Fix Cargo hosted workspace redirects

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Codex:gpt-6-astra

Hosted Cargo patches incorrectly reject workspace-inherited dependency aliases and can mistake an editable local package for a different version outside the project. Quoted dependency values and annotated registry tables also bypass parts of the rewriter, leaving declarations unpatched or producing duplicate TOML tables on reruns.

Root Cause

Workspace references were filtered by their local alias before resolving the root definition. The lockfile ownership guard compared only package names. Several source-preserving TOML readers recognized fewer valid string and table-header forms than Cargo accepts.

Fix

• Resolve workspace aliases before matching the patched crate, including normal, dev, build, and target declarations.
• Match local lockfile owners by name and version, including inherited workspace versions and Cargo's default version.
• Validate proposed manifests against parsed TOML and refuse any matching declaration left unpinned, including legal root/target/workspace dotted and inline forms.
• Recognize literal-string dependency aliases and quoted or annotated registry tables; preserve healthy configuration on repeated application.

Testing

• Regression tests added.
• 73 Cargo redirect Rust unit tests passed.
• CLI built with cargo build --locked -p socket-patch-cli.
• Full workspace Clippy passed with cargo clippy --workspace --all-features -- -D warnings.
• Real depscan converter, PostgreSQL, object store, registry server, and API end-to-end tests passed: direct and workspace projects across hosted, vendored service, and vendored build modes.
• Fresh Cargo caches, locked offline execution of a patch-only function, byte-exact hosted downloads, idempotence, quoted/commented configuration, revert, tampered archive rejection, outside-path refusal, and legacy rows without index metadata all passed.
• Changed Rust file passes rustfmt and diff whitespace checks.

Public Changelog

Hosted Cargo patches now handle inherited workspace aliases and annotated registry configuration correctly, and safely refuse dependencies outside the editable project.

Checklist

• Is PR safe to revert (yes/no)?: Yes.

Companion to SocketDev/depscan#26792. Based on the current main commit 2390c5ff784d2a0fbca5fd13f9dff83752b7615a.

---

Note

Medium Risk
Changes core Cargo.toml/Cargo.lock rewrite logic for hosted patches; mistakes could block valid redirects or still miss edge-case declarations, but failures are fail-closed with warnings rather than silent partial writes.

Overview
Hosted Cargo registry redirects are tightened so workspace aliases, lockfile ownership, and TOML edge cases no longer produce partial or wrong pins.

After plan_cargo_toml, a new validate_cargo_toml_pins pass parses the planned manifest and refuses the whole dependency if any matching declaration (root dotted forms, target.*, workspace.dependencies, workspace-inherited keys) is still unpinned—replacing behavior that could skip garbage lines and leave a partial redirect.

Workspace inheritance is resolved by alias/key before deciding whether an entry targets the patched crate (CargoWorkspaceEntry::OtherPackage, NeedsWorkspacePin for workspace = true in table blocks). Lock transitive checks now treat “pinned” local packages as (name, version) via cargo_manifest_package_id, including workspace-inherited versions and Cargo’s default 0.0.0.

TOML handling moves from narrow regexes to toml_edit-based string/inline parsing for registry pins, renames, and .cargo/config registry blocks (quoted headers, single-quoted values, comments). Malformed manifests that fail validation now emit redirect_cargo_toml_dep_unrewritable instead of best-effort partial rewrites.

Extensive regression tests cover partial-redirect refusal, renamed workspace deps, literal-string forms, and name+version lock matching.

^{Reviewed by Cursor Bugbot for commit a156d87. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Claude (@claude) review

[Mikola Lysenko (mikolalysenko)]

BugBot review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a156d87. Configure here.}