Stop re-parsing bun lock entries for every patch in scan (#580)

[Mikola Lysenko (mikolalysenko)]

Fixes the bun scan slowdown reported on #580. The hosted and vendored bun paths were re-parsing each lock entry's JSON on every (patch, entry) pair.

Why

The maintainer asked on #580 whether the bun regression came from a bug fix or from wasted work. It is mostly wasted work that came in with a real fix. The slowdown was bisected to #472 (1169ae6), which correctly stopped rewriting Bun {"bundled": true} entries. The fix is legitimate, but it ran is_bundled_entry, a full serde_json parse of the entry's meta object, before the cheap spec comparison. That parse ran once per (patch, entry) pair: about 3,000 entries × 127 patches ≈ 380k JSON parses per scan. bun/hosted went from 144 to 302 ms; the request count was unchanged, so the cost is all CPU.

Change

• rewrite_bun_lock (redirect/mod.rs): decode each entry's spec once per lock and compare it first. The bundled flag is computed lazily, and cached per entry, only for entries whose spec matches a patch.
• classify_rewritable / bundled_matches (vendor/bun_lock.rs): classify first, and parse meta only for entries that match.
• is_bundled_entry (bun_lock_text.rs): fast path that skips the JSON parse when the meta never spells bundled and contains no backslash, so an escaped key still goes through the parse. Malformed meta that mentions bundled still fails closed.

The behavior from #472 is kept: bundled entries are still skipped, warned about and left out of VEX.

Results

• rewrite_bun_lock microbench on the bench fixture: 177.2 ms → 4.4 ms.
• Expected bun/hosted recovery: about 140 ms, back to the pre-Fix Bun/vlt bundled copies left unpatched (#469, #471) #472 baseline. The bench routine will confirm it on its next A/B run.

Refs #578, #580. The bench tracking issue stays open.

🤖 Generated with Claude Code

---

Note

Low Risk
Behavior-preserving performance refactor with regression tests; bundled skip/warn/VEX rules unchanged from #472.

Overview
Fixes #580 bun scan slowdown by avoiding redundant work on every patch×lock-entry pair while keeping #472 bundled-entry skip semantics.

rewrite_bun_lock now decodes each entry’s spec once per lock and caches whether an entry is bundled only after a cheap spec match, instead of JSON-parsing meta on every patch loop. Vendoring (classify_rewritable, bundled_matches) uses the same order: classify first, then is_bundled_entry. is_bundled_entry adds a substring fast path that skips serde_json when the meta cannot contain a bundled key (still parsing when a backslash might hide an escaped key).

New tests lock in that bundled warnings/VEX skipping apply only to matching specs, and that the fast path matches the full parse.

^{Reviewed by Cursor Bugbot for commit fe5a42a. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] Merged main, CI green; ready for review.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent).

• Head: fe5a42a7ae5f1642857e75d8b2fbdacdbcdbafe7
• CI: 515/515 check runs green (success/skipped/neutral) on this head, mergeable, no conflicts.
• Bugbot: reviewed this head (Cursor Bugbot check: success), no unresolved review threads.
• Changelog: untouched.

Nothing specific flagged for the reviewer beyond the PR description.

---

Generated by Claude Code