Repository navigation
Show when a patch needs an opt-in setting - #2085
Wenxin Jiang (Wenxin-Jiang) wants to merge 7 commits into
Conversation
Preserve optional activation metadata in manifest records and render it in get, list, apply, and OpenVEX output. Absent fields stay absent when serializing, so existing responses and manifests keep their current shape. Assisted-by: Claude Code:kimi-k3p1-pro
PR SummaryLow Risk Overview
Manifest and agent metadata persistence include the new fields (omitted when unset for backward compatibility). OpenVEX Reviewed by Cursor Bugbot for commit ef1586f. Configure here. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit ef1586f. Configure here.
| .into_iter() | ||
| .map(|e| tag_mode(e, Some("vendored"))), | ||
| ); | ||
| env.add_registered_opt_in_to_events(); |
There was a problem hiding this comment.
Scan JSON events omit opt-in details
Medium Severity
scan --json never calls register_opt_in, so Applied/vendored/hosted action events leave details without requiresOptIn and optInNote. The new add_registered_opt_in_to_events hook in merge_vendor_envelope therefore no-ops on scan, while get registers first and those events do carry the fields. Human scan output still prints the note from patch_block.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit ef1586f. Configure here.
Refresh same-UUID activation metadata, including clearing it, and record the new fields as known manifest keys. Hosted, repeated-agent, and dry-run scans render sanitized notes once per patch UUID. Link nested apply deduplication to the UUIDs its caller already showed. Enrich scan JSON events from both batch and detailed API records. Assisted-by: Claude Code:kimi-k3p1-pro
Suppress a nested note only when its UUID, flag, and full note match what the caller displayed. Keep changed API instructions visible. Strip control characters from decoded PURLs in note output. Add regressions for differing search/view notes, terminal controls, and UUID deduplication. Assisted-by: Claude Code:kimi-k3p1-pro
Fetched patch views now override search metadata in get and scan JSON, including changed or cleared instructions. Reused detached vendor records consume the same prefetched view and persist activation metadata even when artifacts and wiring need no work. Make the manifest schema-key test populate both records so its assertion is not HashMap-order dependent. Assisted-by: Claude Code:kimi-k3p1-pro
Fetch authoritative patch views for same-UUID detached reuse, including search-based reuse, while preserving existing fields offline. Move human activation notes after download and persistence. Use one shared formatter keyed by UUID and note, and carry that exact displayed metadata into nested apply deduplication. Assisted-by: Claude Code:kimi-k3p1-pro
Use fetched or persisted activation metadata after real downloads and one shared preview renderer for dry runs. Defer wet vendored output to the shared vendor step and cover agent, hosted, vendored, agent, apply, and list paths with a parameterized exact-once matrix. Keep unsupported save-only combinations as zero-request usage errors and preserve offline vendor activation metadata. Assisted-by: Claude Code:kimi-k3p1-pro
Register manifest and detached vendor metadata for both check JSON envelopes, including already-patched and drift events. Represent detached vendor state in manifest-free JSON without changing unrelated empty applies. Keep human output deduplicated by UUID and note, and leave direct UUID dry-run rendering to its preview layer. Extend the output matrix with human and JSON assertions for every mode and operation. Assisted-by: Claude Code:kimi-k3p1-pro
LLM Description written by Claude Code:claude-opus-5-5
When a Socket patch only protects users who turn on a setting, the CLI now says so.
get,listandapplyprint the patch's opt-in note, keep it in.socket/manifest.jsonand their JSON output, and add it to the OpenVEX impact statement. Before this, the CLI printed "Fixes", "Patched packages" and "already patched" with no hint that defaults stay vulnerable.Problem
Some advisories are fixed upstream only behind an option that is off by default. Socket research is starting to record this (
requiresOptInplusoptInNote), and the patches API will return both fields. The CLI's API types and manifest schema had nowhere to keep them, so the note would have been dropped, andvexwould have reported the package asnot_affectedwith only "Patched via Socket".Change
PatchResponse,PatchSearchResult,BatchPatchInfoand the manifestPatchRecordgain optionalrequiresOptInandoptInNote. Missing fields deserialize asNoneand are not written, so old manifests and API responses keep their exact shape in both directions.getkeeps both fields when writing the manifest.get,list,applyandscanoutput print the note for flagged patches. The note is printed as data: control sequences are stripped and multi-line notes are indented. JSON events carry the raw values underdetails.impact_statementappends the opt-in instruction. The VEX status itself is unchanged.Noneto struct literals for the new fields.Testing
cargo fmt --all -- --checkandcargo clippy --locked --workspace --all-features -- -D warningspass.cargo test --locked -p socket-patch-core: 8,425 passed, 0 failed.cargo test --locked -p socket-patch-cli --lib --test get --test cli --test apply --test vex --test scan: 1,619 passed, 0 failed.For the reviewer
🤖 Generated with Claude Code