Fix workspace GVS lookup for relative node_modules paths

Canonicalize nm path before walking ancestors in enclosing_pnpm_modules_yaml_sync
to handle relative paths like 'node_modules'. Without canonicalization, relative
paths have parent '.' with only one ancestor, so skip(1) yields nothing and the
workspace root's .modules.yaml is never found, causing workspace members to miss
transitive GVS copies.

Author: cursoragent

crates/socket-patch-core/src/api/ranking.rs

@@ -164,8 +164,14 @@ pub fn batch_supersedes(candidate: &BatchPatchInfo, applied: &BatchPatchInfo) ->
 /// classify a recorded patch (ALREADY vs UPGRADE) and to report
 /// `updates[]`, on the same records that pick the patch, so selection,
 /// classification and reporting cannot disagree.
-pub fn search_result_supersedes(candidate: &PatchSearchResult, recorded: &PatchSearchResult) -> bool {
-    key_supersedes(&rank_search_result(candidate), &rank_search_result(recorded))
+pub fn search_result_supersedes(
+    candidate: &PatchSearchResult,
+    recorded: &PatchSearchResult,
+) -> bool {
+    key_supersedes(
+        &rank_search_result(candidate),
+        &rank_search_result(recorded),
+    )
 }
 
 fn key_supersedes(c: &RankKey<'_>, a: &RankKey<'_>) -> bool {
@@ -371,12 +377,7 @@ mod tests {
                     "2020-01-01T00:00:00Z",
                     &["critical", "high"]
                 ),
-                search_multi(
-                    "z_new_low",
-                    "free",
-                    "2026-08-01T00:00:00Z",
-                    &["low", "low"]
-                ),
+                search_multi("z_new_low", "free", "2026-08-01T00:00:00Z", &["low", "low"]),
             ]),
             "a_old_critical"
         );

crates/socket-patch-core/src/crawlers/npm_crawler.rs

@@ -769,6 +769,7 @@ fn pnpm_global_virtual_store_of_sync(nm: &Path) -> Option<PathBuf> {
 /// The nearest `<ancestor>/node_modules/.modules.yaml` above the importer
 /// holding `nm` (a pnpm workspace root's record, for a member).
 fn enclosing_pnpm_modules_yaml_sync(nm: &Path) -> Option<PathBuf> {
+    let nm = std::fs::canonicalize(nm).ok()?;
     nm.parent()?.ancestors().skip(1).find_map(|dir| {
         let candidate = dir.join("node_modules").join(PNPM_MODULES_YAML);
         std::fs::symlink_metadata(&candidate)

crates/socket-patch-core/src/crawlers/python_crawler.rs

@@ -590,9 +590,7 @@ async fn pdm_saved_interpreter(cwd: &Path) -> Option<PathBuf> {
     let saved = match read_regular_to_string(&cwd.join(".pdm-python")).await {
         Ok(text) => text.trim().to_string(),
         Err(_) => {
-            let text = read_regular_to_string(&cwd.join(".pdm.toml"))
-                .await
-                .ok()?;
+            let text = read_regular_to_string(&cwd.join(".pdm.toml")).await.ok()?;
             let doc = text.parse::<toml_edit::DocumentMut>().ok()?;
             doc.get("python")?.get("path")?.as_str()?.trim().to_string()
         }
@@ -3215,7 +3213,11 @@ mod tests {
         fake_venv(&tmp.path().join("uv-env"), "venv");
         let uv_env = env_of(&[(
             "UV_PROJECT_ENVIRONMENT",
-            tmp.path().join("uv-env").join("venv").to_string_lossy().into_owned(),
+            tmp.path()
+                .join("uv-env")
+                .join("venv")
+                .to_string_lossy()
+                .into_owned(),
         )]);
         assert_eq!(
             find_local_venv_site_packages_with(&project, &uv_env).await,

crates/socket-patch-core/src/formats/cargo/mod.rs

@@ -34,7 +34,6 @@ use crate::utils::purl::simple_purl;
 use crate::vendor::cargo_tag;
 use crate::vendor::lock_inventory::{LockIntegrity, LockfileEntry, SourceKind};
 
