Fix ten hosted cargo redirect bugs found by a real-cargo matrix

[Mikola Lysenko (mikolalysenko)]

Branch fix/cargo-hosted-matrix-bugs, stacked on #254 (commits are keyed by subject below; shas move on each restack) (feat/cargo-vendor-manifest-patch). 21 signed commits, 73 files, +5665/−168 — 58 of those files are new shared golden fixtures under tests/fixtures/redirect/cargo/.

Summary

Ten defects in hosted cargo redirects, every one found by running the real CLI against real cargo rather than by reading code. A 1,232-cell matrix (cargo 1.41 → stable, lock formats v1–v4, 22 project shapes, 6 modes) drove the discovery; each fix carries a real-cargo regression test and was reverted in turn to confirm the test fails without it.

Fix	What was wrong
pin and revert each cargo version separately	Multi-version: plan_cargo_toml matched a crate by name without its version, so every same-named declaration was pinned to the last patch's registry. Each version is now pinned and reverted separately.
repoint a v1 lock's [root] table	A v1 lock's [root] table kept full-id references on crates.io after the rewrite.
never pin a manifest under target/	Workspace-member discovery walked into target/, and followed symlinks out of the project — a symlinked member could be written to outside the repo.
spend one cargo edit per occurrence	A crate declared identically in two dependency tables produced two identical ledger edits, which were deduped into one; remove then reported success and left a pin and a [registries] block behind.
see a hosted pin in a workspace member	A member's own declaration was left on crates.io while the run reported the crate redirected; and the cross-mode takeover guard could not see table-form, renamed, or member-manifest pins.
restore a cargo config's exact trailing bytes	remove appended a blank line to an existing legacy .cargo/config, and left a config it had created behind. Reverts are now byte-exact, including files with no trailing newline.
remove cargo patches across line-ending changes	A CRLF-recorded ledger stopped matching once a checkout converted line endings, so remove/rollback failed.
remove each cargo version from older ledgers	Ledgers written by older CLIs could not have their first-redirected version removed.
refuse cargo requirements the patch misses	A declaration whose requirement excludes the patched version was reported not_found; it is now redirect_cargo_toml_dep_unrewritable, naming each requirement and its manifest.
refuse a lockless cargo pin	See below.

The one behaviour change to weigh

registry = "socket-patch-<uuid>" only reaches the declarations it sits on. If another package in the graph also depends on the patched crate, that package keeps resolving it from crates.io — so the build gets a patched copy for the root and an unpatched copy for everyone else, while the scan reports the crate redirected and vex attests it. That shape is now refused with redirect_cargo_transitive_dependents, pointing at --mode vendored.

Answering that question needs Cargo.lock. A project without one was previously pinned unconditionally, so the silently-wrong case was the common one — and Rust libraries routinely gitignore their lock. With no lock, refuse a lockless cargo pin answers it from the manifests instead: a crate declared beside any other dependency, or beside a workspace member this run could not read, is refused redirect_cargo_lockless_dependents.

This turns a previously-succeeding common shape into a loud skip. It is narrower than it sounds — a lockless project whose only dependency is the patched crate still redirects, and a path dependency on a manifest the same run pins does not count as company — but it is the change most likely to be noticed, and it is the one I would most like a second opinion on. The alternative is to keep silently half-patching those projects.

Cross-repo parity

redirect_cargo_transitive_dependents and redirect_cargo_toml_dep_unrewritable are the shared names; depscan's TypeScript twin adopts both in SocketDev/depscan#SERVERPR. Four new shared golden cases (requirement-excludes-patched-version, transitive-dependents-git, path-dependency, lockless-dependents) plus shared-dependency pin the contract for both implementations.

Testing

cargo test -p socket-patch-core 4922 pass, -p socket-patch-cli 4002 pass, clippy --workspace --all-features --all-targets -D warnings clean. Real-cargo suites across lock formats v1–v4 including e2e_redirect_cargo_shapes 8/8 each, plus the docker 1.41/1.56 legs 14/14.

One trap worth recording: cargo test -p socket-patch-cli --test <name> does not re-uplift debug/socket-patch, so two worktrees sharing a CARGO_TARGET_DIR will silently run each other's binary — e2e_redirect_cargo_shapes reported 0/8 four times before that was spotted. The suites now assert the binary's identity before running.

---

Note

High Risk
Changes hosted cargo lockfile/manifest rewriting and introduces new skip/refusal paths (including lockless projects with multiple deps), which can break workflows that previously appeared to succeed while building mixed patched/unpatched graphs.

Overview
Hosted cargo redirects are reworked so pins stay consistent with what cargo --locked actually resolves: workspace-member and in-root path Cargo.toml files are included in the same transaction as the root, semver-aware pinning applies per declaration when multiple versions of a crate are locked, and v1 Cargo.lock handling repoints [root] plus dependent full-ids via a dedicated redirect_cargo_lock_reference edit (so remove works in any order).

Fail-closed refusals replace cases that previously reported success while leaving unpatched copies in the graph: redirect_cargo_transitive_dependents when another lock package also depends on the crate, redirect_cargo_lockless_dependents when there is no Cargo.lock but other dependencies (or unread workspace members) might pull the crate in, and clearer redirect_cargo_toml_dep_unrewritable when requirements do not match the patched version. CRLF cargo files are rewritten with endings preserved; ledger recording no longer collapses duplicate manifest edits from two dependency sections, and appended .cargo/config fragments revert byte-for-byte.

Adds cargo_workspace::member_manifests, wires it into scan --mode hosted, extends CI with e2e_redirect_cargo_shapes, and documents the contract in CHANGELOG / CLI_CONTRACT.

^{Reviewed by Cursor Bugbot for commit 92ad228. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 92ad228. Configure here.}