GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Refs #823 (slice 7 of the tracking issue; #823 stays open for the remaining files).

Problem

The VEX test suites spawned the built socket-patch binary with a bare Command::new and their own SOCKET_* sweep, and the sweeps differed from file to file:

• e2e_vex.rs, e2e_vex_redirect.rs, e2e_embedded_vex.rs and five e2e_vex_lockfile cells kept an ambient SOCKET_NO_CONFIG (so SOCKET_NO_CONFIG=0 in a dev shell reached the child), and the first three never forced telemetry off.
• Only bun.rs forced SOCKET_NO_UPDATE_CHECK.
• e2e_vex_build/hatch.rs's two vendor --revert spawns scrubbed nothing at all.
• The shared vex_e2e_common::run_vex helper had its own copy of the sweep.

Change (test-only)

• e2e_vex_lockfile/{bun,cargo,golang,maven,npm,nuget,pnpm,poetry,uv,yarn}.rs, e2e_vex_build/{deno,hatch,poetry}.rs, e2e_vex.rs, e2e_vex_redirect.rs and e2e_embedded_vex.rs now spawn through tests/common/hermetic.rs, and they leave PENDING_RAW_SPAWNS (92 → 76 on main).
• vex_e2e_common::run_vex uses hermetic::command(bin). vex_e2e_common loads hermetic.rs as pub mod hermetic (with #[allow(clippy::duplicate_mod)], as the other shared modules do), so e2e_vex_build, which has no common, reaches it there.
• The VIRTUAL_ENV removals go through hermetic::Extra::Venv. Opt-out env sets that the builder already forces are gone.
• SOCKET_NO_API_TOKEN=1 stays where a file set it (caller env lands after the scrub).

Not changed here, on purpose

• The private POETRY_* sweeps (e2e_vex_lockfile/poetry.rs, e2e_vex_build/poetry.rs) and the UV_* sweep (e2e_vex_lockfile/uv.rs) stay for now. CI: hermetic spawns in in_process tests (#823) #1452 adds Extra::Poetry, and adding it here too would conflict. They can move onto Extra once CI: hermetic spawns in in_process tests (#823) #1452 lands.
• vex_e2e_common/uv.rs is still on PENDING_RAW_SPAWNS. Its list line is adjacent to lines CI: hermetic spawns in scan/vendor tests (#823) #1448 removes, so moving it now would cause a merge conflict. It goes in the next slice.

CI cost

No workflow change. A lean PR run keeps the same ~28 Linux jobs and the same job-minutes, before and after.

Evidence

• cargo test -p socket-patch-cli --all-features --no-run: every test target builds (all vex_e2e_common users included), with no rustc warnings.
• spawn_env_hygiene 15/15, including no_new_bare_binary_spawns. e2e_vex_lockfile 345/345, e2e_vex 40/40, e2e_vex_redirect 52/52, e2e_embedded_vex 34/34. e2e_vex_build compiles (its 16 tests are toolchain-gated #[ignore]).
• Hostile shell (SOCKET_DRY_RUN=true SOCKET_JSON=true SOCKET_SILENT=true SOCKET_API_TOKEN=hostile SOCKET_API_URL/SOCKET_PROXY_URL=http://127.0.0.1:1 SOCKET_NO_CONFIG=0 SOCKET_NO_UPDATE_CHECK=0 SOCKET_ORG_SLUG=hostile SOCKET_ECOSYSTEMS=cargo SOCKET_OFFLINE=true SOCKET_VEX_PRODUCT=hostile SOCKET_VEX_NO_VERIFY=true VIRTUAL_ENV=/nonexistent) over e2e_vex_lockfile, e2e_vex, e2e_vex_redirect and e2e_embedded_vex: all pass. I didn't run main under the same shell for comparison.
• cargo fmt --all -- --check is clean. cargo clippy on these test targets reports only warnings that main already has (prebuilt_common, oracle.rs duplicate_mod, e2e_vex_build/poetry.rs:485). CI's clippy job doesn't lint test targets.

/code-review high

7 findings, no correctness bugs. Fixed in 68732af: the new duplicate_mod warning, the dead opt-out sets in e2e_vex_redirect::vex_json_env, the inline VIRTUAL_ENV removals in hatch.rs, and the stale cli() doc comments. Not fixed: the POETRY_*/UV_* sweeps and vex_e2e_common/uv.rs (reasons above), and a suggested shared cli_command() helper. The four call sites set different extra env, so a helper wouldn't remove much code.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Wx5bWkf2EhmUyjqAXPj9fu

Generated by Claude Code