chore(wheelhouse): cascade template@2c1b1700

jdalton · jdalton · commit 1907d57516b7 · 2026-06-01T16:33:06.000-04:00
Auto-applied by socket-wheelhouse sync-scaffolding into socket-bin.
28 file(s) touched:
  - .claude/hooks/fleet/_shared/fleet-repos.mts
  - .claude/hooks/fleet/broken-hook-detector/package.json
  - .claude/hooks/fleet/codex-no-write-guard/package.json
  - .claude/hooks/fleet/concurrent-cargo-build-guard/package.json
  - .claude/hooks/fleet/enterprise-push-property-reminder/package.json
  - .claude/hooks/fleet/gh-token-hygiene-guard/package.json
  - .claude/hooks/fleet/no-empty-commit-guard/package.json
  - .claude/hooks/fleet/no-experimental-strip-types-guard/package.json
  - .claude/hooks/fleet/no-non-fleet-push-guard/package.json
  - .claude/hooks/fleet/no-revert-guard/package.json
  - .claude/hooks/fleet/non-fleet-pr-issue-ask-guard/package.json
  - .claude/hooks/fleet/overeager-staging-guard/package.json
  - .claude/hooks/fleet/parallel-agent-staging-guard/package.json
  - .claude/hooks/fleet/prefer-rebase-over-revert-guard/package.json
  - .claude/hooks/fleet/programmatic-claude-lockdown-guard/package.json
  - .claude/hooks/fleet/release-workflow-guard/package.json
  - .claude/hooks/fleet/scan-label-in-commit-guard/package.json
  - .claude/hooks/fleet/version-bump-order-guard/README.md
  - .claude/hooks/fleet/version-bump-order-guard/index.mts
  - .claude/hooks/fleet/version-bump-order-guard/package.json
  ... and 8 more
diff --git a/.claude/hooks/fleet/_shared/fleet-repos.mts b/.claude/hooks/fleet/_shared/fleet-repos.mts
@@ -21,9 +21,11 @@ export const FLEET_REPO_NAMES = [
   'claude-code',
   'skills',
   'socket-addon',
+  'socket-bin',
   'socket-btm',
   'socket-cli',
   'socket-lib',
+  'socket-mcp',
   'socket-packageurl-js',
   'socket-registry',
   'socket-sdk-js',
diff --git a/.claude/hooks/fleet/broken-hook-detector/package.json b/.claude/hooks/fleet/broken-hook-detector/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/codex-no-write-guard/package.json b/.claude/hooks/fleet/codex-no-write-guard/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/concurrent-cargo-build-guard/package.json b/.claude/hooks/fleet/concurrent-cargo-build-guard/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/enterprise-push-property-reminder/package.json b/.claude/hooks/fleet/enterprise-push-property-reminder/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/gh-token-hygiene-guard/package.json b/.claude/hooks/fleet/gh-token-hygiene-guard/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/no-empty-commit-guard/package.json b/.claude/hooks/fleet/no-empty-commit-guard/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/no-experimental-strip-types-guard/package.json b/.claude/hooks/fleet/no-experimental-strip-types-guard/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/no-non-fleet-push-guard/package.json b/.claude/hooks/fleet/no-non-fleet-push-guard/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/no-revert-guard/package.json b/.claude/hooks/fleet/no-revert-guard/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/non-fleet-pr-issue-ask-guard/package.json b/.claude/hooks/fleet/non-fleet-pr-issue-ask-guard/package.json
@@ -8,5 +8,8 @@
   },
   "scripts": {
     "test": "node --test test/*.test.mts"
+  },
+  "dependencies": {
+    "shell-quote": "catalog:"
   }
 }
diff --git a/.claude/hooks/fleet/overeager-staging-guard/package.json b/.claude/hooks/fleet/overeager-staging-guard/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/parallel-agent-staging-guard/package.json b/.claude/hooks/fleet/parallel-agent-staging-guard/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/prefer-rebase-over-revert-guard/package.json b/.claude/hooks/fleet/prefer-rebase-over-revert-guard/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/programmatic-claude-lockdown-guard/package.json b/.claude/hooks/fleet/programmatic-claude-lockdown-guard/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/release-workflow-guard/package.json b/.claude/hooks/fleet/release-workflow-guard/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@socketsecurity/lib-stable": "catalog:",
     "@types/node": "catalog:"
diff --git a/.claude/hooks/fleet/scan-label-in-commit-guard/package.json b/.claude/hooks/fleet/scan-label-in-commit-guard/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/version-bump-order-guard/README.md b/.claude/hooks/fleet/version-bump-order-guard/README.md
@@ -1,19 +1,24 @@
 # version-bump-order-guard
 
-PreToolUse hook that blocks `git tag vX.Y.Z` when HEAD isn't a bump commit. Enforces step 3-4 of CLAUDE.md's "Version bumps" rule.
+PreToolUse hook that blocks `git tag vX.Y.Z` when HEAD isn't a bump commit **or** the tree fails the fast pre-release gate. Enforces steps 1, 3, and 4 of CLAUDE.md's "Version bumps" rule.
 
