gemvault 0.2.2 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a1d5d0c990e232ac54514f5837db4224d92b127175f370a3443c8d15d44099f
-  data.tar.gz: ab40029793c2dd05206b9812e27da8921eb7fc478164f71fa7485296d5455f15
+  metadata.gz: fc64d612838fd7c22293d18622272cf495d92374f0b23aeb55eb900678081ec8
+  data.tar.gz: 29dae30a7efc5c9d38b829859682e8c3d0db49e340b4e1a28f139940045938ad
 SHA512:
-  metadata.gz: 916b9a114590c9eb5fa3a377d59e9639c33a28e948429b8bac18399473eba0dcacf6711a9808106e3f91348945d71ebd051c1f65fe05239f9804289f56fcf859
-  data.tar.gz: 9ea36ee67195ca7f7a8bafd7ebc8658e000b72bcbf72356e3a2266c2f8d2679e0d8f5212f0b977a36a36c95441152f2dabae8ada78c5831770c0cd3498c4253d
+  metadata.gz: 305c089e3b58804bbf70f89e3c11f94300fc2e6204dec50fab4fb63346da163fe735f639ee89a7fceea83caa53b17f2a69c3f898e97e4b0585ace415f0ade178
+  data.tar.gz: 15bcb0df46245246f279fcb4a08bfa1c351d68f09e432ac547df92e56120800bc5decc1ae5f8351a49990b0f5001a23437a78161af66491f1dd71a2162915bb0

data/.rubycritic.yml

@@ -0,0 +1,15 @@
+path: "tmp/rubycritic" # Set path where report will be saved (tmp/rubycritic by default)
+coverage_path: "tmp/coverage" # Set path where SimpleCov coverage will be saved (./coverage by default)
+threshold_score: 0 # default is 0
+deduplicate_symlinks: false # default is false
+suppress_ratings: false # default is false
+no_browser: true # default is false
+formats: # Available values are: html, json, console, lint. Default value is html.
+  - console
+  - json
+minimum_score: 95 # default is 0
+paths: # Files to analyse. Churn calculation is scoped to these files when using Git SCM.
+  - "lib/"
+  - "spec/"
+  - "test/"
+  - "shim/"

data/CLAUDE.md

@@ -9,15 +9,16 @@ Do NOT modify `.rubocop.yml` or use inline `# rubocop:disable` tags without expl
 1. Specs always come first. Every plan should start with the skeleton of the BDD specs being added, changed or removed. Skeleton means the empty RSpec language, without implementation.
 2. Specs should never have comments. Any urge to put a comment in a spec means that comment should probably be its own spec
 3. DO NOT edit .rubocop.yml or add inline rubocop exemptions without explicit permission
-4. DO NOT run any git command that will rewrite history without explicit permission
-5. PREFER method & class extraction over comments
-6. Making new files, classes, modules, and methods IS NOT overengineering
-7. BEFORE writing code, identify which domain concept owns the behavior. Each class and module should have a single responsibility. If the new behavior doesn't fit an existing class's responsibility, create a new one — don't expand the scope of what's already there.
-8. DO NOT name classes with suffixes like "-er" or "-or" unless using a canonical pattern name (e.g., Parser, Router, Controller)
-9. ALWAYS write specs first. The workflow is: identify the domain concept (rule 5), write specs describing its behavior, then implement. No implementation without a failing spec.
-10. Integration specs are the first line of defense for CLI-tool bugs. For any bug reported from using the CLI tool (not the gemvault lib / Ruby API), the FIRST spec you write is an integration spec that reproduces the user's exact invocation — real subprocess, real vault, real exit code. Stub-heavy unit specs are complementary, not sufficient: they prove internal logic produces the expected value assuming surrounding wiring works, but a user's bug report is evidence the wiring didn't work.
-11. If an integration spec is not catching a reported CLI-tool bug, one of two things is true, and the fix starts by diagnosing which: (a) existing integration specs are not specific enough — extend them to cover the exact scenario before touching production code; or (b) the scenario is not spec'd at all, which means the work is not a bug fix but a new feature — write integration specs for the contract first (per rule 1), then implement.
-12. NEVER write to /tmp. Use /workspace/tmp
+4. DO NOT edit .rubycritic.yml or add inline rubycritic exemptions without explicit permission
+5. DO NOT run any git command that will rewrite history without explicit permission
+6. PREFER method & class extraction over comments
+7. Making new files, classes, modules, and methods IS NOT overengineering
+8. BEFORE writing code, identify which domain concept owns the behavior. Each class and module should have a single responsibility. If the new behavior doesn't fit an existing class's responsibility, create a new one — don't expand the scope of what's already there.
+9. DO NOT name classes with suffixes like "-er" or "-or" unless using a canonical pattern name (e.g., Parser, Router, Controller)
+10. ALWAYS write specs first. The workflow is: identify the domain concept (rule 5), write specs describing its behavior, then implement. No implementation without a failing spec.
+11. Integration specs are the first line of defense for CLI-tool bugs. For any bug reported from using the CLI tool (not the gemvault lib / Ruby API), the FIRST spec you write is an integration spec that reproduces the user's exact invocation — real subprocess, real vault, real exit code. Stub-heavy unit specs are complementary, not sufficient: they prove internal logic produces the expected value assuming surrounding wiring works, but a user's bug report is evidence the wiring didn't work.
+12. If an integration spec is not catching a reported CLI-tool bug, one of two things is true, and the fix starts by diagnosing which: (a) existing integration specs are not specific enough — extend them to cover the exact scenario before touching production code; or (b) the scenario is not spec'd at all, which means the work is not a bug fix but a new feature — write integration specs for the contract first (per rule 1), then implement.
+13. NEVER write to /tmp. Use /workspace/tmp
 
