CI: hermetic spawns in Cargo/Composer suites (#823)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #823 (slice 13; the issue stays open for the remaining PENDING_RAW_SPAWNS files)

What

Three Cargo / Composer suites still on PENDING_RAW_SPAWNS started socket-patch with a bare Command::new and their own partial SOCKET_* handling, which had drifted from tests/common/hermetic.rs:

• e2e_cargo.rs and e2e_composer.rs removed six named vars, so any other ambient SOCKET_* reached the child. With SOCKET_ECOSYSTEMS=npm in the shell, 5 e2e_cargo tests and 2 e2e_composer tests fail on main. Neither forced the config layer or the update notifier off.
• e2e_composer_version_identity.rs had a private sweep that let an ambient SOCKET_NO_CONFIG through and didn't force the update check off.
• No Composer suite guarded the Composer environment. An ambient COMPOSER_VENDOR_DIR, or a user-level config.json with vendor-dir reached through COMPOSER_HOME or XDG_CONFIG_HOME, moves the crawl off the fixture's vendor/. That fails agent_sync_applies_and_keeps_a_padded_composer_patch on main.

All three now spawn through hermetic::command / hermetic::binary_command, scrub an activated venv (Extra::Venv) and use the stand-in HOME from jvm_env::isolate_cli, because their scans crawl every ecosystem. A new hermetic::Extra::Composer removes every ambient COMPOSER_* var and pins COMPOSER_HOME to a missing directory, which outranks XDG_CONFIG_HOME in the crawler's home lookup. Both Composer suites use it, and spawn_env_hygiene gets a self-test for it. The three files leave PENDING_RAW_SPAWNS (22 -> 19), so the ratchet keeps them hermetic.

e2e_redirect_cargo_shapes.rs stays on the list for a later slice because #1429 edits it. #1498 trims other lines of the same PENDING_RAW_SPAWNS list, so whichever PR lands second needs a trivial rebase of that list.

Test-only change; no product code touched.

CI cost

No workflow change. A lean PR run has the same job count (~28 Linux jobs) and job-minutes before and after, because these suites already run in the same jobs.

Test evidence

• cargo fmt --all -- --check: clean. cargo clippy --workspace --all-features -- -D warnings: clean. cargo check -p socket-patch-cli --all-features --tests: every test target builds. Clippy on the touched test targets reports only the existing lints in prebuilt_common/mod.rs, which this PR doesn't touch.

• Red on main:

  • SOCKET_ECOSYSTEMS=npm cargo test -p socket-patch-cli --all-features --no-fail-fast --test e2e_cargo --test e2e_composer: e2e_cargo 20 passed, 5 failed; e2e_composer 20 passed, 2 failed.
  • COMPOSER_VENDOR_DIR=elsewhere cargo test ... --test e2e_composer_version_identity: 6 passed, 1 failed.

• Green on this branch with -- --include-ignored under each of these hostile environments:

  1. SOCKET_ECOSYSTEMS=npm SOCKET_DRY_RUN=true SOCKET_NO_CONFIG=0 SOCKET_CLI_API_TOKEN=x SOCKET_SAVE_ONLY=true COMPOSER_VENDOR_DIR=x
  2. XDG_CONFIG_HOME=<dir with composer/config.json vendor-dir=deps>
  3. COMPOSER_HOME=<same>

  Under every one: e2e_cargo 25/25, e2e_composer 22/22, e2e_composer_version_identity 7/7, spawn_env_hygiene 16/16.

• CI on cdb3669: all checks green (run 38461229984, ci-ok success); Cursor Bugbot passed with no findings; mergeable state clean.

/code-review high

• Fixed: the user-level Composer config leak through COMPOSER_HOME / XDG_CONFIG_HOME (two findings, reproduced as above). The one-off env_remove("COMPOSER_VENDOR_DIR") copies are now Extra::Composer. The doc comments no longer overstate the isolation.
• Not fixed: folding hermetic::command + Extra::Venv + isolate_cli into one shared builder. e2e_composer_version_identity builds on prebuilt_common, not common, so a common helper wouldn't reach it, and changing common::run_bin_with_env to scrub the venv would affect every caller. That belongs in its own change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Er9RqgedbBok557p98HiKT

---

Note

Low Risk
Test harness and environment isolation only; no production CLI or crawler behavior changes.

Overview
Cargo and Composer CLI e2e suites now spawn socket-patch through the shared hermetic helpers instead of bare Command::new with hand-rolled SOCKET_* scrubbing, so ambient env (e.g. SOCKET_ECOSYSTEMS, stray SOCKET_* tokens) cannot skew discovery or proxy routing.

Extra::Composer strips all COMPOSER_* variables and pins COMPOSER_HOME to a nonexistent path so COMPOSER_VENDOR_DIR and user-level Composer config via XDG_CONFIG_HOME cannot redirect the crawler away from fixture vendor/. Composer suites use it; spawn_env_hygiene adds a contract test and drops e2e_cargo, e2e_composer, and e2e_composer_version_identity from PENDING_RAW_SPAWNS.

Unscoped scans also scrub VIRTUAL_ENV and isolate HOME via jvm_env::isolate_cli so developer venvs and user caches do not inflate package counts.

^{Reviewed by Cursor Bugbot for commit cdb3669. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit cdb3669. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent)

• Head: cdb3669594937f01ebf666f364eae6de422be214
• CI: 86/86 settled green on this head (36 success, 50 path-skipped); no main-wide failures
• Bugbot: reviewed cdb3669 and found no issues; no open review threads
• Mergeable: clean, already one human approval on this head
• What to look at: test-only change moving the Cargo/Composer e2e suites onto the shared hermetic spawn helper (Spawn every CLI test child through one hermetic Command builder; 10 test files inherit ambient SOCKET_* today #823)

---

Generated by Claude Code