Fix gem lock readers ignoring gems.locked (#736) (#750)

* Start fix for #736

Assisted-by: Claude Code:claude-opus-5-5

* Read only the gem lock Bundler actually loads

A gems.rb project's gems.locked was invisible to the lock inventory,
ledger recovery read only Gemfile.lock, and VEX discovery read both
locks. A leftover redirected Gemfile.lock beside gems.rb + gems.locked
therefore made vex attest not_affected while bundle install installed
the unpatched gem from gems.locked.

Add one resolver for the lock Bundler loads (honouring BUNDLE_GEMFILE
and the app config) and route the inventory, gem_remotes, VEX
discovery and the hosted engine through it. VEX still reads the
ignored twin, but any Socket wiring there is diagnosed as
unattributable instead of attested.

Fixes #736

Assisted-by: Claude Code:claude-opus-5-5

* Test hosted engine on a gems.rb project

Assisted-by: Claude Code:claude-opus-5-5

* Avoid a single-element loop in the polyglot test

Assisted-by: Claude Code:claude-opus-5-5

* Note the gem lock reader fix in the changelog

Assisted-by: Claude Code:claude-opus-5-5

* Drop CHANGELOG entry from this PR

Release notes are written when a release is cut, from the merged PR
log and the code, so PRs no longer edit CHANGELOG.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Port #851: fix vex alias tests broken by store-copy merge

main is red since 4646693 (#605): two commands::vex_consumed tests
assumed the name-keyed resolver never returns npm-aliased copies, which
#605 changed. Same tests-only change as #851; it no-ops once main
carries it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Ao6g9qAnawPfNxv11f3wM

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/tests/hosted_memory_engine.rs

@@ -990,6 +990,53 @@ async fn a_vlt_project_is_withheld_as_offline() {
     assert!(output.changed_files.is_empty());
 }
 
+/// #736: the engine's purl set comes from the lock bundler loads. A
+/// `gems.rb` project's gems live in `gems.locked`; reading only
+/// `Gemfile.lock` found nothing to redirect, and a leftover `Gemfile.lock`
+/// beside it must not change that.
+#[tokio::test]
+async fn gems_rb_project_yields_its_gem_candidates() {
+    const GEM_FIXTURE: &str = "redirect/gem/bundler/basic";
+    let server = MockServer::start().await;
+    let patches = patches_from_overrides(
+        &fixtures_root().join(GEM_FIXTURE).join("overrides.json"),
+        None,
+    );
+    mount_api(&server, &patches).await;
+    let input = fixture_files(&fixtures_root().join(GEM_FIXTURE).join("input"));
+    let renamed = |stale_twin: bool| {
+        let mut files = BTreeMap::new();
+        files.insert("gems.rb".to_string(), input["Gemfile"].clone());
+        files.insert("gems.locked".to_string(), input["Gemfile.lock"].clone());
+        if stale_twin {
+            // Locks nothing the patch API knows about.
+            files.insert(
+                "Gemfile.lock".to_string(),
+                b"GEM\n  remote: https://rubygems.org/\n  specs:\n    rake (13.0.0)\n\n\
+                  PLATFORMS\n  ruby\n\nDEPENDENCIES\n  rake\n"
+                    .to_vec(),
+            );
+        }
+        files
+    };
+    for stale_twin in [false, true] {
+        let output = run_engine(
+            &server,
+            build_input(&renamed(stale_twin), &[], options(true)),
+        )
+        .await;
+        assert_eq!(output.projects.len(), 1);
+        let project = &output.projects[0];
+        assert!(project.error.is_none(), "{:?}", project.error);
+        assert_eq!(
+            project.redirected.len(),
+            1,
+            "stale twin {stale_twin}: {}",
+            serde_json::to_string_pretty(&comparable(&output)).unwrap()
+        );
+    }
+}
+
 /// #718 in the in-memory engine: a yarn berry pin of a package with a `bin`
 /// takes the map from the served tarball's own package.json (fetched
 /// through the provider, like wheel metadata), and a tarball it cannot

crates/socket-patch-core/src/crawlers/ruby_crawler.rs

@@ -8,6 +8,7 @@ use crate::utils::fs::{
     entry_is_dir, home_dir, is_dir, is_file, list_dir_entries, normalize_lexically, run_blocking,
 };
 use crate::utils::process::{CommandRunner, SystemCommandRunner};
+use crate::vendor::lock_inventory::{DiskSnapshot, ProjectView};
 