 ## Additional rules
 
@@ -94,7 +95,7 @@ bundle exec rake test
 ```
 
 Minitest covers the library; RSpec covers the CLI and the containerized
-integration suite. `rake` (the default task) runs `test`, `spec` and `rubocop`.
+integration suite. `rake` (the default task) runs `test`, `spec`, `rubocop` and `rubycritic`.
 
 ```bash
 bundle exec rake test            # minitest only
@@ -118,7 +119,7 @@ to avoid rubygems.org resolution during testing.
 
 The container has to look like a machine a user actually has. The `ruby` base
 image does not, and every way it differs has already hidden a real defect. These
-four are load-bearing; reverting any of them silently makes the suite green
+five are load-bearing; reverting any of them silently makes the suite green
 against something other than the code under test:
 
 1. **`bundler-source-vault` is NOT installed system-wide in `Dockerfile.test`.**
@@ -141,6 +142,12 @@ against something other than the code under test:
 4. **Bundler is pinned to the version users run, not the image's default gem.**
    The plugin machinery under test is Bundler's own, so a stale default silently
    tests different code.
+5. **dnf runs with stock settings — weak dependencies included.** On a real
+   Fedora machine `dnf install ruby` pulls the unbundled default-gem RPMs
+   (`rubygem-json`, `rubygem-psych`, …) through the ruby package's Recommends.
+   `--setopt=install_weak_deps=False` builds a ruby no user has — one where
+   `require "json"` raises — and that faulty install once failed every CLI
+   scenario in the suite.
 
 Fidelity is a property of the image, not of a script fragment: integration specs
 run only commands a user would actually type.
@@ -153,6 +160,6 @@ container.
 
 - `bundler` — NOT a dependency; the plugin always runs inside an existing Bundler process, and declaring it breaks gem activation under `bundle exec`'s restricted GEM_PATH
 - `command_kit` (~> 0.6) — runtime (CLI)
-- `json` (~> 2.0) — runtime; backs the tarball vault's manifest. A default gem upstream, but distros package it separately, so it is declared. Because the shim loads gemvault off `$LOAD_PATH` without activating it, it has to put json's require paths on `$LOAD_PATH` itself — see `dependency_specs` and `entries` in `shim/gemvault_load_path.rb`.
+- `json` — NOT a dependency, though it backs the tarball vault's manifest. A default gem upstream; distros that unbundle it (Fedora's `rubygem-json`) still install it alongside ruby itself, and it stays requireable even under `bundle exec`'s restricted view. Declaring it would compile a native extension on every `gem install gemvault` for no gain.
 - `sqlite3` (~> 2.0) — NOT a runtime dependency; loaded lazily only to read a legacy SQLite (Dbvault) vault. Declared in the Gemfile for development/test.
 - `minitest`, `rspec`, `rake` — development

data/Dockerfile.test

@@ -9,13 +9,20 @@
 # also the shape that broke `bundle exec` in issue #12.
 FROM docker.io/library/fedora:44
 
-# redhat-rpm-config carries the hardening specs Fedora's ruby-devel compiles
-# extensions against; without it every native gem fails in extconf. Any Fedora
-# machine that can build a gem has it.
-RUN dnf -y install --setopt=install_weak_deps=False \
-        ruby ruby-devel rubygem-bundler \
-        gcc make redhat-rpm-config sqlite-devel tar \
-    && dnf clean all
+# Stock dnf settings, weak dependencies included: on a real Fedora machine
+# `dnf install ruby` pulls the unbundled default-gem RPMs (rubygem-json,
+# rubygem-psych, rubygem-rdoc, ...) through the ruby package's Recommends.
+# Passing --setopt=install_weak_deps=False builds a ruby no user has -- one
+# where `require "json"` raises -- and that faulty install once failed every
+# CLI scenario in the suite.
+RUN dnf \
+	install \
+	-y \
+	@standard \
+	@development-tools \
+	@ruby \
+	sqlite3 \
+	&& dnf clean all
 
