diff --git a/.config/repo/oxlint.config.mts b/.config/repo/oxlint.config.mts
index e74427b9..d0cdb135 100644
--- a/.config/repo/oxlint.config.mts
+++ b/.config/repo/oxlint.config.mts
@@ -1,37 +1,27 @@
 /**
- * @file Socket-vscode repo oxlint config. Imports the fleet factory and
- *   augments it in JS — see `.config/fleet/oxlint.config.mts` for why this is
- *   a factory call rather than oxlint `extends` (extends drops
- *   plugins/categories/ignorePatterns and mis-roots relative globs).
+ * Repository-owned lint configuration. Keep the basic lint command usable
+ * without hydrating the shared Fleet config.
  */
-
-import { config } from '../fleet/oxlint.config.mts'
-
-export default config({
-  rules: {
-    // This extension is interop-heavy by nature: acorn AST node probing
-    // (js-source-externals), the Go wasm runtime glue (wasm-executor), branded
-    // TextDocumentURIString casts, and JSON.parse narrowing across scripts.
-    // Every one of its ~90 `as` sites is a deliberate narrowing at an untyped
-    // boundary, so the type-aware blanket rule is noise here. Re-enable per
-    // directory as boundaries grow real validators (typebox schemas already
-    // cover the lockstep manifest path).
-    'typescript/no-unsafe-type-assertion': 'off',
+export default {
+  categories: {
+    correctness: "error",
+    suspicious: "warn",
   },
-  overrides: [
-    {
-      // tsgolint resolves each file's nearest tsconfig; everything outside
-      // src/ falls back to a projectless view WITHOUT the fleet base's
-      // noUncheckedIndexedAccess, so the type-aware pass mislabels the
-      // `arr[i]!` assertions those trees need as "unnecessary" and its
-      // autofix strips them — breaking the check-tier tsc
-      // (.config/fleet/tsconfig.check.json), which DOES see the fleet base.
-      // Scope the rule to src/ (covered by the root tsconfig project) until
-      // the scripts/test trees get a real tsconfig project of their own.
-      files: ['scripts/**', 'test/**', 'vendor/**', '.github/**', '*.mts'],
-      rules: {
-        'typescript/no-unnecessary-type-assertion': 'off',
-      },
-    },
+  ignorePatterns: [
+    "coverage/**",
+    "out/**",
+    "vendor/**",
+    "scripts/**",
+    "test/**",
+    ".github/**",
+    ".git-hooks/**",
+    ".claude/**",
+    ".config/**",
+    "docs/**",
   ],
-})
+  plugins: ["typescript"],
+  rules: {
+    "no-unused-vars": "off",
+    "typescript/no-unsafe-type-assertion": "off",
+  },
+};
diff --git a/.config/repo/rolldown.config.mts b/.config/repo/rolldown.config.mts
index b7757dbd..8794cfbc 100644
--- a/.config/repo/rolldown.config.mts
+++ b/.config/repo/rolldown.config.mts
@@ -6,7 +6,6 @@ import type { Plugin, RolldownOptions } from 'rolldown'
 
 import { getEnvValue } from '@socketsecurity/lib-stable/env/rewire'
 
-import { defineGuardedPlugin } from '../fleet/rolldown/define-guarded.mts'
 
 const rootPath = path.resolve(import.meta.dirname, '../..')
 const require = createRequire(import.meta.url)
@@ -47,6 +46,19 @@ export function stageParserWasmPlugin(): Plugin {
   }
 }
 
