Consolidated terminal UI and CLI-wide output polish

CHANGELOG.md

@@ -41,8 +41,8 @@ into the new version's section — see docs/releasing.md.
   (hosted-only and vendored projects; the truly-empty project
   keeps the "Manifest not found" exit 1, and a wired-but-ledgerless project
   errors naming `socket-patch repair`). Wet non-preserve runs confirm once
-  ("Roll back N patch(es), remove them from the local manifest, and delete
-  M vendored artifact(s)?" — auto-accepted under `--yes`/`--json`/non-TTY;
+  ("Roll back N patches, remove them from the local manifest, and delete
+  M vendored artifacts and their ledger records?" — auto-accepted under `--yes`/`--json`/non-TTY;
   declining prints "Rollback cancelled." and exits 0). Drift-keeps, hosted
   refusals/unsupported targets, corrupt ledgers, and a failed manifest
   write exit 1 `partial_failure`; not-installed entries still exit 0.
@@ -78,16 +78,16 @@ into the new version's section — see docs/releasing.md.
 - **A plain `scan` without a TTY is report-only.** When stdin is not a TTY,
   `--yes` is absent, and no intent flag (`--mode`, `--apply`, `--sync`,
   `--vendor`, `--redirect`, `--prune`) is given, human-mode `scan` prints the
-  discovery report and the "To apply a patch, run: …" hint, downloads
+  discovery report and the "To apply a single patch, run: …" hint, downloads
   nothing, creates no `.socket/`, and exits 0 — it no longer auto-accepts the
   apply prompt. Any intent flag, `--yes`, or a TTY keeps the previous
   behavior; `rollback`/`remove`/`get`'s non-TTY auto-accept is unchanged.
   Human `scan --mode hosted` now prints the results table and update
-  detection like the other modes and confirms once ("Redirect N package(s)
+  detection like the other modes and confirms once ("Redirect N packages
   to the hosted patch server?" — the same prompt as `get --mode hosted` —
   default yes, skipped by `--yes`/`--json`/`--dry-run`; on a non-TTY stdin
-  without `--yes` it prints `Non-interactive mode detected, proceeding with
-  default.` and proceeds), fetches patch details with the agent arm's
+  without `--yes` it prints `Non-interactive mode detected, proceeding
+  automatically.` and proceeds), fetches patch details with the agent arm's
   progress counter and per-package warnings, and an empty hosted discovery
   prints `No patches available for installed packages.` and exits 0 without
   entering the redirect engine (was `Redirected 0 package(s)`); a discovery
@@ -345,6 +345,29 @@ into the new version's section — see docs/releasing.md.
 
 ### Fixed
 
+- **Terminal output is clean on every command.** Progress lines no longer
+  leave stale text behind (`scan` printed e.g. `Found 7 patches for 1
+  packagesatch 7/7)`) or run into warnings printed while they are active.
+  Progress, prompts, color and truncation now share one implementation.
+  - **Progress lines:** a status line clears itself on finish. It is never
+    drawn off a TTY, under `TERM=dumb`, in debug mode, or under
+    `--json`/`--silent`. `fetch`, `vendor`, `setup`, lock waits and
+    `--update` checks now show progress instead of going quiet.
+  - **Prompts:** Ctrl-D at a `[Y/n]` prompt now declines instead of
+    accepting. Keys pressed while a scan is running no longer answer the
+    prompt that follows. The cursor is restored when a selection menu is
+    interrupted.
+  - **Color:** `NO_COLOR`, `CLICOLOR`, `CLICOLOR_FORCE` and `TERM=dumb` are
+    honored. Colored table rows now align.
+  - **Wording:** counted nouns read `1 package` / `2 packages` instead of
+    `package(s)`. `Error:` / `Warning:` prefixes are consistent, and
+    warnings go to stderr. `--silent` is errors-only, but a failing run
+    still prints why. Output that came out in random order is now sorted.
+    `--help` pages no longer show developer notes.
+  - **Behavior fixes:** `get --dry-run` and `vex --dry-run` no longer write
+    anything, and `vex -O -` writes to stdout. `scan --json` never stops at
+    an interactive menu. API errors show the server's message instead of a
+    raw JSON body.
 - **Reversal leaves no `.socket/` residue.** `rollback`, `remove`,
   `vendor --revert`, the hosted unwind and the GC sweeps now prune what they
   empty: an emptied redirect or vendor ledger is deleted together with the
@@ -374,7 +397,7 @@ into the new version's section — see docs/releasing.md.
   record for a purl the vendor ledger holds at another uuid carries `oldUuid`
   and the human `[fetch]` line reads `(replacing <uuid>)`;
   `get --mode vendored --dry-run` prints `[dry-run] Would download and vendor
-  N patch(es).` on both identifier paths; the `[note]` and
+  N patches. No changes made.` on both identifier paths; the `[note]` and
   `Patch record saved to` lines are gone with the manifest.
 - **Agent-mode `get` leaves nothing behind when it records nothing.**
   `.socket/` and `.socket/blobs/` are created only when a record is

