chore(wheelhouse): cascade template@e670893ac860d1aa90bcd8994759534ffc503adb

Author: jdalton

.config/fleet/oxlintrc.json

@@ -6,8 +6,8 @@
   "schemaVersion": 1,
   "repoName": "socket-cli",
   "bundle": {
-    "ref": "fleet-pack-34b047176c416cd46f1919ad0bba35a0bb7b84b3",
-    "cascadeSha": "34b047176c416cd46f1919ad0bba35a0bb7b84b3"
+    "ref": "fleet-pack-e670893ac860d1aa90bcd8994759534ffc503adb",
+    "cascadeSha": "e670893ac860d1aa90bcd8994759534ffc503adb"
   },
   "repo": {
     "type": "mono"

.config/fleet/tsconfig.check.json

@@ -279,6 +279,7 @@ const repoResolveConditions = resolveVitestConditions()
 // Lane resolution. The runner sets FLEET_LANE (bare `pnpm test` → 'fast'); the
 // filter also applies under coverage. An unset lane traverses every lane.
 const vitestLanes = readVitestLanes()
+const fastLaneGlobs = vitestLanes.fast
 const slowLaneGlobs = vitestLanes.slow ?? []
 const midLaneGlobs = vitestLanes.mid ?? []
 const activeLane = process.env['FLEET_LANE']
@@ -361,9 +362,9 @@ const config = defineConfig({
       'test/fleet/scripts/setup.mts',
       'test/repo/scripts/setup.mts',
     ].filter(p => existsSync(p)),
-    // `--lane mid|slow` runs ONLY that lane (include = its globs); every other
-    // run (bare-fast, --all, scoped, cover) uses the full-suite glob and lets
-    // the exclude below drop the fast-lane's mid+slow. `**/`-anchored so a
+    // Explicit fast membership makes mid the complement of fast and slow.
+    // Legacy configs retain implicit fast membership and explicit mid globs.
+    // `**/`-anchored so a
     // monorepo's nested `packages/<name>/test/**` trees are discovered from this
     // one root config — a bare `test/**/*.test...` only anchors at the repo
     // root, silently missing every sub-package's tests (each scoped `vitest run`
@@ -373,11 +374,13 @@ const config = defineConfig({
       ? [...FUZZ_GLOBS]
       : conformanceTier
         ? laneToTestGlobs(conformanceGlobs)
-        : laneFilterActive && activeLane === 'mid'
-          ? laneToTestGlobs(midLaneGlobs)
-          : laneFilterActive && activeLane === 'slow'
-            ? laneToTestGlobs(slowLaneGlobs)
-            : ['**/test/**/*.test.{js,ts,mjs,mts,cjs}'],
+        : laneFilterActive && activeLane === 'fast' && fastLaneGlobs
+          ? laneToTestGlobs(fastLaneGlobs)
+          : laneFilterActive && activeLane === 'mid' && !fastLaneGlobs
+            ? laneToTestGlobs(midLaneGlobs)
+            : laneFilterActive && activeLane === 'slow'
+              ? laneToTestGlobs(slowLaneGlobs)
+              : ['**/test/**/*.test.{js,ts,mjs,mts,cjs}'],
     // Vitest treats `test/**` as `**/test/**`, so without an explicit
     // exclude it picks up every nested `test/` directory in the repo
     // — including the `.git-hooks/test/`, the oxlint plugin's per-rule
@@ -434,14 +437,13 @@ const config = defineConfig({
       // settings file's `vitest.nodeTestExclude`. The same key feeds
       // prefer-vitest-guard's allowlist so the two never drift.
       ...repoNodeTestExcludeGlobs(),
-      // Fast lane (`--lane fast`, the bare `pnpm test` default) skips the mid +
-      // slow lane globs (heavy/isolated suites) for a quick local loop. Inert
-      // for an unset lane. Coverage explicitly selects each lane in turn;
-      // `--lane mid|slow` scopes via the
-      // include above instead, so no exclusion is applied for them here.
+      // With explicit fast membership, mid owns every test outside fast and
+      // slow. Legacy configs keep fast as the complement of mid and slow.
       ...(laneFilterActive && activeLane === 'fast'
         ? [...midLaneGlobs, ...slowLaneGlobs]
-        : []),
+        : laneFilterActive && activeLane === 'mid' && fastLaneGlobs
+          ? [...fastLaneGlobs, ...slowLaneGlobs]
+          : []),
     ],
     // Some repos in the fleet (scaffolding-only, hook-only, etc.) ship
     // this config but don't yet have a `test/` directory — vitest's
@@ -514,7 +516,8 @@ const config = defineConfig({
     // drifted copy here.
     coverage: {
       enabled: isCoverageEnabled,
-      ...resolveCoverageConfig(),
+      // Ordinary tests do not need the workspace scan for coverage aliases.
+      ...(isCoverageEnabled ? resolveCoverageConfig() : {}),
     },
   },
 })

