chore(sync): cascade fleet template@9ff8d75

Auto-applied by socket-wheelhouse sync-scaffolding into vscode-socket-security.
10 file(s) touched:
  - .claude/hooks/lock-step-ref-guard/index.mts
  - .claude/hooks/lock-step-ref-guard/test/index.test.mts
  - .claude/hooks/marketplace-comment-guard/README.md
  - .claude/hooks/minify-mcp-output/README.md
  - .claude/hooks/minify-mcp-output/index.mts
  - .claude/hooks/minify-mcp-output/test/index.test.mts
  - .claude/hooks/no-file-scope-oxlint-disable-guard/index.mts
  - .config/oxlint-plugin/lib/fleet-paths.mts
  - .config/oxlint-plugin/rules/no-file-scope-oxlint-disable.mts
  - scripts/check-lock-step-refs.mts

Author: jdalton

.claude/hooks/lock-step-ref-guard/index.mts

@@ -364,9 +364,7 @@ async function main(): Promise<void> {
   out.push(
     '  CI gate: scripts/check-lock-step-refs.mts (run via `pnpm check`).',
   )
-  out.push(
-    '  Bypass: "Allow lock-step bypass" in a recent user message, or',
-  )
+  out.push('  Bypass: "Allow lock-step bypass" in a recent user message, or')
   out.push(`  ${ENV_DISABLE}=1.`)
   out.push('')
   process.stderr.write(out.join('\n') + '\n')

.claude/hooks/lock-step-ref-guard/test/index.test.mts

@@ -19,10 +19,12 @@ function makeTranscript(userText?: string): string {
   return transcriptPath
 }
 
-function makeRepo(opts: {
-  configContent?: string
-  existingFiles?: readonly string[]
-} = {}): string {
+function makeRepo(
+  opts: {
+    configContent?: string
+    existingFiles?: readonly string[]
+  } = {},
+): string {
   const root = mkdtempSync(path.join(tmpdir(), 'lsrg-repo-'))
   if (opts.configContent !== undefined) {
     mkdirSync(path.join(root, '.config'), { recursive: true })
@@ -118,7 +120,11 @@ test('ACCEPTS canonical "Lock-step with Go: parser.go" (no config)', () => {
 test('ACCEPTS file-level "//! Lock-step from Rust: crates/parser/src/class.rs"', () => {
   const content =
     '//! Lock-step from Rust: crates/parser/src/class.rs\npackage parser'
-  const { stderr, exitCode } = runHook('Write', '/repo/src/parser/class.go', content)
+  const { stderr, exitCode } = runHook(
+    'Write',
+    '/repo/src/parser/class.go',
+    content,
+  )
   assert.equal(exitCode, 0)
   assert.equal(stderr, '')
 })
@@ -143,7 +149,8 @@ test('FLAGS stale path when config opts in', () => {
       extensions: ['.go'],
     }),
   })
-  const content = '// Lock-step with Rust: crates/parser-stmt/src/foo.rs\nconst x = 1'
+  const content =
+    '// Lock-step with Rust: crates/parser-stmt/src/foo.rs\nconst x = 1'
   const { stderr, exitCode } = runHook(
     'Write',
     path.join(repo, 'src/foo.go'),
@@ -157,7 +164,8 @@ test('FLAGS stale path when config opts in', () => {
 
 test('ACCEPTS stale path when config absent (opt-in disabled)', () => {
   const repo = makeRepo() // no config
-  const content = '// Lock-step with Rust: crates/parser-stmt/src/foo.rs\nconst x = 1'
+  const content =
+    '// Lock-step with Rust: crates/parser-stmt/src/foo.rs\nconst x = 1'
   const { stderr, exitCode } = runHook(
     'Write',
     path.join(repo, 'src/foo.go'),

.claude/hooks/marketplace-comment-guard/README.md

@@ -32,23 +32,24 @@ against — opaque pins look fine and stay broken for months.
         "source": "git-subdir",
         "url": "https://github.com/openai/codex-plugin-cc.git",
         "ref": "v1.0.1",
-        "sha": "9cb4fe4099195b2587c402117a3efce6ab5aac78"
-      }
-    }
-  ]
+        "sha": "9cb4fe4099195b2587c402117a3efce6ab5aac78",
+      },
+    },
+  ],
 }
 ```
 
