[Jordan Harband (ljharb)]

Summary

sauce stops hydrating the GHCR fleet pack and keeps no fleet code. It now owns small scripts for each job, the same way SocketDev/socket-mcp#232 does, and CI uses SHA-pinned upstream actions.

Job	Now
pnpm test, cover, test:fuzz-harnesses, test:structural	plain Vitest through .config/repo/vitest.config.mts
format, format:check, lint, lint:fix, fix	oxfmt / oxlint with root .oxfmtrc.json and .oxlintrc.json
type	tsc on tsconfig.json and .config/repo/tsconfig.release-kit.json
check	format, lint, type, check-paths, the scripts/repo/check/*.mts gates, generate:check, and a content scan
prepare	scripts/repo/install-git-hooks.mts sets core.hooksPath=.git-hooks
Git hooks	commit-msg: Conventional Commits and no AI attribution. pre-commit: scans staged files. pre-push: pnpm run type
CI	actions/checkout and actions/setup-node pinned by SHA, pnpm 12.14.0 from npm, the no-telemetry env in every workflow

The generators (pnpm run generate / generate:check) work unchanged. They now format their output with oxfmt directly.

What is removed

• The GHCR download, verification and hydration code (scripts/repo/bootstrap), its 5,500-line .gitignore block, and its setup steps in .claude/settings.json.
• scripts/fleet, .claude/hooks/fleet, .claude/skills/fleet, .config/fleet, test/fleet, .github/actions, the fleet git-hook chain, and .husky.
• The fleet member configs under .config and .config/repo, and the scripts/repo entry points that only fleet tooling ran.
• Workflows that need fleet scripts. These three stay: ci: gates, ci: e2e, ci: publish claude marketplace.
• 42 of the 54 devDependencies, their catalog pins and soak exclusions, and 5 patches that only that code needed. The lockfile loses about 7,150 lines.

Differences from socket-mcp#232

These files come from socket-mcp unchanged: scripts/repo/util/{main,commit-message}.mts, scripts/repo/hooks/commit-msg.mts, .git-hooks/*, CLAUDE.md, and .gitattributes. These are adapted:

• scripts/repo/util/scan.mts has no private-repo-name rule. sauce names that repository in working code: the plugin installer's marketplace URL and the release-kit's shared Chrome profile path. The existing shipped-content-is-consumer-clean check already governs that name in shipped files.
• scan.mts skips tracked directory symlinks. Without this, check crashes on .opencode/skills.
• pre-commit skips staged gitlinks, which have no blob to read.
• check.mts uses a shell on Windows only for pnpm steps. node steps run without a shell, so a Node path with a space still works.
• .oxfmtrc.json also ignores **/plugin-patches/**, because those files are byte copies of upstream sources.
• install-git-hooks.mts is sauce's existing, tested installer. .claude/settings.json keeps sauce's publish-deny and force-push-ask permissions.

test/repo/unit/repo-scan.test.mts (from socket-mcp) and commit-message.test.mts cover the scan, the hooks, and these differences.

Verification

On a clean clone with Node 26.10.0 and pnpm 12.12.0:

Command	Result
pnpm install --frozen-lockfile	pass; core.hooksPath is .git-hooks
pnpm run check	pass, all steps
pnpm test	56 files, 1231 tests pass
pnpm run test:fuzz-harnesses	41 tests pass
pnpm run cover, build, generate:check	pass

Real commits through the hooks rejected a non-conventional subject, an AI attribution trailer, and a staged AWS key. They accepted normal commits, staged deletions, and fixups. test:e2e needs agent CLIs and credentials, so I did not run it locally. This change does not touch it.

Follow-ups

• An upstream fleet sync would add the removed files back unless that changes upstream.
• socket-mcp's scan.mts and pre-commit.mts have the same symlink and gitlink cases. They don't matter there today, because socket-mcp tracks neither.

---

Note

Medium Risk
Large dev/CI surface change (lint, test, hooks, check gates) with no production runtime path, but regressions would block merges and local workflows until fixed.

Overview
Removes the GHCR fleet pack and all cascaded scaffolding — scripts/fleet, fleet hooks/skills, .config/fleet, wheelhouse member JSON/schema, fleet oxlint/markdownlint/esbuild configs, Husky, and the SessionStart/hook/statusline wiring in .claude/settings.json. Claude settings shrink to telemetry env knobs plus existing publish/force-push permissions.

Replaces fleet runners with repo-local tooling patterned after socket-mcp: pnpm scripts call scripts/repo/* for check, format, lint, type, hooks (core.hooksPath=.git-hooks), and generators; CI uses SHA-pinned checkout/setup-node. Vitest is rewritten — .config/repo/vitest.config.mts drops fleet lanes, coverage merge, and vitest.settings.mts; tests target test/repo/** with optional fuzz via TEST_FUZZ, inline coverage for release-kit/**, and release-kit typecheck now extends root tsconfig.json with DOM lib.

Deletes the updating-xport skill, fleet output style, and per-repo socket-wheelhouse config that drove coverage/hooks/workflows — those behaviors must now live in the simplified configs and check script or are intentionally gone with the fleet workflows.

^{Reviewed by Cursor Bugbot for commit a46a0dd. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a46a0dd. Configure here.}

[John-David Dalton (jdalton)]

I'll follow up with another pass if needed and we can trade reviews Jordan Harband (@ljharb)!