Fix hosted cargo pin of registry = "crates-io" (#386)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #386

Summary

scan --mode hosted now pins a crates.io dependency declared with an explicit registry = "crates-io", in both the inline-table and the [dependencies.x] table spellings, instead of skipping it as "pinned to another registry".

Root cause

The hosted Cargo.toml planner (plan_cargo_toml in patch/redirect/mod.rs) let a registry = … value through only when it was our current pin or a stale socket-patch-<uuid> pin. Every other value was refused, including crates-io, Cargo's built-in name for crates.io. Cargo resolves that declaration exactly like one with no registry key, so hosted mode skipped a dependency it is built to redirect. It reported redirected: 0 and exited 0 with status: success while the project kept building the unpatched crate.

Changes

• is_repinnable_registry_name: crates-io is now overwritten in place, the same way a superseded socket-patch pin is, in both the table and inline arms. Any other registry name is still refused.
• Upstream restore (remove): as for every pin, the original spelling isn't recorded, so the declaration comes back without the redundant registry = "crates-io" key (the inline shorthand collapses to name = "1.0.4"). Cargo resolves it the same way and the lock is unchanged. This is documented in the module doc. unpin_line now keeps a trailing comment from a table-form pin line instead of dropping it with the line.
• mode_migration_cargo::takeover_over_unrewritable_spelling_keeps_vendored (Cargo vendored → hosted takeover un-vendors a crate before hosted mode refuses its Cargo.toml spelling (dotted keys, single quotes, registry = "crates-io"), leaving it unpatched, while --dry-run previews redirected: 1 #1020) used registry = "crates-io" as its example of a refused spelling. It now uses a multi-line inline table (Hosted cargo redirect refuses a dependency whose inline table has a multi-line features array, because it plans Cargo.toml pins with a line scanner #757), which hosted mode still refuses.

Tests (red → green)

Issue	Test	Without fix	With fix
#386	redirect::tests::cargo_explicit_crates_io_registry_is_pinned_in_place (inline, single-quoted + comment, table, renamed table with quoted key; idempotent re-run)	FAILED: redirect_cargo_toml_dep_unrewritable … pinned to another registry ("crates-io")	ok
#386	e2e e2e_redirect_cargo_shapes::cargo_hosted_explicit_crates_io_registry_is_pinned (real cargo: scan, fresh --locked build links the patched crate, VEX, remove)	FAILED: skipped … no lockfile entry pinning it could be rewritten	ok
—	upstream::cargo::tests::table_form_line_keeps_its_comment	—	ok

Local runs on 46af5c2 (c2b3f89 adds the Bugbot CRLF fix; upstream::cargo tests, core clippy and e2e_redirect_cargo_shapes re-run green):

• cargo fmt --all -- --check: clean
• cargo clippy --workspace --all-features -- -D warnings: clean
• cargo test -p socket-patch-core --all-features: 6321 passed, 4 failed. The failures are copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure… and pypi_requirements::wire_failure_rolls_back…. All four are chmod-based tests that fail because the agent sandbox runs as root, and they're unrelated (see Go go.work audit: false NotAMember for a use path through a missing dir on macOS (breaks macOS test job) #1409 for the same note).
• SOCKET_PATCH_CARGO_E2E_REQUIRED=1 cargo test -p socket-patch-cli --all-features --test e2e_redirect_cargo_shapes --test mode_migration_cargo --test e2e_redirect_cargo_build: 31 / 29 / 22 passed
• cargo test -p socket-patch-cli --lib --test in_process_cargo_apply: ok
• The full cargo test --workspace couldn't finish locally because the sandbox ran out of disk linking ~100 CLI test binaries. CI covers it.
• No wrapper changes: the fix is in core only, and npm/, pypi/ and gem/ just dispatch to the binary.

