Fix uv revert after a vendored dep goes direct (#1374)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1374

Summary

In a uv project, vendor a transitive package and then add it directly (uv add six==1.16.0). After that, vendor --revert, remove and rollback wrote a pyproject.toml / uv.lock pair that uv sync --locked rejects. The revert still exited 0, and vendor --check then wrongly said no file references the vendored wheel. Now:

• The revert puts the root element that uv add created back on the registry, spelled the way pyproject.toml declares it now (the Vendored uv revert writes the pre-vendor specifier back into uv.lock after the user changes the vendored package's version spec, so uv sync --locked fails (vendor --revert / remove / rollback exit 0) #840 respell rule). This covers requires-dist, and also requires-dev for uv add --dev.
• When that spelling can't be derived (a multi-clause or === declaration, a URL, or no declaration), the revert writes neither file. It drift-keeps both, and the warning says what to change. That matches the issue's fail-closed alternative and the PEP 723 script lane.
• A final pair gate runs before any write. If the reverted uv.lock would still route through the uuid dir while the reverted pyproject.toml no longer does, nothing is written. A half-reverted uv pair can't be written any more.
• vendor --check: for a PyPI entry that nothing installs from but some project file still names, the verdict is wiring incomplete: … but uv.lock still resolves through it … with a re-lock-first remedy. It no longer says "no lockfile or config references …".

Root cause

revert_uv (crates/socket-patch-core/src/vendor/pypi_uv.rs) restores only the fragments the ledger recorded. A transitive package has no root requires-dist element when it is vendored, so nothing is recorded for it. The element uv add writes later through the socket-written [tool.uv.sources] entry was therefore never restored. The pair was also written without checking that the reverted lock no longer routes through the wheel. The residual-reference guard in pypi.rs runs only after the write, so it could keep the artifact but couldn't stop the inconsistent write.

Test evidence

Each new test was run red with the fix disabled (the new blocks short-circuited), then green with it:

Issue item	Test	Without fix	With fix
#1374: revert after uv add six==1.16.0 (requires-dist)	pypi_uv::tests::revert_after_promoting_a_transitive_to_direct_respells_the_root_entry	FAILED	ok
#1374: same via uv add --dev (requires-dev)	pypi_uv::tests::revert_after_promoting_a_transitive_to_a_dev_group_respells_it	FAILED	ok
#1374: fail closed, never a half-written pair	pypi_uv::tests::revert_keeps_both_files_when_an_unrecorded_reference_survives (multi-clause, ===, undeclared, another name routed through the wheel)	FAILED	ok
#1374: real uv end to end (vendor transitive, uv add six==1.16.0, vendor --revert, uv lock --check)	e2e_vendor_pypi_build::uv_vendor_revert_after_promoting_the_transitive_to_direct (uv 0.11.32)	FAILED ("uv.lock must be fully unwired")	ok
#1374: vendor --check claims no file references the dir	mode_migration_pypi::vendor_check_names_the_file_of_a_half_unwound_uv_pair	FAILED	ok

remove and rollback call the same revert_uv, so the same fix covers them.

Commands run locally:

• cargo fmt --all -- --check: clean
• cargo clippy --workspace --all-features -- -D warnings: clean
• cargo test --workspace --all-features: 7,285 passed. 13 failed, all sandbox-only and outside the code this PR touches: 12 write-failure tests whose chmod-made read-only dirs don't block writes because the sandbox runs as root (copy_tree::relax_loop_must_not_traverse_symlinked_root, covgap_commands_vendor ×3, partial_lockfile_write_failure…, redirect_json_mode_write_failures…, vlt::…heal_invalidation_failure_warns, repair_…_unremovable/cleanup_failure ×2, and core copy_tree/vlt_heal/pypi_poetry/pypi_requirements write-failure tests), plus 1 that needs network to the patch API (e2e_bun_lockb::binary_shared_bundled_record_hosted_pin_is_managed). CI runs them as non-root
• cargo test -p socket-patch-cli --all-features --test e2e_vendor_pypi_build -- --include-ignored uv_vendor_revert_after with SOCKET_PATCH_UV_E2E_REQUIRED=1: 7 passed (every existing uv relock-then-revert capstone plus the new one)

The npm / PyPI / gem wrappers only dispatch to the binary, so they need no change.

