Keep test children off production telemetry and fail e2e legs that run no tests

[Mikola Lysenko (mikolalysenko)]

Problem

From the architecture audit (theme: tests and CI):

• B69: test child processes sent telemetry to production. tests/common/hermetic.rs kept SOCKET_TELEMETRY_DISABLED out of its scrub but never set it, and .cargo/config.toml [env] only set SOCKET_NO_CONFIG and SOCKET_NO_UPDATE_CHECK. An unauthenticated run with no mocked proxy URL POSTs to patches-api.socket.dev.
• B70: the e2e runner's "0 tests ran" check covered Gradle legs only. The Windows e2e_redirect_npm_build leg skipped all 6 capstones on every PR: the suite spawned a bare npm, which Command::new can't resolve to npm.cmd, and the row had no npm_required. The comment pointing at docs/testing/npm-compatibility.md was stale; that file never mentions Windows.
• B01 follow-up: the PENDING_INLINE_DIGESTS ratchet failed with a bare assert_eq! of two lists. A stale entry (the cause of the red main fixed in Fix main CI red on stale digest pending-list entries #1016) looked the same as a new inline copy.

Change

1. Telemetry off for test children. SOCKET_TELEMETRY_DISABLED = "1" is now in the workspace [env] table, and hermetic::command forces it. [env] covers every child of a test that cargo launches, including the ~150 files still on the raw-spawn list. It does not reach the CI legs that run the prebuilt test binaries directly (e2e, e2e-full, cargo-vex-matrix, cargo-vex-matrix-full in ci.yml, and the nine *-compatibility.yml workflows). Their env blocks copy the [env] table by hand, so each copy now sets SOCKET_TELEMETRY_DISABLED: '1' too (13 blocks). A new test, workflow_env_copies_carry_every_opt_out, fails if any workflow env block sets one of the three opt-outs without the other two, so the copies can't drift again (checked failing-first by deleting one line). Suites that assert telemetry already opt back in after command with SOCKET_TELEMETRY_DISABLED=0 or by removing it, plus a wiremock endpoint: telemetry_e2e, cli_config_fallback, covgap list, cli_parse_list, repair lifecycle. Caller env still lands last.
2. Parse suites off the ambient env. clap reads env-bound flags at parse time, so cli_parse_apply and cli_parse_rollback parsed --no-telemetry as set once the default was in place. They were also exposed to any developer's SOCKET_* shell. New hermetic::scrub_process_socket_env() is the in-process half of hermetic::command: it runs once, so no parse reads the env while it changes. hermetic::try_parse wraps it around Cli::try_parse_from, and every parse in both suites goes through that one wrapper.
3. Zero-tests guard on every leg. ci.yml "Run e2e tests" now fails any suite in any leg that reports 0 passed. e2e and e2e-full share these steps. I checked recent logs (PR run 37549486021, 155 e2e legs; nightly 37269953509, 30 e2e-full legs) and every leg passes at least one test, so no row trips the guard today. The unused E2E_JVM_TOOL env is removed.
4. Windows npm leg is real. npm_e2e_common::npm_program() (and the lock-writer probe) resolve npm through socket_patch_core::utils::process::resolve_tool, the CLI's own PATHEXT-aware lookup, so Windows finds npm.cmd. The Windows row now sets npm_required: '1'.
5. Actionable ratchet messages. The digest ratchet is split into a new-copy check and a stale-entry check, like the spawn-hygiene ratchets. All three lists (PENDING_INLINE_DIGESTS, PENDING_SCRUB_COPIES, PENDING_RAW_SPAWNS) now name the files, the constant, the source file and the fix: use the helper, or rebase and delete the entry. The stale-entry check is kept, as asked.

Duplicate copies: none deleted. In-process SOCKET_* scrub strategies go from 5 to 6: the five EnvScrub/SOCKET_ENV_VARS copies (cli_parse_get, cli_parse_repair, cli_parse_vendor, cli_parse_vex, remove_rollback_api_overrides) restore the env with an RAII guard, while the new shared hermetic::scrub_process_socket_env removes it once and never restores it. The new one exists once, in common/hermetic.rs. Moving the five onto it is listed under Deferred.

Overlap with #1018: that PR also edits ci.yml, at the top (on/permissions) and around lines 2068-2110 and 2296+. My edits are confined to the e2e matrix comment and row (~958-969) and the e2e run step (~1625-1650), so the two should merge cleanly. #1016 (stale digest entries) is already on main; #1015 touches a different hunk of digest.rs.

