Render opt-in notes once on every path

Use fetched or persisted activation metadata after real downloads and one shared preview renderer for dry runs. Defer wet vendored output to the shared vendor step and cover agent, hosted, vendored, agent, apply, and list paths with a parameterized exact-once matrix.

Keep unsupported save-only combinations as zero-request usage errors and preserve offline vendor activation metadata.

Assisted-by: Claude Code:kimi-k3p1-pro

Author: Wenxin-Jiang

crates/socket-patch-cli/src/commands/apply.rs

@@ -603,6 +603,21 @@ async fn run_check(args: &ApplyArgs, manifest_path: &Path) -> i32 {
         }
     }
 
+    if !args.common.json && !args.common.silent {
+        if let Some(notes) =
+            crate::ui::opt_in_note_block(manifest.patches.iter().map(|(purl, record)| {
+                crate::ui::OptInEntry {
+                    purl,
+                    uuid: &record.uuid,
+                    requires_opt_in: record.requires_opt_in,
+                    opt_in_note: record.opt_in_note.as_deref(),
+                }
+            }))
+        {
+            println!("\n{notes}");
+        }
+    }
+
     if drifts.is_empty() {
         if args.common.json {
             let mut env = Envelope::new(Command::Apply);
@@ -1333,6 +1348,7 @@ pub async fn run(args: ApplyArgs) -> i32 {
                 _ => {}
             }
         }
+        print_vendor_opt_in_notes(&args.common).await;
         return i32::from(matches!(vex_result, Some(ManifestlessVex::Failed(_))));
     }
 
@@ -1502,6 +1518,27 @@ fn collect_apply_outcomes(
     (applied, skipped)
 }
 
+async fn print_vendor_opt_in_notes(common: &GlobalArgs) {
+    if common.json || common.silent || common.is_global() {
+        return;
+    }
+    let Ok(state) = socket_patch_core::vendor::load_state(&common.cwd).await else {
+        return;
+    };
+    let entries = state.entries.values().filter_map(|entry| {
+        let record = entry.record.as_ref()?;
+        Some(crate::ui::OptInEntry {
+            purl: &entry.base_purl,
+            uuid: &record.uuid,
+            requires_opt_in: record.requires_opt_in,
+            opt_in_note: record.opt_in_note.as_deref(),
+        })
+    });
+    if let Some(notes) = crate::ui::opt_in_note_block(entries) {
+        println!("\n{notes}");
+    }
+}
+
 type OptInPatches = Vec<(String, String, Option<bool>, Option<String>)>;
 
 fn opt_in_patches(manifest: &PatchManifest) -> OptInPatches {

crates/socket-patch-cli/src/commands/get.rs

@@ -1356,7 +1356,7 @@ pub async fn run(args: GetArgs) -> i32 {
                         .await
                     }
                 };
-                if !quiet {
+                if !quiet && mode == super::scan::ScanMode::Agent {
                     if let Some(notes) =
                         crate::ui::opt_in_note_block([crate::ui::OptInEntry::from_response(&patch)])
                     {
@@ -1925,6 +1925,11 @@ async fn agent_dry_run(
         for line in &lines {
             println!("{line}");
         }
+        if let Some(notes) =
+            crate::ui::opt_in_preview(selected.iter().map(crate::ui::OptInEntry::from_search))
+        {
+            println!("\n{notes}");
+        }
         let action = if args.save_only {
             "download and record"
         } else {
@@ -2371,6 +2376,11 @@ async fn run_get_vendored(
             emit(&env);
         } else if !args.common.silent {
             preview.print_human();
+            if let Some(notes) =
+                crate::ui::opt_in_preview(selected.iter().map(crate::ui::OptInEntry::from_search))
+            {
+                println!("\n{notes}");
+            }
         }
         return 0;
     }
@@ -2501,11 +2511,6 @@ async fn run_get_vendored(
             1
         }
     };
-    if !args.common.json && !args.common.silent {
-        if let Some(notes) = env.opt_in_note_block() {
-            println!("\n{notes}");
-        }
-    }
     code
 }
 

crates/socket-patch-cli/src/commands/list.rs

@@ -274,7 +274,12 @@ fn field(indent: &str, label: &str, value: &str) -> Option<String> {
 }
 