+export function defineExtensionVersionPlugin(version: string): Plugin {
+  const replacement = JSON.stringify(version)
+  return {
+    name: 'define-extension-version',
+    transform(source) {
+      return source.replace(
+        /process\s*\.\s*env\s*\[\s*(['"])INLINED_EXTENSION_VERSION\1\s*\]/gu,
+        replacement,
+      )
+    },
+  }
+}
+
 const pkg = JSON.parse(
   readFileSync(path.join(rootPath, 'package.json'), 'utf8'),
 ) as { version?: string | undefined }
@@ -89,9 +101,7 @@ const config: RolldownOptions = {
     // `process.env['X']` on index-signature types — and both normalize to this
     // same key. The `INLINED_*` name follows the fleet convention (see
     // socket-cli) for build-inlined values.
-    defineGuardedPlugin({
-      'process.env.INLINED_EXTENSION_VERSION': JSON.stringify(extensionVersion),
-    }),
+    defineExtensionVersionPlugin(extensionVersion),
     stageParserWasmPlugin(),
   ],
   // The sources are `.mts` (the fleet's sources-are-mts rule) and import each
diff --git a/.config/repo/tsconfig.json b/.config/repo/tsconfig.json
index 3cdf785d..03c565d1 100644
--- a/.config/repo/tsconfig.json
+++ b/.config/repo/tsconfig.json
@@ -1,5 +1,17 @@
 {
-  "extends": ["../fleet/tsconfig.base.json", "./tsconfig.check.json"],
+  "compilerOptions": {
+    "allowImportingTsExtensions": true,
+    "allowSyntheticDefaultImports": true,
+    "esModuleInterop": true,
+    "lib": ["DOM", "ES2024"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "noEmit": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "target": "ES2024",
+    "types": ["node", "vscode"]
+  },
   "include": ["../../src/**/*.mts", "../../src/**/*.d.ts"],
-  "exclude": ["../../node_modules"]
+  "exclude": ["../../node_modules", "../../out"]
 }
diff --git a/.config/repo/vitest.config.mts b/.config/repo/vitest.config.mts
new file mode 100644
index 00000000..88310681
--- /dev/null
+++ b/.config/repo/vitest.config.mts
@@ -0,0 +1,26 @@
+import path from "node:path";
+import { defineConfig } from "vitest/config";
+
+const root = path.resolve(import.meta.dirname, "../..");
+
+export default defineConfig({
+  resolve: {
+    alias: {
+      vscode: path.join(root, "test/stubs/vscode.mts"),
+    },
+  },
+  test: {
+    setupFiles: [path.join(root, "test/repo/vitest.setup.mts")],
+    include: ["test/repo/unit/**/*.test.mts"],
+    exclude: [
+      "test/**/*.fuzz.mts",
+      "test/repo/unit/test-extension.test.mts",
+      "test/repo/unit/test-extension-auth.test.mts",
+      "test/repo/unit/scripts/install-claude-plugins.test.mts",
+    ],
+    testTimeout: 15000,
+    hookTimeout: 15000,
+    pool: "forks",
+    maxWorkers: 4,
+  },
+});
diff --git a/.github/actions/fleet/setup/action.yml b/.github/actions/fleet/setup/action.yml
index 818a8696..40574a37 100644
--- a/.github/actions/fleet/setup/action.yml
+++ b/.github/actions/fleet/setup/action.yml
@@ -789,18 +789,16 @@ runs:
         # Source of truth (baked into the binary) lives at
         # SocketDev/firewall:src/lib/registries/default.ts.
         #
-        # The bypass list itself lives in the wheelhouse-canonical
-        # location `.config/fleet/sfw-bypass-list.txt` (action_path is
-        # the running repo checkout (inlined local action);
-        # `../../../../.config/fleet` walks up out of
-        # `.github/actions/fleet/setup/` to repo root). Every fleet repo gets
-        # a byte-identical copy via sync-scaffolding, so socket-btm's
-        # install-sfw.mts can read its own local copy at the same path.
+        # A Fleet checkout may provide repo-specific registry bypass entries.
+        # Standalone repos do not carry that Fleet config and rely on the
+        # registry defaults compiled into Socket Firewall.
         BYPASS_FILE="${{ github.action_path }}/../../../../.config/fleet/sfw-bypass-list.txt"
         {
           echo 'SFW_CUSTOM_REGISTRIES<<EOF'
-          # Strip comments + blank lines so the env var holds only real entries.
-          grep -vE '^\s*(#|$)' "$BYPASS_FILE"
+          if [ -f "$BYPASS_FILE" ]; then
+            # Strip comments + blank lines so the env var holds only entries.
+            grep -vE '^\s*(#|$)' "$BYPASS_FILE" || true
+          fi
           if [[ -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]]; then
             OIDC_HOST="${ACTIONS_ID_TOKEN_REQUEST_URL#*://}"
             OIDC_HOST="${OIDC_HOST%%/*}"
diff --git a/.github/workflows/ci-gates.yml b/.github/workflows/ci-gates.yml
index 323b625e..7c3be5a2 100644
--- a/.github/workflows/ci-gates.yml
+++ b/.github/workflows/ci-gates.yml
@@ -55,20 +55,14 @@ jobs:
             git fetch "${FETCH_ARGS[@]}"
           fi
           git checkout -q --detach FETCH_HEAD
-      - name: Set up and install
-        uses: ./.github/actions/fleet/setup-and-install
+      - name: Set up environment
+        uses: ./.github/actions/fleet/setup
         with:
-          # Full history: the commit-history checks (AI-attribution,
-          # release-boundary) read the default branch's history and refuse a
-          # shallow clone rather than false-green.
-          checkout-fetch-depth: '0'
           socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
-          payload-token-client-id: ${{ secrets.SOCKET_RELEASE_CLIENT_ID || vars.SOCKET_RELEASE_CLIENT_ID }}
-          payload-token-private-key: ${{ secrets.SOCKET_RELEASE_APP_PRIVATE_KEY }}
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
       - name: Check repository
-        uses: ./.github/actions/fleet/run-script
-        with:
-          main-script: pnpm run check --all
+        run: pnpm run check
 
   test:
     name: Test (${{ matrix.os }})
@@ -102,17 +96,14 @@ jobs:
             git fetch "${FETCH_ARGS[@]}"
           fi
           git checkout -q --detach FETCH_HEAD
-      - name: Set up and install
-        uses: ./.github/actions/fleet/setup-and-install
+      - name: Set up environment
+        uses: ./.github/actions/fleet/setup
         with:
           socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
-          payload-token-client-id: ${{ secrets.SOCKET_RELEASE_CLIENT_ID || vars.SOCKET_RELEASE_CLIENT_ID }}
-          payload-token-private-key: ${{ secrets.SOCKET_RELEASE_APP_PRIVATE_KEY }}
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
       - name: Build and test
-        uses: ./.github/actions/fleet/run-script
-        with:
-          setup-script: pnpm run build
-          main-script: pnpm test --ci
+        run: pnpm test
 
