Fix gem crawler missing Bundler 4 standalone bundle (#796)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #796

Summary

On Bundler 4, bundle install --standalone projects were invisible to the gem crawler. Agent apply patched an ambient copy of the same gem (or reported package_not_installed), and VEX attested not_affected while the app loaded the unpatched ./bundle copy. The crawler now finds the standalone tree, so the copy the app loads is the one patched, judged by VEX, and checked by the hosted stale-install guard.

Root cause

RubyCrawler::discover_bundle_stores_with_env built its Bundler install roots from three sources only: the config path, $BUNDLE_PATH and <cwd>/vendor/bundle. bundle install --standalone installs into <cwd>/bundle/ and writes bundle/bundler/setup.rb. Bundler 2.x also recorded BUNDLE_PATH: "bundle" in .bundle/config, which is why the issue's 2.x rows pass. Bundler 4 no longer remembers CLI flags and writes no config, so the root was never probed and the crawler fell back to the gem env homes. The hosted stale-install guard (scan/hosted.rs) discovers installs through the same crawler, so it missed the root too. One fix at the discovery boundary covers apply, rollback, vex and the hosted guard.

Fix (4 files)

• crates/socket-patch-core/src/crawlers/ruby_crawler.rs: probe <cwd>/bundle as an install root when bundle/bundler/setup.rb is a regular file. The root sits in the slot Bundler 2's recorded path occupied: after the config and env roots, before vendor/bundle, behind the same Bundler-manifest gate. It is lexically normalized, so a Bundler 2 project whose config also names bundle dedups to one store. Like that recorded path, it is an explicit root: the gem env fallback stays on, because default gems only live there. Bundler 4 standalone projects therefore behave exactly like the Bundler 2 standalone projects the issue lists as correct.
• A bundle/ dir without the marker (a frontend build dir, scripts) is not treated as a gem store.
• CLI_CONTRACT.md: the gem install-root order now lists the standalone root.
• Tests in crawler_ruby_e2e.rs and e2e_redirect_gem_stale_install.rs (below).
• The npm, PyPI and gem wrappers only dispatch to the native binary and need no change.

Test evidence

Each new test was run red on main's code and green with the fix:

Test	Without fix	With fix
ruby_crawler::tests::standalone_bundle_root_discovered_without_config	FAILED	ok
ruby_crawler::tests::standalone_bundle_root_probes_between_env_and_default	FAILED	ok
crawler_ruby_e2e::get_gem_paths_finds_bundler4_standalone_tree_before_gem_homes (standalone copy found and ranked ahead of an ambient copy of the same version)	FAILED	ok
e2e_redirect_gem_stale_install::gem_hosted_stale_bundler4_standalone_install_warns_and_is_not_attested (hosted guard warns with the project-local remedy; same-run --vex does not attest)	FAILED	ok
Guards: bundle_dir_without_standalone_marker_is_not_a_store, standalone_bundle_root_ignored_without_manifest, standalone_bundle_root_dedups_with_bundler2_config_path	ok	ok

Real Bundler 4.0.17 repro (Ruby 3.3.6, the issue's steps: gem install rack -v 3.2.7 into the ambient GEM_HOME, then bundle install --standalone, which writes no .bundle/config, then a staged marker patch for pkg:gem/rack@3.2.7):

• socket-patch apply --json --offline: the standalone copy is patched (grep -c PROBE bundle/ruby/3.3.0/gems/rack-3.2.7/lib/rack.rb returns 1), and ruby -e 'require_relative "bundle/bundler/setup"; require "rack"; p defined?(Rack::PROBE)' prints "constant". On main the standalone copy stayed at 0 and this printed nil.
• socket-patch vex --offline: not_affected while the loaded copy is patched. After reverting only the standalone copy (the issue's false-attestation state), vex omits the purl (not_applied) instead of attesting it.

Local gates

• rustfmt: the three changed .rs files are rustfmt-clean (rustfmt --check). A repo-wide cargo fmt --all -- --check is not clean on main itself, and CI doesn't run it, so this PR leaves the other files alone.
• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test --workspace --all-features --no-fail-fast: 9731 passed, 12 failed. All 12 are permission-based write-failure tests (chmod 555 / unremovable-file fixtures) that cannot fail as root, and this container runs as uid 0. Spot-checked tests from both affected crates, re-run as an unprivileged user (setpriv --reuid=65534), pass. None touches the gem path. The touched suites were re-run on the final head 20898fd: ruby_crawler 69/69, crawler_ruby_e2e 26/26, e2e_redirect_gem_stale_install 26/26.

CI on 20898fd: all 338 check runs pass (332 success, 6 skipped). Bugbot reviewed 20898fd and found no issues.

