Add in-memory hosted engine and napi addon - #276
Mikola Lysenko (mikolalysenko) wants to merge 3 commits into
Conversation
Let hosts run hosted-mode patching without a working directory or network access. The new hosted_memory engine takes a map of repository files, finds every project root, looks up patches once across all roots through a pluggable PatchApi provider, and returns the rewritten lockfiles and redirect ledgers. Lockfile inventory now reads through a ProjectView, so the same parsers serve disk and in-memory projects; disk behavior is unchanged. The existing scan --mode hosted path keeps using ApiClient directly, which also implements PatchApi. Parity tests compare the engine against the real CLI binary across npm, pnpm, yarn, bun, pypi, cargo, composer, gem and golang fixtures. A hidden hosted-bundle command exposes the engine for debugging. Assisted-by: Claude Code:claude-opus-5-5
Expose the in-memory hosted engine to Node as a native addon, so a service can stream repository files into a scan session and serve patch lookups from its own data source instead of the Socket API. The package lives under crates/socket-patch-node/npm and is private, so the npm release tooling does not publish it. Release builds now build only the CLI crate, and a new CI job builds the addon and runs its Node smoke test. Assisted-by: Claude Code:claude-opus-5-5
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Export the scan session as an opaque External handle plus plain functions, not a napi class. The class wrapper's generated glue unwraps its native pointer through an FFI out-parameter, which CodeQL reports as a possible invalid pointer dereference. The public HostedScanSession in index.js is unchanged; it now calls the handle functions. Assisted-by: Claude Code:claude-opus-5-5
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 1f45298. Configure here.
| let reason = if rush_internal { | ||
| Some("rush_internal") | ||
| } else if remaining.is_empty() { | ||
| Some("cargo_member") |
There was a problem hiding this comment.
Nested Cargo roots over-demoted
Medium Severity
detect_roots treats any Cargo.lock under an ancestor lock as a workspace member and drops that directory as a root, without reading members/exclude. demote_cargo_members later uses real workspace membership and keeps excluded crates, but those crates never become roots, so their lock is never streamed or scanned. Independent nested Cargo projects are left unpatched.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 1f45298. Configure here.
| socket_patch_core::utils::pipenv::MAJOR_OVERRIDE_ENV | ||
| ), | ||
| }); | ||
| } |
There was a problem hiding this comment.
Pipenv warning cites unused PATH
Low Severity
When pipenvMajor is unset, the engine emits redirect_pipenv_installer_unknown telling users to put Pipenv on PATH or set a process env var. The in-memory engine never reads the environment; only the pipenvMajor option is honored. Following that advice cannot change the next scan.
Triggered by learned rule: Remediation advice must be convergent: following it must clear the triggering detection
Reviewed by Cursor Bugbot for commit 1f45298. Configure here.
This branch has not been deployed
2 participants
LLM Description written by Claude Code:claude-opus-5-5
Summary
Adds a way for a service to run hosted-mode patching in-process, with no working directory and no network calls from the engine. depscan's new autopatch worker streams a repository's lockfiles into it and serves patch lookups straight from the patch database.
hosted_memoryengine (crates/socket-patch-cli/src/hosted_memory/): takes a map of repository files (text, binary, presence-only, symlinks), detects project roots, looks up patches once across all roots, and returns rewritten files plus per-root redirect ledgers. The rewrite, pnpm trust and npm allow-remote planning, confirmation and ledger-merge stages are copied as pure functions fromrun_redirect_selected. The diskscan --mode hostedpath is unchanged.PatchApitrait (appended inapi/client.rs): the five lookups the hosted path makes (batch, by-package, package references, view, artifact download).ApiClientimplements it by forwarding to its existing methods.ProjectViewseam (lock_inventory/view.rs): lockfile readers work over disk or memory. Disk wrappers call the same readers, so behavior is unchanged.hosted-bundlecommand: runs the engine on a JSON bundle from stdin, for debugging.socket-patch-nodenapi addon (crates/socket-patch-node, napi 3.13):HostedScanSession(pushChunk/endFile/markPresent/finish/cancel),selectHostedScanPaths, and a JS provider callback that implementsPatchApi. The JS package is private and lives outside thenpm/socket-patch-*release glob.Scope and limits
bun.lockband Rush), pypi, cargo, golang, gem and composer. Maven and NuGet produceecosystem_unsupported_in_memory, because they have no lockfile inventory without crawlers.Testing
redirectblock against the engine, across npm, pnpm v9, yarn classic and berry,bun.lock,bun.lockb, Rush, uv, requirements, poetry, Pipfile, cargo (including workspaces and[patch]paths), composer, Gemfile, golang and a nested monorepo.SOCKET_*environments, malformed and 200k-deep inputs, limits, cancellation, timeouts, no proxy fallback on 401, symlinks, a corrupt ledger and vendored takeover refusal.cargo clippy --workspace --all-features -- -D warningspasses. The addon has only been built on macOS arm64; Linux and Windows CI builds are the first run there.🤖 Generated with Claude Code
Note
Medium Risk
Large new hosted redirect path and N-API boundary with org-authenticated lookups; disk scan behavior is mostly shared via extracted logic and parity tests, but any engine drift could affect in-process consumers before the CLI path.
Overview
Introduces an in-memory hosted redirect engine so hosted-mode patching can run without touching the filesystem or spawning the CLI. Callers supply repo files (text, binary, presence-only, symlinks); the engine detects roots, deduplicates patch lookups across roots, and returns rewritten lockfiles plus redirect ledgers aligned with
scan --mode hosted --json.The engine lives under
crates/socket-patch-cli/src/hosted_memory/(discovery, ledger merge, path selection, redirect planning/rewrite). Diskscan --mode hostedis largely unchanged; many helpers incommands/scan/hosted.rsare widened topub(crate)so the engine can reuse the same pnpm/npm trust and JSON shapes. A hiddenhosted-bundlesubcommand runs the engine from a JSON stdin bundle for parity/debugging (requires org API token; no public proxy).Adds
socket-patch-node, a private N-API crate exposingHostedScanSession(streamed input),selectHostedScanPaths, and a JSPatchApiprovider. Workspacedefault-membersand release builds now target onlysocket-patch-cliso release artifacts skip the addon; CI gains anode-addonjob (build + Node smoke tests) and a dedicatedprofile.addonfor faster addon links.Reviewed by Cursor Bugbot for commit 1f45298. Configure here.