   full-test:
     name: Full test (${{ matrix.os }})
@@ -146,14 +137,11 @@ jobs:
             git fetch "${FETCH_ARGS[@]}"
           fi
           git checkout -q --detach FETCH_HEAD
-      - name: Set up and install
-        uses: ./.github/actions/fleet/setup-and-install
+      - name: Set up environment
+        uses: ./.github/actions/fleet/setup
         with:
           socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
-          payload-token-client-id: ${{ secrets.SOCKET_RELEASE_CLIENT_ID || vars.SOCKET_RELEASE_CLIENT_ID }}
-          payload-token-private-key: ${{ secrets.SOCKET_RELEASE_APP_PRIVATE_KEY }}
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
       - name: Build and test
-        uses: ./.github/actions/fleet/run-script
-        with:
-          setup-script: pnpm run build
-          main-script: pnpm test --all
+        run: pnpm test
diff --git a/.github/workflows/cron-weekly-fuzz.yml b/.github/workflows/cron-weekly-fuzz.yml
index b93acb61..44a88eac 100644
--- a/.github/workflows/cron-weekly-fuzz.yml
+++ b/.github/workflows/cron-weekly-fuzz.yml
@@ -401,7 +401,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           SDXGEN_GITHUB_TOKEN: ${{ steps.sdxgen-token.outputs.token }}
           FLEET_TEST_FUZZ: '1'
-        run: pnpm run test --all
+        run: pnpm run test:fuzz
       - name: Run the JS fuzz campaign
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/package.json b/package.json
index 81308e93..8483f9e6 100644
--- a/package.json
+++ b/package.json
@@ -40,227 +40,32 @@
     "provenance": true
   },
   "scripts": {
-    "ai-balancer": "node scripts/fleet/ai/balancer/launch.mts",
-    "ai-balancer:auth": "node scripts/fleet/ai/balancer/login.mts",
-    "ai-balancer:doctor": "node scripts/fleet/ai/balancer/doctor.mts",
-    "ai-balancer:refresh": "node scripts/fleet/ai/balancer/service.mts refresh",
-    "ai-balancer:savings": "node scripts/fleet/ai-balancer-savings.mts",
-    "ai-balancer:service": "node scripts/fleet/ai/balancer/service.mts",
-    "ai:drive:check": "node scripts/fleet/check/browser-extension-build-current.mts",
-    "ai:drive:doctor": "node scripts/fleet/ai/browser/bridge/doctor.mts",
-    "ai:drive:setup": "node scripts/fleet/setup/browser/bridge.mts",
-    "ai:drive:verify": "node scripts/fleet/ai/browser/bridge/verify-installed.mts",
-    "ai:odai:cache": "node scripts/fleet/ai/odai/run.mts cache",
-    "ai:odai:ci": "node scripts/fleet/ai/odai/ci.mts",
-    "ai:odai:diagnose": "node scripts/fleet/ai/odai/run.mts diagnose",
-    "ai:read": "node scripts/fleet/ai/bounded-reader.mts",
-    "audit:consumer-source": "node scripts/fleet/audit/consumer-source.mts",
-    "backup": "node scripts/fleet/backup/work/run.mts",
-    "browser:advice": "node scripts/fleet/ai/browser/agent/jev/run.mts",
-    "browser:bridge": "node scripts/fleet/ai/browser/bridge/cli.mts",
-    "browser:open-setup": "node scripts/fleet/ai/browser/open-setup.mts",
     "build": "pnpm run build:dev",
-    "build:check": "node scripts/fleet/commands/run.mts build check",
     "build:dev": "rolldown -c .config/repo/rolldown.config.mts",
-    "build:hook-bundle": "node scripts/fleet/build-hook-bundle.mts",
-    "build:hook-snapshot": "node scripts/fleet/build-hook-snapshot.mts",
-    "build:oxlint-bundle": "node scripts/fleet/build-oxlint-bundle.mts",
     "build:prod": "MINIFY=1 rolldown -c .config/repo/rolldown.config.mts",
-    "build:snapshot-launcher": "node scripts/fleet/build-snapshot-launcher.mts",
-    "build:test": "node scripts/fleet/commands/run.mts build test",
-    "build:update": "node scripts/fleet/commands/run.mts build update",
-    "check": "node scripts/fleet/check.mts",
-    "check:deadcode": "node scripts/fleet/analysis/fallow.mts deadcode",
-    "check:deps": "node scripts/fleet/check.mts --category=deps",
-    "check:duplication": "node scripts/fleet/analysis/fallow.mts duplication",
-    "check:fix": "node scripts/fleet/check/fix.mts",
-    "check:fleet": "node scripts/fleet/check.mts",
-    "check:hooks": "node scripts/fleet/check.mts --category=hooks",
-    "check:paths": "node scripts/fleet/check/paths-are-valid.mts",
-    "check:test": "node scripts/fleet/commands/run.mts check test",
-    "check:test-budget-headroom": "node scripts/fleet/check/test-budget-headroom.mts",
-    "check:types": "node scripts/fleet/check.mts --category=types",
-    "check:update": "node scripts/fleet/commands/run.mts check update",
-    "check:workspace-installation": "node scripts/fleet/check/workspace-installation.mts",
-    "ci:check": "node scripts/fleet/commands/run.mts ci check",
-    "ci:diagnose": "node .claude/skills/fleet/agent-ci/run.mts",
+    "check": "pnpm run build && pnpm run typecheck && pnpm run lint && pnpm run format:check",
     "ci:fix": "node scripts/fleet/ci/fix/run.mts",
-    "ci:fix:preview": "node scripts/fleet/ci/fix/preview.mts",
     "ci:gates": "node scripts/fleet/ci/gates/run.mts",
-    "ci:local": "node scripts/fleet/ci/local/run.mts run --all --quiet --github-token --pause-on-failure",
-    "ci:test": "node scripts/fleet/commands/run.mts ci test",
-    "ci:update": "node scripts/fleet/commands/run.mts ci update",
-    "clean": "node scripts/fleet/clean.mts",
-    "coordination:claim": "node scripts/fleet/coordination/claim.mts",
-    "coordination:mail": "node scripts/fleet/coordination/mail.mts",
+    "clean": "node scripts/repo/clean.mts",
     "cover": "node scripts/fleet/cover.mts",
     "cover:aggregate": "node scripts/fleet/cover-aggregate.mts",
-    "cover:allowance": "node scripts/fleet/cover/allowance.mts",
-    "cover:balance": "node scripts/fleet/cover/balance.mts",
-    "cover:check": "node scripts/fleet/commands/run.mts cover check",
-    "cover:fix": "node scripts/fleet/cover/fix.mts",
-    "cover:shard": "node scripts/fleet/cover-shard.mts",
-    "cover:test": "node scripts/fleet/commands/run.mts cover test",
-    "cover:types": "node scripts/fleet/cover/types/run.mts",
-    "cover:update": "node scripts/fleet/commands/run.mts cover update",
-    "crates:auth": "node scripts/fleet/registry/cargo/auth.mts",
