quality: clear prefer-exists-sync — stat-for-metadata triage

35 → 0 prefer-exists-sync violations. All are legitimate stat calls
that read metadata (size, mtime) or discriminate file type (isFile,
isDirectory, isSymbolicLink) — not pure existence checks.

* src/fs/inspect.ts: whole file is the stat-wrapper surface; file-
  level oxlint-disable.

* src/fs/find-up.ts: needs isFile()/isDirectory() to filter results
  by type; file-level disable.

* src/dlx/binary.ts: DLX cache uses stat for size/mtime metadata;
  file-level disable.

* src/dlx/detect.ts, src/ipc.ts, src/process-lock.ts,
  src/fs/validate.ts: inline disables — single sites, each with a
  one-line `--` explanation (mtime for cache, lstat for symlink
  discrimination, accessSync(R_OK) for permission, etc.).

* scripts/build-externals/bundler.mts, scripts/validate/file-size.mts:
  inline disables — both read stats.size for logging / size limits.

* test/unit/fs.test.mts, test/unit/process-lock.test.mts,
  test/unit/ipc.test.mts, test/unit/dlx/package.test.mts,
  test/integration/fs.test.mts: file-level disables — tests verify
  stat output (mtime stability, isDirectory/isFile transitions, size
  growth), not existence.

Net: 352 → 317 violations. Remaining: 280 sort-source-methods
(blocked on #65), 36 no-status-emoji (intentional test/rule-plugin/
coverage UI), 1 no-placeholders (rule plugin's fixture file).

Author: jdalton

scripts/build-externals/bundler.mts

@@ -103,7 +103,7 @@ export async function bundlePackage(packageName, outputPath, options = {}) {
 ${contentWithoutStrict}`
     await fs.writeFile(outputPath, finalContent)
 
-    // Get file size for logging.
+    // oxlint-disable-next-line socket/prefer-exists-sync -- need size for logging.
     const stats = await fs.stat(outputPath)
     const sizeKB = Math.round(stats.size / 1024)
     if (!quiet) {

scripts/validate/file-size.mts

@@ -76,6 +76,7 @@ export async function scanDirectory(dir, violations = []) {
         }
       } else if (entry.isFile()) {
         try {
+          // oxlint-disable-next-line socket/prefer-exists-sync -- need size for size-limit check.
           const stats = await fs.stat(fullPath)
           if (stats.size > MAX_FILE_SIZE) {
             const relativePath = path.relative(rootPath, fullPath)

src/dlx/binary.ts

@@ -1,5 +1,7 @@
 /** @fileoverview DLX binary execution utilities for Socket ecosystem. */
 
+/* oxlint-disable socket/prefer-exists-sync -- DLX binary metadata uses stat for size/mtime; not existence-only checks. */
+
 import process from 'node:process'
 
 import { getArch, WIN32 } from '../constants/platform'

src/dlx/detect.ts

@@ -166,6 +166,7 @@ export function readPackageJson(packageJsonPath: string): object | undefined {
 
   let mtimeMs = 0
   try {
+    // oxlint-disable-next-line socket/prefer-exists-sync -- need mtimeMs for cache invalidation, not just existence.
     mtimeMs = fs.statSync(packageJsonPath).mtimeMs
   } catch {
     packageJsonContentCache.delete(packageJsonPath)

src/fs/find-up.ts

@@ -6,6 +6,8 @@
  * `/.foo` was never found. The current shape visits root, then breaks.
  */
 
+/* oxlint-disable socket/prefer-exists-sync -- needs stat to discriminate file vs directory matches via isFile()/isDirectory(). */
+
 import process from 'node:process'
 
 import { isArray } from '../arrays'

src/fs/inspect.ts

@@ -8,6 +8,8 @@
  * directly.
  */
 
+/* oxlint-disable socket/prefer-exists-sync -- this module IS the stat-wrapper surface; callers use these for type discrimination (isFile/isDirectory) or metadata, not pure existence checks. */
+
 import { defaultIgnore } from '../globs/defaults'
 import { getGlobMatcher } from '../globs/matcher'
 import { getNodeFs } from '../node/fs'

src/fs/validate.ts

@@ -52,6 +52,7 @@ export function validateFiles(
 
   for (const filepath of filepaths) {
     try {
+      // oxlint-disable-next-line socket/prefer-exists-sync -- accessSync(R_OK) checks read permission, not just existence.
       fs.accessSync(filepath, R_OK)
       validPaths.push(filepath)
     } catch {

src/ipc.ts

@@ -67,6 +67,7 @@ export async function ensureIpcDirectory(filePath: string): Promise<void> {
     return
   }
   /* c8 ignore stop */
+  // oxlint-disable-next-line socket/prefer-exists-sync -- need lstat to discriminate symlink/dir via isDirectory().
   const stats = await fs.promises.lstat(dir)
   // Defensive: mkdir just succeeded so dir is a directory.
   /* c8 ignore start */

src/process-lock.ts

@@ -234,6 +234,7 @@ class ProcessLockManager {
     try {
       // Use single statSync call instead of existsSync + statSync.
       // throwIfNoEntry: false returns undefined if path doesn't exist.
+      // oxlint-disable-next-line socket/prefer-exists-sync -- need mtimeMs for staleness check; existsSync would discard the metadata.
       const stats = getFs().statSync(lockPath, { throwIfNoEntry: false })
       if (!stats) {
         return false

test/integration/fs.test.mts

@@ -9,6 +9,8 @@
  * Used by Socket CLI for config files, package.json manipulation, and cache.
  */
 
+/* oxlint-disable socket/prefer-exists-sync -- tests verify stat output (isFile/isDirectory/mtime/size), not existence. */
+
 import fs from 'node:fs/promises'
 import os from 'node:os'
 import path from 'node:path'