-
 // ── entry model ──
 
 /// The `[metadata]` key a v1 lock files `name`+`version`'s checksum under.
@@ -332,7 +331,6 @@ pub(crate) fn parse_ref(spelled: &str) -> (&str, Option<&str>, Option<&str>) {
     (name, version, source)
 }
 
-
 // ── the model ──
 
 /// One `Cargo.lock`, parsed once (see the module docs).
@@ -500,7 +498,13 @@ impl CargoLock {
         uuid: &str,
         copy_tagged: bool,
     ) -> CopyClaim<'_> {
-        vendored_copy_claim(&self.packages, &self.unused, name, version, uuid, copy_tagged)
+        vendored_copy_claim(
+            &self.packages,
+            &self.unused,
+            name,
+            version,
+            uuid,
+            copy_tagged,
+        )
     }
 }
-

crates/socket-patch-core/src/formats/composer/mod.rs

@@ -22,7 +22,6 @@ use crate::utils::digest::sha1_hex;
 use crate::vendor::lock_inventory::{http_url, LockIntegrity, LockfileEntry, SourceKind};
 use crate::vendor::path::{parse_vendor_path, VendorPathParts};
 
-
 // ── entry model ──
 
 /// One entry of a parsed `composer.lock` (see [`composer_lock_packages`]).
@@ -107,7 +106,6 @@ pub(crate) fn composer_lock_packages(doc: &Value) -> Vec<ComposerLockPackage<'_>
     out
 }
 
-
 // ── the model ──
 
 /// One `composer.lock`, read once (see the module docs).
@@ -177,4 +175,3 @@ impl<'a> ComposerLock<'a> {
         out
     }
 }
-

crates/socket-patch-core/src/formats/gem/hosted.rs

@@ -304,4 +304,3 @@ pub(crate) fn checksum_entry_span(lock: &str, name: &str, version: &str) -> Opti
     }
     None
 }
-

crates/socket-patch-core/src/formats/gem/mod.rs

@@ -27,7 +27,6 @@ use crate::utils::digest::sha256_hex;
 use crate::utils::purl::simple_purl;
 use crate::vendor::lock_inventory::{http_url, LockIntegrity, LockfileEntry, SourceKind};
 
-
 /// The Bundler lockfiles, legacy spelling first: `Gemfile.lock` and
 /// `gems.locked` (what bundler writes instead when the manifest is
 /// `gems.rb`).
@@ -208,7 +207,6 @@ impl<'t> GemfileLock<'t> {
     }
 }
 
-
 /// Where a rubygems-compatible registry at `base` (no trailing `/`) serves
 /// `name`-`version`'s `.gem` — the inventory's resolved URL and ledger
 /// recovery's fetch URL. `None` for a non-http(s) base.

crates/socket-patch-core/src/formats/mod.rs

@@ -26,13 +26,13 @@
 //! [`registry()`] is the one table of which project files carry a lock or
 //! its wiring, and in which roles.
 
+pub(crate) mod bun;
 pub mod cargo;
 pub mod composer;
 pub mod gem;
 pub(crate) mod maven;
 pub(crate) mod nuget;
 pub mod pnpm;
-pub(crate) mod bun;
 pub mod registry;
 pub mod yarn;
 
@@ -81,7 +81,11 @@ mod architecture_tests {
                 .filter(|l| !l.trim_start().starts_with("//"))
                 .collect::<Vec<_>>()
                 .join("\n");
-            let used: Vec<&str> = IMPURE.iter().copied().filter(|n| code.contains(n)).collect();
+            let used: Vec<&str> = IMPURE
+                .iter()
+                .copied()
+                .filter(|n| code.contains(n))
+                .collect();
             assert!(
                 used.is_empty(),
                 "{}: a format model uses {used:?} — models are pure (module docs)",

crates/socket-patch-core/src/formats/pnpm/mod.rs

@@ -39,7 +39,6 @@ use crate::utils::digest::is_sri_pin;
 use crate::vendor::lock_inventory::{http_url, LockIntegrity, LockfileEntry};
 use crate::vendor::path::parse_vendor_path;
 