 ```markdown
 <!-- .claude-plugin/README.md -->
-| plugin | version | sha                                      | date       | notes                            |
-|--------|---------|------------------------------------------|------------|----------------------------------|
-| codex  | v1.0.1  | 9cb4fe4099195b2587c402117a3efce6ab5aac78 | 2026-05-18 | upstream openai/codex-plugin-cc  |
+
+| plugin | version | sha                                      | date       | notes                           |
+| ------ | ------- | ---------------------------------------- | ---------- | ------------------------------- |
+| codex  | v1.0.1  | 9cb4fe4099195b2587c402117a3efce6ab5aac78 | 2026-05-18 | upstream openai/codex-plugin-cc |
 ```
 
 The first four columns are required and inspected. Any trailing column
 (e.g. free-form `notes`) is accepted but not validated. `git blame` is the
-authoritative record of *who* bumped a pin, so a `by` column is deliberately
+authoritative record of _who_ bumped a pin, so a `by` column is deliberately
 absent — duplicating personal identifiers into fleet-canonical files is a
 public-surface-hygiene mistake.
 

.claude/hooks/minify-mcp-output/README.md

@@ -19,11 +19,11 @@ with `mcp__`. For built-in tools, use the proxy instead.
 
 ## Stages (identical to socket-token-minifier)
 
-| Stage         | What it does                                                       |
-| ------------- | ------------------------------------------------------------------ |
-| `minify`      | `JSON.stringify` without indent on JSON-shaped strings.            |
-| `strip-lines` | Removes `   42\t` cat -n style line prefixes.                      |
-| `whitespace`  | Collapses 3+ blank lines to a single blank line.                   |
+| Stage         | What it does                                            |
+| ------------- | ------------------------------------------------------- |
+| `minify`      | `JSON.stringify` without indent on JSON-shaped strings. |
+| `strip-lines` | Removes `   42\t` cat -n style line prefixes.           |
+| `whitespace`  | Collapses 3+ blank lines to a single blank line.        |
 
 All are deterministic, information-preserving transforms. No semantic
 compression, no ML, no Python.

.claude/hooks/minify-mcp-output/index.mts

@@ -66,17 +66,17 @@ function applyStages(text: string): string {
 // ---------- Tool-response walker ----------
 
 /**
- * Walk an MCP tool_response value and compress text content in place.
- * Returns the same structure with strings minified. Non-text content
- * (images, structured data we don't recognize) passes through
- * unchanged.
+ * Walk an MCP tool_response value and compress text content in place. Returns
+ * the same structure with strings minified. Non-text content (images,
+ * structured data we don't recognize) passes through unchanged.
  *
  * Shapes we handle:
- *   - string → minified string.
- *   - { type: "text", text: string } → minified text.
- *   - { content: <recurse> }
- *   - { type: "text", text: string }[] (typical MCP shape).
- *   - other → passes through.
+ *
+ * - String → minified string.
+ * - { type: "text", text: string } → minified text.
+ * - { content: <recurse> }
+ * - { type: "text", text: string }[] (typical MCP shape).
+ * - Other → passes through.
  */
 export function compressMCPOutput(value: unknown): unknown {
   if (typeof value === 'string') {

.claude/hooks/minify-mcp-output/test/index.test.mts

@@ -66,9 +66,7 @@ test('compressMCPOutput: minifies text blocks in arrays', () => {
 
 test('compressMCPOutput: walks into nested content fields', () => {
   const got = compressMCPOutput({
-    content: [
-      { type: 'text', text: '     1\tfoo\n' },
-    ],
+    content: [{ type: 'text', text: '     1\tfoo\n' }],
   })
   assert.deepEqual(got, {
     content: [{ type: 'text', text: 'foo\n' }],
@@ -129,9 +127,7 @@ test('hook: emits updatedMCPToolOutput for MCP tool with text content', () => {
   const { stdout, exitCode } = runHook({
     hook_event_name: 'PostToolUse',
     tool_name: 'mcp__github__list_repos',
-    tool_response: [
-      { type: 'text', text: '     1\tfoo\n     2\tbar\n' },
-    ],
+    tool_response: [{ type: 'text', text: '     1\tfoo\n     2\tbar\n' }],
