Break command-module cycles and share remedy and UI text by mikolalysenko · Pull Request #1043 · SocketDev/socket-patch

Mikola Lysenko (mikolalysenko) · 2026-10-07T15:34:56Z

Problem

From the architecture audit (§3.A remedies/hints/capitalizers, §3.D command cycles, B76, B77, B80, B81) and the #894 acceptance criteria:

Command modules import each other in cycles. get↔scan, scan↔vendor, vendor↔rollback, apply↔rollback (through UI helpers), scan↔rollback, plus vendor↔get through record_from_patch_response, and vendored_backend / vex_sources pointing back into get. On main there are 26 imports into a command module.
B80: stale-wiring remedies in gem, Poetry, PDM, Pipenv (and the npm lock-flavor change refusal) told users to "run vendor --revert for ". vendor --revert takes no package argument.
B77: a refused hosted remove printed the same Error: line twice (the hosted leg prints it, then remove prints it again).
B76: socket-patch setup (removed in v5.0) got clap's typo tip pointing at the hidden internal self-update subcommand.
B81: five copies of a first-letter capitalizer that disagreed with each other, and eight per-backend codes for "this file is a symbolic link".

Change

Cycles broken (Tracking: move the patch engines out of the CLI command modules into core #894 child 2, plus the other cycles). The shared code moved out of whichever command happened to own it:
- commands/agent_download.rs (new helper module): get's agent download engine (download_and_apply_patches_with, download_patch_records_*, DownloadParams/DownloadRun, decide_patch_action, PatchAction and their private helpers). This is a mechanical move. get re-exports the three public entry points, so the in-process tests keep their paths.
- commands/hosted_unwind.rs (new helper): run_hosted_leg, HostedLegOutcome and patch_server_origins, moved out of rollback.
- commands/vlt_heal.rs: scan/hosted/vlt.rs moved out of scan, so rollback and vendor no longer import scan.
- ui/: short_uuid, sweep_failure, display_copy_path and manifest_error_message moved here. is_local_go moved to args.rs, and record_from_patch_response now comes from core.
tests/command_module_layering.rs (Tracking: move the patch engines out of the CLI command modules into core #894 acceptance criteria). The test fails on:
- any import into a command module that is not on the allowlist with a reason. 14 edges remain, each tied to Tracking: move the patch engines out of the CLI command modules into core #894 child 3 or 4, embedded --vex (Decide: warn on and then remove scan --apply/--vendor, and whether --vex stays embedded #966 Q2), or get dispatching to the scan and vendor engines.
- any allowlisted edge that no longer exists.
- any cycle in the commands/ module graph, apart from the one known edge vendored_backend→vendor (Tracking: move the patch engines out of the CLI command modules into core #894 child 4), which is skipped by name and is also on the allowlist.
- The scanner also expands grouped imports (use crate::commands::{get, scan}, and use super::{…} when the super:: climbs to commands). A self-test pins the parser.
One capitalizer. ui::sentence_case replaces five copies. It leaves values alone (purls, UUIDs, paths, flags, code spans, lowercase tool names, now including socket-patch) and is char-safe.
- Human stderr wording changes (JSON envelopes are unchanged): lock_cli, vendor-step and update errors used to uppercase the first character unconditionally. They now leave a message alone when it opens with a path, purl, flag, code span or tool name. For example, pnpm-lock.yaml … used to print as Pnpm-lock.yaml … and now stays as written. The hosted scan flow now also uppercases a non-ASCII first letter (é → É) and a first word that ends in a colon, which it used to leave alone.
B80. One shared remedy string, vendor::common::REVERT_ALL_AND_REVENDOR, which names the command's real reach. Besides the B80 sites (gem, Poetry, PDM, Pipenv), the identical whole-project remedies in yarn_berry_lock, redownload, pypi_requirements (2), pypi_uv and the Maven legacy-root warning now use it too. Why not rollback <purl>: without --preserve-state it also deletes the manifest entry, so the following vendor has nothing left to vendor. With --preserve-state, re-vendoring over a stale-shape lock isn't covered by any test. The constant's doc comment records this. New tests/remedy_commands_parse.rs:
- parses every backticked socket-patch … / <subcommand> <args> in the production code of the core and CLI crates with the real clap definition. A missing operand in prose counts as acceptable; anything else clap rejects is a failure.
- forbids the per-package vendor --revert prose.
One symlink code. Every vendored pre-write check refuses through vendor::common::{refuse_symlinked, symlink_refusal}, which return the hosted engine's redirect_symlinked_file_unsupported code and message. Hosted mode and the vendored group commit already used that code. pypi_lock's private message builder and its refuse_symlinked wrapper are deleted; it calls the common helper. CLI_CONTRACT.md, ecosystems.md and uv-compatibility.md are updated.
patch_server_origins. discover_options (commands/mod.rs) and agent_download's lock refusals now call hosted_unwind::patch_server_origins / patch_server_origins_of instead of rebuilding the filter inline.
B77. In human mode, remove no longer reprints the leg's refusal. It adds only "The manifest was not modified." on the manifest-backed path. The --json envelope is unchanged.
B76. Unknown subcommands now get a precise usage error (still exit 2):
- setup and unlock name the release that removed them and what to use instead.
- update points at --update.
- a tip that would suggest only a hidden subcommand is dropped.
- typos of public subcommands keep clap's own tip.

