test(crawlers): python + cargo coverage

* python: PythonCrawler `Default`, `find_by_purls` canonicalized-name
  match, qualifier stripping, empty/missing/mismatched purls,
  `crawl_all` over staged .dist-info dirs (well-formed + corrupt
  METADATA), global_prefix passthrough, and the METADATA early-break
  arm at first blank line after headers.
* cargo: `parse_cargo_toml_name_version` `version.workspace` bail-out
  test, `verify_crate_at_path` dir-name fallback rejection on name
  mismatch, hidden-dir skip in `scan_crate_source`, dedup on identical
  purls across distinct directories, and local-mode fallback through
  `get_registry_src_paths` with CARGO_HOME stubbed (both with and
  without a staged registry/src tree).

Assisted-by: Claude Code:claude-opus-4-7

Author: mikolalysenko

crates/socket-patch-core/tests/crawler_cargo_e2e.rs

@@ -361,3 +361,152 @@ async fn find_by_purls_verify_fallback_via_dir_name() {
         .unwrap();
     assert_eq!(result.len(), 1, "verify must fall back to dir name");
 }
+
+/// `version.workspace = true` in a top-level `[package]` block must
+/// bail (line 49-52): the crawler can't infer the actual version from
+/// just this file. `find_by_purls` then has to fall back to dir-name
+/// parsing — but `parse_cargo_toml_name_version` itself must return
+/// None up front.
+#[test]
+fn parse_cargo_toml_version_workspace_returns_none() {
+    let toml = "[package]\nname = \"foo\"\nversion.workspace = true\n";
+    assert_eq!(parse_cargo_toml_name_version(toml), None);
+}
+
+/// `verify_crate_at_path` with a dir-name-only match (workspace
+/// version) but a mismatched purl name — must return false. Exercises
+/// the `parsed_name == name && parsed_version == version` false arm
+/// (cargo_crawler.rs:344-346).
+#[tokio::test]
+async fn find_by_purls_verify_fallback_dir_name_mismatch_returns_empty() {
+    let tmp = tempfile::tempdir().unwrap();
+    let pkg = tmp.path().join("real-crate-1.0.0");
+    tokio::fs::create_dir(&pkg).await.unwrap();
+    tokio::fs::write(
+        pkg.join("Cargo.toml"),
+        "[package]\nname = \"real-crate\"\nversion.workspace = true\n",
+    )
+    .await
+    .unwrap();
+
+    let crawler = CargoCrawler;
+    // Ask for a name that doesn't match the dir layout.
+    let result = crawler
+        .find_by_purls(tmp.path(), &["pkg:cargo/other-crate@1.0.0".to_string()])
+        .await
+        .unwrap();
+    assert!(result.is_empty(), "dir-name mismatch must reject");
+}
+
+/// Hidden directory entries inside the crate source root must be
+/// skipped by `scan_crate_source` (line 274).
+#[tokio::test]
+async fn crawl_all_skips_hidden_dirs() {
+    let tmp = tempfile::tempdir().unwrap();
+    // Stage a hidden dir that looks like a registry crate — must be skipped.
+    let hidden = tmp.path().join(".hidden-crate-1.0.0");
+    tokio::fs::create_dir(&hidden).await.unwrap();
+    tokio::fs::write(
+        hidden.join("Cargo.toml"),
+        "[package]\nname = \"hidden-crate\"\nversion = \"1.0.0\"\n",
+    )
+    .await
+    .unwrap();
+    // Also stage a real one to confirm the scan actually runs.
+    stage_registry_crate(tmp.path(), "real-crate", "1.0.0").await;
+
+    let crawler = CargoCrawler;
+    let opts = CrawlerOptions {
+        cwd: tmp.path().to_path_buf(),
+        global: true,
+        global_prefix: Some(tmp.path().to_path_buf()),
+        batch_size: 100,
+    };
+    let result = crawler.crawl_all(&opts).await;
+    let names: Vec<&str> = result.iter().map(|p| p.name.as_str()).collect();
+    assert!(names.contains(&"real-crate"));
