Spawn CLI test children through one hermetic Command builder (#823)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #823 (slice 1 of the first child of tracking #824). Issue #823 stays open for the files that open fix PRs touch.

Summary

This PR adds one hermetic Command builder for CLI test children, tests/common/hermetic.rs, and builds common::run_bin_with_env on it. Every spawner file that no open fix PR touches now goes through it, and their private scrub_socket_env copies are deleted. A new spawn_env_hygiene test target checks the builder's contract and acts as a ratchet, so no new copies or bare binary spawns can appear.

Why

Register rows C30 (scrub_socket_env in 15 files with 14 bodies) and C47 (10 files spawn the binary with no SOCKET_* scrub), in the living document Part 8. Leverage: B 0 · U 1 (first child of #824) · D 8 copies deleted plus 7 unscrubbed spawners made hermetic · R low (test-only). Score ≈ 10, the top of the refactor queue.

What changed

• common/hermetic.rs (new, standalone like cache_env.rs):
  • command(bin) / binary_command(): seeds the 9 hostile SOCKET_* values and then removes them, removes SOCKET_API_TOKEN, sweeps every other ambient SOCKET_* (keeping the telemetry opt-outs), and forces SOCKET_NO_CONFIG=1 and SOCKET_NO_UPDATE_CHECK=1.
  • scrub_socket_vars: the prefix sweep alone, for package-manager children.
  • scrub_extra(&[Extra::Venv | Extra::Yarn | Extra::Pnpm]): the opt-in per-PM sweeps, with the yarn and pnpm seed-then-scrub guards kept.
• common::run_bin_with_env is now hermetic_command(bin) + args + caller env + output(), and common::hermetic_command is re-exported.
• Private copies moved onto the builder and deleted (8): e2e_yarn_legacy_cachekey_refusal_build, e2e_vendor_yarn_classic_dev_flow, e2e_redirect_pnpm_build, e2e_vendor_pnpm_build, get/get_batch_paths_e2e, mode_migration_npm, ecosystem_dispatch_e2e (including its hand-rolled GLOBAL_ARG_ENV_VARS scrub in run_scrubbed), e2e_redirect_rush_sim.
• Unscrubbed spawners now hermetic (7): repair/repair_vendor_e2e, scan/scan_sync_e2e, cli/api_client_errors_e2e, cli_parse_remove, self_update_e2e, update/covgap_update_swap, plus cli/cli_dry_run_paths_e2e (not in the issue's list, but ambient SOCKET_DRY_RUN failed it). self_update_failures_e2e and update/covgap_update_download already went through run_installed.
• spawn_env_hygiene (new target):
  • 6 contract tests on the inputs where the deleted copies differed: SOCKET_NO_CONFIG kept or removed, SOCKET_NO_UPDATE_CHECK forced or not, case of npm_config_*, which PM vars are swept, and whether the seeds leak.
  • A detector test.
  • Two ratchets: PENDING_SCRUB_COPIES (7) and PENDING_RAW_SPAWNS (148). Both fail on a new entry and on a stale one, so the lists can only shrink.
• Ported fix: efa5cde ports #851 (two vex_consumed alias tests that main @ 4646693 broke, which turned coverage red). It becomes a no-op once Fix vex alias tests broken by store-copy merge #851 lands.

Left for later slices (on the allowlists):

• The 7 remaining scrub_socket_env copies and scan/scan_invariants / apply/in_process_npm_multicopy are changed by open fix PRs Fix yarn berry hosted pin of catalog deps (#632) #763, Fix store-copy fold dropping copy writes (#756, #772) #774, Fix vendored mode replacing symlinked lockfiles (#627) #802, Fix vlt 1.3 brotli lock nodes being refused (#372) #820, Fix vendored npm-family tarballs dropped by .gitignore (#831) #837, Fix hosted yarn classic with an offline mirror (#364) #839 and Fix vendored gem rewrite breaking positional args (#847) #849.
• The other ~140 bare spawners mostly scrub by hand.

Deleted (git diff --stat)

• Production: 0 lines. The Fix vex alias tests broken by store-copy merge #851 port changes 2 test functions inside src/commands/vex_consumed.rs (+15 / −4).
• Tests, migrated files and common/mod.rs: +94 / −322 (net −228).
• New: hermetic.rs +149, spawn_env_hygiene.rs +502 (≈150 of those are the allowlist).

Behavior

No production change. In the migrated test children:

• SOCKET_NO_CONFIG=1 and SOCKET_NO_UPDATE_CHECK=1 are forced. Several copies dropped the cargo-config SOCKET_NO_CONFIG, and none forced SOCKET_NO_UPDATE_CHECK.
• The 9 high-risk SOCKET_* seeds are applied everywhere.

