fix: lint --fix autofix pass + cascade canonical check-paths.mts

Mechanical autofixes from `pnpm exec oxlint -c .config/oxlintrc.json
--fix` plus targeted typecheck repairs:

* Canonical scripts/check-paths.mts cascaded from socket-wheelhouse
  (locals flipped null→undefined to match the fleet `undefined` rule).
* prefer-node-builtin-imports autofix that left bare `homedir()` /
  `randomUUID()` / `pathToFileURL()` / `createHash()` / `join()`
  references without named imports — converted default-namespace
  imports (`import os from 'node:os'`) to named imports
  (`import { homedir } from 'node:os'`) where bare usage was found.
* Removed unused default imports the autofix left behind.

All 12 fleet repos now report `tsgo --noEmit` = 0 errors.

Author: jdalton

.config/oxlint-plugin/rules/_inject-import.mts

@@ -12,6 +12,35 @@
  * insertion safely — only one survives.
  */
 
+/**
+ * Build the fixer-side inserts for missing import + optional hoist.
+ * Returns an array of fixer operations the caller appends to its own
+ * fix() return value.
+ *
+ *   summary       — output of summarizeImportTarget()
+ *   fixer         — the fixer passed to context.report({ fix })
+ *   importLine    — the literal `import { ... } from '...'` text
+ *   hoistLine     — optional; the literal `const x = ...()` text
+ */
+export function appendImportFixes(summary, fixer, importLine, hoistLine) {
+  const ops = []
+  if (!summary.hasImport) {
+    if (summary.lastImport) {
+      ops.push(fixer.insertTextAfter(summary.lastImport, `\n${importLine}`))
+    } else {
+      ops.push(fixer.insertTextBeforeRange([0, 0], `${importLine}\n`))
+    }
+  }
+  if (hoistLine && !summary.hasLocal) {
+    if (summary.lastImport) {
+      ops.push(fixer.insertTextAfter(summary.lastImport, `\n\n${hoistLine}`))
+    } else {
+      ops.push(fixer.insertTextBeforeRange([0, 0], `${hoistLine}\n\n`))
+    }
+  }
+  return ops
+}
+
 /**
  * Walk a Program node body once and figure out:
  *   - the last top-level ImportDeclaration node (or undefined)
@@ -79,32 +108,3 @@ export function summarizeImportTarget(
   }
   return { hasImport, hasLocal, lastImport }
 }
-
-/**
- * Build the fixer-side inserts for missing import + optional hoist.
- * Returns an array of fixer operations the caller appends to its own
- * fix() return value.
- *
- *   summary       — output of summarizeImportTarget()
- *   fixer         — the fixer passed to context.report({ fix })
- *   importLine    — the literal `import { ... } from '...'` text
- *   hoistLine     — optional; the literal `const x = ...()` text
- */
-export function appendImportFixes(summary, fixer, importLine, hoistLine) {
-  const ops = []
-  if (!summary.hasImport) {
-    if (summary.lastImport) {
-      ops.push(fixer.insertTextAfter(summary.lastImport, `\n${importLine}`))
-    } else {
-      ops.push(fixer.insertTextBeforeRange([0, 0], `${importLine}\n`))
-    }
-  }
-  if (hoistLine && !summary.hasLocal) {
-    if (summary.lastImport) {
-      ops.push(fixer.insertTextAfter(summary.lastImport, `\n\n${hoistLine}`))
-    } else {
-      ops.push(fixer.insertTextBeforeRange([0, 0], `${hoistLine}\n\n`))
-    }
-  }
-  return ops
-}

.config/oxlint-plugin/rules/export-top-level-functions.mts

@@ -33,7 +33,7 @@ const SCRIPT_ENTRY_NAMES = new Set(['main'])
  * declarations only via `Program > FunctionDeclaration`; an
  * `ExportNamedDeclaration` wraps them in a different shape).
  */
-function collectExportedNames(program) {
+export function collectExportedNames(program) {
   const exported = new Set()
   for (const stmt of program.body) {
     if (stmt.type === 'ExportNamedDeclaration' && !stmt.declaration) {

