GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GeezerVison is showing github.com — Fix gem modes wiring a manifest Bundler ignores (#341, #390) by mikolalysenko · Pull Request #431 · SocketDev/socket-patch Conversation
|
| Issue | Case | Test | Red without fix | Green |
|---|---|---|---|---|
| #341 | vendored: gems.rb twin is refused before any write |
vendor::gem::tests::gems_rb_twin_is_refused_before_any_write |
✅ | ✅ |
| #341 | real Bundler (premise follows the Bundler era): vendor refuses the twin, all four files untouched | e2e_vendor_gem_build::gem_vendor_refuses_a_gems_rb_twin |
✅ (exit 0, applied 1) | ✅ |
| #341 | real Bundler, CHECKSUMS-converged hosted gems.rb pin: get --mode vendored refuses before the takeover reverts it |
e2e_redirect_gem_build::gem_hosted_gems_rb_pin_survives_a_refused_vendored_takeover |
✅ (takeover ran first) | ✅ |
| #390 | vendored: .bundle/config BUNDLE_GEMFILE: Gemfile.next refused |
vendor::gem::tests::bundle_gemfile_naming_another_manifest_is_refused |
✅ | ✅ |
| #390 | real Bundler dual boot: vendor refuses, all four files untouched | e2e_vendor_gem_build::gem_vendor_refuses_a_bundle_gemfile_dual_boot |
✅ | ✅ |
| #390 | hosted engine: Gemfile.next redirects nothing and warns |
hosted::engine::tests::bundle_gemfile_naming_another_manifest_redirects_nothing |
✅ | ✅ |
| #390 | hosted engine: BUNDLE_GEMFILE: Gemfile beside gems.rb edits the Gemfile pair |
hosted::engine::tests::bundle_gemfile_naming_the_gemfile_redirects_it_over_gems_rb |
✅ | ✅ |
| #390 | real Bundler dual boot, scan --mode hosted --vex: nothing redirected or attested, files byte-untouched |
e2e_redirect_gem_build::gem_hosted_bundle_gemfile_dual_boot_redirects_nothing |
✅ (redirected: 1, vex.statements: 1) |
✅ |
| #390 (Bugbot) | relative env value anchored at the project root, not the process cwd under --cwd |
formats::gem::manifest::tests::env_wins_over_config_and_is_anchored_at_the_project_root |
new | ✅ |
| #390 (Bugbot) | refusal remedy matches the knob (env vs .bundle/config) |
formats::gem::manifest::tests::unsupported_detail_names_the_knob_that_set_it |
new | ✅ |
| both | resolver order, env vs config, other directories, app-config read | formats::gem::manifest::tests::*, crawlers::ruby_crawler::tests::loaded_manifest_reads_the_app_config_file |
new | ✅ |
| guard | no BUNDLE_GEMFILE: hosted still prefers gems.rb |
hosted::engine::tests::default_discovery_still_prefers_gems_rb |
guard | ✅ |
Local runs on ffbe645, with the gem suites re-run on 522febb (Ruby 3.3.6, Bundler 4.0.17):
e2e_redirect_gem_build -- --ignored: 8 passed. e2e_vendor_gem_build -- --ignored: 5 passed. These are the full gem capstones, including the existing ones.cargo test -p socket-patch-core --lib gem: 254 passed.cargo test --workspace --all-features --no-fail-fast (ffbe645): 9,340 passed, 12 failed. All 12 are write-failure or permission tests that fail only because the sandbox runs as root (*_write_failure_*, *unremovable*, relax_loop_must_not_traverse_symlinked_root), the same set reported on the other agent PRs. None are in gem code, and CI runs them green.cargo clippy --workspace --all-features -- -D warnings: clean.cargo fmt: the touched files are formatted. main itself isn't fmt-clean, and CI runs no fmt gate.node --test npm/socket-patch/bin/socket-patch.test.mjs: passed. The npm, PyPI and gem wrappers only dispatch, so they need no change.Docs: docs/ecosystems.md (RubyGems row), CLI_CONTRACT.md (new additive warning code), and a Fixed entry in the CHANGELOG.
🤖 Generated with Claude Code
Note
Medium Risk
Changes which Ruby manifest/lock files are mutated and when VEX attests gems; incorrect behavior previously reported patched state while Bundler installed upstream bytes.
Overview
Gem hosted and vendored modes now target only the manifest Bundler actually loads, fixing false success and VEX attestation when an ignored Gemfile was edited (#341, #390).
A shared resolver (formats::gem::manifest::classify + bundler_loaded_manifest) mirrors Bundler’s order: BUNDLE_GEMFILE from the environment, then .bundle/config, then default discovery (gems.rb before Gemfile on Bundler ≥ 2). Hosted scan narrows redirect candidates to that pair; other configured manifests (e.g. Gemfile.next) redirect nothing and emit redirect_gem_bundle_gemfile_unsupported instead of redirect_gem_no_gemfile. Vendored vendor / takeover refuses with gemfile_not_loaded before any write (and before reverting a live hosted pin), including gems.rb twins and dual-boot layouts.
Docs (CLI_CONTRACT, ecosystems.md, CHANGELOG) and e2e/unit tests cover dual-boot hosted --vex, refused vendored takeover on hosted gems.rb, and real-Bundler vendor refusal paths.
Reviewed by Cursor Bugbot for commit a550b6f. Configure here.
