CI: hermetic spawns in VEX tests (#823)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #823 (slice 7 of the tracking issue; #823 stays open for the remaining files).

Problem

The VEX test suites spawned the built socket-patch binary with a bare Command::new and their own SOCKET_* sweep, and the sweeps differed from file to file:

• e2e_vex.rs, e2e_vex_redirect.rs, e2e_embedded_vex.rs and five e2e_vex_lockfile cells kept an ambient SOCKET_NO_CONFIG (so SOCKET_NO_CONFIG=0 in a dev shell reached the child), and the first three never forced telemetry off.
• Only bun.rs forced SOCKET_NO_UPDATE_CHECK.
• e2e_vex_build/hatch.rs's two vendor --revert spawns scrubbed nothing at all.
• The shared vex_e2e_common::run_vex helper had its own copy of the sweep.

Change (test-only)

• e2e_vex_lockfile/{bun,cargo,golang,maven,npm,nuget,pnpm,poetry,uv,yarn}.rs, e2e_vex_build/{deno,hatch,poetry}.rs, e2e_vex.rs, e2e_vex_redirect.rs and e2e_embedded_vex.rs now spawn through tests/common/hermetic.rs, and they leave PENDING_RAW_SPAWNS (92 → 76 on main).
• vex_e2e_common::run_vex uses hermetic::command(bin). vex_e2e_common loads hermetic.rs as pub mod hermetic (with #[allow(clippy::duplicate_mod)], as the other shared modules do), so e2e_vex_build, which has no common, reaches it there.
• The VIRTUAL_ENV removals go through hermetic::Extra::Venv. Opt-out env sets that the builder already forces are gone.
• SOCKET_NO_API_TOKEN=1 stays where a file set it (caller env lands after the scrub).

Not changed here, on purpose

• The private POETRY_* sweeps (e2e_vex_lockfile/poetry.rs, e2e_vex_build/poetry.rs) and the UV_* sweep (e2e_vex_lockfile/uv.rs) stay for now. CI: hermetic spawns in in_process tests (#823) #1452 adds Extra::Poetry, and adding it here too would conflict. They can move onto Extra once CI: hermetic spawns in in_process tests (#823) #1452 lands.
• vex_e2e_common/uv.rs is still on PENDING_RAW_SPAWNS. Its list line is adjacent to lines CI: hermetic spawns in scan/vendor tests (#823) #1448 removes, so moving it now would cause a merge conflict. It goes in the next slice.

CI cost

No workflow change. A lean PR run keeps the same ~28 Linux jobs and the same job-minutes, before and after.

Evidence

• cargo test -p socket-patch-cli --all-features --no-run: every test target builds (all vex_e2e_common users included), with no rustc warnings.
• spawn_env_hygiene 15/15, including no_new_bare_binary_spawns. e2e_vex_lockfile 345/345, e2e_vex 40/40, e2e_vex_redirect 52/52, e2e_embedded_vex 34/34. e2e_vex_build compiles (its 16 tests are toolchain-gated #[ignore]).
• Hostile shell (SOCKET_DRY_RUN=true SOCKET_JSON=true SOCKET_SILENT=true SOCKET_API_TOKEN=hostile SOCKET_API_URL/SOCKET_PROXY_URL=http://127.0.0.1:1 SOCKET_NO_CONFIG=0 SOCKET_NO_UPDATE_CHECK=0 SOCKET_ORG_SLUG=hostile SOCKET_ECOSYSTEMS=cargo SOCKET_OFFLINE=true SOCKET_VEX_PRODUCT=hostile SOCKET_VEX_NO_VERIFY=true VIRTUAL_ENV=/nonexistent) over e2e_vex_lockfile, e2e_vex, e2e_vex_redirect and e2e_embedded_vex: all pass. I didn't run main under the same shell for comparison.
• cargo fmt --all -- --check is clean. cargo clippy on these test targets reports only warnings that main already has (prebuilt_common, oracle.rs duplicate_mod, e2e_vex_build/poetry.rs:485). CI's clippy job doesn't lint test targets.

/code-review high

7 findings, no correctness bugs. Fixed in 68732af: the new duplicate_mod warning, the dead opt-out sets in e2e_vex_redirect::vex_json_env, the inline VIRTUAL_ENV removals in hatch.rs, and the stale cli() doc comments. Not fixed: the POETRY_*/UV_* sweeps and vex_e2e_common/uv.rs (reasons above), and a suggested shared cli_command() helper. The four call sites set different extra env, so a helper wouldn't remove much code.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Wx5bWkf2EhmUyjqAXPj9fu

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 68732af. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Labeled Ready for review by the burn-down agent.

• Head: 68732aff
• CI: 36/36 green (50 path-skipped), mergeable, no conflicts
• Bugbot: reviewed 68732af — no issues found
• Reviewer note: test-only change; makes the VEX e2e tests spawn the CLI with a hermetic environment (Spawn every CLI test child through one hermetic Command builder; 10 test files inherit ambient SOCKET_* today #823).
• Slack announcement: not sent (Slack send unavailable this run; next run retries).

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does: Moves 16 VEX test files (e2e_vex*, e2e_embedded_vex, the e2e_vex_lockfile/* and e2e_vex_build/* cells) and the shared vex_e2e_common::run_vex helper off their own SOCKET_* sweeps and onto the hermetic spawn builder (tests/common/hermetic.rs), and takes them off the PENDING_RAW_SPAWNS ratchet. Before this, the sweeps disagreed (several kept an ambient SOCKET_NO_CONFIG, only bun forced the update-check off, and hatch's two vendor --revert spawns scrubbed nothing). Test-only; refs #823 (slice 7).

Risk: low. Only test harness code changes, and the child env only gets stricter. Per-test env (SOCKET_NO_API_TOKEN, CARGO_HOME, GOMODCACHE, NUGET_PACKAGES, UV_CACHE_DIR, ...) is still applied after the scrub, so explicit injections survive. The POETRY_*/UV_* sweeps stay as they are on purpose until #1452 adds Extra::Poetry.

Look here:

• vex_e2e_common/mod.rs:114 and :427: hermetic loaded as a pub mod (with clippy::duplicate_mod allowed, like the other shared modules), and run_vex built on it.
• e2e_vex_build/hatch.rs:337: the two spawns that previously had no scrub at all.
• e2e_vex_lockfile/poetry.rs:1361:`` builder first, then the remaining private POETRY_* sweep, then caller env.
• e2e_vex_redirect.rs:733: vex_json_env keeps SOCKET_NO_API_TOKEN and the per-call envs after the scrub.
• spawn_env_hygiene.rs:67: 16 list entries removed (vex_e2e_common/uv.rs deliberately kept for the next slice).

Verified:

• Read the full diff. Checked the env ordering (scrub, then suite env, then per-test env) in every changed spawn site, and that the forced opt-outs don't hide anything a test in these files asserts on.
• Merged this PR and CI: hermetic spawns in redirect build tests (#823) #1457 onto current main (15c2c83) locally. Both merge cleanly, and spawn_env_hygiene, e2e_vex, e2e_embedded_vex and e2e_vex_redirect pass on the combined tree.
• CI on 68732af: 36 success / 50 skipped of 86, ci-ok and clippy green. Cursor Bugbot: success, no findings. No unresolved review threads. CHANGELOG.md untouched.

Changes I made: none.

Open questions: none.

Auto-merge (squash) is armed, so approving sends it straight to the merge queue.

---

Generated by Claude Code