clean up pass complete

Author: mikolalysenko

crates/socket-patch-cli/src/commands/setup.rs

@@ -13,9 +13,12 @@ use socket_patch_core::package_json::update::{
     remove_package_json, update_package_json, RemoveResult, RemoveStatus, UpdateResult,
     UpdateStatus,
 };
-use socket_patch_core::pth_hook::{
-    add_hook_dependency, deps_contain_hook, detect_python_pm, pyproject_contains_hook,
-    remove_hook_dependency, ManifestKind, PthEditResult, PthStatus, PythonPackageManager,
+use socket_patch_core::pth_hook::detect::{
+    deps_contain_hook, detect_python_pm, PythonPackageManager,
+};
+use socket_patch_core::pth_hook::edit::{
+    add_hook_dependency, pyproject_contains_hook, remove_hook_dependency, ManifestKind,
+    PthEditResult, PthStatus,
 };
 use socket_patch_core::utils::telemetry::track_patch_setup;
 use socket_patch_core::vex::applied_patches;

crates/socket-patch-cli/src/commands/vex.rs

@@ -22,8 +22,8 @@ use socket_patch_core::manifest::operations::read_manifest;
 use socket_patch_core::manifest::schema::PatchManifest;
 use socket_patch_core::utils::telemetry::{track_vex_failed, track_vex_generated};
 use socket_patch_core::vex::{
-    build_document_with_provenance, detect_product, BuildOptions, Document, FailedPatch,
-    VendorContext, VerifyOutcome,
+    build_document, detect_product, BuildOptions, Document, FailedPatch, VendorContext,
+    VerifyOutcome,
 };
 
 use crate::args::{apply_env_toggles, parse_bool_flag, GlobalArgs};
@@ -413,7 +413,7 @@ async fn generate_vex(
         tooling: Some(format!("socket-patch {}", env!("CARGO_PKG_VERSION"))),
     };
 
-    let doc = match build_document_with_provenance(
+    let doc = match build_document(
         manifest,
         &outcome.applied,
         &outcome.vendored,

crates/socket-patch-core/src/crawlers/composer_crawler.rs

@@ -3,6 +3,7 @@ use std::path::{Path, PathBuf};
 
 use super::types::{CrawledPackage, CrawlerOptions};
 use crate::utils::fs::{is_dir, is_file};
+use crate::utils::process::{CommandRunner, SystemCommandRunner};
 
 /// PHP/Composer ecosystem crawler for discovering packages in Composer
 /// vendor directories.
@@ -226,16 +227,10 @@ async fn get_composer_home() -> Option<PathBuf> {
     }
 
     // Try `composer global config home`
-    if let Ok(output) = std::process::Command::new("composer")
-        .args(["global", "config", "home"])
-        .output()
-    {
-        if output.status.success() {
-            if let Some(path) = parse_composer_home_output(&String::from_utf8_lossy(&output.stdout))
-            {
-                if is_dir(&path).await {
-                    return Some(path);
-                }
+    if let Some(stdout) = SystemCommandRunner.run("composer", &["global", "config", "home"]) {
+        if let Some(path) = parse_composer_home_output(&stdout) {
+            if is_dir(&path).await {
+                return Some(path);
             }
         }
     }

crates/socket-patch-core/src/package_json/find.rs

@@ -2,6 +2,7 @@ use std::path::{Path, PathBuf};
 use tokio::fs;
 
 use super::detect::PackageManager;
+use crate::utils::fs::{entry_file_type, is_dir, list_dir_entries};
 
 /// Detect the package manager based on lockfiles in the project root.
 /// Checks for pnpm-lock.yaml, pnpm-lock.yml, and pnpm-workspace.yaml.
@@ -346,12 +347,7 @@ fn is_ignored_dir(name: &str) -> bool {
 
 /// Search one level deep for package.json files.
 async fn search_one_level(dir: &Path, results: &mut Vec<PathBuf>) {
-    let mut entries = match fs::read_dir(dir).await {
-        Ok(e) => e,
-        Err(_) => return,
-    };
-
-    while let Ok(Some(entry)) = entries.next_entry().await {
+    for entry in list_dir_entries(dir).await {
         let path = entry.path();
         // A single-level `dir/*` glob follows a symlinked direct member, the
         // way npm/pnpm (and our cargo `glob_dir`) resolve a workspace member
@@ -361,11 +357,7 @@ async fn search_one_level(dir: &Path, results: &mut Vec<PathBuf>) {
         // recursive searcher below deliberately does NOT follow symlinks,
         // to avoid loops/escapes — there a symlink's `is_dir() == false` is the
         // desired skip.)
-        if !fs::metadata(&path)
-            .await
-            .map(|m| m.is_dir())
-            .unwrap_or(false)
-        {
+        if !is_dir(&path).await {
             continue;
         }
         // A `dir/*` pattern must not pick up node_modules/hidden/output dirs as
@@ -388,15 +380,9 @@ async fn search_recursive(dir: &Path, depth: usize, max_depth: usize, results: &
         return;
     }
 
