to the manifest anyway; now errors "not yet implemented" up front, mirroring rollback --one-off. Scan mode-fold inversion — ScanMode becomes the single source of truth; legacy booleans (--apply/--vendor/--redirect/--sync) fold into the enum and are never read downstream. Error strings byte-identical; legacy help text demoted to "deprecated spelling of --mode X". 3. Core dedups + hardening (was #120) atomic_write ×7 → utils::fs::atomic_write_bytes via 2-line delegating wrappers; blob_fetcher's lighter cache writer deliberately exempt + documented. (−290) vendor/common.rs: already_patched_verify ×11, synthesized_result ×10, refused ×6, copy_matches_after_hashes ×4 + go_redirect's inline loop hoisted. Tightening #1: cargo/golang's copies lacked the is_safe_relative_subpath guard — the shared helper is the guarded one. (−354) Crawler guards → path_safety delegation. Tightening #2 (security): none of the six guards rejected : (Windows C:evil drive-relative join hazard) — closed, colon cases added RED-first per guard. Tightening #3: maven's dot-split never rejected / inside a segment (/etc groupId → absolute path) — also closed. async is_dir ×8 → utils::fs. vendor CLI dispatch macro: 8 arms × identical 9-arg tuple → vend! keeping per-arm #[cfg]. (−90) Two build fixes found en route: --no-default-features didn't compile (ungated verify_go_h1 → golang-gated go_h1_of_zip; ungated the hasher to keep dirhash verification fail-closed in every build) + a composer-gated test-mod import. Warm-up: normalize_file_path private copy deleted; serialize_sorted → utils/serde.rs; stale vendor doc comments rewritten (all five npm + five pypi flavors dispatch). 4. scan.rs module split (move-only) commands/scan.rs (3,593 lines) → scan/{mod,gc,discovery,hosted,vendor_flow}.rs (largest now 1,514). One module per commit, 131-test gate green between each; boxed_* Windows-stack wrappers preserved byte-for-byte; public paths unchanged; move-only verified by normalized line-multiset diff. 5. Docs sync CLI_CONTRACT: unlock documented (was absent from subcommand + env tables), --strict/--lock-timeout/--break-lock added to the global table, apply --check/--all-releases/unlock --release rows, registry-override + internal env-var sections, envelope command enum completed, exit-code-2 rows, --redirect marked hidden/deprecated (v4 removal), empty-manifest apply exit-0 reconciled. README: unlock section, an Undoing things ownership table for the six recovery verbs, and four accuracy fixes (phantom -m short flag, --break-lock never deletes the file, camelCase-vs-snake_case status split, missing --strict row). 6. Adversarial-review fixes (5 confirmed findings, 0 refuted) remove/rollback --dry-run no longer mutate .socket/blobs — the preview previously created the dir and downloaded before-hash blobs into it; blob reads now stage in a throwaway tempdir_in(.socket) (cached blobs hardlink in), auto-removed. RED-verified. remove's failure envelopes now report dryRun: true on previews. verify_go_redirect_state path-escape closed (pre-existing): a poisoned manifest key like ../../../../../secret could leak an arbitrary file's existence + content hash into apply --check output; now fails closed. RED-verified security test. rollback's --one-off bail hoisted above API-client construction (the contract's "before any network activity" claim is now true). Needless pub(super) on three scan/mod.rs helpers dropped. Test plan Full cargo test --workspace green (148 suites) clippy zero warnings: default, --all-features, --features deno; cargo check clean on --no-default-features/--features composer Per-phase gate suites green after every commit; RED-first verification for every behavior fix and both security hardenings Adversarial multi-agent review of the full diff: 5 findings confirmed → all fixed above 🤖 Generated with Claude Code

Open Graph Description: Summary Combined cleanup PR from the full architecture review — supersedes the #118 → #119 → #120 stack (all commits preserved here; the two inner PRs are closed unmerged). Net −587 lines across 71...

X Description: Summary Combined cleanup PR from the full architecture review — supersedes the #118 → #119 → #120 stack (all commits preserved here; the two inner PRs are closed unmerged). Net −587 lines across 71...

Opengraph URL: https://github.com/SocketDev/socket-patch/pull/120

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width