Test Pipenv .env and .venv discovery end to end

Scan-level regressions for both fixes: a .env-named venv is scanned
(and PIPENV_DONT_LOAD_ENV turns that off), and an explicit "not in
project" setting now scans ./.venv as well as the WORKON_HOME venv.
The Pipenv compatibility doc describes the new discovery rules.

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-cli/tests/in_process_python_envs.rs

@@ -546,6 +546,8 @@ const PIPENV_VARS: &[&str] = &[
     "PIPENV_NO_VENV_IN_PROJECT",
     "PIPENV_CUSTOM_VENV_NAME",
     "PIPENV_PIPFILE",
+    "PIPENV_DONT_LOAD_ENV",
+    "PIPENV_DOTENV_LOCATION",
 ];
 
 /// Run `scan` with exactly `env` set among [`PIPENV_VARS`].
@@ -612,33 +614,103 @@ async fn pipenv_opt_outs_keep_activated_virtual_env_from_hijacking_scan() {
     }
 }
 
-/// #334: Pipenv never uses `venv/`, and `PIPENV_VENV_IN_PROJECT=0` makes it
-/// ignore a `./.venv` directory, so neither may shadow Pipenv's venv.
+/// #334: Pipenv never uses `venv/`, so it may not shadow Pipenv's venv.
 #[tokio::test]
 #[serial]
 async fn pipenv_stray_venv_dirs_do_not_shadow_the_pipenv_venv() {
-    for (stray, opt_out) in [("venv", None), (".venv", Some("0"))] {
+    let (_tmp, project, workon) = pipenv_project();
+    let stray_site = venv_site_packages(&project.join("venv"), "python3.12");
+    std::fs::create_dir_all(&stray_site).unwrap();
+    write_dist_info(&stray_site, "stray_decoy", "6.6.6");
+    let server = MockServer::start().await;
+    mock_batch_empty(&server).await;
+    let env: Vec<(&str, &Path)> = vec![
+        ("WORKON_HOME", &workon),
+        ("PIPENV_CUSTOM_VENV_NAME", Path::new("proj-env")),
+    ];
+    let code = scan_with_pipenv_env(default_args(&project, server.uri()), &env).await;
+    assert_eq!(code, 0);
+    let bodies = batch_bodies(&server).await;
+    assert_discovered(&bodies, "pkg:pypi/pipenv-pkg@1.0.0");
+    assert_not_discovered(&bodies, "pkg:pypi/stray-decoy@6.6.6");
+}
+
+/// #645: with `PIPENV_VENV_IN_PROJECT=0` (or `PIPENV_NO_VENV_IN_PROJECT=1`)
+/// only Pipenv 2023.11.14+ ignores a `./.venv` directory; 2018.11 through
+/// 2023.10.24 still use it. Both venvs are scanned, so whichever one the
+/// installed Pipenv uses is patched.
+#[tokio::test]
+#[serial]
+async fn pipenv_explicit_not_in_project_still_scans_dot_venv() {
+    for (name, value) in [
+        ("PIPENV_VENV_IN_PROJECT", "0"),
+        ("PIPENV_NO_VENV_IN_PROJECT", "1"),
+    ] {
         let (_tmp, project, workon) = pipenv_project();
-        let stray_site = venv_site_packages(&project.join(stray), "python3.12");
-        std::fs::create_dir_all(&stray_site).unwrap();
-        write_dist_info(&stray_site, "stray_decoy", "6.6.6");
+        let dot_site = venv_site_packages(&project.join(".venv"), "python3.12");
+        std::fs::create_dir_all(&dot_site).unwrap();
+        write_dist_info(&dot_site, "dot_venv_pkg", "1.0.0");
         let server = MockServer::start().await;
         mock_batch_empty(&server).await;
-        let mut env: Vec<(&str, &Path)> = vec![
+        let env: Vec<(&str, &Path)> = vec![
             ("WORKON_HOME", &workon),
             ("PIPENV_CUSTOM_VENV_NAME", Path::new("proj-env")),
+            (name, Path::new(value)),
         ];
-        if let Some(value) = opt_out {
-            env.push(("PIPENV_VENV_IN_PROJECT", Path::new(value)));
-        }
         let code = scan_with_pipenv_env(default_args(&project, server.uri()), &env).await;
-        assert_eq!(code, 0, "{stray}");
+        assert_eq!(code, 0, "{name}={value}");
         let bodies = batch_bodies(&server).await;
         assert_discovered(&bodies, "pkg:pypi/pipenv-pkg@1.0.0");
-        assert_not_discovered(&bodies, "pkg:pypi/stray-decoy@6.6.6");
+        assert_discovered(&bodies, "pkg:pypi/dot-venv-pkg@1.0.0");
     }
 }
 