/code-review high

Fixed in b022bef: === and other underivable declarations are no longer restored without a specifier; the keep-both remedies no longer suggest a uv lock that would rebuild the same element; vendor --check uses the probe's clause instead of stripping an English suffix; lock_requirement_declared was folded into declared_lock_specifier; drift_kept is now a plain bool; the doc comment lists the new verdict.

Not fixed:

• The pair gate uses a substring test on pyproject.toml. A pyproject that still mentions the uuid path in a comment skips the gate. In that case, though, the existing post-write residual-reference guard (pypi_reference_clause, which probes pyproject.toml) keeps the artifact and the ledger entry, so nothing is deleted. A precise TOML-level route check would add a lot of code for a far-fetched input.
• The root requirement array walk is duplicated with rewrite_root_metadata_entries. Sharing it means refactoring the wire path as well, which is out of scope for this fix.
• The element is parsed twice (strip path, then with_specifier). This only runs on the rare promoted element, and reusing with_specifier keeps key placement in one place.

🤖 Generated with Claude Code

https://claude.ai/code/session_019iinbVuLMEUcDSE3PWUSho

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b022bef. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review at b022bef.

• CI: 36/36 non-skipped checks green on the head; no main-wide failures.
• Bugbot: reviewed b022bef, no findings.
• Mergeable: no conflicts with main; no CHANGELOG.md changes.

Slack announcement pending (no Slack send tool in this run; the next run retries).

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does. When a vendored uv dep was later promoted to a direct dependency (uv add six), revert_uv left a half-reverted pair: pyproject.toml fixed but uv.lock still routing root requires-dist/requires-dev through the uuid dir. Revert now respells those unrecorded root elements back to the registry using the specifier pyproject.toml declares, fails closed when it can't derive one, and refuses to write a lock that still names the dir once pyproject.toml doesn't. vendor --check now reports wiring incomplete naming the file instead of a wrong "no references" message. Fixes #1374.

Risk: low. New code runs only when there's no drift and only touches root-unit elements named for the package whose path is under .socket/vendor/pypi/<uuid>. Every unclear case (multi-clause or === spec, undeclared name, workspace member, another name routed through the wheel) keeps both files untouched.

Look here

• pypi_uv.rs:1128-1170 — respell call and pair gate in revert_uv
• pypi_uv.rs:1281-1355 — respell_unrecorded_path_entries
• upstream/uv.rs:1369 — declared_lock_specifier (fail-closed cases)
• vendor.rs:487 — new wiring incomplete verdict
• pypi_uv.rs:3321-3450 — new unit tests

Verified. Read the full diff. cargo test -p socket-patch-core --lib pypi_uv 122 passed, upstream::uv 24 passed, --lib pypi 524 passed (2 failures are chmod-based tests that can't fail when run as root; code untouched by this PR). cargo test -p socket-patch-cli --all-features --test mode_migration_pypi --test in_process_vendor 132 + 55 passed. Short-circuiting the new blocks makes the 3 new revert tests fail, so they exercise the fix. Probed CRLF round-trip (byte-exact), marker elements, extras and dry-run with a multi-clause spec. Did not run the networked uv e2e (body says it passed locally). CHANGELOG untouched. CI 84/84 (36 success, 48 skipped); Cursor Bugbot: no issues.

Changes I made. None.

Open questions (non-blocking).

• The respell writes the currently declared specifier without checking it against the restored registry unit's version; the unit fixture expects specifier = "==1.16.0" next to a restored six at 1.17.0. Real use matches (vendored = locked version), and the Vendored uv revert writes the pre-vendor specifier back into uv.lock after the user changes the vendored package's version spec, so uv sync --locked fails (vendor --revert / remove / rollback exit 0) #840 direct-dep respell has the same gap, but the fixture could use 1.16.0 so the expected output is self-consistent.
• The wiring incomplete text says "the project files disagree" even when the clause is about an unreadable file.

Auto-merge is armed: approving sends it straight to the merge queue.

---

Generated by Claude Code