René's URL Explorer Experiment

Title: feat(apply): safety hardening — atomicity, locking, pnpm CoW, sidecars, Maven gate by mikolalysenko · Pull Request #80 · SocketDev/socket-patch · GitHub

Open Graph Title: feat(apply): safety hardening — atomicity, locking, pnpm CoW, sidecars, Maven gate by mikolalysenko · Pull Request #80 · SocketDev/socket-patch

X Title: feat(apply): safety hardening — atomicity, locking, pnpm CoW, sidecars, Maven gate by mikolalysenko · Pull Request #80 · SocketDev/socket-patch

Description: Summary Hardens socket-patch apply against the six failure classes surfaced by a recent audit. Each commit is self-contained, builds clean, and ships with tests. # Commit Defends against 1 feat(apply): advisory file lock across mutating subcommands apply-vs-apply / apply-vs-rollback races; concurrent CI + dev runs against the same .socket/ 2 refactor(cli): plumb --api-url/--api-token without std::env::set_var Rust 1.80+ unsoundness of std::env::set_var under tokio multi-thread runtime 3 feat(maven): gate Maven crawler behind SOCKET_EXPERIMENTAL_MAVEN=1 jar sidecar checksum corruption (.jar.sha1/md5); Maven patches today are experimental 4 feat(apply): copy-on-write defense against pnpm content-store mutation pnpm node_modules/ is a symlink/hardlink into the global store — patching project A used to mutate project B's install 5 feat(apply): detect pnpm + refuse on yarn-berry PnP yarn-berry PnP keeps packages in .yarn/cache/*.zip; apply refuses with a clear pointer to yarn patch 6 feat(apply): atomic write via stage+rename half-written / truncated files on Ctrl-C, OOM, crash, fs error; multi-file patches that fail midway leaving a hybrid state 7 feat(apply): per-ecosystem sidecar fixups (cargo + nuget; advisories for pypi/gem/go) cargo build "checksum changed" failures; NuGet "tampered package" warnings; advisory events for ecosystems we cannot yet fully fix Why this PR exists socket-patch apply is run as the second step of the install → patch apply → build flow. Before this PR it had several silent failure modes that would either break the user's next build (Cargo checksum mismatch, NuGet content hash) or corrupt unrelated projects on the same machine (pnpm store mutation). The audit lays this out in detail; this PR closes the highest-blast-radius items. Confirmed in scope with project lead: pnpm safety via hardlink-aware CoW (not just refuse). yarn-berry PnP: refuse with clear error. Maven: experimental, gated off by default. File modes: not tracked (PatchFileInfo schema change is upstream of socket-patch). What stays out of scope File-mode tracking in PatchFileInfo. Yarn-berry zip patching (would need a zip rewriter or shelling to yarn patch). Honest NuGet contentHash recompute (would need server-side support to ship the original .nupkg). Go module cache native patching (advisory only — go mod verify would fail). Full PyPI RECORD rewriter (path-mapping between site-packages and the package dir has quirks I'd want to verify against real installs first — advisory only here). Maven jar-level patching (compiled out; experimental tier). Tests cargo build --workspace ✓ (default features, what the release binary uses) cargo build --workspace --all-features ✓ cargo build --release --workspace ✓ — no warnings cargo clippy --workspace --all-features -- -D warnings ✓ cargo test --workspace --all-features ✓ — 450 lib tests pass plus every integration suite (cli_parse_*, e2e_*). Notable new tests: patch::cow::hardlink_is_broken_and_sibling_survives_mutation — the core pnpm invariant: patching one link target does not mutate the other. patch::apply::test_apply_file_patch_does_not_propagate_to_hardlinked_sibling — end-to-end variant proving the integration is wired. patch::apply::test_apply_file_patch_hash_mismatch_leaves_original_intact — atomic write contract: a failed apply leaves both the original file and the parent directory exactly as it was (no .socket-stage-* litter). patch::apply_lock::* — five tests covering acquire, contention, drop, missing dir, timeout. patch::sidecars::cargo::rewrites_only_patched_files + sibling tests — .cargo-checksum.json round trip. patch::sidecars::nuget::* — .nupkg.metadata deletion + signed-package advisory. crawlers::pkg_managers::* — 9 tests pinning the detection table. JSON envelope additions (additive) The per-package apply result JSON now carries two new top-level keys: sidecarsUpdated: string[] — paths relative to the package directory that were rewritten or deleted as part of the sidecar fixup. Empty when no sidecar applied. sidecarAdvisory: string | null — one-line operator advisory for ecosystems we cannot fully fix (PyPI RECORD, gem cache, go mod verify). null when there is no advisory. Existing keys are unchanged. The contract test in crates/socket-patch-cli/src/commands/apply.rs was updated to reflect the new top-level key set; downstream wrappers that strict-check the key set need a small update. Relationship to PR #79 This branch is off main at b96a13f and is independent from PR #79 (feat/scan-apply-json, the v3.0 unified-args + scan --sync work). They touch disjoint files and modules, so the merge should be conflict-free, but the depscan submodule bump (PR SocketDev/depscan#20517) will need a follow-up rebase once #79 lands so it picks up both code paths together. Manual smoke checks before merge Lock: ( socket-patch apply --json & ); socket-patch apply --json — second call emits {"errorCode":"lock_held"}. Hardlink: ln a b, run apply against a manifest covering one of them, verify the other is byte-unchanged. Atomic rollback: corrupt a blob (or claim a wrong hash), run apply, verify the target file is byte-unchanged. Cargo sidecar: in a project with a Cargo patch applied, cargo build succeeds (no "checksum changed" error). pnpm: in a pnpm project, apply emits the "pnpm layout detected" note and the global store entry is byte-unchanged. yarn-berry: in a .pnp.cjs project, apply exits 1 with errorCode: yarn_pnp_unsupported. Maven: with the binary built --features maven but SOCKET_EXPERIMENTAL_MAVEN unset, Maven PURLs surface the experimental warning and are skipped. Assisted-by: Claude Code:claude-opus-4-7 Follow-up: dead-code purge + integration coverage expansion (this session) Since the original review request, this branch has accumulated a substantial cleanup + coverage pass that's worth surfacing separately. Net effect: workspace coverage moved from ~70% regions to 90.15% regions / 88.45% lines / 94.57% functions. Dead code removed (~1300 lines across 14 files) crates/socket-patch-core/src/manifest/recovery.rs (543 lines) — entire module removed; the recover_manifest machinery (RecoveryResult, RecoveryEvent, RecoveryOptions, RefetchPatchFn etc.) had zero call sites. utils::purl: 12 unused helpers (is_pypi_purl, is_npm_purl, is_gem_purl, is_maven_purl, is_golang_purl, is_composer_purl, is_nuget_purl, is_cargo_purl, parse_npm_purl, parse_purl, build_pypi_purl, plus a duplicate of build_npm_purl) — all redundant with Ecosystem::from_purl + per-ecosystem parse_*/build_* in the crawlers. json_envelope: PatchEvent::with_old_uuid, ::with_bytes + their underlying old_uuid/bytes fields, Summary::bytes_downloaded/bytes_freed counters, PatchAction::as_tag, Command::as_tag — all unused; the JSON output uses serde's #[serde(rename_all)] directly. utils::telemetry::track_patch_event_fire_and_forget — unused tokio-spawn variant. utils::env_compat::read_env_either — duplicate alias of read_env_with_legacy. utils::fuzzy_match::is_purl / is_scoped_package — duplicates of utils::purl::is_purl and unused scoped-name check. crawlers::nuget_crawler::parse_nuspec_id_version + extract_xml_element — never wired into discovery. crawlers::types::Ecosystem::purl_prefix — production uses Ecosystem::from_purl enum dispatch instead. manifest::operations::get_referenced_blobs, diff_manifests, ManifestDiff — superset/diff helpers that no command consumed. package_json::update::update_multiple_package_jsons — sequential wrapper with no callers. constants: 4 unused .socket/* path constants (DEFAULT_BLOB_FOLDER, DEFAULT_PACKAGES_FOLDER, DEFAULT_DIFFS_FOLDER, DEFAULT_SOCKET_DIR). SidecarFileAction::Created — reserved-but-never-emitted enum variant. Bug fixes surfaced during coverage work Feature-gated tests in in_process_remote_ecosystems_apply.rs + in_process_rollback_all_ecosystems.rs — ecosystem tests assumed --all-features; under narrower builds they false-failed because the crawler dispatch compiled out. Added #[cfg(feature = "")] per test. Stray duplicated #[test] attribute in utils/purl.rs (leftover from earlier removal). Unused imports / variables across several test files. New integration test files Ten new e2e files under crates/socket-patch-{cli,core}/tests/: File Tests Covers e2e_safety_advisories.rs 7 PyPI / gem / Go / NuGet sidecar advisory envelope shapes + non-UTF-8 filename branch e2e_safety_cow.rs 5 hardlink isolation, symlink replacement, multi-file CoW, regular-file no-op, failure-doesn't-CoW e2e_safety_internals.rs 11 direct-dispatch tests for cow/sidecar guards reachable only via pub APIs (incl. macOS chflags uchg + ACL tricks for rename/write failure paths) e2e_safety_cargo_build.rs (extended) +4 malformed checksum, missing files field, read-only checksum (chmod 0444), directory-as-file core/tests/diff_e2e.rs 5 apply_diff round trip + malformed-delta + wrong-source-no-panic core/tests/package_e2e.rs 9 read_archive_to_map / read_archive_filtered happy path + unsafe-path guards (absolute, parent-traversal, backslash) core/tests/fuzzy_match_e2e.rs 8 MatchType ordering: ExactFull > ExactName > PrefixFull > PrefixName > ContainsFull > ContainsName core/tests/rollback_new_file_e2e.rs 5 new-file rollback branches (empty before_hash → delete) and MissingBlob/NotFound arms core/tests/blob_fetcher_edges_e2e.rs 9 early-return branches: empty manifest, empty hash set, skip-existing, no-paths-configured + DownloadMode::parse/as_tag round trip core/tests/crawlers_empty_paths_e2e.rs 12 find_by_purls/crawl_all short-circuits across all 7 ecosystems core/tests/telemetry_helpers_e2e.rs 6 is_telemetry_disabled env-var combos + sanitize_error_message home-dir redaction cli/tests/output_helpers_e2e.rs 10 format_severity ANSI branches per severity + case-insensitivity + color wrapper cli/tests/cli_dry_run_paths_e2e.rs 6 --dry-run envelope shape across apply/repair/rollback/remove/list + apply --silent short-circuit cli/tests/get_batch_paths_e2e.rs 7 get UUID/CVE/GHSA error branches + selection_required + --id filter miss Plus targeted extensions to apply_invariants.rs (no-.socket-dir envelope) and repair_invariants.rs (--offline + --download-only mutual exclusion). Coverage summary (region-level, integration tests via cargo llvm-cov --workspace --all-features) File Before After sidecars/mod.rs 93.6% 100.0% sidecars/cargo.rs 76.7% 100.0% sidecars/nuget.rs 91.4% 100.0% (Linux) / 98.3% (macOS — APFS rejects non-UTF-8 filenames so one branch skips) patch/cow.rs 79.0% 100.0% patch/diff.rs 0% 99.1% patch/package.rs 0% 97.6% utils/fuzzy_match.rs 0% 99.2% manifest/operations.rs 43.4% 97.2% commands/apply.rs (cli) 86.5% 89.0% output.rs 54.4% 91.2% TOTAL workspace regions 70.05% 90.15% The remaining ~10% of uncovered regions lives in CLI command flag-combination paths (commands/get.rs 74.4%, scan.rs 80.4%, ecosystem_dispatch.rs 77.7%) that each need their own wiremock + tempdir + manifest staging — straightforward but voluminous. Worth a follow-up PR focused on commands/* runners alone. Workspace stability All test sweeps green: cargo test --workspace --all-features finishes with 547+ passing tests (118 cli lib + 414 core lib + 60+ new integration tests). No new warnings.

Open Graph Description: Summary Hardens socket-patch apply against the six failure classes surfaced by a recent audit. Each commit is self-contained, builds clean, and ships with tests. # Commit Defends against 1 f...

X Description: Summary Hardens socket-patch apply against the six failure classes surfaced by a recent audit. Each commit is self-contained, builds clean, and ships with tests. # Commit Defends against 1 f...

Opengraph URL: https://github.com/SocketDev/socket-patch/pull/80

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width