diff --git a/.claude/skills/quality-scan/SKILL.md b/.claude/skills/quality-scan/SKILL.md
index c75041421..11014b4af 100644
--- a/.claude/skills/quality-scan/SKILL.md
+++ b/.claude/skills/quality-scan/SKILL.md
@@ -1,479 +1,58 @@
---
name: quality-scan
description: >
- Iteratively scanning socket-cli for code quality issues across critical bugs, logic errors,
- caching problems, workflow issues, security vulnerabilities, and documentation gaps.
- Automatically fixes all discovered issues and commits changes until zero issues remain or
- 5 iterations complete. Use when performing comprehensive quality improvement or preparing
- for releases.
+ Runs iterative code quality scans on socket-cli, fixing all discovered issues
+ and committing changes until zero issues remain or 5 iterations complete.
---
# quality-scan
-## Task Checklist
-
-Copy this checklist to track your progress through each iteration:
-
-```markdown
-### Iteration [N] Progress Tracker
-
-- [ ] Phase 1: Validate git environment
-- [ ] Phase 2: Update dependencies
-- [ ] Phase 3: Clean repository
-- [ ] Phase 4: Validate structure
-- [ ] Phase 5: Determine scan scope
-- [ ] Phase 5b: Install external tools (zizmor)
-- [ ] Phase 6: Execute scans (critical, logic, cache, workflow, security+zizmor, documentation)
-- [ ] Phase 7: Aggregate findings
-- [ ] Phase 8: Generate report
-- [ ] Phase 9: Fix all issues
-- [ ] Phase 10: Run tests
-- [ ] Phase 11: Commit fixes
-- [ ] Decision: Continue to next iteration or exit
-
-**Issues found**: [count]
-**Issues fixed**: [count]
-**Tests status**: [pass/fail]
-```
-
-## Execution Guidelines
-
-
-**Fix comprehensively**: Address all issues regardless of complexity. Architectural problems require fixing, not deferral, because incomplete fixes leave the codebase in an inconsistent state.
-
-**Test continuously**: Run `pnpm test` after each iteration because untested fixes risk introducing regressions that compound across iterations.
-
-**Bound iterations**: Cap at 5 iterations because unbounded loops escalate costs without guaranteed convergence; manual intervention becomes necessary beyond this threshold.
-
-**Work sequentially**: Execute one phase completely before starting the next because each phase's output informs subsequent phases; parallel execution causes missing dependencies.
-
-
-
-Examine repository history to choose the appropriate commit approach:
-
-```bash
-git rev-list --count HEAD
-```
-
-- **If count = 1**: Amend the single commit to maintain clean history
-- **If count > 1**: Create new commits to preserve development timeline
-
-Rationale: Single-commit repos indicate initial setup; amending keeps history clean. Multi-commit repos represent evolution; new commits preserve that narrative.
-
-
-## Phase-by-Phase Execution
-
-### Phase 1: Validate Environment
-
-
-Run `git status` to check repository state.
-
-
-
-- Clean repository → Proceed to Phase 2
-- Dirty repository → Warn user; ask to continue or abort
-- Not a git repository → Exit with error (quality scans require version control)
-
-
-Update checklist: Mark Phase 1 complete.
-
----
-
-### Phase 2: Update Dependencies
-
-
-Run `pnpm install` to ensure current dependencies.
-
-
-Rationale: Outdated packages trigger false positives when scans expect current API signatures.
-
-Track updated packages for commit message context.
-
-Update checklist: Mark Phase 2 complete.
-
----
-
-### Phase 3: Repository Cleanup
-
-
-Find cleanup candidates using Glob tool, then ask user confirmation before deletion.
-
-
-
-1. SCREAMING_TEXT.md files outside `.claude/` and `docs/` directories
-2. Temporary files: `*.tmp`, `*.temp`, `.DS_Store`, `*~`, `*.swp`
-3. Test files outside `test/` or `__tests__/` directories
-
-
-Request confirmation for each file because automated deletion risks removing intentional files with unconventional names.
-
-Update checklist: Mark Phase 3 complete.
-
----
-
-### Phase 4: Structural Validation
-
-
-Use Glob and Grep tools to validate repository structure against socket-cli conventions.
-
-
-
-- package.json scripts follow naming conventions from CLAUDE.md
-- Test files have corresponding vitest configurations
-- Required files exist: tsconfig.json, .oxlintrc.json, vitest.config.mts
-- Imports use `@socketsecurity/lib/*` pattern (not Node.js built-ins where applicable)
-
-
-
-- Missing required files → Critical (blocks builds)
-- Inconsistent naming → High (causes confusion)
-- Missing configs → Medium (reduces effectiveness)
-
-
-Update checklist: Mark Phase 4 complete.
-
----
-
-### Phase 5: Determine Scan Scope
-
-
-Ask user which scans to execute.
-
-
-
-Which scans do you want to run?
