Improve --suggest-fix: Better adherence to restrictions

[timweri]

Make --suggest-fix emit downgrade commands that satisfy the active requirements in Cargo.lock and workspace manifests, on a best-effort basis.

• Read dependent requirements from the sparse crates.io index and local manifests.
• Select the newest eligible, non-yanked version that satisfies every known requirement.
• Report blocked packages with the requirement that prevents a downgrade, and annotate suggestions when a
  requirement could not be verified.
• Preserve package source identity so local and registry packages with the same name and version do not
  affect each other.
• Add prerelease support, cache sparse-index records, and cover the behavior with unit and fixture tests.

[Copilot]

🟡 Changes recommended

Candidate filtering and source handling can produce incorrect or unusable downgrade commands.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Improves --suggest-fix by validating downgrade candidates against lockfile and manifest requirements.

Changes:

• Adds source-aware dependency and manifest constraint collection.
• Supports prereleases, blocked outcomes, and sparse-index caching.
• Expands unit, fixture, and end-to-end coverage.

File summaries

File	Description
Cargo.toml	Adds manifest, semver, and glob dependencies.
Cargo.lock	Locks the new dependency graph.
README.md	Documents enhanced suggestions and prereleases.
src/api.rs	Fetches and parses sparse-index records.
src/cache.rs	Caches sparse-index responses.
src/lockfile.rs	Preserves dependency edges and source identity.
src/main.rs	Integrates manifest constraints and prerelease handling.
src/manifest.rs	Extracts requirements from workspace manifests.
src/policy.rs	Updates test package construction.
src/report.rs	Reports suggestions, blockers, and unverified requirements.
src/suggest.rs	Implements constraint-aware candidate selection.
tests/fixtures/suggest_fix_e2e/Cargo.toml	Defines the fixture workspace.
tests/fixtures/suggest_fix_e2e/Cargo.lock	Supplies the fixture dependency graph.
tests/fixtures/suggest_fix_e2e/app/Cargo.toml	Supplies fixture manifest requirements.

Review details

Suppressed comments (2)

src/manifest.rs:196

• Alternate-registry dependencies are retained here but their registry identity is discarded in DirectRequirement. If one local package depends on crates.io foo and an aliased private-registry foo at the same version, the private requirement is enforced against the crates.io package and can incorrectly block its downgrade. Preserve and match registry/source identity for direct requirements, or treat unsupported alternate-registry requirements as unverified.

    // Path and git dependencies aren't registry-versioned.
    if let Some(detail) = dep.detail()
        && (detail.path.is_some() || detail.git.is_some())
    {
        return;

src/report.rs:184

• This guarantee is false when a suggestion has unverified_dependents: the code deliberately emits the command without knowing those requirements. Qualify the statement so users do not interpret a best-effort suggestion as resolver-safe.

  Suggestions satisfy every version requirement in Cargo.lock and your manifests.
  Source compatibility is not verified: build after applying.

• Files reviewed: 12/14 changed files
• Comments generated: 4
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Workspace exclusion globs and blocker attribution can currently produce incorrect downgrade diagnostics.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

src/manifest.rs:194

• workspace.exclude supports glob patterns, but Path::starts_with treats each entry literally. For example, exclude = ["crates/*-internal"] never matches and those packages' requirements are loaded, so an excluded workspace member can incorrectly block a downgrade. Match the relative path with glob::Pattern instead.

fn is_excluded(root_dir: &Path, member_dir: &Path, exclude: &[String]) -> bool {
    let Ok(relative) = member_dir.strip_prefix(root_dir) else {
        return false;
    };
    exclude.iter().any(|pattern| relative.starts_with(pattern))

• Files reviewed: 11/14 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

Candidate filtering, local optional dependencies, and workspace exclusion globs can produce incorrect outcomes.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

src/manifest.rs:148

• workspace.exclude entries use glob patterns, but Path::starts_with treats *, ?, and character classes literally. Thus an exclusion such as exclude = ["crates/experimental-*"] is ignored; the excluded package is loaded as a workspace member and its dev-dependencies can become false downgrade blockers. Match each root-relative path with Cargo-compatible glob semantics instead.

    exclude.iter().any(|pattern| relative.starts_with(pattern))

• Files reviewed: 12/15 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

Candidate filtering, manifest attribution, exclusion matching, and symlink handling can produce incorrect suggestions.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

src/suggest.rs:84

• This unconditional caret-zone filter drops older versions even when every gathered requirement accepts them—for example, a lock at 2.0.0 with >=1,<3 can legally move to an old-enough 1.9.0, but this path reports no compliant version. Let the collected requirements determine eligibility instead of imposing an undocumented compatible-zone restriction.

            if !same_compatible_zone(locked, &parsed) {
                return None;
            }

src/suggest.rs:307

• Every local declaration is treated as mandatory, although load_direct_requirements collects optional and target-specific declarations and currently discards that metadata. A permissive direct dependency plus a restrictive optional alias can therefore block a downgrade instead of marking the dependent unverified, unlike the registry-index path and the documented best-effort behavior. Preserve the declaration metadata in DirectRequirement and derive mandatory from it here.

                .map(|r| NormalizedDeclaration {
                    req: r.req.clone(),
                    mandatory: true,

src/manifest.rs:148

• workspace.exclude supports glob patterns, but starts_with treats metacharacters literally and also overmatches plain prefixes (for example, excluding crates/foo also excludes crates/foo-extra). This can load requirements from excluded packages or omit active members. Match the normalized relative member path using glob patterns instead.

    exclude.iter().any(|pattern| relative.starts_with(pattern))

• Files reviewed: 21/23 changed files
• Comments generated: 1
• Review effort level: Balanced