Support hosted Pipenv patches and safe vendoring - #242

Merged

Mikola Lysenko (mikolalysenko) merged 28 commits into

mainfrom

codex/pipenv-patch-compatibility

Sep 18, 2026

Commits on Sep 17, 2026

Support hosted Pipenv patches safely
Mikola Lysenko (mikolalysenko)
committed
d70d218
Clarify Pipenv installer requirements
Mikola Lysenko (mikolalysenko)
committed
fa6b27f
fix(pypi): discover Pipenv's out-of-tree virtualenv in agent mode

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
6347d00
fix(pypi): vendor Poetry projects from a lock-only checkout

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
ff82d8e
fix(pypi): inventory Pipfile.lock so lock-only Pipenv checkouts patch in every mode

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
bbcafa6
fix(pipenv): let only pin/source conflicts veto the sibling Python rewriters

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
d1bcfd7
fix(pipenv): warn when a rewritten Pipfile.lock leaves an installed upstream release in place

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
2d92f26
fix(pipenv): retire relocked entries on rollback and probe the installer only when a patch targets the lock

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
405a018
fix(vex): attest same-run hosted redirects whose ledger purl carries a qualifier

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
9392af0
fix(pypi): read requirements.txt alongside Pipfile.lock in the lock inventory

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
20c57b4
test(pipenv): in-process CLI coverage for hosted Pipfile.lock redirects

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
41c235f
fix(pipenv): retire vendored records whose lock entry a relock regenerated

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
106929a
test(pipenv): per-release live matrix harness for hosted, vendored and agent mode

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
04ba777
docs(pipenv): document hosted Pipfile.lock behavior, the new codes and the measured boundaries

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
d5e54d7
fix(pipenv): re-plan Socket-owned hybrid entries, follow the grant origin, validate ledger originals

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
e944fb6
ci(pipenv): run the live Pipenv matrix on Linux and macOS

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
f5be986
fix(pypi): descend into Pipenv's nested interpreter-suffix virtualenv directories

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
73827a5
test(pipenv): harness expectations for Pipenv 0.x–6.x agent shapes

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
4ce99ec

Navigation Menu

Support hosted Pipenv patches and safe vendoring - #242

Support hosted Pipenv patches and safe vendoring#242
Mikola Lysenko (mikolalysenko) merged 28 commits into
mainfrom
codex/pipenv-patch-compatibility

Commits on Sep 17, 2026

Support hosted Pipenv patches safely

Clarify Pipenv installer requirements

fix(pypi): discover Pipenv's out-of-tree virtualenv in agent mode

fix(pypi): vendor Poetry projects from a lock-only checkout

fix(pypi): inventory Pipfile.lock so lock-only Pipenv checkouts patch in every mode

fix(pipenv): let only pin/source conflicts veto the sibling Python rewriters

fix(pipenv): warn when a rewritten Pipfile.lock leaves an installed upstream release in place

fix(pipenv): retire relocked entries on rollback and probe the installer only when a patch targets the lock

fix(vex): attest same-run hosted redirects whose ledger purl carries a qualifier

fix(pypi): read requirements.txt alongside Pipfile.lock in the lock inventory

test(pipenv): in-process CLI coverage for hosted Pipfile.lock redirects

fix(pipenv): retire vendored records whose lock entry a relock regenerated

test(pipenv): per-release live matrix harness for hosted, vendored and agent mode

docs(pipenv): document hosted Pipfile.lock behavior, the new codes and the measured boundaries

fix(pipenv): re-plan Socket-owned hybrid entries, follow the grant origin, validate ledger originals

ci(pipenv): run the live Pipenv matrix on Linux and macOS

fix(pypi): descend into Pipenv's nested interpreter-suffix virtualenv directories

test(pipenv): harness expectations for Pipenv 0.x–6.x agent shapes

Commits on Sep 18, 2026

fix(pipenv): make both rollbacks survive every Pipenv relock, scope the stale probes to the project's venvs, recover lock-only re-scans from the ledger

fix(pypi): keep Socket's own Pipfile.lock references discoverable, never query PyPI for private-index locks, honour USERPROFILE on Windows

fix(vendor): let the ledger recover a lock rewired to Socket's own reference

docs(pipenv): describe lock-only discovery, re-scan idempotency and the private-index rule

ci(pipenv): cover the relock and line-ending shapes and every Pipenv code path in the trigger

Merge origin/main (Poetry #241, Hatch #244) into the Pipenv fix branch

test(pipenv): re-read a missing file a few times in the Docker-side oracle

fix(inventory): satisfy clippy's unnecessary_map_or on the public-index gate

test(pipenv): expect the relocked hybrid entry to roll back to the original

docs(pipenv): record the final compatibility matrix on the merged head