   })
   assert.equal(exitCode, 0)
   const parsed = JSON.parse(stdout) as {
@@ -141,7 +137,10 @@ test('hook: emits updatedMCPToolOutput for MCP tool with text content', () => {
     }
   }
   assert.equal(parsed.hookSpecificOutput.hookEventName, 'PostToolUse')
-  assert.equal(parsed.hookSpecificOutput.updatedMCPToolOutput[0]!.text, 'foo\nbar\n')
+  assert.equal(
+    parsed.hookSpecificOutput.updatedMCPToolOutput[0]!.text,
+    'foo\nbar\n',
+  )
 })
 
 test('hook: emits updatedMCPToolOutput for MCP tool with string-shaped response', () => {

.claude/hooks/no-file-scope-oxlint-disable-guard/index.mts

@@ -154,7 +154,7 @@ async function main(): Promise<void> {
   lines.push('     justification next to the code it covers.')
   lines.push('')
   lines.push(
-    'If the entire file legitimately can\'t comply, the file needs a refactor',
+    "If the entire file legitimately can't comply, the file needs a refactor",
   )
   lines.push('— not a blanket exemption.')
   process.stderr.write(lines.join('\n') + '\n')

.config/oxlint-plugin/lib/fleet-paths.mts

@@ -1,35 +1,32 @@
 /**
- * @file Shared path-suffix constants for fleet-canonical files that any
- *   plugin rule may need to recognize. Centralizing these out of individual
- *   rule files lets multiple rules share the same opt-in / opt-out list
- *   without duplicating the path string + its rationale comment.
- *
- *   Examples of consumers:
+ * @file Shared path-suffix constants for fleet-canonical files that any plugin
+ *   rule may need to recognize. Centralizing these out of individual rule files
+ *   lets multiple rules share the same opt-in / opt-out list without
+ *   duplicating the path string + its rationale comment. Examples of
+ *   consumers:
  *
  *   - `no-file-scope-oxlint-disable` exempts `scripts/paths.mts` (deliberate
  *     flow-ordered exports, see PATHS_FILE constant below).
  *   - `socket/prefer-cached-for-loop` and `socket/no-cached-for-on-iterable`
  *     share `lib/iterable-kind.mts` for the binding-kind heuristic — sibling
- *     pattern.
- *
- *   When a new rule needs to recognize one of these path patterns, add the
- *   import here and use the constant, not a re-spelled literal.
+ *     pattern. When a new rule needs to recognize one of these path patterns,
+ *     add the import here and use the constant, not a re-spelled literal.
  */
 
 /**
  * The fleet's "1 path, 1 reference" source-of-truth file. Each fleet repo has
  * one. Its exports are ordered by path-resolution flow (REPO_ROOT → primary
- * roots → build paths → helpers) — deliberately not alphabetical, and the
- * order is load-bearing for code review. Anything keyed on per-file behavior
- * that recognizes `paths.mts` should match by suffix.
+ * roots → build paths → helpers) — deliberately not alphabetical, and the order
+ * is load-bearing for code review. Anything keyed on per-file behavior that
+ * recognizes `paths.mts` should match by suffix.
  */
 export const PATHS_FILE = 'scripts/paths.mts'
 
 /**
- * Plugin-internal rule + test directories. Rule files often contain the
- * banned shape they ban as lookup-table data (e.g. `no-status-emoji.mts`
- * literally contains the emoji it bans). Same for the matching test files,
- * which intentionally exercise the banned shape.
+ * Plugin-internal rule + test directories. Rule files often contain the banned
+ * shape they ban as lookup-table data (e.g. `no-status-emoji.mts` literally
+ * contains the emoji it bans). Same for the matching test files, which
+ * intentionally exercise the banned shape.
  */
 export const PLUGIN_RULE_DIR = '.config/oxlint-plugin/rules/'
 export const PLUGIN_TEST_DIR = '.config/oxlint-plugin/test/'

.config/oxlint-plugin/rules/no-file-scope-oxlint-disable.mts

@@ -28,10 +28,7 @@
 
 // Path-recognition helpers shared with sibling rules. See
 // `../lib/fleet-paths.mts` for the rationale behind each exemption.
-import {
-  isPathsModule,
-  isPluginInternalPath,
-} from '../lib/fleet-paths.mts'
+import { isPathsModule, isPluginInternalPath } from '../lib/fleet-paths.mts'
 import type { AstNode, RuleContext } from '../lib/rule-types.mts'
 
 const FILE_SCOPE_DISABLE_RE =