 # Keep this in step with the `BUNDLED WITH` line the project's own lockfile
 # carries. The plugin machinery these specs exercise is Bundler's own, so a
@@ -27,19 +34,6 @@ RUN gem install --no-document bundler -v 4.0.17
 # migrates.
 RUN gem install --no-document sqlite3
 
-# Gem files for integration specs that install the plugin from a local gem
-# index at spec runtime, kept for offline use: command_kit and json are
-# gemvault's runtime dependencies, and `bundle plugin install` resolves them
-# against the Gemfile's sources with GEM_PATH already narrowed to the plugin
-# root, so an ambient copy does not satisfy it -- every declared dependency has
-# to be servable from the index. The bundler gem lets specs reinstall bundler
-# in place.
-RUN mkdir -p /opt/gems \
-    && cd /opt/gems \
-    && gem fetch command_kit -v 0.6.0 \
-    && gem fetch json -v "~> 2.0" \
-    && gem fetch bundler -v "$(ruby -rbundler -e 'print Bundler::VERSION')"
-
 # The tree arrives as a bind mount at /src rather than a COPY: the build context
 # lives on a filesystem whose extended-attribute listing podman's copier cannot
 # read. `rake spec:build` supplies both the mount and SOURCE_DIGEST.

data/Rakefile

@@ -24,14 +24,24 @@ RuboCop::RakeTask.new
 require "gempilot/version_task"
 Gempilot::VersionTask.new
 
+require "rubycritic/rake_task"
+require "yaml"
+
+# The task's default paths are FileList["."], passed straight to the CLI where
+# they override .rubycritic.yml's paths -- and "." drags in references/, whose
+# vendored checkouts flog cannot even read. Feed the yml's own list back in so
+# the config file stays the single source of truth.
+RubyCritic::RakeTask.new do |task|
+  task.paths = YAML.load_file(".rubycritic.yml").fetch("paths")
+end
+
 require "digest"
 require_relative "spec/support/container_helper"
+require_relative "spec/support/container_image"
 
-CACHED_IMAGE = ContainerHelper::CACHED_IMAGE
-
-# Dockerfile.test reads the tree through a bind mount, whose contents podman
-# does not fold into its layer cache key. Feeding this digest in as a build arg
-# is what makes `rake spec:build` notice that the source changed.
+# What the image is built from. ContainerImage feeds this to podman as a build
+# arg, because the bind mount the Dockerfile reads is invisible to podman's
+# layer cache key.
 def image_source_digest
   fingerprints = FileList["lib/**/*", "exe/*", "gemvault.gemspec"]
                  .select { |path| File.file?(path) }.sort
@@ -39,31 +49,19 @@ def image_source_digest
   Digest::SHA256.hexdigest(fingerprints.join("\n"))
 end
 
-def cached_image_exists?
-  system("podman", "image", "exists", CACHED_IMAGE, out: File::NULL, err: File::NULL)
-end
-
-def build_cached_image
-  sh "podman", "build", "--network=host", "-v", "#{__dir__}:/src:ro,z",
-     "--build-arg", "SOURCE_DIGEST=#{image_source_digest}",
-     "-t", CACHED_IMAGE, "-f", "Dockerfile.test", "."
-end
-
-def destroy_cached_image
-  strays = `podman ps -aq --filter ancestor=#{CACHED_IMAGE}`.split
-  sh "podman", "rm", "-f", *strays unless strays.empty?
-  sh "podman", "rmi", CACHED_IMAGE
+def cached_image
+  ContainerImage.new(name: ContainerHelper::CACHED_IMAGE, root: __dir__, digest: image_source_digest)
 end
 
 namespace :spec do
   desc "Build cached container image with gemvault pre-installed"
-  task(:build) { build_cached_image }
+  task(:build) { cached_image.build }
 
   desc "Build the cached image unless it already exists"
-  task(:setup) { build_cached_image unless cached_image_exists? }
+  task(:setup) { cached_image.ensure_built }
 
   desc "Remove test containers and the cached image"
-  task(:teardown) { destroy_cached_image if cached_image_exists? }
+  task(:teardown) { cached_image.destroy }
 end
 
 directory "pkg" do
@@ -87,4 +85,4 @@ Rake::Task[:build].enhance ["shim:build"]
 Rake::Task[:release].enhance ["shim:release"]
 Rake::Task[:clobber].enhance ["spec:teardown"]
 
