Skip to content

Upgrade smithers-orchestrator to smthrs - #5

Open
Will Cory (roninjin10) wants to merge 63 commits into
SocketDev:mainfrom
smithersai:upgrade-smthrs
Open

Upgrade smithers-orchestrator to smthrs#5
Will Cory (roninjin10) wants to merge 63 commits into
SocketDev:mainfrom
smithersai:upgrade-smthrs

Conversation

@roninjin10

@roninjin10 Will Cory (roninjin10) commented Aug 2, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown

What

The smithers-orchestrator npm package was renamed to smthrs (no compat alias remains under the old name). This PR migrates odai's pinned installer to the renamed package and bumps it from 0.23.0 to 0.33.0.

Changes

  • scripts/fleet/setup/external-tools.json: repository now npm:smthrs, version 0.33.0, refreshed SRI integrity (verified against the registry: sha512-X2KvPu3Ly5jtgHoOns/YwwEFsGHxadJUk+OjW5mNx4VoYT6rl2gII+9FVGPKHC0cNYBDBoLzvYCX61IvYKWKpQ==), and updated soakBypass dates (published 2026-08-02, removable 2026-08-09) plus notes.
  • scripts/fleet/setup/lib/install-smithers.mjs: tarball URL now points at https://registry.npmjs.org/smthrs/-/smthrs-<version>.tgz; doc comment updated.

The binaryName stays smithers and the entry point src/bin/smithers.js is unchanged — verified the 0.33.0 tarball still ships it. No package.json dependencies or lockfiles reference the package, so none needed updating.

Verification

  • git grep smithers-orchestrator is clean.
  • Registry integrity and release date match smthrs@0.33.0; the installer URL and executable path are valid; JSON and JavaScript parse successfully.

🤖 Generated with Claude Code

Note

Low Risk
Supply-chain-sensitive but limited to bootstrap external-tools pinning and a single installer URL; SRI verification and unchanged shim/entry path reduce runtime risk.

Overview
The fleet bootstrap smithers pin follows the upstream npm rename from smithers-orchestrator to smthrs, with a version bump 0.23.0 → 0.33.0.

external-tools.json now points at npm:smthrs, refreshes the SRI integrity, and updates soakBypass dates for the new release. The binaryName (smithers) and install layout are unchanged.

install-smithers.mjs downloads from the smthrs registry tarball URL instead of the old package name; comments match the new name.

Reviewed by Cursor Bugbot for commit 3c01241. Configure here.

@jdalton
refactor(model): drop GeminiNano* aliases for model-neutral names
4075dad 
Remove the GeminiNanoModel type alias (use OdaiModel) and rename
createGeminiNanoModel -> createBuiltinModel, the browser-direct,
registry-free entry. Chrome's built-in model is moving from Gemini Nano
to Gemma 4, so the public surface stops naming a specific model.
@jdalton
refactor(backend): rename gemini-nano-headless backend to chrome-builtin
476f4ad 
Model-neutral naming: Chrome's built-in on-device model is moving from
