Go: phase 5 — route go.mod tidy to the Java resolver; remove Go modgraph + Http

Complete the port: the GoModTidy recipe no longer resolves dependencies in the
Go peer. It now delegates the entire `go mod tidy` require-set computation to the
pure-Java resolver on the host via a new domain RPC method, GoModResolveTidy.

- core RewriteRpc: replace the generic, network-performing `Http` RPC method
  with a `registerLanguageMethods(JsonRpc)` extension hook (called before bind)
  and a protected getHttpSender(). The generic "host, fetch this URL for the
  peer" capability — the SSRF/coupling concern raised in review — is gone from
  the shared protocol.
- GoRewriteRpc: register GoModResolveTidy, which builds a CacheSource+ProxySource
  from the request and runs Resolver + Tidy. All GOPROXY HTTP happens here, in
  the host, through the configured HttpSender; GOPROXY=off resolves cache-only.
- Go side: resolveTidyViaJava sends {goMod, mainImports, modulePath,
  separateIndirect, goproxy, gomodcache} and applies the returned require set;
  computeTidySet calls it instead of the in-process resolver, falling back to the
  LST-only pass when no resolver is installed (offline). The parse-time marker now
  carries only the declared model; the resolved build list is computed on demand.
- Delete the Go pkg/parser/modgraph package (its algorithm now lives in Java) and
  the parse-time resolveModuleGraph/moduleSource/fetchHTTP plumbing.

Tested: GoModResolveTidyTest drives the exact handler entry point (resolveTidy)
and matches `go mod tidy` for gin's pruning-completeness case, fetching over the
proxy via HttpSender. Full rewrite-go Java suite, rewrite-core rpc tests, and the
Go unit suite are green.

Note: a full modw corpus sweep could not be run here — the moderne-cli
core/serialization module does not compile against the workspace rewrite
(pre-existing API skew, 128 errors in V3LstReader: LstMetadata, ChangesetFilter,
EditPage, UsesMethod.getMethodPattern, …), so the dev fat jar cannot be rebuilt.
This is unrelated to these changes (none touch those files) and predates them
(the on-disk fat jar is from before this work).

Author: sambsnyd

rewrite-core/src/main/java/org/openrewrite/rpc/RewriteRpc.java

@@ -38,12 +38,8 @@
 
 import org.openrewrite.HttpSenderExecutionContextView;
 import org.openrewrite.ipc.http.HttpSender;
-import org.openrewrite.ipc.http.HttpUrlConnectionSender;
 
-import java.io.ByteArrayOutputStream;
-import java.io.InputStream;
 import java.io.PrintStream;
-import java.util.Base64;
 import java.util.HashMap;
 import java.util.Map;
 import java.nio.file.Files;
@@ -243,52 +239,38 @@ protected Boolean handle(Void noParams) {
             }
         });
 
-        // Http: lets the RPC peer (e.g. the Go module-graph resolver fetching
-        // dependency go.mod files from a GOPROXY) perform an HTTP GET through
-        // the configured HttpSender, so proxy/auth/TLS are honored. Returns the
-        // status code and base64-encoded body.
-        jsonRpc.rpc("Http", new JsonRpcMethod<HttpRequest>() {
-            @Override
-            protected Object handle(HttpRequest request) {
-                HttpSender sender = httpSender != null ? httpSender : new HttpUrlConnectionSender();
-                Map<String, Object> out = new HashMap<>();
-                try (HttpSender.Response response = sender.get(request.url).send()) {
-                    ByteArrayOutputStream bos = new ByteArrayOutputStream();
-                    try (InputStream in = response.getBody()) {
-                        byte[] buf = new byte[8192];
-                        for (int n; (n = in.read(buf)) != -1; ) {
-                            bos.write(buf, 0, n);
-                        }
-                    }
-                    out.put("status", response.getCode());
-                    out.put("body", Base64.getEncoder().encodeToString(bos.toByteArray()));
-                } catch (Exception e) {
-                    out.put("status", 0);
-                    out.put("body", "");
-                }
-                return out;
-            }
-        });
+        // Language-specific RPC methods (registered by subclasses) are bound
+        // here, before jsonRpc.bind(). This is where, for example, the Go
+        // support registers its module-graph resolver — keeping domain-specific,
+        // network-performing methods out of the generic core protocol.
+        registerLanguageMethods(jsonRpc);
 
         jsonRpc.bind();
     }
 
     /**
-     * Configure the {@link HttpSender} used by the {@code Http} RPC method.
-     * Typically set from a parse/recipe ExecutionContext so the peer's HTTP
+     * Hook for a subclass to register additional, language-specific RPC methods
+     * on the bidirectional channel before it is bound. The default registers
+     * nothing. Implementations may delegate network calls to {@link
+     * #getHttpSender()} so proxy/auth/TLS are honored. Invoked from the
+     * constructor, so implementations must not rely on subclass instance state.
+     */
+    protected void registerLanguageMethods(JsonRpc jsonRpc) {
+    }
+
+    /**
+     * Configure the {@link HttpSender} a language method may use to perform HTTP
+     * on the peer's behalf. Typically set from a parse/recipe ExecutionContext so
      * fetches use the CLI-configured sender (proxy, auth, TLS).
      */
     public RewriteRpc setHttpSender(@Nullable HttpSender httpSender) {
         this.httpSender = httpSender;
         return this;
     }
 
