SocketDev
diff --git a/‎crates/socket-patch-core/src/crawlers/ruby_crawler.rs‎
Lines changed: 10 additions & 10 deletions b/‎crates/socket-patch-core/src/crawlers/ruby_crawler.rs‎
Lines changed: 10 additions & 10 deletions
@@ -77,16 +77,16 @@ impl RubyCrawler {
         )
         .await;
 
-        // Historic early-return, kept ONLY for the implicit project-local
-        // `vendor/bundle` probe: a deployment-style install is the
-        // project's one gem source, so the ambient gem homes don't apply.
-        // Stores found via an env/config root do NOT suppress the fallback
-        // below: default gems (rexml, json, …) never live in a bundle path
-        // — they ship with ruby in the DEFAULT/system gem homes — so an
-        // env-`BUNDLE_PATH` project still needs the `gem env` homes to see
-        // them (the explicit-roots feature briefly suppressed that
-        // pre-existing fallback).
-        if discovery.default_root_has_stores {
+        // When ANY bundle stores are found (vendor/bundle, env, or config),
+        // return ONLY those stores without appending `gem env` homes. A
+        // deployment-style install or an env/config-rooted store is the
+        // project's gem source, so the ambient gem homes must not become
+        // apply patch targets — patching a machine-wide global gem home
+        // (which `bundle exec` doesn't load) risks permission failures and
+        // the nuget-style global-cache hazard this otherwise avoids.
+        // Default gems (rexml, json, …) never in a bundle path also aren't
+        // in the manifest, so skipping the fallback here is safe.
+        if !discovery.stores.is_empty() {
             return Ok(discovery.stores);
         }