[eslint-refiner] ESLint Refiner daily report - 2026-09-09

[github-actions[bot]]

Overview

This run surfaced that repo-memory tracking for the ESLint Refiner had gone stale: it last recorded state on 2026-07-08 with a tracked count of 12 rules, but eslint-factory/src/index.ts now registers 61 rules. A significant backlog of open eslint-factory-labeled issues already exists that this memory had never recorded. Memory has been corrected this run; going forward dedup uses the live GitHub issue list as the authoritative source rather than repo-memory's issue log.

Key metrics

• Rules registered: 61 (up from the 12 this memory last tracked)
• Rules deep-reviewed this run: 4 (1 re-verification + 3 new)
• Issues filed this run: 2 (quality-over-cap; both latent/ungrounded but justified by precedent)
• Open eslint-factory-labeled issues found on GitHub (pre-existing, not filed by tracked runs): 10

Confirmed fixes

Both defects found in require-fs-sync-try-catch on 2026-07-08 (destructured/aliased fs binding false negative, and catch-less try/finally treated as protective) are now fixed in the shared try-catch-rule-utils.ts resolver, which benefits all 5 sibling *-sync-try-catch rules. The remaining known gap in that resolver family — a bound fs/child_process variable getting reassigned after initialization — is already tracked in #59377 and #57624; not refiled.

Issues filed this run

1. require-http-response-error-listener (the only rule at "error" severity) can skip its check entirely when the response handler is wired via req.on("response", cb) instead of an inline callback, or when the error listener uses .addListener() instead of .on()/.once().
2. no-duplicate-constant-values applies a size-3 minimum-duplicate-group-size guard to numbers/booleans/null (small value spaces) but a flat size-2 to all strings, including low-entropy short strings like "" or single-character delimiters, which share the same small-value-space risk the rule already accounts for elsewhere.

Both are latent/ungrounded findings (no live false positive/negative currently fires in actions/setup/js/**), filed following the precedent set by #59377 for proactively documented soundness gaps.

Rules investigated and ruled out this run

• require-getexecoutput-exitcode-check: extensively investigated across 10+ live ignoreReturnCode call sites (git_auth_helpers.cjs, create_labels.cjs, check_workflow_recompile_needed.cjs, push_to_pull_request_branch.cjs). All resolved correctly as true positives, true negatives, or intentionally conservative skips (e.g. the arrow-concise-body return-forwarding case in push_to_pull_request_branch.cjs:889-898). No grounded or compelling latent defect found.
• require-fs-sync-try-catch: re-verified only; both prior findings confirmed fixed (see above).

Pre-existing open eslint-factory issues (snapshot, not filed by tracked memory)

• require-fs-close-sync: collectCloseTargetVariables treats property/key names as variable references, can misattribute which desc #59378 — require-fs-close-sync: property/key names misattributed as variable references
• eslint-factory: isIdentifierBoundToFsModule in try-catch-rule-utils.ts does not check for reassignment #59377 — fs resolver: no reassignment check (companion: eslint-factory: isChildProcessObjectBinding (try-catch-rule-utils.ts) doesn't check for reassignment, unlike sibling resolvers #57624 for child_process)
• no-misplaced-error-code-definition: naming heuristic misses error_codes.cjs's dominant ERR_* convention (14/15 constants invisib #59144 — no-misplaced-error-code-definition: naming heuristic misses ERR_* convention
• eslint-factory: require-error-code-for-github-api-throw does not recognize octokit.request() calls #58933 — require-error-code-for-github-api-throw: misses octokit.request()
• prefer-actions-exec-over-child-process: blanket suggestion ignores shell semantics of exec()/execSync() vs @actions/exec's non #58738 / prefer-actions-exec-over-child-process: preferActionsExecSyncContext message overstates the migration cost as a caller-chain cas #58169 / prefer-actions-exec-over-child-process: false negative on synchronous spawnSync used for output capture #58168 — prefer-actions-exec-over-child-process: shell semantics, migration-cost messaging, spawnSync false negative
• no-string-fallback-for-non-string-message: add autofix suggestion (currently diagnostic-only) #58400 — no-string-fallback-for-non-string-message: needs autofix
• no-json-stringify-equality: misses indirect template-literal comparisons (live gap: trace_graders.cjs gradeLoops) #57869 — no-json-stringify-equality: misses indirect template-literal comparisons
• eslint-factory: shared try/catch suggestion builder silently skips VariableDeclaration call sites #57868 — shared try/catch suggestion builder skips VariableDeclaration call sites

Next actions

• Rebuild a full rule-review inventory across the 61 registered rules over the next several runs — memory has only ever reviewed 16 of them.
• Prioritize rules with no open issue and no memory review record over rules already covered by the backlog above.
• Continue treating the live GitHub issue list (via gh api query-string form) as the dedup source of truth, not repo-memory's issue log.
• README rule documentation debt persists (2 of 61 rules documented) — worth a future doc-focused issue or discussion rather than folding into a rule-logic issue.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 ESLint Refiner · claude · agent · 344.7 AIC · ⌖ 7.55 AIC · ⊞ 5.8K · ◷

• expires on Sep 9, 2026, 9:36 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by ESLint Refiner.

A newer discussion is available at Discussion #59893.