Duplicate copies deleted (before → after)

What	Before	After
Imports into a command module (`commands/*`)	26 (6 cycles)	14 allowlisted; 0 cycles apart from vendor↔vendored_backend (#894 child 4)
First-letter capitalizers	5 (`rollback::capitalize_first`, `update::capitalize_first`, `scan/hosted::sentence_case`, inline in `lock_cli`, inline in `vendor_flow`)	1 (`ui::sentence_case`)
Vendored symlink refusal codes	8 (`pypi_{uv,poetry,pdm,pipenv,requirements,lock}_symlink_unsupported`, `pypi_hatch_symlink`, `cargo_manifest_symlink_unsupported`)	1 (`redirect_symlinked_file_unsupported`)
Symlink refusal message builders	4 (hosted engine, `vendor::common`, `pypi_lock`, hatch inline)	1 (hosted engine)
Per-backend `refuse_symlinked` helpers	2 (`vendor::common`, `pypi_lock`)	1 (`vendor::common`)
Inline `patch_server_url` origin filters	3 (`hosted_unwind`, `discover_options`, `agent_download`)	1 (`hosted_unwind`); `vlt_heal`'s disagreeing copy is deferred
"revert and re-vendor" remedy text	10 copies (4 B80 sites, yarn_berry_lock, redownload, pypi_requirements ×2, pypi_uv, maven_repo) + npm_flavor variant	1 constant (npm_flavor keeps its own sentence, now with the real reach)

Testing

All runs on macOS with CARGO_INCREMENTAL=0 through the shared limiter:

cargo clippy -p socket-patch-core -p socket-patch-cli --all-features -- -D warnings -A unused_variables (the CI clippy invocation): clean. -A unused_variables covers only a macOS-only warning on main in python_crawler.rs:2734. --all-targets also reports pre-existing test-code lints on main in files this PR does not touch (maven_repo, nuget_feed, crawler_ruby_e2e, jvm_jar, …).
cargo test -p socket-patch-core --lib -- vendor:: hosted::engine: 2372 passed (after rebasing onto main at 1bbcbe3).
cargo test --no-fail-fast -p socket-patch-cli --lib plus --test for remedy_commands_parse, command_module_layering, cli_parse_main, remove, rollback, get, update, repair, cli, scan, vendor, apply, covgap_commands_{get,rollback,scan_hosted,scan_mod,vendor}, in_process_{get,get_modes,scan,redirect,rollback_hosted,rollback_vendored,vendor,remove_repair_lifecycle}, scan_vendor_e2e, vendor_eject, e2e_safety_lock, vex_terminal_output, and cli_parse_{get,remove,rollback,scan,vendor}: all green. One test, covgap_commands_get::human_global_package_search_empty_prefix_prints_no_global_packages, failed once under machine load and then passed 3/3 when run on its own. It exits before any code this PR touches.
Failing-first checks:
- remedy_commands_parse: the built binary was run against main's gem, Poetry, PDM, Pipenv and npm_flavor sources. It flags all five files.
- remove_hosted_revert_failure_prints_the_error_once: run with the old rendering restored. It fails because the refusal printed twice.
- The B76 assertions name the new messages, so they cannot pass on main.
After rebasing onto main at 1bbcbe3, the CLI set above and clippy were rerun: all green.
Review fixes (head 25776be) were rerun:
- cargo clippy -p socket-patch-core -p socket-patch-cli --all-features -- -D warnings -A unused_variables: clean. cargo clippy -p socket-patch-cli --test command_module_layering -- -D warnings -A unused_variables: clean.
- cargo test -p socket-patch-core --lib -- vendor:: hosted::engine: 2372 passed.
- cargo test --no-fail-fast -p socket-patch-cli --lib plus --test for command_module_layering (3, including the new parser self-test), remedy_commands_parse, vendor_jvm_cli, contract_gradle_codes, rollback, get, in_process_get, in_process_vendor, in_process_rollback_{hosted,vendored}, vendor and scan: all green.
Linux-only and docker suites are left to CI.