/code-review high: findings not fixed

• A triple-quoted registry = '''crates-io''' or a registry = '…' string inside a feature name defeats the line regex. The planned manifest then fails validation and the dep is refused, so it fails closed and is never mis-pinned. Both are contrived spellings; the general fix is Hosted cargo redirect refuses a dependency whose inline table has a multi-line features array, because it plans Cargo.toml pins with a line scanner #757's move onto toml_edit.
• A restored override isn't CRLF-converted in the e2e harness. No CRLF shape uses it.
• The explicit restored: vec[] on every Shape literal matches the harness's existing explicit-field style.

Not in scope

#757 (multi-line inline tables) touches the same planner but has a different cause: the planner reads one line per inline table. It needs the planner moved onto toml_edit and the upstream restore taught multi-line edits.

🤖 Generated with Claude Code

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c2b3f89. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent)

• Head: c2b3f89
• CI: 35/35 non-skipped checks green (19 skipped by path filter); mergeable, no conflicts.
• Bugbot: reviewed c2b3f89, no new issues; the one earlier review thread (cargo.rs) is resolved.
• Reviewer focus: the hosted Cargo.toml planner now accepts Cargo's built-in crates-io registry name instead of refusing it as a foreign registry (Hosted cargo redirect refuses a crates.io dependency declared with an explicit registry = "crates-io", treating crates.io as "another registry" #386); see redirect/upstream/cargo.rs and the new e2e shapes in e2e_redirect_cargo_shapes.rs.
• Slack announcement not sent this run (no Slack send tool available); the next run will retry.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does
scan --mode hosted used to skip a Cargo dependency written with an explicit registry = "crates-io", treating it as "pinned to another registry". It reported redirected: 0 with status: success while the project kept building the unpatched crate. crates-io is Cargo's built-in name for crates.io, so the planner now overwrites it in place the same way it overwrites a stale socket-patch-<uuid> pin. Every other registry name is still refused.

Risk: low. It's a one-predicate change in the hosted Cargo.toml planner, and it only affects the literal value crates-io. The one visible side effect: remove restores the declaration without the redundant registry = "crates-io" key. Cargo resolves it identically, the module doc says so, and the e2e test asserts the restored bytes.

Look here

• redirect/mod.rs:2626: the new is_repinnable_registry_name predicate
• redirect/mod.rs:3334 and :3448: where it is used (table and inline arms)
• upstream/cargo.rs:339:`` unpin_line now keeps a trailing comment, and its `\r`, when it drops a table-form pin line
• e2e_redirect_cargo_shapes.rs:1053:``` real-cargo e2e, covering scan, a --locked build linking the patched crate, VEX and remove
• mode_migration_cargo.rs:1347: the Cargo vendored → hosted takeover un-vendors a crate before hosted mode refuses its Cargo.toml spelling (dotted keys, single quotes, registry = "crates-io"), leaving it unpatched, while --dry-run previews redirected: 1 #1020 test's "refused spelling" example moved to a multi-line inline table (Hosted cargo redirect refuses a dependency whose inline table has a multi-line features array, because it plans Cargo.toml pins with a line scanner #757), because crates-io is no longer refused

Verified

• I read the full diff. It's consistent with the existing registry != "crates-io" handling at mod.rs:2357. No CHANGELOG change and no unrelated edits.
• I ran cargo test -p socket-patch-core --lib patch::redirect locally: 748 passed. The 1 failure is vlt_heal::an_unremovable_hidden_lock…, a chmod test that fails because the sandbox runs as root. It's unrelated and also fails on main.
• Red check: with the one-line predicate change reverted, cargo_explicit_crates_io_registry_is_pinned_in_place fails with "pinned to another registry ("crates-io")".
• cargo clippy -p socket-patch-core --all-features -- -D warnings (what CI runs) is clean. With --all-targets there are pre-existing lints, but none of them are in this diff.
• CI: 35/35 non-skipped checks green on c2b3f89 (19 skipped by path filter). Bugbot is clean and its one thread is resolved.

Changes I made: none.

Open questions: none. The contrived triple-quoted spellings in the PR description fail closed and are deferred to #757.

Auto-merge is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code