Fix Bundler global config being ignored (#577)

[Mikola Lysenko (mikolalysenko)]

Final-head CI is complete: 350 successful checks, 6 skipped; no failures or pending checks. Bugbot passed, there are no unresolved review threads, and the PR is mergeable.

Fixes #577. Bundler's global cache_path, gemfile and path settings were ignored, allowing stale global-cache archives to escape the warning/VEX guard, a manifest Bundler does not load to be rewritten, or the wrong installed gem copy to be selected.

The crawler now consults the global config below local configuration and the environment. Its lookup follows BUNDLE_CONFIG, BUNDLE_USER_CONFIG, BUNDLE_USER_HOME/config, then ~/.bundle/config; regular-file reads avoid blocking on FIFOs, and BUNDLE_IGNORE_CONFIG suppresses file configuration. A global gemfile selecting an unsupported manifest is refused with a remedy identifying the global setting. Global install paths are trusted as user configuration, while the existing containment guard for project configuration is preserved.

The review corrections preserve higher-tier setting presence:

• A present local or environment path, path.system, or disable_shared_gems setting stops the global path fallback, including empty strings and false flags. This prevents scanning or patching a global store that native Bundler does not select.
• An empty higher-tier gemfile setting shadows the global gemfile and leaves default manifest discovery active. An existing nonempty BUNDLE_GEMFILE still takes effect when the local setting is empty; nonempty local settings retain the existing same-root/cross-root behavior.

The path-tier behavior matches native Bundler 2.6.9 and 4.0.17. Bundler 1.x's legacy global-path shortcut is not modeled; this limit is explicit in CLI_CONTRACT.md. The older empty cache_path behavior is unchanged by these corrections.

Validation on 906f775c:

• All 137 focused tests passed: 73 Ruby unit, 10 gem manifest, 26 crawler integration and 28 hosted stale-install tests. The new integration regressions demonstrate that an environment path flag excludes an unused global store and that hosted scan rewrites the active default manifest while preserving the unused global alternative byte-for-byte.
• Six reviewer probes failed on the original PR and passed on current main; both production integration regressions failed before the correction and passed afterward.
• Independent native controls cover Ruby 3.4.10 with Bundler 4.0.17 (22 primary and seven supplemental cases), 2.6.9 (four path controls), and 1.17.2 (seven legacy controls). These establish modern tier behavior and the documented legacy limitation; they are not a substitute for the full install matrix.
• Targeted core clippy and diff checks passed. Changed code follows formatting, preserving one existing CLI-test wrapping deviation; clippy reports the existing unrelated macOS unused_variables warning. The committed files match the tested sources, independent review is clear, and the commit merges cleanly with current main 045d7ec7.
• Full CI, compatibility workflows, benchmarks, and Bugbot completed successfully on the corrected commit 906f775c.

---

Note

Medium Risk
Changes gem install-path discovery, cache probing, and hosted manifest selection; incorrect precedence could miss stale installs or refuse/redirect the wrong manifest, but behavior is heavily tested and aligned with Bundler settings.

Overview
Fixes #577 by teaching Ruby/Bundler integration to honor global Bundler config (bundle config set --global …) at the correct priority: local app config → environment → global file ($BUNDLE_CONFIG / $BUNDLE_USER_CONFIG / $BUNDLE_USER_HOME/config / ~/.bundle/config) → defaults. BUNDLE_IGNORE_CONFIG still skips file tiers.

Discovery & hosted gem behavior now use global BUNDLE_PATH (install roots), BUNDLE_CACHE_PATH (stale-install probe), and BUNDLE_GEMFILE (manifest selection). Higher tiers shadow global settings when present—including empty path / gemfile values and env BUNDLE_PATH__SYSTEM / BUNDLE_DISABLE_SHARED_GEMS—so behavior matches Bundler 2.6/4.x and does not scan or rewrite against stores/manifests Bundler would not use. Unsupported global gemfiles get the same fail-closed refusal as local ones (redirect_gem_bundle_gemfile_unsupported).

Contract docs (CLI_CONTRACT.md, ecosystems.md) and e2e/unit tests cover global cache stale warnings (and VEX exclusion), global gemfile refusal, and empty-setting shadowing.

^{Reviewed by Cursor Bugbot for commit 906f775. Configure here.}

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] coverage failed on 4112baf in in_process_vendor::in_process_vendor_state_attests_manifest_less, an npm vendored-VEX test. In its "ledgers-deleted" step the vex run reported vex_record_offline / record_unavailable instead of fetching the record from the mock patch API.

I don't think this PR caused it:

• The diff only changes how the Ruby/Bundler settings are resolved, and nothing on that path is involved in the npm run.
• The same test passes locally on this head.
• coverage is green on the latest main run (045d7ec).

No fix exists to port. I'll re-run the failed job once the CI run finishes (GitHub refuses a re-run while the run is still going). If it fails again I'll treat it as a real failure and investigate.

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

Ready for review at head 6a54d6653027a3e6ac84b56186f913fe0bd99bf6.

• CI: 355/355 check runs green on this head (3 skipped, none failed). The coverage flake from 4112baf didn't come back.
• Bugbot: reviewed 6a54d66 and found no new issues. Its one earlier finding (env path.system not shadowing the global tier, on 4112baf) was a real bug. It's fixed in 6a54d66 and the thread is resolved.
• Reviewer focus: how precedence is ordered between local .bundle/config, BUNDLE_* env and the global ~/.bundle/config / BUNDLE_USER_CONFIG tier in ruby_crawler.rs.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Review updated for 906f775c6fb0a08e4a20ef70611c72aa7cc903bb: Ready to merge as-is from this review. Final-head CI is complete: 350 successful checks, 6 skipped; no failures or pending checks. Bugbot passed, there are no unresolved review threads, and the PR is mergeable.

• Explicitly empty higher-priority gemfile settings now shadow the global value, preserving default discovery or an existing nonempty environment selection. Empty local path settings also stop global fallback.
• disable_shared_gems joins path and path.system in the tier-presence check. Empty and false values count as present, matching native Bundler 2.6.9/4.0.17 and excluding an unused global store.

All 137 focused tests passed (73 Ruby unit, 10 manifest, 26 crawler integration, 28 hosted stale-install). Six reviewer probes reproduce regressions against the original PR and pass on main; two production integration tests fail before the correction and pass afterward. Independent review checked 40 native controls across Bundler 4.0.17, 2.6.9 and 1.17.2, including the documented legacy 1.x limitation.

The committed files match the tested snapshot, targeted core clippy and diff checks pass, and the patch merges cleanly with current main. Existing baseline formatting and the unrelated macOS warning are documented in the PR. No remaining actionable finding from this review.

The Ready label has been restored after all checks completed on the corrected commit.

[Mikola Lysenko (mikolalysenko)]

BugBot review

Please review the corrected commit 906f775c6fb0a08e4a20ef70611c72aa7cc903bb.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 906f775. Configure here.}