GeezerVison

Problem

coverage (part of the ci-ok gate) failed on two PR runs in the last 24h with one cargo test target red and nothing else wrong:

• run 38194961803 (agent/fix-ci-test-helper-copies-5): -p socket-patch-cli --test in_process_edge_cases failed; attempt 2 on the same SHA passed, so it was a flake.
• run 38184196576 (agent/fix-go-selected-version-gate): -p socket-patch-cli --test vendor failed. That binary also links common/cache_env.rs and runs in-process tests. The failing test name isn't in the 5000-line log tail I could read, so I can't confirm this one is the same flake.

Running the in_process_edge_cases binary locally 60 times with --test-threads=16 failed 8 times. Every failure was one of two self-tests:

common::cache_env::cache_env_selftests::ambient_bun_scrub_removes_only_matching_parent_vars
  panicked at tests/common/cache_env.rs:392: SOCKET_OFFLINE is set in the parent env but was not scrubbed
common::cache_env::cache_env_selftests::ambient_vlt_scrub_removes_only_matching_parent_vars
  panicked at tests/common/cache_env.rs:451: SOCKET_OFFLINE kept

common/cache_env.rs is included through common/mod.rs in about 120 test binaries, so the flake can turn up in any of them that also runs in-process commands. In the merge queue, that evicts the entry.

Root cause

Each self-test reads std::env::vars_os() twice: once inside scrub_ambient_*_env and once to check that every matching parent var was removed. These self-tests are not #[serial], so they run at the same time as the binary's #[serial] in-process tests. Those tests call apply::run etc., and apply_env_toggles (src/args.rs) runs std::env::set_var(\"SOCKET_OFFLINE\", \"1\") for --offline. If the var appears between the two reads, the second read sees a matching var that the scrub never saw.

Fix

Read the parent env once (parent_var_names). Pass that one snapshot to both the scrub (scrub_parent_vars) and the self-test's assertions. The public scrub_ambient_bun_env / scrub_ambient_vlt_env behave exactly as before: they read the env once and remove the matching names. No assertion is weakened. The self-tests still check that the scrub removes exactly the matching names, now against a consistent snapshot.

Proof

• Before: in_process_edge_cases failed 8 of 60 runs with --test-threads=16.
• After: 0 of 200 runs failed with the same command.
• cargo test -p socket-patch-cli --test vendor --test cli_parse_get cache_env passes.
• rustfmt run on the touched file only. Clippy reports nothing new in cache_env.rs.

No tests were moved or removed.

🤖 Generated with Claude Code

https://claude.ai/code/session_018js6KeL55GXJTLwgF3bQWV

Generated by Claude Code