-    "credentials": "node scripts/fleet/credentials/run.mts",
-    "credentials:gh": "node scripts/fleet/credentials/gh/run.mts",
-    "credentials:migrate": "node scripts/fleet/credentials/migrate.mts",
-    "depot:auth": "node scripts/fleet/registry/depot/browser-auth.mts",
-    "doctor": "node scripts/fleet/doctor.mts",
-    "doctor:auth": "node scripts/fleet/check/setup-is-prompt-less.mts",
-    "doctor:credentials": "node scripts/fleet/credentials/doctor.mts",
-    "fix": "node scripts/fleet/fix.mts",
-    "fix:js": "node scripts/fleet/fix.mts --js",
-    "fix:repo": "node scripts/fleet/fix.mts --repo",
-    "fleet:status": "node scripts/repo/bootstrap/fleet.mjs --status",
-    "fleet:update": "node scripts/repo/bootstrap/fleet.mjs",
-    "fmt:js": "node scripts/fleet/format.mts",
-    "format": "node scripts/fleet/format.mts",
-    "format:check": "node scripts/fleet/format.mts --check",
-    "format:test": "node scripts/fleet/commands/run.mts format test",
-    "format:update": "node scripts/fleet/commands/run.mts format update",
-    "gen:glyph": "node scripts/fleet/gen/glyph.mts",
-    "gen:mcp:config": "node scripts/fleet/mcp/config.mts",
-    "gh:auth": "node scripts/fleet/gh-auth.mts",
-    "git:admin:merge": "node scripts/fleet/git/admin/merge.mts",
-    "git:admin:push": "node scripts/fleet/git/admin/push.mts",
-    "git:deliver": "node scripts/fleet/git/deliver/cli.mts",
-    "git:history": "node scripts/fleet/git/history/cli.mts",
-    "github:browser": "node scripts/fleet/ai/browser/drive/github.com/auth/run.mts",
-    "hide-comments": "node scripts/fleet/github/comments/hide.mts",
-    "hooks:global:sync": "node scripts/fleet/sync-global-hooks.mts",
-    "hooks:repo:sync": "node scripts/repo/bootstrap/fleet.mjs",
-    "hooks:sync": "node scripts/fleet/hooks/sync.mts",
-    "integrity-refresh": "node scripts/fleet/external-tools/refresh.mts",
-    "jev:benchmark": "node scripts/fleet/ai/eval/cli.mts",
-    "jev:events": "node scripts/fleet/ai/balancer/events/cli.mts",
-    "jev:revision": "node scripts/fleet/ai/classifiers/cli.mts",
-    "lint": "node scripts/fleet/lint.mts",
-    "lint:check": "node scripts/fleet/commands/run.mts lint check",
-    "lint:fix": "node scripts/fleet/lint/fix.mts",
-    "lint:js": "node scripts/fleet/lint.mts",
-    "lint:test": "node scripts/fleet/commands/run.mts lint test",
-    "lint:update": "node scripts/fleet/commands/run.mts lint update",
-    "lockstep": "node scripts/fleet/lockstep.mts",
-    "lockstep:assist": "node scripts/fleet/lockstep/assist/run.mts",
-    "lockstep:check": "node scripts/fleet/commands/run.mts lockstep check",
-    "lockstep:emit-mirror-globs": "node scripts/fleet/lockstep-emit-mirror-globs.mts",
-    "lockstep:emit-schema": "node scripts/fleet/lockstep-emit-schema.mts",
-    "lockstep:fix": "node scripts/fleet/commands/run.mts lockstep fix",
-    "lockstep:test": "node scripts/fleet/commands/run.mts lockstep test",
-    "lockstep:update": "node scripts/fleet/lockstep/update.mts",
-    "mcp:1password": "node scripts/fleet/mcp/1password/run.mts",
-    "mcp:connect": "node scripts/fleet/mcp/connect.mts",
-    "mcp:pgbot": "node scripts/fleet/mcp/pgbot/run.mts",
-    "mcp:reset": "node scripts/fleet/mcp/reset.mts",
-    "mcp:schemas:check": "node scripts/fleet/mcp/schemas.mts check",
-    "mcp:schemas:save": "node scripts/fleet/mcp/schemas.mts save",
-    "mcp:status": "node scripts/fleet/mcp/connect.mts --status",
-    "npm:approve": "node scripts/fleet/npm/approve.mts",
-    "npm:auth": "node scripts/fleet/npm/auth/run.mts",
-    "npm:auth:browser": "node scripts/fleet/npm-auth-browser.mts",
+    "fix": "pnpm run lint:fix && pnpm run format",
+    "format": "oxfmt --ignore-path .config/fleet/.prettierignore .config/repo/oxlint.config.mts .config/repo/tsconfig.json .config/repo/vitest.config.mts test/repo/vitest.setup.mts",
+    "format:check": "oxfmt --check --ignore-path .config/fleet/.prettierignore .config/repo/oxlint.config.mts .config/repo/tsconfig.json .config/repo/vitest.config.mts test/repo/vitest.setup.mts",
+    "lint": "oxlint --config .config/repo/oxlint.config.mts src",
+    "lint:fix": "oxlint --config .config/repo/oxlint.config.mts --fix src",
     "npm:dispatch": "node scripts/fleet/npm/publish/run.mts",
-    "npm:inventory": "node scripts/fleet/registry/npm/account/inventory/read.mts",
     "npm:release-record": "node scripts/fleet/release/record/run.mts",
-    "npm:scan": "node scripts/fleet/npm/scan.mts",
-    "npm:staged": "node scripts/fleet/npm/staged.mts",
-    "npm:trust": "node scripts/fleet/registry/npm/settings/trust.mts",
-    "npm:trust:browser": "node scripts/fleet/registry/npm/settings/trusted-publisher/browser.mts",
-    "npm:trust:migrate": "node scripts/fleet/npm/trusted-publisher/run.mts",
-    "offload:model": "node scripts/fleet/offload-model.mts",
     "package-for-vscode": "pnpm run build:prod && vsce package --no-dependencies",
-    "preflight": "node scripts/repo/bootstrap/fleet.mjs --quiet && node scripts/fleet/preflight.mts",
-    "prepare": "node scripts/repo/bootstrap/prepare.mts && node scripts/fleet/install-git-hooks.mts && node scripts/fleet/prepare.mts",
     "prepublishOnly": "echo 'ERROR: Use GitHub Actions workflow for publishing' && exit 1",
-    "prose": "node scripts/fleet/prose/run.mts",
-    "prune:branch-backups": "node scripts/fleet/backup/branches/run.mts prune",
-    "prune:gha-caches": "node scripts/fleet/workflow/caches/prune.mts",
-    "publish:npm": "node scripts/fleet/npm/publish/run.mts",
-    "release:github": "node scripts/fleet/release/github/remote.mts",
-    "release:hint": "node scripts/fleet/release/hint.mts",
     "release:nightly:plan": "node scripts/fleet/release/nightly/cli.mts",
-    "review:comments": "node scripts/fleet/comment-review/run.mts",
-    "review:pr": "node scripts/fleet/ai/review/jev/run.mts",
-    "ruleset:bypass": "node scripts/fleet/grant-ruleset-bypass.mts",
-    "search:code": "node scripts/fleet/ai/search/run.mts",
-    "security": "node scripts/fleet/security.mts",