-    let mut entries = match fs::read_dir(dir).await {
-        Ok(e) => e,
-        Err(_) => return,
-    };
-
-    while let Ok(Some(entry)) = entries.next_entry().await {
-        let ft = match entry.file_type().await {
-            Ok(ft) => ft,
-            Err(_) => continue,
+    for entry in list_dir_entries(dir).await {
+        let Some(ft) = entry_file_type(&entry).await else {
+            continue;
         };
         if !ft.is_dir() {
             continue;

crates/socket-patch-core/src/patch/vendor/bun_lock.rs

@@ -41,8 +41,8 @@ use crate::patch::copy_tree::remove_tree;
 use crate::utils::fs::atomic_write_bytes;
 
 use super::common::{already_patched_result, refused};
-use super::npm_common::{done_failure, guard_coordinates, stage_patch_pack};
-use super::path::{parse_vendor_path, vendor_uuid_dir_rel};
+use super::npm_common::{done_failure, guard_coordinates, guard_revert_uuid_dir, stage_patch_pack};
+use super::path::parse_vendor_path;
 use super::state::{
     write_marker, VendorArtifact, VendorEntry, VendorMarker, WiringAction, WiringRecord,
 };
@@ -274,11 +274,9 @@ pub(crate) async fn revert_bun(
     // SECURITY: `entry.uuid` comes from the committed, tamper-able
     // state.json and names the directory tree we are about to DELETE.
     // Validate through the same fail-closed grammar vendor used.
-    let Some(uuid_dir_rel) = vendor_uuid_dir_rel("npm", &entry.uuid) else {
-        return RevertOutcome::failed(format!(
-            "refusing revert: `{}` is not a canonical patch uuid (tampered state.json?)",
-            entry.uuid
-        ));
+    let uuid_dir_rel = match guard_revert_uuid_dir(&entry.uuid) {
+        Ok(d) => d,
+        Err(outcome) => return outcome,
     };
     if dry_run {
         return RevertOutcome::ok();

crates/socket-patch-core/src/patch/vendor/cargo.rs

@@ -123,7 +123,7 @@ async fn cargo_service_copy(
             CargoServiceCopy::FallBack
         }
     };
-    match fetch_verified_archive(cfg, &record.uuid, name).await {
+    match fetch_verified_archive(cfg, &record.uuid).await {
         ServiceArtifact::Ready(archive) => {
             // Clean copy dir, then extract the `.crate` (tar.gz; strip its
             // single `{name}-{version}/` top-level dir) into it.

crates/socket-patch-core/src/patch/vendor/composer_lock.rs

@@ -490,7 +490,7 @@ async fn composer_service_copy(
             ComposerServiceCopy::FallBack
         }
     };
-    match fetch_verified_archive(cfg, &record.uuid, pkg).await {
+    match fetch_verified_archive(cfg, &record.uuid).await {
         ServiceArtifact::Ready(archive) => {
             let _ = remove_tree(copy_dir).await;
             if let Err(e) = tokio::fs::create_dir_all(copy_dir).await {

crates/socket-patch-core/src/patch/vendor/gem.rs

@@ -578,7 +578,7 @@ async fn gem_service_copy(
     };
 
     // Step 1: the prebuilt `.gem` (sha512-verified against the reference).
-    let archive = match fetch_verified_archive(cfg, &record.uuid, name).await {
+    let archive = match fetch_verified_archive(cfg, &record.uuid).await {
         ServiceArtifact::Ready(archive) => archive,
         ServiceArtifact::IntegrityMismatch(reason) => {
             return miss(
@@ -613,7 +613,7 @@ async fn gem_service_copy(
     };
 
     // Step 2: the stub gemspec the converter generated alongside the `.gem`.
-    let stub = match fetch_verified_secondary(cfg, &archive, GEM_STUB_ARTIFACT_KIND, name).await {
+    let stub = match fetch_verified_secondary(cfg, &archive, GEM_STUB_ARTIFACT_KIND).await {
         SecondaryArtifactResult::Ready(bytes) => bytes,
         SecondaryArtifactResult::Absent => {
             return miss(

crates/socket-patch-core/src/patch/vendor/golang.rs

@@ -369,7 +369,7 @@ async fn go_service_redirect(
             GoServiceRedirect::FallBack
         }
     };
-    match fetch_verified_archive(cfg, &record.uuid, module).await {
+    match fetch_verified_archive(cfg, &record.uuid).await {
         ServiceArtifact::Ready(archive) => {
             // Clean copy dir; extract the module zip (strip its literal
             // `{module}@{version}/` prefix) into it.

crates/socket-patch-core/src/patch/vendor/mod.rs

@@ -79,9 +79,9 @@ mod pypi_wheel;
 pub mod registry_fetch;
 pub(crate) mod service_fetch;
 mod toml_surgery;
-pub mod verify;
-pub mod yarn_berry_lock;
-pub mod yarn_classic_lock;
+pub(crate) mod verify;
+pub(crate) mod yarn_berry_lock;
+mod yarn_classic_lock;
 
 pub use path::{ecosystem_dir_for_purl, parse_vendor_path};
 pub use state::{load_state, lookup_entry, save_state, VendorEntry, VendorState, VENDOR_STATE_REL};