GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1001
Fixes #729

Summary

scan --mode hosted (and get --mode hosted) now judges stale gem installs only in the gem homes bundle install actually installs into or reuses, and it decides whether a home belongs to the project the same way however --cwd is spelled.

• Hosted gem stale-install guard flags an unused system gem-home copy when the project sets a Bundler path that isn't installed yet, so scan --mode hosted --vex fails with no_applicable_patches on fresh checkouts #1001: a project that sets a Bundler install path (in .bundle/config, env BUNDLE_PATH or the global config) but hasn't installed into it yet no longer gets a false redirect_gem_stale_install for an unrelated copy in the machine's gem env home. That copy is no longer dropped from the same run's --vex, so scan --mode hosted --vex attests the patch (exit 0) instead of failing with no_applicable_patches on fresh checkouts.
• Hosted gem stale-install warning calls the project's own vendor/bundle a "shared gem home" when --cwd is left at its default (or relative), so it gives the wrong remedy and drops the committed cache archive from the delete list #729: with the default --cwd ., a stale copy in the project's own vendor/bundle gets the project-local delete-list remedy instead of the "shared gem home" caveat, and the committed vendor/cache archive is folded into that warning's delete list.

Root cause

The guard (gem_stale_install_warnings in crates/socket-patch-cli/src/commands/scan/hosted.rs) answered two questions with lexical tests on RubyCrawler::get_gem_paths, a flat path list built for agent apply:

1. Which homes does Bundler reuse? get_gem_paths appends the gem env homes whenever the default vendor/bundle has no store. apply needs that for default gems. But with an explicit path, Bundler's use_system_gems? is false: it fetches non-default gems into the path and never reuses a system copy.
2. Is a home project-local? The guard used dir.starts_with(cwd) against the raw --cwd. The crawler hands back vendor/bundle/... for the default ., and Path::starts_with(".") doesn't match that.

Fix

• bundler_sets_explicit_path follows Bundler's Settings#path. The first tier (app config, env, global config) that sets path, path.system or disable_shared_gems decides alone, and its path is explicit only when it's non-empty, path.system isn't true and disable_shared_gems isn't false. Both flags go through Bundler's to_bool (bundler_truthy, from Fix gem crawl ignoring Bundler path.system (#915) #916). A higher tier's path.system: true therefore beats a lower tier's path (a Bugbot finding, fixed in 5ed25cd). An empty path counts as not explicit, so when it's unclear the system homes are still judged.
• RubyCrawler::bundler_install_homes returns the install stores, the refused out-of-tree config root (Hosted gem VEX attests not_affected for an unpatched install when .bundle/config sets an out-of-tree path (absolute or ~/…), because the skipped bundle root counts as "nothing installed" #709), and the gem env homes only when Bundler uses system gems, i.e. no deployment store and no explicit path. Each home comes back tagged project-local by bundler_gem_homes_from, which compares absolute, lexically normalized paths, as the containment guard already does.
• The guard uses that API. get_gem_paths and apply are unchanged.
• CLI_CONTRACT.md's "Gem stale-install guard" section now describes both rules.

No wrapper (npm/, pypi/, gem/) changes are needed. This is Rust-side discovery logic.

Tests (red → green)

Commands run locally

On d6a1466 (main merged in, 33 commits including #916; d65c5c4 only adds the digest-list port, and the digest tests pass):

• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test --workspace --all-features --lib: CLI 861/861. Core 5559 passed, 5 failed: the same root-only permission tests and the digest guard listed below, none in files this PR touches.
• e2e_redirect_gem_stale_install: 35/35. e2e_redirect_gem_build --include-ignored with real Bundler 4.0.18: 31/31.
• e2e_gem --include-ignored (the live-API smoke suite): 3 tests fail only because this sandbox can't reach patches-api.socket.dev (tunnel error). CI runs it with network.

Earlier, the full suite on 9dd72b4 (CI was green on that head in every workflow):

• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo fmt --all -- --check: every hunk this PR touches is clean. main itself isn't rustfmt-clean with the pinned 1.93.1 toolchain (122 files differ), and CI doesn't run a fmt check, so I left the unrelated files alone.
• cargo test --workspace --all-features, run in batches of 10 test binaries because one full build exceeds this sandbox's disk:
  • all 35 e2e_redirect_gem_stale_install tests pass, plus every other suite, except as noted below;
  • socket-patch-core --lib: 5247 passed, 5 failed. 4 are permission-injection tests (copy_tree, vlt_heal, pypi_poetry, pypi_requirements) that can't fail a write when the sandbox runs as root. The 5th is utils::digest::tests::production_digests_go_through_the_helpers, the known main failure that Route Gradle digests through utils::digest #878 fixes;
  • CLI covgap_commands_vendor (3), in_process_redirect (3) and repair (2): all write- or remove-failure injection tests, also defeated by running as root. None of them touch gem code.
• SOCKET_PATCH_BUNDLER_E2E_REQUIRED=1 SOCKET_PATCH_BUNDLER_E2E_VERSION=4.0.18 cargo test -p socket-patch-cli --all-features --test e2e_redirect_gem_build -- --ignored (real Ruby 3.3.6 / Bundler 4.0.18): 16/16 pass.

Notes

• d65c5c4 ports Fix main CI red on stale digest pending-list entries #1016's three-line fix to the utils::digest pending list. That guard is red on main, and the change becomes a no-op once Fix main CI red on stale digest pending-list entries #1016 lands.

• Bugbot's second finding (that a falsy disable_shared_gems hides the path) is a false positive. Bundler 2.5.22 and 4.0.18 both fold disable_shared_gems == false into system_path, which use_system_gems? checks before explicit_path. Evidence is in the review thread.

• Fix gem crawler missing Bundler .bundle root (#967) #968 (open) also changes discover_bundle_stores_impl, so whichever of the two lands second will need a small merge. Fix gem crawl ignoring Bundler path.system (#915) #916 has since merged, and this branch now includes it (merge commit d6a1466).

🤖 Generated with Claude Code

Generated by Claude Code