-
-1. All scans (recommended for comprehensive quality improvement)
-2. Critical only (crashes, security, data corruption, auth)
-3. Custom selection (choose specific scans)
-
-Default: [1]
-
-
-
-See `reference.md` @reference for detailed agent prompts. Each scan targets specific issue categories:
-
-- **critical**: Crashes, security vulnerabilities, data corruption, auth handling
-- **logic**: Algorithm errors, edge cases, validation bugs
-- **cache**: Config/token caching correctness
-- **workflow**: Build scripts, CI/CD, cross-platform compatibility
-- **security**: GitHub Actions security via zizmor + credential exposure patterns
-- **documentation**: Command examples, API accuracy, missing docs
-
-
-Update checklist: Mark Phase 5 complete.
-
----
-
-### Phase 5b: Install External Tools (zizmor)
-
-
-Install zizmor for GitHub Actions security scanning using version that meets repository's minimumReleaseAge policy.
-
-
-
-Determine the appropriate zizmor version dynamically:
-
-1. **Read minimumReleaseAge from `.pnpmrc`**:
- ```bash
- grep 'minimumReleaseAge' .pnpmrc | cut -d'=' -f2
- ```
- This returns minutes (e.g., `10080` = 7 days). Default to 10080 if not found.
-
-2. **Query zizmor releases** (using curl or gh):
- ```bash
- # Option A: curl (universally available)
- curl -s "https://api.github.com/repos/zizmorcore/zizmor/releases" | \
- jq '[.[] | select(.prerelease == false) | {tag: .tag_name, date: .published_at}] | .[0:10]'
-
- # Option B: gh (if available)
- gh api repos/zizmorcore/zizmor/releases --jq \
- '[.[] | select(.prerelease == false) | {tag: .tag_name, date: .published_at}] | .[0:10]'
- ```
-
-3. **Calculate age and select version**:
- - Convert minimumReleaseAge from minutes to days: `minutes / 1440`
- - Find latest stable release older than that threshold
- - Example: If minimumReleaseAge=10080 (7 days) and today is March 24, select releases from March 17 or earlier
-
-4. **Install selected version** (choose based on available tools):
- ```bash
- # macOS with Homebrew (latest only, version pinning limited)
- brew install zizmor
-
- # Python environments (version pinning supported)
- pipx install zizmor==VERSION
- uv tool install zizmor==VERSION
- uvx zizmor@VERSION --help
- ```
-
- **Recommended priority**: pipx/uvx > brew
-
-
-
-Using minimumReleaseAge prevents supply chain attacks from compromised new releases. The 7-day window allows community detection of malicious packages before adoption.
-
-
-
-If no release meets the age requirement, warn the user and skip zizmor scan. Never install a release younger than minimumReleaseAge.
-
-
-Update checklist: Note zizmor version installed.
-
----
-
-### Phase 6: Execute Scans
-
-
-For each selected scan, spawn an agent using Task tool with the prompt from reference.md @reference.
-
-
-
-1. Use Task tool with `subagent_type='general-purpose'`
-2. Pass the full agent prompt from reference.md for the scan type
-3. Include current repository context (recent git log, modified files)
-4. Collect findings from agent response
-5. Track completion status in your checklist
-
-
-
-Run scans **sequentially** (not parallel) because earlier scans may uncover issues that inform later scans. For example, critical crashes found early prevent wasting tokens on logic scans of unreachable code.
-
-Order: critical → logic → cache → workflow → security → documentation
-
-
-
-For the **security** scan, run zizmor first to get machine-verified findings:
-
-```bash
-# Run zizmor on all workflow files
-zizmor .github/workflows/*.yml --format json > /tmp/zizmor-output.json
-
-# Or for human-readable output
-zizmor .github/workflows/*.yml --format plain
-```
-
-Include zizmor findings in the security scan report. zizmor detects:
-- Template injection vulnerabilities
-- Unpinned action versions
-- Dangerous permissions
-- Artifact poisoning risks
-- Excessive permissions
-
-Merge zizmor output with agent-based security scan findings, deduplicating overlapping issues.
-
-
-Choose an approach and commit to it. Execute all selected scans without revisiting scan selection unless you encounter blocking errors.
-
-Update checklist: Mark Phase 6 complete.
-
----
-
-### Phase 7: Aggregate Findings
-
-
-Collect findings from all agent scans, deduplicate, and prioritize.
-
-
-
-- **Same file and line**: Keep the finding with highest severity
-- **Same issue pattern**: Merge descriptions, preserve most actionable fix
-- **Different scans, same root cause**: Combine into single finding with multiple scan references
-
-
-
-1. Severity: Critical → High → Medium → Low (severity gates determine release readiness)
-2. Scan type: critical → logic → cache → workflow → security → documentation
-3. File path: Alphabetical (enables systematic fixing)
-
-
-
-Ensure each finding includes:
-
-```
-File: packages/cli/src/path/file.mts:123
-Issue: One-line description
-Severity: Critical|High|Medium|Low
-Pattern: Code snippet (2-3 lines)
-Trigger: Input/condition causing the issue
-Fix: Specific code change
-Impact: Consequence if triggered
-```
-
-This structure enables you to apply fixes systematically without re-reading findings.
-
-
-Update checklist: Mark Phase 7 complete.
-
----
-
-### Phase 8: Generate Report
-
-
-Create a comprehensive report using the template below.
