FP-FIX(frameworks): eliminate false positives across nextjs/server/tanstack/jotai/preact rules

[aidenybai]

FP-FIX — Framework adapter rules

Part of the false-positive hardening stack. Removes false positives across the framework adapters: nextjs, server, tanstack-query, tanstack-start, jotai, preact, client, view-transitions. The largest slice by file count. Based on #988 (foundation) — merge that first.

Highlights

• nextjs-no-redirect-in-try-catch / tanstack-start-redirect-in-try-catch — a redirect()/notFound() thrown inside a try is only safe when the catch re-throws the caught binding (throw e). Fixed in this slice (see Bugbot below). Local redirect shadows and deferred-callback throws are not flagged.
• query-stable-query-client / query-no-query-in-effect / query-mutation-missing-invalidation / query-destructure-result — TanStack Query patterns narrowed to real misuse.
• jotai-select-atom-in-render-body / jotai-derived-atom-returns-fresh-object — event-handler / memoized callsites of selectAtom aren't flagged.
• server-* (fetch-revalidate, hoist-static-io, mutable-module-state, sequential-await) and nextjs-* (image sizes, inline-script id, no-a-element, client-fetch-for-server-data, client-side-redirect, font-link, script-in-head, side-effect-in-get-handler) tightened. Plus tanstack-start-*, preact-no-children-length, client-*, no-document-start-view-transition.

Bugbot follow-ups

• nextjs: any-throw suppresses — FIXED: requires re-throwing the caught binding, so throw new Error(...) (which swallows the redirect) is reported again.
• tanstack-start: isRedirect() call alone suppresses — FIXED: requires an actual re-throw, not just a guard call.
• jotai handler-name / query inner-helper called during render — declined: closing these requires call-graph analysis (proving a handle*-named fn / lowercase helper actually runs during render), which would reintroduce FPs on the common deferred-handler case. (See threads.)

Eval results

Check	Result
Repos scanned	500 distinct (deduped from repos.json's 8,423 entries)
RootDir scans	467 succeeded / 33 worker failures (giant repos: sentry, appsmith, …)
Target rules	all 34 changed on this branch
Diagnostics	1,603 across 21 firing rules
Manually classified	161 hits (≤10 distinct-repo samples per rule)
False positives found	6 (3.7%) → 2 patterns fixed in 407fdbf5 w/ regression tests, rest documented
Caching	disabled (REACT_DOCTOR_NO_CACHE=1 + fresh RDE spec cache)
Output artifact	.evals/-Users-…-prague.jsonl (RDE), filtered hits in eval comment

Zero-hit audit: the 13 silent rules (incl. all 7 tanstack-start) were probed directly — in-scope corpus code was genuinely clean (every throw redirect an idiomatic beforeLoad guard), and CLI fixtures confirmed each hardened rule still fires on violating shapes while allowing the documented-safe ones. Details in the eval comment.

Test plan

• framework unit + regression suites green
• nextjs redirect e2e fixture still triggers under the stricter rule
• typecheck clean
• RDE eval: 500 distinct OSS repos, 161 hits classified, both systematic FPs fixed
• Full CI after foundation merges + retarget to main

---

Note

Low Risk
Changes are confined to static lint heuristics and regression tests in the plugin; they do not alter application runtime behavior. Residual risk is misclassified diagnostics if new edge cases slip past the expanded analysis.

Overview
Patch release for oxlint-plugin-react-doctor that tightens framework adapter rules (Next.js, server, TanStack Query, Jotai, Preact, client, view transitions) so legitimate patterns stop firing while real violations still report.

Redirect / try-catch — nextjs-no-redirect-in-try-catch (and the parallel TanStack Start rule) now resolves real next/navigation imports, ignores shadowed locals, and uses findGuardingTryStatement so catches that re-throw the caught error, bare try/finally, and deferred callbacks are not treated as swallowing; throw new Error in catch still flags.

Effects & mounts — Client fetch/redirect-in-useEffect rules follow IIFEs, immediately invoked locals, and promise chains run on mount, but skip event handlers, cleanup, and later-fired callbacks via collectEffectInvokedFunctions / containsFetchCall boundaries.

