chore(wheelhouse): cascade template@8a15af1b

Auto-applied by socket-wheelhouse sync-scaffolding into cascade-socket-btm-9299.
12 file(s) touched:
  - .claude/hooks/fleet/prefer-async-spawn-guard/index.mts
  - .claude/hooks/fleet/prefer-async-spawn-guard/test/index.test.mts
  - .github/workflows/ci.yml
  - pnpm-lock.yaml
  - scripts/fleet/setup/external-tools.json
  - scripts/fleet/setup/index.mts
  - scripts/fleet/setup/lib/check-firewall.mjs
  - scripts/fleet/setup/lib/install-tool.mjs
  - scripts/fleet/setup/lib/jq.mjs
  - scripts/fleet/setup/lib/platform.mjs
  - scripts/fleet/setup/lib/read-pinned-version.mjs
  - scripts/fleet/setup/setup-tools.mjs

Author: jdalton

.claude/hooks/fleet/prefer-async-spawn-guard/index.mts

@@ -52,9 +52,14 @@ const CHILD_PROCESS_REQUIRE_RE =
 
 /**
  * Files where importing `node:child_process` is legitimate: this hook's own
- * files, the oxlint rules that match the banned shapes, and the markdownlint
+ * files, the oxlint rules that match the banned shapes, the markdownlint
  * self-skip shim (a `.mjs` rule loaded by markdownlint-cli2, which can't await
- * the async lib wrapper, so its documented fallback is the sync builtin).
+ * the async lib wrapper, so its documented fallback is the sync builtin), and
+ * the pre-pnpm bootstrap `.mjs` provisioners under `scripts/fleet/setup/`.
+ * Those install pnpm itself on a bare machine BEFORE node_modules exists, so
+ * `@socketsecurity/lib`'s async `spawn` wrapper isn't on disk to import — the
+ * sync builtin is the only option (same constraint as the markdownlint shim);
+ * each carries an `oxlint-disable socket/prefer-async-spawn` documenting it.
  */
 export function isExemptPath(filePath: string): boolean {
   return (
@@ -72,7 +77,11 @@ export function isExemptPath(filePath: string): boolean {
     ) ||
     filePath.includes(
       '/.config/fleet/markdownlint-rules/_shared/wheelhouse-self-skip.',
-    )
+    ) ||
+    // Pre-pnpm bootstrap .mjs provisioners (scripts/fleet/setup/{lib/,*}.mjs):
+    // run before node_modules exists, so the lib spawn wrapper isn't importable
+    // yet. Scoped to `.mjs` so the dir's `.mts` steps stay guarded.
+    (filePath.includes('/scripts/fleet/setup/') && filePath.endsWith('.mjs'))
   )
 }
 

.claude/hooks/fleet/prefer-async-spawn-guard/test/index.test.mts

@@ -74,6 +74,10 @@ describe('prefer-async-spawn-guard / isExemptPath', () => {
       '/repo/.config/fleet/markdownlint-rules/_shared/wheelhouse-self-skip.mjs',
       '/repo/dist/foo.js',
       '/repo/node_modules/x/y.js',
+      // Pre-pnpm bootstrap .mjs provisioners (install pnpm before node_modules
+      // exists, so the lib spawn wrapper isn't importable yet).
+      '/repo/scripts/fleet/setup/lib/install-tool.mjs',
+      '/repo/scripts/fleet/setup/setup-tools.mjs',
     ]) {
       assert.equal(isExemptPath(p), true, p)
     }
@@ -82,5 +86,9 @@ describe('prefer-async-spawn-guard / isExemptPath', () => {
   test('does not exempt ordinary source', () => {
     assert.equal(isExemptPath('/repo/scripts/foo.mts'), false)
     assert.equal(isExemptPath('/repo/src/bar.ts'), false)
+    // The setup dir's `.mts` steps run AFTER setup, so they stay guarded —
+    // only the pre-node `.mjs` bootstrap files are exempt.
+    assert.equal(isExemptPath('/repo/scripts/fleet/setup/index.mts'), false)
+    assert.equal(isExemptPath('/repo/scripts/fleet/setup/token.mts'), false)
   })
 })

.github/workflows/ci.yml

@@ -29,4 +29,4 @@ concurrency:
 jobs:
   ci:
     name: Run CI Pipeline
-    uses: SocketDev/socket-registry/.github/workflows/ci.yml@4069dfc8c54c0b6ffa43924857e6b89296370efe # main (2026-06-09)
+    uses: SocketDev/socket-registry/.github/workflows/ci.yml@1c633fb12cf27b12f06f9d685e89d34e302822c3 # main (2026-06-13)