# Verify upstream submodule exists
ls -la packages/node-smol-builder/upstream/node

# Check current Node.js version in submodule
cd packages/node-smol-builder/upstream/node && git describe --tags

Task({
  subagent_type: "general-purpose",
  description: "Regenerate Node.js patches from pristine source",
  prompt: `Regenerate Socket Security Node.js patches from pristine upstream Node.js v25.5.0 source.

<task>
Your task is to regenerate 13 Socket Security Node.js patches from pristine upstream Node.js v25.5.0 source, ensuring each patch applies cleanly to unmodified upstream files. You must follow the 8-step workflow for EACH patch with proper backups, validation, and cleanup.
</task>

<context>
**Project Context:**
You are working on socket-btm (Socket Security's binary tooling manager) which builds custom Node.js binaries with security patches. The patches are stored in:
- Original patches: packages/node-smol-builder/patches/source-patched/
- Upstream Node.js: packages/node-smol-builder/upstream/node (submodule at v25.5.0)

**Why Regenerate Patches:**
- Ensures patches apply to pristine upstream (no dependencies between patches)
- Uses standard diff format (not git diff) for portability
- Validates correctness with patch --dry-run
- Creates backups to prevent data loss

**Patch Inventory (13 total):**
1. 001-common_gypi_fixes.patch → common.gypi
2. 002-polyfills.patch → lib/internal/bootstrap/realm.js
3. 003-fix_gyp_py3_hashlib.patch → tools/gyp/pylib/gyp/common.py
4. 004-realm-vfs-binding.patch → lib/internal/bootstrap/realm.js
5. 005-node-gyp-vfs-binject.patch → node.gyp
6. 006-node-binding-vfs.patch → src/node_binding.cc
7. 007-node-sea-smol-config-header.patch → src/node_sea.h
8. 008-node-sea-smol-config.patch → src/node_sea.cc
9. 009-node-sea-header.patch → src/node_sea.h
10. 010-node-sea-bin-binject.patch → src/node_sea.cc
11. 011-fix_v8_typeindex_macos.patch → common.gypi
12. 012-vfs_bootstrap.patch → lib/internal/bootstrap/node.js
13. 013-vfs_require_resolve.patch → lib/internal/modules/cjs/loader.js
</context>

<constraints>
**CRITICAL Requirements (MUST follow for EACH patch):**
- ALWAYS backup original patch with timestamp BEFORE any changes
- ALWAYS reset upstream/node to pristine v25.5.0 BEFORE working on each patch
- ALWAYS use diff -u (NOT git diff) for standard unified format
- ALWAYS validate with patch --dry-run before saving
- ALWAYS clean workspace between patches (no state reuse)
- ALWAYS preserve Socket Security headers from original patch

**Failure Modes to Prevent:**
- Patch contamination (using modified upstream for next patch)
- Missing backups (can't rollback if regeneration fails)
- Invalid patches (skipping validation causes build failures)
- Format incompatibility (git diff format doesn't work with patch command)
</constraints>

<instructions>

## Critical Workflow (MUST FOLLOW FOR EACH PATCH)

For EACH of the 13 patches, execute these 8 steps:

### Step 1: Backup Original Patch

<action>
Create timestamped backup of the original patch before any modifications:
</action>

\`\`\`bash
PATCH_NAME="001-common_gypi_fixes.patch"  # Example - use actual patch name
TIMESTAMP=$(date +%Y%m%d-%H%M%S)
cp packages/node-smol-builder/patches/source-patched/$PATCH_NAME \\
   packages/node-smol-builder/patches/source-patched/$PATCH_NAME.backup-$TIMESTAMP
\`\`\`

<validation>
Verify backup created:
\`\`\`bash
ls -lh packages/node-smol-builder/patches/source-patched/$PATCH_NAME.backup-*
\`\`\`

Expected: Backup file exists with timestamp in filename.
</validation>

---

### Step 2: Reset Upstream Node.js Submodule to Pristine State

<action>
CRITICAL: Reset upstream Node.js to pristine v25.5.0 - no modifications from previous patches:
</action>

\`\`\`bash
cd packages/node-smol-builder/upstream/node
git reset --hard v25.5.0
git clean -fd
cd -
\`\`\`

<validation>
Verify pristine state:
\`\`\`bash
cd packages/node-smol-builder/upstream/node
git status  # Should show "nothing to commit, working tree clean"
git describe --tags  # Should show v25.5.0
cd -
\`\`\`

Expected: Working tree clean, no uncommitted changes, tagged v25.5.0.
</validation>

---

### Step 3: Get Pristine Target File

<action>
Identify which file this patch modifies and copy pristine version to workspace:
</action>

\`\`\`bash
# Read original patch to identify target file (look at --- a/FILE or +++ b/FILE lines)
# For example: 001-common_gypi_fixes.patch modifies common.gypi

TARGET_FILE="common.gypi"  # Example - extract from patch

# Create clean workspace
mkdir -p /tmp/patch-rebuild
cd packages/node-smol-builder/upstream/node

# Copy pristine file to workspace
cp $TARGET_FILE /tmp/patch-rebuild/pristine-$TARGET_FILE
cd -
\`\`\`

<validation>
Verify pristine file copied:
\`\`\`bash
ls -lh /tmp/patch-rebuild/pristine-*
\`\`\`

Expected: Pristine file exists in workspace.
</validation>

---

### Step 4: Modify the Specific File

<action>
Read original patch to understand Socket Security changes, then apply modifications:
</action>

\`\`\`bash
# Copy pristine to modified
cp /tmp/patch-rebuild/pristine-$TARGET_FILE /tmp/patch-rebuild/modified-$TARGET_FILE

# Read original patch to understand what changes to apply
# Look at the diff hunks (lines starting with + and -)
cat packages/node-smol-builder/patches/source-patched/$PATCH_NAME

# Apply Socket Security modifications to modified-$TARGET_FILE using Edit tool
# Recreate the changes shown in the original patch
\`\`\`

<validation>
Think through these validation questions:
1. Did you read the original patch header (Socket Security comments)?
2. Did you understand what changes are being made?
3. Did you apply ALL changes from the original patch?
4. Did you verify the modifications are correct?

