fix(gem): hosted grant rotation refreshes the source block in place — no more nested Gemfile sources

[Mikola Lysenko (mikolalysenko)]

Defect

A hosted gem re-scan under a rotated grant (production rotates the grant-token path segment of the patch-registry URL per request) did not recognize the Socket source block a previous run wrote — it wrapped it in a new one, leaving nested source "..." do blocks in the Gemfile. On gems.rb/Gemfile twin spellings the same blindness tripped the redirect_gem_gemfile_spellings_diverge trap instead of refreshing. Silent Gemfile corruption on the exact re-scan path production exercises.

Root cause

• gem_index_url_pattern (crates/socket-patch-core/src/patch/redirect/mod.rs:3001): the rotation-idempotency wildcard was keyed on DepOverride.token — and the CLI never populated that field, so the pattern degraded to an exact-URL match. A block written under grant token A was invisible to a run under token B, and the rewriter appended a fresh block around it.
• crates/socket-patch-cli/src/commands/scan/hosted.rs:286: the grant token is not a top-level reference-API field, so the CLI shipped token: "".

Fix

Two-sided, so the guard is caller-independent:

• Core: the recognizer/refresh pattern now wildcards the path level before the patch uuid unconditionally (gem_index_url_pattern), and a rotated grant refreshes the URL in place (ledger edit redirect_gemfile_source_url, original = old URL) — never nests. New helper grant_token_path_segment (mod.rs:2979) derives the token from the URL shape.
• CLI: hosted.rs now populates a truthful token for all ecosystems via the same generic path-segment-before-uuid derivation, so any future dep.token consumer is safe. (Audit: gem_index_url_pattern was the only production consumer repo-wide; bun/npm/cargo/maven/nuget rotation idempotency does not use it.)

Campaign repro

Hosted+vendored real-data sweep, hosted-b2/idempotent-rerun leg: token A → A → B on the same patch uuid. Run 2 was byte-idempotent; run 3 (rotated grant) nested two source blocks — the exact Gemfile shape from that lane's run.log is pinned in the red commit. The lane's run.sh scripts pass as-written on the fixed binary (their green path is the fix).

Tests (red → green)

• Red (8bd8960, test-only): unit gemfile_rerun_with_rotated_grant_and_cli_empty_token_never_nests failed with the exact nested-2-blocks Gemfile; gems_rb_twins_rotated_grant_with_cli_empty_token_refreshes failed on the divergence trap; new e2e capstone gem_hosted_rotated_grant_rescan_refreshes_source_block_and_installs failed through the real binary + real bundler 4.0.15 with the campaign's production failure shape.
• Green (1def4d0): both units pass; full e2e suite 5/5 — the rotation leg proves exactly one source block, the redirect_gemfile_source_url ledger edit (original=token-A URL, new=token-B URL), and a green fresh install of byte-verified patched gems. Plus grant_token_path_segment_shapes (7 URL-shape edges incl. uuid-as-host and uuid-in-first-segment) and Gemfile source:-option refusal units.
• Style (9a47426): scoped rustfmt on the two touched files (reviewer P2 — main's versions were fmt-clean, the drift was introduced here).

Final gate at head: core lib redirect units green, e2e_redirect_gem_build -- --ignored 5/5 against real host bundler 4.0.15, cargo clippy -p socket-patch-core -p socket-patch-cli --all-targets — zero warnings in touched files (5 pre-existing warnings live in untouched test files, present on main).

Reviewer sign-off

Adversarial review approved, red→green independently reproduced at unit and e2e level. Disclosed gaps riding this PR: in-container docker-matrix legs (bundler 1.17/2.7/4.0.18) were not re-run (disk headroom fell below the 15 GB stop threshold; no images were built); maven/golang rotation idempotency was not deep-audited (recommend a cross-lane check).

Cross-repo follow-up

The depscan TS twin (registry-rewrite gem.ts) must be ported to match: token-independent grant-rotation recognition — wildcard the path level before the patch uuid unconditionally. Shared golden suite should pin the nested-block red case.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes hosted gem Gemfile rewrite and idempotency logic on a production re-scan path; scope is gem redirect + CLI override construction, with strong unit and e2e coverage but no broad cross-ecosystem rotation audit in this PR.

Overview
Hosted gem re-scans under a rotated grant (production rotates the grant-token segment in patch-registry URLs per request) no longer nest new source "…" do blocks around existing Socket blocks. The rewriter refreshes the index URL in place, records a redirect_gemfile_source_url ledger edit, and stays byte-idempotent when the grant is unchanged.

Core: New grant_token_path_segment recovers the token from URL shape (path segment before the patch uuid). gem_index_url_pattern now wildcards that segment from DepOverride.token or from the URL itself, so idempotency does not break when callers leave token empty.

CLI: scan/hosted populates DepOverride.token from registry override or artifact URLs via the same helper.

Also: When a gem line blocks redirect because of path: into .socket/vendor/, the warning prescribes socket-patch vendor --revert instead of a generic skip message.

Tests: Unit cases for empty-token rotation, gems.rb twins, grant_token_path_segment edges, and vendored-path warnings; e2e capstone gem_hosted_rotated_grant_rescan_refreshes_source_block_and_installs (token A → A → B through real bundler).

^{Reviewed by Cursor Bugbot for commit 9a47426. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9a47426. Configure here.}