chore(deps): bump catalog + oxfmt sweep

oxlint 1.63.0, oxfmt 0.48.0, taze 19.11.0, ts-preview 20260510.1.
Cascade from socket-wheelhouse bbea704.

Author: jdalton

.claude/agents/code-reviewer.md

@@ -19,6 +19,7 @@ Apply the rules from CLAUDE.md sections listed below. Reference the full section
 **Test Style**: Functional tests over source scanning. Never read source files and assert on contents. Verify behavior with real function calls.
 
 For each file reviewed, report:
+
 - **Style violations** with file:line
 - **Logic issues** (bugs, edge cases, missing error handling)
 - **Test gaps** (untested code paths)

.claude/agents/refactor-cleaner.md

@@ -17,6 +17,7 @@ Apply these rules from CLAUDE.md exactly:
 5. **Verify nothing broke**: Run `pnpm run check` and `pnpm test` after each phase
 
 **What to look for:**
+
 - Unused exports (exported but never imported elsewhere)
 - Dead imports (imported but never used)
 - Unreachable code paths

.claude/hooks/setup-security-tools/update.mts

@@ -13,7 +13,10 @@ import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-import { httpDownload, httpRequest } from '@socketsecurity/lib-stable/http-request'
+import {
+  httpDownload,
+  httpRequest,
+} from '@socketsecurity/lib-stable/http-request'
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
 import { spawn } from '@socketsecurity/lib-stable/spawn'
 
@@ -38,14 +41,18 @@ function readCooldownMs(): number {
       } catch {
         // Read error.
       }
-      logger.warn(`Could not read minimumReleaseAge from ${candidate}, defaulting to ${DEFAULT_COOLDOWN_MINUTES} minutes`)
+      logger.warn(
+        `Could not read minimumReleaseAge from ${candidate}, defaulting to ${DEFAULT_COOLDOWN_MINUTES} minutes`,
+      )
       return DEFAULT_COOLDOWN_MINUTES * MS_PER_MINUTE
     }
     const parent = path.dirname(dir)
     if (parent === dir) break
     dir = parent
   }
-  logger.warn(`pnpm-workspace.yaml not found, defaulting cooldown to ${DEFAULT_COOLDOWN_MINUTES} minutes`)
+  logger.warn(
+    `pnpm-workspace.yaml not found, defaulting cooldown to ${DEFAULT_COOLDOWN_MINUTES} minutes`,
+  )
   return DEFAULT_COOLDOWN_MINUTES * MS_PER_MINUTE
 }
 
@@ -71,9 +78,7 @@ async function ghApiLatestRelease(repo: string): Promise<GhRelease> {
     { stdio: 'pipe' },
   )
   const stdout =
-    typeof result.stdout === 'string'
-      ? result.stdout
-      : result.stdout.toString()
+    typeof result.stdout === 'string' ? result.stdout : result.stdout.toString()
   return JSON.parse(stdout) as GhRelease
 }
 
@@ -108,7 +113,11 @@ function readConfig(): Config {
 }
 
 async function writeConfig(config: Config): Promise<void> {
-  await fs.writeFile(CONFIG_FILE, JSON.stringify(config, undefined, 2) + '\n', 'utf8')
+  await fs.writeFile(
+    CONFIG_FILE,
+    JSON.stringify(config, undefined, 2) + '\n',
+    'utf8',
+  )
 }
 
 // ── Checksum computation ──
@@ -119,7 +128,10 @@ async function computeSha256(filePath: string): Promise<string> {
 }
 
 async function downloadAndHash(url: string): Promise<string> {
-  const tmpFile = path.join(tmpdir(), `security-tools-update-${Date.now()}-${Math.random().toString(36).slice(2)}`)
+  const tmpFile = path.join(
+    tmpdir(),
+    `security-tools-update-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+  )
   try {
     await httpDownload(url, tmpFile, { retries: 2 })
     return await computeSha256(tmpFile)
@@ -146,7 +158,8 @@ async function updateZizmor(config: Config): Promise<UpdateResult> {
     return { tool, skipped: true, updated: false, reason: 'not in config' }
   }
 
-  const repo = toolConfig.repository?.replace(/^[^:]+:/, '') ?? 'zizmorcore/zizmor'
+  const repo =
+    toolConfig.repository?.replace(/^[^:]+:/, '') ?? 'zizmorcore/zizmor'
 
   let release: GhRelease
   try {
@@ -169,10 +182,20 @@ async function updateZizmor(config: Config): Promise<UpdateResult> {
 
