[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1847

Summary

"Which Poetry wrote this poetry.lock" was answered three ways:
redirect::poetry::pre_1_4_writer (hosted), an inline match in
vendor/pypi_poetry.rs (vendored), and source_constraint_break
re-deriving it inline. Meanwhile utils::poetry_lock::lock_writer_version,
which was built for this question, had no caller.

This PR replaces lock_writer_version with one reader,
utils::poetry_lock::lock_writer(lock_text, known_format). It returns:

• LockWriter::Format("0" | "1.0" | "1.1") for a pre-2.0 format. Only
  Poetry < 1.3 writes those, and the format decides even when a stamp
  says otherwise. That ordering is the one both pre-1.4 advisories had.
• otherwise LockWriter::Poetry(major, minor) from the
  @generated by Poetry X.Y stamp, or (1, 3) for an unstamped
  lock-version = "2.0".
• None for an unstamped 2.1+ lock or an unreadable one.

LockWriter::is_pre_1_4() drives the hosted
redirect_poetry_stale_install_risk and vendored
pypi_poetry_integrity_unverified warnings. source_constraint_break
now matches on the writer. The inline copies are deleted, and
generated_by_version is now pub(crate).

No change for any lock a real Poetry writes. The only behaviour change is
for a hand-edited lock: source_constraint_break now refuses a 1.0/1.1
lock whose first line carries a 1.4–2.2 stamp. Before, the stamp alone
decided. This is the safe direction, since every Poetry from 1.3 on
re-solves those formats.

A second hand-edited case goes the other way. A legacy format-0 lock (with
a [metadata.hashes] table) whose first line was hand-edited to name
Poetry 1.3 – 2.2 used to be refused by source_constraint_break. It is
now admitted, the same as every unstamped format-0 lock already was.

Third case: a 2.1+ lock whose first line was hand-edited to name a Poetry
older than 1.4 now gets the pre-1.4 install warnings. Before, only a 2.0
lock with such a stamp did. These are warnings only.

Tests

• New utils::poetry_lock::tests::lock_writer_reads_old_formats_then_the_stamp
  covers all 15 Poetry fixture locks (0.12 to 2.4), with and without a
  known format. It also covers an unstamped 2.0 lock, a versionless stamp,
  stamp-only text, stamped 2.0 and 2.1 locks, a 1.4+ stamp on a 0/1.0/1.1
  lock, unstamped 2.1/2.2 locks, unreadable text, and CRLF variants.
  It doesn't compile without the fix because the reader is new. The
  stamp-vs-format rows would fail on the first commit (6abc8c5), which
  checked the stamp first; /code-review caught that and 672ab67 fixes it.
• All existing hosted/vendored Poetry tests pass unchanged, including
  integrity_advisory_tracks_pre_1_4_writers_not_the_bare_format,
  source_constraint_breaks_1_3_to_2_2_writers_and_pre_2_1_locks and the
  hosted stale-install / source-pin matrix.

Run locally on 672ab67:

• cargo fmt --all -- --check: ok
• cargo clippy --workspace --all-features -- -D warnings: ok
• cargo test -p socket-patch-core --all-features --no-fail-fast: lib 6995
  passed and 4 failed; integration suites 658 passed. The 4 failures
  (copy_tree::relax_loop_must_not_traverse_symlinked_root,
  vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry,
  pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched,
  pypi_requirements::wire_failure_rolls_back_already_written_files) are
  permission-denial tests. The sandbox runs as root, so the denial never
  happens. wire_write_failure_… fails the same way on main here. CI
  runs as non-root.
• cargo test -p socket-patch-cli --all-features --test in_process_redirect_poetry --test mode_migration_pypi:
  83 passed. A full cargo test --workspace didn't fit the sandbox's disk
  allowance, so CI covers the remaining CLI suites. No wrapper under
  npm/, pypi/ or gem/ reads Poetry locks, so they're untouched.

