[VPEX][5c] local-env: --check cache purity, greenfield name, and databricks-connect insertion

[rugpanov]

Why

Follow-up fixes to the local-env python sync pipeline (#5851, now merged), from codex and reviewer feedback. Three independent correctness issues in the merge / dry-run paths, none of which the pipeline PR's own tests caught:

1. --check still wrote to disk. FetchConstraints populated the on-disk constraint cache on every successful live fetch, so a dry run mutated the cache directory even though the pipeline skips every other write-side step under --check.
2. Greenfield rendered an invalid project name. filepath.Base(ProjectDir) is . when run from the project's own directory (and / at root) — not a valid PEP 621/508 name, so uv sync rejected the generated pyproject.toml.
3. Default-mode sync failed for an existing project without a databricks-connect pin. The merge only replaced an existing pin; it never inserted one, so an existing pyproject.toml with a dev group but no databricks-connect was written back unchanged, uv installed nothing, and validation failed with E_VALIDATE. Greenfield worked only because RenderFreshPyproject inserts the pin — a path the existing-project merge lacked.

What

• --check no cache write — thread a writeCache bool through FetchConstraints; the pipeline passes !p.Check. An existing cache is still read for offline fallback (reading is not a mutation); only the write is suppressed under a dry run.
• Valid greenfield name — projectName() resolves ./""/root via filepath.Abs before taking the base and sanitizes to a valid PEP 508 identifier (non-alphanumeric runs collapse to -, trimmed), falling back to app when nothing usable remains.
• Insert databricks-connect when absent — mergeDatabricksConnect now inserts the pin into [dependency-groups].dev (single- or multi-line array), creating the dev key and the [dependency-groups] table when absent, mirroring RenderFreshPyproject. Constraints-only (empty value) stays a no-op. Detection is comment-aware and spans the whole array, so a pin on the dev = [ line or one carrying a trailing comment is rewritten in place rather than duplicated (a duplicate-pin bug codex caught in the first cut of this change). The insert path is idempotent.

Testing strategy

• --check purity: TestFetchConstraintsSkipsCacheWriteWhenDisabled, and TestPipelineCheckMutatesNothing strengthened to assert the cache dir stays empty; TestPipelineCheckReRunPlanMatchesRealRun for accurate re-run plans.
• Greenfield name: TestProjectName, TestPipelineGreenfieldFromDotDirRendersValidName.
• databricks-connect insertion: TestMergeInserts{DatabricksConnectMultiLine,SingleLine,EmptyDev,DevKeyWhenAbsent,DependencyGroupsWhenAbsent}, no-duplicate regressions TestMergeReplacesDatabricksConnect{OnDevLine,WithTrailingComment}, and TestMergeConstraintsOnlyDoesNotInsertDatabricksConnect.
• Gates: go build, go test, golangci-lint (0 issues), deadcode, gofmt — all green.

---

About this stack

Follow-up to the databricks local-env python sync stack; targets main now that the pipeline PR (#5851) has merged.

This pull request and its description were written by Isaac.

[eng-dev-ecosystem-bot]

Integration test report

Commit: 0eb1236

Run: 29321919460

	Env	🔄​flaky	💚​RECOVERED	🙈​SKIP	✅​pass	🙈​skip	Time
💚​	aws linux		4	4	230	1084	5:18
💚​	aws windows		4	4	232	1082	7:13
💚​	aws-ucws linux		4	4	316	1001	5:39
💚​	aws-ucws windows		4	4	318	999	7:28
🔄​	azure linux	2	2	4	230	1083	6:53
🔄​	azure windows	2	2	4	232	1081	9:25
💚​	azure-ucws linux		4	4	318	998	5:39
💚​	azure-ucws windows		4	4	320	996	7:16
💚​	gcp linux		4	4	229	1085	5:06
💚​	gcp windows		4	4	231	1083	6:59

