GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #457

Summary

Hosted rollback / remove no longer turn a redirected transitive gem into a top-level exact pin. On a converged (CHECKSUMS) lock, the Gemfile and lock now come back byte for byte, so bundle update <gem> can move off the vulnerable version again.

Root cause

When hosted mode redirects a transitive gem, rewrite_gem (patch/redirect/mod.rs) appends a source "<patch registry>" do … end block. If the Gemfile already ends in \n, it writes no blank separator. The upstream restore (patch/redirect/upstream/gem.rs, provably_appended) only treats the block as the rewriter's append (Decl::Transitive) when a blank line comes right before it, because an in-place rewrite swallows the blank lines before the declaration. The rewriter's own append never had that blank line, so the restore fell back to Decl::Direct. The result was a new gem "<name>", "<version>" line and a <name> (= <version>) DEPENDENCIES entry.

Fix

• rewrite_gem: the transitive append always writes exactly one blank line before the block, using the Gemfile's own line ending (two line breaks if the file had no final one). The append is now provably an append.
• restore_manifest: Decl::Transitive removes that blank separator together with the block, so the restore is byte-identical.
• Docs: CLI_CONTRACT.md "Hosted unwind coverage" (gem bullet) and the gem.rs module docs.
• Limitation: a block written before this change (no blank line before it) still can't be told apart from an in-place rewrite of a last-line declaration. It still comes back as the exact pin, which is documented and covered by a test.
• Follow-up outside this repo: the depscan TS twin (registry-rewrite gem.ts) should write the same blank separator.

Tests (red → green)

Local runs on 3aaf1dc:

• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --all-features --lib upstream::gem: 10/10 pass.
• cargo test -p socket-patch-core --all-features --test upstream_restore_golden gem: 5/5 pass.
• cargo test --workspace --all-features --no-fail-fast: everything gem- and redirect-related passes. 15 tests fail only in this sandbox because it runs as root, which bypasses the read-only / chmod fixtures: *_write_failure_*, *unremovable*, *cleanup_failure*, vlt_heal an_unremovable_hidden_lock…, copy_tree relax_loop_must_not_traverse_symlinked_root, and pypi_poetry / pypi_requirements wire-failure rollback. None of them touches gem code, and CI runs them as a non-root user.
• cargo fmt --all -- --check: not run as a gate. Main itself isn't rustfmt-clean under the pinned 1.93.1 toolchain (about 125 files churn), CI has no fmt job, and this PR keeps its formatting changes to the lines it edits.

No wrapper change is needed: npm/, pypi/ and gem/ only dispatch to the binary.

Priority note: this is a p1 single-issue cluster. I picked it over the older #328 because #457 silently freezes a vulnerable version after rollback, while #328 fails closed.

Generated by Claude Code