Hosted NuGet mapping reads commented-out package sources

[mikolalysenko]

[agent] Filed by the scheduled architecture audit routine (ecosystems and formats). Register: #560 (comment).

Kind: bug. Source: review §1 #5; Part 5.4; register E01 (first step of E11).

Problem

The hosted NuGet rewriter reads the pre-existing <packageSources> keys with two regexes over the raw XML and never masks <!-- … -->:

• redirect/mod.rs#L4343-L4376:`` NUGET_PACKAGE_SOURCES_REGION_RE, `NUGET_ADD_KEY_RE` and `nuget_package_source_keys`.
• add_nuget_source (#L4159-L4231) uses those keys for two decisions. It skips seeding nuget.org when the list is non-empty (seed_nuget_org = creating_mapping && pre_existing_keys.is_empty()). It also fans <package pattern="*" /> out to every key in the list.

The other two readers of the same file both skip comments:

• formats::nuget::parse_config (formats/nuget/mod.rs#L51-L91) is a real tag walk. It is already used by hosted restore (upstream/nuget.rs#L26) and by VEX (vex/discover/nuget.rs#L77).
• The vendored writer calls blank_comments before parse_config_source_keys (vendor/nuget_feed.rs#L1014-L1075).``

So hosted forward and hosted restore disagree about the same nuget.config.

Reproduced on d63ae5f (a unit test in redirect/mod.rs, run twice). The input is a nuget.config whose only source is commented out:

<configuration>
  <packageSources>
    <!-- <add key="old" value="https://old.example/v3/index.json" /> -->
  </packageSources>
</configuration>

nuget_package_source_keys(cfg)        = ["old"]
formats::nuget::parse_config(cfg).sources = []
add_nuget_source(cfg, "socket", …, "Foo") →
  sources  (per formats::nuget) = [("socket", …)]
  mappings (per formats::nuget) = [("socket", ["Foo"]), ("old", ["*"])]

The comment counts as a pre-existing source, so nuget.org is never seeded. The catch-all * goes to old, which is not a source in this file. Once the mapping exists it is exclusive, so restore of every other package then depends on a key that NuGet does not read from this file. A commented <packageSources> block placed before the real one is mis-read the same way, because NUGET_PACKAGE_SOURCES_REGION_RE captures the first match.

Symptoms

None filed for the comment case. Related, but a different defect: #354 (the * fan-out ignores sources inherited from parent and user configs) and #462. Both live in the same function.

Impact: any hosted NuGet project whose nuget.config has commented-out sources (common in templates and docs) can get a mapping that routes * to a source this file doesn't define. That breaks restore or sends packages to the wrong feed. Size: small.

Proposed change

• Compute pre_existing_keys from formats::nuget::parse_config(config): its sources keys, minus disabled if that matches the vendored behavior. Do this when the parse returns None (malformed config): skip the dep fail-closed, as the other readers do.
• Delete nuget_package_source_keys and NUGET_ADD_KEY_RE, plus NUGET_PACKAGE_SOURCES_REGION_RE if nothing else uses it.
• Out of scope: the splice anchors (insert_nuget_source, nuget_mapping_open_end) are also regex-based. Moving them onto a span-aware formats::nuget model is E10/E11 follow-up work. Note in the PR whether insert_nuget_source's open-tag regex can match inside a comment; if it can, file that as a separate issue.

Size and scope

crates/socket-patch-core/src/patch/redirect/mod.rs only. About −30 / +15 production lines, plus tests.

Acceptance criteria

• nuget_package_source_keys is gone, and hosted forward reads sources through formats::nuget::parse_config.
• Regression test: a config whose only source is commented out seeds nuget.org and maps * only to defined sources.
• Regression test: a commented <packageSources> block before the real one, plus a commented <add> beside real ones, both yield the real keys only.
• Regression test: a malformed config refuses the dep and authors no mapping.
• The existing hosted NuGet tests, group_equivalence_tests, and the hosted/memory parity tests stay green.

Dependencies

Blocked by nothing. This is the first step of the E11 consolidation (one NuGet config reader). The vendored parse_config_source_keys is the next one.

[mikolalysenko]

[agent] Triage: priority:p3 (NuGet). Confirmed on main: nuget_package_source_keys (patch/redirect/mod.rs:4357) regex-scans raw XML without masking comments, while restore and VEX use formats::nuget::parse_config. Distinct from #462/#354 (mapping exclusivity / inherited sources); no open PR covers it.

---

Generated by Claude Code

[mikolalysenko]

[agent] Shares root cause with #585: the hosted NuGet rewriter (add_nuget_source in patch/redirect/mod.rs) runs every regex lookup (source keys, the <packageSources> / <packageSourceMapping> splice anchors) on the raw nuget.config text instead of comment-masked text. Will be fixed together.

---

Generated by Claude Code

[mikolalysenko]

[agent] Re-checked on main 203e092: still present. The code moved, so here are fresh permalinks. nuget_package_source_keys still regex-scans the raw nuget.config, and it is called from add_nuget_source and rewrite_nuget.

The splice-anchor half that this issue's "Out of scope" note mentions is now #585. The wider unification (hosted, vendored and restore readers and anchors on formats::nuget) is #594, which this issue can land ahead of.

---

Generated by Claude Code

[mikolalysenko]

[agent] Open PR #597 addresses this (together with #585) by moving the hosted NuGet reader and splice anchors onto formats::nuget. Leaving open until it merges.

---

Generated by Claude Code