-task default: [:test, :spec, :rubocop]
+task default: [:test, :spec, :rubocop, :rubycritic]

data/issues.rec

@@ -756,4 +756,264 @@ Id: 15
 Updated: Wed, 29 Jul 2026 17:39:23 -0400
 Name: gemvault new fails on path/to/gemvault.gemv
 Description: I did it in /tmp, maybe that's why?
++ 
++ RESOLUTION: /tmp was a red herring -- the trigger is the missing parent
++ directory. `gemvault new path/to/gemvault.gemv` reached Tempfile.create with a
++ nonexistent dirname and died with a raw Errno::ENOENT and a 25-line Ruby
++ backtrace; with path/to already present the same command always worked.
++ 
++ A vault is one file, so `gemvault new vendor/vendored.gemv` in a tree that has
++ no vendor yet reads as an ordinary request rather than a mistake: the missing
++ directories are now created, and the shallowest one created is reported
++ ("Created directory vendor") so nothing appears out of nowhere. What cannot be
++ papered over is raised as VaultDestination::Error and printed as one line with
++ exit 1 -- a parent that is a file, or one that cannot be created (EACCES).
++ SystemCallError from the vault write itself is caught the same way, so no path
++ through `gemvault new` ends in a backtrace.
++ 
++ Gemvault::VaultDestination owns the .gemv suffix defaulting, the occupied-path
++ check and the parent creation; the command stays thin. Replicated first by
++ spec/integration/cli/commands/new_spec.rb (real subprocess, real vault, real
++ exit code -- 5 of its 9 examples failed against the old code, including one
++ asserting the absence of Errno::ENOENT), with unit cover in
++ spec/gemvault/vault_destination_spec.rb and spec/gemvault/cli/commands/new_spec.rb.
+Status: closed
+
+Id: 16
+Updated: Wed, 29 Jul 2026 18:25:48 -0400
+Name: Add jruby-ci workflow
+Description: It should be already set up on the jruby-support branch. It just needs to be picked from it. DO NOT use the other code in that - it is very outdated
+Status: open
+
+Id: 17
+Updated: Thu, 30 Jul 2026 00:07:42 +0000
+Name: Integration CI job reddens on transient podman/crun failures
+Description: Both `integration` jobs failed on master (run 30496142063) and on PR #17 with:
++ 
++ ```
++ error running container: from /usr/bin/crun creating container for
++ [/bin/sh -c dnf -y install ...]: unknown version specified
++ ```
++ 
++ Nothing had changed between the last green run and the first red one: same runner
++ image 20260720.247.2, same pre-installed podman, same fedora:44 blob and config
++ digests, same SOURCE_DIGEST build arg, and the only commit in between touched
++ issues.rec text. Rerunning the identical commit went green.
++ 
++ `rake spec:build` had no retry, so one momentary container-runtime failure reddens
++ the whole run -- and because the matrix cancels the sibling leg, a flake reads as a
++ real break in the suite CLAUDE.md calls the first line of defense for CLI bugs.
++ 
++ RESOLUTION: the image lifecycle moved out of the Rakefile into ContainerImage
++ (spec/support/container_image.rb), which retries a failed build ATTEMPTS (3) times
++ and announces each retry. Nothing in the exit status separates a transient runtime
++ failure from a real Dockerfile error, so every failure is retried; a genuinely broken
++ Dockerfile still fails, just after 3 tries, and fails fast because it never reaches
++ the network. Commands run through an injected Shell so the retry behaviour is
++ specified without podman (spec/container_image_spec.rb, spec/shell_spec.rb), and the
++ loop was also confirmed against real podman with a Dockerfile that exits nonzero.
++ 
++ RESOLUTION: the `jruby` job is picked into .github/workflows/ci.yml; none of the
++ branch's Sequel/jdbc-sqlite3 code came with it. Master needs none of it -- the
++ tarball format uses only rubygems' own tar tooling, so gemvault already runs on
++ JRuby. Three of the branch job's details did not survive the pick: JAVA_OPTS
++ --enable-native-access existed to silence a jdbc-sqlite3 warning under Java 25
++ (no JDBC driver here, and the job pins Java 21), BUNDLE_FROZEN existed for a
++ committed MRI-resolved lock (Gemfile.lock is gitignored on master), and the
++ branch's matrix/podman edits to the MRI jobs are the outdated part.
++ 
++ Two things the branch job would have hit on master, both found by running it:
++ (1) `bundle install` died on the sqlite3 C extension, which cannot build on the
++ JVM. sqlite3 is a dev-only dependency for the legacy Dbvault read path, so the
++ Gemfile now scopes it `platform: %i[ruby windows]`; nothing under test/ touches
++ sqlite3, which is why the job runs `rake test` only and leaves the sqlite3-backed
++ specs to the MRI jobs. (2) `bundle install` then exhausted JRuby's default 500MB
++ heap during resolution -- inherent to the Gemfile, not to sqlite3 -- so the job
++ sets JRUBY_OPTS=-J-Xmx2048m, the remedy JRuby's own error message prescribes.
++ 
++ Verified locally against JRuby 10.1.0.0 on Java 25 (installed for this; the box
++ had none, and no install-jruby script existed -- one is now at
++ ~/.local/bin/install-jruby): bundle install clean with sqlite3 absent, rake test
++ 113 tests / 231 assertions / 0 failures. MRI unaffected: sqlite3 still resolves,
++ rake test 113/0, spec:core 130 examples/0 failures, rubocop 111 files clean.
+Status: closed
+
+Id: 18
+Updated: Thu, 30 Jul 2026 01:06:09 +0000
+Name: Integration CI broken by runner image podman 5 / crun 1.14 mismatch
+Description: Every `integration` job fails at the Dockerfile's dnf layer with:
++ 
++ ```
++ error running container: from /usr/bin/crun creating container for
