Report hosted-mode adoption and self-update in telemetry

[Mikola Lysenko (mikolalysenko)]

Summary

This PR audits socket-patch telemetry against depscan's v0 /orgs/:slug/telemetry handler and the patches API proxy, and fixes the gaps.

• Wire format was already compatible. All 17 existing event types were in depscan's patch event map. The proxy forwards the body unchanged. Events carry no event_kind, so depscan stores them as required events even without org opt-in.
• Hosted-mode installs were invisible. v5 made --mode hosted the default for scan, but the hosted path sent no outcome event. A default scan therefore recorded only patch_scanned, never patch_applied, and adoption dropped out of the patch-adoption dashboard. scan/get --mode hosted now send patch_applied (or patch_apply_failed) with mode: "hosted", patches_count and files_count. The success event is sent before the result prints, so a closed stdout can't drop it. Agent-mode apply events gain mode: "agent".
• Self-update had no telemetry. socket-patch --update now sends cli_updated (from_version, to_version, channel, pinned, forced) or cli_update_failed (the envelope's error_code plus the message). The new types need SocketDev/depscan#27684. Without it they're stored as external.
• patch_scanned.ecosystems now lists the ecosystems the crawl found. It previously echoed the --ecosystems filter, which is empty on every default run.
• Mode adoption by client version: patch_scanned gains mode and project_modes. mode is what the run was asked for (hosted / vendored / agent, or report with none). project_modes is what the project is already wired for (hosted lockfile pins, a vendor ledger, an agent manifest). Every event already carries context.version, so this gives mode usage per client version from the one event every scan sends.
• Contract test: a core test pins depscan's accepted event types and the body shape its handler extracts.
• Docs: CLI_CONTRACT.md gains a table of which command sends which event.

Test plan

• New core tests: backend event-type contract, wire shape, each new tracker against wiremock
• New e2e tests: requested/project modes on scan and re-scan, hosted scan success/failure, get --mode hosted, self-update success/failure/--offline
• Regression: CLI lib + update/get/scan/cli/hosted/redirect/self-update suites, 1,805 tests green locally
• cargo clippy --locked --workspace --all-features -- -D warnings, cargo fmt --check

Merge depscan#27684 first or alongside. A depscan submodule bump afterwards lets 82_socket-patch-telemetry-coverage.ts exercise these paths end to end.

🤖 Generated with Claude Code

---

Note

Low Risk
Changes are limited to optional telemetry payloads and timing; patch/redirect behavior is unchanged aside from when events fire.

Overview
Hosted-mode scan/get now emit adoption telemetry so default v5 scans show up on patch-adoption dashboards: non-empty hosted redirects send patch_applied with mode: "hosted", patches_count, and files_count (or patch_apply_failed on early exit), with context.command set to scan or get. Agent apply paths tag existing apply events with mode: "agent".

socket-patch --update reports cli_updated (versions, install channel, pin/force flags) or cli_update_failed (envelope error_code plus message), sent before human/JSON output like other commands.

patch_scanned metadata now lists ecosystems discovered from crawled PURLs via scanned_ecosystems, not the often-empty --ecosystems filter.

Contract and tests: CLI_CONTRACT.md documents per-command events; socket-patch-core adds trackers, a depscan event-type allowlist test, and wire-shape checks; new e2e coverage for hosted scan/get and self-update (including --offline sending nothing).

^{Reviewed by Cursor Bugbot for commit ea70e1b. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ea70e1b. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[final reviewer] Not enqueuing. Tanmay Singla (@Tanmay182003), two non-merge commits landed after your approval at ea70e1b2:

• 7a00157a Report requested and wired patch modes in patch_scanned (commands/scan/mod.rs, telemetry_e2e.rs, redirect/upstream/mod.rs, CLI_CONTRACT.md, +162/-10)
• 7f842ce0 Drop an unrelated rustfmt change to upstream/mod.rs (+1/-4)

There is also 1 open review thread. Please take another look at 7a00157a in particular, since it adds new telemetry fields.

---

Generated by Claude Code