fix: satisfy the two rules @eslint/js 10 turns on

The bump was red because eslint 10's recommended set adds
`preserve-caught-error` and `no-useless-assignment`, and nine existing
sites break them. Both findings are real, so they are fixed rather than
silenced.

preserve-caught-error (5) — settings loading (twice), the directory
trust store, the hook trust file, and the MCP `headersHelper` each
wrapped a caught error in a new Error carrying only `.message`. A
JSON parse failure or a spawn error therefore arrived with its stack,
`errno` and `path` gone: the message says "Failed to parse ~/.deepcode/
settings.json: Unexpected token" and nothing says which byte, or that
the real failure was EACCES. Each now passes `{ cause }`.

no-useless-assignment (4) — `patch`/`binary` in workspace-diff and
`stdout` in the Grep tool were initialised and then overwritten on every
path that reads them; the initialisers only suppressed TypeScript's
definite-assignment analysis. Dropping them lets tsc prove what the
initialiser was papering over, and it does. In `parseQName` the `pos++`
before `break` consumed the DNS root label for a variable nothing reads
after the loop.

Note eslint itself was already 10.8.0 in the lockfile — only `@eslint/js`
was pinned at 9, so the repo was running a v10 engine against a v9
recommended config. This closes that gap.

typecheck, lint, format, docs clean; 1671 tests pass, 19 skipped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: oratis

CHANGELOG.md

@@ -181,6 +181,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### 🐛 Fixed
 
+- **A rethrown error keeps the one that caused it.** Five places wrapped a
+  caught error in a new `Error` carrying only its `.message` — settings and
+  trust-store loading, the hook trust file, and the MCP `headersHelper` — so a
+  parse failure or a spawn error arrived with the original stack, `errno` and
+  `path` discarded. They now pass `{ cause }`, and ESLint's `preserve-caught-error`
+  keeps the next one from being written.
+
 - **Tool output could flood the model's context, or vanish** (#268). Two defects,
   one cause: nothing central bounded what a tool result put in front of the
   model, so each tool improvised.

apps/server/src/workspace-diff.ts

@@ -35,8 +35,8 @@ export async function collectWorkspaceDiff(cwd: string): Promise<WorkspaceDiffRe
   const files: WorkspaceDiffFile[] = [];
 
   for (const entry of selected) {
-    let patch = '';
-    let binary = false;
+    let patch: string;
+    let binary: boolean;
     let fileTruncated = false;
     if (entry.untracked || !hasHead) {
       const captured = await addedFilePatch(workspace, entry.path, remainingBytes);

packages/core/src/config/hook-trust.ts

@@ -38,7 +38,9 @@ export class HookTrustStore {
       if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
         return { version: 1, directories: {} };
       }
-      throw new Error(`Failed to load hook trust: ${(error as Error).message}`);
+      throw new Error(`Failed to load hook trust: ${(error as Error).message}`, {
+        cause: error,
+      });
     }
   }
 

packages/core/src/config/loader.ts

@@ -93,7 +93,7 @@ async function readJson(path: string): Promise<DeepCodeSettings | undefined> {
   } catch (err) {
     const code = (err as NodeJS.ErrnoException).code;
     if (code === 'ENOENT') return undefined;
-    throw new Error(`Failed to parse ${path}: ${(err as Error).message}`);
+    throw new Error(`Failed to parse ${path}: ${(err as Error).message}`, { cause: err });
   }
 }
 
@@ -104,7 +104,9 @@ async function readJsonRequired(path: string): Promise<DeepCodeSettings> {
     const raw = await fs.readFile(path, 'utf8');
     return parseSettings(raw, path);
   } catch (err) {
-    throw new Error(`--settings: cannot load ${path}: ${(err as Error).message}`);
+    throw new Error(`--settings: cannot load ${path}: ${(err as Error).message}`, {
+      cause: err,
+    });
   }
 }
 

packages/core/src/config/trust-store.ts

@@ -33,7 +33,9 @@ export class DirectoryTrustStore {
       return validateState(parsed);
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { dirs: {} };
-      throw new Error(`Failed to load directory trust: ${(error as Error).message}`);
+      throw new Error(`Failed to load directory trust: ${(error as Error).message}`, {
+        cause: error,
+      });
     }
   }
 

packages/core/src/mcp/client.ts

@@ -153,7 +153,7 @@ async function resolveAuthHeaders(config: McpServerConfig): Promise<Record<strin
       });
       Object.assign(headers, parseHelperOutput(stdout));
     } catch (err) {
-      throw new Error(`headersHelper failed: ${(err as Error).message}`);
+      throw new Error(`headersHelper failed: ${(err as Error).message}`, { cause: err });
     }
   }
   return headers;

packages/core/src/sandbox/dns-proxy.ts

@@ -91,10 +91,9 @@ export function parseQName(buf: Buffer): string | null {
   while (pos < buf.length) {
     const len = buf[pos];
     if (len === undefined) return null;
-    if (len === 0) {
-      pos++;
-      break;
-    }
+    // The root label ends the name. `pos` is not read after the loop, so
+    // there is nothing left to consume it for.
+    if (len === 0) break;
     if (len > 63) return null; // compression / invalid
     pos++;
     if (pos + len > buf.length) return null;

packages/core/src/tools/grep.ts

@@ -145,7 +145,7 @@ export const GrepTool: ToolHandler = {
 
     args.push('--', input.pattern, searchPath);
 
-    let stdout = '';
+    let stdout: string;
     try {
       const result = await execFileAsync('rg', args, {
         cwd: ctx.cwd,