 ## What it catches
 
 - `git tag v1.2.3` (or `git tag -a v…`, `git tag -s v…`) when the most-recent commit subject doesn't match `chore: bump version to X.Y.Z` or `chore(scope): release X.Y.Z`.
+- A version tag whose tree fails `pnpm run lint --all` (the exact command CI's Check job runs) — accumulated lint debt that CI will reject.
+- A version tag whose tree has open `pnpm audit` advisories — a release carrying known-vulnerable dependencies.
 
 ## Why
 
 The bump commit must be the LAST commit on the release. Tagging on a non-bump commit produces a broken release: `git describe` lies, bisecting past the tag lands on a different state, and the changelog drifts from the artifact.
 
+The gate half front-runs the two pre-release checks cheap enough to run synchronously. **Why:** 2026-06-01 socket-lib tagged v6.0.7 while a cascade had escalated ~10 socket lint rules to `error` without bringing the code into compliance — 1144 lint errors and 2 moderate advisories shipped past the local steps and only surfaced when CI's Check job failed post-tag. The slow half of the gate (`pnpm run check --all` — typecheck, unit tests, coverage) stays in CI.
+
 ## Bypass
 
 - Type `Allow version-bump-order bypass` in a recent user message (also accepts `Allow version bump order bypass` / `Allow versionbumporder bypass`), or
-- Set `SOCKET_VERSION_BUMP_ORDER_GUARD_DISABLED=1`.
+- Set `SOCKET_VERSION_BUMP_ORDER_GUARD_DISABLED=1` (whole guard), or
+- Set `SOCKET_VERSION_BUMP_SKIP_GATE=1` (gate half only — when the gate is being run out-of-band but ordering is fine).
 
 ## Test
 
diff --git a/.claude/hooks/fleet/version-bump-order-guard/index.mts b/.claude/hooks/fleet/version-bump-order-guard/index.mts
@@ -18,11 +18,24 @@
 // X.Y.Z`). Without that, the tag is being placed on a non-bump commit,
 // which produces a broken release.
 //
+// It ALSO runs the fast half of the pre-release gate at tag time — the
+// two checks cheap enough for a synchronous hook: `pnpm run lint --all`
+// (the same lint CI's Check job runs) and `pnpm audit` (open security
+// advisories). A tag whose tree fails either would publish a release CI
+// rejects, or one carrying a known-vulnerable dependency. The slow half
+// of the gate — `pnpm run check --all` typecheck, unit tests, coverage —
+// stays in CI; this hook front-runs the two that catch the common
+// release-day breakage (accumulated lint debt, an unpinned advisory).
+//
 // Bypass: "Allow version-bump-order bypass" in a recent user turn, or
-// SOCKET_VERSION_BUMP_ORDER_GUARD_DISABLED=1.
+// SOCKET_VERSION_BUMP_ORDER_GUARD_DISABLED=1. The gate half alone can be
+// skipped with SOCKET_VERSION_BUMP_SKIP_GATE=1 when the bump ordering is
+// fine but the gate is being run out-of-band.
 
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger/default'
 import { spawnSync } from '@socketsecurity/lib-stable/process/spawn/child'
+import { existsSync, readFileSync } from 'node:fs'
+import path from 'node:path'
 import process from 'node:process'
 
 import { withBashGuard } from '../_shared/payload.mts'
@@ -53,6 +66,58 @@ function isVersionTagCommand(command: string): boolean {
 const BUMP_SUBJECT_RE =
   /^(?:chore(?:\([\w-]+\))?:\s+(?:bump version to|release)\s+v?\d+\.\d+\.\d+|chore(?:\([\w-]+\))?:\s+v?\d+\.\d+\.\d+\s+release)/i
 
