refactor: drop leading underscores from module-private identifiers

Per the fleet's socket/no-underscore-identifier rule, 12 module-private
identifiers in scripts/ and test/ had leading underscores stripped:

- scripts/constants/{node,utils}.mts: platform, gitExecPath, tsxExecPath,
  defaultWhichOptions, licenseContent, gitIgnorePatterns, ignoreGlobs
- scripts/util/{tests,packages,templates}.mts: cliArgs,
  cachedTestNpmPackageJson, templates
- test/npm/{has-symbols,json-stable-stringify}.test.mts: key,
  jsonStableStringifyModule

One rule-interaction tweak: test/npm/has-symbols.test.mts renamed
`_key` to `key`. The loop body uses the binding only as a sentinel
(if a `for...in` enumerates ANY key, the test fails). After the
rename, eslint/no-unused-vars + TS6133 would flag it; the
`expect.fail()` message now interpolates `String(key)`, preserving
test intent while marking the binding as used.

Also: allowlist acorn.wasm in the local
scripts/validation/file-size.mts (mirrors the wheelhouse-canonical
fix; socket-registry has its own validator path).

Verified: pnpm run check --all passes; pnpm test = 2184 tests, all green.

Author: jdalton

pnpm-lock.yaml

@@ -4,9 +4,9 @@
 
 import os from 'node:os'
 
-const _platform = os.platform()
-export const DARWIN = _platform === 'darwin'
-export const WIN32 = _platform === 'win32'
+const platform = os.platform()
+export const DARWIN = platform === 'darwin'
+export const WIN32 = platform === 'win32'
 
 export const NEWLINE = os.EOL
 

scripts/constants/node.mts

@@ -20,78 +20,78 @@ import {
 /**
  * Get cached default which command options with augmented PATH.
  */
-let _defaultWhichOptions: { path: string } | undefined
+let defaultWhichOptions: { path: string } | undefined
 export function getDefaultWhichOptions(): { path: string } {
-  if (_defaultWhichOptions === undefined) {
-    _defaultWhichOptions = {
+  if (defaultWhichOptions === undefined) {
+    defaultWhichOptions = {
       __proto__: null,
       path: `${ROOT_NODE_MODULES_BIN_PATH}${path.delimiter}${process.env['PATH']}`,
     } as { path: string }
   }
-  return _defaultWhichOptions!
+  return defaultWhichOptions!
 }
 
 /**
  * Get root LICENSE file content.
  */
-let _licenseContent: string | undefined
+let licenseContent: string | undefined
 export function getLicenseContent(): string {
-  if (_licenseContent === undefined) {
-    _licenseContent = readFileSync(ROOT_LICENSE_PATH, 'utf8')
+  if (licenseContent === undefined) {
+    licenseContent = readFileSync(ROOT_LICENSE_PATH, 'utf8')
   }
-  return _licenseContent!
+  return licenseContent!
 }
 
 /**
  * Get git executable path.
  */
-let _gitExecPath: string | undefined
+let gitExecPath: string | undefined
 export function getGitExecPath(): string {
-  if (_gitExecPath === undefined) {
-    _gitExecPath = which.sync('git', getDefaultWhichOptions())
+  if (gitExecPath === undefined) {
+    gitExecPath = which.sync('git', getDefaultWhichOptions())
   }
-  return _gitExecPath!
+  return gitExecPath!
 }
 
 /**
  * Get tsx executable path.
  */
-let _tsxExecPath: string | undefined
+let tsxExecPath: string | undefined
 export function getTsxExecPath(): string {
-  if (_tsxExecPath === undefined) {
+  if (tsxExecPath === undefined) {
     const tsxPath = path.join(ROOT_NODE_MODULES_BIN_PATH, 'tsx')
     if (existsSync(tsxPath)) {
-      _tsxExecPath = tsxPath
+      tsxExecPath = tsxPath
     } else {
-      _tsxExecPath = which.sync('tsx', getDefaultWhichOptions())
+      tsxExecPath = which.sync('tsx', getDefaultWhichOptions())
     }
   }
-  return _tsxExecPath!
+  return tsxExecPath!
 }
 