-
-
-
-```markdown
-# Quality Scan Report - socket-cli
-
-**Date**: YYYY-MM-DD | **Iteration**: N/5 | **Total Issues**: X
-
-## Summary
-
-| Severity | Count |
-|----------|-------|
-| Critical | X |
-| High | X |
-| Medium | X |
-| Low | X |
-
-## Findings by Severity
-
-### Critical Issues (X)
-
-**1. [Issue title]**
-- File: `packages/cli/src/path/file.mts:123`
-- Pattern: `code snippet`
-- Trigger: When this happens
-- Fix: Specific change
-- Impact: What breaks
-
-[Repeat for each]
-
-[Additional severity sections follow same structure]
-
-## Scan Coverage
-
-| Scan Type | Issues |
-|---------------|--------|
-| critical | X |
-| logic | X |
-| cache | X |
-| workflow | X |
-| security | X |
-| documentation | X |
-```
-
-
-Display report to user. Offer to save to `reports/quality-scan-YYYY-MM-DD.md`.
-
-Update checklist: Mark Phase 8 complete.
-
----
-
-### Phase 9: Fix All Issues
-
-
-Apply fixes for every finding from the report, working from Critical to Low severity.
-
-
-Read each file only once, then apply all fixes for that file using Edit tool. This batching approach minimizes tool calls.
-
-Never speculate about code you have not read. Open each file before editing.
-
-Update checklist: Mark Phase 9 complete.
-
----
-
-### Phase 10: Run Tests
-
-
-Execute `pnpm test` to verify fixes didn't introduce regressions.
-
-
-
-- **All pass**: Proceed to Phase 11
-- **Some fail**: Revert last changes, report failed tests to user, exit iteration
-
-
-Tests validate that fixes solve problems without creating new ones; failures indicate logic errors in fixes requiring manual review.
-
-Update checklist: Mark Phase 10 complete.
-
----
-
-### Phase 11: Commit Fixes
-
-
-Stage changes and create commit using strategy from earlier.
-
-
-
-```
-fix: resolve quality scan issues (iteration N)
-
-- Fixed X critical issues
-- Fixed X high priority issues
-- Fixed X medium priority issues
-- Fixed X low priority issues
-
-Scans: [list of scan types run]
-```
-
-
-Use `git add .` followed by commit (amend if single-commit repo, new commit otherwise).
-
-Update checklist: Mark Phase 11 complete.
-
----
-
-### Phase 12: Iteration Decision
-
-
-Determine whether to continue or exit.
-
-
-
-**Exit conditions**:
-- Zero issues found → Success! Output `QUALITY_SCAN_COMPLETE`
-- Iteration count = 5 → Stop (manual intervention needed)
-
-**Continue condition**:
-- Issues remain AND iteration < 5 → Start new iteration, copy fresh checklist
-
-
-When continuing, increment iteration counter and return to Phase 6 (re-run scans on updated code).
-
----
-
-## Error Recovery
-
-
-**Scan agent failures**: Log warning, continue with remaining scans, note failure in report. Don't abort the entire process because other scans may still find valuable issues.
-
-**Test failures after fixes**: Revert changes from current iteration using `git restore .`, report specific test failures to user, exit. Test failures indicate logic errors requiring human review.
-
-**Git commit failures**: Display error, ask user to resolve manually. Cannot proceed without clean commits because subsequent iterations depend on committed changes.
-
-**Dirty repository**: Warn user, offer to stash changes or continue with dirty state. Continuing risks conflating quality fixes with unrelated changes.
-
-
----
-
-## socket-cli Context
-
-
-Primary targets: `packages/cli/src/`, `packages/cli/test/`, `.github/workflows/`, `scripts/`, `.config/`
-
+
+Your task is to scan socket-cli for code quality issues and fix them iteratively.
+
+
+
+- Fix all issues regardless of complexity; do not defer architectural problems.
+- Run `pnpm test` after each iteration.
+- Cap at 5 iterations; stop and report if issues persist.
+- Execute phases sequentially; each phase's output informs the next.
+- If repo has 1 commit, amend; otherwise create new commits.
+
+
+## Phases
+
+1. **Validate Environment** - `git status`; abort if not a git repo, warn if dirty.
+2. **Update Dependencies** - `pnpm install` to avoid stale-API false positives.
+3. **Repository Cleanup** - Glob for temp files, stray docs; confirm before deletion.
+4. **Structural Validation** - Verify required configs, naming conventions, import patterns.
+5. **Determine Scan Scope** - Ask user: all scans, critical only, or custom selection.
+5b. **Install zizmor** - Install version meeting `.pnpmrc` minimumReleaseAge policy.
+6. **Execute Scans** - Run selected scans sequentially via Task tool using prompts from `reference.md`.
+7. **Aggregate Findings** - Deduplicate, prioritize (Critical > High > Medium > Low).
+8. **Generate Report** - Summary table by severity + scan type, display to user.
+9. **Fix All Issues** - Apply fixes from Critical to Low; read each file before editing.
+10. **Run Tests** - `pnpm test`; revert and exit iteration on failure.
+11. **Commit Fixes** - Stage and commit with summary of fixed issue counts.
+12. **Iteration Decision** - Zero issues = done; otherwise loop back to Phase 6.
