mcp: fix and improve lint rules and error capture from the October 2026 audit #332

Context

This comes from a code audit of errors, lint rules and audits, done during a comparison with other devtools in October 2026. Roadmap items live in #310, #311, #312 and #313. Items marked (to confirm) were not reproduced; every problem below was checked against the code on main.

Problems

Medium

• email-in-url leaks the email: the finding sets route: emailed.url, so the address the rule warns about is sent to the panel and agents. redactUrl does not mask email addresses, so the same URL also shows in the navigation list. Mask emails in the finding (for example [email]), or report the route pattern only, and consider masking emails in redactUrl too (packages/devtools/src/rpc/router-config-tools.ts:530-536, packages/devtools/src/router.ts:290).

Low

• forms rejection attribution: while submittingForm is set, any unhandledrejection on the page is recorded as a threw submit event for that form, even when it is unrelated. Attribute only rejections that come from the submission action, for example by wrapping the action's promise (packages/devtools/src/forms-collector.ts:329, 349, 608-622).
• hydration capture redacts first: the HTTP hydration console patch runs redactMessage over up to 5000 characters on every console.warn and console.error, before isHydrationMessage checks the text. Check first, then redact (packages/devtools/src/http.ts:355-359).
• impure-pipe-in-for misses *ngFor: forBlocks only matches @for (, so templates that still use *ngFor never get the finding. Also match *ngFor host elements, or parse templates with @angular/compiler parseTemplate (packages/devtools/src/rpc/pipe-lint.ts:108-123).
• forms NG code regex: setupErrorOf uses /NG0?1\d{3}/ with no word boundary, so it also matches NG1xxx and codes inside longer tokens, while the hydration regex uses \b. Use /\bNG01\d{3}\b[^\n]*/ and share one NG code parser (packages/devtools/src/forms-collector.ts:95-103).

Improvements

• Server-side errors: capture SSR render errors in the SSR middleware and Vite dev-server errors in the Vite plugin, so agents see compile and SSR failures (packages/devtools/src/ssr-middleware.ts, packages/devtools/src/vite.ts).
• Template diagnostics: run Angular's extended diagnostics (nullish coalescing on a non-nullable value, signal not invoked in an interpolation, missing control flow import) through the Vite plugin and expose them as a lint-templates agent tool, registered in config.ts (packages/devtools/src/vite.ts, packages/devtools/src/config.ts).
• Perf collector: PerformanceObserver for LCP, CLS, INP and long tasks, with long tasks matched to change detection cycles, and findings in the shared { rule, severity, fix } shape, including a missing or $index @for track rule (packages/devtools/src/cd-recorder.ts, packages/devtools/src/rpc/cd-tools.ts).
• Lazy chunk sizes from the Vite or esbuild metafile, reported per lazy route (packages/devtools/src/vite.ts, packages/devtools/src/rpc/router-config-tools.ts).
• Let users turn rules off in the devtools config (lint: { rules: { 'missing-title': 'off' } }), applied by every lint tool and documented in apps/docs (packages/devtools/src/config.ts, packages/devtools/src/rpc/forms-lint.ts, packages/devtools/src/rpc/pipe-lint.ts, packages/devtools/src/rpc/router-config-tools.ts).
• JSON and SARIF export of lint findings for CI, through the CLI (packages/devtools/src/cli.ts).

Already tracked elsewhere

• Runtime error capture (ErrorHandler, error, unhandledrejection, NG0xxx codes, errors panel and agent tools): phase 3 of 4: a devframe shell as good as Vue and Nuxt DevTools #312.
• Replacing the three stacked console patches with one shared console tap: phase 3 of 4: a devframe shell as good as Vue and Nuxt DevTools #312.
• An axe pass over the inspected app: phase 4 of 4: lead where no Angular devtools goes today #313.
• One audit entry point with a single list of findings across lint tools: phase 4 of 4: lead where no Angular devtools goes today #313.