 /**
  * Parse gitignore file and return ignore patterns.
  */
-let _gitIgnorePatterns: string[] | undefined
+let gitIgnorePatterns: string[] | undefined
 export function getGitIgnorePatterns(): string[] {
-  if (_gitIgnorePatterns === undefined) {
+  if (gitIgnorePatterns === undefined) {
     const gitignorePath = path.join(ROOT_PATH, '.gitignore')
     const content = readFileSync(gitignorePath, 'utf8')
-    _gitIgnorePatterns = content
+    gitIgnorePatterns = content
       .split('\n')
       .map(line => line.trim())
       .filter(line => line && !line.startsWith('#'))
   }
-  return _gitIgnorePatterns!
+  return gitIgnorePatterns!
 }
 
 /**
  * Get merged ignore globs from gitignore and standard exclusions.
  */
-let _ignoreGlobs: readonly string[] | undefined
+let ignoreGlobs: readonly string[] | undefined
 export function getIgnoreGlobs(): readonly string[] {
-  if (_ignoreGlobs === undefined) {
-    _ignoreGlobs = Object.freeze([
+  if (ignoreGlobs === undefined) {
+    ignoreGlobs = Object.freeze([
       // oxlint-disable-next-line socket/sort-set-args -- spread + template strings, non-sortable
       ...new Set([
         // Most of these ignored files can be included specifically if included in the
@@ -108,7 +108,7 @@ export function getIgnoreGlobs(): readonly string[] {
       ]),
     ])
   }
-  return _ignoreGlobs!
+  return ignoreGlobs!
 }
 
 /**

scripts/constants/utils.mts

@@ -10,22 +10,22 @@ import { hasOwn } from '@socketsecurity/lib-stable/objects'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
-let _cachedTestNpmPackageJson
+let cachedTestNpmPackageJson
 
 /**
  * Get cached test npm package.json.
  */
 export function getTestNpmPackageJson() {
-  if (_cachedTestNpmPackageJson === undefined) {
+  if (cachedTestNpmPackageJson === undefined) {
     const testNpmPackageJsonPath = path.resolve(
       __dirname,
       '../../test/npm/package.json',
     )
-    _cachedTestNpmPackageJson = JSON.parse(
+    cachedTestNpmPackageJson = JSON.parse(
       readFileSync(testNpmPackageJsonPath, 'utf8'),
     )
   }
-  return _cachedTestNpmPackageJson
+  return cachedTestNpmPackageJson
 }
 
 /**

scripts/util/packages.mts

@@ -74,10 +74,10 @@ export async function getEta() {
   return eta
 }
 
-let _templates
+let templates
 export function getTemplates() {
-  if (_templates === undefined) {
-    _templates = Object.freeze({
+  if (templates === undefined) {
+    templates = Object.freeze({
       __proto__: null,
       ...Object.fromEntries(
         [
@@ -91,7 +91,7 @@ export function getTemplates() {
       ),
     })
   }
-  return _templates
+  return templates
 }
 
 /**

scripts/util/templates.mts

@@ -7,13 +7,13 @@ import process from 'node:process'
 
 import { parseArgs } from '@socketsecurity/lib-stable/argv/parse'
 
-let _cliArgs: Record<string, unknown> | undefined
+let cliArgs: Record<string, unknown> | undefined
 
 /**
  * Parse and cache command line arguments.
  */
 function getCliArgs() {
-  if (_cliArgs === undefined) {
+  if (cliArgs === undefined) {
     const { values } = parseArgs({
       options: {
         force: {
@@ -26,9 +26,9 @@ function getCliArgs() {
       },
       strict: false,
     })
-    _cliArgs = values
+    cliArgs = values
   }
-  return _cliArgs
+  return cliArgs
 }
 
 /**

scripts/util/tests.mts

@@ -23,6 +23,15 @@ const rootPath = path.join(__dirname, '..', '..')
 // Maximum file size: 2MB (2,097,152 bytes)
 const MAX_FILE_SIZE = 2 * 1024 * 1024
 
