[eslint-refiner] ESLint Refiner — Daily Report 2026-07-02

[github-actions[bot]]

Overview

Today's run focused on the last unanalyzed rule, no-unsafe-promise-catch-error-property, and ran live diagnostics over every .catch(err => ...) callback in actions/setup/js. The rule has drifted behind its try/catch sibling no-unsafe-catch-error-property, which received refinements (from #42190/#42188/#42189) the promise rule never got. Three non-duplicate issues were filed. A triage pass also confirmed several older issues are now fixed in source and can be closed.

Key metrics

Metric	Value
Rules in factory	6
Rule analyzed this run	no-unsafe-promise-catch-error-property (first review)
Live .catch(err=>...) sites inspected	16
Live true positives (unguarded err.message)	4 — claude_harness.cjs:538, codex_harness.cjs:593, copilot_harness.cjs:1185, emit_outcome_spans.cjs:317
Live false positives	2 — apply_samples.cjs:651 (err && err.stack ? ... : String(err))
New issues filed	3
Prior issues verified fixed (recommend close)	7

New issues filed

1. False positive — the rule flags the defensive err && err.stack ? err.stack : String(err) idiom (live at apply_samples.cjs:651). Truthiness-gated access with a String(err) fallback is safe and should not be reported.
2. Parity drift — the promise rule (unlike its sibling) does not detect computed access err["message"] and gives no suggestion for non-message props (stack/code/status/cause/name). Port both from no-unsafe-catch-error-property (ref eslint-factory: no-unsafe-catch-error-property — add suggestions for stack/code and cover computed access #42190).
3. Branch-order false negative — the frame-level guard suppresses the whole callback, so an unguarded err.message textually before a later instanceof Error slips through. Mirrors sibling issue eslint-factory: no-unsafe-catch-error-property guard is whole-block, causing branch-order false negatives #42189.

Live diagnostics detail (16 sites)

Correctly silent (guarded by instanceof Error in-expression): start_mcp_gateway.cjs:940-941, mcp_cli_bridge.cjs:1262, copilot_sdk_driver.cjs:157, pi_agent_core_driver.cjs:392, copilot_sdk_session.cjs:400. safe_outputs_mcp_server_http.cjs:362 & mcp_scripts_mcp_server_http.cjs:220 already use getErrorMessage().

True positives (genuine unguarded access the rule would catch): ${err.message} in claude_harness.cjs:538, codex_harness.cjs:593, copilot_harness.cjs:1185; ${err.message || err} in emit_outcome_spans.cjs:317.

False positive: apply_samples.cjs:651 — 2 reports on err && err.stack ? err.stack : String(err).

Triage — prior issues verified fixed in current source (recommend closing)

This workflow cannot close issues; maintainers should verify and close:

• eslint-factory: add a test suite for require-parseInt-radix (currently zero coverage) #42015 — require-parseInt-radix now has a test suite (require-parseInt-radix.test.ts). ✅
• eslint-factory: add a suggestion fix + fix broken docs URL for require-parseInt-radix #42016 — require-parseInt-radix now has an addRadix10 suggestion + fix. ✅
• eslint-factory: require-parseInt-radix misses computed/indirect parseInt access #42017 — require-parseInt-radix now handles computed Number["parseInt"]. ✅ (aliased bindings remain intentionally out of scope)
• eslint-factory: broaden no-unsafe-catch-error-property beyond message/stack/code to .status/.cause/.name #42188 — no-unsafe-catch-error-property UNSAFE_PROPERTIES now covers status/cause/name. ✅
• eslint-factory: no-unsafe-catch-error-property — add suggestions for stack/code and cover computed access #42190 — sibling now has wrapWithInstanceof suggestions + computed access. ✅
• eslint-factory: require-json-parse-try-catch misses indirect/computed JSON.parse access #41962 — require-json-parse-try-catch now handles computed JSON["parse"]. ✅ (aliased out of scope)
• eslint-factory: try-block ancestry check is unsound for deferred callbacks #41963 — require-json-parse-try-catch now models deferred-callback boundaries (DEFERRED_SINK_NAMES). ✅

Still valid — keep open

• eslint-factory: no-unsafe-catch-error-property guard is whole-block, causing branch-order false negatives #42189 — sibling whole-block guard branch-order FN (still present; new issue Add workflow: githubnext/agentics/weekly-research #3 above is its promise-rule twin).
• eslint-factory: no-core-setoutput-non-string misses negative/unary numeric literals (e.g. -1, +5) #42680 — no-core-setoutput-non-string misses negative/unary numeric literals (-1, +5): nonStringKind only matches Literal, not UnaryExpression.
• eslint-factory: no-core-setoutput-non-string only recognizes .length; misses .number/.size (live FN in close_entity_helpers.cjs) #42682 — no-core-setoutput-non-string only recognizes .length; .number/.size still slip through.

Next actions

• Fix eslint-factory: no-unsafe-catch-error-property guard is whole-block, causing branch-order false negatives #42189 + the new branch-order twin together (shared guard model).
• Extract shared reporting logic between the two no-unsafe-*-catch-error-property rules to stop future drift.
• Next run: mine a 6th recurring defect class in actions/setup/js and re-verify eslint-factory: no-core-setoutput-non-string misses negative/unary numeric literals (e.g. -1, +5) #42680/eslint-factory: no-core-setoutput-non-string only recognizes .length; misses .number/.size (live FN in close_entity_helpers.cjs) #42682 fixes land.

Generated by 🤖 ESLint Refiner · 253.6 AIC · ⌖ 10.2 AIC · ⊞ 4.7K · ◷

• expires on Jul 2, 2026, 10:35 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by ESLint Refiner.

A newer discussion is available at Discussion #43131.