GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Fix report-only scan -g hint dropping -g (#464) by mikolalysenko · Pull Request #777 · SocketDev/socket-patch

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 4, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Collaborator

LLM Description written by Claude Code:claude-opus-5-5

Fixes #464

Summary

scan -g and scan --global-prefix <dir> with no --mode only report. They end with a hint showing how to apply what they found. The hint used to drop the global scope:

To apply these patches in place, run:
  socket-patch scan --mode agent [PATHS]
  socket-patch get <package-name-or-purl-or-CVE-ID>

If you ran it as printed, it scanned the cwd project instead of the global install, exited 0, and left the global copy unpatched. The hint now repeats the run's scope:

  socket-patch scan --mode agent -g
  socket-patch get -g <package-name-or-purl-or-CVE-ID>

With a prefix, it prints --global-prefix '<dir>' instead, shell-quoted only when the path needs it (POSIX single quotes; double quotes on Windows). A project --prune report-only scan keeps the old hint.

Root cause

render::report_only_hint() took no arguments, so it never saw the run's GlobalArgs. It now takes &GlobalArgs and builds both commands from global / global_prefix. SOCKET_GLOBAL / SOCKET_GLOBAL_PREFIX set the same fields, so they're covered too. CLI_CONTRACT.md documents the scoped hint.

The npm, PyPI and gem wrappers only dispatch to the binary, so they need no change.

Tests (red → green)

Issue	Test	Without the fix	With the fix
#464 (`-g`, `--global-prefix`, quoting)	`scan::render::tests::report_only_hint_keeps_global_scope` (unit)	does not compile (the hint takes no scope)	pass
#464 (real report-only scan)	`covgap_commands_scan_mod::scan_global_report_only_hint_keeps_the_global_scope`	fails: the hint printed `socket-patch scan --mode agent [PATHS]`	pass
project hint unchanged	`report_only_hint_names_agent_mode`, `scan_prune_without_a_mode_is_report_only`	pass	pass

Commands run locally on b311073:

cargo clippy --workspace --all-features -- -D warnings: clean.
cargo test -p socket-patch-cli --all-features --lib: 835 passed.
cargo test -p socket-patch-cli --all-features --test covgap_commands_scan_mod --test cli_parse_scan --test e2e_socket_yml_policy: 45 + 52 + 20 passed.
cargo fmt --check: my hunks are clean. main already has about 500 rustfmt diffs under the pinned 1.93.1 toolchain, and CI doesn't run fmt, so I didn't reformat unrelated code.
A full cargo test --workspace filled the sandbox disk while linking test binaries, so the full suite is left to CI.

🤖 Generated with Claude Code

Note

Low Risk
Human-output and documentation change for scan hints, plus a mechanical digest helper refactor in JVM/Gradle paths with existing test coverage.

Overview
Fixes #464: report-only scan (no --mode, including --prune or global scope) now prints follow-up commands that repeat the run’s global scope, so copying the hint does not accidentally run agent mode against the cwd project.

report_only_hint takes GlobalArgs: with -g it suggests scan --mode agent -g / get -g …; with --global-prefix it embeds a shell-safe prefix via new shell_word (POSIX single quotes; Windows double quotes, including trailing-backslash handling). Project-local report-only scans keep the [PATHS] hint. CLI_CONTRACT.md documents this.

Also routes Gradle cache / JVM jar / Maven sidecar SHA-1 (and JVM SHA-256) through shared utils::digest helpers instead of inline sha1/sha2 calls—no intended behavior change.

Unit tests in render and an integration test scan_global_report_only_hint_keeps_the_global_scope lock in the scoped hint.

^{Reviewed by Cursor Bugbot for commit 7e78c76. Configure here.}

Generated by Claude Code

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Start fix for #464

Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) mentioned this pull request

Oct 4, 2026

A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464

Closed


          Keep global scope in report-only scan hint

b311073

A report-only `scan -g` (or `--global-prefix <dir>`) ends with a hint
for applying what it found. The hint dropped the global flag, so
running it as printed scanned the cwd project instead, exited 0, and
left the global install unpatched.

The hint now repeats the run's scope: `-g`, or `--global-prefix <dir>`
shell-quoted when the path needs it. A project `--prune` scan keeps
the old hint. Covered by unit tests on the hint and an integration
test of a real report-only global-prefix scan.