Per-issue checklist

• Gem crawler misses a Bundler 4 bundle install --standalone tree (./bundle), so agent apply patches the system copy and VEX attests not_affected while the app loads the unpatched standalone copy #796, agent apply patches the standalone copy: crawler_ruby_e2e::get_gem_paths_finds_bundler4_standalone_tree_before_gem_homes + real 4.0.17 repro
• Gem crawler misses a Bundler 4 bundle install --standalone tree (./bundle), so agent apply patches the system copy and VEX attests not_affected while the app loads the unpatched standalone copy #796, VEX never attests while the standalone copy is unpatched: real 4.0.17 repro + gem_hosted_stale_bundler4_standalone_install_warns_and_is_not_attested
• Gem crawler misses a Bundler 4 bundle install --standalone tree (./bundle), so agent apply patches the system copy and VEX attests not_affected while the app loads the unpatched standalone copy #796, package_not_installed with no ambient copy: covered by the same discovery (standalone_bundle_root_discovered_without_config)
• Gem crawler misses a Bundler 4 bundle install --standalone tree (./bundle), so agent apply patches the system copy and VEX attests not_affected while the app loads the unpatched standalone copy #796, hosted stale-install guard (flagged as unverified in the issue): gem_hosted_stale_bundler4_standalone_install_warns_and_is_not_attested

CI note

An earlier head picked up unrelated whitespace reformatting from a repo-wide cargo fmt. The branch (agent-owned) was rebuilt from main with only the four files above. On that earlier head, three PDM-compatibility legs each failed one different PDM hosted case (appliedExactlyOne). That path is untouched here, and the rerun of the failed jobs passed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WT6bsGwkaDRadX3XUgBxvt

---

Note

Medium Risk
Changes which on-disk gem trees are discovered and patched for Ruby projects; behavior is narrowed by the setup.rb marker and manifest gate, but mistaken discovery could still target the wrong directory in edge layouts.

Overview
Fixes #796: Bundler 4 bundle install --standalone layouts were skipped because they install under ./bundle/ and no longer write .bundle/config, so the gem crawler only saw ambient gem env copies. apply, hosted stale-install checks, and --vex could miss or mis-judge the tree the app actually loads via bundle/bundler/setup.rb.

The Ruby crawler now treats <cwd>/bundle as an explicit Bundler root when bundle/bundler/setup.rb is present—after config/env roots and before vendor/bundle, gated on a Bundler manifest like other explicit roots, with dedup when Bundler 2 still records BUNDLE_PATH: "bundle". A bundle/ directory without that marker is not crawled. CLI_CONTRACT.md documents the updated root order.

Coverage adds unit tests in ruby_crawler, an e2e get_gem_paths ranking test, a hosted stale-install + --vex e2e for standalone copies, and small vex_consumed npm regression tweaks after #605 (resolver vs alias-expansion expectations).

^{Reviewed by Cursor Bugbot for commit 6bcaf51. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] Two "PDM patch compatibility" legs failed on 41b7809: native (ubuntu-latest, 2.9.3) in the direct hosted case and native (macos-latest, 2.29.2) in the optional hosted case. Both failed appliedExactlyOne (the hosted scan did not apply exactly one patch). Every other case in both legs passed, including the same shapes in vendored and agent mode. This PR only changes the gem crawler (ruby_crawler.rs) and gem tests and docs, none of which the PDM hosted path runs. The same workflow passed on the four most recent agent PRs. The failing case is different on each leg, which points to the live-service step rather than this diff. I've queued one rerun of the failed jobs. If either leg fails again I'll treat it as real and investigate it here.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent).

• Head: 20898fd89b
• CI: 338/338 (6 skipped) check runs green on head
• Bugbot: reviewed 20898fd89b, no new issues; no unresolved review threads
• Mergeable, no conflicts (blocked only on required human approval)

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

[agent] coverage failed on 4ee2061, the merge of main into this branch: socket-patch-cli --lib fails commands::vex_consumed::tests::hosted_expands_alias_only_copies and hosted_reuses_expanded_npm_copies_and_merges_alias_variants. This failure did not come from this PR. main (4646693) fails the same two tests locally. The cause is a semantic conflict between #738 and #605, both now on main. #851 fixes it with a tests-only change. I ported that change here as 6bcaf51, with no production code. On that head, cargo test -p socket-patch-cli --all-features --lib passes 840/840 and cargo clippy --workspace --all-features -- -D warnings is clean. The commit becomes a no-op once #851 lands on main.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6bcaf51. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review.

• Head: 6bcaf510ac73785bb66317397f238e5fc34ee955
• CI: 458/458 check runs complete (452 success, 6 skipped, none failed).
• Bugbot: reviewed 6bcaf51 with no open findings; no unresolved review threads.
• Merges cleanly onto current main (99f61d2). Its Fix vex alias tests broken by store-copy merge #851 cherry-pick is already on main through Fix vendored gem rewrite breaking positional args (#847) #849, so that part is now a no-op.
• Reviewer note: ruby_crawler.rs gates the new <cwd>/bundle root on bundle/bundler/setup.rb being a regular file, so a bundle/ directory without that file isn't treated as a gem store.

---

Generated by Claude Code