 /// One entry of the human listing (no trailing newline).
+#[cfg(test)]
 fn format_entry(entry: &ListEntry<'_>, color: bool) -> String {
+    format_entry_inner(entry, color, true)
+}
+
+fn format_entry_inner(entry: &ListEntry<'_>, color: bool, show_opt_in: bool) -> String {
     let patch = entry.record;
     let mut lines = vec![format!("Package: {}", sanitize(entry.purl))];
     lines.extend(field("  ", "UUID", &patch.uuid));
@@ -293,7 +298,7 @@ fn format_entry(entry: &ListEntry<'_>, color: bool) -> String {
     lines.extend(field("  ", "License", &patch.license));
     lines.extend(field("  ", "Exported", &patch.exported_at));
     lines.extend(field("  ", "Description", &patch.description));
-    if patch.requires_opt_in == Some(true) {
+    if show_opt_in && patch.requires_opt_in == Some(true) {
         if let Some(note) = &patch.opt_in_note {
             lines.extend(field("  ", "Opt-in required", note));
         }
@@ -348,7 +353,22 @@ fn format_listing(entries: &[ListEntry<'_>], color: bool) -> String {
         "Found {}:\n\n",
         crate::ui::plural(entries.len(), "patch", "patches")
     );
-    let blocks: Vec<String> = entries.iter().map(|e| format_entry(e, color)).collect();
+    let mut shown_opt_ins = std::collections::HashSet::new();
+    let blocks: Vec<String> = entries
+        .iter()
+        .map(|entry| {
+            let show_opt_in = match (
+                entry.record.requires_opt_in,
+                entry.record.opt_in_note.as_deref(),
+            ) {
+                (Some(true), Some(note)) if !note.trim().is_empty() => {
+                    shown_opt_ins.insert((entry.record.uuid.as_str(), note))
+                }
+                _ => false,
+            };
+            format_entry_inner(entry, color, show_opt_in)
+        })
+        .collect();
     out.push_str(&blocks.join("\n\n"));
     out
 }
@@ -1231,6 +1251,21 @@ mod tests {
         assert!(out.contains("      Summary: 漏洞\n"), "{out}");
     }
 
+    #[test]
+    fn format_listing_deduplicates_identical_opt_in_notes_per_uuid() {
+        let mut manifest = sample_manifest();
+        let mut other = manifest.patches["pkg:npm/minimist@1.2.2"].clone();
+        other.requires_opt_in = Some(true);
+        other.opt_in_note = Some("Enable safe mode.".into());
+        manifest.patches.insert("pkg:npm/other@1.0.0".into(), other);
+        let first = manifest.patches.get_mut("pkg:npm/minimist@1.2.2").unwrap();
+        first.requires_opt_in = Some(true);
+        first.opt_in_note = Some("Enable safe mode.".into());
+
+        let out = format_listing(&combined_entries(Some(&manifest), &[], None), false);
+        assert_eq!(out.matches("Enable safe mode.").count(), 1, "{out}");
+    }
+
     #[test]
     fn format_listing_counts_and_separates_entries() {
         assert_eq!(format_listing(&[], false), NO_PATCHES);

crates/socket-patch-cli/src/commands/scan/mod.rs

@@ -3615,7 +3615,7 @@ async fn scan_project(
 
     if selected.is_empty() && (!reapply || already_recorded.is_empty()) {
         if !silent {
-            if let Some(notes) = ui::opt_in_note_block(
+            if let Some(notes) = ui::opt_in_preview(
                 selected
                     .iter()
                     .chain(&already_recorded)
@@ -3689,8 +3689,8 @@ async fn scan_project(
         }
     }
 
-    if !silent && (vendor || report_only || args.common.dry_run) {
-        if let Some(notes) = ui::opt_in_note_block(
+    if !silent && (report_only || args.common.dry_run) {
+        if let Some(notes) = ui::opt_in_preview(
             selected
                 .iter()
                 .chain(&already_recorded)

crates/socket-patch-cli/src/commands/scan/vendor_flow.rs

@@ -588,6 +588,20 @@ async fn vendor_under_lock(
             Some(Box::new(env)),
         ));
     }
+    if !common.json && !common.silent {
+        if let Some(notes) =
+            crate::ui::opt_in_note_block(manifest.patches.iter().map(|(purl, record)| {
+                crate::ui::OptInEntry {
+                    purl,
+                    uuid: &record.uuid,
+                    requires_opt_in: record.requires_opt_in,
+                    opt_in_note: record.opt_in_note.as_deref(),
+                }
+            }))
+        {
+            println!("\n{notes}");
+        }
+    }
     migrate_legacy_manifest_records(common, &manifest_path, &manifest.patches, &mut env).await;
     if has_errors {
         env.mark_partial_failure();

crates/socket-patch-cli/src/ui/mod.rs

@@ -26,8 +26,8 @@ pub(crate) use status::StatusLine;
 pub use text::ShownOptIn;
 pub(crate) use text::{
     agent_next_steps, manifest_error_message, next_steps, next_steps_installed, opt_in_note_block,
-    plural, sentence_case, shell_word, short_uuid, sweep_failure, terminal_text, truncate,
-    OptInEntry,
+    opt_in_preview, plural, sentence_case, shell_word, short_uuid, sweep_failure, terminal_text,
+    truncate, OptInEntry,
 };
 
 /// [`text::no_patches_message`] for this run: the manifest path is named

crates/socket-patch-cli/src/ui/text.rs

@@ -330,6 +330,12 @@ impl ShownOptIn {
     }
 }
 
+pub(crate) fn opt_in_preview<'a>(
+    entries: impl IntoIterator<Item = OptInEntry<'a>>,
+) -> Option<String> {
+    opt_in_note_block(entries)
+}
+
 pub(crate) fn opt_in_note_block<'a>(
     entries: impl IntoIterator<Item = OptInEntry<'a>>,
 ) -> Option<String> {