[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Architecture refactor sweep of crates/socket-patch-cli/src/commands/scan/hosted/{nuget,takeover}.rs, coverage rows 22 and 24 of the ledger (python.rs is held by #1883). It follows the audit notes and Part 4 (structure) of the living document.

Changes

takeover.rs

• Inlined 3 single-caller helpers into Takeover::stage: revert_keeps_wiring, residual_takeover_warning and drifted_takeover_warning.
• Deleted the keep-wiring branch's third conjunct (any(code == residual reference)). It is dead: the branch is reached only when residual_only_keep returned None, which means either drift_skipped() is true (already a conjunct) or there is no residual warning.
• The literal "vendor_revert_residual_reference" is replaced by vendor::RESIDUAL_REFERENCE_CODE. The 4 copies of "redirect_vendored_revert_failed" are now a REVERT_FAILED const.
• KEPT_VENDORED was pub(super) with no outside user and is now private.
• The cargo ledger-less probe uses purl_parts(purl).filter(type == "cargo") instead of starts_with + then + flatten.
• Fully qualified std::collections::BTreeSet is replaced by the imported name.
• Removed 9 bare issue references from comments (Hosted and lock-only scans treat a UTF-16 requirements.txt (what Windows PowerShell's pip freeze > writes) as absent: exit 0, no warning, and pip keeps installing the unpatched pin #721, remove and rollback call a vendored PyPI residual-reference keep "lockfile wiring drifted", and their "re-run scan --mode vendored to normalize, then remove" remedy loops (Pipenv pipenv requirements export) #1184, Vendored→hosted takeover on yarn classic un-patches a vendored npm: alias copy when a direct copy is pinned, instead of retracting the takeover #1158, Vendored → hosted takeover strands a requirements.txt pin that lives in a -r include or a vendored "(transitive)" line: the wet run reverts it to the unpatched release, while --dry-run previews a clean takeover #699, uv vendored → hosted takeover strands a package that vendored mode pinned to a different version than uv.lock: the wet run reverts to the unpatched release (exit 1), while --dry-run previews a clean takeover #723, Poetry 0.x vendored → hosted takeover un-vendors the package before hosted mode refuses the lock, while --dry-run previews a clean takeover (redirected: 1, exit 0) #945, Hosted uv scan gives no uv < 0.5.6 advisory for transitive overrides or repointed constraints, so on uv ≤ 0.5.4 a plain uv sync silently reinstalls the unpatched wheel after a clean exit 0 #1569 ×2, Hosted yarn berry rewrites a mixed-line-ending package.json that vendored mode refuses #628). The comment on the keep-wiring branch now also covers kept_artifact, not only drift.

nuget.rs: dropped the bare (#352) from the module doc.

Tests: none changed. The existing explain and names_package unit tests still apply. classic_takeover_keeps_vendored_alias_copy_patched (mode_migration_npm) guards unwires_alias_copy: breaking its yarn.lock match turned that test red.

Diff: +65 / −94, all production code in takeover.rs and nuget.rs. No test lines changed.

Behavior change

None. Output bytes, codes and skip reasons are the same.

Risk

Low. This is a local inlining in one CLI module, with no cfg(windows)/cfg(unix) code touched.

Verification

• cargo clippy -p socket-patch-cli --all-features -- -D warnings passes.
• The socket-patch-cli lib tests pass (940).
• These suites pass: scan (247), mode_migration_{cargo,composer,npm,pypi,vlt,bun}, in_process_vendor, and in_process_vendor_{pnpm,bun}_takeover.
• /code-review high ran. I fixed the dead conjunct, the stale comment and the repeated code literal. I kept unwires_alias_copy named, because inlining it nested 5 closures.