+// Allowlisted large files: fleet-canonical assets whose size is bounded by
+// the upstream they ship, not by repo authoring. acorn.wasm is the AST
+// parser shared by AST-based oxlint plugin rules + hooks; ~3MB is the
+// upstream build artifact.
+const ALLOWED_LARGE_FILES = new Set<string>([
+  '.claude/hooks/_shared/acorn/acorn.wasm',
+  'vendor/acorn-wasm/acorn.wasm',
+])
+
 // Directories to skip
 const SKIP_DIRS = new Set([
   '.cache',
@@ -81,6 +90,9 @@ export async function scanDirectory(dir, violations = []) {
           const stats = await fs.stat(fullPath)
           if (stats.size > MAX_FILE_SIZE) {
             const relativePath = path.relative(rootPath, fullPath)
+            if (ALLOWED_LARGE_FILES.has(relativePath)) {
+              continue
+            }
             violations.push({
               file: relativePath,
               size: stats.size,

scripts/validation/file-size.mts

@@ -46,8 +46,10 @@ describe(`${eco} > ${sockRegPkgName}`, { skip }, () => {
       const sym = Symbol('test')
       obj[sym] = 42
 
-      for (const _key in obj) {
-        expect.fail('symbol property key was found in for..in of object')
+      for (const key in obj) {
+        expect.fail(
+          `symbol property key ${String(key)} was found in for..in of object`,
+        )
       }
 
       expect(Object.keys(obj)).toEqual([])

test/npm/has-symbols.test.mts

@@ -18,7 +18,7 @@ describe(
   },
   () => {
     const pkgRequireIndexJsPath = `${pkgPath}/index.js`
-    const _jsonStableStringifyModule =
+    const jsonStableStringifyModule =
       skip || ENV.CI ? undefined : require(pkgRequireIndexJsPath)
 
     const rawJSON: ((_str: string) => { rawJSON: string }) | undefined = (
@@ -33,7 +33,7 @@ describe(
     ]) {
       it(`${methodName}: space parameter (nested objects)`, () => {
         const obj = { one: 1, two: { b: 4, a: [2, 3] } }
-        expect(_jsonStableStringifyModule(obj, { space: '  ' })).toBe(
+        expect(jsonStableStringifyModule(obj, { space: '  ' })).toBe(
           '' +
             '{\n' +
             '  "one": 1,\n' +
@@ -51,36 +51,36 @@ describe(
       it(`${methodName}: space parameter (same as native)`, () => {
         // For this test, properties need to be in alphabetical order.
         const obj = { one: 1, two: { a: [2, 3], b: 4 } }
-        expect(_jsonStableStringifyModule(obj, { space: '  ' })).toBe(
+        expect(jsonStableStringifyModule(obj, { space: '  ' })).toBe(
           JSON.stringify(obj, null, '  '),
         )
       })
 
       it(`${methodName}: space parameter base empty behavior: empty arrays and objects have added newline and space`, () => {
         const obj = { emptyArr: [], emptyObj: {} }
-        expect(_jsonStableStringifyModule(obj, { space: '  ' })).toBe(
+        expect(jsonStableStringifyModule(obj, { space: '  ' })).toBe(
           '{\n  "emptyArr": [\n  ],\n  "emptyObj": {\n  }\n}',
         )
       })
 
       it(`${methodName}: space parameter, with collapseEmpty: true`, () => {
         const obj = { emptyArr: [], emptyObj: {} }
         expect(() => {
-          _jsonStableStringifyModule(obj, { collapseEmpty: 'not a boolean' })
+          jsonStableStringifyModule(obj, { collapseEmpty: 'not a boolean' })
         }).toThrow(TypeError)
         expect(
-          _jsonStableStringifyModule(obj, { collapseEmpty: true, space: '  ' }),
+          jsonStableStringifyModule(obj, { collapseEmpty: true, space: '  ' }),
         ).toBe('{\n  "emptyArr": [],\n  "emptyObj": {}\n}')
       })
 
       it(
         `${methodName}: supports JSON.rawJSON`,
-        { skip: !SUPPORTS_JSON_RAW_JSON || !_jsonStableStringifyModule },
+        { skip: !SUPPORTS_JSON_RAW_JSON || !jsonStableStringifyModule },
         () => {
           // Test case from MDN example:
           // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/isRawJSON#examples
           expect(
-            _jsonStableStringifyModule({
+            jsonStableStringifyModule({
               name: 'Josh',
               userId: rawJSON?.('12345678901234567890'),
               friends: [
@@ -114,7 +114,7 @@ describe(
           return result
         }
         expect(() =>
-          _jsonStableStringifyModule(createCallStackBusterObject()),
+          jsonStableStringifyModule(createCallStackBusterObject()),
         ).not.toThrow()
       })
     }