[John-David Dalton (jdalton)]

Add an experimental standalone socket 2.1.0 prerelease that embeds Node 27 and supported tools. Keep Socket 1.14.1 and both legacy packages buildable; unavailable tools fail clearly instead of downloading replacements.

Add native image tests for all 71 registered command paths and eight bundled patch subcommands, plus local behavior and two interactive flows. Help captures use 140 columns. Screenshots trim empty bottom rows automatically; animation checkpoints share a canvas. Runs isolate fixtures and caches, and trusted macOS CI signs the binary before execution.

Validation: 92 native tests pass on macOS ARM64 and Linux ARM64; 24 utility tests, 29 artifact-upload tests, and lint pass. Fixed CRLF lockfile parsing that omitted the Windows patch binary; the updated CI matrix is running.

Animated scan setup. CI artifacts include the HTML gallery, 95 images, and both animations.

Automated review notes

---

[!NOTE]
High Risk
Large build-pipeline and dependency-inlining changes affect every distribution path (npm dist vs SEA), bundled third-party legal compliance, and standalone tool resolution (Bazel/cdxgen/synp).

Overview
Node 27 SEA packaging lands as a 2.1.0 prerelease: new Rollup configs bundle cdxgen and Synp into the VFS, roll provenance via includedModulesInventoryPlugin / THIRD-PARTY-NOTICES.json, and stage curated license material under src/sea/licenses/. Dist builds honor SOCKET_SEA_BUILD (inventories for core, blessed-contrib, and copied blessed; skip package.json churn where appropriate).

Build/runtime decoupling from @socketsecurity/registry: helpers move to scripts/utils/registry-helpers.js, runtime imports shift to local src/utils/* (logger, spawn, prompts, fs, etc.), @socketsecurity/registry is no longer external/copied, and bin/cli.js spawns through dist/utils.js. Build constants in scripts/constants.js are local, with SOCKET_SEA_DIST_DIR / SOCKET_SEA_EXTERNAL_DIR overrides.

Standalone behavior: isStandaloneSea() tightens Bazel resolution (native binary only, no Bazelisk/Node launchers); README documents SOCKET_CLI_SOCKET_PATCH_PATH.

Repo hygiene and CI: .gitignore switches to deny-all with an explicit allowlist; integration (scripts/test/integration.mts) and native SEA (scripts/test/native.mts) test scripts join the matrix; Apple signing helper capture.mts is added; package bumps inquirer/cross-spawn, removes registry deps, and extends test scripts.

^{Reviewed by Cursor Bugbot for commit 1e5a252. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​termless/​xtermjs@​0.11.0
	npm/​@​types/​cross-spawn@​6.0.6
	npm/​svgo@​4.1.0
	npm/​node-pty@​1.2.0-beta.18
	npm/​@​termless/​core@​0.11.0
	npm/​@​inquirer/​password@​4.0.18
	npm/​@​inquirer/​select@​4.3.2
	npm/​@​inquirer/​input@​4.2.2
	npm/​@​inquirer/​confirm@​5.1.16

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​termless/​xtermjs@​0.11.0
	npm/​@​types/​cross-spawn@​6.0.6
	npm/​node-pty@​1.2.0-beta.18
	npm/​@​termless/​core@​0.11.0
	npm/​@​inquirer/​password@​4.0.18
	npm/​@​inquirer/​confirm@​5.1.16
	npm/​@​inquirer/​select@​4.3.2
	npm/​@​inquirer/​input@​4.2.2
	npm/​svgo@​4.1.0

View full report

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Gitignore drops GitHub workflow tracking
  • Allowlisted .github and its contents in the deny-by-default gitignore so workflows are trackable and scanned, while copilot instructions stay ignored.

Or push these changes by commenting:

@cursor push 8129ed34e4

Preview (8129ed34e4)

diff --git a/.gitignore b/.gitignore
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,8 @@
 !/.claude/skills/
 !/.claude/skills/bump-coana/
 !/.config/
+!/.github/
+!/.github/**
 !/.husky/
 !/.vscode/
 !/assets/

_{You can send follow-ups to the cloud agent here.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1e5a252. Configure here.}

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm playwright-core under MIT WITH Google-Patent-WebM License: MIT WITH Google-Patent-WebM - The applicable license policy does not permit this license (5) (package/lib/webp_codec.LICENSE) From: pnpm-lock.yaml → npm/@termless/core@0.11.0 → npm/playwright-core@1.65.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/playwright-core@1.65.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[socket-security-staging]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm playwright-core under MIT WITH Google-Patent-WebM License: MIT WITH Google-Patent-WebM - The applicable license policy does not permit this license (5) (package/lib/webp_codec.LICENSE) From: pnpm-lock.yaml → npm/@termless/core@0.11.0 → npm/playwright-core@1.65.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/playwright-core@1.65.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report