[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #397
Fixes #398

Summary

Agent-mode apply, scan and vex on NuGet now use the package folder the project actually restores from. Before this change, a project that relocated its packages folder had the user-wide ~/.nuget/packages copy patched instead. apply exited 0 and VEX attested not_affected while the build linked the unpatched copy.

Root cause

nuget_crawler::package_roots listed roots in this order: <cwd>/packages, then the default global folder (NUGET_PACKAGES or ~/.nuget/packages), then the packageFolders of obj/project.assets.json (root and one level down only). The first root that yields a purl wins (merge_first_wins). It never read the folders NuGet is configured to use:

• Agent-mode NuGet apply patches ~/.nuget/packages instead of the project's configured globalPackagesFolder / RestorePackagesPath, reports success, and VEX attests not_affected #397: globalPackagesFolder (project nuget.config chain, or the user config under -g) and RestorePackagesPath. A warm default cache won. With a cold default cache, a project two levels below the solution root (src/App) wasn't found at all.
• Agent-mode NuGet apply ignores nuget.config repositoryPath for packages.config projects and patches ~/.nuget/packages instead, reporting success #398: repositoryPath for packages.config projects. <cwd>/packages was the only legacy root checked, so the global folder that nuget.exe also extracts into won.

Fix

• formats::nuget::parse_config now records configuration/config/add settings (and <clear />). New effective_setting resolves a setting from the nearest config.
• vendor::nuget_config::settings_chain reads the configs NuGet merges for a directory (that directory and every ancestor, nearest first, then the user config) once per crawl. A relative --cwd is made absolute first. SettingsChain::folder expands %VAR% the way .NET does and resolves relative values against the directory of the config that set them.
• Local roots, in priority order:
  1. The packages.config folder: repositoryPath, honored only when a packages.config exists under the root; otherwise <cwd>/packages.
  2. The packageFolders of every obj/project.assets.json under the root, at any depth. These record RestorePackagesPath and a configured globalPackagesFolder as the restore resolved them. This reuses the existing restore-scope walk (restore_scope became restore_walk). The walk never enters the configured stores, or any store a restore names, so a big in-tree store can't use up its 10k-directory budget.
  3. The global folder NuGet would use: NUGET_PACKAGES, then the nearest globalPackagesFolder, then the default. A relocated folder replaces the default one.
• Global mode (-g) uses the same global-folder rule over the user config.
• The default folder honors DOTNET_CLI_HOME off Windows, matching the existing user-config lookup.

The npm/PyPI/gem wrappers only dispatch to the binary, so they need no parallel change.

Tests (red on main → green here)

Issue	Test	Before fix
#397 local, warm default cache, src/App + globalPackagesFolder	nuget_crawler::tests::configured_global_packages_folder_beats_a_warm_default_cache	FAILED
#397 cold default cache, project two levels deep	…::deep_project_restore_is_found_with_a_cold_default_cache	FAILED
#397 RestorePackagesPath	…::restore_packages_path_beats_a_warm_default_cache	FAILED
#397 -g with user-config globalPackagesFolder	…::global_mode_reads_the_user_config_global_packages_folder	FAILED
#397 -g end to end (scan -g --sync patches the configured copy, leaves the default copy alone)	in_process_remote_ecosystems_apply::nuget_global_apply_patches_the_user_configured_global_packages_folder	FAILED
#398 repositoryPath=lib/pkgs, from the solution root and from the project dir	…::repository_path_folder_beats_the_global_folder	FAILED
Bugbot: walk entered a store its own restore names	…::restore_walk_does_not_enter_a_store_its_restore_names	FAILED on 01ff0ff
guard: NUGET_PACKAGES still overrides config	…::nuget_packages_env_overrides_the_configured_folder	ok (unchanged behavior)
guard: a shared repositoryPath without packages.config is ignored	…::repository_path_is_ignored_without_a_packages_config	new
config reader / env expansion / relative cwd	formats::nuget::tests::config_settings_resolve_nearest_first, vendor::nuget_config::settings_tests::*	new

Commands run locally (all pass):

• cargo fmt --all -- --check
• cargo clippy --locked --workspace --all-features -- -D warnings
• cargo test -p socket-patch-core --all-features --lib: 4 failures are permission-based tests in files this PR doesn't touch (copy_tree, vlt_heal, pypi_poetry, pypi_requirements) that can't fail under uid 0 in this container.
• cargo test -p socket-patch-core --all-features --test crawler_nuget_e2e
• cargo test -p socket-patch-cli --all-features --lib --test in_process_remote_ecosystems_apply --test e2e_nuget --test ecosystem_dispatch_e2e --test e2e_vex --test e2e_vex_vendor --test e2e_vex_redirect --test in_process_rollback_all_ecosystems --test in_process_get_hosted_ecosystems --test e2e_safety_internals

CI on b90c942 is green (ci-ok success, including the full test matrix and the real-dotnet NuGet suites). Bugbot's latest review of b90c942 found no new issues, and its one earlier finding is fixed and resolved.