+
+## Available Scans
+
+See `reference.md` for detailed agent prompts. Scan types:
+
+- **critical** - Crashes, security vulnerabilities, data corruption, auth handling
+- **logic** - Algorithm errors, edge cases, validation bugs
+- **cache** - Config/token caching correctness
+- **workflow** - Build scripts, CI/CD, cross-platform compatibility
+- **security** - GitHub Actions security via zizmor + credential exposure patterns
+- **documentation** - Command examples, API accuracy, missing docs
+
+## Scan Scope
+
+Primary: `packages/cli/src/`, `packages/cli/test/`, `.github/workflows/`, `scripts/`, `.config/`
Excluded: `node_modules/`, `dist/`, `build/`, `.pnpm-store/`, `packages/*/dist/`
-
-
-
-Apply these socket-cli conventions when scanning and fixing:
-
-- Import pattern: `@socketsecurity/lib/*` (not Node.js built-ins where Socket provides equivalents)
-- Error types: `InputError`, `AuthError` from `src/utils/errors.mts`
-- Logging: `getDefaultLogger()` from `@socketsecurity/lib/logger`
-- File extension: `.mts` for TypeScript modules
-- Type imports: `import type` separately (NEVER mix with runtime imports)
-- CLI framework: meow-based command structure
-
----
-
-## Reference
-
-See `reference.md` @reference for complete agent prompts and pattern definitions.
+## Error Recovery
-**Version**: 1.1.0 (2026-03-24)
+- **Scan agent failure**: Log warning, continue remaining scans.
+- **Test failure after fixes**: `git restore .`, report failures, exit iteration.
+- **Git commit failure**: Display error, ask user to resolve.
diff --git a/.claude/skills/security-scan/SKILL.md b/.claude/skills/security-scan/SKILL.md
index 0ba403fea..161fb5bfa 100644
--- a/.claude/skills/security-scan/SKILL.md
+++ b/.claude/skills/security-scan/SKILL.md
@@ -1,6 +1,6 @@
---
name: security-scan
-description: Run a multi-tool security scan — AgentShield for Claude config, zizmor for GitHub Actions, and optionally Socket CLI for dependency scanning. Produces an A-F graded security report.
+description: Runs a multi-tool security scan — AgentShield for Claude config, zizmor for GitHub Actions, and optionally Socket CLI for dependency scanning. Produces an A-F graded security report.
---
# Security Scan
diff --git a/.claude/skills/updating-checksums/SKILL.md b/.claude/skills/updating-checksums/SKILL.md
index 9a3e5bf0c..2ba0ffb56 100644
--- a/.claude/skills/updating-checksums/SKILL.md
+++ b/.claude/skills/updating-checksums/SKILL.md
@@ -1,6 +1,9 @@
---
name: updating-checksums
-description: Updates SHA-256 checksums from GitHub releases to external-tools.json. Triggers when user mentions "update checksums", "sync checksums", or after releasing new tool versions.
+description: >
+ Syncs SHA-256 checksums from GitHub releases to external-tools.json.
+ Triggers when user mentions "update checksums", "sync checksums", or after
+ releasing new tool versions.
user-invocable: true
allowed-tools: Bash, Read, Edit
---
@@ -11,168 +14,26 @@ allowed-tools: Bash, Read, Edit
Your task is to sync SHA-256 checksums from GitHub releases to the embedded `external-tools.json` file, ensuring SEA builds have up-to-date integrity verification.
-
-**What is this?**
-socket-cli downloads prebuilt security tools (opengrep, python, socket-patch, sfw, trivy, trufflehog) from GitHub releases for bundling into SEA (Single Executable Application) builds. Each release may include a `checksums.txt` file with SHA-256 hashes.
-
-**Architecture:**
-
-- `packages/cli/external-tools.json` - Configuration with embedded checksums
-- `packages/cli/scripts/sync-checksums.mjs` - Sync script for GitHub release tools
-
-**Tool Types in external-tools.json:**
-
-| Type | Example | Checksums |
-|------|---------|-----------|
-| `github-release` | opengrep, trivy, sfw | Synced from releases |
-| `npm` | @coana-tech/cli, synp | SRI integrity hashes |
-| `pypi` | socketsecurity | May have checksums |
-
-**Why Sync?**
-- After tool updates (new versions), checksums become stale
-- SEA builds verify downloads against embedded checksums
-- Version-controlled checksums enable audit trail
-
-
-**CRITICAL Requirements:**
-- Network access required to fetch from GitHub API
-- Only `github-release` type tools are synced
-
-**Do NOT:**
-- Modify checksums manually (always fetch from releases)
-- Skip verification after sync
-- Commit without reviewing changes
-
-**Do ONLY:**
-- Fetch checksums from official GitHub releases
-- Update external-tools.json with new checksums
-- Verify the JSON is valid after update
+- Network access required to fetch from GitHub API.
+- Only `github-release` type tools are synced (not npm or pypi).
+- Never modify checksums manually; always fetch from releases.
+- Verify JSON validity after sync.
+- Review changes before committing.
