chore(wheelhouse): cascade template@cd65ef7a

Auto-applied by socket-wheelhouse sync-scaffolding into cascade-socket-cli-66133.
14 file(s) touched:
  - .claude/hooks/fleet/_shared/test/transcript.test.mts
  - .claude/hooks/fleet/_shared/transcript.mts
  - .claude/hooks/fleet/minimum-release-age-guard/index.mts
  - .claude/hooks/fleet/no-fleet-fork-guard/index.mts
  - .claude/hooks/fleet/no-fleet-fork-guard/test/index.test.mts
  - .config/oxfmtrc.json
  - .config/oxlintrc.json
  - .gitattributes
  - docs/claude.md/fleet/bypass-phrases.md
  - pnpm-workspace.yaml
  - scripts/check-soak-exclude-dates.mts
  - scripts/soak-bypass.mts
  - scripts/test/check-soak-exclude-dates.test.mts
  - scripts/test/soak-bypass.test.mts

Author: jdalton

.claude/hooks/fleet/_shared/test/transcript.test.mts

@@ -155,12 +155,23 @@ test('bypassPhrasePresent: finds the phrase', () => {
   }
 })
 
-test('bypassPhrasePresent: case-sensitive (lowercase does not count)', () => {
+test('bypassPhrasePresent: case-insensitive (lowercase counts)', () => {
   const f = writeTranscript(
     JSON.stringify({ role: 'user', content: 'allow revert bypass please' }),
   )
   try {
-    assert.equal(bypassPhrasePresent(f, 'Allow revert bypass'), false)
+    assert.equal(bypassPhrasePresent(f, 'Allow revert bypass'), true)
+  } finally {
+    cleanup(f)
+  }
+})
+
+test('bypassPhrasePresent: uppercase counts', () => {
+  const f = writeTranscript(
+    JSON.stringify({ role: 'user', content: 'ALLOW REVERT BYPASS please' }),
+  )
+  try {
+    assert.equal(bypassPhrasePresent(f, 'Allow revert bypass'), true)
   } finally {
     cleanup(f)
   }

.claude/hooks/fleet/_shared/transcript.mts

@@ -53,10 +53,17 @@ function normalizeBypassText(text: string): string {
   // the bypass phrase only after invisible chars are stripped — nor
   // can a user accidentally type a phrase that fails to match because
   // an editor inserted a zero-width-space.
+  // toLowerCase: matching is case-INsensitive — `allow fleet-fork bypass`
+  // and `ALLOW FLEET-FORK BYPASS` count the same as the canonical mixed
+  // case. Typing the phrase is already a deliberate act; casing carries no
+  // extra signal, and requiring exact case just trips up a hurried user.
+  // Combined with the dash/whitespace fold below, only the words + their
+  // order are load-bearing.
   return text
     .normalize('NFKC')
     .replace(/\p{Cf}/gu, '')
     .replace(/[-—–\s]+/g, ' ')
+    .toLowerCase()
 }
 
 export function bypassPhrasePresent(

.claude/hooks/fleet/minimum-release-age-guard/index.mts

@@ -205,7 +205,12 @@ async function main(): Promise<void> {
       '    - Emergency CVE patch published < 7 days ago.',
       '    - First-party package you control.',
       '',
-      `  Bypass: type "${BYPASS_PHRASE}" in a new message, then retry.`,
+      "  Don't hand-edit the exclude list — run the canonical helper, which",
+      '  looks up the npm publish date and writes the dated annotation for you:',
+      '    node scripts/soak-bypass.mts <pkg>@<version>',
+      '  (the daily updating-daily job removes the entry once its soak clears).',
+      '',
+      `  Bypass (to hand-edit anyway): type "${BYPASS_PHRASE}" in a new message, then retry.`,
       '',
     ].join('\n'),
   )

.claude/hooks/fleet/no-fleet-fork-guard/index.mts

@@ -148,7 +148,10 @@ export function findFleetRepoRoot(filePath: string): string | undefined {
   return undefined
 }
 