-    "setup-all": "node scripts/fleet/setup/index.mts",
-    "setup-security-tools": "node scripts/fleet/setup/security/tools.mts",
-    "setup:0-mise": "node scripts/fleet/setup/mise.mts --bootstrap",
-    "setup:1-token": "node scripts/fleet/setup/token.mts",
-    "setup:1password": "node scripts/fleet/setup/one-password.mts",
-    "setup:3-hook-snapshot": "node scripts/fleet/setup/hook-snapshot.mts",
-    "setup:4-repo-steps": "node scripts/fleet/setup/repo-steps.mts",
-    "setup:ai-clients": "node scripts/fleet/setup/ai-clients.mts",
-    "setup:brew": "node scripts/fleet/setup/brew.mts",
-    "setup:ci:local": "node scripts/fleet/ci/local/setup.mts",
-    "setup:ci:remote": "node scripts/fleet/ci/remote/setup.mts",
-    "setup:credentials": "node scripts/fleet/setup/credentials.mts",
-    "setup:fff": "node scripts/fleet/setup/fff.mts",
-    "setup:github:app": "node scripts/fleet/github/credentials/setup.mts",
-    "setup:go": "node scripts/fleet/setup/go.mts",
-    "setup:hook-snapshot": "node scripts/fleet/setup/hook-snapshot.mts",
-    "setup:iterm2": "node scripts/fleet/setup/iterm2/run.mts",
-    "setup:mise": "node scripts/fleet/setup/mise.mts",
-    "setup:offload-providers": "node scripts/fleet/setup/offload-providers.mts",
-    "setup:pgbot": "node scripts/fleet/setup/pgbot.mts",
-    "setup:python": "node scripts/fleet/setup/python.mts",
-    "setup:refero": "node scripts/fleet/setup/refero.mts",
-    "setup:repo-steps": "node scripts/fleet/setup/repo-steps.mts",
-    "setup:rust": "node scripts/fleet/setup/rust.mts",
     "setup:rust-coverage": "node scripts/fleet/setup/rust-coverage.mts",
-    "setup:security": "node scripts/fleet/setup/security/run.mts",
-    "setup:security-tools": "node scripts/fleet/setup/security/tools.mts",
-    "setup:sfw-ca": "node scripts/fleet/setup/sfw-ca.mts",
-    "setup:token:rotate": "node scripts/fleet/setup/token.mts --rotate",
-    "setup:xcode": "node scripts/fleet/setup/xcode-license.mts",
-    "setup:xcode-license": "node scripts/fleet/setup/xcode-license.mts",
-    "slack:auth": "node scripts/fleet/setup/slack-token.mts",
-    "slack:token": "node scripts/fleet/setup/slack-token.mts",
-    "soak:bypass": "node scripts/fleet/soak-bypass.mts",
-    "soak:check": "node scripts/fleet/check/soak-time-is-consistent.mts",
-    "socket-wheelhouse:emit-schema": "node scripts/fleet/socket-wheelhouse-emit-schema.mts",
-    "spend-usage": "node scripts/fleet/spend-usage.mts",
-    "strip:ai-tags": "node scripts/fleet/strip-ai-tags.mts",
-    "sweep": "node scripts/fleet/sweep.mts",
-    "sweep:worktrees": "node scripts/fleet/worktree-sweep.mts",
-    "sweep:worktrees:visit": "node scripts/fleet/worktree/sweep/run.mts",
-    "sync-fleet": "node scripts/repo/bootstrap/fleet.mjs",
-    "sync-global-hooks": "node scripts/fleet/sync-global-hooks.mts",
-    "sync-oxlint-rules": "node scripts/fleet/sync-oxlint-rules.mts",
-    "sync-package-manager-pins": "node scripts/fleet/sync-package-manager-pins.mts",
-    "test": "node scripts/fleet/test.mts",
-    "test:allowance": "node scripts/fleet/test/allowance.mts",
-    "test:balance": "node scripts/fleet/test/balance.mts",
-    "test:check": "node scripts/fleet/commands/run.mts test check",
+    "test": "vitest run --config .config/repo/vitest.config.mts",
     "test:extension": "node scripts/repo/test-extension.mts",
     "test:extension-auth": "node scripts/repo/test-extension-auth.mts",
-    "test:fast": "node scripts/fleet/test/fast.mts",
-    "test:fix": "node scripts/fleet/test/fix.mts",
     "test:fuzz": "node scripts/repo/fuzz.mts",
-    "test:mid": "node scripts/fleet/test/mid.mts",
-    "test:profile": "node scripts/fleet/test/profile.mts",
-    "test:slow": "node scripts/fleet/test/slow.mts",
-    "test:test": "node scripts/fleet/commands/run.mts test test",
-    "test:update": "node scripts/fleet/commands/run.mts test update",
-    "type": "node scripts/fleet/type.mts",
-    "types:check": "node scripts/fleet/commands/run.mts types check",
-    "types:fix": "node scripts/fleet/types/fix.mts",
-    "types:test": "node scripts/fleet/commands/run.mts types test",
-    "types:update": "node scripts/fleet/commands/run.mts types update",
-    "update": "node scripts/fleet/update.mts",
-    "update:check": "node scripts/fleet/weekly-update.mts --check-updates",
-    "update:chrome": "node scripts/fleet/update/chrome.mts",
-    "update:pnpm": "node scripts/fleet/update/pnpm.mts",
-    "watch": "pnpm run build:dev --watch",
-    "weekly-update": "node scripts/fleet/weekly-update.mts",
-    "weekly-update:ci": "gh workflow run cron-weekly-update.yml",
-    "worktree:create": "node scripts/fleet/worktree/create/run.mts",
-    "notion:planning:update": "node scripts/fleet/notion/planning/update.mts",
-    "notion:standup:update": "node scripts/fleet/notion/standup/update.mts",
-    "workflow:actions:lock": "node scripts/fleet/workflow/actions-lock/run.mts"
+    "typecheck": "tsc --noEmit -p .config/repo/tsconfig.json",
+    "watch": "pnpm run build:dev --watch"
   },
   "dependencies": {
     "@socketsecurity/lib": "catalog:",
diff --git a/scripts/repo/clean.mts b/scripts/repo/clean.mts
new file mode 100644
index 00000000..b26331fa
--- /dev/null
+++ b/scripts/repo/clean.mts
@@ -0,0 +1,8 @@
+import { rm } from 'node:fs/promises'
+import path from 'node:path'
+import process from 'node:process'
+
+const root = process.cwd()
+for (const entry of ['coverage', 'dist', 'out', '.vitest']) {
+  await rm(path.join(root, entry), { force: true, recursive: true })
+}
diff --git a/test/repo/unit/api-public.test.mts b/test/repo/unit/api-public.test.mts
index c2bed499..a15702c1 100644
--- a/test/repo/unit/api-public.test.mts
+++ b/test/repo/unit/api-public.test.mts
@@ -26,8 +26,8 @@ const requestCases = [
   {
     name: 'authenticated',
     apiKey: 'sktsec_test_token',
-    origin: 'https://api.socket.dev',
-    path: '/v0/purl',
+    origin: proxyOrigin,
+    path: '/batch',
     query: { alerts: 'true', compact: 'false' },
   },
 ]
@@ -257,8 +257,8 @@ describe('public package response bounds', () => {
 