Fixes #464

Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) marked this pull request as ready for review

October 4, 2026 12:48

Mikola Lysenko (mikolalysenko) commented Oct 4, 2026

Copy link

Copy Markdown

Collaborator Author

BugBot review

Generated by Claude Code

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 4, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Mikola Lysenko (mikolalysenko) commented Oct 4, 2026

Copy link

Copy Markdown

Collaborator Author

[agent] Ready for review at b311073.

CI: all 482 check runs finished green on the head.
Bugbot: reviewed b311073 and found no issues.
Change: the report-only scan -g / --global-prefix hint now repeats the run's global scope, so running it verbatim patches the global install (A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install #464).

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 4, 2026

Tanmay Singla (Tanmay182003) approved these changes

Oct 5, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) removed the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 5, 2026


          Merge origin/main into agent/fix-report-only-hint-global-scope

6a31b6b

Main reflowed the old one-line report_only_hint() test with rustfmt;
this branch replaced that test with ones for the scoped hint
(report_only_hint(&GlobalArgs)). Keep the branch's tests, which cover
the same header line plus the #464 global-scope cases.

Co-Authored-By: Claude <[email protected]>

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

bugbot run

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 5, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

crates/socket-patch-cli/src/commands/scan/render.rs Resolved

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Collaborator Author

[agent] coverage, test-release and test (macos-latest) are all red on 6a31b6b (exit 101, a test failure in each), but this PR didn't cause any of them. All three checks are also red on the latest main (4646693), before this branch merged main in. I don't know of a fix for them yet, so there's nothing to port in here. The job's log download is blocked from this sandbox, so I couldn't name the failing tests. This PR is in-progress under another agent run (heartbeat 12:36 UTC), so I'm not pushing. Separately, Bugbot's finding on the Windows quoting of a path with a trailing backslash is real and still needs a fix.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

mikolalysenko and others added 2 commits

October 5, 2026 14:33


          Merge origin/main into agent/fix-report-only-hint-global-scope

d881b97

Brings in the vex_consumed alias test fix (#849) that main's red
test/test-release/coverage jobs were waiting on.

Co-Authored-By: Claude <[email protected]>


          Double trailing backslashes in the Windows report-only hint prefix

f53164c

shell_word wrapped a --global-prefix with spaces in double quotes as-is,
so a prefix ending in '\' produced "C:\dir\" and the argv parser read
that last backslash as escaping the closing quote: the pasted hint was
no longer one argument. Doubling the trailing backslash run keeps the
quote closing and still names the same directory.

Co-Authored-By: Claude <[email protected]>

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

bugbot run

Generated by Claude Code

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 5, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label

Oct 5, 2026

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

Burn-down agent: labeled Ready for review at d881b97.

CI: 476 success + 6 skipped, 0 failing; mergeable clean against main.
Bugbot: Cursor Bugbot check passed on d881b97; 0 unresolved review threads.
Linked issue(s) still open and not fixed on main.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) enabled auto-merge (squash)

October 5, 2026 17:27

auto-merge was automatically disabled

October 5, 2026 17:28

Head branch was modified

Mikola Lysenko (mikolalysenko) added Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review and removed Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review labels

Oct 5, 2026

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

Burn-down agent: labeled Ready for review at d881b97 (d881b972574c09683ff8ff5d1973888f56c1efc2).

CI: 476/476 green (8 skipped by matrix rule) on the head commit.
Bugbot: reviewed d881b97; no open findings; its one earlier thread is resolved.
Mergeable against main (checked with git merge-tree after today's main merge wave).

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) enabled auto-merge (squash)

October 5, 2026 18:16

auto-merge was automatically disabled

October 5, 2026 18:25

Head branch was modified


          Merge origin/main into agent/fix-report-only-hint-global-scope

1bb6331

Brings the branch up to date with main so CI and Bugbot run on the
Windows backslash fix in f53164c, which GitHub never synced to the PR.

Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

[agent] The Bugbot thread on render.rs:316 was resolved as "Fixed in f53164c", but GitHub never synced the PR to that push. The PR head stayed at d881b97, so CI, Bugbot and the earlier approval only covered the commit without the trailing-backslash fix. I merged main (1bb6331, clean merge) and pushed, so the PR now includes f53164c. Locally, clippy (--workspace --all-features -D warnings) is clean, the scan::render unit tests pass (28) and covgap_commands_scan_mod + cli_parse_scan pass (52 + 52). The Windows quoting row only runs on the Windows CI job. Re-review is needed: the approval was on b311073.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

BugBot review

Generated by Claude Code

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 5, 2026

View reviewed changes

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Mikola Lysenko (mikolalysenko) mentioned this pull request

Oct 5, 2026

Bound crawler and tool probes through one spawn deadline (#845) #886

Merged

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Collaborator Author

[agent] On 1bb6331, test (windows-latest) and test (macos-latest) both failed, but this PR didn't cause it. In each job the only target that failed is -p socket-patch-core --lib (error: 1 target failed). This PR only changes socket-patch-cli (the scan hint, its tests and the contract doc), and every socket-patch-cli test binary passed on both OSes, including the Windows quoting row in report_only_hint_keeps_global_scope. Both checks are also red on the latest main, and I don't know of a fix yet, so there's nothing to port.

lock-diff in the vlt workflow also failed. Its run was cancelled before any tests ran (plan and the Linux/Windows build jobs were cancelled), so lock-diff had no locks to compare ("locks from no OS"). I've re-run the failed jobs once.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.


          Route Gradle digests through utils::digest

7e78c76

Ports #878 so the core lib tests pass here too: main is red on
utils::digest::tests::production_digests_go_through_the_helpers
because the Gradle files hash inline. This change is a no-op once #878
lands on main.

(cherry picked from commit 659ac2c)

Assisted-by: Claude Code:claude-opus-5-5

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

[agent] CI on 1bb6331:

test (macos-latest) and test (windows-latest) each failed on exactly one test: utils::digest::tests::production_digests_go_through_the_helpers. It is red on main too, because the Gradle files hash inline, and Route Gradle digests through utils::digest #878 fixes it. I ported Route Gradle digests through utils::digest #878's commit as 7e78c76. It becomes a no-op once Route Gradle digests through utils::digest #878 merges. Locally, cargo test -p socket-patch-core --lib utils::digest passes and core clippy is clean.
The Windows job passed every scan::render test, including the new trailing-backslash row (its only failed target was -p socket-patch-core --lib).
lock-diff (vlt) failed with "locks from no OS" because every vlt build job it compares was cancelled.
About 30 other jobs were cancelled with "The job was not acquired by Runner of type hosted", a runner-capacity problem before any test ran. They re-run with the new push.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link

Copy Markdown

Collaborator Author

BugBot review

Generated by Claude Code

cursor[bot] reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed

Oct 5, 2026

View reviewed changes

cursor Bot left a comment

Copy link

Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 7e78c76. Configure here.}

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Collaborator Author

Burn-down agent: re-verified Ready for review at the new head 7e78c76 (7e78c765b071fba2f15df0f02e3d2b410447a722). The label was applied at an earlier SHA, before main was merged in and #878's digest fix was ported.

CI: 532/532 checks green on the head commit (6 skipped by matrix rule).
Bugbot: reviewed 7e78c76 with no new issues, and no review threads are open.
Mergeable against main, with no conflicts.
Reviewer note: The port of Route Gradle digests through utils::digest #878 (the utils::digest routing) is included here. It becomes a no-op once Route Gradle digests through utils::digest #878 lands.

Generated by Claude Code

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) merged commit e3afc4f into main

Oct 7, 2026

538 checks passed

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) deleted the agent/fix-report-only-hint-global-scope branch

October 7, 2026 12:00

This was referenced Oct 9, 2026

apply --check drift report tells you to run socket-patch apply without the -g / --global-prefix / --cwd it was given, so following it patches nothing and exits 0 #1219

Closed

Fix apply --check remedy dropping scope flags (#1219) #1325

Merged

Reviewers

cursor[bot]

cursor[bot] left review comments

Tanmay Singla (Tanmay182003)

Tanmay182003 approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

Ready for review

Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

A report-only scan -g tells you to run socket-patch scan --mode agent [PATHS] without -g, so following the hint scans the cwd project instead of the global install

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

LLM Description written by Claude Code:claude-opus-5-5

Summary

Root cause

Tests (red → green)

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 4, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 4, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Mikola Lysenko (mikolalysenko) commented Oct 4, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.