[eslint-refiner] ESLint Refiner — Daily Report (2026-08-27)

[github-actions[bot]]

Reviewed the two least-scrutinized rules in eslint-factory (require-mkdtempsync-try-catch, require-decodeuricomponent-try-catch), plus a cross-cutting sweep for a message-wording defect known to have already recurred once. Filed 2 non-duplicate issues; found the rule set is otherwise sound on live grounding.

Key metrics

• Rules in index.ts: 60 (up from 12 tracked in this workflow's last local memory sync — most of that growth came from the sibling eslint-miner workflow, which has been adding roughly one new rule per day)
• Issues filed today: 2
• Live call sites checked: 5 (decodeURIComponent/decodeURI) + 9 (fs.mkdtempSync) across non-test actions/setup/js/**/*.cjs
• True negatives confirmed: 1 decode call + 6 mkdtemp calls, all already correctly wrapped in try/catch
• Live true positives (real, currently-unwrapped call sites the rules correctly flag — app bugs, not rule bugs, out of scope for this workflow): 3 decodeURIComponent sites, 3 mkdtempSync sites

Issues filed

1. [HIGH, systemic] 11 sibling rules — including both reviewed today — still say a call "will crash the action if unhandled." That's an overclaim: every actions/setup/js entrypoint has a top-level try/catch that routes uncaught throws to core.setFailed, so the real value of wrapping is preserving { cause }/message context, not preventing a crash. This exact wording was already fixed once for require-fetch-response-body-try-catch (eslint-factory: require-fetch-response-body-try-catch — "will crash the action" message overclaims given the codebase's entrypoi [Content truncated due to length] #52644) but never propagated to siblings, and has since recurred in 2 newly-added rules. Asked for a reword-all pass plus a guard (shared constant or a meta-test) so it can't recur a third time.
2. [MED, latent] require-decodeuricomponent-try-catch only treats string literals/static concatenations as provably safe; numeric/boolean/null literal arguments (e.g. decodeURIComponent(42)) can never throw but get flagged anyway. Zero live occurrences, but cheap to close now — mirrors an already-fixed class of bug in prefer-number-isnan.

Detail

Grounding notes (rule-by-rule)

require-decodeuricomponent-try-catch — 5 live non-test call sites:

• update_release.cjs:40, send_otlp_span.cjs:784-785, artifact_client.cjs:175 — unwrapped; rule correctly flags these (app-level bugs, not rule bugs; out of this workflow's scope).
• send_otlp_span.cjs:495 — already wrapped; correct true negative.
• No alias-blindspot found live (= decodeURIComponent grep came back empty), so that theoretical gap wasn't filed.

require-mkdtempsync-try-catch — 9 live non-test call sites:

• 6 correctly wrapped (check_daily_aic_workflow_guardrail.cjs:282, generate_git_bundle.cjs:259/264 — enclosed by an outer try spanning lines 151-491, memory_custom_validation.cjs:61, fuzz_template_substitution_harness.cjs:68, artifact_client.cjs:54).
• 3 unwrapped and correctly flagged (start_mcp_gateway.cjs:154, restore_aic_usage_cache_fallback.cjs:166, operational_value_grader.cjs:151) — real diagnostics, not rule defects.

Continuity note: this workflow's local repo-memory had gone stale since 2026-07-08 even though the workflow kept running and filing issues daily (verified via GitHub issue search on the eslint-refiner tracker ID, 100 issues found through 2026-08-26). Memory has been rebuilt from that ground truth and now records the gap explicitly so future runs don't need to re-derive it.

Next actions

• Re-check for a second page of tracker-id search results next run (count hit exactly 100 today, the API page cap).
• Candidates for next review, based on lowest historical issue-search hit counts: no-throw-plain-object, no-json-stringify-equality, no-unsafe-promise-catch-error-property, prefer-get-error-message-over-string, require-fs-close-sync, require-execfilesync-try-catch, require-fs-io-try-catch, require-fetch-timeout, require-error-code-for-github-api-throw.
• Verify the "will crash the action" reword lands across all 11 files (not just a subset) once picked up.

Generated by 🤖 ESLint Refiner · claude · agent · 223.2 AIC · ⌖ 7.75 AIC · ⊞ 5.8K · ◷

• expires on Aug 27, 2026, 11:56 PM UTC-08:00