fix(lint): address review on the Oxlint plugin API rewrite

Seven fixes from review on #2328.

Correctness of the rewrite:

- A statement that mixes the two `oxlint` surfaces, such as
  `import { defineConfig, defineRule } from 'oxlint'`, is now left alone.
  The rewrite replaces the whole specifier, so moving it stripped
  `defineConfig` of its module. Splitting is the user's call.
- `require('@oxlint/plugins')` and `require('oxlint/plugins-dev')` no
  longer rewrite. The `vite-plus/lint/*` exports are ESM-only, so a
  rewritten `require()` failed with ERR_PACKAGE_PATH_NOT_EXPORTED. Static
  import, export, and dynamic `import()` still rewrite, because those
  resolve through the `import` condition.

The published-plugin exemption, which did not work end to end:

- `rewritePackageJson` strips `oxlint` before the import rewriter reads the
  manifests, so `SkipPackages::skip_oxlint` never saw the signal in a real
  migration. `collectOxlintOwnerDirs` now captures it before the edit and
  passes the directories through to the rewriter. Note that `skip_tsdown`
  has the same latent flaw, since `tsdown` is also in `REMOVE_PACKAGES`;
  this change does not touch it.
- `vp lint --fix` rewrote a published plugin's source unconditionally,
  undoing the exemption the migration had just honored. The rule now checks
  the nearest manifest, reusing the mtime-keyed cache shape already used
  for `@nuxt/test-utils`.
- The `oxlint` peer entry is no longer stripped from a package that owns
  the plugin API. A peer is a consumer contract, not a tool the package
  runs, and removing it left the source importing a package the manifest
  no longer declared.
- `declare module '@oxlint/plugins'` and the `oxlint` forms are preserved,
  the same way the rule already preserves Vitest-family augmentations. The
  re-exported types keep their upstream module identity, so a retargeted
  augmentation stopped merging.

Cleanup:

- The migration now drops a dead `@oxlint/plugins` devDependency, since
  nothing imports it after the rewrite. Only from devDependencies: a
  `dependencies` or `peerDependencies` edge marks a published plugin.

Tests: 3 Rust cases for the mixed, `require`, and dynamic-import rules; 8
lint-rule cases for the published-plugin and augmentation guards; and a new
`migration_oxlint_published_plugin` snapshot fixture covering the skip.

Author: fengmk2

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/migration_oxlint_js_plugin_imports/snapshots.toml

@@ -11,7 +11,7 @@ steps = [
     "vpt",
     "print-file",
     "package.json",
-  ], comment = "oxlint is removed and nothing replaces it. The API now comes from vite-plus. @oxlint/plugins stays on purpose: it is inert once the imports are rewritten, and removing it would also remove the peer dependency of a published Oxlint plugin", continue-on-failure = true },
+  ], comment = "oxlint and @oxlint/plugins are both gone from devDependencies, and nothing replaces them. The API now comes from vite-plus", continue-on-failure = true },
   { argv = [
     "vpt",
     "print-file",

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/migration_oxlint_js_plugin_imports/snapshots/migration_oxlint_js_plugin_imports.md