 describe('authenticated package response bounds', () => {
   test('rejects identity responses beyond the SDK wire-byte limit', async () => {
-    const scope = nock('https://api.socket.dev')
-      .post('/v0/purl')
+    const scope = nock(proxyOrigin)
+      .post('/batch')
       .query({ alerts: 'true', compact: 'false' })
       .reply(200, Buffer.alloc(10 * 1024 * 1024 + 1, 0x20), {
         'content-encoding': 'identity',
@@ -281,14 +281,14 @@ describe('authenticated package response bounds', () => {
       purls.push(`pkg:npm/example-authenticated-${index}`)
     }
     const artifacts = [publicArtifact(purls[0]!), publicArtifact(purls[1024]!)]
-    const first = nock('https://api.socket.dev')
-      .post('/v0/purl', {
+    const first = nock(proxyOrigin)
+      .post('/batch', {
         components: purls.slice(0, 1024).map(purl => ({ purl })),
       })
       .query({ alerts: 'true', compact: 'false' })
       .reply(200, JSON.stringify(artifacts[0]))
-    const second = nock('https://api.socket.dev')
-      .post('/v0/purl', { components: [{ purl: purls[1024] }] })
+    const second = nock(proxyOrigin)
+      .post('/batch', { components: [{ purl: purls[1024] }] })
       .query({ alerts: 'true', compact: 'false' })
       .reply(200, JSON.stringify(artifacts[1]))
     const seen: PackageScoreAndAlerts[] = []
diff --git a/test/repo/unit/api.test.mts b/test/repo/unit/api.test.mts
index 2cb2a2d4..6bfa25e9 100644
--- a/test/repo/unit/api.test.mts
+++ b/test/repo/unit/api.test.mts
@@ -1,7 +1,7 @@
 /**
  * @file Unit tests for the Socket API layer (src/api.mts), which wraps
  *   `@socketsecurity/sdk`. Every request is exercised against a nock-mocked
- *   api.socket.dev — no real network (the fleet setup fails net-connect
+ *   purl-api.socket.dev — no real network (the test setup fails net-connect
  *   closed), and no owned-infrastructure mocking. We assert both the request
  *   the SDK sends (path, query, body) and how api.ts reshapes the response.
  */
@@ -19,10 +19,11 @@ import type { PackageScoreAndAlerts } from '../../../src/api.mts'
 import type { SimPURL } from '../../../src/ui/externals/parse-externals.mts'
 
