chore: sync fleet-canonical scripts/fix.mts from socket-repo-template@c7eff9e

Refresh of the auto-fix script to the new fleet-canonical form.
Functional change vs. prior local copy: extra argv now flows
through to `pnpm run lint --fix`, so `pnpm run fix --all`,
`pnpm run fix --staged`, and explicit file paths all work
uniformly across the fleet.

Eliminates the prior split where socket-addon + socket-stuie used
an inline `oxfmt --write . && oxlint --fix` form that rejected
`--all`. Both adopted scripts/fix.mts in their own commits today;
this brings the rest of the fleet to byte-identical with the new
canonical version.

Synced byte-identical from socket-repo-template via sync-scaffolding.

Author: jdalton

scripts/fix.mts

@@ -3,16 +3,22 @@
  * tools (zizmor, agentshield) if available.
  *
  * Steps:
- *   1. pnpm run lint --fix — oxlint + oxfmt
- *   2. zizmor --fix .github/ — GitHub Actions workflow fixes (if .github/ exists)
- *   3. agentshield scan --fix — Claude config fixes (if .claude/ exists)
+ *   1. pnpm run lint --fix — oxlint + oxfmt (forwards extra argv like --all)
+ *   2. zizmor --fix .github/ — GitHub Actions workflow fixes
+ *      (skipped if .github/ doesn't exist)
+ *   3. agentshield scan --fix — Claude config fixes
+ *      (skipped if .claude/ or agentshield isn't installed)
+ *
+ * Forwards `process.argv.slice(2)` to the lint step, so
+ * `pnpm run fix --all` runs `pnpm run lint --fix --all` (full-tree
+ * fix), and `pnpm run fix --staged` does the staged-only flow.
  */
 
 import { existsSync } from 'node:fs'
 import process from 'node:process'
 
-import { getDefaultLogger } from '@socketsecurity/lib-stable/logger'
-import { spawn } from '@socketsecurity/lib-stable/spawn'
+import { getDefaultLogger } from '@socketsecurity/lib/logger'
+import { spawn } from '@socketsecurity/lib/spawn'
 
 const WIN32 = process.platform === 'win32'
 const logger = getDefaultLogger()
@@ -37,16 +43,19 @@ async function run(
     }
     return 0
   } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
     if (!required) {
-      logger.warn(`${label || cmd}: ${e.message} (non-blocking)`)
+      logger.warn(`${label || cmd}: ${msg} (non-blocking)`)
       return 0
     }
     throw e
   }
 }
 
 async function main(): Promise<void> {
-  // Step 1: Lint fix — delegates to per-package lint scripts.
+  // Step 1: Lint fix — delegates to scripts/lint.mts which runs both
+  // oxfmt and oxlint. Forward extra argv so `--all` / `--staged` /
+  // explicit file paths reach the lint runner unchanged.
   const lintExit = await run(
     'pnpm',
     ['run', 'lint', '--fix', ...process.argv.slice(2)],
@@ -76,6 +85,7 @@ async function main(): Promise<void> {
 }
 
 main().catch((e: unknown) => {
-  logger.error(e)
+  const msg = e instanceof Error ? e.message : String(e)
+  logger.error(msg)
   process.exitCode = 1
 })