Socket CLI builds one Node package. Commands download external tools when needed; bundle-tools.json records their versions and checksums.
Socket Firewall runs inside the CLI from src/core/firewall/. Package-manager commands call this implementation directly.
Each tool entry declares its distribution source, version, and platform checksums. Build scripts read the manifest from the repository root and include the required metadata in the CLI bundle.
src/util/dlx/resolve-binary.mts resolves tool executables. src/util/dlx/spawn.mts handles downloads and execution. The Python tool helpers live in src/util/basics/.
Tool downloads must retain their integrity checks. A local executable override is an explicit operator choice and must not replace the default verified download path.
.gitmodules declares source references under upstream/. These references are shallow and sparse. Exact commit references keep checkout content reproducible.
Source references do not add upstream files to the npm package. The root manifest's file list defines the published artifact.
- Add its source, version, and checksums to
bundle-tools.json. - Wire the required build metadata in
scripts/repo/cli-build/environment-variables.mts. - Add the command's resolver and execution path.
- Test successful execution, integrity failures, and command exit status.