[eslint-refiner] ESLint Refiner — Daily Report 2026-07-17

[github-actions[bot]]

Overview

First triage pass over the 7 new rules added since the last run (rule count 12 → 19). The eslint-factory rule set is in strong shape: the newly-added rules are well-constructed, and the actions/setup/js codebase is disciplined about error handling, so grounded defects are scarce. Two false-positive-prevention refinements were filed on previously-untriaged rules; overlapping areas already covered by open issues were deliberately skipped.

Note: git history for eslint-factory/src/rules/** is squashed — every rule file reports as added 2026-07-17, so rule age is derived by diffing index.ts registrations against the persisted rules[] list, not from git dates.

Key metrics

Metric	Value
Registered rules	19 (was 12)
New rules triaged this run	7
Issues filed	2 (of 3 cap)
Skipped as duplicate / already-covered	4 areas
Real bug the new rules correctly flag	1 (apply_samples.cjs:97)

Issues filed

1. require-spawnsync-error-check — false positive when result.error is guarded through an intermediate variable. const e = result.error; if (e) throw e; is reported because isGuardingErrorUsage does not follow a single-assignment alias from the .error read to the later guard. Affects both the simple-identifier and object-pattern branches.
2. require-new-url-try-catch — false positives for provably non-throwing arguments. Compile-time constant string concatenation (new URL("(x/redacted)" + "/y")) and import.meta.url as the sole/first argument (isKnownSafeBase is only consulted for the base argument) are flagged even though they cannot throw. This aligns the rule with the sibling no-github-request-interpolated-route, which already accepts compile-time constants.

Both are logic-derived precision refinements with concrete repros and acceptance criteria; neither has a live escaping site today (filed to prevent future noise).

New-rule triage detail

Per-rule assessment of the 7 new rules

• require-spawnsync-error-check — Good. Correctly flags a genuine latent bug: apply_samples.cjs:97 (runGit) checks only result.status, never result.error, so a spawn failure (ENOENT/ETIMEDOUT) yields a misleading exit null message with no cause. Rules run at warn severity, so this real defect persists — worth a follow-up code fix.
• require-new-url-try-catch — Good. generate_history_link.cjs:61 correctly flagged (true positive); awf_reflect.cjs:140 correctly ignored (already wrapped). Ungrounded FN class: aliased / namespaced URL (const U = URL; new U(x), new globalThis.URL(x)).
• require-mkdirsync-try-catch — Good, and the prior destructured-fs false negative is now fixed in the shared createFsSyncMethodResolver. One asymmetry: require-fs-sync-try-catch passes { allowUnboundFsIdentifier: true } while this rule does not, so an ambient/unresolved fs.mkdirSync(...) is a latent false negative. Not filed — it overlaps the open “Consolidate require-mkdirsync-try-catch into require-fs-sync-try-catch” issue and all live mkdirSync sites bind fs via require. Recommend the consolidation reconcile the resolver option.
• no-throw-plain-object — Good. isJsonRpcErrorShape exempts { code: <negative int literal>, message, data? }; all live throws (mcp_server_core.cjs 721–816, safe_outputs_handlers.cjs) match and are correctly not flagged. Latent FP only if code is a named constant (all repo throws use literals).
• require-return-after-core-setfailed — Robust. Handles nested blocks, cross-block continuation, loop back-edges, switch fall-through, core aliases, and destructured setFailed. All live core.setFailed() sites (check_skip_if_helpers.cjs, setup_threat_detection.cjs) are correctly followed by return. Documented limitation: break/continue accepted even though post-loop code still runs.
• no-core-exportvariable-non-string — Twin of no-core-setoutput-non-string via the shared nonStringKind helper, so it inherits the same gaps already tracked in eslint-factory: no-core-setoutput-non-string only recognizes .length; misses .number/.size (live FN in close_entity_helpers.cjs) #42682 (misses unary/negative numeric literals such as -1; only .length). Not re-filed to avoid duplicating eslint-factory: no-core-setoutput-non-string only recognizes .length; misses .number/.size (live FN in close_entity_helpers.cjs) #42682 — fixing nonStringKind fixes both rules at once.
• no-github-request-interpolated-route — Already has an open scope-resolution FN issue; skipped.

Deduplication

Open issues consulted; areas intentionally skipped

• [eslint-monster] [Code Quality] × 2 — application-side fixes (wrap fs/mkdirSync in try/catch; normalize error handling). Not rule-refinement work.
• [Code Quality] Consolidate require-mkdirsync-try-catch into require-fs-sync-try-catch — covers the mkdirsync/fs-sync relationship, including the resolver-option asymmetry noted above.
• [Code Quality] Document ESLint factory rules 13–18 in the eslint-factory README — README doc-debt already tracked.
• no-github-request-interpolated-route scope-resolution false negatives — already open.

Next actions

• On the next run, re-diff index.ts registrations against the persisted rules[] (19) to catch any newer untriaged rule and lead with it.
• If the two filed FP fixes land, confirm the added valid-cases pass and the existing invalid-case regressions still hold.
• Recommend the mkdirsync/fs-sync consolidation reconcile the allowUnboundFsIdentifier option so the ambient-fs false negative cannot regress.
• Consider a follow-up code fix for apply_samples.cjs:97 to check result.error (the rule already surfaces it at warn).

References: §29558764310

Generated by 🤖 ESLint Refiner · 429.1 AIC · ⌖ 13.4 AIC · ⊞ 4.6K · ◷

• expires on Jul 17, 2026, 10:20 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by ESLint Refiner.

A newer discussion is available at Discussion #46357.