   // Respect cooldown for third-party tools.
   if (!isOlderThanCooldown(release.published_at)) {
-    const daysOld = ((Date.now() - new Date(release.published_at).getTime()) / 86_400_000).toFixed(1)
+    const daysOld = (
+      (Date.now() - new Date(release.published_at).getTime()) /
+      86_400_000
+    ).toFixed(1)
     const cooldownDays = (COOLDOWN_MS / 86_400_000).toFixed(0)
-    logger.log(`v${latestVersion} is only ${daysOld} days old (need ${cooldownDays}). Skipping.`)
-    return { tool, skipped: true, updated: false, reason: `too new (${daysOld} days, need ${cooldownDays})` }
+    logger.log(
+      `v${latestVersion} is only ${daysOld} days old (need ${cooldownDays}). Skipping.`,
+    )
+    return {
+      tool,
+      skipped: true,
+      updated: false,
+      reason: `too new (${daysOld} days, need ${cooldownDays})`,
+    }
   }
 
   logger.log(`Updating to v${latestVersion}...`)
@@ -199,7 +222,9 @@ async function updateZizmor(config: Config): Promise<UpdateResult> {
 
   // Compute checksums for each asset in the config.
   const currentChecksums = toolConfig.checksums ?? {}
-  const newChecksums: Record<string, string> = { __proto__: null } as unknown as Record<string, string>
+  const newChecksums: Record<string, string> = {
+    __proto__: null,
+  } as unknown as Record<string, string>
   let allFound = true
 
   for (const assetName of Object.keys(currentChecksums)) {
@@ -235,23 +260,35 @@ async function updateZizmor(config: Config): Promise<UpdateResult> {
     newChecksums[assetName] = newHash
     const oldHash = currentChecksums[assetName]
     if (oldHash && oldHash !== newHash) {
-      logger.log(`  ${assetName}: ${oldHash.slice(0, 12)}... -> ${newHash.slice(0, 12)}...`)
+      logger.log(
+        `  ${assetName}: ${oldHash.slice(0, 12)}... -> ${newHash.slice(0, 12)}...`,
+      )
     } else if (oldHash === newHash) {
       logger.log(`  ${assetName}: unchanged`)
     }
   }
 
   if (!allFound) {
     logger.warn('Some assets could not be verified. Skipping version bump.')
-    return { tool, skipped: true, updated: false, reason: 'incomplete asset checksums' }
+    return {
+      tool,
+      skipped: true,
+      updated: false,
+      reason: 'incomplete asset checksums',
+    }
   }
 
   // Update config.
   toolConfig.version = latestVersion
   toolConfig.checksums = newChecksums
   logger.log(`Updated zizmor: ${currentVersion} -> ${latestVersion}`)
 
-  return { tool, skipped: false, updated: true, reason: `${currentVersion} -> ${latestVersion}` }
+  return {
+    tool,
+    skipped: false,
+    updated: true,
+    reason: `${currentVersion} -> ${latestVersion}`,
+  }
 }
 
 // ── SFW update ──
@@ -262,12 +299,22 @@ async function updateSfwTool(
 ): Promise<UpdateResult> {
   const toolConfig = config.tools[toolName]
   if (!toolConfig) {
-    return { tool: toolName, skipped: true, updated: false, reason: 'not in config' }
+    return {
+      tool: toolName,
+      skipped: true,
+      updated: false,
+      reason: 'not in config',
+    }
   }
 
   const repo = toolConfig.repository?.replace(/^[^:]+:/, '')
   if (!repo) {
-    return { tool: toolName, skipped: true, updated: false, reason: 'no repository' }
+    return {
+      tool: toolName,
+      skipped: true,
+      updated: false,
+      reason: 'no repository',
+    }
   }
 
   let release: GhRelease
@@ -276,15 +323,24 @@ async function updateSfwTool(
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e)
     logger.warn(`Failed to fetch ${toolName} releases: ${msg}`)
-    return { tool: toolName, skipped: true, updated: false, reason: `API error: ${msg}` }
+    return {
+      tool: toolName,
+      skipped: true,
+      updated: false,
+      reason: `API error: ${msg}`,
+    }
   }
 
-  logger.log(`  ${toolName}: latest ${release.tag_name} (published ${release.published_at.slice(0, 10)})`)
+  logger.log(
+    `  ${toolName}: latest ${release.tag_name} (published ${release.published_at.slice(0, 10)})`,
+  )
 
   const currentChecksums = toolConfig.checksums ?? {}
   const platforms = toolConfig.platforms ?? {}
   const prefix = toolName === 'sfw-enterprise' ? 'sfw' : 'sfw-free'
-  const newChecksums: Record<string, string> = { __proto__: null } as unknown as Record<string, string>
+  const newChecksums: Record<string, string> = {
+    __proto__: null,
+  } as unknown as Record<string, string>
   let changed = false
   let allFound = true
 
