Fix per-patch Poetry/PDM lock re-parse (#760, #762) (#877)

* Start fix for #760, #762

Assisted-by: Claude Code:claude-opus-5-5

* Test that a Poetry/PDM lock renders once per scan

Hosted scans rewrite poetry.lock and pdm.lock once per patched
package, rendering and re-parsing the whole lock each time. Count the
engine's whole-lock renders and require one per lock for a dozen
patched packages. Both tests fail today with 12 renders.

Refs #760, #762

Assisted-by: Claude Code:claude-opus-5-5

* Rewrite each Poetry/PDM lock in one pass

A hosted scan rewrote poetry.lock and pdm.lock once per patched
package, and every rewrite rendered and re-parsed the whole lock. A
project with a dozen patches paid for a dozen full parses, which made
Poetry and PDM scans 3.5-4.5x slower per package than other managers.

The shared lock-splice engine now plans every package against one
parsed lock, applies all the changes, renders and re-parses once, and
splices each package's changed fragments into the original text. The
result is checked against the rendering byte for byte. When a lock
mixes line endings, a package is rewritten twice, or any check fails,
the rewrite falls back to the old package-by-package path, so output
and recorded edits never change.

Differential tests run both paths over every Poetry and PDM lock
generation, LF, CRLF and mixed, with refusals, missing packages and
re-runs mixed in, and require identical text and per-package results.

Fixes #760, #762

Assisted-by: Claude Code:claude-opus-5-5

* Read PDM lock_version from the parsed original

The rewrite never changes [metadata] lock_version, so read it from the
parse the presence probe already took instead of parsing the output.

Assisted-by: Claude Code:claude-opus-5-5

* Route Gradle digests through utils::digest

main has failed socket-patch-core's lib tests since Gradle support
(#646) and the digest helpers (#865) both landed. The guard test
production_digests_go_through_the_helpers flags three files #646 added
that still hash inline: crawlers/gradle_cache.rs, patch/jvm_jar.rs and
patch/sidecars/maven.rs. That breaks test, test-release and coverage on
every open PR.

Each inline sha1/sha256 call now goes through sha1_hex_of or
sha256_hex_of, which compute the same lowercase hex. Behaviour is
unchanged.

Assisted-by: Claude Code:claude-opus-5-5

* Drop the unrelated formatting sweep

Running cargo fmt over the whole workspace reformatted 117 files this
PR does not otherwise touch, because main is not rustfmt-clean and CI
does not check formatting. Restore those files to main and keep the
diff to the Poetry/PDM rewrite and the ported digest fix.

Assisted-by: Claude Code:claude-opus-5-5

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-core/src/patch/redirect/pdm.rs

@@ -4,7 +4,7 @@ use serde_json::json;
 
 use super::{DepOverride, FileEdit, RewriteResult, RewriteWarning};
 use crate::crawlers::python_crawler::canonicalize_pypi_name;
-use crate::utils::pdm_lock::{rewrite_pdm_lock_in, PdmLockParse};
+use crate::utils::pdm_lock::{rewrite_pdm_lock_all, LockBatch, LockStep, PdmLockDep, PdmLockParse};
 