-
 // ── entry model ──
 
 /// One `packages:` entry of a pnpm lock, read with the entry grammar
@@ -283,7 +282,10 @@ fn lock_versions(text: &str) -> impl Iterator<Item = (Option<u32>, u32)> + '_ {
         let value = rest.trim().trim_matches(|c| c == '\'' || c == '"');
         let mut parts = value.split('.');
         let major = parts.next().and_then(|m| m.parse::<u32>().ok());
-        let minor = parts.next().and_then(|m| m.parse::<u32>().ok()).unwrap_or(0);
+        let minor = parts
+            .next()
+            .and_then(|m| m.parse::<u32>().ok())
+            .unwrap_or(0);
         Some((major, minor))
     })
 }
@@ -303,7 +305,8 @@ pub fn lock_version_major(text: &str) -> Option<u32> {
 /// rejects it): a `shrinkwrapVersion` lock (pnpm 1–2) or lockfileVersion
 /// 5.0–5.2 (pnpm 3–5). Later locks never get the `--store` note.
 pub fn may_need_store_flag(text: &str) -> bool {
-    text.lines().any(|line| line.starts_with("shrinkwrapVersion:"))
+    text.lines()
+        .any(|line| line.starts_with("shrinkwrapVersion:"))
         || lock_versions(text).any(|(major, minor)| major == Some(5) && minor <= 2)
 }
 
@@ -491,7 +494,9 @@ pub(crate) fn vendored_npm_uuids(text: &str) -> HashSet<String> {
         if !in_section {
             continue;
         }
-        if let Some(uuid) = lines::parse_key_line(line, 2).and_then(|(key, _, _)| vendored_npm_uuid(key)) {
+        if let Some(uuid) =
+            lines::parse_key_line(line, 2).and_then(|(key, _, _)| vendored_npm_uuid(key))
+        {
             out.insert(uuid);
         }
     }
@@ -508,17 +513,52 @@ mod tests {
     fn resolves_reads_every_key_generation_boundary_anchored() {
         let lock = |keys: &str| format!("lockfileVersion: '9.0'\n\npackages:\n\n{keys}");
         let yes = [
-            ("  left-pad@1.3.0:\n    resolution: {integrity: sha512-x}\n", "left-pad", "1.3.0"),
-            ("  /left-pad@1.3.0:\n    resolution: {}\n", "left-pad", "1.3.0"),
-            ("  /left-pad/1.3.0:\n    resolution: {}\n", "left-pad", "1.3.0"),
-            ("  'left-pad@1.3.0(react@18.0.0)':\n    dev: false\n", "left-pad", "1.3.0"),
-            ("  /left-pad/1.3.0_react@18.0.0:\n    dev: false\n", "left-pad", "1.3.0"),
-            ("  '@scope/name@1.0.0':\n    dev: false\n", "@scope/name", "1.0.0"),
-            ("  /@scope/name@1.0.0:\n    dev: false\n", "@scope/name", "1.0.0"),
-            ("  /@scope/name/1.0.0:\n    dev: false\n", "@scope/name", "1.0.0"),
+            (
+                "  left-pad@1.3.0:\n    resolution: {integrity: sha512-x}\n",
+                "left-pad",
+                "1.3.0",
+            ),
+            (
+                "  /left-pad@1.3.0:\n    resolution: {}\n",
+                "left-pad",
+                "1.3.0",
+            ),
+            (
+                "  /left-pad/1.3.0:\n    resolution: {}\n",
+                "left-pad",
+                "1.3.0",
+            ),
+            (
+                "  'left-pad@1.3.0(react@18.0.0)':\n    dev: false\n",
+                "left-pad",
+                "1.3.0",
+            ),
+            (
+                "  /left-pad/1.3.0_react@18.0.0:\n    dev: false\n",
+                "left-pad",
+                "1.3.0",
+            ),
+            (
+                "  '@scope/name@1.0.0':\n    dev: false\n",
+                "@scope/name",
+                "1.0.0",
+            ),
+            (
+                "  /@scope/name@1.0.0:\n    dev: false\n",
+                "@scope/name",
+                "1.0.0",
+            ),
+            (
+                "  /@scope/name/1.0.0:\n    dev: false\n",
+                "@scope/name",
+                "1.0.0",
+            ),
         ];
         for (keys, name, version) in yes {
-            assert!(PnpmLock::parse(&lock(keys)).resolves(name, version), "{keys}");
+            assert!(
+                PnpmLock::parse(&lock(keys)).resolves(name, version),
+                "{keys}"
+            );
         }
         let no = [
             ("  left-pad@1.3.0-beta.1:\n    dev: false\n", "left-pad", "1.3.0"),
@@ -534,7 +574,10 @@ mod tests {
             ),
         ];
         for (keys, name, version) in no {
-            assert!(!PnpmLock::parse(&lock(keys)).resolves(name, version), "{keys}");
+            assert!(
+                !PnpmLock::parse(&lock(keys)).resolves(name, version),
+                "{keys}"
+            );
         }
         // Keys outside `packages:` (importers, overrides) resolve nothing.
         let importers = "lockfileVersion: '9.0'\n\nimporters:\n\n  left-pad@1.3.0:\n    x: y\n";
@@ -557,7 +600,10 @@ mod tests {
             let other = "22222222-2222-4222-8222-222222222222";
             assert!(!PnpmLock::parse(text).vendored_in_use(other));
             let crlf = text.replace('\n', "\r\n");
-            assert!(PnpmLock::parse(&crlf).vendored_in_use(UUID), "CRLF reads like LF");
+            assert!(
+                PnpmLock::parse(&crlf).vendored_in_use(UUID),
+                "CRLF reads like LF"
+            );
         }
         // An overrides declaration alone is not usage.
         let overrides = format!(