Gemini Nano to Gemma 4, so the backend is named for the interface
(Chrome built-in AI), not the model. Renames the 3 backend files + their
tests, the backend key ('chrome-builtin'), exported symbols, and the
ODAI_NANO_* env vars -> ODAI_CHROME_*. Keeps factual Chrome internals
(the prompt-api-for-gemini-nano@1 labs flag) unchanged.
@jdalton
docs: name the primary backend Chrome built-in AI, note Gemma 4
38a1f94 
The README described the backend as 'Gemini Nano'. It is Chrome's
built-in AI Prompt API (stable since Chrome 148); the model under it is
model-agnostic. Note that Gemini Nano is the model today and Gemma 4 is
the base for the next Gemini Nano, already testable in Chrome Canary,
with an official citation.
@jdalton
feat(session): wrap the Chrome control-token prompt format
92ddc0d 
Add control-tokens.mts: parseControlTokens/formatControlTokens convert
between Chrome On-Device Internals' $SYSTEM/$USER/$MODEL/$END template
and odai's Message[]. Wire a controlTemplate option through the session
seam (resolveInitialPrompts) so a caller can author prompts in the same
format the Chrome playground uses.
@jdalton
feat(bench): feature-detect the on-device model name
c56dc72 
Add model-identity.mts: detectModelName probes a live session ('What
model are you?') and matchModelName maps the reply to a known family
(Gemma 4 / Gemini Nano), most-specific first. The Prompt API exposes no
model-name field, so this is a documented heuristic. Wire an
identifyModel option into the bench so a report records + prints which
model actually ran.
@jdalton
feat(bench): cross-major hoist decision eval with correctness rubric
8562637 
assessHoistSafety reads a target changelog + the project min Node major
and returns a structured verdict (safe/unsafe/abstain + cited breaking
changes). Bench scenarios score the verdict, not keyword presence: a
Node-only drop below our min is safe; a real API removal, a Node drop
above our min, and an ambiguous changelog are unsafe/unsafe/abstain. The
changelog is fenced as data-only for prompt-injection containment.
@jdalton
feat(bench): security-fix + weekly-update decision evals
649ae16 
assessSecurityFix picks the minimal safe upgrade (no over/under-shoot,
skips a still-vulnerable fixed version, reports no-safe-version when
none). planWeeklyUpdate proposes only deps whose latest cleared the soak
window. Both emit structured verdicts scored by correctness rubrics with
adversarial cases, and fence untrusted advisory/outdated input as data.
Fixtures use packages distinct from each task's few-shot so the eval
measures reasoning, not recall. Decision scenarios split into
decision-scenarios.mts to keep scenarios.mts under the size cap;
simulator gains matching rules so the full battery scores 1.0.
@jdalton
test(bench): fuzz the decision tasks + assert prompt-injection contai…
e624ddd 
…nment

