Fix the defects found by the 5.1.0 full review: do no harm, Bundler hosted mode, VEX, monorepo scans

Cargo.toml

@@ -21,7 +21,7 @@ repository = "https://github.com/SocketDev/socket-patch"
 
 [workspace.dependencies]
 socket-patch-core = { path = "crates/socket-patch-core", version = "=5.1.0" }
-clap = { version = "=4.5.60", features = ["derive", "env"] }
+clap = { version = "=4.5.60", features = ["derive", "env", "wrap_help"] }
 serde = { version = "=1.0.228", features = ["derive"] }
 serde_json = { version = "=1.0.149", features = ["preserve_order", "raw_value"] }
 sha2 = "=0.10.9"

README.md

@@ -5,10 +5,7 @@ without waiting for an upstream release or upgrading the dependency.
 Socket Patch updates dependency files to use patched packages, which you install
 with your normal package manager.
 
-> This branch documents the v5 prerelease. Installation commands below select the
-> latest published release, which may have different behavior. To try this branch,
-> [build from source](docs/development.md#build). Existing users should read the
-> [v5 migration guide](docs/migrating-to-v5.md).
+> Upgrading from v4? Read the [v5 migration guide](docs/migrating-to-v5.md).
 
 ## Installation
 
@@ -102,10 +99,33 @@ control. See [usage and recovery](docs/usage.md).
 Use `socket-patch <command> --help` for options and
 [`socket.yml`](docs/configuration.md#repository-patch-policy) for a shared rollout policy.
 
+## Telemetry
+
+Socket Patch sends usage telemetry by default: each command reports its outcome
+to Socket as a small JSON event. An event holds the event name (for example
+`patch_applied` or `patch_scan_failed`), the subcommand, the CLI version, the
+operating system and CPU architecture, a timestamp, a random ID generated for
+that one run, and a few counters and flags for the command (such as patches
+applied, packages scanned, ecosystems found, the patch mode, `dry_run`). `get`
+adds the patch UUID. A failure adds the error message, with URL credentials
+redacted and your home directory replaced by `~`. Apart from what an error
+message quotes, events hold no package names, file paths, file contents, or
+dependency lists.
+
+Events go to `api.socket.dev` with your API token when a token and organization
+are configured, otherwise anonymously to `patches-api.socket.dev`. They are sent
+in the background: a command never waits for telemetry before it prints, a
+failed send changes nothing, and an unreachable endpoint adds at most 300 ms to
+the exit.
+
+To turn telemetry off, pass `--no-telemetry` or set `SOCKET_TELEMETRY_DISABLED=1`
+or `DO_NOT_TRACK=1`. `--offline` / `SOCKET_OFFLINE=1` sends nothing either. See
+[configuration](docs/configuration.md#telemetry) for every event, field, and switch.
+
 ## Documentation
 
 - [Usage](docs/usage.md): targeting, CI, vendoring, agent mode, VEX, and recovery.
-- [Configuration](docs/configuration.md): authentication, environment, and rollout policy.
+- [Configuration](docs/configuration.md): authentication, environment, telemetry, and rollout policy.
 - [Ecosystem support](docs/ecosystems.md): package-manager formats and limitations.
 - [Migrating to v5](docs/migrating-to-v5.md): changed defaults and retired install hooks.
 - [CLI contract](crates/socket-patch-cli/CLI_CONTRACT.md): flags, JSON, diagnostics, and exit codes.

crates/socket-patch-cli/Cargo.toml

@@ -33,8 +33,8 @@ glob = { workspace = true }
 tempfile = { workspace = true }
 
 [target.'cfg(unix)'.dependencies]
-# main.rs restores the default SIGPIPE disposition so piped invocations
-# (`socket-patch scan | head -1`) die quietly instead of panicking.
+# interrupt.rs installs the signal handlers that remove a held lock, and
+# keeps SIGPIPE ignored so a closed output pipe cannot end a run mid-write.
 libc = { workspace = true }
 
 [target.'cfg(windows)'.dependencies]