-    /**
-     * Request body for the {@code Http} RPC method.
-     */
-    static class HttpRequest {
-        public String url;
-        public @Nullable String method;
+    /** The configured {@link HttpSender}, for use by language RPC methods. */
+    protected @Nullable HttpSender getHttpSender() {
+        return httpSender;
     }
 
     public RewriteRpc livenessCheck(Supplier<? extends @Nullable RuntimeException> livenessCheck) {

rewrite-go/cmd/rpc/main.go

@@ -20,7 +20,6 @@ package main
 
 import (
 	"bufio"
-	"encoding/base64"
 	"encoding/csv"
 	"encoding/json"
 	"flag"
@@ -40,7 +39,6 @@ import (
 	"github.com/grafana/pyroscope-go"
 
 	goparser "github.com/openrewrite/rewrite/rewrite-go/pkg/parser"
-	"github.com/openrewrite/rewrite/rewrite-go/pkg/parser/modgraph"
 	"github.com/openrewrite/rewrite/rewrite-go/pkg/preconditions"
 	"github.com/openrewrite/rewrite/rewrite-go/pkg/printer"
 	"github.com/openrewrite/rewrite/rewrite-go/pkg/recipe"
@@ -829,95 +827,53 @@ func mapMarkerPrinter(mp *string) printer.MarkerPrinter {
 	}
 }
 
