Sandbox::https://github.com/SocketDev/socket-patch/pull/1103

Mikola Lysenko (mikolalysenko) · 2026-10-08T02:17:45Z

LLM Description written by Claude Code:claude-opus-5-5

Fixes #631 (slice: steps 2 and 3; step 1, the move to formats/golang/sum.rs, stays open on the issue)

Summary

vendor/go_sum_edit.rs had two implementations of the same three go.sum edits: free upsert_module_lines, has_module_version and remove_exact_module_version_lines, and the GoSumEditor methods the hosted Go redirect actually uses. The free copies had no production caller and survived only as the oracle for one test. This PR deletes them, so GoSumEditor is the one implementation, and names the version-line key rule once.

Why (leverage)

Issue #631, register row E52 in register/10-audit-ecosystems.md, living document §5 (codecs outside formats/, refactor oracles kept in production).
B 0, U 1 (the file move in step 1 now carries one implementation), D 1 + 87/200 ≈ 1.4, S 0, R L. Score ≈ 5.
It ranked first among eligible candidates: every higher-ranked row (Finish every vendored revert through one shared helper with an explicit keep policy instead of 12 copied finish blocks #990, Build npm-family vendor ledger entries through one constructor instead of seven literal VendorEntry blocks #922, apply, apply --check and vendor report noManifest (exit 0) when .socket/manifest.json exists but can't be stat'd #998, An unparseable .socket/manifest.json is reported under five different --json error codes depending on the command #931, repair and scan --prune delete the beforeHash blobs of active patches, so a later offline rollback fails and tells the user to run repair #893 and the rest of the queue) changes files that one of the 39 open PRs also changes. vendor/go_sum_edit.rs is touched by none.

What changed

New is_version_line(line, module, version): the "{module} {version} " / "{module} {version}/go.mod " rule, previously spelled six times with two format! allocations per call, now in one place and allocation-free.
New GoSumEditor::current_lines(): one iterator over the content in either state, replacing three match &self.state copies.
The editor methods carry the doc comments of the deleted free functions.
Tests: the existing cases now run through the editor (small test-only adapters keep their bodies unchanged). odd_line_endings_give_the_recorded_outputs pins mixed CRLF/LF, bare-\r, missing-final-newline and blank-line inputs to the exact outputs the deleted functions produced (captured on this branch before deleting them). version_line_key_rule covers the near misses. The 3000-seed random test now checks the editor's lines form against a fresh text-form editor at every step, instead of against the deleted oracle.

The first commit refactors the editor while keeping the free functions, and the old oracle test passed on it, so the refactored editor is proven equal to the old text transforms before they are deleted.

Deleted

git diff --stat origin/main: 1 file, +194 / −173. Production: 485 → 398 lines (−87). Tests: 264 → 372 lines (+108).

Behavior

None. Hosted go.sum rewrites are byte-identical; no public API changes (GoSumEditor is pub(crate); the deleted functions had no caller in the workspace).

Test evidence

cargo clippy --workspace --all-features -- -D warnings: clean.
cargo test -p socket-patch-core --lib: 5663 passed, 4 failed. The 4 are the known root-sandbox failures that also fail on main (copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched, pypi_requirements::wire_failure_rolls_back_already_written_files).
cargo test -p socket-patch-core --lib go_sum_edit: 13 passed (the old oracle test passed on the first code commit too).
cargo test -p socket-patch-core --test redirect_golden --test upstream_restore_golden: 49 passed.
cargo test -p socket-patch-cli --all-features --test e2e_golang_hosted_state: 28 passed.
cargo test -p socket-patch-cli --all-features --test e2e_golang_hosted_build -- --include-ignored with a real go toolchain: 21 passed.

Risk

Low. One file, pub(crate) surface only, equivalence proven against the deleted code before deletion.