 pub(super) fn rewrite(
     files: &BTreeMap<String, String>,
@@ -14,28 +14,44 @@ pub(super) fn rewrite(
     let Some(original) = files.get("pdm.lock") else {
         return;
     };
-    let mut text = original.clone();
-    let mut stale_warned = false;
-    // Each lock state is parsed once: the presence probe, the rewrite, the
-    // format probe and the next dep all share it.
+    // Each dep's intake, in dep order: skipped (the lock lacks it), refused
+    // before the lock is read, or one dep of the batch rewrite. A package
+    // `pdm.lock` simply does not contain is not installed by pdm — a sibling
+    // `requirements.txt`/pylock may legitimately carry it — so we neither
+    // redirect it here nor veto the other pypi rewriters. Only a package the
+    // lock DOES contain but the plan refuses (source conflict, unsupported
+    // format, forked variants, bad hashes) withholds siblings. No rewrite
+    // adds or drops a package, so the probe reads the original lock.
     let mut parse = PdmLockParse::default();
-    for dep in overrides.iter().filter(|dep| dep.ecosystem == "pypi") {
-        // A package `pdm.lock` simply does not contain is not installed by pdm —
-        // a sibling `requirements.txt`/pylock may legitimately carry it — so we
-        // neither redirect it here nor veto the other pypi rewriters. Only a
-        // package the lock DOES contain but the plan refuses (source conflict,
-        // unsupported format, forked variants, bad hashes) withholds siblings.
-        if !lock_contains(&mut parse, &text, &dep.name) {
-            continue;
-        }
-        match plan_in(&mut parse, &text, dep) {
-            Ok((rewritten, edits)) => {
+    let intake: Vec<(&DepOverride, Result<Artifact, String>)> = overrides
+        .iter()
+        .filter(|dep| dep.ecosystem == "pypi")
+        .filter(|dep| lock_contains(&mut parse, original, &dep.name))
+        .map(|dep| (dep, artifact_of(dep)))
+        .collect();
+    let lock_deps: Vec<PdmLockDep> = intake
+        .iter()
+        .filter_map(|(dep, artifact)| Some(lock_dep(dep, artifact.as_ref().ok()?)))
+        .collect();
+    // Every dep is rewritten over one parse and one render of the lock.
+    let LockBatch { text, steps } = rewrite_pdm_lock_all(original, &lock_deps);
+    let mut steps = steps.into_iter();
+    // No rewrite touches `[metadata] lock_version`: read once, from the
+    // parse the presence probe already took.
+    let lock_ver: Option<String> = parse.parsed(original).ok().and_then(|lock| {
+        crate::utils::pdm_lock::lock_version(lock)
+            .ok()
+            .map(str::to_string)
+    });
+    let mut stale_warned = false;
+    for (dep, intake) in intake {
+        let step = match intake {
+            Ok(_) => steps.next().expect("one step per batched dep"),
+            Err(detail) => LockStep::Refused(detail),
+        };
+        match step {
+            LockStep::Rewritten(_) | LockStep::Unchanged => {
                 result.confirmed_pdm_uuids.insert(dep.patch_uuid.clone());
-                let lock_ver: Option<String> = parse.parsed(&rewritten).ok().and_then(|lock| {
-                    crate::utils::pdm_lock::lock_version(lock)
-                        .ok()
-                        .map(str::to_string)
-                });
                 if lock_ver.as_deref() == Some("2") {
                     result.warnings.push(RewriteWarning { code: "redirect_pdm_legacy_sync_required".into(), detail: "PDM 0.x may regenerate freshly generated locks during install; use `pdm sync` to preserve this patch, or upgrade PDM".into() });
                 }
@@ -65,10 +81,14 @@ pub(super) fn rewrite(
                         ),
                     });
                 }
-                text = rewritten;
-                result.edits.extend(edits);
+                if let LockStep::Rewritten(edits) = step {
+                    result
+                        .edits
+                        .extend(edits.into_iter().map(|(old, new)| file_edit(dep, old, new)));
+                }
             }
-            Err(detail) => {
+            LockStep::NotFound => unreachable!("PDM refuses a package its lock lacks"),
+            LockStep::Refused(detail) => {
                 result.refused_pdm_uuids.insert(dep.patch_uuid.clone());
                 result.warnings.push(RewriteWarning {
                     code: "redirect_pdm_refused".into(),
@@ -106,17 +126,11 @@ fn lock_contains(parse: &mut PdmLockParse, text: &str, name: &str) -> bool {
     }
 }
 
-#[cfg(test)]
-fn plan(text: &str, dep: &DepOverride) -> Result<(String, Vec<FileEdit>), String> {
-    plan_in(&mut PdmLockParse::default(), text, dep)
-}
+/// A dep's wheel filename and SHA-256.
+type Artifact<'a> = (String, &'a str);
 