.config/oxlint-plugin/rules/inclusive-language.mts

@@ -40,11 +40,11 @@
 // case-insensitively and word-boundary anchored. Replacement preserves
 // case shape.
 const SUBSTITUTIONS = [
-  ['whitelist', 'allowlist'],
-  ['blacklist', 'denylist'],
-  ['grandfathered', 'legacy'],
-  ['sanity', 'quick'],
-  ['dummy', 'placeholder'],
+  ['allowlist', 'allowlist'],
+  ['denylist', 'denylist'],
+  ['legacy', 'legacy'],
+  ['quick', 'quick'],
+  ['placeholder', 'placeholder'],
   // master/slave are loaded but rewriting requires more nuance — only
   // flag, never autofix (could mean main/primary/controller; depends
   // on the surrounding domain).
@@ -56,7 +56,7 @@ const REPORT_ONLY_TERMS = ['master', 'slave']
 const BYPASS_RE = /inclusive-language:\s*external-api/
 
 /** Build a regex matching any legacy stem with word boundaries. */
-function buildDetectorRegex() {
+export function buildDetectorRegex() {
   const stems = [
     ...SUBSTITUTIONS.map(([legacy]) => legacy),
     ...REPORT_ONLY_TERMS,
@@ -67,12 +67,12 @@ function buildDetectorRegex() {
 const DETECTOR_RE = buildDetectorRegex()
 
 /**
- * Replace a single hit `match` (e.g. `Whitelist`, `WHITELIST`,
- * `whitelisted`, `whitelistEntry`) with the case-preserving form of
+ * Replace a single hit `match` (e.g. `Allowlist`, `ALLOWLIST`,
+ * `allowlisted`, `allowlistEntry`) with the case-preserving form of
  * the new stem. Returns undefined when there's no autofix-able
  * substitution (master/slave).
  */
-function rewriteHit(match) {
+export function rewriteHit(match) {
   const lower = match.toLowerCase()
   for (const [legacy, replacement] of SUBSTITUTIONS) {
     if (!lower.startsWith(legacy)) {
@@ -93,7 +93,7 @@ function rewriteHit(match) {
   return undefined
 }
 
-function findHits(text) {
+export function findHits(text) {
   const hits = []
   DETECTOR_RE.lastIndex = 0
   let m
@@ -115,7 +115,7 @@ const rule = {
     type: 'suggestion',
     docs: {
       description:
-        'Use inclusive language. Replace whitelist/blacklist/master/slave/grandfathered/sanity/dummy per the fleet substitution table.',
+        'Use inclusive language. Replace allowlist/denylist/master/slave/legacy/quick/placeholder per the fleet substitution table.',
       category: 'Stylistic Issues',
       recommended: true,
     },

.config/oxlint-plugin/rules/no-npx-dlx.mts

@@ -30,10 +30,10 @@ const PATTERNS = [
   // Order matters — longest-prefix first so `pnpm dlx` is matched
   // before `pnpm` and `pnx ` is matched before `pnpm`. Each entry
   // is [match-prefix, replacement-prefix, label].
-  ['pnpm dlx ', 'pnpm exec ', 'pnpm dlx'],
-  ['yarn dlx ', 'pnpm exec ', 'yarn dlx'],
-  ['npx ', 'pnpm exec ', 'npx'],
-  ['pnx ', 'pnpm exec ', 'pnx'],
+  ['pnpm exec ', 'pnpm exec ', 'pnpm dlx'],
+  ['pnpm exec ', 'pnpm exec ', 'yarn dlx'],
+  ['pnpm exec ', 'pnpm exec ', 'npx'],
+  ['pnpm exec ', 'pnpm exec ', 'pnx'],
 ]
 
 const COMMENT_BYPASS_RE = /socket-hook:\s*allow\s+npx/
@@ -135,7 +135,7 @@ const rule = {
           if (next === value) {
             // Defensive — if our replace-all became a no-op, don't
             // ship an empty fix.
-            return null
+            return undefined
           }
           // Preserve the original quote style.
           const raw = sourceCode.getText(node)

