[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Sweep of the audited core rows utils/{notice,npm_range,package_manager,pep440,pipenv,purl}.rs in coverage/files.tsv, done by the architecture refactor routine (discussion #1830). See the living document's Part 4 (structure) and Part 5 (tests).

Changes

• notice.rs: inlined is_muted into notice_once, its only caller.
• npm_range.rs: the operator character set was written out twice. It is now one private is_operator.
• pep440.rs: the two copies of the trailing-zero trim are now one trim_trailing_zeros. Dropped a bare #1589.
• pipenv.rs:
  • Inlined resolve_on_path, a forwarder to process::resolve_tool_with over the real env. It now calls process::resolve_tool("pipenv").
  • Deleted 3 tests (resolve_on_path_*) that repeat process.rs's resolve_tool_* tests of the same resolver.
  • The unused root parameter is now named _root, replacing let _ = root. Removing it would touch callers in scan/hosted.rs (Sweep scan/hosted.rs (helpers and tests region) #1897) and vendor/pypi.rs (Fix pylock wiring ignoring an out-of-root -r pin (#1851) #1853, Fix templated pip pins ignored beside pylock (#1873) #1874, Fix Pipenv stale-install remedy built twice (#1878) #1883).
• purl.rs:
  • Deleted the JsrPurlParts alias and the is_purl wrapper. target.rs now calls starts_with("pkg:") in both places.
  • parse_name_version is private.
  • Trimmed the strip_purl_qualifiers essay, the JSR "as of writing" note, the builder banner, the REGRESSION/B73/remove and rollback don't PEP 503-normalise PyPI purl identifiers, so remove pkg:pypi/typing_extensions@4.7.1 exits 1 "No patch found" while get accepts the same identifier #1024 tags and 5 test section banners.
  • Folded the 3 test modules into one.
  • Tests: deleted test_is_purl, 7 test_build_*_purl tests (which restate a format!), 7 *_round_trip tests and cargo_purl_round_trips_through_the_encoded_spelling (which repeat the parse tests). They are replaced by one test, builders_round_trip_through_their_parsers, which round-trips every builder with a literal + version. It went red when build_jsr_purl was mutated to drop the /. test_parse_golang_purl_percent_decodes and test_parse_jsr_purl_percent_encoded_scope were duplicates; their one unique assert each (Azure case is kept; an encoded bare @ is rejected) moved into the parse tests.
• package_manager.rs: nothing local. The yarn_major note is A13, and its callers' files (vendor/mod.rs) are held by Fix Go patch delivery, audits, and reinstalls #1698.

Not done because the files are held by open PRs: inlining the 7 build_*_purl wrappers (callers in crawlers and vendor files held by #1882, #1886, #1891 and #1698), inlining parse_jsr_purl into deno_crawler (#1891), and moving the PurlKey asserts to purl_key.rs (#1907).

Size

+135 / −432 in 6 files: about −55 production lines and −242 test lines.

Behavior change

None.

/code-review high

7 findings. I fixed 2: the builder/literal-+ round-trip coverage, and _root. I left 5 unchanged:

• npm_range_admits(">=", v) reads as *: pre-existing, and fixing it changes behavior. It is noted in the register for an issue.
• The Windows .bat spawn test went with pipenv.rs: process.rs tests PATHEXT resolution and the batch-shim spawn with .cmd. A .bat case belongs there, but process.rs is held by Fix env-keyed probe memo written three ways (#1888) #1895.
• Removing pub fn is_purl is a breaking change: core is consumed only by this workspace's CLI, and earlier sweeps narrowed pub items the same way.
• starts_with("pkg:") is case-sensitive: identical to the old is_purl.
• Two copies of starts_with("pkg:"): a one-token literal; a wrapper for it is what the audit asked to remove.

Verification

• cargo clippy --workspace --all-features -- -D warnings is clean.
• cargo test -p socket-patch-core --lib: 6975 passed. The 4 failures are permission-dependent tests that fail under the root sandbox and are untouched here: copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched and pypi_requirements::wire_failure_rolls_back_already_written_files.
• CI (82 checks) and Bugbot are green on 9a0b930.

Risk

Low. The changes are local inlines and test edits. No platform-specific production code changed; only a cfg(windows) test was deleted.

https://claude.ai/code/session_011f9aeQHPtUvnVjDnuWKCpj

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9a0b930. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[burn-down agent] Labeled Ready for review at 9a0b930.

• CI: all 82 checks on 9a0b930 pass or are skipped (32 success, 50 skipped). Mergeable, no conflicts.
• Bugbot: reviewed 9a0b930, no findings. No unresolved review threads.
• Reviewer note: refactor sweep of core utils (notice, npm_range, pep440, pipenv, purl). Net −297 lines, most of it in utils/purl.rs. No CHANGELOG.md change.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief (9a0b930)

What it does. A refactor sweep of six core utils files with no intended behavior change. It inlines is_muted, resolve_on_path and is_purl, folds duplicated helpers (npm is_operator, pep440 trim_trailing_zeros), and makes parse_name_version private. It also replaces 16 purl builder and round-trip tests with one test that round-trips every builder, and deletes 3 pipenv resolver tests that repeat process.rs's resolve_tool_* tests.

Risk: low. I compared each production rewrite with the old code and found them equivalent:

• pipenv::installed_major now calls process::resolve_tool("pipenv"), which is resolve_tool_with(name, env::var_os), the same absolute-PATH-only resolver as before. The probe still runs in temp_dir().
• is_purl(t) was t.starts_with("pkg:"), which is now inlined at both call sites in target.rs.
• The notice, npm_range and pep440 changes are mechanical extractions or inlines.

Look here

• pipenv.rs:53: the resolver call that replaced resolve_on_path
• target.rs:93 and target.rs:370: the inlined is_purl
• pep440.rs:39: trim_trailing_zeros, shared by versions_equal and equivalent_release_spellings
• purl.rs:567: builders_round_trip_through_their_parsers, the replacement test

Verified

• Read the full diff (6 files, +135/−432) and the description, and they match.
• Coverage the deleted tests had is still there:
  • The coordinate-validation test purl_builders_validate_coordinates (path traversal, extra levels) was moved, not deleted.
  • The golang %2Bincompatible decode is still covered by parsers_percent_decode_the_version.
  • The relative-PATH and non-executable resolver cases are covered in process.rs.
• Nothing else in the workspace uses is_purl or JsrPurlParts. CHANGELOG.md is untouched, and I found no debug leftovers.
• CI is green on 9a0b930 (ci-ok and clippy pass). Bugbot found no issues, and there are no review threads. I didn't run the tests locally and relied on CI for this one.

Changes I made: none.

Open questions (not blocking)

• The deleted cfg(windows) test resolve_on_path_honours_pathext_shims was the only test that spawned a .bat shim end to end. process.rs covers .cmd. The author deferred a .bat case because process.rs is held by Fix env-keyed probe memo written three ways (#1888) #1895. Consider a follow-up once that PR lands.
• pub fn is_purl is removed from the published core crate. Nothing in this workspace uses it, and earlier sweeps narrowed pub items the same way.

Auto-merge is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code