From 61f386f94c720beb7d59bad3cffded566e99c0c8 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 05:01:48 +0000 Subject: [PATCH 1/2] CI: hermetic spawns in e2e_redirect_cargo_shapes The cargo redirect-shapes suite started socket-patch with a bare Command::new and its own SOCKET_* sweep. That sweep never forced the update check or telemetry off, and an activated venv reached the unscoped hosted scan. It now spawns through the shared hermetic builder, scrubs VIRTUAL_ENV, and leaves PENDING_RAW_SPAWNS. Refs #823 Assisted-by: Claude Code:claude-opus-5-5 --- .../tests/e2e_redirect_cargo_shapes.rs | 18 +++++++++--------- .../tests/spawn_env_hygiene.rs | 1 - 2 files changed, 9 insertions(+), 10 deletions(-) diff --git a/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs b/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs index 2733dd040..66be5d838 100644 --- a/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs +++ b/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs @@ -50,11 +50,11 @@ #[path = "common/mod.rs"] mod common; -use common::binary; +use common::hermetic; use std::collections::BTreeMap; use std::path::{Path, PathBuf}; -use std::process::{Command, Output}; +use std::process::Output; use sha2::{Digest, Sha256}; use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes; @@ -135,20 +135,20 @@ fn run_socket(cwd: &Path, args: &[&str], cargo_home: &Path) -> (i32, String, Str } /// [`run_socket`] with extra env applied after the scrub. +/// +/// The child gets the hermetic `SOCKET_*` environment +/// (`hermetic::binary_command`), and an activated venv is scrubbed: the +/// hosted scan is unscoped, so the developer's venv would add packages to +/// it. `CARGO_HOME` is the leg's own, set after the scrubs. fn run_socket_env( cwd: &Path, args: &[&str], cargo_home: &Path, env: &[(&str, &str)], ) -> (i32, String, String) { - let mut cmd = Command::new(binary()); + let mut cmd = hermetic::binary_command(); + hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]); cmd.args(args).current_dir(cwd); - for (k, _) in std::env::vars_os() { - if k.to_string_lossy().starts_with("SOCKET_") { - cmd.env_remove(&k); - } - } - cmd.env("SOCKET_NO_CONFIG", "1"); cmd.env("CARGO_HOME", cargo_home); for (k, v) in env { cmd.env(k, v); diff --git a/crates/socket-patch-cli/tests/spawn_env_hygiene.rs b/crates/socket-patch-cli/tests/spawn_env_hygiene.rs index 7c977310e..180a9431f 100644 --- a/crates/socket-patch-cli/tests/spawn_env_hygiene.rs +++ b/crates/socket-patch-cli/tests/spawn_env_hygiene.rs @@ -30,7 +30,6 @@ use serial_test::serial; /// scrubs by hand. const PENDING_RAW_SPAWNS: &[&str] = &[ "e2e_hosted_production.rs", - "e2e_redirect_cargo_shapes.rs", "e2e_vendored_production.rs", ]; From 4d4ade76a69885a29515f39ddf36328cc43a5df4 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 05:06:47 +0000 Subject: [PATCH 2/2] Clarify the venv scrub and format the list The venv scrub covers every call, not just scan: vex also discovers packages under --cwd. Reformat the two-entry PENDING_RAW_SPAWNS list the way rustfmt wants it. Assisted-by: Claude Code:claude-opus-5-5 --- crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs | 7 ++++--- crates/socket-patch-cli/tests/spawn_env_hygiene.rs | 5 +---- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs b/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs index 66be5d838..0b7ab9720 100644 --- a/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs +++ b/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs @@ -137,9 +137,10 @@ fn run_socket(cwd: &Path, args: &[&str], cargo_home: &Path) -> (i32, String, Str /// [`run_socket`] with extra env applied after the scrub. /// /// The child gets the hermetic `SOCKET_*` environment -/// (`hermetic::binary_command`), and an activated venv is scrubbed: the -/// hosted scan is unscoped, so the developer's venv would add packages to -/// it. `CARGO_HOME` is the leg's own, set after the scrubs. +/// (`hermetic::binary_command`), and an activated venv is scrubbed on +/// every call: `scan` and `vex` discover packages unscoped under `--cwd`, +/// so the developer's venv would add packages to them. `CARGO_HOME` is the +/// leg's own, set after the scrubs. fn run_socket_env( cwd: &Path, args: &[&str], diff --git a/crates/socket-patch-cli/tests/spawn_env_hygiene.rs b/crates/socket-patch-cli/tests/spawn_env_hygiene.rs index 180a9431f..8a051dae0 100644 --- a/crates/socket-patch-cli/tests/spawn_env_hygiene.rs +++ b/crates/socket-patch-cli/tests/spawn_env_hygiene.rs @@ -28,10 +28,7 @@ use serial_test::serial; /// Files that still spawn the binary with a bare `Command::new`, so their /// children see whatever `SOCKET_*` the ambient shell exports unless the file /// scrubs by hand. -const PENDING_RAW_SPAWNS: &[&str] = &[ - "e2e_hosted_production.rs", - "e2e_vendored_production.rs", -]; +const PENDING_RAW_SPAWNS: &[&str] = &["e2e_hosted_production.rs", "e2e_vendored_production.rs"]; /// The environment `cmd`'s child would see: the parent environment with /// `cmd`'s explicit sets and removals applied.