@@ -14,7 +14,7 @@ VITE+ - The Unified Toolchain for the Web
 
 ## `vpt print-file package.json`
 
-oxlint is removed and nothing replaces it. The API now comes from vite-plus. @oxlint/plugins stays on purpose: it is inert once the imports are rewritten, and removing it would also remove the peer dependency of a published Oxlint plugin
+oxlint and @oxlint/plugins are both gone from devDependencies, and nothing replaces them. The API now comes from vite-plus
 
 ```
 {
@@ -24,7 +24,6 @@ oxlint is removed and nothing replaces it. The API now comes from vite-plus. @ox
     "prepare": "vp config"
   },
   "devDependencies": {
-    "@oxlint/plugins": "^1.0.0",
     "vite": "catalog:",
     "vite-plus": "catalog:"
   },

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/migration_oxlint_published_plugin/lint/index.js

@@ -0,0 +1,14 @@
+import { defineRule } from 'oxlint';
+
+export const noFoo = defineRule({
+  meta: { messages: { noFoo: 'Do not name things "foo".' } },
+  create(context) {
+    return {
+      Identifier(node) {
+        if (node.name === 'foo') {
+          context.report({ node, messageId: 'noFoo' });
+        }
+      },
+    };
+  },
+});

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/migration_oxlint_published_plugin/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "oxlint-plugin-example",
+  "version": "1.0.0",
+  "scripts": {
+    "lint": "oxlint ."
+  },
+  "peerDependencies": {
+    "oxlint": "^1.0.0"
+  },
+  "devDependencies": {
+    "vite": "^7.0.0"
+  }
+}

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/migration_oxlint_published_plugin/snapshots.toml

@@ -0,0 +1,20 @@
+[[case]]
+name = "migration_oxlint_published_plugin"
+vp = "global"
+steps = [
+  { argv = [
+    "vp",
+    "migrate",
+    "--no-interactive",
+  ], comment = "this package declares `oxlint` as a peer dependency, which marks it a published Oxlint plugin", continue-on-failure = true },
+  { argv = [
+    "vpt",
+    "print-file",
+    "lint/index.js",
+  ], comment = "the authoring import stays on 'oxlint'. Consumers of a published plugin may run plain Oxlint, so a rewrite to vite-plus would break them. This also covers the ordering trap: rewritePackageJson strips `oxlint` before the import rewriter reads the manifest, so the skip signal is captured up front", continue-on-failure = true },
+  { argv = [
+    "vpt",
+    "print-file",
+    "package.json",
+  ], comment = "the `oxlint` peer entry survives. It is a consumer contract, not a tool this package runs, and stripping it would leave the source importing a package the manifest no longer declares", continue-on-failure = true },
+]

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/migration_oxlint_published_plugin/snapshots/migration_oxlint_published_plugin.md

@@ -0,0 +1,63 @@
+# migration_oxlint_published_plugin
+
+## `vp migrate --no-interactive`
+
+this package declares `oxlint` as a peer dependency, which marks it a published Oxlint plugin
+
+```
+VITE+ - The Unified Toolchain for the Web
+
+◇ Migrated . to Vite+ <version>
+• Node <version>  pnpm <version>
+• 2 config updates applied
+```
+
+## `vpt print-file lint/index.js`
+
+the authoring import stays on 'oxlint'. Consumers of a published plugin may run plain Oxlint, so a rewrite to vite-plus would break them. This also covers the ordering trap: rewritePackageJson strips `oxlint` before the import rewriter reads the manifest, so the skip signal is captured up front
+
+```
+import { defineRule } from 'oxlint';
+
+export const noFoo = defineRule({
+  meta: { messages: { noFoo: 'Do not name things "foo".' } },
+  create(context) {
+    return {
+      Identifier(node) {
+        if (node.name === 'foo') {
+          context.report({ node, messageId: 'noFoo' });
+        }
+      },
+    };
+  },
+});
+```
+
+## `vpt print-file package.json`
+
+the `oxlint` peer entry survives. It is a consumer contract, not a tool this package runs, and stripping it would leave the source importing a package the manifest no longer declares
+
+```
+{
+  "name": "oxlint-plugin-example",
+  "version": "1.0.0",
+  "scripts": {
+    "lint": "vp lint .",
+    "prepare": "vp config"
+  },
+  "peerDependencies": {
+    "oxlint": "^1.0.0"
+  },
+  "devDependencies": {
+    "vite": "catalog:",
+    "vite-plus": "catalog:"
+  },
+  "devEngines": {
+    "packageManager": {
+      "name": "pnpm",
+      "version": "<version>",
+      "onFail": "download"
+    }
+  }
+}
+```

crates/vp_migration/src/import_rewriter.rs

@@ -1,5 +1,5 @@
 use std::{
-    collections::HashMap,
+    collections::{HashMap, HashSet},
     path::{Path, PathBuf},
     sync::LazyLock,
 };
@@ -1596,12 +1596,20 @@ fix: $NEW_IMPORT
 /// plugin type names. An unrecognized name falls on the side of fixing the
 /// breakage.
 ///
+/// A statement that mixes the two surfaces, such as