Deferred

B81 reinstall hints. Hosted next steps say npm ci; the vendored flavor table says npm install. Changing either is user-facing guidance whose correctness depends on whether vendoring changes package.json, so it is left as is.
vlt_heal's origin list disagrees with hosted_unwind::patch_server_origins. vlt_heal also counts --api-url. Merging them changes behavior, so it is kept for now. The identical inline copies are merged.
Remedies that are not the plain revert-then-revendor sentence keep their own text: the hosted requirements takeover (patch/redirect/requirements.rs, a three-step switch to hosted) and the hosted gem source-option refusal (patch/redirect/mod.rs, which offers remove <purl> first).
Remaining allowlisted edges.
- agent_download→apply (the nested apply still builds ApplyArgs): Tracking: move the patch engines out of the CLI command modules into core #894 child 3, which waits on Tracking: build one RunCtx in main and stop mirroring CLI flags into the process environment #793.
- vendored_backend→vendor (vendor_records_reusing): Tracking: move the patch engines out of the CLI command modules into core #894 child 4.
- remove→rollback (agent engine).
- apply/scan/vendor→vex (embedded --vex): maintainer decision Decide: warn on and then remove scan --apply/--vendor, and whether --vex stays embedded #966 Q2. Not decided here.
bun.lockb symlink refusals keep vendor_bun_lockb_invalid. They belong to the bun PR Fix open bun issues (#992, #861, #784, #764, #735, #635, #599, #578, #497, #443, #371) #1009.
Overlaps. None of the listed open PRs covers this scope. Fix 15 open pnpm issues across hosted, vendored and agent modes #1007, Fix open npm issues #1008, Fix open bun issues (#992, #861, #784, #764, #735, #635, #599, #578, #497, #443, #371) #1009, Scan every vendored-write file for vendored references (#832, #958) #1015 and Fix vendored uv/Hatch re-vendor to a newer patch (#742, #650) #943/Fix PyPI hosted takeover un-vendoring before refusal (#723, #945) #946/Fix PyPI revert deleting still-referenced wheel (#996, #867) #997 touch some of the same files (vendor.rs, get.rs, scan/, pypi_), so expect rebase conflicts. They are mechanical.

🤖 Generated with Claude Code

Note

Medium Risk
Large mechanical move of get/scan download paths and shared hosted unwind logic; behavior should be unchanged but regressions could affect manifest lock ordering, nested apply, or error text consumers rely on.

Overview
This PR breaks command-module import cycles and consolidates duplicated CLI behavior without changing the agent/vendored download contract.

The get agent download engine (fetch → manifest/blobs → nested apply) moves into commands/agent_download.rs; get keeps the same public entry points via re-exports, and CLI_CONTRACT.md now points at that module. hosted_unwind.rs holds the shared hosted “restore upstream registry” leg (with patch_server_origins), and vlt_heal is split out so rollback/vendor no longer pull in scan.

Shared UI and predicates land in ui and args (sentence_case, manifest errors, short_uuid, is_local_go, etc.), and human stderr formatting in apply/list/lock/hosted paths uses those helpers. remove is adjusted so hosted revert failures are not double-printed (per PR scope).

Docs unify vendored symlink refusals under redirect_symlinked_file_unsupported instead of per-ecosystem pypi_*_symlink / cargo_manifest_symlink_unsupported codes (runtime consolidation is described in the PR; contract tables are updated accordingly).

