get <uuid> overrides socket.yml without the documented policy_bypassed warning (purl/CVE/GHSA forms do warn) #453

[agent] Found by the scheduled Pipenv bug-hunt routine (ledger #313).

Summary

The contract says get ignores socket.yml but has to say so when it does. When the repo's socket.yml would have skipped the package, get must warn policy_bypassed, both in warnings[] and on stderr. The purl, CVE and GHSA forms of get do this. The UUID form doesn't. get <uuid> takes an early-return path straight into the mode dispatch, and that path never calls policy_bypass_warnings. The package gets patched in every mode (agent, hosted, vendored) with exit 0, no stderr line, and no warnings key in the --json envelope.

I found this on a Pipenv project, but the code path doesn't depend on the ecosystem.

Impact

policy_bypassed is the only signal that a run overrode the repository's rollout policy (ignorePackages, ecosystems, includePaths/ignorePaths, minSeverity, enabled: false). A UUID is the identifier that dashboards, bots and the scan table all hand out. So the most common scripted get can push a patch the repo explicitly excluded (for example enabled: false during a freeze) and leave nothing in CI logs or JSON output to flag it.

Repro (Linux, main 2463257, Pipenv 2026.8.0 project, local mock patch API)

git init -q proj && cd proj
# Pipfile + Pipfile.lock pinning six==1.16.0 (pipfile-spec 6)
printf 'version: 2\npatches:\n  ignorePackages: ["pkg:pypi/six"]\n' > socket.yml
socket-patch get pkg:pypi/six@1.16.0 --mode hosted --yes --json | jq .warnings
#   ["(policy_bypassed) pkg:pypi/six@1.16.0 would be skipped by socket.yml (policy_package_ignored: pkg:pypi/six (patches.ignorePackages)); get patches it anyway"]
git checkout Pipfile.lock 2>/dev/null || cp Pipfile.lock.orig Pipfile.lock
socket-patch get <uuid-of-that-patch> --mode hosted --yes --json | jq .warnings
#   null   (Pipfile.lock is rewritten, exit 0, nothing on stderr)

Results from two runs, each identical:

Expected vs actual

• Expected: crates/socket-patch-cli/CLI_CONTRACT.md (socket.yml, "Commands") says: "get is explicit intent: it ignores the policy and warns policy_bypassed (in warnings[], and on stderr) when socket.yml would have skipped the package". docs/configuration.md says the same: "it bypasses policy and warns when a valid policy would exclude its target". Neither carves out the UUID form.
• Actual: only the search-backed forms warn. The UUID form patches silently.

OS × version

First bad

socket.yml arrived with #277 (2463257) and isn't in any published release (v4.0.0 predates it). So the bug has been there since the feature landed.

Suspect code

• crates/socket-patch-cli/src/commands/get.rs:2603-2700: the IdentifierType::Uuid branch returns from the match mode dispatch (save_and_apply_patch / run_get_hosted(…, &[], &[]) / run_get_vendored(…, &[], &[])) with empty warning lists.
• crates/socket-patch-cli/src/commands/get.rs:2929-2933: the only call site of super::scan::policy::policy_bypass_warnings, which only the search path reaches.

Backlog review — 2026-10-08

Priority: P1 → P2. Explicit get intentionally overrides policy; the bug is the missing bypass warning across target forms. Preserve the functional fix, but P1 overstates the current impact.