+/// `import { defineConfig, defineRule } from 'oxlint'`, is left alone. The
+/// rewrite replaces the whole specifier, so moving it would strip
+/// `defineConfig` of its module. Splitting the statement is the user's call.
+///
 /// These forms name no specifier, so the rewrite skips them: namespace imports
 /// (`import * as`), default imports, bare side-effect imports,
 /// `require('oxlint')`, and `import('oxlint')`.
 ///
 /// `@oxlint/plugins` and `oxlint/plugins-dev` are unambiguous. They expose only
-/// the plugin API and the dev-time utilities, so every statement form rewrites.
+/// the plugin API and the dev-time utilities, so import, export, and dynamic
+/// `import()` statements all rewrite. `require()` does NOT: the
+/// `vite-plus/lint/*` exports are ESM-only, so a rewritten `require()` would
+/// fail to resolve with ERR_PACKAGE_PATH_NOT_EXPORTED.
 ///
 /// The rewrite skips a package that declares `oxlint` or `@oxlint/plugins` in
 /// `dependencies` or `peerDependencies`. Those are published Oxlint plugins,
@@ -1639,27 +1647,6 @@ transform:
       by: "vite-plus/lint/plugins"
 fix: $NEW_IMPORT
 ---
-id: rewrite-oxlint-plugins-require
-language: TypeScript
-rule:
-  pattern: $STR
-  kind: string
-  regex: ^['"]@oxlint/plugins['"]$
-  inside:
-    kind: arguments
-    inside:
-      kind: call_expression
-      has:
-        field: function
-        regex: ^require$
-transform:
-  NEW_IMPORT:
-    replace:
-      source: $STR
-      replace: "@oxlint/plugins"
-      by: "vite-plus/lint/plugins"
-fix: $NEW_IMPORT
----
 id: rewrite-oxlint-plugins-dynamic-import
 language: TypeScript
 rule:
@@ -1713,27 +1700,6 @@ transform:
       by: "vite-plus/lint/plugins-dev"
 fix: $NEW_IMPORT
 ---
-id: rewrite-oxlint-plugins-dev-require
-language: TypeScript
-rule:
-  pattern: $STR
-  kind: string
-  regex: ^['"]oxlint/plugins-dev['"]$
-  inside:
-    kind: arguments
-    inside:
-      kind: call_expression
-      has:
-        field: function
-        regex: ^require$
-transform:
-  NEW_IMPORT:
-    replace:
-      source: $STR
-      replace: oxlint/plugins-dev
-      by: "vite-plus/lint/plugins-dev"
-fix: $NEW_IMPORT
----
 id: rewrite-oxlint-plugins-dev-dynamic-import
 language: TypeScript
 rule:
@@ -1763,13 +1729,17 @@ rule:
   regex: ^['"]oxlint['"]$
   inside:
     kind: import_statement
-    has:
-      kind: import_specifier
-      stopBy: end
-      not:
-        has:
-          field: name
-          regex: ^(defineConfig|AllowWarnDeny|DummyRule|DummyRuleMap|ExternalPluginEntry|ExternalPluginsConfig|OxlintConfig|OxlintEnv|OxlintGlobals|OxlintOverride|RuleCategories)$
+    all:
+      - has:
+          kind: import_specifier
+          stopBy: end
+      - not:
+          has:
+            kind: import_specifier
+            stopBy: end
+            has:
+              field: name
+              regex: ^(defineConfig|AllowWarnDeny|DummyRule|DummyRuleMap|ExternalPluginEntry|ExternalPluginsConfig|OxlintConfig|OxlintEnv|OxlintGlobals|OxlintOverride|RuleCategories)$
 transform:
   NEW_IMPORT:
     replace:
@@ -2187,11 +2157,22 @@ struct PackageRewriteContext {
 }
 
 /// Options controlling directory-wide import rewriting.
-#[derive(Debug, Clone, Copy, Default)]
+#[derive(Debug, Clone, Default)]
 pub struct RewriteImportsOptions {
     /// Preserve `vitest` and `vitest/*` module specifiers throughout packages
     /// whose nearest package.json declares `@nuxt/test-utils`.
     pub preserve_vitest_in_nuxt_packages: bool,
+    /// Directories of packages that declared `oxlint` or `@oxlint/plugins` in
+    /// `dependencies` or `peerDependencies` BEFORE the migration edited their
+    /// manifests.
+    ///
+    /// `rewritePackageJson` strips `oxlint` (it is in `REMOVE_PACKAGES`) before
+    /// import rewriting reads the manifests, so `get_package_rewrite_context`
+    /// can no longer see that signal on disk. The caller captures it up front
+    /// and passes it here, otherwise a published Oxlint plugin that declared
+    /// the legacy `oxlint` package would lose its exemption and get rewritten
+    /// to depend on Vite+.
+    pub oxlint_owner_dirs: Vec<PathBuf>,
 }
 
 impl SkipPackages {
@@ -2406,15 +2387,26 @@ pub fn rewrite_imports_in_directory_with_options(
 
     // Pre-compute package context for each file (requires mutable cache, done sequentially).
     let mut package_context_cache: HashMap<PathBuf, PackageRewriteContext> = HashMap::new();
+    // Packages whose manifest declared `oxlint` / `@oxlint/plugins` before the
+    // migration edited it. Matched by the package DIRECTORY because the
+    // manifest itself no longer carries the signal (see `oxlint_owner_dirs`).
+    let oxlint_owner_dirs: HashSet<PathBuf> = options.oxlint_owner_dirs.iter().cloned().collect();
+
     let files_with_context: Vec<(PathBuf, PackageRewriteContext)> = walk_result
