Skip to content

ir.cmd: put RubyGems' bindir on RUBYPATH, so ir -S <gem executable> finds its binstub - #20

Merged
Largo merged 3 commits into
masterfrom
fix/ir-cmd-gem-bindir
Oct 13, 2026
Merged

Largo merged 3 commits into
masterfrom
fix/ir-cmd-gem-bindir

Conversation

@Largo

@Largo Largo commented Oct 13, 2026 •

Copy link
Copy Markdown
Owner

The Windows twin of #18, which fixes the same thing in ir.sh.

RubyGems writes a gem's binstubs to Gem.bindir, which for IronRuby is the directory ir.exe itself is in (RbConfig's bindir, Src\Console\bin\<config>\<tfm>[\win-x64]). ir.cmd only put Src\StdLib\bin on RUBYPATH, so ir.cmd -S <gem executable> after igem.cmd install <gem> skipped the binstub RubyGems had just written and took whatever came first on PATH.

The directory of ir.exe now comes after Src\StdLib\bin and before an existing RUBYPATH, the same order ir.sh uses after #18. On Windows RubyGems writes both <name> and <name>.bat there; -S resolves <name>, the Ruby script.

Tested: the new RUBYPATH lines in isolation with an IR_BIN path containing spaces and parentheses (C:\Program Files (x86)\...), with RUBYPATH empty and with an existing value containing parentheses; both come out as expected. ir.cmd still parses and reaches its "no build" message. Not tested end to end against a built ir.exe: no .NET SDK on the machine this was written on, so CI's Windows job is the real check. CI is currently red on every branch for an unrelated reason (prism main changed its serialization format); that is being fixed separately.

Summary by CodeRabbit

  • Bug Fixes
    • The selected ir.exe directory is now included in RUBYPATH, helping the application locate related files.

… finds its binstub

The Windows twin of the ir.sh change in #18. RubyGems writes a gem's
binstubs to Gem.bindir, which for IronRuby is the directory ir.exe itself
is in (RbConfig's bindir). ir.cmd only put Src\StdLib\bin on RUBYPATH, so
`ir.cmd -S <gem executable>` after `igem.cmd install <gem>` skipped the
binstub RubyGems had just written and took whatever came first on PATH -
a host Ruby's command of the same name, if there was one.

The directory of ir.exe now comes after Src\StdLib\bin and before an
existing RUBYPATH, the same order ir.sh uses.
@coderabbitai

coderabbitai Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 20d80fd2-bafa-4fe9-83ee-3da6fb13f9e1
📥 Commits

Reviewing files that changed from the base of the PR and between 60a1f1e and f4f72a1.

⛔ Files ignored due to path filters: 3
  • Src/Prism/Generated/PrismLoader.Generated.cs is excluded by !**/*.generated.*, !**/generated/**
  • Src/Prism/Generated/PrismMeta.Generated.cs is excluded by !**/*.generated.*, !**/generated/**
  • Src/Prism/Generated/PrismNodes.Generated.cs is excluded by !**/*.generated.*, !**/generated/**
📒 Files selected for processing: 26
  • .github/workflows/release.yml
  • README.md
  • Src/Prism/PrismLoader.cs
  • Src/Prism/PrismParser.cs
  • Src/Prism/README.md
  • Src/StdLib/ironruby/prism/ironruby.rb
  • Src/StdLib/ruby/4.0/prism.rb
  • Src/StdLib/ruby/4.0/prism/dot_visitor.rb
  • Src/StdLib/ruby/4.0/prism/dsl.rb
  • Src/StdLib/ruby/4.0/prism/ffi.rb
  • Src/StdLib/ruby/4.0/prism/inspect_visitor.rb
  • Src/StdLib/ruby/4.0/prism/lex_compat.rb
  • Src/StdLib/ruby/4.0/prism/node.rb
  • Src/StdLib/ruby/4.0/prism/node_ext.rb
  • Src/StdLib/ruby/4.0/prism/node_find.rb
  • Src/StdLib/ruby/4.0/prism/parse_result.rb
  • Src/StdLib/ruby/4.0/prism/parse_result/comments.rb
  • Src/StdLib/ruby/4.0/prism/parse_result/newlines.rb
  • Src/StdLib/ruby/4.0/prism/pattern.rb
  • Src/StdLib/ruby/4.0/prism/reflection.rb
  • Src/StdLib/ruby/4.0/prism/relocation.rb
  • Src/StdLib/ruby/4.0/prism/serialize.rb
  • Src/StdLib/ruby/4.0/prism/translation/parser/compiler.rb
  • Src/StdLib/ruby/4.0/prism/translation/parser/lexer.rb
  • Src/StdLib/ruby/4.0/prism/translation/ripper.rb
  • Src/StdLib/ruby/4.0/prism/translation/ruby_parser.rb
 _______________________________________________________
< Input validation: the love story you forgot to write. >
 -------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       /   づ

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 4e2acab3-5095-49f8-8fe0-f8cf8ac83286
📥 Commits

Reviewing files that changed from the base of the PR and between 1672d83 and 60a1f1e.