Compare your changes:
\`\`\`bash
diff -u /tmp/patch-rebuild/pristine-$TARGET_FILE /tmp/patch-rebuild/modified-$TARGET_FILE
\`\`\`

Expected: Diff shows the Socket Security changes you applied.
</validation>

---

### Step 5: Create Patch (diff style, NOT git diff)

<action>
Generate patch in standard unified diff format:
</action>

\`\`\`bash
cd /tmp/patch-rebuild

# Generate diff with unified format (minimum 3 context lines)
diff -u pristine-$TARGET_FILE modified-$TARGET_FILE > raw-patch.diff

# Read Socket Security header from original patch (lines starting with #)
# Preserve these comments - they document what the patch does

# Create final patch with header
cat > final-patch.patch << 'EOF'
# Socket Security: [Copy brief description from original]
# [Copy detailed explanation from original]
# Files modified: $TARGET_FILE
EOF

# Append the diff
cat raw-patch.diff >> final-patch.patch

# Normalize headers to standard format (remove temp workspace filenames)
sed -i.bak "s|^--- pristine-|--- a/|; s|^+++ modified-|+++ b/|" final-patch.patch
rm final-patch.patch.bak
\`\`\`

<validation>
Verify patch format:
\`\`\`bash
head -20 /tmp/patch-rebuild/final-patch.patch
\`\`\`

Expected:
- Socket Security comments at top (lines starting with #)
- Standard diff headers: --- a/FILE and +++ b/FILE
- Unified diff hunks with @@ markers
- Context lines (unchanged) and change lines (+/-)
</validation>

---

### Step 6: Validate Patch Against Pristine

<action>
CRITICAL: Validate patch applies cleanly to pristine source (dry-run, no actual changes):
</action>

\`\`\`bash
cd /tmp/patch-rebuild

# Copy pristine for testing
cp pristine-$TARGET_FILE test-$TARGET_FILE

# Test patch application (dry-run)
if ! patch --dry-run test-$TARGET_FILE < final-patch.patch; then
  echo "ERROR: Patch validation failed!"
  echo "Patch contents:"
  cat final-patch.patch
  echo ""
  echo "This patch does NOT apply cleanly to pristine $TARGET_FILE"
  exit 1
fi

# Clean up test file
rm test-$TARGET_FILE
\`\`\`

<validation>
Think through these validation questions:
1. Did patch --dry-run succeed (exit 0)?
2. Are there any "FAILED" or "reject" messages?
3. Does the patch apply to pristine source without errors?

**If validation fails:**
- Review your modifications in Step 4
- Compare with original patch to see what you missed
- Regenerate the diff and retry validation
- Do NOT proceed to Step 7 if validation fails

Expected: patch --dry-run exits 0 with no errors.
</validation>

---

### Step 7: Save Patch

<action>
Copy validated patch to patches directory, replacing original:
</action>

\`\`\`bash
cp /tmp/patch-rebuild/final-patch.patch \\
   packages/node-smol-builder/patches/source-patched/$PATCH_NAME
\`\`\`

<validation>
Verify patch saved and compare sizes:
\`\`\`bash
ls -lh packages/node-smol-builder/patches/source-patched/$PATCH_NAME
ls -lh packages/node-smol-builder/patches/source-patched/$PATCH_NAME.backup-*
\`\`\`

Expected:
- New patch exists
- File size similar to backup (within 10-20%)
- Backup still exists (rollback available)
</validation>

---

### Step 8: Reset Upstream Node Submodule (Cleanup)

<action>
CRITICAL: Reset upstream to pristine state for next patch and clean workspace:
</action>

\`\`\`bash
cd packages/node-smol-builder/upstream/node
git reset --hard v25.5.0
git clean -fd
cd -

# Clean workspace
rm -rf /tmp/patch-rebuild
\`\`\`

<validation>
Verify clean state:
\`\`\`bash
cd packages/node-smol-builder/upstream/node
git status  # Should be clean
cd -
ls /tmp/patch-rebuild  # Should not exist
\`\`\`

Expected:
- Upstream Node.js pristine (no modifications)
- Workspace removed (no state leakage to next patch)

This ensures the next patch starts from pristine v25.5.0.
</validation>

---

## Reporting

For each patch, report:

**Patch: [NAME]**
- Backup: [BACKUP_FILENAME]
- Target file: [FILE_PATH]
- Validation: ✓ Passed / ✗ Failed
- Original size: [SIZE]
- New size: [SIZE]
- Status: ✓ Complete

At the end, provide summary:

**Patch Regeneration Complete**
================================
Total patches: 13
Successful: [N]
Failed: [N]
Backups created: [N]

All patches validated with patch --dry-run against pristine v25.5.0.
</instructions>

<completion_signal>
\`\`\`xml
<promise>PATCH_REGENERATION_COMPLETE</promise>
\`\`\`
</completion_signal>

<success_criteria>
- ✅ All 13 patches regenerated from pristine v25.5.0
- ✅ Each patch backed up with timestamp before replacement
- ✅ Each patch validated with patch --dry-run (100% success rate)
- ✅ Workspace cleaned between patches (no contamination)
- ✅ Socket Security headers preserved in all patches
- ✅ Ready for build testing
</success_criteria>
`
})

<promise>SKILL_COMPLETE</promise>