fix(lint): revive socket oxlint plugin in lib — ignore stale tree + comment regexes

The one-dir-per-rule plugin migration (cascading in) left a pre-migration flat
tree at .config/fleet/oxlint-plugin/ alongside the new .config/oxlint-plugin/.
The stale tree's rule sources + test fixtures contain the bad patterns each
rule detects by design, self-flagging (212 false positives); ignore it via the
repo overlay until the upstream migration removes it.

With the plugin loading again (regjsparser now installed via the workspace
fix), socket/require-regex-comment surfaced 15 genuinely-uncommented complex
regexes across src/ + scripts/ + .config/ — add a part-by-part breakdown
comment to each (checksum-file, paths/_internal, python/pin, checks/primordials,
eco/npm/flags, rolldown.config, strings/transform, cover/type, repo/cover).

Lint --all: 0 warnings / 0 errors.

Author: jdalton

.config/rolldown.config.mts

@@ -46,6 +46,7 @@ for (let i = 0, { length } = entryFiles; i < length; i += 1) {
   const abs = entryFiles[i]!
   const rel = path
     .relative(srcPath, abs)
+    // Strip a trailing TypeScript extension — `.ts`, `.cts`, or `.mts`.
     .replace(/\.(?:c|m)?ts$/, '')
     .split(path.sep)
     .join('/')
@@ -65,6 +66,8 @@ export const buildConfig: RolldownOptions = {
   // this is exactly what esbuild's bundle:false avoided by treating every
   // import as external).
   external: (id: string) =>
+    // Treat any path with an `external/` segment as external: bounded by a
+    // separator (either platform) or string start before, and a separator after.
     /(?:[/\\]|^)external[/\\]/.test(id) ||
     (!id.startsWith('.') && !path.isAbsolute(id)),
   input,

scripts/repo/cover.mts

@@ -127,6 +127,9 @@ export function displayCodeCoverage(
       logger.log('')
     }
 
+    // Grab vitest's v8 coverage table header: the `% Coverage report from v8`
+    // banner, then a separator row (group 1 = the `-|` rule), the header row
+    // (group 2), and the same separator again via backreference `\1`.
     const coverageHeaderMatch = mainOutput.match(
       / % Coverage report from v8\n([-|]+)\n([^\n]+)\n\1/,
     )
@@ -198,6 +201,9 @@ export async function updateReadmeBadge(percent: number): Promise<boolean> {
     logger.warn(`Failed to read ${readmePath}: ${errorMessage(e)}`)
     return false
   }
+  // Match the README shields.io coverage badge so the percentage can be
+  // swapped: group 1 = the markdown + URL prefix up to `coverage-`, group 2 =
+  // the current percentage, group 3 = the `%25-<color>)` suffix.
   const badgeRegex =
     /(!\[Coverage\]\(https:\/\/img\.shields\.io\/badge\/coverage-)([\d.]+)(%25-[a-z]+\))/
   if (!badgeRegex.test(content)) {

src/checks/primordials.ts

@@ -264,11 +264,14 @@ export function extractPrimordialsNames(src: string): string[] {
  */
 export function extractTsExports(src: string): string[] {
   const out = new Set<string>()
+  // `export [declare] const <name>` at line start (multiline): group 1 is the
+  // identifier (JS ident chars, can't start with a digit). `declare` optional.
   for (const m of src.matchAll(
     /^export\s+(?:declare\s+)?const\s+([A-Za-z_$][A-Za-z0-9_$]*)/gm,
   )) {
     out.add(m[1]!)
   }
+  // Same as above for `export [declare] function <name>`: group 1 is the name.
   for (const m of src.matchAll(
     /^export\s+(?:declare\s+)?function\s+([A-Za-z_$][A-Za-z0-9_$]*)/gm,
   )) {

src/cover/type.ts

@@ -40,8 +40,9 @@ export async function getTypeCoverage(
       stdio: ['ignore', 'pipe', 'pipe'],
     })
 
