[eslint-refiner] ESLint Refiner Daily Report 2026-10-03

[github-actions[bot]]

ESLint Refiner — Daily Report (2026-10-03)

Overview: ruleCount is unchanged at 64 (no new rule shipped since 2026-10-02). With git-log diffing still dead after 14 consecutive shallow-clone squash artifacts, this run adopted a new discovery method — gh api repos/github/gh-aw/pulls/<PR#>/files — which reads the real changed-file list straight from GitHub regardless of local clone depth. HEAD's PR (#65199, "Fix Codex engine configuration, recovery, and observability gaps") genuinely touches 14 non-test files under actions/setup/js (the codex_*, harness_retry_*, process_runner.cjs, send_otlp_span.cjs, unified_session_payload.cjs family). Auditing those files directly surfaced one grounded rule gap, filed as a new issue. Two older open issues also expired a second time this run, crossing the project's 2-expiry retirement threshold.

Key metrics

Metric	Value
Rules registered	64 (unchanged)
Issues filed today	1
Issues retired (2nd expiry)	2
Open issues remaining (pre-existing)	3

Issue filed

no-unsafe-catch-error-property: rename alias of catch param bypasses unsafe-property detection

The rule tracks unsafe .message/.stack/etc. access only against the catch clause's own parameter name. It never follows a simple rename alias (const err = /** @type {Error} */ error;) created inside the catch block, so property access through the alias escapes detection entirely — even with zero runtime guard. Grounded in 3 live, unguarded sites in codex_harness.cjs (lines 328, 571, 733), all part of today's real PR diff. The sibling rule no-caught-error-interpolation already implements the same one-hop alias resolution this rule is missing, giving a direct template for the fix.

Expired issues (2nd expiry — themes now retired)

• require-fetch-response-body-try-catch: chain-unwrap gap hides .catch()/.then()-chained body reads (recurrence of #61542) #63359 — require-fetch-response-body-try-catch chain-unwrap gap (.catch()/.then()-chained body reads hide from the AwaitExpression visitor). Originally require-fetch-response-body-try-catch: trailing .catch()/.then() on the body-read call hides it from the rule #61542 → refiled as require-fetch-response-body-try-catch: chain-unwrap gap hides .catch()/.then()-chained body reads (recurrence of #61542) #63359 → both expired not_planned with no source fix. Per established policy, this theme is now retired from the rotation; it remains grounded in source (unchanged) but will not be refiled a 3rd time without a fresh angle.
• no-string-fallback-for-non-string-message: false positive on type-narrowed catch-param alias (recurrence of #60757) #62560 — no-string-fallback-for-non-string-message type-narrowed catch-param alias false positive. Originally no-string-fallback-for-non-string-message: false positive on type-narrowed catch-param alias (safeoutputs_cli.cjs:48) #60757 → refiled as no-string-fallback-for-non-string-message: false positive on type-narrowed catch-param alias (recurrence of #60757) #62560 → both expired not_planned. Same retirement policy applies.

Both gaps are still structurally present in the rule source; retirement here reflects filing discipline, not resolution.

Still-open issues (unchanged, re-verified this run)

• no-github-request-interpolated-route: fallback-expression Octokit client aliases (x || github, ternary) bypass client detection #64186 (4d) — no-github-request-interpolated-route: fallback-expression Octokit client aliases (x || github, ternary) bypass client detection.
• no-math-minmax-array-spread: false positive on identifiers holding statically-bounded arrays #63781 (6d) — no-math-minmax-array-spread: false positive on identifiers holding statically-bounded arrays.
• require-escaped-regexp-interpolation: no recognition for regex-fragment constants (5 sites already need manual disable, 1 unsupp #63566 (7d, oldest) — require-escaped-regexp-interpolation: no recognition for regex-fragment constants. At the historical ~1-week first-expiry window — watch for expiry next run.

Other findings this run (not filed)

• codex_config.cjs:105 has an unguarded JSON.parse(...) in loadCompiledConfig() — this is a true positive the rule would already catch if linted (confirms rule correctness, not a rule defect).
• harness_retry_guard.cjs's .exec() regexes have no /g flag — out of scope for require-lastindex-reset-before-global-exec-loop.
• no-caught-error-interpolation re-checked against the same Codex files: correctly out of scope (it only flags bare ${err} interpolation, not .message property reads).

Next actions

• Watch #63566 for expiry next run (oldest open issue, at the typical first-expiry window).
• Apply the new gh api pulls/<PR#>/files method as the primary discovery path whenever ruleCount is flat, ahead of content-rotation re-grep.
• Chronic unresolved (no create_pull_request capability from this workflow): try-catch-rule-utils.ts's shared VariableDeclaration-suggestion gap (affects ~14 rules, twice-filed-and-expired as eslint-factory: shared try/catch suggestion builder silently skips VariableDeclaration call sites #57868/eslint-factory: shared try/catch suggestion builder still skips VariableDeclaration call sites -- recurrence of expired issue 57 #59891) remains a source-level fix proposal that needs a human or PR-capable follow-up — not refiling a 3rd time.
• Strategy and full findings persisted to repo-memory (memory/eslint-refiner branch) for continuity.

Generated by 🤖 ESLint Refiner · claude · agent · 364.6 AIC · ⌖ 6.94 AIC · ⊞ 5.2K · ◷

• expires on Oct 3, 2026, 9:40 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-04T05:40:03.753Z.

Closed by Workflow