Cargo.toml

@@ -24,8 +24,8 @@ tokio = { version = "=1.50.0", features = ["full"] }
 thiserror = "=2.0.18"
 walkdir = "=2.5.0"
 uuid = { version = "=1.21.0", features = ["v4"] }
+console = "=0.15.11"
 dialoguer = "=0.11.0"
-indicatif = "=0.17.11"
 tempfile = "=3.26.0"
 regex = "=1.12.3"
 glob = "=0.3.4"
@@ -38,6 +38,7 @@ zip = { version = "=8.6.0", default-features = false, features = ["deflate"] }
 fs2 = "=0.4.3"
 same-file = "=1.0.6"
 libc = "=0.2.182"
+windows-sys = "=0.59.0"
 semver = "=1.0.27"
 self-replace = "=1.5.0"
 wiremock = "=0.6.5"

README.md

@@ -158,7 +158,7 @@ socket-patch list
 ```
 
 ```
-Found 1 patch(es):
+Found 1 patch:
 
 Package: pkg:npm/flatted@3.3.1
   UUID: 5cac955f-eab1-4d29-8f4f-c408a6cc9647
@@ -525,7 +525,7 @@ it finds. `scan` is the entry point for all three [patch modes](#three-patch-mod
 
 Without a mode, interactive `scan` prompts before applying (in a TTY — when stdin is not a
 TTY and neither `--yes` nor a mode/`--prune` flag is given, it is report-only: it prints what
-it found plus the "To apply a patch, run: …" hint, writes nothing, and exits 0), and
+it found plus the "To apply a single patch, run: …" hint, writes nothing, and exits 0), and
 `scan --json` is read-only (discovery plus an `updates[]` array; no mutation).
 
 `scan --mode agent --prune` is the single command bots need for full auto-update: it
@@ -946,7 +946,7 @@ socket-patch get <identifier> [options]
 | `--ghsa` | — | Force identifier to be treated as a GHSA ID. |
 | `-p, --package` | — | Force identifier to be treated as a package name. |
 | `--save-only` | `SOCKET_SAVE_ONLY` | Download the patch without applying it (alias: `--no-apply`). |
-| `--one-off` | `SOCKET_ONE_OFF` | Reserved: apply the patch immediately without saving to the `.socket` folder. **Not yet implemented** — the command currently errors up front. |
+| `--one-off` | `SOCKET_ONE_OFF` | Reserved (hidden from `--help`): apply the patch immediately without saving to the `.socket` folder. **Not yet implemented** — the command currently errors up front. |
 | `--all-releases` | `SOCKET_ALL_RELEASES` | Download patches for every release/distribution variant of a matched package (PyPI wheel/sdist, RubyGems platform, Maven classifier), not just the installed one. |
 
 > Authenticated lookups run against an org. The slug is auto-resolved from your token
@@ -1002,7 +1002,7 @@ socket-patch list --json
 
 **Sample output:**
 ```
-Found 1 patch(es):
+Found 1 patch:
 
 Package: pkg:npm/flatted@3.3.1
   UUID: 5cac955f-eab1-4d29-8f4f-c408a6cc9647
@@ -1238,7 +1238,7 @@ socket-patch apply --json | jq '.status'
 When stdin is not a TTY (e.g. in CI pipelines), interactive prompts auto-proceed instead
 of blocking — with one deliberate exception: a plain `scan` (no `--mode`/`--apply`/`--sync`/
 `--vendor`/`--prune` and no `--yes`) is report-only there. It prints what it found and the
-"To apply a patch, run: …" hint, writes nothing, and exits 0; add `--yes` or a mode flag
+"To apply a single patch, run: …" hint, writes nothing, and exits 0; add `--yes` or a mode flag
 to mutate. Progress indicators and ANSI colors are automatically suppressed when output
 is piped.