-
-
-## Process
-
-### Phase 1: Check Current State
-
-
-Review current embedded checksums and tool versions:
-
-
-```bash
-# Show current GitHub release tools in external-tools.json
-grep -A2 '"type": "github-release"' packages/cli/external-tools.json | head -40
-```
-
----
-
-### Phase 2: Sync Checksums
-
-
-Run the sync script to fetch latest checksums:
-
-
-```bash
-# Sync all GitHub release tools
-node packages/cli/scripts/sync-checksums.mjs
-
-# Or sync specific tool
-# node packages/cli/scripts/sync-checksums.mjs --tool=opengrep
-```
-
-
-**Expected Output:**
-```
-Syncing checksums for 6 GitHub release tool(s)...
-
-[opengrep] opengrep/opengrep @ v1.16.0
- Found checksums.txt, downloading...
- Parsed 5 checksums from checksums.txt
- Unchanged: 5 checksums
-
-[python] astral-sh/python-build-standalone @ 3.11.14
- No checksums.txt found, downloading 8 assets to compute checksums...
- ...
-
-Summary: X updated, Y unchanged
-```
-
-**If sync fails:**
-- Check network connectivity
-- Verify release exists: `gh release view --repo `
-- Check GitHub API rate limits
-
-
----
-
-### Phase 3: Verify Changes
-
-
-Review the updated checksums:
-
-
-```bash
-# Show what changed
-git diff packages/cli/external-tools.json
-
-# Validate JSON syntax
-node -e "JSON.parse(require('fs').readFileSync('packages/cli/external-tools.json'))"
-```
+## Phases
----
-
-### Phase 4: Commit Changes (if any)
-
-
-If checksums were updated, commit the changes:
-
-
-```bash
-# Only if there are changes
-git add packages/cli/external-tools.json
-git commit -m "chore(cli): sync external tool checksums
-
-Update embedded SHA-256 checksums from GitHub releases.
-Enables SEA builds with up-to-date integrity verification."
-```
-
-
-
-## Success Criteria
-
-- All GitHub release tools synced from releases
-- external-tools.json updated with latest checksums
-- JSON syntax validated
-- Changes committed (if any updates)
+1. **Check Current State** - Review current checksums and tool versions in `packages/cli/external-tools.json`.
+2. **Sync Checksums** - Run `node packages/cli/scripts/sync-checksums.mjs`. Tries `checksums.txt` from the release first; falls back to downloading assets and computing SHA-256.
+3. **Verify Changes** - `git diff packages/cli/external-tools.json`; validate JSON syntax.
+4. **Commit Changes** - If updated, commit `packages/cli/external-tools.json`.
## Commands
```bash
-# Sync all GitHub release tools
-node packages/cli/scripts/sync-checksums.mjs
-
-# Sync specific tool
-node packages/cli/scripts/sync-checksums.mjs --tool=opengrep
-
-# Dry run (show what would change)
-node packages/cli/scripts/sync-checksums.mjs --dry-run
-
-# Force update even if unchanged
-node packages/cli/scripts/sync-checksums.mjs --force
+node packages/cli/scripts/sync-checksums.mjs # Sync all
+node packages/cli/scripts/sync-checksums.mjs --tool=opengrep # Sync one
+node packages/cli/scripts/sync-checksums.mjs --dry-run # Preview
+node packages/cli/scripts/sync-checksums.mjs --force # Force update
```
-
-## Context
-
-This skill is useful for:
-
-- After updating tool versions in external-tools.json
-- When new GitHub releases are published
-- Before building SEA executables
-- Regular maintenance to keep checksums current
-
-**Behavior:**
-1. First tries to download `checksums.txt` from the GitHub release
-2. If not available, downloads each asset and computes SHA-256 hashes
-3. Only updates tools with `type: "github-release"`
-4. npm packages use SRI integrity hashes (not handled by this script)
diff --git a/.claude/skills/updating/SKILL.md b/.claude/skills/updating/SKILL.md
index 4a43b1c97..8d8d3b207 100644
--- a/.claude/skills/updating/SKILL.md
+++ b/.claude/skills/updating/SKILL.md
@@ -1,6 +1,9 @@
---
name: updating
-description: Coordinates all dependency updates (npm packages and external tool checksums). Triggers when user asks to "update everything", "update dependencies", or prepare for a release.
+description: >
+ Coordinates all dependency updates (npm packages and external tool checksums).
+ Triggers when user asks to "update everything", "update dependencies", or
+ prepare for a release.
user-invocable: true
allowed-tools: Task, Skill, Bash, Read, Grep, Glob, Edit
---
@@ -11,183 +14,22 @@ allowed-tools: Task, Skill, Bash, Read, Grep, Glob, Edit
Your task is to update all dependencies in socket-cli: npm packages via `pnpm run update`, then sync external tool checksums, ensuring all builds and tests pass.
-
-**What is this?**
-socket-cli uses npm packages and external tools (opengrep, python, socket-patch, sfw, trivy, trufflehog) that need periodic updates for security patches, bug fixes, and new features.
-
-**Existing Skills:**
-- `updating-checksums` - Syncs SHA-256 checksums from GitHub releases to external-tools.json
-- `quality-scan` - Comprehensive quality scanning and issue fixing
-
-**Update Targets:**
-1. **npm packages** - Updated via `pnpm run update`
-2. **External tool checksums** - Updated via `updating-checksums` skill
-
-
-**Requirements:**
-- Start with clean working directory (no uncommitted changes)
-- Target stable releases only (exclude -rc, -alpha, -beta tags)
-
-**CI Mode** (detected via `CI=true` or `GITHUB_ACTIONS`):
-- Create atomic commits, skip build validation (CI validates separately)
-- Workflow handles push and PR creation
-
-**Interactive Mode** (default):
-- Validate each update with build/tests before proceeding
-- Report validation results to user
-
-**Actions:**
-- Update npm packages and external tool checksums
-- Create atomic commits for each update
-- Report comprehensive summary of all changes
+- Start with clean working directory (no uncommitted changes).