^{Reviewed by Cursor Bugbot for commit 36f5021. Configure here.}

Generated by Claude Code

`vendor --revert` takes no package argument, but the stale-wiring refusals in gem, Poetry, PDM and Pipenv (and the npm lock-flavor change refusal) told users to "run `vendor --revert` for <purl>". The remedies now come from one shared string that names the command's real reach: it reverts every vendored package in the project, then vendor again. New test tests/remedy_commands_parse.rs scans the production string literals of the core and CLI crates for backticked commands and parses each with the real clap definition, and forbids the per-package `vendor --revert` prose. Run against main's sources it flags all five files. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Eight vendored pre-write checks refused a symlinked target file with their own code (pypi_uv/poetry/pdm/pipenv/requirements/lock _symlink_unsupported, pypi_hatch_symlink, cargo_manifest_symlink_unsupported) and three different messages, while hosted mode and the vendored group commit already refuse the same condition with redirect_symlinked_file_unsupported. Every backend now refuses through vendor::common::{refuse_symlinked, symlink_refusal}, which return the hosted engine's code and message. pypi_lock's private copy of the message and refusal helper is deleted. Contract: the per-backend codes collapse into redirect_symlinked_file_unsupported (CLI_CONTRACT.md, ecosystems.md, uv-compatibility.md updated). v5 is not released yet. bun.lockb keeps vendor_bun_lockb_invalid (owned by the bun fix PR #1009). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Command modules imported each other in five cycles (get<->scan, scan<->vendor, vendor<->rollback, apply<->rollback, scan<->rollback), plus vendor<->get through record_from_patch_response. Each cycle is broken by moving the shared code out of the command that happened to own it: - commands/agent_download.rs (new helper): get's agent download engine (download_and_apply_patches_with, download_patch_records_*, DownloadParams/DownloadRun, decide_patch_action, PatchAction and their private helpers), a mechanical move (#894 child 2). get re-exports the three public entry points so in-process tests keep their paths. - commands/hosted_unwind.rs (new helper): rollback's run_hosted_leg, HostedLegOutcome and patch_server_origins, used by rollback, remove and vendor. - commands/vlt_heal.rs: scan/hosted/vlt.rs moved out of scan, so rollback and vendor no longer import scan for the vlt heals. - ui/: one sentence_case replaces five first-letter capitalizers (rollback::capitalize_first, update::capitalize_first, scan/hosted::sentence_case, and inline copies in lock_cli and vendor_flow); short_uuid, sweep_failure, display_copy_path and manifest_error_message move out of get/rollback/list. - args.rs: is_local_go moves out of apply. - record_from_patch_response is imported from core directly. tests/command_module_layering.rs fails on any new import into a command module that is not allowlisted with a reason, on allowlisted edges that no longer exist, and on any cycle in the commands/ module graph. The capitalizer is the union of the copies' rules: it leaves values (purls, uuids, paths, flags, code spans, lowercase tool names now including socket-patch) alone and is char-safe. Messages that opened with such a value used to be capitalized by the naive copies in update, lock_cli and vendor_flow. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

The hosted unwind leg prints each refusal as `Error: …` when it happens; remove then printed the same message again on its way out (plus "The manifest was not modified." on the manifest-backed path). A human run now gets the refusal once, followed by the manifest note where it applies. The --json envelope is unchanged and still carries the whole message. Regression test remove_hosted_revert_failure_prints_the_error_once covers the manifest-backed and hosted-only paths; it fails on the old rendering (the refusal appeared twice). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

`socket-patch setup` (removed in v5.0) got clap's typo tip pointing at the hidden internal `self-update` subcommand. Unknown subcommands now get a precise usage error (still exit 2): `setup` and `unlock` name the release that removed them and what to do instead, `update` points at the root `--update` flag, and a typo whose only suggestion is a hidden subcommand (`self-update`, `hosted-bundle`) loses that suggestion. Typos of public subcommands keep clap's own tip. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Rebase follow-up. vendor's gem takeover refusal (#776) called the patch_server_origins that moved to hosted_unwind, and get's vendored dry run now previews vendor's gem takeover refusals, so get -> vendor is an allowlisted edge again (it is not part of a cycle). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