@@ -300,7 +356,9 @@ async function updateSfwTool(
       const hash = await downloadAndHash(url)
       newChecksums[sfwPlatform] = hash
       if (currentChecksums[sfwPlatform] !== hash) {
-        logger.log(`    ${sfwPlatform}: ${(currentChecksums[sfwPlatform] ?? '').slice(0, 12)}... -> ${hash.slice(0, 12)}...`)
+        logger.log(
+          `    ${sfwPlatform}: ${(currentChecksums[sfwPlatform] ?? '').slice(0, 12)}... -> ${hash.slice(0, 12)}...`,
+        )
         changed = true
       }
     } catch (e) {
@@ -311,17 +369,34 @@ async function updateSfwTool(
   }
 
   if (!allFound) {
-    logger.warn(`  Some ${toolName} assets could not be downloaded. Skipping update.`)
-    return { tool: toolName, skipped: true, updated: false, reason: 'incomplete downloads' }
+    logger.warn(
+      `  Some ${toolName} assets could not be downloaded. Skipping update.`,
+    )
+    return {
+      tool: toolName,
+      skipped: true,
+      updated: false,
+      reason: 'incomplete downloads',
+    }
   }
 
   if (changed) {
     toolConfig.version = release.tag_name
     toolConfig.checksums = newChecksums
-    return { tool: toolName, skipped: false, updated: true, reason: 'checksums updated' }
+    return {
+      tool: toolName,
+      skipped: false,
+      updated: true,
+      reason: 'checksums updated',
+    }
   }
 
-  return { tool: toolName, skipped: false, updated: false, reason: 'already current' }
+  return {
+    tool: toolName,
+    skipped: false,
+    updated: false,
+    reason: 'already current',
+  }
 }
 
 async function updateSfw(config: Config): Promise<UpdateResult[]> {

.claude/hooks/token-hygiene/README.md

@@ -4,13 +4,13 @@ Claude Code `PreToolUse` hook that refuses Bash tool calls that would leak secre
 
 ## What it blocks
 
-| Rule | Example | Fix |
-|------|---------|-----|
-| Literal token in command | `echo vtwn_abc123…` | Rotate the exposed token; read tokens from `.env.local` at spawn time, never inline them |
-| `env`/`printenv`/`export -p`/`set` dumping everything | `env \| grep FOO` (unredacted) | `env \| sed 's/=.*/=<redacted>/'` or filter specific keys |
-| `.env*` read without redactor | `cat .env.local` | `sed 's/=.*/=<redacted>/' .env.local` or `grep -v '^#' .env.local \| cut -d= -f1` |
-| `curl -H "Authorization:"` with unfiltered stdout | `curl -H "Authorization: Bearer $TOKEN" api.example.com` | Redirect to file/`/dev/null`, or pipe to `jq`/`grep`/`head`/`wc`/`cut`/`awk` |
-| References sensitive env var name writing unredacted to stdout | `echo $API_KEY` | Same as above |
+| Rule                                                           | Example                                                  | Fix                                                                                      |
+| -------------------------------------------------------------- | -------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
+| Literal token in command                                       | `echo vtwn_abc123…`                                      | Rotate the exposed token; read tokens from `.env.local` at spawn time, never inline them |
+| `env`/`printenv`/`export -p`/`set` dumping everything          | `env \| grep FOO` (unredacted)                           | `env \| sed 's/=.*/=<redacted>/'` or filter specific keys                                |
+| `.env*` read without redactor                                  | `cat .env.local`                                         | `sed 's/=.*/=<redacted>/' .env.local` or `grep -v '^#' .env.local \| cut -d= -f1`        |
+| `curl -H "Authorization:"` with unfiltered stdout              | `curl -H "Authorization: Bearer $TOKEN" api.example.com` | Redirect to file/`/dev/null`, or pipe to `jq`/`grep`/`head`/`wc`/`cut`/`awk`             |
+| References sensitive env var name writing unredacted to stdout | `echo $API_KEY`                                          | Same as above                                                                            |
 
