[eslint-refiner] ESLint Refiner Daily Report — 2026-07-15

[github-actions[bot]]

Overview

Reviewed the two newest ESLint factory rules that had never been analyzed before (identified as the README-undocumented set). The rule count has grown 12 → 17 since the last recorded run (2026-07-08); note the state was stale — a Refiner run also happened on 2026-07-14 (discussion #45388) and its findings are already tracked as open issues.

Filed 2 non-duplicate refinement issues (quality over the cap of 3), both grounded in real call sites in actions/setup/js.

Key metrics

Metric	Value
Rules total	17 (gh-aw-custom/*, all warn)
New rules since 07-08	5
Reviewed this run	2 (no-throw-plain-object, no-core-exportvariable-non-string)
Issues filed	2
Already-covered new rules (skipped)	3 (open issues #45586, #45405, #45206)

Filed issues

1. no-throw-plain-object — exempt intentional JSON-RPC error throws (HIGH)

100% of the sites this rule flags in the linted corpus are the deliberate JSON-RPC error idiom throw { code: <negative int>, message: <string>, data?: {...} } — 22 sites across mcp_server_core.cjs (10) and safe_outputs_handlers.cjs (12). These objects are consumed by field, not by stack trace: the dispatcher catch at mcp_server_core.cjs:828-842 reads err.code/err.message to build a conformant JSON-RPC response. There are currently zero accidental ad-hoc object throws for the rule to catch, so every warning it produces is noise on intentional protocol code. Proposed: exempt the JSON-RPC shape while keeping the regression guard for genuine bad throws.

2. no-core-exportvariable-non-string — recognize the coreObj alias (MED)

The rule only matches callee.object.name === "core", so it is structurally blind to coreObj.exportVariable(...) — diverging from the plugin's own CORE_ALIASES = {core, coreObj} convention used by require-return-after-core-setfailed and require-await-core-summary-write. Grounded blind sites: parse_mcp_gateway_log.cjs:214/220. Both currently pass strings (.toFixed/String), so this is a coverage/consistency gap, not a live bug — filed accordingly.

Reviewed but NOT filed (grounded reasoning)

• require-spawnsync-error-check false-positive angle — Distinct from open issue [Code Quality] Fix ESLint require-spawnsync-error-check: misses destructured spawnSync and weak error guards #45586 (which targets false negatives): the rule flags status-inequality guards like if (result.status !== 0) throw even though status !== 0 already treats spawn failure (status === null) as fatal. At artifact_client.cjs:163/170 the code throws a clear "zip command is required" message on ENOENT; following the rule's suggestion would degrade that diagnostic. However this is in tension with [Code Quality] Fix ESLint require-spawnsync-error-check: misses destructured spawnSync and weak error guards #45586 (which calls artifact_client.cjs a true-positive site), and there IS a genuine true positive at apply_samples.cjs:97 ("exit ${result.status}" → misleading "exit null"). Raising here rather than filing a competing issue.
• no-core-exportvariable-non-string value gaps — Inherits the sibling no-core-setoutput-non-string gap (misses unary/negative numeric literals, e.g. -1). No grounded non-string exportVariable site exists in the corpus (all values are strings), so not filed per the ground-before-filing discipline.
• no-throw-plain-object / require-return-after-core-setfailed static-flow analysis — the complex control-flow rule appears robust; no grounded defect found without a live lint run (npm is firewalled in this environment).

Method & environment notes

No live lint is possible (no node_modules/dist, npm firewalled). All findings are grounded statically via grep over non-test .cjs files in actions/setup/js (the config ignores *.test.cjs) plus the rule sources and tests. Strategy and per-run history persisted to repo-memory (state.json + history.jsonl, validated at 11 KB / 12 KB limit).

Next actions

• Next run: re-diff index.ts rules against the reviewed set; lead with any newer/undocumented rule.
• Once value-coercion rules stabilize, consider a consolidated issue for the shared unary/negative-numeric-literal + alias gap (needs a grounded non-string site first).
• Consider grounding the next new defect class: fs sync method-scope expansion (mkdirSync/readdirSync unwrapped) or String.replace without /g.

References:

• §29392768175
• Prior report — discussion #45388

Generated by 🤖 ESLint Refiner · 392.4 AIC · ⌖ 12.9 AIC · ⊞ 4.6K · ◷

• expires on Jul 15, 2026, 10:11 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by ESLint Refiner.

A newer discussion is available at Discussion #45930.