crates/socket-patch-core/src/formats/registry.rs

@@ -67,7 +67,11 @@ const fn row(path: &'static str, ecosystem: &'static str, roles: u8) -> FormatFi
 const REGISTRY: &[FormatFile] = &[
     // ── npm family ──
     row("package-lock.json", "npm", HOSTED | VENDORED | PROBE | ROOT),
-    row("npm-shrinkwrap.json", "npm", HOSTED | VENDORED | PROBE | ROOT),
+    row(
+        "npm-shrinkwrap.json",
+        "npm",
+        HOSTED | VENDORED | PROBE | ROOT,
+    ),
     row(
         "pnpm-lock.yaml",
         "npm",
@@ -118,7 +122,11 @@ const REGISTRY: &[FormatFile] = &[
     row(".cargo/config", "cargo", HOSTED | VENDORED | PROBE),
     // ── composer ──
     row("composer.json", "composer", VENDORED),
-    row("composer.lock", "composer", HOSTED | VENDORED | PROBE | ROOT),
+    row(
+        "composer.lock",
+        "composer",
+        HOSTED | VENDORED | PROBE | ROOT,
+    ),
     // ── nuget ──
     row("nuget.config", "nuget", HOSTED | PROBE),
     row("NuGet.config", "nuget", HOSTED | PROBE),
@@ -213,7 +221,11 @@ mod tests {
         paths.dedup();
         assert_eq!(before, paths.len(), "duplicate registry path");
         for f in REGISTRY.iter().filter(|f| f.has(ROOT)) {
-            assert!(!f.path.contains('/'), "{}: a root marker is a basename", f.path);
+            assert!(
+                !f.path.contains('/'),
+                "{}: a root marker is a basename",
+                f.path
+            );
         }
     }