++ [/bin/sh -c dnf -y install ...]: unknown version specified
++ ```
++ 
++ This looked like issue #17's flake and is not. Correlating the runner image
++ against the outcome settles it:
++ 
++ | runner image        | podman | outcome     |
++ |---------------------|--------|-------------|
++ | 20260720.247 (old)  | 4.9.3  | pass        |
++ | 20260726.254 (new)  | 5.8.4  | crun error  |
++ 
++ Every genuine failure is on 20260726.254; every job on 20260720.247 either passed
++ or was cancelled by fail-fast (which is what made two of them look like failures).
++ GitHub rolls the image out gradually, so jobs land on either one -- hence reruns
++ sometimes helping and sometimes not, and hence integration CI going permanently
++ red as the rollout completes.
++ 
++ The new image bumped podman 4.9.3 -> 5.8.4 and left Ubuntu 24.04's crun 1.14 in
++ place. podman 5 writes an OCI config declaring ociVersion 1.2.0; crun 1.14
++ rejects any version not prefixed "1.0" with exactly "unknown version
++ specified". A dev box running podman 5.8.4 with crun 1.28 builds and runs the
++ same image fine, which is the control.
++ 
++ Nothing about this is intermittent, so #17's retry cannot help: three attempts
++ on the same runner fail three times.
++ 
++ RESOLUTION: the integration job installs a pinned crun 1.28 (newer than any
++ noble package) and names it in GEMVAULT_PODMAN_RUNTIME; Podman.command inserts
++ `--runtime` ahead of the subcommand when that variable is set, so both
++ ContainerImage's build and ContainerHelper's container runs go through it. Unset
++ -- every dev machine, and any runner whose podman and crun agree -- podman
++ chooses as before. The job also prints podman, crun and the chosen runtime, so
++ the next mismatch names itself instead of being mistaken for a flake, and
++ fail-fast is off because one leg cancelling the other hid which had broken.
++ 
++ Verified locally both ways: with the variable set to a downloaded crun 1.28,
++ spec:build plus 135 integration examples pass; with it unset, the same. A
++ config-file override (`[engine.runtimes]`) was tried first and did not take --
++ podman kept /usr/bin/crun -- which is why this uses the explicit flag.
+Status: closed
+
+Id: 19
+Updated: Fri, 31 Jul 2026 09:18:45 -0400
+Name: Deps in Dockerfile.test are not dynamically inferred
+Description: Bundler version, command kit version, and all other deps that are being installed need to be inferred from this project via bundler info, and should be passed in as ENV variables. Hardcoding is not acceptable
+Status: open
+
+Id: 20
+Updated: Fri, 31 Jul 2026 13:42:28 -0400
+Name: Received the following error during bundle install:
+Description: [dev@rstore]/workspace% bundle install
++ Bundler 4.0.14 is running, but your lockfile was generated with 4.0.17. Installing Bundler 4.0.17 and restarting using that version.
++ Source locally installed gems is ignoring #<Bundler::StubSpecification name=io-event version=1.19.4 platform=ruby> because it is missing extensions
++ Fetching gem metadata from https://rubygems.org/.
++ Source rubygems repository https://rubygems.org/ is ignoring #<Bundler::StubSpecification name=io-event version=1.19.4 platform=ruby> because it is missing extensions
++ Installing bundler 4.0.17
++ Ignoring io-event-1.19.4 because its extensions are not built. Try: gem pristine io-event --version 1.19.4
++ Fetching gem metadata from https://rubygems.org/.......
++ Source rubygems repository https://rubygems.org/, cached gems or installed locally is ignoring #<Bundler::StubSpecification name=io-event version=1.19.4 platform=ruby> because it is missing extensions
++ Resolving dependencies...
++ Fetching json 2.21.2
++ Installing json 2.21.2 with native extensions
++ Fetching gemvault 0.2.2
++ Installing gemvault 0.2.2
++ Fetching bundler-source-vault 0.2.2
++ Installing bundler-source-vault 0.2.2
++ The following plugin paths don't exist: /Users/davidgillis/.rbenv/versions/4.0.1/lib/ruby/gems/4.0.0/gems/bundler-source-vault-0.2.1/..
++ 
++ This can happen if the plugin was installed with a different version of Ruby that has since been uninstalled.
++ 
++ If you would like to reinstall the plugin, run:
++ 
++ bundler plugin uninstall bundler-source-vault && bundler plugin install bundler-source-vault
++ 
++ Continuing without installing plugin bundler-source-vault.
++ /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/source_list.rb:59:in 'Bundler::SourceList#add_plugin_source': undefined method 'new' for nil (NoMethodError)
++ 
++       add_source_to_list Plugin.source(source).new(options), @plugin_sources
++                                               ^^^^
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/dsl.rb:135:in 'Bundler::Dsl#source'
++ 	from /workspace/Gemfile:20:in 'block in Bundler::Dsl#eval_gemfile'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/dsl.rb:49:in 'BasicObject#instance_eval'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/dsl.rb:49:in 'block in Bundler::Dsl#eval_gemfile'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/dsl.rb:330:in 'Bundler::Dsl#with_gemfile'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/dsl.rb:47:in 'Bundler::Dsl#eval_gemfile'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/dsl.rb:13:in 'Bundler::Dsl.evaluate'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/definition.rb:40:in 'Bundler::Definition.build'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler.rb:235:in 'Bundler.definition'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/env.rb:36:in 'Bundler::Env.report'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/friendly_errors.rb:71:in 'Bundler::FriendlyErrors.request_issue_report_for'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/friendly_errors.rb:50:in 'Bundler::FriendlyErrors.log_error'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/friendly_errors.rb:124:in 'Bundler.with_friendly_errors'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/exe/bundle:20:in '<top (required)>'
