Fix pipenv_reads_pylock to honor higher-priority tool locks

Pipenv should not read a pylock.toml when uv.lock or poetry.lock (higher-
priority locks in the PyPI precedence order) are present. Previously,
pipenv_reads_pylock only checked for Pipfile and the absence of Pipfile.lock,
causing it to refuse the pylock even when a governing uv.lock or poetry.lock
existed. This poisoned sibling confirmation by inserting uuids into
refused_python_lock_uuids, making hosted and vendored disagree about whether
files were redirected.

The fix adds checks for uv.lock and poetry.lock presence, aligning the hosted
behavior with the vendored router which already filters Pipenv pylocks when a
higher-ranked tool lock governs.

Author: cursoragent

crates/socket-patch-core/src/crawlers/cargo_crawler.rs

@@ -300,8 +300,7 @@ fn read_crate_cargo_toml(crate_path: &Path, dir_name: &str) -> Option<(String, S
     let content = crate::utils::fs::read_regular_to_string_sync(&cargo_toml_path).ok()?;
 
     // Fallback: parse directory name as <name>-<version>
-    package_name_version(&content)
-        .or_else(|| CargoCrawler::parse_dir_name_version(dir_name))
+    package_name_version(&content).or_else(|| CargoCrawler::parse_dir_name_version(dir_name))
 }
 
 impl Default for CargoCrawler {

crates/socket-patch-core/src/formats/mod.rs

@@ -29,8 +29,8 @@
 pub(crate) mod bun;
 pub mod cargo;
 pub mod composer;
-pub mod governing_locks;
 pub mod gem;
+pub mod governing_locks;
 pub(crate) mod maven;
 pub(crate) mod nuget;
 pub mod pnpm;

crates/socket-patch-core/src/hosted/memory/mod.rs

@@ -66,9 +66,9 @@ use crate::rollout::stage::{
     classify, lookup_incomplete, mark_pinned, offers_from_results, Offers, RecordedIndex, Row,
     Stage, ROLLOUT_DEFERRED,
 };
+use crate::utils::purl_key::PurlKey;
 use discover::Provider;
 use stages::{Planned, RewriteRefused, Rewritten, StageOptions};
-use crate::utils::purl_key::PurlKey;
 
 /// `"<crate version>+<git sha or 'unknown'>"`; the sha comes from the
 /// `SOCKET_PATCH_GIT_SHA` build-time variable.

crates/socket-patch-core/src/patch/redirect/mod.rs

@@ -79,9 +79,9 @@ use crate::formats::yarn::patterns::{
 use crate::formats::yarn::source::{classic_copy_source, CopySource};
 use crate::formats::yarn::stanzas::{stanza_key, BerryStanzas};
 #[cfg(test)]
-mod pnpm_equivalence_tests;
-#[cfg(test)]
 mod platform_wheel_tests;
+#[cfg(test)]
+mod pnpm_equivalence_tests;
 mod poetry;
 mod pypi_takeover;
 pub use pypi_takeover::preflight_pypi_takeover;
@@ -567,7 +567,7 @@ pub fn rewrite_registry_redirect_with_pipenv_version(
         bun_lockb_present,
         &std::collections::BTreeSet::new(),
         &std::collections::BTreeSet::new(),
-     &yarnrc::OuterYarnMirror::default(),
+        &yarnrc::OuterYarnMirror::default(),
     )
 }
 