Per-issue checklist:

• Read "poetry.lock written before Poetry 1.4" through one helper; utils::poetry_lock::lock_writer_version is dead #1847: one reader (lock_writer). pre_1_4_writer, the vendored
  inline match and source_constraint_break are expressed through it.
  The inline copies are deleted. Test:
  lock_writer_reads_old_formats_then_the_stamp.

/code-review high findings not applied

• Unstamped 2.0 reads as a confirmed 1.3 writer. This is unchanged from
  before (The #1282 source-pin guard misses Poetry 1.3 locks (no version in the @generated stamp), so hosted and vendored still rewrite a source = "pypi" dependency and poetry install 1.3 fails with a solver error #1447): every previous copy read it that way, and the warnings
  it drives are advisories.
• Format(&'static str) is stringly typed. Only lock_writer builds
  it, from three literals. A LockFormat enum would add more code than
  this refactor removes, so it's left as a possible follow-up.

https://claude.ai/code/session_011f9aeRpvEGL78RFpkUC4tZ

---

Note

Low Risk
Refactor of advisory/refusal heuristics on lock metadata only; real Poetry-generated locks are unchanged, with a stricter edge case for tampered headers on legacy formats.

Overview
Unifies how the codebase decides who wrote a poetry.lock by replacing duplicated logic in hosted redirect, vendored PyPI, and source_constraint_break with lock_writer and a LockWriter enum (Poetry(major, minor) or legacy Format("0"|"1.0"|"1.1")). LockWriter::is_pre_1_4() now drives stale-install and integrity-unverified warnings; the local pre_1_4_writer helper and lock_writer_version are removed, and generated_by_version is pub(crate).

Resolution order: pre-2.0 lock-version wins over the @generated by Poetry stamp (so a hand-merged 1.4+ header cannot hide a 1.0/1.1 lock). source_constraint_break is refactored to match on lock_writer; the only intentional behavior change is refusing source-pin breaks on stamped-but-1.0/1.1 locks that previously followed the stamp alone.

Tests add lock_writer_reads_old_formats_then_the_stamp (fixtures, CRLF, stamp-vs-format cases) and extend source_constraint_break cases for a 1.4 stamp on 1.0/1.1 formats.

^{Reviewed by Cursor Bugbot for commit 3143a07. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review at 672ab67f229cafe5f022f40ab066a64b15104fc7.

• CI: 32/32 run checks green (50 skipped by path filters); no main-wide failures.
• Bugbot: the earlier run on this head was cancelled, so I re-requested it. It reviewed 672ab67 and found no issues. No review threads are open.
• Mergeable: yes, with no conflicts. CHANGELOG.md is untouched. Only human approval is needed.
• Slack: not announced, because Slack sending isn't available in this run. The next run will retry.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Ready for review at 672ab67.

• CI: all checks on the head are green (31 success, 50 skipped, no failures).
• Bugbot: the earlier run on this head had been cancelled. I re-ran it and it found no issues.
• Mergeable, and the PR doesn't touch CHANGELOG.md.
• Reviewers: the change sends the "lock written before Poetry 1.4" rule through the single writer reader in utils::poetry_lock instead of reading it three separate ways (patch/redirect/poetry.rs, vendor/pypi_poetry.rs).
• The Slack announcement couldn't be sent in this run, so there's no slack-announced marker yet.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final reviewer: the logic is sound, but the description says the one behaviour change (a 1.0/1.1 lock with a hand-merged 1.4+ stamp now reads as its old format, so source_constraint_break refuses it) is tested, and no test row covered it. I pushed f3a0162, which adds those rows to lock_writer_reads_old_formats_then_the_stamp and source_constraint_breaks_1_3_to_2_2_writers_and_pre_2_1_locks (the latter fail against main). I removed Ready for review so the burn-down re-labels it once CI is green; I will post the review brief after that.

bugbot run

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

Ready for review at f3a0162 (burn-down agent).