-    // Parse output: "1234 / 5678 48.92%"
     const outputText = result.stdout ? result.stdout.toString() : ''
+    // Parse type-coverage's summary line `1234 / 5678 48.92%`: group 1 =
+    // covered count, group 2 = total count, group 3 = the percentage.
     const match = /(\d+) \/ (\d+) ([\d.]+)%/.exec(outputText)
 
     if (!match || !match[1] || !match[2] || !match[3]) {

src/eco/npm/npm/flags.ts

@@ -16,6 +16,7 @@
  *   ```
  */
 export function isNpmAuditFlag(cmdArg: string): boolean {
+  // Matches `--audit`, `--no-audit`, and either with an `=<value>` suffix.
   return /^--(?:no-)?audit(?:=.*)?$/.test(cmdArg)
 }
 
@@ -30,6 +31,7 @@ export function isNpmAuditFlag(cmdArg: string): boolean {
  *   ```
  */
 export function isNpmFundFlag(cmdArg: string): boolean {
+  // Matches `--fund`, `--no-fund`, and either with an `=<value>` suffix.
   return /^--(?:no-)?fund(?:=.*)?$/.test(cmdArg)
 }
 
@@ -81,5 +83,6 @@ export function isNpmNodeOptionsFlag(cmdArg: string): boolean {
  *   ```
  */
 export function isNpmProgressFlag(cmdArg: string): boolean {
+  // Matches `--progress`, `--no-progress`, and either with an `=<value>` suffix.
   return /^--(?:no-)?progress(?:=.*)?$/.test(cmdArg)
 }

src/external-tools/python/pin.ts

@@ -266,6 +266,9 @@ export function specDistName(spec: string): string {
   if (eggIdx !== -1) {
     return spec.slice(eggIdx + '#egg='.length)
   }
+  // Pull the package name off the front of a pip requirement spec: group 1 is
+  // the name (letters/digits/`._-`), stopping at the first version/URL operator
+  // — `@` (PEP 508 URL/extra) or a comparator (`==`, `>=`, `<`, `!=`, `~=`).
   const match = /^([A-Za-z0-9._-]+)\s*(?:@|[=<>!~]=?)/.exec(spec)
   return match ? match[1]! : spec
 }

src/http-request/checksum-file.ts

@@ -22,7 +22,11 @@ import { httpRequest } from './request'
 
 import type { ChecksumFile, FetchChecksumFileOptions } from './download-types'
 
+// BSD `shasum -a 256` line: `SHA256 (<filename>) = <64-hex digest>`.
+// Group 1 = filename (anything inside the parens), group 2 = the 64-char hex.
 const CHECKSUM_BSD_RE = /^SHA256\s+\((.+)\)\s+=\s+([a-fA-F0-9]{64})$/
+// GNU `sha256sum` line: `<64-hex digest>  <filename>`.
+// Group 1 = the 64-char hex digest, group 2 = the filename (rest of line).
 const CHECKSUM_GNU_RE = /^([a-fA-F0-9]{64})\s+(.+)$/
 
 /**

src/paths/_internal.ts

@@ -42,6 +42,9 @@ export const CHAR_UPPERCASE_Z = 90
 // `.toUpperCase()` would throw on Windows MSYS-style paths like `/c/foo`.
 // oxlint-disable-next-line socket/prefer-non-capturing-group -- both groups are read by the replace callback in paths/normalize.ts:msysDriveToNative
 export const msysDriveRegExp = /^\/([a-zA-Z])($|\/)/
+// Matches a `node_modules` path segment: bounded by a slash (either separator)
+// or string start before, and a slash or string end after — so it hits
+// `node_modules` as a whole segment, not a substring like `my_node_modules`.
 export const nodeModulesPathRegExp = /(?:[/\\]|^)node_modules(?:$|[/\\])/
 export const slashRegExp = /[/\\]/
 

src/strings/transform.ts

@@ -70,6 +70,9 @@ export function toKebabCase(str: string): string {
     return str
   }
   return (
+    // camelCase→kebab boundary: group 1 = a lowercase run (optional trailing
+    // digits), group 2 = the following uppercase letter; insert `-` between
+    // them (`fooBar` → `foo-Bar`, later lowercased).
     StringPrototypeReplace(str, /([a-z]+[0-9]*)([A-Z])/g, '$1-$2')
       // Convert underscores to hyphens
       .replace(/_/g, '-')