refactor(repo): make core scripts independent of Fleet bootstrap

.config/repo/oxlint.config.mts

@@ -1,37 +1,27 @@
 /**
- * @file Socket-vscode repo oxlint config. Imports the fleet factory and
- *   augments it in JS — see `.config/fleet/oxlint.config.mts` for why this is
- *   a factory call rather than oxlint `extends` (extends drops
- *   plugins/categories/ignorePatterns and mis-roots relative globs).
+ * Repository-owned lint configuration. Keep the basic lint command usable
+ * without hydrating the shared Fleet config.
  */
-
-import { config } from '../fleet/oxlint.config.mts'
-
-export default config({
-  rules: {
-    // This extension is interop-heavy by nature: acorn AST node probing
-    // (js-source-externals), the Go wasm runtime glue (wasm-executor), branded
-    // TextDocumentURIString casts, and JSON.parse narrowing across scripts.
-    // Every one of its ~90 `as` sites is a deliberate narrowing at an untyped
-    // boundary, so the type-aware blanket rule is noise here. Re-enable per
-    // directory as boundaries grow real validators (typebox schemas already
-    // cover the lockstep manifest path).
-    'typescript/no-unsafe-type-assertion': 'off',
+export default {
+  categories: {
+    correctness: "error",
+    suspicious: "warn",
   },
-  overrides: [
-    {
-      // tsgolint resolves each file's nearest tsconfig; everything outside
-      // src/ falls back to a projectless view WITHOUT the fleet base's
-      // noUncheckedIndexedAccess, so the type-aware pass mislabels the
-      // `arr[i]!` assertions those trees need as "unnecessary" and its
-      // autofix strips them — breaking the check-tier tsc
-      // (.config/fleet/tsconfig.check.json), which DOES see the fleet base.
-      // Scope the rule to src/ (covered by the root tsconfig project) until
-      // the scripts/test trees get a real tsconfig project of their own.
-      files: ['scripts/**', 'test/**', 'vendor/**', '.github/**', '*.mts'],
-      rules: {
-        'typescript/no-unnecessary-type-assertion': 'off',
-      },
-    },
+  ignorePatterns: [
+    "coverage/**",
+    "out/**",
+    "vendor/**",
+    "scripts/**",
+    "test/**",
+    ".github/**",
+    ".git-hooks/**",
+    ".claude/**",
+    ".config/**",
+    "docs/**",
   ],
-})
+  plugins: ["typescript"],
+  rules: {
+    "no-unused-vars": "off",
+    "typescript/no-unsafe-type-assertion": "off",
+  },
+};

.config/repo/rolldown.config.mts

@@ -6,7 +6,6 @@ import type { Plugin, RolldownOptions } from 'rolldown'
 
 import { getEnvValue } from '@socketsecurity/lib-stable/env/rewire'
 
-import { defineGuardedPlugin } from '../fleet/rolldown/define-guarded.mts'
 
 const rootPath = path.resolve(import.meta.dirname, '../..')
 const require = createRequire(import.meta.url)
@@ -47,6 +46,19 @@ export function stageParserWasmPlugin(): Plugin {
   }
 }
 
+export function defineExtensionVersionPlugin(version: string): Plugin {
+  const replacement = JSON.stringify(version)
+  return {
+    name: 'define-extension-version',
+    transform(source) {
+      return source.replace(
+        /process\s*\.\s*env\s*\[\s*(['"])INLINED_EXTENSION_VERSION\1\s*\]/gu,
+        replacement,
+      )
+    },
+  }
+}
+
 const pkg = JSON.parse(
   readFileSync(path.join(rootPath, 'package.json'), 'utf8'),
 ) as { version?: string | undefined }
@@ -89,9 +101,7 @@ const config: RolldownOptions = {
     // `process.env['X']` on index-signature types — and both normalize to this
     // same key. The `INLINED_*` name follows the fleet convention (see
     // socket-cli) for build-inlined values.
-    defineGuardedPlugin({
-      'process.env.INLINED_EXTENSION_VERSION': JSON.stringify(extensionVersion),
-    }),
+    defineExtensionVersionPlugin(extensionVersion),
     stageParserWasmPlugin(),
   ],
   // The sources are `.mts` (the fleet's sources-are-mts rule) and import each

.config/repo/tsconfig.json

@@ -1,5 +1,17 @@
 {
-  "extends": ["../fleet/tsconfig.base.json", "./tsconfig.check.json"],
+  "compilerOptions": {
+    "allowImportingTsExtensions": true,
+    "allowSyntheticDefaultImports": true,
+    "esModuleInterop": true,
+    "lib": ["DOM", "ES2024"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "noEmit": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "target": "ES2024",
+    "types": ["node", "vscode"]
+  },
   "include": ["../../src/**/*.mts", "../../src/**/*.d.ts"],
-  "exclude": ["../../node_modules"]
+  "exclude": ["../../node_modules", "../../out"]
 }

