Fix Pipenv stale-install remedy ignoring lock categories (#790)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #790

Summary

When a warm Pipenv virtualenv still holds the unpatched release, the stale-install warning's remedy now reinstalls the package from the lock for every Pipfile.lock category. Before this change, following the printed remedy for a [dev-packages] or named-category package uninstalled it and left it uninstalled.

Root cause

The hosted redirect_pypi_stale_install and vendored pypi_pipenv_stale_install warnings printed fixed text: pipenv run pip uninstall -y <pkg> && pipenv sync or pipenv --rm && pipenv sync. Plain pipenv sync installs only default. So for a package pinned in develop or a Pipenv 2022+ named category, the remedy removed it. The --rm form also dropped every dev and category package, even for a default package.

Fix

• New shared builder socket_patch_core::vendor::pypi_pipenv::stale_install_remedy(lock, name). Both warnings use it, so they can't drift apart again:
  • targeted (uninstall && sync): re-syncs exactly the categories that pin the package. default gives plain pipenv sync (unchanged), default/develop gives --dev, and anything with a named category gives --categories "<Pipfile names>" (packages, dev-packages, <name>);
  • clean (--rm && sync): re-syncs every non-empty category in the lock;
  • pre-2018 pipenv install --deploy gets --dev when the package is in develop. Named categories don't exist before 2022;
  • with no readable lock, it falls back to the old default-only text.
• Hosted passes the run's final Pipfile.lock text (rewrite.files, falling back to the read files). Vendored passes the already-parsed project lock.
• CLI_CONTRACT.md and docs/testing/pipenv-compatibility.md ("Verified remedies") describe the category-aware arguments.
• The npm, PyPI and gem wrappers only dispatch to the binary, so they need no changes.

Per-issue checklist

• Pipenv stale-install remedy always says pipenv sync, so for a [dev-packages] or named-category entry following it uninstalls the package instead of reinstalling it patched #790, develop/named category, hosted: commands::scan::hosted::python::tests::pipenv_remedy_resyncs_the_category_that_pins_the_package
• Pipenv stale-install remedy always says pipenv sync, so for a [dev-packages] or named-category entry following it uninstalls the package instead of reinstalling it patched #790, develop category, vendored: vendor::pypi::tests::pipenv_stale_install_remedy_names_the_develop_category
• Pipenv stale-install remedy always says pipenv sync, so for a [dev-packages] or named-category entry following it uninstalls the package instead of reinstalling it patched #790, every variant (default only, develop, a default package next to dev-packages for --rm, named category, multi-category, no lock): vendor::pypi_pipenv::tests::stale_install_remedy_follows_the_lock_categories

Test evidence

• Red → green. I forced stale_install_remedy to ignore the lock, which reproduces the old behaviour. All three new tests then FAILED (core: 2 failed; cli lib: 1 failed). With the fix they pass.
• Real Pipenv check of the printed commands (project with [packages] idna, [dev-packages] attrs, [docs] six), on 2026.8.0 and 2022.12.19:
  • pip uninstall -y six && pipenv sync --categories "docs": all packages present;
  • pip uninstall -y attrs && pipenv sync --dev: all present;
  • pipenv --rm && pipenv sync --categories "packages dev-packages docs": all present;
  • control, the old remedy pip uninstall -y six && pipenv sync: ModuleNotFoundError: No module named 'six' (reproduces Pipenv stale-install remedy always says pipenv sync, so for a [dev-packages] or named-category entry following it uninstalls the package instead of reinstalling it patched #790).
• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-cli --all-features --lib --test in_process_redirect_pipenv --test in_process_vendor: 835 + 6 + 104 passed.
• cargo test -p socket-patch-core --all-features --lib: 4844 passed, 4 failed. The 4 failures are not caused by this change. They are chmod 0o555 read-only-directory tests (copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_…, pypi_requirements::wire_failure_rolls_back_…), and they can't fail as designed when the sandbox runs as root (uid 0). CI runs as non-root.
• Windows fix (fbdfa6f). On 77071a5, test (windows-latest) failed in vendor::pypi::tests::pipenv_stale_install_remedy_names_the_develop_category ("the upstream six.py is installed"). The test only built the POSIX lib/python3.12/site-packages layout, but the Windows venv probe reads .venv\Lib\site-packages. The test now also places the install there on Windows. The product code is unchanged.
• Not run locally:
  • the full cargo test --workspace --all-features ran out of the sandbox's disk (target/ reached 29 GB while linking the integration test binaries). CI covers it;
  • cargo fmt --all -- --check is not clean on main itself (rustfmt 1.8.0 reformats ~130 files untouched by this PR), and CI doesn't run it. The files this PR touches were formatted hunk-by-hunk with rustfmt, so the diff carries no unrelated reformatting.

🤖 Generated with Claude Code

https://claude.ai/code/session_01K9MfJ84pKgWnWZUoTYq8Zg

---

Note

Low Risk
Warning-message and documentation changes only; no redirect, vendor wiring, or install behavior is altered.

Overview
Fixes #790: stale-install warnings for Pipenv no longer tell users to run plain pipenv sync, which only reinstalls default and could leave dev or named-category packages missing after pip uninstall.

A shared stale_install_remedy(lock, name) in pypi_pipenv builds the reinstall text from Pipfile.lock: targeted pipenv sync gets --dev or --categories "…" for the sections that pin the package; pipenv --rm && pipenv sync lists every non-empty category. Hosted redirect_pypi_stale_install and vendored pypi_pipenv_stale_install both call it (hosted passes the post-rewrite lock text from the scan rewrite). Contract and Pipenv compatibility docs match the new wording. Tests cover develop, named categories, multi-section pins, and Windows venv layout.

^{Reviewed by Cursor Bugbot for commit fbdfa6f. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit fbdfa6f. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent).

• Head: fbdfa6fa73
• CI: 485/485 check runs green on head
• Bugbot: reviewed fbdfa6fa73, no new issues; no unresolved review threads
• Mergeable, no conflicts (blocked only on required human approval)

---

Generated by Claude Code