@@ -6803,8 +6803,10 @@ fn rewrite_maven_pom(
     // One pass over the pom's repositories: `(id, url)` of each, which also
     // answers the per-dep URL-refresh check below while the pom is still
     // unchanged (a no-op rescan then never re-scans the pom per dep).
-    let original_repos: Vec<(String, Option<String>)> =
-        pom.as_deref().map(maven_repository_ids_and_urls).unwrap_or_default();
+    let original_repos: Vec<(String, Option<String>)> = pom
+        .as_deref()
+        .map(maven_repository_ids_and_urls)
+        .unwrap_or_default();
     let hosted_repo_generations: std::collections::BTreeSet<String> = original_repos
         .iter()
         .filter_map(|(id, _)| generation::pin_name_uuid(id, false).map(str::to_string))
@@ -10876,7 +10878,10 @@ mod tests {
             &[(YARNRC_REL, "yarn-offline-mirror: false\n")],
             &[(YARNRC_REL, "yarn-offline-mirror:\n")],
             &[(YARNRC_REL, "yarn-offline-mirror \"\"\n")],
-            &[(YARNRC_REL, "yarn-offline-mirror-pruning true\n# yarn-offline-mirror ./m\n")],
+            &[(
+                YARNRC_REL,
+                "yarn-offline-mirror-pruning true\n# yarn-offline-mirror ./m\n",
+            )],
             &[(npmrc::NPMRC_REL, "[scope]\nyarn-offline-mirror=./m\n")],
             &[
                 (YARNRC_REL, "yarn-offline-mirror false\n"),
@@ -10892,7 +10897,10 @@ mod tests {
             let mut r = RewriteResult::default();
             rewrite_yarn_classic(&files, std::slice::from_ref(&ovr), &mut r);
             assert!(r.warnings.is_empty(), "{rcs:?}: {:?}", r.warnings);
-            assert!(r.files["yarn.lock"].contains("http://p.test/lp.tgz"), "{rcs:?}");
+            assert!(
+                r.files["yarn.lock"].contains("http://p.test/lp.tgz"),
+                "{rcs:?}"
+            );
             assert!(r.refused_yarn_classic_uuids.is_empty(), "{rcs:?}");
         }
     }
@@ -10917,7 +10925,10 @@ mod tests {
         rewrite_yarn_classic(&files, std::slice::from_ref(&other), &mut r);
         assert!(r.refused_yarn_classic_uuids.is_empty());
         assert_eq!(
-            r.warnings.iter().map(|w| w.code.as_str()).collect::<Vec<_>>(),
+            r.warnings
+                .iter()
+                .map(|w| w.code.as_str())
+                .collect::<Vec<_>>(),
             ["redirect_yarn_classic_entry_not_found"]
         );
     }

crates/socket-patch-core/src/patch/redirect/poetry.rs

@@ -89,7 +89,9 @@ pub(super) fn rewrite_poetry(
                             new: Some(Value::String(new)),
                         });
                     }
-                    result.confirmed_python_lock_uuids.insert(dep.patch_uuid.clone());
+                    result
+                        .confirmed_python_lock_uuids
+                        .insert(dep.patch_uuid.clone());
                     if !stale_warned {
                         if let Some(format) =
                             *writer_format.get_or_insert_with(|| pre_1_4_writer(&content))
@@ -124,14 +126,18 @@ pub(super) fn rewrite_poetry(
                 }
                 // Already redirected to this artifact (idempotent re-scan).
                 LockStep::Unchanged => {
-                    result.confirmed_python_lock_uuids.insert(dep.patch_uuid.clone());
+                    result
+                        .confirmed_python_lock_uuids
+                        .insert(dep.patch_uuid.clone());
                 }
                 LockStep::NotFound => result.warnings.push(RewriteWarning {
                     code: "redirect_poetry_entry_not_found".into(),
                     detail: format!("no {path} entry for {}@{}", dep.name, dep.version),
                 }),
                 LockStep::Refused(detail) => {
-                    result.refused_python_lock_uuids.insert(dep.patch_uuid.clone());
+                    result
+                        .refused_python_lock_uuids
+                        .insert(dep.patch_uuid.clone());
                     result.warnings.push(RewriteWarning {
                         code: "redirect_poetry_lock_unsupported".into(),
                         detail: format!("{path}: {detail}"),

crates/socket-patch-core/src/patch/redirect/upstream/cargo.rs

@@ -489,6 +489,9 @@ mod tests {
         let other = format!("log = {{ version = \"0.4.20\", registry = \"socket-patch-{C}\" }}\n");
         let (outcome, after) = restore_b(&manifest(&other), &config).await;
         assert_eq!(outcome.restored().count(), 1, "{:?}", outcome.pins);
-        assert_eq!(after.as_deref().map(str::trim_start), Some(block(C).as_str()));
+        assert_eq!(
+            after.as_deref().map(str::trim_start),
+            Some(block(C).as_str())
+        );
     }
 }