Generated by Claude Code
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Assisted-by: Claude Code:claude-opus-5-5
Vendored gem mode always wired Gemfile and Gemfile.lock. When Bundler loads a different manifest (a gems.rb twin, or BUNDLE_GEMFILE set in the environment or in .bundle/config), vendor reported success while Bundler installed the unpatched gem, and VEX then attested it. Add one resolver for the manifest Bundler loads, following Bundler's own order, and refuse vendoring before any write unless that manifest is the Gemfile. Refs #341, #390 Assisted-by: Claude Code:claude-opus-5-5
Hosted gem mode picked gems.rb or Gemfile by filename and ignored BUNDLE_GEMFILE. With 'bundle config set --local gemfile Gemfile.next' it rewrote Gemfile, reported success and attested the patch in the in-run VEX, while Bundler kept installing the unpatched gem. The hosted candidate files now hold only the pair Bundler loads. A BUNDLE_GEMFILE naming the project's Gemfile or gems.rb selects that pair; one naming any other file redirects no gem and reports redirect_gem_bundle_gemfile_unsupported. Refs #390 Assisted-by: Claude Code:claude-opus-5-5
Real-Bundler e2e capstones for both issues. A hosted scan of a dual-boot project (BUNDLE_GEMFILE: Gemfile.next in .bundle/config) redirects and attests nothing. Vendor refuses a gems.rb twin and the dual-boot layout, leaving every manifest and lock untouched. Docs, CLI contract and CHANGELOG describe the new refusals. Refs #341, #390 Assisted-by: Claude Code:claude-opus-5-5
A hosted gems.rb project that is then vendored hit the hosted to vendored takeover first: the takeover restored the upstream entry, then vendoring refused gems.rb, leaving the gem unpatched in both modes. The takeover now runs the gem manifest check first, like the yarn berry preflight, so a refused gem keeps its hosted pin. Refs #341 Assisted-by: Claude Code:claude-opus-5-5
Bundler 1.x reads a Gemfile before gems.rb, while 2.x and later load gems.rb, so the vendored refusal of a gems.rb twin no longer claims that Bundler always loads gems.rb. The twin is still refused on every version, because vendor cannot tell which Bundler will install. The e2e premise now follows the host Bundler, which fixes the 1.17.3 leg. Refs #341 Assisted-by: Claude Code:claude-opus-5-5
The formats modules are pure by contract, and an architecture test enforces that. Move the disk and environment reads for the manifest Bundler loads into the ruby crawler, next to the BUNDLE_PATH config reader. formats::gem::manifest keeps only the classification. Refs #341, #390 Assisted-by: Claude Code:claude-opus-5-5
|
BugBot review Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Stale Bugbot comment from a previous run.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
A relative BUNDLE_GEMFILE was resolved against socket-patch's own working directory, so a --cwd run classified BUNDLE_GEMFILE=Gemfile as unsupported. Bundler expands the value in the directory bundle runs in, which is the project. The refusal also always said to unset the environment variable; for a .bundle/config setting it now gives the matching 'bundle config unset --local gemfile' remedy. Refs #390 Assisted-by: Claude Code:claude-opus-5-5
|
BugBot review Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Stale Bugbot comment from a previous run.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
[burn-down agent] Ready for review at
Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Union the CHANGELOG Fixed entries from both sides. Co-Authored-By: Claude <[email protected]>
|
bugbot run Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Stale Bugbot comment from a previous run.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Keeps both CHANGELOG entries (gem manifest fix and the Poetry venv fix from #330). Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01L6i4cQ51yarBFnFs2b8HRx
Keeps both CHANGELOG entries (gem manifest fix and the npm non-registry entry fix from #345). Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01L6i4cQ51yarBFnFs2b8HRx
|
bugbot run Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit a550b6f. Configure here.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Burn-down agent check: ready for review at
Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Keeps both new hosted-engine tests: the BUNDLE_GEMFILE cases from this branch and the Pipfile presence test from #425. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01L6i4cQ51yarBFnFs2b8HRx
There was an error while loading. Please reload this page.
#751's fix picked a twin's pair from the locks' BUNDLED WITH: all 1.x meant the Gemfile pair, otherwise gems.rb. But BUNDLED WITH records which bundler wrote a lock, not which one installs it. Bundler chooses the twin's spelling from the running major: 1.x loads the Gemfile, >= 2 loads gems.rb. So bundler >= 2 installing a 1.x-stamped twin, or 1.x installing a 2.x-stamped one, read the pair the scan never pinned, while the run (and its VEX) reported the gem redirected. Lock inventory and VEX discovery used the same selector. Nothing a scan can read says which bundler runs, so a twin under default discovery is now refused everywhere, the way vendored mode already refuses it: - hosted mode: redirect_gem_twin_manifest_ambiguous (replaces the unreleased redirect_gem_twin_bundler_versions_diverge), nothing written or attested; - lock readers (lock inventory, VEX discovery): no lock, with the gem_lock_unsupported diagnosis. BUNDLE_GEMFILE naming either spelling still selects that pair, and a lone Gemfile or gems.rb pair is unchanged. The BUNDLED WITH parser this PR added is gone. Tests: the engine, lock-inventory and hosted_memory_engine twin tests now expect the refusal for 1.x, 2.x and mixed stamps. #431's default_discovery_still_prefers_gems_rb now covers a lone gems.rb. The real-Bundler e2e (gem_hosted_twin_redirects_nothing) runs on every bundler line and checks the untouched twin still installs frozen. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_018ULgrJMQMWEBAsiuprY449
There was an error while loading. Please reload this page.
Successfully merging this pull request may close these issues.
Gem hosted redirect andsetup ignore BUNDLE_GEMFILE from .bundle/config, so they wire Gemfile while bundler loads the configured manifest unpatched (VEX and setup --check still pass)
Vendored gem mode wires Gemfile when gems.rb is also present, so bundler installs the unpatched gem while vex attests it
There was an error while loading. Please reload this page.