🤖 Generated with Claude Code

Generated by Claude Code

Assisted-by: Claude Code:claude-opus-5-5

GoSumEditor spelled the "{module} {version} " / "/go.mod " key rule in three methods, each allocating two format! keys per call. One is_version_line helper now carries the rule without allocating, and the editor reads its lines through one current_lines iterator instead of matching on its state in every method. No behavior change: the step-by-step oracle test still compares the editor with the text transforms over 3000 random go.sum files. Assisted-by: Claude Code:claude-opus-5-5

vendor/go_sum_edit.rs kept two implementations of the same three go.sum edits: free upsert_module_lines, has_module_version and remove_exact_module_version_lines, which no production code called, and the GoSumEditor methods the hosted Go redirect uses. The free copies survived only as a test oracle, so every rule change had to be made twice. They are gone; their tests now run through the editor, the odd line-ending cases are pinned to the outputs the old functions gave, and the random step-by-step test now checks the editor's lines form against its text form instead of an oracle. No user-visible change: hosted go.sum rewrites are byte-identical. Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) · 2026-10-08T02:18:02Z

BugBot review

Generated by Claude Code

Assisted-by: Claude Code:claude-opus-5-5

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 084cd9e. Configure here.}

Mikola Lysenko (mikolalysenko) · 2026-10-08T14:23:18Z

Ready for review (burn-down agent).

Head: 084cd9ee917793b3dc87c267cd7bd132faf26900
CI: all checks green on this head; one lock-diff job was cancelled by a superseded run, and the same job succeeded on this head (run 37717185035).
Bugbot: reviewed this head (Cursor Bugbot check: success), no unresolved review threads.
Changelog: untouched.

Nothing specific flagged for the reviewer beyond the PR description.

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-10-08T21:38:16Z

[final reviewer] Re-enqueued (auto-merge on, squash) at head 084cd9ee. Merge-group run 37843887676 evicted it at 21:14 UTC: the only failed job was e2e (ubuntu-latest, e2e_redirect_maven_build, maven, 3.9.3) (step Run e2e tests), and fail-fast cancelled the rest. This PR only changes crates/socket-patch-core/src/vendor/go_sum_edit.rs, which the Maven redirect e2e doesn't touch, so this isn't this PR's failure. This is the one re-queue. If it's evicted again, the janitor should look at the Maven 3.9.3 leg.

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-10-08T23:17:53Z

[final reviewer] Re-enqueued (auto-merge on, squash) at head 084cd9ee. The queue dropped it at 22:55 UTC: in merge-group run 37853387102 the only failed job was e2e (ubuntu-latest, e2e_vendor_maven_build, maven, 3.6.3) in its Install Maven 3.6.3 step (download failure, before any test ran); fail-fast then cancelled the rest. Not caused by this PR (#1166 adds recovery for these Maven downloads). Still approved at this head, ci-ok/clippy green, mergeable with current main (checked locally: clean merge), no open threads.

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-10-08T23:31:30Z

[ci-janitor] The merge queue evicted this PR a second time at 22:38 UTC (run 37853387102). The failing job was e2e_vendor_maven_build (maven 3.6.3): its install Maven step got six HTTP 429s from repo.maven.apache.org. The 21:14 eviction was the same class of failure, a Maven Central miss during the e2e fixture warm-up. Neither one is caused by this PR's go_sum_edit.rs change.

Fixes:

Cut release-test wait time and recover Maven downloads #1166 adds a pinned archive.apache.org fallback to the install step (open, needs review).
Stop Maven e2e evictions on Central 429s #1189 sends warm-up retries through Central's Google mirror (just opened).

I have not re-queued this PR. The final reviewer can re-add it whenever it decides to.

Generated by Claude Code

Claude (claude) added 3 commits October 8, 2026 02:06

Start refactor for #631

a5ad55e

Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) added arch-refactor PR opened by the scheduled architecture refactor routine refactor Structural change: duplicated code or logic, missing abstraction, layering, dead code labels Oct 8, 2026

Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 8, 2026

Delete go_sum_edit's oracle-only free functions and move the go.sum codec to formats #631

Closed

3 tasks

Mikola Lysenko (mikolalysenko) marked this pull request as ready for review October 8, 2026 02:17

Mikola Lysenko (mikolalysenko) pushed a commit that referenced this pull request Oct 8, 2026

Refactor run: #1103 for #631 (E52)

3f0d759

Assisted-by: Claude Code:claude-opus-5-5

cursor Bot reviewed Oct 8, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Oct 8, 2026

Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 8, 2026

Delete the vendored and hosted-vlt helpers left without a production caller by the v5 consolidation #782

Open

20 tasks

Tanmay Singla (Tanmay182003) approved these changes Oct 8, 2026

View reviewed changes