[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1951

Summary

Hosted scans now identify a yarn classic file: directory or tarball-URL copy through formats::yarn::copy (classic_copy_ref, CopyRef::read_path, CopyRef::identity). That is the reader vendored and VEX already use. The second reader in formats/yarn/source.rs (classic_file_directory, classic_copy_real_name) and its third dir/package.json join are deleted.

Root cause

classic_file_directory normalized the file: path through a Cargo helper (cargo_workspace::normalize_rel) that drops any path leaving the root. For lp2@file:../ext/lpdir, hosted never read the copy's package.json, so the yarn rewriter never named it. Only the engine's generic post-run fallback (redirect_copy_unpatched) caught it, whereas an in-root copy gets redirect_yarn_classic_directory_skipped and is counted in bundled_skipped_uuids. Vendored and VEX read the same copy (#1516), so the modes disagreed.

Changes

• formats/yarn/copy.rs: new classic_copy_name(patterns, resolved, version, read_text) over classic_copy_ref + identity. It is gated to the Directory and RemoteTarball-URL copies the old function handled; a file: tarball still needs bytes, which a text reader can't give.
• hosted/engine.rs: reads each directory copy's manifest at CopyRef::read_path(). Out-of-root paths are read, as vendored and VEX read them; absolute paths are never read.
• patch/redirect/mod.rs: the yarn classic rewriter calls classic_copy_name.
• formats/yarn/source.rs: the duplicate reader is deleted.
• e2e_redirect_yarn_classic_build: classic_outside_root_copy_under_another_name_is_named_and_not_attested now expects the out-of-root copy to be named exactly once, with the code an in-root copy gets (redirect_yarn_classic_directory_skipped). The VEX assertions are unchanged.

Test evidence

Issue	Regression test	Without fix	With fix
#1951	patch::redirect::tests::issue_1951_yarn_classic_copy_named_as_vendored_reads_it (in-root, file:../ext, file:/abs and codeload: hosted names a copy iff vendored identifies it)	FAIL (out-of-root directory: [])	pass
#1951	hosted::engine::tests::issue_1951_yarn_classic_copy_manifests_read_as_vendored_reads_them (disk view reads ../ext/lpdir/package.json, never the absolute one)	FAIL (None)	pass

Run locally on 0c263ae:

• cargo fmt --all -- --check: ok.
• cargo clippy --workspace --all-features -- -D warnings: ok.
• cargo test -p socket-patch-core --all-features: 6997 passed. 4 failed, and the same 4 fail on main in this container, because it runs as uid 0, so chmod-based write-failure tests can't fail: copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched and pypi_requirements::wire_failure_rolls_back_already_written_files.
• cargo test -p socket-patch-cli --all-features --lib: 940 passed.
• scripts/yarn-classic-vex-matrix.sh 1.22.22: every VEX cell passed. e2e_redirect_yarn_classic_build failed only on the out-of-root test above, as expected, and passes 42/42 after the update.
• The full cargo test --workspace ran out of the container's disk building all CLI test binaries, so CI covers the rest of the CLI integration suites.

No wrapper changes are needed: npm/, pypi/ and gem/ only dispatch to the binary.

/code-review high: findings not fixed here

• Hosted still skips an unidentified copy (absolute file:, unreadable manifest, codeload): vendored keeps it as a possible copy (Yarn classic renamed-copy detection (#1489) misses a file: copy outside the project root and a tarball whose root isn't package/, so scans succeed and VEX attests while that copy installs unpatched #1516). This predates the PR; the old reader returned None for the same inputs. It is a separate rule (possible-copy naming), not the identity reader this issue consolidates. Worth a follow-up issue.
• file: tarball copies keyed under another name aren't identified by the hosted rewriter, because the engine's file map is text-only. This predates the PR and is unchanged.
• Dead (live == false) blocks: the hosted rewriter doesn't filter on liveness. This predates the PR and is unchanged.
• Out-of-root reads from an untrusted lock: this is intended parity. Vendored and VEX already read these paths (Yarn classic renamed-copy detection (#1489) misses a file: copy outside the project root and a tarball whose root isn't package/, so scans succeed and VEX attests while that copy installs unpatched #1516); only the manifest's name is used, and absolute paths are still never read.
• Engine read gate vs classic_copy_name gate, and perf of per-block reads: both gates take the first file: pattern via classic_copy_ref and agree on the mixed tarball+directory case (both skip it). The per-block reads matched what the old code did for in-root copies.
• The fixed finding is the parity test's doc, which overclaimed "the same decision"; it now says "identify the same copies".

https://claude.ai/code/session_011f9aeRqL3jx1o1HYCU4NK4

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0c263ae. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[burn-down agent] Labeled Ready for review at 0c263ae.

• CI: 32/32 checks green on 0c263ae (50 skipped); mergeable, no conflicts.
• Bugbot: reviewed 0c263ae, no findings; no open review threads.
• Reviewer note: hosted now reads yarn classic file:/url copy identity through copy.rs's reader (fixes out-of-root file: dirs being dropped, Resolve a yarn classic file:/url copy's identity through formats::yarn::copy only: source.rs keeps a drifted second reader that hosted uses #1951); the yarn classic e2e expectation now matches the single reader's warning.
• Slack announcement not sent this run (Slack send unavailable to the agent); a later run will retry.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does. Hosted scans now read which package a yarn classic file: directory or tarball-URL copy holds through the same reader vendored and VEX already use (classic_copy_ref + CopyRef::identity), and the duplicate reader in formats/yarn/source.rs is deleted. So an out-of-root copy like lp2@file:../ext/lpdir is now named by the yarn rewriter (redirect_yarn_classic_directory_skipped) exactly as an in-root copy is, instead of only by the generic post-run fallback.

Risk: low. Narrow change in one rewriter's identity lookup. The one widening is that hosted now reads package.json from out-of-root relative paths named in the lock; this matches what vendored and VEX already read (#1516), absolute paths are still never read, and these manifests are advisory only: I checked that no rewriter writes them back (the yarn rewriter only inserts yarn.lock).

Look here

• copy.rs:177: new classic_copy_name, gated to Directory/RemoteTarball copies
• engine.rs:700: which manifests the hosted run reads (now CopyRef::read_path, out-of-root allowed, absolute refused)
• redirect/mod.rs:4593: rewriter switched to the shared reader
• redirect/mod.rs:13765 and engine.rs:4337: regression tests (in-root / ../ / absolute / codeload)
• e2e_redirect_yarn_classic_build.rs:1639:`` e2e expectation now asserts the copy is named once, with the in-root code

Verified

• Read the full diff; description matches the code; no CHANGELOG.md change, no debug leftovers.
• cargo test -p socket-patch-core --all-features --lib -- issue_1951 yarn on 0c263ae: 403 passed.
• CI on 0c263ae: ci-ok and clippy green (32 success, 50 skipped by path filters, 0 failed). Bugbot: passed. No unresolved review threads.

Changes I made: none.

Open questions: none blocking. The PR body lists pre-existing gaps it leaves alone (hosted still skips an unidentified copy that vendored keeps as a possible copy; file: tarball copies under another name). Worth a follow-up issue, not this PR.

Auto-merge is armed, so approving sends it straight to the merge queue.

---

Generated by Claude Code

[Wenxin Jiang (Wenxin-Jiang)]

[agent] Reviewed 0c263aedcbccdd28b505b97cf6378a072f5943c6. Checked shared Yarn classic copy identity and advisory directory-manifest reads. No major correctness issues found. Validation: source and regression-test review plus the available exact-head CI checks; no local test pass is claimed.