The layering test now expands `{...}` groups after `crate::commands::` and after a `super::` prefix that climbs to `commands`, so `use crate::commands::{get, scan}` counts as two edges. A self-test pins the parser. The cycle check no longer folds vendored_backend into vendor; it skips the one known cycle edge by name (#894 child 4). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

pypi_lock now calls vendor::common::refuse_symlinked like every other backend. Also fix a stale symlink-code test comment in pypi_uv and drop a formatting-only hunk in gem.rs. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

yarn_berry_lock, redownload, pypi_requirements (x2), pypi_uv and the maven legacy-root warning now use vendor::common::REVERT_ALL_AND_REVENDOR. The constant's doc says why the remedy is not `rollback <purl>`. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Mikola Lysenko (mikolalysenko) · 2026-10-07T18:58:30Z

bugbot run

cursor

Stale Bugbot comment from a previous run.

Mikola Lysenko (mikolalysenko) · 2026-10-07T23:43:33Z

[agent] Ready for review at 2f9663d.

CI: 557 successful, 6 skipped, 0 failed, 0 pending. ci-ok is green. GitHub reports the PR as mergeable (clean).

What changed this pass (socket-patch-de, taking over from socket-patch-2e):

Merged origin/main into the branch twice: first the merge 2e had already made locally but not pushed (dcf3aef), then 05ecc6ed (merge-queue ci.yml, Run CI on the merge queue and stop cancelling main push runs #1018). Both merged without conflicts, and I made no code changes.
Local checks before pushing: cargo clippy --workspace --all-features -D warnings passed. A macOS-only unused_variables warning in python_crawler.rs already exists on main, isn't touched by this PR, and doesn't fire on Linux CI. These test targets also passed: workspace --lib (871 + 5633), cli_parse_main, command_module_layering, remedy_commands_parse and remove.
On the previous head, the clippy, node-addon, lint-ecosystems and similar jobs failed before running any step, and CodeQL failed to upload its SARIF. Those were runner/infra failures, and all of them passed on this head.

Bugbot: ran on 2f9663d and found no new issues. All review threads are resolved; the CodeQL cleartext-logging alerts are false positives on patch UUIDs and were answered earlier.

Merge order: this is the largest arch-fix PR (+3.1K/-2.3K) and overlaps about 6 other arch-fix PRs. Queue it LAST, after the other arch-fix PRs merge. If any of them land first and cause conflicts, merge main into this branch again before queueing it.

Generated by Claude Code

get.rs: keep this branch's split (the download engine lives in agent_download.rs, short_uuid tests in ui/text.rs) and carry main's changes to the moved code over to agent_download.rs: store_verified_blob in write_blob_entry (#726), PurlKey comparisons in lock_text_refusals_for / apply_key_covers / fold_apply_failures (#1045), and the base64 engine. main's new get.rs tests (verified blob writes, linked blob dirs, base64 tolerance, the pnpm-lock FIFO guard) are kept. list.rs: keep ui::sentence_case (main only reformatted the line). scan/hosted.rs: add main's yarn_classic_outer closure (#1083). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

The merge of main (#1045) moved lock_text_refusals_for onto PurlKey, so canonical_purl is no longer referenced in agent_download.rs and the workspace clippy job fails on -D unused-imports. Co-Authored-By: Claude <noreply@anthropic.com>

Mikola Lysenko (mikolalysenko) · 2026-10-08T14:56:17Z

bugbot run

Generated by Claude Code

Merge commit fbf3104 accidentally checked in this conflict-resolution backup. Cargo never compiles it and nothing references it, so it is 1707 lines of dead, stale code that would otherwise land on main. Co-Authored-By: Claude <noreply@anthropic.com>

Mikola Lysenko (mikolalysenko) · 2026-10-08T14:56:47Z

bugbot run

Generated by Claude Code

cursor

Stale Bugbot comment from a previous run.

scan/hosted.rs: add main's takeover module (#1039) and keep this branch's vlt_heal alias in place of scan/hosted/vlt.rs. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Mikola Lysenko (mikolalysenko) · 2026-10-08T17:19:48Z

bugbot run

Generated by Claude Code

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 36f5021. Configure here.}

Mikola Lysenko (mikolalysenko) · 2026-10-08T17:29:22Z

Burn-down agent: labeled Ready for review at 36f5021.

CI: all non-skipped checks green on this head (ci-ok success).
Bugbot: re-reviewed 36f5021 on request, no findings; no unresolved review threads.
Mergeable: yes (merges cleanly with current main).

