Enforce WorkOS Vault style rules with oxlint

[RhysSullivan]

Summary

Adds seven repo-local oxlint rules scoped to packages/plugins/workos-vault/src/**/*.{ts,tsx} so the provider's Effect-only surface, tagged-error discipline, and typed-boundary patterns stay enforced. Cherry-picks the rule logic from #425 and adapts the imports to the flat scripts/oxlint-plugin-executor/utils.js layout on main.

Rules added

• executor/no-inline-object-type-assertion
• executor/no-instanceof-tagged-error
• executor/no-manual-tag-check
• executor/no-promise-client-surface
• executor/no-raw-error-throw
• executor/no-redundant-error-factory
• executor/no-unknown-shape-probing

All registered as error severity under an overrides block targeting packages/plugins/workos-vault/src/**/*.{ts,tsx} (matches the scope #425 used).

Rules from #425 that were skipped

• no-vitest-import — already on main as executor/no-vitest-import.
• no-if-in-tests — overlaps with main's executor/no-conditional-tests. The two are not identical (the new rule blanket-bans if in tests; the existing rule bans expect() only inside conditionals), but the existing rule is the more nuanced of the two and the WorkOS Vault tests pass under it. Adding both would double-up on the same intent, so skipping per the task brief.

Source-file fixes required

The new rules apply to existing workos-vault source. To make them pass:

• client.ts: WorkOSVaultClientError now captures message and status at construction time via a small named ErrorWithStatus guard, so callers consume typed fields instead of probing unknown causes. Renamed the exported WorkOSVaultSdk interface to module-private WorkOSVaultPromiseApi (the rule forbids exposing Promise-shaped client surfaces); removed it from index.ts and updated testing.ts to import the new name.
• secret-store.ts: replaced unwrapVaultError + inline shape probes ("status" in cause, (cause as { status: number }), etc.) in isStatusError, isKekNotReadyError, and formatVaultError with direct typed access on WorkOSVaultClientError. Removed the now-unused GenericServerException/NotFoundException imports.
• secret-store.test.ts: introduced a named VaultMetadataRow interface instead of an inline as { scope_id: string } cast.

Validation

• bun run lint — passes (Found 0 warnings and 0 errors).
• bun run --cwd packages/plugins/workos-vault typecheck — passes.
• bunx vitest run src/sdk/secret-store.test.ts from packages/plugins/workos-vault — 11/11 passing.

Test plan

• CI green
• Spot-check that the rules still fire by introducing a violating pattern temporarily

Based on #425.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	6e44b63	Commit Preview URL Branch Preview URL	May 04 2026, 03:11 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	6e44b63	May 04 2026, 03:12 AM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@481

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@481

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@481

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@481

@executor-js/storage-core

npm i https://pkg.pr.new/@executor-js/storage-core@481

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@481

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@481

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@481

@executor-js/plugin-google-discovery

npm i https://pkg.pr.new/@executor-js/plugin-google-discovery@481

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@481

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@481

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@481

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@481

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@481

executor

npm i https://pkg.pr.new/executor@481

commit: 6e44b63