Server — server-hoist-static-io taints request-derived paths through destructuring and bindings; server-no-mutable-module-state only reports const containers that are actually mutated (aliases, nested writes, one-hop same-file helpers); server-fetch-without-revalidate abstains on non-literal or spread options; server-sequential-independent-await ignores auth/connect gates and already-started promises; GET handler side-effect detection follows one same-file helper hop and no longer flags read-only “mutating” route names alone.

TanStack Query / Jotai — Invalidation recognizes scoped invalidateQueries and tRPC use*Utils → .invalidate(); destructure-result distinguishes forwarding the whole query from field reads; raw *QueryAtom imports require envelope-shaped consumption; selectAtom / derived-atom rules add memo, effect, handler, and reference-stability escape hatches.

Next.js & client UX — Image/script rules respect JSX spreads; anchors skip //, downloads, and _blank; passive listeners resolve handlers for preventDefault and explicit passive; localStorage versioning accepts camelCase V2 keys; Preact children checks gate on component-like functions.

Regression tests were added across these rules; changeset notes validation on 500 OSS repos.

^{Reviewed by Cursor Bugbot for commit 5b1b879. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@995

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@995

npm i https://pkg.pr.new/react-doctor@995

commit: 5b1b879

[rayhanadev]

Pushed a follow-up deslop / consolidation commit (a246ff1d) on top of the FP fixes. The hardening pass had copy-pasted the same helpers across many rules, so this collapses them:

• 4 new shared utils — find-enclosing-function, get-function-binding-name, collect-handler-referenced-names, catch-clause-rethrows-caught — plus a HOOK_NAME_PATTERN constant, replacing inline copies across ~6 / 4 / 2 / 2 rules (collect-handler-referenced-names was a verbatim jotai↔navigate port).
• Reuse existing utils (isFunctionLike, getCalleeName, findJsxAttribute) in place of re-implemented inline copies; dropped one nested ternary.

Behaviour-preserving: full plugin suite unchanged (7409 passing / 88 skipped), typecheck + lint + format clean, react-doctor --staged 100/100. Net −208 lines (+194 / −402 across 19 files).

[rayhanadev]

RDE eval results (500 distinct OSS repos, cache disabled)

Check	Result
Repos scanned	500 distinct (deduped from repos.json)
RootDir scans	467 succeeded, 33 worker failures (giant repos: sentry, appsmith, …)
Target rules	all 34 changed on this branch
Diagnostics	1,603 across 21 firing rules
Manually classified	161 hits (≤10 distinct-repo samples/rule)
False positives	6 confirmed (3.7%) → 2 patterns fixed in 407fdbf5, 1 deferred
Artifacts	.evals/-Users-…-prague.jsonl, /tmp/rde-target-hits.json

Fixed from eval findings (with regression tests):

• server-hoist-static-io: request-derived paths through intermediate bindings (params → pathArray → filePath → fullPath) no longer flagged — taint now propagates through declarations (3/10 sampled hits were this FP).
• query-mutation-missing-invalidation: tRPC's utils.x.invalidate() now counts as cache invalidation.

Deferred (documented limits): helper-wrapped invalidation (invalidateDashboardQueries(queryClient)) needs same-file call resolution; nextjs-no-side-effect-in-get-handler can flag method-branched shared handlers (export { handle as GET, handle as POST }).

Zero-hit audit: 13 silent rules verified — corpus route files in scanned rootDirs contained no violations (all throw redirect sites were idiomatic beforeLoad guards), and CLI probes confirmed the hardened rules still fire on violating shapes (bare-catch redirect swallow → flags; isRedirectError rethrow → silent, which the old rule false-positived).

Suite: 7412 passed / 88 skipped, typecheck + format clean.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5b1b879. Configure here.}

[cursor]

Sync helper skips redirect try check

Medium Severity

findGuardingTryStatement stops at any nested function that is not an IIFE, so a redirect() or router throw redirect() inside a helper that the try block calls synchronously (for example function load() { … } then load(), or const go = () => …; go()) is treated as outside the try. The redirect-in-try-catch rules then stay silent even though the surrounding catch still swallows the control-flow error.

Additional Locations (2)

• packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-redirect-in-try-catch.ts#L27-L28
• packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-redirect-in-try-catch.ts#L25-L26

 

^{Reviewed by Cursor Bugbot for commit 5b1b879. Configure here.}