chore(claude+sync): fleet-canonical sync from socket-repo-template

Picks up the fleet's "soak window" terminology shift in CLAUDE.md
(pnpm-workspace.yaml minimumReleaseAge → "soak window … default 7
days") and security-reviewer.md (dependency review checklist
phrased as "soak-window bypass justification").

Also picks up pre-existing template drifts (path-guard, token-guard,
xport-schema, _shared/path-guard-rule) that had accumulated since
the last fleet sync — these are unrelated to the soak-window
terminology change but sync-scaffolding rolls them in by design.

Generated by `node scripts/sync-scaffolding.mts --all --fix`.

Author: jdalton

.claude/agents/security-reviewer.md

@@ -18,7 +18,7 @@ Apply these rules from CLAUDE.md exactly:
 
 1. **Secrets**: Hardcoded API keys, passwords, tokens, private keys in code or config
 2. **Injection**: Command injection via shell: true or string interpolation in spawn/exec. Path traversal in file operations.
-3. **Dependencies**: npx/dlx usage. Unpinned versions (^ or ~). Missing minimumReleaseAge bypass justification. # zizmor: documentation-checklist
+3. **Dependencies**: npx/dlx usage. Unpinned versions (^ or ~). Missing soak-window bypass justification (pnpm-workspace.yaml `minimumReleaseAgeExclude`). # zizmor: documentation-checklist
 4. **File operations**: fs.rm without safeDelete. process.chdir usage. fetch() usage (must use lib's httpRequest).
 5. **GitHub Actions**: Unpinned action versions (must use full SHA). Secrets outside env blocks. Template injection from untrusted inputs.
 6. **Error handling**: Sensitive data in error messages. Stack traces exposed to users.

.claude/hooks/path-guard/README.md

@@ -1,6 +1,6 @@
 # path-guard
 
-Claude Code `PreToolUse` hook that refuses `Edit`/`Write` tool calls that would *construct* a multi-segment build/output path inline in a `.mts` or `.cts` file. Mandatory across the Socket fleet — every repo ships this file byte-for-byte via `scripts/sync-scaffolding.mjs`.
+Claude Code `PreToolUse` hook that refuses `Edit`/`Write` tool calls that would *construct* a multi-segment build/output path inline in a `.mts` or `.cts` file. Mandatory across the Socket fleet — every repo ships this file byte-for-byte via `scripts/sync-scaffolding.mts`.
 
 **Mantra: 1 path, 1 reference.**
 
@@ -57,10 +57,10 @@ Adding a new detection pattern: update `STAGE_SEGMENTS` (or `KNOWN_SIBLING_PACKA
 
 ## Updating across the fleet
 
-This file is in `IDENTICAL_FILES` in `scripts/sync-scaffolding.mjs` (in `socket-repo-template`). After editing, run from `socket-repo-template`:
+This file is in `IDENTICAL_FILES` in `scripts/sync-scaffolding.mts` (in `socket-repo-template`). After editing, run from `socket-repo-template`:
 
 ```bash
-node scripts/sync-scaffolding.mjs --all --fix
+node scripts/sync-scaffolding.mts --all --fix
 ```
 
 to propagate the change to every fleet repo.

.claude/hooks/path-guard/segments.mts

@@ -6,7 +6,7 @@
 // consumers import from here so they can never drift apart.
 //
 // Synced byte-identically across the Socket fleet via
-// socket-repo-template/scripts/sync-scaffolding.mjs (IDENTICAL_FILES).
+// socket-repo-template/scripts/sync-scaffolding.mts (IDENTICAL_FILES).
 // When adding a new stage/build-root/mode/sibling, edit this file in
 // the template and re-sync.
 
@@ -41,7 +41,7 @@ export const MODE_SEGMENTS = new Set(['dev', 'prod', 'shared'])
 // Socket fleet — the gate is byte-identical via sync-scaffolding, so
 // listing every fleet package keeps Rule B firing in any repo. When a
 // new package joins the workspace, add it here and propagate via
-// `node scripts/sync-scaffolding.mjs --all --fix` from
+// `node scripts/sync-scaffolding.mts --all --fix` from
 // socket-repo-template.
 export const KNOWN_SIBLING_PACKAGES = new Set([
   // socket-btm

.claude/hooks/token-guard/README.md

@@ -1,6 +1,6 @@
 # token-guard
 
-Claude Code `PreToolUse` hook that refuses Bash tool calls that would leak secrets to tool output. Mandatory across the Socket fleet — every repo ships this file byte-for-byte via `scripts/sync-scaffolding.mjs`.
+Claude Code `PreToolUse` hook that refuses Bash tool calls that would leak secrets to tool output. Mandatory across the Socket fleet — every repo ships this file byte-for-byte via `scripts/sync-scaffolding.mts`.
 
 ## What it blocks
 
@@ -48,10 +48,10 @@ Adding new token-shape detections: update `LITERAL_TOKEN_PATTERNS` in `index.mts
 
 ## Updating across the fleet
 
-This file is in `IDENTICAL_FILES` in `scripts/sync-scaffolding.mjs`. After editing, run from `socket-repo-template`:
+This file is in `IDENTICAL_FILES` in `scripts/sync-scaffolding.mts`. After editing, run from `socket-repo-template`:
 
 ```bash
-node scripts/sync-scaffolding.mjs --all --fix
+node scripts/sync-scaffolding.mts --all --fix
 ```
 
 to propagate the change to every fleet repo.

.claude/skills/_shared/path-guard-rule.md

@@ -1,7 +1,7 @@
 <!--
 Shared snippet — the canonical "1 path, 1 reference" rule text.
 Synced byte-identical across the Socket fleet via socket-repo-template's
-sync-scaffolding.mjs (SHARED_SKILL_FILES).
+sync-scaffolding.mts (SHARED_SKILL_FILES).
 
 This file is the source of truth for the rule's wording. Three artifacts
 embed (or paraphrase) it:
@@ -10,7 +10,7 @@ embed (or paraphrase) it:
   2. .claude/hooks/path-guard/README.md — what the hook blocks.
   3. .claude/skills/path-guard/SKILL.md — what the skill enforces.
 
-If the wording changes here, re-run `node scripts/sync-scaffolding.mjs
+If the wording changes here, re-run `node scripts/sync-scaffolding.mts
 --all --fix` from socket-repo-template to propagate.
 -->
 

.git-hooks/pre-commit.mts

@@ -242,7 +242,7 @@ const main = (): number => {
         }
       }
       out(
-        'Use `getDefaultLogger()` from `@socketsecurity/lib/logger`. ' +
+        "Use `getDefaultLogger()` from `@socketsecurity/lib/logger`. " +
           'For documentation lines that need the literal call, append ' +
           'the marker `# socket-hook: allow logger`.',
       )

CLAUDE.md

@@ -2,7 +2,7 @@
 
 **MANDATORY**: Act as principal-level engineer. Follow these guidelines exactly.
 
-<!-- BEGIN FLEET-CANONICAL — sync via socket-repo-template/scripts/sync-scaffolding.mjs. Do not edit downstream. -->
+<!-- BEGIN FLEET-CANONICAL — sync via socket-repo-template/scripts/sync-scaffolding.mts. Do not edit downstream. -->
 
 ## 📚 Fleet Standards
 
@@ -59,7 +59,7 @@ The umbrella rule: never run a git command that mutates state belonging to a pat
 
 - **Package manager**: `pnpm`. Run scripts via `pnpm run foo --flag`, never `foo:bar`. After `package.json` edits, `pnpm install`.
 - 🚨 NEVER use `npx`, `pnpm dlx`, or `yarn dlx` — use `pnpm exec <package>` or `pnpm run <script>` # socket-hook: allow npx
-- **`minimumReleaseAge`** — never add packages to `minimumReleaseAgeExclude` in CI. Locally, ASK before adding (security control).
+- **Soak window** (pnpm-workspace.yaml `minimumReleaseAge`, default 7 days) — never add packages to `minimumReleaseAgeExclude` in CI. Locally, ASK before adding (security control).
 - **Backward compatibility** — FORBIDDEN to maintain. Actively remove when encountered.
 
 ### Code style

scripts/xport-schema.mts

@@ -10,7 +10,7 @@
  *     `@socketsecurity/lib/validation/validate-schema`
  *
  * Byte-identical across socket-tui / socket-btm / socket-sdxgen / ultrathink /
- * socket-registry / socket-repo-template via sync-scaffolding.mjs.
+ * socket-registry / socket-repo-template via sync-scaffolding.mts.
  */
 
 import { Type, type Static } from '@sinclair/typebox'

xport.schema.json

@@ -4,7 +4,9 @@
   "title": "xport lock-step manifest",
   "description": "Unified lock-step manifest shared across Socket repos. One schema, all cases — `kind` discriminator on each row selects which flavor of lock-step applies.",
   "type": "object",
-  "required": ["rows"],
+  "required": [
+    "rows"
+  ],
   "properties": {
     "$schema": {
       "type": "string"
@@ -30,7 +32,10 @@
         "^(.*)$": {
           "additionalProperties": false,
           "type": "object",
-          "required": ["submodule", "repo"],
+          "required": [
+            "submodule",
+            "repo"
+          ],
           "properties": {
             "submodule": {
               "description": "Submodule path, relative to repo root.",
@@ -52,7 +57,9 @@
         "^(.*)$": {
           "additionalProperties": false,
           "type": "object",
-          "required": ["path"],
+          "required": [
+            "path"
+          ],
           "properties": {
             "path": {
               "description": "Path to the port's root directory, relative to repo root.",
@@ -205,7 +212,13 @@
             "additionalProperties": false,
             "description": "A behavioral feature reimplemented locally to match upstream behavior. Three-pillar validation: code patterns, test patterns, fixture snapshots.",
             "type": "object",
-            "required": ["kind", "id", "upstream", "criticality", "local_area"],
+            "required": [
+              "kind",
+              "id",
+              "upstream",
+              "criticality",
+              "local_area"
+            ],
             "properties": {
               "kind": {
                 "const": "feature-parity",
@@ -260,7 +273,9 @@
                 "additionalProperties": false,
                 "description": "Golden-input verification. Prefer snapshot-based diffs over hardcoded counts (brittleness lesson from sdxgen's lock-step-features).",
                 "type": "object",
-                "required": ["fixture_path"],
+                "required": [
+                  "fixture_path"
+                ],
                 "properties": {
                   "fixture_path": {
                     "type": "string"
@@ -410,7 +425,9 @@
                     "additionalProperties": false,
                     "description": "Per-port status for a lang-parity row. `implemented` = port meets assertions; `opt-out` = port consciously skips, requires non-empty `reason`.",
                     "type": "object",
-                    "required": ["status"],
+                    "required": [
+                      "status"
+                    ],
                     "properties": {
                       "status": {
                         "anyOf": [