[John-David Dalton (jdalton)]

Add a standalone socket 2.1.0 pre-release with Node 27 and supported tools bundled in, so those tools run without extra downloads. Unavailable tools fail with a clear message.

Keep Socket 1.14.1 and both legacy CLI packages buildable alongside the native release.

---

Note

High Risk
Large changes to packaging, bundling, and release CI including native executables, third-party license handling, and removal of the external registry package from the dist layout.

Overview
Introduces a Node 27 SEA build path for the 2.1.0 pre-release CLI: pnpm build:sea assembles a self-contained native binary with bundled tools (cdxgen, synp, uv, etc.), new Rollup configs that emit THIRD-PARTY-NOTICES and source inventories for license provenance, and SEA-specific dist staging (SOCKET_SEA_BUILD).

Build and packaging no longer ship @socketsecurity/registry as an external copy; registry utilities move to scripts/utils/registry-helpers.js and are bundled into dist, with CLI spawn paths updated accordingly. A build:package-matrix script still produces 1.14.1 and legacy/Sentry npm variants in isolation.

CI and tests add cross-platform native CLI jobs (prototype SEA build, download cache, terminal screenshot/signing checks), bump the default Node test matrix toward 26.13, and split Vitest into unit / integration / native / terminal configs under .config/. package.json gains native-test and snapshot scripts and related dev dependencies (e.g. termless, node-pty).

Repository hygiene changes include a deny-all .gitignore with explicit allowlists and config moves (Vitest, taze, tsconfig) into .config/.

^{Reviewed by Cursor Bugbot for commit 5912c1a. Configure here.}

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​termless/​xtermjs@​0.11.0
	npm/​@​types/​cross-spawn@​6.0.6
	npm/​@​actions/​cache@​6.3.0
	npm/​node-pty@​1.2.0-beta.18
	npm/​@​termless/​core@​0.11.0
	npm/​svgo@​4.1.0

View full report

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Gitignore drops GitHub workflow tracking
  • Allowlisted .github and its contents in the deny-by-default gitignore so workflows are trackable and scanned, while copilot instructions stay ignored.

Or push these changes by commenting:

@cursor push 8129ed34e4

Preview (8129ed34e4)

diff --git a/.gitignore b/.gitignore
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,8 @@
 !/.claude/skills/
 !/.claude/skills/bump-coana/
 !/.config/
+!/.github/
+!/.github/**
 !/.husky/
 !/.vscode/
 !/assets/

_{You can send follow-ups to the cloud agent here.}

[socket-security-staging]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm playwright-core under MIT WITH Google-Patent-WebM License: MIT WITH Google-Patent-WebM - The applicable license policy does not permit this license (5) (package/lib/webp_codec.LICENSE) From: pnpm-lock.yaml → npm/@termless/core@0.11.0 → npm/playwright-core@1.65.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/playwright-core@1.65.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 5912c1a. Configure here.}

[John-David Dalton (jdalton)]

Build verification for c1d36f904: all required checks pass in the verification run.

• Linux x64, macOS ARM64, and Windows x64: 95 native binary tests pass on each platform. Download-cache restore and fresh uploads work on all three.
• Package tests pass on Node 22, Node 24, and Node 26. Lint and type checking pass.

The two skipped rows belong to separate automatic runs:

• Native CLI tests • Cache read-only • No Apple signing (push): runs on PRs targeting v1.x, so it skips on pushes; the passing trusted matrix covers that event. The PR job has read-only cache access and no Apple signing credentials, keeping proposed code from publishing cache entries or accessing the signing identity.
• Native CLI tests • Cache writes • Apple signing available (pull_request): runs on pushes or manual dispatches for explicitly allowed branches in this repository, so it skips on PR events; the passing PR matrix covers that event. Trusted runs can save caches and use configured Apple signing credentials. Both jobs verify cached download checksums and run the same three-platform tests.

This PR introduces the workflow. The linked runs verify the reduced-diff build and fresh cache uploads. The current revision changes only the two job display names; its CI results are pending.