fix(lint): resolve socket-rule violations surfaced by fleet onboarding

The cascade activated 7 new socket/* oxlint rules; this clears all 103
resulting violations (lint + build green, 2424 tests pass). Bulk fixed by the
fleet ai-lint-fix step (markers gain a -- reason, prefer-normalize-path swaps,
prefer-non-capturing-group, no-namespace-import, no-source-sniffing); the AI
changes were reviewed. Manual follow-ups: revert + justified-disable the
legitimate namespace imports the AI mis-converted (sorts/types.ts type-only
namespace, stdio/prompts.ts untyped @InQuirer wrappers, globs/_internal.ts
dynamic-require typeof); and `{__proto__:null} as Record` -> `as unknown as`
in ai/{billing-context,route-heuristic} for the typescript 7.0.1-rc bump.

Author: jdalton

scripts/build-externals/stubs/throw.cjs

@@ -5,7 +5,7 @@
 'use strict'
 
 // `export` is invalid in CJS — this file is inlined as text by esbuild.
-// oxlint-disable-next-line socket/export-top-level-functions
+// oxlint-disable-next-line socket/export-top-level-functions -- CJS stub inlined as text; export syntax invalid
 function throwStub(moduleName) {
   throw new Error(
     `Module '${moduleName}' is stubbed and should not be called. ` +

scripts/post-build/rewrite-external-imports.mts

@@ -9,6 +9,7 @@ import process from 'node:process'
 
 import { isQuiet } from '@socketsecurity/lib-stable/argv/flag-predicates'
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger/default'
+import { normalizePath } from '@socketsecurity/lib-stable/paths/normalize'
 
 import { externalPackages, scopedPackages } from '../build-externals/config.mts'
 import { REPO_ROOT } from '../fleet/paths.mts'
@@ -111,7 +112,7 @@ export function getExternalPathPrefix(filePath) {
   const dir = path.dirname(filePath)
   const relativePath = path.relative(dir, distExternalDir)
   // Normalize to forward slashes and ensure it starts with ./ or ../
-  const normalized = relativePath.replace(/\\/g, '/')
+  const normalized = normalizePath(relativePath)
   return normalized.startsWith('.') ? normalized : `./${normalized}`
 }
 

scripts/repo/audit-api-usage.mts

@@ -289,6 +289,7 @@ function main(): number {
     for (let j = 0, flen = files.length; j < flen; j += 1) {
       const file = files[j]!
       const source = readFileSync(file, 'utf8')
+      // oxlint-disable-next-line socket/no-source-sniffing -- fast-path pre-filter only; not inferring behavior — it skips files that cannot contain a lib specifier before the real AST walk in collectRefs
       if (!source.includes(PKG)) {
         continue
       }

scripts/validate/esm-named-exports.mts

@@ -59,10 +59,13 @@ export function checkEsmNamedExports(filePath) {
 
     // Check for problematic patterns
     const hasDefaultExport =
+      // oxlint-disable-next-line socket/no-source-sniffing -- dist files are compiled CJS; text-matching detects single-value exports invisible at require() time
       /module\.exports\s*=\s*\w+\s*;?\s*$/.test(source) ||
+      // oxlint-disable-next-line socket/no-source-sniffing -- dist files are compiled CJS; text-matching detects module.exports.default= which require() cannot distinguish from named exports
       /module\.exports\.default\s*=/.test(source)
 
     // Check for proper named exports pattern
+    // oxlint-disable-next-line socket/no-source-sniffing -- dist files are compiled CJS; text-matching distinguishes object-form exports from single-value form, complementing the require() shape check
     const hasNamedExportsObject = /module\.exports\s*=\s*{/.test(source)
 
     // Also check by actually requiring the module

scripts/validate/no-extraneous-dependencies.mts

@@ -23,7 +23,7 @@ import process from 'node:process'
 
 import { parse } from '@babel/parser'
 import traverseModule from '@babel/traverse'
-import * as t from '@babel/types'
+import { isIdentifier, isStringLiteral } from '@babel/types'
 
