[Mikola Lysenko (mikolalysenko)]

Problem

hosted-e2e is required through ci-ok. Since about 17:12 UTC on 2026-11-01 it has failed on every non-draft PR. Examples: 41330638545 and 41330161127, each red on 2 attempts with 3 internal retries. Tracking issue: #1945.

There are two causes, both on the production side:

1. bun: patch.socket.dev returns 403 to bun for the hosted minimist artifact. That has to be fixed in production, or bypassed with HOSTED_E2E_DISABLED. This PR does not fix it.
2. gem: production now publishes patches for actionpack and activesupport 6.0.3, which are dependencies of activestorage. The hosted Gemfile therefore holds several patch-registry blocks. wired_gem_registry_uuid read the first block, so the leg checked actionpack's patch (f86d5caa…) against GEM_UUIDS. It then failed with a misleading "verify the new patch and extend GEM_UUIDS" message. In some retries the leg passed, depending on which block came first.

Root cause

The test parser assumed the Gemfile holds exactly one Socket source block.

Fix

wired_gem_registry_uuid(gemfile, name) now returns the UUID only from the block whose body declares gem "<name>". If activestorage is not wired at all, which is what the failing tries show, the leg now fails with "the hosted scan did not redirect activestorage itself". It no longer blames a neighbour's patch. A new non-ignored unit test, wired_gem_registry_uuid_reads_the_named_gems_block, covers:

• blocks in any order
• the unwired-activestorage case
• a gem whose name starts with activestorage

No assertion was weakened, and no test was removed or moved.

Proof

• cargo test -p socket-patch-cli --test e2e_hosted_production wired_gem passes.
• rustfmt was run on the touched file only.
• I could not run the live leg: this sandbox's proxy blocks the production API.

---

Generated by Claude Code

---

Note

Low Risk
Test-only changes to hosted e2e Gemfile parsing; no runtime CLI or redirect behavior is modified.

Overview
Fixes flaky/misleading failures in the hosted production gem e2e leg after production started wiring patch-registry blocks for activestorage transitive gems (actionpack, activesupport).

wired_gem_registry_uuid now takes a gem name and scans each Socket source … do block until it finds one whose body declares gem "<name>", then reads that block’s patch UUID. It no longer returns the first registry block, which could belong to a dependency and be checked against GEM_UUIDS for activestorage.

The gem install proof calls the helper with GEM_NAME and uses a clearer panic when activestorage itself was never redirected. A new unit test covers block ordering, unwired activestorage beside wired transitives, and non-prefix gem name matching.

^{Reviewed by Cursor Bugbot for commit 75b6f65. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 75b6f65. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[burn-down agent] Labeled Ready for review at 75b6f65.

• CI: every check on 75b6f65 is green (29 success, 19 skipped). hosted-e2e had failed on a transient live patch.socket.dev 403 for the bun leg, and passed on re-run at 19:13 UTC.
• Bugbot: reviewed 75b6f65, no findings.
• Reviewer note: the hosted gem leg now reads activestorage's own patch-registry block instead of the first block. This fixes the gem leg once production publishes transitive gem patches (hosted-e2e red on every PR: patch.socket.dev 403s bun; new transitive gem patches #1945).

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does. Test-only fix for the hosted-e2e gem leg. Production now publishes patches for activestorage's dependencies too, so the hosted Gemfile can hold several Socket source ... do blocks. The helper used to read the first block, which could be a neighbour's patch. It now reads only the block that declares gem "activestorage". If that block is missing, the leg fails with a clear "did not redirect activestorage itself" message. The separate bun 403 is not fixed here (#1945).

Risk: low. One test file. No CLI or product code. The new unit test runs on every PR.

Look here

• e2e_hosted_production.rs#L720-L739:`` the block scan. The marker matches the rewriter's source "<idx>" do format (`upstream/gem.rs`).
• #L730: the body ends at the first line that starts with end. An indented end would let the body run on into the next block. The rewriter writes end at column 0, so this does not matter today.
• #L742-L776:``` unit test. It covers block order, an unwired activestorage beside wired transitive gems, and a gem whose name starts with activestorage.
• #L2251:```` call site.

Verified

• Read the full diff. CHANGELOG.md is untouched. No debug code.
• CRLF Gemfiles are handled: lines() strips the \r, and "\nend" still matches.
• Ran cargo test -p socket-patch-cli --test e2e_hosted_production wired_gem on the head: 1 passed. I used the stable toolchain because this container's pinned 1.93.1 toolchain has no cargo.
• Without the fix, the old first-block read returns u-actionpack for the first fixture, so the new test catches the old behaviour.
• CI: 31 checks green, 19 skipped, 0 failing. ci-ok and clippy are green. Bugbot reviewed this head and rated it Low Risk with no findings.

Changes I made: none.

Open questions: none.

Auto-merge is armed, so approving sends this PR straight to the merge queue.

---

Generated by Claude Code

[Wenxin Jiang (Wenxin-Jiang)]

[agent] Reviewed 75b6f65395b0db0f97635da7f4e3ebbff41db6fc. Checked named-gem block selection, UUID extraction, missing-target and prefix regressions. No major correctness issues found. Validation: source and regression-test review plus the available exact-head CI checks; no local test pass is claimed.