diff --git a/CHANGELOG.md b/CHANGELOG.md
index 74fcf8f..4567472 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -181,6 +181,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### 🐛 Fixed
 
+- **A rethrown error keeps the one that caused it.** Five places wrapped a
+  caught error in a new `Error` carrying only its `.message` — settings and
+  trust-store loading, the hook trust file, and the MCP `headersHelper` — so a
+  parse failure or a spawn error arrived with the original stack, `errno` and
+  `path` discarded. They now pass `{ cause }`, and ESLint's `preserve-caught-error`
+  keeps the next one from being written.
+
 - **Tool output could flood the model's context, or vanish** (#268). Two defects,
   one cause: nothing central bounded what a tool result put in front of the
   model, so each tool improvised.
diff --git a/apps/server/src/workspace-diff.ts b/apps/server/src/workspace-diff.ts
index 9b878c2..5fc83c0 100644
--- a/apps/server/src/workspace-diff.ts
+++ b/apps/server/src/workspace-diff.ts
@@ -35,8 +35,8 @@ export async function collectWorkspaceDiff(cwd: string): Promise<WorkspaceDiffRe
   const files: WorkspaceDiffFile[] = [];
 
   for (const entry of selected) {
-    let patch = '';
-    let binary = false;
+    let patch: string;
+    let binary: boolean;
     let fileTruncated = false;
     if (entry.untracked || !hasHead) {
       const captured = await addedFilePatch(workspace, entry.path, remainingBytes);
diff --git a/package.json b/package.json
index e8c005a..ec7a61e 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "prepare": "husky || true"
   },
   "devDependencies": {
-    "@eslint/js": "^9.16.0",
+    "@eslint/js": "^10.0.1",
     "@types/node": "^22.10.0",
     "eslint": "^10.8.0",
     "husky": "^9.1.0",
diff --git a/packages/core/src/config/hook-trust.ts b/packages/core/src/config/hook-trust.ts
index 799a92a..82c3a29 100644
--- a/packages/core/src/config/hook-trust.ts
+++ b/packages/core/src/config/hook-trust.ts
@@ -38,7 +38,9 @@ export class HookTrustStore {
       if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
         return { version: 1, directories: {} };
       }
-      throw new Error(`Failed to load hook trust: ${(error as Error).message}`);
+      throw new Error(`Failed to load hook trust: ${(error as Error).message}`, {
+        cause: error,
+      });
     }
   }
 
diff --git a/packages/core/src/config/loader.ts b/packages/core/src/config/loader.ts
index d06a14d..ca233cb 100644
--- a/packages/core/src/config/loader.ts
+++ b/packages/core/src/config/loader.ts
@@ -93,7 +93,7 @@ async function readJson(path: string): Promise<DeepCodeSettings | undefined> {
   } catch (err) {
     const code = (err as NodeJS.ErrnoException).code;
     if (code === 'ENOENT') return undefined;
-    throw new Error(`Failed to parse ${path}: ${(err as Error).message}`);
+    throw new Error(`Failed to parse ${path}: ${(err as Error).message}`, { cause: err });
   }
 }
 
@@ -104,7 +104,9 @@ async function readJsonRequired(path: string): Promise<DeepCodeSettings> {
     const raw = await fs.readFile(path, 'utf8');
     return parseSettings(raw, path);
   } catch (err) {
-    throw new Error(`--settings: cannot load ${path}: ${(err as Error).message}`);
+    throw new Error(`--settings: cannot load ${path}: ${(err as Error).message}`, {
+      cause: err,
+    });
   }
 }
 
diff --git a/packages/core/src/config/trust-store.ts b/packages/core/src/config/trust-store.ts
index d883023..28be849 100644
--- a/packages/core/src/config/trust-store.ts
+++ b/packages/core/src/config/trust-store.ts
@@ -33,7 +33,9 @@ export class DirectoryTrustStore {
       return validateState(parsed);
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { dirs: {} };
-      throw new Error(`Failed to load directory trust: ${(error as Error).message}`);
+      throw new Error(`Failed to load directory trust: ${(error as Error).message}`, {
+        cause: error,
+      });
     }
   }
 
diff --git a/packages/core/src/mcp/client.ts b/packages/core/src/mcp/client.ts
index 7985e62..2ea22ec 100644
--- a/packages/core/src/mcp/client.ts
+++ b/packages/core/src/mcp/client.ts
@@ -153,7 +153,7 @@ async function resolveAuthHeaders(config: McpServerConfig): Promise<Record<strin
       });
       Object.assign(headers, parseHelperOutput(stdout));
     } catch (err) {
-      throw new Error(`headersHelper failed: ${(err as Error).message}`);
+      throw new Error(`headersHelper failed: ${(err as Error).message}`, { cause: err });
     }
   }
   return headers;
diff --git a/packages/core/src/sandbox/dns-proxy.ts b/packages/core/src/sandbox/dns-proxy.ts
index ea18090..eee0096 100644
--- a/packages/core/src/sandbox/dns-proxy.ts
+++ b/packages/core/src/sandbox/dns-proxy.ts
@@ -91,10 +91,9 @@ export function parseQName(buf: Buffer): string | null {
   while (pos < buf.length) {
     const len = buf[pos];
     if (len === undefined) return null;
-    if (len === 0) {
-      pos++;
-      break;
-    }
+    // The root label ends the name. `pos` is not read after the loop, so
+    // there is nothing left to consume it for.
+    if (len === 0) break;
     if (len > 63) return null; // compression / invalid
     pos++;
     if (pos + len > buf.length) return null;
diff --git a/packages/core/src/tools/grep.ts b/packages/core/src/tools/grep.ts
index 366ce64..8cbd3ac 100644
--- a/packages/core/src/tools/grep.ts
+++ b/packages/core/src/tools/grep.ts
@@ -145,7 +145,7 @@ export const GrepTool: ToolHandler = {
 
     args.push('--', input.pattern, searchPath);
 
-    let stdout = '';
+    let stdout: string;
     try {
       const result = await execFileAsync('rg', args, {
         cwd: ctx.cwd,
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 9b75435..f62c4bf 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -9,8 +9,8 @@ importers:
   .:
     devDependencies:
       '@eslint/js':
-        specifier: ^9.16.0
-        version: 9.39.4
+        specifier: ^10.0.1
+        version: 10.0.1(eslint@10.8.0(jiti@1.21.7))
       '@types/node':
         specifier: ^22.10.0
         version: 22.19.19
@@ -445,9 +445,14 @@ packages:
     resolution: {integrity: sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
-  '@eslint/js@9.39.4':
-    resolution: {integrity: sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+  '@eslint/js@10.0.1':
+    resolution: {integrity: sha512-zeR9k5pd4gxjZ0abRoIaxdc7I3nDktoXZk2qOv9gCNWx3mVwEn32VRhyLaRsDiJjTs0xq/T8mfPtyuXu7GWBcA==}
+    engines: {node: ^20.19.0 || ^22.13.0 || >=24}
+    peerDependencies:
+      eslint: ^10.0.0
+    peerDependenciesMeta:
+      eslint:
+        optional: true
 
   '@eslint/object-schema@3.0.5':
     resolution: {integrity: sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw==}
@@ -2760,7 +2765,9 @@ snapshots:
     dependencies:
       '@types/json-schema': 7.0.15
 
-  '@eslint/js@9.39.4': {}
+  '@eslint/js@10.0.1(eslint@10.8.0(jiti@1.21.7))':
+    optionalDependencies:
+      eslint: 10.8.0(jiti@1.21.7)
 
   '@eslint/object-schema@3.0.5': {}