++ 	from /usr/local/share/ruby/site_ruby/rubygems.rb:305:in 'Kernel#load'
++ 	from /usr/local/share/ruby/site_ruby/rubygems.rb:305:in 'Gem.activate_and_load_bin_path'
++ 	from /usr/local/bin/bundle:25:in '<main>'
++ /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/source_list.rb:59:in 'Bundler::SourceList#add_plugin_source': undefined method 'new' for nil (NoMethodError)
++ 
++       add_source_to_list Plugin.source(source).new(options), @plugin_sources
++                                               ^^^^
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/dsl.rb:135:in 'Bundler::Dsl#source'
++ 	from /workspace/Gemfile:20:in 'block in Bundler::Dsl#eval_gemfile'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/dsl.rb:49:in 'BasicObject#instance_eval'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/dsl.rb:49:in 'block in Bundler::Dsl#eval_gemfile'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/dsl.rb:330:in 'Bundler::Dsl#with_gemfile'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/dsl.rb:47:in 'Bundler::Dsl#eval_gemfile'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/dsl.rb:13:in 'Bundler::Dsl.evaluate'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/definition.rb:40:in 'Bundler::Definition.build'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler.rb:235:in 'Bundler.definition'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/cli/install.rb:45:in 'Bundler::CLI::Install#run'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/cli.rb:296:in 'block in Bundler::CLI#install'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/settings.rb:145:in 'Bundler::Settings#temporary'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/cli.rb:295:in 'Bundler::CLI#install'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/vendor/thor/lib/thor/command.rb:28:in 'Bundler::Thor::Command#run'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/vendor/thor/lib/thor/invocation.rb:127:in 'Bundler::Thor::Invocation#invoke_command'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/vendor/thor/lib/thor.rb:538:in 'Bundler::Thor.dispatch'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/cli.rb:35:in 'Bundler::CLI.dispatch'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/vendor/thor/lib/thor/base.rb:584:in 'Bundler::Thor::Base::ClassMethods#start'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/cli.rb:29:in 'Bundler::CLI.start'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/exe/bundle:28:in 'block in <top (required)>'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/lib/bundler/friendly_errors.rb:118:in 'Bundler.with_friendly_errors'
++ 	from /workspace/vendor/ruby/4.0.0/gems/bundler-4.0.17/exe/bundle:20:in '<top (required)>'
++ 	from /usr/local/share/ruby/site_ruby/rubygems.rb:305:in 'Kernel#load'
++ 	from /usr/local/share/ruby/site_ruby/rubygems.rb:305:in 'Gem.activate_and_load_bin_path'
++ 	from /usr/local/bin/bundle:25:in '<main>'
++ 
++ Though I will add that gemvault doctor followed by bundle install fixed the issue
+Status: open
+
+Id: 21
+Updated: Fri, 31 Jul 2026 13:54:09 -0400
+Name: bundle info fails when gem is in vault
+Description: bundle info jarpack
++ Source locally installed gems is ignoring #<Bundler::StubSpecification name=json version=2.21.2 platform=ruby> because it is missing extensions
++ Could not find gem 'jarpack'.
++ Did you mean 'jarpack'?
++ 
++ 
++  bundle info jarpack
+Status: open
+
+Id: 22
+Updated: Mon, 10 Aug 2026 10:03:35 -0400
+Name: Add github actions disclaimer/instructions
+Description: bundler-cache: true on the ruby/setup-ruby action will not work correctly:
++ 
++    - uses: ruby/setup-ruby@v1
++         with:
++           ruby-version: ${{ matrix.ruby }}
++           # bundler-cache runs `bundle lock`, which cannot parse the vault source until
++           # `bundle install` has fetched its plugin; install and cache manually instead.
++           bundler-cache: false
++       - name: Cache gems
++         uses: actions/cache@v6
++         with:
++           path: |
++             vendor/bundle
++             .bundle/plugin
++           key: ${{ runner.os }}-gems-${{ matrix.ruby }}-${{ hashFiles('Gemfile', '*.gemspec', 'vendor/vendored.gemv') }}
++           restore-keys: |
++             ${{ runner.os }}-gems-${{ matrix.ruby }}-
++ 
++       - name: Install gems
++         run: | # confine gems to vendor/bundle so the cache never shadows vendor/vendored.gemv
++           bundle config set --local path vendor/bundle
++           bundle install --jobs 4 --retry 3
+Updated: Mon, 10 Aug 2026 10:14:51 -0400
+Name: Gemvault spams warnings on bundle install
+Description: /workspace/.bundle/plugin/gems/bundler-source-vault-0.2.2/gemvault_load_path.rb:31: warning: already initialized constant BundlerSourceVault::GemvaultLoadPath::GEM
++ /workspace/.bundle/plugin/gems/bundler-source-vault-0.2.2/gemvault_load_path.rb:32: warning: already initialized constant BundlerSourceVault::GemvaultLoadPath::SHIM
++ /workspace/.bundle/plugin/gems/bundler-source-vault-0.2.2/gemvault_load_path.rb:33: warning: already initialized constant BundlerSourceVault::GemvaultLoadPath::VAULT_SOURCE
 Status: open