/code-review high findings not fixed

• The restore walk now runs for solution/config-only roots, not only project roots. That deep walk is the fix for the src/App case in Agent-mode NuGet apply patches ~/.nuget/packages instead of the project's configured globalPackagesFolder / RestorePackagesPath, reports success, and VEX attests not_affected #397. It's bounded by the existing 10k-directory budget and skips package stores.
• settings_chain duplicates the config discovery in inherited_source_keys_traced. That function walks in the opposite order and records every probed path for a read cache. Merging the two would change the vendored-feed code path, which is out of scope here, so I'd leave it as a follow-up refactor.

🤖 Generated with Claude Code

https://claude.ai/code/session_011f9aeS2ity8CoowhYN5FpJ

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Restore walk still enters package stores
  • Fixed by stripping trailing slashes from package folder paths and checking if directories are package stores when popping from the pending queue.

Or push these changes by commenting:

@cursor push 9f55775994

Preview (9f55775994)

diff --git a/crates/socket-patch-core/src/crawlers/nuget_crawler.rs b/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
--- a/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
@@ -616,7 +616,15 @@
     let package_folders = json
         .get("packageFolders")
         .and_then(|folders| folders.as_object())
-        .map(|folders| folders.keys().map(PathBuf::from).collect())
+        .map(|folders| {
+            folders
+                .keys()
+                .map(|key| {
+                    let path = key.strip_suffix('/').unwrap_or(key);
+                    PathBuf::from(path)
+                })
+                .collect()
+        })
         .unwrap_or_default();
     let libraries = json
         .get("libraries")
@@ -684,6 +692,9 @@
     let mut pending = vec![root];
     let mut listed = 0usize;
     while let Some(dir) = pending.pop() {
+        if skip.contains(&dir) || walk.package_folders.contains(&dir) {
+            continue;
+        }
         listed += 1;
         if listed > SCOPE_DIR_BUDGET {
             walk.libraries = None;

_{You can send follow-ups to the cloud agent here.}

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b90c942. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does. For NuGet, agent-mode apply/scan/vex now patch the package folder the project actually restores from. Before, a warm ~/.nuget/packages won over a relocated folder, so apply exited 0 and VEX said not_affected while the build linked the unpatched copy (#397, #398). Roots are now tried in this order: the packages.config folder (repositoryPath), then the packageFolders of every obj/project.assets.json at any depth, then the global folder NuGet would use (NUGET_PACKAGES, then the nearest globalPackagesFolder, then the default).

Risk: low–medium. It only changes which NuGet copy gets picked, and the order now follows NuGet's own. The medium part: the restore walk used to run only when cwd was a project, and now runs on every local NuGet crawl. It still has the existing 10k-directory budget and skips the package stores.

Look here

• nuget_crawler.rs:410 global_packages_folder, and :527-598 package_roots (the new order, and repositoryPath only when a packages.config exists)
• nuget_crawler.rs:675 restore_walk: it collects packageFolders, skips stores, and keeps the old scope rules
• nuget_config.rs:183-260 settings_chain, folder and expand_env_vars
• formats/nuget/mod.rs:396 effective_setting: the nearest config wins and <clear /> is honored

Verified

• I read the full diff (5 files, +847/−87) and the description; they match.
• cargo test -p socket-patch-core --all-features --lib -- nuget: 276 passed. --test crawler_nuget_e2e: 28 passed.
• Mutation check: making global_packages_folder ignore the config fails global_mode_reads_the_user_config_global_packages_folder. The local-mode Agent-mode NuGet apply patches ~/.nuget/packages instead of the project's configured globalPackagesFolder / RestorePackagesPath, reports success, and VEX attests not_affected #397 test is guarded by the new root order (assets folders before the global folder).
• NUGET_PACKAGES still overrides config. An empty NUGET_PACKAGES is still treated as unset. File reads use the existing regular-file-only readers.
• CI on the head: 31/31 passed (the rest are skipped). Bugbot is clean, and its one earlier thread is resolved. CHANGELOG.md is untouched.

Changes I made: none.

Open questions (not blocking):

1. Store skipping and the root dedupe compare paths exactly. A relative globalPackagesFolder like ../pkgs resolves to /proj/../pkgs, which is not normalized, so an in-tree store reached through .. may still be walked. That costs walk budget, not correctness.
2. NuGet's machine-wide configs (/etc/opt/NuGet/Config, %ProgramFiles(x86)%\NuGet\Config) aren't read. A globalPackagesFolder set only there is rare.

Auto-merge is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code