.config/repo/vitest.config.mts

@@ -0,0 +1,26 @@
+import path from "node:path";
+import { defineConfig } from "vitest/config";
+
+const root = path.resolve(import.meta.dirname, "../..");
+
+export default defineConfig({
+  resolve: {
+    alias: {
+      vscode: path.join(root, "test/stubs/vscode.mts"),
+    },
+  },
+  test: {
+    setupFiles: [path.join(root, "test/repo/vitest.setup.mts")],
+    include: ["test/repo/unit/**/*.test.mts"],
+    exclude: [
+      "test/**/*.fuzz.mts",
+      "test/repo/unit/test-extension.test.mts",
+      "test/repo/unit/test-extension-auth.test.mts",
+      "test/repo/unit/scripts/install-claude-plugins.test.mts",
+    ],
+    testTimeout: 15000,
+    hookTimeout: 15000,
+    pool: "forks",
+    maxWorkers: 4,
+  },
+});

.github/actions/fleet/setup/action.yml

@@ -789,18 +789,16 @@ runs:
         # Source of truth (baked into the binary) lives at
         # SocketDev/firewall:src/lib/registries/default.ts.
         #
-        # The bypass list itself lives in the wheelhouse-canonical
-        # location `.config/fleet/sfw-bypass-list.txt` (action_path is
-        # the running repo checkout (inlined local action);
-        # `../../../../.config/fleet` walks up out of
-        # `.github/actions/fleet/setup/` to repo root). Every fleet repo gets
-        # a byte-identical copy via sync-scaffolding, so socket-btm's
-        # install-sfw.mts can read its own local copy at the same path.
+        # A Fleet checkout may provide repo-specific registry bypass entries.
+        # Standalone repos do not carry that Fleet config and rely on the
+        # registry defaults compiled into Socket Firewall.
         BYPASS_FILE="${{ github.action_path }}/../../../../.config/fleet/sfw-bypass-list.txt"
         {
           echo 'SFW_CUSTOM_REGISTRIES<<EOF'
-          # Strip comments + blank lines so the env var holds only real entries.
-          grep -vE '^\s*(#|$)' "$BYPASS_FILE"
+          if [ -f "$BYPASS_FILE" ]; then
+            # Strip comments + blank lines so the env var holds only entries.
+            grep -vE '^\s*(#|$)' "$BYPASS_FILE" || true
+          fi
           if [[ -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]]; then
             OIDC_HOST="${ACTIONS_ID_TOKEN_REQUEST_URL#*://}"
             OIDC_HOST="${OIDC_HOST%%/*}"

.github/workflows/ci-gates.yml

@@ -55,20 +55,14 @@ jobs:
             git fetch "${FETCH_ARGS[@]}"
           fi
           git checkout -q --detach FETCH_HEAD
-      - name: Set up and install
-        uses: ./.github/actions/fleet/setup-and-install
+      - name: Set up environment
+        uses: ./.github/actions/fleet/setup
         with:
-          # Full history: the commit-history checks (AI-attribution,
-          # release-boundary) read the default branch's history and refuse a
-          # shallow clone rather than false-green.
-          checkout-fetch-depth: '0'
           socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
-          payload-token-client-id: ${{ secrets.SOCKET_RELEASE_CLIENT_ID || vars.SOCKET_RELEASE_CLIENT_ID }}
-          payload-token-private-key: ${{ secrets.SOCKET_RELEASE_APP_PRIVATE_KEY }}
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
       - name: Check repository
-        uses: ./.github/actions/fleet/run-script
-        with:
-          main-script: pnpm run check --all
+        run: pnpm run check
 
   test:
     name: Test (${{ matrix.os }})
@@ -102,17 +96,14 @@ jobs:
             git fetch "${FETCH_ARGS[@]}"
           fi
           git checkout -q --detach FETCH_HEAD
-      - name: Set up and install
-        uses: ./.github/actions/fleet/setup-and-install
+      - name: Set up environment
+        uses: ./.github/actions/fleet/setup
         with:
           socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
-          payload-token-client-id: ${{ secrets.SOCKET_RELEASE_CLIENT_ID || vars.SOCKET_RELEASE_CLIENT_ID }}
-          payload-token-private-key: ${{ secrets.SOCKET_RELEASE_APP_PRIVATE_KEY }}
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
       - name: Build and test
-        uses: ./.github/actions/fleet/run-script
-        with:
-          setup-script: pnpm run build
-          main-script: pnpm test --ci
+        run: pnpm test
 
   full-test:
     name: Full test (${{ matrix.os }})
@@ -146,14 +137,11 @@ jobs:
             git fetch "${FETCH_ARGS[@]}"
           fi
           git checkout -q --detach FETCH_HEAD
-      - name: Set up and install
-        uses: ./.github/actions/fleet/setup-and-install
+      - name: Set up environment
+        uses: ./.github/actions/fleet/setup
         with:
           socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
-          payload-token-client-id: ${{ secrets.SOCKET_RELEASE_CLIENT_ID || vars.SOCKET_RELEASE_CLIENT_ID }}
-          payload-token-private-key: ${{ secrets.SOCKET_RELEASE_APP_PRIVATE_KEY }}
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
       - name: Build and test
-        uses: ./.github/actions/fleet/run-script
-        with:
-          setup-script: pnpm run build
-          main-script: pnpm test --all
+        run: pnpm test