Not fixed here (pre-existing; each changes output)

• The residual-refusal pin split doesn't decode the purl. It splits by hand without percent-decoding, so pkg:pypi/six@1.16.0%2Bsocket.1 would advise six==1.16.0%2Bsocket.1. purl_parts decodes, but switching to it changes the message bytes. A14 (Tracking: build and classify purls through one validated utils::purl API #748).
• The takeover and vendor --revert classify a residual keep differently. residual_only_keep doesn't require kept_artifact, while core RevertOutcome::kept_for_residual_reference does. A wet revert always sets it, but a dry-run revert emits the residual warning without it.
• No test asserts the residual refusal's detail text. I mutated that string and every suite still passed.
• Bare issue references: the review suggested keeping them. The refactor procedure deletes bare issue numbers, and the "why" text around them stays.

🤖 Generated with Claude Code

https://claude.ai/code/session_011f9aeNy5nnxWTLcart5Joa

---

Note

Low Risk
Local CLI refactor in hosted scan takeover logic with explicit parity on output bytes; no auth, data, or cross-platform paths touched.

Overview
Refactors takeover.rs and trims nuget.rs module docs as an audit-driven structure sweep, with no intended behavior change to warning codes, skip reasons, or JSON output.

In Takeover::stage, vendored-revert refusal handling is inlined (replacing revert_keeps_wiring, residual_takeover_warning, and drifted_takeover_warning) and the keep-wiring check is simplified to kept_artifact || drift_skipped() after dropping a dead residual-warning conjunct. Repeated "redirect_vendored_revert_failed" strings become a REVERT_FAILED const; residual lookup uses RESIDUAL_REFERENCE_CODE. KEPT_VENDORED is now module-private.

Smaller cleanups: cargo ledger-less probing uses purl_parts + type filter instead of a pkg:cargo/ prefix chain; unwires_alias_copy takes &BTreeSet and unpinned uses is_some_and; bare issue references are removed from comments. nuget.rs drops (#352) from its module doc.

^{Reviewed by Cursor Bugbot for commit 3c9459a. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 3c9459a. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[burn-down agent] Labeled Ready for review at 3c9459a.

• CI: all PR checks green on 3c9459a (32 success, 50 skipped); mergeable, no conflicts.
• Bugbot: reviewed 3c9459a, no findings; no unresolved review threads.
• Reviewer note: local cleanups in scan/hosted/nuget.rs and scan/hosted/takeover.rs only.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does: Behavior-neutral cleanup of scan/hosted/takeover.rs (plus a one-line doc change in nuget.rs). It inlines three single-caller warning helpers into Takeover::stage, replaces repeated code literals with REVERT_FAILED and RESIDUAL_REFERENCE_CODE, drops one dead conjunct, simplifies the cargo purl probe and unwires_alias_copy's Option parameter, and removes bare issue numbers from comments.

Risk: low. Warning codes and detail strings are byte-identical, and no platform-specific code changed.

Look here:

• crates/socket-patch-cli/src/commands/scan/hosted/takeover.rs:281:`` the keep-wiring branch without the residual conjunct. It's dead: residual_only_keep returns `None` only when drift was skipped or no residual warning exists, so a residual-only outcome never reaches this branch.
• crates/socket-patch-cli/src/commands/scan/hosted/takeover.rs:263:```` the inlined residual refusal, whose text matches the deleted helper
• crates/socket-patch-cli/src/commands/scan/hosted/takeover.rs:146:````` purl_parts(purl).filter(ty == "cargo") is equivalent to the old `starts_with("pkg:cargo/")` check, because `purl_parts` doesn't normalize the type
• crates/socket-patch-cli/src/commands/scan/hosted/takeover.rs:342:`````` unpinned now unwraps the `Option` with `is_some_and`, with the same result for `None`

Verified: Read the full diff and compared each inlined string against the deleted helpers. rustfmt --check passes on the head file. The PR's CI run is green (ci-ok and clippy pass). Bugbot found no issues on this head. CHANGELOG.md is untouched.

Changes I made: none.

Auto-merge is armed, so approving sends it straight to the merge queue.

---

Generated by Claude Code

[Wenxin Jiang (Wenxin-Jiang)]

[agent] Reviewed 3c9459acd531302fcfc6b55219c9dab7770c7a12. Checked takeover revert refusal equivalence, residual wiring and alias-copy protection. No major correctness issues found. Validation: source and regression-test review plus the available exact-head CI checks; no local test pass is claimed.