@@ -15,15 +15,13 @@
 //! crawler won't match, which trips the "no packages found / offline"
 //! branches and exercises the invariants without needing a real fixture.
 
+use crate::common::{binary, git_sha256};
+
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
 use sha2::{Digest, Sha256};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 /// Minimal manifest with one synthetic patch entry. The PURL points at a
 /// package that won't be found on disk; the `afterHash` blob is missing
 /// from `.socket/blobs/`. This forces every branch we want to test —
@@ -151,17 +149,6 @@ const SCOPED_NPM_PURL: &str = "pkg:npm/scopedpkg@1.0.0";
 const SCOPED_ORIGINAL: &[u8] = b"module.exports = function vulnerable() { return 'pwn'; };\n";
 const SCOPED_PATCHED: &[u8] = b"module.exports = function safe() { return 'ok'; };\n";
 
-/// Git SHA-256: `SHA256("blob <len>\0" ++ content)`. Computed
-/// independently here so the manifest hashes are NOT derived from the
-/// code under test (no circular oracle).
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// Lay down a project with TWO manifest patches:
 ///   - an npm patch that is fully applicable offline (package installed,
 ///     patched blob present in `.socket/blobs/`), and
 
@@ -26,11 +26,11 @@
 //!     modified"). When NO variant matches, the base still fails with
 //!     "no matching variant found" and the file stays untouched.
 
+use crate::common::{binary, git_sha256};
+
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
-use sha2::{Digest, Sha256};
-
 const SINGLETON_PURL: &str = "pkg:gem/rack@3.1.0";
 const UUID_SINGLETON: &str = "31313131-3131-4131-8131-313131313131";
 
@@ -48,19 +48,6 @@ const LINUX_MARKER: &[u8] = b"\n# SOCKET-LINUX-PATCH\n";
 const DARWIN_BEFORE: &[u8] = b"# nokogiri.rb from the arm64-darwin gem\n";
 const DARWIN_MARKER: &[u8] = b"\n# DARWIN-MARKER\n";
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
-/// Git-SHA256: SHA256("blob <len>\0" ++ content).
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn with_marker(base: &[u8], marker: &[u8]) -> Vec<u8> {
     let mut v = base.to_vec();
     v.extend_from_slice(marker);
 
@@ -10,26 +10,14 @@
 //!   * non-JSON runs print ONE stderr warning, gated on `!--silent`
 //!     (`--silent` = errors only — a bare crawler eprintln violated that).
 
-use std::path::{Path, PathBuf};
-use std::process::Command;
+use crate::common::{binary, git_sha256};
 
-use sha2::{Digest, Sha256};
+use std::path::Path;
+use std::process::Command;
 
 const PURL: &str = "pkg:gem/rack@3.1.0";
 const CODE: &str = "gem_bundle_config_path_ignored";
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// Project fixture: Gemfile + `.bundle/config` pointing `BUNDLE_PATH` at
 /// an ABSOLUTE directory outside the project (holding a real store, so
 /// the only reason it goes undiscovered is the containment skip), plus —
 
@@ -20,30 +20,18 @@
 
 #![cfg(unix)]
 
+use crate::common::{binary, git_sha256};
+
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
-use sha2::{Digest, Sha256};
-
 const BASE_PURL: &str = "pkg:gem/rack@3.1.0";
 const QUALIFIED_PURL: &str = "pkg:gem/rack@3.1.0?platform=ruby";
 const SKIP_CODE: &str = "gem_fallback_home_skipped";
 
 const ORIGINAL: &[u8] = b"module Rack\n  VERSION = 'VULNERABLE'\nend\n";
 const MARKER: &[u8] = b"# SOCKET-PATCHED-FALLBACK\n";
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn patched_bytes() -> Vec<u8> {
     let mut v = ORIGINAL.to_vec();
     v.extend_from_slice(MARKER);
 
@@ -17,26 +17,13 @@
 //! physical copy is patched (and later restored) AND that the JSON summary
 //! counts every copy.
 
