Merge branch 'fix/scan-report-large-output' into jdalton/report-version-main

Author: jdalton

.config/repo/lockstep.json

@@ -101,7 +101,7 @@
         "honors a custom stdio",
         "merges options.env"
       ],
-      "notes": "The patch adapter resolves and executes socket-patch with argument, environment, and stdio forwarding. The sparse upstream contains core implementation, CLI commands, and behavioral tests for incorporation. This row covers the execution adapter; patch algorithms are implemented by the upstream executable."
+      "notes": "The adapter resolves and executes `socket-patch` with argument, environment, and stdio forwarding. It remains the CLI implementation until the in-process TypeScript port reaches the upstream contract. The public SocketDev/socket-patch source pin is `15a6ba6f416c244e918ff01260a1bc91f67bc945` on `main`, with a depth-one single-branch checkout of core, CLI, and tests. The upstream license is MIT."
     }
   ]
 }

.gitignore

@@ -189,7 +189,9 @@ opencode.json
 .claude/commands/fleet/update-hooks-dry.md
 .claude/commands/fleet/update-pricing.md
 .claude/commands/fleet/update-security.md
+.claude/hooks/fleet/_dist/fleet-pack.excluded.generated.cjs
 .claude/hooks/fleet/_dist/fleet-pack.generated.cjs
+.claude/hooks/fleet/_dist/fleet-pack.snapshot.generated.cjs
 .claude/hooks/fleet/_dist/launchers/dispatch-launcher-darwin-arm64
 .claude/hooks/fleet/_dist/launchers/dispatch-launcher-darwin-x64
 .claude/hooks/fleet/_dist/launchers/dispatch-launcher-linux-arm64

.gitmodules

@@ -45,13 +45,13 @@
 	verify = none
 
 # no-release-tag: Development reference pins the explicitly selected main commit.
-# socket-patch-main (2026-09-08) sha256:40c6e9c3f5663a32d73eb2f3398be23ec2ea15f356a2a56fadc7749662dd3b49
+# socket-patch-main (2026-09-23) sha256:f557f5cac56056ca409478af4884bfd7de7bc4b37453412d058b5d5669c32fbe
 [submodule "upstream/socket-patch"]
 	ignore = dirty
-	ref = a0b04807d158ae5c0d980370ad31a15fcc9b030e
+	ref = 15a6ba6f416c244e918ff01260a1bc91f67bc945
 	path = upstream/socket-patch
 	url = https://github.com/SocketDev/socket-patch.git
 	branch = main
 	shallow = true
-	sparse-checkout = crates/socket-patch-core/src crates/socket-patch-core/tests crates/socket-patch-cli/src tests
+	sparse-checkout = crates/socket-patch-core/src crates/socket-patch-core/tests crates/socket-patch-cli tests
 	verify = none

.node-version

@@ -1 +1 @@
-26.8.1
+26.10.0

AGENTS.md

@@ -169,3 +169,11 @@
 - A written mermaid fence gets rewritten GitHub-safe at edit time. [`hook-registry`](docs/fleet/agents.md/hook-registry.md)
 
 <!-- </fleet> -->
+
+## 🏗️ CLI-Specific
+
+- Build production native binaries with `pnpm run build:native:prod`; inspect them with `pnpm run check:native-package`.
+- Use `pnpm test <path>` for focused tests. Native release tests live under `test/repo/unit/build/sea/` and `test/repo/unit/sea/`.
+- Version selection, reservation, and source tagging belong to the npm release pipeline. Use the `next` dist-tag for prereleases; do not edit the package version to start a release.
+- Native release signing and notarization run in macOS CI. The Apple certificate passphrase is CI-only. The workflow qualifies one packed artifact on all eight supported targets. See [native release](docs/repo/agents.md/native-release.md).
+- Inspect staged package state with `pnpm run npm:staged`. After validation, approve eligible stages with `pnpm stage approve`; use the AI Drive/browser path only for CLI fallback or an npm challenge.