 /// Ruby/RubyGems ecosystem crawler for discovering gems in Bundler vendor
 /// directories or global gem installation paths.
@@ -1026,6 +1027,40 @@ pub async fn bundler_loaded_manifest(root: &Path) -> crate::formats::gem::manife
     .await
 }
 
+/// [`bundler_loaded_manifest`] for the project `view` shows. A disk view
+/// (or a snapshot of one) reads the ambient environment and the app config
+/// like bundler; a memory view has no environment, so only its own
+/// `.bundle/config` counts.
+pub(crate) async fn bundler_loaded_manifest_in(
+    view: &ProjectView<'_>,
+) -> crate::formats::gem::manifest::LoadedManifest {
+    use crate::formats::gem::manifest;
+    match view {
+        ProjectView::Disk(root) | ProjectView::Snapshot(DiskSnapshot { root, .. }) => {
+            bundler_loaded_manifest(root).await
+        }
+        ProjectView::Memory(_) => {
+            let config = view.read_text(".bundle/config").await.ok();
+            let value = config.as_deref().and_then(manifest::config_gemfile);
+            manifest::classify(Path::new("/"), None, value.as_deref(), None)
+        }
+    }
+}
+
+/// The ONE lockfile bundler reads for the project `view` shows: the lock of
+/// [`LoadedManifest::pair`](crate::formats::gem::manifest::LoadedManifest::pair)
+/// — `gems.locked` when the root holds a `gems.rb` file and nothing
+/// configures `BUNDLE_GEMFILE`, else `Gemfile.lock` — or `None` when
+/// `BUNDLE_GEMFILE` names a manifest outside the two default pairs. Every
+/// lock READER asks this (lock inventory, ledger recovery, VEX discovery),
+/// so none reads a twin bundler ignores (#736).
+pub(crate) async fn bundler_loaded_lock_in(view: &ProjectView<'_>) -> Option<&'static str> {
+    bundler_loaded_manifest_in(view)
+        .await
+        .pair(view.is_file("gems.rb"))
+        .map(|(_, lock)| lock)
+}
+
 /// [`bundler_loaded_manifest`] with the environment passed explicitly (hermetic
 /// tests). `ignore_config` is [`bundler_ignores_config`]; `global_config` is
 /// [`bundler_global_config_file`].

crates/socket-patch-core/src/hosted/engine.rs

@@ -664,19 +664,8 @@ const GEM_MANIFEST_FILES: [&str; 4] = ["Gemfile", "Gemfile.lock", "gems.rb", "ge
 ///
 /// A memory view has no environment: only its own app config is read.
 async fn keep_bundler_loaded_gem_files(view: &ProjectView<'_>, out: &mut CandidateFiles) {
-    use crate::formats::gem::manifest::{self, LoadedManifest};
-    let loaded = match view {
-        ProjectView::Disk(root)
-        | ProjectView::Snapshot(crate::vendor::lock_inventory::DiskSnapshot { root, .. }) => {
-            crate::crawlers::ruby_crawler::bundler_loaded_manifest(root).await
-        }
-        ProjectView::Memory(_) => {
-            let config = view.read_text(".bundle/config").await.ok();
-            let value = config.as_deref().and_then(manifest::config_gemfile);
-            let root = std::path::Path::new("/");
-            manifest::classify(root, None, value.as_deref(), None)
-        }
-    };
+    use crate::formats::gem::manifest::LoadedManifest;
+    let loaded = crate::crawlers::ruby_crawler::bundler_loaded_manifest_in(view).await;
     let keep: &[&str] = match &loaded {
         LoadedManifest::Default => return,
         LoadedManifest::Configured { .. } => {

crates/socket-patch-core/src/vendor/lock_inventory/gem.rs

@@ -1,8 +1,10 @@
-//! `Gemfile.lock`: the registry view and the GEM remote set ledger recovery
-//! reads.
+//! The Bundler lock (`Gemfile.lock`, or `gems.locked` for a `gems.rb`
+//! project — whichever bundler loads): the registry view and the GEM remote
+//! set ledger recovery reads.
 
 use std::path::Path;
 
