Support hosted and vendored Hatch patches

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Codex:gpt-6-astra

Hatch projects lacked hosted and vendored manifest wiring. Add exact PEP 508 rewrites for project, optional and environment dependencies in pyproject.toml and hatch.toml, preserving extras, markers, external configuration precedence, comments and line endings. Vendored references use relocatable root URIs; both modes pin the artifact SHA-256.

Validate recorded artifact paths, pins and wheel bytes before repeated scans, refuse concurrent edits and symlinked inputs, and preserve shared ownership of Hatchling’s direct-reference permission during selective or preserved rollback. Existing requirements and lockfile routing keeps precedence. Python hosted confirmation now requires a successful writer, preventing an inactive Hatch URL from masking a refused UV/Poetry lock or failed metadata preparation. Environment discovery uses regular-file reads so FIFO configuration cannot hang a scan.

Vendored environments require Hatch >=1.2 and pip: earlier Hatch releases do not expand the root URI, and uv ignores local-wheel hash fragments. Vendored groups, ranges, transitive-only targets, dynamic metadata, source/plugin configurations and conditional overrides are refused before writes; the install hook remains available. Hosted environments support pip and uv.

Validation:

• 17 Hatch-focused Rust tests, 58 Poetry tests, 10 UV-lock tests and 72 requirements tests pass; CLI build and Clippy with warnings denied pass.
• Real CLI probes verify that rejected UV/legacy Poetry locks with inactive Hatch URLs report zero redirects, while a supported Poetry lock redirects and rolls back exactly.
• Native Windows/Linux matrix covers 13 releases across both Hatch majors, including installed patch-file hashes, wrong-digest rejection, repeated scans and rollback. The permanent compatibility report separates successful installs from safe refusals and upstream limitations.
• Companion depscan #26388 implements the SBOM support; its stacked tests and fixtures PR #26400 validates 1,267 captured/adversarial SBOM fixtures and preserves native manifest hashes and installer results.

---

Note

Medium Risk
Changes PyPI redirect, vendor wire/revert, and hosted attestation logic; mistakes could mis-report patched deps, but behavior is fail-closed with explicit confirmed/refused UUID sets and broad tests.

Overview
Adds Hatch as a first-class PyPI path for hosted redirects and vendored wheels, rewriting exact == PEP 508 pins in pyproject.toml / hatch.toml (project, optional, and environment deps) to direct @ URLs with SHA-256 fragments and enabling allow-direct-references when needed. Vendored wiring uses {root:uri} pins, ledger-backed wire/revert, symlink and concurrent-edit refusal, and shared permission rollback; unsupported shapes (ranges, dynamic deps, uv-only envs for vendored hashes, etc.) fail closed toward the install hook.

Hosted scan confirmation stops inferring PyPI patches from URL substrings: redirects count only when the matching writer succeeds—python lock (uv/poetry/…), Hatch, or requirements—so an inactive Hatch URL cannot attest a failed or skipped lock rewrite. Scan inputs now include hatch.toml, pdm.lock, and Pipfile.lock.

Poetry virtualenv discovery reads config via read_regular_to_string so FIFO pyproject.toml / poetry.toml cannot hang scans; redirect replay adds Hatch document restore (including CRLF drift).

^{Reviewed by Cursor Bugbot for commit 31e74e4. Configure here.}