 const API_ORIGIN = 'https://api.socket.dev'
+const PURL_ORIGIN = 'https://purl-api.socket.dev'
 const TOKEN = 'sktsec_test_token'
 const nullPayloadValue: unknown = JSON.parse('null')
 
-// Build a full artifact line as the /v0/purl NDJSON stream emits it.
+// Build a full artifact line as the PURL batch NDJSON stream emits it.
 function artifactLine(purl: SimPURL, overall: number): string {
   const artifact: PackageScoreAndAlerts = {
     alerts: [],
@@ -128,8 +129,8 @@ describe('api getOrganizations', () => {
 describe('api streamPackageScores', () => {
   test('accepts the cache timeout within the SDK transport limit', async () => {
     const purl = 'pkg:npm/example-cache-timeout' as SimPURL
-    const scope = nock(API_ORIGIN)
-      .post('/v0/purl')
+    const scope = nock(PURL_ORIGIN)
+      .post('/batch')
       .query({ alerts: 'true', compact: 'false' })
       .reply(200, `${artifactLine(purl, 0.5)}\n`)
 
@@ -159,7 +160,7 @@ describe('api streamPackageScores', () => {
         cause: new ResponseError(
           response,
           TOKEN,
-          `${API_ORIGIN}/?token=${TOKEN}`,
+          `${PURL_ORIGIN}/?token=${TOKEN}`,
         ),
       }),
     )
@@ -217,8 +218,8 @@ describe('api streamPackageScores', () => {
       { version: 42 },
     ]
     for (let index = 0, { length } = malformed; index < length; index += 1) {
-      const scope = nock(API_ORIGIN)
-        .post('/v0/purl')
+      const scope = nock(PURL_ORIGIN)
+        .post('/batch')
         .query({ alerts: 'true', compact: 'false' })
         .reply(
           200,
@@ -239,8 +240,8 @@ describe('api streamPackageScores', () => {
     async identity => {
       const purl = 'pkg:npm/example-invalid-identity' as SimPURL
       const invalid = { ...JSON.parse(artifactLine(purl, 0.1)), ...identity }
-      const scope = nock(API_ORIGIN)
-        .post('/v0/purl')
+      const scope = nock(PURL_ORIGIN)
+        .post('/batch')
         .query({ alerts: 'true', compact: 'false' })
         .reply(200, `${JSON.stringify(invalid)}\n${artifactLine(purl, 0.9)}\n`)
 
@@ -276,8 +277,8 @@ describe('api streamPackageScores', () => {
         },
       ],
     }
-    const scope = nock(API_ORIGIN)
-      .post('/v0/purl')
+    const scope = nock(PURL_ORIGIN)
+      .post('/batch')
       .query({ alerts: 'true', compact: 'false' })
       .reply(200, `${JSON.stringify(artifact)}\n`)
 
@@ -295,7 +296,7 @@ describe('api streamPackageScores', () => {
         status,
         error: TOKEN,
         cause: `Authorization: Bearer ${TOKEN}`,
-        url: `${API_ORIGIN}/v0/purl?token=${TOKEN}`,
+        url: `${PURL_ORIGIN}/batch?token=${TOKEN}`,
       })
 
       expect(error).toMatchObject({
@@ -311,8 +312,8 @@ describe('api streamPackageScores', () => {
     'rejects an SDK HTTP %i failure without response details',
     async status => {
       const purl = 'pkg:npm/example-denied@1.0.0' as SimPURL
-      const scope = nock(API_ORIGIN)
-        .post('/v0/purl')
+      const scope = nock(PURL_ORIGIN)
+        .post('/batch')
         .query({ alerts: 'true', compact: 'false' })
         .reply(status, { error: { message: `Authorization: Bearer ${TOKEN}` } })
 
@@ -339,8 +340,8 @@ describe('api streamPackageScores', () => {
         type: 'npm',
         alerts: [{ action: 'warn', type, severity: 'medium' }],
       })
-      const scope = nock(API_ORIGIN)
-        .post('/v0/purl')
+      const scope = nock(PURL_ORIGIN)
+        .post('/batch')
         .query({ alerts: 'true', compact: 'false' })
         .reply(
           200,
@@ -371,8 +372,8 @@ describe('api streamPackageScores', () => {
           `{"inputPurl":"${purl}","name":"example-invalid-score","type":"npm","alerts":[],"score":${score}}`,
       )
       .join('\n')
-    const scope = nock(API_ORIGIN)
-      .post('/v0/purl')
+    const scope = nock(PURL_ORIGIN)
+      .post('/batch')
       .query({ alerts: 'true', compact: 'false' })
       .reply(200, `${lines}\n${artifactLine(purl, 0)}\n`)
 
@@ -386,8 +387,8 @@ describe('api streamPackageScores', () => {
   test('yields one score+alerts object per artifact line', async () => {
     const purlA = 'pkg:npm/left-pad@1.0.0' as SimPURL
     const purlB = 'pkg:npm/right-pad@2.0.0' as SimPURL
-    nock(API_ORIGIN)
-      .post('/v0/purl')
+    nock(PURL_ORIGIN)
+      .post('/batch')
       .query({ alerts: 'true', compact: 'false' })
       .reply(200, `${artifactLine(purlA, 42)}\n${artifactLine(purlB, 99)}\n`)
 
@@ -400,11 +401,11 @@ describe('api streamPackageScores', () => {
     expect(seen.map(s => s.score.overall)).toEqual([42, 99])
   })
 
-  test('requests /v0/purl with the pending purls in the body', async () => {
+  test('requests /batch with the pending purls in the body', async () => {
     const purl = 'pkg:npm/express@4.0.0' as SimPURL
     let sentBody: unknown
-    nock(API_ORIGIN)
-      .post('/v0/purl', body => {
+    nock(PURL_ORIGIN)
+      .post('/batch', body => {
         sentBody = body
         return true
       })
@@ -438,8 +439,8 @@ describe('api streamPackageScores', () => {
       _type: 'purlError',
       value: { error: 'Package not found', inputPurl: purl },
     })
-    nock(API_ORIGIN)
-      .post('/v0/purl')
+    nock(PURL_ORIGIN)
+      .post('/batch')
       .query({ alerts: 'true', compact: 'false' })
       .reply(200, `${artifactLine(purl, 77)}\n${summaryLine}\n${errorLine}\n`)
 
