feat(migrate): preserve packages referenced via lint.jsPlugins

Before this commit, `rewriteEslintPackageJson` stripped every package
matching `isEslintEcosystemDep` — including ones `@oxlint/migrate` had
just referenced via `lint.jsPlugins`. Result: the generated config
listed `jsPlugins: ["eslint-plugin-foo"]` but the package was no
longer in `package.json`, so the sanitizer (or Oxlint at runtime)
would strip / fail to load it. Two passes in a row, two opposite
decisions about the same package.

Now the cleanup honors what `@oxlint/migrate` actually wrote:

  1. After `@oxlint/migrate` produces `.oxlintrc.json`, collect every
     string-form package name appearing in `lint.jsPlugins[]` (and in
     each `overrides[].jsPlugins[]`), skipping local-path specifiers
     (`./X`, `../X`, `/X`) which don't map to a `package.json` entry.
  2. Pass that set to `rewriteEslintPackageJson` as `preserveJsPlugins`.
  3. The cleanup loop skips removal for any name in that set — even
     when it matches `isEslintEcosystemDep`'s named / prefix / scope /
     scoped-regex patterns.

Net effect:
  - User had `eslint-plugin-vue` in devDeps AND imported it from
    `eslint.config.mjs` → `@oxlint/migrate` lists it in jsPlugins →
    cleanup keeps it → sanitizer keeps it → `vp lint` actually loads
    the plugin and runs its rules.
  - User had `eslint-plugin-vue` in devDeps but didn't import it →
    `@oxlint/migrate` doesn't list it → cleanup removes it as before
    (no regression).
  - `@oxlint/migrate` invented a reference to a package the user never
    installed (the WeakAuras `eslint-plugin-unocss` case) → not in
    devDeps, nothing to preserve → sanitizer still strips the orphan
    reference + warns (no regression).

New snap-test `migration-eslint-jsplugins-preserve` exercises the
preserve path end-to-end: a fixture with `eslint-plugin-survives` in
devDeps + an inline `survives` plugin in `eslint.config.mjs`. After
migration, the package is still in devDeps, the jsPlugins reference is
intact in `vite.config.ts`, and the `survives/no-fiction` rule
survived in `lint.rules` — all without firing any "stripped" warning.

Three unit tests cover the API surface:
  - preserveJsPlugins keeps named jsPlugins through cleanup
  - preserveJsPlugins overrides every branch of isEslintEcosystemDep
    (named / prefix / scope / scoped regex)
  - empty preserveJsPlugins set behaves identically to no argument
    (default-compatible, can't accidentally weaken cleanup for
    existing callers)

No existing snap-test drifted.

Author: fengmk2

packages/cli/snap-tests-global/migration-eslint-jsplugins-preserve/eslint.config.mjs

@@ -0,0 +1,31 @@
+// Inline-defined `survives` plugin — @oxlint/migrate translates it into
+// `lint.jsPlugins: ["eslint-plugin-survives"]`. The package is listed
+// in this fixture's package.json devDependencies, so:
+//   1. The cleanup step should NOT delete `eslint-plugin-survives`
+//      from package.json (it's referenced by the generated jsPlugins
+//      array — removing it would invalidate the lint config we just
+//      generated).
+//   2. The sanitizer should NOT strip the jsPlugins entry (the
+//      package is present in the workspace).
+//   3. The `survives/no-fiction` rule should survive in the merged
+//      `lint.rules` (the `survives` namespace is backed by the kept
+//      jsPlugin).
+export default [
+  {
+    plugins: {
+      survives: {
+        rules: {
+          'no-fiction': {
+            meta: { type: 'problem' },
+            create() {
+              return {};
+            },
+          },
+        },
+      },
+    },
+    rules: {
+      'survives/no-fiction': 'warn',
+    },
+  },
+];

packages/cli/snap-tests-global/migration-eslint-jsplugins-preserve/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "migration-eslint-jsplugins-preserve",
+  "scripts": {
+    "lint": "eslint ."
+  },
+  "devDependencies": {
+    "eslint": "^9.0.0",
+    "eslint-plugin-survives": "^1.0.0",
+    "vite": "^7.0.0"
+  }
+}

