sbt, Mill and scala-cli support in agent, hosted and vendored modes

[Mikola Lysenko (mikolalysenko)]

This adds sbt, Mill and scala-cli support for pkg:maven patches in agent, hosted and vendored modes. It is stacked on #646 (Gradle), so review and merge #646 first; this PR's diff is against feat/gradle-support.

In every mode the user's own build files (build.sbt and friends) are left untouched. socket-patch only writes files it owns.

How each mode works

Mode	sbt (0.13.18, 1.x, 2.x)	Mill	scala-cli
Agent	Patches jars in place in the Coursier cache (sbt 1.3+) and the Ivy cache (sbt 0.13–1.2, or useCoursier := false). Coursier's checksum sidecars are resynced.	In place (Coursier)	In place (Coursier)
Hosted	Writes one owned root file, socket-patch.sbt	Guidance snippet	Guidance snippet
Vendored	Writes socket-patch-vendor.sbt and a committed .socket/vendor/maven2 tree	Guidance only (wiring it means editing user files)	Owned socket-patch.scala plus a same-GAV Coursier tree (directory builds)

Hosted and vendored sbt. Both modes use a generated file with these properties, all verified by probe on every sbt line:

• Scope. It works through inThisBuild, so it reaches every subproject and transitive dependency, and never adds a dependency.
• Version. It pins the suffixed <v>-socket.<hex8> version with dependencyOverrides. This is needed because Ivy and Coursier both rank the plain release above the suffix.
• Integrity at load. It checks a sha256 for every patched jar and pom when sbt loads. A wrong hash fails the load.
• Integrity after resolution. A post-resolution check fails the build if a resolved jar's bytes aren't pinned, or if a project declares a newer version of a patched package.
• Repository order. On 0.13 and 1.x it puts its repository first, so offline builds resolve.

Scoping. sbt has no lockfile, and dependencyOverrides would downgrade a project that resolves a newer version. Hosted and vendored modes therefore pin a package only when sbt's own resolution records under target/ show the project resolves exactly the patched base version.

• With no records, or stale ones, the run warns once and wires nothing.
• socket-patch never runs sbt.

Background: docs/design/sbt-support.md, docs/design/sbt-template-probe.md and docs/design/sbt-evidence-probe.md. New codes are listed in CLI_CONTRACT.md.

Test coverage

These are the real-tool docker runs (scripts/sbt-compat-matrix.sh):

Group	Versions	Result
hosted	sbt 0.13.18, 1.2.8, 1.3.13 (JDK 8); 1.9.9, 1.13.0, 2.0.9 (JDK 17); 2.0.9 (JDK 21)	14/14 tests per cell
vendored	same	8/8 tests per cell
agent	sbt 0.13.18, 1.2.8, 1.13.0, 2.0.9; useCoursier := false	pass
Mill agent	0.11.13, 0.12.17, 1.1.10	pass
scala-cli	1.17.1, agent and vendored	pass

Before this rebase, the full matrix also passed with JDK 21 legs for 1.13.0 and 2.0.9.

The hermetic suites (e2e_sbt, e2e_sbt_hosted, e2e_sbt_vendor, e2e_scala_cli_vendor), the golden harness redirect_sbt_golden and the vendored VEX cells all pass.

CI changes:

• New sbt-compatibility.yml: a docker matrix, scala-tools legs, and native macOS and Windows legs.
• New blocking sbt rows in ci.yml.

Known limits

• Untested legs. The native macOS and Windows legs have not run on GitHub before this PR.
• Agent mode. It inherits Full Gradle support in agent, hosted and vendored modes #646's every-copy fan-out and whole-jar swap. Coursier and Ivy copies plug into installed_copies.
• Unrelated failing test. mode_migration_npm::berry_vendored_then_hosted_takeover_leaves_pure_hosted fails locally on main as well. Fix yarn berry hosted pin leaking npm auth (#404) #465 changed the hosted Berry pin and the test was never updated. It only runs when real yarn is installed.

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches JVM cache patching, hosted/vendored wiring, and eject flows where mistakes could leave builds half-patched or break offline resolution; mitigated by extensive CI matrices and evidence gates, but scope spans security-sensitive dependency integrity paths.

Overview
Adds Maven patch support for Scala builds (sbt 0.13.18+, Mill, scala-cli) across agent, hosted, and vendored modes without editing user build.sbt / Mill / scala-cli sources.

Agent mode discovers and patches artifacts in Coursier and Ivy caches (alongside ~/.m2), fans out patches to every copy like Gradle, resyncs Coursier checksum sidecars after apply/rollback, and tightens Gradle-only mavenLocal() warnings so Coursier/Ivy paths are not treated as unconsumed ~/.m2.

Hosted mode wires sbt through a single generated socket-patch.sbt (pins, local repo, load-time verification), gated on resolution evidence under target/; Mill and scala-cli get manual snippets. Vendored mode adds socket-patch-vendor.sbt / scala-cli Coursier trees under .socket/vendor/, with shared evidence gates, new refusal/warning codes, and safer hosted→vendored eject (preflight + eject_incomplete backstop).

CI & tests: sbt joins docker e2e/coverage matrices; new sbt-compatibility.yml (version × JDK × mode matrix, Mill, scala-cli, macOS/Windows); Dockerfile.sbt, warm-seed scripts, byte-exact fixtures in .gitattributes. Hermetic e2e_sbt*, docker_e2e_sbt, and VEX sbt modules exercise the flows. Docs (CHANGELOG, README, CLI_CONTRACT) describe behavior and limits.