diff --git a/test/repo/unit/define-guarded.test.mts b/test/repo/unit/define-guarded.test.mts
deleted file mode 100644
index e13b305f..00000000
--- a/test/repo/unit/define-guarded.test.mts
+++ /dev/null
@@ -1,83 +0,0 @@
-/**
- * @file Tests for the guarded compile-time define plugin
- *   (.config/fleet/rolldown/define-guarded.mts). Locks in that a single dotted
- *   define
- *   key matches dot, single-quote, and double-quote member access alike (TS
- *   forces quoted bracket access on `process.env`), that TS source is parsed
- *   (not rejected as JS), and that write / dynamic positions are left
- *   untouched.
- */
-
-import { describe, expect, test } from 'vitest'
-
-import { defineGuardedPlugin } from '../../../.config/fleet/rolldown/define-guarded.mts'
-
-// Exported `function` declaration: satisfies both fleet rules —
-// socket/prefer-function-declaration (no module-scope arrow) and
-// socket/export-top-level-functions (top-level functions must be exported).
-export function run(code: string, id = 'src/example.ts'): string | undefined {
-  const plugin = defineGuardedPlugin({
-    'process.env.INLINED_EXTENSION_VERSION': JSON.stringify('2.0.3'),
-  })
-  // rolldown's transform hook signature is (code, id); call it directly.
-  const transform = plugin.transform as (
-    this: unknown,
-    code: string,
-    id: string,
-  ) => { code: string } | undefined
-  const result = transform.call({}, code, id)
-  return result?.code
-}
-
-describe('defineGuardedPlugin', () => {
-  test('rewrites dot access', () => {
-    const out = run('const a = process.env.INLINED_EXTENSION_VERSION')
-    expect(out).toContain('"2.0.3"')
-    expect(out).not.toContain('INLINED_EXTENSION_VERSION')
-  })
-
-  test('rewrites single-quote bracket access', () => {
-    const out = run("const b = process.env['INLINED_EXTENSION_VERSION']")
-    expect(out).toContain('"2.0.3"')
-    expect(out).not.toContain('INLINED_EXTENSION_VERSION')
-  })
-
-  test('rewrites double-quote bracket access', () => {
-    const out = run('const c = process.env["INLINED_EXTENSION_VERSION"]')
-    expect(out).toContain('"2.0.3"')
-    expect(out).not.toContain('INLINED_EXTENSION_VERSION')
-  })
-
-  test('parses TypeScript source (type annotations do not abort the rewrite)', () => {
-    const out = run(
-      'export function f(ctx: vscode.ExtensionContext): string {\n' +
-        "  return process.env['INLINED_EXTENSION_VERSION']\n" +
-        '}\n',
-    )
-    expect(out).toContain('"2.0.3"')
-  })
-
-  test('parses .tsx source', () => {
-    const out = run(
-      'const e = <div>{process.env["INLINED_EXTENSION_VERSION"]}</div>',
-      'src/example.tsx',
-    )
-    expect(out).toContain('"2.0.3"')
-  })
-
-  test('leaves an assignment target untouched', () => {
-    const code = "process.env['INLINED_EXTENSION_VERSION'] = 'x'"
-    expect(run(code)).toBeUndefined()
-  })
-
-  test('leaves dynamic computed access untouched', () => {
-    const code =
-      'const k = "INLINED_EXTENSION_VERSION"\nconst d = process.env[k]'
-    expect(run(code)).toBeUndefined()
-  })
-
-  test('does not rewrite an unrelated env var', () => {
-    const code = "const u = process.env['SOMETHING_ELSE']"
-    expect(run(code)).toBeUndefined()
-  })
-})
diff --git a/test/repo/unit/rolldown.config-extension-version.test.mts b/test/repo/unit/rolldown.config-extension-version.test.mts
new file mode 100644
index 00000000..31bd0ede
--- /dev/null
+++ b/test/repo/unit/rolldown.config-extension-version.test.mts
@@ -0,0 +1,65 @@
+import { describe, expect, test } from "vitest";
+
+import { defineExtensionVersionPlugin } from "../../../.config/repo/rolldown.config.mts";
+
+export function rewriteInlinedExtensionVersion(
+  code: string,
+  version = "2.0.3",
+): string {
+  const plugin = defineExtensionVersionPlugin(version);
+  const transform = plugin.transform;
+  if (typeof transform !== "function") {
+    throw new TypeError("Extension version plugin must provide a transform.");
+  }
+  const result: unknown = Reflect.apply(transform, {}, [
+    code,
+    "src/example.mts",
+  ]);
+  if (typeof result !== "string") {
+    throw new TypeError(
+      "Extension version plugin did not return transformed code.",
+    );
+  }
+  return result;
+}
+
+describe("defineExtensionVersionPlugin", () => {
+  test("rewrites single-quoted bracket access", () => {
+    expect(
+      rewriteInlinedExtensionVersion(
+        "const version = process.env['INLINED_EXTENSION_VERSION']",
+      ),
+    ).toBe('const version = "2.0.3"');
+  });
+
+  test("rewrites double-quoted bracket access", () => {
+    expect(
+      rewriteInlinedExtensionVersion(
+        'const version = process.env["INLINED_EXTENSION_VERSION"]',
+      ),
+    ).toBe('const version = "2.0.3"');
+  });
+
+  test("rewrites TypeScript source", () => {
+    const source =
+      "export function readVersion(): string {\n" +
+      "  return process.env['INLINED_EXTENSION_VERSION']\n" +
+      "}\n";
+    expect(rewriteInlinedExtensionVersion(source)).toBe(
+      'export function readVersion(): string {\n  return "2.0.3"\n}\n',
+    );
+  });
+
+  test("leaves dot and dynamic access untouched", () => {
+    const source =
+      "const a = process.env.INLINED_EXTENSION_VERSION\n" +
+      'const key = "INLINED_EXTENSION_VERSION"\n' +
+      "const b = process.env[key]";
+    expect(rewriteInlinedExtensionVersion(source)).toBe(source);
+  });
+
+  test("leaves unrelated environment variables untouched", () => {
+    const source = "const value = process.env['OTHER_VARIABLE']";
+    expect(rewriteInlinedExtensionVersion(source)).toBe(source);
+  });
+});
diff --git a/test/repo/vitest.setup.mts b/test/repo/vitest.setup.mts
new file mode 100644
index 00000000..b3bf3bbe
--- /dev/null
+++ b/test/repo/vitest.setup.mts
@@ -0,0 +1,3 @@
+import nock from "nock";
+
+nock.disableNetConnect();
diff --git a/tsconfig.json b/tsconfig.json
index b3cce1b7..4de6d333 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -1,3 +1,3 @@
 {
-  "extends": "./.config/fleet/tsconfig.base.json"
+  "extends": "./.config/repo/tsconfig.json"
 }