+- Target stable releases only (exclude -rc, -alpha, -beta tags).
+- **CI mode** (`CI=true` or `GITHUB_ACTIONS`): Create atomic commits, skip build validation.
+- **Interactive mode** (default): Validate each update with build/tests before proceeding.
-
-
-## Process
-
-### Phase 1: Validate Environment
-
-
-Check working directory is clean and detect CI mode:
-
-
-```bash
-# Detect CI mode
-if [ "$CI" = "true" ] || [ -n "$GITHUB_ACTIONS" ]; then
- CI_MODE=true
- echo "Running in CI mode - will skip build validation"
-else
- CI_MODE=false
- echo "Running in interactive mode - will validate builds"
-fi
-
-# Check working directory is clean
-git status --porcelain
-```
-
-
-- Working directory must be clean
-- CI_MODE detected for subsequent phases
-
-
----
-
-### Phase 2: Update npm Packages
-
-
-Run pnpm run update to update npm dependencies:
-
-
-```bash
-# Update npm packages
-pnpm run update
-
-# Check if there are changes
-if [ -n "$(git status --porcelain pnpm-lock.yaml package.json packages/*/package.json)" ]; then
- git add pnpm-lock.yaml package.json packages/*/package.json
- git commit -m "chore: update npm dependencies
-
-Updated npm packages via pnpm run update."
- echo "npm packages updated"
-else
- echo "npm packages already up to date"
-fi
-```
-
----
-
-### Phase 3: Update External Tool Checksums
-
-
-Use the updating-checksums skill to sync SHA-256 checksums from GitHub releases:
-
-
-```
-Skill({ skill: "updating-checksums" })
-```
-
-Wait for skill completion before proceeding.
-
----
-
-### Phase 4: Final Validation
-
-
-Run full build and test suite (skip in CI mode):
-
-
-```bash
-if [ "$CI_MODE" = "true" ]; then
- echo "CI mode: Skipping final validation (CI will run builds/tests separately)"
- echo "Commits created - ready for push by CI workflow"
-else
- echo "Interactive mode: Running full validation..."
- pnpm run fix --all
- pnpm run check --all
- pnpm test
-fi
-```
-
----
-
-### Phase 5: Report Summary
-
-
-Generate comprehensive update report:
-
-
-```
-## Update Complete
-
-### Updates Applied:
-
-| Category | Status |
-|----------|--------|
-| npm packages | Updated/Up to date |
-| External tool checksums | Updated/Up to date |
-
-### Commits Created:
-- [list commits]
-
-### Validation:
-- Build: SUCCESS/SKIPPED (CI mode)
-- Tests: PASS/SKIPPED (CI mode)
-
-### Next Steps:
-**Interactive mode:**
-1. Review changes: `git log --oneline -N`
-2. Push to remote: `git push origin main`
-
-**CI mode:**
-1. Workflow will push branch and create PR
-2. CI will run full build/test validation
-3. Review PR when CI passes
-```
-
-
-
-## Success Criteria
-
-- All npm packages checked for updates
-- External tool checksums synced
-- Full build and tests pass (interactive mode)
-- Comprehensive summary report generated
-
-## Commands
-
-This skill coordinates other skills:
-
-- Uses `updating-checksums` skill for external tool checksums
-- Direct pnpm commands for npm package updates
-
-## Context
+## Phases
-This skill is useful for:
+1. **Validate Environment** - Verify clean working directory; detect CI vs interactive mode.
+2. **Update npm Packages** - Run `pnpm run update`; commit if changes detected.
+3. **Update External Tool Checksums** - Invoke the `updating-checksums` skill.
+4. **Final Validation** - In interactive mode: `pnpm run fix --all`, `pnpm run check --all`, `pnpm test`. Skipped in CI.
+5. **Report Summary** - List updates applied, commits created, validation results, and next steps.
-- Weekly maintenance (automated via weekly-update.yml)
-- Security patch rollout across all dependencies
-- Pre-release preparation
+## Coordinates
-**Safety:** Each update is validated independently. Failures stop the process.