packages/cli/snap-tests-global/migration-eslint-jsplugins-preserve/snap.txt

@@ -0,0 +1,59 @@
+> vp migrate --no-interactive # plugin referenced via lint.jsPlugins must be preserved through cleanup AND sanitization
+◇ Migrated . to Vite+
+• Node <semver>  pnpm <semver>
+• 4 config updates applied
+• ESLint rules migrated to Oxlint
+
+> cat package.json # eslint-plugin-survives stays in devDependencies (eslint itself is removed)
+{
+  "name": "migration-eslint-jsplugins-preserve",
+  "scripts": {
+    "lint": "vp lint .",
+    "prepare": "vp config"
+  },
+  "devDependencies": {
+    "eslint-plugin-survives": "^1.0.0",
+    "vite": "catalog:",
+    "vite-plus": "catalog:"
+  },
+  "packageManager": "pnpm@<semver>"
+}
+
+> cat vite.config.ts # lint.jsPlugins keeps `eslint-plugin-survives`; lint.rules keeps `survives/no-fiction`
+import { defineConfig } from 'vite-plus';
+
+export default defineConfig({
+  staged: {
+    "*": "vp check --fix"
+  },
+  fmt: {},
+  lint: {
+    "plugins": [
+      "oxc",
+      "typescript",
+      "unicorn",
+      "react"
+    ],
+    "jsPlugins": [
+      "eslint-plugin-survives",
+      {
+        "name": "vite-plus",
+        "specifier": "vite-plus/oxlint-plugin"
+      }
+    ],
+    "categories": {
+      "correctness": "warn"
+    },
+    "env": {
+      "builtin": true
+    },
+    "rules": {
+      "survives/no-fiction": "warn",
+      "vite-plus/prefer-vite-plus-imports": "error"
+    },
+    "options": {
+      "typeAware": true,
+      "typeCheck": true
+    }
+  },
+});

packages/cli/snap-tests-global/migration-eslint-jsplugins-preserve/steps.json

@@ -0,0 +1,7 @@
+{
+  "commands": [
+    "vp migrate --no-interactive # plugin referenced via lint.jsPlugins must be preserved through cleanup AND sanitization",
+    "cat package.json # eslint-plugin-survives stays in devDependencies (eslint itself is removed)",
+    "cat vite.config.ts # lint.jsPlugins keeps `eslint-plugin-survives`; lint.rules keeps `survives/no-fiction`"
+  ]
+}

packages/cli/src/migration/__tests__/migrator.spec.ts

@@ -543,6 +543,84 @@ describe('rewriteEslintPackageJson', () => {
     const after = fs.readFileSync(pkgPath, 'utf8');
     expect(after).toBe(before);
   });
+
+  it('preserves packages referenced in lint.jsPlugins (so the generated config still loads)', () => {
+    // When @oxlint/migrate translates a real ESLint plugin into a
+    // lint.jsPlugins reference, Oxlint will `import()` the package at
+    // lint time. If we strip it from package.json the lint config we
+    // just generated is invalidated. The preserveJsPlugins set guards
+    // against that.
+    const pkgPath = writePkg({
+      devDependencies: {
+        eslint: '^9.0.0',
+        'eslint-plugin-vue': '^10.0.0',
+        'eslint-plugin-import-x': '^4.0.0',
+        'eslint-plugin-react': '^7.37.0',
+        '@stylistic/eslint-plugin': '^2.0.0',
+        '@typescript-eslint/parser': '^8.0.0',
+        vite: '^7.0.0',
+      },
+    });
+    rewriteEslintPackageJson(
+      pkgPath,
+      new Set(['eslint-plugin-vue', 'eslint-plugin-import-x', '@stylistic/eslint-plugin']),
+    );
+    const pkg = readJson(pkgPath);
+    expect(pkg.devDependencies).toEqual({
+      // Preserved (in jsPlugins set, so Oxlint will load them):
+      'eslint-plugin-vue': '^10.0.0',
+      'eslint-plugin-import-x': '^4.0.0',
+      '@stylistic/eslint-plugin': '^2.0.0',
+      // Removed (no jsPlugins reference, normal cleanup):
+      // 'eslint': stripped
+      // 'eslint-plugin-react': stripped
+      // '@typescript-eslint/parser': stripped
+      vite: '^7.0.0',
+    });
+  });
+
+  it('preserveJsPlugins overrides every cleanup pattern (named, prefix, scope, regex)', () => {
+    // Stress-test each branch of isEslintEcosystemDep against the
+    // preserve set so a future contributor adding a new cleanup branch
+    // can't accidentally bypass the carve-out.
+    const pkgPath = writePkg({
+      devDependencies: {
+        eslint: '^9.0.0', // named match in ESLINT_ECOSYSTEM_NAMES
+        'eslint-plugin-foo': '^1.0.0', // prefix match
+        '@eslint/js': '^9.0.0', // scope match
+        '@scope/eslint-plugin-bar': '^1.0.0', // scoped regex match
+        keepme: '^1.0.0',
+      },
+    });
+    rewriteEslintPackageJson(
+      pkgPath,
+      new Set(['eslint', 'eslint-plugin-foo', '@eslint/js', '@scope/eslint-plugin-bar']),
+    );
+    const pkg = readJson(pkgPath);
+    expect(pkg.devDependencies).toEqual({
+      eslint: '^9.0.0',
+      'eslint-plugin-foo': '^1.0.0',
+      '@eslint/js': '^9.0.0',
+      '@scope/eslint-plugin-bar': '^1.0.0',
+      keepme: '^1.0.0',
+    });
+  });
+
+  it('does not invent preserveJsPlugins entries — only what the caller asked for', () => {
+    // Sanity: an empty preserve set behaves identically to the default
+    // (no carve-out), so the new parameter can't accidentally weaken
+    // the cleanup for existing callers.
+    const pkgPath = writePkg({
+      devDependencies: {
+        eslint: '^9.0.0',
+        'eslint-plugin-foo': '^1.0.0',
+        vite: '^7.0.0',
+      },
+    });
+    rewriteEslintPackageJson(pkgPath, new Set());
+    const pkg = readJson(pkgPath);
+    expect(pkg.devDependencies).toEqual({ vite: '^7.0.0' });
+  });
 });
 
