fix(lint): re-cascade canonical oxlint plugin rules — undo self-corruption

The most recent `lint --fix` autofix pass ran the plugin rules against
their own source files and rewrote the match tables in place. The shape
of the corruption per rule:

* `no-npx-dlx.mts`: PATTERNS table flipped from `['npx ', 'pnpm exec ']`
  / `['pnpm dlx ', 'pnpm exec ']` to `['pnpm exec ', 'pnpm exec ']` —
  causing the rule to flag every `pnpm exec` reference (~117 false
  positives in socket-cli alone).
* `inclusive-language.mts`: SUBSTITUTIONS table flipped from
  `['whitelist', 'allowlist']` / `['grandfathered', 'legacy']` /
  `['dummy', 'placeholder']` to `['allowlist', 'allowlist']` /
  `['legacy', 'legacy']` / `['placeholder', 'placeholder']` — causing
  the rule to scan FOR its own replacements (~217 false positives).

Re-cascaded all 12 plugin rule files from `socket-wheelhouse/template/.
config/oxlint-plugin/rules/`. Real lint counts dropped sharply (cli's
inclusive-language: 252 → 35; no-npx-dlx: 117 → 10).

Underlying defect to fix in a follow-up: the plugin rule files should be
excluded from the autofix surface (they're self-referential by design).

Author: jdalton

.config/oxlint-plugin/rules/_inject-import.mts

@@ -12,35 +12,6 @@
  * insertion safely — only one survives.
  */
 
-/**
- * Build the fixer-side inserts for missing import + optional hoist.
- * Returns an array of fixer operations the caller appends to its own
- * fix() return value.
- *
- *   summary       — output of summarizeImportTarget()
- *   fixer         — the fixer passed to context.report({ fix })
- *   importLine    — the literal `import { ... } from '...'` text
- *   hoistLine     — optional; the literal `const x = ...()` text
- */
-export function appendImportFixes(summary, fixer, importLine, hoistLine) {
-  const ops = []
-  if (!summary.hasImport) {
-    if (summary.lastImport) {
-      ops.push(fixer.insertTextAfter(summary.lastImport, `\n${importLine}`))
-    } else {
-      ops.push(fixer.insertTextBeforeRange([0, 0], `${importLine}\n`))
-    }
-  }
-  if (hoistLine && !summary.hasLocal) {
-    if (summary.lastImport) {
-      ops.push(fixer.insertTextAfter(summary.lastImport, `\n\n${hoistLine}`))
-    } else {
-      ops.push(fixer.insertTextBeforeRange([0, 0], `${hoistLine}\n\n`))
-    }
-  }
-  return ops
-}
-
 /**
  * Walk a Program node body once and figure out:
  *   - the last top-level ImportDeclaration node (or undefined)
@@ -108,3 +79,32 @@ export function summarizeImportTarget(
   }
   return { hasImport, hasLocal, lastImport }
 }
+
+/**
+ * Build the fixer-side inserts for missing import + optional hoist.
+ * Returns an array of fixer operations the caller appends to its own
+ * fix() return value.
+ *
+ *   summary       — output of summarizeImportTarget()
+ *   fixer         — the fixer passed to context.report({ fix })
+ *   importLine    — the literal `import { ... } from '...'` text
+ *   hoistLine     — optional; the literal `const x = ...()` text
+ */
+export function appendImportFixes(summary, fixer, importLine, hoistLine) {
+  const ops = []
+  if (!summary.hasImport) {
+    if (summary.lastImport) {
+      ops.push(fixer.insertTextAfter(summary.lastImport, `\n${importLine}`))
+    } else {
+      ops.push(fixer.insertTextBeforeRange([0, 0], `${importLine}\n`))
+    }
+  }
+  if (hoistLine && !summary.hasLocal) {
+    if (summary.lastImport) {
+      ops.push(fixer.insertTextAfter(summary.lastImport, `\n\n${hoistLine}`))
+    } else {
+      ops.push(fixer.insertTextBeforeRange([0, 0], `${hoistLine}\n\n`))
+    }
+  }
+  return ops
+}

.config/oxlint-plugin/rules/export-top-level-functions.mts

@@ -33,7 +33,7 @@ const SCRIPT_ENTRY_NAMES = new Set(['main'])
  * declarations only via `Program > FunctionDeclaration`; an
  * `ExportNamedDeclaration` wraps them in a different shape).
  */
-export function collectExportedNames(program) {
+function collectExportedNames(program) {
   const exported = new Set()
   for (const stmt of program.body) {
     if (stmt.type === 'ExportNamedDeclaration' && !stmt.declaration) {

.config/oxlint-plugin/rules/inclusive-language.mts

@@ -56,7 +56,7 @@ const REPORT_ONLY_TERMS = ['master', 'slave']
 const BYPASS_RE = /inclusive-language:\s*external-api/
 