-export function isCanonicalRelativePath(rel: string): boolean {
+export function isCanonicalRelativePath(
+  rel: string,
+  repoRoot?: string | undefined,
+): boolean {
   const normalized = rel.replace(/\\/g, '/')
   // Per-repo carve-outs take precedence over the canonical prefixes
   // (they're more specific). Edits under these paths are intentionally
@@ -165,6 +168,19 @@ export function isCanonicalRelativePath(rel: string): boolean {
       return true
     }
   }
+  // `scripts/<x>` is fleet-canonical when it has a cascaded twin under
+  // `template/scripts/<x>` (the wheelhouse mirrors root scripts/ from the
+  // template; sync-scaffolding/ + validate-template.mts etc. are
+  // wheelhouse-only tooling with no template twin and are NOT canonical).
+  // A bare `scripts/` prefix would wrongly guard that wheelhouse-only set,
+  // so probe for the twin instead. `scripts/repo/` is already excluded above.
+  if (
+    repoRoot &&
+    normalized.startsWith('scripts/') &&
+    existsSync(path.join(repoRoot, 'template', normalized))
+  ) {
+    return true
+  }
   return CANONICAL_FILES.includes(normalized)
 }
 
@@ -215,7 +231,7 @@ async function main(): Promise<number> {
 
   const relToRepo = path.relative(repoRoot, absPath)
 
-  if (!isCanonicalRelativePath(relToRepo)) {
+  if (!isCanonicalRelativePath(relToRepo, repoRoot)) {
     return 0
   }
 

.claude/hooks/fleet/no-fleet-fork-guard/test/index.test.mts

@@ -274,10 +274,9 @@ test('bypass phrase variants do NOT count', async () => {
   const repo = makeFakeFleetRepo()
   try {
     const file = makeCanonicalFile(repo, '.git-hooks/pre-push.mts')
-    // Each of these should NOT bypass — phrase must be exact.
+    // Each of these should NOT bypass: a word of the phrase is missing.
+    // (Case + dash/space variants DO count — see the next test.)
     for (const variant of [
-      'allow fleet-fork bypass', // lowercase
-      'Allow fleet fork bypass', // space instead of hyphen
       'Allow fleet-fork', // no "bypass"
       'fleet-fork bypass', // no "Allow"
     ]) {
@@ -299,6 +298,34 @@ test('bypass phrase variants do NOT count', async () => {
   }
 })
 
+test('case / hyphen / space / dash variants of the phrase all count', async () => {
+  const repo = makeFakeFleetRepo()
+  try {
+    const file = makeCanonicalFile(repo, '.git-hooks/pre-push.mts')
+    // The normalizer lowercases + folds dash variants + whitespace, so a
+    // human typing lowercase, spaces, or an em-dash instead of the canonical
+    // mixed-case hyphenated phrase still bypasses. Only the words + order matter.
+    for (const variant of [
+      'Allow fleet-fork bypass', // canonical
+      'allow fleet-fork bypass', // lowercase
+      'ALLOW FLEET-FORK BYPASS', // uppercase
+      'Allow fleet fork bypass', // spaces instead of hyphen
+      'Allow fleet—fork bypass', // em-dash
+    ]) {
+      const result = await runHook(
+        {
+          tool_input: { file_path: file, new_string: 'x' },
+          tool_name: 'Edit',
+        },
+        userTurn(variant),
+      )
+      assert.strictEqual(result.code, 0, `variant should bypass: ${variant}`)
+    }
+  } finally {
+    rmSync(repo, { force: true, recursive: true })
+  }
+})
+
 test('paths under socket-wheelhouse/template/ always pass', async () => {
   // Even if Claude tries to spell out a path that would otherwise
   // match a canonical prefix, anything under .../socket-wheelhouse/

.config/oxfmtrc.json

@@ -122,12 +122,15 @@
     "**/scripts/publish-shared.mts",
     "**/scripts/publish.mts",
     "**/scripts/security.mts",
+    "**/scripts/soak-bypass.mts",
     "**/scripts/socket-wheelhouse-emit-schema.mts",
     "**/scripts/socket-wheelhouse-schema.mts",
     "**/scripts/test/check-lock-step-header.test.mts",
     "**/scripts/test/check-lock-step-refs.test.mts",
+    "**/scripts/test/check-soak-exclude-dates.test.mts",
     "**/scripts/test/install-claude-plugins.test.mts",
     "**/scripts/test/install-git-hooks.test.mts",
+    "**/scripts/test/soak-bypass.test.mts",
     "**/scripts/update.mts",
     "**/scripts/util/multi-package-publish.mts",
     "**/scripts/util/pack-app-triplets.mts",

