test(cli): parse suites onto hermetic::try_parse (T56) (#1978)

* Start T56: parse suites onto hermetic::try_parse

Assisted-by: Claude Code:claude-opus-5-5

* Parse suites onto hermetic::try_parse

The cli_parse_* suites and cli_global_args kept four ways to keep
ambient SOCKET_* vars out of a parse: four copies of EnvScrub with
drifted hand lists, scan's with_clean_env, global_args' save/restore,
and nothing at all in list, remove and main (SOCKET_JSON=true failed
them). Every parse now goes through hermetic::try_parse, which drops
every SOCKET_* var once per process. Tests that set a var use the new
common/clap_parse.rs try_parse_with_env and stay #[serial]; get, list,
remove and main need no #[serial] at all.

The four hand Snap mirrors of GlobalArgs (get and repair missed four
fields, vendor nine, vex one) are replaced by one hand-written
GlobalArgs literal compared through Debug, so a new global field fails
to compile instead of going unchecked. The scrub self-tests, which
only tested the deleted lists, are gone.

Fixes #1956

Assisted-by: Claude Code:claude-opus-5-5

* Keep forced opt-outs in list and remove parses

cli_parse_list and cli_parse_remove call list::run and remove::run
in-process on parallel threads. The once-per-process SOCKET_* scrub
removed SOCKET_TELEMETRY_DISABLED and SOCKET_NO_CONFIG under them, so
those runs could read a developer's socket login and send telemetry.
Their parses now go through try_parse_keeping_opt_outs, which keeps
and forces hermetic::FORCED_OPT_OUTS on; their default oracle expects
no_telemetry true accordingly.

cli_global_args' last hand set_var/remove_var pairs move onto
try_parse_with_env, so a failed assert no longer leaks a var into
later tests, and scan's defaults test compares the whole GlobalArgs
against the shared oracle.

Assisted-by: Claude Code:claude-opus-5-5

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/tests/cli_global_args.rs

@@ -13,13 +13,16 @@
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 
-use clap::Parser;
 use socket_patch_cli::commands::list::{run, ListArgs};
 
+#[path = "common/clap_parse.rs"]
+mod clap_parse;
 #[path = "common/mod.rs"]
 mod common;
-use common::hermetic::binary_command;
-use socket_patch_cli::{Cli, Commands};
+use clap_parse::try_parse_keeping_opt_outs as try_parse;
+use common::hermetic;
+use hermetic::binary_command;
+use socket_patch_cli::Commands;
 use socket_patch_core::manifest::schema::{
     PatchFileInfo, PatchManifest, PatchRecord, VulnerabilityInfo,
 };
@@ -31,7 +34,7 @@ use socket_patch_core::manifest::schema::{
 fn parse_list(extra: &[&str]) -> ListArgs {
     let mut argv = vec!["socket-patch", "list"];
     argv.extend_from_slice(extra);
-    let cli = Cli::try_parse_from(&argv).expect("parse");
+    let cli = try_parse(&argv).expect("parse");
     match cli.command {
         Commands::List(a) => a,
         _ => panic!("expected List"),
@@ -44,10 +47,12 @@ fn parse_list(extra: &[&str]) -> ListArgs {
 
 #[test]
 fn defaults_match_contract() {
+    // The `run()` tests below need the forced opt-outs, so parses here see
+    // `SOCKET_TELEMETRY_DISABLED=1`.
     let args = parse_list(&[]);
-    assert_eq!(args.common.cwd, PathBuf::from("."));
-    assert_eq!(args.common.manifest_path, ".socket/manifest.json");
-    assert!(!args.common.json);
+    let mut want = clap_parse::global_defaults();
+    want.no_telemetry = true;
+    assert_eq!(clap_parse::Globals(args.common), want);
 }
 
