chore: sync fleet-canonical scripts/fix.mts from socket-repo-template@c7eff9e

Refresh of the auto-fix script to the new fleet-canonical form.
Functional change vs. prior local copy: extra argv now flows
through to `pnpm run lint --fix`, so `pnpm run fix --all`,
`pnpm run fix --staged`, and explicit file paths all work
uniformly across the fleet.

Eliminates the prior split where socket-addon + socket-stuie used
an inline `oxfmt --write . && oxlint --fix` form that rejected
`--all`. Both adopted scripts/fix.mts in their own commits today;
this brings the rest of the fleet to byte-identical with the new
canonical version.

Synced byte-identical from socket-repo-template via sync-scaffolding.

Author: jdalton

scripts/fix.mts

@@ -3,39 +3,33 @@
  * tools (zizmor, agentshield) if available.
  *
  * Steps:
- *   1. pnpm run lint --fix — oxlint + oxfmt
- *   2. zizmor --fix .github/ — GitHub Actions workflow fixes (if .github/ exists)
- *   3. agentshield scan --fix — Claude config fixes (if .claude/ exists)
+ *   1. pnpm run lint --fix — oxlint + oxfmt (forwards extra argv like --all)
+ *   2. zizmor --fix .github/ — GitHub Actions workflow fixes
+ *      (skipped if .github/ doesn't exist)
+ *   3. agentshield scan --fix — Claude config fixes
+ *      (skipped if .claude/ or agentshield isn't installed)
+ *
+ * Forwards `process.argv.slice(2)` to the lint step, so
+ * `pnpm run fix --all` runs `pnpm run lint --fix --all` (full-tree
+ * fix), and `pnpm run fix --staged` does the staged-only flow.
  */
 
 import { existsSync } from 'node:fs'
 import process from 'node:process'
 
-import type { Logger } from '@socketsecurity/lib/logger'
 import { getDefaultLogger } from '@socketsecurity/lib/logger'
-import type { SpawnResult } from '@socketsecurity/lib/spawn'
 import { spawn } from '@socketsecurity/lib/spawn'
-import { errorMessage } from './utils/error-message.mts'
 
 const WIN32 = process.platform === 'win32'
-const logger: Logger = getDefaultLogger()
-
-type RunOptions = {
-  label?: string
-  required?: boolean
-}
-
-function getErrorMessage(error: unknown): string {
-  return errorMessage(error)
-}
+const logger = getDefaultLogger()
 
 async function run(
   cmd: string,
   args: string[],
-  { label, required = true }: RunOptions = {},
+  { label, required = true }: { label?: string; required?: boolean } = {},
 ): Promise<number> {
   try {
-    const result: Awaited<SpawnResult> = await spawn(cmd, args, {
+    const result = await spawn(cmd, args, {
       shell: WIN32,
       stdio: 'inherit',
     })
@@ -49,21 +43,24 @@ async function run(
     }
     return 0
   } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
     if (!required) {
-      logger.warn(`${label || cmd}: ${getErrorMessage(e)} (non-blocking)`)
+      logger.warn(`${label || cmd}: ${msg} (non-blocking)`)
       return 0
     }
     throw e
   }
 }
 
 async function main(): Promise<void> {
-  const extraArgs: string[] = process.argv.slice(2)
-
-  // Step 1: Lint fix — delegates to per-package lint scripts.
-  const lintExit = await run('pnpm', ['run', 'lint', '--fix', ...extraArgs], {
-    label: 'lint --fix',
-  })
+  // Step 1: Lint fix — delegates to scripts/lint.mts which runs both
+  // oxfmt and oxlint. Forward extra argv so `--all` / `--staged` /
+  // explicit file paths reach the lint runner unchanged.
+  const lintExit = await run(
+    'pnpm',
+    ['run', 'lint', '--fix', ...process.argv.slice(2)],
+    { label: 'lint --fix' },
+  )
   if (lintExit) {
     process.exitCode = lintExit
   }
@@ -87,7 +84,8 @@ async function main(): Promise<void> {
   }
 }
 
-main().catch((error: unknown) => {
-  logger.error(error)
+main().catch((e: unknown) => {
+  const msg = e instanceof Error ? e.message : String(e)
+  logger.error(msg)
   process.exitCode = 1
 })