GeezerVison

The run's API client now carries one ApiRoute, Org{slug} or Proxy,
decided once in get_api_client_with_overrides. With a token and no
--org / SOCKET_ORG_SLUG / socket-cli defaultOrg, a failed
GET /v0/organizations (network error, 401/403, no orgs, bad answer)
makes the whole run an anonymous public-proxy run with one warning,
instead of querying /v0/orgs/default/... for JSON while blobs, vendor
package references and telemetry went to the proxy. Offline runs with a
token and no slug use the proxy route without a network call.

- ApiClient: route replaces use_public_proxy + org_slug; a proxy client
  never keeps the token. patches_path, the batch 404 message,
  binary_url and vendor_package_url match on the route; the
  org_slug_or_default fallback, the proxy_url_from_env re-derivation and
  fetch_registry_references_for_org are gone.
- Telemetry takes a TelemetryAuth built from the run's client
  (TelemetryAuth::for_client); list keeps a no-client constructor.
- Embedded --vex reuses the host command's client (VexBuildParams
  api_client), so scan/apply/vendor --vex no longer resolve the org a
  second time; standalone vex builds its client at most once and reports
  telemetry on it. vendored repair hands the client it builds back to
  repair.
- scan --json and get --json report the downgrade as api_auth_fallback
  in warnings[].

The mid-run 401/403 proxy swap is unchanged (#647).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

CLI_CONTRACT.md: the --org / SOCKET_ORG_SLUG rows and the
api_auth_fallback warning cover the unresolved-org proxy run.
docs/configuration.md and docs/migrating-to-v5.md describe the change.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…n path (#648)

get <uuid> --json (agent save, paid_required, not_found) and the search
path's not_found / paid_required envelopes now carry the
api_auth_fallback warning like the other get paths. Standalone
vex --json notes it when it built the run's client itself; a host that
seeded its client reports it and adds no duplicate. Human mode still
warns once, from client construction. Tests pin the warning count and
the new JSON entries.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Resolve import conflicts in rollback.rs, vendor.rs and scan/vendor_flow.rs
(keep TelemetryAuth, take main's PurlKey in place of
composer_purls_equivalent), and move main's new blob_fetcher test client
onto ApiRoute::Proxy.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

apply and vendor seed their embedded --vex with the run's client, which
suppresses the VEX plan's own api_auth_fallback note on the promise that
the host reports it. scan and get copy org_unresolved() into warnings[],
but apply and vendor (including the hosted-pin eject path) never did, so a
token whose org failed to resolve was invisible to --json consumers.

Add a shared api_auth_fallback_warning() helper and push it onto the
apply and vendor envelopes under --json, plus an e2e test covering both.

Co-Authored-By: Claude <[email protected]>

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

run_eject builds its client (and may fall back to the public proxy)
before any envelope is printed, but only the wet-path envelope carried
the api_auth_fallback warning. The dry-run success envelope and the
fetch-failure / refused envelopes now carry it too, so --json consumers
see the same downgrade stderr already reported.

Co-Authored-By: Claude <[email protected]>

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Conflicts in get.rs (imports: kept main's trimmed set plus this branch's TelemetryAuth) and remove.rs (kept main's emit_hosted_unwind_error with this branch's TelemetryAuth telemetry call).

Co-Authored-By: Claude <[email protected]>

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

save_and_apply_patch folds the run's org warnings into the wet-run JSON
envelope, but its --dry-run branch called agent_dry_run with empty
warning slices. So `get <uuid> --json --dry-run --mode agent` after a
failed org resolve dropped api_auth_fallback from warnings[], even
though the client warned on stderr and the search dry-run path (which
extends narrow_warnings with org_warnings) reports it. Pass org_warnings
through so the preview envelope matches the wet run.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Resolve get.rs and rollback.rs conflicts with #1027: keep this PR's
shared telemetry handle and take main's {code, message} error codes.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

When a token's org cannot be resolved, repair's download runs on the
public proxy and only stderr said so; scan, get, apply and vendor already
carry api_auth_fallback in the envelope's warnings[]. Copy it from the
download phase's client (not the telemetry-only client, which fetched
nothing). Bugbot finding on #1041.

Co-Authored-By: Claude <[email protected]>

cursor Bot left a comment