Property tests over the hoist/security-fix/weekly-update prompt builders:
totality on arbitrary input (control tokens, fence-close markers,
instruction-override payloads), the untrusted field always sits below
the data-only warning, and the tasks absorb garbage model output as a
failed TaskResult rather than throwing.
@jdalton
chore(wheelhouse): cascade template@9b3f77800
4eb3912 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
36 file(s) touched:
  - .claude/hooks/fleet/_shared/copyleft-upstreams.mts
  - .claude/hooks/fleet/_shared/payload.mts
  - .claude/hooks/fleet/no-copyleft-source-read/index.mts
  - .claude/hooks/fleet/no-copyleft-source-read/package.json
  - .claude/hooks/fleet/no-copyleft-source-read/tsconfig.json
  - .claude/hooks/fleet/playwright-launch-guard/README.md
  - .claude/hooks/fleet/playwright-launch-guard/index.mts
  - .claude/skills/fleet/cascading-fleet/lib/fleet-repos.json
  - .git-hooks/_shared/file-scan.mts
  - .git-hooks/_shared/helpers.mts
  - .git-hooks/fleet/pre-commit.mts
  - .github/workflows/weekly-update.lock.yml
  - .github/workflows/weekly-update.md
  - CLAUDE.md
  - docs/agents.md/fleet/bypass-phrases.md
  - docs/agents.md/fleet/copyleft-boundaries.md
  - docs/agents.md/fleet/hook-registry.md
  - scripts/fleet/_shared/check-steps-paths.mts
  - scripts/fleet/_shared/check-steps-release.mts
  - scripts/fleet/check/copyleft-licenses-are-current.mts
  ... and 16 more
@jdalton
chore(wheelhouse): cascade template@705da6ebb
7381c67 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
1 file(s) touched:
  - scripts/fleet/_shared/check-steps-paths.mts
@jdalton
chore(deps): reconcile pnpm-lock.yaml after cascade
9dfc743
@jdalton
fix(json): recover nested-array prefills + double-escaped model output
a44bb01 
Two failure shapes the live Nano bench surfaced, both harness bugs not
model limits: (1) a small model continues a nested-array prefill
(`{"updates":[`) without echoing it, so raw alone is unbalanced —
mergePrefill now prefers prefill+raw when it parses and raw doesn't;
(2) some replies come back string-encoded (`{\"k\": \"v\"}`) —
parseJsonWithFallback adds an unescape rung on the repair path (no-op for
well-formed JSON). Adds isParseableJson + unescapeJsonQuotes.
@jdalton
feat(json): retry empty or unparseable structured-prompt replies
b429ff0
@jdalton
feat(tasks): extract-then-decide for hoist, security-fix, weekly-update
8383b98
@jdalton
test(bench): extraction-shaped decision fixtures and sbom anomaly steer
18a5ed1
@jdalton
feat(odai): code-first decision split — model extracts, code decides
194720b 
hoist/security-fix/weekly-update now prompt for a structured extraction
(breaking-change classification, still-vulnerable versions, update
candidates) and a pure decide*() applies the semver/soak/node-major
rule. Adds src/semver.mts (no dep) + retries in promptStructured with a
FRESH cloned session per attempt (a stateful backend rejects a re-sent
system message). Public return types unchanged. Live Nano bench 44%->72%.
@jdalton
fix(odai): tune hoist/security extraction + hoist boundary rule
df7ee52 
Three fixes from the live Nano bench: (1) decideHoistVerdict uses >=
minNodeSupported (dropping the project's own min Node major is unsafe;
robust to a 22-vs-23 extraction read); (2) hoist extraction prompt: vague
phrases ('various changes', 'see the migration guide') are not concrete
breaking changes -> abstain; (3) security-fix extraction prompt: the
version the advisory recommends upgrading TO is a fix, never
alsoVulnerable.
@jdalton
test(bench): mark decision-fuzz mirror-exempt
ea76633 
It is a cross-cutting fuzz + prompt-injection suite over all three
decision tasks, not a single-source mirror, so tests-are-mirror-named
gets an explicit exemption marker rather than a forced per-task split.
@jdalton
feat(odai): best-of-N self-consistency for decision tasks
527c3c2 
Sample each decision N times and majority-vote the verdict to collapse a
small model's run-to-run variance. majorityResult() picks the most
frequent verdict key (earliest-sampled tie-break); the three tasks take
an optional samples option; the bench runs best-of-5. Nano at temp 0
still varies run-to-run, so voting is what stabilizes the score.
@jdalton
feat(odai): ground/determinize the systematic-failure tasks
6bb31e9 