 #[test]
@@ -70,7 +75,7 @@ fn json_flag_sets_true() {
 
 #[test]
 fn unknown_flag_is_rejected() {
-    let err = match Cli::try_parse_from(["socket-patch", "list", "--nope"]) {
+    let err = match try_parse(&["socket-patch", "list", "--nope"]) {
         Ok(_) => panic!("unknown flag must fail"),
         Err(e) => e,
     };

crates/socket-patch-cli/tests/cli_parse_get.rs

@@ -23,6 +23,7 @@ mod hermetic;
 /// the real CLI. Routing through the wrapper means each name/alias/error-kind
 /// assertion below also exercises the code path users actually hit.
 fn parse(argv: &[&str]) -> Result<Cli, clap::Error> {
+    hermetic::scrub_process_socket_env();
     parse_argv_with_shortcuts(argv.iter().map(|s| s.to_string()).collect())
 }
 

crates/socket-patch-cli/tests/cli_parse_list.rs

@@ -7,24 +7,36 @@
 //! These tests deliberately avoid spawning the binary so they run in the
 //! default `cargo test` set (no `--ignored` required) and stay fast.
 
-use clap::Parser;
 use socket_patch_cli::commands::remove::{run, RemoveArgs};
-use socket_patch_cli::{Cli, Commands};
+use socket_patch_cli::Commands;
 use std::path::PathBuf;
 
+#[path = "common/clap_parse.rs"]
+mod clap_parse;
 #[path = "common/hermetic.rs"]
 mod hermetic;
 
+use clap_parse::try_parse_keeping_opt_outs as try_parse;
+use clap_parse::{global_defaults, Globals};
+
 fn parse_remove(extra: &[&str]) -> RemoveArgs {
     let mut argv = vec!["socket-patch", "remove"];
     argv.extend_from_slice(extra);
-    let cli = Cli::try_parse_from(&argv).expect("parse");
+    let cli = try_parse(&argv).expect("parse");
     match cli.command {
         Commands::Remove(a) => a,
         _ => panic!("expected Remove"),
     }
 }
 
+/// The `run()` tests below need the forced opt-outs, so parses here see
+/// `SOCKET_TELEMETRY_DISABLED=1`.
+fn opt_out_defaults() -> Globals {
+    let mut want = global_defaults();
+    want.no_telemetry = true;
+    want
+}
+
 // ---------------------------------------------------------------------------
 // Defaults
 // ---------------------------------------------------------------------------
@@ -33,13 +45,8 @@ fn parse_remove(extra: &[&str]) -> RemoveArgs {
 fn defaults_with_purl_positional() {
     let args = parse_remove(&["pkg:npm/foo@1"]);
     assert_eq!(args.identifier, "pkg:npm/foo@1");
-    assert_eq!(args.common.cwd, PathBuf::from("."));
-    assert_eq!(args.common.manifest_path, ".socket/manifest.json");
     assert!(!args.skip_rollback);
-    assert!(!args.common.yes);
-    assert!(!args.common.global);
-    assert_eq!(args.common.global_prefix, None);
-    assert!(!args.common.json);
+    assert_eq!(Globals(args.common), opt_out_defaults());
 }
 
 #[test]
@@ -49,13 +56,8 @@ fn positional_uuid_stored_in_identifier() {
     // Everything else still at default — `remove` does not auto-detect the
     // identifier shape at parse time; the runtime branch on `pkg:` happens
     // inside `run()`.
-    assert_eq!(args.common.cwd, PathBuf::from("."));
-    assert_eq!(args.common.manifest_path, ".socket/manifest.json");
     assert!(!args.skip_rollback);
-    assert!(!args.common.yes);
-    assert!(!args.common.global);
-    assert_eq!(args.common.global_prefix, None);
-    assert!(!args.common.json);
+    assert_eq!(Globals(args.common), opt_out_defaults());
 }
 
 // ---------------------------------------------------------------------------
@@ -153,7 +155,7 @@ fn all_flags_combined() {
 
 #[test]
 fn missing_required_positional_is_error() {
-    let result = Cli::try_parse_from(["socket-patch", "remove"]);
+    let result = try_parse(&["socket-patch", "remove"]);
     let err = match result {
         Ok(_) => panic!("remove without identifier must fail"),
         Err(e) => e,
@@ -163,7 +165,7 @@ fn missing_required_positional_is_error() {
 
 #[test]
 fn unknown_flag_is_error() {
-    let result = Cli::try_parse_from([
+    let result = try_parse(&[
         "socket-patch",
         "remove",
         "pkg:npm/foo@1",