CI: hermetic spawns in npm/Bun suites (#823)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #823 (slice 15: npm/Bun suites). Uses Refs, so #823 stays open for the remaining PENDING_RAW_SPAWNS files.

Summary

e2e_npm.rs, e2e_redirect_bun_build.rs and vendor/in_process_vendor_bun.rs now spawn socket-patch through tests/common/hermetic.rs and leave PENDING_RAW_SPAWNS (12 → 9 on main after #1505), so the ratchet in spawn_env_hygiene.rs keeps them hermetic. Test-only; no product code and no workflow changes.

Root cause

Each file started the CLI with a bare Command::new and its own SOCKET_* scrub, which had drifted from the shared builder:

• e2e_npm and the Bun redirect suite never forced SOCKET_NO_CONFIG / SOCKET_NO_UPDATE_CHECK on, so a developer's socket login or an ambient SOCKET_NO_UPDATE_CHECK=0 reached the child.
• The Bun redirect suite ran its bun fixtures under the cache sandbox's HOME but the CLI under the real one, so a registry/scope in the developer's ~/.npmrc could make them disagree. The CLI now gets the stand-in HOME (jvm_env::isolate_cli), and its redundant --no-telemetry is gone (the builder forces telemetry off).
• The in-process Bun vendor FIFO helper skipped the stand-in HOME that every other spawn in that file gets via common::run_with_env.
• e2e_npm's npm install children now drop ambient SOCKET_* too (hermetic::scrub_socket_vars). e2e_npm keeps its real HOME on purpose (the global auto-discovery test needs real prefixes).

Test evidence

• Red: with only the PENDING_RAW_SPAWNS removal and none of the conversions, cargo test -p socket-patch-cli --test spawn_env_hygiene no_new_bare fails: These test files spawn the binary with a bare Command::new: ["e2e_npm.rs", "e2e_redirect_bun_build.rs", "vendor/in_process_vendor_bun.rs"].
• Green: spawn_env_hygiene 16/16; vendor 95/95; e2e_redirect_bun_build 38/38 with real bun 1.4.2 and SOCKET_PATCH_BUN_E2E_REQUIRED=1, also run under hostile ambient SOCKET_ECOSYSTEMS=cargo SOCKET_DRY_RUN=true; e2e_npm non-ignored 20/20.
• e2e_npm's 6 #[ignore]d live-API tests can't reach patches-api.socket.dev from the agent sandbox (proxy tunnel refused), so they weren't run locally; CI doesn't run them either (opt-in live smoke).
• cargo fmt --all -- --check, cargo clippy --locked --workspace --all-features -- -D warnings: clean. No new clippy findings in the touched files under --tests.
• A full cargo test --workspace ran out of sandbox disk; CI covers it.

/code-review high

Fixed: CLI vs bun HOME mismatch, redundant --no-telemetry, unscrubbed npm children. Not fixed:

• Folding e2e_npm's run and the FIFO run_with_deadline into a shared common builder: a refactor of common outside this slice. The ratchet already stops new drift in the SOCKET_* handling.
• "Stand-in HOME may hide a HOME-relative bun shim in the FIFO test": every other spawn in that file already runs under isolate_cli via common::run_with_env, and the test passes.

CI cost

No workflow changes. Lean PR run is the same before and after (~28 Linux jobs, ~8 min).

🤖 Generated with Claude Code

https://claude.ai/code/session_01LsbTgBWpFb9LqLgDdQTsmf

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 94e91a1. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review at 94e91a1502433ee079ca9f9ae405993e590ca372.

• CI: all checks on this head are green (ci-ok success, 34 succeeded, the rest skipped by the lean PR matrix). No main-wide failures.
• Bugbot: reviewed 94e91a1 (the merge from main) and 2bf2c2e. No findings either time.
• Mergeable: yes. Already approved by Tanmay Singla (@Tanmay182003) at this head.
• For the reviewer: test-only change. It moves three npm/Bun suites onto the shared hermetic spawn builder and shrinks PENDING_RAW_SPAWNS from 12 to 9.

Slack announcement didn't go out: this session has no Slack send tool. The next run will retry.

---

Generated by Claude Code