+- `updating-checksums` skill for external tool checksums
+- `pnpm run update` for npm packages
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4437a7ee6..a3b2ed9f8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -109,7 +109,7 @@ jobs:
export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
CODE
- - uses: SocketDev/socket-registry/.github/actions/setup-and-install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
+ - uses: SocketDev/socket-registry/.github/actions/setup-and-install@96c2a403934488b2b1d6127e44f65fd2c36c1150 # main
with:
checkout: 'false'
@@ -168,7 +168,7 @@ jobs:
export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
CODE
- - uses: SocketDev/socket-registry/.github/actions/setup-and-install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
+ - uses: SocketDev/socket-registry/.github/actions/setup-and-install@96c2a403934488b2b1d6127e44f65fd2c36c1150 # main
with:
checkout: 'false'
@@ -234,7 +234,7 @@ jobs:
export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
CODE
- - uses: SocketDev/socket-registry/.github/actions/setup-and-install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
+ - uses: SocketDev/socket-registry/.github/actions/setup-and-install@96c2a403934488b2b1d6127e44f65fd2c36c1150 # main
with:
checkout: 'false'
node-version: ${{ matrix.node-version }}
@@ -310,7 +310,7 @@ jobs:
export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
CODE
- - uses: SocketDev/socket-registry/.github/actions/setup-and-install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
+ - uses: SocketDev/socket-registry/.github/actions/setup-and-install@96c2a403934488b2b1d6127e44f65fd2c36c1150 # main
with:
checkout: 'false'
node-version: ${{ matrix.node-version }}
diff --git a/.github/workflows/provenance.yml b/.github/workflows/provenance.yml
index e3e9c881a..86ceac345 100644
--- a/.github/workflows/provenance.yml
+++ b/.github/workflows/provenance.yml
@@ -51,7 +51,7 @@ jobs:
with:
persist-credentials: false
- - uses: SocketDev/socket-registry/.github/actions/setup-and-install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
+ - uses: SocketDev/socket-registry/.github/actions/setup-and-install@96c2a403934488b2b1d6127e44f65fd2c36c1150 # main
with:
checkout: 'false'
@@ -91,7 +91,7 @@ jobs:
with:
persist-credentials: false
- - uses: SocketDev/socket-registry/.github/actions/setup-and-install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
+ - uses: SocketDev/socket-registry/.github/actions/setup-and-install@96c2a403934488b2b1d6127e44f65fd2c36c1150 # main
with:
checkout: 'false'
registry-url: 'https://registry.npmjs.org'
@@ -134,14 +134,14 @@ jobs:
timeout-minutes: 45
permissions:
contents: read
- id-token: write
+ id-token: write # NPM trusted publishing via OIDC
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- - uses: SocketDev/socket-registry/.github/actions/setup-and-install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
+ - uses: SocketDev/socket-registry/.github/actions/setup-and-install@96c2a403934488b2b1d6127e44f65fd2c36c1150 # main
with:
checkout: 'false'
registry-url: 'https://registry.npmjs.org'
@@ -354,6 +354,7 @@ jobs:
done
- name: Summary
+ # zizmor: ignore[template-injection]
run: |
echo "## Publish Summary" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/weekly-update.yml b/.github/workflows/weekly-update.yml
index a316e4d33..0d95bec1d 100644
--- a/.github/workflows/weekly-update.yml
+++ b/.github/workflows/weekly-update.yml
@@ -29,7 +29,7 @@ jobs:
with:
persist-credentials: false
- - uses: SocketDev/socket-registry/.github/actions/setup-and-install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
+ - uses: SocketDev/socket-registry/.github/actions/setup-and-install@96c2a403934488b2b1d6127e44f65fd2c36c1150 # main
with:
checkout: 'false'
@@ -52,8 +52,8 @@ jobs:
if: needs.check-updates.outputs.has-updates == 'true' && inputs.dry-run != true
runs-on: ubuntu-latest
permissions:
- contents: write
- pull-requests: write
+ contents: write # Push update branch
+ pull-requests: write # Create PR
steps:
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -61,7 +61,7 @@ jobs:
fetch-depth: 0
persist-credentials: false
- - uses: SocketDev/socket-registry/.github/actions/setup-and-install@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
+ - uses: SocketDev/socket-registry/.github/actions/setup-and-install@96c2a403934488b2b1d6127e44f65fd2c36c1150 # main
with:
checkout: 'false'
@@ -69,13 +69,14 @@ jobs:
id: branch
env:
GH_TOKEN: ${{ github.token }}
+ GITHUB_REPO: ${{ github.repository }}
run: |
BRANCH_NAME="weekly-update-$(date +%Y%m%d)"
- git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
+ git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPO}.git"
git checkout -b "$BRANCH_NAME"
echo "branch=$BRANCH_NAME" >> $GITHUB_OUTPUT
- - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
+ - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@96c2a403934488b2b1d6127e44f65fd2c36c1150 # main
with:
gpg-private-key: ${{ secrets.BOT_GPG_PRIVATE_KEY }}
@@ -302,7 +303,7 @@ jobs:
test.log
retention-days: 7
- - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@4edf2e3c3beff7d536e79ce43dfb61abba7cb537 # main
+ - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@96c2a403934488b2b1d6127e44f65fd2c36c1150 # main
if: always()
notify:
diff --git a/CLAUDE.md b/CLAUDE.md
index 8b5872945..6aa55880f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -2,132 +2,86 @@
**MANDATORY**: Act as principal-level engineer. Follow these guidelines exactly.
-## 👤 USER CONTEXT
+## USER CONTEXT
-- **Identify users by git credentials**: Extract name from git commit author, GitHub account, or context
-- 🚨 **When identity is verified**: ALWAYS use their actual name - NEVER use "the user" or "user"
-- **Direct communication**: Use "you/your" when speaking directly to the verified user
-- **Discussing their work**: Use their actual name when referencing their commits/contributions
-- **Example**: If git shows "John-David Dalton ", refer to them as "John-David"
-- **Other contributors**: Use their actual names from commit history/context
+- Identify users by git credentials (commit author, GitHub account). Use their actual name, never "the user".