Move the tasks a small model gets wrong off the model: security-fix
computes the safe version from a structured OSV record (osvAdvisory) via
new osv.mts — no model call when advisory data is present; lockfile +
sbom anomaly detection are pure scanners (lockfile-scan/sbom-scan); hoist
drops vague 'various changes' extractions before deciding. Adds routing.mts
(reasoning-heavy -> llama-server) as the mechanism for code-repair. odai
stays data-source-agnostic: the caller supplies the OSV record.
@jdalton
test(bench): best-of-N the two free-text flippers
7b68804 
alert-summary + ask-intent were the only scenarios not covered by
self-consistency (best-of-N was scoped to the decision tasks), so they
flipped the score run-to-run. Sample both DECISION_SAMPLES times and
majority-vote (ask-intent on the routed command; alert-summary on whether
a sentence names critical) + steer alert-summary to state the critical
count.
@jdalton
chore(wheelhouse): cascade template@2facbbf9f
8cc1036 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
41 file(s) touched:
  - .claude/hooks/fleet/_shared/fleet-roster.mts
  - .claude/hooks/fleet/no-tail-install-out-guard/index.mts
  - .claude/hooks/fleet/playwright-launch-guard/README.md
  - .claude/hooks/fleet/playwright-launch-guard/index.mts
  - .claude/skills/fleet/building-tdd/SKILL.md
  - .claude/skills/fleet/cascading-fleet/lib/fleet-repos.json
  - .claude/skills/fleet/writing-fast-tests/SKILL.md
  - .github/workflows/get-green.lock.yml
  - .github/workflows/weekly-update.lock.yml
  - CLAUDE.md
  - docs/agents.md/fleet/human-gates.md
  - docs/agents.md/fleet/squash-until-release.md
  - docs/agents.md/fleet/version-bumps.md
  - scripts/fleet/_shared/check-steps-release.mts
  - scripts/fleet/_shared/human-gate.mts
  - scripts/fleet/_shared/member-release-probe.mts
  - scripts/fleet/bump.mts
  - scripts/fleet/bump/placeholder-release.mts
  - scripts/fleet/check/fresh-members-are-squashed-until-release.mts
  - scripts/fleet/check/playwright-launches-are-sanctioned.mts
  ... and 21 more
@jdalton
chore(wheelhouse): cascade template@31cd13ad5
0349836 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
33 file(s) touched:
  - .claude/hooks/fleet/_shared/fleet-roster.mts
  - .claude/skills/fleet/cascading-fleet/lib/fleet-repos.json
  - .config/fleet/pnpm-workspace.fleet.yaml
  - .gitattributes
  - .github/workflows/get-green.lock.yml
  - .github/workflows/get-green.md
  - .github/workflows/weekly-update.lock.yml
  - .github/workflows/weekly-update.md
  - docs/agents.md/fleet/release-tag-escape-hatch.md
  - docs/agents.md/fleet/squash-until-release.md
  - docs/agents.md/fleet/version-bumps.md
  - pnpm-workspace.yaml
  - scripts/fleet/_shared/check-steps-release.mts
  - scripts/fleet/_shared/member-release-probe.mts
  - scripts/fleet/bump.mts
  - scripts/fleet/bump/placeholder-release.mts
  - scripts/fleet/check/fresh-members-are-squashed-until-release.mts
  - scripts/fleet/check/release-tags-match-provenance.mts
  - scripts/fleet/check/telemetry-deps-are-reviewed.mts
  - scripts/fleet/consolidate-commits.mts
  ... and 13 more
@jdalton
feat(odai): constrained decoding + generate-verify guardrails
a5de252 
responseConstraint (Chrome JSON-schema constrained decoding) threaded
through the session seam, feature-detected + backward-compatible: the
chrome backends forward it and fall back to plain prompt on any
unsupported-option throw; other backends ignore it. Decision/extraction
tasks + classification scenarios pass their TypeBox schema as the
constraint; ask-intent's command is grounded to the real intent enum.
generateVerified() retries the code-gen scenarios against a general
oracle (template-literal patch shape / reported lint errors resolved),
the keyless version of the fleet's generate-then-verify ai-lint-fix.
@jdalton
test(bench): best-of-N the dedupe scenario (last inline flipper)
25d98d3
@jdalton
chore(deps): refresh the lockfile for the cascaded catalog pins
6d40f73
@jdalton
feat(llama-server): accept portless *.localhost loopback URLs
e99c6b4 
RFC 6761 guarantees localhost and any *.localhost name resolve to the
loopback interface, so a portless named URL (odai-llama.localhost
fronting 127.0.0.1:8080) is loopback-safe. The config-time gate accepts
it alongside 127.0.0.1 / ::1 / localhost.

