@@ -1050,11 +1050,11 @@ State lives at `$XDG_CACHE_HOME`|`~/.cache` (Unix/macOS) or `%LOCALAPPDATA%` (Wi
 
 ## Telemetry events
 
-Each command POSTs its outcome as one JSON event (`{event_sender_created_at, event_type, context: {version, platform, arch, command}, session_id, metadata?, error?: {type, message}}`; no `event_kind`, so the backend stores it as a required event) to `<api>/v0/orgs/<org>/telemetry` with the bearer when the run has a token and an org, else anonymously to `<proxy>/patch/telemetry`. `--no-telemetry`/`SOCKET_TELEMETRY_DISABLED`, `SOCKET_OFFLINE`/`--offline` and `VITEST=true` send nothing. Error messages have the home directory replaced by `~`. Every `event_type` must be in depscan's patch event map (`telemetry-discriminators.ts`), or it is stored as `external` and drops out of the patch dashboards; `telemetry.rs` pins that list in a test.
+Each command POSTs its outcome as one JSON event (`{event_sender_created_at, event_type, context: {version, platform, arch, command}, session_id, metadata?, error?: {type, message}}`; no `event_kind`, so the backend stores it as a required event) to `<api>/v0/orgs/<org>/telemetry` with the bearer when the run has a token and an org, else anonymously to `<proxy>/patch/telemetry`. `--no-telemetry`/`SOCKET_TELEMETRY_DISABLED`, `SOCKET_OFFLINE`/`--offline` and `VITEST=true` send nothing. Every event's `context.version` is the client version. Error messages have the home directory replaced by `~`. Every `event_type` must be in depscan's patch event map (`telemetry-discriminators.ts`), or it is stored as `external` and drops out of the patch dashboards; `telemetry.rs` pins that list in a test.
 
 | Command | Success | Failure | Metadata |
 |---|---|---|---|
-| `scan` | `patch_scanned` | `patch_scan_failed` | `packages_scanned`, `free_patches`, `paid_patches`, `can_access_paid`, `ecosystems` (found by the crawl), `fallback_to_proxy` |
+| `scan` | `patch_scanned` | `patch_scan_failed` | `packages_scanned`, `free_patches`, `paid_patches`, `can_access_paid`, `ecosystems` (found by the crawl), `fallback_to_proxy`, `mode` (requested: `hosted` / `vendored` / `agent`, or `report` with none), `project_modes` (already wired: `hosted` lockfile pins, `vendored` ledger, `agent` manifest) |
 | `scan`/`get --mode hosted` (non-empty selection) | `patch_applied` | `patch_apply_failed` | `mode: "hosted"`, `patches_count` (pins confirmed), `files_count` (files rewritten), `dry_run` |
 | `apply` (and the nested apply of `scan`/`get --mode agent`) | `patch_applied` | `patch_apply_failed` | `mode: "agent"`, `patches_count`, `dry_run` |
 | `vendor` / `scan`/`get --mode vendored` | `patch_vendored` | `patch_vendor_failed` | `patches_count`, `dry_run` |
 
@@ -1963,6 +1963,23 @@ async fn run_scan(
             read_set: read_set.as_ref(),
         })
     };
+    // Telemetry: the mode this run was asked for, and the modes the
+    // project is already wired for (it may hold more than one mid-migration).
+    let requested_mode = args.mode.map_or("report", ScanMode::cli_name);
+    let project_modes: Vec<&str> = [
+        (
+            !hosted_pin_list.is_empty() || !hosted_unlocked_pins.is_empty(),
+            "hosted",
+        ),
+        (!vendored_purls.is_empty(), "vendored"),
+        (
+            existing_manifest.is_some_and(|m| !m.patches.is_empty()),
+            "agent",
+        ),
+    ]
+    .into_iter()
+    .filter_map(|(present, mode)| present.then_some(mode))
+    .collect();
     let hosted_state = (!args.common.is_global())
         .then(|| crate::commands::hosted_state_from_pins(&hosted_pin_list));
     let redirect_state = hosted_state.as_ref();
@@ -2140,7 +2157,18 @@ async fn run_scan(
             }
         }
         // Telemetry: empty-scan still counts as a successful scan.
-        spawn_patch_scanned(telemetry, 0, 0, 0, false, &[], false, &telemetry_auth);
+        spawn_patch_scanned(
+            telemetry,
+            0,
+            0,
+            0,
+            false,
+            &[],
+            false,
+            requested_mode,
+            &project_modes,
+            &telemetry_auth,
+        );
         // The result prints right away: nothing to overlap the send with.
         telemetry.flush().await;
         if args.common.json {
@@ -2458,6 +2486,8 @@ async fn run_scan(
         can_access_paid_patches,
         &scanned_ecosystems(&all_purls),
         fallback_to_proxy,
+        requested_mode,
+        &project_modes,
         &telemetry_auth,
     );
 
