Guard old Hatch environment installers

Require Hatch 1.2 or later for vendored environment dependencies,
whose root placeholders older releases cannot expand. Exercise
rollback after newline conversion and refuse symlinked manifests.

Assisted-by: Codex:gpt-6-astra

Author: mikolalysenko

crates/socket-patch-core/src/patch/redirect/replay.rs

@@ -748,6 +748,28 @@ mod tests {
         tokio::fs::read_to_string(root.join(rel)).await.unwrap()
     }
 
+    #[tokio::test]
+    async fn hatch_documents_revert_after_checkout_newline_conversion() {
+        let original = "[project]\ndependencies=[\"one==1\"]\n[tool.hatch.envs.default]\n";
+        let files = [("pyproject.toml".to_owned(), original.to_owned())].into_iter().collect();
+        let patched = crate::utils::hatch::rewrite(&files, "one", "1", "https://patch.test/one.whl").unwrap().remove("pyproject.toml").unwrap();
+        for drift in [false, true] {
+            let dir = TempDir::new().unwrap();
+            let live = if drift {patched.replace("one.whl", "changed.whl")} else {patched.replace('\n', "\r\n")};
+            write(dir.path(), "pyproject.toml", &live).await;
+            let mut state = state_with(vec![edit("pyproject.toml", "redirect_hatch_document", "rewritten", Some(original), Some(&patched))], &["pkg:pypi/one@1"]);
+            let outcome = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
+            assert_eq!(outcome.fully_reverted(), !drift);
+            if drift {
+                assert_eq!(read(dir.path(), "pyproject.toml").await, live);
+                assert_eq!(state.edits.len(), 1);
+            } else {
+                assert_eq!(read(dir.path(), "pyproject.toml").await, original.replace('\n', "\r\n"));
+                assert!(state.edits.is_empty());
+            }
+        }
+    }
+
     // ---------- ReplaceFragment ----------
 
     #[tokio::test]

crates/socket-patch-core/src/utils/hatch.rs

@@ -23,6 +23,42 @@ pub fn is_hatch(files: &BTreeMap<String, String>) -> bool {
         })
 }
 
+pub fn has_environment_dependency(files: &BTreeMap<String, String>, name: &str) -> bool {
+    let external = files
+        .get("hatch.toml")
+        .and_then(|text| text.parse::<DocumentMut>().ok());
+    let project = files
+        .get("pyproject.toml")
+        .and_then(|text| text.parse::<DocumentMut>().ok());
+    let environments = external
+        .as_ref()
+        .and_then(|document| document.get("envs"))
+        .or_else(|| {
+            project
+                .as_ref()
+                .and_then(|document| document.get("tool"))
+                .and_then(|tool| tool.get("hatch"))
+                .and_then(|hatch| hatch.get("envs"))
+        });
+    environments
+        .and_then(Item::as_table_like)
+        .is_some_and(|environments| {
+            environments.iter().any(|(_, environment)| {
+                ["dependencies", "extra-dependencies"].iter().any(|key| {
+                    environment
+                        .get(key)
+                        .and_then(Item::as_array)
+                        .is_some_and(|dependencies| {
+                            dependencies.iter().filter_map(Value::as_str).any(|spec| {
+                                canonicalize_pypi_name(pep508_name(spec))
+                                    == canonicalize_pypi_name(name)
+                            })
+                        })
+                })
+            })
+        })
+}
+
 fn replacement(spec: &str, name: &str, version: &str, url: &str) -> Result<Option<String>, String> {
     let declared = pep508_name(spec);
     if canonicalize_pypi_name(declared) != name {

crates/socket-patch-core/src/vendor/pypi_hatch.rs

@@ -98,6 +98,9 @@ pub(super) async fn load(
         });
     let changes = hatch::rewrite(&files, name, version, &url)
         .map_err(|error| ("pypi_hatch_unsupported", error))?;
+    if hatch::has_environment_dependency(&files, name) {
+        require_environment_context_support(root).await?;
+    }
     let in_sync = pin.is_some() && changes.is_empty();
     Ok(HatchProject {
         files,
@@ -106,6 +109,30 @@ pub(super) async fn load(
     })
 }
 
+async fn require_environment_context_support(root: &Path) -> Result<(), Failure> {
+    let output = tokio::time::timeout(
+        std::time::Duration::from_secs(10),
+        tokio::process::Command::new("hatch")
+            .arg("--version")
+            .current_dir(root)
+            .stdin(std::process::Stdio::null())
+            .kill_on_drop(true)
+            .output(),
+    )
+    .await;
+    if let Ok(Ok(output)) = output {
+        if output.status.success()
+            && String::from_utf8_lossy(&output.stdout)
+                .split_whitespace()
+                .filter_map(|word| semver::Version::parse(word).ok())
+                .any(|version| version >= semver::Version::new(1, 2, 0))
+        {
+            return Ok(());
+        }
+    }
+    Err(("pypi_hatch_unsupported", "vendored environment dependencies require Hatch >=1.2 on PATH for root URI expansion; upgrade Hatch or use the install hook".into()))
+}
+
 async fn write_files(
     root: &Path,
     original: &BTreeMap<String, String>,
@@ -317,6 +344,18 @@ mod tests {
         assert!(load(root, "one", "1", UUID).await.unwrap().in_sync);
     }
 
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn symlinked_configuration_is_refused_without_touching_target() {
+        let temp = tempfile::tempdir().unwrap();
+        let external = tempfile::tempdir().unwrap();
+        let target = external.path().join("pyproject.toml");
+        tokio::fs::write(&target, ORIGINAL).await.unwrap();
+        std::os::unix::fs::symlink(&target, temp.path().join("pyproject.toml")).unwrap();
+        assert!(load(temp.path(), "one", "1", UUID).await.is_err());
+        assert_eq!(tokio::fs::read_to_string(target).await.unwrap(), ORIGINAL);
+    }
+
     #[tokio::test]
     async fn concurrent_edits_are_not_overwritten() {
         let temp = tempfile::tempdir().unwrap();

docs/testing/hatch.md

@@ -6,6 +6,8 @@ Hatch environment `dependencies` / `extra-dependencies`. External
 `hatch.toml` tables override the corresponding top-level `tool.hatch` keys.
 Project references enable Hatchling's `allow-direct-references` setting.
 Vendored references use `{root:uri}` so checkouts remain relocatable.
+Environment references require Hatch >=1.2 on PATH; preflight verifies the
+installed version because Hatch 1.0 and 1.1 do not expand that context.
 Both modes pin the wheel SHA-256, preserve extras, markers, comments and
 line endings, and record reversible document edits.