+// Whether the repo at `cwd` declares a `lint` script. The gate only runs
+// where there's something to gate — a repo with no `lint` script (or no
+// package.json at all) fails open, so this guard stays a pure tag-ordering
+// check there.
+function hasLintScript(cwd: string): boolean {
+  try {
+    const pkgPath = path.join(cwd, 'package.json')
+    if (!existsSync(pkgPath)) {
+      return false
+    }
+    const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as {
+      scripts?: Record<string, string>
+    }
+    return typeof pkg.scripts?.['lint'] === 'string'
+  } catch {
+    return false
+  }
+}
+
+// Run the fast pre-release gate (lint --all + pnpm audit). Returns a list
+// of human-readable failures; an empty list means the gate passed. Fails
+// open on a non-spawnable tool — the gate enforces what it can confirm,
+// never invents a failure.
+function runPreReleaseGate(opts: { cwd?: string }): string[] {
+  const failures: string[] = []
+  const spawnOpts = { ...opts, stdio: 'pipe' as const }
+  // `pnpm run lint --all` — the exact command CI's Check job runs. A
+  // non-zero exit means accumulated lint debt that CI will reject.
+  const lint = spawnSync('pnpm', ['run', 'lint', '--all'], spawnOpts)
+  if (lint.error) {
+    // pnpm not spawnable — can't confirm, fail open.
+    return failures
+  }
+  if (lint.status !== 0) {
+    failures.push('`pnpm run lint --all` failed — fix lint before tagging.')
+  }
+  // `pnpm audit` — open security advisories. Only meaningful against a
+  // resolved lockfile; without `pnpm-lock.yaml` it has nothing to audit
+  // and its exit code is noise, so skip it there (fail open).
+  const cwd = opts.cwd ?? process.cwd()
+  if (existsSync(path.join(cwd, 'pnpm-lock.yaml'))) {
+    const audit = spawnSync('pnpm', ['audit'], spawnOpts)
+    if (!audit.error && audit.status !== 0) {
+      failures.push(
+        '`pnpm audit` found advisories — pin safe versions in ' +
+          'pnpm-workspace.yaml overrides (past soak) before tagging.',
+      )
+    }
+  }
+  return failures
+}
+
 // withBashGuard handles the stdin drain, tool_name gate, command narrow,
 // and fail-open on any throw.
 await withBashGuard((command, payload) => {
@@ -66,8 +131,40 @@ await withBashGuard((command, payload) => {
     return
   }
 
-  // Read the most-recent commit subject from HEAD.
   const opts = payload.cwd ? { cwd: payload.cwd } : {}
+
+  // Fast pre-release gate: a tag whose tree fails lint or carries an open
+  // advisory would publish a broken / vulnerable release. Run it before
+  // the ordering check so a clean-ordering-but-dirty-tree tag still blocks.
+  if (
+    !process.env['SOCKET_VERSION_BUMP_SKIP_GATE'] &&
+    hasLintScript(opts.cwd ?? process.cwd())
+  ) {
+    const gateFailures = runPreReleaseGate(opts)
+    if (gateFailures.length) {
+      const gateLines = [
+        '[version-bump-order-guard] Pre-release gate failed for tag.',
+        '',
+        ...gateFailures.map(f => `  ✗ ${f}`),
+        '',
+        '  Run the full prep wave clean before tagging:',
+        '',
+        '    pnpm run update',
+        '    pnpm i',
+        '    pnpm run fix --all',
+        '    pnpm run check --all   # typecheck + unit tests + coverage',
+        '',
+        '  Bypass the gate only: SOCKET_VERSION_BUMP_SKIP_GATE=1',
+        '  Bypass the whole guard: "Allow version-bump-order bypass".',
+        '',
+      ]
+      logger.error(gateLines.join('\n') + '\n')
+      process.exitCode = 2
+      return
+    }
+  }
+
+  // Read the most-recent commit subject from HEAD.
   const subjectResult = spawnSync('git', ['log', '-1', '--pretty=%s'], opts)
   if (subjectResult.status !== 0) {
     // Not a git repo or git unavailable — fail open.
diff --git a/.claude/hooks/fleet/version-bump-order-guard/package.json b/.claude/hooks/fleet/version-bump-order-guard/package.json
@@ -9,6 +9,9 @@
   "scripts": {
     "test": "node --test test/*.test.mts"
   },
+  "dependencies": {
+    "shell-quote": "catalog:"
+  },
   "devDependencies": {
     "@types/node": "catalog:"
   }
diff --git a/.claude/hooks/fleet/version-bump-order-guard/test/index.test.mts b/.claude/hooks/fleet/version-bump-order-guard/test/index.test.mts
diff --git a/.config/fleet/oxlint-plugin/index.mts b/.config/fleet/oxlint-plugin/index.mts
diff --git a/.config/fleet/oxlint-plugin/rules/no-top-level-await.mts b/.config/fleet/oxlint-plugin/rules/no-top-level-await.mts
diff --git a/.config/fleet/oxlint-plugin/rules/prefer-stable-external-semver.mts b/.config/fleet/oxlint-plugin/rules/prefer-stable-external-semver.mts
diff --git a/.config/fleet/oxlintrc.json b/.config/fleet/oxlintrc.json
diff --git a/.gitattributes b/.gitattributes
diff --git a/.npmrc b/.npmrc
diff --git a/scripts/fleet/publish-release.mts b/scripts/fleet/publish-release.mts
