Read the go.mod module directive through go_mod_edit (#781)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #781

Summary

The go.mod module directive had three readers: a dead crawlers::go_crawler::parse_go_mod_module, VEX --product's own line scanner in vex/product.rs, and the go_mod_edit directive walker that require and replace already go through. This PR adds go_mod_edit::module_path, built on that walker, and deletes the other two readers.

Why

• Issue #781, register row E19 (Go half) in the living architecture document.
• Leverage: B 0 filed bugs (it fixes the unfiled block-form misread below), U 0, D ≈2.2 (three readers become one; net ≈−42 production lines), R L. It is the top-ranked candidate whose files no open fix or refactor PR changes.

What changed

• vendor/go_mod_edit.rs: new pub fn module_path(text) -> Option<String>. It runs normalize_for_read (BOM, quoted tokens) and for_each_directive_body(…, "module", …) (single-line and module ( … ) block forms, trailing // comments, any whitespace). It takes the first body and returns its single token. It returns None for a multi-token body, a token that is still quoted (module ""), or a path that fails is_safe_multi_segment.
• vex/product.rs: parse_go_mod now calls module_path and only formats pkg:golang/<module>.

What was deleted

• crawlers::go_crawler::parse_go_mod_module, which had no production caller, plus its 8 unit tests and the 5 tests in tests/crawler_go_e2e.rs. The cases worth keeping now run against module_path.
• The line scanner in product.rs parse_go_mod.
• git diff --stat: 4 files, +87 / −181. That's about +22 / −64 production lines and +65 / −117 test lines.

Behavior

• Fixed: vex product auto-detection on a go.mod that uses the block form module (⏎\texample.com/blk⏎). It now yields pkg:golang/example.com/blk instead of pkg:golang/(.
• Two edge cases change as well, both for go.mod files that Go itself rejects. An unterminated quote (module "foo) is no longer read as foo. A whitespace separator other than space or tab after module is now accepted, matching Go's lexer.
• No change to the CLI contract, JSON output or exit codes.

Test evidence

• New go_mod_edit tests: module_path_reads_every_directive_form and module_path_rejects_malformed_directives (the cases carried over from the deleted tests, plus the block form, backticks, BOM, CRLF and unsafe paths).
• New vex::product test: detect_go_mod_block_form_module. Red→green: with main's parse_go_mod restored it fails with left: Some("pkg:golang/("), right: Some("pkg:golang/example.com/blk"). On this branch it passes.
• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --lib: 5046 passed, 4 failed. Those 4 are the sandbox's known root-only failures, which also fail on main: copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched and pypi_requirements::wire_failure_rolls_back_already_written_files.
• cargo test -p socket-patch-core --test crawler_go_e2e: 19 passed.
• cargo test -p socket-patch-cli --all-features --test vex_terminal_output: 12 passed. --test covgap_commands_vex: 12 passed.
• CI on b486532: 455 checks passed, 6 skipped. The one failure, the Bun native (macos-latest, 1.3.10) cell preexisting-manifest vendored, passed on its one re-run.

Risk

Low. One read-only parser in VEX product detection. The writers and lockfile discovery already used the shared walker.

🤖 Generated with Claude Code

---

Note

Low Risk
Read-only parsing change in VEX product detection with expanded tests; no CLI contract or crawler runtime behavior changes beyond removing dead code.

Overview
Consolidates go.mod module directive parsing into a single shared reader, go_mod_edit::module_path, built on the same directive walker already used for require / replace.

VEX product auto-detection (parse_go_mod) now calls that helper instead of a hand-rolled line scanner. Block-form directives (module (\n\tpath\n)) correctly yield pkg:golang/<path> instead of the bogus pkg:golang/(.

Removes the unused crawlers::go_crawler::parse_go_mod_module and its duplicate tests; coverage moves to go_mod_edit and a new detect_go_mod_block_form_module test. Net reduction in duplicated parsing logic (~40 production lines).

^{Reviewed by Cursor Bugbot for commit b486532. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b486532. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[agent] One check is red: native (macos-latest, 1.3.10) in Bun patch compatibility (job). One backtest cell, 1.3.10 preexisting-manifest vendored, failed refusalCodesExact; 52 of 53 cells passed, and the log shows no transport errors.

I don't think this PR causes it:

• The diff only changes how the go.mod module directive is read, which feeds VEX --product detection. Nothing on the bun vendored path calls go_mod_edit::module_path or vex::product.
• The same cell passes on every other bun version and OS in this run (454 of 455 checks are green).
• It also passes on the current heads of Compute sha256, sha1 and SRI digests through utils::digest (#706) #865, Fix npm 6 installing unpatched aliases (#432) #813 and Fix yarn berry project gates drifting between modes (#628, #629) #657.

No fix exists to port. I'm re-running the failed job once. If it fails again, I'll treat it as a real failure and investigate the cell's result.json in the bun-results-macos-latest-1.3.10 artifact.

---

Generated by Claude Code