CI: hermetic spawns in VEX tests (#823)

crates/socket-patch-cli/tests/e2e_embedded_vex.rs

@@ -12,7 +12,6 @@
 
 #[path = "common/mod.rs"]
 mod common;
-use common::binary;
 
 use std::collections::HashMap;
 use std::path::Path;
@@ -24,8 +23,10 @@ use socket_patch_core::manifest::schema::{
     PatchFileInfo, PatchManifest, PatchRecord, VulnerabilityInfo,
 };
 
-/// Build a `Command` for the CLI with the entire `SOCKET_*` environment
-/// scrubbed from the child process.
+/// Build a `Command` for the CLI with the hermetic `SOCKET_*` environment of
+/// `tests/common/hermetic.rs`: ambient `SOCKET_*` vars (other than a
+/// telemetry opt-out) are removed from the child, and the config,
+/// update-check and telemetry opt-outs are forced on.
 ///
 /// Every embedded-VEX flag has an env fallback (`--vex`/`SOCKET_VEX`,
 /// `--vex-product`/`SOCKET_VEX_PRODUCT`, `--vex-no-verify`/
@@ -41,13 +42,7 @@ use socket_patch_core::manifest::schema::{
 /// need no serialization) makes the explicit CLI flags the sole source of
 /// truth.
 fn cli() -> Command {
-    let mut cmd = Command::new(binary());
-    for (key, _) in std::env::vars() {
-        if key.starts_with("SOCKET_") && key != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(key);
-        }
-    }
-    cmd
+    common::hermetic::binary_command()
 }
 
 fn write_manifest(cwd: &Path, manifest: &PatchManifest) {

crates/socket-patch-cli/tests/e2e_vex.rs

@@ -16,7 +16,6 @@
 
 #[path = "common/mod.rs"]
 mod common;
-use common::binary;
 
 use std::collections::HashMap;
 use std::path::Path;
@@ -28,8 +27,10 @@ use socket_patch_core::manifest::schema::{
     PatchFileInfo, PatchManifest, PatchRecord, VulnerabilityInfo,
 };
 
-/// Build a `Command` for the CLI with the entire `SOCKET_*` environment
-/// scrubbed from the child process.
+/// Build a `Command` for the CLI with the hermetic `SOCKET_*` environment of
+/// `tests/common/hermetic.rs`: ambient `SOCKET_*` vars (other than a
+/// telemetry opt-out) are removed from the child, and the config,
+/// update-check and telemetry opt-outs are forced on.
 ///
 /// Every flag these tests rely on has an env fallback: `--product`/
 /// `SOCKET_VEX_PRODUCT`, `--no-verify`/`SOCKET_VEX_NO_VERIFY`, `--doc-id`/
@@ -46,13 +47,7 @@ use socket_patch_core::manifest::schema::{
 /// (the parent env is never mutated, so tests stay independent and need no
 /// serialization) makes the explicit CLI flags the sole source of truth.
 fn cli() -> Command {
-    let mut cmd = Command::new(binary());
-    for (key, _) in std::env::vars() {
-        if key.starts_with("SOCKET_") && key != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(key);
-        }
-    }
-    cmd
+    common::hermetic::binary_command()
 }
 
 /// Write `manifest` to `<cwd>/.socket/manifest.json`.

crates/socket-patch-cli/tests/e2e_vex_build/deno.rs

@@ -161,17 +161,9 @@ impl Deno {
 }
 
 fn socket_patch(cwd: &Path, deno_dir: &Path, args: &[&str]) -> (Option<i32>, Value, String) {
-    let mut cmd = Command::new(binary());
-    for (key, _) in std::env::vars_os() {
-        if key.to_string_lossy().starts_with("SOCKET_") {
-            cmd.env_remove(key);
-        }
-    }
-    let out = cmd
+    let out = crate::vex_e2e_common::hermetic::binary_command()
         .args(args)
         .current_dir(cwd)
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
         .env("DENO_DIR", deno_dir)
         .output()
         .expect("spawn socket-patch");

crates/socket-patch-cli/tests/e2e_vex_build/hatch.rs

@@ -334,7 +334,9 @@ fn flow(flavor: Flavor, mode: Mode) {
                 .replacen("dependencies = [", "dependencies = [\"idna==3.7\", ", 1)
         };
         std::fs::write(edited.join("pyproject.toml"), edit(&wired)).unwrap();
-        let out = std::process::Command::new(vex_e2e_common::binary())
+        let mut cmd = vex_e2e_common::hermetic::binary_command();
+        vex_e2e_common::hermetic::scrub_extra(&mut cmd, &[vex_e2e_common::hermetic::Extra::Venv]);
+        let out = cmd
             .args(["vendor", "--revert", "--json", "--cwd"])
             .arg(&edited)
             .current_dir(&edited)
@@ -381,7 +383,9 @@ fn flow(flavor: Flavor, mode: Mode) {
             1,
         );
         std::fs::write(copied.join("pyproject.toml"), &with_copy).unwrap();
-        let out = std::process::Command::new(vex_e2e_common::binary())
+        let mut cmd = vex_e2e_common::hermetic::binary_command();
+        vex_e2e_common::hermetic::scrub_extra(&mut cmd, &[vex_e2e_common::hermetic::Extra::Venv]);
+        let out = cmd
             .args(["vendor", "--revert", "--json", "--cwd"])
             .arg(&copied)
             .current_dir(&copied)

crates/socket-patch-cli/tests/e2e_vex_build/poetry.rs

@@ -545,19 +545,20 @@ fn socket_patch(
     service: &PatchService,
     args: &[&str],
 ) -> (Option<i32>, Value) {
-    let mut cmd = Command::new(binary());
+    let mut cmd = crate::vex_e2e_common::hermetic::binary_command();
+    crate::vex_e2e_common::hermetic::scrub_extra(
+        &mut cmd,
+        &[crate::vex_e2e_common::hermetic::Extra::Venv],
+    );
     for (key, _) in std::env::vars_os() {
-        let k = key.to_string_lossy();
-        if k.starts_with("SOCKET_") || k.starts_with("POETRY_") || k == "VIRTUAL_ENV" {
+        if key.to_string_lossy().starts_with("POETRY_") {
             cmd.env_remove(&key);
         }
     }
     for (key, value) in poetry.cli_envs() {
         cmd.env(key, value);
     }
     let out = cmd
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
         .current_dir(project)
         .args(args)
         .args(["--json", "--yes", "--cwd"])

crates/socket-patch-cli/tests/e2e_vex_lockfile/bun.rs

@@ -497,19 +497,11 @@ impl Api {
 
 // ── running the CLI ──────────────────────────────────────────────────────
 
-/// The CLI with the ambient `SOCKET_*` environment scrubbed, telemetry and
-/// socket-cli config off, and no ambient API token.
+/// The CLI with the hermetic `SOCKET_*` environment: ambient vars scrubbed,
+/// telemetry, socket-cli config and the update check off, and no ambient
+/// API token.
 fn cli() -> Command {
-    let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
-    for (key, _) in std::env::vars() {
-        if key.starts_with("SOCKET_") {
-            cmd.env_remove(key);
-        }
-    }
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
-        .env("SOCKET_NO_UPDATE_CHECK", "1");
-    cmd
+    crate::hermetic::binary_command()
 }
 
 /// Parsed stdout envelope of a `--json` run.

crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs

@@ -51,8 +51,6 @@
 
 //! manifest-less lockfile-wired project.
 
-use crate::common::binary;
-
 use crate::vex_e2e_common;
 
 use std::collections::HashMap;
@@ -137,17 +135,10 @@ impl Fx {
     /// Hermetic child: ambient `SOCKET_*` scrubbed, no token / config /
     /// telemetry, the fixture's private caches.
     fn command(&self) -> Command {
-        let mut cmd = Command::new(binary());
-        for (key, _) in std::env::vars() {
-            if key.starts_with("SOCKET_") && key != "SOCKET_NO_CONFIG" {
-                cmd.env_remove(key);
-            }
-        }
-        cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
-            .env("SOCKET_NO_CONFIG", "1")
-            .env("SOCKET_NO_API_TOKEN", "1")
-            .env("CARGO_HOME", &self.cargo_home)
-            .env_remove("VIRTUAL_ENV");
+        let mut cmd = crate::hermetic::binary_command();
+        crate::hermetic::scrub_extra(&mut cmd, &[crate::hermetic::Extra::Venv]);
+        cmd.env("SOCKET_NO_API_TOKEN", "1")
+            .env("CARGO_HOME", &self.cargo_home);
         cmd
     }
 

crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs

@@ -43,7 +43,6 @@
 //! go-patches redirect (no uuid — a documented limitation, asserted below).
 //! Embedded: `scan --vex` and `apply --vex` on a manifest-less project.
 
-use crate::common::binary;
 use crate::common::envelope::codes_in;
 
 use crate::vex_e2e_common;
@@ -132,19 +131,12 @@ impl Fx {
     /// Hermetic child: ambient `SOCKET_*` scrubbed, no token / config /
     /// telemetry, the fixture's private caches.
     fn command(&self) -> Command {
-        let mut cmd = Command::new(binary());
-        for (key, _) in std::env::vars() {
-            if key.starts_with("SOCKET_") && key != "SOCKET_NO_CONFIG" {
-                cmd.env_remove(key);
-            }
-        }
-        cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
-            .env("SOCKET_NO_CONFIG", "1")
-            .env("SOCKET_NO_API_TOKEN", "1")
+        let mut cmd = crate::hermetic::binary_command();
+        crate::hermetic::scrub_extra(&mut cmd, &[crate::hermetic::Extra::Venv]);
+        cmd.env("SOCKET_NO_API_TOKEN", "1")
             .env("GOMODCACHE", &self.gomodcache)
             .env("GOPATH", &self.gopath)
-            .env_remove("GOFLAGS")
-            .env_remove("VIRTUAL_ENV");
+            .env_remove("GOFLAGS");
         cmd
     }
 

crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs

@@ -41,8 +41,6 @@
 //! alive by a ledger under `--no-verify`, and agent-mode (`apply`) patches,
 //! which have no lockfile wiring to discover.
 
-use crate::common::binary;
-
 #[path = "../prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
@@ -81,17 +79,10 @@ const CVE: &str = "CVE-2026-7100";
 /// ecosystem stores the crawlers read pinned to `store` — an ambient
 /// `~/.m2` must never become installed evidence.
 fn cli(store: &Path) -> Command {
-    let mut cmd = Command::new(binary());
-    for (key, _) in std::env::vars() {
-        if key.starts_with("SOCKET_") && key != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(key);
-        }
-    }
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
-        .env("MAVEN_REPO_LOCAL", store.join("m2"))
-        .env_remove("M2_HOME")
-        .env_remove("VIRTUAL_ENV");
+    let mut cmd = crate::hermetic::binary_command();
+    crate::hermetic::scrub_extra(&mut cmd, &[crate::hermetic::Extra::Venv]);
+    cmd.env("MAVEN_REPO_LOCAL", store.join("m2"))
+        .env_remove("M2_HOME");
     cmd
 }
 

crates/socket-patch-cli/tests/e2e_vex_lockfile/npm.rs

@@ -454,15 +454,8 @@ fn standalone_vex_dry_run_and_stdout_output_work_without_a_manifest() {
     assert_no_manifest_or_ledgers(p);
 
     // `-O -`: the document is stdout.
-    let mut cmd = std::process::Command::new(binary());
-    for (key, _) in std::env::vars_os() {
-        if key.to_string_lossy().starts_with("SOCKET_") {
-            cmd.env_remove(key);
-        }
-    }
+    let mut cmd = crate::hermetic::binary_command();
     let out = cmd
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
         .env("SOCKET_NO_API_TOKEN", "1")
         .current_dir(p)
         .args(["vex", "--cwd"])
@@ -700,15 +693,8 @@ fn manifestless_apply_prints_its_summary_before_vex_warnings() {
     std::fs::write(p.join("package-lock.json"), "not json").unwrap();
     let log = p.join("combined.log");
     let file = std::fs::File::create(&log).unwrap();
-    let mut cmd = std::process::Command::new(binary());
-    for (key, _) in std::env::vars_os() {
-        if key.to_string_lossy().starts_with("SOCKET_") {
-            cmd.env_remove(key);
-        }
-    }
+    let mut cmd = crate::hermetic::binary_command();
     let status = cmd
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
         .env("SOCKET_NO_API_TOKEN", "1")
         .current_dir(p)
         .args(["apply", "--offline", "--cwd"])

crates/socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs

@@ -74,16 +74,9 @@ const CVE: &str = "CVE-2026-7100";
 /// global packages folder pinned to `store` — an ambient `~/.nuget/packages`
 /// must never become installed evidence.
 fn cli(store: &Path) -> Command {
-    let mut cmd = Command::new(binary());
-    for (key, _) in std::env::vars_os() {
-        if key.to_string_lossy().starts_with("SOCKET_") {
-            cmd.env_remove(key);
-        }
-    }
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
-        .env("NUGET_PACKAGES", store.join("nuget"))
-        .env_remove("VIRTUAL_ENV");
+    let mut cmd = crate::hermetic::binary_command();
+    crate::hermetic::scrub_extra(&mut cmd, &[crate::hermetic::Extra::Venv]);
+    cmd.env("NUGET_PACKAGES", store.join("nuget"));
     cmd
 }
 

crates/socket-patch-cli/tests/e2e_vex_lockfile/pnpm.rs

@@ -37,7 +37,6 @@
 mod prebuilt_common;
 
 use std::path::{Path, PathBuf};
-use std::process::Command;
 
 use serde_json::Value;
 use sha2::{Digest, Sha512};
@@ -185,18 +184,11 @@ fn install(root: &Path, index: &[u8]) {
 }
 
 fn socket(root: &Path, args: &[&str]) -> (Option<i32>, Value, String) {
-    let mut cmd = Command::new(binary());
-    for (k, _) in std::env::vars_os() {
-        if k.to_string_lossy().starts_with("SOCKET_") {
-            cmd.env_remove(k);
-        }
-    }
+    let mut cmd = crate::hermetic::binary_command();
     let _fixture = prebuilt_common::prepare_command(&mut cmd, root, args, &[]);
     let out = cmd
         .arg("--cwd")
         .arg(root)
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
         .current_dir(root)
         .output()
         .expect("spawn socket-patch");

crates/socket-patch-cli/tests/e2e_vex_lockfile/poetry.rs

@@ -42,7 +42,6 @@ use crate::vex_e2e_common;
 
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
-use std::process::Command;
 
 use serde_json::{json, Value};
 use sha2::{Digest, Sha256};
@@ -1360,19 +1359,17 @@ impl ScanApi {
 /// An authenticated `socket-patch <args> --json --yes` in `p` against
 /// `api` → (exit, envelope).
 fn run_authed(p: &Proj, api: &ScanApi, args: &[&str]) -> (Option<i32>, Value) {
-    let mut cmd = Command::new(binary());
+    let mut cmd = crate::hermetic::binary_command();
+    crate::hermetic::scrub_extra(&mut cmd, &[crate::hermetic::Extra::Venv]);
     for (key, _) in std::env::vars() {
-        if key.starts_with("SOCKET_") || key.starts_with("POETRY_") {
+        if key.starts_with("POETRY_") {
             cmd.env_remove(key);
         }
     }
     for (key, value) in poetry_envs(p) {
         cmd.env(key, value);
     }
     let out = cmd
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
-        .env_remove("VIRTUAL_ENV")
         .current_dir(&p.root)
         .args(args)
         .args([

crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs

@@ -39,8 +39,6 @@
 //! Plus the embedded entry points (`scan --mode hosted --vex`, `scan --mode vendored
 //! --vex`, `apply --vex`).
 
-use crate::common::binary;
-
 use crate::vex_e2e_common;
 
 use std::collections::HashMap;
@@ -669,16 +667,14 @@ impl Api {
 /// The CLI with the ambient `SOCKET_*` / python / uv discovery environment
 /// scrubbed and uv's cache pointed into `p.home`.
 fn cli(p: &Proj) -> Command {
-    let mut cmd = Command::new(binary());
+    let mut cmd = crate::hermetic::binary_command();
+    crate::hermetic::scrub_extra(&mut cmd, &[crate::hermetic::Extra::Venv]);
     for (key, _) in std::env::vars() {
-        if (key.starts_with("SOCKET_") && key != "SOCKET_NO_CONFIG") || key.starts_with("UV_") {
+        if key.starts_with("UV_") {
             cmd.env_remove(key);
         }
     }
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
-        .env_remove("VIRTUAL_ENV")
-        .env("UV_CACHE_DIR", p.home.join("uv-cache"));
+    cmd.env("UV_CACHE_DIR", p.home.join("uv-cache"));
     cmd
 }