 
@@ -1077,7 +1077,7 @@ async fn scan_delivers_telemetry_before_writing_to_a_closed_stderr() {
 const HOSTED_NAME: &str = "telemetry-hosted";
 const HOSTED_PURL: &str = "pkg:npm/telemetry-hosted@1.0.0";
 const HOSTED_UUID: &str = "11111111-1111-4111-8111-111111111111";
-const HOSTED_URL: &str = "http://patch.test/patch/npm/telemetry-hosted/1.0.0/22222222-2222-4222-8222-222222222222/11111111-1111-4111-8111-111111111111/telemetry-hosted-1.0.0.tgz";
+const HOSTED_URL: &str = "https://patch.socket.dev/patch/npm/telemetry-hosted/1.0.0/22222222-2222-4222-8222-222222222222/11111111-1111-4111-8111-111111111111/telemetry-hosted-1.0.0.tgz";
 
 /// An npm project whose lockfile resolves [`HOSTED_NAME`] upstream (the
 /// `covgap_commands_scan_hosted.rs` `write_npm_project` shape).
@@ -1225,6 +1225,9 @@ async fn hosted_scan_reports_patch_applied_with_hosted_mode() {
         scanned["metadata"]["ecosystems"],
         serde_json::json!(["npm"])
     );
+    // Default mode, on a project nothing is wired into yet.
+    assert_eq!(scanned["metadata"]["mode"], "hosted");
+    assert_eq!(scanned["metadata"]["project_modes"], serde_json::json!([]));
     assert_eq!(scanned["metadata"]["free_patches"], 1);
 
     let applied = &bodies[1];
@@ -1245,6 +1248,80 @@ async fn hosted_scan_reports_patch_applied_with_hosted_mode() {
         applied["session_id"], scanned["session_id"],
         "one run, one session"
     );
+
+    // A re-scan sees the hosted pins the first run wrote.
+    let (code, stdout, stderr) = run_cmd(tmp.path(), &mock.uri(), "scan", &[], &[]);
+    assert_eq!(code, 0, "stdout:\n{stdout}\nstderr:\n{stderr}");
+    let bodies = telemetry_bodies(&mock).await;
+    let rescanned = bodies
+        .iter()
+        .filter(|b| b["event_type"] == "patch_scanned")
+        .nth(1)
+        .expect("the re-scan's patch_scanned");
+    assert_eq!(
+        rescanned["metadata"]["project_modes"],
+        serde_json::json!(["hosted"])
+    );
+    assert_ne!(rescanned["session_id"], scanned["session_id"]);
+}
+
+/// `patch_scanned` carries the requested mode and the modes the project is
+/// already wired for: here an agent manifest, scanned with `--mode agent`.
+#[tokio::test]
+async fn scan_reports_requested_and_project_modes() {
+    let mock = setup_mock(
+        serde_json::json!({ "packages": [], "canAccessPaidPatches": false }),
+        None,
+    )
+    .await;
+    let tmp = tempfile::tempdir().expect("tempdir");
+    write_root_package_json(tmp.path());
+    write_npm_package(tmp.path(), "minimist", "1.2.2");
+    let socket = tmp.path().join(".socket");
+    std::fs::create_dir_all(&socket).unwrap();
+    std::fs::write(
+        socket.join("manifest.json"),
+        serde_json::json!({
+            "patches": {
+                "pkg:npm/minimist@1.2.2": {
+                    "uuid": "33333333-3333-4333-8333-333333333333",
+                    "exportedAt": "2024-01-01T00:00:00Z",
+                    "files": {},
+                    "vulnerabilities": {},
+                    "description": "x",
+                    "license": "MIT",
+                    "tier": "free"
+                }
+            }
+        })
+        .to_string(),
+    )
+    .unwrap();
+
+    let (code, stdout, stderr) = run_cmd(
+        tmp.path(),
+        &mock.uri(),
+        "scan",
+        &["--mode", "agent", "--dry-run"],
+        &[],
+    );
+    assert_eq!(code, 0, "stdout:\n{stdout}\nstderr:\n{stderr}");
+
+    let bodies = telemetry_bodies(&mock).await;
+    let scanned = bodies
+        .iter()
+        .find(|b| b["event_type"] == "patch_scanned")
+        .unwrap_or_else(|| panic!("no patch_scanned: {bodies:#?}"));
+    assert_eq!(scanned["metadata"]["mode"], "agent");
+    assert_eq!(
+        scanned["metadata"]["project_modes"],
+        serde_json::json!(["agent"])
+    );
+    assert_eq!(
+        scanned["context"]["version"],
+        env!("CARGO_PKG_VERSION"),
+        "every event carries the client version"
+    );
 }
 
