chore(wheelhouse): cascade template@d9ab7d2f

Auto-applied by socket-wheelhouse sync-scaffolding into socket-bin.
30 file(s) touched:
  - .claude/hooks/fleet/no-disable-lint-rule-guard/README.md
  - .claude/hooks/fleet/vitest-include-vs-node-test-guard/README.md
  - .claude/hooks/fleet/vitest-include-vs-node-test-guard/index.mts
  - .claude/skills/fleet/_shared/scripts/resolve-tools.mts
  - .claude/skills/fleet/scanning-quality/scans/bundle-trim.md
  - .claude/skills/fleet/scanning-quality/scans/deadcode-removal.md
  - .claude/skills/fleet/trimming-bundle/SKILL.md
  - .config/fleet/.markdownlint-cli2.jsonc
  - .config/fleet/oxlint-plugin/index.mts
  - .config/fleet/oxlint-plugin/rules/inclusive-language.mts
  - .config/fleet/oxlint-plugin/rules/max-file-lines.mts
  - .config/fleet/oxlint-plugin/rules/prefer-async-spawn.mts
  - .config/fleet/oxlint-plugin/rules/prefer-spawn-over-execsync.mts
  - .config/fleet/sfw-bypass-list.txt
  - .config/fleet/taze.config.mts
  - .config/fleet/tsconfig.base.json
  - .config/fleet/vitest.coverage.fleet.config.mts
  - .config/repo/rolldown/define-guarded.mts
  - .config/repo/rolldown/lib-stub.mts
  - .config/socket-registry-pins.json
  ... and 10 more

Author: jdalton

.claude/hooks/fleet/no-disable-lint-rule-guard/README.md

@@ -10,7 +10,7 @@ Lint rules catch real classes of bug or style drift. Disabling a rule globally w
 
 Block examples:
 
-- Adding `"socket/foo": "off"` to `.config/oxlintrc.json`
+- Adding `"socket/foo": "off"` to `.config/fleet/oxlintrc.json`
 - Adding `"no-console": "warn"` to `.eslintrc.json`
 - Writing a new lint config file that already contains rule disables
 

.claude/hooks/fleet/vitest-include-vs-node-test-guard/README.md

@@ -39,7 +39,7 @@ the vitest config.
 
 ## Detection
 
-Reads `.config/vitest.config.mts` (or the standard fleet alternatives),
+Reads `.config/repo/vitest.config.mts` (or the standard fleet alternatives),
 parses the `include: [...]` literal array, converts each glob to a regex,
 and tests the target file's repo-relative path. Fails open if the config
 isn't found or the include globs aren't string literals (dynamic includes

.claude/hooks/fleet/vitest-include-vs-node-test-guard/index.mts

@@ -11,7 +11,7 @@
 //   - Fires on Write/Edit operations whose target file path imports
 //     `node:test`.
 //   - Reads the repo's `vitest.config.*` from the standard fleet locations
-//     (`.config/vitest.config.mts`, `vitest.config.mts/mjs/ts/js`, or the
+//     (`.config/repo/vitest.config.mts`, `vitest.config.mts/mjs/ts/js`, or the
 //     `template/.config/` mirror for wheelhouse).
 //   - Parses the config's `include` globs (string-literal extraction; if
 //     the config uses dynamic globs, we fail open).
@@ -40,7 +40,7 @@ const BYPASS_PHRASE = 'Allow node-test-in-vitest-include bypass'
 
 // Standard fleet vitest config locations, checked in order.
 const VITEST_CONFIG_CANDIDATES = [
-  '.config/vitest.config.mts',
+  '.config/repo/vitest.config.mts',
   '.config/vitest.config.mjs',
   '.config/vitest.config.ts',
   '.config/vitest.config.js',

.claude/skills/fleet/_shared/scripts/resolve-tools.mts

@@ -7,7 +7,7 @@ allowed-tools: Read, Edit, Grep, Glob, AskUserQuestion, Bash(pnpm:*), Bash(node:
 
 # trimming-bundle
 
-Iteratively stub heavyweight modules that the bundler statically pulls in but the runtime never reaches. Apply on repos that ship a built bundle. Today: rolldown only (socket-packageurl-js, socket-sdk-js; any repo with `.config/rolldown.config.mts`). The skill is named generically because the dead-path-stubbing pattern applies to any bundler; today the only fleet bundler is rolldown.
+Iteratively stub heavyweight modules that the bundler statically pulls in but the runtime never reaches. Apply on repos that ship a built bundle. Today: rolldown only (socket-packageurl-js, socket-sdk-js; any repo with `.config/repo/rolldown.config.mts`). The skill is named generically because the dead-path-stubbing pattern applies to any bundler; today the only fleet bundler is rolldown.
 
 ## When to invoke
 
@@ -18,19 +18,19 @@ Iteratively stub heavyweight modules that the bundler statically pulls in but th
 
 ## Skip when
 
-- The repo doesn't build a rolldown bundle (no `.config/rolldown.config.mts`).
+- The repo doesn't build a rolldown bundle (no `.config/repo/rolldown.config.mts`).
 - The bundle is consumed by code that uses dynamic feature detection (rare; flagged by the rolldown plugin's `moduleSideEffects: false` annotation).
 - Tests aren't running (`pnpm test` fails before any trim). Fix tests first; trim depends on the test signal.
 