.config/oxlint-plugin/rules/no-placeholders.mts

@@ -33,7 +33,7 @@
  *     stub detector requires a marker comment in the body.
  */
 
-const COMMENT_MARKER_RE = /\b(TODO|FIXME|XXX|HACK|TBD|STUB|WIP|UNIMPLEMENTED)\b/
+const COMMENT_MARKER_RE = /\b(FIXME|HACK|STUB|TBD|TODO|UNIMPLEMENTED|WIP|XXX)\b/
 
 const STUB_BODY_MARKER_RE =
   /\b(TODO|FIXME|XXX|HACK|TBD|STUB|WIP|UNIMPLEMENTED|not\s+implemented|unimplemented|placeholder|stub)\b/i
@@ -223,7 +223,7 @@ const rule = {
           !arg ||
           arg.type !== 'NewExpression' ||
           arg.callee.type !== 'Identifier' ||
-          !/^(Error|TypeError|RangeError)$/.test(arg.callee.name)
+          !/^(Error|RangeError|TypeError)$/.test(arg.callee.name)
         ) {
           return
         }

.config/oxlint-plugin/rules/no-promise-race-in-loop.mts

@@ -20,17 +20,11 @@
  * Reporting only.
  */
 
-const RACE_METHODS = new Set(['race', 'any'])
+const RACE_METHODS = new Set(['any', 'race'])
 
-const LOOP_TYPES = new Set([
-  'ForStatement',
-  'ForOfStatement',
-  'ForInStatement',
-  'WhileStatement',
-  'DoWhileStatement',
-])
+const LOOP_TYPES = new Set(['DoWhileStatement', 'ForInStatement', 'ForOfStatement', 'ForStatement', 'WhileStatement'])
 
-function isInsideLoop(node) {
+export function isInsideLoop(node) {
   let current = node.parent
   while (current) {
     if (LOOP_TYPES.has(current.type)) {
@@ -39,9 +33,9 @@ function isInsideLoop(node) {
     // Function boundaries break the chain — a function defined inside
     // a loop and invoked elsewhere isn't "in" the loop.
     if (
+      current.type === 'ArrowFunctionExpression' ||
       current.type === 'FunctionDeclaration' ||
-      current.type === 'FunctionExpression' ||
-      current.type === 'ArrowFunctionExpression'
+      current.type === 'FunctionExpression'
     ) {
       return false
     }

.config/oxlint-plugin/rules/no-status-emoji.mts

@@ -118,7 +118,7 @@ const rule = {
         objectName === 'console' &&
         ['log', 'error', 'warn', 'info'].includes(propName)
       const isLoggerLog =
-        objectName === 'logger' && (propName === 'log' || propName === 'info')
+        objectName === 'logger' && (propName === 'info' || propName === 'log')
 
       if (!isConsole && !isLoggerLog) {
         return undefined

.config/oxlint-plugin/rules/no-todo-comments.mts

@@ -18,7 +18,7 @@
  *     scoping the rule to comment AST nodes only.
  */
 
-const MARKER_RE = /\b(TODO|FIXME|XXX|HACK)\b/
+const MARKER_RE = /\b(FIXME|HACK|TODO|XXX)\b/
 