-// fetchHTTP performs an HTTP GET by delegating to the Java side over
-// bidirectional RPC, which executes the request through the CLI-configured
-// OpenRewrite HttpSender (proxy, auth, TLS all honored). Returns the response
-// body and status code. Used by the module-graph resolver to fetch dependency
-// go.mod files from a GOPROXY when they are not in the local module cache.
-func (s *server) fetchHTTP(url string) ([]byte, int, error) {
+// resolveTidyViaJava computes the `go mod tidy` require set by delegating to the
+// pure-Java module resolver over bidirectional RPC. The Java side performs all
+// GOPROXY HTTP through the CLI-configured OpenRewrite HttpSender (proxy, auth,
+// TLS honored) and writes fetched modules through to the standard module cache,
+// so no network egress originates from this peer. We pass the GOPROXY/GOMODCACHE
+// resolved from the environment; GOPROXY=off degrades to cache-only on the host.
+func (s *server) resolveTidyViaJava(content string, mainImports []string, modulePath string, separateIndirect bool) (recipes.TidyRequireSet, bool) {
 	s.httpMu.Lock()
 	defer s.httpMu.Unlock()
-	params, _ := json.Marshal(map[string]any{"url": url, "method": "GET"})
+	params, _ := json.Marshal(map[string]any{
+		"goMod":            content,
+		"mainImports":      mainImports,
+		"modulePath":       modulePath,
+		"separateIndirect": separateIndirect,
+		"goproxy":          envOr("GOPROXY", "https://proxy.golang.org,direct"),
+		"gomodcache":       envOr("GOMODCACHE", defaultModCache()),
+	})
 	req, _ := json.Marshal(map[string]any{
 		"jsonrpc": "2.0",
-		"id":      "go-Http",
-		"method":  "Http",
+		"id":      "go-GoModResolveTidy",
+		"method":  "GoModResolveTidy",
 		"params":  json.RawMessage(params),
 	})
 	header := fmt.Sprintf("Content-Length: %d\r\n\r\n", len(req))
 	if _, err := s.writer.Write(append([]byte(header), req...)); err != nil {
-		return nil, 0, err
+		return recipes.TidyRequireSet{}, false
 	}
 	resp, err := s.readMessage()
 	if err != nil {
-		return nil, 0, err
+		return recipes.TidyRequireSet{}, false
 	}
 	raw := resp.Result
 	if raw == nil {
 		raw = resp.Params
 	}
 	if raw == nil {
-		return nil, 0, fmt.Errorf("Http: empty response")
+		return recipes.TidyRequireSet{}, false
 	}
 	var out struct {
-		Status int    `json:"status"`
-		Body   string `json:"body"` // base64
+		Direct   map[string]string `json:"direct"`
+		Indirect map[string]string `json:"indirect"`
+		Complete bool              `json:"complete"`
 	}
 	if err := json.Unmarshal(raw, &out); err != nil {
-		return nil, 0, err
-	}
-	body, err := base64.StdEncoding.DecodeString(out.Body)
-	if err != nil {
-		return nil, 0, err
-	}
-	return body, out.Status, nil
-}
-
-// resolveModuleGraph enriches a go.mod's GoResolutionResult marker with the
-// resolved module graph + build list. Dependency go.mod files are read from the
-// local module cache first and fetched from the GOPROXY (via the Java
-// HttpSender) on a miss. Best-effort: on any failure the marker keeps whatever
-// was resolved and GraphComplete reflects partiality.
-//
-// Proxy fetching is on by default and disabled the Go-native way with
-// GOPROXY=off. Fetched modules are written through to the standard module
-// cache, so the first parse warms it and every later parse/recipe run — across
-// projects on the machine — resolves the full graph offline.
-func (s *server) resolveModuleGraph(goModContent []byte, mrr *golang.GoResolutionResult) {
-	res, err := modgraph.Resolve(goModContent, s.moduleSource())
-	if err != nil {
-		s.logger.Printf("resolveModuleGraph: %v", err)
-		return
+		return recipes.TidyRequireSet{}, false
 	}
-	modgraph.ApplyTo(res, mrr)
-}
-
-// moduleSource builds the dependency-resolution source: the local module cache
-// first, then (unless disabled) a write-through GOPROXY tier whose HTTP is
-// delegated to the Java HttpSender via the bidirectional Http method. Proxy
-// fetches persist .mod/.zip/.ziphash into the standard $GOMODCACHE/cache/download
-// layout, so the cache fills in on first use and is shared by every subsequent
-// lookup. The same source is used at parse time and installed into the recipe
-// ExecutionContext for recipe-time re-resolution, giving both the full graph.
-func (s *server) moduleSource() modgraph.ModSource {
-	gomodcache := envOr("GOMODCACHE", defaultModCache())
-	sources := []modgraph.ModSource{modgraph.CacheSource(gomodcache)}
-	if proxyResolveEnabled() {
-		goproxy := envOr("GOPROXY", "https://proxy.golang.org,direct")
-		sources = append(sources, modgraph.ProxyWriteThroughSource(goproxy, gomodcache, s.fetchHTTP))
-	}
-	return modgraph.TieredSource(sources...)
-}
-
-// proxyResolveEnabled reports whether the GOPROXY tier should be added. Network
-// module resolution is on by default — like rewrite's other ecosystems we
-// attempt the network (via the CLI HttpSender) and degrade gracefully to the
-// local cache and the existing require set when it is unavailable. It is
-// disabled the Go-native way, GOPROXY=off, the standard mechanism for
-// air-gapped builds. (A GOPROXY list such as "https://corp,off" still enables
-// the proxy; only the bare value "off" means no network.)
-func proxyResolveEnabled() bool {
-	return strings.TrimSpace(os.Getenv("GOPROXY")) != "off"
+	return recipes.TidyRequireSet{Direct: out.Direct, Indirect: out.Indirect, Complete: out.Complete}, true
 }
 
 func envOr(key, def string) string {
@@ -1164,10 +1120,10 @@ func (s *server) resolveExecutionContext(pid *string) *recipe.ExecutionContext {
 		s.preparedContexts[*pid] = ctx
 	}
 	s.installDataTableStore(ctx)
-	// Make the dependency-resolution source available so recipes that mutate
-	// dependencies can re-resolve the module model at recipe time (network via
-	// the Java HttpSender).
-	recipes.SetModSource(ctx, s.moduleSource())
+	// Install the recipe-time tidy resolver, which delegates the require-set
+	// computation to the pure-Java module resolver on the host (all GOPROXY HTTP
+	// runs there through the CLI HttpSender).
+	recipes.SetTidyResolver(ctx, s.resolveTidyViaJava)
 	return ctx
 }
 
@@ -2083,9 +2039,8 @@ func (s *server) handleParseProject(params json.RawMessage) (any, *rpcError) {
 		if sumData, err := os.ReadFile(sumPath); err == nil {
 			mrr.ResolvedDependencies = goparser.ParseGoSum(string(sumData))
 		}
-		// Enrich with the resolved module graph + build list (cache, then
-		// GOPROXY via the Java HttpSender) so recipes get the full graph.
-		s.resolveModuleGraph(data, mrr)
+		// The marker carries only the declared model at parse time; the resolved
+		// build list is computed on demand by the Java resolver at recipe time.
 		mods[filepath.Dir(modPath)] = &modCtx{dir: filepath.Dir(modPath), mrr: mrr}
 	}