chore(sync): mark cascaded files as linguist-generated in .gitattributes

Fleet cascade of socket-wheelhouse@a0e72c2. Adds a managed block to
`.gitattributes` flagging all 204 cascaded files (IDENTICAL_FILES /
OPTIONAL_IDENTICAL_FILES / SHARED_SKILL_FILES) as `linguist-generated`.

GitHub now collapses these files in PR diff views by default (reviewer
can still expand on click) and excludes them from the repo's language
stats. Drift detection via sync-scaffolding still works as before.

Author: jdalton

.gitattributes

@@ -1,2 +1,212 @@
 * text=auto eol=lf
 *.lockb binary diff=lockb
+
+# ─── BEGIN fleet-canonical (managed by socket-wheelhouse sync) ──
+# Cascaded from socket-wheelhouse/template/. Don't edit locally —
+# edit upstream and re-cascade via sync-scaffolding. Marked
+# linguist-generated so GitHub PR diffs collapse them by default.
+.claude/agents/security-reviewer.md linguist-generated=true
+.claude/commands/quality-loop.md linguist-generated=true
+.claude/commands/security-scan.md linguist-generated=true
+.claude/commands/setup-security-tools.md linguist-generated=true
+.claude/commands/squash-history.md linguist-generated=true
+.claude/hooks/_shared/bash-quote-mask.mts linguist-generated=true
+.claude/hooks/_shared/test/bash-quote-mask.test.mts linguist-generated=true
+.claude/hooks/auth-rotation-reminder/README.md linguist-generated=true
+.claude/hooks/auth-rotation-reminder/index.mts linguist-generated=true
+.claude/hooks/auth-rotation-reminder/package.json linguist-generated=true
+.claude/hooks/auth-rotation-reminder/services.mts linguist-generated=true
+.claude/hooks/auth-rotation-reminder/test/auth-rotation-reminder.test.mts linguist-generated=true
+.claude/hooks/auth-rotation-reminder/tsconfig.json linguist-generated=true
+.claude/hooks/check-new-deps/README.md linguist-generated=true
+.claude/hooks/check-new-deps/index.mts linguist-generated=true
+.claude/hooks/check-new-deps/package.json linguist-generated=true
+.claude/hooks/claude-md-size-guard/README.md linguist-generated=true
+.claude/hooks/claude-md-size-guard/index.mts linguist-generated=true
+.claude/hooks/claude-md-size-guard/package.json linguist-generated=true
+.claude/hooks/claude-md-size-guard/test/index.test.mts linguist-generated=true
+.claude/hooks/claude-md-size-guard/tsconfig.json linguist-generated=true
+.claude/hooks/cross-repo-guard/README.md linguist-generated=true
+.claude/hooks/cross-repo-guard/index.mts linguist-generated=true
+.claude/hooks/cross-repo-guard/package.json linguist-generated=true
+.claude/hooks/cross-repo-guard/test/cross-repo-guard.test.mts linguist-generated=true
+.claude/hooks/cross-repo-guard/tsconfig.json linguist-generated=true
+.claude/hooks/excuse-detector/README.md linguist-generated=true
+.claude/hooks/excuse-detector/index.mts linguist-generated=true
+.claude/hooks/excuse-detector/package.json linguist-generated=true
+.claude/hooks/excuse-detector/test/index.test.mts linguist-generated=true
+.claude/hooks/excuse-detector/tsconfig.json linguist-generated=true
+.claude/hooks/gitmodules-comment-guard/README.md linguist-generated=true
+.claude/hooks/gitmodules-comment-guard/index.mts linguist-generated=true
+.claude/hooks/gitmodules-comment-guard/package.json linguist-generated=true
+.claude/hooks/gitmodules-comment-guard/tsconfig.json linguist-generated=true
+.claude/hooks/logger-guard/README.md linguist-generated=true
+.claude/hooks/logger-guard/index.mts linguist-generated=true
+.claude/hooks/logger-guard/package.json linguist-generated=true
+.claude/hooks/logger-guard/test/logger-guard.test.mts linguist-generated=true
+.claude/hooks/logger-guard/tsconfig.json linguist-generated=true
+.claude/hooks/markdown-filename-guard/README.md linguist-generated=true
+.claude/hooks/markdown-filename-guard/index.mts linguist-generated=true
+.claude/hooks/markdown-filename-guard/package.json linguist-generated=true
+.claude/hooks/markdown-filename-guard/test/index.test.mts linguist-generated=true
+.claude/hooks/markdown-filename-guard/tsconfig.json linguist-generated=true
+.claude/hooks/no-experimental-strip-types-guard/README.md linguist-generated=true
+.claude/hooks/no-experimental-strip-types-guard/index.mts linguist-generated=true
+.claude/hooks/no-experimental-strip-types-guard/package.json linguist-generated=true
+.claude/hooks/no-experimental-strip-types-guard/test/index.test.mts linguist-generated=true
+.claude/hooks/no-experimental-strip-types-guard/tsconfig.json linguist-generated=true
+.claude/hooks/no-fleet-fork-guard/README.md linguist-generated=true
+.claude/hooks/no-fleet-fork-guard/index.mts linguist-generated=true
+.claude/hooks/no-fleet-fork-guard/package.json linguist-generated=true
+.claude/hooks/no-fleet-fork-guard/test/index.test.mts linguist-generated=true
+.claude/hooks/no-fleet-fork-guard/tsconfig.json linguist-generated=true
+.claude/hooks/no-revert-guard/README.md linguist-generated=true
+.claude/hooks/no-revert-guard/index.mts linguist-generated=true
+.claude/hooks/no-revert-guard/package.json linguist-generated=true
+.claude/hooks/no-revert-guard/test/index.test.mts linguist-generated=true
+.claude/hooks/no-revert-guard/tsconfig.json linguist-generated=true
+.claude/hooks/path-guard/README.md linguist-generated=true
+.claude/hooks/path-guard/index.mts linguist-generated=true
+.claude/hooks/path-guard/package.json linguist-generated=true
+.claude/hooks/path-guard/segments.mts linguist-generated=true
+.claude/hooks/path-guard/test/path-guard.test.mts linguist-generated=true
+.claude/hooks/path-guard/tsconfig.json linguist-generated=true
+.claude/hooks/private-name-guard/README.md linguist-generated=true
+.claude/hooks/public-surface-reminder/README.md linguist-generated=true
+.claude/hooks/release-workflow-guard/README.md linguist-generated=true
+.claude/hooks/setup-security-tools/README.md linguist-generated=true
+.claude/hooks/stale-process-sweeper/README.md linguist-generated=true
+.claude/hooks/stale-process-sweeper/index.mts linguist-generated=true
+.claude/hooks/stale-process-sweeper/package.json linguist-generated=true
+.claude/hooks/stale-process-sweeper/test/stale-process-sweeper.test.mts linguist-generated=true
+.claude/hooks/stale-process-sweeper/tsconfig.json linguist-generated=true
+.claude/hooks/token-guard/README.md linguist-generated=true
+.claude/hooks/token-guard/index.mts linguist-generated=true
+.claude/hooks/token-guard/package.json linguist-generated=true
+.claude/hooks/token-guard/test/token-guard.test.mts linguist-generated=true
+.claude/hooks/token-guard/tsconfig.json linguist-generated=true
+.claude/settings.json linguist-generated=true
+.claude/skills/_shared/compound-lessons.md linguist-generated=true
+.claude/skills/_shared/env-check.md linguist-generated=true
+.claude/skills/_shared/multi-agent-backends.md linguist-generated=true
+.claude/skills/_shared/path-guard-rule.md linguist-generated=true
+.claude/skills/_shared/report-format.md linguist-generated=true
+.claude/skills/_shared/scripts/git-default-branch.mts linguist-generated=true
+.claude/skills/_shared/scripts/logger-guardrails.mts linguist-generated=true
+.claude/skills/_shared/scripts/resolve-tools.mts linguist-generated=true
+.claude/skills/_shared/security-tools.md linguist-generated=true
+.claude/skills/_shared/skill-authoring.md linguist-generated=true
+.claude/skills/_shared/variant-analysis.md linguist-generated=true
+.claude/skills/_shared/verify-build.md linguist-generated=true
+.claude/skills/driving-cursor-bugbot/SKILL.md linguist-generated=true
+.claude/skills/driving-cursor-bugbot/reference.md linguist-generated=true
+.claude/skills/guarding-paths/SKILL.md linguist-generated=true
+.claude/skills/guarding-paths/reference.md linguist-generated=true
+.claude/skills/guarding-paths/templates/check-paths.mts.tmpl linguist-generated=true
+.claude/skills/guarding-paths/templates/paths-allowlist.yml.tmpl linguist-generated=true
+.claude/skills/handing-off/SKILL.md linguist-generated=true
+.claude/skills/locking-down-programmatic-claude/SKILL.md linguist-generated=true
+.claude/skills/plug-leaking-promise-race/SKILL.md linguist-generated=true
+.claude/skills/refreshing-history/SKILL.md linguist-generated=true
+.claude/skills/refreshing-history/run.mts linguist-generated=true
+.claude/skills/reviewing-code/SKILL.md linguist-generated=true
+.claude/skills/reviewing-code/run.mts linguist-generated=true
+.claude/skills/scanning-quality/SKILL.md linguist-generated=true
+.claude/skills/scanning-quality/scans/bundle-trim.md linguist-generated=true
+.claude/skills/scanning-quality/scans/differential.md linguist-generated=true
+.claude/skills/scanning-quality/scans/insecure-defaults.md linguist-generated=true
+.claude/skills/scanning-quality/scans/variant-analysis.md linguist-generated=true
+.claude/skills/scanning-security/SKILL.md linguist-generated=true
+.claude/skills/squashing-history/SKILL.md linguist-generated=true
+.claude/skills/squashing-history/reference.md linguist-generated=true
+.claude/skills/updating-lockstep/SKILL.md linguist-generated=true
+.claude/skills/updating-lockstep/reference.md linguist-generated=true
+.claude/skills/updating/SKILL.md linguist-generated=true
+.claude/skills/updating/reference.md linguist-generated=true
+.claude/skills/worktree-management/SKILL.md linguist-generated=true
+.config/lockstep.schema.json linguist-generated=true
+.config/oxlint-plugin/index.mts linguist-generated=true
+.config/oxlint-plugin/package.json linguist-generated=true
+.config/oxlint-plugin/rules/_inject-import.mts linguist-generated=true
+.config/oxlint-plugin/rules/export-top-level-functions.mts linguist-generated=true
+.config/oxlint-plugin/rules/inclusive-language.mts linguist-generated=true
+.config/oxlint-plugin/rules/max-file-lines.mts linguist-generated=true
+.config/oxlint-plugin/rules/no-console-prefer-logger.mts linguist-generated=true
+.config/oxlint-plugin/rules/no-dynamic-import-outside-bundle.mts linguist-generated=true
+.config/oxlint-plugin/rules/no-fetch-prefer-http-request.mts linguist-generated=true
+.config/oxlint-plugin/rules/no-inline-logger.mts linguist-generated=true
+.config/oxlint-plugin/rules/no-npx-dlx.mts linguist-generated=true
+.config/oxlint-plugin/rules/no-placeholders.mts linguist-generated=true
+.config/oxlint-plugin/rules/no-promise-race-in-loop.mts linguist-generated=true
+.config/oxlint-plugin/rules/no-status-emoji.mts linguist-generated=true
+.config/oxlint-plugin/rules/personal-path-placeholders.mts linguist-generated=true
+.config/oxlint-plugin/rules/prefer-async-spawn.mts linguist-generated=true
+.config/oxlint-plugin/rules/prefer-exists-sync.mts linguist-generated=true
+.config/oxlint-plugin/rules/prefer-node-builtin-imports.mts linguist-generated=true
+.config/oxlint-plugin/rules/prefer-safe-delete.mts linguist-generated=true
+.config/oxlint-plugin/rules/prefer-undefined-over-null.mts linguist-generated=true
+.config/oxlint-plugin/rules/socket-api-token-env.mts linguist-generated=true
+.config/oxlint-plugin/rules/sort-equality-disjunctions.mts linguist-generated=true
+.config/oxlint-plugin/rules/sort-named-imports.mts linguist-generated=true
+.config/oxlint-plugin/rules/sort-regex-alternations.mts linguist-generated=true
+.config/oxlint-plugin/rules/sort-set-args.mts linguist-generated=true
+.config/oxlint-plugin/rules/sort-source-methods.mts linguist-generated=true
+.config/rolldown/lib-stub.mts linguist-generated=true
+.config/socket-wheelhouse-schema.json linguist-generated=true
+.config/taze.config.mts linguist-generated=true
+.git-hooks/_helpers.mts linguist-generated=true
+.git-hooks/commit-msg.mts linguist-generated=true
+.git-hooks/pre-commit.mts linguist-generated=true
+.git-hooks/pre-push.mts linguist-generated=true
+.git-hooks/test/_helpers.test.mts linguist-generated=true
+.git-hooks/test/commit-msg.test.mts linguist-generated=true
+.git-hooks/test/pre-commit.test.mts linguist-generated=true
+.git-hooks/test/pre-push.test.mts linguist-generated=true
+.husky/commit-msg linguist-generated=true
+.husky/pre-commit linguist-generated=true
+.husky/pre-push linguist-generated=true
+assets/README.md linguist-generated=true
+assets/socket-icon-brand-128.png linguist-generated=true
+assets/socket-icon-brand-16.png linguist-generated=true
+assets/socket-icon-brand-256.png linguist-generated=true
+assets/socket-icon-brand-32.png linguist-generated=true
+assets/socket-icon-brand-512.png linguist-generated=true
+assets/socket-icon-brand-64.png linguist-generated=true
+assets/socket-icon-brand-square.svg linguist-generated=true
+assets/socket-icon-brand.svg linguist-generated=true
+assets/socket-icon-shield-square.svg linguist-generated=true
+assets/socket-icon-shield.svg linguist-generated=true
+assets/socket-icon-square.svg linguist-generated=true
+assets/socket-icon.svg linguist-generated=true
+assets/socket-logo-dark-1680.png linguist-generated=true
+assets/socket-logo-dark-420.png linguist-generated=true
+assets/socket-logo-dark-840.png linguist-generated=true
+assets/socket-logo-dark.svg linguist-generated=true
+assets/socket-logo-light-1680.png linguist-generated=true
+assets/socket-logo-light-420.png linguist-generated=true
+assets/socket-logo-light-840.png linguist-generated=true
+assets/socket-logo-light.svg linguist-generated=true
+docs/claude.md/agent-delegation.md linguist-generated=true
+docs/claude.md/bypass-phrases.md linguist-generated=true
+docs/claude.md/error-messages.md linguist-generated=true
+docs/claude.md/inclusive-language.md linguist-generated=true
+docs/claude.md/no-local-fork-canonical.md linguist-generated=true
+docs/claude.md/sorting.md linguist-generated=true
+packages/build-infra/lib/release-checksums/consumer.mts linguist-generated=true
+packages/build-infra/lib/release-checksums/core.mts linguist-generated=true
+packages/build-infra/lib/release-checksums/producer.mts linguist-generated=true
+packages/build-infra/release-assets.schema.json linguist-generated=true
+scripts/ai-lint-fix.mts linguist-generated=true
+scripts/check-paths.mts linguist-generated=true
+scripts/fix.mts linguist-generated=true
+scripts/install-sfw.mts linguist-generated=true
+scripts/lockstep-emit-schema.mts linguist-generated=true
+scripts/lockstep-schema.mts linguist-generated=true
+scripts/lockstep.mts linguist-generated=true
+scripts/power-state.mts linguist-generated=true
+scripts/security.mts linguist-generated=true
+scripts/socket-wheelhouse-emit-schema.mts linguist-generated=true
+scripts/socket-wheelhouse-schema.mts linguist-generated=true
+scripts/update.mts linguist-generated=true
+scripts/validate-config-paths.mts linguist-generated=true
+# ─── END fleet-canonical ────────────────────────────────────────

src/dlx/_internal.ts

@@ -1,69 +1,15 @@
 /**
- * @fileoverview Shared internals for the `dlx/package` split — lazy
- * `node:fs` / `node:path` loaders + the bounded LRU cache used by
- * `resolveBinaryPath` on Windows. Kept as a leaf so every other dlx
- * file in the split (`spec`, `firewall`, `binary-resolution`,
- * `package` itself) can layer above it without cycles.
+ * @fileoverview Shared internals for the `dlx/*` module — the bounded
+ * LRU cache used by `resolveBinaryPath` on Windows.
  *
- * `binary.ts` ships its own duplicate `getFs` / `getPath` for now —
- * collapsing them into this single source of truth is a follow-up.
+ * Webpack-safe lazy `node:fs` / `node:path` / `node:crypto` loaders
+ * live in the canonical `@socketsecurity/lib/node/{fs,path,crypto}`
+ * helpers — import `getNodeFs` / `getNodePath` / `getNodeCrypto`
+ * directly from there.
  */
 
 import { MapCtor } from '../primordials/map-set'
 
-let _crypto: typeof import('node:crypto') | undefined
-let _fs: typeof import('node:fs') | undefined
-let _path: typeof import('node:path') | undefined
-
-/**
- * Lazily load the crypto module to avoid Webpack errors.
- * Uses non-'node:' prefixed require to prevent Webpack bundling issues.
- *
- * @private
- */
-/*@__NO_SIDE_EFFECTS__*/
-export function getCrypto() {
-  if (_crypto === undefined) {
-    // Use non-'node:' prefixed require to avoid Webpack errors.
-
-    _crypto = /*@__PURE__*/ require('node:crypto')
-  }
-  return _crypto as typeof import('node:crypto')
-}
-
-/**
- * Lazily load the fs module to avoid Webpack errors.
- * Uses non-'node:' prefixed require to prevent Webpack bundling issues.
- *
- * @private
- */
-/*@__NO_SIDE_EFFECTS__*/
-export function getFs() {
-  if (_fs === undefined) {
-    // Use non-'node:' prefixed require to avoid Webpack errors.
-
-    _fs = /*@__PURE__*/ require('node:fs')
-  }
-  return _fs as typeof import('node:fs')
-}
-
-/**
- * Lazily load the path module to avoid Webpack errors.
- * Uses non-'node:' prefixed require to prevent Webpack bundling issues.
- *
- * @returns The Node.js path module
- * @private
- */
-/*@__NO_SIDE_EFFECTS__*/
-export function getPath() {
-  if (_path === undefined) {
-    // Use non-'node:' prefixed require to avoid Webpack errors.
-
-    _path = /*@__PURE__*/ require('node:path')
-  }
-  return _path as typeof import('node:path')
-}
-
 // Cache for binary path resolution to avoid repeated extension checks
 // on Windows. Bounded LRU: a long-running process that resolves many
 // distinct binary paths used to accumulate entries forever, and entries

src/dlx/binary-cache.ts

@@ -28,7 +28,8 @@ import { DateNow } from '../primordials/date'
 
 import { StringPrototypeStartsWith } from '../primordials/string'
 
-import { getFs, getPath } from './_internal'
+import { getNodeFs } from '../node/fs'
+import { getNodePath } from '../node/path'
 
 import type { DlxMetadata } from './binary-types'
 
@@ -48,15 +49,15 @@ export async function cleanDlxCache(
   maxAge: number = DLX_BINARY_CACHE_TTL,
 ): Promise<number> {
   const cacheDir = getDlxCachePath()
-  const fs = getFs()
+  const fs = getNodeFs()
 
   if (!fs.existsSync(cacheDir)) {
     return 0
   }
 
   let cleaned = 0
   const now = DateNow()
-  const path = getPath()
+  const path = getNodePath()
   const entries = await fs.promises.readdir(cacheDir)
 
   for (const entry of entries) {
@@ -116,7 +117,7 @@ export async function cleanDlxCache(
  * ```
  */
 export function getBinaryCacheMetadataPath(cacheEntryPath: string): string {
-  return getPath().join(cacheEntryPath, '.dlx-metadata.json')
+  return getNodePath().join(cacheEntryPath, '.dlx-metadata.json')
 }
 
 /**
@@ -147,7 +148,7 @@ export async function isBinaryCacheValid(
   cacheEntryPath: string,
   cacheTtl: number,
 ): Promise<boolean> {
-  const fs = getFs()
+  const fs = getNodeFs()
   try {
     const metaPath = getBinaryCacheMetadataPath(cacheEntryPath)
     if (!fs.existsSync(metaPath)) {
@@ -196,15 +197,15 @@ export async function listDlxCache(): Promise<
   }>
 > {
   const cacheDir = getDlxCachePath()
-  const fs = getFs()
+  const fs = getNodeFs()
 
   if (!fs.existsSync(cacheDir)) {
     return []
   }
 
   const results = []
   const now = DateNow()
-  const path = getPath()
+  const path = getNodePath()
   const entries = await fs.promises.readdir(cacheDir)
 
   for (const entry of entries) {
@@ -291,7 +292,7 @@ export async function writeBinaryCacheMetadata(
       url,
     },
   }
-  const fs = getFs()
+  const fs = getNodeFs()
   // Use atomic write-then-rename pattern to prevent corruption on crash
   const tmpPath = `${metaPath}.tmp.${process.pid}`
   await fs.promises.writeFile(tmpPath, JSON.stringify(metadata, null, 2))

src/dlx/binary-download.ts

@@ -22,7 +22,9 @@ import { normalizeHash } from './integrity'
 
 import { ErrorCtor } from '../primordials/error'
 
-import { getCrypto, getFs, getPath } from './_internal'
+import { getNodeCrypto } from '../node/crypto'
+import { getNodeFs } from '../node/fs'
+import { getNodePath } from '../node/path'
 import {
   getDlxCachePath,
   isBinaryCacheValid,
@@ -68,8 +70,8 @@ export async function downloadBinary(
       sha256 = normalized.value
     }
   }
-  const fs = getFs()
-  const path = getPath()
+  const fs = getNodeFs()
+  const path = getNodePath()
   // Generate cache paths similar to pnpm/npx structure.
   const cacheDir = getDlxCachePath()
   const binaryName = name || `binary-${process.platform}-${getArch()}`
@@ -168,9 +170,9 @@ export async function downloadBinaryFile(
 ): Promise<string> {
   // Use process lock to prevent concurrent downloads.
   // Lock is placed in the cache entry directory as 'concurrency.lock'.
-  const crypto = getCrypto()
-  const fs = getFs()
-  const path = getPath()
+  const crypto = getNodeCrypto()
+  const fs = getNodeFs()
+  const path = getNodePath()
   const cacheEntryDir = path.dirname(destPath)
   const lockPath = path.join(cacheEntryDir, 'concurrency.lock')