Drop env lines the hermetic builder covers

The migrated scan and repair spawners still set SOCKET_NO_CONFIG and
SOCKET_TELEMETRY_DISABLED by hand, which the shared builder already
forces, and removed VIRTUAL_ENV directly instead of through
Extra::Venv. Drop the duplicates and the telemetry mock that no run
can reach now that telemetry stays off, and extend the seed-leak
guard to SOCKET_ECOSYSTEMS.

Refs #823

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-cli/tests/repair/covgap_commands_repair.rs

@@ -300,7 +300,7 @@ fn repair_offline_warning_truncates_missing_list_after_five() {
 /// The dry-run preview lists at most 10 missing ids and folds the rest into
 /// "  ... and N more". With 12 missing that's 10 items + 2. (No `--offline`:
 /// the dry-run branch returns before any download I/O, so the run stays
-/// hermetic; telemetry is pinned off explicitly since the run is not
+/// hermetic; `socket_cmd` keeps telemetry off since the run is not
 /// airgapped by flag.)
 #[test]
 fn repair_dry_run_preview_truncates_missing_list_after_ten() {
@@ -309,7 +309,6 @@ fn repair_dry_run_preview_truncates_missing_list_after_ten() {
 
     let out = socket_cmd(tmp.path())
         .args(["repair", "--dry-run"])
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
         .output()
         .expect("run socket-patch");
     let stdout = String::from_utf8_lossy(&out.stdout);
@@ -712,7 +711,6 @@ fn run_cli(root: &Path, mock_uri: &str, argv: &[&str], json: bool) -> (i32, Stri
         "--org",
         ORG_SLUG,
     ]);
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
     let out = cmd.output().expect("run socket-patch");
     (
         out.status.code().unwrap_or(-1),

crates/socket-patch-cli/tests/repair/repair_invariants.rs

@@ -789,11 +789,6 @@ async fn repair_json_reports_unresolved_org_fallback_in_warnings() {
         .expect(1)
         .mount(&mock)
         .await;
-    Mock::given(method("POST"))
-        .and(path("/patch/telemetry"))
-        .respond_with(ResponseTemplate::new(201))
-        .mount(&mock)
-        .await;
 
     let tmp = tempfile::tempdir().expect("tempdir");
     let socket = tmp.path().join(".socket");
@@ -814,7 +809,6 @@ async fn repair_json_reports_unresolved_org_fallback_in_warnings() {
             "--api-token",
             &token,
         ])
-        .env("SOCKET_NO_CONFIG", "1")
         .output()
         .expect("run socket-patch");
     let stdout = String::from_utf8_lossy(&out.stdout).to_string();
@@ -990,7 +984,7 @@ fn repair_honors_manifest_path_override() {
 async fn repair_silent_still_reports_download_failures_on_stderr() {
     // Mock API with NO blob route mounted: every fetch 404s → counted as
     // failed ("Blob not found on server"), with no retries or live egress
-    // (telemetry also resolves to this mock via SOCKET_API_URL).
+    // (`hermetic_command` keeps telemetry off).
     let mock = MockServer::start().await;
 
     let tmp = tempfile::tempdir().expect("tempdir");

crates/socket-patch-cli/tests/scan/scan_batch_sizing_e2e.rs

@@ -13,7 +13,7 @@
 use std::path::Path;
 use std::process::Command;
 
-use crate::common::hermetic;
+use crate::common::hermetic::{self, Extra};
 
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
@@ -26,7 +26,7 @@ const BODY_CAP: usize = 256 * 1024;
 
 fn scrubbed_cli() -> Command {
     let mut cmd = hermetic::binary_command();
-    cmd.env_remove("VIRTUAL_ENV");
+    hermetic::scrub_extra(&mut cmd, &[Extra::Venv]);
     cmd
 }
 
@@ -43,8 +43,7 @@ fn run_scan(
     let mut cmd = scrubbed_cli();
     cmd.arg("scan")
         .args(["--json", "--cwd", cwd.to_str().unwrap()])
-        .args(args)
-        .env("SOCKET_NO_CONFIG", "1");
+        .args(args);
     if token {
         cmd.args([
             "--api-url",
@@ -238,8 +237,7 @@ async fn a_mid_run_downgrade_keeps_the_500_purl_chunks() {
     cmd.arg("scan")
         .args(["--json", "--cwd", tmp.path().to_str().unwrap()])
         .args(["--api-url", &server.uri(), "--proxy-url", &server.uri()])
-        .args(["--api-token", "fake-token-for-test", "--org", ORG])
-        .env("SOCKET_NO_CONFIG", "1");
+        .args(["--api-token", "fake-token-for-test", "--org", ORG]);
     let out = cmd.output().expect("run socket-patch scan");
     let stdout = String::from_utf8_lossy(&out.stdout);
     let stderr = String::from_utf8_lossy(&out.stderr);

crates/socket-patch-cli/tests/scan/scan_ecosystems_scope_e2e.rs

@@ -19,6 +19,7 @@
 //! installed (`CARGO_HOME` points at an empty dir, so the cargo crawl finds
 //! nothing — hermetic, and a lockfile-only cargo entry either way).
 
+use crate::common::hermetic::{self, Extra};
 use crate::common::{binary, hermetic_command};
 
 use std::path::Path;
@@ -39,7 +40,7 @@ const INSTALLED_CRATE: &str = "installed-crate";
 fn run_scan(cwd: &Path, api_url: &str, extra: &[&str]) -> (i32, String, String) {
     let mut cmd = hermetic_command(&binary());
     cmd.arg("scan").current_dir(cwd);
-    cmd.env_remove("VIRTUAL_ENV");
+    hermetic::scrub_extra(&mut cmd, &[Extra::Venv]);
     cmd.env("CARGO_HOME", cwd.join(".cargo-home"));
     let out = cmd
         .args([

crates/socket-patch-cli/tests/scan/scan_ordered_concurrency_e2e.rs

@@ -16,10 +16,10 @@
 
 use std::path::Path;
 use std::process::Command;
-
-use crate::common::hermetic;
 use std::time::Duration;
 
+use crate::common::hermetic::{self, Extra};
+
 use wiremock::matchers::{body_string_contains, method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
@@ -58,7 +58,7 @@ fn encode_purl(purl: &str) -> String {
 
 fn scrubbed_cli() -> Command {
     let mut cmd = hermetic::binary_command();
-    cmd.env_remove("VIRTUAL_ENV");
+    hermetic::scrub_extra(&mut cmd, &[Extra::Venv]);
     cmd
 }
 
@@ -505,8 +505,7 @@ fn run_scan_anonymous(
             proxy,
         ])
         .args(args)
-        .env("SOCKET_NO_API_TOKEN", "1")
-        .env("SOCKET_NO_CONFIG", "1");
+        .env("SOCKET_NO_API_TOKEN", "1");
     for (key, value) in extra {
         cmd.env(key, value);
     }

crates/socket-patch-cli/tests/scan/scan_paths_e2e.rs

@@ -20,6 +20,7 @@
 //!   under `--json` or `--vex`, or an unparseable glob is a usage error
 //!   (exit 2).
 
+use crate::common::hermetic::{self, Extra};
 use crate::common::{binary, hermetic_command};
 
 use std::path::{Path, PathBuf};
@@ -42,7 +43,7 @@ const APP_PURL: &str = "pkg:npm/app-dep@1.0.0";
 fn scan_cmd(cwd: &Path) -> Command {
     let mut cmd = hermetic_command(&binary());
     cmd.arg("scan").current_dir(cwd);
-    cmd.env_remove("VIRTUAL_ENV");
+    hermetic::scrub_extra(&mut cmd, &[Extra::Venv]);
     cmd
 }
 

crates/socket-patch-cli/tests/scan/scan_vendor_step_error_e2e.rs

@@ -159,8 +159,9 @@ fn run_cli(root: &Path, argv: &[&str]) -> (i32, String, String) {
     cmd.args(argv).current_dir(root);
     // `hermetic_command` scrubs the ambient `SOCKET_*` surface so a
     // developer's shell can't steer the child, and forces the telemetry
-    // kill-switch: telemetry resolves its endpoint from env only, so an
-    // ambient value would ship this run's events to the LIVE API.
+    // kill-switch on: telemetry resolves its endpoint from env only (and
+    // the scrub keeps `SOCKET_TELEMETRY_*`), so a run with telemetry on
+    // would ship its events to whatever endpoint the shell names.
     let out = cmd.output().expect("run");
     (
         out.status.code().unwrap_or(-1),

crates/socket-patch-cli/tests/spawn_env_hygiene.rs

@@ -379,6 +379,7 @@ fn command_never_leaks_its_hostile_seeds() {
         "SOCKET_GLOBAL",
         "SOCKET_GLOBAL_PREFIX",
         "SOCKET_DRY_RUN",
+        "SOCKET_ECOSYSTEMS",
         "SOCKET_MANIFEST_PATH",
         "SOCKET_JSON",
         "SOCKET_SILENT",