+use crate::crawlers::ruby_crawler::bundler_loaded_lock_in;
 pub(super) use crate::formats::gem::gem_download_url;
 use crate::formats::gem::GemfileLock;
 use crate::utils::fs::read_regular_to_string;
@@ -46,26 +48,33 @@ pub(super) async fn inventory_gemfile_lock_in(
 pub(super) async fn inventory_gemfile_lock_raw_in(
     view: &ProjectView<'_>,
 ) -> Option<Vec<LockfileEntry>> {
-    let text = view.read_text("Gemfile.lock").await.ok()?;
+    // Only the lock bundler loads: a twin it ignores (a leftover
+    // `Gemfile.lock` beside `gems.rb` + `gems.locked`) is not what installs.
+    let lock = bundler_loaded_lock_in(view).await?;
+    let text = view.read_text(lock).await.ok()?;
     // The shared lock model (lockfile discovery reads it too); what bundler
     // would refuse (`problems`) still inventories whatever parsed — this is
     // read-only discovery.
     GemfileLock::parse(&text).entries()
 }
 
-/// The DISTINCT `GEM remote:` bases across ALL GEM sections of the
-/// Gemfile.lock (trailing `/` trimmed), in first-appearance order. A
-/// vendored gem's spec block moved into its PATH section, so which GEM
-/// section it came from is unrecoverable — ledger recovery may only build
-/// a download URL when the lock's GEM sources agree on a single remote.
+/// The DISTINCT `GEM remote:` bases across ALL GEM sections of the lock
+/// bundler loads ([`bundler_loaded_lock_in`]; trailing `/` trimmed), in
+/// first-appearance order. A vendored gem's spec block moved into its PATH
+/// section, so which GEM section it came from is unrecoverable — ledger
+/// recovery may only build a download URL when the lock's GEM sources
+/// agree on a single remote.
 /// Collected scheme-AGNOSTICALLY: a non-http remote (a `file://` gem repo —
 /// bundler 4.0.15 locks one GEM section per `source "file://…" do` block)
 /// still counts toward the ambiguity decision; filtering it out first would
 /// collapse a mixed http+file lock to one "agreed" remote and send the
 /// file-sourced gem's name to the http one. The caller requires the single
 /// survivor to be http(s).
 pub(super) async fn gem_remotes(project_root: &Path) -> Vec<String> {
-    let Ok(text) = read_regular_to_string(&project_root.join("Gemfile.lock")).await else {
+    let Some(lock) = bundler_loaded_lock_in(&ProjectView::Disk(project_root)).await else {
+        return Vec::new();
+    };
+    let Ok(text) = read_regular_to_string(&project_root.join(lock)).await else {
         return Vec::new();
     };
     GemfileLock::parse(&text)

crates/socket-patch-core/src/vendor/lock_inventory/tests.rs

@@ -1460,6 +1460,168 @@ async fn gemfile_lock_legacy_multi_remote_section_is_discovery_only() {
     assert_eq!(rack.integrity, LockIntegrity::Sha256Hex("c".repeat(64)));
 }
 
+/// A one-gem `GEM` lock on `remote` locking `rack (version)`.
+fn rack_lock(remote: &str, version: &str) -> String {
+    format!(
+        "GEM\n  remote: {remote}\n  specs:\n    rack ({version})\n\n\
+         PLATFORMS\n  ruby\n\nDEPENDENCIES\n  rack (= {version})\n\n\
+         BUNDLED WITH\n   2.6.9\n"
+    )
+}
+
+fn gem_purls(entries: &[LockfileEntry]) -> Vec<String> {
+    let mut out: Vec<String> = entries
+        .iter()
+        .filter(|e| e.purl.starts_with("pkg:gem/"))
+        .map(|e| e.purl.clone())
+        .collect();
+    out.sort();
+    out
+}
+
+/// #736: bundler loads `gems.rb` + `gems.locked` when the root holds a
+/// `gems.rb` (and nothing configures `BUNDLE_GEMFILE`), so the inventory
+/// reads `gems.locked`. A leftover `Gemfile.lock` beside it is a lock
+/// bundler ignores and must not stand in for it.
+#[tokio::test]
+async fn gem_inventory_reads_the_lock_bundler_loads() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    write(
+        root,
+        "gems.rb",
+        "source \"https://rubygems.org\"\ngem \"rack\", \"2.2.8\"\n",
+    )
+    .await;
+    write(
+        root,
+        "gems.locked",
+        &rack_lock("https://rubygems.org/", "2.2.8"),
+    )
+    .await;
+    assert_eq!(
+        gem_purls(&inventory_project(root).await),
+        vec!["pkg:gem/rack@2.2.8"],
+        "a gems.rb project's gems.locked is inventoried"
+    );
+
+    // The stale twin from before the project moved to gems.rb.
+    write(
+        root,
+        "Gemfile.lock",
+        &rack_lock("https://rubygems.org/", "2.0.0"),
+    )
+    .await;
+    assert_eq!(
+        gem_purls(&inventory_project(root).await),
+        vec!["pkg:gem/rack@2.2.8"],
+        "the ignored Gemfile.lock is not read"
+    );
+    assert_eq!(
+        gem_purls(&inventory_project_every_lock(root).await),
+        vec!["pkg:gem/rack@2.2.8"],
+        "nor by the every-instance view"
+    );
+
+    // `bundle config set --local gemfile Gemfile` beside the gems.rb:
+    // bundler now loads Gemfile + Gemfile.lock.
+    write(
+        root,
+        "Gemfile",
+        "source \"https://rubygems.org\"\ngem \"rack\"\n",
+    )
+    .await;
+    tokio::fs::create_dir_all(root.join(".bundle"))
+        .await
+        .unwrap();
+    write(root, ".bundle/config", "---\nBUNDLE_GEMFILE: \"Gemfile\"\n").await;
+    assert_eq!(
+        gem_purls(&inventory_project(root).await),
+        vec!["pkg:gem/rack@2.0.0"],
+        "BUNDLE_GEMFILE in the app config selects Gemfile.lock"
+    );
+
+    // A BUNDLE_GEMFILE naming some other manifest: neither root lock is
+    // what bundler reads.
+    write(
+        root,
+        ".bundle/config",
+        "---\nBUNDLE_GEMFILE: \"Gemfile.next\"\n",
+    )
+    .await;
+    assert_eq!(
+        gem_purls(&inventory_project(root).await),
+        Vec::<String>::new()
+    );
+}
+
+/// #736: without a `gems.rb`, bundler loads `Gemfile` + `Gemfile.lock`; a
+/// stray `gems.locked` is not read.
+#[tokio::test]
+async fn gem_inventory_ignores_gems_locked_without_gems_rb() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    write(
+        root,
+        "Gemfile.lock",
+        &rack_lock("https://rubygems.org/", "2.0.0"),
+    )
+    .await;
+    write(
+        root,
+        "gems.locked",
+        &rack_lock("https://rubygems.org/", "2.2.8"),
+    )
+    .await;
+    assert_eq!(
+        gem_purls(&inventory_project(root).await),
+        vec!["pkg:gem/rack@2.0.0"]
+    );
+}
+
+/// #736: the in-memory view (the hosted engine's) picks the same lock: a
+/// `gems.rb` selects `gems.locked`, and its own `.bundle/config` can
+/// select `Gemfile.lock` instead.
+#[tokio::test]
+async fn gem_inventory_memory_view_reads_the_lock_bundler_loads() {
+    let mut project = MemoryProject::new();
+    project.insert_text("gems.rb", "gem \"rack\"\n");
+    project.insert_text("gems.locked", rack_lock("https://rubygems.org/", "2.2.8"));
+    project.insert_text("Gemfile.lock", rack_lock("https://rubygems.org/", "2.0.0"));
+    let (entries, _) = inventory_project_diagnosed_in(&ProjectView::Memory(&project)).await;
+    assert_eq!(gem_purls(&entries), vec!["pkg:gem/rack@2.2.8"]);
+
+    project.insert_text("Gemfile", "gem \"rack\"\n");
+    project.insert_text(".bundle/config", "---\nBUNDLE_GEMFILE: \"Gemfile\"\n");
+    let (entries, _) = inventory_project_diagnosed_in(&ProjectView::Memory(&project)).await;
+    assert_eq!(gem_purls(&entries), vec!["pkg:gem/rack@2.0.0"]);
+}
+
+/// #736: ledger recovery's GEM remote set comes from the lock bundler
+/// loads too, never from an ignored twin's sources.
+#[tokio::test]
+async fn gem_remotes_reads_the_lock_bundler_loads() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    write(root, "gems.rb", "gem \"rack\"\n").await;
+    write(
+        root,
+        "gems.locked",
+        &rack_lock("https://gems.example.com/", "2.2.8"),
+    )
+    .await;
+    write(
+        root,
+        "Gemfile.lock",
+        &rack_lock("https://rubygems.org/", "2.0.0"),
+    )
+    .await;
+    assert_eq!(
+        gem_remotes(root).await,
+        vec!["https://gems.example.com".to_string()]
+    );
+}
+
 #[tokio::test]
 async fn inventories_script_and_pylock_files_without_installed_packages() {
     let tmp = tempfile::tempdir().unwrap();