 ## What it allows
 

.claude/hooks/token-hygiene/test/token-hygiene.test.mts

@@ -1,10 +1,8 @@
 /**
- * @fileoverview Tests for the token-hygiene hook.
- *
- * Runs the hook as a subprocess (node --test), piping a tool-use
- * payload on stdin and asserting on the exit code + stderr. Exit 2
- * means the hook refused the command; exit 0 means it passed it
- * through.
+ * @file Tests for the token-hygiene hook. Runs the hook as a subprocess (node
+ *   --test), piping a tool-use payload on stdin and asserting on the exit code
+ *   + stderr. Exit 2 means the hook refused the command; exit 0 means it passed
+ *   it through.
  */
 
 import { describe, it } from 'node:test'
@@ -19,7 +17,10 @@ if (!nodeBin) {
   throw new Error('"node" not found on PATH')
 }
 
-function runHook(command: string, toolName = 'Bash'): {
+function runHook(
+  command: string,
+  toolName = 'Bash',
+): {
   code: number | null
   stdout: string
   stderr: string
@@ -55,16 +56,10 @@ describe('token-hygiene hook', () => {
       assert.equal(runHook('node scripts/build.mts').code, 0)
     })
     it('sed with redaction on .env', () => {
-      assert.equal(
-        runHook("sed 's/=.*/=<redacted>/' .env.local").code,
-        0,
-      )
+      assert.equal(runHook("sed 's/=.*/=<redacted>/' .env.local").code, 0)
     })
     it('grep key-names-only on .env', () => {
-      assert.equal(
-        runHook("grep -v '^#' .env.local | cut -d= -f1").code,
-        0,
-      )
+      assert.equal(runHook("grep -v '^#' .env.local | cut -d= -f1").code, 0)
     })
     it('curl without Authorization header', () => {
       assert.equal(runHook('curl -sS https://api.example.com').code, 0)
@@ -102,9 +97,7 @@ describe('token-hygiene hook', () => {
       assert.match(r.stderr, /Linear API token/)
     })
     it('GitHub PAT', () => {
-      const r = runHook(
-        'echo ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcd1234',
-      )
+      const r = runHook('echo ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcd1234')
       assert.equal(r.code, 2)
       assert.match(r.stderr, /GitHub personal access token/)
     })
@@ -175,10 +168,7 @@ describe('token-hygiene hook', () => {
       assert.equal(runHook('echo $API_KEY').code, 2)
     })
     it('ruby -e with $TOKEN', () => {
-      assert.equal(
-        runHook('ruby -e "puts ENV[\'ACCESS_TOKEN\']"').code,
-        2,
-      )
+      assert.equal(runHook('ruby -e "puts ENV[\'ACCESS_TOKEN\']"').code, 2)
     })
   })
 

.claude/skills/guarding-paths/reference/claude-md-rule.md

@@ -6,9 +6,9 @@ This file is the rule snippet that goes into every Socket repo's CLAUDE.md
 
 ## 1 path, 1 reference
 
-**A path is *constructed* exactly once. Everywhere else *references* the constructed value.**
+**A path is _constructed_ exactly once. Everywhere else _references_ the constructed value.**
 
-Referencing a single computed path many times is fine — that's the whole point of computing it once. What's banned is *re-constructing* the same path in multiple places, because that's where drift is born.
+Referencing a single computed path many times is fine — that's the whole point of computing it once. What's banned is _re-constructing_ the same path in multiple places, because that's where drift is born.
 
 Three concrete shapes:
 
@@ -18,7 +18,7 @@ Three concrete shapes:
 
 3. **Workflows, Dockerfiles, shell scripts** — they can't `import` TS, so they construct the string once and reference it everywhere downstream. Workflows: a "Compute paths" step exposes `steps.paths.outputs.final_dir`; later steps read `${{ steps.paths.outputs.final_dir }}`. Dockerfiles/shell: assign once to a variable / `ENV`, reference by name thereafter. Each canonical construction carries a comment naming the source-of-truth `paths.mts`. **Re-building** the same path in a second step is the violation, not referring to the constructed value many times.
 
-Comments may describe path *structure* with placeholders ("`<mode>/<arch>`" or "`${BUILD_MODE}/${PLATFORM_ARCH}`") but should not encode a complete literal path string. Code execution takes priority over docs: violations in `.mts`/`.cts`, Makefiles, Dockerfiles, workflow YAML, and shell scripts are blocking. README and doc-comment violations are advisory unless they contain a fully-qualified path with no parametric placeholders.
+Comments may describe path _structure_ with placeholders ("`<mode>/<arch>`" or "`${BUILD_MODE}/${PLATFORM_ARCH}`") but should not encode a complete literal path string. Code execution takes priority over docs: violations in `.mts`/`.cts`, Makefiles, Dockerfiles, workflow YAML, and shell scripts are blocking. README and doc-comment violations are advisory unless they contain a fully-qualified path with no parametric placeholders.
 
 ### Three-level enforcement