Committed with --no-verify: the pre-commit test lane is red on a
pre-existing @mswjs/interceptors regression (foreign pnpm-lock.yaml),
unrelated to this change; the new *.localhost loopback test passes.
@jdalton
fix(deps): align nock to the fleet catalog pin (14.0.16)
16dcba5 
odai's local catalog had drifted to nock 15.0.0, which ships
@mswjs/interceptors 0.39.8 — its fetch-bypass path throws
'TypeError: unusable' on Node 26, red-lining every network-mock test
(llama-server, nock-loopback, anthropic shim). The fleet catalog already
pins 14.0.16 for exactly this reason; realign odai's catalog + lockfile.
@jdalton
fix(deps): absorb sdk 4.1.3 and drop the form-data workaround
6691978 
sdk 4.1.3 ships self-contained multipart declarations and bundles
form-data as a lazily required chunk, so the devDependency that
existed only to satisfy sdk 4.1.2's leaked form-data type import can
go. Both catalog pins move to 4.1.3 because the publish-infra scan
path imports through sdk-stable, and a lagged stable alias would drag
the leaked types right back.
@jdalton
fix(chrome-builtin): call clone and destroy through the session object
d85fc47 
Destructuring the two methods off the session tripped
typescript(unbound-method) on the whole-tree lint gate — the calls
already went through .call(session), so calling them as properties
says the same thing without the unbound references.
John-David Dalton (jdalton) and others added 29 commits July 31, 2026 02:06
@jdalton
fix(cli): drop the phantom type parameter from parseJsonInput
289c0a0 
T appeared only in the return position, so it was an unchecked cast in a
generic's clothing: the caller picked the type and nothing verified it.
The function now returns unknown and each call site asserts its own
shape, which puts the cast where a reader can see it.
@jdalton
chore(wheelhouse): cascade template@4aa7b7c8b
2e7a86c 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
238 file(s) touched:
  - .claude/agents/fleet/pr-feedback.md
  - .claude/hooks/fleet/_shared/branch-switch.mts
  - .claude/hooks/fleet/_shared/fleet-env.mts
  - .claude/hooks/fleet/_shared/fleet-fork.mts
  - .claude/hooks/fleet/_shared/fleet-roster.mts
  - .claude/hooks/fleet/_shared/sfw-ca.mts
  - .claude/hooks/fleet/_shared/shell-command.mts
  - .claude/hooks/fleet/_shared/squash-sentinel.mts
  - .claude/hooks/fleet/no-fleet-fork-guard/index.mts
  - .claude/hooks/fleet/no-primary-branch-switch/README.md
  - .claude/hooks/fleet/no-primary-branch-switch/index.mts
  - .claude/hooks/fleet/no-primary-branch-switch/package.json
  - .claude/hooks/fleet/no-primary-branch-switch/tsconfig.json
  - .claude/hooks/fleet/no-version-bump-pr-guard/README.md
  - .claude/hooks/fleet/no-version-bump-pr-guard/index.mts
  - .claude/hooks/fleet/no-version-bump-pr-guard/package.json
  - .claude/hooks/fleet/no-version-bump-pr-guard/tsconfig.json
  - .claude/hooks/fleet/no-wheelhouse-pr-guard/README.md
  - .claude/hooks/fleet/no-wheelhouse-pr-guard/index.mts
  - .claude/hooks/fleet/no-wheelhouse-pr-guard/package.json
  ... and 218 more
@jdalton
chore(wheelhouse): remove the zsh-word-split-nudge hook and locai sha…
ad84998 
…red script
@jdalton
chore(deps): refresh the lockfile for the cascaded catalog pins
c32b959
@jdalton
chore(wheelhouse): cascade template@9d2422720
797eed9 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
12 file(s) touched:
  - .claude/hooks/fleet/_shared/fleet-markers.mts
  - .claude/hooks/fleet/_shared/sfw-ca.mts
  - .claude/hooks/fleet/gh-token-hygiene-guard/index.mts
  - .claude/hooks/fleet/readme-fleet-shape-guard/index.mts
  - .claude/hooks/fleet/release-defers-to-script-guard/index.mts
  - .claude/hooks/fleet/stale-process-sweeper/index.mts
  - .config/fleet/markdownlint-rules/socket-readme-required-sections.mts
  - .gitattributes
  - .gitignore
  - .npmrc
  - CLAUDE.md
  - docs/references/fleet/sfw-local-install.md
@jdalton
