feat: add tsgo type checking to check runner

[John-David Dalton (jdalton)]

Summary

• Add @typescript/native-preview@7.0.0-dev.20260415.1 (tsgo) to devDependencies
• Add tsgo --noEmit type checking step to pnpm check flow
• Check runner now does: lint → format → typecheck

Aligns with socket-lib, socket-registry, socket-btm, ultrathink which all have this now.

---

Note

Medium Risk
Touches developer workflow enforcement (git hooks) and lint/typecheck tooling, which can block commits/pushes or introduce new CI failures if behavior changes unexpectedly; no production/runtime logic is affected.

Overview
Improves repo security/tooling ergonomics by hardening git hooks and tightening scanning guidance: commit-msg now uses safer temp-file handling/cleanup and consistent printf output, .husky/commit-msg fails fast if the hook script is missing, and pre-push reduces false positives by word-boundary matching AKIA... AWS keys.

Updates security-scan docs (marks the skill user-invocable, adjusts tool reference to external-tools.json) and tightens code quality by enforcing oxlint eslint/curly as an error. Also adds @typescript/native-preview to devDependencies (with lockfile updates) and does mostly formatting/robustness tweaks in checksum sync/validation scripts.

^{Reviewed by Cursor Bugbot for commit 922a2f2. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​typescript/​native-preview@​7.0.0-dev.20260415.1

View full report

[John-David Dalton (jdalton)]

Consolidated into #1203

[John-David Dalton (jdalton)]

Merged into #1203

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 922a2f2. Configure here.}

[cursor]

Dependency added but never wired into any script

Medium Severity

@typescript/native-preview is added to devDependencies but tsgo is never invoked anywhere in the repo. The CLI package's type script still runs tsc --noEmit, and neither scripts/check.mjs nor scripts/type.mjs were updated to call tsgo. The PR description claims "Check runner now does: lint → format → typecheck" with tsgo, but the integration is missing — developers may mistakenly believe tsgo type checking is active when it isn't. This also adds a large native binary to every install for no benefit.

 

^{Reviewed by Cursor Bugbot for commit 922a2f2. Configure here.}