.config/oxlintrc.json

@@ -245,12 +245,15 @@
     "**/scripts/publish-shared.mts",
     "**/scripts/publish.mts",
     "**/scripts/security.mts",
+    "**/scripts/soak-bypass.mts",
     "**/scripts/socket-wheelhouse-emit-schema.mts",
     "**/scripts/socket-wheelhouse-schema.mts",
     "**/scripts/test/check-lock-step-header.test.mts",
     "**/scripts/test/check-lock-step-refs.test.mts",
+    "**/scripts/test/check-soak-exclude-dates.test.mts",
     "**/scripts/test/install-claude-plugins.test.mts",
     "**/scripts/test/install-git-hooks.test.mts",
+    "**/scripts/test/soak-bypass.test.mts",
     "**/scripts/update.mts",
     "**/scripts/util/multi-package-publish.mts",
     "**/scripts/util/pack-app-triplets.mts",

.gitattributes

@@ -321,12 +321,15 @@ scripts/publish-release.mts linguist-generated=true
 scripts/publish-shared.mts linguist-generated=true
 scripts/publish.mts linguist-generated=true
 scripts/security.mts linguist-generated=true
+scripts/soak-bypass.mts linguist-generated=true
 scripts/socket-wheelhouse-emit-schema.mts linguist-generated=true
 scripts/socket-wheelhouse-schema.mts linguist-generated=true
 scripts/test/check-lock-step-header.test.mts linguist-generated=true
 scripts/test/check-lock-step-refs.test.mts linguist-generated=true
+scripts/test/check-soak-exclude-dates.test.mts linguist-generated=true
 scripts/test/install-claude-plugins.test.mts linguist-generated=true
 scripts/test/install-git-hooks.test.mts linguist-generated=true
+scripts/test/soak-bypass.test.mts linguist-generated=true
 scripts/update.mts linguist-generated=true
 scripts/util/multi-package-publish.mts linguist-generated=true
 scripts/util/pack-app-triplets.mts linguist-generated=true

docs/claude.md/fleet/bypass-phrases.md

@@ -304,16 +304,20 @@ blockExoticSubdeps: true
 # in the default `catalog:` block above. This defeats accidental
 # local-checkout resolution when a sibling repo is on disk.
 overrides:
+  # Fleet-canonical overrides (managed by socket-wheelhouse sync; do not edit).
+  '@socketregistry/packageurl-js': 'catalog:'
+  '@socketsecurity/lib': 'catalog:'
+  '@socketsecurity/registry': 'catalog:'
+  '@socketsecurity/sdk': 'catalog:'
+  'uuid': '11.1.1'
+
+  # Repo-specific overrides below.
   '@octokit/graphql': 'catalog:'
   '@octokit/request-error': 'catalog:'
   '@sigstore/sign': '4.1.0'
-  '@socketregistry/packageurl-js': 'catalog:'
   '@socketregistry/packageurl-js-stable': 'catalog:'
-  '@socketsecurity/lib': 'catalog:'
   '@socketsecurity/lib-stable': 'catalog:'
-  '@socketsecurity/registry': 'catalog:'
   '@socketsecurity/registry-stable': 'catalog:'
-  '@socketsecurity/sdk': 'catalog:'
   '@socketsecurity/sdk-stable': 'catalog:'
   'aggregate-error': 'catalog:'
   'ansi-regex': 'catalog:'
@@ -360,7 +364,6 @@ overrides:
   'tiny-colors': 'catalog:'
   'typedarray': 'catalog:'
   'undici': 'catalog:'
-  'uuid': '11.1.1'
   'vite': 'catalog:'
   'wrap-ansi': 'catalog:'
   'xml2js': 'catalog:'