GeezerVison

…egistration

Pins the 2026-08 e2e campaign finding (D3/C3, P2): setup --remove unwires
the Gemfile and deletes the generated plugin files, but leaves bundler's
machine-local .bundle/plugin/index registration (hook subscriptions +
plugin/load paths) dangling, so every later bundle install prints
bundler's 5-line "plugin paths don't exist ... Continuing without
installing plugin socket-patch" block with a misleading reinstall
suggestion.

Three failing guards:
- host_guard::gem_setup_roundtrip_host now seeds the index exactly as
  bundler writes it and asserts remove leaves no socket-patch entry
  (index deleted when nothing else is registered);
- host_guard::gem_setup_remove_strips_registration_surgically_under_
  bundle_app_config: surgical strip that preserves another plugin's
  entries verbatim, drops emptied hook events, and follows bundler's
  BUNDLE_APP_CONFIG resolution (relative value resolves against the
  project root);
- plugin_runtime::setup_remove_clears_bundler_plugin_registration:
  real host-bundler flow — install registers, remove must clear, and the
  next bundle install must print neither "plugin paths don't exist" nor
  "Continuing without installing plugin".

Co-Authored-By: Claude Fable 5 <[email protected]>

…n registration

Campaign finding D3/C3 (P2, bundler 2.7.2 + 4.0.18 repros): the unwire
deleted the generated plugin files/stamp and restored the Gemfile, but
never touched the .bundle/plugin/index registration (hook subscriptions
and plugin/load paths) bundler wrote at the wired plugin's first
install, so every later bundle install printed bundler's 5-line
"plugin paths don't exist ... Continuing without installing plugin
socket-patch" block with a misleading reinstall suggestion, forever.

remove_plugin_directive now runs a third step after the Gemfile un-wire
and plugin-file removal (never before — while the directive is wired
the registration is live state, not residue):

- resolves the index location exactly like Bundler.app_config_path:
  $BUNDLE_APP_CONFIG when set (relative values resolve against the
  project root — the official ruby images export
  BUNDLE_APP_CONFIG=/usr/local/bundle), else <root>/.bundle;
- surgically strips socket-patch from the index, parsing only the
  exact dialect bundler's YAMLSerializer writes: plugin_paths/
  load_paths keys, hooks subscriptions (dropping an event key left
  with no subscribers), commands/sources mappings — every other
  plugin's line is kept byte-verbatim, and unknown sections survive
  untouched;
- deletes a bundler-plugin-installed copy only when the recorded dir
  sits inside the plugin root, never a path elsewhere;
- deletes the index outright when no plugin remains (bundler treats a
  missing index as empty) and prunes the emptied plugin/app-config
  dirs (remove_dir, so a .bundle/config keeps its parent);
- an index in any OTHER shape is never rewritten on a guess: the
  cleanup reports residue as a gem_plugin_registration files[] error
  whose message carries the remedy
  (`bundler plugin uninstall socket-patch`).

The cleanup is reported as its own files[] entry
(kind gem_plugin_registration, remove-only, emitted only when a
registration existed) — contract + README updated; a project whose
only leftover is the registration now counts as removable, so a
re-run of setup --remove heals residue left by older CLIs.

Co-Authored-By: Claude Fable 5 <[email protected]>

…pes the delete gate

Review finding (P2): Path::starts_with is a purely lexical component
compare, so a crafted committed .bundle/plugin/index recording
plugin_paths <root>/.bundle/plugin/../../victim passes the containment
gate and remove_dir_all deletes outside the plugin root.

Co-Authored-By: Claude Fable 5 <[email protected]>

…fore deleting

Path::starts_with is lexical, so the containment gate alone lets a
crafted index's <plugin_root>/../../victim path through to
remove_dir_all. Refuse any recorded dir containing a ParentDir
component — bundler never writes traversal paths, so only hostile
input is rejected.

Co-Authored-By: Claude Fable 5 <[email protected]>

…it-test path

Review finding (P2): remove_plugin_directive read the ambient
BUNDLE_APP_CONFIG, so the -core unit tests exercising it failed
spuriously on machines exporting it (official ruby images export
/usr/local/bundle) — and could have pointed the cleanup at a real
machine-local index outside the tempdir. Thread the env through an
explicit remove_plugin_directive_at (mirroring
remove_plugin_registration_at); the public entry still reads the
process env exactly like bundler. Verified red: with
BUNDLE_APP_CONFIG=/usr/local/bundle,
test_remove_clears_bundler_plugin_registration_entry failed before
this change and passes after (69/69 with and without the export).

Co-Authored-By: Claude Fable 5 <[email protected]>

Review nit: 5 rustfmt divergences introduced by this branch (the
unquote condition width plus 4 test-code spots). cargo fmt --check on
the workspace is back to main's pre-existing count; no touched-file
divergence remains.

Co-Authored-By: Claude Fable 5 <[email protected]>

cursor Bot left a comment

Bugbot round: the new tests' setup reads/writes carried bare unwrap();
failures now name the setup step.

Co-Authored-By: Claude Fable 5 <[email protected]>