+- Use "you/your" when speaking directly; use their name when discussing their work.
## PRE-ACTION PROTOCOL
**MANDATORY**: Review CLAUDE.md before any action. No exceptions.
-- Before ANY structural refactor on a file >300 LOC: remove dead code, unused exports, unused imports first — commit that cleanup separately before the real work
-- Multi-file changes: break into phases (≤5 files each), verify each phase before the next
-- When pointed to existing code as a reference: study it before building — working code is a better spec than any description
-- Work from raw error data, not theories — if a bug report has no error output, ask for it
+- Before ANY structural refactor on a file >300 LOC: remove dead code, unused exports, unused imports first -- commit that cleanup separately
+- Multi-file changes: break into phases (<=5 files each), verify each phase before the next
+- When pointed to existing code as a reference: study it before building
+- Work from raw error data, not theories -- if a bug report has no error output, ask for it
- On "yes", "do it", or "go": execute immediately, no plan recap
## VERIFICATION PROTOCOL
**MANDATORY**: Before claiming any task is complete:
-1. Run the actual command — execute the script, run the test, check the output
+1. Run the actual command -- execute the script, run the test, check the output
2. State what you verified, not just "looks good"
-3. **FORBIDDEN**: Claiming "Done" when any test output shows failures, or characterizing incomplete/broken work as complete
+3. **FORBIDDEN**: Claiming "Done" when any test output shows failures
4. If type-check or lint is configured, run it and fix ALL errors before reporting done
5. Re-read every file modified; confirm nothing references something that no longer exists
## CONTEXT & EDIT SAFETY
-- After 10+ messages: re-read any file before editing it — do not trust remembered contents
-- Read files >500 LOC in chunks using offset/limit; never assume one read captured the whole file
-- Before every edit: re-read the file. After every edit: re-read to confirm the change applied correctly
-- When renaming anything, search separately for: direct calls, type references, string literals, dynamic imports, re-exports, test files — one grep is not enough
-- Never fix a display/rendering problem by duplicating state — one source of truth, everything reads from it
+- After 10+ messages: re-read any file before editing it
+- Read files >500 LOC in chunks using offset/limit
+- Before every edit: re-read the file. After every edit: re-read to confirm
+- When renaming: search for direct calls, type references, string literals, dynamic imports, re-exports, test files -- one grep is not enough
+- Never fix a display/rendering problem by duplicating state
-## JUDGMENT PROTOCOL
+## JUDGMENT & SCOPE
-- If the user's request is based on a misconception, say so before executing
-- If you spot a bug adjacent to what was asked, flag it: "I also noticed X — want me to fix it?"
-- You are a collaborator, not just an executor
-
-## SCOPE PROTOCOL
-
-- Do not add features, refactor, or make improvements beyond what was asked — band-aids when asked for band-aids
-- Try the simplest approach first; if architecture is actually flawed, flag it and wait for approval before restructuring
-- When asked to "make a plan," output only the plan — no code until given the go-ahead
+- If the request is based on a misconception, say so before executing
+- If you spot a bug adjacent to what was asked, flag it
+- Do not add features, refactor, or make improvements beyond what was asked
+- Try the simplest approach first; flag architecture issues and wait for approval
+- When asked to "make a plan," output only the plan -- no code until given the go-ahead
## SELF-EVALUATION
-- Before calling anything done: present two views — what a perfectionist would reject vs. what a pragmatist would ship — let the user decide
+- Before calling anything done: present what a perfectionist would reject vs. what a pragmatist would ship
- After fixing a bug: explain why it happened and what category of bug it represents
-- If a fix doesn't work after two attempts: stop, re-read the relevant section top-down, state where the mental model was wrong, propose something fundamentally different
-- If asked to "step back" or "we're going in circles": drop everything, rethink from scratch
+- If a fix doesn't work after two attempts: stop, re-read top-down, state where the mental model was wrong
+- If asked to "step back": drop everything, rethink from scratch
## HOUSEKEEPING
-- Before risky changes: offer to checkpoint — "want me to commit before this?"
-- If a file is getting unwieldy (>400 LOC): flag it — "this is big enough to cause pain — want me to split it?"
+- Before risky changes: offer to checkpoint
+- If a file is getting unwieldy (>400 LOC): flag it
## Critical Rules
-### Fix ALL Issues
-
-- **Fix ALL issues when asked** - Never dismiss issues as "pre-existing" or "not caused by my changes"
-- When asked to fix, lint, or check: fix everything found, regardless of who introduced it
-- Always address all issues found during lint/check operations
-
-## ABSOLUTE RULES
-
-- Never create files unless necessary
-- Always prefer editing existing files
+- **Fix ALL issues when asked** -- never dismiss issues as "pre-existing"
+- Never create files unless necessary; always prefer editing existing files
- Forbidden to create docs unless requested
-- Required to do exactly what was asked
-- 🚨 **NEVER use `npx`, `pnpm dlx`, or `yarn dlx`** — use `pnpm exec ` for devDep binaries, or `pnpm run