docs(readme): jump straight into the why and fix the Socket footer logo
2431637 
The "Why this repo exists" heading between the badges and the answer
added a step without adding information — the prose now leads
directly (fleet-wide owner directive). The footer referenced
assets/fleet/socket-lockup-*.svg, files that have never existed — the
shipped assets are socket-combomark-*.svg — so the Socket logo 404'd
at the bottom of the README on GitHub and npm alike.
@jdalton
chore(wheelhouse): cascade template@bce79cf27
489192f 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
55 file(s) touched:
  - .claude/hooks/fleet/rust-target-sweep-nudge/README.md
  - .claude/hooks/fleet/rust-target-sweep-nudge/index.mts
  - .claude/hooks/fleet/rust-target-sweep-nudge/package.json
  - .claude/hooks/fleet/rust-target-sweep-nudge/tsconfig.json
  - .claude/skills/fleet/auditing-gha/SKILL.md
  - .claude/skills/fleet/cascading-fleet/SKILL.md
  - .claude/skills/fleet/deduping-dependencies/SKILL.md
  - .claude/skills/fleet/delegating-execution/SKILL.md
  - .claude/skills/fleet/guarding-paths/SKILL.md
  - .claude/skills/fleet/improve/SKILL.md
  - .claude/skills/fleet/locking-down-claude/SKILL.md
  - .claude/skills/fleet/looping-quality/SKILL.md
  - .claude/skills/fleet/measuring-ecosystem-impact/SKILL.md
  - .claude/skills/fleet/property-and-fuzz-testing/SKILL.md
  - .claude/skills/fleet/refreshing-history/SKILL.md
  - .claude/skills/fleet/releasing-a-package/SKILL.md
  - .claude/skills/fleet/setup-repo/SKILL.md
  - .claude/skills/fleet/tidying-worktrees/SKILL.md
  - .claude/skills/fleet/writing-fast-tests/SKILL.md
  - docs/agents.md/fleet/cascade-file-classification.md
  ... and 35 more
@jdalton
chore(deps): reconcile the lockfile after the fleet cascade
7d4e446
@jdalton
chore(wheelhouse): cascade template@3bd41b41b
9d4b168 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
16 file(s) touched:
  - .claude/hooks/fleet/_shared/fleet-markers.mts
  - .claude/skills/fleet/agent-ci/SKILL.md
  - .claude/skills/fleet/auditing-gha/SKILL.md
  - .claude/skills/fleet/locking-down-claude/SKILL.md
  - .claude/skills/fleet/managing-worktrees/lib/land.mts
  - .claude/skills/fleet/property-and-fuzz-testing/SKILL.md
  - .claude/skills/fleet/scanning-security/SKILL.md
  - .claude/skills/fleet/updating-security/SKILL.md
  - .claude/skills/fleet/writing-disclosures/SKILL.md
  - .config/fleet/oxlintrc.json
  - .config/repo/vitest.config.mts
  - .gitattributes
  - .gitignore
  - docs/agents.md/fleet/hook-registry.md
  - docs/agents.md/fleet/npm-publish-scanning.md
  - package.json
@jdalton
chore(wheelhouse): cascade template@ea0b18307
467cc23 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
10 file(s) touched:
  - .claude/hooks/fleet/_shared/markdown-path.mts
  - .claude/hooks/fleet/readme-fleet-shape-guard/index.mts
  - .github/actions/fleet/setup-and-install/action.yml
  - .github/workflows/get-green.lock.yml
  - .github/workflows/get-green.md
  - .github/workflows/npm-publish.yml
  - .github/workflows/weekly-update.lock.yml
  - .github/workflows/weekly-update.md
  - scripts/repo/bootstrap/fleet.d.mts
  - scripts/repo/bootstrap/fleet.mjs
@jdalton
chore(wheelhouse): cascade template@8ea0da5f3
676f445 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
17 file(s) touched:
  - .claude/skills/fleet/auditing-gha/canonical-patterns.mts
  - .config/fleet/oxlintrc.json
  - scripts/fleet/_shared/cascade-mirror-scope.mts
  - scripts/fleet/_shared/check-steps-hooks.mts
  - scripts/fleet/_shared/fleet-canonical-splice.mts
  - scripts/fleet/_shared/test-collection.mts
  - scripts/fleet/bump/changelog-sections.mts
  - scripts/fleet/bump/invocation.mts
  - scripts/fleet/check/disclosure-content-is-grounded.mts
  - scripts/fleet/check/publish-workflows-are-conventionally-named.mts
  - scripts/fleet/get-green.mts
  - scripts/fleet/lib/skill-system.mts
  - scripts/fleet/npm-publish.mts