data/lib/gemvault/cli/commands/new.rb

@@ -1,5 +1,6 @@
-require "pathname"
 require_relative "../command"
+require_relative "../destination"
+require_relative "../../vault_destination"
 
 module Gemvault
   class CLI
@@ -13,16 +14,23 @@ module Gemvault
                         desc: "Vault name (auto-appends .gemv)"
 
         def run(name)
-          path = Pathname(name.end_with?(".gemv") ? name : "#{name}.gemv")
-
-          if path.exist?
-            print_error("#{path} already exists")
+          begin
+            destination = build_destination(name)
+            destination.refuse_existing
+            destination.create_parents
+            Vault.create(destination.path)
+            puts "Created #{destination.path}"
+          rescue VaultDestination::Error, Vault::Error, SystemCallError => e
+            print_error(e.message)
             exit(1)
           end
+        end
+
+        private
 
-          vault = Vault.new(path, create: true)
-          vault.close
-          puts "Created #{path}"
+        def build_destination(name)
+          vault_destination = VaultDestination.new(name)
+          Destination.new(vault_destination, stdout:)
         end
       end
     end

data/lib/gemvault/cli/destination.rb

@@ -0,0 +1,29 @@
+require "forwardable"
+
+module Gemvault
+  class CLI
+    ##
+    # A VaultDestination as the CLI presents it: the same operations, with the
+    # directories they grow narrated on +stdout+ so nothing appears on disk
+    # unannounced. What the destination refuses still surfaces as
+    # <tt>VaultDestination::Error</tt> for the command to report.
+    class Destination
+      extend Forwardable
+
+      def_delegators :@destination, :path, :refuse_existing
+
+      def initialize(destination, stdout:)
+        @destination = destination
+        @stdout = stdout
+      end
+
+      # Creates the destination's missing parent directories, reporting the
+      # shallowest one created so the user learns where the tree grew.
+      def create_parents
+        missing = @destination.missing_directory
+        @destination.create_parents
+        @stdout.puts "Created directory #{missing}" if missing
+      end
+    end
+  end
+end

data/lib/gemvault/vault.rb

@@ -30,6 +30,11 @@ module Gemvault
                    :spec_from_blob, :with_gem_file, :size, :close, :closed?,
                    :path, :format_version
 
