chore(wheelhouse): cascade template@df432707

Auto-applied by socket-wheelhouse sync-scaffolding into socket-lib.
8 file(s) touched:
  - .claude/hooks/fleet/concurrent-cargo-build-guard/README.md
  - .claude/hooks/fleet/concurrent-cargo-build-guard/index.mts
  - .claude/hooks/fleet/concurrent-cargo-build-guard/package.json
  - .claude/hooks/fleet/concurrent-cargo-build-guard/test/index.test.mts
  - .claude/hooks/fleet/concurrent-cargo-build-guard/tsconfig.json
  - .claude/hooks/fleet/logger-guard/index.mts
  - .claude/hooks/fleet/logger-guard/test/logger-guard.test.mts
  - .git-hooks/fleet/pre-push.mts

Author: jdalton

.claude/hooks/fleet/concurrent-cargo-build-guard/README.md

@@ -82,7 +82,9 @@ export function emitBlock(filePath: string, hits: Hit[]): string {
     out.push(`  …and ${hits.length - 3} more.`)
   }
   out.push(
-    '  Opt-out for one line (rare): append `// socket-lint: allow console`.',
+    '  Opt-out for one line (rare): append `// socket-lint: allow console` for a ' +
+      '`console.*` call, or `// socket-lint: allow process-stdio` for a raw ' +
+      '`process.std{out,err}.write` (the id must match the call kind).',
   )
   out.push('')
   return out.join('\n')
@@ -115,10 +117,16 @@ export function scan(source: string): Hit[] {
   const lines = source.split('\n')
   const hits: Hit[] = []
   for (const leak of findLoggerLeaks(source)) {
-    // Per-line allow marker: `// socket-lint: allow console`. The marker
-    // must appear on the same source line as the call.
+    // Per-line allow marker, keyed by leak kind so the edit-time guard agrees
+    // with the pre-push `scanLoggerLeaks`: `console.*` waives with
+    // `// socket-lint: allow console`, raw `process.std*.write` waives with the
+    // more deliberate `// socket-lint: allow process-stdio`. The marker must be
+    // on the same source line as the call.
+    const rule = leak.fullCall.startsWith('process.')
+      ? 'process-stdio'
+      : 'console'
     const sourceLine = lines[leak.line - 1] ?? ''
-    if (lineIsSuppressed(sourceLine, 'console')) {
+    if (lineIsSuppressed(sourceLine, rule)) {
       continue
     }
     hits.push({

.claude/hooks/fleet/concurrent-cargo-build-guard/index.mts

@@ -136,17 +136,28 @@ test('respects bare # socket-lint: allow marker', async () => {
   assert.equal(code, 0)
 })
 
-test('respects // socket-lint: allow console marker (slash-slash prefix)', async () => {
+test('respects // socket-lint: allow process-stdio marker on a process.* write', async () => {
   const { code } = await runHook({
     tool_name: 'Edit',
     tool_input: {
       file_path: 'src/foo.ts',
-      new_string: 'process.stderr.write(buf) // socket-lint: allow console',
+      new_string: 'process.stderr.write(buf) // socket-lint: allow process-stdio',
     },
   })
   assert.equal(code, 0)
 })
 
+test('a process.* write waived with the console id is still flagged (needs process-stdio)', async () => {
+  const { code } = await runHook({
+    tool_name: 'Edit',
+    tool_input: {
+      file_path: 'src/foo.ts',
+      new_string: 'process.stderr.write(buf) // socket-lint: allow console',
+    },
+  })
+  assert.equal(code, 2)
+})
+
 test('respects /* socket-lint: allow console */ marker (block-comment prefix)', async () => {
   const { code } = await runHook({
     tool_name: 'Edit',