Fix hosted Maven pom edits outside live markup (#259, #262, #342)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #259
Fixes #262
Fixes #342

Summary

scan / get --mode hosted for a Maven pom could edit markup Maven never reads for the project, suffix artifacts the patch server does not serve, or write a second top-level section that Maven refuses. Every one of these exited 0 with redirected: 1 and no warning. After this PR the hosted rewriter reads the pom the way Maven builds the project, and the same way vex reads it.

Root cause

rewrite_maven_pom (patch/redirect/mod.rs) found its edit points with raw text anchors:

• a bare <dependency>…</dependency> regex for matches,
• pom.contains("<repositories>") for the repository,
• a <dependencyManagement>\s*<dependencies> regex for the transitive pin.

None of these skipped comments, <profiles> or <build> plugin dependencies, none recognized self-closed sections, and the matcher never read <classifier>.

Fix

• formats::maven::PomScope (new, shared). It blanks comments and CDATA (offsets kept) and excludes <build>, <reporting>, <pluginRepositories>, <distributionManagement> and <profiles>. parse_pom (which VEX discovery uses) now runs on it, so the rewriter and VEX read the same scope. ScopedDep carries the <classifier> and the version byte range.
• Matches (Hosted Maven rewriter edits commented-out, plugin and profile markup, so builds either stay unpatched or break #259 a/c, Hosted Maven rewriter ignores <classifier> and suffixes sources/tests/native classifier dependencies, which breaks the build #262): only live, classifier-less declarations decide between rewriting the literal and adding the depMgmt pin.
  • A classifier variant (sources, tests, a native build) keeps its version. Warning: redirect_maven_classifier_unsupported.
  • A base literal inside <profiles> is not edited. Warning: redirect_maven_profile_dependency_unpatched. If a profile holds the GA's only declaration, the dep is skipped. This keeps the existing maven_profile_scoped_dependency_is_not_redirected contract.
  • A GA that is declared only in a comment or a plugin counts as transitive and gets the top-level pin.
• Anchors (Hosted Maven rewriter edits commented-out, plugin and profile markup, so builds either stay unpatched or break #259 b/d/e, Maven pom rewrites add a second <repositories> or <dependencyManagement> section when the existing one is self-closed or has a comment before <dependencies>, so Maven refuses the pom #342): insert_maven_repository and insert_maven_dependency_management target only the project's own top-level sections.
  • A self-closed <repositories/>, <dependencyManagement/> or <dependencies/> is expanded in place.
  • A comment between <dependencyManagement> and <dependencies> no longer hides the section.
  • The "repository already present" and URL-refresh checks count only live repositories.
  • A pom that is not readable as one is left untouched. Warning: redirect_maven_pom_unreadable.
• Performance: the rewriter reads the pom once into a PomIndex (patch/redirect/maven_index.rs) and keeps its offsets in step with its own edits, instead of rescanning the pom for every patched dependency.
  • This fixes the scan performance regression the first push showed: maven/hosted +35%, maven/rescan +25%.
  • Local probe, 1000 patched dependencies in one pom, release build:
    • main: 1.70 s first scan, 0.96 s rescan.
    • First push: 4.68 s / 3.33 s.
    • Now: 25 ms / 9.5 ms.
  • edits_keep_the_index_in_step checks the kept index against a fresh build after every kind of edit.
• Upstream restore (rollback): it recognizes a pin the rewriter added past a comment. It also counts "the GA's only literal" in the same scope, so a classifier or profile sibling doesn't make an authored pin look like the user's.
• VEX discovery: a classifier variant neither pins nor shadows the main jar, so what the rewriter reports as redirected, vex attests.
• Docs: docs/ecosystems.md (hosted Maven caveats) and CLI_CONTRACT.md (new warning codes, scope).

#342, vendored row: this is already fixed on main. v5 vendors every pom root through the reactor planner (vendor/jvm/maven_reactor.rs), which expands self-closed sections. See the existing test single_line_poms_and_self_closing_sections. The retired maven_repo.rs single-pom backend only reverts now.

Not in this PR: the depscan TS twin (registry-rewrite/maven-pom.ts) lives in another repo. The new shared goldens under tests/fixtures/redirect/maven/pom/ are what it needs to match.

Per-issue checklist

• Hosted Maven rewriter edits commented-out, plugin and profile markup, so builds either stay unpatched or break #259 (comments, profiles, plugins). Goldens: comment-dependency (a), profile-repositories (b), plugin-dependency (c), profile-depmgmt (d), commented-repositories (e), profile-literal.
• Hosted Maven rewriter ignores <classifier> and suffixes sources/tests/native classifier dependencies, which breaks the build #262 (classifier). Goldens: classifier-sources-sibling and classifier-only-transitive-main. Each gets a VEX attestation in every_fail_closed_rewriter_fixture_yields_the_patch_uuid_not_the_token.
• Maven pom rewrites add a second <repositories> or <dependencyManagement> section when the existing one is self-closed or has a comment before <dependencies>, so Maven refuses the pom #342 (duplicate sections). Goldens: self-closed-repositories, depmgmt-comment, self-closed-depmgmt.
• Restore coverage:
  • scoped_rewrites_round_trip and expanded_self_closed_sections_restore_to_one_empty_section (upstream/maven.rs).
  • The maven_goldens_round_trip corpus.
• Scanner unit test: scope_skips_comments_and_plugin_sections_and_flags_profiles.

Red → green

On origin/main (a8e9397), with the new fixtures copied in:

• redirect_golden fails on the first new case (classifier-only-transitive-main: pom.xml byte-mismatch).
• A per-case dump showed all 11 new cases differ from the expected output. Only the depMgmt cases warned, and only with redirect_maven_dep_management_added.

On this branch all of them pass.

Commands run

• cargo test -p socket-patch-core (full, --no-fail-fast): green after the restore-golden exclusion for the two self-closed cases.
• cargo test -p socket-patch-cli (default features): green except two e2e_vendor_cargo_build old-toolchain cases. Those depend on locally installed old cargo toolchains and are unrelated to this change.
• cargo test -p socket-patch-cli --test e2e_redirect_maven_build -- --ignored with real Maven 3.9.16: green.
• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo fmt --all -- --check: clean for the changed files. Local rustfmt flags only the untouched upstream/mod.rs:917.

🤖 Generated with Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1bbdd63. Configure here.}