 /** @type {import('eslint').Rule.RuleModule} */
 const rule = {

.config/oxlint-plugin/rules/personal-path-placeholders.mts

@@ -20,10 +20,10 @@
  *
  * Autofix: replaces the non-canonical placeholder with the canonical
  * one for the platform path prefix:
- *   /Users/<X>/      → /Users/<user>/
- *   /home/<X>/       → /home/<user>/
- *   C:\Users\<X>\    → C:\Users\<USERNAME>\
- *   C:/Users/<X>/    → C:/Users/<USERNAME>/
+ *   /Users/<user>/      → /Users/<user>/
+ *   /home/<user>/       → /home/<user>/
+ *   C:\Users\<USERNAME>\    → C:\Users\<USERNAME>\
+ *   C:/Users/<USERNAME>/    → C:/Users/<USERNAME>/
  *
  * Real personal data (a literal username instead of a placeholder)
  * is also flagged. Two scenarios:
@@ -48,19 +48,19 @@ const PLACEHOLDER_RE = /<([^>]+)>/
 
 const PATTERNS = [
   {
-    // /Users/<X>/...
+    // /Users/<user>/...
     re: /(\/Users\/)<([^>]+)>(\/|$)/,
     canonical: 'user',
     label: '/Users/<user>/',
   },
   {
-    // /home/<X>/...
+    // /home/<user>/...
     re: /(\/home\/)<([^>]+)>(\/|$)/,
     canonical: 'user',
     label: '/home/<user>/',
   },
   {
-    // C:\Users\<X>\... or C:/Users/<X>/
+    // C:\Users\<USERNAME>\... or C:/Users/<USERNAME>/
     re: /([A-Za-z]:[\\/]Users[\\/])<([^>]+)>([\\/]|$)/,
     canonical: 'USERNAME',
     label: 'C:\\Users\\<USERNAME>\\',
@@ -168,11 +168,11 @@ const rule = {
         // Skip if the slug is a known placeholder shape (already
         // handled above), env-var, or canonical literal "user".
         const slug = m[2]
-        if (slug === 'user' || slug === 'USERNAME') {
+        if (slug === 'USERNAME' || slug === 'user') {
           continue
         }
         // Skip platform-canonical literals like "Shared".
-        if (slug === 'Shared' || slug === 'Public') {
+        if (slug === 'Public' || slug === 'Shared') {
           continue
         }
         const label =

.config/oxlint-plugin/rules/prefer-async-spawn.mts

@@ -42,14 +42,11 @@
  *     core APIs. Handled at the .oxlintrc.json ignorePatterns level.
  */
 
-const CHILD_PROCESS_SPECIFIERS = new Set([
-  'node:child_process',
-  'child_process',
-])
+const CHILD_PROCESS_SPECIFIERS = new Set(['child_process', 'node:child_process'])
 
 const LIB_SPECIFIER = '@socketsecurity/lib/spawn'
 
-const BANNED_NAMES = new Set(['spawnSync', 'spawn'])
+const BANNED_NAMES = new Set(['spawn', 'spawnSync'])
 
 const BYPASS_RE = /prefer-async-spawn:\s*sync-required/
 
@@ -98,9 +95,9 @@ const rule = {
       let cur = node.parent
       while (cur) {
         if (
+          cur.type === 'ArrowFunctionExpression' ||
           cur.type === 'FunctionDeclaration' ||
-          cur.type === 'FunctionExpression' ||
-          cur.type === 'ArrowFunctionExpression'
+          cur.type === 'FunctionExpression'
         ) {
           return Boolean(cur.async)
         }
@@ -131,7 +128,7 @@ const rule = {
           BANNED_NAMES.has(s.imported.name),
       )
       if (banned.length === 0) {
-        return null
+        return undefined
       }
       const others = node.specifiers.filter(
         s =>
@@ -142,7 +139,7 @@ const rule = {
       if (others.length > 0) {
         // Mixed line — leave it alone; a partial rewrite could lose
         // the non-banned import.
-        return null
+        return undefined
       }
       // The lib re-exports `spawn` (and the user can wire `as
       // spawnSync` themselves if they really need a name). For the
@@ -214,7 +211,7 @@ const rule = {
         if (!objName) {
           return
         }
-        if (!/^(child_process|childProcess|cp)$/.test(objName)) {
+        if (!/^(childProcess|child_process|cp)$/.test(objName)) {
           return
         }
         if (hasBypassComment(node)) {