^{Reviewed by Cursor Bugbot for commit 650f561. Configure here.}

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​sbt/​setup-sbt@​6158cb0903b8ceeae04f830055f3155e1b6a5ad7

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​sbt/​setup-sbt@​6158cb0903b8ceeae04f830055f3155e1b6a5ad7

View full report

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Ivy POM fallback skips layout check
  • Added validation to ensure installed_dir is an Ivy artifact directory (jars/, bundles/, or orbits/) before walking to parent, preventing layout escape attacks where malicious POMs could be planted in shared parent directories.

Or push these changes by commenting:

@cursor push ecd6b3d40e

Preview (ecd6b3d40e)

diff --git a/crates/socket-patch-core/src/crawlers/ivy_cache.rs b/crates/socket-patch-core/src/crawlers/ivy_cache.rs
--- a/crates/socket-patch-core/src/crawlers/ivy_cache.rs
+++ b/crates/socket-patch-core/src/crawlers/ivy_cache.rs
@@ -176,6 +176,15 @@
     if let Ok(bytes) = read_regular_to_bytes_sync(&installed_dir.join(format!("{a}-{v}.pom"))) {
         return Some(bytes);
     }
+    // SECURITY: verify installed_dir is an Ivy artifact directory before
+    // walking to its parent, to prevent layout escape attacks.
+    let is_artifact_dir = installed_dir
+        .file_name()
+        .and_then(|n| n.to_str())
+        .is_some_and(|n| ARTIFACT_DIRS.contains(&n));
+    if !is_artifact_dir {
+        return None;
+    }
     let original = installed_dir
         .parent()?
         .join(format!("ivy-{v}.xml.original"));

_{You can send follow-ups to the cloud agent here.}

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent). This is stacked on #646, so review and merge #646 first.

• Head: 6a358e637e2cc8f0765819e16f50aa2f7980b7c6, 0 commits behind feat/gradle-support
• CI: 579/579 check runs passed (6 skipped, 0 failed or pending). Two jobs needed one re-run each:
  • sbt 1.13.0 e2e_sbt_vendor_build / windows-latest: the warm-up sbt update hit java.net.SocketException: Connection reset fetching commons-text-1.10.0.jar from repo1.maven.org. It passed on re-run.
  • native (ubuntu-latest, 1.0.10) (Poetry): only the online vexLedgersDeleted check failed, in the direct hosted cell. That check depends on the patch API. It passed on re-run. This is a flake class across the repo, not specific to this PR: since yesterday the PDM matrix has failed on attempt 1 on seven branches, including Fix Hatch environments being invisible to stale-install checks and VEX (#335) #700, Fix vendored revert leaving created scaffold behind (#636, #670) #672, Fix in-run hosted VEX attesting npm bundled copies (#325) #669 and Fix hosted gem redirect breaking multi-line and conditional gem lines (#340) #637, which don't touch JVM code. Fix Poetry matrix flakes on PyPI/patch API transport blips #596 and Retry patch API connections reset mid-handshake #610 target these transport blips.
• Bugbot: reviewed 6a358e6 and found no issues. All 8 review threads are resolved: 3 Bugbot findings fixed in e568897, and 5 CodeQL threads now outdated.
• Reviewers should look at: the generated socket-patch.sbt / socket-patch-vendor.sbt templates, and the target/ resolution-evidence gate that decides when sbt pins are wired. The native macOS and Windows legs of sbt-compatibility.yml ran green here for the first time.

---

Generated by Claude Code

[Tanmay Singla (Tanmay182003)]

[agent] I reviewed this PR and left inline comments on the bugs I verified in the code. Two more issues are outside the diff hunks:

• Rolling back a jar swap doesn't resync Coursier sidecars. Apply resyncs .a-1.jar__sha1/.computed via dispatch_fixup_with → coursier::fixup, but rollback_jar_swap (patch/jvm_jar.rs ~L781) only runs maven_sidecars::resync. A rolled-back member-keyed jar in a Coursier cache is left beside the patched jar's checksum/digest pair. That contradicts CLI_CONTRACT.md, which says the CLI resyncs them "after apply and rollback". A second rollback hits the already-Ready early return, so it doesn't repair it either.
• A cut-short evidence walk gives the wrong warning. When the evidence scan fails, distill returns a doc with deps_digest = "". digest is then Some(""), not None, so every new pin is refused as redirect_sbt_unsafe_value ("not 8 lowercase hex digits") instead of the run-level no_resolution_evidence warning that carries read_error. It fails closed, but the diagnosis is wrong.

Lower-confidence items I didn't verify as fully: takeover pre-checks only the gate, so later sbt planner refusals can leave a pin neither hosted nor vendored (commands/vendor.rs ~L2523-2560); holds_artifact skips pom-only GAV dirs in Coursier caches; --global-prefix <coursier v1> keeps only the first repository's copy (or_insert).

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 650f561. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review.

• Head: 650f56144a9459a52f38b2ed0cab81d796f472ea
• CI: 579/579 green (6 skipped) on this head; branch not behind its base, no conflicts
• Bugbot: reviewed 650f561, no new issues; all review threads resolved
• Reviewer note: Stacked on Full Gradle support in agent, hosted and vendored modes #646 (base feat/gradle-support) — merge Full Gradle support in agent, hosted and vendored modes #646 first, then retarget this to main.

---

Generated by Claude Code