.config/repo/external-tools.json

@@ -44,13 +44,16 @@ export interface VitestRepoConfig {
  * (.config/repo/socket-wheelhouse.json; see paths.mts's resolver order for the
  * fallbacks). `slow` = heavy suites (subprocess-per-case, e.g. hook integration
  * specs); `mid` = isolated in-process suites (env-mutating / vi.mock /
- * fs-heavy); `fast` = the implicit complement, pure in-process. The runner's
+ * fs-heavy); `fast` = pure in-process. When `fast` is declared, `mid` becomes
+ * the complement of `fast` and `slow`, so unclassified tests remain covered.
+ * Without it, `fast` remains the complement of `mid` and `slow`. The runner's
  * `--lane <fast|mid|slow>` flag (scripts/fleet/test.mts) selects one, and bare
  * `pnpm test` defaults to `fast` for a quick local loop. The lane filter is
  * active under coverage too. An unset FLEET_LANE traverses every lane; the
  * coverage runner selects each lane in turn and merges their reports.
  */
 export interface VitestLanes {
+  fast?: string[] | undefined
   mid?: string[] | undefined
   slow?: string[] | undefined
 }
@@ -131,7 +134,11 @@ export function readNonIsolatedGlobs(): string[] {
 export function readVitestLanes(): VitestLanes {
   const lanes = readVitestSettings().lanes
   return lanes !== null && typeof lanes === 'object' && !Array.isArray(lanes)
-    ? { mid: stringArray(lanes.mid), slow: stringArray(lanes.slow) }
+    ? {
+        ...(Array.isArray(lanes.fast) ? { fast: stringArray(lanes.fast) } : {}),
+        mid: stringArray(lanes.mid),
+        slow: stringArray(lanes.slow),
+      }
     : {}
 }
 

.config/repo/socket-wheelhouse.json

@@ -1,13 +1,19 @@
 import { spawnSync } from '@socketsecurity/lib-stable/process/spawn/child'
-import { existsSync, readdirSync, readFileSync } from 'node:fs'
+import { existsSync, lstatSync, readdirSync, readFileSync } from 'node:fs'
 import path from 'node:path'
+import { readCanonicalIndexEntry, readCanonicalTreeEntry } from './git.mts'
+import { canonicalMemberCopyMatches } from './proof.mts'
+import type { CanonicalIndexEntry } from './git.mts'
 
 import {
   fleetCanonicalEntries,
   isOperatorLocalPath,
   isPerRepoMarkerPath,
-} from '../../.claude/hooks/fleet/_shared/fleet-fork.mts'
-import { textHasFleetBlockMarkers } from '../../.claude/hooks/fleet/_shared/fleet-markers.mts'
+} from '../../../.claude/hooks/fleet/_shared/fleet-fork.mts'
+import {
+  findFleetRegions,
+  textHasFleetBlockMarkers,
+} from '../../../.claude/hooks/fleet/_shared/fleet-markers.mts'
 
 // Each child names one capability or member, never an arbitrary generated
 // bucket. Generated universal files map directly to the destination tree.
@@ -62,19 +68,27 @@ export function templateTwinPaths(repoRoot: string, file: string): string[] {
 export function matchesTemplateTwin(
   repoRoot: string,
   file: string,
-  content: string,
+  content: string | Uint8Array,
+  mode = '100644',
 ): boolean {
   const candidates = templateTwinPaths(repoRoot, file)
   for (let i = 0, { length } = candidates; i < length; i += 1) {
-    let twin: string
     try {
-      twin = readFileSync(candidates[i]!, 'utf8')
+      const stat = lstatSync(candidates[i]!)
+      const candidateMode = stat.mode & 0o111 ? '100755' : '100644'
+      if (!stat.isFile() || candidateMode !== mode) {
+        continue
+      }
+      if (
+        readFileSync(candidates[i]!).equals(
+          typeof content === 'string' ? Buffer.from(content) : content,
+        )
+      ) {
+        return true
+      }
     } catch {
       continue
     }
-    if (twin === content) {
-      return true
-    }
   }
   return false
 }
@@ -199,27 +213,48 @@ export function scanCanonicalForkPaths(
     if (!isCanonical) {
       continue
     }
-    if (matchesMergeParentIndex(repoRoot, file)) {
-      continue
-    }
-    // Fleet-block allowance: a canonical file carrying `<fleet-canonical>`
-    // markers is only PART fleet-managed — content outside the markers is
-    // repo-owned, so staging it is normal repo work, not a fork.
-    let content = ''
-    try {
-      content = readFileSync(path.join(repoRoot, file), 'utf8')
-    } catch {
-      // Unreadable (permissions, binary) — fall through as non-exempt; a
-      // canonical path staged unreadable is still worth surfacing.
-    }
-    if (textHasFleetBlockMarkers(content)) {
-      continue
-    }
-    // Byte-identical to canonical is propagation, not divergence.
-    if (matchesTemplateTwin(repoRoot, file, content)) {
+    const entry = readCanonicalIndexEntry(repoRoot, file)
+    if (entry && stagedCanonicalFileIsAllowed(repoRoot, file, entry)) {
       continue
     }
     findings.push({ file })
   }
   return findings
 }
+
+function fleetRegionBodies(content: Uint8Array): string[] {
+  const text = Buffer.from(content).toString('utf8')
+  if (!textHasFleetBlockMarkers(text)) {
+    return []
+  }
+  const lines = text.split(/(?<=\n)/u)
+  return findFleetRegions(lines).map(region =>
+    lines.slice(region.start, region.end + 1).join(''),
+  )
+}
+
+function stagedCanonicalFileIsAllowed(
+  repoRoot: string,
+  file: string,
+  entry: CanonicalIndexEntry,
+): boolean {
+  if (matchesMergeParentIndex(repoRoot, file)) {
+    return true
+  }
+  const baseline = readCanonicalTreeEntry(repoRoot, 'HEAD', file)
+  if (baseline && baseline.mode === entry.mode) {
+    const before = fleetRegionBodies(baseline.content)
+    const after = fleetRegionBodies(entry.content)
+    if (
+      before.length > 0 &&
+      before.length === after.length &&
+      before.every((body, index) => body === after[index])
+    ) {
+      return true
+    }
+  }
+  return (
+    matchesTemplateTwin(repoRoot, file, entry.content, entry.mode) ||
+    canonicalMemberCopyMatches(repoRoot, file, entry)
+  )
+}