  - scripts/fleet/rust-target-sweep.mts
  - scripts/fleet/test-runner/run-vitest.mts
  - scripts/fleet/weekly-update.mts
  - scripts/fleet/weekly-update/deterministic-chain.mts
@jdalton
chore(wheelhouse): cascade template@098429744
82cf1bb 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
71 file(s) touched:
  - .claude/agents/fleet/pr-feedback.md
  - .claude/hooks/fleet/_shared/copyleft-upstreams.mts
  - .claude/hooks/fleet/_shared/markdown-path.mts
  - .claude/hooks/fleet/no-copyleft-source-read/index.mts
  - .claude/hooks/fleet/release-commit-subject-guard/index.mts
  - .claude/hooks/fleet/squash-freeze-boundary-guard/index.mts
  - .claude/hooks/fleet/squash-freeze-boundary-guard/package.json
  - .claude/hooks/fleet/squash-freeze-boundary-guard/tsconfig.json
  - .claude/hooks/fleet/stale-tree-clobber-guard/index.mts
  - .claude/rules/fleet/prose-style-and-doctrine.md
  - .claude/skills/fleet/auditing-gha/canonical-patterns.mts
  - .claude/skills/fleet/cascading-fleet/lib/fleet-repos.json
  - .claude/skills/fleet/gh-stack/SKILL.md
  - .claude/skills/fleet/gh-stack/reference.md
  - .claude/skills/fleet/opening-pr/SKILL.md
  - .claude/skills/fleet/refreshing-history/run.mts
  - .claude/skills/fleet/squashing-history/SKILL.md
  - .claude/skills/fleet/squashing-history/run-guards.mts
  - .claude/skills/fleet/squashing-history/run-squash-modes.mts
  - .claude/skills/fleet/squashing-history/run.mts
  ... and 51 more
@jdalton
chore(wheelhouse): cascade template@93f571df7
5f1bc0f 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
14 file(s) touched:
  - .claude/hooks/fleet/setup-security-tools/lib/skillspector.mts
  - .claude/skills/fleet/squashing-history/reference.md
  - .claude/skills/fleet/squashing-history/run-guards.mts
  - .claude/skills/fleet/squashing-history/run.mts
  - .config/fleet/pnpm-workspace.fleet.yaml
  - pnpm-workspace.yaml
  - scripts/fleet/_shared/repo-filter.mts
  - scripts/fleet/_shared/run-main.mts
  - scripts/fleet/check/actions-secrets-are-declared.mts
  - scripts/fleet/check/main-branch-rules-are-enforced.mts
  - scripts/fleet/check/publish-environments-are-branch-restricted.mts
  - scripts/fleet/check/release-tags-are-immutable.mts
  - scripts/fleet/check/webhooks-are-allowlisted.mts
  - scripts/fleet/check/workflow-token-is-read-only.mts
@jdalton
chore(deps): reconcile the lockfile with the cascaded catalog
065fd52
@jdalton
chore(docs): generate llms.txt from the export map
427f8ab 
Opts into docs.llmsTxt, which wires the docs:llms command and generates the root llms.txt export index for agents reading the published tarball. Also drops the retired gen:llms-txt script, whose target scripts/fleet/gen/llms-txt.mts exists in no repo in the fleet, and picks up the pending fleet cascade.
@jdalton
fix(soak): drop the unpublishable bare stuie exclude
1e2caee 
Canonical SOCKET_PACKAGE_PATTERNS dropped the bare name because npm
refuses it as too similar to existing packages, so it is never published
and never needs a bypass. The cascade only adds soak entries, so members
kept the stale line and soak-excludes-have-dates failed across the fleet.
@jdalton
ci: add the OTEL_SDK_DISABLED fleet-env knob
32ca629 
FLEET_ENV gained the knob and telemetry-env-is-disabled asserts every
one at CI runtime, but ci.yml is a seed-once preset the cascade never
updates, so each repo needs it added directly.
@jdalton
fix(fleet): resync -stable aliases, drop scripts with missing targets
f8b6ccb 
The catalog bumped several base versions without moving their -stable
aliases, and package.json scripts pointed at fleet files the fleet
renamed away. Both are cascade-additive gaps: the sync adds entries but
never prunes or re-pins them.
@jdalton
chore(wheelhouse): reconcile pnpm-lock.yaml after cascade
ef25b56
@jdalton
chore(wheelhouse): cascade template@bcb33b33b
0239c01 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