+    # Creates an empty vault file at +path+, leaving it closed.
+    def self.create(path)
+      new(path, create: true).close
+    end
+
     def self.assert_readable!(version:, path:)
       return if version.between?(MIN_READABLE_FORMAT, CURRENT_FORMAT)
 

data/lib/gemvault/vault_destination.rb

@@ -0,0 +1,70 @@
+require "pathname"
+
+module Gemvault
+  ##
+  # Where a new vault is about to be written: the <tt>.gemv</tt> path itself,
+  # and the directories that have to exist before anything can be written to it.
+  #
+  # A vault is one file, so <tt>gemvault new vendor/vendored.gemv</tt> in a tree
+  # that has no <tt>vendor</tt> yet reads as an ordinary request rather than a
+  # mistake, and the missing directories are created. What cannot be papered
+  # over -- something already occupying the path, a parent that is a file, a
+  # parent that cannot be created -- is raised as Error, so the CLI reports one
+  # line instead of a Ruby backtrace.
+  class VaultDestination
+    SUFFIX = ".gemv".freeze
+
+    ##
+    # Raised when the path cannot hold a new vault.
+    class Error < StandardError; end
+
+    # The vault's path, with SUFFIX appended if the name lacked it.
+    attr_reader :path
+
+    def initialize(name)
+      locator = suffixed(name.to_s)
+      @path = Pathname(locator)
+    end
+
+    # Raises Error when something already occupies the vault's path.
+    def refuse_existing
+      raise Error, "#{@path} already exists" if @path.exist?
+    end
+
+    # :call-seq:
+    #   missing_directory -> Pathname or nil
+    #
+    # The shallowest directory create_parents would have to make -- creating it
+    # brings every deeper one with it -- or +nil+ when the parent already
+    # exists.
+    def missing_directory
+      @path.dirname.ascend.reject(&:exist?).last
+    end
+
+    # Creates the vault's missing parent directories.
+    def create_parents
+      parent = @path.dirname
+      return if parent.directory?
+
+      raise Error, "#{parent} is not a directory" if parent.exist?
+
+      make(parent)
+    end
+
+    private
+
+    def suffixed(locator)
+      return locator if locator.end_with?(SUFFIX)
+
+      "#{locator}#{SUFFIX}"
+    end
+
+    def make(parent)
+      begin
+        parent.mkpath
+      rescue SystemCallError => e
+        raise Error, "cannot create directory #{parent}: #{e.message}"
+      end
+    end
+  end
+end

data/lib/gemvault/version.rb

@@ -1,3 +1,3 @@
 module Gemvault
-  VERSION = "0.2.2".freeze
+  VERSION = "0.2.3".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gemvault
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.2.3
 platform: ruby
 authors:
 - David Gillis
@@ -23,20 +23,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.6'
-- !ruby/object:Gem::Dependency
-  name: json
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
 description: Portable .gemv archives for bundling and distributing multiple gems as
   a single file, read directly by Bundler and RubyGems
 email:
@@ -50,6 +36,7 @@ files:
 - ".rspec"
 - ".rubocop.yml"
 - ".ruby-version"
+- ".rubycritic.yml"
 - CHANGELOG.md
 - CLAUDE.md
 - Dockerfile.test
@@ -78,6 +65,7 @@ files:
 - lib/gemvault/cli/commands/new.rb
 - lib/gemvault/cli/commands/remove.rb
 - lib/gemvault/cli/commands/upgrade.rb
+- lib/gemvault/cli/destination.rb
 - lib/gemvault/dbvault.rb
 - lib/gemvault/deprecation.rb
 - lib/gemvault/gem_entry.rb
@@ -90,6 +78,7 @@ files:
 - lib/gemvault/tarball.rb
 - lib/gemvault/tarvault.rb
 - lib/gemvault/vault.rb
+- lib/gemvault/vault_destination.rb
 - lib/gemvault/vault_path.rb
 - lib/gemvault/vault_session.rb
 - lib/gemvault/vault_upgrade.rb
@@ -119,7 +108,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.17
+rubygems_version: 4.0.18
 specification_version: 4
 summary: Multi-gem portable archives — a gem server in a file
 test_files: []