         .files
         .into_iter()
         .map(|file_path| {
             let package_context =
                 if let Some(package_json_path) = find_nearest_package_json(&file_path, root) {
-                    *package_context_cache
+                    let mut context = *package_context_cache
                         .entry(package_json_path.clone())
-                        .or_insert_with(|| get_package_rewrite_context(&package_json_path))
+                        .or_insert_with(|| get_package_rewrite_context(&package_json_path));
+                    if let Some(package_dir) = package_json_path.parent()
+                        && oxlint_owner_dirs.contains(package_dir)
+                    {
+                        context.skip_packages.skip_oxlint = true;
+                    }
+                    context
                 } else {
                     PackageRewriteContext::default()
                 };
@@ -3379,7 +3371,10 @@ import { mockNuxtImport } from '@nuxt/test-utils/runtime';"#,
 
         let result = rewrite_imports_in_directory_with_options(
             temp.path(),
-            RewriteImportsOptions { preserve_vitest_in_nuxt_packages: true },
+            RewriteImportsOptions {
+                preserve_vitest_in_nuxt_packages: true,
+                ..RewriteImportsOptions::default()
+            },
         )
         .unwrap();
 
@@ -3417,7 +3412,10 @@ import { mockNuxtImport } from '@nuxt/test-utils/runtime';"#,
 
         let result = rewrite_imports_in_directory_with_options(
             temp.path(),
-            RewriteImportsOptions { preserve_vitest_in_nuxt_packages: true },
+            RewriteImportsOptions {
+                preserve_vitest_in_nuxt_packages: true,
+                ..RewriteImportsOptions::default()
+            },
         )
         .unwrap();
 
@@ -4028,6 +4026,40 @@ new RuleTester().run('no-foo', noFoo, { valid: [], invalid: [] });"#
         );
     }
 
+    #[test]
+    fn test_rewrite_import_content_oxlint_mixed_surfaces_are_left_alone() {
+        // Replacing the specifier would move `defineConfig` to an entry that
+        // does not export it. Splitting the statement is the user's call.
+        let mixed = r#"import { defineConfig, defineRule } from 'oxlint';"#;
+
+        let result = rewrite_import_content(mixed, &SkipPackages::default()).unwrap();
+        assert!(!result.updated);
+        assert_eq!(result.content, mixed);
+    }
+
+    #[test]
+    fn test_rewrite_import_content_oxlint_require_is_left_alone() {
+        // `vite-plus/lint/plugins` is an ESM-only export, so a rewritten
+        // `require()` would fail with ERR_PACKAGE_PATH_NOT_EXPORTED.
+        let cjs = r#"const { defineRule } = require('@oxlint/plugins');
+const { RuleTester } = require('oxlint/plugins-dev');"#;
+
+        let result = rewrite_import_content(cjs, &SkipPackages::default()).unwrap();
+        assert!(!result.updated);
+        assert_eq!(result.content, cjs);
+    }
+
+    #[test]
+    fn test_rewrite_import_content_oxlint_dynamic_import_still_rewrites() {
+        // Dynamic `import()` resolves through the `import` condition, so the
+        // ESM-only export is reachable.
+        let dynamic = r#"const plugins = await import('@oxlint/plugins');"#;
+
+        let result = rewrite_import_content(dynamic, &SkipPackages::default()).unwrap();
+        assert!(result.updated);
+        assert_eq!(result.content, r#"const plugins = await import('vite-plus/lint/plugins');"#);
+    }
+
     #[test]
     fn test_rewrite_import_content_oxlint_skipped_for_published_plugins() {
         let plugin = r#"import { defineRule } from '@oxlint/plugins';"#;

packages/cli/binding/index.d.cts

@@ -3621,6 +3621,7 @@ export declare function rewriteEslint(scriptsJson: string): string | null;
 export declare function rewriteImportsInDirectory(
   root: string,
   preserveVitestInNuxtPackages?: boolean | undefined | null,
+  oxlintOwnerDirs?: Array<string> | undefined | null,
 ): BatchRewriteResult;
 
 /**

packages/cli/binding/src/migration.rs

@@ -290,11 +290,17 @@ pub fn wrap_lazy_plugins(vite_config_path: String) -> Result<MergeJsonConfigResu
 pub fn rewrite_imports_in_directory(
     root: String,
     preserve_vitest_in_nuxt_packages: Option<bool>,
+    oxlint_owner_dirs: Option<Vec<String>>,
 ) -> Result<BatchRewriteResult> {
     let result = vp_migration::rewrite_imports_in_directory_with_options(
         Path::new(&root),
         vp_migration::RewriteImportsOptions {
             preserve_vitest_in_nuxt_packages: preserve_vitest_in_nuxt_packages.unwrap_or(false),
+            oxlint_owner_dirs: oxlint_owner_dirs
+                .unwrap_or_default()
+                .into_iter()
+                .map(std::path::PathBuf::from)
+                .collect(),
         },
     )
     .map_err(anyhow::Error::from)?;