PM children keep their former sweeps: yarn, pnpm and venv, plus the rush file's explicit npm_config_store_dir / PNPM_HOME and dev_flow's YARN_CACHE_FOLDER removals.

Test evidence

• cargo clippy --workspace --all-features -- -D warnings: clean. cargo test -p socket-patch-cli --all-features --tests --no-run: no warnings. cargo test -p socket-patch-cli --all-features --lib: 840/840 with the Fix vex alias tests broken by store-copy merge #851 port (2 fail on main).

• Suites, branch: spawn_env_hygiene 9/9, cli_parse_remove 19, ecosystem_dispatch_e2e 21, scan 108, cli 86, get 75, update 55, self_update_e2e 27, mode_migration_npm 15, e2e_redirect_pnpm_build 11, e2e_vendor_pnpm_build 20, e2e_vendor_yarn_classic_dev_flow 11, e2e_yarn_legacy_cachekey_refusal_build 15, e2e_redirect_rush_sim 9: all pass. repair: 114 pass, 2 fail. The 2 failures are the known root-only tests (repair_exits_zero_and_stays_quiet_when_lock_file_unremovable, repair_cleanup_failure_is_reported_in_json_and_silent_modes), which chmod a directory and fail in the root sandbox on main too.

• Red → green (ambient var):

  command	main	branch
  SOCKET_DRY_RUN=true cargo test --test repair	20 failed (18 + 2 root-only)	2 failed (root-only)
  SOCKET_DRY_RUN=true cargo test --test cli	2 failed	0 failed
  SOCKET_OFFLINE=true cargo test --test cli	—	0 failed
  SOCKET_OFFLINE=true cargo test --test repair	18 failed per Spawn every CLI test child through one hermetic Command builder; 10 test files inherit ambient SOCKET_* today #823's proof	2 failed (root-only)

  scan still fails under ambient vars only in scan_invariants, which is on the allowlist pending Fix vlt 1.3 brotli lock nodes being refused (#372) #820/Fix vendored gem rewrite breaking positional args (#847) #849.

• CI on efa5cde: 414 checks passed and 0 failed as of 13:16Z, including coverage, clippy, test (windows-latest) and test (macos-latest). Some macOS e2e legs were still queued. Bugbot found no issues.

Risk

Low. The change is test-only, and the env differences are limited to the forced opt-outs and seeds above, which common::run* callers already had.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Cs49XgUuutoPh15zrPGaTy

---

Note

Low Risk
Test-only refactor of subprocess environment setup; no production code paths change. Residual risk is limited to test flakiness if hermetic scrubbing diverges from prior per-file behavior.

Overview
Introduces tests/common/hermetic.rs as the single way CLI integration tests spawn socket-patch (and related package-manager children): hostile SOCKET_* seed-then-scrub, sweep of ambient SOCKET_* vars, forced SOCKET_NO_CONFIG / SOCKET_NO_UPDATE_CHECK, and opt-in Extra::Venv | Yarn | Pnpm scrubs. common::run_bin_with_env and common::hermetic_command now delegate to this builder; migrated suites drop duplicated scrub_socket_env helpers and replace bare Command::new(binary()) with hermetic::command.

Adds spawn_env_hygiene contract tests plus allowlist ratchets (PENDING_SCRUB_COPIES, PENDING_RAW_SPAWNS) so new private scrubs or unhermetic spawns fail CI. Several e2e/CLI/get/scan/repair/update tests are wired through the shared helper in this slice.

Separately, vex_consumed npm hosted tests are adjusted for post-#605 behavior where the name-keyed resolver already finds aliases/store peers: tests still exercise alias expansion with an alias-free installed map and assert the resolver’s full copy set matches expectations.

^{Reviewed by Cursor Bugbot for commit efa5cde. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

[agent] The coverage job failed on 37b5b4e in -p socket-patch-cli --lib: commands::vex_consumed::tests::hosted_expands_alias_only_copies and hosted_reuses_expanded_npm_copies_and_merges_alias_variants.

This isn't caused by this PR. Those 2 tests fail identically on main @ 4646693, which merged #605, and this PR doesn't change src/. The fix is open as #851. I ported the same diff into this PR as efa5cde, so it becomes a no-op once #851 lands. Locally, cargo test -p socket-patch-cli --all-features --lib now passes 840/840, and clippy is clean.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit efa5cde. Configure here.}