-/// Plan `dep`'s rewrite of `text`, reusing (and refreshing) `parse`.
-fn plan_in(
-    parse: &mut PdmLockParse,
-    text: &str,
-    dep: &DepOverride,
-) -> Result<(String, Vec<FileEdit>), String> {
+/// `dep`'s [`Artifact`], or its refusal before the lock is read.
+fn artifact_of(dep: &DepOverride) -> Result<Artifact<'_>, String> {
     let sha256 = dep
         .integrity
         .sha256
@@ -133,28 +147,48 @@ fn plan_in(
         .path_segments()
         .and_then(|mut segments| segments.next_back())
         .ok_or("missing PDM wheel filename")?;
-    let rewrite = rewrite_pdm_lock_in(
-        parse,
-        text,
-        &dep.name,
-        &dep.version,
-        ("url", &dep.artifact_url),
+    Ok((filename.to_string(), sha256))
+}
+
+/// `dep`'s arguments to the lock rewrite, given its [`artifact_of`].
+fn lock_dep<'a>(dep: &'a DepOverride, (filename, sha256): &'a Artifact<'a>) -> PdmLockDep<'a> {
+    PdmLockDep {
+        name: &dep.name,
+        version: &dep.version,
+        source: ("url", &dep.artifact_url),
         filename,
         sha256,
-    )?;
-    let edits = rewrite
-        .edits()?
-        .into_iter()
-        .map(|(old, new)| FileEdit {
-            path: "pdm.lock".into(),
-            kind: "redirect_pdm_lock_package".into(),
-            action: "rewritten".into(),
-            key: Some(dep.name.clone()),
-            original: Some(json!(old)),
-            new: Some(json!(new)),
-        })
-        .collect();
-    Ok((rewrite.text, edits))
+    }
+}
+
+fn file_edit(dep: &DepOverride, old: String, new: String) -> FileEdit {
+    FileEdit {
+        path: "pdm.lock".into(),
+        kind: "redirect_pdm_lock_package".into(),
+        action: "rewritten".into(),
+        key: Some(dep.name.clone()),
+        original: Some(json!(old)),
+        new: Some(json!(new)),
+    }
+}
+
+/// `dep`'s rewrite of `text` alone: the rewritten text and its edits.
+#[cfg(test)]
+fn plan(text: &str, dep: &DepOverride) -> Result<(String, Vec<FileEdit>), String> {
+    let artifact = artifact_of(dep)?;
+    let LockBatch { text, mut steps } = rewrite_pdm_lock_all(text, &[lock_dep(dep, &artifact)]);
+    match steps.remove(0) {
+        LockStep::Rewritten(edits) => Ok((
+            text,
+            edits
+                .into_iter()
+                .map(|(old, new)| file_edit(dep, old, new))
+                .collect(),
+        )),
+        LockStep::Unchanged => Ok((text, Vec::new())),
+        LockStep::NotFound => unreachable!("PDM refuses a package its lock lacks"),
+        LockStep::Refused(detail) => Err(detail),
+    }
 }
 
 #[cfg(test)]
@@ -428,4 +462,56 @@ mod parse_reuse_equivalence_tests {
         assert!(confirmed > 100, "only {confirmed} confirmed");
         g.finish();
     }
+
+    /// A dozen patched packages in one lock cost one whole-lock render and
+    /// re-parse, not one per package (#762).
+    #[test]
+    fn many_patches_render_the_lock_once() {
+        use crate::utils::lock_fragments::RENDERS;
+        let url = |name: &str| {
+            format!("https://patch.socket.dev/patch/pypi/{name}/a/{name}-1.26.18-py3-none-any.whl")
+        };
+        let mut checked = 0;
+        for (fixture, lock) in fixtures() {
+            for crlf in [false, true] {
+                let mut lock = grown(&lock.replace("\r\n", "\n"), 11);
+                if crlf {
+                    lock = lock.replace('\n', "\r\n");
+                }
+                let names = std::iter::once("urllib3".to_string())
+                    .chain((0..11).map(|n| format!("pkg{n}")));
+                let deps: Vec<DepOverride> = names
+                    .enumerate()
+                    .map(|(n, name)| DepOverride {
+                        ecosystem: "pypi".into(),
+                        artifact_url: url(&name),
+                        name,
+                        namespace: None,
+                        version: "1.26.18".into(),
+                        token: String::new(),
+                        patch_uuid: format!("00000000-0000-4000-8000-{n:012}"),
+                        registry_override: None,
+                        integrity: Integrity {
+                            sha256: Some("a".repeat(64)),
+                            ..Default::default()
+                        },
+                    })
+                    .collect();
+                let files = BTreeMap::from([("pdm.lock".to_string(), lock)]);
+                RENDERS.with(|renders| renders.set(0));
+                let mut got = RewriteResult::default();
+                rewrite(&files, &deps, &mut got);
+                if got.confirmed_pdm_uuids.len() != 12 {
+                    continue; // a generation this dep shape doesn't land on
+                }
+                checked += 1;
+                assert_eq!(
+                    RENDERS.with(|renders| renders.get()),
+                    1,
+                    "{fixture} crlf={crlf}"
+                );
+            }
+        }
+        assert!(checked >= 16, "only {checked} locks landed every dep");
+    }
 }

crates/socket-patch-core/src/patch/redirect/poetry.rs

@@ -9,7 +9,7 @@ use toml_edit::DocumentMut;
 
 use super::{DepOverride, FileEdit, RewriteResult, RewriteWarning};
 use crate::utils::poetry_lock::{
-    generated_by_version, lock_version, rewrite_poetry_lock_in, PoetryLockParse,
+    generated_by_version, lock_version, rewrite_poetry_lock_all, LockBatch, LockStep, PoetryLockDep,
 };
 
 /// Whether the lock was written by a Poetry release older than 1.4. Those
@@ -56,52 +56,40 @@ pub(super) fn rewrite_poetry(
         }
     }
     for (path, original) in locks {
-        let mut content = original.clone();
+        let deps: Vec<PoetryLockDep> = usable
+            .iter()
+            .map(|&(dep, sha256)| PoetryLockDep {
+                name: &dep.name,
+                version: &dep.version,
+                source_type: "url",
+                source_url: &dep.artifact_url,
+                filename: dep.artifact_url.rsplit('/').next().unwrap_or(""),
+                sha256,
+            })
+            .collect();
+        // Every dep is rewritten over one parse and one render of the lock.
+        let LockBatch {
+            text: content,
+            steps,
+        } = rewrite_poetry_lock_all(original, &deps);
         let mut stale_warned = false;
         // `pre_1_4_writer` reads only the first line and `[metadata]
-        // lock-version`, which no package rewrite touches: judged once, on the
-        // lock as of its first rewrite (where it was always first judged).
+        // lock-version`, which no package rewrite touches: judged once.
         let mut writer_format: Option<Option<&'static str>> = None;
-        // Each lock state is parsed once: a rewrite hands its parsed output
-        // to the next dep.
-        let mut parse = PoetryLockParse::default();
-        for &(dep, sha256) in &usable {
-            let filename = dep.artifact_url.rsplit('/').next().unwrap_or("");
-            match rewrite_poetry_lock_in(
-                &mut parse,
-                &content,
-                &dep.name,
-                &dep.version,
-                "url",
-                &dep.artifact_url,
-                filename,
-                sha256,
-            ) {
-                Ok(Some(rewrite)) if rewrite.text != content => {
-                    match rewrite.edits() {
-                        Ok(edits) => {
-                            for (original, new) in edits {
-                                result.edits.push(FileEdit {
-                                    path: path.clone(),
-                                    kind: "redirect_poetry_lock_package".into(),
-                                    action: "rewritten".into(),
-                                    key: Some(format!("{}@{}", dep.name, dep.version)),
-                                    original: Some(Value::String(original)),
-                                    new: Some(Value::String(new)),
-                                });
-                            }
-                        }
-                        Err(detail) => {
-                            result.refused_python_lock_uuids.insert(dep.patch_uuid.clone());
-                            result.warnings.push(RewriteWarning {
-                                code: "redirect_poetry_lock_unsupported".into(),
-                                detail: format!("{path}: {detail}"),
-                            });
-                            continue;
-                        }
+        for (&(dep, _), step) in usable.iter().zip(steps) {
+            match step {
+                LockStep::Rewritten(edits) => {
+                    for (original, new) in edits {
+                        result.edits.push(FileEdit {
+                            path: path.clone(),
+                            kind: "redirect_poetry_lock_package".into(),
+                            action: "rewritten".into(),
+                            key: Some(format!("{}@{}", dep.name, dep.version)),
+                            original: Some(Value::String(original)),
+                            new: Some(Value::String(new)),
+                        });
                     }
                     result.confirmed_python_lock_uuids.insert(dep.patch_uuid.clone());
-                    content = rewrite.text;
                     if !stale_warned {
                         if let Some(format) =
                             *writer_format.get_or_insert_with(|| pre_1_4_writer(&content))
@@ -135,14 +123,14 @@ pub(super) fn rewrite_poetry(
                     }
                 }
                 // Already redirected to this artifact (idempotent re-scan).
-                Ok(Some(_)) => {
+                LockStep::Unchanged => {
                     result.confirmed_python_lock_uuids.insert(dep.patch_uuid.clone());
                 }
-                Ok(None) => result.warnings.push(RewriteWarning {
+                LockStep::NotFound => result.warnings.push(RewriteWarning {
                     code: "redirect_poetry_entry_not_found".into(),
                     detail: format!("no {path} entry for {}@{}", dep.name, dep.version),
                 }),
-                Err(detail) => {
+                LockStep::Refused(detail) => {
                     result.refused_python_lock_uuids.insert(dep.patch_uuid.clone());
                     result.warnings.push(RewriteWarning {
                         code: "redirect_poetry_lock_unsupported".into(),
@@ -274,4 +262,40 @@ mod equivalence_tests {
         }
         g.finish();
     }
+
+    /// A dozen patched packages in one lock cost one whole-lock render and
+    /// re-parse, not one per package (#760).
+    #[test]
+    fn many_patches_render_the_lock_once() {
+        use crate::utils::lock_fragments::RENDERS;
+        for version in VERSIONS.iter().filter(|version| !version.starts_with("0.")) {
+            for crlf in [false, true] {
+                let mut lock = grown(version, 11);
+                // Give every clone its own populated legacy integrity entry,
+                // as Poetry writes them.
+                if let Some(start) = lock.find("\nurllib3 = [\n") {
+                    let end = start + lock[start..].find("\n]").unwrap() + 2;
+                    let entry = lock[start..end].to_string();
+                    let clones: String = (0..11)
+                        .map(|i| entry.replacen("urllib3 =", &format!("pkg{i} ="), 1))
+                        .collect();
+                    lock.insert_str(end, &clones);
+                }
+                if crlf {
+                    lock = lock.replace('\n', "\r\n");
+                }
+                let files = BTreeMap::from([("poetry.lock".to_string(), lock)]);
+                let mut deps = vec![dep("urllib3", "1.26.18", Some(SHA), 0)];
+                deps.extend((0..11).map(|i| dep(&format!("pkg{i}"), "1.26.18", Some(SHA), i + 1)));
+                RENDERS.with(|renders| renders.set(0));
+                let got = run(rewrite_poetry, &files, &deps);
+                assert_eq!(got.confirmed_python_lock_uuids.len(), 12, "{version}");
+                assert_eq!(
+                    RENDERS.with(|renders| renders.get()),
+                    1,
+                    "{version} crlf={crlf}"
+                );
+            }
+        }
+    }
 }