 ## Required: rolldown/lib-stub.mts
 
-🚨 This skill **REQUIRES** `.config/rolldown/lib-stub.mts` to be present and to export `createLibStubPlugin`. The file is fleet-canonical (cascades from `socket-wheelhouse/template/.config/rolldown/lib-stub.mts` via sync-scaffolding) and must NOT be edited locally per the no-fleet-fork rule.
+🚨 This skill **REQUIRES** `.config/repo/rolldown/lib-stub.mts` to be present and to export `createLibStubPlugin`. The file is fleet-canonical (cascades from `socket-wheelhouse/template/.config/rolldown/lib-stub.mts` via sync-scaffolding) and must NOT be edited locally per the no-fleet-fork rule.
 
 Before doing anything else:
 
 ```bash
-[ -f .config/rolldown/lib-stub.mts ] || {
-  echo "ERROR: .config/rolldown/lib-stub.mts is missing."
+[ -f .config/repo/rolldown/lib-stub.mts ] || {
+  echo "ERROR: .config/repo/rolldown/lib-stub.mts is missing."
   echo "Cascade it from socket-wheelhouse:"
   echo "  cd /Users/<user>/projects/socket-wheelhouse &&" # socket-hook: allow cross-repo
   echo "  node scripts/sync-scaffolding/cli.mts --target <this-repo> --fix"
@@ -43,8 +43,8 @@ If the file is missing, STOP and run the cascade. Do NOT inline a copy of the pl
 Verify the rolldown config imports it:
 
 ```bash
-grep -q "createLibStubPlugin" .config/rolldown.config.mts || {
-  echo "ERROR: .config/rolldown.config.mts doesn't import createLibStubPlugin."
+grep -q "createLibStubPlugin" .config/repo/rolldown.config.mts || {
+  echo "ERROR: .config/repo/rolldown.config.mts doesn't import createLibStubPlugin."
   echo "Add: import { createLibStubPlugin } from './rolldown/lib-stub.mts'"
   echo "And: plugins: [createLibStubPlugin({ stubPattern: /...regex.../ })]"
   exit 1
@@ -54,7 +54,7 @@ grep -q "createLibStubPlugin" .config/rolldown.config.mts || {
 ## Inputs
 
 - `dist/`: the most recent build output (run `pnpm build` first if missing or stale).
-- `.config/rolldown.config.mts`: already imports `createLibStubPlugin` from `.config/rolldown/lib-stub.mts` (fleet-canonical; cascaded via sync-scaffolding).
+- `.config/repo/rolldown.config.mts`: already imports `createLibStubPlugin` from `.config/repo/rolldown/lib-stub.mts` (fleet-canonical; cascaded via sync-scaffolding).
 - `pnpm test`: must pass at start; the trim loop's signal is "tests still pass after stub."
 
 ## Process
@@ -112,7 +112,7 @@ If any of these find a hit, the candidate is reachable; skip it. Only candidates
 
 ### Phase 4: Stub one candidate
 
-Edit `.config/rolldown.config.mts` to extend the `stubPattern` regex:
+Edit `.config/repo/rolldown.config.mts` to extend the `stubPattern` regex:
 
 ```ts
 const stubPattern = /(?:globs|sorts|<new-candidate>)\.js$/
@@ -153,15 +153,15 @@ All four must pass before committing.
 ### Phase 7: Commit
 
 ```bash
-git add .config/rolldown.config.mts
+git add .config/repo/rolldown.config.mts
 git commit -m "perf(bundle): stub <N> unused lib internals (<size> saved)"
 ```
 
 The commit message states the count + size delta. If the trim is significant (say >50KB), also update `docs/rolldown-migration.md` with the new baseline.
 
 ## Reference
 
-- `.config/rolldown/lib-stub.mts`: fleet-canonical plugin (cascade via sync-scaffolding; never edit locally per the no-fleet-fork rule).
+- `.config/repo/rolldown/lib-stub.mts`: fleet-canonical plugin (cascade via sync-scaffolding; never edit locally per the no-fleet-fork rule).
 - `docs/rolldown-migration.md`: repo-specific (in repos that ran the migration). Records baseline numbers from before/after the esbuild → rolldown switch.
 - `socket-packageurl-js/.config/rolldown.config.mts`: the worked example of `createLibStubPlugin` use, with a populated `stubPattern`.
 

.claude/skills/fleet/scanning-quality/scans/bundle-trim.md

@@ -4,8 +4,8 @@
  *   Why a plugin instead of a separate scanner: oxlint's native plugin surface
  *   integrates with the existing `pnpm run lint` pipeline, inherits oxlint's
  *   AST + sourcemap + fix-application machinery, and keeps the rule set
- *   discoverable via `oxlint --rules`. Wiring: `.config/oxlintrc.json` adds
- *   this plugin via `jsPlugins: ["./oxlint-plugin/index.mts"]` and enables
+ *   discoverable via `oxlint --rules`. Wiring: `.config/fleet/oxlintrc.json`
+ *   adds this plugin via `jsPlugins: ["./oxlint-plugin/index.mts"]` and enables
  *   rules under the `socket/` namespace.
  */
 

.claude/skills/fleet/scanning-quality/scans/deadcode-removal.md

@@ -18,12 +18,12 @@
  *     Allowed exceptions (skipped — no report, no fix):
  *   - Third-party API field references: comment with `inclusive-language:
  *     external-api` adjacent to the line.
- *   - Vendored / fixture paths: handled at the .config/oxlintrc.json
+ *   - Vendored / fixture paths: handled at the .config/fleet/oxlintrc.json
  *     ignorePatterns level; this rule trusts the include set.
  *   - The literal phrase "main / primary" / etc. inside a doc that spells out the
  *     substitution table — handled by the
  *     `docs/references/inclusive-language.md` ignore pattern in
- *     .config/oxlintrc.json (caller adds the override).
+ *     .config/fleet/oxlintrc.json (caller adds the override).
  */
 
 // [legacyStem, replacementStem]. The detector matches the stem