+/// #546: Pipenv loads the project's `.env` before it picks the venv, so a
+/// `PIPENV_CUSTOM_VENV_NAME` or `WORKON_HOME` there decides which venv is
+/// scanned (and `PIPENV_DONT_LOAD_ENV` turns that off).
+#[tokio::test]
+#[serial]
+async fn pipenv_dotenv_settings_pick_the_scanned_venv() {
+    // Name in .env, WORKON_HOME exported.
+    let (_tmp, project, workon) = pipenv_project();
+    std::fs::write(project.join(".env"), "PIPENV_CUSTOM_VENV_NAME=proj-env\n").unwrap();
+    let server = MockServer::start().await;
+    mock_batch_empty(&server).await;
+    let code = scan_with_pipenv_env(
+        default_args(&project, server.uri()),
+        &[("WORKON_HOME", &workon)],
+    )
+    .await;
+    assert_eq!(code, 0);
+    assert_discovered(&batch_bodies(&server).await, "pkg:pypi/pipenv-pkg@1.0.0");
+
+    // Both in .env, nothing exported.
+    std::fs::write(
+        project.join(".env"),
+        format!(
+            "export WORKON_HOME=\"{}\"\nPIPENV_CUSTOM_VENV_NAME=proj-env # named\n",
+            workon.display()
+        ),
+    )
+    .unwrap();
+    let server = MockServer::start().await;
+    mock_batch_empty(&server).await;
+    let code = scan_with_pipenv_env(default_args(&project, server.uri()), &[]).await;
+    assert_eq!(code, 0);
+    assert_discovered(&batch_bodies(&server).await, "pkg:pypi/pipenv-pkg@1.0.0");
+
+    // PIPENV_DONT_LOAD_ENV: Pipenv ignores .env, and so does discovery.
+    let server = MockServer::start().await;
+    mock_batch_empty(&server).await;
+    let code = scan_with_pipenv_env(
+        default_args(&project, server.uri()),
+        &[("PIPENV_DONT_LOAD_ENV", Path::new("1"))],
+    )
+    .await;
+    assert_eq!(code, 0);
+    assert_not_discovered(&batch_bodies(&server).await, "pkg:pypi/pipenv-pkg@1.0.0");
+}
+
 // ---------------------------------------------------------------------------
 // Package-manager-recorded envs: PDM's saved interpreter / PEP 582, and uv's
 // UV_PROJECT_ENVIRONMENT, ahead of a stray `./.venv` the manager never uses

docs/testing/pipenv-compatibility.md

@@ -17,7 +17,7 @@ requirements.txt lanes of the same ecosystem.
 
 | Input | Hosted | Vendored | Agent |
 |-------|--------|----------|-------|
-| `Pipfile.lock`, `pipfile-spec: 6` (Pipenv 7 and later) | Every category (`default`, `develop`, Pipenv 2022+ named categories) that pins the patched release becomes `{"file" \| "path": "<url>#sha256=<hex>", "hashes": ["sha256:<hex>"]}` with `markers`/`extras`/`index` kept as Pipenv wrote them and `version` dropped. `path` for Pipenv 7–11, `file` from 2018. `_meta` (the Pipfile content hash) and the Pipfile are untouched. | Every matching category refers to the committed wheel under `.socket/vendor/pypi/<uuid>/`; wheels with extras use `path` (Pipenv 2022's file-URL bug). Requires Pipenv 2018 or later (`pypi_pipenv_installer_unsupported`). | Independent of the lock: patches the installed distribution in the venv Pipenv resolves for the project — `VIRTUAL_ENV` unless `PIPENV_ACTIVE` / `PIPENV_IGNORE_VIRTUALENVS` is set, in-project `.venv` subject to `PIPENV_VENV_IN_PROJECT` and the Pipfile's `[pipenv] venv_in_project`, or Pipenv's default `$WORKON_HOME/<dir>-<hash>[-<python>]`; never `venv/` (discovered without running Pipenv). With an auto-detected `.venv` and an existing WORKON_HOME venv, both are patched, since Pipenv 2026.2+ uses the WORKON_HOME venv and older releases use `.venv`. |
+| `Pipfile.lock`, `pipfile-spec: 6` (Pipenv 7 and later) | Every category (`default`, `develop`, Pipenv 2022+ named categories) that pins the patched release becomes `{"file" \| "path": "<url>#sha256=<hex>", "hashes": ["sha256:<hex>"]}` with `markers`/`extras`/`index` kept as Pipenv wrote them and `version` dropped. `path` for Pipenv 7–11, `file` from 2018. `_meta` (the Pipfile content hash) and the Pipfile are untouched. | Every matching category refers to the committed wheel under `.socket/vendor/pypi/<uuid>/`; wheels with extras use `path` (Pipenv 2022's file-URL bug). Requires Pipenv 2018 or later (`pypi_pipenv_installer_unsupported`). | Independent of the lock: patches the installed distribution in the venv Pipenv resolves for the project — `VIRTUAL_ENV` unless `PIPENV_ACTIVE` / `PIPENV_IGNORE_VIRTUALENVS` is set, in-project `.venv` subject to `PIPENV_VENV_IN_PROJECT` and the Pipfile's `[pipenv] venv_in_project`, or Pipenv's default `$WORKON_HOME/<dir>-<hash>[-<python>]`; never `venv/` (discovered without running Pipenv). Settings come from the project's `.env` (or `PIPENV_DOTENV_LOCATION`, unless `PIPENV_DONT_LOAD_ENV`) layered over the environment, as Pipenv loads it first, and from the environment alone. With a `.venv` directory and an existing WORKON_HOME venv, both are patched unless the project is explicitly in-project: Pipenv 2026.2+ prefers the WORKON_HOME venv when nothing is set, 2023.11.14+ uses it when the project is explicitly not in-project, and older releases use `.venv` either way. |
 | `Pipfile.lock`, `pipfile-spec` < 6 (Pipenv 0–6) | Refused (`redirect_pipenv_skipped`), lock untouched. | Refused (`pypi_pipenv_spec_unsupported`). | Works. |
 | Lock-only checkout (nothing installed) | Discovered from the lock and redirected. | Discovered from the lock; the patched wheel or source distribution is downloaded and verified from the service without a local install. | Nothing to patch (no installed distribution); the lock's pins are listed as lockfile-only packages. |