Generated by Claude Code

#1043 moved the discovery origin helper from rollback to hosted_unwind::patch_server_origins and moved the vlt heal from scan/hosted/vlt.rs to commands/vlt_heal.rs, where its outcome is now RewriteHeal. The conflict in commands/mod.rs takes main's helper; this branch's other callers (scan/hosted.rs, the vlt_heal_origins doc) now use it too. The healed_store field this branch added to the heal's outcome moves from StaleInstallOutcome to RewriteHeal, so the post-write discovery reuse still sees the healed store. Co-Authored-By: Claude <noreply@anthropic.com>

Also brings in f956e6e (token-only Bun scope's token sent to npmjs), the fix for Bugbot's last finding, which could not be pushed while this PR was queued. Conflicts with #1043, which moved the hosted unwind leg out of rollback.rs into commands/hosted_unwind.rs: - rollback.rs: drop this branch's copy of run_hosted_leg and patch_server_origins in favour of hosted_unwind.rs. - hosted_unwind.rs: carry over the #764 `redirect_bun_reinstall_required` advisory after the restore. - scan/hosted.rs: test imports keep lock_entry_warning_count; sentence_case now lives in ui::text. Assisted-by: Claude Code:claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TSx4W4Qfb8hsBhw4NEvkv9

Main (#1043) moved get's agent-mode engine into agent_download.rs, so the {code, message} error object is ported there: report_error takes a code, report_lock_failure and the manifest read/write failures use legacy_error, and fold_apply_failures sets the run-level error with set_error_keep_status instead of a top-level errorCode. Rollback's path_glob_invalid keeps the verbatim JSON message and uses main's ui::sentence_case for the human line. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Conflicts resolved onto main's #1043 structure: re-applied the nested-apply warnings (apply_warning_lines, #1004) in agent_download.rs where main moved get's download engine; dropped rollback's capitalize_first for main's ui::sentence_case while keeping hosted_state_not_preservable_warning; yarn berry error keeps this branch's Result shape with main's REVERT_ALL_AND_REVENDOR remedy; Discovery keeps both shadowed (#828) and install_trees (#1086); CLI_CONTRACT merges both sides' text. Co-Authored-By: Claude <noreply@anthropic.com>

Conflict in vendor/maven_repo.rs: kept this branch's removal of the legacy single-pom path (legacy roots are refused), and re-applied main's #1043 shared remedy by building the legacy_maven_root refusal detail from common::REVERT_ALL_AND_REVENDOR. Co-Authored-By: Claude <noreply@anthropic.com>

Main (#1043) moved the agent download engine (DownloadParams, DownloadRun, filter_to_installed_releases, nested_apply_args_from_params, ...) out of commands/get.rs into commands/agent_download.rs and moved is_local_go into args.rs. This branch had edited that code in get.rs to drop the --download-mode plumbing, so the conflicts were "deleted on main, modified here". Resolution: - get.rs: take main's removal of the moved block, then re-apply this PR's change at the new home: agent_download.rs loses the DownloadParams::download_mode field, its forwarding into the nested apply's GlobalArgs, and the --download-mode mention in the nested-apply doc comment (GlobalArgs no longer has the field). - commands/apply.rs imports: keep main's `is_local_go` from crate::args; keep this PR's removal of `StagedSources` (only the deleted diff path used it). Also gate the core apply.rs `make_fixture` test helper on macOS: with the diff tests gone, its only remaining caller is the macOS-only chflags test, so `clippy --all-targets -D warnings` failed on Linux/Windows with dead_code. No docs still list --download-mode as a live flag. It appears only in the v5.0 removal note in CLI_CONTRACT.md and in the Retired spellings row of migrating-to-v5.md, next to main's SOCKET_FORCE row. Co-Authored-By: Claude <noreply@anthropic.com>

Conflict in commands/get.rs: main (#1043) moved the download engine into commands/agent_download.rs; took main's side and re-applied this branch's hosted_pins / claimed_purls / hosted_claimed_purls helpers there, and pointed scan/vendor_flow.rs and get.rs at agent_download and hosted_unwind (patch_server_origins moved out of rollback.rs on main). Co-Authored-By: Claude <noreply@anthropic.com>