+    assert!(!names.contains(&"hidden-crate"), "hidden dir must be skipped");
+}
+
+/// `read_crate_cargo_toml` early-returns when the purl has already
+/// been recorded in `seen` (line 310-311). Drive this by staging two
+/// registry dirs for the same crate — the second one is deduped.
+#[tokio::test]
+async fn crawl_all_dedups_same_purl() {
+    let tmp = tempfile::tempdir().unwrap();
+    // Two physical dirs with identical Cargo.toml -> same purl.
+    stage_registry_crate(tmp.path(), "foo", "1.0.0").await;
+    let dup = tmp.path().join("dup-mirror");
+    tokio::fs::create_dir(&dup).await.unwrap();
+    tokio::fs::write(
+        dup.join("Cargo.toml"),
+        "[package]\nname = \"foo\"\nversion = \"1.0.0\"\n",
+    )
+    .await
+    .unwrap();
+
+    let crawler = CargoCrawler;
+    let opts = CrawlerOptions {
+        cwd: tmp.path().to_path_buf(),
+        global: true,
+        global_prefix: Some(tmp.path().to_path_buf()),
+        batch_size: 100,
+    };
+    let result = crawler.crawl_all(&opts).await;
+    assert_eq!(result.len(), 1, "duplicate purls must dedup; got {result:?}");
+}
+
+/// `get_crate_source_paths` in local mode without a vendor dir but
+/// with a Cargo.toml falls through to `get_registry_src_paths`. With
+/// CARGO_HOME pointed at an empty tempdir, the registry/src subdir
+/// doesn't exist → returns empty. Covers line 130.
+#[tokio::test]
+#[serial_test::serial]
+async fn get_crate_source_paths_local_cargo_toml_falls_back_to_registry() {
+    let tmp = tempfile::tempdir().unwrap();
+    tokio::fs::write(tmp.path().join("Cargo.toml"), b"[package]\n").await.unwrap();
+    // CARGO_HOME points at an empty tempdir → no registry/src to scan.
+    let cargo_home = tempfile::tempdir().unwrap();
+    let prev = std::env::var("CARGO_HOME").ok();
+    std::env::set_var("CARGO_HOME", cargo_home.path());
+
+    let crawler = CargoCrawler;
+    let paths = crawler.get_crate_source_paths(&options_at(tmp.path())).await.unwrap();
+
+    if let Some(v) = prev {
+        std::env::set_var("CARGO_HOME", v);
+    } else {
+        std::env::remove_var("CARGO_HOME");
+    }
+
+    assert!(
+        paths.is_empty(),
+        "missing registry/src must yield empty; got {paths:?}"
+    );
+}
+
+/// Same as above but with a registry/src tree staged — the discovered
+/// index dirs must surface. Covers lines 228-235 (entry walk).
+#[tokio::test]
+#[serial_test::serial]
+async fn get_crate_source_paths_local_cargo_toml_with_registry_src() {
+    let tmp = tempfile::tempdir().unwrap();
+    tokio::fs::write(tmp.path().join("Cargo.toml"), b"[package]\n").await.unwrap();
+    let cargo_home = tempfile::tempdir().unwrap();
+    let index_dir = cargo_home.path().join("registry").join("src").join("index.crates.io-stub");
+    tokio::fs::create_dir_all(&index_dir).await.unwrap();
+
+    let prev = std::env::var("CARGO_HOME").ok();
+    std::env::set_var("CARGO_HOME", cargo_home.path());
+
+    let crawler = CargoCrawler;
+    let paths = crawler.get_crate_source_paths(&options_at(tmp.path())).await.unwrap();
+
+    if let Some(v) = prev {
+        std::env::set_var("CARGO_HOME", v);
+    } else {
+        std::env::remove_var("CARGO_HOME");
+    }
+
+    assert!(paths.iter().any(|p| p == &index_dir));
+}

crates/socket-patch-core/tests/crawler_python_e2e.rs

@@ -18,6 +18,8 @@ use socket_patch_core::crawlers::python_crawler::{
     find_local_venv_site_packages, find_python_dirs, get_global_python_site_packages,
     read_python_metadata,
 };
+use socket_patch_core::crawlers::types::CrawlerOptions;
+use socket_patch_core::crawlers::PythonCrawler;
 