docs/repo/agents.md/native-release.md

@@ -0,0 +1,39 @@
+# Native release
+
+The npm release pipeline owns the release version, changelog, source commit, and reserved tag. Start it through `pnpm run publish:npm --dist-tag next` for the prerelease channel. Do not edit `package.json` to reserve a release. The native workflow consumes the reserved source SHA and package version.
+
+## Local checks
+
+Build the production native matrix and inspect the resulting package:
+
+```sh
+pnpm run build:native:prod
+pnpm run check:native-package
+```
+
+Focused release tests:
+
+```sh
+pnpm test test/repo/unit/build/sea/release.test.mts
+pnpm test test/repo/unit/check/publish-contract-is-valid.test.mts
+pnpm test test/repo/unit/sea/check.test.mts
+```
+
+## CI qualification
+
+The `publish: native` workflow builds and signs the package on macOS. The Apple certificate passphrase is supplied only as a CI secret. The workflow uploads one package archive, verifier, and receipt. Qualification jobs check the archive and digests, then run that verifier for all eight targets:
+
+- `darwin-arm64`
+- `darwin-x64`
+- `linux-arm64`
+- `linux-arm64-musl`
+- `linux-x64`
+- `linux-x64-musl`
+- `win32-arm64`
+- `win32-x64`
+
+The macOS jobs also run Gatekeeper qualification. Treat the artifact as qualified only when the workflow reports success for every target.
+
+## Stage
+
+Inspect the staged package with `pnpm run npm:staged`. After artifact validation and the configured malware scan pass, approve eligible stages with `pnpm stage approve`. Ignore and monitor findings do not block approval. Use the AI Driver/browser fallback when the CLI cannot complete authentication or npm presents a challenge.

package.json

@@ -92,8 +92,6 @@
     "check:hooks": "node scripts/fleet/check.mts --category=hooks",
     "check:native-package": "node scripts/repo/build/sea/check.mts",
     "check:paths": "node scripts/fleet/check/paths-are-valid.mts",
-    "docs:commands:check": "node scripts/repo/check/docs-commands.mts",
-    "docs:commands:test": "node scripts/fleet/test.mts test/repo/unit/check/docs-command-inventory.test.mts test/repo/unit/check/docs-commands.test.mts",
     "check:test": "node scripts/fleet/commands/run.mts check test",
     "check:test-budget-headroom": "node scripts/fleet/check/test-budget-headroom.mts",
     "check:types": "node scripts/fleet/check.mts --category=types",
@@ -205,7 +203,6 @@
     "publish:npm": "node scripts/fleet/npm/publish/run.mts",
     "release:github": "node scripts/fleet/release/github/remote.mts",
     "release:hint": "node scripts/fleet/release/hint.mts",
-    "release:nightly:plan": "node scripts/fleet/release/nightly/cli.mts",
     "review:comments": "node scripts/fleet/comment-review/run.mts",
     "review:pr": "node scripts/fleet/ai/review/jev/run.mts",
     "ruleset:bypass": "node scripts/fleet/grant-ruleset-bypass.mts",
@@ -286,6 +283,9 @@
     "weekly-update": "node scripts/fleet/weekly-update.mts",
     "weekly-update:ci": "gh workflow run cron-weekly-update.yml",
     "worktree:create": "node scripts/fleet/worktree/create/run.mts",
+    "docs:commands:check": "node scripts/repo/check/docs-commands.mts",
+    "docs:commands:test": "node scripts/fleet/test.mts test/repo/unit/check/docs-command-inventory.test.mts test/repo/unit/check/docs-commands.test.mts",
+    "release:nightly:plan": "node scripts/fleet/release/nightly/cli.mts",
     "ci:fix:preview": "node scripts/fleet/ci/fix/preview.mts"
   },
   "devDependencies": {

pnpm-workspace.yaml

@@ -292,7 +292,6 @@ catalog:
   mock-fs: 5.5.0
   nanotar: 0.2.1
   npm-package-arg: 13.0.2
-  npm-run-all2: 9.0.3
   octokit: 5.0.5
   open: 10.2.0
   packageurl-js: npm:@socketregistry/packageurl-js@^1.5.0