 /** Build a regex matching any legacy stem with word boundaries. */
-export function buildDetectorRegex() {
+function buildDetectorRegex() {
   const stems = [
     ...SUBSTITUTIONS.map(([legacy]) => legacy),
     ...REPORT_ONLY_TERMS,
@@ -72,7 +72,7 @@ const DETECTOR_RE = buildDetectorRegex()
  * the new stem. Returns undefined when there's no autofix-able
  * substitution (master/slave).
  */
-export function rewriteHit(match) {
+function rewriteHit(match) {
   const lower = match.toLowerCase()
   for (const [legacy, replacement] of SUBSTITUTIONS) {
     if (!lower.startsWith(legacy)) {
@@ -93,7 +93,7 @@ export function rewriteHit(match) {
   return undefined
 }
 
-export function findHits(text) {
+function findHits(text) {
   const hits = []
   DETECTOR_RE.lastIndex = 0
   let m

.config/oxlint-plugin/rules/no-npx-dlx.mts

@@ -135,7 +135,7 @@ const rule = {
           if (next === value) {
             // Defensive — if our replace-all became a no-op, don't
             // ship an empty fix.
-            return undefined
+            return null
           }
           // Preserve the original quote style.
           const raw = sourceCode.getText(node)

.config/oxlint-plugin/rules/no-promise-race-in-loop.mts

@@ -20,17 +20,17 @@
  * Reporting only.
  */
 
-const RACE_METHODS = new Set(['any', 'race'])
+const RACE_METHODS = new Set(['race', 'any'])
 
 const LOOP_TYPES = new Set([
-  'DoWhileStatement',
-  'ForInStatement',
-  'ForOfStatement',
   'ForStatement',
+  'ForOfStatement',
+  'ForInStatement',
   'WhileStatement',
+  'DoWhileStatement',
 ])
 
-export function isInsideLoop(node) {
+function isInsideLoop(node) {
   let current = node.parent
   while (current) {
     if (LOOP_TYPES.has(current.type)) {

.config/oxlint-plugin/rules/prefer-async-spawn.mts

@@ -43,13 +43,13 @@
  */
 
 const CHILD_PROCESS_SPECIFIERS = new Set([
-  'child_process',
   'node:child_process',
+  'child_process',
 ])
 
 const LIB_SPECIFIER = '@socketsecurity/lib/spawn'
 
-const BANNED_NAMES = new Set(['spawn', 'spawnSync'])
+const BANNED_NAMES = new Set(['spawnSync', 'spawn'])
 
 const BYPASS_RE = /prefer-async-spawn:\s*sync-required/
 
@@ -131,7 +131,7 @@ const rule = {
           BANNED_NAMES.has(s.imported.name),
       )
       if (banned.length === 0) {
-        return undefined
+        return null
       }
       const others = node.specifiers.filter(
         s =>
@@ -142,7 +142,7 @@ const rule = {
       if (others.length > 0) {
         // Mixed line — leave it alone; a partial rewrite could lose
         // the non-banned import.
-        return undefined
+        return null
       }
       // The lib re-exports `spawn` (and the user can wire `as
       // spawnSync` themselves if they really need a name). For the

.config/oxlint-plugin/rules/prefer-exists-sync.mts

@@ -33,8 +33,8 @@
 import { appendImportFixes, summarizeImportTarget } from './_inject-import.mts'
 
 const ACCESS_METHODS = new Set(['access', 'accessSync'])
-const STAT_METHODS = new Set(['lstat', 'lstatSync', 'stat', 'statSync'])
-const WRAPPER_NAMES = new Set(['fileExists', 'isDir', 'isFile', 'pathExists'])
+const STAT_METHODS = new Set(['stat', 'statSync', 'lstat', 'lstatSync'])
+const WRAPPER_NAMES = new Set(['fileExists', 'pathExists', 'isFile', 'isDir'])
 
 const EXISTS_SYNC_IMPORT_LINE = "import { existsSync } from 'node:fs'"
 

.config/oxlint-plugin/rules/prefer-safe-delete.mts

@@ -36,13 +36,13 @@ import { appendImportFixes, summarizeImportTarget } from './_inject-import.mts'
 const DELETE_METHODS = new Set([
   'rm',
   'rmSync',
-  'rmdir',
-  'rmdirSync',
   'unlink',
   'unlinkSync',
+  'rmdir',
+  'rmdirSync',
 ])
 
-const SYNC_METHODS = new Set(['rmSync', 'rmdirSync', 'unlinkSync'])
+const SYNC_METHODS = new Set(['rmSync', 'unlinkSync', 'rmdirSync'])
 
 /** @type {import('eslint').Rule.RuleModule} */
 const rule = {

.config/oxlint-plugin/rules/socket-api-token-env.mts

@@ -24,8 +24,8 @@
 
 const LEGACY_ALIASES = new Set([
   'SOCKET_API_KEY',
-  'SOCKET_SECURITY_API_KEY',
   'SOCKET_SECURITY_API_TOKEN',
+  'SOCKET_SECURITY_API_KEY',
 ])
 
 const CANONICAL = 'SOCKET_API_TOKEN'

.config/oxlint-plugin/rules/sort-named-imports.mts

@@ -131,7 +131,7 @@ const rule = {
               filter: t => t.value === '}',
             })
             if (!openBrace || !closeBrace) {
-              return undefined
+              return null
             }
             const sliceStart = openBrace.range[1]
             const sliceEnd = closeBrace.range[0]