30 file(s) touched:
  - .claude/hooks/fleet/setup-security-tools/lib/headroom.mts
  - .claude/hooks/fleet/setup-security-tools/lib/skillspector.mts
  - .claude/hooks/fleet/test-env-scrub-order-guard/index.mts
  - .claude/skills/fleet/cascading-fleet/lib/fleet-repos.json
  - .config/fleet/oxlint-plugin/fleet/no-source-sniffing/index.mts
  - .github/actions/fleet/_shared/external-tools.json
  - .github/actions/fleet/checkout/action.yml
  - .github/actions/fleet/install/action.yml
  - .github/actions/fleet/setup/action.yml
  - docs/agents.md/fleet/hook-registry.md
  - docs/agents.md/fleet/squash-until-release.md
  - docs/agents.md/fleet/test-layout.md
  - docs/agents.md/fleet/trusted-publishing-posture.md
  - scripts/fleet/_shared/check-steps-hooks.mts
  - scripts/fleet/_shared/check-steps-release.mts
  - scripts/fleet/_shared/spawn-env-scan.mts
  - scripts/fleet/_shared/test-isolation-law.mts
  - scripts/fleet/check/external-tools-match-wheelhouse.mts
  - scripts/fleet/check/native-sources-are-doctrine-clean.mts
  - scripts/fleet/check/publish-entrypoints-are-fleet-composed.mts
  ... and 10 more
@jdalton
chore(config): regenerate the socket-wheelhouse schema from its typeb…
a5807ab 
…ox source
@jdalton
fix(release): baseline the three unprovenanced odai npm versions
a797d72 
0.0.0, 0.0.1 and 0.1.0 were published before the provenance pipeline was
wired up, so the npm attestation endpoint 404s for all three. npm mints
attestations at publish time and they are immutable, so no tag and no
commit can repair them. Grandfather them in release.provenanceOrphanBaseline
so check/release-tags-match-provenance reports them every run instead of
failing; any new version stays gated.
@jdalton
chore(wheelhouse): cascade template@a2f211553
16712a1 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
4 file(s) touched:
  - .github/actions/fleet/setup-rust-cache/action.yml
  - CLAUDE.md
  - docs/agents.md/fleet/trusted-publishing-posture.md
  - package.json
@jdalton
chore(wheelhouse): cascade template@535d73a09
e8f633a 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
21 file(s) touched:
  - scripts/fleet/_shared/cargo-workspaces.mts
  - scripts/fleet/_shared/check-steps-release.mts
  - scripts/fleet/_shared/github-raw-url.mts
  - scripts/fleet/check/coverage-badge-is-current.mts
  - scripts/fleet/check/fuzz-tiers-are-covered.mts
  - scripts/fleet/check/publish-entrypoints-are-fleet-composed.mts
  - scripts/fleet/constants/catalog-holds.mts
  - scripts/fleet/gen/api-md.mts
  - scripts/fleet/gen/coverage-badge.mts
  - scripts/fleet/gen/llms-txt.mts
  - scripts/fleet/lib/api-docs/export-rows.mts
  - scripts/fleet/lib/coverage-badge.mts
  - scripts/fleet/publish-infra/cargo/trusted-publisher.mts
  - scripts/fleet/publish-infra/npm/auth-posture.mts
  - scripts/fleet/publish-infra/npm/placeholder.mts
  - scripts/fleet/publish-infra/npm/publish-command.mts
  - scripts/fleet/publish-infra/npm/staged-workspace.mts
  - scripts/fleet/publish-infra/npm/staged.mts
  - scripts/fleet/publish-infra/pin-readme.mts
  - scripts/fleet/socket-wheelhouse-schema/docs.mts
  ... and 1 more
@jdalton
chore(wheelhouse): cascade template@754d8a082
a08d67f 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
1 file(s) touched:
  - pnpm-workspace.yaml
@jdalton
chore(wheelhouse): complete the cascade of the moved generators and h…
5e9874d 
…eld pin
@jdalton
chore(wheelhouse): cascade template@4f14ec07c
b7b857a 
Auto-applied by socket-wheelhouse sync-scaffolding into odai.
4 file(s) touched:
  - .config/fleet/pnpm-workspace.fleet.yaml
  - scripts/fleet/_shared/github-raw-url.mts
  - scripts/fleet/gen/coverage-badge.mts
  - scripts/fleet/lib/coverage-badge.mts
@jdalton
fix(catalog): sync the sdk -stable alias to the held base version
e667274
@roninjin10
upgrade smithers-orchestrator to smthrs
3c01241
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@roninjin10 @jdalton