Make scan exit alike in human and JSON output

A scan whose detail queries all succeeded but returned no records
exited 1 in human output ("could not fetch patch details") and 0 with
--json, so CI and a developer saw different results for the same API
state. Human --dry-run --prune also never previewed the GC that the
--json arm reports, and hosted --json passed the raw --prune flag
where the human arm used the policy-gated one.

Only a real fetch failure (every query errored) now fails either arm;
the human dry run previews the GC; hosted mode gets the gated prune in
both arms (#1062).

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-cli/src/commands/scan/hosted.rs

@@ -554,6 +554,9 @@ pub(super) async fn run_redirect(
     stage: &mut super::rollout::Stage,
     // Scan's pre-redirect lockfile discovery (see `rollout::Gate::prior`).
     prior: Option<super::rollout::Prior<'_>>,
+    // `--prune` / `--sync`, gated by the policy exactly as the human arm
+    // gates it (`patches.enabled: false` writes nothing, the GC included).
+    prune: bool,
 ) -> i32 {
     // Same discovery/selection as agent and vendored mode.
     let discovered = match discover_selected(
@@ -606,7 +609,7 @@ pub(super) async fn run_redirect(
     run_redirect_selected(
         &args.common,
         &args.vex,
-        args.prune || args.sync,
+        prune,
         api_client,
         &pairs,
         scan_result,

crates/socket-patch-cli/src/commands/scan/mod.rs

@@ -489,7 +489,6 @@ async fn discover_selected(
     // Some queries failed, some succeeded: a `--json` run has no stderr
     // warning (`warn` is human-only), so each failed package becomes a
     // run-level `warnings[]` entry — never a silent drop from the envelope.
-    let fetched = all_search_results.len();
     let offers = select_accessible(all_search_results, can_access_paid_patches, policy);
     if let Some(result) = json_warnings {
         for (purl, e) in &failures {
@@ -503,18 +502,15 @@ async fn discover_selected(
     }
     Ok(Discovered {
         offers,
-        fetched,
         failed: failures,
     })
 }
 
-/// [`discover_selected`]'s result: the offers, how many records came back
-/// (before the tier filter), and each failed detail query as `(purl,
-/// error)` (a failure for a package with no recorded patch makes a capped
-/// run's data incomplete).
+/// [`discover_selected`]'s result: the offers and each failed detail
+/// query as `(purl, error)` (a failure for a package with no recorded
+/// patch makes a capped run's data incomplete).
 struct Discovered {
     offers: rollout::Offers,
-    fetched: usize,
     failed: Vec<(String, String)>,
 }
 
@@ -2544,6 +2540,7 @@ async fn run_scan(
                 batch_error_count > 0,
                 &mut stage,
                 prior_discovery,
+                prune,
             )
             .await;
         }
@@ -2843,10 +2840,11 @@ async fn run_scan(
 
     // The by-package records every arm selects from, fetched before the
     // table so its `[UPDATE]` markers are the same UPGRADE rows the
-    // selection acts on (§5.1). Discovery said these packages HAVE
-    // patches, so an empty merged set is a fetch failure.
-    // A failed discovery still prints the table first; its exit code is
-    // returned below it.
+    // selection acts on (§5.1). Only `discover_selected`'s own `Err`
+    // (every query failed) is a fetch failure: queries that succeed with
+    // no records leave nothing to select, in every arm and in `--json`
+    // alike (#1062). A failed discovery still prints the table first; its
+    // exit code is returned below it.
     let mut discovery_failure: Option<i32> = None;
     let rows: Vec<rollout::Row> = if downloadable_count == 0 {
         Vec::new()
@@ -2864,13 +2862,6 @@ async fn run_scan(
         )
         .await
         {
-            // The agent / vendored / report-only arms need records to show:
-            // an empty merged set is a fetch failure there.
-            Ok(discovered) if !hosted && discovered.fetched == 0 => {
-                eprintln!("{}", render::fetch_details_failed(&discovered.failed));
-                discovery_failure = Some(1);
-                Vec::new()
-            }
             Ok(discovered) => {
                 let rows = classified_rows(
                     &mut stage,
@@ -3228,6 +3219,19 @@ async fn run_scan(
             }
         }
         print_rollout_human(&stage, true, silent);
+        // `finish_human` previews the agent / report-only GC; vendored
+        // runs its own GC, so its dry run previews it here, as the
+        // `--json` arm reports it in `gc`.
+        if prune && vendor {
+            gc::run_human_gc(
+                &args.common,
+                &manifest_path,
+                &socket_dir,
+                &scanned_purls,
+                &vendored_purls,
+            )
+            .await;
+        }
         return finish_human(0).await;
     }
 

crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs

@@ -2852,13 +2852,18 @@ async fn scan_empty_detail_results_exit_alike_in_human_and_json() {
     }
 }
 
-/// #1062: a human `--dry-run --prune` previews the GC the `--json` arm
-/// previews (`gc` block), instead of skipping it.
+/// #1062: a human `--dry-run --prune` previews the GC (once) in every
+/// mode the `--json` arm previews it (`gc` block); vendored skipped it.
 #[tokio::test]
 async fn scan_dry_run_prune_previews_gc_in_human_and_json() {
     let purl = "pkg:npm/minimist@1.2.2";
     let stale = "pkg:npm/left-pad@1.3.0";
-    for mode in [&["--mode", "agent"][..], &["--prune"][..]] {
+    // Agent, vendored, and report-only (no mode; `--prune` below).
+    for mode in [
+        &["--mode", "agent"][..],
+        &["--mode", "vendored"][..],
+        &[][..],
+    ] {
         let mock = MockServer::start().await;
         mount_batch_one(&mock, purl, UUID, "free", &[], false).await;
         mount_by_package(&mock, purl, UUID, serde_json::json!({})).await;
@@ -2887,9 +2892,12 @@ async fn scan_dry_run_prune_previews_gc_in_human_and_json() {
                     "{extra:?}: {v}"
                 );
             } else {
-                assert!(
-                    stdout.contains("[dry-run] GC would prune 1 manifest entry"),
-                    "{extra:?}: the human dry run previews the GC; stdout={stdout}"
+                assert_eq!(
+                    stdout
+                        .matches("[dry-run] GC would prune 1 manifest entry")
+                        .count(),
+                    1,
+                    "{extra:?}: the human dry run previews the GC once; stdout={stdout}"
                 );
             }
             assert_eq!(

crates/socket-patch-cli/tests/in_process_scan.rs

@@ -930,10 +930,13 @@ async fn scan_non_json_with_patches_prints_table() {
 
     let code = run_scrubbed(args).await;
     // Non-JSON path: discovery → batch query → render table → fetch
-    // per-package details. We only mount the batch mock, so detail-fetch
-    // 404s and scan exits 1 ("Error: could not fetch patch details"). That exit is
-    // deterministic given these mocks.
-    assert_eq!(code, 1, "missing detail mock → detail fetch fails → exit 1");
+    // per-package details. We only mount the batch mock, so the detail
+    // query 404s, which the client reads as "no records": nothing to
+    // select, a clean exit 0, exactly like the `--json` arm (#1062).
+    assert_eq!(
+        code, 0,
+        "an empty detail result is no patch to apply, not a failure"
+    );
     // Prove the table-rendering path actually ran against real discovered
     // data: the batch endpoint was queried with the package, and the path
     // proceeded to the per-package detail fetch (i.e. it had a row to print).