scripts/repo/build-infra/unicode-property-escape-transform.mts

@@ -149,18 +149,41 @@ export function hasUnsupportedUnicodeFeatures(pattern: string) {
  * Transform a regex pattern by replacing \p{Property} with character classes.
  */
 export function transformRegexPattern(pattern: string) {
-  let transformed = pattern
-
-  // Replace \p{Property} with character class equivalents.
-  for (const [prop, replacement] of Object.entries(unicodePropertyMap)) {
-    const escapedProp = prop.replace(/[\\{}]/g, '\\$&')
-    // Replace \p{Property} with [replacement].
-    transformed = transformed.replace(
-      new RegExp(`\\\\p\\{${escapedProp}\\}`, 'g'),
-      () => `[${replacement}]`,
-    )
+  let transformed = ''
+  let inCharacterClass = false
+  for (let index = 0; index < pattern.length; index += 1) {
+    const character = pattern[index]!
+    if (character === '\\') {
+      if (
+        pattern.charCodeAt(index + 1) === 112 /* 'p' */ &&
+        pattern.charCodeAt(index + 2) === 123 /* '{' */
+      ) {
+        const propertyEnd = pattern.indexOf('}', index + 3)
+        if (propertyEnd !== -1) {
+          const property = pattern.slice(index + 3, propertyEnd)
+          if (Object.hasOwn(unicodePropertyMap, property)) {
+            const replacement =
+              unicodePropertyMap[property as keyof typeof unicodePropertyMap]
+            transformed += inCharacterClass ? replacement : `[${replacement}]`
+            index = propertyEnd
+            continue
+          }
+        }
+      }
+      transformed += character
+      if (index + 1 < pattern.length) {
+        transformed += pattern[index + 1]
+        index += 1
+      }
+      continue
+    }
+    if (character === '[' && !inCharacterClass) {
+      inCharacterClass = true
+    } else if (character === ']' && inCharacterClass) {
+      inCharacterClass = false
+    }
+    transformed += character
   }
-
   return transformed
 }
 
@@ -230,15 +253,7 @@ export function transformUnicodePropertyEscapes(content: string) {
         const originalPattern = originalRegex.slice(1, lastSlash)
         const originalFlags = originalRegex.slice(lastSlash + 1)
 
-        // Do the same transformations on the source text.
-        let newPattern = originalPattern
-        for (const [prop, replacement] of Object.entries(unicodePropertyMap)) {
-          const escapedProp = prop.replace(/[\\{}]/g, '\\$&')
-          newPattern = newPattern.replace(
-            new RegExp(`\\\\p\\{${escapedProp}\\}`, 'g'),
-            () => `[${replacement}]`,
-          )
-        }
+        const newPattern = transformRegexPattern(originalPattern)
 
         // Remove /u and /v flags from the original flags.
         const newFlags = originalFlags.replace(/[uv]/g, '')

scripts/repo/build/sea/build.mts

@@ -8,7 +8,7 @@ import { isMainModule } from '../../../fleet/process/is-main-module.mts'
 import { runMain } from '../../../fleet/process/main/run.mts'
 import { BINJECT_VERSION, NODE_SMOL_VERSION } from '../constants/sea-assets.mts'
 import { fetchSeaAsset } from './assets.mts'
-import { relocateDarwinInitializerOffsets } from './initializer-offsets.mts'
+import { repairDarwinInitializerOffsets } from './initializer-repair.mts'
 import { extractSmolRuntime } from './runtime.mts'
 import { signAndNotarizeSeaBinary } from './sign.mts'
 import type { SeaSigningReceipt } from './sign.mts'
@@ -344,11 +344,7 @@ async function buildSeaTarget(
       )
     }
     if (target === 'darwin-x64') {
-      const injected = await readFile(output)
-      const relocated = relocateDarwinInitializerOffsets(runtime, injected)
-      if (relocated !== injected) {
-        await writeFile(output, relocated)
-      }
+      await repairDarwinInitializerOffsets(runtime, output)
     }
   }
   if (entitlementsPath) {