fix(eslint-plugin): close 3 false-negatives + add additionalPatterns option (#1758)

[bokelley]

Closes #1758.

Summary

Closes the three false-negative gaps in no-credential-read-from-args (shipped in #1752, on main but not yet released — the existing minor changeset is still pending) and adds an additionalPatterns rule option for adopters extending the runtime matcher.

Bug-class fixes

1. Destructure-then-read — extractContext(args) { const { access_token } = args; ... } previously passed. New VariableDeclarator visitor handles this, recursing through nested ObjectPatterns and reporting at the source key (not the alias). Shares collectObjectPatternKeys with the first-param destructure scanner so both forms produce identical paths.
2. AssignmentPattern default-value silently disabled scanning — extractContext(args = {}) previously made firstParamIdentifierName return null, which disabled the MemberExpression scanner. Now unwraps AssignmentPattern.left to recover the identifier name. extractContext({ access_token } = {}) likewise — destructuredKeys unwraps the AssignmentPattern wrapper before pattern-walking.
3. Nested destructure in first param — extractContext({ context: { access_token } }) previously only inspected the top-level pattern. collectObjectPatternKeys now recurses into nested ObjectPatterns and tracks the full path so the error message reads args.context.access_token. Nested renames ({ context: { access_token: tok } }) fire on the source key. RestElement skipped (documented gap).

False-positive fix

Free-standing function extractContext(args) { return args.access_token; } no longer fires. Dropped the FunctionDeclaration branch from methodNameForFunction — only Property (object literals) and MethodDefinition (class bodies) are matched. Class methods still fire (three regression tests cover this).

Rule option

New additionalPatterns: string[] option. Each entry compiled as new RegExp(p, 'i') and appended to DEFAULT_CREDENTIAL_PATTERNS. Adopters mirror their credentialPolicy.patterns.extend(...) runtime config for lint parity. Fully-replaceable credentialPolicy.matcher functions documented as a known gap (no regex analogue).

README

Adds Known gaps section listing aliasing / spread / helper-indirection / computed-key / cross-function bypasses that pass the linter by design — runtime credentialPolicy: 'authInfo-only' is the security boundary. Adds an additionalPatterns option example with matching runtime config.

Test count

14 → 30. New invalid cases: destructure-then-read (incl. rename, with-default, with-leaf-default), default-value param, destructure-with-default first param, nested destructure (plain + rename), additionalPatterns (member + destructure), class-method regression for each of the three fixes. New valid cases: free-standing function extractContext, spread aliasing, plain aliasing, destructure-then-read of a non-credential key.

Changeset

patch on @adcp/eslint-plugin.

Test plan

• cd packages/eslint-plugin && npm test — 30/30 pass
• cd packages/eslint-plugin && npm run build — clean
• npm run format:check — clean
• All 14 pre-existing tests still pass (verified via test count delta)

🤖 Generated with Claude Code