crates/socket-patch-core/src/utils/group_commit.rs

@@ -1335,7 +1335,10 @@ mod tests {
             (".socket/vendor/.gitattributes", true),
             (".socket/vendor/gradle/g/a/maven-metadata.xml", true),
             (".socket/vendor/gradle/g/a/1/a-1.jar", false),
-            (".socket/vendor/gradle/g/a/1/socket-patch.vendor.json", false),
+            (
+                ".socket/vendor/gradle/g/a/1/socket-patch.vendor.json",
+                false,
+            ),
             (".socket/vendor/npm/u/left-pad-1.3.0.tgz", false),
             (".socket/manifest.json", false),
             ("packages/a/.socket/vendor/npm/u/a.tgz", false),
@@ -1437,10 +1440,16 @@ mod tests {
             if keep {
                 group.rollback_to(savepoint);
                 group.commit().await.unwrap();
-                assert!(unit.join("a.tgz").exists(), "a rolled-back removal is forgotten");
+                assert!(
+                    unit.join("a.tgz").exists(),
+                    "a rolled-back removal is forgotten"
+                );
             } else {
                 drop(group);
-                assert!(unit.join("a.tgz").exists(), "a dropped group deletes nothing");
+                assert!(
+                    unit.join("a.tgz").exists(),
+                    "a dropped group deletes nothing"
+                );
             }
         }
 
@@ -1449,8 +1458,14 @@ mod tests {
         remove_tree_and_prune(&unit, &socket).await.unwrap();
         group.commit().await.unwrap();
         assert!(!unit.exists());
-        assert!(!socket.join("vendor").exists(), "the emptied levels are pruned");
-        assert!(socket.join("apply.lock").exists(), "`.socket/` itself stays");
+        assert!(
+            !socket.join("vendor").exists(),
+            "the emptied levels are pruned"
+        );
+        assert!(
+            socket.join("apply.lock").exists(),
+            "`.socket/` itself stays"
+        );
     }
 
     /// A journal the commit had to create `.socket/vendor/` for (a hosted

crates/socket-patch-core/src/utils/python_lock.rs

@@ -186,7 +186,8 @@ pub fn is_pep751_lock_name(name: &str) -> bool {
 /// #912 / #1122: whether Pipenv installs from the PEP 751 lock `rel` (a
 /// project-relative path). A `Pipfile` beside the lock makes Pipenv the
 /// installer, and Pipenv reads a pylock only when that directory has no
-/// `Pipfile.lock`. Its reader (`PylockFile.convert_to_pipenv_lockfile`)
+/// `Pipfile.lock` and no higher-priority tool lock (`uv.lock` or
+/// `poetry.lock`). Its reader (`PylockFile.convert_to_pipenv_lockfile`)
 /// keeps a package's version, marker and wheel / sdist hashes and nothing
 /// else, so no hosted or vendored `archive` entry survives it: such a lock
 /// can't carry a patch. `exists` answers for project-relative paths.
@@ -198,6 +199,8 @@ pub fn pipenv_reads_pylock(rel: &str, exists: impl Fn(&str) -> bool) -> bool {
     is_pep751_lock_name(name)
         && exists(&format!("{dir}Pipfile"))
         && !exists(&format!("{dir}Pipfile.lock"))
+        && !exists(&format!("{dir}uv.lock"))
+        && !exists(&format!("{dir}poetry.lock"))
 }
 
 pub fn python_lock_paths(root: &Path) -> std::io::Result<Vec<String>> {

crates/socket-patch-core/src/vendor/lock_inventory/tests.rs

@@ -999,7 +999,10 @@ async fn headerless_yarn_classic_lock_is_inventoried_as_classic_by_the_fallback(
         .filter(|l| !l.starts_with('#'))
         .collect::<Vec<_>>()
         .join("\n");
-    assert!(!headerless.contains("lockfile v1"), "fixture drops the header");
+    assert!(
+        !headerless.contains("lockfile v1"),
+        "fixture drops the header"
+    );
     write(tmp.path(), "yarn.lock", &headerless).await;
     let (flavor, entries) = inventory_npm_lock(tmp.path()).await.unwrap().unwrap();
     assert_eq!(flavor, NpmLockFlavor::YarnClassic);

crates/socket-patch-core/src/vendor/mod.rs

@@ -129,8 +129,8 @@ pub use verify::{
 };
 // The hosted→vendored takeover refuses a berry project the backend would
 // refuse BEFORE it reverts the hosted redirect.
-pub use npm_lock::npm_lock_vendor_preflight;
 pub use npm_common::npm_tarball_gitignore_preflight;
+pub use npm_lock::npm_lock_vendor_preflight;
 pub use yarn_berry_lock::{yarn_berry_vendor_preflight, yarn_berry_vendor_target_preflight};
 
 use std::collections::{HashMap, HashSet};