Testing

All run on macOS arm64 in the worktree, through the heavy-job limiter, with CARGO_INCREMENTAL=0:

• Failing first: before the fix, cargo test -p socket-patch-cli --test spawn_env_hygiene failed both new tests, command_forces_telemetry_off and cargo_config_env_carries_the_opt_outs. After the fix: 11/11.
• cargo test --workspace --no-fail-fast: everything passes except
  • cli_parse_apply and cli_parse_rollback, which the default broke and change 2 fixes (now 43/43 and 38/38);
  • two machine-local failures that also fail without this change. e2e_vendor_cargo_build old-toolchain cells fail with "Bad CPU type" (x86_64 rustup 1.41 on arm64). mode_migration_npm::berry_vendored_then_hosted_takeover_leaves_pure_hosted fails the same way with SOCKET_TELEMETRY_DISABLED=0 (local yarn 4.12; not this change).
• SOCKET_PATCH_NPM_E2E_REQUIRED=1 cargo test -p socket-patch-cli --test e2e_redirect_npm_build --test e2e_vendor_npm_build -- --include-ignored: 15/15 and 22/22. This exercises the new npm resolution.
• cargo clippy --workspace --all-features (the CI form): the only warning is the pre-existing macOS-only unused variable: unix_default in python_crawler.rs, which this PR doesn't touch. cargo clippy -p socket-patch-core -p socket-patch-cli --tests gives no diagnostics in any touched file. (--all-targets -D warnings on this toolchain stops at about 20 pre-existing test-target lints in untouched core files.)
• python3 -m unittest discover -s scripts/tests -p 'test_ci_*.py': 43 OK.
• rustfmt on touched files only.
• Review round: cargo test -p socket-patch-cli --test spawn_env_hygiene --test cli_parse_apply --test cli_parse_rollback: 12/12, 43/43, 38/38. cargo clippy -p socket-patch-cli --tests: no diagnostics in any touched file. Ran workflow_env_copies_carry_every_opt_out with one copy removed from go-compatibility.yml: it fails and names the block.
• Left to CI: the Windows e2e_redirect_npm_build leg, which now really runs npm with npm_required, and the generalized guard on every Linux/macOS/Windows leg.

Deferred

• Move the five remaining EnvScrub/SOCKET_ENV_VARS copies onto hermetic::scrub_process_socket_env (or a restoring variant). This is Tracking: share CLI test helpers through one test-support module instead of 100+ per-file copies #824-adjacent test-helper consolidation.
• A skip-marker check for the soft-skip legs, tracked in Make non-vlt e2e legs fail when every test soft-skips #1054. libtest counts an early-return skip as "passed", so the passed > 0 guard can't see it, and rows without a _REQUIRED gate (e.g. e2e_redirect_rush_sim) can still go green having tested nothing.
• The Windows e2e_redirect_npm_build leg has never run with npm_required, locally or in CI yet (PR CI was still queued at this update). It must be green before merge. If it fails on real Windows npm bugs, either fix them or drop npm_required on that one row with a tracking issue, and keep the resolve_tool change.
• Making the ratchets one-sided (audit rec for B01). Not done: the task said to keep the stale-entry check.

🤖 Generated with Claude Code

---

Note

Low Risk
Changes affect test/CI hygiene and workflow guards only; production telemetry behavior for real users is unchanged, and telemetry suites can still opt in explicitly.

Overview
Stops test and CI runs from posting telemetry to production by defaulting SOCKET_TELEMETRY_DISABLED=1 in .cargo/config.toml, forcing it in hermetic::command, and mirroring that opt-out across workflow env blocks that run prebuilt e2e binaries. New spawn-hygiene tests lock in the three-way opt-out set and scan workflows so partial copies cannot drift.

Parser contract tests now use hermetic::try_parse (with one-time in-process SOCKET_* scrubbing) so workspace defaults like --no-telemetry do not change clap snapshots.

CI reliability: the e2e runner fails any leg where a suite reports 0 passed (not only Gradle). Windows e2e_redirect_npm_build resolves npm via PATHEXT-aware resolve_tool and sets npm_required: '1' so the leg cannot soft-skip. Digest and spawn-hygiene ratchets emit clearer fix/rebase messages instead of bare list diffs.

^{Reviewed by Cursor Bugbot for commit 5ad1365. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 5ad1365. Configure here.}