📒 Files selected for processing (1)
  • ir.cmd

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

ir.cmd adds the directory containing the selected ir.exe to RUBYPATH, after the bundled standard-library bin directory and before any existing entries. If RUBYPATH is unset, it contains the two launcher directories.

Changes: Launcher path setup

Layer / File(s) Summary
Set RUBYPATH from launcher paths
ir.cmd
The launcher derives IR_BINDIR from the selected executable path. It adds that directory after %S%\bin and before existing RUBYPATH entries. If RUBYPATH is unset, the value contains only those two directories.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 60a1f

The Windows launcher’s executable lookup follows the intended order, and no actionable merge risk is evident.

Security architecture risk: 🔵 Low · up to 60a1f

The change is limited to script lookup within the launched runtime. Bundled commands retain priority, and the caller’s environment is preserved. No security vulnerability was established, but the newly searched runtime directory must be trusted; its deployed permissions and Windows end-to-end behavior were not verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The demonstrated exposure is script selection for invocations through ir.cmd, including downstream Bundler lookup. The search-path addition can change which script executes under the invoking runtime’s existing authority; the changed code does not itself establish a new privileged identity.

Trust Boundaries and Controls

  • inferred — A matching script in the selected executable’s directory becomes trusted ahead of inherited search locations. Exploitation would require control of such a script and a relevant invocation, with no earlier matching bundled command. The added directory already contains the runtime being invoked, but that fact alone does not establish identical write permissions for every file there. Deployed ownership and permissions remain unverified.

Hardening Proposals

  • proposed — For deployments that launch IronRuby with elevated authority, ensure lower-privilege users cannot create or replace scripts in the selected runtime directory. This is a deployment hardening proposal, not an observed permissions defect.
Pre-merge checks: Passed 5
Passed Passed checks (5 passed)
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely describes the main change: adding RubyGems' bindir to RUBYPATH so ir -S can find gem executable binstubs.
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

CI builds libprism from prism's main branch, and since ruby/prism#4255
(attach_comments, merged 2026-10-12) every build job has failed in the
smoke test with "Unknown prism node type: 0 (TypeError)" - master, #17,
#18 and #19 alike. That change altered prism's serialization in two
places without moving the serialization version off 1.9, so the version
check in PrismLoader could not catch it:

- the options blob has a new attach_comments byte after freeze. The blob
  IronRuby wrote was one byte short, so prism read the scope count from
  the wrong offset;
- the serialized header has a comment-attachment list after the comments
  (node id, count, comment indices). PrismLoader read its count as the
  magic comment count and walked off from there.

PrismParser.BuildOptionsData writes the byte (0: IronRuby never asks for
attachments) and PrismLoader.Load skips the list. PrismLex only reads the
token stream, which ends before the header, so it needs nothing.

The rest of the revision comes along so that every piece names the same
prism commit, as Src/Prism/README.md asks:

- Src/Prism/Generated is regenerated from cd76b0d1's config.yml:
  SymbolNode#value_loc became the non-optional content_loc (the bridge
  reads neither), and a WORDS_SEP_IMPLICIT token was added after
  WORDS_SEP. Ripper looks tokens up by name and skips the ones it has no
  event for, which is what prism's own lex_compat does with this one.
- Src/StdLib/ruby/4.0/prism is prism's lib/ at cd76b0d1, generated files
  included; prism.rb keeps IronRuby's backend branch.
  parse_result/comments.rb is gone upstream - attaching comments moved
  into libprism.
- Src/StdLib/ironruby/prism/ironruby.rb follows ffi.rb: attach_comments
  is a known option and is dumped after freeze, and the *_file APIs take
  a Pathname (to_path / to_str) the way PrismSource.with_file now does.
- release.yml's PRISM_REF and the README build instructions move to
  cd76b0d1.
@Largo
Largo merged commit 260c10d into master Oct 13, 2026
6 of 7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant