diff --git a/.claude/commands/audit-gha-settings.md b/.claude/commands/audit-gha-settings.md
index 7ce9368..6ce21eb 100644
--- a/.claude/commands/audit-gha-settings.md
+++ b/.claude/commands/audit-gha-settings.md
@@ -15,9 +15,10 @@ If no arguments given, audit the canonical fleet repo list:
 - `SocketDev/socket-sdk-js`
 - `SocketDev/socket-sdxgen`
 - `SocketDev/socket-stuie`
+- `SocketDev/socket-vscode`
+- `SocketDev/socket-webext`
 - `SocketDev/socket-wheelhouse`
 - `SocketDev/ultrathink`
-- `SocketDev/vscode-socket-security`
 
 ## Process
 
diff --git a/.claude/hooks/_shared/acorn/acorn-bindgen.cjs b/.claude/hooks/_shared/acorn/acorn-bindgen.cjs
index 23c4b87..44a5ca1 100644
--- a/.claude/hooks/_shared/acorn/acorn-bindgen.cjs
+++ b/.claude/hooks/_shared/acorn/acorn-bindgen.cjs
@@ -1,769 +1,993 @@
+let imports = {}
+imports['__wbindgen_placeholder__'] = module.exports
 
-let imports = {};
-imports['__wbindgen_placeholder__'] = module.exports;
+let heap = new Array(128).fill(undefined)
 
-let heap = new Array(128).fill(undefined);
+heap.push(undefined, null, true, false)
 
-heap.push(undefined, null, true, false);
-
-function getObject(idx) { return heap[idx]; }
+function getObject(idx) {
+  return heap[idx]
+}
 
-let heap_next = heap.length;
+let heap_next = heap.length
 
 function addHeapObject(obj) {
-    if (heap_next === heap.length) heap.push(heap.length + 1);
-    const idx = heap_next;
-    heap_next = heap[idx];
+  if (heap_next === heap.length) heap.push(heap.length + 1)
+  const idx = heap_next
+  heap_next = heap[idx]
 
-    heap[idx] = obj;
-    return idx;
+  heap[idx] = obj
+  return idx
 }
 
 function handleError(f, args) {
-    try {
-        return f.apply(this, args);
-    } catch (e) {
-        wasm.__wbindgen_export_0(addHeapObject(e));
-    }
+  try {
+    return f.apply(this, args)
+  } catch (e) {
+    wasm.__wbindgen_export_0(addHeapObject(e))
+  }
 }
 
-let cachedUint8ArrayMemory0 = null;
+let cachedUint8ArrayMemory0 = null
 
 function getUint8ArrayMemory0() {
-    if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
-        cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer);
-    }
-    return cachedUint8ArrayMemory0;
+  if (
+    cachedUint8ArrayMemory0 === null ||
+    cachedUint8ArrayMemory0.byteLength === 0
+  ) {
+    cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer)
+  }
+  return cachedUint8ArrayMemory0
 }
 
-let cachedTextDecoder = new TextDecoder('utf-8', { ignoreBOM: true, fatal: true });
+let cachedTextDecoder = new TextDecoder('utf-8', {
+  ignoreBOM: true,
+  fatal: true,
+})
 
-cachedTextDecoder.decode();
+cachedTextDecoder.decode()
 
 function decodeText(ptr, len) {
-    return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
+  return cachedTextDecoder.decode(
+    getUint8ArrayMemory0().subarray(ptr, ptr + len),
+  )
 }
 
 function getStringFromWasm0(ptr, len) {
-    ptr = ptr >>> 0;
-    return decodeText(ptr, len);
+  ptr = ptr >>> 0
+  return decodeText(ptr, len)
 }
 
 function isLikeNone(x) {
-    return x === undefined || x === null;
+  return x === undefined || x === null
 }
 
 function debugString(val) {
-    // primitive types
-    const type = typeof val;
-    if (type == 'number' || type == 'boolean' || val == null) {
-        return  `${val}`;
-    }
-    if (type == 'string') {
-        return `"${val}"`;
-    }
-    if (type == 'symbol') {
-        const description = val.description;
-        if (description == null) {
-            return 'Symbol';
-        } else {
-            return `Symbol(${description})`;
-        }
-    }
-    if (type == 'function') {
-        const name = val.name;
-        if (typeof name == 'string' && name.length > 0) {
-            return `Function(${name})`;
-        } else {
-            return 'Function';
-        }
-    }
-    // objects
-    if (Array.isArray(val)) {
-        const length = val.length;
-        let debug = '[';
-        if (length > 0) {
-            debug += debugString(val[0]);
-        }
-        for(let i = 1; i < length; i++) {
-            debug += ', ' + debugString(val[i]);
-        }
-        debug += ']';
-        return debug;
-    }
-    // Test for built-in
-    const builtInMatches = /\[object ([^\]]+)\]/.exec(toString.call(val));
-    let className;
-    if (builtInMatches && builtInMatches.length > 1) {
-        className = builtInMatches[1];
+  // primitive types
+  const type = typeof val
+  if (type == 'number' || type == 'boolean' || val == null) {
+    return `${val}`
+  }
+  if (type == 'string') {
+    return `"${val}"`
+  }
+  if (type == 'symbol') {
+    const description = val.description
+    if (description == null) {
+      return 'Symbol'
     } else {
-        // Failed to match the standard '[object ClassName]'
-        return toString.call(val);
-    }
-    if (className == 'Object') {
-        // we're a user defined class or Object
-        // JSON.stringify avoids problems with cycles, and is generally much
-        // easier than looping through ownProperties of `val`.
-        try {
-            return 'Object(' + JSON.stringify(val) + ')';
-        } catch (_) {
-            return 'Object';
-        }
+      return `Symbol(${description})`
     }
-    // errors
-    if (val instanceof Error) {
-        return `${val.name}: ${val.message}\n${val.stack}`;
-    }
-    // TODO we could test for more things here, like `Set`s and `Map`s.
-    return className;
+  }
+  if (type == 'function') {
+    const name = val.name
+    if (typeof name == 'string' && name.length > 0) {
+      return `Function(${name})`
+    } else {
+      return 'Function'
+    }
+  }
+  // objects
+  if (Array.isArray(val)) {
+    const length = val.length
+    let debug = '['
+    if (length > 0) {
+      debug += debugString(val[0])
+    }
+    for (let i = 1; i < length; i++) {
+      debug += ', ' + debugString(val[i])
+    }
+    debug += ']'
+    return debug
+  }
+  // Test for built-in
+  const builtInMatches = /\[object ([^\]]+)\]/.exec(toString.call(val))
+  let className
+  if (builtInMatches && builtInMatches.length > 1) {
+    className = builtInMatches[1]
+  } else {
+    // Failed to match the standard '[object ClassName]'
+    return toString.call(val)
+  }
+  if (className == 'Object') {
+    // we're a user defined class or Object
+    // JSON.stringify avoids problems with cycles, and is generally much
+    // easier than looping through ownProperties of `val`.
+    try {
+      return 'Object(' + JSON.stringify(val) + ')'
+    } catch (_) {
+      return 'Object'
+    }
+  }
+  // errors
+  if (val instanceof Error) {
+    return `${val.name}: ${val.message}\n${val.stack}`
+  }
+  // TODO we could test for more things here, like `Set`s and `Map`s.
+  return className
 }
 
-let WASM_VECTOR_LEN = 0;
+let WASM_VECTOR_LEN = 0
 
-const cachedTextEncoder = new TextEncoder();
+const cachedTextEncoder = new TextEncoder()
 
 if (!('encodeInto' in cachedTextEncoder)) {
-    cachedTextEncoder.encodeInto = function (arg, view) {
-        const buf = cachedTextEncoder.encode(arg);
-        view.set(buf);
-        return {
-            read: arg.length,
-            written: buf.length
-        };
-    }
+  cachedTextEncoder.encodeInto = function (arg, view) {
+    const buf = cachedTextEncoder.encode(arg)
+    view.set(buf)
+    return {
+      read: arg.length,
+      written: buf.length,
+    }
+  }
 }
 
 function passStringToWasm0(arg, malloc, realloc) {
-
-    if (realloc === undefined) {
-        const buf = cachedTextEncoder.encode(arg);
-        const ptr = malloc(buf.length, 1) >>> 0;
-        getUint8ArrayMemory0().subarray(ptr, ptr + buf.length).set(buf);
-        WASM_VECTOR_LEN = buf.length;
-        return ptr;
-    }
-
-    let len = arg.length;
-    let ptr = malloc(len, 1) >>> 0;
-
-    const mem = getUint8ArrayMemory0();
-
-    let offset = 0;
-
-    for (; offset < len; offset++) {
-        const code = arg.charCodeAt(offset);
-        if (code > 0x7F) break;
-        mem[ptr + offset] = code;
-    }
-
-    if (offset !== len) {
-        if (offset !== 0) {
-            arg = arg.slice(offset);
-        }
-        ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
-        const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
-        const ret = cachedTextEncoder.encodeInto(arg, view);
-
-        offset += ret.written;
-        ptr = realloc(ptr, len, offset, 1) >>> 0;
-    }
-
-    WASM_VECTOR_LEN = offset;
-    return ptr;
+  if (realloc === undefined) {
+    const buf = cachedTextEncoder.encode(arg)
+    const ptr = malloc(buf.length, 1) >>> 0
+    getUint8ArrayMemory0()
+      .subarray(ptr, ptr + buf.length)
+      .set(buf)
+    WASM_VECTOR_LEN = buf.length
+    return ptr
+  }
+
+  let len = arg.length
+  let ptr = malloc(len, 1) >>> 0
+
+  const mem = getUint8ArrayMemory0()
+
+  let offset = 0
+
+  for (; offset < len; offset++) {
+    const code = arg.charCodeAt(offset)
+    if (code > 0x7f) break
+    mem[ptr + offset] = code
+  }
+
+  if (offset !== len) {
+    if (offset !== 0) {
+      arg = arg.slice(offset)
+    }
+    ptr = realloc(ptr, len, (len = offset + arg.length * 3), 1) >>> 0
+    const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len)
+    const ret = cachedTextEncoder.encodeInto(arg, view)
+
+    offset += ret.written
+    ptr = realloc(ptr, len, offset, 1) >>> 0
+  }
+
+  WASM_VECTOR_LEN = offset
+  return ptr
 }
 
-let cachedDataViewMemory0 = null;
+let cachedDataViewMemory0 = null
 
 function getDataViewMemory0() {
-    if (cachedDataViewMemory0 === null || cachedDataViewMemory0.buffer.detached === true || (cachedDataViewMemory0.buffer.detached === undefined && cachedDataViewMemory0.buffer !== wasm.memory.buffer)) {
-        cachedDataViewMemory0 = new DataView(wasm.memory.buffer);
-    }
-    return cachedDataViewMemory0;
+  if (
+    cachedDataViewMemory0 === null ||
+    cachedDataViewMemory0.buffer.detached === true ||
+    (cachedDataViewMemory0.buffer.detached === undefined &&
+      cachedDataViewMemory0.buffer !== wasm.memory.buffer)
+  ) {
+    cachedDataViewMemory0 = new DataView(wasm.memory.buffer)
+  }
+  return cachedDataViewMemory0
 }
 
 function dropObject(idx) {
-    if (idx < 132) return;
-    heap[idx] = heap_next;
-    heap_next = idx;
+  if (idx < 132) return
+  heap[idx] = heap_next
+  heap_next = idx
 }
 
 function takeObject(idx) {
-    const ret = getObject(idx);
-    dropObject(idx);
-    return ret;
+  const ret = getObject(idx)
+  dropObject(idx)
+  return ret
 }
 /**
- * Parse `source`, compile `selector`, run the matcher, return a
- * JSON-encoded result string. Meant to be called from JavaScript as:
+ * Parse `source`, compile `selector`, run the matcher, return a JSON-encoded
+ * result string. Meant to be called from JavaScript as:
  *
  *     const result = JSON.parse(aqs_match(source, selector))
+ *
  * @param {string} source
  * @param {string} selector
+ *
  * @returns {string}
  */
-exports.aqs_match = function(source, selector) {
-    let deferred3_0;
-    let deferred3_1;
-    try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(source, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(selector, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len1 = WASM_VECTOR_LEN;
-        wasm.aqs_match(retptr, ptr0, len0, ptr1, len1);
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        deferred3_0 = r0;
-        deferred3_1 = r1;
-        return getStringFromWasm0(r0, r1);
-    } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-        wasm.__wbindgen_export_3(deferred3_0, deferred3_1, 1);
-    }
-};
+exports.aqs_match = function (source, selector) {
+  let deferred3_0
+  let deferred3_1
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+    const ptr0 = passStringToWasm0(
+      source,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len0 = WASM_VECTOR_LEN
+    const ptr1 = passStringToWasm0(
+      selector,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len1 = WASM_VECTOR_LEN
+    wasm.aqs_match(retptr, ptr0, len0, ptr1, len1)
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+    deferred3_0 = r0
+    deferred3_1 = r1
+    return getStringFromWasm0(r0, r1)
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16)
+    wasm.__wbindgen_export_3(deferred3_0, deferred3_1, 1)
+  }
+}
 
 /**
  * Standalone parse function (matches Acorn API)
+ *
  * @param {string} code
  * @param {any} options
+ *
  * @returns {any}
  */
-exports.parse = function(code, options) {
-    try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        wasm.parse(retptr, ptr0, len0, addHeapObject(options));
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-        if (r2) {
-            throw takeObject(r1);
-        }
-        return takeObject(r0);
-    } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-    }
-};
+exports.parse = function (code, options) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+    const ptr0 = passStringToWasm0(
+      code,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len0 = WASM_VECTOR_LEN
+    wasm.parse(retptr, ptr0, len0, addHeapObject(options))
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+    var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true)
+    if (r2) {
+      throw takeObject(r1)
+    }
+    return takeObject(r0)
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16)
+  }
+}
 
 /**
  * Check if code has syntax errors (returns true if valid)
+ *
  * @param {string} code
+ *
  * @returns {boolean}
  */
-exports.is_valid = function(code) {
-    const ptr0 = passStringToWasm0(code, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.is_valid(ptr0, len0);
-    return ret !== 0;
-};
+exports.is_valid = function (code) {
+  const ptr0 = passStringToWasm0(
+    code,
+    wasm.__wbindgen_export_1,
+    wasm.__wbindgen_export_2,
+  )
+  const len0 = WASM_VECTOR_LEN
+  const ret = wasm.is_valid(ptr0, len0)
+  return ret !== 0
+}
 
 /**
- * Get version information
+ * Get version information.
+ *
  * @returns {string}
  */
-exports.version = function() {
-    let deferred1_0;
-    let deferred1_1;
-    try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        wasm.version(retptr);
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        deferred1_0 = r0;
-        deferred1_1 = r1;
-        return getStringFromWasm0(r0, r1);
-    } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-        wasm.__wbindgen_export_3(deferred1_0, deferred1_1, 1);
-    }
-};
+exports.version = function () {
+  let deferred1_0
+  let deferred1_1
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+    wasm.version(retptr)
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+    deferred1_0 = r0
+    deferred1_1 = r1
+    return getStringFromWasm0(r0, r1)
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16)
+    wasm.__wbindgen_export_3(deferred1_0, deferred1_1, 1)
+  }
+}
 
 /**
- * Find innermost node containing position
+ * Find innermost node containing position.
+ *
  * @param {string} code
  * @param {number} pos
  * @param {string | null | undefined} node_type
  * @param {any} options_js
+ *
  * @returns {any}
  */
-exports.findNodeAround = function(code, pos, node_type, options_js) {
-    try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        var ptr1 = isLikeNone(node_type) ? 0 : passStringToWasm0(node_type, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        var len1 = WASM_VECTOR_LEN;
-        wasm.findNodeAround(retptr, ptr0, len0, pos, ptr1, len1, addHeapObject(options_js));
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-        if (r2) {
-            throw takeObject(r1);
-        }
-        return takeObject(r0);
-    } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-    }
-};
+exports.findNodeAround = function (code, pos, node_type, options_js) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+    const ptr0 = passStringToWasm0(
+      code,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len0 = WASM_VECTOR_LEN
+    var ptr1 = isLikeNone(node_type)
+      ? 0
+      : passStringToWasm0(
+          node_type,
+          wasm.__wbindgen_export_1,
+          wasm.__wbindgen_export_2,
+        )
+    var len1 = WASM_VECTOR_LEN
+    wasm.findNodeAround(
+      retptr,
+      ptr0,
+      len0,
+      pos,
+      ptr1,
+      len1,
+      addHeapObject(options_js),
+    )
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+    var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true)
+    if (r2) {
+      throw takeObject(r1)
+    }
+    return takeObject(r0)
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16)
+  }
+}
 
 /**
- * Find first node starting at or after position
+ * Find first node starting at or after position.
+ *
  * @param {string} code
  * @param {number} pos
  * @param {string | null | undefined} node_type
  * @param {any} options_js
+ *
  * @returns {any}
  */
-exports.findNodeAfter = function(code, pos, node_type, options_js) {
-    try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        var ptr1 = isLikeNone(node_type) ? 0 : passStringToWasm0(node_type, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        var len1 = WASM_VECTOR_LEN;
-        wasm.findNodeAfter(retptr, ptr0, len0, pos, ptr1, len1, addHeapObject(options_js));
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-        if (r2) {
-            throw takeObject(r1);
-        }
-        return takeObject(r0);
-    } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-    }
-};
+exports.findNodeAfter = function (code, pos, node_type, options_js) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+    const ptr0 = passStringToWasm0(
+      code,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len0 = WASM_VECTOR_LEN
+    var ptr1 = isLikeNone(node_type)
+      ? 0
+      : passStringToWasm0(
+          node_type,
+          wasm.__wbindgen_export_1,
+          wasm.__wbindgen_export_2,
+        )
+    var len1 = WASM_VECTOR_LEN
+    wasm.findNodeAfter(
+      retptr,
+      ptr0,
+      len0,
+      pos,
+      ptr1,
+      len1,
+      addHeapObject(options_js),
+    )
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+    var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true)
+    if (r2) {
+      throw takeObject(r1)
+    }
+    return takeObject(r0)
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16)
+  }
+}
 
 /**
- * Find outermost node ending before position
+ * Find outermost node ending before position.
+ *
  * @param {string} code
  * @param {number} pos
  * @param {string | null | undefined} node_type
  * @param {any} options_js
+ *
  * @returns {any}
  */
-exports.findNodeBefore = function(code, pos, node_type, options_js) {
-    try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        var ptr1 = isLikeNone(node_type) ? 0 : passStringToWasm0(node_type, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        var len1 = WASM_VECTOR_LEN;
-        wasm.findNodeBefore(retptr, ptr0, len0, pos, ptr1, len1, addHeapObject(options_js));
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-        if (r2) {
-            throw takeObject(r1);
-        }
-        return takeObject(r0);
-    } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-    }
-};
+exports.findNodeBefore = function (code, pos, node_type, options_js) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+    const ptr0 = passStringToWasm0(
+      code,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len0 = WASM_VECTOR_LEN
+    var ptr1 = isLikeNone(node_type)
+      ? 0
+      : passStringToWasm0(
+          node_type,
+          wasm.__wbindgen_export_1,
+          wasm.__wbindgen_export_2,
+        )
+    var len1 = WASM_VECTOR_LEN
+    wasm.findNodeBefore(
+      retptr,
+      ptr0,
+      len0,
+      pos,
+      ptr1,
+      len1,
+      addHeapObject(options_js),
+    )
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+    var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true)
+    if (r2) {
+      throw takeObject(r1)
+    }
+    return takeObject(r0)
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16)
+  }
+}
 
 /**
- * Simple walk - parse code and call visitor for each node type
+ * Simple walk - parse code and call visitor for each node type.
+ *
  * @param {string} code
  * @param {any} visitors_obj
  * @param {any} options_js
  */
-exports.simple = function(code, visitors_obj, options_js) {
-    try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        wasm.simple(retptr, ptr0, len0, addHeapObject(visitors_obj), addHeapObject(options_js));
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        if (r1) {
-            throw takeObject(r0);
-        }
-    } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-    }
-};
+exports.simple = function (code, visitors_obj, options_js) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+    const ptr0 = passStringToWasm0(
+      code,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len0 = WASM_VECTOR_LEN
+    wasm.simple(
+      retptr,
+      ptr0,
+      len0,
+      addHeapObject(visitors_obj),
+      addHeapObject(options_js),
+    )
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+    if (r1) {
+      throw takeObject(r0)
+    }
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16)
+  }
+}
 
 /**
- * Walk with ancestors
+ * Walk with ancestors.
+ *
  * @param {string} code
  * @param {any} visitors_obj
  * @param {any} options_js
  */
-exports.walk = function(code, visitors_obj, options_js) {
-    try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        wasm.walk(retptr, ptr0, len0, addHeapObject(visitors_obj), addHeapObject(options_js));
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        if (r1) {
-            throw takeObject(r0);
-        }
-    } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-    }
-};
+exports.walk = function (code, visitors_obj, options_js) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+    const ptr0 = passStringToWasm0(
+      code,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len0 = WASM_VECTOR_LEN
+    wasm.walk(
+      retptr,
+      ptr0,
+      len0,
+      addHeapObject(visitors_obj),
+      addHeapObject(options_js),
+    )
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+    if (r1) {
+      throw takeObject(r0)
+    }
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16)
+  }
+}
 
 /**
- * Full walk with enter/exit
+ * Full walk with enter/exit.
+ *
  * @param {string} code
  * @param {any} visitors_obj
  * @param {any} options_js
  */
-exports.full = function(code, visitors_obj, options_js) {
-    try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        wasm.full(retptr, ptr0, len0, addHeapObject(visitors_obj), addHeapObject(options_js));
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        if (r1) {
-            throw takeObject(r0);
-        }
-    } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-    }
-};
+exports.full = function (code, visitors_obj, options_js) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+    const ptr0 = passStringToWasm0(
+      code,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len0 = WASM_VECTOR_LEN
+    wasm.full(
+      retptr,
+      ptr0,
+      len0,
+      addHeapObject(visitors_obj),
+      addHeapObject(options_js),
+    )
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+    if (r1) {
+      throw takeObject(r0)
+    }
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16)
+  }
+}
 
 /**
  * Recursive walk — visitor controls child traversal via c(child, state)
+ *
  * @param {string} code
  * @param {any} state
  * @param {any} funcs
  * @param {any} options_js
  */
-exports.recursive = function(code, state, funcs, options_js) {
-    try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        wasm.recursive(retptr, ptr0, len0, addHeapObject(state), addHeapObject(funcs), addHeapObject(options_js));
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        if (r1) {
-            throw takeObject(r0);
-        }
-    } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-    }
-};
+exports.recursive = function (code, state, funcs, options_js) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+    const ptr0 = passStringToWasm0(
+      code,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len0 = WASM_VECTOR_LEN
+    wasm.recursive(
+      retptr,
+      ptr0,
+      len0,
+      addHeapObject(state),
+      addHeapObject(funcs),
+      addHeapObject(options_js),
+    )
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+    if (r1) {
+      throw takeObject(r0)
+    }
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16)
+  }
+}
 
 /**
- * Find all nodes matching a type string
+ * Find all nodes matching a type string.
+ *
  * @param {string} code
  * @param {string} node_type
  * @param {any} options_js
+ *
  * @returns {any}
  */
-exports.findAll = function(code, node_type, options_js) {
-    try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(node_type, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len1 = WASM_VECTOR_LEN;
-        wasm.findAll(retptr, ptr0, len0, ptr1, len1, addHeapObject(options_js));
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-        if (r2) {
-            throw takeObject(r1);
-        }
-        return takeObject(r0);
-    } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-    }
-};
+exports.findAll = function (code, node_type, options_js) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+    const ptr0 = passStringToWasm0(
+      code,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len0 = WASM_VECTOR_LEN
+    const ptr1 = passStringToWasm0(
+      node_type,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len1 = WASM_VECTOR_LEN
+    wasm.findAll(retptr, ptr0, len0, ptr1, len1, addHeapObject(options_js))
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+    var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true)
+    if (r2) {
+      throw takeObject(r1)
+    }
+    return takeObject(r0)
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16)
+  }
+}
 
 /**
- * Count nodes by type
+ * Count nodes by type.
+ *
  * @param {string} code
  * @param {any} options_js
+ *
  * @returns {any}
  */
-exports.countNodes = function(code, options_js) {
-    try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        wasm.countNodes(retptr, ptr0, len0, addHeapObject(options_js));
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-        if (r2) {
-            throw takeObject(r1);
-        }
-        return takeObject(r0);
-    } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-    }
-};
+exports.countNodes = function (code, options_js) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+    const ptr0 = passStringToWasm0(
+      code,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len0 = WASM_VECTOR_LEN
+    wasm.countNodes(retptr, ptr0, len0, addHeapObject(options_js))
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+    var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true)
+    if (r2) {
+      throw takeObject(r1)
+    }
+    return takeObject(r0)
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16)
+  }
+}
 
 /**
- * Walk all nodes, calling callback with (node, ancestors) for every node
+ * Walk all nodes, calling callback with (node, ancestors) for every node.
+ *
  * @param {string} code
  * @param {any} callback
  * @param {any} options_js
  */
-exports.fullAncestor = function(code, callback, options_js) {
-    try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        wasm.fullAncestor(retptr, ptr0, len0, addHeapObject(callback), addHeapObject(options_js));
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        if (r1) {
-            throw takeObject(r0);
-        }
-    } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-    }
-};
+exports.fullAncestor = function (code, callback, options_js) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+    const ptr0 = passStringToWasm0(
+      code,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len0 = WASM_VECTOR_LEN
+    wasm.fullAncestor(
+      retptr,
+      ptr0,
+      len0,
+      addHeapObject(callback),
+      addHeapObject(options_js),
+    )
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+    if (r1) {
+      throw takeObject(r0)
+    }
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16)
+  }
+}
 
 /**
- * Find innermost node at exact start/end position
+ * Find innermost node at exact start/end position.
+ *
  * @param {string} code
  * @param {number | null | undefined} start
  * @param {number | null | undefined} end
  * @param {string | null | undefined} node_type
  * @param {any} options_js
+ *
  * @returns {any}
  */
-exports.findNodeAt = function(code, start, end, node_type, options_js) {
+exports.findNodeAt = function (code, start, end, node_type, options_js) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+    const ptr0 = passStringToWasm0(
+      code,
+      wasm.__wbindgen_export_1,
+      wasm.__wbindgen_export_2,
+    )
+    const len0 = WASM_VECTOR_LEN
+    var ptr1 = isLikeNone(node_type)
+      ? 0
+      : passStringToWasm0(
+          node_type,
+          wasm.__wbindgen_export_1,
+          wasm.__wbindgen_export_2,
+        )
+    var len1 = WASM_VECTOR_LEN
+    wasm.findNodeAt(
+      retptr,
+      ptr0,
+      len0,
+      isLikeNone(start) ? 0x100000001 : start >>> 0,
+      isLikeNone(end) ? 0x100000001 : end >>> 0,
+      ptr1,
+      len1,
+      addHeapObject(options_js),
+    )
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+    var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true)
+    if (r2) {
+      throw takeObject(r1)
+    }
+    return takeObject(r0)
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16)
+  }
+}
+
+const WasmParserFinalization =
+  typeof FinalizationRegistry === 'undefined'
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_wasmparser_free(ptr >>> 0, 1))
+
+class WasmParser {
+  __destroy_into_raw() {
+    const ptr = this.__wbg_ptr
+    this.__wbg_ptr = 0
+    WasmParserFinalization.unregister(this)
+    return ptr
+  }
+
+  free() {
+    const ptr = this.__destroy_into_raw()
+    wasm.__wbg_wasmparser_free(ptr, 0)
+  }
+  constructor() {
+    const ret = wasm.wasmparser_new()
+    this.__wbg_ptr = ret >>> 0
+    WasmParserFinalization.register(this, this.__wbg_ptr, this)
+    return this
+  }
+  /**
+   * Parse JavaScript code and return AST as JsValue (WASM) or JSON string
+   * (native).
+   *
+   * The WASM path goes: options_js (JS object) → options_from_jsvalue
+   * (Reflect-based reads, no serde_json) → parser → JSON string → JSON::parse
+   * (one cheap JS-side parse) → JsValue handed back to JS as the AST root.
+   *
+   * @param {string} code
+   * @param {any} options_js
+   *
+   * @returns {any}
+   */
+  parse(code, options_js) {
     try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        var ptr1 = isLikeNone(node_type) ? 0 : passStringToWasm0(node_type, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        var len1 = WASM_VECTOR_LEN;
-        wasm.findNodeAt(retptr, ptr0, len0, isLikeNone(start) ? 0x100000001 : (start) >>> 0, isLikeNone(end) ? 0x100000001 : (end) >>> 0, ptr1, len1, addHeapObject(options_js));
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-        if (r2) {
-            throw takeObject(r1);
-        }
-        return takeObject(r0);
+      const retptr = wasm.__wbindgen_add_to_stack_pointer(-16)
+      const ptr0 = passStringToWasm0(
+        code,
+        wasm.__wbindgen_export_1,
+        wasm.__wbindgen_export_2,
+      )
+      const len0 = WASM_VECTOR_LEN
+      wasm.wasmparser_parse(
+        retptr,
+        this.__wbg_ptr,
+        ptr0,
+        len0,
+        addHeapObject(options_js),
+      )
+      var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true)
+      var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true)
+      var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true)
+      if (r2) {
+        throw takeObject(r1)
+      }
+      return takeObject(r0)
     } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
+      wasm.__wbindgen_add_to_stack_pointer(16)
     }
-};
+  }
+}
+if (Symbol.dispose)
+  WasmParser.prototype[Symbol.dispose] = WasmParser.prototype.free
+
+exports.WasmParser = WasmParser
+
+exports.__wbg_call_641db1bb5db5a579 = function () {
+  return handleError(function (arg0, arg1, arg2, arg3) {
+    const ret = getObject(arg0).call(
+      getObject(arg1),
+      getObject(arg2),
+      getObject(arg3),
+    )
+    return addHeapObject(ret)
+  }, arguments)
+}
 
-const WasmParserFinalization = (typeof FinalizationRegistry === 'undefined')
-    ? { register: () => {}, unregister: () => {} }
-    : new FinalizationRegistry(ptr => wasm.__wbg_wasmparser_free(ptr >>> 0, 1));
+exports.__wbg_call_a5400b25a865cfd8 = function () {
+  return handleError(function (arg0, arg1, arg2) {
+    const ret = getObject(arg0).call(getObject(arg1), getObject(arg2))
+    return addHeapObject(ret)
+  }, arguments)
+}
 
-class WasmParser {
+exports.__wbg_get_0da715ceaecea5c8 = function (arg0, arg1) {
+  const ret = getObject(arg0)[arg1 >>> 0]
+  return addHeapObject(ret)
+}
 
-    __destroy_into_raw() {
-        const ptr = this.__wbg_ptr;
-        this.__wbg_ptr = 0;
-        WasmParserFinalization.unregister(this);
-        return ptr;
-    }
+exports.__wbg_get_458e874b43b18b25 = function () {
+  return handleError(function (arg0, arg1) {
+    const ret = Reflect.get(getObject(arg0), getObject(arg1))
+    return addHeapObject(ret)
+  }, arguments)
+}
 
-    free() {
-        const ptr = this.__destroy_into_raw();
-        wasm.__wbg_wasmparser_free(ptr, 0);
-    }
-    constructor() {
-        const ret = wasm.wasmparser_new();
-        this.__wbg_ptr = ret >>> 0;
-        WasmParserFinalization.register(this, this.__wbg_ptr, this);
-        return this;
-    }
-    /**
-     * Parse JavaScript code and return AST as JsValue (WASM) or JSON string (native).
-     *
-     * The WASM path goes:
-     *   options_js (JS object)
-     *     → options_from_jsvalue (Reflect-based reads, no serde_json)
-     *     → parser → JSON string
-     *     → JSON::parse (one cheap JS-side parse)
-     *     → JsValue handed back to JS as the AST root
-     * @param {string} code
-     * @param {any} options_js
-     * @returns {any}
-     */
-    parse(code, options_js) {
-        try {
-            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-            const ptr0 = passStringToWasm0(code, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-            const len0 = WASM_VECTOR_LEN;
-            wasm.wasmparser_parse(retptr, this.__wbg_ptr, ptr0, len0, addHeapObject(options_js));
-            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-            var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-            if (r2) {
-                throw takeObject(r1);
-            }
-            return takeObject(r0);
-        } finally {
-            wasm.__wbindgen_add_to_stack_pointer(16);
-        }
-    }
+exports.__wbg_isArray_030cce220591fb41 = function (arg0) {
+  const ret = Array.isArray(getObject(arg0))
+  return ret
+}
+
+exports.__wbg_keys_ef52390b2ae0e714 = function (arg0) {
+  const ret = Object.keys(getObject(arg0))
+  return addHeapObject(ret)
+}
+
+exports.__wbg_length_186546c51cd61acd = function (arg0) {
+  const ret = getObject(arg0).length
+  return ret
+}
+
+exports.__wbg_new_19c25a3f2fa63a02 = function () {
+  const ret = new Object()
+  return addHeapObject(ret)
+}
+
+exports.__wbg_new_1f3a344cf3123716 = function () {
+  const ret = new Array()
+  return addHeapObject(ret)
+}
+
+exports.__wbg_new_da9dc54c5db29dfa = function (arg0, arg1) {
+  const ret = new Error(getStringFromWasm0(arg0, arg1))
+  return addHeapObject(ret)
+}
+
+exports.__wbg_parse_442f5ba02e5eaf8b = function () {
+  return handleError(function (arg0, arg1) {
+    const ret = JSON.parse(getStringFromWasm0(arg0, arg1))
+    return addHeapObject(ret)
+  }, arguments)
+}
+
+exports.__wbg_pop_5aaf63e29ea83074 = function (arg0) {
+  const ret = getObject(arg0).pop()
+  return addHeapObject(ret)
+}
+
+exports.__wbg_push_330b2eb93e4e1212 = function (arg0, arg1) {
+  const ret = getObject(arg0).push(getObject(arg1))
+  return ret
+}
+
+exports.__wbg_set_453345bcda80b89a = function () {
+  return handleError(function (arg0, arg1, arg2) {
+    const ret = Reflect.set(getObject(arg0), getObject(arg1), getObject(arg2))
+    return ret
+  }, arguments)
+}
+
+exports.__wbg_setname_832b43d4602cb930 = function (arg0, arg1, arg2) {
+  getObject(arg0).name = getStringFromWasm0(arg1, arg2)
+}
+
+exports.__wbg_wbindgenbooleanget_3fe6f642c7d97746 = function (arg0) {
+  const v = getObject(arg0)
+  const ret = typeof v === 'boolean' ? v : undefined
+  return isLikeNone(ret) ? 0xffffff : ret ? 1 : 0
+}
+
+exports.__wbg_wbindgendebugstring_99ef257a3ddda34d = function (arg0, arg1) {
+  const ret = debugString(getObject(arg1))
+  const ptr1 = passStringToWasm0(
+    ret,
+    wasm.__wbindgen_export_1,
+    wasm.__wbindgen_export_2,
+  )
+  const len1 = WASM_VECTOR_LEN
+  getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true)
+  getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true)
+}
+
+exports.__wbg_wbindgenisfunction_8cee7dce3725ae74 = function (arg0) {
+  const ret = typeof getObject(arg0) === 'function'
+  return ret
+}
+
+exports.__wbg_wbindgenisnull_f3037694abe4d97a = function (arg0) {
+  const ret = getObject(arg0) === null
+  return ret
+}
+
+exports.__wbg_wbindgenisobject_307a53c6bd97fbf8 = function (arg0) {
+  const val = getObject(arg0)
+  const ret = typeof val === 'object' && val !== null
+  return ret
+}
+
+exports.__wbg_wbindgenisundefined_c4b71d073b92f3c5 = function (arg0) {
+  const ret = getObject(arg0) === undefined
+  return ret
+}
+
+exports.__wbg_wbindgennumberget_f74b4c7525ac05cb = function (arg0, arg1) {
+  const obj = getObject(arg1)
+  const ret = typeof obj === 'number' ? obj : undefined
+  getDataViewMemory0().setFloat64(arg0 + 8 * 1, isLikeNone(ret) ? 0 : ret, true)
+  getDataViewMemory0().setInt32(arg0 + 4 * 0, !isLikeNone(ret), true)
+}
+
+exports.__wbg_wbindgenstringget_0f16a6ddddef376f = function (arg0, arg1) {
+  const obj = getObject(arg1)
+  const ret = typeof obj === 'string' ? obj : undefined
+  var ptr1 = isLikeNone(ret)
+    ? 0
+    : passStringToWasm0(ret, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2)
+  var len1 = WASM_VECTOR_LEN
+  getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true)
+  getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true)
+}
+
+exports.__wbg_wbindgenthrow_451ec1a8469d7eb6 = function (arg0, arg1) {
+  throw new Error(getStringFromWasm0(arg0, arg1))
+}
+
+exports.__wbindgen_cast_2241b6af4c4b2941 = function (arg0, arg1) {
+  // Cast intrinsic for `Ref(String) -> Externref`.
+  const ret = getStringFromWasm0(arg0, arg1)
+  return addHeapObject(ret)
+}
+
+exports.__wbindgen_cast_d6cd19b81560fd6e = function (arg0) {
+  // Cast intrinsic for `F64 -> Externref`.
+  const ret = arg0
+  return addHeapObject(ret)
+}
+
+exports.__wbindgen_object_clone_ref = function (arg0) {
+  const ret = getObject(arg0)
+  return addHeapObject(ret)
+}
+
+exports.__wbindgen_object_drop_ref = function (arg0) {
+  takeObject(arg0)
 }
-if (Symbol.dispose) WasmParser.prototype[Symbol.dispose] = WasmParser.prototype.free;
-
-exports.WasmParser = WasmParser;
-
-exports.__wbg_call_641db1bb5db5a579 = function() { return handleError(function (arg0, arg1, arg2, arg3) {
-    const ret = getObject(arg0).call(getObject(arg1), getObject(arg2), getObject(arg3));
-    return addHeapObject(ret);
-}, arguments) };
-
-exports.__wbg_call_a5400b25a865cfd8 = function() { return handleError(function (arg0, arg1, arg2) {
-    const ret = getObject(arg0).call(getObject(arg1), getObject(arg2));
-    return addHeapObject(ret);
-}, arguments) };
-
-exports.__wbg_get_0da715ceaecea5c8 = function(arg0, arg1) {
-    const ret = getObject(arg0)[arg1 >>> 0];
-    return addHeapObject(ret);
-};
-
-exports.__wbg_get_458e874b43b18b25 = function() { return handleError(function (arg0, arg1) {
-    const ret = Reflect.get(getObject(arg0), getObject(arg1));
-    return addHeapObject(ret);
-}, arguments) };
-
-exports.__wbg_isArray_030cce220591fb41 = function(arg0) {
-    const ret = Array.isArray(getObject(arg0));
-    return ret;
-};
-
-exports.__wbg_keys_ef52390b2ae0e714 = function(arg0) {
-    const ret = Object.keys(getObject(arg0));
-    return addHeapObject(ret);
-};
-
-exports.__wbg_length_186546c51cd61acd = function(arg0) {
-    const ret = getObject(arg0).length;
-    return ret;
-};
-
-exports.__wbg_new_19c25a3f2fa63a02 = function() {
-    const ret = new Object();
-    return addHeapObject(ret);
-};
-
-exports.__wbg_new_1f3a344cf3123716 = function() {
-    const ret = new Array();
-    return addHeapObject(ret);
-};
-
-exports.__wbg_new_da9dc54c5db29dfa = function(arg0, arg1) {
-    const ret = new Error(getStringFromWasm0(arg0, arg1));
-    return addHeapObject(ret);
-};
-
-exports.__wbg_parse_442f5ba02e5eaf8b = function() { return handleError(function (arg0, arg1) {
-    const ret = JSON.parse(getStringFromWasm0(arg0, arg1));
-    return addHeapObject(ret);
-}, arguments) };
-
-exports.__wbg_pop_5aaf63e29ea83074 = function(arg0) {
-    const ret = getObject(arg0).pop();
-    return addHeapObject(ret);
-};
-
-exports.__wbg_push_330b2eb93e4e1212 = function(arg0, arg1) {
-    const ret = getObject(arg0).push(getObject(arg1));
-    return ret;
-};
-
-exports.__wbg_set_453345bcda80b89a = function() { return handleError(function (arg0, arg1, arg2) {
-    const ret = Reflect.set(getObject(arg0), getObject(arg1), getObject(arg2));
-    return ret;
-}, arguments) };
-
-exports.__wbg_setname_832b43d4602cb930 = function(arg0, arg1, arg2) {
-    getObject(arg0).name = getStringFromWasm0(arg1, arg2);
-};
-
-exports.__wbg_wbindgenbooleanget_3fe6f642c7d97746 = function(arg0) {
-    const v = getObject(arg0);
-    const ret = typeof(v) === 'boolean' ? v : undefined;
-    return isLikeNone(ret) ? 0xFFFFFF : ret ? 1 : 0;
-};
-
-exports.__wbg_wbindgendebugstring_99ef257a3ddda34d = function(arg0, arg1) {
-    const ret = debugString(getObject(arg1));
-    const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-    const len1 = WASM_VECTOR_LEN;
-    getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
-    getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
-};
-
-exports.__wbg_wbindgenisfunction_8cee7dce3725ae74 = function(arg0) {
-    const ret = typeof(getObject(arg0)) === 'function';
-    return ret;
-};
-
-exports.__wbg_wbindgenisnull_f3037694abe4d97a = function(arg0) {
-    const ret = getObject(arg0) === null;
-    return ret;
-};
-
-exports.__wbg_wbindgenisobject_307a53c6bd97fbf8 = function(arg0) {
-    const val = getObject(arg0);
-    const ret = typeof(val) === 'object' && val !== null;
-    return ret;
-};
-
-exports.__wbg_wbindgenisundefined_c4b71d073b92f3c5 = function(arg0) {
-    const ret = getObject(arg0) === undefined;
-    return ret;
-};
-
-exports.__wbg_wbindgennumberget_f74b4c7525ac05cb = function(arg0, arg1) {
-    const obj = getObject(arg1);
-    const ret = typeof(obj) === 'number' ? obj : undefined;
-    getDataViewMemory0().setFloat64(arg0 + 8 * 1, isLikeNone(ret) ? 0 : ret, true);
-    getDataViewMemory0().setInt32(arg0 + 4 * 0, !isLikeNone(ret), true);
-};
-
-exports.__wbg_wbindgenstringget_0f16a6ddddef376f = function(arg0, arg1) {
-    const obj = getObject(arg1);
-    const ret = typeof(obj) === 'string' ? obj : undefined;
-    var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-    var len1 = WASM_VECTOR_LEN;
-    getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
-    getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
-};
-
-exports.__wbg_wbindgenthrow_451ec1a8469d7eb6 = function(arg0, arg1) {
-    throw new Error(getStringFromWasm0(arg0, arg1));
-};
-
-exports.__wbindgen_cast_2241b6af4c4b2941 = function(arg0, arg1) {
-    // Cast intrinsic for `Ref(String) -> Externref`.
-    const ret = getStringFromWasm0(arg0, arg1);
-    return addHeapObject(ret);
-};
-
-exports.__wbindgen_cast_d6cd19b81560fd6e = function(arg0) {
-    // Cast intrinsic for `F64 -> Externref`.
-    const ret = arg0;
-    return addHeapObject(ret);
-};
-
-exports.__wbindgen_object_clone_ref = function(arg0) {
-    const ret = getObject(arg0);
-    return addHeapObject(ret);
-};
-
-exports.__wbindgen_object_drop_ref = function(arg0) {
-    takeObject(arg0);
-};
-
-const wasmPath = `${__dirname}/./acorn.wasm`;
-const wasmBytes = require('fs').readFileSync(wasmPath);
-const wasmModule = new WebAssembly.Module(wasmBytes);
-const wasm = exports.__wasm = new WebAssembly.Instance(wasmModule, imports).exports;
 
+const wasmPath = `${__dirname}/./acorn.wasm`
+const wasmBytes = require('fs').readFileSync(wasmPath)
+const wasmModule = new WebAssembly.Module(wasmBytes)
+const wasm = (exports.__wasm = new WebAssembly.Instance(
+  wasmModule,
+  imports,
+).exports)
diff --git a/.claude/hooks/actionlint-on-workflow-edit/index.mts b/.claude/hooks/actionlint-on-workflow-edit/index.mts
index 7046a30..5e21b15 100644
--- a/.claude/hooks/actionlint-on-workflow-edit/index.mts
+++ b/.claude/hooks/actionlint-on-workflow-edit/index.mts
@@ -13,7 +13,7 @@
 // No-op when actionlint isn't on PATH — most fleet machines have it via
 // brew, CI runners have it preinstalled, but downstreams may not.
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import process from 'node:process'
 
 import { readStdin } from '../_shared/transcript.mts'
diff --git a/.claude/hooks/actionlint-on-workflow-edit/test/index.test.mts b/.claude/hooks/actionlint-on-workflow-edit/test/index.test.mts
index 167087d..bc748e7 100644
--- a/.claude/hooks/actionlint-on-workflow-edit/test/index.test.mts
+++ b/.claude/hooks/actionlint-on-workflow-edit/test/index.test.mts
@@ -1,6 +1,6 @@
 // node --test specs for the actionlint-on-workflow-edit hook.
 
-import { spawn, spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawn, spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import test from 'node:test'
@@ -13,6 +13,11 @@ type Result = { code: number; stderr: string }
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/ask-suppression-reminder/test/index.test.mts b/.claude/hooks/ask-suppression-reminder/test/index.test.mts
index 9e49bf1..f39fee1 100644
--- a/.claude/hooks/ask-suppression-reminder/test/index.test.mts
+++ b/.claude/hooks/ask-suppression-reminder/test/index.test.mts
@@ -3,7 +3,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -28,6 +28,11 @@ function writeTranscript(userTurns: string[]): string {
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/auth-rotation-reminder/index.mts b/.claude/hooks/auth-rotation-reminder/index.mts
index 5da5864..a408abf 100644
--- a/.claude/hooks/auth-rotation-reminder/index.mts
+++ b/.claude/hooks/auth-rotation-reminder/index.mts
@@ -40,7 +40,7 @@
 //   SOCKET_AUTH_ROTATION_DISABLED        default: unset
 //     If set to a truthy value, skip the hook entirely.
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import {
   existsSync,
   mkdirSync,
@@ -54,7 +54,7 @@ import path from 'node:path'
 import process from 'node:process'
 
 import { errorMessage } from '@socketsecurity/lib-stable/errors'
-import { safeDelete } from '@socketsecurity/lib-stable/fs'
+import { safeDelete } from '@socketsecurity/lib-stable/fs/safe'
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
 
 import {
diff --git a/.claude/hooks/auth-rotation-reminder/test/auth-rotation-reminder.test.mts b/.claude/hooks/auth-rotation-reminder/test/auth-rotation-reminder.test.mts
index 2f25192..54f457e 100644
--- a/.claude/hooks/auth-rotation-reminder/test/auth-rotation-reminder.test.mts
+++ b/.claude/hooks/auth-rotation-reminder/test/auth-rotation-reminder.test.mts
@@ -1,7 +1,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -9,7 +9,7 @@ import { fileURLToPath } from 'node:url'
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
 
-import { safeDelete } from '@socketsecurity/lib-stable/fs'
+import { safeDelete } from '@socketsecurity/lib-stable/fs/safe'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const HOOK = path.resolve(__dirname, '..', 'index.mts')
@@ -36,6 +36,11 @@ function runHook(
         ...opts.env,
       },
     })
+    // v6 lib-stable spawn returns an enriched Promise that rejects on
+    // non-zero exit; this test reads stderr + exit via manual listeners
+    // instead. Swallow the Promise rejection so it doesn't race the
+    // listener-based resolve and trigger "async activity after test ended".
+    void child.catch(() => undefined)
     let stderr = ''
     child.process.stderr!.on('data', d => {
       stderr += d.toString()
diff --git a/.claude/hooks/check-new-deps/audit.mts b/.claude/hooks/check-new-deps/audit.mts
index fa78ab7..be3f3fb 100644
--- a/.claude/hooks/check-new-deps/audit.mts
+++ b/.claude/hooks/check-new-deps/audit.mts
@@ -26,8 +26,8 @@ import path from 'node:path'
 
 import { stringify } from '@socketregistry/packageurl-js-stable'
 import type { PackageURL } from '@socketregistry/packageurl-js-stable'
-import { createTtlCache } from '@socketsecurity/lib-stable/cache-with-ttl'
-import type { TtlCache } from '@socketsecurity/lib-stable/cache-with-ttl'
+import { createTtlCache } from '@socketsecurity/lib-stable/ttl-cache/cache'
+import type { TtlCache } from '@socketsecurity/lib-stable/ttl-cache/types'
 import { errorMessage } from '@socketsecurity/lib-stable/errors'
 
 import type {
diff --git a/.claude/hooks/claude-md-section-size-guard/README.md b/.claude/hooks/claude-md-section-size-guard/README.md
index 444027e..54c4b97 100644
--- a/.claude/hooks/claude-md-section-size-guard/README.md
+++ b/.claude/hooks/claude-md-section-size-guard/README.md
@@ -4,7 +4,7 @@ PreToolUse hook that caps the body length of individual `### ` sections inside t
 
 ## What it does
 
-Complements `claude-md-size-guard` (40KB byte cap on the whole block) by enforcing a per-section line cap inside the block. Each `### Section heading` inside the `<!-- BEGIN/END FLEET-CANONICAL -->` markers gets at most **8 body lines** (configurable via `CLAUDE_MD_FLEET_SECTION_MAX_LINES`).
+Complements `claude-md-size-guard` (48KB byte cap on the whole block) by enforcing a per-section line cap inside the block. Each `### Section heading` inside the `<!-- BEGIN/END FLEET-CANONICAL -->` markers gets at most **8 body lines** (configurable via `CLAUDE_MD_FLEET_SECTION_MAX_LINES`).
 
 Sections that exceed 8 lines should have a long-form companion at `docs/claude.md/fleet/<topic>.md` and the inline body should shrink to 1-2 sentences plus a link. The cap was 20 initially (during the bootstrap when several fleet sections were 12-19 lines); it tightened to 8 once those sections were outsourced.
 
@@ -24,7 +24,7 @@ When a section exceeds the cap, the hook prints:
 
 ## Why a per-section cap, not just the byte cap
 
-The failure mode this hook addresses: an operator can grow a single rule from 2 lines to 60 lines of detailed prose without ever tripping the 40KB byte cap — until enough other sections accrete that an unrelated 1-line addition breaks the build. The per-section cap catches this directly, at the moment the long content is written, when the operator has the long-form text in hand and can immediately drop it into a `docs/claude.md/fleet/<topic>.md` companion.
+The failure mode this hook addresses: an operator can grow a single rule from 2 lines to 60 lines of detailed prose without ever tripping the 48KB byte cap — until enough other sections accrete that an unrelated 1-line addition breaks the build. The per-section cap catches this directly, at the moment the long content is written, when the operator has the long-form text in hand and can immediately drop it into a `docs/claude.md/fleet/<topic>.md` companion.
 
 ## Override
 
diff --git a/.claude/hooks/claude-md-section-size-guard/test/index.test.mts b/.claude/hooks/claude-md-section-size-guard/test/index.test.mts
index 5910406..3a6fc1e 100644
--- a/.claude/hooks/claude-md-section-size-guard/test/index.test.mts
+++ b/.claude/hooks/claude-md-section-size-guard/test/index.test.mts
@@ -5,7 +5,7 @@ import assert from 'node:assert/strict'
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -22,6 +22,11 @@ async function runHook(
     stdio: 'pipe',
     env: { ...process.env, ...env },
   })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/claude-md-size-guard/README.md b/.claude/hooks/claude-md-size-guard/README.md
index ead7e36..910c722 100644
--- a/.claude/hooks/claude-md-size-guard/README.md
+++ b/.claude/hooks/claude-md-size-guard/README.md
@@ -1,10 +1,10 @@
 # claude-md-size-guard
 
-PreToolUse Edit/Write hook that blocks CLAUDE.md edits which would push the **fleet-canonical block** (between `<!-- BEGIN FLEET-CANONICAL -->` / `<!-- END FLEET-CANONICAL -->` markers) above 40 KB.
+PreToolUse Edit/Write hook that blocks CLAUDE.md edits which would push the **fleet-canonical block** (between `<!-- BEGIN FLEET-CANONICAL -->` / `<!-- END FLEET-CANONICAL -->` markers) above 48 KB.
 
 ## Why
 
-The fleet block is byte-identical across every `socket-*` repo. Every byte added there costs N copies of in-context tokens fleet-wide. Per-repo content outside the markers is paid once. Capping the fleet block at 40 KB:
+The fleet block is byte-identical across every `socket-*` repo. Every byte added there costs N copies of in-context tokens fleet-wide. Per-repo content outside the markers is paid once. Capping the fleet block at 48 KB:
 
 - Forces new fleet rules to be **terse + reference-deferred** (link to `docs/references/<topic>.md`).
 - Leaves headroom for per-repo content. Per-repo CLAUDE.md additions are NOT capped here.
@@ -16,7 +16,7 @@ The hook fires on Edit/Write tool calls. For Write, it inspects `content`. For E
 
 ## Cap
 
-- **Default:** 40 KB (40 960 bytes).
+- **Default:** 48 KB (49 152 bytes). Sized to leave per-repo CLAUDE.md additions ample room outside the fleet block.
 - **Override:** set `CLAUDE_MD_FLEET_BLOCK_BYTES=<n>` in env (rarely needed; bumping the cap should be a deliberate fleet-wide decision).
 
 ## Failing open
diff --git a/.claude/hooks/claude-md-size-guard/index.mts b/.claude/hooks/claude-md-size-guard/index.mts
index 06338ef..efd5011 100644
--- a/.claude/hooks/claude-md-size-guard/index.mts
+++ b/.claude/hooks/claude-md-size-guard/index.mts
@@ -2,7 +2,7 @@
 // Claude Code PreToolUse hook — claude-md-size-guard.
 //
 // Blocks Edit/Write tool calls that would push the CLAUDE.md
-// fleet-canonical block above the 40KB size cap. The fleet block lives
+// fleet-canonical block above the 48KB size cap. The fleet block lives
 // between `<!-- BEGIN FLEET-CANONICAL -->` and `<!-- END FLEET-CANONICAL -->`
 // markers; everything outside is per-repo content owned by the host
 // repo (different cap, evaluated separately).
@@ -24,8 +24,9 @@
 //      remediation (move detail into `docs/references/<topic>.md`).
 //
 // Cap policy:
-//   - Default: 40 KB (40_960 bytes). Override per-repo by setting
-//     `CLAUDE_MD_FLEET_BLOCK_BYTES` in the env (rarely needed).
+//   - Default: 48 KB (49_152 bytes). Sized to leave room for per-repo
+//     CLAUDE.md additions outside the fleet block. Override per-repo by
+//     setting `CLAUDE_MD_FLEET_BLOCK_BYTES` in the env (rarely needed).
 //   - Whole-file cap: NOT enforced here. Per-repo content can grow
 //     freely; this hook only protects the fleet block.
 //
@@ -44,7 +45,7 @@ import process from 'node:process'
 
 import { readStdin } from '../_shared/transcript.mts'
 
-const DEFAULT_CAP_BYTES = 40 * 1024
+const DEFAULT_CAP_BYTES = 48 * 1024
 const FLEET_BEGIN_MARKER = '<!-- BEGIN FLEET-CANONICAL'
 const FLEET_END_MARKER = '<!-- END FLEET-CANONICAL'
 
diff --git a/.claude/hooks/claude-md-size-guard/test/index.test.mts b/.claude/hooks/claude-md-size-guard/test/index.test.mts
index 6ea4d1e..61db387 100644
--- a/.claude/hooks/claude-md-size-guard/test/index.test.mts
+++ b/.claude/hooks/claude-md-size-guard/test/index.test.mts
@@ -3,7 +3,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -24,6 +24,11 @@ async function runHook(
     stdio: 'pipe',
     env: { ...process.env, ...envOverride },
   })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
@@ -64,17 +69,17 @@ test('Write of small fleet block is allowed', async () => {
   assert.strictEqual(result.code, 0)
 })
 
-test('Write of fleet block at exactly 40KB is allowed', async () => {
+test('Write of fleet block at exactly 48KB is allowed', async () => {
   const result = await runHook({
-    tool_input: { content: fleetBlock(40 * 1024), file_path: 'CLAUDE.md' },
+    tool_input: { content: fleetBlock(48 * 1024), file_path: 'CLAUDE.md' },
     tool_name: 'Write',
   })
   assert.strictEqual(result.code, 0)
 })
 
-test('Write of fleet block over 40KB is blocked', async () => {
+test('Write of fleet block over 48KB is blocked', async () => {
   const result = await runHook({
-    tool_input: { content: fleetBlock(45 * 1024), file_path: 'CLAUDE.md' },
+    tool_input: { content: fleetBlock(53 * 1024), file_path: 'CLAUDE.md' },
     tool_name: 'Write',
   })
   assert.strictEqual(result.code, 2)
diff --git a/.claude/hooks/codex-no-write-guard/test/index.test.mts b/.claude/hooks/codex-no-write-guard/test/index.test.mts
index e48fc17..1669436 100644
--- a/.claude/hooks/codex-no-write-guard/test/index.test.mts
+++ b/.claude/hooks/codex-no-write-guard/test/index.test.mts
@@ -3,7 +3,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -18,6 +18,11 @@ type Result = { code: number; stderr: string }
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/comment-tone-reminder/index.mts b/.claude/hooks/comment-tone-reminder/index.mts
index c97d4e0..3af6fba 100644
--- a/.claude/hooks/comment-tone-reminder/index.mts
+++ b/.claude/hooks/comment-tone-reminder/index.mts
@@ -19,7 +19,7 @@ await runStopReminder({
   patterns: [
     {
       label: 'first, we (will|are)',
-      regex: /\bfirst,? we (are|need|should|will)\b/i,
+      regex: /\bfirst,? we (?:are|need|should|will)\b/i,
       why: 'Teacher-tone narration. Drop the step-by-step framing in comments.',
     },
     {
@@ -39,7 +39,7 @@ await runStopReminder({
     },
     {
       label: 'remember that',
-      regex: /\bremember (that|to)\b/i,
+      regex: /\bremember (?:that|to)\b/i,
       why: "Teacher-tone. The reader doesn't need to be reminded — state the rule.",
     },
     {
diff --git a/.claude/hooks/comment-tone-reminder/test/index.test.mts b/.claude/hooks/comment-tone-reminder/test/index.test.mts
index 9159238..53692bc 100644
--- a/.claude/hooks/comment-tone-reminder/test/index.test.mts
+++ b/.claude/hooks/comment-tone-reminder/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -32,7 +32,6 @@ function runHook(transcriptPath: string): {
   exitCode: number
 } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: transcriptPath }),
   })
   return {
@@ -107,7 +106,6 @@ test('disabled env var short-circuits', () => {
   const { path: p, cleanup } = makeTranscript('Note that we should skip this.')
   try {
     const result = spawnSync('node', [HOOK_PATH], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: JSON.stringify({ transcript_path: p }),
       env: { ...process.env, SOCKET_COMMENT_TONE_REMINDER_DISABLED: '1' },
     })
diff --git a/.claude/hooks/commit-author-guard/index.mts b/.claude/hooks/commit-author-guard/index.mts
index 7f5a182..5c368b8 100644
--- a/.claude/hooks/commit-author-guard/index.mts
+++ b/.claude/hooks/commit-author-guard/index.mts
@@ -36,7 +36,7 @@
 // Bypass: type "Allow commit-author bypass" in a recent user message,
 // or set SOCKET_COMMIT_AUTHOR_GUARD_DISABLED=1.
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { existsSync, readFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -148,11 +148,7 @@ export function readAllowedAuthors(): AllowedAuthors {
   // Source (b): global git config
   let email: string | undefined
   let name: string | undefined
-  const emailResult = spawnSync('git', [
-    'config',
-    '--global',
-    'user.email',
-  ])
+  const emailResult = spawnSync('git', ['config', '--global', 'user.email'])
   if (emailResult.status === 0) {
     email = String(emailResult.stdout).trim() || undefined
   }
diff --git a/.claude/hooks/commit-author-guard/test/index.test.mts b/.claude/hooks/commit-author-guard/test/index.test.mts
index 7de655a..0203b46 100644
--- a/.claude/hooks/commit-author-guard/test/index.test.mts
+++ b/.claude/hooks/commit-author-guard/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -60,7 +60,6 @@ function runHook(
   extraEnv: Record<string, string> = {},
 ): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify(payload),
     env: { ...process.env, HOME: home, ...extraEnv },
   })
@@ -333,7 +332,6 @@ test('fails open when no canonical email is configured anywhere', () => {
     // fails open; if it's set to the user's real email, this test's
     // imposter email gets blocked. Either way, the hook should not crash.
     const result = spawnSync('node', [HOOK_PATH], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: JSON.stringify({
         tool_name: 'Bash',
         tool_input: { command: 'git commit -m "fix"' },
diff --git a/.claude/hooks/commit-pr-reminder/test/index.test.mts b/.claude/hooks/commit-pr-reminder/test/index.test.mts
index 3882f93..768a9b7 100644
--- a/.claude/hooks/commit-pr-reminder/test/index.test.mts
+++ b/.claude/hooks/commit-pr-reminder/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -23,7 +23,6 @@ function makeTranscript(assistantText: string): string {
 
 function runHook(transcriptPath: string): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: transcriptPath }),
   })
   return { stderr: String(result.stderr), exitCode: result.status ?? -1 }
@@ -72,7 +71,6 @@ test('does NOT fire on the word "generated" without "claude" nearby', () => {
 test('disabled env var short-circuits', () => {
   const t = makeTranscript('Generated with Claude Code')
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: t }),
     env: { ...process.env, SOCKET_COMMIT_PR_REMINDER_DISABLED: '1' },
   })
diff --git a/.claude/hooks/compound-lessons-reminder/test/index.test.mts b/.claude/hooks/compound-lessons-reminder/test/index.test.mts
index 3559d79..974a5ae 100644
--- a/.claude/hooks/compound-lessons-reminder/test/index.test.mts
+++ b/.claude/hooks/compound-lessons-reminder/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -46,7 +46,6 @@ function makeTranscript(
 
 function runHook(transcriptPath: string): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: transcriptPath }),
   })
   return { stderr: String(result.stderr), exitCode: result.status ?? -1 }
@@ -182,7 +181,6 @@ test('disabled env var short-circuits', () => {
   const { path: p, cleanup } = makeTranscript('Hitting this again.')
   try {
     const result = spawnSync('node', [HOOK_PATH], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: JSON.stringify({ transcript_path: p }),
       env: { ...process.env, SOCKET_COMPOUND_LESSONS_REMINDER_DISABLED: '1' },
     })
diff --git a/.claude/hooks/concurrent-cargo-build-guard/index.mts b/.claude/hooks/concurrent-cargo-build-guard/index.mts
index 83809de..5998868 100644
--- a/.claude/hooks/concurrent-cargo-build-guard/index.mts
+++ b/.claude/hooks/concurrent-cargo-build-guard/index.mts
@@ -20,7 +20,7 @@
 // Fires only on cargo / build-prod commands, so a no-op in repos that
 // don't use cargo.
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import process from 'node:process'
 
 import { bypassPhrasePresent, readStdin } from '../_shared/transcript.mts'
diff --git a/.claude/hooks/concurrent-cargo-build-guard/test/index.test.mts b/.claude/hooks/concurrent-cargo-build-guard/test/index.test.mts
index 64ebe17..e9695f5 100644
--- a/.claude/hooks/concurrent-cargo-build-guard/test/index.test.mts
+++ b/.claude/hooks/concurrent-cargo-build-guard/test/index.test.mts
@@ -3,7 +3,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { fileURLToPath } from 'node:url'
 import path from 'node:path'
 import test from 'node:test'
@@ -16,6 +16,11 @@ type Result = { code: number; stderr: string }
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/consumer-grep-reminder/test/index.test.mts b/.claude/hooks/consumer-grep-reminder/test/index.test.mts
index 86f007d..1bcf9ab 100644
--- a/.claude/hooks/consumer-grep-reminder/test/index.test.mts
+++ b/.claude/hooks/consumer-grep-reminder/test/index.test.mts
@@ -3,7 +3,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdirSync, mkdtempSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -27,6 +27,11 @@ function mkRepo(opts: { consumerDirs?: string[] | undefined } = {}): string {
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/cross-repo-guard/index.mts b/.claude/hooks/cross-repo-guard/index.mts
index 4478506..9d85e08 100644
--- a/.claude/hooks/cross-repo-guard/index.mts
+++ b/.claude/hooks/cross-repo-guard/index.mts
@@ -59,8 +59,9 @@ const FLEET_REPO_NAMES = [
   'socket-sdk-js',
   'socket-sdxgen',
   'socket-stuie',
+  'socket-vscode',
+  'socket-webext',
   'ultrathink',
-  'vscode-socket-security',
 ] as const
 
 const FLEET_RE_FRAGMENT = FLEET_REPO_NAMES.join('|')
diff --git a/.claude/hooks/cross-repo-guard/test/cross-repo-guard.test.mts b/.claude/hooks/cross-repo-guard/test/cross-repo-guard.test.mts
index c7340d8..8f327c8 100644
--- a/.claude/hooks/cross-repo-guard/test/cross-repo-guard.test.mts
+++ b/.claude/hooks/cross-repo-guard/test/cross-repo-guard.test.mts
@@ -1,7 +1,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { test } from 'node:test'
@@ -24,6 +24,11 @@ function runHook(payload: Payload): Promise<{ code: number; stderr: string }> {
     const child = spawn(process.execPath, [HOOK], {
       stdio: ['pipe', 'ignore', 'pipe'],
     })
+    // v6 lib-stable spawn returns an enriched Promise that rejects on
+    // non-zero exit; this test reads stderr + exit via manual listeners
+    // instead. Swallow the Promise rejection so it doesn't race the
+    // listener-based resolve and trigger "async activity after test ended".
+    void child.catch(() => undefined)
     let stderr = ''
     child.process.stderr!.on('data', d => {
       stderr += d.toString()
diff --git a/.claude/hooks/default-branch-guard/index.mts b/.claude/hooks/default-branch-guard/index.mts
index d56a7f2..8798e4b 100644
--- a/.claude/hooks/default-branch-guard/index.mts
+++ b/.claude/hooks/default-branch-guard/index.mts
@@ -53,15 +53,16 @@ const SCRIPT_CONTEXT_PATTERNS: ReadonlyArray<{ label: string; regex: RegExp }> =
   [
     {
       label: 'BASE=main / BASE=master literal assignment',
-      regex: /\bBASE\s*=\s*(["']?)(main|master)\1\b/,
+      regex: /\bBASE\s*=\s*(?:["']?)(?:main|master)\1\b/,
     },
     {
       label: '--base main / --base=main literal value',
-      regex: /--base[\s=](["']?)(main|master)\1\b/,
+      regex: /--base[\s=](?:["']?)(?:main|master)\1\b/,
     },
     {
       label: 'DEFAULT_BRANCH=main literal assignment',
-      regex: /\b(DEFAULT_BRANCH|MAIN_BRANCH)\s*=\s*(["']?)(main|master)\2\b/,
+      regex:
+        /\b(?:DEFAULT_BRANCH|MAIN_BRANCH)\s*=\s*(?:["']?)(?:main|master)\2\b/,
     },
   ]
 
@@ -70,9 +71,9 @@ const SCRIPT_CONTEXT_PATTERNS: ReadonlyArray<{ label: string; regex: RegExp }> =
 // to `main..HEAD` / `main...HEAD` inside the writeable body counts as
 // scripting context.
 const SCRIPT_WRITE_RE =
-  /(cat\s*>\s*|tee\s+|>\s*)\S+\.(bash|fish|js|mjs|mts|sh|ts|zsh)\b/
+  /(?:cat\s*>\s*|tee\s+|>\s*)\S+\.(?:bash|fish|js|mjs|mts|sh|ts|zsh)\b/
 
-const TRIPLE_DOT_BRANCH_RE = /\b(main|master)\.{2,3}HEAD\b/
+const TRIPLE_DOT_BRANCH_RE = /\b(?:main|master)\.{2,3}HEAD\b/
 
 async function main(): Promise<void> {
   if (process.env['SOCKET_DEFAULT_BRANCH_GUARD_DISABLED']) {
diff --git a/.claude/hooks/default-branch-guard/test/index.test.mts b/.claude/hooks/default-branch-guard/test/index.test.mts
index c988cd0..3886c6a 100644
--- a/.claude/hooks/default-branch-guard/test/index.test.mts
+++ b/.claude/hooks/default-branch-guard/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -25,7 +25,6 @@ function runHook(
   extraEnv: Record<string, string> = {},
 ): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({
       tool_name: 'Bash',
       tool_input: { command },
@@ -89,7 +88,6 @@ test('ALLOWS the canonical lookup pattern', () => {
 
 test('IGNORES non-Bash tools', () => {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({
       tool_name: 'Write',
       tool_input: { command: 'BASE=main' },
diff --git a/.claude/hooks/dont-stop-mid-queue-reminder/test/index.test.mts b/.claude/hooks/dont-stop-mid-queue-reminder/test/index.test.mts
index e79528a..a2b55f6 100644
--- a/.claude/hooks/dont-stop-mid-queue-reminder/test/index.test.mts
+++ b/.claude/hooks/dont-stop-mid-queue-reminder/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -31,7 +31,6 @@ function runHook(
   extraEnv: Record<string, string> = {},
 ): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: transcriptPath }),
     env: { ...process.env, ...extraEnv },
   })
@@ -347,7 +346,6 @@ test('disabled env var short-circuits', () => {
 
 test('does not crash on missing transcript_path', () => {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({}),
   })
   assert.equal(result.status, 0)
@@ -355,7 +353,6 @@ test('does not crash on missing transcript_path', () => {
 
 test('does not crash on malformed payload', () => {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: 'not-json',
   })
   assert.equal(result.status, 0)
diff --git a/.claude/hooks/drift-check-reminder/test/index.test.mts b/.claude/hooks/drift-check-reminder/test/index.test.mts
index ceab96a..8a8103e 100644
--- a/.claude/hooks/drift-check-reminder/test/index.test.mts
+++ b/.claude/hooks/drift-check-reminder/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -23,7 +23,6 @@ function makeTranscript(assistantText: string): string {
 
 function runHook(transcriptPath: string): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: transcriptPath }),
   })
   return { stderr: String(result.stderr), exitCode: result.status ?? -1 }
@@ -91,7 +90,6 @@ test('does NOT fire on non-drift edits', () => {
 test('disabled env var short-circuits', () => {
   const t = makeTranscript('Bumped external-tools.json.')
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: t }),
     env: { ...process.env, SOCKET_DRIFT_CHECK_REMINDER_DISABLED: '1' },
   })
diff --git a/.claude/hooks/error-message-quality-reminder/index.mts b/.claude/hooks/error-message-quality-reminder/index.mts
index b15f35a..110b134 100644
--- a/.claude/hooks/error-message-quality-reminder/index.mts
+++ b/.claude/hooks/error-message-quality-reminder/index.mts
@@ -60,18 +60,18 @@ const VAGUE_MESSAGE_PATTERNS: ReadonlyArray<{
   {
     label: 'bare "invalid"',
     regex:
-      /^(invalid|invalid value|invalid input|invalid argument|invalid format)\.?$/i,
+      /^(?:invalid|invalid value|invalid input|invalid argument|invalid format)\.?$/i,
     hint: '"Invalid" describes the fallout, not the rule. Say what shape was expected: "must be lowercase", "must match /^[a-z]+$/", "must be one of X / Y / Z".',
   },
   {
     label: 'bare "failed"',
     regex:
-      /^(failed|failure|operation failed|request failed|action failed)\.?$/i,
+      /^(?:failed|failure|operation failed|request failed|action failed)\.?$/i,
     hint: '"Failed" describes the symptom. Name what was attempted and what blocked it: "could not write <path>: ENOENT", "fetch <url> returned 503".',
   },
   {
     label: 'bare "error occurred"',
-    regex: /^(an? )?error(\s+occurred)?\.?$/i,
+    regex: /^(?:an? )?error(?:\s+occurred)?\.?$/i,
     hint: 'The message says nothing the reader can act on. State the rule, the location, the bad value.',
   },
   {
@@ -81,18 +81,18 @@ const VAGUE_MESSAGE_PATTERNS: ReadonlyArray<{
   },
   {
     label: 'bare "unable to X" / "could not X" (verb-only)',
-    regex: /^(unable to|could not|cannot|can'?t)\s+\w+\.?$/i,
+    regex: /^(?:unable to|could not|cannot|can'?t)\s+\w+\.?$/i,
     hint: 'No object / no reason. "Unable to read" → "could not read <path>: <errno>".',
   },
   {
     label: 'bare "not found"',
-    regex: /^(not found|not\s+exist|does not exist|missing)\.?$/i,
+    regex: /^(?:not found|not\s+exist|does not exist|missing)\.?$/i,
     hint: 'Missing what? Where? Say "config file not found: <path>" with the specific path.',
   },
   {
     label: 'bare "bad" / "wrong" / "incorrect"',
     regex:
-      /^(bad|wrong|incorrect|invalid format)(\s+(argument|data|format|input|value))?\.?$/i,
+      /^(?:bad|wrong|incorrect|invalid format)(?:\s+(?:argument|data|format|input|value))?\.?$/i,
     hint: 'Same as "invalid" — describe the rule the value violated, not how you feel about it.',
   },
 ]
diff --git a/.claude/hooks/error-message-quality-reminder/test/index.test.mts b/.claude/hooks/error-message-quality-reminder/test/index.test.mts
index 40b1f99..b1ddf0a 100644
--- a/.claude/hooks/error-message-quality-reminder/test/index.test.mts
+++ b/.claude/hooks/error-message-quality-reminder/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -28,7 +28,6 @@ function makeTranscript(assistantText: string): {
 
 function runHook(transcriptPath: string): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: transcriptPath }),
   })
   return { stderr: String(result.stderr), exitCode: result.status ?? -1 }
@@ -165,7 +164,6 @@ test('disabled env var short-circuits', () => {
   )
   try {
     const result = spawnSync('node', [HOOK_PATH], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: JSON.stringify({ transcript_path: p }),
       env: {
         ...process.env,
diff --git a/.claude/hooks/excuse-detector/index.mts b/.claude/hooks/excuse-detector/index.mts
index 049dfdf..23e1338 100644
--- a/.claude/hooks/excuse-detector/index.mts
+++ b/.claude/hooks/excuse-detector/index.mts
@@ -90,14 +90,14 @@ await runStopReminder({
       label: 'leave it for later',
       // Already deferral-shaped by construction ("leave" is the verb);
       // no extra DEFER pairing needed.
-      regex: /\bleave (it|that|this) for later\b/i,
+      regex: /\bleave (?:it|that|this) for later\b/i,
       why: 'CLAUDE.md "Completion": never leave TODO/FIXME/XXX/shims/stubs/placeholders — finish 100%.',
     },
     {
       label: 'not my issue',
       // Already deferral-shaped; "not my X" is the surface form of
       // the deferral itself.
-      regex: /\bnot my (bug|issue|problem)\b/i,
+      regex: /\bnot my (?:bug|issue|problem)\b/i,
       why: 'CLAUDE.md "Unrelated issues are critical": same as "unrelated".',
     },
     {
@@ -108,31 +108,31 @@ await runStopReminder({
     {
       label: 'should I implement … or accept',
       regex:
-        /\bshould (i|we) (build|do|fix|implement) [^.?!\n]+(or|,)\s+(accept|defer|document|leave|skip|treat)\b/i,
+        /\bshould (?:i|we) (?:build|do|fix|implement) [^.?!\n]+(?:or|,)\s+(?:accept|defer|document|leave|skip|treat)\b/i,
       why: 'CLAUDE.md "Fix > defer": this is a choice-architecture masquerading as a question. Fix it.',
     },
     {
       label: 'accept … as (a) (known )?gap',
       regex:
-        /\baccept (this|it|that|[^.?!\n]{1,40}) as (a |an )?(known |documented |expected )?(drift|gap|limitation)\b/i,
+        /\baccept (?:this|it|that|[^.?!\n]{1,40}) as (?:a |an )?(?:known |documented |expected )?(?:drift|gap|limitation)\b/i,
       why: 'CLAUDE.md "Fix > defer": gap-acceptance is the rationalization branch. The fix is the answer unless the user explicitly asked for the trade-off.',
     },
     {
       label: 'two paths/options: fix … or',
       regex:
-        /\b(three|two) (choices|options|paths)[^.?!\n]{0,40}(fix|implement)[^.?!\n]{0,80}(or|,)\s+(accept|defer|document|leave|skip|treat)\b/i,
+        /\b(?:three|two) (?:choices|options|paths)[^.?!\n]{0,40}(?:fix|implement)[^.?!\n]{0,80}(?:or|,)\s+(?:accept|defer|document|leave|skip|treat)\b/i,
       why: 'CLAUDE.md "Fix > defer": collapsing the menu — pick the fix path, start the first sub-step.',
     },
     {
       label: 'document(ed)? (it )?as a known (gap|drift|limitation)',
       regex:
-        /\bdocument(ed)?\b[^.?!\n]{0,40}\bas a known (drift|gap|limitation)\b/i,
+        /\bdocument(?:ed)?\b[^.?!\n]{0,40}\bas a known (?:drift|gap|limitation)\b/i,
       why: 'CLAUDE.md "Fix > defer": "document as known gap" is the deferral euphemism. Fix it instead.',
     },
     {
       label: 'want me to fix … or',
       regex:
-        /\bwant me to (address|build|do|fix|implement) [^.?!\n]+(or|,)\s+(skip|defer|document|treat|accept|leave|move on)\b/i,
+        /\bwant me to (?:address|build|do|fix|implement) [^.?!\n]+(?:or|,)\s+(?:skip|defer|document|treat|accept|leave|move on)\b/i,
       why: 'CLAUDE.md "Fix > defer": same pattern — re-litigating the fix decision. The user already said yes by virtue of asking.',
     },
   ],
diff --git a/.claude/hooks/excuse-detector/test/index.test.mts b/.claude/hooks/excuse-detector/test/index.test.mts
index 7df0c7c..2f2ed82 100644
--- a/.claude/hooks/excuse-detector/test/index.test.mts
+++ b/.claude/hooks/excuse-detector/test/index.test.mts
@@ -7,7 +7,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -66,6 +66,11 @@ async function runHook(
   const transcript = setupTranscript(rawContent)
   try {
     const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+    // v6 lib-stable spawn returns an enriched Promise that rejects on
+    // non-zero exit; this test reads stderr + exit via manual listeners
+    // instead. Swallow the Promise rejection so it doesn't race the
+    // listener-based resolve and trigger "async activity after test ended".
+    void child.catch(() => undefined)
     const payload: Record<string, unknown> = {
       transcript_path: transcript.transcriptPath,
     }
diff --git a/.claude/hooks/file-size-reminder/test/index.test.mts b/.claude/hooks/file-size-reminder/test/index.test.mts
index ecbb2c1..1971520 100644
--- a/.claude/hooks/file-size-reminder/test/index.test.mts
+++ b/.claude/hooks/file-size-reminder/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -49,7 +49,6 @@ function writeLines(filePath: string, n: number): void {
 
 function runHook(transcriptPath: string): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: transcriptPath }),
   })
   return { stderr: String(result.stderr), exitCode: result.status ?? -1 }
@@ -186,7 +185,6 @@ test('disabled env var short-circuits', () => {
       { name: 'Write', input: { file_path: target, content: '...' } },
     ])
     const result = spawnSync('node', [HOOK_PATH], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: JSON.stringify({ transcript_path: transcript }),
       env: { ...process.env, SOCKET_FILE_SIZE_REMINDER_DISABLED: '1' },
     })
diff --git a/.claude/hooks/gitmodules-comment-guard/test/index.test.mts b/.claude/hooks/gitmodules-comment-guard/test/index.test.mts
index a86723c..1acce17 100644
--- a/.claude/hooks/gitmodules-comment-guard/test/index.test.mts
+++ b/.claude/hooks/gitmodules-comment-guard/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -9,7 +9,6 @@ const HOOK_PATH = path.join(__dirname, '..', 'index.mts')
 
 function runHook(payload: object): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify(payload),
   })
   return { stderr: String(result.stderr), exitCode: result.status ?? -1 }
@@ -130,7 +129,6 @@ test('handles multiple submodules, blocks only the orphan', () => {
 
 test('fails open on malformed JSON', () => {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: 'not-json',
   })
   assert.equal(result.status, 0)
diff --git a/.claude/hooks/identifying-users-reminder/index.mts b/.claude/hooks/identifying-users-reminder/index.mts
index ed7c88a..ef603e1 100644
--- a/.claude/hooks/identifying-users-reminder/index.mts
+++ b/.claude/hooks/identifying-users-reminder/index.mts
@@ -40,7 +40,7 @@ const PATTERNS: readonly RuleViolation[] = [
     // specific person's intent. The verb-list is intentionally narrow
     // — generic API docs say "the user can call X" which is fine.
     regex:
-      /\b[Tt]he\s+user\s+(asked|chose|decided|likes|needs|picked|prefers|requested|said|wants|wrote)\b/i,
+      /\b[Tt]he\s+user\s+(?:asked|chose|decided|likes|needs|picked|prefers|requested|said|wants|wrote)\b/i,
     why: 'Refers to a specific person\'s intent. Use their name from `git config user.name`, or "you" if speaking directly.',
   },
   {
@@ -50,13 +50,13 @@ const PATTERNS: readonly RuleViolation[] = [
   },
   {
     label: 'someone (singular human reference)',
-    regex: /^Someone\s+(asked|needs|prefers|requested|said|wants|wrote)\b/im,
+    regex: /^Someone\s+(?:asked|needs|prefers|requested|said|wants|wrote)\b/im,
     why: '"Someone" hedges around naming. If you have access to git config, use the name.',
   },
   {
     label: 'the developer / the engineer (third-party framing)',
     regex:
-      /\b[Tt]he\s+(developer|engineer)\s+(asked|needs|prefers|said|wants|wrote)\b/i,
+      /\b[Tt]he\s+(?:developer|engineer)\s+(?:asked|needs|prefers|said|wants|wrote)\b/i,
     why: 'Same — name them if known, "you" if direct.',
   },
 ]
diff --git a/.claude/hooks/identifying-users-reminder/test/index.test.mts b/.claude/hooks/identifying-users-reminder/test/index.test.mts
index 36d8974..a25b0ba 100644
--- a/.claude/hooks/identifying-users-reminder/test/index.test.mts
+++ b/.claude/hooks/identifying-users-reminder/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -30,7 +30,6 @@ function makeTranscript(assistantText: string): {
 
 function runHook(transcriptPath: string): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: transcriptPath }),
   })
   return { stderr: String(result.stderr), exitCode: result.status ?? -1 }
@@ -154,7 +153,6 @@ test('disabled env var short-circuits', () => {
   const { path: p, cleanup } = makeTranscript('The user wants this.')
   try {
     const result = spawnSync('node', [HOOK_PATH], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: JSON.stringify({ transcript_path: p }),
       env: { ...process.env, SOCKET_IDENTIFYING_USERS_REMINDER_DISABLED: '1' },
     })
diff --git a/.claude/hooks/inline-script-defer-guard/test/index.test.mts b/.claude/hooks/inline-script-defer-guard/test/index.test.mts
index 9c0db71..103207e 100644
--- a/.claude/hooks/inline-script-defer-guard/test/index.test.mts
+++ b/.claude/hooks/inline-script-defer-guard/test/index.test.mts
@@ -3,7 +3,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -18,6 +18,11 @@ type Result = { code: number; stderr: string }
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/judgment-reminder/test/index.test.mts b/.claude/hooks/judgment-reminder/test/index.test.mts
index 098edc9..bdfffed 100644
--- a/.claude/hooks/judgment-reminder/test/index.test.mts
+++ b/.claude/hooks/judgment-reminder/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -28,7 +28,6 @@ function makeTranscript(assistantText: string): {
 
 function runHook(transcriptPath: string): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: transcriptPath }),
   })
   return { stderr: String(result.stderr), exitCode: result.status ?? -1 }
@@ -130,7 +129,6 @@ test('disabled env var short-circuits', () => {
   const { path: p, cleanup } = makeTranscript("I'm not sure which approach.")
   try {
     const result = spawnSync('node', [HOOK_PATH], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: JSON.stringify({ transcript_path: p }),
       env: { ...process.env, SOCKET_JUDGMENT_REMINDER_DISABLED: '1' },
     })
diff --git a/.claude/hooks/lock-step-ref-guard/test/index.test.mts b/.claude/hooks/lock-step-ref-guard/test/index.test.mts
index 9b3d534..edcdbc4 100644
--- a/.claude/hooks/lock-step-ref-guard/test/index.test.mts
+++ b/.claude/hooks/lock-step-ref-guard/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -62,7 +62,6 @@ function runHook(
     payload['cwd'] = options.cwd
   }
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify(payload),
     env: { ...process.env, ...(options.env ?? {}) },
   })
@@ -282,7 +281,6 @@ test('BYPASS via SOCKET_LOCK_STEP_REF_GUARD_DISABLED=1', () => {
 
 test('exits 0 on invalid JSON payload', () => {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: 'not-json',
   })
   assert.equal(result.status, 0)
@@ -290,7 +288,6 @@ test('exits 0 on invalid JSON payload', () => {
 
 test('exits 0 on missing tool_input', () => {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ tool_name: 'Write' }),
   })
   assert.equal(result.status, 0)
diff --git a/.claude/hooks/logger-guard/index.mts b/.claude/hooks/logger-guard/index.mts
index 0ca71b3..18e7374 100644
--- a/.claude/hooks/logger-guard/index.mts
+++ b/.claude/hooks/logger-guard/index.mts
@@ -44,13 +44,16 @@ import { readStdin } from '../_shared/transcript.mts'
 const EXEMPT_PATH_PATTERNS: RegExp[] = [
   /\.claude\/hooks\//,
   /\.git-hooks\//,
-  /(^|\/)scripts\//,
-  /\.(spec|test)\.(m?[jt]s|tsx?|cts|mts)$/,
-  /(^|\/)tests?\//,
-  /(^|\/)fixtures\//,
-  /(^|\/)external\//,
-  /(^|\/)vendor\//,
-  /(^|\/)upstream\//,
+  /(?:^|\/)scripts\//,
+  /\.(?:spec|test)\.(?:m?[jt]s|tsx?|cts|mts)$/,
+  /(?:^|\/)tests?\//,
+  /(?:^|\/)fixtures\//,
+  /(?:^|\/)external\//,
+  /(?:^|\/)vendor\//,
+  /(?:^|\/)upstream\//,
+  // The logger is its own owner — these files implement the Logger
+  // class + its browser shim and must call console.* directly.
+  /(?:^|\/)src\/logger\//,
 ]
 
 // The forbidden calls and the canonical logger replacement for each.
@@ -116,7 +119,7 @@ export function isInScope(filePath: string): boolean {
   if (!filePath) {
     return false
   }
-  if (!/\.(m?ts|tsx|cts)$/.test(filePath)) {
+  if (!/\.(?:m?ts|tsx|cts)$/.test(filePath)) {
     return false
   }
   for (let i = 0, { length } = EXEMPT_PATH_PATTERNS; i < length; i += 1) {
diff --git a/.claude/hooks/logger-guard/test/logger-guard.test.mts b/.claude/hooks/logger-guard/test/logger-guard.test.mts
index 285f50d..080a214 100644
--- a/.claude/hooks/logger-guard/test/logger-guard.test.mts
+++ b/.claude/hooks/logger-guard/test/logger-guard.test.mts
@@ -1,7 +1,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { test } from 'node:test'
@@ -24,6 +24,11 @@ function runHook(payload: Payload): Promise<{ code: number; stderr: string }> {
     const child = spawn(process.execPath, [HOOK], {
       stdio: ['pipe', 'ignore', 'pipe'],
     })
+    // v6 lib-stable spawn returns an enriched Promise that rejects on
+    // non-zero exit; this test reads stderr + exit via manual listeners
+    // instead. Swallow the Promise rejection so it doesn't race the
+    // listener-based resolve and trigger "async activity after test ended".
+    void child.catch(() => undefined)
     let stderr = ''
     child.process.stderr!.on('data', d => {
       stderr += d.toString()
diff --git a/.claude/hooks/markdown-filename-guard/test/index.test.mts b/.claude/hooks/markdown-filename-guard/test/index.test.mts
index 906454b..855934e 100644
--- a/.claude/hooks/markdown-filename-guard/test/index.test.mts
+++ b/.claude/hooks/markdown-filename-guard/test/index.test.mts
@@ -5,7 +5,7 @@ import assert from 'node:assert/strict'
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -16,6 +16,11 @@ type Result = { code: number; stderr: string }
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/marketplace-comment-guard/test/index.test.mts b/.claude/hooks/marketplace-comment-guard/test/index.test.mts
index 74c1b68..7ee3a8e 100644
--- a/.claude/hooks/marketplace-comment-guard/test/index.test.mts
+++ b/.claude/hooks/marketplace-comment-guard/test/index.test.mts
@@ -3,19 +3,18 @@ import assert from 'node:assert/strict'
 // prefer-async-spawn: sync-required — test flow is sync.
 // prefer-spawn-over-execsync: required — uses encoding/input options
 // not exposed on the lib spawnSync wrapper.
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { safeDeleteSync } from '@socketsecurity/lib-stable/fs'
+import { safeDeleteSync } from '@socketsecurity/lib-stable/fs/safe'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const HOOK_PATH = path.join(__dirname, '..', 'index.mts')
 
 function runHook(payload: object): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify(payload),
   })
   return { stderr: String(result.stderr), exitCode: result.status ?? -1 }
diff --git a/.claude/hooks/minify-mcp-output/test/index.test.mts b/.claude/hooks/minify-mcp-output/test/index.test.mts
index 22b61d8..e64c558 100644
--- a/.claude/hooks/minify-mcp-output/test/index.test.mts
+++ b/.claude/hooks/minify-mcp-output/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -14,7 +14,6 @@ function runHook(payload: object): {
   exitCode: number
 } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify(payload),
   })
   return { stdout: String(result.stdout), exitCode: result.status ?? -1 }
@@ -158,7 +157,6 @@ test('hook: emits updatedMCPToolOutput for MCP tool with string-shaped response'
 
 test('hook: fails open on malformed stdin', () => {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: '{not json',
   })
   assert.equal(result.status, 0)
diff --git a/.claude/hooks/minimum-release-age-guard/test/index.test.mts b/.claude/hooks/minimum-release-age-guard/test/index.test.mts
index 2f9a768..97a98f7 100644
--- a/.claude/hooks/minimum-release-age-guard/test/index.test.mts
+++ b/.claude/hooks/minimum-release-age-guard/test/index.test.mts
@@ -3,7 +3,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -25,6 +25,11 @@ function tmpYaml(content: string): string {
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/new-hook-claude-md-guard/test/index.test.mts b/.claude/hooks/new-hook-claude-md-guard/test/index.test.mts
index 13c85e2..c1445e2 100644
--- a/.claude/hooks/new-hook-claude-md-guard/test/index.test.mts
+++ b/.claude/hooks/new-hook-claude-md-guard/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -45,7 +45,6 @@ function makeTranscript(dir: string, bypassPhrase?: string): string {
 
 function runHook(payload: object): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify(payload),
   })
   return { stderr: String(result.stderr), exitCode: result.status ?? -1 }
@@ -220,7 +219,6 @@ test('disabled env var short-circuits', () => {
   const repo = makeFakeRepo('# no reference')
   try {
     const result = spawnSync('node', [HOOK_PATH], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: JSON.stringify({
         tool_name: 'Write',
         tool_input: { file_path: repo.hookIndexPath('my-new-hook') },
diff --git a/.claude/hooks/no-blind-keychain-read-guard/README.md b/.claude/hooks/no-blind-keychain-read-guard/README.md
new file mode 100644
index 0000000..22a1796
--- /dev/null
+++ b/.claude/hooks/no-blind-keychain-read-guard/README.md
@@ -0,0 +1,65 @@
+# no-blind-keychain-read-guard
+
+`PreToolUse(Bash)` blocker that refuses direct keychain READ calls
+from Bash. The keychain APIs surface a UI auth prompt per call;
+reading three times costs three prompts. The fleet's canonical
+in-process resolver (`api-token.mts.findApiToken()`) caches the
+value module-scoped after the first hit, so subsequent code paths
+should never need to re-read the keychain.
+
+## Detected reads
+
+| Platform       | Pattern                                        |
+| -------------- | ---------------------------------------------- |
+| macOS          | `security find-{generic,internet}-password`    |
+| Linux          | `secret-tool lookup` / `secret-tool search`    |
+| Windows        | `Get-StoredCredential`                         |
+| Windows        | `Get-Credential … \| ConvertFrom-SecureString` |
+| cross-platform | `keyring get`                                  |
+
+## Allowed (not flagged)
+
+Writes and deletes — these only happen during operator-driven
+setup / rotation, never on hot paths:
+
+- `security add-generic-password` / `security delete-generic-password`
+- `secret-tool store` / `secret-tool clear`
+- `New-StoredCredential` / `Remove-StoredCredential`
+- `keyring set` / `keyring del`
+
+## Bypass
+
+Type the canonical phrase verbatim in your next user turn:
+
+```
+Allow blind-keychain-read bypass
+```
+
+Use when you genuinely need a fresh keychain read — operator-invoked
+diagnostics, verifying an entry exists, etc.
+
+## Why
+
+`security find-generic-password` on macOS prompts the user every call
+unless the calling process is on the entry's ACL. Claude Code's Bash
+tool spawns a fresh process per call, so each `security` invocation
+re-prompts. The same shape exists on Linux (`secret-tool` against
+gnome-keyring / kwallet) and Windows (`Get-StoredCredential` against
+the CredentialManager UI).
+
+The right answer is to read the cached value from process state:
+
+```ts
+import { findApiToken } from '../setup-security-tools/lib/api-token.mts'
+const { token } = findApiToken() // module-cached after first call
+```
+
+Or from a child process spawned by hooks:
+
+```bash
+echo "$SOCKET_API_KEY"   # populated by wheelhouse shell-rc bridge
+```
+
+The bridge writes the token to `~/.zshenv` (or platform equivalent)
+so every new shell exports `SOCKET_API_KEY` + `SOCKET_API_TOKEN`
+without a keychain read.
diff --git a/.claude/hooks/no-blind-keychain-read-guard/index.mts b/.claude/hooks/no-blind-keychain-read-guard/index.mts
new file mode 100644
index 0000000..bdb1094
--- /dev/null
+++ b/.claude/hooks/no-blind-keychain-read-guard/index.mts
@@ -0,0 +1,229 @@
+#!/usr/bin/env node
+// Claude Code PreToolUse hook — no-blind-keychain-read-guard.
+//
+// Blocks Bash invocations that READ a credential from the OS
+// keychain. Reading via the platform CLI surfaces a per-call UI auth
+// prompt on the user's screen ("this app wants to access your
+// keychain"), and the prompt fires once per call — a hook chain that
+// reads the keychain three times costs three prompts. Tokens are
+// already cached in process memory after the first resolution; the
+// fleet's canonical resolver (`api-token.mts.findApiToken()`) hits
+// the cache, then env, then keychain, in that order. Bash callers
+// that go straight to `security find-generic-password` skip all of
+// that and re-prompt the user every time.
+//
+// Detects (case-sensitive, structural — not just substring):
+//
+//   macOS:
+//     security find-generic-password
+//     security find-internet-password
+//
+//   Linux:
+//     secret-tool lookup
+//     secret-tool search
+//
+//   Windows (PowerShell):
+//     Get-StoredCredential          (CredentialManager module)
+//     Get-Credential                (when piping to ConvertFrom-SecureString)
+//
+//   Cross-platform (Python keyring CLI):
+//     keyring get
+//
+// Allowed (writes / deletes — necessary for operator-driven setup /
+// rotation, never on hot paths):
+//
+//   security add-generic-password   security delete-generic-password
+//   secret-tool store               secret-tool clear
+//   New-StoredCredential            Remove-StoredCredential
+//   keyring set                     keyring del
+//
+// Bypass: `Allow blind-keychain-read bypass` in a recent user turn.
+// Use when you genuinely need to verify a keychain entry exists
+// (e.g. operator-invoked diagnostics).
+//
+// Exit codes:
+//   0 — pass.
+//   2 — block.
+//
+// Fails open on malformed payloads (exit 0 + stderr log) — the fleet's
+// hook contract.
+
+import process from 'node:process'
+
+import { bypassPhrasePresent } from '../_shared/transcript.mts'
+
+interface ToolInput {
+  readonly tool_input?:
+    | {
+        readonly command?: string | undefined
+      }
+    | undefined
+  readonly tool_name?: string | undefined
+  readonly transcript_path?: string | undefined
+}
+
+interface Hit {
+  readonly tool: string
+  readonly platform: 'macos' | 'linux' | 'windows' | 'cross-platform'
+  readonly snippet: string
+}
+
+const BYPASS_PHRASE = 'Allow blind-keychain-read bypass'
+
+// Token-bearing read patterns. Each entry: the literal verb that
+// surfaces a UI prompt + a label for the error message. Writes /
+// deletes are intentionally absent from this list.
+const READ_PATTERNS: ReadonlyArray<{
+  readonly re: RegExp
+  readonly tool: string
+  readonly platform: Hit['platform']
+}> = [
+  // macOS — `security(1)`. The `-w` flag prints the password to
+  // stdout, but even the metadata-only form triggers the ACL prompt.
+  {
+    re: /\bsecurity\s+(?:find-generic-password|find-internet-password)\b/,
+    tool: 'security find-*-password',
+    platform: 'macos',
+  },
+  // Linux — `secret-tool`. `lookup` returns the password; `search`
+  // lists matches (also surfaces the libsecret prompt).
+  {
+    re: /\bsecret-tool\s+(?:lookup|search)\b/,
+    tool: 'secret-tool lookup/search',
+    platform: 'linux',
+  },
+  // Windows PowerShell — CredentialManager module. The
+  // `Get-StoredCredential` cmdlet returns a PSCredential; reading
+  // `.Password | ConvertFrom-SecureString` is the read pattern.
+  {
+    re: /\bGet-StoredCredential\b/,
+    tool: 'Get-StoredCredential',
+    platform: 'windows',
+  },
+  // PowerShell `Get-Credential -Credential` piped to
+  // `ConvertFrom-SecureString -AsPlainText` is the readback shape.
+  // The bare `Get-Credential` (no pipe) is a fresh-prompt-the-user
+  // flow and not the issue here — match only the readback pipe.
+  {
+    re: /\bGet-Credential\b[^|]*\|\s*ConvertFrom-SecureString\b/,
+    tool: 'Get-Credential | ConvertFrom-SecureString',
+    platform: 'windows',
+  },
+  // Python `keyring` CLI — `keyring get <service> <username>`.
+  {
+    re: /\bkeyring\s+get\b/,
+    tool: 'keyring get',
+    platform: 'cross-platform',
+  },
+]
+
+/**
+ * Scan a Bash command string for keychain READ patterns. Returns one hit per
+ * matching subcommand so the error message can name them all (a `&&`-chained
+ * command might have multiple).
+ */
+export function findKeychainReads(command: string): Hit[] {
+  const hits: Hit[] = []
+  for (let i = 0, { length } = READ_PATTERNS; i < length; i += 1) {
+    const entry = READ_PATTERNS[i]!
+    const m = entry.re.exec(command)
+    if (!m) {
+      continue
+    }
+    // Pull a short snippet around the match (up to 80 chars) so the
+    // operator can see the context. Centered on the match start.
+    const start = Math.max(0, m.index - 10)
+    const end = Math.min(command.length, m.index + m[0].length + 50)
+    const snippet = command.slice(start, end)
+    hits.push({
+      tool: entry.tool,
+      platform: entry.platform,
+      snippet: snippet.length < command.length ? `…${snippet}…` : snippet,
+    })
+  }
+  return hits
+}
+
+function handlePayload(payloadRaw: string): number {
+  let payload: ToolInput
+  try {
+    payload = JSON.parse(payloadRaw) as ToolInput
+  } catch {
+    return 0
+  }
+  if (payload.tool_name !== 'Bash') {
+    return 0
+  }
+  const command = payload.tool_input?.command ?? ''
+  if (!command) {
+    return 0
+  }
+  const hits = findKeychainReads(command)
+  if (hits.length === 0) {
+    return 0
+  }
+  if (bypassPhrasePresent(payload.transcript_path, BYPASS_PHRASE)) {
+    return 0
+  }
+  const lines: string[] = []
+  lines.push(
+    '[no-blind-keychain-read-guard] Blocked: direct keychain READ from Bash.',
+  )
+  lines.push('')
+  for (let i = 0, { length } = hits; i < length; i += 1) {
+    const h = hits[i]!
+    lines.push(`  ${h.platform.padEnd(15)} ${h.tool}`)
+    lines.push(`    Saw: ${h.snippet}`)
+  }
+  lines.push('')
+  lines.push('  Reading the keychain via the platform CLI surfaces a UI auth')
+  lines.push("  prompt on the user's screen — and the prompt fires once per")
+  lines.push('  call. A hook chain that reads three times costs three prompts.')
+  lines.push('')
+  lines.push('  The token is almost certainly already available without a')
+  lines.push('  keychain read:')
+  lines.push('')
+  lines.push('    - In-process: call findApiToken() from setup-security-tools/')
+  lines.push('      lib/api-token.mts. It returns the module-cached value from')
+  lines.push('      the first call onward, then env, then keychain.')
+  lines.push('')
+  lines.push('    - From Bash: read process.env.SOCKET_API_KEY or')
+  lines.push(
+    '      process.env.SOCKET_API_TOKEN. The wheelhouse shell-rc bridge',
+  )
+  lines.push('      exports both for every new shell session.')
+  lines.push('')
+  lines.push('  Writes / deletes (security add-generic-password / secret-tool')
+  lines.push('  store / New-StoredCredential / etc.) are allowed — they only')
+  lines.push('  happen during operator-driven setup / rotation.')
+  lines.push('')
+  lines.push('  Bypass (e.g. operator-invoked diagnostics that need a fresh')
+  lines.push('  keychain read):')
+  lines.push(`    Type "${BYPASS_PHRASE}" in your next message.`)
+  process.stderr.write(lines.join('\n') + '\n')
+  return 2
+}
+
+export { handlePayload }
+
+// CLI entrypoint — only fires when this file is the main module.
+// During tests the importer pulls `findKeychainReads` without triggering
+// the stdin reader (which would never see an `end` event in test env
+// and hang the process).
+if (process.argv[1] && process.argv[1].endsWith('index.mts')) {
+  let payloadRaw = ''
+  process.stdin.setEncoding('utf8')
+  process.stdin.on('data', chunk => {
+    payloadRaw += chunk
+  })
+  process.stdin.on('end', () => {
+    try {
+      process.exit(handlePayload(payloadRaw))
+    } catch (e) {
+      process.stderr.write(
+        `[no-blind-keychain-read-guard] hook error (allowing): ${e}\n`,
+      )
+      process.exit(0)
+    }
+  })
+}
diff --git a/.claude/hooks/no-blind-keychain-read-guard/package.json b/.claude/hooks/no-blind-keychain-read-guard/package.json
new file mode 100644
index 0000000..819429b
--- /dev/null
+++ b/.claude/hooks/no-blind-keychain-read-guard/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "hook-no-blind-keychain-read-guard",
+  "private": true,
+  "type": "module",
+  "main": "./index.mts",
+  "exports": {
+    ".": "./index.mts"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mts"
+  },
+  "devDependencies": {
+    "@types/node": "catalog:"
+  }
+}
diff --git a/.claude/hooks/no-blind-keychain-read-guard/test/index.test.mts b/.claude/hooks/no-blind-keychain-read-guard/test/index.test.mts
new file mode 100644
index 0000000..8567a3b
--- /dev/null
+++ b/.claude/hooks/no-blind-keychain-read-guard/test/index.test.mts
@@ -0,0 +1,142 @@
+/**
+ * @file Unit tests for findKeychainReads — the structural matcher that
+ *   classifies a Bash command string into keychain READ hits (vs writes,
+ *   deletes, and unrelated commands).
+ */
+
+import test from 'node:test'
+import assert from 'node:assert/strict'
+
+import { findKeychainReads } from '../index.mts'
+
+test('macOS find-generic-password is flagged', () => {
+  const hits = findKeychainReads(
+    'security find-generic-password -s socket-cli -a SOCKET_API_KEY -w',
+  )
+  assert.equal(hits.length, 1)
+  assert.equal(hits[0]!.platform, 'macos')
+})
+
+test('macOS find-internet-password is flagged', () => {
+  const hits = findKeychainReads(
+    'security find-internet-password -s example.com -a user',
+  )
+  assert.equal(hits.length, 1)
+  assert.equal(hits[0]!.platform, 'macos')
+})
+
+test('macOS add-generic-password is NOT flagged (write)', () => {
+  const hits = findKeychainReads(
+    'security add-generic-password -U -s socket-cli -a SOCKET_API_KEY -w xxx',
+  )
+  assert.equal(hits.length, 0)
+})
+
+test('macOS delete-generic-password is NOT flagged (delete)', () => {
+  const hits = findKeychainReads(
+    'security delete-generic-password -s socket-cli -a SOCKET_API_KEY',
+  )
+  assert.equal(hits.length, 0)
+})
+
+test('Linux secret-tool lookup is flagged', () => {
+  const hits = findKeychainReads(
+    'secret-tool lookup service socket-cli user SOCKET_API_KEY',
+  )
+  assert.equal(hits.length, 1)
+  assert.equal(hits[0]!.platform, 'linux')
+})
+
+test('Linux secret-tool search is flagged', () => {
+  const hits = findKeychainReads('secret-tool search service socket-cli')
+  assert.equal(hits.length, 1)
+  assert.equal(hits[0]!.platform, 'linux')
+})
+
+test('Linux secret-tool store is NOT flagged (write)', () => {
+  const hits = findKeychainReads(
+    'secret-tool store --label="Socket API token" service socket-cli user SOCKET_API_KEY',
+  )
+  assert.equal(hits.length, 0)
+})
+
+test('Linux secret-tool clear is NOT flagged (delete)', () => {
+  const hits = findKeychainReads(
+    'secret-tool clear service socket-cli user SOCKET_API_KEY',
+  )
+  assert.equal(hits.length, 0)
+})
+
+test('Windows Get-StoredCredential is flagged', () => {
+  const hits = findKeychainReads(
+    'powershell -Command "(Get-StoredCredential -Target \'socket-cli:SOCKET_API_KEY\').Password"',
+  )
+  assert.equal(hits.length, 1)
+  assert.equal(hits[0]!.platform, 'windows')
+})
+
+test('Windows Get-Credential | ConvertFrom-SecureString is flagged', () => {
+  const hits = findKeychainReads(
+    'Get-Credential -Credential admin | ConvertFrom-SecureString -AsPlainText',
+  )
+  assert.equal(hits.length, 1)
+  assert.equal(hits[0]!.platform, 'windows')
+})
+
+test('Windows Get-Credential WITHOUT pipe is NOT flagged (fresh prompt)', () => {
+  // Bare Get-Credential is an interactive fresh-prompt flow, not a
+  // readback of a stored credential. Don't block.
+  const hits = findKeychainReads('$cred = Get-Credential -Credential admin')
+  assert.equal(hits.length, 0)
+})
+
+test('Windows New-StoredCredential is NOT flagged (write)', () => {
+  const hits = findKeychainReads(
+    "New-StoredCredential -Target 'socket-cli:SOCKET_API_KEY' -UserName x -SecurePassword $s",
+  )
+  assert.equal(hits.length, 0)
+})
+
+test('keyring get is flagged', () => {
+  const hits = findKeychainReads('keyring get socket-cli SOCKET_API_KEY')
+  assert.equal(hits.length, 1)
+  assert.equal(hits[0]!.platform, 'cross-platform')
+})
+
+test('keyring set is NOT flagged (write)', () => {
+  const hits = findKeychainReads('keyring set socket-cli SOCKET_API_KEY')
+  assert.equal(hits.length, 0)
+})
+
+test('chained reads count separately', () => {
+  // && chain with two reads
+  const hits = findKeychainReads(
+    'security find-generic-password -s a -a b -w && secret-tool lookup service a user b',
+  )
+  assert.equal(hits.length, 2)
+})
+
+test('unrelated commands are not flagged', () => {
+  for (const cmd of [
+    'ls -la',
+    'git log --oneline -5',
+    'echo $SOCKET_API_KEY',
+    'pnpm install',
+    'grep security file.txt',
+    'security delete-keychain ~/Library/Keychains/foo.keychain',
+  ]) {
+    const hits = findKeychainReads(cmd)
+    assert.equal(hits.length, 0, `should not flag: ${cmd}`)
+  }
+})
+
+test('command substitution wrapping is still flagged', () => {
+  // The structural matcher is intentionally a regex, not an AST. This
+  // catches the common subshell shape — verifying the inner verb is
+  // detected even inside `$(...)`. AST-based parsing is overkill for
+  // a non-security-critical reminder hook.
+  const hits = findKeychainReads(
+    'TOKEN="$(security find-generic-password -s socket-cli -a SOCKET_API_KEY -w)" && echo done',
+  )
+  assert.equal(hits.length, 1)
+})
diff --git a/.claude/hooks/no-blind-keychain-read-guard/tsconfig.json b/.claude/hooks/no-blind-keychain-read-guard/tsconfig.json
new file mode 100644
index 0000000..19458cf
--- /dev/null
+++ b/.claude/hooks/no-blind-keychain-read-guard/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "declarationMap": false,
+    "erasableSyntaxOnly": true,
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "noEmit": true,
+    "rewriteRelativeImportExtensions": true,
+    "skipLibCheck": true,
+    "sourceMap": false,
+    "strict": true,
+    "target": "esnext",
+    "types": ["node"],
+    "verbatimModuleSyntax": true
+  }
+}
diff --git a/.claude/hooks/no-empty-commit-guard/README.md b/.claude/hooks/no-empty-commit-guard/README.md
new file mode 100644
index 0000000..c43b041
--- /dev/null
+++ b/.claude/hooks/no-empty-commit-guard/README.md
@@ -0,0 +1,40 @@
+# no-empty-commit-guard
+
+PreToolUse hook that blocks two empty-commit shapes the fleet bans
+(see CLAUDE.md "Commits & PRs → No empty commits"):
+
+1. `git commit --allow-empty` (with or without `-m`, also covers
+   `--allow-empty-message`).
+2. `git cherry-pick --allow-empty` / `--keep-redundant-commits` —
+   replaying a no-content commit forward.
+
+## Why blocking
+
+Empty commits pollute `git log`, break CHANGELOG generators (which
+expect each commit to carry a diff), and hide intent: a future
+reader can't tell whether the author meant to amend the previous
+commit, anchor a tag, or something else.
+
+The canonical way to anchor a release tag forward is
+`git tag -f vX.Y.Z <real-content-commit>` against an actual content
+commit, not a fake "anchor" commit with no diff. Force-moving the
+tag is a cleaner mechanism than synthesising history.
+
+## Bypass
+
+Type `Allow empty-commit bypass` verbatim in a recent user turn,
+then retry. The phrase authorises the next blocked `git commit`
+or `git cherry-pick` invocation within the conversation window.
+
+## Skipped silently
+
+- `tool_name !== 'Bash'`.
+- Commands that don't contain `git commit` or `git cherry-pick`.
+- `--allow-empty` appearing inside a quoted string (e.g. inside a
+  `-m` commit-message body that mentions the flag).
+
+## Failure mode
+
+Fails open: any internal error logs to stderr and exits 0. The hook
+is a quality gate, not a hard dependency — it never wedges the
+operator's flow.
diff --git a/.claude/hooks/no-empty-commit-guard/index.mts b/.claude/hooks/no-empty-commit-guard/index.mts
new file mode 100644
index 0000000..6beb9bb
--- /dev/null
+++ b/.claude/hooks/no-empty-commit-guard/index.mts
@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+// Claude Code PreToolUse hook — no-empty-commit-guard.
+//
+// Blocks two empty-commit shapes the fleet bans (see CLAUDE.md
+// "Commits & PRs → No empty commits"):
+//
+//   1. `git commit --allow-empty` (with or without `-m`).
+//   2. `git cherry-pick --allow-empty` / `--keep-redundant-commits`
+//      against a ref whose patch is empty relative to HEAD.
+//
+// Why blocking, not reminder: empty commits pollute `git log`, break
+// CHANGELOG generators (which expect each commit to carry a diff),
+// and hide intent ("did the author mean to anchor a tag? amend a
+// previous commit? something else?"). The canonical way to anchor
+// a release tag forward is `git tag -f vX.Y.Z` against the actual
+// content commit, not a fake "anchor" commit with no diff.
+//
+// Skipped silently:
+//   - tool_name !== 'Bash'.
+//   - Command doesn't contain `git commit` or `git cherry-pick`.
+//   - Bypass phrase present in recent transcript turns.
+//
+// Reads a Claude Code PreToolUse JSON payload from stdin:
+//   { "tool_name": "Bash",
+//     "tool_input": { "command": "..." },
+//     "transcript_path": "/path/to/jsonl",  // optional
+//     ... }
+//
+// Exit codes:
+//   0  — allow.
+//   2  — block. Stderr carries the operator-facing message.
+//
+// Fails open on any internal error (exit 0 + stderr log) so the
+// hook never wedges the operator's flow.
+
+import process from 'node:process'
+
+import { containsOutsideQuotes } from '../_shared/bash-quote-mask.mts'
+import { bypassPhrasePresent } from '../_shared/transcript.mts'
+
+interface ToolInput {
+  readonly tool_input?: { readonly command?: string | undefined } | undefined
+  readonly tool_name?: string | undefined
+  readonly transcript_path?: string | undefined
+}
+
+const BYPASS_PHRASE = 'Allow empty-commit bypass'
+
+/**
+ * Detect `git commit --allow-empty` (and `--allow-empty-message`, which is the
+ * same antipattern — both produce a no-op commit). Matches outside quoted
+ * strings so a literal `--allow-empty` in a commit-message body doesn't
+ * false-positive.
+ */
+export function isAllowEmptyCommit(command: string): boolean {
+  if (!containsOutsideQuotes(command, /\bgit\s+commit\b/)) {
+    return false
+  }
+  return containsOutsideQuotes(command, /--allow-empty(?:-message)?\b/)
+}
+
+/**
+ * Detect `git cherry-pick --allow-empty` or `--keep-redundant-commits` — both
+ * replay a no-content commit forward into the current branch, which is exactly
+ * the empty-commit pattern the rule bans.
+ */
+export function isCherryPickAllowEmpty(command: string): boolean {
+  if (!containsOutsideQuotes(command, /\bgit\s+cherry-pick\b/)) {
+    return false
+  }
+  return containsOutsideQuotes(
+    command,
+    /--(?:allow-empty|keep-redundant-commits)\b/,
+  )
+}
+
+let payloadRaw = ''
+process.stdin.setEncoding('utf8')
+process.stdin.on('data', chunk => {
+  payloadRaw += chunk
+})
+process.stdin.on('end', () => {
+  try {
+    let payload: ToolInput
+    try {
+      payload = JSON.parse(payloadRaw) as ToolInput
+    } catch {
+      process.exit(0)
+    }
+    if (payload.tool_name !== 'Bash') {
+      process.exit(0)
+    }
+    const command = payload.tool_input?.command ?? ''
+    if (!command) {
+      process.exit(0)
+    }
+
+    const allowEmptyCommit = isAllowEmptyCommit(command)
+    const allowEmptyCherryPick = isCherryPickAllowEmpty(command)
+    if (!allowEmptyCommit && !allowEmptyCherryPick) {
+      process.exit(0)
+    }
+
+    // Operator bypass — `Allow empty-commit bypass` in a recent turn.
+    if (bypassPhrasePresent(payload.transcript_path, BYPASS_PHRASE)) {
+      process.exit(0)
+    }
+
+    const flag = allowEmptyCommit
+      ? '--allow-empty (or --allow-empty-message)'
+      : '--allow-empty / --keep-redundant-commits'
+    process.stderr.write(
+      [
+        `[no-empty-commit-guard] Blocked: git ${allowEmptyCommit ? 'commit' : 'cherry-pick'} ${flag}`,
+        '',
+        '  Empty commits pollute `git log`, break CHANGELOG generators',
+        '  (which expect each commit to carry a diff), and hide intent.',
+        '',
+        '  If you are anchoring a release tag forward, use:',
+        '    git tag -f vX.Y.Z <real-content-commit>',
+        '    git push origin --force-with-lease vX.Y.Z',
+        '',
+        '  If you genuinely need to record a no-content waypoint, type',
+        `  "${BYPASS_PHRASE}" in chat, then retry.`,
+        '',
+      ].join('\n'),
+    )
+    process.exit(2)
+  } catch (e) {
+    process.stderr.write(
+      `[no-empty-commit-guard] hook error (allowing): ${e}\n`,
+    )
+    process.exit(0)
+  }
+})
diff --git a/.claude/hooks/no-empty-commit-guard/package.json b/.claude/hooks/no-empty-commit-guard/package.json
new file mode 100644
index 0000000..b78fb04
--- /dev/null
+++ b/.claude/hooks/no-empty-commit-guard/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "hook-no-empty-commit-guard",
+  "private": true,
+  "type": "module",
+  "main": "./index.mts",
+  "exports": {
+    ".": "./index.mts"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mts"
+  },
+  "devDependencies": {
+    "@types/node": "catalog:"
+  }
+}
diff --git a/.claude/hooks/no-empty-commit-guard/test/index.test.mts b/.claude/hooks/no-empty-commit-guard/test/index.test.mts
new file mode 100644
index 0000000..9ce2c95
--- /dev/null
+++ b/.claude/hooks/no-empty-commit-guard/test/index.test.mts
@@ -0,0 +1,112 @@
+// node --test specs for the no-empty-commit-guard hook.
+
+// prefer-async-spawn: streaming-stdio-required — test spawns child
+// subprocess and pipes stdin/stdout/stderr; Node spawn returns the
+// ChildProcess streaming surface the lib promise wrapper does not.
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import test from 'node:test'
+import assert from 'node:assert/strict'
+
+const here = path.dirname(fileURLToPath(import.meta.url))
+const HOOK = path.join(here, '..', 'index.mts')
+
+type Result = { code: number; stderr: string }
+
+async function runHook(payload: Record<string, unknown>): Promise<Result> {
+  const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
+  child.stdin!.end(JSON.stringify(payload))
+  let stderr = ''
+  child.process.stderr!.on('data', chunk => {
+    stderr += chunk.toString('utf8')
+  })
+  return new Promise(resolve => {
+    child.process.on('exit', code => {
+      resolve({ code: code ?? 0, stderr })
+    })
+  })
+}
+
+test('non-Bash tool calls pass through silently', async () => {
+  const result = await runHook({
+    tool_input: { file_path: 'foo.ts', new_string: 'x' },
+    tool_name: 'Edit',
+  })
+  assert.strictEqual(result.code, 0)
+  assert.strictEqual(result.stderr, '')
+})
+
+test('plain git commit passes through silently', async () => {
+  const result = await runHook({
+    tool_input: { command: 'git commit -m "real change"' },
+    tool_name: 'Bash',
+  })
+  assert.strictEqual(result.code, 0)
+  assert.strictEqual(result.stderr, '')
+})
+
+test('git commit --allow-empty is blocked', async () => {
+  const result = await runHook({
+    tool_input: {
+      command: 'git commit --allow-empty -m "anchor v1.0.0 tag"',
+    },
+    tool_name: 'Bash',
+  })
+  assert.strictEqual(result.code, 2)
+  assert.match(result.stderr, /no-empty-commit-guard.*Blocked/)
+})
+
+test('git commit --allow-empty-message is blocked', async () => {
+  const result = await runHook({
+    tool_input: { command: 'git commit --allow-empty-message -m ""' },
+    tool_name: 'Bash',
+  })
+  assert.strictEqual(result.code, 2)
+  assert.match(result.stderr, /no-empty-commit-guard.*Blocked/)
+})
+
+test('git cherry-pick --allow-empty is blocked', async () => {
+  const result = await runHook({
+    tool_input: { command: 'git cherry-pick --allow-empty abc1234' },
+    tool_name: 'Bash',
+  })
+  assert.strictEqual(result.code, 2)
+  assert.match(result.stderr, /no-empty-commit-guard.*Blocked/)
+})
+
+test('git cherry-pick --keep-redundant-commits is blocked', async () => {
+  const result = await runHook({
+    tool_input: {
+      command: 'git cherry-pick --keep-redundant-commits abc1234',
+    },
+    tool_name: 'Bash',
+  })
+  assert.strictEqual(result.code, 2)
+  assert.match(result.stderr, /no-empty-commit-guard.*Blocked/)
+})
+
+test('plain git cherry-pick passes through silently', async () => {
+  const result = await runHook({
+    tool_input: { command: 'git cherry-pick abc1234' },
+    tool_name: 'Bash',
+  })
+  assert.strictEqual(result.code, 0)
+  assert.strictEqual(result.stderr, '')
+})
+
+test('commit message bodies mentioning --allow-empty are skipped (quote-aware)', async () => {
+  const result = await runHook({
+    tool_input: {
+      command: `git commit -m "docs: forbid git commit --allow-empty in fleet"`,
+    },
+    tool_name: 'Bash',
+  })
+  assert.strictEqual(result.code, 0)
+  assert.strictEqual(result.stderr, '')
+})
diff --git a/.claude/hooks/no-empty-commit-guard/tsconfig.json b/.claude/hooks/no-empty-commit-guard/tsconfig.json
new file mode 100644
index 0000000..19458cf
--- /dev/null
+++ b/.claude/hooks/no-empty-commit-guard/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "declarationMap": false,
+    "erasableSyntaxOnly": true,
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "noEmit": true,
+    "rewriteRelativeImportExtensions": true,
+    "skipLibCheck": true,
+    "sourceMap": false,
+    "strict": true,
+    "target": "esnext",
+    "types": ["node"],
+    "verbatimModuleSyntax": true
+  }
+}
diff --git a/.claude/hooks/no-experimental-strip-types-guard/test/index.test.mts b/.claude/hooks/no-experimental-strip-types-guard/test/index.test.mts
index fb4a2e9..4c130c7 100644
--- a/.claude/hooks/no-experimental-strip-types-guard/test/index.test.mts
+++ b/.claude/hooks/no-experimental-strip-types-guard/test/index.test.mts
@@ -6,7 +6,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import test from 'node:test'
@@ -22,6 +22,11 @@ interface Result {
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/no-external-issue-ref-guard/test/index.test.mts b/.claude/hooks/no-external-issue-ref-guard/test/index.test.mts
index 0899da2..72a1afa 100644
--- a/.claude/hooks/no-external-issue-ref-guard/test/index.test.mts
+++ b/.claude/hooks/no-external-issue-ref-guard/test/index.test.mts
@@ -6,7 +6,7 @@
  */
 
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { describe, test } from 'node:test'
@@ -21,7 +21,6 @@ interface RunResult {
 
 function runHook(payload: object): RunResult {
   const r = spawnSync('node', [HOOK], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify(payload),
   })
   return {
@@ -149,7 +148,8 @@ EOF
         'and again spencermountain/compromise#1203"',
     )
     assert.equal(r.code, 2)
-    const matches = String(r.stderr).match(/spencermountain\/compromise#1203/g) || []
+    const matches =
+      String(r.stderr).match(/spencermountain\/compromise#1203/g) || []
     // Ref appears in 'Refs found:' bullet — one bullet, not two.
     // (May also appear in narrative text once.)
     assert.ok(matches.length <= 2, `expected dedup; saw ${matches.length}`)
@@ -157,7 +157,6 @@ EOF
 
   test('fails open on invalid JSON', () => {
     const r = spawnSync('node', [HOOK], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: 'not json',
     })
     assert.equal(r.status, 0)
@@ -165,7 +164,6 @@ EOF
 
   test('fails open on empty stdin', () => {
     const r = spawnSync('node', [HOOK], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: '',
     })
     assert.equal(r.status, 0)
diff --git a/.claude/hooks/no-fleet-fork-guard/test/index.test.mts b/.claude/hooks/no-fleet-fork-guard/test/index.test.mts
index a1826bb..8a4595a 100644
--- a/.claude/hooks/no-fleet-fork-guard/test/index.test.mts
+++ b/.claude/hooks/no-fleet-fork-guard/test/index.test.mts
@@ -11,7 +11,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -36,6 +36,11 @@ async function runHook(
     payload['transcript_path'] = transcriptPath
   }
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/no-meta-comments-guard/test/index.test.mts b/.claude/hooks/no-meta-comments-guard/test/index.test.mts
index 0ec5c61..a92b61c 100644
--- a/.claude/hooks/no-meta-comments-guard/test/index.test.mts
+++ b/.claude/hooks/no-meta-comments-guard/test/index.test.mts
@@ -5,7 +5,7 @@ import assert from 'node:assert/strict'
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -16,6 +16,11 @@ type Result = { code: number; stderr: string }
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/no-orphaned-staging/index.mts b/.claude/hooks/no-orphaned-staging/index.mts
index 0b9e373..0a8989f 100644
--- a/.claude/hooks/no-orphaned-staging/index.mts
+++ b/.claude/hooks/no-orphaned-staging/index.mts
@@ -34,7 +34,7 @@
 //
 // Disabled via `SOCKET_NO_ORPHANED_STAGING_DISABLED=1`.
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import process from 'node:process'
 
 export async function drainStdin(): Promise<void> {
diff --git a/.claude/hooks/no-orphaned-staging/test/index.test.mts b/.claude/hooks/no-orphaned-staging/test/index.test.mts
index c60a34c..a7cf5d4 100644
--- a/.claude/hooks/no-orphaned-staging/test/index.test.mts
+++ b/.claude/hooks/no-orphaned-staging/test/index.test.mts
@@ -5,7 +5,7 @@
  */
 
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -22,7 +22,6 @@ interface RunResult {
 
 function runHook(env: Record<string, string>): RunResult {
   const r = spawnSync('node', [HOOK], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: '{}',
     env: { ...process.env, ...env },
   })
@@ -33,7 +32,7 @@ function runHook(env: Record<string, string>): RunResult {
 }
 
 function git(repoDir: string, args: string[]): void {
-  const r = spawnSync('git', args, { cwd: repoDir,})
+  const r = spawnSync('git', args, { cwd: repoDir })
   if (r.status !== 0) {
     throw new Error(`git ${args.join(' ')} failed: ${r.stderr}`)
   }
@@ -120,7 +119,6 @@ describe('no-orphaned-staging', () => {
     // Empty stdin would normally drain; verifying the hook doesn't
     // crash on missing-env-vars or other edge cases.
     const r = spawnSync('node', [HOOK], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: '',
       env: { ...process.env, CLAUDE_PROJECT_DIR: '/nonexistent/path' },
     })
diff --git a/.claude/hooks/no-revert-guard/test/index.test.mts b/.claude/hooks/no-revert-guard/test/index.test.mts
index 950f9a7..b247579 100644
--- a/.claude/hooks/no-revert-guard/test/index.test.mts
+++ b/.claude/hooks/no-revert-guard/test/index.test.mts
@@ -6,7 +6,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -31,6 +31,11 @@ async function runHook(
     payload['transcript_path'] = transcriptPath
   }
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/no-structured-clone-prefer-json-guard/test/index.test.mts b/.claude/hooks/no-structured-clone-prefer-json-guard/test/index.test.mts
index 6d96666..2fa2661 100644
--- a/.claude/hooks/no-structured-clone-prefer-json-guard/test/index.test.mts
+++ b/.claude/hooks/no-structured-clone-prefer-json-guard/test/index.test.mts
@@ -4,7 +4,7 @@ import assert from 'node:assert/strict'
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { describe, test } from 'node:test'
 import { fileURLToPath } from 'node:url'
@@ -20,6 +20,11 @@ interface RunResult {
 function runHook(payload: object): Promise<RunResult> {
   return new Promise((resolve, reject) => {
     const child = spawn('node', [HOOK], { stdio: ['pipe', 'pipe', 'pipe'] })
+    // v6 lib-stable spawn returns an enriched Promise that rejects on
+    // non-zero exit; this test reads stderr + exit via manual listeners
+    // instead. Swallow the Promise rejection so it doesn't race the
+    // listener-based resolve and trigger "async activity after test ended".
+    void child.catch(() => undefined)
     let stderr = ''
     child.process.stderr!.on('data', d => {
       stderr += d.toString()
diff --git a/.claude/hooks/no-token-in-dotenv-guard/index.mts b/.claude/hooks/no-token-in-dotenv-guard/index.mts
index ef7c835..fb1d77f 100644
--- a/.claude/hooks/no-token-in-dotenv-guard/index.mts
+++ b/.claude/hooks/no-token-in-dotenv-guard/index.mts
@@ -60,7 +60,7 @@ interface ToolInput {
 }
 
 // Dotfile shapes that carry env-style KEY=VALUE content.
-const DOTENV_BASENAME_RE = /^\.env(\..+)?$|^\.envrc$/
+const DOTENV_BASENAME_RE = /^\.env(?:\..+)?$|^\.envrc$/
 
 // Token-bearing key names live in `_shared/token-patterns.mts` so
 // every hook that scans for secret leaks (this one + token-guard)
diff --git a/.claude/hooks/no-token-in-dotenv-guard/test/index.test.mts b/.claude/hooks/no-token-in-dotenv-guard/test/index.test.mts
index a7b198e..13c6b1d 100644
--- a/.claude/hooks/no-token-in-dotenv-guard/test/index.test.mts
+++ b/.claude/hooks/no-token-in-dotenv-guard/test/index.test.mts
@@ -5,7 +5,7 @@ import assert from 'node:assert/strict'
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -16,6 +16,11 @@ type Result = { code: number; stderr: string }
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/no-underscore-identifier-guard/test/index.test.mts b/.claude/hooks/no-underscore-identifier-guard/test/index.test.mts
index 37acc50..282b5d2 100644
--- a/.claude/hooks/no-underscore-identifier-guard/test/index.test.mts
+++ b/.claude/hooks/no-underscore-identifier-guard/test/index.test.mts
@@ -5,7 +5,7 @@ import assert from 'node:assert/strict'
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -16,6 +16,11 @@ type Result = { code: number; stderr: string }
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/node-modules-staging-guard/index.mts b/.claude/hooks/node-modules-staging-guard/index.mts
index d442f97..5b87967 100644
--- a/.claude/hooks/node-modules-staging-guard/index.mts
+++ b/.claude/hooks/node-modules-staging-guard/index.mts
@@ -75,15 +75,15 @@ export function isForbiddenPath(arg: string): boolean {
   // Any `/node_modules/` segment OR a top-level `node_modules` /
   // `node_modules/...`.
   if (
-    /(^|\/)node_modules(\/|$)/.test(stripped) ||
-    /[\\]node_modules([\\]|$)/.test(stripped)
+    /(?:^|\/)node_modules(?:\/|$)/.test(stripped) ||
+    /[\\]node_modules(?:[\\]|$)/.test(stripped)
   ) {
     return true
   }
   // `package-lock.json` under `.claude/hooks/<name>/` or
   // `.claude/skills/<name>/`.
   if (
-    /(^|\/)\.claude\/(hooks|skills)\/[^/]+\/(package-lock\.json|pnpm-lock\.yaml)$/.test(
+    /(?:^|\/)\.claude\/(?:hooks|skills)\/[^/]+\/(?:package-lock\.json|pnpm-lock\.yaml)$/.test(
       stripped,
     )
   ) {
diff --git a/.claude/hooks/node-modules-staging-guard/test/index.test.mts b/.claude/hooks/node-modules-staging-guard/test/index.test.mts
index 818b9da..694a5ca 100644
--- a/.claude/hooks/node-modules-staging-guard/test/index.test.mts
+++ b/.claude/hooks/node-modules-staging-guard/test/index.test.mts
@@ -3,7 +3,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -18,6 +18,11 @@ type Result = { code: number; stderr: string }
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/overeager-staging-guard/index.mts b/.claude/hooks/overeager-staging-guard/index.mts
index 5420390..d181830 100644
--- a/.claude/hooks/overeager-staging-guard/index.mts
+++ b/.claude/hooks/overeager-staging-guard/index.mts
@@ -36,7 +36,7 @@
 //     "tool_input": { "command": "..." },
 //     "transcript_path": "/.../session.jsonl" }
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { readFileSync } from 'node:fs'
 import path from 'node:path'
 import process from 'node:process'
@@ -118,9 +118,15 @@ export function detectBroadGitAdd(command: string): string | undefined {
     const rest = tokens.slice(j + 2)
     for (let k = 0, { length } = rest; k < length; k += 1) {
       const arg = rest[k]!
-      if (arg === '--all' || arg === '-A') {return `git add ${arg}`}
-      if (arg === '--update' || arg === '-u') {return `git add ${arg}`}
-      if (arg === '.') {return 'git add .'}
+      if (arg === '--all' || arg === '-A') {
+        return `git add ${arg}`
+      }
+      if (arg === '--update' || arg === '-u') {
+        return `git add ${arg}`
+      }
+      if (arg === '.') {
+        return 'git add .'
+      }
     }
   }
   return undefined
diff --git a/.claude/hooks/overeager-staging-guard/test/index.test.mts b/.claude/hooks/overeager-staging-guard/test/index.test.mts
index c0b8475..2784f9e 100644
--- a/.claude/hooks/overeager-staging-guard/test/index.test.mts
+++ b/.claude/hooks/overeager-staging-guard/test/index.test.mts
@@ -7,7 +7,7 @@
  */
 
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -36,7 +36,6 @@ function runHook(
     transcript_path: options.transcriptPath,
   }
   const r = spawnSync('node', [HOOK], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify(payload),
     env: {
       ...process.env,
@@ -255,7 +254,6 @@ test('git commit silent when index files match transcript git-add history', () =
 
 test('non-Bash tool_name is ignored', () => {
   const r = spawnSync('node', [HOOK], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({
       tool_name: 'Edit',
       tool_input: { file_path: '/tmp/foo' },
@@ -266,7 +264,6 @@ test('non-Bash tool_name is ignored', () => {
 
 test('malformed payload is ignored (fail-open)', () => {
   const r = spawnSync('node', [HOOK], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: 'not-json',
   })
   assert.equal(r.status, 0)
diff --git a/.claude/hooks/path-guard/README.md b/.claude/hooks/path-guard/README.md
index 72ef970..bec03c1 100644
--- a/.claude/hooks/path-guard/README.md
+++ b/.claude/hooks/path-guard/README.md
@@ -73,11 +73,10 @@ The hook recognizes Rule B traversals only when the next segment
 after `..` is a known fleet package name:
 
 `binflate`, `binject`, `binpress`, `bin-infra`, `build-infra`,
-`codet5-models-builder`, `curl-builder`, `iocraft-builder`,
-`ink-builder`, `libpq-builder`, `lief-builder`, `minilm-builder`,
-`models`, `napi-go`, `node-smol-builder`, `onnxruntime-builder`,
-`opentui-builder`, `stubs-builder`, `ultraviolet-builder`,
-`yoga-layout-builder`
+`codet5-models-builder`, `curl-builder`, `libpq-builder`,
+`lief-builder`, `minilm-builder`, `models`, `napi-go`,
+`node-smol-builder`, `onnxruntime-builder`, `opentui-builder`,
+`stubs-builder`, `ultraviolet-builder`, `yoga-layout-builder`
 
 When a new package joins the workspace, add it to
 `KNOWN_SIBLING_PACKAGES` in `index.mts`.
diff --git a/.claude/hooks/path-guard/index.mts b/.claude/hooks/path-guard/index.mts
index 5e24aea..33f730d 100644
--- a/.claude/hooks/path-guard/index.mts
+++ b/.claude/hooks/path-guard/index.mts
@@ -62,10 +62,10 @@ import {
 } from './segments.mts'
 
 const EXEMPT_FILE_PATTERNS: RegExp[] = [
-  /(^|\/)paths\.(cts|mts)$/,
+  /(?:^|\/)paths\.(?:cts|mts)$/,
   /scripts\/check-paths\.mts$/,
   /scripts\/check-paths\//,
-  /\.claude\/hooks\/path-guard\/index\.(cts|mts)$/,
+  /\.claude\/hooks\/path-guard\/index\.(?:cts|mts)$/,
   /\.claude\/hooks\/path-guard\/test\//,
   /scripts\/check-consistency\.mts$/,
 ]
diff --git a/.claude/hooks/path-guard/segments.mts b/.claude/hooks/path-guard/segments.mts
index d680eb8..c4eb78e 100644
--- a/.claude/hooks/path-guard/segments.mts
+++ b/.claude/hooks/path-guard/segments.mts
@@ -54,8 +54,6 @@ export const KNOWN_SIBLING_PACKAGES = new Set([
   'codet5-models-builder',
   'core',
   'curl-builder',
-  'ink-builder',
-  'iocraft-builder',
   'libpq-builder',
   'lief-builder',
   'minilm-builder',
diff --git a/.claude/hooks/path-guard/test/path-guard.test.mts b/.claude/hooks/path-guard/test/path-guard.test.mts
index 0da895b..dbef944 100644
--- a/.claude/hooks/path-guard/test/path-guard.test.mts
+++ b/.claude/hooks/path-guard/test/path-guard.test.mts
@@ -5,7 +5,7 @@
 // Run: pnpm --filter hook-path-guard test
 //      (or directly: node --test test/*.test.mts)
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import process from 'node:process'
 import { fileURLToPath } from 'node:url'
@@ -30,7 +30,6 @@ const runHook = (
         : { file_path: filePath, content: source },
   })
   const result = spawnSync(process.execPath, [HOOK], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: payload,
   })
   return {
@@ -298,7 +297,6 @@ describe('path-guard — tool-name filter', () => {
 describe('path-guard — bug-tolerance (fails open)', () => {
   it('passes through invalid JSON payload', () => {
     const result = spawnSync(process.execPath, [HOOK], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: 'not json at all',
     })
     assert.equal(result.status, 0)
@@ -306,7 +304,6 @@ describe('path-guard — bug-tolerance (fails open)', () => {
 
   it('passes through empty stdin', () => {
     const result = spawnSync(process.execPath, [HOOK], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: '',
     })
     assert.equal(result.status, 0)
diff --git a/.claude/hooks/paths-mts-inherit-guard/index.mts b/.claude/hooks/paths-mts-inherit-guard/index.mts
index 39a816c..f77746c 100644
--- a/.claude/hooks/paths-mts-inherit-guard/index.mts
+++ b/.claude/hooks/paths-mts-inherit-guard/index.mts
@@ -74,9 +74,9 @@ type ToolInput = {
 const BYPASS_PHRASE = 'Allow paths-mts-inherit bypass'
 const BYPASS_LOOKBACK_USER_TURNS = 8
 
-const PATHS_MTS_RE = /(^|\/)paths\.(?:cts|mts)$/
+const PATHS_MTS_RE = /(?:^|\/)paths\.(?:cts|mts)$/
 const EXPORT_STAR_RE =
-  /^\s*export\s+\*\s+from\s+['"]([^'"]+\/paths\.m?ts)['"];?\s*$/m
+  /^\s*export\s+\*\s+from\s+['"](?:[^'"]+\/paths\.m?ts)['"];?\s*$/m
 
 /**
  * Walk up from `filePath` looking for an ancestor `scripts/paths.mts` or
diff --git a/.claude/hooks/paths-mts-inherit-guard/test/index.test.mts b/.claude/hooks/paths-mts-inherit-guard/test/index.test.mts
index a336d94..4dd400a 100644
--- a/.claude/hooks/paths-mts-inherit-guard/test/index.test.mts
+++ b/.claude/hooks/paths-mts-inherit-guard/test/index.test.mts
@@ -5,7 +5,7 @@
  */
 
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -22,7 +22,6 @@ interface RunResult {
 
 function runHook(payload: object): RunResult {
   const r = spawnSync('node', [HOOK], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify(payload),
   })
   return {
@@ -170,7 +169,6 @@ describe('paths-mts-inherit-guard', () => {
 
   test('fails open on invalid JSON', () => {
     const r = spawnSync('node', [HOOK], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: 'not json',
     })
     assert.equal(r.status, 0)
@@ -178,7 +176,6 @@ describe('paths-mts-inherit-guard', () => {
 
   test('fails open on empty stdin', () => {
     const r = spawnSync('node', [HOOK], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: '',
     })
     assert.equal(r.status, 0)
diff --git a/.claude/hooks/perfectionist-reminder/index.mts b/.claude/hooks/perfectionist-reminder/index.mts
index 2c14ba5..135a461 100644
--- a/.claude/hooks/perfectionist-reminder/index.mts
+++ b/.claude/hooks/perfectionist-reminder/index.mts
@@ -36,29 +36,29 @@ await runStopReminder({
     {
       label: 'option A (depth/correctness) … option B (speed/shipped)',
       regex:
-        /\boption\s+a\b[^.?!\n]{0,80}\b(correctness|depth|proper|thorough)\b[\s\S]{0,200}\boption\s+b\b[^.?!\n]{0,80}\b(breadth|fast|ship|speed)\b/i,
+        /\boption\s+a\b[^.?!\n]{0,80}\b(?:correctness|depth|proper|thorough)\b[\s\S]{0,200}\boption\s+b\b[^.?!\n]{0,80}\b(?:breadth|fast|ship|speed)\b/i,
       why: 'Speed-vs-depth choice menu. Per CLAUDE.md "Default to perfectionist when you have latitude" — pick depth and execute.',
     },
     {
       label: 'maximally useful vs maximally shipped',
       regex:
-        /\bmaximally\s+(correct|thorough|useful)\b[\s\S]{0,80}\bmaximally\s+(fast|quick|shipped)\b/i,
+        /\bmaximally\s+(?:correct|thorough|useful)\b[\s\S]{0,80}\bmaximally\s+(?:fast|quick|shipped)\b/i,
       why: 'Same pattern — re-litigating perfectionist-vs-velocity. User already chose perfectionist.',
     },
     {
       label: 'ship-it precision / ship-it-now',
-      regex: /\bship[- ]it[- ]?(fast|now|precision|version)\b/i,
+      regex: /\bship[- ]it[- ]?(?:fast|now|precision|version)\b/i,
       why: 'Velocity-framed; CLAUDE.md says perfectionist default. Use unless user explicitly time-boxed.',
     },
     {
       label: 'depth over breadth / breadth over depth',
-      regex: /\b(depth\s+over\s+breadth|breadth\s+over\s+depth)\?/i,
+      regex: /\b(?:depth\s+over\s+breadth|breadth\s+over\s+depth)\?/i,
       why: 'The CLAUDE.md default is depth (perfectionist). Pick it.',
     },
     {
       label: 'speed vs depth / fast vs right / now vs correct',
       regex:
-        /\b(fast|now|quick|speed)\s+vs\.?\s+(correct|depth|proper|right|thorough)\b/i,
+        /\b(?:fast|now|quick|speed)\s+vs\.?\s+(?:correct|depth|proper|right|thorough)\b/i,
       why: 'Same speed-vs-quality framing; perfectionist is the default unless user opted out.',
     },
     {
@@ -69,7 +69,7 @@ await runStopReminder({
     {
       label: 'plow through vs do it right',
       regex:
-        /\bplow\s+(ahead|through)\b[\s\S]{0,80}\b(carefully|correctly|properly|right)\b/i,
+        /\bplow\s+(?:ahead|through)\b[\s\S]{0,80}\b(?:carefully|correctly|properly|right)\b/i,
       why: 'Same pattern (velocity vs care). Default perfectionist.',
     },
   ],
diff --git a/.claude/hooks/perfectionist-reminder/test/index.test.mts b/.claude/hooks/perfectionist-reminder/test/index.test.mts
index e091d35..42541fb 100644
--- a/.claude/hooks/perfectionist-reminder/test/index.test.mts
+++ b/.claude/hooks/perfectionist-reminder/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -28,7 +28,6 @@ function makeTranscript(assistantText: string): {
 
 function runHook(transcriptPath: string): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: transcriptPath }),
   })
   return { stderr: String(result.stderr), exitCode: result.status ?? -1 }
@@ -127,7 +126,6 @@ test('disabled env var short-circuits', () => {
   )
   try {
     const result = spawnSync('node', [HOOK_PATH], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: JSON.stringify({ transcript_path: p }),
       env: { ...process.env, SOCKET_PERFECTIONIST_REMINDER_DISABLED: '1' },
     })
diff --git a/.claude/hooks/plan-location-guard/test/index.test.mts b/.claude/hooks/plan-location-guard/test/index.test.mts
index 0af717f..63f0927 100644
--- a/.claude/hooks/plan-location-guard/test/index.test.mts
+++ b/.claude/hooks/plan-location-guard/test/index.test.mts
@@ -5,7 +5,7 @@ import assert from 'node:assert/strict'
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -16,6 +16,11 @@ type Result = { code: number; stderr: string }
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/plan-review-reminder/index.mts b/.claude/hooks/plan-review-reminder/index.mts
index a7a8418..5b98a77 100644
--- a/.claude/hooks/plan-review-reminder/index.mts
+++ b/.claude/hooks/plan-review-reminder/index.mts
@@ -35,18 +35,18 @@ interface StopPayload {
 // Plan-announcement phrases. Each fires only if the announcement is
 // NOT followed (within a window of text) by a numbered list.
 const PLAN_PHRASE_RE =
-  /\b(here'?s the plan|my plan is|i will:|approach:|steps:|step 1)\b/i
+  /\b(?:here'?s the plan|my plan is|i will:|approach:|steps:|step 1)\b/i
 
 // Numbered-list shape: "1." or "1)" at line start.
 const NUMBERED_LIST_RE = /^\s*1\s*[.)]\s+\S/m
 
 // Fleet-shared resources whose edits should invite a second-opinion pass.
 const FLEET_SHARED_RE =
-  /\b(CLAUDE\.md|\.claude\/hooks\/|_shared\/|template\/CLAUDE\.md|sync-scaffolding|cascade-tooling)\b/
+  /\b(?:CLAUDE\.md|\.claude\/hooks\/|_shared\/|template\/CLAUDE\.md|sync-scaffolding|cascade-tooling)\b/
 
 // Second-opinion-invitation phrases.
 const SECOND_OPINION_RE =
-  /\b(second[- ]opinion|review (the|this) plan|sanity[- ]check|pair[- ]review|invite a review)\b/i
+  /\b(?:second[- ]opinion|review (?:the|this) plan|sanity[- ]check|pair[- ]review|invite a review)\b/i
 
 async function main(): Promise<void> {
   const payloadRaw = await readStdin()
@@ -90,7 +90,7 @@ async function main(): Promise<void> {
     // (which keeps the I'll context) and the stripped text.
     if (
       PLAN_PHRASE_RE.test(text) ||
-      /\b(I'?ll|I will|I'm going to)\b/i.test(rawText)
+      /\b(?:I'?ll|I will|I'm going to)\b/i.test(rawText)
     ) {
       hits.push(
         'plan touches fleet-shared resources (CLAUDE.md / .claude/hooks/ / ' +
diff --git a/.claude/hooks/plan-review-reminder/test/index.test.mts b/.claude/hooks/plan-review-reminder/test/index.test.mts
index cbff9ca..096a559 100644
--- a/.claude/hooks/plan-review-reminder/test/index.test.mts
+++ b/.claude/hooks/plan-review-reminder/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -23,7 +23,6 @@ function makeTranscript(assistantText: string): string {
 
 function runHook(transcriptPath: string): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: transcriptPath }),
   })
   return { stderr: String(result.stderr), exitCode: result.status ?? -1 }
@@ -78,7 +77,6 @@ test('does NOT fire on plain non-plan prose', () => {
 test('disabled env var short-circuits', () => {
   const t = makeTranscript("Here's the plan: do stuff.")
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: t }),
     env: { ...process.env, SOCKET_PLAN_REVIEW_REMINDER_DISABLED: '1' },
   })
diff --git a/.claude/hooks/pointer-comment-guard/index.mts b/.claude/hooks/pointer-comment-guard/index.mts
index dc104bc..cc9cefe 100644
--- a/.claude/hooks/pointer-comment-guard/index.mts
+++ b/.claude/hooks/pointer-comment-guard/index.mts
@@ -225,7 +225,7 @@ async function main(): Promise<void> {
     process.exit(0)
   }
   // Skip tests — they often have illustrative pointer-only comments.
-  if (/(^|\/)test\//.test(filePath) || /\.test\.[jt]sx?$/.test(filePath)) {
+  if (/(?:^|\/)test\//.test(filePath) || /\.test\.[jt]sx?$/.test(filePath)) {
     process.exit(0)
   }
   if (bypassPhrasePresent(payload.transcript_path, BYPASS_PHRASES)) {
diff --git a/.claude/hooks/pointer-comment-guard/test/index.test.mts b/.claude/hooks/pointer-comment-guard/test/index.test.mts
index d3743d0..0e51b72 100644
--- a/.claude/hooks/pointer-comment-guard/test/index.test.mts
+++ b/.claude/hooks/pointer-comment-guard/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -36,7 +36,6 @@ function runHook(
     payload['transcript_path'] = options.transcriptPath
   }
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify(payload),
     env: { ...process.env, ...(options.env ?? {}) },
   })
@@ -196,7 +195,6 @@ test('handles block comments — pointer + claim in /* … */ passes', () => {
 
 test('does not crash on malformed payload', () => {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: 'not-json',
   })
   assert.equal(result.status, 0)
@@ -204,7 +202,6 @@ test('does not crash on malformed payload', () => {
 
 test('does not crash when content is missing', () => {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({
       tool_name: 'Write',
       tool_input: { file_path: '/repo/src/foo.ts' },
diff --git a/.claude/hooks/pr-vs-push-default-reminder/index.mts b/.claude/hooks/pr-vs-push-default-reminder/index.mts
index 4abeee7..ef72760 100644
--- a/.claude/hooks/pr-vs-push-default-reminder/index.mts
+++ b/.claude/hooks/pr-vs-push-default-reminder/index.mts
@@ -15,7 +15,7 @@
 // Skipped when the branch isn't main/master (feature branches always
 // PR via the wheelhouse push-fallback policy).
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { readFileSync } from 'node:fs'
 import process from 'node:process'
 
@@ -58,7 +58,9 @@ export function hasPrDirective(turns: string[]): boolean {
     const text = turns[i]!
     for (let i = 0, { length } = PR_DIRECTIVE_PATTERNS; i < length; i += 1) {
       const re = PR_DIRECTIVE_PATTERNS[i]!
-      if (re.test(text)) {return true}
+      if (re.test(text)) {
+        return true
+      }
     }
   }
   return false
diff --git a/.claude/hooks/pr-vs-push-default-reminder/test/index.test.mts b/.claude/hooks/pr-vs-push-default-reminder/test/index.test.mts
index faad65a..38282d4 100644
--- a/.claude/hooks/pr-vs-push-default-reminder/test/index.test.mts
+++ b/.claude/hooks/pr-vs-push-default-reminder/test/index.test.mts
@@ -1,6 +1,6 @@
 // node --test specs for the pr-vs-push-default-reminder hook.
 
-import { spawn, spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawn, spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -36,6 +36,11 @@ function mkTranscript(userTurns: string[]): string {
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/prefer-rebase-over-revert-guard/index.mts b/.claude/hooks/prefer-rebase-over-revert-guard/index.mts
index 97090e6..cdc8f90 100644
--- a/.claude/hooks/prefer-rebase-over-revert-guard/index.mts
+++ b/.claude/hooks/prefer-rebase-over-revert-guard/index.mts
@@ -30,7 +30,7 @@
 //
 // Fails open on any internal error (exit 0 + stderr log).
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import process from 'node:process'
 
 import { containsOutsideQuotes } from '../_shared/bash-quote-mask.mts'
diff --git a/.claude/hooks/prefer-rebase-over-revert-guard/test/index.test.mts b/.claude/hooks/prefer-rebase-over-revert-guard/test/index.test.mts
index 65266a1..67de5c3 100644
--- a/.claude/hooks/prefer-rebase-over-revert-guard/test/index.test.mts
+++ b/.claude/hooks/prefer-rebase-over-revert-guard/test/index.test.mts
@@ -11,7 +11,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import test from 'node:test'
@@ -24,6 +24,11 @@ type Result = { code: number; stderr: string }
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/private-name-guard/index.mts b/.claude/hooks/private-name-guard/index.mts
index 03b11b8..2d8795f 100644
--- a/.claude/hooks/private-name-guard/index.mts
+++ b/.claude/hooks/private-name-guard/index.mts
@@ -38,10 +38,10 @@ type ToolInput = {
 const PUBLIC_SURFACE_PATTERNS: RegExp[] = [
   /\bgit\s+commit\b/,
   /\bgit\s+push\b/,
-  /\bgh\s+pr\s+(comment|create|edit|review)\b/,
-  /\bgh\s+issue\s+(comment|create|edit)\b/,
-  /\bgh\s+api\b[^|]*-X\s*(PATCH|POST|PUT)\b/i,
-  /\bgh\s+release\s+(create|edit)\b/,
+  /\bgh\s+pr\s+(?:comment|create|edit|review)\b/,
+  /\bgh\s+issue\s+(?:comment|create|edit)\b/,
+  /\bgh\s+api\b[^|]*-X\s*(?:PATCH|POST|PUT)\b/i,
+  /\bgh\s+release\s+(?:create|edit)\b/,
 ]
 
 export function isPublicSurface(command: string): boolean {
diff --git a/.claude/hooks/private-name-guard/test/private-name-guard.test.mts b/.claude/hooks/private-name-guard/test/private-name-guard.test.mts
index f092bac..dae327b 100644
--- a/.claude/hooks/private-name-guard/test/private-name-guard.test.mts
+++ b/.claude/hooks/private-name-guard/test/private-name-guard.test.mts
@@ -2,7 +2,7 @@ import assert from 'node:assert/strict'
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { test } from 'node:test'
 import { fileURLToPath } from 'node:url'
@@ -24,6 +24,11 @@ function runHook(payload: Payload): Promise<{ code: number; stderr: string }> {
     const child = spawn(process.execPath, [HOOK], {
       stdio: ['pipe', 'ignore', 'pipe'],
     })
+    // v6 lib-stable spawn returns an enriched Promise that rejects on
+    // non-zero exit; this test reads stderr + exit via manual listeners
+    // instead. Swallow the Promise rejection so it doesn't race the
+    // listener-based resolve and trigger "async activity after test ended".
+    void child.catch(() => undefined)
     let stderr = ''
     child.process.stderr!.on('data', d => {
       stderr += d.toString()
diff --git a/.claude/hooks/public-surface-reminder/index.mts b/.claude/hooks/public-surface-reminder/index.mts
index 208bfbe..0856652 100644
--- a/.claude/hooks/public-surface-reminder/index.mts
+++ b/.claude/hooks/public-surface-reminder/index.mts
@@ -37,10 +37,10 @@ type ToolInput = {
 const PUBLIC_SURFACE_PATTERNS: RegExp[] = [
   /\bgit\s+commit\b/,
   /\bgit\s+push\b/,
-  /\bgh\s+pr\s+(comment|create|edit|review)\b/,
-  /\bgh\s+issue\s+(comment|create|edit)\b/,
-  /\bgh\s+api\b[^|]*-X\s*(PATCH|POST|PUT)\b/i,
-  /\bgh\s+release\s+(create|edit)\b/,
+  /\bgh\s+pr\s+(?:comment|create|edit|review)\b/,
+  /\bgh\s+issue\s+(?:comment|create|edit)\b/,
+  /\bgh\s+api\b[^|]*-X\s*(?:PATCH|POST|PUT)\b/i,
+  /\bgh\s+release\s+(?:create|edit)\b/,
 ]
 
 export function isPublicSurface(command: string): boolean {
diff --git a/.claude/hooks/public-surface-reminder/test/public-surface-reminder.test.mts b/.claude/hooks/public-surface-reminder/test/public-surface-reminder.test.mts
index e947183..4a747c0 100644
--- a/.claude/hooks/public-surface-reminder/test/public-surface-reminder.test.mts
+++ b/.claude/hooks/public-surface-reminder/test/public-surface-reminder.test.mts
@@ -2,7 +2,7 @@ import assert from 'node:assert/strict'
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { test } from 'node:test'
 import { fileURLToPath } from 'node:url'
@@ -24,6 +24,11 @@ function runHook(payload: Payload): Promise<{ code: number; stderr: string }> {
     const child = spawn(process.execPath, [HOOK], {
       stdio: ['pipe', 'ignore', 'pipe'],
     })
+    // v6 lib-stable spawn returns an enriched Promise that rejects on
+    // non-zero exit; this test reads stderr + exit via manual listeners
+    // instead. Swallow the Promise rejection so it doesn't race the
+    // listener-based resolve and trigger "async activity after test ended".
+    void child.catch(() => undefined)
     let stderr = ''
     child.process.stderr!.on('data', d => {
       stderr += d.toString()
diff --git a/.claude/hooks/pull-request-target-guard/test/index.test.mts b/.claude/hooks/pull-request-target-guard/test/index.test.mts
index 424788b..0f65a2f 100644
--- a/.claude/hooks/pull-request-target-guard/test/index.test.mts
+++ b/.claude/hooks/pull-request-target-guard/test/index.test.mts
@@ -5,7 +5,7 @@ import assert from 'node:assert/strict'
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -16,6 +16,11 @@ type Result = { code: number; stderr: string }
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/readme-fleet-shape-guard/README.md b/.claude/hooks/readme-fleet-shape-guard/README.md
new file mode 100644
index 0000000..20f19c6
--- /dev/null
+++ b/.claude/hooks/readme-fleet-shape-guard/README.md
@@ -0,0 +1,36 @@
+# readme-fleet-shape-guard
+
+PreToolUse Edit/Write hook that blocks edits to the **root `README.md`** when the resulting content violates the canonical fleet skeleton.
+
+## Why
+
+Root READMEs across fleet repos drift in three predictable ways: (a) the canonical 5-section structure gets reordered or partially missing, (b) `socket-wheelhouse` (a private repo) leaks into prose or links, (c) commands invoke sibling-repo relative paths (`node ../socket-foo/scripts/...`) that outside readers can't follow. All three are public-facing failure modes.
+
+The fleet has matching surfaces at three layers:
+
+- **Lint-time** — `template/.config/markdownlint-rules/socket-{readme-required-sections, no-private-wheelhouse-leak, no-relative-sibling-script}.mjs`.
+- **Sync-time** — `scripts/sync-scaffolding/checks/readme-skeleton-drift.mts` (report-only; no autofix because README content is contextual).
+- **Edit-time** — this hook. Fires at the earliest surface, before the drift can be committed or pushed.
+
+## How
+
+On `Edit` / `MultiEdit` / `Write` whose `file_path` resolves to the repo-root `README.md`, the hook:
+
+1. Reconstructs the post-edit text (Write → `content`; Edit → splice `old_string` → `new_string` against the on-disk file).
+2. Runs three checks: section list (5 required, in order); `socket-wheelhouse` mention (outside fenced code blocks); sibling-repo relative path patterns.
+3. If any check fires AND the user hasn't typed the bypass phrase, exits 2 with a stderr explaining which rule was hit, the canonical fix, and the bypass instructions.
+
+Nested READMEs (`packages/*/README.md`, `docs/*/README.md`, etc.) are silently ignored — they're scoped docs with their own shape.
+
+## Bypass
+
+User types **`Allow readme-fleet-shape bypass`** verbatim in a recent message (within the last 8 user turns). Case-sensitive; paraphrases don't count.
+
+## Failing open
+
+The hook fails open on its own bugs (exit 0 + stderr log) so a buggy hook can't brick the session. The trade-off: a bug means the check silently doesn't apply for that edit. The sync-time check and the lint-time check still catch the drift later.
+
+## Related
+
+- `.claude/hooks/no-meta-comments-guard/` — structural template; same `_shared/transcript.mts` bypass pattern.
+- `.claude/hooks/plan-location-guard/` — same PreToolUse + bypass shape, blocking on file-path classification.
diff --git a/.claude/hooks/readme-fleet-shape-guard/index.mts b/.claude/hooks/readme-fleet-shape-guard/index.mts
new file mode 100644
index 0000000..dccc7c2
--- /dev/null
+++ b/.claude/hooks/readme-fleet-shape-guard/index.mts
@@ -0,0 +1,334 @@
+#!/usr/bin/env node
+// Claude Code PreToolUse hook — readme-fleet-shape-guard.
+//
+// Blocks Edit/Write of the root README.md when the resulting content
+// violates the canonical fleet skeleton:
+//
+//   (a) Missing or out-of-order canonical section. The 5 level-2
+//       sections must appear in this order:
+//         Why this repo exists / Install / Usage / Development / License
+//
+//   (b) Mentions `socket-wheelhouse` outside fenced code blocks.
+//       socket-wheelhouse is a private repo; the link 404s for outside
+//       readers.
+//
+//   (c) Invokes a command against a sibling-repo relative path.
+//       `node ../socket-foo/scripts/...` and similar shapes assume the
+//       reader has the sibling repo checked out at exactly the right
+//       relative level — almost never true for an outside user.
+//
+// Only fires on the REPO-ROOT README.md (basename === 'README.md' AND
+// directory is repo root). Nested READMEs (packages/, docs/, .claude/,
+// etc.) are scoped docs with their own shape; this hook is silent for
+// them.
+//
+// Bypass phrase: `Allow readme-fleet-shape bypass`. Reading recent user
+// turns follows the same pattern as no-revert-guard, plan-location-guard.
+//
+// Companion to:
+//   - scripts/sync-scaffolding/checks/readme-skeleton-drift.mts
+//     (sync-time check, no autofix)
+//   - template/.config/markdownlint-rules/socket-{readme-required-sections,
+//     no-private-wheelhouse-leak, no-relative-sibling-script}.mjs
+//     (lint-time check)
+//
+// This hook is the edit-time enforcement — it fires when the README is
+// being written, catching the failure mode at its earliest surface.
+//
+// Reads a Claude Code PreToolUse JSON payload from stdin:
+//   { "tool_name": "Edit" | "MultiEdit" | "Write",
+//     "tool_input": { "file_path": "...",
+//                     "content"?: "...",
+//                     "new_string"?: "...",
+//                     "old_string"?: "..." },
+//     "transcript_path": "/.../session.jsonl" }
+//
+// Exits:
+//   0 — allowed.
+//   2 — blocked (with stderr message that explains rule + fix + bypass).
+//   0 (with stderr log) — fail-open on hook bugs.
+
+import { existsSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+
+import { bypassPhrasePresent, readStdin } from '../_shared/transcript.mts'
+
+type ToolInput = {
+  tool_input?:
+    | {
+        content?: string | undefined
+        file_path?: string | undefined
+        new_string?: string | undefined
+        old_string?: string | undefined
+      }
+    | undefined
+  tool_name?: string | undefined
+  transcript_path?: string | undefined
+}
+
+const BYPASS_PHRASE = 'Allow readme-fleet-shape bypass'
+const BYPASS_LOOKBACK_USER_TURNS = 8
+
+const REQUIRED_SECTIONS = [
+  'Why this repo exists',
+  'Install',
+  'Usage',
+  'Development',
+  'License',
+] as const
+
+const WHEELHOUSE_LEAK_RE = /socket-wheelhouse/i
+const SIBLING_PATH_RES: readonly RegExp[] = [
+  /\b(?:bun|deno|node|npm|pnpm|yarn)\s+\.\.\/[\w@-]+\//,
+  // socket-hook: allow regex-alternation-order
+  /(?:^|\s)\.\.\/socket-[\w-]+\//i,
+  // socket-hook: allow regex-alternation-order
+  /(?:^|\s)\.\.\/sdxgen\//,
+  // socket-hook: allow regex-alternation-order
+  /(?:^|\s)\.\.\/stuie\//,
+]
+
+/**
+ * Repo-root README detection. The hook only fires on the root README.md, not
+ * nested READMEs. The check is path-shape only — basename match + parent
+ * directory ≠ another README's parent.
+ */
+export function isRootReadme(filePath: string): boolean {
+  const normalized = filePath.replace(/\\/g, '/')
+  if (path.basename(normalized) !== 'README.md') {
+    return false
+  }
+  const dir = path.dirname(normalized)
+  // Nested-README markers: any path segment that says "this is a
+  // scoped doc, not the repo root."
+  const segments = dir.split('/').filter(Boolean)
+  const SCOPED_PARENTS = new Set([
+    '.claude',
+    'apps',
+    'crates',
+    'docs',
+    'examples',
+    'packages',
+    'pkg-node',
+    'scripts',
+    'template',
+    'test',
+    'tools',
+  ])
+  for (const seg of segments) {
+    if (SCOPED_PARENTS.has(seg)) {
+      return false
+    }
+  }
+  return true
+}
+
+/**
+ * Compute the post-edit text for an Edit (splice old_string → new_string
+ * against the on-disk file) or a Write (just `content`). Returns undefined when
+ * the post-edit text can't be reliably computed (Edit against a file that
+ * doesn't exist, or old_string not found).
+ */
+export function computePostEditText(
+  toolName: string,
+  filePath: string,
+  newString: string | undefined,
+  oldString: string | undefined,
+  content: string | undefined,
+): string | undefined {
+  if (toolName === 'Write') {
+    return content
+  }
+  if (toolName === 'Edit' || toolName === 'MultiEdit') {
+    if (!existsSync(filePath)) {
+      // Edit against a non-existent file is unusual; let it through.
+      return undefined
+    }
+    let onDisk: string
+    try {
+      onDisk = readFileSync(filePath, 'utf8')
+    } catch {
+      return undefined
+    }
+    if (oldString === undefined || newString === undefined) {
+      return undefined
+    }
+    const idx = onDisk.indexOf(oldString)
+    if (idx === -1) {
+      return undefined
+    }
+    return (
+      onDisk.slice(0, idx) + newString + onDisk.slice(idx + oldString.length)
+    )
+  }
+  return undefined
+}
+
+interface ShapeFinding {
+  kind: 'missing-section' | 'wheelhouse-leak' | 'relative-sibling'
+  detail: string
+}
+
+export function findShapeViolations(text: string): ShapeFinding[] {
+  const lines = text.split('\n')
+  const findings: ShapeFinding[] = []
+
+  const headings: string[] = []
+  for (let i = 0, { length } = lines; i < length; i += 1) {
+    const m = /^##\s+(.+?)\s*$/.exec(lines[i] ?? '')
+    if (m && m[1]) {
+      headings.push(m[1])
+    }
+  }
+  let cursor = 0
+  for (let r = 0, { length } = REQUIRED_SECTIONS; r < length; r += 1) {
+    const want = REQUIRED_SECTIONS[r]
+    let found = -1
+    for (let h = cursor; h < headings.length; h += 1) {
+      if (headings[h] === want) {
+        found = h
+        break
+      }
+    }
+    if (found === -1) {
+      findings.push({
+        kind: 'missing-section',
+        detail: `Missing canonical section "## ${want}" (or out of order)`,
+      })
+      break
+    }
+    cursor = found + 1
+  }
+
+  let inFence = false
+  for (let i = 0, { length } = lines; i < length; i += 1) {
+    const line = lines[i] ?? ''
+    if (/^\s*(?:```|~~~)/.test(line)) {
+      inFence = !inFence
+      continue
+    }
+    if (inFence) {
+      continue
+    }
+    if (WHEELHOUSE_LEAK_RE.test(line)) {
+      findings.push({
+        kind: 'wheelhouse-leak',
+        detail: `Line ${i + 1} mentions socket-wheelhouse: ${line.trim().slice(0, 120)}`,
+      })
+      break
+    }
+  }
+
+  for (let i = 0, { length } = lines; i < length; i += 1) {
+    const line = lines[i] ?? ''
+    let matched = false
+    for (let j = 0, jl = SIBLING_PATH_RES.length; j < jl; j += 1) {
+      if (SIBLING_PATH_RES[j]!.test(line)) {
+        matched = true
+        break
+      }
+    }
+    if (matched) {
+      findings.push({
+        kind: 'relative-sibling',
+        detail: `Line ${i + 1} invokes a sibling-relative path: ${line.trim().slice(0, 120)}`,
+      })
+      break
+    }
+  }
+
+  return findings
+}
+
+async function main(): Promise<number> {
+  const raw = await readStdin()
+  if (!raw.trim()) {
+    return 0
+  }
+
+  let payload: ToolInput
+  try {
+    payload = JSON.parse(raw) as ToolInput
+  } catch {
+    process.stderr.write(
+      'readme-fleet-shape-guard: failed to parse stdin payload — fail-open\n',
+    )
+    return 0
+  }
+
+  const tool = payload.tool_name
+  if (tool !== 'Edit' && tool !== 'MultiEdit' && tool !== 'Write') {
+    return 0
+  }
+
+  const filePath = payload.tool_input?.file_path
+  if (!filePath || !isRootReadme(filePath)) {
+    return 0
+  }
+
+  const postEdit = computePostEditText(
+    tool,
+    filePath,
+    payload.tool_input?.new_string,
+    payload.tool_input?.old_string,
+    payload.tool_input?.content,
+  )
+  if (postEdit === undefined) {
+    return 0
+  }
+
+  const findings = findShapeViolations(postEdit)
+  if (findings.length === 0) {
+    return 0
+  }
+
+  if (
+    bypassPhrasePresent(
+      payload.transcript_path,
+      BYPASS_PHRASE,
+      BYPASS_LOOKBACK_USER_TURNS,
+    )
+  ) {
+    return 0
+  }
+
+  const lines: string[] = [
+    `🚨 readme-fleet-shape-guard: blocked Edit/Write of root README.md.`,
+    ``,
+    `File: ${filePath}`,
+    ``,
+    `Violations:`,
+  ]
+  for (let i = 0, { length } = findings; i < length; i += 1) {
+    lines.push(`  - ${findings[i]!.detail}`)
+  }
+  lines.push(``)
+  lines.push(
+    `Per the fleet "Canonical README" rule (CLAUDE.md → Canonical README),`,
+  )
+  lines.push(`root README.md must follow the skeleton at:`)
+  lines.push(`  socket-wheelhouse/template/README.md`)
+  lines.push(``)
+  lines.push(`Required sections in order:`)
+  for (let i = 0, { length } = REQUIRED_SECTIONS; i < length; i += 1) {
+    lines.push(`  ${i + 1}. ## ${REQUIRED_SECTIONS[i]}`)
+  }
+  lines.push(``)
+  lines.push(
+    `One-shot bypass (rare): user types "${BYPASS_PHRASE}" verbatim in a recent message.`,
+  )
+  lines.push(``)
+  process.stderr.write(`${lines.join('\n')}`)
+  return 2
+}
+
+main().then(
+  code => process.exit(code),
+  err => {
+    process.stderr.write(
+      `readme-fleet-shape-guard: hook error — fail-open: ${String(err)}\n`,
+    )
+    process.exit(0)
+  },
+)
diff --git a/.claude/hooks/readme-fleet-shape-guard/package.json b/.claude/hooks/readme-fleet-shape-guard/package.json
new file mode 100644
index 0000000..5aa4206
--- /dev/null
+++ b/.claude/hooks/readme-fleet-shape-guard/package.json
@@ -0,0 +1,18 @@
+{
+  "name": "hook-readme-fleet-shape-guard",
+  "private": true,
+  "type": "module",
+  "main": "./index.mts",
+  "exports": {
+    ".": "./index.mts"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mts"
+  },
+  "dependencies": {
+    "@socketsecurity/lib-stable": "catalog:"
+  },
+  "devDependencies": {
+    "@types/node": "catalog:"
+  }
+}
diff --git a/.claude/hooks/readme-fleet-shape-guard/test/index.test.mts b/.claude/hooks/readme-fleet-shape-guard/test/index.test.mts
new file mode 100644
index 0000000..a524fff
--- /dev/null
+++ b/.claude/hooks/readme-fleet-shape-guard/test/index.test.mts
@@ -0,0 +1,139 @@
+// node --test specs for the readme-fleet-shape-guard hook.
+
+import test from 'node:test'
+import assert from 'node:assert/strict'
+// prefer-async-spawn: streaming-stdio-required — test spawns child
+// subprocess and pipes stdin/stdout/stderr; Node spawn returns the
+// ChildProcess streaming surface the lib promise wrapper does not.
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = path.dirname(fileURLToPath(import.meta.url))
+const HOOK = path.join(here, '..', 'index.mts')
+
+type Result = { code: number; stderr: string }
+
+async function runHook(payload: Record<string, unknown>): Promise<Result> {
+  const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
+  child.stdin!.end(JSON.stringify(payload))
+  let stderr = ''
+  child.process.stderr!.on('data', chunk => {
+    stderr += chunk.toString('utf8')
+  })
+  return new Promise(resolve => {
+    child.process.on('exit', code => {
+      resolve({ code: code ?? 0, stderr })
+    })
+  })
+}
+
+const CANONICAL_README = [
+  '# foo',
+  '',
+  '## Why this repo exists',
+  '',
+  'A thing.',
+  '',
+  '## Install',
+  '',
+  '```sh',
+  'npm install foo',
+  '```',
+  '',
+  '## Usage',
+  '',
+  '```js',
+  'const foo = require("foo")',
+  '```',
+  '',
+  '## Development',
+  '',
+  'pnpm install',
+  '',
+  '## License',
+  '',
+  'MIT',
+  '',
+].join('\n')
+
+test('non-Edit/Write tool calls pass through', async () => {
+  const result = await runHook({
+    tool_input: { command: 'ls' },
+    tool_name: 'Bash',
+  })
+  assert.strictEqual(result.code, 0)
+})
+
+test('nested README is ignored', async () => {
+  const result = await runHook({
+    tool_input: {
+      file_path: '/Users/x/projects/foo/packages/bar/README.md',
+      content: '# bar\n\nNo canonical sections at all.\n',
+    },
+    tool_name: 'Write',
+  })
+  assert.strictEqual(result.code, 0)
+})
+
+test('canonical root README passes', async () => {
+  const result = await runHook({
+    tool_input: {
+      file_path: '/Users/x/projects/foo/README.md',
+      content: CANONICAL_README,
+    },
+    tool_name: 'Write',
+  })
+  assert.strictEqual(result.code, 0)
+})
+
+test('missing canonical section is blocked', async () => {
+  const broken = CANONICAL_README.replace('## Install', '## Setup')
+  const result = await runHook({
+    tool_input: {
+      file_path: '/Users/x/projects/foo/README.md',
+      content: broken,
+    },
+    tool_name: 'Write',
+  })
+  assert.strictEqual(result.code, 2)
+  assert.match(result.stderr, /readme-fleet-shape-guard/)
+  assert.match(result.stderr, /Missing canonical section "## Install"/)
+})
+
+test('socket-wheelhouse mention is blocked', async () => {
+  const leaky = CANONICAL_README.replace(
+    'A thing.',
+    'A thing. See socket-wheelhouse for details.',
+  )
+  const result = await runHook({
+    tool_input: {
+      file_path: '/Users/x/projects/foo/README.md',
+      content: leaky,
+    },
+    tool_name: 'Write',
+  })
+  assert.strictEqual(result.code, 2)
+  assert.match(result.stderr, /socket-wheelhouse/)
+})
+
+test('relative sibling script is blocked', async () => {
+  const sibling = CANONICAL_README.replace(
+    'pnpm install',
+    'node ../socket-bar/scripts/foo.mts',
+  )
+  const result = await runHook({
+    tool_input: {
+      file_path: '/Users/x/projects/foo/README.md',
+      content: sibling,
+    },
+    tool_name: 'Write',
+  })
+  assert.strictEqual(result.code, 2)
+  assert.match(result.stderr, /sibling-relative path/)
+})
diff --git a/.claude/hooks/readme-fleet-shape-guard/tsconfig.json b/.claude/hooks/readme-fleet-shape-guard/tsconfig.json
new file mode 100644
index 0000000..19458cf
--- /dev/null
+++ b/.claude/hooks/readme-fleet-shape-guard/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "declarationMap": false,
+    "erasableSyntaxOnly": true,
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "noEmit": true,
+    "rewriteRelativeImportExtensions": true,
+    "skipLibCheck": true,
+    "sourceMap": false,
+    "strict": true,
+    "target": "esnext",
+    "types": ["node"],
+    "verbatimModuleSyntax": true
+  }
+}
diff --git a/.claude/hooks/release-workflow-guard/test/release-workflow-guard.test.mts b/.claude/hooks/release-workflow-guard/test/release-workflow-guard.test.mts
index f2a319a..291c8cf 100644
--- a/.claude/hooks/release-workflow-guard/test/release-workflow-guard.test.mts
+++ b/.claude/hooks/release-workflow-guard/test/release-workflow-guard.test.mts
@@ -15,8 +15,9 @@ import process, { execPath } from 'node:process'
 import { afterEach, describe, it } from 'node:test'
 import assert from 'node:assert/strict'
 
-import { safeDelete } from '@socketsecurity/lib-stable/fs'
-import { isSpawnError, spawn } from '@socketsecurity/lib-stable/spawn'
+import { safeDelete } from '@socketsecurity/lib-stable/fs/safe'
+import { isSpawnError } from '@socketsecurity/lib-stable/spawn/errors'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 
 const hookScript = new URL('../index.mts', import.meta.url).pathname
 
@@ -704,7 +705,9 @@ describe('release-workflow-guard hook', () => {
       // Create a sibling project named "socket-other" alongside the
       // primary fixture; place a stubs.yml in the sibling. The hook
       // must read the sibling, not the primary.
-      const projectsRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'rwg-roots-'))
+      const projectsRoot = await fs.mkdtemp(
+        path.join(os.tmpdir(), 'rwg-roots-'),
+      )
       const primaryDir = path.join(projectsRoot, 'socket-btm')
       const siblingDir = path.join(projectsRoot, 'socket-other')
       await fs.mkdir(path.join(primaryDir, '.github', 'workflows'), {
diff --git a/.claude/hooks/scan-label-in-commit-guard/README.md b/.claude/hooks/scan-label-in-commit-guard/README.md
new file mode 100644
index 0000000..0af75b6
--- /dev/null
+++ b/.claude/hooks/scan-label-in-commit-guard/README.md
@@ -0,0 +1,53 @@
+# scan-label-in-commit-guard
+
+`PreToolUse(Bash)` blocker that refuses `git commit` invocations
+whose message body contains scan-report-internal labels (`B1`, `M9`,
+`H3`, `L4`).
+
+## Why
+
+`/scanning-quality` and `/scanning-security` assign scratch-pad IDs
+like `B5` ("Blocker #5") or `M9` ("Medium #9") to findings inside a
+review session. The label has meaning **only within the report** —
+a future reader of `git log` doesn't have the report and cannot
+decode "fix B5" or "addresses M9".
+
+The right shape inlines the actual finding text:
+
+```
+✗ fix(http-request): B5 download truncation race
+✓ fix(http-request/download): settle on fileStream finish, not res end
+```
+
+## Detection
+
+Case-sensitive `\b[BMHL]\d+\b` as a standalone word. The hook
+extracts the message body from:
+
+- `git commit -m "<msg>"` (single or repeated `-m`)
+- `git commit --message=<msg>` / `--message <msg>`
+- `git commit -F <file>` / `--file=<file>` / `--file <file>`
+
+`git commit` without `-m`/`-F` opens the editor — those messages are
+reviewed by the operator, so the hook doesn't fire.
+
+Fenced code blocks (` ``` `) are stripped before scanning so
+labels inside log output / quoted fixtures don't trigger the rule.
+
+## What's not flagged
+
+- Lowercase: `b1`, `m9` are not report labels
+- 5+ digit IDs: `B12345` is too long to be a report label
+- `GHSA-B1-xyz`-style identifiers (label is part of a larger token)
+- Anything inside ` ``` ` fences
+
+## Bypass
+
+Type the canonical phrase verbatim in your next user turn:
+
+```
+Allow scan-label-in-commit bypass
+```
+
+Use when the label is genuinely meaningful in the message (e.g. citing
+a real internal advisory ID that happens to match the shape).
diff --git a/.claude/hooks/scan-label-in-commit-guard/index.mts b/.claude/hooks/scan-label-in-commit-guard/index.mts
new file mode 100644
index 0000000..c5740f9
--- /dev/null
+++ b/.claude/hooks/scan-label-in-commit-guard/index.mts
@@ -0,0 +1,233 @@
+#!/usr/bin/env node
+// Claude Code PreToolUse hook — scan-label-in-commit-guard.
+//
+// Blocks `git commit` invocations whose message body contains
+// scan-report-internal labels (B1, B2, …, M3, H5, L7). These are
+// the scratch-pad IDs the `/scanning-quality` and `/scanning-security`
+// skills assign to findings inside a single review session. They have
+// no meaning outside that session — a future reader of `git log` who
+// doesn't have the original report can't decode "fix B5" or
+// "addresses M9".
+//
+// The right shape is to inline the actual finding text:
+//
+//   ✗ fix(http-request): B5 download truncation race
+//   ✓ fix(http-request/download): settle on fileStream finish, not res end
+//
+// Detection — the message is sourced from one of:
+//   - `git commit -m "<msg>"` (single -m or repeated)
+//   - `git commit --message=<msg>`
+//   - `git commit -F <file>` / `git commit --file=<file>` — read file
+//
+// Pattern: case-sensitive `\b[BMHL]\d+\b` as a standalone word.
+//   - B1, M9, H3, L4 → flag
+//   - 'B' alone, 'B12345' (5+ digits = likely a real ID), 'GHSA-…' → don't flag
+//   - Inside fenced code blocks (``` … ```) → don't flag (the operator
+//     is quoting test output / SQL / etc.)
+//
+// Bypass: type "Allow scan-label-in-commit bypass" in a recent user
+// message. Use when the label is genuinely meaningful (e.g. citing a
+// specific advisory ID that happens to match the shape).
+//
+// Exit codes:
+//   0 — pass.
+//   2 — block.
+//
+// Fails open on malformed payloads (exit 0 + stderr log).
+
+import { existsSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+
+import { bypassPhrasePresent } from '../_shared/transcript.mts'
+
+interface ToolInput {
+  readonly tool_input?:
+    | {
+        readonly command?: string | undefined
+      }
+    | undefined
+  readonly tool_name?: string | undefined
+  readonly transcript_path?: string | undefined
+  readonly cwd?: string | undefined
+}
+
+interface Hit {
+  readonly label: string
+  readonly line: number
+  readonly snippet: string
+}
+
+const BYPASS_PHRASE = 'Allow scan-label-in-commit bypass'
+
+// Match standalone scan-report-internal IDs: B/M/H/L (Blocker /
+// Medium / High / Low) followed by 1–4 digits. The lookbehind /
+// lookahead pair excludes `B12345` (5+ digits) and `GHSA-B1-…` /
+// `branch-B12` shapes where a hyphen sits next to the label.
+// Case-sensitive — lowercase `b1` is not a report label.
+const LABEL_RE = /(?<![A-Za-z0-9_-])[BMHL][0-9]{1,4}(?![A-Za-z0-9_-])/g
+
+/**
+ * Strip fenced code blocks from a multi-line message body so we don't flag
+ * labels that appear inside quoted log output. Triple-backtick fences only
+ * (`````); we don't try to handle indented code blocks.
+ */
+export function stripFencedCode(body: string): string {
+  return body.replace(/```[\s\S]*?```/g, '')
+}
+
+/**
+ * Find scan-label matches in a commit message body. Returns one hit per unique
+ * (line, label) pair so the error message can name them all.
+ */
+export function findScanLabels(body: string): Hit[] {
+  const stripped = stripFencedCode(body)
+  const hits: Hit[] = []
+  const lines = stripped.split('\n')
+  const seen = new Set<string>()
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i]!
+    let m: RegExpExecArray | null
+    LABEL_RE.lastIndex = 0
+    while ((m = LABEL_RE.exec(line)) !== null) {
+      const label = m[0]
+      const key = `${i}:${label}`
+      if (seen.has(key)) {
+        continue
+      }
+      seen.add(key)
+      hits.push({
+        label,
+        line: i + 1,
+        snippet: line.length > 80 ? line.slice(0, 77) + '…' : line,
+      })
+    }
+  }
+  return hits
+}
+
+/**
+ * Pull the commit message from a `git commit …` command line. Returns the
+ * message text or `undefined` if the command doesn't carry an inline message
+ * (e.g. uses `-e` to open the editor — those messages are reviewed by the
+ * operator, no need to flag).
+ *
+ * Handles `-m "msg"`, `-m msg`, `--message=msg`, `--message msg`, `-F file`,
+ * `--file=file`. For file-form invocations, reads the file relative to `cwd`.
+ */
+export function extractCommitMessage(
+  command: string,
+  cwd: string,
+): string | undefined {
+  // Skip non-commit commands quickly.
+  if (!/\bgit\s+commit\b/.test(command)) {
+    return undefined
+  }
+  // -m "msg" or --message="msg" / --message=msg
+  const mMatches = [
+    ...command.matchAll(
+      /(?:^|\s)-m\s+(?:"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'|(\S+))/g,
+    ),
+    ...command.matchAll(
+      /--message=(?:"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'|(\S+))/g,
+    ),
+  ]
+  if (mMatches.length > 0) {
+    return mMatches.map(m => m[1] ?? m[2] ?? m[3] ?? '').join('\n\n')
+  }
+  // -F file / --file=file / --file file
+  const fMatch =
+    /(?:^|\s)-F\s+(\S+)/.exec(command) ??
+    /--file=(\S+)/.exec(command) ??
+    /--file\s+(\S+)/.exec(command)
+  if (fMatch) {
+    const filePath = path.isAbsolute(fMatch[1]!)
+      ? fMatch[1]!
+      : path.join(cwd, fMatch[1]!)
+    if (existsSync(filePath)) {
+      try {
+        return readFileSync(filePath, 'utf8')
+      } catch {
+        return undefined
+      }
+    }
+  }
+  return undefined
+}
+
+function handlePayload(payloadRaw: string): number {
+  let payload: ToolInput
+  try {
+    payload = JSON.parse(payloadRaw) as ToolInput
+  } catch {
+    return 0
+  }
+  if (payload.tool_name !== 'Bash') {
+    return 0
+  }
+  const command = payload.tool_input?.command ?? ''
+  if (!command) {
+    return 0
+  }
+  const cwd = payload.cwd ?? process.cwd()
+  const body = extractCommitMessage(command, cwd)
+  if (!body) {
+    return 0
+  }
+  const hits = findScanLabels(body)
+  if (hits.length === 0) {
+    return 0
+  }
+  if (bypassPhrasePresent(payload.transcript_path, BYPASS_PHRASE)) {
+    return 0
+  }
+  const lines: string[] = []
+  lines.push(
+    '[scan-label-in-commit-guard] Blocked: scan-report-internal label in commit message.',
+  )
+  lines.push('')
+  for (let i = 0, { length } = hits; i < length; i += 1) {
+    const h = hits[i]!
+    lines.push(`  Line ${h.line}: ${h.label} — "${h.snippet}"`)
+  }
+  lines.push('')
+  lines.push('  Labels like B1 / M9 / H3 / L4 come from /scanning-quality and')
+  lines.push('  /scanning-security reports. They are scratch-pad IDs that mean')
+  lines.push('  nothing outside the original session — a future reader of')
+  lines.push('  `git log` who does not have the report cannot decode them.')
+  lines.push('')
+  lines.push('  Rewrite the message to inline the actual finding text:')
+  lines.push('    ✗ fix(http-request): B5 download truncation race')
+  lines.push(
+    '    ✓ fix(http-request/download): settle on fileStream finish, not res end',
+  )
+  lines.push('')
+  lines.push('  Bypass (e.g. citing a real advisory ID that happens to match):')
+  lines.push(`    Type "${BYPASS_PHRASE}" in your next message.`)
+  process.stderr.write(lines.join('\n') + '\n')
+  return 2
+}
+
+export { handlePayload }
+
+// CLI entrypoint — only fires when this file is the main module. Tests
+// import `findScanLabels` / `extractCommitMessage` directly without
+// triggering the stdin reader (which would never see an `end` event
+// in test env and hang the process).
+if (process.argv[1] && process.argv[1].endsWith('index.mts')) {
+  let payloadRaw = ''
+  process.stdin.setEncoding('utf8')
+  process.stdin.on('data', chunk => {
+    payloadRaw += chunk
+  })
+  process.stdin.on('end', () => {
+    try {
+      process.exit(handlePayload(payloadRaw))
+    } catch (e) {
+      process.stderr.write(
+        `[scan-label-in-commit-guard] hook error (allowing): ${e}\n`,
+      )
+      process.exit(0)
+    }
+  })
+}
diff --git a/.claude/hooks/scan-label-in-commit-guard/package.json b/.claude/hooks/scan-label-in-commit-guard/package.json
new file mode 100644
index 0000000..bdf2b33
--- /dev/null
+++ b/.claude/hooks/scan-label-in-commit-guard/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "hook-scan-label-in-commit-guard",
+  "private": true,
+  "type": "module",
+  "main": "./index.mts",
+  "exports": {
+    ".": "./index.mts"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mts"
+  },
+  "devDependencies": {
+    "@types/node": "catalog:"
+  }
+}
diff --git a/.claude/hooks/scan-label-in-commit-guard/test/index.test.mts b/.claude/hooks/scan-label-in-commit-guard/test/index.test.mts
new file mode 100644
index 0000000..6a18f5f
--- /dev/null
+++ b/.claude/hooks/scan-label-in-commit-guard/test/index.test.mts
@@ -0,0 +1,159 @@
+/**
+ * @file Unit tests for findScanLabels + extractCommitMessage.
+ */
+
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+import { extractCommitMessage, findScanLabels } from '../index.mts'
+
+// ── findScanLabels ──
+
+test('flags single B-label in prose', () => {
+  const hits = findScanLabels('fix(http): B5 download truncation race')
+  assert.equal(hits.length, 1)
+  assert.equal(hits[0]!.label, 'B5')
+})
+
+test('flags multiple labels across lines', () => {
+  const body = `fix(security): land B1 + M9 fixes
+
+Also addresses H3 (rc file mode).`
+  const hits = findScanLabels(body)
+  assert.equal(hits.length, 3)
+  const labels = hits.map(h => h.label).toSorted()
+  assert.deepEqual(labels, ['B1', 'H3', 'M9'])
+})
+
+test('does not flag lowercase', () => {
+  const hits = findScanLabels('fix b1 bug')
+  assert.equal(hits.length, 0)
+})
+
+test('does not flag 5+ digit IDs', () => {
+  const hits = findScanLabels('Refs B12345 (a real internal ID)')
+  assert.equal(hits.length, 0)
+})
+
+test('does not flag GHSA-style identifiers', () => {
+  const hits = findScanLabels('Bump for GHSA-B1-xyz advisory')
+  assert.equal(hits.length, 0)
+})
+
+test('does not flag inside fenced code block', () => {
+  const body = `chore: pin pnpm
+
+Output for reference:
+\`\`\`
+B1 = expected
+M9 = expected
+\`\`\`
+
+No real labels here.`
+  const hits = findScanLabels(body)
+  assert.equal(hits.length, 0)
+})
+
+test('flags label before fenced block', () => {
+  const body = `fix B5 issue
+
+\`\`\`
+log content
+\`\`\``
+  const hits = findScanLabels(body)
+  assert.equal(hits.length, 1)
+  assert.equal(hits[0]!.label, 'B5')
+})
+
+test('flags label after fenced block', () => {
+  const body = `\`\`\`
+output
+\`\`\`
+
+Closes M3.`
+  const hits = findScanLabels(body)
+  assert.equal(hits.length, 1)
+  assert.equal(hits[0]!.label, 'M3')
+})
+
+test('deduplicates same label same line', () => {
+  // Same label twice on one line dedups to a single hit (the dedup key
+  // is `${line}:${label}` so the operator gets one entry per offending
+  // line, not one per character offset).
+  const hits = findScanLabels('fix B1 and B1 again')
+  assert.equal(hits.length, 1)
+})
+
+// ── extractCommitMessage ──
+
+test('extracts -m "msg"', () => {
+  const msg = extractCommitMessage('git commit -m "fix B5 issue"', '/tmp')
+  assert.equal(msg, 'fix B5 issue')
+})
+
+test("extracts -m 'msg' (single quotes)", () => {
+  const msg = extractCommitMessage("git commit -m 'fix M9 issue'", '/tmp')
+  assert.equal(msg, 'fix M9 issue')
+})
+
+test('extracts --message=msg', () => {
+  const msg = extractCommitMessage(
+    'git commit --message="addresses H3"',
+    '/tmp',
+  )
+  assert.equal(msg, 'addresses H3')
+})
+
+test('returns undefined for non-commit command', () => {
+  assert.equal(extractCommitMessage('git push origin main', '/tmp'), undefined)
+  assert.equal(extractCommitMessage('ls -la', '/tmp'), undefined)
+})
+
+test('returns undefined for `git commit` with no -m/-F (editor mode)', () => {
+  assert.equal(extractCommitMessage('git commit', '/tmp'), undefined)
+  assert.equal(extractCommitMessage('git commit --amend', '/tmp'), undefined)
+})
+
+test('extracts -F file content', () => {
+  const dir = mkdtempSync(path.join(os.tmpdir(), 'commit-msg-test-'))
+  try {
+    const file = path.join(dir, 'msg.txt')
+    writeFileSync(file, 'fix(http): B5 + M9 issues')
+    const msg = extractCommitMessage(`git commit -F ${file}`, dir)
+    assert.equal(msg, 'fix(http): B5 + M9 issues')
+  } finally {
+    rmSync(dir, { force: true, recursive: true })
+  }
+})
+
+test('extracts --file= file content', () => {
+  const dir = mkdtempSync(path.join(os.tmpdir(), 'commit-msg-test-'))
+  try {
+    const file = path.join(dir, 'msg.txt')
+    writeFileSync(file, 'fix L7')
+    const msg = extractCommitMessage(`git commit --file=${file}`, dir)
+    assert.equal(msg, 'fix L7')
+  } finally {
+    rmSync(dir, { force: true, recursive: true })
+  }
+})
+
+test('returns undefined if -F file does not exist', () => {
+  const msg = extractCommitMessage(
+    'git commit -F /nonexistent-path-for-test',
+    '/tmp',
+  )
+  assert.equal(msg, undefined)
+})
+
+test('multiple -m flags concatenate', () => {
+  const msg = extractCommitMessage(
+    'git commit -m "title B1" -m "body M9"',
+    '/tmp',
+  )
+  assert.match(msg!, /B1/)
+  assert.match(msg!, /M9/)
+})
diff --git a/.claude/hooks/scan-label-in-commit-guard/tsconfig.json b/.claude/hooks/scan-label-in-commit-guard/tsconfig.json
new file mode 100644
index 0000000..19458cf
--- /dev/null
+++ b/.claude/hooks/scan-label-in-commit-guard/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "declarationMap": false,
+    "erasableSyntaxOnly": true,
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "noEmit": true,
+    "rewriteRelativeImportExtensions": true,
+    "skipLibCheck": true,
+    "sourceMap": false,
+    "strict": true,
+    "target": "esnext",
+    "types": ["node"],
+    "verbatimModuleSyntax": true
+  }
+}
diff --git a/.claude/hooks/setup-basics-tools/README.md b/.claude/hooks/setup-basics-tools/README.md
new file mode 100644
index 0000000..99cabef
--- /dev/null
+++ b/.claude/hooks/setup-basics-tools/README.md
@@ -0,0 +1,23 @@
+# setup-basics-tools
+
+Operator-invoked installer for the **socket-basics workflow stack**:
+TruffleHog, Trivy, OpenGrep, and uv. Slim leaf of the
+`setup-security-tools` umbrella.
+
+## When to use
+
+```sh
+node .claude/hooks/setup-basics-tools/install.mts
+```
+
+For the full setup (firewall + scanners + socket-basics + misc), use
+`node .claude/hooks/setup-security-tools/install.mts`.
+
+## What gets installed
+
+| Tool       | Source                              | Purpose                                                             |
+| ---------- | ----------------------------------- | ------------------------------------------------------------------- |
+| TruffleHog | `github:trufflesecurity/trufflehog` | Secrets scanner                                                     |
+| Trivy      | `github:aquasecurity/trivy`         | Container / IaC / SBOM vuln scanner                                 |
+| OpenGrep   | `github:opengrep/opengrep`          | SAST (semgrep fork)                                                 |
+| uv         | `github:astral-sh/uv`               | Python package manager (used by socket-basics for Python bootstrap) |
diff --git a/.claude/hooks/setup-basics-tools/install.mts b/.claude/hooks/setup-basics-tools/install.mts
new file mode 100644
index 0000000..83781be
--- /dev/null
+++ b/.claude/hooks/setup-basics-tools/install.mts
@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+/**
+ * @file Install-only entry point for the socket-basics workflow stack:
+ *   TruffleHog (secrets scanner), Trivy (vuln/SBOM scanner), OpenGrep (SAST),
+ *   and uv (Python package manager bootstrap). Slim leaf of the
+ *   `setup-security-tools` umbrella. Run via: node
+ *   .claude/hooks/setup-basics-tools/install.mts For the full setup (firewall +
+ *   scanners + socket-basics + misc), use `node
+ *   .claude/hooks/setup-security-tools/install.mts`.
+ */
+
+import process from 'node:process'
+
+import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
+
+const logger = getDefaultLogger()
+
+async function main(): Promise<void> {
+  logger.log('socket-basics tools — install / verify')
+  logger.log('')
+
+  const { setupTrufflehog, setupTrivy, setupOpengrep, setupUv } =
+    (await import('../setup-security-tools/lib/installers.mts')) as {
+      setupTrufflehog: () => Promise<boolean>
+      setupTrivy: () => Promise<boolean>
+      setupOpengrep: () => Promise<boolean>
+      setupUv: () => Promise<boolean>
+    }
+
+  const [trufflehogOk, trivyOk, opengrepOk, uvOk] = await Promise.all([
+    setupTrufflehog(),
+    setupTrivy(),
+    setupOpengrep(),
+    setupUv(),
+  ])
+  logger.log('')
+
+  logger.log('=== Summary ===')
+  logger.log(`OpenGrep:    ${opengrepOk ? 'ready' : 'FAILED'}`)
+  logger.log(`Trivy:       ${trivyOk ? 'ready' : 'FAILED'}`)
+  logger.log(`TruffleHog:  ${trufflehogOk ? 'ready' : 'FAILED'}`)
+  logger.log(`uv:          ${uvOk ? 'ready' : 'FAILED'}`)
+
+  if (!(trufflehogOk && trivyOk && opengrepOk && uvOk)) {
+    process.exitCode = 1
+  }
+}
+
+main().catch((e: unknown) => {
+  const msg = e instanceof Error ? e.message : String(e)
+  logger.error(`setup-basics-tools install: ${msg}`)
+  process.exitCode = 1
+})
diff --git a/.claude/hooks/setup-basics-tools/package.json b/.claude/hooks/setup-basics-tools/package.json
new file mode 100644
index 0000000..139639b
--- /dev/null
+++ b/.claude/hooks/setup-basics-tools/package.json
@@ -0,0 +1,16 @@
+{
+  "name": "hook-setup-basics-tools",
+  "private": true,
+  "type": "module",
+  "main": "./install.mts",
+  "exports": {
+    ".": "./install.mts"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mts"
+  },
+  "devDependencies": {
+    "@socketsecurity/lib-stable": "catalog:",
+    "@types/node": "catalog:"
+  }
+}
diff --git a/.claude/hooks/setup-basics-tools/tsconfig.json b/.claude/hooks/setup-basics-tools/tsconfig.json
new file mode 100644
index 0000000..19458cf
--- /dev/null
+++ b/.claude/hooks/setup-basics-tools/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "declarationMap": false,
+    "erasableSyntaxOnly": true,
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "noEmit": true,
+    "rewriteRelativeImportExtensions": true,
+    "skipLibCheck": true,
+    "sourceMap": false,
+    "strict": true,
+    "target": "esnext",
+    "types": ["node"],
+    "verbatimModuleSyntax": true
+  }
+}
diff --git a/.claude/hooks/setup-claude-scanners/README.md b/.claude/hooks/setup-claude-scanners/README.md
new file mode 100644
index 0000000..4fe2f4a
--- /dev/null
+++ b/.claude/hooks/setup-claude-scanners/README.md
@@ -0,0 +1,39 @@
+# setup-claude-scanners
+
+Operator-invoked installer for **AgentShield** + **zizmor** — the two
+claude-config / GitHub-Actions scanners. Slim leaf of the
+`setup-security-tools` umbrella.
+
+## When to use
+
+- You want to install or refresh ONLY the scanner surface
+  (AgentShield + zizmor) without re-running the firewall /
+  socket-basics / misc installers.
+- You're onboarding a fresh worktree where the only thing you need
+  scanning right now is claude-config + workflow YAML.
+
+```sh
+node .claude/hooks/setup-claude-scanners/install.mts
+```
+
+For the full setup (firewall + scanners + socket-basics + misc), use
+`node .claude/hooks/setup-security-tools/install.mts`.
+
+## Relationship to setup-security-tools
+
+The umbrella `setup-security-tools/install.mts` does everything this
+leaf does PLUS sfw (firewall) + socket-basics tools (TruffleHog,
+Trivy, OpenGrep, uv) + misc tools (cdxgen, synp, janus).
+
+This leaf is a thin re-entry point that imports `setupAgentShield`
+
+- `setupZizmor` from the umbrella's `lib/installers.mts` and runs
+  ONLY those. No token resolution / keychain / shell-rc plumbing is
+  involved — the two scanners are auth-free.
+
+## What gets installed
+
+| Tool        | Source                                  | Purpose                                                       |
+| ----------- | --------------------------------------- | ------------------------------------------------------------- |
+| AgentShield | `pkg:npm/ecc-agentshield@1.4.0` via dlx | Claude AI config security scanner (prompt injection, secrets) |
+| zizmor      | `github:zizmorcore/zizmor` GH-release   | GitHub Actions security scanner                               |
diff --git a/.claude/hooks/setup-claude-scanners/install.mts b/.claude/hooks/setup-claude-scanners/install.mts
new file mode 100644
index 0000000..ab69240
--- /dev/null
+++ b/.claude/hooks/setup-claude-scanners/install.mts
@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+/**
+ * @file Install-only entry point for AgentShield + zizmor — the two
+ *   claude-config / GitHub-Actions scanners. Slim leaf of the
+ *   `setup-security-tools` umbrella. Run via: node
+ *   .claude/hooks/setup-claude-scanners/install.mts For the full setup
+ *   (firewall + scanners + socket-basics + misc), use `node
+ *   .claude/hooks/setup-security-tools/install.mts`.
+ */
+
+import process from 'node:process'
+
+import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
+
+const logger = getDefaultLogger()
+
+async function main(): Promise<void> {
+  logger.log('Claude scanners — install / verify')
+  logger.log('')
+
+  const { setupAgentShield, setupZizmor } =
+    (await import('../setup-security-tools/lib/installers.mts')) as {
+      setupAgentShield: () => Promise<boolean>
+      setupZizmor: () => Promise<boolean>
+    }
+
+  const agentshieldOk = await setupAgentShield()
+  logger.log('')
+  const zizmorOk = await setupZizmor()
+  logger.log('')
+
+  logger.log('=== Summary ===')
+  logger.log(`AgentShield: ${agentshieldOk ? 'ready' : 'NOT AVAILABLE'}`)
+  logger.log(`Zizmor:      ${zizmorOk ? 'ready' : 'FAILED'}`)
+
+  if (!(agentshieldOk && zizmorOk)) {
+    process.exitCode = 1
+  }
+}
+
+main().catch((e: unknown) => {
+  const msg = e instanceof Error ? e.message : String(e)
+  logger.error(`setup-claude-scanners install: ${msg}`)
+  process.exitCode = 1
+})
diff --git a/.claude/hooks/setup-claude-scanners/package.json b/.claude/hooks/setup-claude-scanners/package.json
new file mode 100644
index 0000000..c8e5359
--- /dev/null
+++ b/.claude/hooks/setup-claude-scanners/package.json
@@ -0,0 +1,16 @@
+{
+  "name": "hook-setup-claude-scanners",
+  "private": true,
+  "type": "module",
+  "main": "./install.mts",
+  "exports": {
+    ".": "./install.mts"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mts"
+  },
+  "devDependencies": {
+    "@socketsecurity/lib-stable": "catalog:",
+    "@types/node": "catalog:"
+  }
+}
diff --git a/.claude/hooks/setup-claude-scanners/tsconfig.json b/.claude/hooks/setup-claude-scanners/tsconfig.json
new file mode 100644
index 0000000..19458cf
--- /dev/null
+++ b/.claude/hooks/setup-claude-scanners/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "declarationMap": false,
+    "erasableSyntaxOnly": true,
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "noEmit": true,
+    "rewriteRelativeImportExtensions": true,
+    "skipLibCheck": true,
+    "sourceMap": false,
+    "strict": true,
+    "target": "esnext",
+    "types": ["node"],
+    "verbatimModuleSyntax": true
+  }
+}
diff --git a/.claude/hooks/setup-firewall/README.md b/.claude/hooks/setup-firewall/README.md
new file mode 100644
index 0000000..2e09edc
--- /dev/null
+++ b/.claude/hooks/setup-firewall/README.md
@@ -0,0 +1,40 @@
+# setup-firewall
+
+Operator-invoked installer for **Socket Firewall** (sfw enterprise +
+free). Slim leaf of the `setup-security-tools` umbrella.
+
+## When to use
+
+- You want to install or refresh ONLY the firewall surface without
+  re-running the AgentShield / zizmor / socket-basics tool
+  installers.
+- You're rotating `SOCKET_API_KEY` and want sfw to re-resolve
+  enterprise vs free without touching everything else.
+
+```sh
+# Install / verify
+node .claude/hooks/setup-firewall/install.mts
+
+# Rotate the API token (re-prompts; overwrites keychain)
+node .claude/hooks/setup-firewall/install.mts --rotate
+```
+
+## Relationship to setup-security-tools
+
+The umbrella `setup-security-tools/install.mts` does everything this
+leaf does PLUS AgentShield + zizmor + socket-basics tools (TruffleHog,
+Trivy, OpenGrep, uv) + a few misc tools (cdxgen, synp, janus).
+
+This leaf is a thin re-entry point that imports from the umbrella's
+`lib/installers.mts` and runs ONLY the firewall installer. The token
+resolution / keychain / shell-rc bridge / --rotate prompt all use the
+umbrella's exported helpers — single source of truth.
+
+## What gets installed
+
+| Surface                                                            | Source                                                              |
+| ------------------------------------------------------------------ | ------------------------------------------------------------------- |
+| sfw binary (enterprise or free, depending on token)                | github:SocketDev/firewall-release (enterprise) / SocketDev/sfw-free |
+| PATH shims for npm / pnpm / yarn / pip / uv / cargo / etc.         | `~/.socket/sfw/shims/`                                              |
+| Shell-rc env block (`~/.zshenv` on macOS)                          | `setup-security-tools/lib/shell-rc-bridge.mts`                      |
+| OS keychain entry (macOS Keychain / libsecret / CredentialManager) | `setup-security-tools/lib/token-storage.mts`                        |
diff --git a/.claude/hooks/setup-firewall/install.mts b/.claude/hooks/setup-firewall/install.mts
new file mode 100644
index 0000000..f1dfe87
--- /dev/null
+++ b/.claude/hooks/setup-firewall/install.mts
@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+/**
+ * @file Install-only entry point for Socket Firewall (sfw enterprise + free).
+ *   Slim leaf of the setup-security-tools umbrella — for operators who want to
+ *   install / refresh ONLY the firewall surface without re-running the
+ *   AgentShield / zizmor / socket-basics tool installers. The actual installer
+ *   code lives in `../setup-security-tools/lib/installers.mts`. This entry
+ *   point exists so operators can scope their setup precisely: node
+ *   .claude/hooks/setup-firewall/install.mts For the full setup, use `node
+ *   .claude/hooks/setup-security-tools/install.mts` which sequences this leaf
+ *   alongside the others. --rotate is honored here too — re-prompts for
+ *   SOCKET_API_KEY and overwrites the OS keychain entry, just like the
+ *   umbrella's --rotate path.
+ */
+
+import process from 'node:process'
+
+import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
+
+import { findApiToken } from '../setup-security-tools/lib/api-token.mts'
+import {
+  offerTokenPrompt,
+  parseArgs,
+  promptAndPersist,
+  wireBridgeIntoShellRc,
+} from '../setup-security-tools/lib/operator-prompts.mts'
+
+const logger = getDefaultLogger()
+
+async function main(): Promise<void> {
+  const args = parseArgs(process.argv.slice(2))
+  logger.log('Socket Firewall — install / verify')
+  logger.log('')
+
+  let apiToken: string | undefined
+  if (args.rotate) {
+    const fresh = await promptAndPersist(logger, 'rotate')
+    if (fresh) {
+      apiToken = fresh
+    } else {
+      const lookup = findApiToken()
+      apiToken = lookup.token
+      if (apiToken && lookup.source) {
+        logger.log(`Keeping existing SOCKET_API_KEY (via ${lookup.source}).`)
+      }
+    }
+  } else {
+    const lookup = findApiToken()
+    apiToken = lookup.token
+    if (apiToken && lookup.source) {
+      logger.log(`SOCKET_API_KEY: found via ${lookup.source}.`)
+    } else {
+      apiToken = await offerTokenPrompt(logger)
+    }
+  }
+
+  if (apiToken) {
+    wireBridgeIntoShellRc(logger, apiToken)
+  }
+
+  const { setupSfw } =
+    (await import('../setup-security-tools/lib/installers.mts')) as {
+      setupSfw: (apiToken: string | undefined) => Promise<boolean>
+    }
+
+  const sfwOk = await setupSfw(apiToken)
+  logger.log('')
+  logger.log('=== Summary ===')
+  logger.log(`SFW: ${sfwOk ? 'ready' : 'FAILED'}`)
+  if (!sfwOk) {
+    process.exitCode = 1
+  }
+}
+
+main().catch((e: unknown) => {
+  const msg = e instanceof Error ? e.message : String(e)
+  logger.error(`setup-firewall install: ${msg}`)
+  process.exitCode = 1
+})
diff --git a/.claude/hooks/setup-firewall/package.json b/.claude/hooks/setup-firewall/package.json
new file mode 100644
index 0000000..cdfc9e3
--- /dev/null
+++ b/.claude/hooks/setup-firewall/package.json
@@ -0,0 +1,16 @@
+{
+  "name": "hook-setup-firewall",
+  "private": true,
+  "type": "module",
+  "main": "./install.mts",
+  "exports": {
+    ".": "./install.mts"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mts"
+  },
+  "devDependencies": {
+    "@socketsecurity/lib-stable": "catalog:",
+    "@types/node": "catalog:"
+  }
+}
diff --git a/.claude/hooks/setup-firewall/tsconfig.json b/.claude/hooks/setup-firewall/tsconfig.json
new file mode 100644
index 0000000..19458cf
--- /dev/null
+++ b/.claude/hooks/setup-firewall/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "declarationMap": false,
+    "erasableSyntaxOnly": true,
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "noEmit": true,
+    "rewriteRelativeImportExtensions": true,
+    "skipLibCheck": true,
+    "sourceMap": false,
+    "strict": true,
+    "target": "esnext",
+    "types": ["node"],
+    "verbatimModuleSyntax": true
+  }
+}
diff --git a/.claude/hooks/setup-misc-tools/README.md b/.claude/hooks/setup-misc-tools/README.md
new file mode 100644
index 0000000..287134b
--- /dev/null
+++ b/.claude/hooks/setup-misc-tools/README.md
@@ -0,0 +1,21 @@
+# setup-misc-tools
+
+Operator-invoked installer for one-off tools: **cdxgen**, **synp**,
+and **janus**. Slim leaf of the `setup-security-tools` umbrella.
+
+## When to use
+
+```sh
+node .claude/hooks/setup-misc-tools/install.mts
+```
+
+For the full setup (firewall + scanners + socket-basics + misc), use
+`node .claude/hooks/setup-security-tools/install.mts`.
+
+## What gets installed
+
+| Tool   | Source                                     | Purpose                                                    |
+| ------ | ------------------------------------------ | ---------------------------------------------------------- |
+| cdxgen | `github:CycloneDX/cdxgen` (slim SEA)       | CycloneDX SBOM generator (used by `socket scan sbom`)      |
+| synp   | `pkg:npm/synp@1.9.14` via dlx              | yarn.lock ↔ package-lock.json converter (cross-PM interop) |
+| janus  | `github:divmain/janus` (darwin-arm64 only) | Tool that some Socket workflows opt into                   |
diff --git a/.claude/hooks/setup-misc-tools/install.mts b/.claude/hooks/setup-misc-tools/install.mts
new file mode 100644
index 0000000..620e00f
--- /dev/null
+++ b/.claude/hooks/setup-misc-tools/install.mts
@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+/**
+ * @file Install-only entry point for one-off tools: cdxgen (SBOM), synp
+ *   (lockfile interop), and janus. Slim leaf of the `setup-security-tools`
+ *   umbrella. Run via: node .claude/hooks/setup-misc-tools/install.mts For the
+ *   full setup (firewall + scanners + socket-basics + misc), use `node
+ *   .claude/hooks/setup-security-tools/install.mts`.
+ */
+
+import process from 'node:process'
+
+import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
+
+const logger = getDefaultLogger()
+
+async function main(): Promise<void> {
+  logger.log('misc tools — install / verify')
+  logger.log('')
+
+  const { setupCdxgen, setupSynp, setupJanus } =
+    (await import('../setup-security-tools/lib/installers.mts')) as {
+      setupCdxgen: () => Promise<boolean>
+      setupSynp: () => Promise<boolean>
+      setupJanus: () => Promise<boolean>
+    }
+
+  const [cdxgenOk, synpOk, janusOk] = await Promise.all([
+    setupCdxgen(),
+    setupSynp(),
+    setupJanus(),
+  ])
+  logger.log('')
+
+  logger.log('=== Summary ===')
+  logger.log(`cdxgen: ${cdxgenOk ? 'ready' : 'FAILED'}`)
+  logger.log(`janus:  ${janusOk ? 'ready' : 'FAILED'}`)
+  logger.log(`synp:   ${synpOk ? 'ready' : 'FAILED'}`)
+
+  if (!(cdxgenOk && synpOk && janusOk)) {
+    process.exitCode = 1
+  }
+}
+
+main().catch((e: unknown) => {
+  const msg = e instanceof Error ? e.message : String(e)
+  logger.error(`setup-misc-tools install: ${msg}`)
+  process.exitCode = 1
+})
diff --git a/.claude/hooks/setup-misc-tools/package.json b/.claude/hooks/setup-misc-tools/package.json
new file mode 100644
index 0000000..6926823
--- /dev/null
+++ b/.claude/hooks/setup-misc-tools/package.json
@@ -0,0 +1,16 @@
+{
+  "name": "hook-setup-misc-tools",
+  "private": true,
+  "type": "module",
+  "main": "./install.mts",
+  "exports": {
+    ".": "./install.mts"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mts"
+  },
+  "devDependencies": {
+    "@socketsecurity/lib-stable": "catalog:",
+    "@types/node": "catalog:"
+  }
+}
diff --git a/.claude/hooks/setup-misc-tools/tsconfig.json b/.claude/hooks/setup-misc-tools/tsconfig.json
new file mode 100644
index 0000000..19458cf
--- /dev/null
+++ b/.claude/hooks/setup-misc-tools/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "declarationMap": false,
+    "erasableSyntaxOnly": true,
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "noEmit": true,
+    "rewriteRelativeImportExtensions": true,
+    "skipLibCheck": true,
+    "sourceMap": false,
+    "strict": true,
+    "target": "esnext",
+    "types": ["node"],
+    "verbatimModuleSyntax": true
+  }
+}
diff --git a/.claude/hooks/setup-security-tools/index.mts b/.claude/hooks/setup-security-tools/index.mts
index ca59de9..32e961a 100644
--- a/.claude/hooks/setup-security-tools/index.mts
+++ b/.claude/hooks/setup-security-tools/index.mts
@@ -38,7 +38,7 @@
 // Fails open on every error (exit 0 + stderr log). The hook must
 // not block the conversation on its own bugs.
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { existsSync, promises as fs } from 'node:fs'
 import path from 'node:path'
 import process from 'node:process'
diff --git a/.claude/hooks/setup-security-tools/install.mts b/.claude/hooks/setup-security-tools/install.mts
index 66e1b2c..3d948d0 100644
--- a/.claude/hooks/setup-security-tools/install.mts
+++ b/.claude/hooks/setup-security-tools/install.mts
@@ -28,19 +28,17 @@
 import { existsSync, promises as fs } from 'node:fs'
 import path from 'node:path'
 import process from 'node:process'
-import readline from 'node:readline'
 import { fileURLToPath } from 'node:url'
 
-import { getCI } from '@socketsecurity/lib-stable/env/ci'
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
 
 import { findApiToken } from './lib/api-token.mts'
-import { installShellRcBridge } from './lib/shell-rc-bridge.mts'
-import type { BridgeWriteResult } from './lib/shell-rc-bridge.mts'
 import {
-  keychainAvailable,
-  writeTokenToKeychain,
-} from './lib/token-storage.mts'
+  offerTokenPrompt,
+  parseArgs,
+  promptAndPersist,
+  wireBridgeIntoShellRc,
+} from './lib/operator-prompts.mts'
 
 const logger = getDefaultLogger()
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
@@ -86,201 +84,6 @@ export async function findBrokenShims(): Promise<string[]> {
   return broken
 }
 
-export async function offerTokenPrompt(): Promise<string | undefined> {
-  return promptAndPersist('missing')
-}
-
-interface CliArgs {
-  rotate: boolean
-}
-
-export function parseArgs(argv: readonly string[]): CliArgs {
-  let rotate = false
-  for (let i = 0, { length } = argv; i < length; i += 1) {
-    const arg = argv[i]!
-    if (arg === '--rotate' || arg === '--update-token') {
-      rotate = true
-    }
-  }
-  return { rotate }
-}
-
-/**
- * Shared prompt-and-persist body used by both the "no token found" and the
- * explicit `--rotate` paths. The `reason` strings differ but the gating + the
- * prompt + the keychain write are identical.
- */
-export async function promptAndPersist(
-  reason: 'missing' | 'rotate',
-): Promise<string | undefined> {
-  if (getCI()) {
-    logger.log(
-      'CI environment detected — skipping the SOCKET_API_KEY prompt. ' +
-        'Falling back to sfw-free.',
-    )
-    return undefined
-  }
-  if (!process.stdin.isTTY) {
-    logger.log(
-      'No TTY — skipping the SOCKET_API_KEY prompt. ' +
-        'Falling back to sfw-free. Set SOCKET_API_KEY in env or run ' +
-        'this script interactively to persist it to the OS keychain.',
-    )
-    return undefined
-  }
-  const kc = keychainAvailable()
-  if (!kc.available) {
-    logger.warn(
-      `OS keychain tool '${kc.toolName}' is not available. ${
-        kc.installHint ?? ''
-      }`,
-    )
-    logger.log('Falling back to sfw-free.')
-    return undefined
-  }
-  logger.log('')
-  if (reason === 'rotate') {
-    logger.log(
-      `Rotating SOCKET_API_KEY — the keychain entry will be overwritten ` +
-        `via ${kc.toolName}.`,
-    )
-  } else {
-    logger.log('Socket API token not found in env, .env, or the OS keychain.')
-    logger.log(
-      'A token unlocks sfw-enterprise (org-aware malware scanning). ' +
-        `It will be stored securely via ${kc.toolName}.`,
-    )
-  }
-  logger.log(
-    'Get a token at https://socket.dev/dashboard or press Enter to skip' +
-      (reason === 'rotate'
-        ? ' (the existing keychain entry stays in place).'
-        : ' and use sfw-free.'),
-  )
-  logger.log('')
-  const answer = await promptSecret('SOCKET_API_KEY (input hidden): ')
-  if (!answer) {
-    if (reason === 'rotate') {
-      logger.log('No token entered. Keychain unchanged.')
-    } else {
-      logger.log('No token entered. Falling back to sfw-free.')
-    }
-    return undefined
-  }
-  try {
-    writeTokenToKeychain(answer)
-    if (reason === 'rotate') {
-      logger.success(`SOCKET_API_KEY rotated and persisted via ${kc.toolName}.`)
-    }
-  } catch (e) {
-    logger.error(
-      `Failed to persist token to keychain: ${(e as Error).message}. ` +
-        'Continuing with the value for this session only — it will not ' +
-        'persist across runs until the keychain tool is available.',
-    )
-  }
-  return answer
-}
-
-/**
- * Read a secret from the TTY without echoing it. Wraps node:readline with
- * custom output muting — typed characters never appear on screen and never end
- * up in shell history.
- *
- * Caller must verify `process.stdin.isTTY` before invoking.
- */
-export async function promptSecret(prompt: string): Promise<string> {
-  // Custom output stream that swallows everything written to stdout
-  // during the prompt — that's how readline echoes typed characters,
-  // and we want them invisible.
-  const muted = new (class extends (await import('node:stream')).Writable {
-    override _write(_chunk: unknown, _enc: unknown, cb: () => void): void {
-      cb()
-    }
-  })()
-  const rl = readline.createInterface({
-    input: process.stdin,
-    output: muted,
-    terminal: true,
-  })
-  // The prompt itself is written directly to stderr so it shows up
-  // even though readline's echo is muted.
-  process.stderr.write(prompt)
-  try {
-    return await new Promise<string>(resolve => {
-      rl.question('', answer => {
-        process.stderr.write('\n')
-        resolve(answer.trim())
-      })
-    })
-  } finally {
-    rl.close()
-  }
-}
-
-/**
- * Print a one-paragraph summary of what the shell-rc bridge did (or didn't do),
- * with a copy-pasteable next step. Splitting this out keeps `promptAndPersist`
- * readable and gives the rotate path the same instruction without duplicating
- * the prose.
- */
-export function reportBridgeOutcome(
-  bridge: BridgeWriteResult | undefined,
-): void {
-  if (!bridge) {
-    // Non-macOS or no rc detectable — fall through to a manual line
-    // the user can paste. We hand the user a literal-export template
-    // (not a keychain-read) because re-reading the keychain on every
-    // shell triggers an auth prompt on macOS.
-    logger.log('')
-    logger.log(
-      'Add this to your shell rc / .zshenv so SOCKET_API_KEY is exported ' +
-        'each session (every Socket tool reads it without a fallback chain):',
-    )
-    logger.log("  export SOCKET_API_KEY='<your-token>'")
-    return
-  }
-  if (bridge.outcome === 'unchanged') {
-    logger.log(
-      `Shell-rc env block already canonical at ${bridge.rcPath} — no change.`,
-    )
-  } else if (bridge.outcome === 'updated') {
-    logger.success(
-      `Updated the shell-rc env block at ${bridge.rcPath}. ` +
-        'Run `source ' +
-        bridge.rcPath +
-        '` (or open a new shell) so SOCKET_API_KEY gets exported.',
-    )
-  } else {
-    logger.success(
-      `Wrote the shell-rc env block to ${bridge.rcPath}. ` +
-        'Run `source ' +
-        bridge.rcPath +
-        '` (or open a new shell) so SOCKET_API_KEY gets exported.',
-    )
-  }
-}
-
-/**
- * Write (or refresh) the keychain → shell-env bridge block in the user's shell
- * rc. Idempotent: re-running install.mts on an already- wired rc is a no-op.
- * Called from main() on every invocation so the bridge gets installed whether
- * or not the user just entered a fresh token via the prompt — keychain hits
- * from env/.env/keychain still need the bridge to actually reach the shell of
- * every NEW session.
- */
-export function wireBridgeIntoShellRc(token: string): void {
-  try {
-    const bridge = installShellRcBridge(token)
-    reportBridgeOutcome(bridge)
-  } catch (e) {
-    logger.warn(
-      `Failed to write the shell-rc env block: ${(e as Error).message}. ` +
-        'You will need to export SOCKET_API_KEY manually for Socket tools to pick it up.',
-    )
-  }
-}
-
 async function main(): Promise<void> {
   const args = parseArgs(process.argv.slice(2))
   logger.log('Socket security tools — install / verify')
@@ -294,7 +97,7 @@ async function main(): Promise<void> {
     // existing keychain value stays in place — we fall through to the
     // normal lookup below so downstream installers still get the
     // pre-rotation token.
-    const fresh = await promptAndPersist('rotate')
+    const fresh = await promptAndPersist(logger, 'rotate')
     if (fresh) {
       apiToken = fresh
     } else {
@@ -311,7 +114,7 @@ async function main(): Promise<void> {
     if (apiToken && lookup.source) {
       logger.log(`SOCKET_API_KEY: found via ${lookup.source}.`)
     } else {
-      apiToken = await offerTokenPrompt()
+      apiToken = await offerTokenPrompt(logger)
     }
   }
 
@@ -326,7 +129,7 @@ async function main(): Promise<void> {
   // 2026-05-15 incident memory). Idempotent: same-value re-run is
   // outcome=unchanged. Rotate writes a fresh block.
   if (apiToken) {
-    wireBridgeIntoShellRc(apiToken)
+    wireBridgeIntoShellRc(logger, apiToken)
   }
 
   // Broken-shim detection. When the dlx cache rotates (cleanup, manifest
diff --git a/.claude/hooks/setup-security-tools/lib/api-token.mts b/.claude/hooks/setup-security-tools/lib/api-token.mts
index 752ae47..a8caff9 100644
--- a/.claude/hooks/setup-security-tools/lib/api-token.mts
+++ b/.claude/hooks/setup-security-tools/lib/api-token.mts
@@ -1,43 +1,34 @@
 /**
  * @file Single source of truth for "what's the Socket API token?" Resolution
- *   order (first hit wins):
- *
- *   1. `SOCKET_API_KEY` env var (primary — universally supported across Socket
- *      tools; what setup-security-tools' install.mts writes to both the OS
- *      keychain and the shell-rc bridge).
- *   2. `SOCKET_API_TOKEN` env var (forward-canonical name targeted by fleet docs /
- *      workflow inputs / .env.example; accepted so consumers that set the
- *      forward-canonical name explicitly still resolve a value).
- *   3. OS keychain (macOS Keychain / Linux libsecret / Windows CredentialManager).
- *      Returns `undefined` when no token is found. Never throws — callers
- *      decide how to react (use free SFW, skip auth-gated install, prompt).
- *      **No `.env` / `.env.local` reads.** Dotfiles leak — they get
- *      accidentally committed, read by every dev tool that walks the project
- *      dir, swept into log scrapers. Tokens belong in env (for CI) or in the OS
- *      keychain (for dev local). The canonical resolution chain stays explicit:
- *      env → keychain → prompt. **Module-scope cache.** Each successful
- *      resolution is memoized for the lifetime of the process. Reason: every
- *      `security find-generic- password` call on macOS triggers a fresh
- *      Keychain ACL check, which surfaces the "this app wants to access your
- *      keychain" dialog. A pre-commit hook + commit-msg hook + post-commit
- *      invocation can fire three keychain reads in 200ms — each one its own
- *      prompt. The cache collapses N reads per process to 1. Also propagates
- *      the resolved token into `process.env.SOCKET_API_KEY` so child processes
- *      (spawned by the same hook chain) inherit it instead of re-querying.
+ *   order (first hit wins): env → keychain. External fleet docs / workflow
+ *   inputs / .env.example use SOCKET_API_TOKEN (the promoted name); internally
+ *   we read both SOCKET_API_TOKEN and SOCKET_API_KEY because every Socket tool
+ *   supports SOCKET_API_KEY (CLI, SDK, sfw, fleet scripts). Returns `undefined`
+ *   when no token is found. Never throws — callers decide how to react (use
+ *   free SFW, skip auth-gated install, prompt). **No `.env` / `.env.local`
+ *   reads.** Dotfiles leak — they get accidentally committed, read by every dev
+ *   tool that walks the project dir, swept into log scrapers. Tokens belong in
+ *   env (for CI) or in the OS keychain (for dev local). **Module- scope
+ *   cache.** Each successful resolution is memoized for the lifetime of the
+ *   process. Reason: every `security find-generic-password` call on macOS
+ *   triggers a fresh Keychain ACL check, which surfaces the "this app wants to
+ *   access your keychain" dialog. A pre-commit hook + commit-msg hook +
+ *   post-commit invocation can fire three keychain reads in 200ms — each one
+ *   its own prompt. The cache collapses N reads per process to 1. Also
+ *   propagates the resolved token into both env names so child processes
+ *   inherit it regardless of which name they read.
  */
 
 import { readTokenFromKeychain } from './token-storage.mts'
 
-const PRIMARY = 'SOCKET_API_TOKEN'
-const FORWARD_CANONICAL = 'SOCKET_API_TOKEN'
+// Both names are checked at read time — first env hit wins. Storage layer
+// (token-storage.mts) writes ONLY SOCKET_API_KEY to keep macOS Keychain
+// rotation to a single auth prompt.
+const ENV_NAMES = ['SOCKET_API_TOKEN', 'SOCKET_API_KEY'] as const
 
 export interface TokenLookup {
   readonly token: string | undefined
-  readonly source:
-    | 'env-primary'
-    | 'env-forward-canonical'
-    | 'keychain'
-    | undefined
+  readonly source: 'env' | 'keychain' | undefined
 }
 
 // Module-scope cache: the result of the FIRST findApiToken() call is
@@ -52,7 +43,7 @@ let cached: TokenLookup | null | undefined
  * call this. Used by `--rotate` flows that need to re-prompt after wiping the
  * keychain entry.
  */
-export function _resetApiTokenCacheForTesting(): void {
+export function resetApiTokenCacheForTesting(): void {
   cached = undefined
 }
 
@@ -61,21 +52,16 @@ export function findApiToken(): TokenLookup {
     return cached === null ? { token: undefined, source: undefined } : cached
   }
 
-  // 1. Env — primary slot first, then forward-canonical fallback.
-  const envPrimary = process.env[PRIMARY]
-  if (envPrimary) {
-    propagateToEnv(envPrimary)
-    cached = { token: envPrimary, source: 'env-primary' }
-    return cached
-  }
-  const envForwardCanonical = process.env[FORWARD_CANONICAL]
-  if (envForwardCanonical) {
-    propagateToEnv(envForwardCanonical)
-    cached = { token: envForwardCanonical, source: 'env-forward-canonical' }
-    return cached
+  for (let i = 0, { length } = ENV_NAMES; i < length; i += 1) {
+    const name = ENV_NAMES[i]!
+    const value = process.env[name]
+    if (value) {
+      propagateToEnv(value)
+      cached = { token: value, source: 'env' }
+      return cached
+    }
   }
 
-  // 2. OS keychain.
   const fromKeychain = readTokenFromKeychain()
   if (fromKeychain) {
     propagateToEnv(fromKeychain)
@@ -88,21 +74,16 @@ export function findApiToken(): TokenLookup {
 }
 
 /**
- * Populate BOTH `SOCKET_API_KEY` (primary) and `SOCKET_API_TOKEN`
- * (forward-canonical) in `process.env` so any spawned child resolves a value
- * under whichever name it reads. The keychain-side mirror was removed at the
- * storage layer (one stored slot = one macOS Keychain auth prompt), but env
- * propagation here is free in-process and helps consumers that haven't migrated
- * to SOCKET_API_KEY yet.
- *
- * Idempotent — already-set values are left alone (so the user's explicit env
- * value isn't clobbered by a keychain read).
+ * Populate both SOCKET_API_TOKEN and SOCKET_API_KEY in `process.env` so any
+ * spawned child resolves a value under whichever name it reads. Idempotent —
+ * already-set values are left alone (so the user's explicit env value isn't
+ * clobbered by a keychain read).
  */
 export function propagateToEnv(token: string): void {
-  if (!process.env[PRIMARY]) {
-    process.env[PRIMARY] = token
-  }
-  if (!process.env[FORWARD_CANONICAL]) {
-    process.env[FORWARD_CANONICAL] = token
+  for (let i = 0, { length } = ENV_NAMES; i < length; i += 1) {
+    const name = ENV_NAMES[i]!
+    if (!process.env[name]) {
+      process.env[name] = token
+    }
   }
 }
diff --git a/.claude/hooks/setup-security-tools/lib/installers.mts b/.claude/hooks/setup-security-tools/lib/installers.mts
index dedd5e5..7626b5d 100644
--- a/.claude/hooks/setup-security-tools/lib/installers.mts
+++ b/.claude/hooks/setup-security-tools/lib/installers.mts
@@ -13,6 +13,8 @@
 //    in env / .env / .env.local.
 
 import { existsSync, promises as fs, readFileSync } from 'node:fs'
+
+import { findApiToken as findApiTokenCanonical } from './api-token.mts'
 import os from 'node:os'
 import path from 'node:path'
 import process from 'node:process'
@@ -21,15 +23,15 @@ import { fileURLToPath } from 'node:url'
 import { PackageURL } from '@socketregistry/packageurl-js-stable'
 import { Type } from '@sinclair/typebox'
 
-import { whichSync } from '@socketsecurity/lib-stable/bin'
+import { whichSync } from '@socketsecurity/lib-stable/bin/which'
 import { downloadBinary } from '@socketsecurity/lib-stable/dlx/binary'
 import { downloadPackage } from '@socketsecurity/lib-stable/dlx/package'
 import { errorMessage } from '@socketsecurity/lib-stable/errors'
-import { safeDelete } from '@socketsecurity/lib-stable/fs'
+import { safeDelete } from '@socketsecurity/lib-stable/fs/safe'
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
 import { normalizePath } from '@socketsecurity/lib-stable/paths/normalize'
 import { getSocketHomePath } from '@socketsecurity/lib-stable/paths/socket'
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { parseSchema } from '@socketsecurity/lib-stable/schema/parse'
 
 const logger = getDefaultLogger()
@@ -90,55 +92,27 @@ const JANUS = config.tools['janus']!
 export async function checkZizmorVersion(binPath: string): Promise<boolean> {
   try {
     const result = await spawn(binPath, ['--version'], { stdio: 'pipe' })
-    const output =
-      typeof result.stdout === 'string'
-        ? result.stdout.trim()
-        : result.stdout.toString().trim()
+    const output = String(result.stdout).trim()
     return ZIZMOR.version ? output.includes(ZIZMOR.version) : false
   } catch {
     return false
   }
 }
 
+/**
+ * Resolve the Socket API token from env → keychain. Re-exported from
+ * `lib/api-token.mts` so call sites can keep importing `findApiToken` from
+ * `installers.mts` (back-compat) while the canonical resolver stays a single
+ * source of truth.
+ *
+ * The previous in-file implementation read `.env` / `.env.local` which is a
+ * CLAUDE.md token-hygiene violation (dotfiles leak; tokens belong in env or the
+ * OS keychain). It also skipped the keychain entirely, which caused
+ * sfw-enterprise → sfw-free silent downgrades when the token was only in the
+ * macOS Keychain.
+ */
 export function findApiToken(): string | undefined {
-  // SOCKET_API_TOKEN is the canonical fleet name; SOCKET_API_KEY remains
-  // universally supported across Socket tools (CLI, SDK, sfw, fleet scripts)
-  // as the legacy alias.
-  const envToken =
-    process.env['SOCKET_API_TOKEN'] ?? process.env['SOCKET_API_KEY']
-  if (envToken) {
-    return envToken
-  }
-  const projectDir = process.env['CLAUDE_PROJECT_DIR'] ?? process.cwd()
-  for (const filename of ['.env.local', '.env']) {
-    const filepath = path.join(projectDir, filename)
-    if (existsSync(filepath)) {
-      try {
-        const content = readFileSync(filepath, 'utf8')
-        const match =
-          /^SOCKET_API_KEY\s*=\s*(.+)$/m.exec(content) ??
-          /^SOCKET_API_TOKEN\s*=\s*(.+)$/m.exec(content)
-        if (match) {
-          return match[1]!
-            .replace(/\s*#.*$/, '') // Strip inline comments.
-            .trim() // Strip whitespace before quote removal.
-            .replace(/^["']|["']$/g, '') // Strip surrounding quotes.
-        }
-      } catch (e) {
-        // We already checked existsSync; ENOENT here means a race with
-        // an external delete (rare, ignorable). Anything else (EACCES,
-        // EISDIR, decode failure) is a real signal — log it so the
-        // operator can fix the perms / encoding instead of wondering
-        // why their .env-stored token isn't being picked up.
-        const code = (e as NodeJS.ErrnoException).code
-        if (code !== 'ENOENT') {
-          const msg = e instanceof Error ? e.message : String(e)
-          logger.warn(`could not read ${filepath}: ${msg}`)
-        }
-      }
-    }
-  }
-  return undefined
+  return findApiTokenCanonical().token
 }
 
 type ToolEntry = (typeof config.tools)[string]
@@ -253,7 +227,9 @@ export async function installGitHubReleaseTool(
     return true
   }
 
-  const extractDir = await fs.mkdtemp(path.join(os.tmpdir(), `${name}-extract-`))
+  const extractDir = await fs.mkdtemp(
+    path.join(os.tmpdir(), `${name}-extract-`),
+  )
   try {
     if (isZip) {
       if (process.platform === 'win32') {
@@ -350,7 +326,9 @@ export async function installGitHubReleaseToolWithTag(
   }
 
   const isZip = asset.endsWith('.zip')
-  const extractDir = await fs.mkdtemp(path.join(os.tmpdir(), `${name}-extract-`))
+  const extractDir = await fs.mkdtemp(
+    path.join(os.tmpdir(), `${name}-extract-`),
+  )
   try {
     if (isZip) {
       if (process.platform === 'win32') {
@@ -636,26 +614,20 @@ export async function setupSfw(apiToken: string | undefined): Promise<boolean> {
     ]
     if (isEnterprise) {
       // Read API token from env at runtime — never embed secrets in
-      // scripts. SOCKET_API_KEY is the primary slot (universally
-      // supported); SOCKET_API_TOKEN is the forward-canonical name
-      // accepted as a secondary read. Whichever name is set gets
-      // exported under both so downstream tools see the value
-      // regardless of which name they read.
+      // scripts. Either SOCKET_API_KEY or SOCKET_API_TOKEN is accepted;
+      // whichever is set gets exported under both so downstream tools
+      // see the value regardless of which name they read.
+      //
+      // Dotfile fallback (`.env` / `.env.local`) is intentionally NOT
+      // checked here per CLAUDE.md token-hygiene: tokens belong in env
+      // (CI) or the OS keychain (dev local), never in dotfiles. The
+      // shell-rc bridge installed by setup-security-tools writes the
+      // export line into ~/.zshenv so every new shell already has the
+      // env var set.
       bashLines.push(
         'if [ -z "$SOCKET_API_KEY" ] && [ -n "$SOCKET_API_TOKEN" ]; then',
         '  SOCKET_API_KEY="$SOCKET_API_TOKEN"',
         'fi',
-        'if [ -z "$SOCKET_API_KEY" ]; then',
-        '  for f in .env.local .env; do',
-        '    if [ -f "$f" ]; then',
-        '      _val="$(grep -m1 "^SOCKET_API_KEY\\s*=" "$f" | sed "s/^[^=]*=\\s*//" | sed "s/\\s*#.*//" | sed "s/^["\\x27]\\(.*\\)["\\x27]$/\\1/")"',
-        '      if [ -z "$_val" ]; then',
-        '        _val="$(grep -m1 "^SOCKET_API_TOKEN\\s*=" "$f" | sed "s/^[^=]*=\\s*//" | sed "s/\\s*#.*//" | sed "s/^["\\x27]\\(.*\\)["\\x27]$/\\1/")"',
-        '      fi',
-        '      if [ -n "$_val" ]; then SOCKET_API_KEY="$_val"; break; fi',
-        '    fi',
-        '  done',
-        'fi',
         'if [ -n "$SOCKET_API_KEY" ]; then',
         '  export SOCKET_API_KEY',
         '  SOCKET_API_TOKEN="$SOCKET_API_KEY"',
@@ -678,26 +650,16 @@ export async function setupSfw(apiToken: string | undefined): Promise<boolean> {
     if (isWindows) {
       let cmdApiTokenBlock = ''
       if (isEnterprise) {
-        // Read API token from .env files at runtime — mirrors the bash
-        // shim logic. SOCKET_API_KEY is the primary slot (universally
-        // supported); SOCKET_API_TOKEN is the forward-canonical name
-        // accepted as a secondary read.
+        // Mirror the bash-shim env-only resolution. Dotfile fallback
+        // (`.env` / `.env.local`) is intentionally not read here — see
+        // the bash-shim comment for the token-hygiene rationale. The
+        // Windows CredentialManager shell-rc bridge installed by
+        // setup-security-tools writes the env var for every new
+        // session.
         cmdApiTokenBlock =
           `if not defined SOCKET_API_KEY (\r\n` +
           `  if defined SOCKET_API_TOKEN set "SOCKET_API_KEY=%SOCKET_API_TOKEN%"\r\n` +
           `)\r\n` +
-          `if not defined SOCKET_API_KEY (\r\n` +
-          `  for %%F in (.env.local .env) do (\r\n` +
-          `    if exist "%%F" (\r\n` +
-          `      for /f "tokens=1,* delims==" %%A in ('findstr /b "SOCKET_API_KEY" "%%F"') do (\r\n` +
-          `        set "SOCKET_API_KEY=%%B"\r\n` +
-          `      )\r\n` +
-          `      for /f "tokens=1,* delims==" %%A in ('findstr /b "SOCKET_API_TOKEN" "%%F"') do (\r\n` +
-          `        if not defined SOCKET_API_KEY set "SOCKET_API_KEY=%%B"\r\n` +
-          `      )\r\n` +
-          `    )\r\n` +
-          `  )\r\n` +
-          `)\r\n` +
           `if defined SOCKET_API_KEY set "SOCKET_API_TOKEN=%SOCKET_API_KEY%"\r\n`
       }
       const cmdContent =
diff --git a/.claude/hooks/setup-security-tools/lib/operator-prompts.mts b/.claude/hooks/setup-security-tools/lib/operator-prompts.mts
new file mode 100644
index 0000000..24bd928
--- /dev/null
+++ b/.claude/hooks/setup-security-tools/lib/operator-prompts.mts
@@ -0,0 +1,220 @@
+/**
+ * @file Operator-prompt helpers shared between the setup-security-tools
+ *   umbrella's install.mts and the scoped leaves (setup-firewall, etc.). Each
+ *   helper here is library-shaped: no top-level side effects, no process.exit,
+ *   no implicit logger ownership. Callers pass their own logger so each
+ *   entrypoint can label its prompts/outputs differently. What's intentionally
+ *   NOT here:
+ *
+ *   - `findBrokenShims()` — only used by the umbrella to print a pre-install
+ *     warning. Stays in install.mts.
+ *   - `main()` — orchestration, not a helper.
+ */
+
+import process from 'node:process'
+import readline from 'node:readline'
+
+import { getCI } from '@socketsecurity/lib-stable/env/ci'
+import type { Logger } from '@socketsecurity/lib-stable/logger'
+
+import { installShellRcBridge } from './shell-rc-bridge.mts'
+import type { BridgeWriteResult } from './shell-rc-bridge.mts'
+import { keychainAvailable, writeTokenToKeychain } from './token-storage.mts'
+
+export interface CliArgs {
+  readonly rotate: boolean
+}
+
+export function parseArgs(argv: readonly string[]): CliArgs {
+  let rotate = false
+  for (let i = 0, { length } = argv; i < length; i += 1) {
+    const arg = argv[i]!
+    if (arg === '--rotate' || arg === '--update-token') {
+      rotate = true
+    }
+  }
+  return { rotate }
+}
+
+/**
+ * Read a secret from the TTY without echoing it. Wraps node:readline with
+ * custom output muting — typed characters never appear on screen and never end
+ * up in shell history.
+ *
+ * Caller must verify `process.stdin.isTTY` before invoking.
+ */
+export async function promptSecret(prompt: string): Promise<string> {
+  // Custom output stream that swallows everything written to stdout
+  // during the prompt — that's how readline echoes typed characters,
+  // and we want them invisible.
+  const muted = new (class extends (await import('node:stream')).Writable {
+    override _write(_chunk: unknown, _enc: unknown, cb: () => void): void {
+      cb()
+    }
+  })()
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: muted,
+    terminal: true,
+  })
+  // The prompt itself is written directly to stderr so it shows up
+  // even though readline's echo is muted.
+  process.stderr.write(prompt)
+  try {
+    return await new Promise<string>(resolve => {
+      rl.question('', answer => {
+        process.stderr.write('\n')
+        resolve(answer.trim())
+      })
+    })
+  } finally {
+    rl.close()
+  }
+}
+
+/**
+ * Shared prompt-and-persist body used by both the "no token found" and the
+ * explicit `--rotate` paths. The `reason` strings differ but the gating + the
+ * prompt + the keychain write are identical.
+ */
+export async function promptAndPersist(
+  logger: Logger,
+  reason: 'missing' | 'rotate',
+): Promise<string | undefined> {
+  if (getCI()) {
+    logger.log(
+      'CI environment detected — skipping the SOCKET_API_KEY prompt. ' +
+        'Falling back to sfw-free.',
+    )
+    return undefined
+  }
+  if (!process.stdin.isTTY) {
+    logger.log(
+      'No TTY — skipping the SOCKET_API_KEY prompt. ' +
+        'Falling back to sfw-free. Set SOCKET_API_KEY in env or run ' +
+        'this script interactively to persist it to the OS keychain.',
+    )
+    return undefined
+  }
+  const kc = keychainAvailable()
+  if (!kc.available) {
+    logger.warn(
+      `OS keychain tool '${kc.toolName}' is not available. ${
+        kc.installHint ?? ''
+      }`,
+    )
+    logger.log('Falling back to sfw-free.')
+    return undefined
+  }
+  logger.log('')
+  if (reason === 'rotate') {
+    logger.log(
+      `Rotating SOCKET_API_KEY — the keychain entry will be overwritten ` +
+        `via ${kc.toolName}.`,
+    )
+  } else {
+    logger.log('Socket API token not found in env, .env, or the OS keychain.')
+    logger.log(
+      'A token unlocks sfw-enterprise (org-aware malware scanning). ' +
+        `It will be stored securely via ${kc.toolName}.`,
+    )
+  }
+  logger.log(
+    'Get a token at https://socket.dev/dashboard or press Enter to skip' +
+      (reason === 'rotate'
+        ? ' (the existing keychain entry stays in place).'
+        : ' and use sfw-free.'),
+  )
+  logger.log('')
+  const answer = await promptSecret('SOCKET_API_KEY (input hidden): ')
+  if (!answer) {
+    if (reason === 'rotate') {
+      logger.log('No token entered. Keychain unchanged.')
+    } else {
+      logger.log('No token entered. Falling back to sfw-free.')
+    }
+    return undefined
+  }
+  try {
+    writeTokenToKeychain(answer)
+    if (reason === 'rotate') {
+      logger.success(`SOCKET_API_KEY rotated and persisted via ${kc.toolName}.`)
+    }
+  } catch (e) {
+    logger.error(
+      `Failed to persist token to keychain: ${(e as Error).message}. ` +
+        'Continuing with the value for this session only — it will not ' +
+        'persist across runs until the keychain tool is available.',
+    )
+  }
+  return answer
+}
+
+/**
+ * Thin alias for the "no token found" prompt path. Same shape as
+ * `promptAndPersist(logger, 'missing')` but reads better at call sites that are
+ * only ever in the missing-token branch.
+ */
+export async function offerTokenPrompt(
+  logger: Logger,
+): Promise<string | undefined> {
+  return promptAndPersist(logger, 'missing')
+}
+
+/**
+ * Print a one-paragraph summary of what the shell-rc bridge did (or didn't do),
+ * with a copy-pasteable next step.
+ */
+export function reportBridgeOutcome(
+  logger: Logger,
+  bridge: BridgeWriteResult | undefined,
+): void {
+  if (!bridge) {
+    // Non-macOS or no rc detectable — fall through to a manual line
+    // the user can paste. We hand the user a literal-export template
+    // (not a keychain-read) because re-reading the keychain on every
+    // shell triggers an auth prompt on macOS.
+    logger.log('')
+    logger.log(
+      'Add this to your shell rc / .zshenv so SOCKET_API_KEY is exported ' +
+        'each session (every Socket tool reads it without a fallback chain):',
+    )
+    logger.log("  export SOCKET_API_KEY='<your-token>'")
+    return
+  }
+  if (bridge.outcome === 'unchanged') {
+    logger.log(
+      `Shell-rc env block already canonical at ${bridge.rcPath} — no change.`,
+    )
+  } else if (bridge.outcome === 'updated') {
+    logger.success(
+      `Updated the shell-rc env block at ${bridge.rcPath}. ` +
+        'Run `source ' +
+        bridge.rcPath +
+        '` (or open a new shell) so SOCKET_API_KEY gets exported.',
+    )
+  } else {
+    logger.success(
+      `Wrote the shell-rc env block to ${bridge.rcPath}. ` +
+        'Run `source ' +
+        bridge.rcPath +
+        '` (or open a new shell) so SOCKET_API_KEY gets exported.',
+    )
+  }
+}
+
+/**
+ * Write (or refresh) the keychain → shell-env bridge block in the user's shell
+ * rc. Idempotent: re-running on an already-wired rc is a no-op.
+ */
+export function wireBridgeIntoShellRc(logger: Logger, token: string): void {
+  try {
+    const bridge = installShellRcBridge(token)
+    reportBridgeOutcome(logger, bridge)
+  } catch (e) {
+    logger.warn(
+      `Failed to write the shell-rc env block: ${(e as Error).message}. ` +
+        'You will need to export SOCKET_API_KEY manually for Socket tools to pick it up.',
+    )
+  }
+}
diff --git a/.claude/hooks/setup-security-tools/lib/token-storage.mts b/.claude/hooks/setup-security-tools/lib/token-storage.mts
index a96f9d6..1e18d99 100644
--- a/.claude/hooks/setup-security-tools/lib/token-storage.mts
+++ b/.claude/hooks/setup-security-tools/lib/token-storage.mts
@@ -17,7 +17,7 @@
  *   persistence failed.
  */
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import {
   existsSync,
   mkdirSync,
@@ -175,7 +175,7 @@ export function readLinux(account: string): string | undefined {
   const r = spawnSync(
     'secret-tool',
     ['lookup', 'service', SERVICE, 'user', account],
-    {stdio: ['ignore', 'pipe', 'pipe'] },
+    { stdio: ['ignore', 'pipe', 'pipe'] },
   )
   if (r.status !== 0) {
     // secret-tool exits 1 when the entry doesn't exist AND when the
@@ -193,7 +193,7 @@ export function readMacOS(account: string): string | undefined {
   const r = spawnSync(
     'security',
     ['find-generic-password', '-s', SERVICE, '-a', account, '-w'],
-    {stdio: ['ignore', 'pipe', 'pipe'] },
+    { stdio: ['ignore', 'pipe', 'pipe'] },
   )
   if (r.status !== 0) {
     return undefined
@@ -247,7 +247,7 @@ export function readWindows(account: string): string | undefined {
       '-Command',
       `try { (Get-StoredCredential -Target '${SERVICE}:${account}').Password | ConvertFrom-SecureString -AsPlainText } catch { exit 1 }`,
     ],
-    {stdio: ['ignore', 'pipe', 'pipe'] },
+    { stdio: ['ignore', 'pipe', 'pipe'] },
   )
   if (ps.status === 0) {
     const out = String(ps.stdout).trim()
@@ -292,7 +292,6 @@ export function writeLinux(token: string, account: string): void {
     'secret-tool',
     ['store', '--label=Socket API token', 'service', SERVICE, 'user', account],
     {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: token,
       stdio: ['pipe', 'pipe', 'pipe'],
     },
@@ -327,7 +326,7 @@ export function writeMacOS(token: string, account: string): void {
       '-l',
       'Socket API token',
     ],
-    {stdio: ['ignore', 'pipe', 'pipe'] },
+    { stdio: ['ignore', 'pipe', 'pipe'] },
   )
   if (r.status !== 0) {
     throw new Error(
@@ -389,7 +388,6 @@ export function writeWindows(token: string, account: string): void {
     } catch { exit 1 }
   `
   const ps = spawnSync('powershell', ['-NoProfile', '-Command', psScript], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: token,
     stdio: ['pipe', 'pipe', 'pipe'],
   })
@@ -420,7 +418,6 @@ export function writeWindowsDpapiFile(token: string): void {
     [Convert]::ToBase64String($protected) | Set-Content -Path '${filePath.replace(/'/g, "''")}' -NoNewline
   `
   const ps = spawnSync('powershell', ['-NoProfile', '-Command', psScript], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: token,
     stdio: ['pipe', 'pipe', 'pipe'],
   })
diff --git a/.claude/hooks/setup-security-tools/test/setup-security-tools.test.mts b/.claude/hooks/setup-security-tools/test/setup-security-tools.test.mts
index d249e8f..97e260c 100644
--- a/.claude/hooks/setup-security-tools/test/setup-security-tools.test.mts
+++ b/.claude/hooks/setup-security-tools/test/setup-security-tools.test.mts
@@ -2,7 +2,7 @@ import assert from 'node:assert/strict'
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import os from 'node:os'
 import path from 'node:path'
 import { test } from 'node:test'
@@ -24,6 +24,11 @@ test('parses without syntax errors (node --check)', async () => {
     const child = spawn(process.execPath, ['--check', SCRIPT], {
       stdio: ['ignore', 'ignore', 'pipe'],
     })
+    // v6 lib-stable spawn returns an enriched Promise that rejects on
+    // non-zero exit; this test reads stderr + exit via manual listeners
+    // instead. Swallow the Promise rejection so it doesn't race the
+    // listener-based resolve and trigger "async activity after test ended".
+    void child.catch(() => undefined)
     let stderr = ''
     child.process.stderr!.on('data', d => {
       stderr += d.toString()
diff --git a/.claude/hooks/soak-exclude-date-annotation-guard/test/index.test.mts b/.claude/hooks/soak-exclude-date-annotation-guard/test/index.test.mts
index d3aa28e..c66102f 100644
--- a/.claude/hooks/soak-exclude-date-annotation-guard/test/index.test.mts
+++ b/.claude/hooks/soak-exclude-date-annotation-guard/test/index.test.mts
@@ -4,7 +4,7 @@ import assert from 'node:assert/strict'
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { describe, test } from 'node:test'
 import { fileURLToPath } from 'node:url'
@@ -20,6 +20,11 @@ interface RunResult {
 function runHook(payload: object): Promise<RunResult> {
   return new Promise((resolve, reject) => {
     const child = spawn('node', [HOOK], { stdio: ['pipe', 'pipe', 'pipe'] })
+    // v6 lib-stable spawn returns an enriched Promise that rejects on
+    // non-zero exit; this test reads stderr + exit via manual listeners
+    // instead. Swallow the Promise rejection so it doesn't race the
+    // listener-based resolve and trigger "async activity after test ended".
+    void child.catch(() => undefined)
     let stderr = ''
     child.process.stderr!.on('data', d => {
       stderr += d.toString()
diff --git a/.claude/hooks/socket-token-minifier-start/index.mts b/.claude/hooks/socket-token-minifier-start/index.mts
index a51b35b..dabc3f9 100644
--- a/.claude/hooks/socket-token-minifier-start/index.mts
+++ b/.claude/hooks/socket-token-minifier-start/index.mts
@@ -17,7 +17,7 @@
 // Time budget: ~3 seconds total. Anything slower than that holds the
 // SessionStart hook chain and the user feels it.
 
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { appendFileSync, existsSync } from 'node:fs'
 import http from 'node:http'
 import path from 'node:path'
diff --git a/.claude/hooks/squash-history-reminder/README.md b/.claude/hooks/squash-history-reminder/README.md
new file mode 100644
index 0000000..22d6140
--- /dev/null
+++ b/.claude/hooks/squash-history-reminder/README.md
@@ -0,0 +1,36 @@
+# squash-history-reminder
+
+Stop hook that nudges the operator toward the `squashing-history` skill when an opted-in fleet repo's default branch has grown beyond a configurable commit threshold.
+
+## Why
+
+A subset of fleet repos (currently `socket-addon`, `socket-bin`, `socket-btm`, `sdxgen`, `stuie`) periodically squash the default branch to a single "Initial commit" — the convention exists for repos where deep history is more confusing than useful (binary publishing forwards, scratchpad tooling, etc.). The opt-in is declared centrally in `template/.claude/skills/cascading-fleet/lib/fleet-repos.json` under each repo's `optIns: ['squash-history']` array.
+
+The hook is a soft reminder, not a blocker. It fires at end-of-turn when all three are true:
+
+1. The current repo is on the opt-in list.
+2. The current branch is the repo's default branch (`main` / `master` — resolved per the fleet's _Default branch fallback_ rule).
+3. The default branch has > `SOCKET_SQUASH_HISTORY_COMMIT_THRESHOLD` commits (default 50).
+
+When all three fire, stderr emits a one-paragraph reminder pointing at the `squashing-history` skill.
+
+## Bypass
+
+User types **`Allow squash-history-reminder bypass`** verbatim in a recent message (within the last 8 user turns). Case-sensitive; paraphrases don't count.
+
+Or set `SOCKET_SQUASH_HISTORY_REMINDER_DISABLED=1` in the env to disable entirely.
+
+## Configuration
+
+- `SOCKET_SQUASH_HISTORY_COMMIT_THRESHOLD` — integer; default 50. Below this count, the hook stays silent.
+- `SOCKET_SQUASH_HISTORY_REMINDER_DISABLED` — any truthy value short-circuits the hook.
+
+## Failing open
+
+The hook fails open on its own bugs (the catch in `main()`). A buggy hook can never block the session.
+
+## Related
+
+- `.claude/skills/squashing-history/SKILL.md` — the canonical squash-history skill (does the actual work).
+- `.claude/skills/cascading-fleet/lib/fleet-repos.json` — the roster + opt-in declarations.
+- `.claude/hooks/default-branch-guard/` — sibling hook that enforces `main → master` fallback wherever the default branch is hard-coded.
diff --git a/.claude/hooks/squash-history-reminder/index.mts b/.claude/hooks/squash-history-reminder/index.mts
new file mode 100644
index 0000000..9dcc430
--- /dev/null
+++ b/.claude/hooks/squash-history-reminder/index.mts
@@ -0,0 +1,220 @@
+#!/usr/bin/env node
+// Claude Code Stop hook — squash-history-reminder.
+//
+// Reminds the operator about the `squashing-history` skill when:
+//   1. The current repo's `name` (from the local git remote OR
+//      basename of the working tree) is listed in the fleet
+//      roster's `optIns: ['squash-history']` set.
+//   2. The current branch is the repo's default branch (per the
+//      fleet's _Default branch fallback_ rule — main → master).
+//   3. The default branch has more than HISTORY_COMMIT_THRESHOLD
+//      commits (default 50). Tunable via env.
+//
+// The reminder is a soft one-liner; pairs with the
+// `template/.claude/skills/squashing-history/SKILL.md` skill that
+// does the actual squash.
+//
+// Bypass phrase: `Allow squash-history-reminder bypass`. Disable
+// entirely via SOCKET_SQUASH_HISTORY_REMINDER_DISABLED.
+
+import { existsSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+// prefer-async-spawn: sync-required — hook fires synchronously at
+// turn-end and must finish before stdin/stdout close.
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
+
+import { bypassPhrasePresent, readStdin } from '../_shared/transcript.mts'
+
+const BYPASS_PHRASE = 'Allow squash-history-reminder bypass'
+const BYPASS_LOOKBACK_USER_TURNS = 8
+const HISTORY_COMMIT_THRESHOLD = Number.parseInt(
+  process.env['SOCKET_SQUASH_HISTORY_COMMIT_THRESHOLD'] ?? '50',
+  10,
+)
+
+interface StopPayload {
+  readonly transcript_path?: string | undefined
+  readonly cwd?: string | undefined
+}
+
+interface FleetRepo {
+  readonly name: string
+  readonly optIns?: readonly string[] | undefined
+}
+
+interface FleetRoster {
+  readonly repos: readonly FleetRepo[]
+}
+
+function gitSafe(cwd: string, args: string[]): string | undefined {
+  const r = spawnSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'ignore'],
+  })
+  if (r.status !== 0 || typeof r.stdout !== 'string') {
+    return undefined
+  }
+  return r.stdout.trim()
+}
+
+/**
+ * Identify the canonical repo name. Prefer the GitHub remote (handles checkout
+ * dir renames like `socket-cli-fix-foo`); fall back to the working-tree
+ * basename.
+ */
+export function resolveRepoName(cwd: string): string | undefined {
+  const remote = gitSafe(cwd, ['config', '--get', 'remote.origin.url'])
+  if (remote) {
+    // git@github.com:Org/repo.git OR https://github.com/Org/repo(.git)?
+    const m = /[/:]([^/:]+?)(?:\.git)?$/.exec(remote)
+    if (m && m[1]) {
+      return m[1]
+    }
+  }
+  const base = path.basename(cwd)
+  return base || undefined
+}
+
+export function readRoster(rosterPath: string): FleetRoster | undefined {
+  if (!existsSync(rosterPath)) {
+    return undefined
+  }
+  try {
+    const raw = readFileSync(rosterPath, 'utf8')
+    return JSON.parse(raw) as FleetRoster
+  } catch {
+    return undefined
+  }
+}
+
+export function isOptedIn(
+  roster: FleetRoster,
+  repoName: string,
+  optIn: string,
+): boolean {
+  for (let i = 0, { length } = roster.repos; i < length; i += 1) {
+    const r = roster.repos[i]!
+    if (r.name === repoName) {
+      return (r.optIns ?? []).includes(optIn)
+    }
+  }
+  return false
+}
+
+function defaultBranch(cwd: string): string {
+  const sym = gitSafe(cwd, ['symbolic-ref', 'refs/remotes/origin/HEAD'])
+  if (sym) {
+    return sym.replace(/^refs\/remotes\/origin\//, '')
+  }
+  for (const candidate of ['main', 'master']) {
+    if (
+      gitSafe(cwd, [
+        'show-ref',
+        '--verify',
+        '--quiet',
+        `refs/remotes/origin/${candidate}`,
+      ]) !== undefined
+    ) {
+      return candidate
+    }
+  }
+  return 'main'
+}
+
+function currentBranch(cwd: string): string | undefined {
+  return gitSafe(cwd, ['branch', '--show-current'])
+}
+
+function commitCount(cwd: string, ref: string): number {
+  const out = gitSafe(cwd, ['rev-list', '--count', ref])
+  if (out === undefined) {
+    return 0
+  }
+  const n = Number.parseInt(out, 10)
+  return Number.isFinite(n) ? n : 0
+}
+
+async function main(): Promise<void> {
+  if (process.env['SOCKET_SQUASH_HISTORY_REMINDER_DISABLED']) {
+    return
+  }
+  const raw = await readStdin()
+  if (!raw.trim()) {
+    return
+  }
+  let payload: StopPayload
+  try {
+    payload = JSON.parse(raw) as StopPayload
+  } catch {
+    return
+  }
+  const cwd = payload.cwd ?? process.cwd()
+
+  const repoRoot = gitSafe(cwd, ['rev-parse', '--show-toplevel']) ?? cwd
+  const rosterCandidates = [
+    path.join(
+      repoRoot,
+      'template/.claude/skills/cascading-fleet/lib/fleet-repos.json',
+    ),
+    path.join(repoRoot, '.claude/skills/cascading-fleet/lib/fleet-repos.json'),
+  ]
+  let roster: FleetRoster | undefined
+  for (let i = 0, { length } = rosterCandidates; i < length; i += 1) {
+    roster = readRoster(rosterCandidates[i]!)
+    if (roster) {
+      break
+    }
+  }
+  if (!roster) {
+    return
+  }
+
+  const repoName = resolveRepoName(repoRoot)
+  if (!repoName) {
+    return
+  }
+  if (!isOptedIn(roster, repoName, 'squash-history')) {
+    return
+  }
+
+  const branch = currentBranch(repoRoot)
+  const base = defaultBranch(repoRoot)
+  if (branch !== base) {
+    return
+  }
+
+  const count = commitCount(repoRoot, branch)
+  if (count <= HISTORY_COMMIT_THRESHOLD) {
+    return
+  }
+
+  if (
+    bypassPhrasePresent(
+      payload.transcript_path,
+      BYPASS_PHRASE,
+      BYPASS_LOOKBACK_USER_TURNS,
+    )
+  ) {
+    return
+  }
+
+  process.stderr.write(
+    [
+      `💡 squash-history-reminder: ${repoName} is opted into the squash-history convention.`,
+      `   The default branch \`${branch}\` has ${count} commits (threshold ${HISTORY_COMMIT_THRESHOLD}).`,
+      `   Consider running the \`squashing-history\` skill to collapse to a single Initial commit.`,
+      `   Skill: .claude/skills/squashing-history/SKILL.md`,
+      `   Suppress for this session: type "${BYPASS_PHRASE}" verbatim, or set`,
+      `   SOCKET_SQUASH_HISTORY_REMINDER_DISABLED=1 to disable entirely.`,
+      '',
+    ].join('\n'),
+  )
+}
+
+main().catch(e => {
+  process.stderr.write(
+    `squash-history-reminder: hook error (continuing): ${(e as Error).message}\n`,
+  )
+})
diff --git a/.claude/hooks/squash-history-reminder/package.json b/.claude/hooks/squash-history-reminder/package.json
new file mode 100644
index 0000000..e3f4af7
--- /dev/null
+++ b/.claude/hooks/squash-history-reminder/package.json
@@ -0,0 +1,18 @@
+{
+  "name": "hook-squash-history-reminder",
+  "private": true,
+  "type": "module",
+  "main": "./index.mts",
+  "exports": {
+    ".": "./index.mts"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mts"
+  },
+  "dependencies": {
+    "@socketsecurity/lib-stable": "catalog:"
+  },
+  "devDependencies": {
+    "@types/node": "catalog:"
+  }
+}
diff --git a/.claude/hooks/squash-history-reminder/test/index.test.mts b/.claude/hooks/squash-history-reminder/test/index.test.mts
new file mode 100644
index 0000000..189593c
--- /dev/null
+++ b/.claude/hooks/squash-history-reminder/test/index.test.mts
@@ -0,0 +1,51 @@
+// node --test specs for squash-history-reminder hook helpers.
+
+import test from 'node:test'
+import assert from 'node:assert/strict'
+
+import { isOptedIn, resolveRepoName } from '../index.mts'
+
+test('isOptedIn returns true for an opted-in repo', () => {
+  const roster = {
+    repos: [
+      { name: 'socket-btm', optIns: ['squash-history'] },
+      { name: 'socket-cli' },
+    ],
+  }
+  assert.strictEqual(isOptedIn(roster, 'socket-btm', 'squash-history'), true)
+})
+
+test('isOptedIn returns false for a non-opted-in repo', () => {
+  const roster = {
+    repos: [
+      { name: 'socket-btm', optIns: ['squash-history'] },
+      { name: 'socket-cli' },
+    ],
+  }
+  assert.strictEqual(isOptedIn(roster, 'socket-cli', 'squash-history'), false)
+})
+
+test('isOptedIn returns false for a repo missing from the roster', () => {
+  const roster = {
+    repos: [{ name: 'socket-btm', optIns: ['squash-history'] }],
+  }
+  assert.strictEqual(isOptedIn(roster, 'unknown-repo', 'squash-history'), false)
+})
+
+test('isOptedIn returns false for a different opt-in name', () => {
+  const roster = {
+    repos: [{ name: 'socket-btm', optIns: ['squash-history'] }],
+  }
+  assert.strictEqual(isOptedIn(roster, 'socket-btm', 'other-opt-in'), false)
+})
+
+test('resolveRepoName falls back to cwd basename if no git remote', () => {
+  // Use a real path to verify basename extraction; the function tries
+  // git first but will silently fail in /tmp (no remote configured).
+  const result = resolveRepoName('/tmp/socket-imaginary')
+  // Result is either the basename OR a real remote name if /tmp happens
+  // to be inside a git checkout (unlikely). Both are valid; the
+  // important thing is the function returns *something* string-shaped.
+  assert.strictEqual(typeof result, 'string')
+  assert.ok((result?.length ?? 0) > 0)
+})
diff --git a/.claude/hooks/squash-history-reminder/tsconfig.json b/.claude/hooks/squash-history-reminder/tsconfig.json
new file mode 100644
index 0000000..19458cf
--- /dev/null
+++ b/.claude/hooks/squash-history-reminder/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "declarationMap": false,
+    "erasableSyntaxOnly": true,
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "noEmit": true,
+    "rewriteRelativeImportExtensions": true,
+    "skipLibCheck": true,
+    "sourceMap": false,
+    "strict": true,
+    "target": "esnext",
+    "types": ["node"],
+    "verbatimModuleSyntax": true
+  }
+}
diff --git a/.claude/hooks/stale-process-sweeper/index.mts b/.claude/hooks/stale-process-sweeper/index.mts
index 5f476df..fc99568 100644
--- a/.claude/hooks/stale-process-sweeper/index.mts
+++ b/.claude/hooks/stale-process-sweeper/index.mts
@@ -31,7 +31,7 @@
 // Stop hooks receive JSON on stdin (we don't read it; the body
 // shape is irrelevant to our work) and exit code is advisory.
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import process from 'node:process'
 
 // Process-name patterns that indicate a stale test/build worker.
diff --git a/.claude/hooks/stale-process-sweeper/test/stale-process-sweeper.test.mts b/.claude/hooks/stale-process-sweeper/test/stale-process-sweeper.test.mts
index 4f7adfa..be79c41 100644
--- a/.claude/hooks/stale-process-sweeper/test/stale-process-sweeper.test.mts
+++ b/.claude/hooks/stale-process-sweeper/test/stale-process-sweeper.test.mts
@@ -1,7 +1,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { fileURLToPath } from 'node:url'
 import path from 'node:path'
 import { test } from 'node:test'
@@ -17,6 +17,11 @@ function runHook(): Promise<{ code: number; stderr: string }> {
     const child = spawn(process.execPath, [HOOK], {
       stdio: ['pipe', 'ignore', 'pipe'],
     })
+    // v6 lib-stable spawn returns an enriched Promise that rejects on
+    // non-zero exit; this test reads stderr + exit via manual listeners
+    // instead. Swallow the Promise rejection so it doesn't race the
+    // listener-based resolve and trigger "async activity after test ended".
+    void child.catch(() => undefined)
     let stderr = ''
     child.process.stderr!.on('data', d => {
       stderr += d.toString()
diff --git a/.claude/hooks/sweep-ds-store/README.md b/.claude/hooks/sweep-ds-store/README.md
new file mode 100644
index 0000000..eb8fdd5
--- /dev/null
+++ b/.claude/hooks/sweep-ds-store/README.md
@@ -0,0 +1,45 @@
+# sweep-ds-store
+
+Stop hook that sweeps `.DS_Store` files at turn-end. Excludes `.git/`
+and `node_modules/`. Silent on the happy path; logs sweep count when
+files are found.
+
+## Why
+
+`.DS_Store` is gitignored fleet-wide, but the files still exist on
+disk. They surface in:
+
+- `find` output, polluting search results
+- `git status --ignored` reports
+- non-git tooling (rsync, tar, zip artifacts)
+- Spotlight indexing churn
+
+The right fix is to delete them, not just ignore them. The hook runs
+at every turn-end (the same time `stale-process-sweeper` runs), so
+files Finder created mid-session are gone before the next turn.
+
+## Behavior
+
+- Walks the worktree starting at `$CLAUDE_PROJECT_DIR` (or `cwd` as
+  fallback)
+- Skips `.git/` and `node_modules/` subtrees
+- Doesn't follow symlinks
+- Max depth: 12 (defense against pathological symlink loops)
+- Per-file delete errors are logged but never block the hook
+
+## Output
+
+Silent unless files were found. Output goes to stderr:
+
+```
+[sweep-ds-store] swept 3 .DS_Store file(s):
+  .DS_Store
+  src/.DS_Store
+  test/fixtures/.DS_Store
+```
+
+## Bypass
+
+None — `.DS_Store` is never wanted in a repo. If you have a reason
+to keep one (very rare; testing macOS-specific tooling), name it
+`.DS_Store.fixture` and adjust the test.
diff --git a/.claude/hooks/sweep-ds-store/index.mts b/.claude/hooks/sweep-ds-store/index.mts
new file mode 100644
index 0000000..c5632e6
--- /dev/null
+++ b/.claude/hooks/sweep-ds-store/index.mts
@@ -0,0 +1,152 @@
+#!/usr/bin/env node
+// Claude Code Stop hook — sweep-ds-store.
+//
+// Fires at turn-end. Walks the worktree (current working directory)
+// and deletes any `.DS_Store` files Finder created mid-session.
+// Excludes `.git/` and `node_modules/` so we don't churn through
+// directories full of vendor noise.
+//
+// Why a hook instead of `.gitignore` alone:
+//   `.DS_Store` is gitignored fleet-wide, but the FILES themselves
+//   still exist on disk. They surface in:
+//     - `find` output, polluting search results
+//     - `git status --ignored` reports
+//     - non-git tooling (rsync, tar, zip)
+//     - Spotlight indexing churn
+//   The right fix is to delete them, not just ignore them.
+//
+// Silent on the happy path. When files are found, logs:
+//
+//   [sweep-ds-store] swept N .DS_Store file(s):
+//     ./path/to/.DS_Store
+//     ...
+//
+// No bypass — `.DS_Store` is never wanted in a repo. If you have a
+// reason to keep one (very rare — testing macOS-specific code), use
+// a name like `.DS_Store.fixture` and adjust the test fixture.
+//
+// Stop hooks receive a JSON payload on stdin but the body shape is
+// irrelevant here; we ignore it. Drains the pipe so the upstream
+// doesn't buffer-stall.
+
+import { existsSync, promises as fs } from 'node:fs'
+import type { Dirent } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import process from 'node:process'
+import { safeDelete } from '@socketsecurity/lib-stable/fs/safe'
+
+const TARGET = '.DS_Store'
+const EXCLUDE_DIRS = new Set(['.git', 'node_modules'])
+const MAX_DEPTH = 12
+
+interface SweepResult {
+  readonly swept: readonly string[]
+  readonly errors: readonly string[]
+}
+
+/**
+ * Recursively walk `root`, deleting every `.DS_Store` found. Returns the list
+ * of deleted paths (relative to `root`) and any per-file delete errors. Never
+ * throws — Stop hooks must not block the conversation on their own bugs.
+ *
+ * `MAX_DEPTH` is a defense against pathological symlink loops; the worktrees we
+ * run on don't nest anywhere near that deep.
+ */
+export async function sweepDsStore(root: string): Promise<SweepResult> {
+  const swept: string[] = []
+  const errors: string[] = []
+  await walk(root, root, 0, swept, errors)
+  return { swept, errors }
+}
+
+async function walk(
+  root: string,
+  dir: string,
+  depth: number,
+  swept: string[],
+  errors: string[],
+): Promise<void> {
+  if (depth > MAX_DEPTH) {
+    return
+  }
+  let entries: Dirent[]
+  try {
+    entries = await fs.readdir(dir, { withFileTypes: true })
+  } catch {
+    // Permission denied, race with another process, etc. Skip the
+    // dir; never block the hook.
+    return
+  }
+  for (let i = 0, { length } = entries; i < length; i += 1) {
+    const entry = entries[i]!
+    const name = entry.name
+    const full = path.join(dir, name)
+    if (entry.isDirectory()) {
+      if (EXCLUDE_DIRS.has(name)) {
+        continue
+      }
+      // Avoid following symlinks — keeps the walk to the working
+      // tree, not whatever a symlink points at.
+      if (entry.isSymbolicLink()) {
+        continue
+      }
+      await walk(root, full, depth + 1, swept, errors)
+      continue
+    }
+    if (name === TARGET) {
+      try {
+        await safeDelete(full)
+        swept.push(path.relative(root, full))
+      } catch (e) {
+        errors.push(`${path.relative(root, full)}: ${(e as Error).message}`)
+      }
+    }
+  }
+}
+
+async function main(): Promise<void> {
+  // Drain stdin so the upstream pipe doesn't buffer-stall, but ignore
+  // the body — Stop hooks pass a JSON payload that we don't need.
+  process.stdin.resume()
+  process.stdin.on('data', () => {})
+  // Short timeout — if stdin never closes we still want to run.
+  await new Promise<void>(resolve => {
+    process.stdin.on('end', () => resolve())
+    setTimeout(() => resolve(), 100)
+  })
+
+  const root = process.env['CLAUDE_PROJECT_DIR'] ?? process.cwd()
+  if (!existsSync(root)) {
+    return
+  }
+  const { swept, errors } = await sweepDsStore(root)
+  if (swept.length === 0 && errors.length === 0) {
+    return
+  }
+  const lines: string[] = []
+  if (swept.length > 0) {
+    lines.push(`[sweep-ds-store] swept ${swept.length} .DS_Store file(s):`)
+    for (let i = 0, { length } = swept; i < length; i += 1) {
+      lines.push(`  ${swept[i]!}`)
+    }
+  }
+  if (errors.length > 0) {
+    lines.push(`[sweep-ds-store] ${errors.length} delete error(s):`)
+    for (let i = 0, { length } = errors; i < length; i += 1) {
+      lines.push(`  ${errors[i]!}`)
+    }
+  }
+  process.stderr.write(lines.join(os.EOL) + os.EOL)
+}
+
+// CLI entrypoint — only fires when this file is the main module so
+// the test importer can pull `sweepDsStore` without triggering the
+// stdin reader.
+if (process.argv[1] && process.argv[1].endsWith('index.mts')) {
+  main().catch(e => {
+    process.stderr.write(
+      `[sweep-ds-store] hook error (allowing): ${(e as Error).message}${os.EOL}`,
+    )
+  })
+}
diff --git a/.claude/hooks/sweep-ds-store/package.json b/.claude/hooks/sweep-ds-store/package.json
new file mode 100644
index 0000000..cdfcfeb
--- /dev/null
+++ b/.claude/hooks/sweep-ds-store/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "hook-sweep-ds-store",
+  "private": true,
+  "type": "module",
+  "main": "./index.mts",
+  "exports": {
+    ".": "./index.mts"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mts"
+  },
+  "devDependencies": {
+    "@types/node": "catalog:"
+  }
+}
diff --git a/.claude/hooks/sweep-ds-store/test/index.test.mts b/.claude/hooks/sweep-ds-store/test/index.test.mts
new file mode 100644
index 0000000..005bdd1
--- /dev/null
+++ b/.claude/hooks/sweep-ds-store/test/index.test.mts
@@ -0,0 +1,115 @@
+/**
+ * @file Unit tests for sweepDsStore — the recursive .DS_Store remover used by
+ *   the Stop hook. Uses real temp dirs (cheap, < 50ms total) rather than
+ *   mocks.
+ */
+
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { rmSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+import { sweepDsStore } from '../index.mts'
+
+function setup(): string {
+  return mkdtempSync(path.join(os.tmpdir(), 'sweep-ds-store-test-'))
+}
+
+function cleanup(dir: string): void {
+  try {
+    rmSync(dir, { force: true, recursive: true })
+  } catch {
+    // best-effort
+  }
+}
+
+test('sweeps a top-level .DS_Store', async () => {
+  const root = setup()
+  try {
+    writeFileSync(path.join(root, '.DS_Store'), 'binary-junk')
+    const result = await sweepDsStore(root)
+    assert.equal(result.swept.length, 1)
+    assert.equal(result.swept[0], '.DS_Store')
+    assert.equal(existsSync(path.join(root, '.DS_Store')), false)
+  } finally {
+    cleanup(root)
+  }
+})
+
+test('sweeps nested .DS_Store files', async () => {
+  const root = setup()
+  try {
+    mkdirSync(path.join(root, 'a', 'b'), { recursive: true })
+    writeFileSync(path.join(root, '.DS_Store'), 'x')
+    writeFileSync(path.join(root, 'a', '.DS_Store'), 'x')
+    writeFileSync(path.join(root, 'a', 'b', '.DS_Store'), 'x')
+    const result = await sweepDsStore(root)
+    assert.equal(result.swept.length, 3)
+    assert.equal(existsSync(path.join(root, 'a', 'b', '.DS_Store')), false)
+  } finally {
+    cleanup(root)
+  }
+})
+
+test('skips .git/', async () => {
+  const root = setup()
+  try {
+    mkdirSync(path.join(root, '.git'), { recursive: true })
+    writeFileSync(path.join(root, '.git', '.DS_Store'), 'x')
+    writeFileSync(path.join(root, '.DS_Store'), 'x')
+    const result = await sweepDsStore(root)
+    assert.equal(result.swept.length, 1)
+    assert.equal(result.swept[0], '.DS_Store')
+    // .git/.DS_Store still exists
+    assert.equal(existsSync(path.join(root, '.git', '.DS_Store')), true)
+  } finally {
+    cleanup(root)
+  }
+})
+
+test('skips node_modules/', async () => {
+  const root = setup()
+  try {
+    mkdirSync(path.join(root, 'node_modules', 'foo'), { recursive: true })
+    writeFileSync(path.join(root, 'node_modules', 'foo', '.DS_Store'), 'x')
+    writeFileSync(path.join(root, '.DS_Store'), 'x')
+    const result = await sweepDsStore(root)
+    assert.equal(result.swept.length, 1)
+    assert.equal(result.swept[0], '.DS_Store')
+  } finally {
+    cleanup(root)
+  }
+})
+
+test('ignores other files with similar names', async () => {
+  const root = setup()
+  try {
+    writeFileSync(path.join(root, '.DS_Store.fixture'), 'x')
+    writeFileSync(path.join(root, '_DS_Store'), 'x')
+    writeFileSync(path.join(root, '.ds_store'), 'x')
+    const result = await sweepDsStore(root)
+    assert.equal(result.swept.length, 0)
+    assert.equal(existsSync(path.join(root, '.DS_Store.fixture')), true)
+  } finally {
+    cleanup(root)
+  }
+})
+
+test('empty directory tree returns empty result', async () => {
+  const root = setup()
+  try {
+    const result = await sweepDsStore(root)
+    assert.equal(result.swept.length, 0)
+    assert.equal(result.errors.length, 0)
+  } finally {
+    cleanup(root)
+  }
+})
+
+test('non-existent root does not throw', async () => {
+  const result = await sweepDsStore('/nonexistent-path-for-test')
+  assert.equal(result.swept.length, 0)
+  assert.equal(result.errors.length, 0)
+})
diff --git a/.claude/hooks/sweep-ds-store/tsconfig.json b/.claude/hooks/sweep-ds-store/tsconfig.json
new file mode 100644
index 0000000..19458cf
--- /dev/null
+++ b/.claude/hooks/sweep-ds-store/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "declarationMap": false,
+    "erasableSyntaxOnly": true,
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "noEmit": true,
+    "rewriteRelativeImportExtensions": true,
+    "skipLibCheck": true,
+    "sourceMap": false,
+    "strict": true,
+    "target": "esnext",
+    "types": ["node"],
+    "verbatimModuleSyntax": true
+  }
+}
diff --git a/.claude/hooks/token-guard/test/token-guard.test.mts b/.claude/hooks/token-guard/test/token-guard.test.mts
index 1270e34..681de7c 100644
--- a/.claude/hooks/token-guard/test/token-guard.test.mts
+++ b/.claude/hooks/token-guard/test/token-guard.test.mts
@@ -8,8 +8,8 @@
 import { describe, it } from 'node:test'
 import assert from 'node:assert/strict'
 
-import { whichSync } from '@socketsecurity/lib-stable/bin'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { whichSync } from '@socketsecurity/lib-stable/bin/which'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 
 const hookScript = new URL('../index.mts', import.meta.url).pathname
 const nodeBinRaw = whichSync('node')
@@ -31,7 +31,6 @@ function runHook(
     tool_input: { command },
   })
   const result = spawnSync(nodeBin, [hookScript], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input,
     timeout: 5_000,
     stdio: ['pipe', 'pipe', 'pipe'],
@@ -196,7 +195,6 @@ describe('token-guard hook', () => {
   describe('fails open on malformed input', () => {
     it('empty stdin', () => {
       const r = spawnSync(nodeBin, [hookScript], {
-        // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
         input: '',
         timeout: 5_000,
         stdio: ['pipe', 'pipe', 'pipe'],
@@ -205,7 +203,6 @@ describe('token-guard hook', () => {
     })
     it('non-JSON stdin', () => {
       const r = spawnSync(nodeBin, [hookScript], {
-        // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
         input: 'not json',
         timeout: 5_000,
         stdio: ['pipe', 'pipe', 'pipe'],
diff --git a/.claude/hooks/variant-analysis-reminder/test/index.test.mts b/.claude/hooks/variant-analysis-reminder/test/index.test.mts
index c73bb08..207f471 100644
--- a/.claude/hooks/variant-analysis-reminder/test/index.test.mts
+++ b/.claude/hooks/variant-analysis-reminder/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -46,7 +46,6 @@ function makeTranscript(
 
 function runHook(transcriptPath: string): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({ transcript_path: transcriptPath }),
   })
   return { stderr: String(result.stderr), exitCode: result.status ?? -1 }
@@ -172,7 +171,6 @@ test('disabled env var short-circuits', () => {
   const { path: p, cleanup } = makeTranscript('Critical: bug found')
   try {
     const result = spawnSync('node', [HOOK_PATH], {
-      // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
       input: JSON.stringify({ transcript_path: p }),
       env: { ...process.env, SOCKET_VARIANT_ANALYSIS_REMINDER_DISABLED: '1' },
     })
diff --git a/.claude/hooks/verify-rendered-output-before-commit-reminder/index.mts b/.claude/hooks/verify-rendered-output-before-commit-reminder/index.mts
index 333beef..d1ba4fa 100644
--- a/.claude/hooks/verify-rendered-output-before-commit-reminder/index.mts
+++ b/.claude/hooks/verify-rendered-output-before-commit-reminder/index.mts
@@ -18,7 +18,7 @@
 //
 // No-op when the staged set is purely non-UI source.
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { readFileSync } from 'node:fs'
 import process from 'node:process'
 
@@ -33,7 +33,7 @@ interface ToolInput {
 
 // Files whose changes likely affect rendered output.
 const UI_FILE_RE =
-  /\.(astro|css|ejs|handlebars|hbs|htm|html|less|njk|sass|scss|svelte|vue)$/i
+  /\.(?:astro|css|ejs|handlebars|hbs|htm|html|less|njk|sass|scss|svelte|vue)$/i
 
 // Build-script patterns. Conservative — match the common fleet shapes:
 // `pnpm run build`, `pnpm build`, `node scripts/<name>.mts`, `pnpm tour`,
diff --git a/.claude/hooks/verify-rendered-output-before-commit-reminder/test/index.test.mts b/.claude/hooks/verify-rendered-output-before-commit-reminder/test/index.test.mts
index fbaefb7..98eb60a 100644
--- a/.claude/hooks/verify-rendered-output-before-commit-reminder/test/index.test.mts
+++ b/.claude/hooks/verify-rendered-output-before-commit-reminder/test/index.test.mts
@@ -1,6 +1,6 @@
 // node --test specs for the verify-rendered-output-before-commit-reminder hook.
 
-import { spawn, spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawn, spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -37,6 +37,11 @@ function mkTranscript(entries: object[]): string {
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
@@ -101,7 +106,9 @@ test('commit with UI files + recent build + no verify — reminder fires', async
     ]),
   })
   assert.strictEqual(r.code, 0)
-  assert.ok(String(r.stderr).includes('verify-rendered-output-before-commit-reminder'))
+  assert.ok(
+    String(r.stderr).includes('verify-rendered-output-before-commit-reminder'),
+  )
 })
 
 test('commit with UI files + build + later user verify — no reminder', async () => {
diff --git a/.claude/hooks/version-bump-order-guard/index.mts b/.claude/hooks/version-bump-order-guard/index.mts
index 130e328..2ee00ce 100644
--- a/.claude/hooks/version-bump-order-guard/index.mts
+++ b/.claude/hooks/version-bump-order-guard/index.mts
@@ -21,7 +21,7 @@
 // Bypass: "Allow version-bump-order bypass" in a recent user turn, or
 // SOCKET_VERSION_BUMP_ORDER_GUARD_DISABLED=1.
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import process from 'node:process'
 
 import { bypassPhrasePresent, readStdin } from '../_shared/transcript.mts'
@@ -46,7 +46,7 @@ const VERSION_TAG_RE = /\bgit\s+tag\b[^|;&\n]*\bv\d+\.\d+\.\d+\b/
 // Subject patterns that count as a "bump commit". Matches Keep-a-
 // Changelog style and Conventional Commits style.
 const BUMP_SUBJECT_RE =
-  /^(chore(?:\([\w-]+\))?:\s+(?:bump version to|release)\s+v?\d+\.\d+\.\d+|chore(?:\([\w-]+\))?:\s+v?\d+\.\d+\.\d+\s+release)/i
+  /^(?:chore(?:\([\w-]+\))?:\s+(?:bump version to|release)\s+v?\d+\.\d+\.\d+|chore(?:\([\w-]+\))?:\s+v?\d+\.\d+\.\d+\s+release)/i
 
 async function main(): Promise<void> {
   if (process.env['SOCKET_VERSION_BUMP_ORDER_GUARD_DISABLED']) {
@@ -75,11 +75,7 @@ async function main(): Promise<void> {
 
   // Read the most-recent commit subject from HEAD.
   const opts = payload.cwd ? { cwd: payload.cwd } : {}
-  const subjectResult = spawnSync(
-    'git',
-    ['log', '-1', '--pretty=%s'],
-    opts,
-  )
+  const subjectResult = spawnSync('git', ['log', '-1', '--pretty=%s'], opts)
   if (subjectResult.status !== 0) {
     // Not a git repo or git unavailable — fail open.
     process.exit(0)
diff --git a/.claude/hooks/version-bump-order-guard/test/index.test.mts b/.claude/hooks/version-bump-order-guard/test/index.test.mts
index 2e3c810..12cc706 100644
--- a/.claude/hooks/version-bump-order-guard/test/index.test.mts
+++ b/.claude/hooks/version-bump-order-guard/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -46,7 +46,6 @@ function runHook(
   extraEnv: Record<string, string> = {},
 ): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({
       tool_name: 'Bash',
       tool_input: { command },
@@ -112,7 +111,6 @@ test('ALLOWS git tag with non-version label (no enforcement)', () => {
 
 test('IGNORES non-Bash tools', () => {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify({
       tool_name: 'Write',
       tool_input: { command: 'git tag v1.0.0' },
diff --git a/.claude/hooks/vitest-include-vs-node-test-guard/test/index.test.mts b/.claude/hooks/vitest-include-vs-node-test-guard/test/index.test.mts
index b58e240..86f6cb7 100644
--- a/.claude/hooks/vitest-include-vs-node-test-guard/test/index.test.mts
+++ b/.claude/hooks/vitest-include-vs-node-test-guard/test/index.test.mts
@@ -3,7 +3,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -40,6 +40,11 @@ function makeFixture(opts: FixtureOpts): {
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/hooks/workflow-uses-comment-guard/test/index.test.mts b/.claude/hooks/workflow-uses-comment-guard/test/index.test.mts
index 2558e3c..d61fa99 100644
--- a/.claude/hooks/workflow-uses-comment-guard/test/index.test.mts
+++ b/.claude/hooks/workflow-uses-comment-guard/test/index.test.mts
@@ -1,6 +1,6 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -9,7 +9,6 @@ const HOOK_PATH = path.join(__dirname, '..', 'index.mts')
 
 function runHook(payload: object): { stderr: string; exitCode: number } {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: JSON.stringify(payload),
   })
   return { stderr: String(result.stderr), exitCode: result.status ?? -1 }
@@ -127,7 +126,6 @@ test('ignores non-Edit/Write tool calls', () => {
 
 test('fails open on bad JSON', () => {
   const result = spawnSync('node', [HOOK_PATH], {
-    // @ts-expect-error TS2353 -- lib v5 SpawnSyncOptions omits "input"; v6 exposes it. Runtime accepts it.
     input: '{not-json}',
   })
   assert.equal(result.status, 0)
diff --git a/.claude/hooks/workflow-yaml-multiline-body-guard/test/index.test.mts b/.claude/hooks/workflow-yaml-multiline-body-guard/test/index.test.mts
index 2432a67..ca580eb 100644
--- a/.claude/hooks/workflow-yaml-multiline-body-guard/test/index.test.mts
+++ b/.claude/hooks/workflow-yaml-multiline-body-guard/test/index.test.mts
@@ -3,7 +3,7 @@
 // prefer-async-spawn: streaming-stdio-required — test spawns child
 // subprocess and pipes stdin/stdout/stderr; Node spawn returns the
 // ChildProcess streaming surface the lib promise wrapper does not.
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -27,6 +27,11 @@ function tmpWorkflow(content: string): string {
 
 async function runHook(payload: Record<string, unknown>): Promise<Result> {
   const child = spawn(process.execPath, [HOOK], { stdio: 'pipe' })
+  // v6 lib-stable spawn returns an enriched Promise that rejects on
+  // non-zero exit; this test reads stderr + exit via manual listeners
+  // instead. Swallow the Promise rejection so it doesn't race the
+  // listener-based resolve and trigger "async activity after test ended".
+  void child.catch(() => undefined)
   child.stdin!.end(JSON.stringify(payload))
   let stderr = ''
   child.process.stderr!.on('data', chunk => {
diff --git a/.claude/settings.json b/.claude/settings.json
index b07aef2..4fb6536 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -20,6 +20,10 @@
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/cross-repo-guard/index.mts"
           },
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/no-disable-lint-rule-guard/index.mts"
+          },
           {
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/gitmodules-comment-guard/index.mts"
@@ -80,6 +84,10 @@
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/pull-request-target-guard/index.mts"
           },
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/readme-fleet-shape-guard/index.mts"
+          },
           {
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/workflow-uses-comment-guard/index.mts"
@@ -147,6 +155,10 @@
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/commit-author-guard/index.mts"
           },
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/commit-message-format-guard/index.mts"
+          },
           {
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/concurrent-cargo-build-guard/index.mts"
@@ -155,10 +167,18 @@
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/default-branch-guard/index.mts"
           },
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/no-blind-keychain-read-guard/index.mts"
+          },
           {
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/no-experimental-strip-types-guard/index.mts"
           },
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/no-empty-commit-guard/index.mts"
+          },
           {
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/node-modules-staging-guard/index.mts"
@@ -195,6 +215,10 @@
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/release-workflow-guard/index.mts"
           },
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/scan-label-in-commit-guard/index.mts"
+          },
           {
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/token-guard/index.mts"
@@ -233,6 +257,10 @@
           {
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/actionlint-on-workflow-edit/index.mts"
+          },
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/extension-build-current-guard/index.mts"
           }
         ]
       }
@@ -300,10 +328,18 @@
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/setup-security-tools/index.mts"
           },
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/squash-history-reminder/index.mts"
+          },
           {
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/stale-process-sweeper/index.mts"
           },
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/sweep-ds-store/index.mts"
+          },
           {
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/variant-analysis-reminder/index.mts"
diff --git a/.claude/skills/_shared/scripts/git-default-branch.mts b/.claude/skills/_shared/scripts/git-default-branch.mts
index 81c41b3..209b836 100644
--- a/.claude/skills/_shared/scripts/git-default-branch.mts
+++ b/.claude/skills/_shared/scripts/git-default-branch.mts
@@ -9,7 +9,8 @@
  * Cross-platform: shells out to git via @socketsecurity/lib/spawn, which works
  * the same on macOS / Linux / Windows.
  */
-import { isSpawnError, spawn } from '@socketsecurity/lib/spawn'
+import { isSpawnError } from '@socketsecurity/lib/spawn/errors'
+import { spawn } from '@socketsecurity/lib/spawn/spawn'
 
 export type ResolveDefaultBranchOptions = {
   /**
diff --git a/.claude/skills/_shared/scripts/resolve-tools.mts b/.claude/skills/_shared/scripts/resolve-tools.mts
index acb380a..ea362aa 100644
--- a/.claude/skills/_shared/scripts/resolve-tools.mts
+++ b/.claude/skills/_shared/scripts/resolve-tools.mts
@@ -20,7 +20,7 @@
 import { existsSync } from 'node:fs'
 import path from 'node:path'
 
-import { spawn } from '@socketsecurity/lib/spawn'
+import { spawn } from '@socketsecurity/lib/spawn/spawn'
 
 /**
  * Result of a resolver. `args` is the full argv passed to `pnpm exec`,
diff --git a/.claude/skills/auditing-gha-settings/SKILL.md b/.claude/skills/auditing-gha-settings/SKILL.md
index f0108d9..b17ad50 100644
--- a/.claude/skills/auditing-gha-settings/SKILL.md
+++ b/.claude/skills/auditing-gha-settings/SKILL.md
@@ -75,9 +75,10 @@ Or all-at-once with the canonical fleet list (manual today; the orchestrator ski
       SocketDev/socket-sdk-js \
       SocketDev/socket-sdxgen \
       SocketDev/socket-stuie \
+      SocketDev/socket-vscode \
+      SocketDev/socket-webext \
       SocketDev/socket-wheelhouse \
-      SocketDev/ultrathink \
-      SocketDev/vscode-socket-security
+      SocketDev/ultrathink
 
 For machine-readable output (one finding per repo):
 
diff --git a/.claude/skills/auditing-gha-settings/run.mts b/.claude/skills/auditing-gha-settings/run.mts
index 0cbda84..986c85c 100644
--- a/.claude/skills/auditing-gha-settings/run.mts
+++ b/.claude/skills/auditing-gha-settings/run.mts
@@ -22,7 +22,7 @@
 import process from 'node:process'
 
 import { getDefaultLogger } from '@socketsecurity/lib/logger'
-import { spawn } from '@socketsecurity/lib/spawn'
+import { spawn } from '@socketsecurity/lib/spawn/spawn'
 
 const logger = getDefaultLogger()
 
diff --git a/.claude/skills/cascading-fleet/SKILL.md b/.claude/skills/cascading-fleet/SKILL.md
index 378d31c..879133a 100644
--- a/.claude/skills/cascading-fleet/SKILL.md
+++ b/.claude/skills/cascading-fleet/SKILL.md
@@ -34,7 +34,7 @@ The `FLEET_SYNC=1` sentinel is recognized by the wheelhouse `no-revert-guard` +
 
 ### Mode 2 — `registry-pins`
 
-Propagates a `socket-registry` pin chain through the fleet. Different shape — uses `scripts/cascade-registry-pins.mts --sha <M'>` to walk the per-repo workflow pins. Documented here for completeness; the cascade script in `lib/cascade-template.sh` covers Mode 1, and a future `lib/cascade-registry-pins.sh` will cover Mode 2.
+Propagates a `socket-registry` pin chain through the fleet. Different shape — uses `scripts/cascade-registry-pins.mts --sha <M'>` to walk the per-repo workflow pins. Documented here for completeness; the cascade script in `lib/cascade-template.mts` covers Mode 1, and a future `lib/cascade-registry-pins.mts` will cover Mode 2.
 
 For now, the registry-pin cascade is two steps documented inline:
 
@@ -50,7 +50,7 @@ Skipping Step 1 means Step 3 propagates a SHA whose dependency graph still pins
 
 ```bash
 # Mode 1 — propagate wheelhouse template SHA
-bash .claude/skills/cascading-fleet/lib/cascade-template.sh <template-sha>
+node .claude/skills/cascading-fleet/lib/cascade-template.mts <template-sha>
 ```
 
 The script reads the fleet-repo list from `lib/fleet-repos.txt` (single source of truth), iterates, and writes a per-repo result line to stdout. Output also tees to `/tmp/cascade-<sha>.log` for post-hoc inspection.
diff --git a/.claude/skills/cascading-fleet/lib/cascade-template.mts b/.claude/skills/cascading-fleet/lib/cascade-template.mts
new file mode 100644
index 0000000..1529736
--- /dev/null
+++ b/.claude/skills/cascading-fleet/lib/cascade-template.mts
@@ -0,0 +1,328 @@
+#!/usr/bin/env node
+/**
+ * @file Fleet cascade — propagate a socket-wheelhouse/template/ SHA to every
+ *   fleet repo. Uses the FLEET_SYNC=1 sentinel to bypass the no-revert-guard /
+ *   overeager-staging-guard hooks without per-repo Allow-bypass phrases.
+ *   Replaces the original cascade-template.sh; the fleet convention is `.mts`
+ *   for all runners. Usage: node
+ *   .claude/skills/cascading-fleet/lib/cascade-template.mts <template-sha>
+ *   Reads the canonical fleet-repo list from `<this-dir>/fleet-repos.txt`. Each
+ *   repo's worktree is created off `origin/<default-branch>`, the wheelhouse
+ *   sync-scaffolding CLI runs, the resulting changes are committed, and the
+ *   script tries a direct push first, falling back to opening a PR on
+ *   rejection.
+ */
+
+// prefer-async-spawn: sync-required — cascade orchestrator runs
+// sequentially across repos with exit-code gating; async would
+// complicate the linear pipeline for no real concurrency win.
+// prefer-spawn-over-execsync: same — top-level sync CLI flow.
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
+import {
+  appendFileSync,
+  existsSync,
+  readFileSync,
+  writeFileSync,
+} from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import process from 'node:process'
+
+import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
+
+const logger = getDefaultLogger()
+
+const LOG_PATH_PREFIX = '/tmp/cascade-'
+
+function usage(): never {
+  logger.error(`usage: ${process.argv[1]} <template-sha>`)
+  process.exit(2)
+}
+
+const TEMPLATE_SHA = process.argv[2]
+if (!TEMPLATE_SHA) {
+  usage()
+}
+
+const SCRIPT_DIR = import.meta.dirname
+const FLEET_REPOS_FILE = path.join(SCRIPT_DIR, 'fleet-repos.txt')
+const PROJECTS = process.env['PROJECTS'] || path.join(homedir(), 'projects')
+// socket-hook: allow cross-repo
+const WH_SCRIPT = path.join(
+  PROJECTS,
+  'socket-wheelhouse',
+  'scripts',
+  'sync-scaffolding',
+  'cli.mts',
+)
+// socket-hook: allow cross-repo
+const CLEANUP_SCRIPT = path.join(
+  PROJECTS,
+  'socket-wheelhouse',
+  'scripts',
+  'cascade-tooling',
+  'cleanup-stranded.mts',
+)
+
+// Prepend the active Node version's bin dir to PATH so the `node` invoked by
+// the wheelhouse CLI matches the operator's expected toolchain (avoids the
+// pre-commit hook's "wrong Node" fallback). Honors NVM_BIN when set; otherwise
+// leaves PATH alone so a Volta / homebrew / system Node still resolves.
+if (process.env['NVM_BIN']) {
+  process.env['PATH'] = `${process.env['NVM_BIN']}:${process.env['PATH'] || ''}`
+}
+
+if (!existsSync(FLEET_REPOS_FILE)) {
+  logger.error(`fleet-repos.txt not found at ${FLEET_REPOS_FILE}`)
+  process.exit(2)
+}
+if (!existsSync(WH_SCRIPT)) {
+  logger.error(`wheelhouse sync-scaffolding CLI not found at ${WH_SCRIPT}`)
+  logger.error(
+    'set PROJECTS=<dir containing socket-wheelhouse> before retrying',
+  )
+  process.exit(2)
+}
+// CLEANUP_SCRIPT is optional — older wheelhouse checkouts won't have it.
+// When missing, skip auto-cleanup; the cascade still runs.
+
+const LOG_FILE = `${LOG_PATH_PREFIX}${TEMPLATE_SHA}.log`
+writeFileSync(LOG_FILE, '')
+
+function log(line: string): void {
+  logger.info(line)
+  appendFileSync(LOG_FILE, `${line}\n`)
+}
+
+const RESULTS: string[] = []
+
+log(`══ Cascade ${TEMPLATE_SHA} ══`)
+log(`Log: ${LOG_FILE}`)
+log('')
+
+// Resolve a canonical fleet repo name to a local primary checkout. Mirrors
+// scripts/sync-scaffolding/discover.mts directoryAliasesFor(): canonical
+// `socket-<x>` also resolves to `${PROJECTS}/<x>/`; canonical `<x>` (no
+// socket- prefix — sdxgen, stuie, ultrathink) also resolves to
+// `${PROJECTS}/socket-<x>/`. First primary checkout wins. Returns undefined
+// when no primary checkout exists.
+function resolveLocalCheckout(canonical: string): string | undefined {
+  let candidate = path.join(PROJECTS, canonical)
+  if (existsSync(path.join(candidate, '.git'))) {
+    return candidate
+  }
+  candidate = canonical.startsWith('socket-')
+    ? path.join(PROJECTS, canonical.slice('socket-'.length))
+    : path.join(PROJECTS, `socket-${canonical}`)
+  if (existsSync(path.join(candidate, '.git'))) {
+    return candidate
+  }
+  return undefined
+}
+
+type RunResult = {
+  status: number
+  stdout: string
+  stderr: string
+}
+
+function run(
+  cmd: string,
+  args: string[],
+  opts: { cwd: string; env?: NodeJS.ProcessEnv | undefined } = {
+    cwd: process.cwd(),
+  },
+): RunResult {
+  const r = spawnSync(cmd, args, {
+    cwd: opts.cwd,
+    env: opts.env ?? process.env,
+    encoding: 'utf8',
+  })
+  return {
+    status: r.status ?? 1,
+    stdout: r.stdout ?? '',
+    stderr: r.stderr ?? '',
+  }
+}
+
+function logTail(out: string, n: number): void {
+  const lines = out.split('\n').filter(Boolean)
+  for (const line of lines.slice(-n)) {
+    log(line)
+  }
+}
+
+function git(cwd: string, args: string[]): RunResult {
+  return run('git', args, { cwd })
+}
+
+function gitSilent(cwd: string, args: string[]): void {
+  // Used for best-effort cleanup that should not pollute output on failure
+  // (mirrors `2>/dev/null` in the original bash).
+  spawnSync('git', args, { cwd, stdio: 'ignore' })
+}
+
+function resolveBase(src: string): string {
+  const sym = git(src, ['symbolic-ref', 'refs/remotes/origin/HEAD'])
+  if (sym.status === 0) {
+    return sym.stdout.trim().replace(/^refs\/remotes\/origin\//, '')
+  }
+  for (const candidate of ['main', 'master']) {
+    if (
+      git(src, [
+        'show-ref',
+        '--verify',
+        '--quiet',
+        `refs/remotes/origin/${candidate}`,
+      ]).status === 0
+    ) {
+      return candidate
+    }
+  }
+  return 'main'
+}
+
+const fleetReposRaw = readFileSync(FLEET_REPOS_FILE, 'utf8').split('\n')
+
+for (const rawLine of fleetReposRaw) {
+  const repo = rawLine.trim()
+  if (!repo || repo.startsWith('#')) {
+    continue
+  }
+
+  const src = resolveLocalCheckout(repo)
+  const wt = path.join('/tmp', `cascade-${repo}-${process.pid}`)
+  log(`── ${repo} ──`)
+
+  if (!src) {
+    RESULTS.push(`${repo}|skip:no-git`)
+    continue
+  }
+
+  const base = resolveBase(src)
+  git(src, ['fetch', 'origin', base, '--quiet'])
+
+  // Auto-clean stranded cascade artifacts from earlier waves. Safety rails
+  // inside the script bail the repo (no-op) if anything looks ambiguous;
+  // only removes commits matching the cascade subject regex, authored by a
+  // trusted identity, touching only cascade-allowlisted files, and whose
+  // template SHA strictly precedes origin's current cascade SHA.
+  if (existsSync(CLEANUP_SCRIPT)) {
+    const cleanup = run('node', [CLEANUP_SCRIPT, '--target', src], { cwd: src })
+    logTail(cleanup.stdout + cleanup.stderr, 3)
+  }
+
+  const branch = `chore/sync-${TEMPLATE_SHA}`
+
+  gitSilent(src, ['worktree', 'remove', '--force', wt])
+  gitSilent(src, ['branch', '-D', branch])
+
+  const wtAdd = git(src, [
+    'worktree',
+    'add',
+    '-b',
+    branch,
+    wt,
+    `origin/${base}`,
+  ])
+  if (wtAdd.status !== 0) {
+    logTail(wtAdd.stdout + wtAdd.stderr, 1)
+    RESULTS.push(`${repo}|fail:worktree`)
+    continue
+  }
+  logTail(wtAdd.stdout + wtAdd.stderr, 1)
+
+  const sync = run('node', [WH_SCRIPT, '--target', wt, '--fix'], { cwd: wt })
+  logTail(sync.stdout + sync.stderr, 3)
+
+  const aheadOut = git(wt, ['rev-list', '--count', `origin/${base}..HEAD`])
+  const ahead =
+    aheadOut.status === 0 ? parseInt(aheadOut.stdout.trim(), 10) || 0 : 0
+  if (ahead === 0) {
+    const dirty = git(wt, ['status', '--porcelain']).stdout.trim()
+    if (!dirty) {
+      RESULTS.push(`${repo}|noop`)
+      gitSilent(src, ['worktree', 'remove', '--force', wt])
+      gitSilent(src, ['branch', '-D', branch])
+      continue
+    }
+    // FLEET_SYNC=1 + CI=true env is required: the sentinel allowlists exactly
+    // this commit through the no-revert-guard / overeager-staging-guard
+    // hooks. CI=true suppresses interactive pre-commit hook prompts.
+    const stageEnv = { ...process.env, FLEET_SYNC: '1', CI: 'true' }
+    git(wt, ['add', '--update'])
+    const commit = run(
+      'git',
+      [
+        'commit',
+        '--no-verify',
+        '-m',
+        `chore(sync): cascade fleet template@${TEMPLATE_SHA}`,
+      ],
+      { cwd: wt, env: stageEnv },
+    )
+    logTail(commit.stdout + commit.stderr, 2)
+    if (commit.status !== 0) {
+      RESULTS.push(`${repo}|fail:commit`)
+      gitSilent(src, ['worktree', 'remove', '--force', wt])
+      gitSilent(src, ['branch', '-D', branch])
+      continue
+    }
+  }
+
+  const pushEnv = { ...process.env, FLEET_SYNC: '1' }
+  const push = run('git', ['push', '--no-verify', 'origin', `HEAD:${base}`], {
+    cwd: wt,
+    env: pushEnv,
+  })
+  logTail(push.stdout + push.stderr, 2)
+  if (push.status === 0) {
+    RESULTS.push(`${repo}|push:${base}`)
+  } else {
+    const branchPush = run(
+      'git',
+      ['push', '--no-verify', '-u', 'origin', branch],
+      { cwd: wt, env: pushEnv },
+    )
+    logTail(branchPush.stdout + branchPush.stderr, 2)
+    if (branchPush.status === 0) {
+      const prCreate = run(
+        'gh',
+        [
+          'pr',
+          'create',
+          '--repo',
+          `SocketDev/${repo}`,
+          '--base',
+          base,
+          '--head',
+          branch,
+          '--title',
+          `chore(sync): cascade fleet template@${TEMPLATE_SHA}`,
+          '--body',
+          `Auto-cascade of socket-wheelhouse@${TEMPLATE_SHA}.`,
+        ],
+        { cwd: wt },
+      )
+      const prUrl =
+        (prCreate.stdout + prCreate.stderr)
+          .trim()
+          .split('\n')
+          .filter(Boolean)
+          .slice(-1)[0] ?? ''
+      RESULTS.push(`${repo}|pr:${prUrl}`)
+    } else {
+      RESULTS.push(`${repo}|fail:push+pr`)
+    }
+  }
+
+  gitSilent(src, ['worktree', 'remove', '--force', wt])
+  gitSilent(src, ['branch', '-D', branch])
+}
+
+log('')
+log('════ RESULTS ════')
+for (let i = 0, { length } = RESULTS; i < length; i += 1) {
+  const entry = RESULTS[i]!
+  log(`  ${entry}`)
+}
diff --git a/.claude/skills/cascading-fleet/lib/fleet-repos.json b/.claude/skills/cascading-fleet/lib/fleet-repos.json
new file mode 100644
index 0000000..627f86d
--- /dev/null
+++ b/.claude/skills/cascading-fleet/lib/fleet-repos.json
@@ -0,0 +1,58 @@
+{
+  "$schema": "./fleet-repos.schema.json",
+  "repos": [
+    {
+      "name": "socket-addon",
+      "description": "NAPI .node binaries for @socketaddon/* npm packages",
+      "optIns": ["squash-history"]
+    },
+    {
+      "name": "socket-bin",
+      "description": "SEA-packed CLI distributions for @socketbin/* packages",
+      "optIns": ["squash-history"]
+    },
+    {
+      "name": "socket-btm",
+      "description": "Build toolchain — produces signed prebuilt binaries for @socketaddon/* and @socketbin/*",
+      "optIns": ["squash-history"]
+    },
+    {
+      "name": "socket-cli",
+      "description": "Command-line interface for socket.dev security analysis"
+    },
+    {
+      "name": "socket-lib",
+      "description": "Core library: fs, processes, HTTP, logging, env detection"
+    },
+    {
+      "name": "socket-mcp",
+      "description": "Model Context Protocol server for socket.dev integration"
+    },
+    {
+      "name": "socket-packageurl-js",
+      "description": "purl spec implementation for JavaScript"
+    },
+    {
+      "name": "socket-registry",
+      "description": "Optimized package overrides for Socket Optimize"
+    },
+    {
+      "name": "socket-sdk-js",
+      "description": "JavaScript SDK for the socket.dev API"
+    },
+    {
+      "name": "sdxgen",
+      "description": "CycloneDX and SPDX manifest generator (Socket dx gen)",
+      "optIns": ["squash-history"]
+    },
+    {
+      "name": "stuie",
+      "description": "Terminal UI library: OpenTUI + yoga-layout + React",
+      "optIns": ["squash-history"]
+    },
+    {
+      "name": "socket-wheelhouse",
+      "description": "Internal scaffolding template for socket-* repos"
+    }
+  ]
+}
diff --git a/.claude/skills/cascading-fleet/lib/fleet-repos.txt b/.claude/skills/cascading-fleet/lib/fleet-repos.txt
index 52aaf95..84ea8f1 100644
--- a/.claude/skills/cascading-fleet/lib/fleet-repos.txt
+++ b/.claude/skills/cascading-fleet/lib/fleet-repos.txt
@@ -1,4 +1,5 @@
 socket-addon
+socket-bin
 socket-btm
 socket-cli
 socket-lib
@@ -6,5 +7,5 @@ socket-mcp
 socket-packageurl-js
 socket-registry
 socket-sdk-js
-socket-sdxgen
-socket-stuie
+sdxgen
+stuie
diff --git a/.claude/skills/cleaning-redundant-ci/SKILL.md b/.claude/skills/cleaning-redundant-ci/SKILL.md
new file mode 100644
index 0000000..38be26b
--- /dev/null
+++ b/.claude/skills/cleaning-redundant-ci/SKILL.md
@@ -0,0 +1,159 @@
+---
+name: cleaning-redundant-ci
+description: Sweeps a fleet repo (or every fleet repo) for redundant CI surface — orphan workflow YAML files (lint.yml / check.yml / type.yml / test.yml that the unified ci.yml replaced), GitHub-Dependabot auto-fix PRs that the fleet handles via /updating-security, and stale workflow run history in the Actions sidebar. Deletes the YAML files, disables Dependabot automated-security-fixes via gh api, and reports anything that needs a manual UI toggle. Once-and-never-again sweep — meant to leave a repo clean.
+user-invocable: true
+allowed-tools: Read, Edit, Write, Glob, Grep, Bash(gh:*), Bash(git:*), Bash(ls:*), Bash(rm:*), Bash(find:*), Bash(jq:*)
+---
+
+# cleaning-redundant-ci
+
+Audit + clean redundant CI surface on a Socket fleet repo. Three
+target classes:
+
+1. **Orphan workflow YAML files** — `lint.yml`, `check.yml`,
+   `type.yml`, `test.yml`. The fleet consolidated those into the
+   shared `ci.yml` (via `SocketDev/socket-registry/.github/workflows/ci.yml`)
+   long ago. Any per-repo file with those names is a leftover from
+   pre-consolidation days. Delete them.
+
+2. **GitHub-Dependabot automated security PRs** — the fleet pattern
+   is to handle vulnerability fixes via `/updating-security`
+   (pnpm `overrides:` for transitive deps), not via auto-PRs from
+   Dependabot. The `dependabot.yml` no-op file
+   (`open-pull-requests-limit: 0`) suppresses version-update PRs but
+   does NOT suppress security PRs — those flow from a separate
+   repo-settings toggle (`automated-security-fixes`). Disable via
+   `gh api -X DELETE /repos/{owner}/{repo}/automated-security-fixes`.
+
+3. **Stale workflow run history** — when a workflow YAML gets
+   deleted, the **runs** stay listed in the Actions sidebar forever
+   (the workflow appears as a name with no associated file). Delete
+   the workflow record via `gh api /repos/{owner}/{repo}/actions/workflows/{id} -X DELETE`
+   to remove the sidebar entry.
+
+## When to use
+
+- **Onboarding a new fleet repo** — sweep once on first integration
+  to clear any pre-fleet CI baggage.
+- **After a CI consolidation cascade** — when the fleet retires a
+  workflow shape (e.g. the lint/check/type/test → unified ci.yml
+  migration), run this skill on every fleet repo to clean up the
+  per-repo leftovers.
+- **Periodic fleet-wide health check** — run quarterly to catch
+  drift (someone adds a per-repo `lint.yml` to scratch an itch,
+  forgetting the unified ci.yml already covers it).
+
+## What it does NOT do
+
+- **Touch the `dependabot.yml` file.** That file MUST exist (GitHub
+  refuses to fully disable Dependabot without it) and the fleet
+  convention is to ship it pre-configured with
+  `open-pull-requests-limit: 0`. The skill leaves the file alone;
+  only the `automated-security-fixes` toggle is acted on.
+- **Touch `SocketDev/workflows`.** Don't edit org-level required
+  workflows from this skill — the org config is the source of truth
+  for what runs cross-repo, and silent edits are unsafe.
+- **Delete legitimate per-repo workflows.** socket-btm's per-binary
+  build dispatchers (`curl.yml`, `lief.yml`, etc.), ultrathink's
+  `build-*.yml`, socket-packageurl-js's `pages.yml` /`valtown.yml`,
+  socket-registry's `_local-not-for-reuse-*.yml` dogfood copies —
+  all stay. The skill only matches the four canonical orphan names.
+
+## Phases
+
+### Phase 1 — Inventory
+
+```sh
+# Orphan YAML files
+ls .github/workflows/ | grep -E '^(lint|check|type|test)\.ya?ml$'
+
+# Workflow records (live + stale)
+gh api "repos/{owner}/{repo}/actions/workflows" --paginate \
+  --jq '.workflows[] | "\(.id)\t\(.state)\t\(.name)\t\(.path)"'
+
+# Dependabot automated-security-fixes state
+gh api "repos/{owner}/{repo}/automated-security-fixes" --jq .enabled
+```
+
+Categorise each finding:
+
+- **delete-file**: orphan YAML on disk
+- **delete-record**: workflow record whose `.path` no longer exists
+  in the repo OR whose name matches the orphan pattern
+- **toggle-off**: `automated-security-fixes: true`
+
+### Phase 2 — File deletions (commit + push)
+
+```sh
+git rm .github/workflows/{lint,check,type,test}.yml 2>/dev/null
+git commit -m "chore(ci): remove orphan {lint,check,type,test} workflows — consolidated into ci.yml"
+```
+
+One commit per repo, conventional-commit subject. Push directly to
+main per fleet policy (or fall back to PR if branch protection
+requires).
+
+### Phase 3 — Workflow record deletions (gh api)
+
+For each delete-record finding:
+
+```sh
+gh api -X DELETE "repos/{owner}/{repo}/actions/workflows/{id}"
+```
+
+GitHub returns 204 on success. The record disappears from the
+Actions sidebar. Runs associated with the workflow remain in their
+own URLs but stop showing in the per-workflow filter.
+
+Skip workflow records that match `dynamic/dependabot/...` — those
+are GitHub-managed and can't be deleted via API. They'll stop
+appearing on their own once Dependabot has nothing to do (after
+Phase 4).
+
+### Phase 4 — Disable Dependabot automated-security-fixes
+
+```sh
+gh api -X DELETE "repos/{owner}/{repo}/automated-security-fixes"
+```
+
+204 = disabled. Going forward, security advisories are visible in
+the Security tab (via the `vulnerability-alerts` setting, which
+stays on) but won't open auto-PRs. The fleet's `/updating-security`
+skill is the canonical path for resolving them.
+
+### Phase 5 — Report
+
+For each repo: list what was deleted, what was disabled, and what
+needs manual UI action (rare — most things this skill touches are
+API-actionable).
+
+## Fleet-wide invocation
+
+```sh
+# One repo
+/cleaning-redundant-ci socket-foo
+
+# All fleet repos (reads template/.claude/skills/cascading-fleet/lib/fleet-repos.json)
+/cleaning-redundant-ci --all
+```
+
+The fleet-roster path is the canonical list — same file the cascade
+mechanism uses. Don't hard-code a repo list inside this skill.
+
+## Safety
+
+- **Read-only inventory first.** Print findings before any deletion.
+- **Per-repo confirmation** in interactive mode; `--yes` to skip.
+- **Direct push to main, fall back to PR** per fleet policy. Never
+  force-push.
+- **Never edit `dependabot.yml`** — only the `automated-security-fixes`
+  toggle. The .yml is structurally required.
+- **Never touch `SocketDev/workflows`.** Org-required workflows are
+  out of scope.
+
+## Why a skill, not a hook
+
+This is operator-invoked maintenance, not edit-time enforcement.
+Hooks are wrong shape: there's no `gh commit` or `gh push` event
+that should trigger a fleet-wide CI audit. Skills are user-callable,
+run on demand, and produce a one-shot report.
diff --git a/.claude/skills/greening-ci/run.mts b/.claude/skills/greening-ci/run.mts
index 1b4a7f3..cef1000 100644
--- a/.claude/skills/greening-ci/run.mts
+++ b/.claude/skills/greening-ci/run.mts
@@ -33,7 +33,7 @@ import path from 'node:path'
 import process from 'node:process'
 
 import { getDefaultLogger } from '@socketsecurity/lib/logger'
-import { spawn } from '@socketsecurity/lib/spawn'
+import { spawn } from '@socketsecurity/lib/spawn/spawn'
 
 const logger = getDefaultLogger()
 
diff --git a/.claude/skills/refreshing-history/run.mts b/.claude/skills/refreshing-history/run.mts
index 1c39d94..dec86b4 100644
--- a/.claude/skills/refreshing-history/run.mts
+++ b/.claude/skills/refreshing-history/run.mts
@@ -28,8 +28,10 @@ import { getDefaultLogger } from '@socketsecurity/lib/logger'
 const logger = getDefaultLogger()
 import process from 'node:process'
 
-import { errorMessage, isError } from '@socketsecurity/lib/errors'
-import { isSpawnError, spawn } from '@socketsecurity/lib/spawn'
+import { errorMessage } from '@socketsecurity/lib/errors'
+import { isError } from '@socketsecurity/lib/errors/predicates'
+import { isSpawnError } from '@socketsecurity/lib/spawn/errors'
+import { spawn } from '@socketsecurity/lib/spawn/spawn'
 
 import { resolveDefaultBranch } from '../_shared/scripts/git-default-branch.mts'
 
diff --git a/.claude/skills/reviewing-code/run.mts b/.claude/skills/reviewing-code/run.mts
index 2963c4a..df3e05b 100644
--- a/.claude/skills/reviewing-code/run.mts
+++ b/.claude/skills/reviewing-code/run.mts
@@ -17,10 +17,11 @@ import os from 'node:os'
 import path from 'node:path'
 import process from 'node:process'
 
-import { which } from '@socketsecurity/lib/bin'
-import { safeDelete } from '@socketsecurity/lib/fs'
+import { which } from '@socketsecurity/lib/bin/which'
+import { safeDelete } from '@socketsecurity/lib/fs/safe'
 import { getDefaultLogger } from '@socketsecurity/lib/logger'
-import { isSpawnError, spawn } from '@socketsecurity/lib/spawn'
+import { isSpawnError } from '@socketsecurity/lib/spawn/errors'
+import { spawn } from '@socketsecurity/lib/spawn/spawn'
 
 const logger = getDefaultLogger()
 
diff --git a/.claude/skills/scanning-quality/SKILL.md b/.claude/skills/scanning-quality/SKILL.md
index 3b4b01f..b8f6e3c 100644
--- a/.claude/skills/scanning-quality/SKILL.md
+++ b/.claude/skills/scanning-quality/SKILL.md
@@ -35,6 +35,7 @@ Modular scan types (one file per type under `scans/`, easier to extend than the
 10. **insecure-defaults** — fail-open defaults, hardcoded credentials, lazy fallbacks. See [`scans/insecure-defaults.md`](scans/insecure-defaults.md).
 11. **differential** — security-focused diff against a base ref. See [`scans/differential.md`](scans/differential.md).
 12. **bundle-trim** — for repos that ship a built bundle (today: rolldown), identify unused module paths the bundler statically pulled in but the runtime never reaches. Reports candidates; the trim loop itself lives in the [`trimming-bundle`](../trimming-bundle/SKILL.md) skill. See [`scans/bundle-trim.md`](scans/bundle-trim.md).
+13. **deadcode-removal** — surface dead source files, test-only helpers, stale `// eslint-disable` / `// oxlint-disable` directives, and dead string-literal constants. Critically captures the fleet rule that `socket/export-top-level-functions` REQUIRES `export` on helpers (exports exist for tests) — so the scan never recommends dropping `export` to colocate. See [`scans/deadcode-removal.md`](scans/deadcode-removal.md).
 
 Adding a new scan type: drop a file under `scans/<name>.md` describing mission, method, output shape, when-to-skip — same shape as the three above. The orchestrator picks them up by directory listing; no edits to this SKILL.md needed beyond appending to the list.
 
diff --git a/.claude/skills/updating-coverage/SKILL.md b/.claude/skills/updating-coverage/SKILL.md
new file mode 100644
index 0000000..3bac712
--- /dev/null
+++ b/.claude/skills/updating-coverage/SKILL.md
@@ -0,0 +1,119 @@
+---
+name: updating-coverage
+description: Refresh the coverage badge in the root README by running the repo's coverage script and rewriting the `![Coverage](https://img.shields.io/badge/coverage-<PCT>%25-brightgreen)` line. Sibling of `updating-security` / `updating-lockstep` under the `updating` umbrella.
+user-invocable: true
+allowed-tools: Read, Edit, Bash(pnpm run cover:*), Bash(pnpm run coverage:*), Bash(pnpm run test:cover:*), Bash(node:*), Bash(git:*), Bash(jq:*), Bash(cat:*)
+---
+
+# updating-coverage
+
+Runs the repo's coverage script and rewrites the README badge so the published number matches reality. Invoked directly via `/update-coverage` or as a phase of the `updating` umbrella.
+
+## When to use
+
+- After landing a substantial change to test coverage (added a major
+  feature with tests, removed a large untested module).
+- Pre-release, to refresh the public badge.
+- As part of `updating` umbrella flow when the repo declares a
+  coverage script.
+
+## What it does NOT do
+
+- **Generate coverage from scratch.** This skill consumes the
+  output of the repo's existing coverage tooling — vitest /
+  c8 / istanbul / node-test coverage. If no coverage script is
+  declared in `package.json`, the skill reports that and exits.
+- **Compute coverage thresholds.** The badge reflects what the
+  tooling reports; tightening the threshold is a separate decision
+  in the repo's vitest/c8 config.
+- **Modify nested READMEs.** Only the repo-root `README.md` is
+  rewritten. Nested READMEs under `packages/*` have their own
+  badges and lifecycles.
+
+## Phases
+
+| #   | Phase     | Outcome                                                                                                                         |
+| --- | --------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| 1   | Discovery | Find the coverage script in `package.json` (`cover` / `coverage` / `test:cover`, in that preference).                           |
+| 2   | Run       | `pnpm run <script>`. Capture stdout. Fail loudly if the run errors.                                                             |
+| 3   | Parse     | Extract the percentage. Two paths — read `coverage/coverage-summary.json` if present, otherwise scrape `All files \| ...` line. |
+| 4   | Rewrite   | Replace the `<PCT>` in the README badge URL with the parsed value (two decimals).                                               |
+| 5   | Commit    | `docs(readme): refresh coverage badge to N.NN%`. Direct-push per fleet norm.                                                    |
+
+## Phase 1 — discovery
+
+```sh
+node -e '
+const p = require("./package.json").scripts ?? {};
+for (const name of ["cover", "coverage", "test:cover"]) {
+  if (p[name]) { console.log(name); process.exit(0); }
+}
+process.exit(1);'
+```
+
+If no matching script exists, the skill emits `no coverage script found` and exits cleanly (this is not a failure mode — many fleet repos don't track coverage).
+
+## Phase 2 — run
+
+```sh
+pnpm run <SCRIPT>
+```
+
+Use the standard pnpm runner so we pick up the repo's own env config (catalog versions, etc.).
+
+## Phase 3 — parse
+
+**Preferred path** — read `coverage/coverage-summary.json` (vitest / istanbul format):
+
+```sh
+jq -r '.total.lines.pct' coverage/coverage-summary.json
+```
+
+The number is a float with one decimal place. Two decimals is the canonical badge format — pad with `.00` when needed.
+
+**Fallback path** — scrape the `All files | ...` line from coverage stdout:
+
+```sh
+pnpm run cover | tee /tmp/cover-output.txt
+awk -F '|' '/^All files/ { gsub(/ /, "", $2); print $2 }' /tmp/cover-output.txt
+```
+
+Whichever column the tool prints first (statements vs lines) is acceptable — the badge is approximate by design. Document the column choice in the commit message.
+
+## Phase 4 — rewrite
+
+The canonical badge line in `README.md` is:
+
+```markdown
+![Coverage](https://img.shields.io/badge/coverage-<PCT>%25-brightgreen)
+```
+
+Use the Edit tool to replace the `<PCT>` placeholder with the actual percentage. The `%25` is URL-encoded `%`; leave it alone.
+
+If the README has been canonicalized but the badge still reads `<PCT>` (e.g. just-canonicalized by the readme-skeleton work), Phase 4 substitutes; otherwise the existing number is replaced.
+
+## Phase 5 — commit
+
+```sh
+git add README.md
+git commit -m "docs(readme): refresh coverage badge to <N.NN>%"
+git push origin <default-branch>
+```
+
+Direct-push per the fleet's `Commits & PRs → Push policy` rule; fall back to PR if the remote rejects.
+
+## Output
+
+When called via `/update-coverage`, emit a one-line summary:
+
+```
+updated coverage badge: 96.42% → 97.18% (source: coverage/coverage-summary.json)
+```
+
+When no coverage script exists or the percentage is unchanged, exit silently.
+
+## Related
+
+- `.claude/skills/updating/SKILL.md` — umbrella that calls this skill when applicable.
+- `.claude/skills/updating-security/SKILL.md` — sibling under `updating`.
+- `template/README.md` — canonical README skeleton ships the placeholder badge.
diff --git a/.claude/skills/updating-security/SKILL.md b/.claude/skills/updating-security/SKILL.md
index 6427ac6..cdb51e3 100644
--- a/.claude/skills/updating-security/SKILL.md
+++ b/.claude/skills/updating-security/SKILL.md
@@ -36,16 +36,16 @@ them via the cheapest principled mechanism. Invoked directly via
 
 ## Phases
 
-| #   | Phase                | Outcome                                                                                                                       |
-| --- | -------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| 1   | Discover             | `gh api repos/{owner}/{repo}/dependabot/alerts?state=open`. Group by package + relationship (direct / transitive).            |
+| #   | Phase                | Outcome                                                                                                                        |
+| --- | -------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
+| 1   | Discover             | `gh api repos/{owner}/{repo}/dependabot/alerts?state=open`. Group by package + relationship (direct / transitive).             |
 | 2   | Classify             | Each alert → one of: `direct-fix` (bump `package.json`), `override-fix` (pnpm override for transitive), `dismiss-with-reason`. |
-| 3   | Apply direct fixes   | For each direct dep: `pnpm update <pkg>@<first-patched-version>` (or higher); commit per alert.                               |
-| 4   | Apply override fixes | For each transitive: add `pnpm.overrides[<pkg>]` to `package.json` pinning the patched range; `pnpm install`; commit per row. |
+| 3   | Apply direct fixes   | For each direct dep: `pnpm update <pkg>@<first-patched-version>` (or higher); commit per alert.                                |
+| 4   | Apply override fixes | For each transitive: add `pnpm.overrides[<pkg>]` to `package.json` pinning the patched range; `pnpm install`; commit per row.  |
 | 5   | Validate             | `pnpm run check --all` (interactive) or `pnpm run check --staged` (CI). Roll back any commit whose check fails.                |
-| 6   | Push                 | Per CLAUDE.md push policy — `git push origin <branch>`, fall back to PR on rejection. NEVER force-push.                       |
+| 6   | Push                 | Per CLAUDE.md push policy — `git push origin <branch>`, fall back to PR on rejection. NEVER force-push.                        |
 | 7   | Verify resolution    | After push lands, `gh api .../dependabot/alerts` should show each fixed alert as `auto_dismissed` or `fixed`. Log remaining.   |
-| 8   | Report               | Per-alert table: alert # / pkg / severity / action taken / state.                                                             |
+| 8   | Report               | Per-alert table: alert # / pkg / severity / action taken / state.                                                              |
 
 ## Hard requirements
 
diff --git a/.claude/skills/updating-security/reference.md b/.claude/skills/updating-security/reference.md
index 3237167..ae6e830 100644
--- a/.claude/skills/updating-security/reference.md
+++ b/.claude/skills/updating-security/reference.md
@@ -35,20 +35,20 @@ jq '. | length' /tmp/dependabot-alerts.json
   "number": 2,
   "state": "open",
   "dependency": {
-    "package":     { "ecosystem": "npm", "name": "brace-expansion" },
+    "package": { "ecosystem": "npm", "name": "brace-expansion" },
     "manifest_path": "pnpm-lock.yaml",
-    "scope":        "development",
+    "scope": "development",
     "relationship": "transitive"
   },
   "security_advisory": {
-    "ghsa_id":  "GHSA-jxxr-4gwj-5jf2",
+    "ghsa_id": "GHSA-jxxr-4gwj-5jf2",
     "severity": "medium",
-    "summary":  "Large numeric range defeats documented `max` DoS protection"
+    "summary": "Large numeric range defeats documented `max` DoS protection"
   },
   "security_vulnerability": {
-    "package":                  { "name": "brace-expansion" },
+    "package": { "name": "brace-expansion" },
     "vulnerable_version_range": ">= 5.0.0, < 5.0.6",
-    "first_patched_version":    { "identifier": "5.0.6" }
+    "first_patched_version": { "identifier": "5.0.6" }
   },
   "html_url": "https://github.com/SocketDev/<repo>/security/dependabot/2"
 }
@@ -112,9 +112,9 @@ For transitive deps, edit `package.json`:
       // CVE-2026-45149 — DoS via numeric range. Patched 5.0.6.
       "brace-expansion": "^5.0.6",
       // CVE-2026-41305 — XSS via unescaped </style>. Patched 8.5.10.
-      "postcss": "^8.5.10"
-    }
-  }
+      "postcss": "^8.5.10",
+    },
+  },
 }
 ```
 
@@ -221,7 +221,7 @@ should match the AWAITING-SOAK / DISMISS sets we tracked above.
 - Read one: `GET repos/{owner}/{repo}/dependabot/alerts/{number}`
 - Dismiss: `PATCH repos/{owner}/{repo}/dependabot/alerts/{number}`
   with body `{ "state": "dismissed", "dismissed_reason": "...",
-  "dismissed_comment": "..." }`
+"dismissed_comment": "..." }`
 
 Documented at:
 <https://docs.github.com/en/rest/dependabot/alerts>
@@ -230,13 +230,13 @@ Documented at:
 
 GitHub accepts exactly these values for `dismissed_reason`:
 
-| Value             | When to use                                                                |
-| ----------------- | -------------------------------------------------------------------------- |
-| `fix_started`     | A PR resolving the alert is already open in this repo.                     |
-| `inaccurate`      | The advisory mis-classifies our usage (e.g. server-only dep on a CLI repo). |
-| `no_bandwidth`    | Known, accepted, will revisit later — typical for low-severity transitives. |
-| `not_used`        | Dep is in the lockfile but not actually loaded at runtime.                 |
-| `tolerable_risk`  | Risk is understood and accepted; no remediation planned.                   |
+| Value            | When to use                                                                 |
+| ---------------- | --------------------------------------------------------------------------- |
+| `fix_started`    | A PR resolving the alert is already open in this repo.                      |
+| `inaccurate`     | The advisory mis-classifies our usage (e.g. server-only dep on a CLI repo). |
+| `no_bandwidth`   | Known, accepted, will revisit later — typical for low-severity transitives. |
+| `not_used`       | Dep is in the lockfile but not actually loaded at runtime.                  |
+| `tolerable_risk` | Risk is understood and accepted; no remediation planned.                    |
 
 Pick the most precise one; fleet convention prefers `inaccurate` /
 `not_used` (factual) over `tolerable_risk` (judgmental) when both
diff --git a/.claude/skills/updating/SKILL.md b/.claude/skills/updating/SKILL.md
index 74c267b..bf4a92a 100644
--- a/.claude/skills/updating/SKILL.md
+++ b/.claude/skills/updating/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: updating
-description: Umbrella update skill for a Socket fleet repo. Runs `pnpm run update` (npm), validates `lockstep.json` via `pnpm run lockstep` (if present), optionally bumps submodules, checks workflow SHA pins, and resolves open Dependabot security alerts. Use when asked to update dependencies, sync upstreams, fix security advisories, or prepare for a release.
+description: Umbrella update skill for a Socket fleet repo. Runs `pnpm run update` (npm), validates `lockstep.json` via `pnpm run lockstep` (if present), optionally bumps submodules, checks workflow SHA pins, resolves open Dependabot security alerts, refreshes the README coverage badge when applicable, and audits GitHub repo + Actions settings drift via `scripts/lint-github-settings.mts`. Use when asked to update dependencies, sync upstreams, fix security advisories, refresh coverage, or prepare for a release.
 user-invocable: true
 allowed-tools: Task, Skill, Read, Edit, Grep, Glob, Bash(pnpm run:*), Bash(pnpm test:*), Bash(pnpm install:*), Bash(git:*), Bash(claude --version)
 ---
@@ -22,21 +22,25 @@ Umbrella update skill. Runs `pnpm run update` for npm deps, then adapts to whate
 - **Other submodules** — repo-specific `updating-*` sub-skills handle `.gitmodules` entries not claimed by a lockstep `version-pin` row.
 - **Workflow SHA pins** — `_local-not-for-reuse-*.yml` SHAs against the remote's default branch (per CLAUDE.md _Default branch fallback_); run `/updating-workflows` when stale.
 - **Security advisories** — open GitHub Dependabot alerts via `/update-security`. Direct deps bumped via `pnpm update`; transitives pinned via `pnpm.overrides`; unfixable advisories dismissed with documented reasons. Honors the 7-day soak gate.
+- **Coverage badge** — when a coverage script exists (`cover` / `coverage` / `test:cover`), `/update-coverage` runs the script and rewrites the README badge to match. Repos without a coverage script skip silently.
+- **GitHub settings drift** — `scripts/lint-github-settings.mts --force --json` audits repo + Actions settings against the fleet baseline (custom properties, feature flags, merge policy, branch protection, required apps like `cursor` / `claude` / `socket-security`). Read-only by default; fixes are surfaced as URLs the operator clicks through (`--fix` is gated on `repo:admin`, not auto-applied in the umbrella). Skipped under `CI=true` — the underlying script's local-only design.
 
 This umbrella reads repo state first to discover what applies — sub-skills are only invoked when relevant.
 
 ## Phases
 
-| #   | Phase                | Outcome                                                                                                              |
-| --- | -------------------- | -------------------------------------------------------------------------------------------------------------------- |
-| 1   | Validate environment | Clean tree, detect CI mode (`CI=true` / `GITHUB_ACTIONS`), submodules initialized.                                   |
-| 2   | npm packages         | `pnpm run update` → atomic commit if anything moved.                                                                 |
-| 3   | Validate lockstep    | If `lockstep.json` exists: `pnpm run lockstep`. Exit 0 = clean, 1 = stop, 2 = drift (handled in Phase 4).            |
-| 4   | Apply drift          | 4a: lockstep auto-bumps (one commit per row). 4b: repo-specific `updating-*` sub-skills for non-lockstep submodules. |
-| 5   | Security advisories  | If `gh api .../dependabot/alerts?state=open` returns any rows, invoke `/update-security` (the `updating-security` sub-skill). Atomic commit per alert. |
-| 6   | Workflow SHA pins    | Compare pinned SHAs against `origin/$BASE`; report stale → `/updating-workflows`.                                    |
-| 7   | Final validation     | Interactive only: `pnpm run check --all && pnpm test && pnpm run build`. CI skips (validated separately).            |
-| 8   | Report               | Per-category summary: npm / lockstep / submodules / security / SHA pins / validation / next steps.                   |
+| #   | Phase                | Outcome                                                                                                                                                                                                                                                                                 |
+| --- | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1   | Validate environment | Clean tree, detect CI mode (`CI=true` / `GITHUB_ACTIONS`), submodules initialized.                                                                                                                                                                                                      |
+| 2   | npm packages         | `pnpm run update` → atomic commit if anything moved.                                                                                                                                                                                                                                    |
+| 3   | Validate lockstep    | If `lockstep.json` exists: `pnpm run lockstep`. Exit 0 = clean, 1 = stop, 2 = drift (handled in Phase 4).                                                                                                                                                                               |
+| 4   | Apply drift          | 4a: lockstep auto-bumps (one commit per row). 4b: repo-specific `updating-*` sub-skills for non-lockstep submodules.                                                                                                                                                                    |
+| 5   | Security advisories  | If `gh api .../dependabot/alerts?state=open` returns any rows, invoke `/update-security` (the `updating-security` sub-skill). Atomic commit per alert.                                                                                                                                  |
+| 6   | Workflow SHA pins    | Compare pinned SHAs against `origin/$BASE`; report stale → `/updating-workflows`.                                                                                                                                                                                                       |
+| 7   | Coverage badge       | If the repo declares a coverage script (`cover` / `coverage` / `test:cover`), invoke `/update-coverage` to refresh the README badge. Atomic commit if the percentage moved.                                                                                                             |
+| 8   | GH settings drift    | Skipped under `CI=true`. Otherwise: `node scripts/lint-github-settings.mts --force --json` and surface findings — repo-settings drift, missing apps (cursor/claude/socket-security/etc), custom-property/visibility mismatches. Read-only; operator follows the fixUrl in each finding. |
+| 9   | Final validation     | Interactive only: `pnpm run check --all && pnpm test && pnpm run build`. CI skips (validated separately).                                                                                                                                                                               |
+| 10  | Report               | Per-category summary: npm / lockstep / submodules / security / SHA pins / coverage / settings drift / validation / next steps.                                                                                                                                                          |
 
 Full bash, exit-code tables, mode contracts, and failure recovery in [`reference.md`](reference.md).
 
diff --git a/.claude/skills/updating/reference.md b/.claude/skills/updating/reference.md
index f658d62..b5002bb 100644
--- a/.claude/skills/updating/reference.md
+++ b/.claude/skills/updating/reference.md
@@ -2,6 +2,13 @@
 
 Long-form details for the `updating` umbrella skill — phase scripts, exit-code semantics, and per-mode contracts. The orchestration story lives in [`SKILL.md`](SKILL.md).
 
+Phase numbers below match SKILL.md's table. Phase 1 (Validate
+environment) is procedural and has no bash — see the SKILL.md
+description directly. Phase 5 (Security advisories) and Phase 7
+(Coverage badge) are documented in their respective sub-skill
+references: [`../updating-security/reference.md`](../updating-security/reference.md)
+and [`../updating-coverage/SKILL.md`](../updating-coverage/SKILL.md).
+
 ## Phase scripts
 
 ### Phase 2 — npm packages
@@ -65,7 +72,7 @@ fi
 
 If no `.gitmodules` exists, skip 4b.
 
-### Phase 5 — Workflow SHA pins
+### Phase 6 — Workflow SHA pins
 
 Resolve the default branch (per CLAUDE.md _Default branch fallback_), then compare:
 
@@ -86,7 +93,34 @@ else
 fi
 ```
 
-### Phase 6 — Final validation (skip in CI)
+### Phase 8 — GitHub settings drift (skip in CI)
+
+`scripts/lint-github-settings.mts` audits repo + Actions settings
+against the fleet baseline. Read-only by default; surfaces findings
+with a fixUrl for each (operator clicks through to apply). The
+underlying script's CI-skip is intentional — it has its own 7-day
+local cache and the umbrella honours that.
+
+```bash
+if [ "$CI" = "true" ] || [ -n "$GITHUB_ACTIONS" ]; then
+  echo "CI mode: skipping GH settings audit"
+elif [ -f scripts/lint-github-settings.mts ]; then
+  node scripts/lint-github-settings.mts --force --json | tee /tmp/gh-settings-audit.json
+  # Findings are not auto-fixed by the umbrella — operator decides
+  # per-finding whether to follow the URL or `pnpm exec node
+  # scripts/lint-github-settings.mts --fix` (needs repo:admin).
+else
+  echo "No scripts/lint-github-settings.mts in this repo; skip"
+fi
+```
+
+Common finding shapes (full taxonomy in `scripts/lint-github-settings.mts`):
+
+- `doesnt-touch-customers must match visibility` — public→`false`, private→`true`. Manual fix at `…/settings/custom-properties`.
+- `GitHub App must be installed: <slug>` — install via `https://github.com/apps/<slug>`. Current required apps: `claude`, `cursor`, `socket-security`, `socket-security-staging`, `socket-trufflehog`.
+- `<repo-setting> must be <value>` — usually fixable via `--fix` (needs `repo:admin`) or the GitHub UI link in the finding.
+
+### Phase 9 — Final validation (skip in CI)
 
 ```bash
 if [ "$CI" = "true" ] || [ -n "$GITHUB_ACTIONS" ]; then
@@ -98,7 +132,7 @@ else
 fi
 ```
 
-### Phase 7 — Report
+### Phase 10 — Report
 
 ```
 ## Update Complete
diff --git a/.config/.markdownlint-cli2.jsonc b/.config/.markdownlint-cli2.jsonc
new file mode 100644
index 0000000..c681a7c
--- /dev/null
+++ b/.config/.markdownlint-cli2.jsonc
@@ -0,0 +1,51 @@
+// markdownlint-cli2 configuration for fleet repos.
+//
+// Loaded by `pnpm run lint` (template/scripts/lint.mts invokes
+// markdownlint-cli2 with `-c .config/.markdownlint-cli2.jsonc`).
+//
+// Two concerns:
+//   1. Stock markdownlint rules — disable a handful that bite real prose
+//      without adding value, leave the rest at defaults.
+//   2. Fleet-canonical custom rules under markdownlint-rules/ — these
+//      enforce the fleet's README hygiene contract (no private-repo
+//      mentions, no relative-path commands, README skeleton structure).
+{
+  "config": {
+    "default": true,
+    // MD013 (line-length) bites code-block-heavy READMEs without warning.
+    // Disabled fleet-wide; reviewers catch genuinely-too-long prose.
+    "MD013": false,
+    // MD033 (no inline HTML) bites our <details> collapsed Development
+    // sections and Socket-badge img tags. Allow specific tags only.
+    "MD033": { "allowed_elements": ["details", "summary", "img", "br"] },
+    // MD041 (first-line-h1) is the contract; keep it on.
+    // MD024 (no-duplicate-heading) — siblings-only mode so that ### subsections
+    // can repeat under different ## parents (common in API docs).
+    "MD024": { "siblings_only": true },
+  },
+  // Globs: every *.md / *.mdx under the repo, except generated output,
+  // node_modules, vendored upstream trees, and CHANGELOG.md (auto-generated).
+  "globs": ["**/*.md", "**/*.mdx"],
+  "ignores": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/coverage/**",
+    "**/vendor/**",
+    "**/upstream/**",
+    "**/third_party/**",
+    "**/CHANGELOG.md",
+    // .claude/ markdown is internal scaffolding (hook READMEs, agent
+    // role files, skill SKILL.mds, command reminders) — scoped docs
+    // with their own shape conventions. Excluded from the public-
+    // facing markdown lint surface.
+    "**/.claude/**",
+  ],
+  // Custom rule plugins live under markdownlint-rules/, byte-identical
+  // across the fleet via sync-scaffolding manifest registration.
+  "customRules": [
+    "./markdownlint-rules/socket-no-private-wheelhouse-leak.mjs",
+    "./markdownlint-rules/socket-no-relative-sibling-script.mjs",
+    "./markdownlint-rules/socket-readme-required-sections.mjs",
+  ],
+}
diff --git a/.config/.prettierignore b/.config/.prettierignore
index f8193ad..6cbe4c6 100644
--- a/.config/.prettierignore
+++ b/.config/.prettierignore
@@ -31,3 +31,17 @@
 template/.claude/hooks/_shared/acorn/acorn.wasm
 template/.claude/hooks/_shared/acorn/acorn-bindgen.cjs
 .claude/hooks/_shared/acorn/acorn-bindgen.cjs
+
+# Vendored / upstream trees — kept byte-identical with their source
+# of truth. Per CLAUDE.md "Untracked-by-default for vendored / build-
+# copied trees": these are someone else's source, not ours, and the
+# formatter would happily rewrite (e.g.) an upstream HTML test
+# fixture or shipped third-party JS into our local style.
+**/upstream/**
+upstream/**
+**/vendor/**
+vendor/**
+**/third_party/**
+third_party/**
+**/external/**
+external/**
diff --git a/.config/markdownlint-rules/_shared/wheelhouse-self-skip.mjs b/.config/markdownlint-rules/_shared/wheelhouse-self-skip.mjs
new file mode 100644
index 0000000..9c52223
--- /dev/null
+++ b/.config/markdownlint-rules/_shared/wheelhouse-self-skip.mjs
@@ -0,0 +1,40 @@
+/**
+ * @file Shared helper for fleet markdown rules: detect whether the lint is
+ *   running inside socket-wheelhouse itself, in which case the rule should
+ *   bail. The custom rules in this directory exist to protect PUBLIC fleet
+ *   consumers from leaking internal scaffolding; wheelhouse referencing itself
+ *   in its own docs is the canonical case and must not trigger. Detection
+ *   prefers explicit env override (CI sets SOCKET_FLEET_REPO_NAME) then falls
+ *   back to checking the cwd's basename and git remote.
+ */
+
+// oxlint-disable-next-line socket/prefer-async-spawn -- markdownlint-cli2 calls isInsideWheelhouse() synchronously at rule init; an async spawn would require the rule loader to await, which markdownlint-cli2 doesnt support.
+import { spawnSync } from 'node:child_process'
+import path from 'node:path'
+import process from 'node:process'
+
+export function isInsideWheelhouse() {
+  const envName = process.env['SOCKET_FLEET_REPO_NAME']
+  if (envName) {
+    return envName === 'socket-wheelhouse'
+  }
+  const cwd = process.cwd()
+  if (path.basename(cwd) === 'socket-wheelhouse') {
+    return true
+  }
+  // Fallback: probe the git remote URL. Tolerates renamed local
+  // checkout dirs (`~/projects/wheelhouse/` would still match).
+  // spawnSync (not execSync) — array args, no shell interpolation.
+  // This file is loaded by markdownlint-cli2 as a regular ESM module,
+  // not bundled, so we cant pull in @socketsecurity/lib-stable/spawn —
+  // node:child_process spawnSync is the canonical fallback.
+  const r = spawnSync('git', ['config', '--get', 'remote.origin.url'], {
+    cwd,
+    stdio: ['ignore', 'pipe', 'ignore'],
+  })
+  if (r.status !== 0 || !r.stdout) {
+    return false
+  }
+  const remote = r.stdout.toString().trim()
+  return /[/:]socket-wheelhouse(?:\.git)?$/.test(remote)
+}
diff --git a/.config/markdownlint-rules/socket-no-private-wheelhouse-leak.mjs b/.config/markdownlint-rules/socket-no-private-wheelhouse-leak.mjs
new file mode 100644
index 0000000..ae4dbda
--- /dev/null
+++ b/.config/markdownlint-rules/socket-no-private-wheelhouse-leak.mjs
@@ -0,0 +1,61 @@
+/**
+ * @file Flag mentions of `socket-wheelhouse` in public-facing markdown.
+ *   socket-wheelhouse is a private repo. Public READMEs / docs / release notes
+ *   that link to it leak the internal tooling layout to users who can't access
+ *   the link anyway. Whatever the markdown is trying to teach should be
+ *   rewritten to not require the reference. Detects:
+ *
+ *   - The literal token `socket-wheelhouse` (case-insensitive) anywhere in a
+ *     line.
+ *   - `https://github.com/SocketDev/socket-wheelhouse...` URL forms. Skips fenced
+ *     code blocks because those are intentional examples (and fenced-block
+ *     scanning would false-positive on the very markdownlint config that
+ *     references this file). No autofix: the right rewrite is contextual.
+ */
+
+import { isInsideWheelhouse } from './_shared/wheelhouse-self-skip.mjs'
+
+const RULE_NAME = 'socket-no-private-wheelhouse-leak'
+const FORBIDDEN_TOKEN_RE = /socket-wheelhouse/i
+
+/**
+ * @type {import('markdownlint').Rule}
+ */
+const rule = {
+  names: [RULE_NAME, 'socket/no-private-wheelhouse-leak'],
+  description:
+    'socket-wheelhouse is a private repo — never reference it in public markdown',
+  tags: ['socket', 'privacy'],
+  parser: 'none',
+  function(params, onError) {
+    if (isInsideWheelhouse()) {
+      return
+    }
+    let inFence = false
+    for (let i = 0; i < params.lines.length; i += 1) {
+      const line = params.lines[i]
+      // Track fenced-code state. Open/close on lines that START with ``` or ~~~.
+      if (/^\s*(?:```|~~~)/.test(line)) {
+        inFence = !inFence
+        continue
+      }
+      if (inFence) {
+        continue
+      }
+      const match = FORBIDDEN_TOKEN_RE.exec(line)
+      if (!match) {
+        continue
+      }
+      onError({
+        lineNumber: i + 1,
+        detail:
+          'Rewrite to not mention socket-wheelhouse — it is a private repo and the link will 404 for outside readers.',
+        context: line.trim().slice(0, 120),
+        range: [match.index + 1, match[0].length],
+      })
+    }
+  },
+}
+
+// oxlint-disable-next-line socket/no-default-export -- markdownlint-cli2 loads custom rules via dynamic import and expects the default export to be the rule object.
+export default rule
diff --git a/.config/markdownlint-rules/socket-no-relative-sibling-script.mjs b/.config/markdownlint-rules/socket-no-relative-sibling-script.mjs
new file mode 100644
index 0000000..7fe4453
--- /dev/null
+++ b/.config/markdownlint-rules/socket-no-relative-sibling-script.mjs
@@ -0,0 +1,67 @@
+/**
+ * @file Flag commands that reference sibling repos via relative paths. `node
+ *   ../socket-foo/scripts/bar.mts` in a fleet README assumes the reader has the
+ *   sibling repo checked out at exactly the right level relative to the current
+ *   repo. That's almost never true for an outside user, and the command
+ *   silently fails. Detects (inside fenced code blocks and inline `code`):
+ *
+ *   - `node ../<segment>/...` invocations
+ *   - `pnpm ../<segment>/...` invocations
+ *   - Bare `../socket-<segment>/...` references in code/inline-code Skips:
+ *     relative paths to the current repo's own tree (`./scripts/`,
+ *     `../package.json` within a monorepo), which are useful and don't leak
+ *     sibling state. No autofix: the rewrite is to either inline the script's
+ *     content or publish the helper to npm and reference the published name.
+ */
+
+import { isInsideWheelhouse } from './_shared/wheelhouse-self-skip.mjs'
+
+const RULE_NAME = 'socket-no-relative-sibling-script'
+const SIBLING_PATH_RES = [
+  // Detect `<runner> ../<sibling>/...` where runner is one of the common
+  // JS/TS toolchain binaries (any runtime invocation).
+  /\b(?:bun|deno|node|npm|pnpm|yarn)\s+\.\.\/[\w@-]+\//,
+  // Detect bare ../<segment>/ where the first segment doesn't start with `.`
+  // (i.e. genuine sibling, not the current repo's `..` for monorepo packages).
+  // `(?:^|\s)` alternation order is the canonical regex idiom (anchor-first).
+  /(?:^|\s)\.\.\/socket-[\w-]+\//i, // socket-hook: allow regex-alternation-order
+  /(?:^|\s)\.\.\/sdxgen\//, // socket-hook: allow regex-alternation-order
+  /(?:^|\s)\.\.\/stuie\//, // socket-hook: allow regex-alternation-order
+]
+
+/**
+ * @type {import('markdownlint').Rule}
+ */
+const rule = {
+  names: [RULE_NAME, 'socket/no-relative-sibling-script'],
+  description:
+    'Commands referencing sibling fleet repos via relative paths fail for outside readers',
+  tags: ['socket', 'fleet'],
+  parser: 'none',
+  function(params, onError) {
+    if (isInsideWheelhouse()) {
+      return
+    }
+    for (let i = 0; i < params.lines.length; i += 1) {
+      const line = params.lines[i]
+      for (let j = 0; j < SIBLING_PATH_RES.length; j += 1) {
+        const re = SIBLING_PATH_RES[j]
+        const match = re.exec(line)
+        if (!match) {
+          continue
+        }
+        onError({
+          lineNumber: i + 1,
+          detail:
+            'Rewrite the command to not depend on a sibling-repo checkout. Inline the script, link to its source on GitHub, or publish the helper to npm and reference the package name.',
+          context: line.trim().slice(0, 120),
+          range: [match.index + 1, match[0].length],
+        })
+        break
+      }
+    }
+  },
+}
+
+// oxlint-disable-next-line socket/no-default-export -- markdownlint-cli2 loads custom rules via dynamic import and expects the default export to be the rule object.
+export default rule
diff --git a/.config/markdownlint-rules/socket-readme-required-sections.mjs b/.config/markdownlint-rules/socket-readme-required-sections.mjs
new file mode 100644
index 0000000..61e4342
--- /dev/null
+++ b/.config/markdownlint-rules/socket-readme-required-sections.mjs
@@ -0,0 +1,93 @@
+/**
+ * @file Enforce the canonical fleet README section list. Fires only on the
+ *   repo-root `README.md` (skipped for nested READMEs under `packages/`,
+ *   `docs/`, `.claude/`, etc. — those are scoped docs with their own shape).
+ *   Every fleet root README must contain five level-2 sections in this order:
+ *
+ *   1. Why this repo exists
+ *   2. Install
+ *   3. Usage
+ *   4. Development
+ *   5. License The canonical skeleton lives at
+ *      socket-wheelhouse/template/README.md. Additional sections between/after
+ *      these are allowed; reordering / missing / typo'd sections are findings.
+ *      No autofix: a missing section needs content, not just a heading.
+ */
+
+import path from 'node:path'
+
+import { isInsideWheelhouse } from './_shared/wheelhouse-self-skip.mjs'
+
+const RULE_NAME = 'socket-readme-required-sections'
+const REQUIRED_SECTIONS = [
+  'Why this repo exists',
+  'Install',
+  'Usage',
+  'Development',
+  'License',
+]
+
+export function isRootReadme(filePath) {
+  // markdownlint passes `params.name` as a path relative to the working
+  // dir. The root README is the one whose basename is README.md AND
+  // whose directory is the cwd or `.`.
+  if (!filePath) {
+    return false
+  }
+  const base = path.basename(filePath)
+  if (base !== 'README.md') {
+    return false
+  }
+  const dir = path.dirname(filePath)
+  return dir === '.' || dir === '' || dir === process.cwd()
+}
+
+/**
+ * @type {import('markdownlint').Rule}
+ */
+const rule = {
+  names: [RULE_NAME, 'socket/readme-required-sections'],
+  description:
+    'Fleet root README must contain the canonical five sections in order',
+  tags: ['socket', 'fleet', 'readme'],
+  parser: 'none',
+  function(params, onError) {
+    if (isInsideWheelhouse()) {
+      return
+    }
+    if (!isRootReadme(params.name)) {
+      return
+    }
+    const headings = []
+    for (let i = 0; i < params.lines.length; i += 1) {
+      const line = params.lines[i]
+      const m = /^##\s+(.+?)\s*$/.exec(line)
+      if (m) {
+        headings.push({ text: m[1], lineNumber: i + 1 })
+      }
+    }
+    let cursor = 0
+    for (let r = 0; r < REQUIRED_SECTIONS.length; r += 1) {
+      const want = REQUIRED_SECTIONS[r]
+      let found = -1
+      for (let h = cursor; h < headings.length; h += 1) {
+        if (headings[h].text === want) {
+          found = h
+          break
+        }
+      }
+      if (found === -1) {
+        onError({
+          lineNumber: 1,
+          detail: `Missing required section "## ${want}" (or it appears out of order). Canonical order: ${REQUIRED_SECTIONS.map(s => `"## ${s}"`).join(' → ')}.`,
+          context: `README.md: required section "## ${want}" not found after position ${cursor}`,
+        })
+        return
+      }
+      cursor = found + 1
+    }
+  },
+}
+
+// oxlint-disable-next-line socket/no-default-export -- markdownlint-cli2 loads custom rules via dynamic import and expects the default export to be the rule object.
+export default rule
diff --git a/.config/oxlint-plugin/index.mts b/.config/oxlint-plugin/index.mts
index ce9951f..8c32db5 100644
--- a/.config/oxlint-plugin/index.mts
+++ b/.config/oxlint-plugin/index.mts
@@ -40,6 +40,7 @@ import preferExistsSync from './rules/prefer-exists-sync.mts'
 import preferFunctionDeclaration from './rules/prefer-function-declaration.mts'
 import preferNodeBuiltinImports from './rules/prefer-node-builtin-imports.mts'
 import preferNodeModulesDotCache from './rules/prefer-node-modules-dot-cache.mts'
+import preferNonCapturingGroup from './rules/prefer-non-capturing-group.mts'
 import preferSafeDelete from './rules/prefer-safe-delete.mts'
 import preferSeparateTypeImport from './rules/prefer-separate-type-import.mts'
 import preferSpawnOverExecsync from './rules/prefer-spawn-over-execsync.mts'
@@ -95,6 +96,7 @@ const plugin = {
     'prefer-function-declaration': preferFunctionDeclaration,
     'prefer-node-builtin-imports': preferNodeBuiltinImports,
     'prefer-node-modules-dot-cache': preferNodeModulesDotCache,
+    'prefer-non-capturing-group': preferNonCapturingGroup,
     'prefer-safe-delete': preferSafeDelete,
     'prefer-separate-type-import': preferSeparateTypeImport,
     'prefer-spawn-over-execsync': preferSpawnOverExecsync,
diff --git a/.config/oxlint-plugin/lib/rule-tester.mts b/.config/oxlint-plugin/lib/rule-tester.mts
index cbbab03..b3f4b87 100644
--- a/.config/oxlint-plugin/lib/rule-tester.mts
+++ b/.config/oxlint-plugin/lib/rule-tester.mts
@@ -34,14 +34,14 @@
  *   })
  */
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
-import { safeDeleteSync } from '@socketsecurity/lib-stable/fs'
+import { safeDeleteSync } from '@socketsecurity/lib-stable/fs/safe'
 
 const logger = getDefaultLogger()
 
diff --git a/.config/oxlint-plugin/rules/max-file-lines.mts b/.config/oxlint-plugin/rules/max-file-lines.mts
index 46b1c44..c85a80e 100644
--- a/.config/oxlint-plugin/rules/max-file-lines.mts
+++ b/.config/oxlint-plugin/rules/max-file-lines.mts
@@ -27,7 +27,7 @@ const SOFT_CAP = 500
 const HARD_CAP = 1000
 
 const BYPASS_RE =
-  /max-file-lines:\s*(legitimate|parser|state[- ]?machine|table)/i
+  /max-file-lines:\s*(?:legitimate|parser|state[- ]?machine|table)/i
 
 /**
  * @type {import('eslint').Rule.RuleModule}
diff --git a/.config/oxlint-plugin/rules/prefer-async-spawn.mts b/.config/oxlint-plugin/rules/prefer-async-spawn.mts
index bbf133a..3e52577 100644
--- a/.config/oxlint-plugin/rules/prefer-async-spawn.mts
+++ b/.config/oxlint-plugin/rules/prefer-async-spawn.mts
@@ -1,6 +1,6 @@
 /**
  * @file Per CLAUDE.md "Subprocesses" rule: Prefer async `spawn` from
- *   `@socketsecurity/lib-stable/spawn` over `spawnSync` from
+ *   `@socketsecurity/lib-stable/spawn/spawn` over `spawnSync` from
  *   `node:child_process`. Async unblocks parallel tests / event-loop work; the
  *   sync version freezes the runner for the duration of the child. Use
  *   `spawnSync` only when you genuinely need synchronous semantics. Detects:
@@ -13,19 +13,20 @@
  *     async core spawn lacks the lib's SpawnError shape. Autofix scope
  *     (deterministic; no AI required) — sync-aware: The lib re-exports BOTH
  *     `spawn` and `spawnSync`. The autofix only ever rewrites the import source
- *     (`node:child_process` → `@socketsecurity/lib-stable/spawn`); it never
- *     changes the imported name, never collapses `spawnSync` into `spawn`, and
- *     never touches call sites. Converting sync → async is a semantic change
- *     (callers must `await`, return types change from objects to promises) and
- *     that's a human-eyes job, not an autofix. Skipped when: a) any non-spawn
- *     named import (e.g. `exec`, `execSync`, `ChildProcess`) shares the same
- *     statement — the lib doesn't re-export those, so we can't safely rewrite
- *     the whole line. Allowed exceptions:
+ *     (`node:child_process` → `@socketsecurity/lib-stable/spawn/spawn`); it
+ *     never changes the imported name, never collapses `spawnSync` into
+ *     `spawn`, and never touches call sites. Converting sync → async is a
+ *     semantic change (callers must `await`, return types change from objects
+ *     to promises) and that's a human-eyes job, not an autofix. Skipped when:
+ *     a) any non-spawn named import (e.g. `exec`, `execSync`, `ChildProcess`)
+ *     shares the same statement — the lib doesn't re-export those, so we can't
+ *     safely rewrite the whole line. Allowed exceptions:
  *   - Adjacent comment with `prefer-async-spawn: sync-required` — for top-level
  *     scripts whose entire flow is sync (per CLAUDE.md "Reserve `spawnSync` for
  *     top-level scripts whose entire flow is sync").
- *   - Files inside `@socketsecurity/lib-stable/spawn` itself — they wrap the core
- *     APIs. Handled at the .config/oxlintrc.json ignorePatterns level.
+ *   - Files inside `@socketsecurity/lib-stable/spawn/spawn` itself — they wrap
+ *     the core APIs. Handled at the .config/oxlintrc.json ignorePatterns
+ *     level.
  */
 
 import type { AstNode, RuleContext, RuleFixer } from '../lib/rule-types.mts'
@@ -35,7 +36,7 @@ const CHILD_PROCESS_SPECIFIERS = new Set([
   'node:child_process',
 ])
 
-const LIB_SPECIFIER = '@socketsecurity/lib-stable/spawn'
+const LIB_SPECIFIER = '@socketsecurity/lib-stable/spawn/spawn'
 
 const BANNED_NAMES = new Set(['spawn', 'spawnSync'])
 
@@ -49,16 +50,16 @@ const rule = {
     type: 'problem',
     docs: {
       description:
-        'Use `spawn` from @socketsecurity/lib-stable/spawn instead of `spawnSync` / core `spawn` from node:child_process.',
+        'Use `spawn` from @socketsecurity/lib-stable/spawn/spawn instead of `spawnSync` / core `spawn` from node:child_process.',
       category: 'Best Practices',
       recommended: true,
     },
     fixable: 'code',
     messages: {
       importBanned:
-        'Importing `{{name}}` from {{specifier}} — use `spawn` from @socketsecurity/lib-stable/spawn. Async unblocks parallel work and the lib ships consistent error shapes (SpawnError).',
+        'Importing `{{name}}` from {{specifier}} — use `spawn` from @socketsecurity/lib-stable/spawn/spawn. Async unblocks parallel work and the lib ships consistent error shapes (SpawnError).',
       callBanned:
-        'Calling `child_process.{{name}}(...)` — use `spawn` from @socketsecurity/lib-stable/spawn instead.',
+        'Calling `child_process.{{name}}(...)` — use `spawn` from @socketsecurity/lib-stable/spawn/spawn instead.',
     },
     schema: [],
   },
@@ -177,7 +178,7 @@ const rule = {
         if (!objName) {
           return
         }
-        if (!/^(childProcess|child_process|cp)$/.test(objName)) {
+        if (!/^(?:childProcess|child_process|cp)$/.test(objName)) {
           return
         }
         if (hasBypassComment(node)) {
diff --git a/.config/oxlint-plugin/rules/prefer-cached-for-loop.mts b/.config/oxlint-plugin/rules/prefer-cached-for-loop.mts
index 3f43f2a..94fbbcf 100644
--- a/.config/oxlint-plugin/rules/prefer-cached-for-loop.mts
+++ b/.config/oxlint-plugin/rules/prefer-cached-for-loop.mts
@@ -340,8 +340,16 @@ const rule = {
         // integer-indexable). The companion rule
         // socket/no-cached-for-on-iterable would then flag what THIS
         // rule just wrote. Skip silently rather than fight ourselves.
+        //
+        // Also skip when the kind can't be determined from the AST
+        // (e.g. `await fn()` / `someCall()` initializers without a
+        // type annotation). Without type info we can't prove the
+        // iterable is integer-indexable, and autofixing produces
+        // broken code (Set.length / Set[i]) on the wrong guess.
+        // Require explicit array shape (literal, type annotation,
+        // Array.from, Object.keys/values/entries) to opt in.
         const iterKind = resolveKind(node, iter.name as string)
-        if (FLAGGED_KINDS.has(iterKind)) {
+        if (FLAGGED_KINDS.has(iterKind) || iterKind === 'unknown') {
           return
         }
         if (node.body.type !== 'BlockStatement') {
diff --git a/.config/oxlint-plugin/rules/prefer-safe-delete.mts b/.config/oxlint-plugin/rules/prefer-safe-delete.mts
index d24ea15..38c38cb 100644
--- a/.config/oxlint-plugin/rules/prefer-safe-delete.mts
+++ b/.config/oxlint-plugin/rules/prefer-safe-delete.mts
@@ -1,16 +1,16 @@
 /**
  * @file Per CLAUDE.md "File deletion" rule: route every delete through
- *   `safeDelete()` / `safeDeleteSync()` from `@socketsecurity/lib-stable/fs`.
- *   Never `fs.rm` / `fs.unlink` / `fs.rmdir` / `rm -rf` directly — even for one
- *   known file. Detects:
+ *   `safeDelete()` / `safeDeleteSync()` from
+ *   `@socketsecurity/lib-stable/fs/safe`. Never `fs.rm` / `fs.unlink` /
+ *   `fs.rmdir` / `rm -rf` directly — even for one known file. Detects:
  *
  *   - `fs.rm(...)` / `fs.rmSync(...)` / `fs.promises.rm(...)`
  *   - `fs.unlink(...)` / `fs.unlinkSync(...)`
  *   - `fs.rmdir(...)` / `fs.rmdirSync(...)` Autofix: rewrites the call to
  *     `safeDelete(path)` / `safeDeleteSync(path)` AND injects `import {
- *     safeDelete } from '@socketsecurity/lib-stable/fs'` (or `safeDeleteSync`)
- *     when missing. The autofix is conservative — it only fires when the call
- *     shape is "obviously equivalent" to safeDelete:
+ *     safeDelete } from '@socketsecurity/lib-stable/fs/safe'` (or
+ *     `safeDeleteSync`) when missing. The autofix is conservative — it only
+ *     fires when the call shape is "obviously equivalent" to safeDelete:
  *   - The first argument is a single expression (the path).
  *   - Any second argument is an options object literal (we drop it; safeDelete
  *     handles recursive/force internally).
@@ -47,14 +47,14 @@ const rule = {
     type: 'problem',
     docs: {
       description:
-        'Route every delete through safeDelete / safeDeleteSync from @socketsecurity/lib-stable/fs.',
+        'Route every delete through safeDelete / safeDeleteSync from @socketsecurity/lib-stable/fs/safe.',
       category: 'Best Practices',
       recommended: true,
     },
     fixable: 'code',
     messages: {
       banned:
-        'fs.{{method}}() — use safeDelete / safeDeleteSync from @socketsecurity/lib-stable/fs. The lib wrapper handles ENOENT, retries on EBUSY, and integrates with the rest of the fleet.',
+        'fs.{{method}}() — use safeDelete / safeDeleteSync from @socketsecurity/lib-stable/fs/safe. The lib wrapper handles ENOENT, retries on EBUSY, and integrates with the rest of the fleet.',
     },
     schema: [],
   },
@@ -79,7 +79,7 @@ const rule = {
       }
       s = summarizeImportTarget(
         sourceCode.ast,
-        '@socketsecurity/lib-stable/fs',
+        '@socketsecurity/lib-stable/fs/safe',
         importName,
       )
       summaryCache.set(importName, s)
@@ -181,7 +181,7 @@ const rule = {
               ...appendImportFixes(
                 s,
                 fixer,
-                `import { ${replacement} } from '@socketsecurity/lib-stable/fs'`,
+                `import { ${replacement} } from '@socketsecurity/lib-stable/fs/safe'`,
                 undefined,
               ),
             ]
diff --git a/.config/oxlint-plugin/rules/prefer-spawn-over-execsync.mts b/.config/oxlint-plugin/rules/prefer-spawn-over-execsync.mts
index 3b728e0..c1dcc71 100644
--- a/.config/oxlint-plugin/rules/prefer-spawn-over-execsync.mts
+++ b/.config/oxlint-plugin/rules/prefer-spawn-over-execsync.mts
@@ -1,7 +1,7 @@
 /**
  * @file Per the fleet "Subprocesses" rule: prefer `spawn` from
- *   `@socketsecurity/lib-stable/spawn` over `execSync` / `execFileSync` from
- *   `node:child_process`. Two reasons:
+ *   `@socketsecurity/lib-stable/spawn/spawn` over `execSync` / `execFileSync`
+ *   from `node:child_process`. Two reasons:
  *
  *   1. Command-injection surface — `execSync(cmd)` runs `cmd` through a shell; any
  *      string concatenation into `cmd` is a potential injection vector.
@@ -24,8 +24,8 @@
  *   - Adjacent comment with `prefer-spawn-over-execsync: required` — for callers
  *     who genuinely need shell expansion (e.g. expanding env vars mid-command).
  *     Rare; document why.
- *   - Files inside `@socketsecurity/lib-stable/spawn` itself — handled at the
- *     .config/oxlintrc.json ignorePatterns level.
+ *   - Files inside `@socketsecurity/lib-stable/spawn/spawn` itself — handled at
+ *     the .config/oxlintrc.json ignorePatterns level.
  */
 
 import type { AstNode, RuleContext } from '../lib/rule-types.mts'
@@ -47,16 +47,16 @@ const rule = {
     type: 'problem',
     docs: {
       description:
-        'Use `spawn` from @socketsecurity/lib-stable/spawn instead of `execSync` / `execFileSync` from node:child_process.',
+        'Use `spawn` from @socketsecurity/lib-stable/spawn/spawn instead of `execSync` / `execFileSync` from node:child_process.',
       category: 'Best Practices',
       recommended: true,
     },
     fixable: undefined,
     messages: {
       importBanned:
-        'Importing `{{name}}` from {{specifier}} — use `spawn` (or `spawnSync` for top-level-sync) from @socketsecurity/lib-stable/spawn. `execSync` runs through a shell (command-injection surface); array-arg `spawn` does not. The lib also ships a typed SpawnError shape — `execSync` errors are plain Errors with no structured fields.',
+        'Importing `{{name}}` from {{specifier}} — use `spawn` (or `spawnSync` for top-level-sync) from @socketsecurity/lib-stable/spawn/spawn. `execSync` runs through a shell (command-injection surface); array-arg `spawn` does not. The lib also ships a typed SpawnError shape — `execSync` errors are plain Errors with no structured fields.',
       callBanned:
-        'Calling `{{obj}}.{{name}}(...)` — use `spawn` from @socketsecurity/lib-stable/spawn instead. Avoids shell-interpolation injection paths; ships consistent SpawnError shape.',
+        'Calling `{{obj}}.{{name}}(...)` — use `spawn` from @socketsecurity/lib-stable/spawn/spawn instead. Avoids shell-interpolation injection paths; ships consistent SpawnError shape.',
     },
     schema: [],
   },
@@ -137,7 +137,7 @@ const rule = {
         if (!objName) {
           return
         }
-        if (!/^(childProcess|child_process|cp)$/.test(objName)) {
+        if (!/^(?:childProcess|child_process|cp)$/.test(objName)) {
           return
         }
         if (hasBypassComment(node)) {
diff --git a/.config/oxlint-plugin/rules/socket-api-token-env.mts b/.config/oxlint-plugin/rules/socket-api-token-env.mts
index 2f0e681..d2efba4 100644
--- a/.config/oxlint-plugin/rules/socket-api-token-env.mts
+++ b/.config/oxlint-plugin/rules/socket-api-token-env.mts
@@ -56,12 +56,27 @@ const rule = {
       : context.sourceCode
 
     function hasBypassComment(node: AstNode) {
-      const before = sourceCode.getCommentsBefore(node)
-      const after = sourceCode.getCommentsAfter(node)
-      for (const c of [...before, ...after]) {
-        if (BYPASS_RE.test(c.value)) {
-          return true
+      // Walk up: literal -> array element -> array/declaration. The bypass
+      // comment can sit on the literal itself OR on any ancestor up to (and
+      // including) the nearest statement. This lets the entire alias-lookup
+      // array carry one bypass instead of needing one per element.
+      let cursor: AstNode | undefined = node
+      while (cursor) {
+        const before = sourceCode.getCommentsBefore(cursor)
+        const after = sourceCode.getCommentsAfter(cursor)
+        for (const c of [...before, ...after]) {
+          if (BYPASS_RE.test(c.value)) {
+            return true
+          }
+        }
+        if (
+          cursor.type === 'ExportNamedDeclaration' ||
+          cursor.type === 'ExpressionStatement' ||
+          cursor.type === 'VariableDeclaration'
+        ) {
+          break
         }
+        cursor = cursor.parent
       }
       return false
     }
diff --git a/.config/oxlint-plugin/rules/sort-boolean-chains.mts b/.config/oxlint-plugin/rules/sort-boolean-chains.mts
index 3546bc7..b7fd69c 100644
--- a/.config/oxlint-plugin/rules/sort-boolean-chains.mts
+++ b/.config/oxlint-plugin/rules/sort-boolean-chains.mts
@@ -1,27 +1,33 @@
 /**
  * @file Sort all-identifier boolean chains alphanumerically. Per CLAUDE.md
- *   "Sorting" rule, a chain like `agentshieldOk && zizmorOk && sfwOk` reads
- *   with the identifier names in alpha order: `agentshieldOk && sfwOk &&
+ *   "Sorting" rule, a flag-list chain like `agentshieldOk && zizmorOk && sfwOk`
+ *   reads with the identifier names in alpha order: `agentshieldOk && sfwOk &&
  *   zizmorOk`. The runtime is short-circuit-insensitive to operand order _when
  *   every operand is a plain identifier_ (no calls, no member access with
  *   getters) — so reordering doesn't change semantics. Sorting reduces diff
  *   churn when adding a new flag and makes "is everything ready?" checks
- *   visually consistent. Detects: chains of `&&` or `||` whose operands are ALL
- *   bare Identifiers (length ≥ 2, no duplicates, uniform operator across the
- *   flattened chain). Skipped (not reported, autofix-safe stays narrow):
+ *   visually consistent. Scope: lists of flags, not guard pairs. The rule ONLY
+ *   fires on chains of length ≥ 3. Two-operand chains like `useHttp &&
+ *   oauthEnabled` are guard patterns — the order carries narrative ("in HTTP
+ *   mode, did OAuth get enabled?") that alpha-sort destroys. Three or more bare
+ *   identifiers in a single chain is the structural signal that it's a flag
+ *   list, not a guard. Detects: chains of `&&` or `||` whose operands are ALL
+ *   bare Identifiers (length ≥ 3, no duplicates, uniform operator across the
+ *   flattened chain). Skipped (not reported):
  *
+ *   - Length 2 — guard patterns; narrative order is intentional.
  *   - Any operand isn't a bare `Identifier` (Calls / member-access / literals /
  *     negations / nested non-uniform logical exprs short-circuit, and a
  *     `getter` on a member-access can have side effects — reordering would be
  *     observable).
  *   - Duplicate identifiers in the chain (rare, but rewriting through the
  *     duplicate would silently drop one).
- *   - Comments live between operands (autofix would relocate them).
- *   - Chain length < 2 (nothing to sort). Why a separate rule from
- *     sort-equality-disjunctions: that rule sorts the right-hand string-literal
- *     of an equality chain (`x === 'a' || x === 'b'`); this rule sorts the
- *     bare-identifier operands of a pure-identifier chain. Structurally
- *     different ASTs, semantically different safety arguments.
+ *   - Comments live between operands (autofix would relocate them). Why a
+ *     separate rule from sort-equality-disjunctions: that rule sorts the
+ *     right-hand string-literal of an equality chain (`x === 'a' || x ===
+ *     'b'`); this rule sorts the bare-identifier operands of a pure-identifier
+ *     chain. Structurally different ASTs, semantically different safety
+ *     arguments.
  */
 
 /**
@@ -103,7 +109,10 @@ const rule = {
 
       const leaves: AstNode[] = []
       flatten(rootNode, op, leaves)
-      if (leaves.length < 2) {
+      // Length 2 chains are guard patterns (`useHttp && oauthEnabled`)
+      // where order carries narrative; only length 3+ chains are flag
+      // lists where alpha-sort is unambiguously a readability win.
+      if (leaves.length < 3) {
         return
       }
 
diff --git a/.config/oxlint-plugin/test/no-underscore-identifier.test.mts b/.config/oxlint-plugin/test/no-underscore-identifier.test.mts
index 55c0baa..bffa1bf 100644
--- a/.config/oxlint-plugin/test/no-underscore-identifier.test.mts
+++ b/.config/oxlint-plugin/test/no-underscore-identifier.test.mts
@@ -1,9 +1,9 @@
 /**
- * @file Unit tests for the no-underscore-identifier oxlint rule.
- *   Spawns the real oxlint binary against fixture files in a tmp
- *   dir (see lib/rule-tester.mts). Skips silently when `oxlint`
- *   isn't on PATH so a fresh-laptop checkout doesn't false-fail
- *   before `pnpm install` materializes the bin link.
+ * @file Unit tests for the no-underscore-identifier oxlint rule. Spawns the
+ *   real oxlint binary against fixture files in a tmp dir (see
+ *   lib/rule-tester.mts). Skips silently when `oxlint` isn't on PATH so a
+ *   fresh-laptop checkout doesn't false-fail before `pnpm install` materializes
+ *   the bin link.
  */
 
 import { describe, test } from 'node:test'
diff --git a/.config/oxlint-plugin/test/prefer-cached-for-loop.test.mts b/.config/oxlint-plugin/test/prefer-cached-for-loop.test.mts
index e848573..a24f962 100644
--- a/.config/oxlint-plugin/test/prefer-cached-for-loop.test.mts
+++ b/.config/oxlint-plugin/test/prefer-cached-for-loop.test.mts
@@ -19,6 +19,14 @@ describe('socket/prefer-cached-for-loop', () => {
           name: 'for-of',
           code: 'for (const x of [1,2,3]) {}\n',
         },
+        {
+          name: 'for-of over awaited value — unknown kind, skip autofix',
+          code:
+            'async function f() {\n' +
+            '  const items = await getThings()\n' +
+            '  for (const x of items) { console.log(x) }\n' +
+            '}\n',
+        },
       ],
       invalid: [
         {
diff --git a/.config/oxlint-plugin/test/prefer-spawn-over-execsync.test.mts b/.config/oxlint-plugin/test/prefer-spawn-over-execsync.test.mts
index 71d2f42..ed26996 100644
--- a/.config/oxlint-plugin/test/prefer-spawn-over-execsync.test.mts
+++ b/.config/oxlint-plugin/test/prefer-spawn-over-execsync.test.mts
@@ -1,9 +1,9 @@
 /**
- * @file Unit tests for the prefer-spawn-over-execsync oxlint rule.
- *   Spawns the real oxlint binary against fixture files in a tmp
- *   dir (see lib/rule-tester.mts). Skips silently when `oxlint`
- *   isn't on PATH so a fresh-laptop checkout doesn't false-fail
- *   before `pnpm install` materializes the bin link.
+ * @file Unit tests for the prefer-spawn-over-execsync oxlint rule. Spawns the
+ *   real oxlint binary against fixture files in a tmp dir (see
+ *   lib/rule-tester.mts). Skips silently when `oxlint` isn't on PATH so a
+ *   fresh-laptop checkout doesn't false-fail before `pnpm install` materializes
+ *   the bin link.
  */
 
 import { describe, test } from 'node:test'
@@ -17,13 +17,11 @@ describe('socket/prefer-spawn-over-execsync', () => {
       valid: [
         {
           name: 'lib-stable spawn import',
-          code:
-            "import { spawn } from '@socketsecurity/lib-stable/spawn'\n",
+          code: "import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'\n",
         },
         {
           name: 'lib-stable spawnSync import',
-          code:
-            "import { spawnSync } from '@socketsecurity/lib-stable/spawn'\n",
+          code: "import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'\n",
         },
         {
           name: 'node:child_process spawn (not exec*Sync) is acceptable',
@@ -41,18 +39,13 @@ describe('socket/prefer-spawn-over-execsync', () => {
         },
         {
           name: 'execFileSync from node:child_process',
-          code:
-            "import { execFileSync } from 'node:child_process'\n",
+          code: "import { execFileSync } from 'node:child_process'\n",
           errors: [{ messageId: 'preferSpawn' }],
         },
         {
           name: 'mixed execSync + execFileSync',
-          code:
-            "import { execSync, execFileSync } from 'node:child_process'\n",
-          errors: [
-            { messageId: 'preferSpawn' },
-            { messageId: 'preferSpawn' },
-          ],
+          code: "import { execSync, execFileSync } from 'node:child_process'\n",
+          errors: [{ messageId: 'preferSpawn' }, { messageId: 'preferSpawn' }],
         },
       ],
     })
diff --git a/.config/oxlint-plugin/test/socket-api-token-env.test.mts b/.config/oxlint-plugin/test/socket-api-token-env.test.mts
index dcfb34b..550bbca 100644
--- a/.config/oxlint-plugin/test/socket-api-token-env.test.mts
+++ b/.config/oxlint-plugin/test/socket-api-token-env.test.mts
@@ -15,6 +15,13 @@ describe('socket/socket-api-token-env', () => {
           name: 'canonical SOCKET_API_TOKEN',
           code: 'const t = process.env["SOCKET_API_TOKEN"]\nconsole.log(t)\n',
         },
+        {
+          name: 'alias-lookup array with declaration-level bypass comment',
+          code:
+            '// socket-api-token-env: bootstrap -- alias-normalization shim.\n' +
+            "const ALIASES = ['SOCKET_API_TOKEN', 'SOCKET_API_KEY', 'SOCKET_SECURITY_API_TOKEN'] as const\n" +
+            'console.log(ALIASES)\n',
+        },
       ],
       invalid: [
         {
diff --git a/.config/oxlint-plugin/test/sort-boolean-chains.test.mts b/.config/oxlint-plugin/test/sort-boolean-chains.test.mts
index 7c04eab..6f12230 100644
--- a/.config/oxlint-plugin/test/sort-boolean-chains.test.mts
+++ b/.config/oxlint-plugin/test/sort-boolean-chains.test.mts
@@ -31,6 +31,14 @@ describe('socket/sort-boolean-chains', () => {
           name: 'single operand — not a chain',
           code: 'export const r = (a: boolean) => a\n',
         },
+        {
+          name: 'two-operand guard pair — narrative order preserved',
+          code: 'export const r = (useHttp: boolean, oauthEnabled: boolean) => useHttp && oauthEnabled\n',
+        },
+        {
+          name: 'two-operand reversed guard pair — still not sorted',
+          code: 'export const r = (b: boolean, a: boolean) => b && a\n',
+        },
         {
           name: 'duplicates skipped',
           code: 'export const r = (b: boolean, a: boolean) => b && a && b\n',
diff --git a/.git-hooks/_helpers.mts b/.git-hooks/_helpers.mts
index 39ad910..99271c6 100644
--- a/.git-hooks/_helpers.mts
+++ b/.git-hooks/_helpers.mts
@@ -443,6 +443,110 @@ export const scanNpxDlx = (text: string): LineHit[] =>
     suggest: suggestNpxReplacement,
   })
 
+// ── pnpm-first docs scanner ────────────────────────────────────────
+//
+// Fleet rule: user-facing documentation that shows install commands
+// should LEAD with the pnpm form (`pnpm install <pkg>`, `pnpm add
+// <pkg>`). npm / yarn fallbacks are fine, but they should appear
+// after the pnpm form — or in a sibling code block introduced as a
+// fallback for users who don't have pnpm.
+//
+// This scanner walks fenced markdown code blocks (``` or ~~~) and
+// emits a warning for any fence whose first install-shape line is
+// npm/yarn rather than pnpm. Warning-only — never fails a commit.
+// Inline backtick spans (a single `npm install foo` in prose) are
+// NOT scanned; only block-level fences.
+//
+// Suppression: a line containing `socket-hook: allow pnpm-first`
+// anywhere in the fence (or just above it) skips that block.
+
+// Match shell install commands at line start (allowing leading
+// whitespace + `$` prompt). Captures the package manager so the
+// caller can tell which form was seen first.
+const PNPM_INSTALL_LINE_RE = /^\s*\$?\s*pnpm\s+(?:install|add|i)\b/
+const NPM_YARN_INSTALL_LINE_RE =
+  /^\s*\$?\s*(?:(npm)\s+(?:install|add|i)|(?:yarn)\s+(?:install|add)|(?:yarn))\s/
+
+// Markdown fence opener: ``` or ~~~ at line start, optionally followed
+// by an info string (language hint). We don't require closing match —
+// just count fences as we go and treat alternating opens/closes.
+const FENCE_OPEN_RE = /^\s*(?:```|~~~)/
+
+const PNPM_FIRST_SUPPRESS_RE = /socket-hook:\s*allow\s+pnpm-first\b/
+
+export const scanDocsPnpmFirst = (text: string): LineHit[] => {
+  const hits: LineHit[] = []
+  const lines = splitLines(text)
+  let inFence = false
+  let fenceStartLine = -1
+  let fenceHasPnpm = false
+  let fenceHasSuppress = false
+  let fenceFirstNpmYarnHit: LineHit | undefined
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]!
+    if (FENCE_OPEN_RE.test(line)) {
+      // Closing fence: flush any pending hit if no pnpm form was seen
+      // and the block wasn't suppressed.
+      if (inFence) {
+        if (fenceFirstNpmYarnHit && !fenceHasPnpm && !fenceHasSuppress) {
+          hits.push(fenceFirstNpmYarnHit)
+        }
+        inFence = false
+        fenceStartLine = -1
+        fenceHasPnpm = false
+        fenceHasSuppress = false
+        fenceFirstNpmYarnHit = undefined
+      } else {
+        inFence = true
+        fenceStartLine = i + 1
+      }
+      continue
+    }
+    if (!inFence) {
+      // Suppression marker on a comment line just above the fence is
+      // also honored (some docs prefer keeping markers outside the
+      // rendered code block).
+      if (PNPM_FIRST_SUPPRESS_RE.test(line)) {
+        // Look ahead one line for a fence open; if it's there, mark
+        // the upcoming block as suppressed.
+        const next = lines[i + 1]
+        if (next !== undefined && FENCE_OPEN_RE.test(next)) {
+          fenceHasSuppress = true
+        }
+      }
+      continue
+    }
+    if (PNPM_FIRST_SUPPRESS_RE.test(line)) {
+      fenceHasSuppress = true
+      continue
+    }
+    if (PNPM_INSTALL_LINE_RE.test(line)) {
+      fenceHasPnpm = true
+      continue
+    }
+    if (
+      NPM_YARN_INSTALL_LINE_RE.test(line) &&
+      fenceFirstNpmYarnHit === undefined
+    ) {
+      fenceFirstNpmYarnHit = {
+        lineNumber: i + 1,
+        line,
+        suggested: line.replace(/\b(npm|yarn)\s+(install|add|i)\b/, 'pnpm $2'),
+      }
+    }
+  }
+  // Unclosed fence at EOF — flush whatever's pending.
+  if (inFence && fenceFirstNpmYarnHit && !fenceHasPnpm && !fenceHasSuppress) {
+    hits.push(fenceFirstNpmYarnHit)
+  }
+  // Reference fenceStartLine to suppress unused-variable lints; the
+  // value is useful for future enhancements (e.g. block-level
+  // diagnostics) but the current per-line LineHit shape carries the
+  // offending line number directly.
+  void fenceStartLine
+  return hits
+}
+
 // ── Logger leak scanner ────────────────────────────────────────────
 //
 // The fleet rule: source code uses `getDefaultLogger()` from
@@ -508,8 +612,9 @@ const FLEET_REPO_NAMES = [
   'socket-sdk-js',
   'socket-sdxgen',
   'socket-stuie',
+  'socket-vscode',
+  'socket-webext',
   'ultrathink',
-  'vscode-socket-security',
 ] as const
 
 // `../<repo>/…` or `../../<repo>/…` etc. — relative path that walks
diff --git a/.git-hooks/pre-commit b/.git-hooks/pre-commit
index 4e271f4..16e0c21 100755
--- a/.git-hooks/pre-commit
+++ b/.git-hooks/pre-commit
@@ -40,8 +40,34 @@ if ! command -v pnpm >/dev/null 2>&1; then
   exit 1
 fi
 
+# Error-visibility helper. When lint/test fails, harness output often
+# shows only a final "Failed with non-blocking status code" line — the
+# actual error is buried thousands of lines up the log and gets clipped
+# by the agent's stdout limits. Tee each step's output to a tempfile,
+# tail it on failure with a clear marker so the operator (or agent)
+# can see what broke without scrolling.
+run_step() {
+  step_name=$1
+  shift
+  step_log=$(mktemp -t "pre-commit-${step_name}.XXXXXX") || step_log=/tmp/pre-commit-step.log
+  if "$@" 2>&1 | tee "$step_log"; then
+    status=0
+  else
+    status=$?
+  fi
+  if [ "$status" -ne 0 ]; then
+    printf '\n========== pre-commit: %s FAILED (exit %s) ==========\n' "$step_name" "$status"
+    printf 'Last 60 lines of output:\n\n'
+    tail -60 "$step_log"
+    printf '\n========== full log: %s ==========\n' "$step_log"
+  else
+    rm -f "$step_log"
+  fi
+  return "$status"
+}
+
 if [ -z "${DISABLE_PRECOMMIT_LINT}" ]; then
-  pnpm lint --staged
+  run_step lint pnpm lint --staged || exit $?
 else
   echo "Skipping lint due to DISABLE_PRECOMMIT_LINT env var"
 fi
@@ -58,9 +84,9 @@ if [ -z "${DISABLE_PRECOMMIT_TEST}" ]; then
   # local override that pre-filters with `git diff --cached --name-only`
   # then runs `pnpm test`.
   if [ -n "${DISABLE_PRECOMMIT_LINT}" ]; then
-    pnpm test --staged --fast
+    run_step test pnpm test --staged --fast || exit $?
   else
-    pnpm test --staged
+    run_step test pnpm test --staged || exit $?
   fi
 else
   echo "Skipping testing due to DISABLE_PRECOMMIT_TEST env var"
diff --git a/.git-hooks/pre-commit.mts b/.git-hooks/pre-commit.mts
index b6f179a..7045a36 100644
--- a/.git-hooks/pre-commit.mts
+++ b/.git-hooks/pre-commit.mts
@@ -19,6 +19,7 @@ import {
   readFileForScan,
   scanAwsKeys,
   scanCrossRepoPaths,
+  scanDocsPnpmFirst,
   scanGitHubTokens,
   scanLoggerLeaks,
   scanNpxDlx,
@@ -217,6 +218,41 @@ const main = (): number => {
     }
   }
 
+  // Documentation pnpm-first scanner (warning, not blocking).
+  //
+  // Fleet rule: user-facing install commands in docs lead with the
+  // pnpm form. npm/yarn fallbacks come after. Block-only — inline
+  // backtick spans are not scanned. Suppress per-block with
+  // `socket-hook: allow pnpm-first`.
+  logger.info('Checking docs lead with pnpm install commands...')
+  for (const file of stagedFiles) {
+    if (shouldSkipFile(file)) {
+      continue
+    }
+    if (!/\.(?:md|mdx)$/i.test(file)) {
+      continue
+    }
+    const text = readFileForScan(file)
+    if (!text) {
+      continue
+    }
+    const hits = scanDocsPnpmFirst(text)
+    if (hits.length > 0) {
+      logger.warn(`docs without pnpm-first install command: ${file}`)
+      for (const h of hits.slice(0, 3)) {
+        logger.info(`${h.lineNumber}: ${h.line.trim()}`)
+        if (h.suggested && h.suggested !== h.line) {
+          logger.info(`     fix: ${h.suggested.trim()}`)
+        }
+      }
+      logger.info(
+        'Lead with the pnpm form; keep npm/yarn as fallbacks. To ' +
+          'suppress a fenced block, include `socket-hook: allow ' +
+          'pnpm-first` anywhere in the block.',
+      )
+    }
+  }
+
   // Direct stream writes (process.stderr.write, process.stdout.write,
   // console.*) in source files. Source code uses getDefaultLogger()
   // from @socketsecurity/lib-stable/logger; the logger-guard PreToolUse hook
@@ -243,7 +279,11 @@ const main = (): number => {
       file.startsWith('template/scripts/') ||
       file.includes('/external/') ||
       file.includes('/vendor/') ||
-      file.includes('/upstream/')
+      file.includes('/upstream/') ||
+      // src/logger/ IS the logger — implementing the surface itself
+      // requires direct console.* calls. Same exemption the
+      // logger-guard PreToolUse hook applies.
+      file.startsWith('src/logger/')
     ) {
       continue
     }
diff --git a/.git-hooks/pre-push.mts b/.git-hooks/pre-push.mts
index 5718335..752b673 100644
--- a/.git-hooks/pre-push.mts
+++ b/.git-hooks/pre-push.mts
@@ -330,6 +330,9 @@ const scanFilesInRange = (range: string): number => {
       !file.includes('/external/') &&
       !file.includes('/vendor/') &&
       !file.includes('/upstream/') &&
+      // src/logger/ IS the logger — implementing the surface itself
+      // requires direct console.* calls.
+      !file.startsWith('src/logger/') &&
       /\.(m?ts|tsx|cts)$/.test(file)
     ) {
       const loggerHits = scanLoggerLeaks(text)
diff --git a/.git-hooks/test/_helpers.test.mts b/.git-hooks/test/_helpers.test.mts
index 5e05c45..c2ed34f 100644
--- a/.git-hooks/test/_helpers.test.mts
+++ b/.git-hooks/test/_helpers.test.mts
@@ -24,6 +24,7 @@ import {
   normalizePath,
   scanAwsKeys,
   scanCrossRepoPaths,
+  scanDocsPnpmFirst,
   scanGitHubTokens,
   scanLinearRefs,
   scanPersonalPaths,
@@ -585,3 +586,92 @@ test('gitOrThrow: throws on non-zero exit', () => {
     /git this-subcommand-does-not-exist:/,
   )
 })
+
+// ── scanDocsPnpmFirst ─────────────────────────────────────────────
+
+test('scanDocsPnpmFirst: flags fence with only npm install', () => {
+  const md = ['# Install', '', '```sh', 'npm install lodash', '```'].join('\n')
+  const hits = scanDocsPnpmFirst(md)
+  assert.strictEqual(hits.length, 1)
+  assert.strictEqual(hits[0]!.line, 'npm install lodash')
+  assert.strictEqual(hits[0]!.suggested, 'pnpm install lodash')
+})
+
+test('scanDocsPnpmFirst: accepts fence with pnpm leading npm', () => {
+  const md = [
+    '```sh',
+    'pnpm install lodash',
+    '# or for npm users:',
+    'npm install lodash',
+    '```',
+  ].join('\n')
+  assert.strictEqual(scanDocsPnpmFirst(md).length, 0)
+})
+
+test('scanDocsPnpmFirst: flags yarn add without pnpm form', () => {
+  const md = ['```bash', 'yarn add typescript', '```'].join('\n')
+  const hits = scanDocsPnpmFirst(md)
+  assert.strictEqual(hits.length, 1)
+  assert.match(hits[0]!.line, /yarn add/)
+})
+
+test('scanDocsPnpmFirst: accepts tilde-fenced block', () => {
+  const md = ['~~~sh', 'pnpm add react', 'npm install react', '~~~'].join('\n')
+  assert.strictEqual(scanDocsPnpmFirst(md).length, 0)
+})
+
+test('scanDocsPnpmFirst: ignores inline backtick spans', () => {
+  // Inline `npm install foo` in prose is NOT a fenced block — out of
+  // scope for this scanner.
+  const md = 'Run `npm install lodash` to install lodash.'
+  assert.strictEqual(scanDocsPnpmFirst(md).length, 0)
+})
+
+test('scanDocsPnpmFirst: per-block suppression marker', () => {
+  const md = [
+    '```sh',
+    '# socket-hook: allow pnpm-first',
+    'npm install lodash',
+    '```',
+  ].join('\n')
+  assert.strictEqual(scanDocsPnpmFirst(md).length, 0)
+})
+
+test('scanDocsPnpmFirst: suppression marker on line above fence', () => {
+  const md = [
+    '<!-- socket-hook: allow pnpm-first -->',
+    '```sh',
+    'npm install lodash',
+    '```',
+  ].join('\n')
+  assert.strictEqual(scanDocsPnpmFirst(md).length, 0)
+})
+
+test('scanDocsPnpmFirst: handles multiple fences independently', () => {
+  const md = [
+    '```sh',
+    'pnpm add foo',
+    '```',
+    '',
+    'And here is a fallback:',
+    '',
+    '```sh',
+    'npm install foo',
+    '```',
+  ].join('\n')
+  // First fence has pnpm form → ok. Second fence is bare npm with no
+  // pnpm leader → one warning.
+  assert.strictEqual(scanDocsPnpmFirst(md).length, 1)
+})
+
+test('scanDocsPnpmFirst: handles $-prefixed prompt lines', () => {
+  const md = ['```sh', '$ npm install foo', '```'].join('\n')
+  assert.strictEqual(scanDocsPnpmFirst(md).length, 1)
+})
+
+test('scanDocsPnpmFirst: ignores non-install npm commands', () => {
+  // `npm run build` is not an install — out of scope for the leader
+  // rule (which is about how users *get* a package).
+  const md = ['```sh', 'npm run build', '```'].join('\n')
+  assert.strictEqual(scanDocsPnpmFirst(md).length, 0)
+})
diff --git a/docs/claude.md/fleet/sorting.md b/docs/claude.md/fleet/sorting.md
index 2f7b5cc..9ea6ea6 100644
--- a/docs/claude.md/fleet/sorting.md
+++ b/docs/claude.md/fleet/sorting.md
@@ -12,7 +12,7 @@ Sort lists alphanumerically (literal byte order, ASCII before letters).
 - **`Set` constructor arguments** — `new Set([...])` and `new SafeSet([...])` literals. The runtime is order-insensitive, so source order is alphanumeric. Same rationale as Array literals: predictable diffs, no merge conflicts on insertions.
 - **Regex alternation groups** — `(foo|bar|baz)` reads as `(bar|baz|foo)`. Capturing, non-capturing, and named-capture groups all follow the rule. Auto-fixable when every alternative is a simple literal. The exception is order-bearing alternations where the regex engine MUST try one alternative before another (rare; the canonical example is markup parsers where `<!--|-->` would silently mismatch if reordered) — append `// socket-hook: allow regex-alternation-order` on those lines.
 - **String-equality disjunctions** — `x === 'a' || x === 'b' || x === 'c'` reads with the comparand strings in alpha order. The De Morgan dual `x !== 'a' && x !== 'b'` (negative-membership check) follows the same rule. The `||` chain short-circuits regardless of operand order; sorting reduces diff churn when adding new comparands and makes "is X in this set?" checks visually consistent. Auto-fixable when every clause has the same left operand and uses string-literal comparands. Mixed shape (different left, different operator, non-string right) is skipped — those are usually genuine ordering-sensitive predicates and the autofix would change semantics.
-- **Boolean identifier chains** — `agentshieldOk && zizmorOk && sfwOk` reads with the names in alpha order: `agentshieldOk && sfwOk && zizmorOk`. Same rule for `||` chains. The lint rule fires only when every leaf is a bare `Identifier` (no calls, no member access, no literals, no negations) — those have side-effect or short-circuit semantics where order can be observable. Duplicate identifiers and chains with interior comments are skipped (the autofix would lose information). Enforced by `socket/sort-boolean-chains`.
+- **Boolean identifier chains** — `agentshieldOk && zizmorOk && sfwOk` reads with the names in alpha order: `agentshieldOk && sfwOk && zizmorOk`. Same rule for `||` chains. The lint rule fires only when (1) every leaf is a bare `Identifier` (no calls, no member access, no literals, no negations) — those have side-effect or short-circuit semantics where order can be observable — AND (2) the chain has **3 or more operands**. Two-operand chains like `useHttp && oauthEnabled` are guard patterns where order carries narrative ("in HTTP mode, did OAuth get enabled?") that alpha-sort would destroy; only length-3+ chains are unambiguously flag lists. Duplicate identifiers and chains with interior comments are skipped (the autofix would lose information). Enforced by `socket/sort-boolean-chains`.
 - **TypeScript union of string literals** — `type Source = 'download' | 'path' | 'vfs'` (not `'vfs' | 'path' | 'download'`). Members are interchangeable at the type level; alpha order makes "which values can this take?" answerable without scanning. Applies to type aliases, inline parameter unions, and template-literal type alternatives. Position-bearing unions (rare — e.g. a discriminator where order encodes priority) keep their meaningful order; append `// socket-hook: allow union-order` on those lines.
 
 ## Default
diff --git a/packages/build-infra/lib/release-checksums/consumer.mts b/packages/build-infra/lib/release-checksums/consumer.mts
index 33222be..e7b34d8 100644
--- a/packages/build-infra/lib/release-checksums/consumer.mts
+++ b/packages/build-infra/lib/release-checksums/consumer.mts
@@ -17,9 +17,9 @@ import path from 'node:path'
 import process from 'node:process'
 
 import { errorMessage } from '@socketsecurity/lib/errors'
-import { safeMkdir } from '@socketsecurity/lib/fs'
+import { safeMkdir } from '@socketsecurity/lib/fs/safe'
 import { getDefaultLogger } from '@socketsecurity/lib/logger'
-import { getLatestRelease } from '@socketsecurity/lib/releases/github-api'
+import { getLatestRelease } from '@socketsecurity/lib/releases/github-listing'
 import { downloadReleaseAsset } from '@socketsecurity/lib/releases/github-downloads'
 import type { RepoConfig } from '@socketsecurity/lib/releases/github-types'
 
@@ -35,34 +35,41 @@ export interface ChecksumsResult {
 
 const checksumCache = new Map<string, ChecksumsResult>()
 
+/**
+ * Clear the checksum cache. Useful for testing or forcing re-download.
+ */
+export function clearChecksumCache(): void {
+  checksumCache.clear()
+}
+
 interface GetChecksumsOptions {
   /**
    * The producing repo whose releases we're verifying against.
    */
   repoConfig: RepoConfig
   /**
-   * Tool name prefix used in the producing repo's release tag (e.g. `iocraft`).
+   * Tool name prefix used in the producing repo's release tag (e.g. `lief`).
    */
   tool: string
   /**
    * Specific tag to fetch. If omitted, uses the embedded tag, then `latest`.
    */
-  releaseTag?: string
+  releaseTag?: string | undefined
   /**
    * Where to cache the downloaded `checksums.txt`. Defaults to
    * `<cwd>/build/temp`.
    */
-  tempDir?: string
+  tempDir?: string | undefined
   /**
    * Suppress info/warn logging (errors still log).
    */
-  quiet?: boolean
+  quiet?: boolean | undefined
   /**
    * If true (default), use embedded checksums when available even if a network
    * fetch could find newer ones. Set false to force a network fetch — useful
    * when bumping checksums.
    */
-  preferEmbedded?: boolean
+  preferEmbedded?: boolean | undefined
 }
 
 /**
@@ -208,10 +215,3 @@ export async function getReleaseChecksums(
     return { checksums: {}, source: 'network', tag }
   }
 }
-
-/**
- * Clear the checksum cache. Useful for testing or forcing re-download.
- */
-export function clearChecksumCache(): void {
-  checksumCache.clear()
-}
diff --git a/packages/build-infra/lib/release-checksums/core.mts b/packages/build-infra/lib/release-checksums/core.mts
index 7be5e63..aaa1ae5 100644
--- a/packages/build-infra/lib/release-checksums/core.mts
+++ b/packages/build-infra/lib/release-checksums/core.mts
@@ -29,7 +29,7 @@ const __dirname = path.dirname(__filename)
 // ---------------------------------------------------------------------------
 
 export interface ToolConfig {
-  description?: string
+  description?: string | undefined
   tag: string
   checksums: Record<string, string>
 }
@@ -37,10 +37,10 @@ export interface ToolConfig {
 export type EmbeddedChecksums = Record<string, ToolConfig>
 
 export interface VerifyResult {
-  actual?: string
-  expected?: string
-  source?: string
-  skipped?: boolean
+  actual?: string | undefined
+  expected?: string | undefined
+  source?: string | undefined
+  skipped?: boolean | undefined
   valid: boolean
 }
 
@@ -55,27 +55,16 @@ export interface VerifyResult {
 
 let embeddedChecksums: EmbeddedChecksums | undefined | null
 
-export function getEmbeddedChecksums(): EmbeddedChecksums | undefined {
-  if (embeddedChecksums === null) {
-    return undefined
-  }
-  if (embeddedChecksums === undefined) {
-    try {
-      const checksumPath = path.join(
-        __dirname,
-        '..',
-        '..',
-        'release-assets.json',
-      )
-      embeddedChecksums = JSON.parse(
-        readFileSync(checksumPath, 'utf8'),
-      ) as EmbeddedChecksums
-    } catch {
-      embeddedChecksums = null
-      return undefined
-    }
+/**
+ * Compute SHA256 hash of a file as lowercase hex.
+ */
+export async function computeFileHash(filePath: string): Promise<string> {
+  const hash = crypto.createHash('sha256')
+  const stream = createReadStream(filePath)
+  for await (const chunk of stream) {
+    hash.update(chunk)
   }
-  return embeddedChecksums
+  return hash.digest('hex')
 }
 
 export function getEmbeddedChecksum(
@@ -97,20 +86,27 @@ export function getEmbeddedChecksum(
   return { checksum, tag: toolConfig.tag }
 }
 
-// ---------------------------------------------------------------------------
-// Format primitives.
-// ---------------------------------------------------------------------------
-
-/**
- * Compute SHA256 hash of a file as lowercase hex.
- */
-export async function computeFileHash(filePath: string): Promise<string> {
-  const hash = crypto.createHash('sha256')
-  const stream = createReadStream(filePath)
-  for await (const chunk of stream) {
-    hash.update(chunk)
+export function getEmbeddedChecksums(): EmbeddedChecksums | undefined {
+  if (embeddedChecksums === null) {
+    return undefined
   }
-  return hash.digest('hex')
+  if (embeddedChecksums === undefined) {
+    try {
+      const checksumPath = path.join(
+        __dirname,
+        '..',
+        '..',
+        'release-assets.json',
+      )
+      embeddedChecksums = JSON.parse(
+        readFileSync(checksumPath, 'utf8'),
+      ) as EmbeddedChecksums
+    } catch {
+      embeddedChecksums = undefined
+      return undefined
+    }
+  }
+  return embeddedChecksums
 }
 
 /**
@@ -136,15 +132,11 @@ export function parseChecksums(content: string): Record<string, string> {
   return checksums
 }
 
-// ---------------------------------------------------------------------------
-// Verify.
-// ---------------------------------------------------------------------------
-
 interface VerifyOptions {
   filePath: string
   assetName: string
   tool: string
-  quiet?: boolean
+  quiet?: boolean | undefined
 }
 
 /**
diff --git a/packages/build-infra/release-assets.schema.json b/packages/build-infra/release-assets.schema.json
index d049c86..4044659 100644
--- a/packages/build-infra/release-assets.schema.json
+++ b/packages/build-infra/release-assets.schema.json
@@ -29,7 +29,7 @@
         },
         "tag": {
           "type": "string",
-          "description": "Full release tag, including the tool prefix (e.g. `iocraft-20260424-18f0f46`).",
+          "description": "Full release tag, including the tool prefix (e.g. `lief-20260507-76c1796`).",
           "minLength": 1
         },
         "checksums": {
diff --git a/scripts/ai-lint-fix/cli.mts b/scripts/ai-lint-fix/cli.mts
index 51df308..bdcea6e 100644
--- a/scripts/ai-lint-fix/cli.mts
+++ b/scripts/ai-lint-fix/cli.mts
@@ -36,7 +36,8 @@ import path from 'node:path'
 import process from 'node:process'
 
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
-import { isSpawnError, spawn } from '@socketsecurity/lib-stable/spawn'
+import { isSpawnError } from '@socketsecurity/lib-stable/spawn/errors'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 
 import { AI_HANDLED_RULES, RULE_GUIDANCE } from './rule-guidance.mts'
 
diff --git a/scripts/ai-lint-fix/rule-guidance.mts b/scripts/ai-lint-fix/rule-guidance.mts
index 2847584..12dd301 100644
--- a/scripts/ai-lint-fix/rule-guidance.mts
+++ b/scripts/ai-lint-fix/rule-guidance.mts
@@ -54,18 +54,18 @@ export const RULE_GUIDANCE: Readonly<Record<string, string>> = {
     'Rewrite `fs.access` / `fs.stat` existence-checks to `existsSync(p)` from `node:fs`. Common shapes: `try { await fs.access(p); return true } catch { return false }` → `return existsSync(p)`. `await fs.access(p).then(() => true).catch(() => false)` → `existsSync(p)`. `if (await fs.stat(p))` → `if (existsSync(p))`. When the stat result is destructured for metadata (`s.size`, `s.mtime`, `s.isDirectory()`), KEEP the stat call and add a one-line comment stating intent — that is not an existence check. Trace back through callers: if the caller awaited a Promise<boolean>, the rewrite collapses to a sync boolean and the await becomes a no-op (safe).',
   'socket/prefer-node-builtin-imports':
     "Rewrite `import fs from 'node:fs'` / `import * as fs from 'node:fs'` to `import { … } from 'node:fs'` with the names actually used in the file. Change every `fs.X` reference to bare `X`. If `fs` is passed as a value (e.g. `someApi(fs)`), keep the namespace import and add a `// prefer-node-builtin-imports: passed-as-value` comment.",
-  'socket/prefer-async-spawn': `Replace \`node:child_process\` spawn calls with their \`@socketsecurity/lib-stable/spawn\` equivalents. The lib re-exports BOTH names so a sync caller keeps using \`spawnSync\` and only the import source changes; only convert sync → async when the enclosing function is already async (or can be safely made async) AND every caller of that function is async-ready.
+  'socket/prefer-async-spawn': `Replace \`node:child_process\` spawn calls with their \`@socketsecurity/lib-stable/spawn/spawn\` equivalents. The lib re-exports BOTH names so a sync caller keeps using \`spawnSync\` and only the import source changes; only convert sync → async when the enclosing function is already async (or can be safely made async) AND every caller of that function is async-ready.
 
 <process>
   1. List every spawn-family callsite in the file: \`spawnSync(\`, \`spawn(\`, \`child_process.spawnSync(\`, \`cp.spawnSync(\`. Note which names are actually used.
   2. For each callsite, decide: (a) keep sync semantics — use \`spawnSync\` from the lib (drop-in, same args, same return shape \`{ status, stdout, stderr }\`); or (b) convert to async — use \`spawn\` from the lib (returns a Promise of \`{ code, stdout, stderr }\`, requires \`await\`, requires async enclosing context, return shape uses \`.code\` not \`.status\`). Default to (a) unless you can verify (b) is safe — sync → async is a contract change.
-  3. Update the import line. If every callsite stays sync: \`import { spawnSync } from '@socketsecurity/lib-stable/spawn'\`. If every callsite becomes async: \`import { spawn } from '@socketsecurity/lib-stable/spawn'\`. If mixed: \`import { spawn, spawnSync } from '@socketsecurity/lib-stable/spawn'\`.
-  4. Self-verify before stopping: re-read the file. Confirm EVERY \`spawnSync(\` callsite is satisfied by the new import (either the name is in the import list OR you converted that callsite to \`await spawn(\`). A file with \`import { spawn } from '@socketsecurity/lib-stable/spawn'\` and a body containing \`spawnSync(\` is broken — fix it before you declare done.
+  3. Update the import line. If every callsite stays sync: \`import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'\`. If every callsite becomes async: \`import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'\`. If mixed: \`import { spawn, spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'\`.
+  4. Self-verify before stopping: re-read the file. Confirm EVERY \`spawnSync(\` callsite is satisfied by the new import (either the name is in the import list OR you converted that callsite to \`await spawn(\`). A file with \`import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'\` and a body containing \`spawnSync(\` is broken — fix it before you declare done.
 </process>
 
 <good-fix description="Sync caller; safest path is keeping sync semantics by importing spawnSync from the lib.">
 - import { spawnSync } from 'node:child_process'
-+ import { spawnSync } from '@socketsecurity/lib-stable/spawn'
++ import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 
   function run(cmd) {
     const r = spawnSync(cmd, [], { encoding: 'utf8' })
@@ -75,7 +75,7 @@ export const RULE_GUIDANCE: Readonly<Record<string, string>> = {
 
 <bad-fix description="What you must NOT do: rename the import without updating callsites.">
 - import { spawnSync } from 'node:child_process'
-+ import { spawn } from '@socketsecurity/lib-stable/spawn'
++ import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 
   function run(cmd) {
     const r = spawnSync(cmd, [], { encoding: 'utf8' })  // ❌ spawnSync is no longer imported — runtime ReferenceError
@@ -85,7 +85,7 @@ export const RULE_GUIDANCE: Readonly<Record<string, string>> = {
 
 <good-fix description="Async caller; can switch to lib's async spawn AND update return-shape access.">
 - import { spawnSync } from 'node:child_process'
-+ import { spawn } from '@socketsecurity/lib-stable/spawn'
++ import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 
   async function run(cmd) {
     const r = await spawn(cmd, [], { stdio: 'pipe' })
diff --git a/scripts/check-lock-step-refs.mts b/scripts/check-lock-step-refs.mts
index 3e9872d..7bd8b32 100644
--- a/scripts/check-lock-step-refs.mts
+++ b/scripts/check-lock-step-refs.mts
@@ -73,7 +73,7 @@ type Finding = {
 //      matching prose like "Lock-step with Go: JSON parser")
 //   4: optional `:start[-end]` line range (discarded for path resolution)
 const LOCK_STEP_RE =
-  /Lock-step (from|with) ([A-Za-z][A-Za-z0-9+#-]*): ([^\s:,]*[./][^\s:,]*)(?::(\d+(?:-\d+)?))?/g
+  /Lock-step (?:from|with) (?:[A-Za-z][A-Za-z0-9+#-]*): (?:[^\s:,]*[./][^\s:,]*)(?::(?:\d+(?:-\d+)?))?/g
 
 function loadConfig(repoRoot: string): Config | undefined {
   const configFile = path.join(repoRoot, CONFIG_PATH)
diff --git a/scripts/check-paths/allowlist.mts b/scripts/check-paths/allowlist.mts
index 5d6beac..bab1218 100644
--- a/scripts/check-paths/allowlist.mts
+++ b/scripts/check-paths/allowlist.mts
@@ -11,7 +11,7 @@
  *   is OR'd so reformatting that shifts the line still matches via the hash.
  */
 
-import { createHash } from 'node:crypto'
+import crypto from 'node:crypto'
 import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 
diff --git a/scripts/check-paths/exempt.mts b/scripts/check-paths/exempt.mts
index a69d7ce..a7f7031 100644
--- a/scripts/check-paths/exempt.mts
+++ b/scripts/check-paths/exempt.mts
@@ -9,7 +9,7 @@
 // File-path patterns that legitimately enumerate path segments.
 export const EXEMPT_FILE_PATTERNS: RegExp[] = [
   // Any paths.mts is the canonical constructor.
-  /(^|\/)paths\.(cts|js|mts)$/,
+  /(?:^|\/)paths\.(?:cts|js|mts)$/,
   // Build-infra owns shared helpers that enumerate stages.
   /packages\/build-infra\/lib\/paths\.mts$/,
   /packages\/build-infra\/lib\/constants\.mts$/,
diff --git a/scripts/check-prompt-less-setup.mts b/scripts/check-prompt-less-setup.mts
index 0edd986..7cecaa4 100644
--- a/scripts/check-prompt-less-setup.mts
+++ b/scripts/check-prompt-less-setup.mts
@@ -26,7 +26,7 @@
  *      signing/keychain prompt surprises you.
  */
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { existsSync, readFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
diff --git a/scripts/fix.mts b/scripts/fix.mts
index c57d75c..d79bc8e 100644
--- a/scripts/fix.mts
+++ b/scripts/fix.mts
@@ -20,7 +20,7 @@ import { existsSync } from 'node:fs'
 import process from 'node:process'
 
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 
 const WIN32 = process.platform === 'win32'
 const logger = getDefaultLogger()
diff --git a/scripts/install-claude-plugins.mts b/scripts/install-claude-plugins.mts
index 2563205..47ba52a 100644
--- a/scripts/install-claude-plugins.mts
+++ b/scripts/install-claude-plugins.mts
@@ -26,7 +26,7 @@
  *      matching version + sha + ISO date.
  */
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import process from 'node:process'
diff --git a/scripts/install-git-hooks.mts b/scripts/install-git-hooks.mts
index 24420ea..bae3fef 100644
--- a/scripts/install-git-hooks.mts
+++ b/scripts/install-git-hooks.mts
@@ -10,7 +10,7 @@
  *     into this repo yet).
  */
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { existsSync } from 'node:fs'
 import path from 'node:path'
 import process from 'node:process'
diff --git a/scripts/install-sfw.mts b/scripts/install-sfw.mts
index 8689c23..552ed9c 100644
--- a/scripts/install-sfw.mts
+++ b/scripts/install-sfw.mts
@@ -37,7 +37,7 @@ import { parseArgs } from 'node:util'
 import { WIN32, getArch } from '@socketsecurity/lib-stable/constants/platform'
 import { downloadBinary } from '@socketsecurity/lib-stable/dlx/binary'
 import { errorMessage } from '@socketsecurity/lib-stable/errors'
-import { safeDelete, safeMkdirSync } from '@socketsecurity/lib-stable/fs'
+import { safeDelete, safeMkdirSync } from '@socketsecurity/lib-stable/fs/safe'
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
 import {
   getSocketAppDir,
diff --git a/scripts/install-token-minifier.mts b/scripts/install-token-minifier.mts
index 2430a2e..f5a9f57 100644
--- a/scripts/install-token-minifier.mts
+++ b/scripts/install-token-minifier.mts
@@ -34,10 +34,10 @@ import { fileURLToPath } from 'node:url'
 import { parseArgs } from 'node:util'
 
 import { errorMessage } from '@socketsecurity/lib-stable/errors'
-import { safeMkdirSync } from '@socketsecurity/lib-stable/fs'
+import { safeMkdirSync } from '@socketsecurity/lib-stable/fs/safe'
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
 import { getSocketAppDir } from '@socketsecurity/lib-stable/paths/socket'
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 
 const logger = getDefaultLogger()
 
@@ -94,7 +94,7 @@ interface CatalogYamlMap {
  * line-shaped (key: value) and we only need the @socketsecurity/* entries the
  * proxy actually references.
  */
-function readNeededCatalogEntries(): CatalogYamlMap {
+export function readNeededCatalogEntries(): CatalogYamlMap {
   const yamlPath = path.join(WHEELHOUSE_ROOT, 'pnpm-workspace.yaml')
   const text = readFileSync(yamlPath, 'utf8')
   const lines = text.split('\n')
@@ -140,7 +140,7 @@ function readNeededCatalogEntries(): CatalogYamlMap {
  * catalog aliases the package source declares. Keeps imports of
  * `@socketsecurity/lib-stable/...` resolvable from inside the install.
  */
-function writeInstallWorkspaceYaml(catalog: CatalogYamlMap): void {
+export function writeInstallWorkspaceYaml(catalog: CatalogYamlMap): void {
   const lines = ['catalog:']
   for (const [k, v] of Object.entries(catalog)) {
     // Quote values that aren't bare versions (e.g. `npm:foo@1.0.0`).
@@ -161,7 +161,7 @@ function writeInstallWorkspaceYaml(catalog: CatalogYamlMap): void {
  * Stripping `bin`/`exports` keeps pnpm from trying to wire global binaries at
  * install time — we drop our own shim explicitly.
  */
-function writeInstallPackageJson(sourceVersion: string): void {
+export function writeInstallPackageJson(sourceVersion: string): void {
   const sourcePkg = JSON.parse(
     readFileSync(path.join(PKG_SOURCE_DIR, 'package.json'), 'utf8'),
   )
@@ -190,7 +190,7 @@ function writeInstallPackageJson(sourceVersion: string): void {
  * `fs.cp` with recursive + force is the cross-platform equivalent of `cp -r`.
  * Force overwrites stale files on reinstall.
  */
-function copySource(): void {
+export function copySource(): void {
   // Use sync fs API for consistency with the rest of the script — this
   // is a one-shot install, not a hot path. `cpSync` exists since
   // Node 20; the recursive option is required for directories.
@@ -207,14 +207,14 @@ function copySource(): void {
  * when the recorded x-source-version in the dest's package.json differs from
  * the source.
  */
-function readSourceVersion(): string {
+export function readSourceVersion(): string {
   const pkg = JSON.parse(
     readFileSync(path.join(PKG_SOURCE_DIR, 'package.json'), 'utf8'),
   )
   return pkg.version ?? '0.0.0'
 }
 
-function readInstalledVersion(): string | undefined {
+export function readInstalledVersion(): string | undefined {
   const installedPkgPath = path.join(INSTALL_DIR, 'package.json')
   if (!existsSync(installedPkgPath)) {
     return undefined
@@ -227,7 +227,7 @@ function readInstalledVersion(): string | undefined {
   }
 }
 
-function pnpmInstallAtDest(quiet: boolean): void {
+export function pnpmInstallAtDest(quiet: boolean): void {
   const result = spawnSync(
     'pnpm',
     [
@@ -248,7 +248,7 @@ function pnpmInstallAtDest(quiet: boolean): void {
   }
 }
 
-function writeBinShim(): void {
+export function writeBinShim(): void {
   // Shim execs the proxy's top-level bin/ entry. Source lives at
   // INSTALL_DIR/bin/, NOT under node_modules/ — so Node 22+ can strip
   // types from the .mts file at runtime. `node` is on PATH on every
diff --git a/scripts/janus.mts b/scripts/janus.mts
index 1e369e5..539eb7e 100644
--- a/scripts/janus.mts
+++ b/scripts/janus.mts
@@ -27,7 +27,7 @@ import { fileURLToPath } from 'node:url'
 import { WIN32 } from '@socketsecurity/lib-stable/constants/platform'
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
 import { getSocketHomePath } from '@socketsecurity/lib-stable/paths/socket'
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 
 const logger = getDefaultLogger()
 
diff --git a/scripts/lint-github-settings.mts b/scripts/lint-github-settings.mts
index ab504c0..ff28721 100644
--- a/scripts/lint-github-settings.mts
+++ b/scripts/lint-github-settings.mts
@@ -22,7 +22,7 @@
  *   scripts/lint-github-settings.mts --json # machine-readable.
  */
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import process from 'node:process'
diff --git a/scripts/lockstep/checks.mts b/scripts/lockstep/checks.mts
index 6593f2a..d20bb0a 100644
--- a/scripts/lockstep/checks.mts
+++ b/scripts/lockstep/checks.mts
@@ -238,8 +238,8 @@ export function checkFeatureParity(
 
   const codePatterns = row.code_patterns ?? []
   const testPatterns = row.test_patterns ?? []
-  const codeFiles = walkDirFiles(localAreaPath, /\.(m?[jt]sx?|json)$/).filter(
-    f => !/[/\\](__tests__|test|tests)[/\\]|\.test\.|\.spec\./.test(f),
+  const codeFiles = walkDirFiles(localAreaPath, /\.(?:m?[jt]sx?|json)$/).filter(
+    f => !/[/\\](?:__tests__|test|tests)[/\\]|\.test\.|\.spec\./.test(f),
   )
 
   const codeScore =
@@ -251,11 +251,11 @@ export function checkFeatureParity(
   // that directory instead (sdxgen-style where tests live outside the
   // parser directory).
   const testAreaPath = path.join(rootDir, row.test_area ?? row.local_area)
-  const testAreaFiles = walkDirFiles(testAreaPath, /\.(m?[jt]sx?|json)$/)
+  const testAreaFiles = walkDirFiles(testAreaPath, /\.(?:m?[jt]sx?|json)$/)
   const testFiles = row.test_area
     ? testAreaFiles
     : testAreaFiles.filter(f =>
-        /[/\\](__tests__|test|tests)[/\\]|\.test\.|\.spec\./.test(f),
+        /[/\\](?:__tests__|test|tests)[/\\]|\.test\.|\.spec\./.test(f),
       )
   const testScore =
     testPatterns.length === 0
diff --git a/scripts/lockstep/emit-schema.mts b/scripts/lockstep/emit-schema.mts
index bec79ef..84c65da 100644
--- a/scripts/lockstep/emit-schema.mts
+++ b/scripts/lockstep/emit-schema.mts
@@ -10,7 +10,7 @@ import { writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
 
 import { LockstepManifestSchema } from './schema.mts'
diff --git a/scripts/lockstep/git.mts b/scripts/lockstep/git.mts
index 1a9f8e8..42d785a 100644
--- a/scripts/lockstep/git.mts
+++ b/scripts/lockstep/git.mts
@@ -10,7 +10,7 @@
  *   helpers write to.
  */
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 
 import type { Upstream } from './schema.mts'
 import type { DriftCommit, Manifest } from './types.mts'
diff --git a/scripts/power-state.mts b/scripts/power-state.mts
index 2e75287..9418340 100644
--- a/scripts/power-state.mts
+++ b/scripts/power-state.mts
@@ -29,7 +29,7 @@ import { isBuiltin } from 'node:module'
 import path from 'node:path'
 import process from 'node:process'
 
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 
 // Probe for node:smol-power. Lives in socket-btm's node-smol binary
 // — `isBuiltin()` returns true on those builds and false on system
diff --git a/scripts/security.mts b/scripts/security.mts
index 426f51a..d04ae92 100644
--- a/scripts/security.mts
+++ b/scripts/security.mts
@@ -20,10 +20,10 @@
 
 import process from 'node:process'
 
-import { which } from '@socketsecurity/lib-stable/bin'
+import { which } from '@socketsecurity/lib-stable/bin/which'
 import { WIN32 } from '@socketsecurity/lib-stable/constants/platform'
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 
 const logger = getDefaultLogger()
 
diff --git a/scripts/socket-wheelhouse-emit-schema.mts b/scripts/socket-wheelhouse-emit-schema.mts
index adc84b5..5a60c30 100644
--- a/scripts/socket-wheelhouse-emit-schema.mts
+++ b/scripts/socket-wheelhouse-emit-schema.mts
@@ -8,7 +8,7 @@ import { writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
 
 import { SocketWheelhouseConfigSchema } from './socket-wheelhouse-schema.mts'
diff --git a/scripts/test/check-lock-step-header.test.mts b/scripts/test/check-lock-step-header.test.mts
index 605763f..ea783bb 100644
--- a/scripts/test/check-lock-step-header.test.mts
+++ b/scripts/test/check-lock-step-header.test.mts
@@ -9,7 +9,7 @@
 // whose header lists peers + the peer files themselves, vary the
 // peers' headers, and inspect exit code + stderr.
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import os from 'node:os'
diff --git a/scripts/test/check-lock-step-refs.test.mts b/scripts/test/check-lock-step-refs.test.mts
index 2c7ad42..6958a85 100644
--- a/scripts/test/check-lock-step-refs.test.mts
+++ b/scripts/test/check-lock-step-refs.test.mts
@@ -11,7 +11,7 @@
 // script from that cwd and inspect exit code + stderr/stdout. Each test
 // owns its own tmpdir to avoid cross-pollution.
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import os from 'node:os'
diff --git a/scripts/test/install-git-hooks.test.mts b/scripts/test/install-git-hooks.test.mts
index 6b8e451..2e63ed4 100644
--- a/scripts/test/install-git-hooks.test.mts
+++ b/scripts/test/install-git-hooks.test.mts
@@ -18,7 +18,7 @@
 // resolve REPO_ROOT to the real repo and write to the real git config
 // instead of the tmpdir, which is what we want to verify.
 
-import { spawnSync } from '@socketsecurity/lib-stable/spawn'
+import { spawnSync } from '@socketsecurity/lib-stable/spawn/spawn'
 import {
   copyFileSync,
   mkdirSync,
@@ -95,7 +95,7 @@ function runInstaller(
   const r = spawnSync(process.execPath, [installerPath], {
     cwd,
   })
-  return { code: r.status ?? 0, stderr: String(r.stderr) ?? '' }
+  return { code: r.status ?? 0, stderr: r.stderr ? String(r.stderr) : '' }
 }
 
 test('install-git-hooks: sets core.hooksPath when .git + .git-hooks both present', () => {
diff --git a/scripts/update.mts b/scripts/update.mts
index f384b58..f90b857 100644
--- a/scripts/update.mts
+++ b/scripts/update.mts
@@ -19,7 +19,7 @@
  * scripts/ dir and wire it in via a `"update": "node scripts/update.mts"`
  * package.json entry.
  */
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { spawn } from '@socketsecurity/lib-stable/spawn/spawn'
 
 async function run(cmd: string, args: string[]): Promise<boolean> {
   try {
diff --git a/scripts/validate-bundle-deps.mts b/scripts/validate-bundle-deps.mts
index 111007b..c71bb93 100644
--- a/scripts/validate-bundle-deps.mts
+++ b/scripts/validate-bundle-deps.mts
@@ -23,10 +23,15 @@ const logger = getDefaultLogger()
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const rootPath = path.join(__dirname, '..')
 
-// Node.js builtins to ignore (including node: prefix variants)
+// Node.js builtins to ignore (including node: prefix variants).
+// node:smol-* are Socket SEA-bundled optional builtins (smol-util, smol-primordial);
+// they appear in dist behind `mod.isBuiltin('node:smol-util')` guards and are only
+// resolvable in SEA binaries, so they should never be expected in dependencies.
+const SOCKET_SEA_BUILTINS = ['node:smol-util', 'node:smol-primordial']
 const BUILTIN_MODULES = new Set([
   ...builtinModules,
   ...builtinModules.map(m => `node:${m}`),
+  ...SOCKET_SEA_BUILTINS,
 ])
 
 /**
@@ -364,16 +369,14 @@ async function validateBundleDeps(): Promise<ValidationResult> {
 
     // externals + bundled are Set<string> — use for...of, the
     // canonical fix for set / map / iterable iteration.
-    for (let i = 0, { length } = externals; i < length; i += 1) {
-      const ext = externals[i]!
+    for (const ext of externals) {
       const packageName = getPackageName(ext)
       if (packageName && !BUILTIN_MODULES.has(packageName)) {
         allExternals.add(packageName)
       }
     }
 
-    for (let i = 0, { length } = bundled; i < length; i += 1) {
-      const bun = bundled[i]!
+    for (const bun of bundled) {
       allBundled.add(bun)
     }
   }
diff --git a/scripts/validate-file-size.mts b/scripts/validate-file-size.mts
index 19b624a..41b3bcc 100644
--- a/scripts/validate-file-size.mts
+++ b/scripts/validate-file-size.mts
@@ -23,6 +23,19 @@ const rootPath = path.join(__dirname, '..')
 // Maximum file size: 2MB (2,097,152 bytes)
 const MAX_FILE_SIZE = 2 * 1024 * 1024
 
+// Allowlisted large files: fleet-canonical assets whose size is bounded by
+// the upstream they ship, not by repo authoring. acorn.wasm is the AST
+// parser shared by AST-based oxlint plugin rules + hooks; its ~3MB is the
+// upstream build artifact. Two paths because socket-lib vendors its own
+// copy at vendor/acorn-wasm/ (so the lib package's own AST helpers can
+// load without a node_modules round-trip). Adding a path here is
+// intentional — it should only happen for files the fleet jointly owns,
+// not per-repo binary leaks.
+const ALLOWED_LARGE_FILES = new Set<string>([
+  '.claude/hooks/_shared/acorn/acorn.wasm',
+  'vendor/acorn-wasm/acorn.wasm',
+])
+
 // Directories to skip
 const SKIP_DIRS = new Set([
   '.cache',
@@ -95,6 +108,9 @@ async function scanDirectory(
           const stats = await fs.stat(fullPath)
           if (stats.size > MAX_FILE_SIZE) {
             const relativePath = path.relative(rootPath, fullPath)
+            if (ALLOWED_LARGE_FILES.has(relativePath)) {
+              continue
+            }
             violations.push({
               file: relativePath,
               size: stats.size,