8 interesting tests: 4 SKIP, 2 RECOVERED, 2 flaky

	Test Name	aws linux	aws windows	aws-ucws linux	aws-ucws windows	azure linux	azure windows	azure-ucws linux	azure-ucws windows	gcp linux	gcp windows
💚​	TestAccept	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
🙈​	TestAccept/bundle/invariant/no_drift	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_endpoints/drift/recreated_same_name	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_indexes/recreate/embedding_dimension	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/ssh/connection	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
💚​	TestFetchRepositoryInfoAPI_FromRepo	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
🔄​	TestFetchRepositoryInfoAPI_FromRepo/root	💚​R	💚​R	💚​R	💚​R	🔄​f	🔄​f	💚​R	💚​R	💚​R	💚​R
🔄​	TestFetchRepositoryInfoAPI_FromRepo/subdir	💚​R	💚​R	💚​R	💚​R	🔄​f	🔄​f	💚​R	💚​R	💚​R	💚​R

Top 10 slowest tests (at least 2 minutes):

duration	env	testname
6:23	aws-ucws windows	TestAccept
6:02	gcp windows	TestAccept
5:59	azure-ucws windows	TestAccept
5:59	aws windows	TestAccept
5:57	azure windows	TestAccept
2:54	gcp linux	TestAccept
2:51	azure linux	TestAccept
2:49	aws linux	TestAccept
2:48	aws-ucws linux	TestAccept
2:43	azure-ucws linux	TestAccept

[anton-107]

Approving. Tight, correct follow-up: writeCache threaded through FetchConstraints with the pipeline passing !p.Check, and an existing cache is still read for offline fallback (reading isn't a mutation) — exactly right. Test pair is the right shape: unit (TestFetchConstraintsSkipsCacheWriteWhenDisabled) plus the strengthened end-to-end TestPipelineCheckMutatesNothing asserting the cache dir stays empty. All call sites updated. No findings.

[rugpanov]

codex review [P2] — duplicate databricks-connect pins — fixed in b09b9ce.

Confirmed the bug (reproduced: 2 pins for both dev = ["databricks-connect~=16", opening-line arrays and elements with a trailing comment). The multi-line detection used an anchored per-line regex (dbconnectLineRe, …"$) that started scanning at devStart+1, so a pin on the dev = [ line or one carrying a trailing comment was missed → the insert path added a second pin.

Fix: the multi-line branch now scans the whole array span (devStart..arrayLast), detects an existing databricks-connect token comment-aware (via dbconnectTokenRe), and rewrites it in place; it inserts only when no element exists anywhere. Removed the now-unused dbconnectLineRe. Regression tests: TestMergeReplacesDatabricksConnectOnDevLine, TestMergeReplacesDatabricksConnectWithTrailingComment. All gates green.

[rugpanov]

codex review [P3] — trailing-comment mutation — fixed in e257732.

Confirmed (reproduced: a dev element with a comment mentioning a quoted "databricks-connect…" token had the comment rewritten too). The multi-line replace applied dbconnectTokenRe to the whole line. Now it splits at commentStart and rewrites only the code portion, re-appending the comment byte-for-byte — matching the single-line branch. Regression test TestMergePreservesCommentMentioningDatabricksConnect. All gates green.

[rugpanov]

isaac review — 2 MAJOR bugs in the databricks-connect insert path — both fixed in 0eb1236.

Both reproduced and confirmed real:

1. Non-canonical spelling → duplicate pin. Detection used a raw case/hyphen-sensitive substring, but the artifact side matches under PEP 503 (isDatabricksConnectDep). An existing databricks_connect / Databricks-Connect / databricks.connect pin escaped detection, so the insert path appended a second element → conflicting specifiers → uv sync fails. Fixed: replaceDbconnectElement now matches quoted elements under PEP 503 normalization (reusing isDatabricksConnectDep), applied at all detect/replace sites; removed the old dbconnectTokenRe. Test TestMergeRewritesNonCanonicalDatabricksConnectSpelling.

2. Insert produced invalid TOML when the last element had no trailing comma. TOML allows omitting the final comma; the insert appended a new element after it with no separator. Fixed: ensureTrailingComma adds the separator to the prior last element (preserving whitespace/comment) before inserting. Test TestMergeInsertsCommaWhenLastElementHasNone (+ idempotency round-trip).

All gates green (build, test, lint 0, deadcode, gofmt).