 /// Helper: stage a fake `python3.X/lib/python3.X/site-packages` tree
 /// under `root` so `find_python_dirs(root, ["python3.*", "lib",
@@ -273,6 +275,192 @@ async fn read_python_metadata_missing_name_returns_none() {
     assert_eq!(result, None);
 }
 
+/// `PythonCrawler::default()` should forward to `new()`.
+#[test]
+fn python_crawler_default_and_new_construct_cleanly() {
+    let _a = PythonCrawler::default();
+    let _b = PythonCrawler::new();
+}
+
+// ── find_by_purls + crawl_all over a staged site-packages ─────
+
+/// Helper: stage a well-formed `<pkg>-<version>.dist-info/METADATA`
+/// inside a fake site-packages directory.
+async fn stage_dist_info(site_packages: &Path, raw_name: &str, version: &str) {
+    let dist = site_packages.join(format!("{raw_name}-{version}.dist-info"));
+    tokio::fs::create_dir_all(&dist).await.unwrap();
+    let metadata = format!("Metadata-Version: 2.1\nName: {raw_name}\nVersion: {version}\n");
+    tokio::fs::write(dist.join("METADATA"), metadata).await.unwrap();
+}
+
+#[tokio::test]
+async fn find_by_purls_matches_canonicalized_name() {
+    let tmp = tempfile::tempdir().unwrap();
+    // PEP 503 canonicalization: "Requests" -> "requests"
+    stage_dist_info(tmp.path(), "Requests", "2.28.0").await;
+
+    let crawler = PythonCrawler;
+    let result = crawler
+        .find_by_purls(tmp.path(), &["pkg:pypi/requests@2.28.0".to_string()])
+        .await
+        .unwrap();
+    assert_eq!(result.len(), 1, "canonical lookup must hit");
+}
+
+#[tokio::test]
+async fn find_by_purls_strips_qualifiers() {
+    let tmp = tempfile::tempdir().unwrap();
+    stage_dist_info(tmp.path(), "requests", "2.28.0").await;
+
+    let crawler = PythonCrawler;
+    let result = crawler
+        .find_by_purls(
+            tmp.path(),
+            &["pkg:pypi/requests@2.28.0?extension=tar.gz".to_string()],
+        )
+        .await
+        .unwrap();
+    assert_eq!(result.len(), 1, "qualifiers must be stripped before lookup");
+}
+
+#[tokio::test]
+async fn find_by_purls_empty_purls_returns_empty() {
+    let tmp = tempfile::tempdir().unwrap();
+    stage_dist_info(tmp.path(), "requests", "2.28.0").await;
+
+    let crawler = PythonCrawler;
+    let result = crawler.find_by_purls(tmp.path(), &[]).await.unwrap();
+    assert!(result.is_empty());
+}
+
+#[tokio::test]
+async fn find_by_purls_missing_site_packages_returns_empty() {
+    let tmp = tempfile::tempdir().unwrap();
+    let crawler = PythonCrawler;
+    // site_packages_path doesn't exist — read_dir Err arm must yield empty.
+    let result = crawler
+        .find_by_purls(
+            &tmp.path().join("no-such-dir"),
+            &["pkg:pypi/requests@2.28.0".to_string()],
+        )
+        .await
+        .unwrap();
+    assert!(result.is_empty());
+}
+
+#[tokio::test]
+async fn find_by_purls_invalid_purl_skipped() {
+    let tmp = tempfile::tempdir().unwrap();
+    stage_dist_info(tmp.path(), "requests", "2.28.0").await;
+
+    let crawler = PythonCrawler;
+    let result = crawler
+        .find_by_purls(tmp.path(), &["pkg:not-pypi/foo@1.0".to_string()])
+        .await
+        .unwrap();
+    assert!(result.is_empty());
+}
+
+#[tokio::test]
+async fn find_by_purls_version_mismatch_returns_empty() {
+    let tmp = tempfile::tempdir().unwrap();
+    stage_dist_info(tmp.path(), "requests", "2.28.0").await;
+
+    let crawler = PythonCrawler;
+    let result = crawler
+        .find_by_purls(tmp.path(), &["pkg:pypi/requests@99.99.99".to_string()])
+        .await
