GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Refs #823 (slice 13; the issue stays open for the remaining PENDING_RAW_SPAWNS files)

What

Three Cargo / Composer suites still on PENDING_RAW_SPAWNS started socket-patch with a bare Command::new and their own partial SOCKET_* handling, which had drifted from tests/common/hermetic.rs:

• e2e_cargo.rs and e2e_composer.rs removed six named vars, so any other ambient SOCKET_* reached the child. With SOCKET_ECOSYSTEMS=npm in the shell, 5 e2e_cargo tests and 2 e2e_composer tests fail on main. Neither forced the config layer or the update notifier off.
• e2e_composer_version_identity.rs had a private sweep that let an ambient SOCKET_NO_CONFIG through and didn't force the update check off.
• No Composer suite guarded the Composer environment. An ambient COMPOSER_VENDOR_DIR, or a user-level config.json with vendor-dir reached through COMPOSER_HOME or XDG_CONFIG_HOME, moves the crawl off the fixture's vendor/. That fails agent_sync_applies_and_keeps_a_padded_composer_patch on main.

All three now spawn through hermetic::command / hermetic::binary_command, scrub an activated venv (Extra::Venv) and use the stand-in HOME from jvm_env::isolate_cli, because their scans crawl every ecosystem. A new hermetic::Extra::Composer removes every ambient COMPOSER_* var and pins COMPOSER_HOME to a missing directory, which outranks XDG_CONFIG_HOME in the crawler's home lookup. Both Composer suites use it, and spawn_env_hygiene gets a self-test for it. The three files leave PENDING_RAW_SPAWNS (22 -> 19), so the ratchet keeps them hermetic.

e2e_redirect_cargo_shapes.rs stays on the list for a later slice because #1429 edits it. #1498 trims other lines of the same PENDING_RAW_SPAWNS list, so whichever PR lands second needs a trivial rebase of that list.

Test-only change; no product code touched.

CI cost

No workflow change. A lean PR run has the same job count (~28 Linux jobs) and job-minutes before and after, because these suites already run in the same jobs.

Test evidence

• cargo fmt --all -- --check: clean. cargo clippy --workspace --all-features -- -D warnings: clean. cargo check -p socket-patch-cli --all-features --tests: every test target builds. Clippy on the touched test targets reports only the existing lints in prebuilt_common/mod.rs, which this PR doesn't touch.

• Red on main:

  • SOCKET_ECOSYSTEMS=npm cargo test -p socket-patch-cli --all-features --no-fail-fast --test e2e_cargo --test e2e_composer: e2e_cargo 20 passed, 5 failed; e2e_composer 20 passed, 2 failed.
  • COMPOSER_VENDOR_DIR=elsewhere cargo test ... --test e2e_composer_version_identity: 6 passed, 1 failed.

• Green on this branch with -- --include-ignored under each of these hostile environments:

  1. SOCKET_ECOSYSTEMS=npm SOCKET_DRY_RUN=true SOCKET_NO_CONFIG=0 SOCKET_CLI_API_TOKEN=x SOCKET_SAVE_ONLY=true COMPOSER_VENDOR_DIR=x
  2. XDG_CONFIG_HOME=<dir with composer/config.json vendor-dir=deps>
  3. COMPOSER_HOME=<same>

  Under every one: e2e_cargo 25/25, e2e_composer 22/22, e2e_composer_version_identity 7/7, spawn_env_hygiene 16/16.

• CI on cdb3669: all checks green (run 38461229984, ci-ok success); Cursor Bugbot passed with no findings; mergeable state clean.

/code-review high

• Fixed: the user-level Composer config leak through COMPOSER_HOME / XDG_CONFIG_HOME (two findings, reproduced as above). The one-off env_remove("COMPOSER_VENDOR_DIR") copies are now Extra::Composer. The doc comments no longer overstate the isolation.
• Not fixed: folding hermetic::command + Extra::Venv + isolate_cli into one shared builder. e2e_composer_version_identity builds on prebuilt_common, not common, so a common helper wouldn't reach it, and changing common::run_bin_with_env to scrub the venv would affect every caller. That belongs in its own change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Er9RqgedbBok557p98HiKT

Generated by Claude Code