• CI: 50/50 checks green on the head (31 success, 19 skipped, no failures). No main-wide failures.
• Bugbot: Cursor Bugbot check passed on this head; no open review threads.
• Mergeable with no conflicts; no CHANGELOG.md change.

Slack announcement not sent this run (the Slack send tool was unavailable); a later run will retry.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

Final reviewer: I pushed 3143a07.

• Performance fix. lock_writer parsed the lock with an uncached DocumentMut parse. That meant source_constraint_break, which used to skip parsing for every stamped lock, re-parsed the whole lock once per source-constrained package. The parse was also invisible to the PARSES counter behind many_patches_render_the_lock_once. It now goes through lock_fragments::parse_lock, so the parse is shared and counted.
• Doc fix. LockWriter::Format now says a format wins whether or not the lock is stamped.
• Tests. The writer table now covers all 15 fixture locks, adding 1.5.1, 1.6.1, 1.7.1, 2.0.1, 2.1.4 and 2.2.1, so it matches the description.
• Results. poetry and pypi_takeover lib tests: 110 passed. The one failure is wire_write_failure_maps_error_and_leaves_lock_untouched, the root-only permission test the PR already names.

Behaviour note for the description (non-blocking): one case now goes the loosening way. A format-0 lock ([metadata.hashes]) with a hand-added 1.3–2.2 stamp used to be refused by source_constraint_break and is now admitted. That matches how unstamped format-0 locks were already handled, and it only affects hand-edited headers.

I removed Ready for review until CI and Bugbot are green on the new head.

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 3143a07. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review at 3143a07 (burn-down agent).

• CI: 50/50 checks green on the head (31 success, 19 path-skipped), no failures.
• Bugbot: reviewed 3143a07, no new issues; no unresolved review threads.
• Mergeable, no conflicts; no CHANGELOG.md change.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief (3143a07)

What it does. Three code paths each worked out which Poetry wrote a poetry.lock, and a fourth helper did it too but had no callers. This PR replaces them with one reader, lock_writer, which returns a LockWriter (Poetry(major, minor) or Format("0"|"1.0"|"1.1")). A pre-2.0 lock format now always wins over the "generated by Poetry X.Y" stamp. The pre-1.4 warnings in hosted and vendored mode and the source-pin refusal all use that reader, which closes #1847.

Risk: low. I compared the old and new code for every Poetry release from 0.12 to 2.4, and each one reads the same. The only changes in behaviour are for hand-edited lock headers, and they affect only advisory warnings and the source-pin refusal.

Look here

• lock_writer: the format is checked before the stamp
• LockWriter / is_pre_1_4
• source_constraint_break, now a match
• hosted stale-install warning
• vendored integrity advisory

Verified

• Read the full diff and Read "poetry.lock written before Poetry 1.4" through one helper; utils::poetry_lock::lock_writer_version is dead #1847.
• Checked the behaviour of every case before and after the change.
• Ran cargo test -p socket-patch-core --test poetry_hosted: 7 passed.
• Ran the --lib filters poetry, redirect, pypi_takeover, source_constraint and lock_writer. All passed except 2 root-only permission tests, which fail the same way on main inside a root sandbox.
• Put the stamp check back ahead of the format check (the original bug). Both new tests then fail, so they catch it.
• cargo clippy -p socket-patch-core -- -D warnings is clean.
• CI on 3143a07: 50/50 check runs, 31 passed and 19 skipped. Bugbot found no issues. No open review threads. CHANGELOG.md is untouched.

Changes I made: none.

Open questions (optional, not blocking)

• One behaviour change is missing from the description. A lock in format 2.1 or later that was hand-stamped with a Poetry older than 1.4 now gets the pre-1.4 advisories, where before only format 2.0 did. These are warnings only, so this errs on the safe side.
• source_constraint_break has no test for a stamped format-0 lock, which is the one case this PR loosens. It now matches how an unstamped format-0 lock is treated.

Auto-merge is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code