Conflict in crates/socket-patch-cli/src/commands/get.rs only. Main's #1043 moved get's agent download engine (DownloadParams/DownloadRun, filter_to_installed_releases, download_patch_records_*, ...) into the new commands/agent_download.rs and re-exports its entry points from get. This branch did not change any of the moved code, so the resolution takes main's get.rs and re-applies this branch's get.rs hunks onto it: Target-based identifier classification and forced_identifier_error, the exact-name per-version search fan-out, --ecosystems filtering, the UUID policy_bypassed path, the deleted purl_has_version / IdentifierType / CVE/GHSA regexes, and the test updates. Imports: dropped regex, is_purl, fmt and LazyLock (no longer used), added Target/TargetKind, crawl_ecosystems (crawl_all_ecosystems is deleted on this branch), and kept StreamExt, hold_back_debug and ordered_concurrent/api_concurrency_for for the concurrent per-version name search, which main's get.rs no longer imported after the move. All other files auto-merged. Co-Authored-By: Claude <noreply@anthropic.com>

Mikola Lysenko (mikolalysenko) added the arch-refactor PR opened by the scheduled architecture refactor routine label Oct 7, 2026

Mikola Lysenko (mikolalysenko) and others added 6 commits October 7, 2026 11:35

github-advanced-security Bot found potential problems Oct 7, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) force-pushed the arch-fix/ui-text-cycles branch from 718589b to 0ab0033 Compare October 7, 2026 16:05

Mikola Lysenko (mikolalysenko) and others added 4 commits October 7, 2026 12:31

Share the patch-server origin filter with discovery and agent download

25776be

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Mikola Lysenko (mikolalysenko) marked this pull request as ready for review October 7, 2026 16:32

Merge remote-tracking branch 'origin/main' into arch-fix/ui-text-cycles

dcf3aef

Tanmay Singla (Tanmay182003) approved these changes Oct 7, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into prfix2/1043

2f9663d

cursor Bot reviewed Oct 7, 2026

View reviewed changes

This was referenced Oct 7, 2026

Tracking: assert stable codes instead of human sentences in CLI tests, and fold the covgap suites #1089

Open

Assert error codes instead of sentences in remove's covgap suite and add shared JSON assertion helpers #1090

Closed

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Oct 7, 2026

Mikola Lysenko (mikolalysenko) enabled auto-merge October 8, 2026 01:28

Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 8, 2026

Read Cargo.toml [package] identity through formats::cargo::manifest (#693) #1110

Merged

Mikola Lysenko (mikolalysenko) removed the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Oct 8, 2026

Mikola Lysenko (mikolalysenko) disabled auto-merge October 8, 2026 11:01

Merge branch 'main' into arch-fix/ui-text-cycles

d4d7c16

Mikola Lysenko (mikolalysenko) enabled auto-merge October 8, 2026 13:07

cursor Bot reviewed Oct 8, 2026

View reviewed changes

Comment thread crates/socket-patch-cli/src/commands/agent_download.rs.orig Outdated

Merge main into arch-fix/ui-text-cycles

36f5021

scan/hosted.rs: add main's takeover module (#1039) and keep this branch's vlt_heal alias in place of scan/hosted/vlt.rs. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Mikola Lysenko (mikolalysenko) added this pull request to the merge queue Oct 8, 2026

cursor Bot reviewed Oct 8, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Oct 8, 2026

Merged via the queue into main with commit 9dd93ca Oct 8, 2026
457 checks passed

Mikola Lysenko (mikolalysenko) deleted the arch-fix/ui-text-cycles branch October 8, 2026 18:55

Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 8, 2026

Fix open bun issues (#992, #861, #784, #764, #735, #635, #599, #578, #497, #443, #371) #1009

Merged

Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 9, 2026

Vendored gem revert restores Gemfile.lock but leaves the Gemfile path: line when that line carries a trailing comment, and no re-run can finish it #988

Open

3 tasks

Navigation Menu

Repository navigation

Break command-module cycles and share remedy and UI text - #1043

Break command-module cycles and share remedy and UI text#1043
Mikola Lysenko (mikolalysenko) merged 17 commits into
mainfrom
arch-fix/ui-text-cycles

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 8, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 8, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 8, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Change

Duplicate copies deleted (before → after)

Testing

Deferred

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 8, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 8, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 8, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Mikola Lysenko (mikolalysenko) commented Oct 7, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading