From cb563d99b0ab5efbb8a40cae088399b12323490b Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 03:00:33 +0000 Subject: [PATCH 1/3] Start fix for #823 (slice 17) Assisted-by: Claude Code:claude-opus-5-5 From a18853dcaaf574618a919a20bc056ecf40308691 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 03:00:33 +0000 Subject: [PATCH 2/3] Spawn vex-vendor and rollback tests hermetically e2e_vex_vendor.rs and rollback/rollback_multicopy_blob_gate.rs started socket-patch with a bare Command::new and their own SOCKET_* sweep. Both sweeps had drifted from the shared builder: the vex-vendor one let an ambient SOCKET_NO_CONFIG=0 through, so a developer's real `socket login` could reach the child, and neither forced the passive update check off. Both now spawn through tests/common/hermetic.rs and leave the PENDING_RAW_SPAWNS list, so the spawn_env_hygiene ratchet keeps them hermetic. Test-only change. Refs #823 Assisted-by: Claude Code:claude-opus-5-5 --- crates/socket-patch-cli/tests/e2e_vex_vendor.rs | 17 ++++------------- .../rollback/rollback_multicopy_blob_gate.rs | 16 ++++------------ .../socket-patch-cli/tests/spawn_env_hygiene.rs | 2 -- 3 files changed, 8 insertions(+), 27 deletions(-) diff --git a/crates/socket-patch-cli/tests/e2e_vex_vendor.rs b/crates/socket-patch-cli/tests/e2e_vex_vendor.rs index 423e0d8f6..f18eae269 100644 --- a/crates/socket-patch-cli/tests/e2e_vex_vendor.rs +++ b/crates/socket-patch-cli/tests/e2e_vex_vendor.rs @@ -41,19 +41,12 @@ const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f"; #[path = "common/mod.rs"] mod common; -use common::binary; +use common::{binary, hermetic_command}; -/// CLI invocation with the ambient `SOCKET_*` environment scrubbed (same -/// rationale as `e2e_vex.rs`: explicit flags must be the sole source of -/// truth). +/// CLI invocation through the shared hermetic builder (same rationale as +/// `e2e_vex.rs`: explicit flags must be the sole source of truth). fn cli() -> Command { - let mut cmd = Command::new(binary()); - for (key, _) in std::env::vars() { - if key.starts_with("SOCKET_") && key != "SOCKET_NO_CONFIG" { - cmd.env_remove(key); - } - } - cmd + hermetic_command(&binary()) } /// Write `manifest` to `/.socket/manifest.json`. @@ -2310,8 +2303,6 @@ fn vex_json(cwd: &Path, extra: &[&str]) -> (Option, Value) { ]; args.extend(extra.iter().map(|s| s.to_string())); let out = cli() - .env("SOCKET_TELEMETRY_DISABLED", "1") - .env("SOCKET_NO_CONFIG", "1") .env("SOCKET_NO_API_TOKEN", "1") .args(&args) .output() diff --git a/crates/socket-patch-cli/tests/rollback/rollback_multicopy_blob_gate.rs b/crates/socket-patch-cli/tests/rollback/rollback_multicopy_blob_gate.rs index 68e3662e5..49bde6f60 100644 --- a/crates/socket-patch-cli/tests/rollback/rollback_multicopy_blob_gate.rs +++ b/crates/socket-patch-cli/tests/rollback/rollback_multicopy_blob_gate.rs @@ -21,7 +21,7 @@ use std::path::{Path, PathBuf}; use std::process::Command; use std::sync::{Arc, Mutex}; -use crate::common::{binary, git_sha256}; +use crate::common::{binary, git_sha256, hermetic_command}; /// Minimal HTTP stub playing the authenticated API: serves `blob` bytes at /// any path ending in `/patches/blob/`, 404 otherwise, and records @@ -161,19 +161,11 @@ fn build_diverged_two_copy_tree(root: &Path) -> (PathBuf, PathBuf, String, Vec Command { - let mut cmd = Command::new(binary()); + let mut cmd = hermetic_command(&binary()); cmd.arg("rollback").current_dir(cwd); - for (key, _) in std::env::vars_os() { - if key.to_string_lossy().starts_with("SOCKET_") { - cmd.env_remove(&key); - } - } - cmd.env("SOCKET_NO_CONFIG", "1"); - cmd.env("SOCKET_TELEMETRY_DISABLED", "1"); cmd } diff --git a/crates/socket-patch-cli/tests/spawn_env_hygiene.rs b/crates/socket-patch-cli/tests/spawn_env_hygiene.rs index 23ac28316..2ed19837d 100644 --- a/crates/socket-patch-cli/tests/spawn_env_hygiene.rs +++ b/crates/socket-patch-cli/tests/spawn_env_hygiene.rs @@ -36,8 +36,6 @@ const PENDING_RAW_SPAWNS: &[&str] = &[ "e2e_scan.rs", "e2e_socket_yml_policy.rs", "e2e_vendored_production.rs", - "e2e_vex_vendor.rs", - "rollback/rollback_multicopy_blob_gate.rs", ]; /// The environment `cmd`'s child would see: the parent environment with From 3cc99c3adb5ee12df40ecaf8984ea2a38a4b3428 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 03:03:58 +0000 Subject: [PATCH 3/3] Use binary_command in vex-vendor suite Matches e2e_vex.rs, which this suite cites, so the twin suites spawn the CLI the same way. Refs #823 Assisted-by: Claude Code:claude-opus-5-5 --- crates/socket-patch-cli/tests/e2e_vex_vendor.rs | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/crates/socket-patch-cli/tests/e2e_vex_vendor.rs b/crates/socket-patch-cli/tests/e2e_vex_vendor.rs index f18eae269..3aa918b14 100644 --- a/crates/socket-patch-cli/tests/e2e_vex_vendor.rs +++ b/crates/socket-patch-cli/tests/e2e_vex_vendor.rs @@ -41,12 +41,11 @@ const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f"; #[path = "common/mod.rs"] mod common; -use common::{binary, hermetic_command}; /// CLI invocation through the shared hermetic builder (same rationale as /// `e2e_vex.rs`: explicit flags must be the sole source of truth). fn cli() -> Command { - hermetic_command(&binary()) + common::hermetic::binary_command() } /// Write `manifest` to `/.socket/manifest.json`.