+        .unwrap();
+    assert!(result.is_empty());
+}
+
+#[tokio::test]
+async fn crawl_all_via_site_packages_finds_dist_info_packages() {
+    let tmp = tempfile::tempdir().unwrap();
+    stage_dist_info(tmp.path(), "Requests", "2.28.0").await;
+    stage_dist_info(tmp.path(), "urllib3", "2.0.0").await;
+    // A non-dist-info dir should be skipped.
+    tokio::fs::create_dir_all(tmp.path().join("ignore-me")).await.unwrap();
+
+    let crawler = PythonCrawler;
+    let opts = CrawlerOptions {
+        cwd: tmp.path().to_path_buf(),
+        global: true,
+        global_prefix: Some(tmp.path().to_path_buf()),
+        batch_size: 100,
+    };
+    let result = crawler.crawl_all(&opts).await;
+    let names: Vec<&str> = result.iter().map(|p| p.name.as_str()).collect();
+    assert!(names.contains(&"requests"));
+    assert!(names.contains(&"urllib3"));
+    assert_eq!(result.len(), 2);
+}
+
+#[tokio::test]
+async fn crawl_all_with_corrupt_metadata_skips() {
+    let tmp = tempfile::tempdir().unwrap();
+    let dist = tmp.path().join("broken-1.0.0.dist-info");
+    tokio::fs::create_dir_all(&dist).await.unwrap();
+    // Empty METADATA — read_python_metadata returns None.
+    tokio::fs::write(dist.join("METADATA"), b"").await.unwrap();
+
+    let crawler = PythonCrawler;
+    let opts = CrawlerOptions {
+        cwd: tmp.path().to_path_buf(),
+        global: true,
+        global_prefix: Some(tmp.path().to_path_buf()),
+        batch_size: 100,
+    };
+    let result = crawler.crawl_all(&opts).await;
+    assert!(result.is_empty(), "broken METADATA must be skipped");
+}
+
+/// `get_site_packages_paths` with `global_prefix` set returns just that
+/// prefix — exercises the early-return arm at python_crawler.rs:473-474.
+#[tokio::test]
+async fn get_site_packages_paths_with_global_prefix_passthrough() {
+    let tmp = tempfile::tempdir().unwrap();
+    let custom = tmp.path().join("custom-sp");
+    tokio::fs::create_dir_all(&custom).await.unwrap();
+
+    let crawler = PythonCrawler;
+    let opts = CrawlerOptions {
+        cwd: tmp.path().to_path_buf(),
+        global: false,
+        global_prefix: Some(custom.clone()),
+        batch_size: 100,
+    };
+    let paths = crawler.get_site_packages_paths(&opts).await.unwrap();
+    assert_eq!(paths, vec![custom]);
+}
+
+// ── METADATA early-break arm ───────────────────────────────────
+
+/// METADATA with extra header lines AFTER the blank line should NOT be
+/// parsed — the parser must stop at the first blank line after
+/// collecting name+version. Covers `python_crawler.rs:80-81`.
+#[tokio::test]
+async fn read_python_metadata_stops_at_blank_line_after_headers() {
+    let tmp = tempfile::tempdir().unwrap();
+    let dist = tmp.path().join("requests-2.28.0.dist-info");
+    tokio::fs::create_dir(&dist).await.unwrap();
+    // Headers block, then blank line, then garbage that would otherwise
+    // (re-)set Name to something else — the parser must NOT pick it up.
+    tokio::fs::write(
+        dist.join("METADATA"),
+        "Name: requests\nVersion: 2.28.0\n\nName: would-be-overwritten\nVersion: 9.9.9\n",
+    )
+    .await
+    .unwrap();
+
+    let result = read_python_metadata(&dist).await;
+    assert_eq!(
+        result,
+        Some(("requests".to_string(), "2.28.0".to_string())),
+        "parser must stop at first blank line; got {result:?}"
+    );
+}
+
 /// METADATA missing Version field → None.
 #[tokio::test]
 async fn read_python_metadata_missing_version_returns_none() {