 function writePkgAt(dir: string, pkg: object): void {

packages/cli/src/migration/migrator.ts

@@ -329,6 +329,15 @@ export async function migrateEslintToOxlint(
     options.report.eslintMigrated = true;
   }
 
+  // Read the generated `.oxlintrc.json` to find any packages it references
+  // in `lint.jsPlugins`. Those packages need to stay in `package.json` so
+  // Oxlint can actually `import()` them at lint time — without this carve-out,
+  // the next step would strip them via `isEslintEcosystemDep` and we'd
+  // immediately invalidate the config we just generated. Local-path
+  // specifiers (`./X`, `../X`, `/X`) are skipped — they're paths, not
+  // package names, and have no `package.json` entry to preserve.
+  const preserveJsPlugins = collectJsPluginPackageNames(projectPath);
+
   // Step 3-5: Cleanup runs uniformly across the root and every workspace
   // package — delete eslint config files, scrub ESLint-ecosystem deps from
   // package.json, and rewrite eslint references in any local lint-staged
@@ -346,13 +355,52 @@ export async function migrateEslintToOxlint(
       continue;
     }
     deleteEslintConfigFiles(target, options?.report, options?.silent);
-    rewriteEslintPackageJson(path.join(target, 'package.json'));
+    rewriteEslintPackageJson(path.join(target, 'package.json'), preserveJsPlugins);
     rewriteEslintLintStagedConfigFiles(target, options?.report);
   }
 
   return true;
 }
 
+/**
+ * Read `<projectPath>/.oxlintrc.json` (if any) and collect the package
+ * names referenced via `lint.jsPlugins[]` string entries. Object-form
+ * entries (`{ name, specifier }`) and local-path specifiers (`./X`,
+ * `../X`, `/X`) are excluded — neither maps to a `package.json` entry
+ * we'd accidentally strip.
+ */
+function collectJsPluginPackageNames(projectPath: string): Set<string> {
+  const out = new Set<string>();
+  const oxlintConfigPath = path.join(projectPath, '.oxlintrc.json');
+  if (!fs.existsSync(oxlintConfigPath)) {
+    return out;
+  }
+  let config: OxlintConfig;
+  try {
+    config = readJsonFile(oxlintConfigPath, true) as OxlintConfig;
+  } catch {
+    return out;
+  }
+  const collectFrom = (jsPlugins: OxlintConfig['jsPlugins']): void => {
+    for (const entry of jsPlugins ?? []) {
+      if (typeof entry !== 'string') {
+        continue;
+      }
+      if (entry.startsWith('./') || entry.startsWith('../') || entry.startsWith('/')) {
+        continue;
+      }
+      out.add(entry);
+    }
+  };
+  collectFrom(config.jsPlugins);
+  if (Array.isArray(config.overrides)) {
+    for (const override of config.overrides) {
+      collectFrom(override.jsPlugins);
+    }
+  }
+  return out;
+}
+
 function deleteEslintConfigFiles(basePath: string, report?: MigrationReport, silent = false): void {
   const configs = detectConfigs(basePath);
   for (const file of [configs.eslintConfig, configs.eslintLegacyConfig]) {
@@ -442,8 +490,16 @@ function isEslintEcosystemDep(name: string): boolean {
  * in scope for adoption, so a half-cleanup at the workspace level would
  * be inconsistent with the rest of the flow (which already replaces
  * vite-related overrides and adds vite-plus across all packages).
+ *
+ * `preserveJsPlugins` names packages that `@oxlint/migrate` referenced
+ * via `lint.jsPlugins` and that Oxlint will need to `import()` at lint
+ * time. They override `isEslintEcosystemDep` so the generated config
+ * isn't immediately invalidated by the cleanup step.
  */
-export function rewriteEslintPackageJson(packageJsonPath: string): void {
+export function rewriteEslintPackageJson(
+  packageJsonPath: string,
+  preserveJsPlugins: ReadonlySet<string> = new Set(),
+): void {
   editJsonFile<{
     devDependencies?: Record<string, string>;
     dependencies?: Record<string, string>;
@@ -465,6 +521,9 @@ export function rewriteEslintPackageJson(packageJsonPath: string): void {
       }
       let removedAny = false;
       for (const name of Object.keys(deps)) {
+        if (preserveJsPlugins.has(name)) {
+          continue;
+        }
         if (isEslintEcosystemDep(name)) {
           delete deps[name];
           changed = true;