 /// A hosted run that fails after selecting patches reports
 
@@ -917,7 +917,10 @@ mod tests {
     fn bun_lock_remedies_name_the_forced_reinstall() {
         for file in ["bun.lockb", "bun.lock", "packages/app/bun.lockb"] {
             let remedy = checkout_remedy(&[file.to_string()]);
-            assert!(remedy.contains(&format!("`git checkout -- {file}`")), "{remedy}");
+            assert!(
+                remedy.contains(&format!("`git checkout -- {file}`")),
+                "{remedy}"
+            );
             assert!(remedy.ends_with(
                 ", then run `bun install --force` (a plain `bun install` keeps the patched copy)"
             ), "{remedy}");
 
@@ -654,9 +654,12 @@ pub async fn track_patch_rollback_failed(error: impl std::fmt::Display, auth: &T
 // ---------------------------------------------------------------------------
 
 /// The whole `patch_scanned` event — type, command and metadata (per-tier
-/// patch counts and whether the call was downgraded to the public proxy
-/// after an auth-endpoint 401/403). Both wrappers below build their event
-/// here, so the inline and background paths can never drift apart.
+/// patch counts, whether the call was downgraded to the public proxy
+/// after an auth-endpoint 401/403, the mode the run was asked for —
+/// `hosted` / `vendored` / `agent`, or `report` with none — and the modes
+/// the project is already wired for, from its hosted lockfile pins, vendor
+/// ledger and agent manifest). Both wrappers below build their event here,
+/// so the inline and background paths can never drift apart.
 #[allow(clippy::too_many_arguments)]
 fn prepare_patch_scanned(
     packages_scanned: usize,
@@ -665,6 +668,8 @@ fn prepare_patch_scanned(
     can_access_paid: bool,
     ecosystems: &[String],
     fallback_to_proxy: bool,
+    mode: &str,
+    project_modes: &[&str],
     auth: &TelemetryAuth,
 ) -> Option<PreparedSend> {
     prepare(
@@ -677,6 +682,8 @@ fn prepare_patch_scanned(
             "can_access_paid": can_access_paid,
             "ecosystems": ecosystems,
             "fallback_to_proxy": fallback_to_proxy,
+            "mode": mode,
+            "project_modes": project_modes,
         }),
         None::<&str>,
         auth,
@@ -704,6 +711,8 @@ pub async fn track_patch_scanned(
     can_access_paid: bool,
     ecosystems: &[String],
     fallback_to_proxy: bool,
+    mode: &str,
+    project_modes: &[&str],
     auth: &TelemetryAuth,
 ) {
     fire_prepared(prepare_patch_scanned(
@@ -713,6 +722,8 @@ pub async fn track_patch_scanned(
         can_access_paid,
         ecosystems,
         fallback_to_proxy,
+        mode,
+        project_modes,
         auth,
     ))
     .await;
@@ -730,6 +741,8 @@ pub fn spawn_patch_scanned(
     can_access_paid: bool,
     ecosystems: &[String],
     fallback_to_proxy: bool,
+    mode: &str,
+    project_modes: &[&str],
     auth: &TelemetryAuth,
 ) {
     pending.spawn_prepared(prepare_patch_scanned(
@@ -739,6 +752,8 @@ pub fn spawn_patch_scanned(
         can_access_paid,
         ecosystems,
         fallback_to_proxy,
+        mode,
+        project_modes,
         auth,
     ));
 }
@@ -1121,8 +1136,30 @@ mod tests {
         let ecosystems = vec!["npm".to_string(), "pypi".to_string()];
         let auth = TelemetryAuth::from_credentials(None, None);
         let mut pending = PendingTelemetry::new();
-        track_patch_scanned(5, 3, 2, true, &ecosystems, true, &auth).await;
-        spawn_patch_scanned(&mut pending, 5, 3, 2, true, &ecosystems, true, &auth);
+        track_patch_scanned(
+            5,
+            3,
+            2,
+            true,
+            &ecosystems,
+            true,
+            "hosted",
+            &["vendored"],
+            &auth,
+        )
+        .await;
+        spawn_patch_scanned(
+            &mut pending,
+            5,
+            3,
+            2,
+            true,
+            &ecosystems,
+            true,
+            "hosted",
+            &["vendored"],
+            &auth,
+        );
         pending.flush().await;
         track_patch_scan_failed("all batches failed", true, &auth).await;
         spawn_patch_scan_failed(&mut pending, "all batches failed", true, &auth);
@@ -1151,6 +1188,11 @@ mod tests {
         assert_eq!(bodies[0]["event_type"], "patch_scanned");
         assert_eq!(bodies[0]["context"]["command"], "scan");
         assert_eq!(bodies[0]["metadata"]["free_patches"], 3);
+        assert_eq!(bodies[0]["metadata"]["mode"], "hosted");
+        assert_eq!(
+            bodies[0]["metadata"]["project_modes"],
+            serde_json::json!(["vendored"])
+        );
         assert_eq!(bodies[2]["event_type"], "patch_scan_failed");
         assert_eq!(bodies[2]["context"]["command"], "scan");
         assert_eq!(bodies[2]["error"]["message"], "all batches failed");