Fix direct URL dependencies not stored in lockfile

[matteius]

Summary

Fixes #5967

When a package has an extra dependency with a direct URL using PEP 508 syntax (e.g., my-package @ https://server.com/my-package-1.0.0.whl), the URL was not being stored in the lockfile. This caused pipenv to fall back to searching PyPI for the package, which would fail if the package is only available at the private URL.

Root Cause

In pipenv/utils/locking.py, the format_requirement_for_lockfile function only checked for req.link.is_file (which only matches file:// URLs), but not for remote HTTP/HTTPS URLs:

if req.link and req.link.is_file:
    entry["file"] = req.link.url

For a remote URL like https://my-private-artifactory-url/.../my-private-dependency-1.0.0.whl, is_file returns False (it only returns True for file:// scheme URLs), so the URL was never stored in the lockfile.

Fix

Added handling for http and https schemes, storing the URL in the file key of the lockfile entry (same as file:// URLs):

if req.link:
    if req.link.is_file:
        entry["file"] = req.link.url
    elif req.link.scheme in ("http", "https"):
        # Handle direct URL dependencies (PEP 508 style: package @ https://...)
        entry["file"] = req.link.url
        entry.pop("version", None)  # URL deps don't need version
        entry.pop("index", None)  # URL deps don't use index

Tests

Added unit tests for:

• HTTPS direct URL dependencies
• HTTP direct URL dependencies
• Local file:// URLs (regression test)
• Regular PyPI dependencies (regression test)

---

Pull Request opened by Augment Code with guidance from the PR author