+use crate::common::{binary, git_sha256};
+
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
-use sha2::{Digest, Sha256};
-
 const PURL: &str = "pkg:gem/rack@3.1.0";
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
-/// Git-SHA256: SHA256("blob <len>\0" ++ content).
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// Write a gem copy at `gem_dir` with `lib/rack.rb` holding `bytes`,
 /// returning the file path.
 fn write_copy(gem_dir: &Path, bytes: &[u8]) -> PathBuf {
 
@@ -19,19 +19,15 @@
 //! Requires: `python3` with `venv` and `pip` on PATH. Skipped (visibly)
 //! when python3 is missing — same contract as `in_process_pypi_apply`.
 
+use crate::common::{binary, git_sha256};
+
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
-use sha2::{Digest, Sha256};
-
 const PYPI_PACKAGE: &str = "six";
 const PYPI_VERSION: &str = "1.16.0";
 const UUID: &str = "12121212-1212-4121-8121-121212121212";
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 /// Spawn the CLI with the ambient environment scrubbed, so the flags each
 /// test passes are the only thing deciding behaviour.
 ///
@@ -72,14 +68,6 @@ fn run_apply_scrubbed(args: &[&str]) -> std::process::Output {
     cmd.output().expect("run socket-patch apply")
 }
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn find_python() -> Option<&'static str> {
     for cmd in ["python3", "python", "py"] {
         let ok = Command::new(cmd)
 
@@ -3,13 +3,9 @@
 //! asserts the JSON envelope's `dryRun: true` field — covering the
 //! dry-run flag-propagation branches each command's `run` has.
 
-use std::path::{Path, PathBuf};
+use crate::common::{binary, git_sha256};
 
-use sha2::{Digest, Sha256};
-
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
+use std::path::Path;
 
 fn make_socket_with_empty_manifest(root: &std::path::Path) {
     let socket = root.join(".socket");
@@ -18,17 +14,6 @@ fn make_socket_with_empty_manifest(root: &std::path::Path) {
     std::fs::create_dir_all(socket.join("blobs")).unwrap();
 }
 
-/// Git SHA-256: `SHA256("blob <len>\0" ++ content)`. Computed
-/// independently here so the manifest hashes are NOT derived from the
-/// code under test (no circular oracle).
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 const DRYRUN_PURL: &str = "pkg:npm/dryrunpkg@1.0.0";
 const DRYRUN_ORIGINAL: &[u8] = b"module.exports = function vulnerable() { return 'pwn'; };\n";
 const DRYRUN_PATCHED: &[u8] = b"module.exports = function safe() { return 'ok'; };\n";
 
@@ -14,7 +14,9 @@
 
 #![cfg(unix)]
 
-use std::path::{Path, PathBuf};
+use crate::common::binary;
+
+use std::path::Path;
 use std::time::Duration;
 
 use portable_pty::{native_pty_system, CommandBuilder, PtySize};
@@ -30,10 +32,6 @@ const ORG_SLUG: &str = "test-org";
 const UUID_A: &str = "11111111-1111-4111-8111-111111111111";
 const UUID_B: &str = "22222222-2222-4222-8222-222222222222";
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 /// Spawn the socket-patch binary inside a PTY, send `input`, and collect
 /// all output until the child exits. Returns `(exit_code, output)`.
 ///
 
@@ -7,15 +7,13 @@
 
 #![cfg(unix)]
 
-use std::path::{Path, PathBuf};
+use crate::common::binary;
+
+use std::path::Path;
 use std::time::Duration;
 
 use portable_pty::{native_pty_system, CommandBuilder, PtySize};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 /// Spawn the socket-patch binary inside a PTY, send `input`, and
 /// collect all output until the child exits. Returns `(exit_code,
 /// output)`. The timeout is enforced via a watchdog thread that
 
@@ -18,4 +18,5 @@ mod covgap_commands_list;
 mod covgap_output;
 mod interactive_prompts_e2e;
 mod output_modes_e2e;
+mod shared_helper_copies;
 mod telemetry_e2e;