[lelia]

⚠️ DO NOT MERGE until backend changes are confirmed deployed ⚠️

Summary

Basics currently inherits SocketSDKPython/<SDK version> for Socket API requests, so request attribution cannot distinguish it from standalone SDK consumers. Send socket-basics/<Basics version> from both dashboard configuration reads and scan uploads, using one shared constant.

Blocked on backend deployment. Keep this PR in draft and do not merge or release it until depscan recognizes socket-basics/ as basics. Backend dependency PR has been raised. Client releases must follow deployment, not merely backend PR merge.

Changes

• Override the SDK User-Agent on both Basics API clients without requiring an SDK upgrade.
• Derive the identity from the existing Basics version module and record the change under Unreleased.
• Keep this work separate from fix(scanner): preserve option values #125, which fixes Tier 1 argument parsing.

Testing

• 487 Python tests passed using the installed SDK 3.5.0; isolated test Git configuration disables local signing and hooks for temporary fixture repos.
• The Java/OpenGrep module was excluded because the installed OpenGrep scanner fails to start locally. The initial broader run exposed that environment issue; CI retains its normal scanner coverage.
• Both new request tests also passed against the proposed SDK changes in fix(user-agent): identify the Python SDK consistently socket-sdk-python#127.
• New tests exercise the real SDK and inspect prepared HTTP headers for organization discovery, Basics settings, and multipart scan upload. Only the HTTP transport boundary is replaced.
• Black and Flake8 passed for the new module and tests; git diff --check passed. Added code contains no comments requiring revision in the fourth-wall audit.

Rollout and reviewer context

Prior art: SocketDev/socket-python-cli#320 by jdalton. Basics follows the same application override pattern and uses its own version rather than the SDK version. Select the unpublished patch version during release preparation after backend deployment; this draft leaves release metadata unchanged.

---

Note

Low Risk
Only HTTP client metadata changes; scan logic, auth, and payloads are unchanged, though attribution depends on a coordinated backend deploy.

Overview
Socket Basics no longer leaves Socket API traffic labeled as the generic Python SDK. Dashboard configuration loads (org discovery and Basics settings) and full-scan uploads now pass a shared user_agent when constructing socketdev, so outbound requests use socket-basics/<Basics version> instead of SocketSDKPython/<SDK version>.

A small user_agent module centralizes that string from the existing package version, and the Unreleased changelog records the behavior change. New tests stub HTTP at the transport layer and assert the User-Agent header on both the config path and the multipart scan POST.

Release is blocked on backend recognizing the socket-basics/ prefix as Basics traffic (per PR description).

^{Reviewed by Cursor Bugbot for commit 9179f8f. Configure here.}

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9179f8f. Configure here.}