 // Handle @babel/traverse CommonJS/ESM interop
 const traverse = traverseModule.default
@@ -89,9 +89,9 @@ export async function extractRequireSpecifiers(filePath) {
 
       // Check if this is a require() call
       if (
-        t.isIdentifier(node.callee, { name: 'require' }) &&
+        isIdentifier(node.callee, { name: 'require' }) &&
         node.arguments.length > 0 &&
-        t.isStringLiteral(node.arguments[0])
+        isStringLiteral(node.arguments[0])
       ) {
         const specifier = node.arguments[0].value
         const { column, line } = node.loc.start

src/ai/agent-context.mts

@@ -29,6 +29,7 @@ import { WIN32 } from '../constants/platform'
 import { getHome } from '../env/home'
 import { getEnvValue } from '../env/rewire'
 import { getXdgConfigHome } from '../env/xdg'
+import { normalizePath } from '../paths/normalize'
 
 import path from 'node:path'
 
@@ -119,7 +120,12 @@ export function agentPaths(
       // replaced by `-` (a leading `/` becomes a leading `-`).
       const cwd = opts.cwd
       const memoryDir = cwd
-        ? path.join(configDir, 'projects', cwd.replace(/[/\\]/g, '-'), 'memory')
+        ? path.join(
+            configDir,
+            'projects',
+            normalizePath(cwd).replace(/\//g, '-'),
+            'memory',
+          )
         : undefined
       return { agent, configDir, memoryDir }
     }

src/ai/billing-context.mts

@@ -77,7 +77,10 @@ export function billingFromKeyed(
   options: BillingFromKeyedOptions,
 ): BillingContext {
   const opts = { __proto__: null, ...options } as BillingFromKeyedOptions
-  const out = { __proto__: null } as Record<CredentialProvider, BillingAccount>
+  const out = { __proto__: null } as unknown as Record<
+    CredentialProvider,
+    BillingAccount
+  >
   for (const provider of opts.keyed) {
     const kind = opts.kinds?.[provider] ?? DEFAULT_PROVIDER_KIND[provider]
     if (!kind) {

src/ai/route-heuristic.mts

@@ -203,7 +203,7 @@ export function allocateBudget(
     totalWeight += weights[TASK_CLASSES[i]!] ?? 0
   }
   const divisor = totalWeight > 0 ? totalWeight : 1
-  const out = { __proto__: null } as Record<TaskClass, number>
+  const out = { __proto__: null } as unknown as Record<TaskClass, number>
   for (let i = 0, { length } = TASK_CLASSES; i < length; i += 1) {
     const taskClass = TASK_CLASSES[i]!
     out[taskClass] = (perMember * (weights[taskClass] ?? 0)) / divisor

src/bin/resolve.ts

@@ -364,7 +364,7 @@ export function resolveRealBinSync(binPath: string): string {
         // to a directory. The lint rule recommends existsSync, but
         // that loses the file-vs-directory signal.
         try {
-          // oxlint-disable-next-line socket/prefer-exists-sync
+          // oxlint-disable-next-line socket/prefer-exists-sync -- statSync needed to discriminate files from directories
           const stats = fs.statSync(baseBinPath)
           // Only use this path if it's a file (the shell script).
           if (stats.isFile()) {

src/bin/shadow.ts

@@ -5,6 +5,8 @@
  *   the real interpreter.
  */
 
+import { normalizePath } from '@socketsecurity/lib/paths/normalize'
+
 /**
  * Check if a directory path contains any shadow bin patterns.
  *
@@ -19,6 +21,6 @@ export function isShadowBinPath(dirPath: string | undefined): boolean {
     return false
   }
   // Check for node_modules/.bin pattern (Unix and Windows)
-  const normalized = dirPath.replace(/\\/g, '/')
+  const normalized = normalizePath(dirPath)
   return normalized.includes('node_modules/.bin')
 }