From 1337e2d3ee3ed390f08edb535a1f1f3f902a063e Mon Sep 17 00:00:00 2001 From: thePR0M3TH3AN Date: Thu, 20 Aug 2026 15:20:49 -0400 Subject: [PATCH] Add a prioritized NEXT section, so the open items are findable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Everything recorded over this session accumulated inside a nested sub-list under "Independent security review", which is no longer where most of it belongs — the agent not running on Windows is a platform gap, not a review finding. Eleven open items now have a scannable entry point at the top of the TypeScript section, ordered by what a TypeScript-only product cannot ship with, with the detail left where it already lives. The ordering reflects the change in what this repository is: Python is now the oracle the port is validated against rather than the product, so Python-side items are marked as keeping the oracle working rather than improving what ships. Two of them may resolve by deletion rather than by fixing. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN --- TODO.md | 61 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) diff --git a/TODO.md b/TODO.md index 23538422..78de253e 100644 --- a/TODO.md +++ b/TODO.md @@ -125,6 +125,67 @@ Branch state as of 2026-08-17: core + CLI + interactive TUI are feature-complete for daily use and cross-verified against Python on every change. What follows is everything still open, in the order it should be tackled. +### NEXT — open items as of 2026-08-20 + +TypeScript is the implementation going forward; Python is now the reference +oracle the port is validated against, not the product. That reframes some of +what follows, and each item says which side it is on. Detail for every entry +is further down this file. + +**P0 — a TypeScript-only product cannot ship with these open** + +1. **The session agent does not run on Windows.** `listen EACCES`: Node needs + a named pipe there, not a filesystem path. No `seedpass agent` means no + held seeds, no tokens, no high-risk sessions and no sink delivery. NOT a + path substitution — the agent's access control IS the socket's 0600 mode, + so this is a security design decision about what replaces it. Four test + files are excluded on Windows meanwhile. +2. **Are vault files protected from other users on Windows?** Ten `0600` + assertions across both languages are now skipped there, including the + vault index and the semantic index, which hold secrets. Windows has no + POSIX mode bits; these files inherit directory ACLs instead. Either verify + the inherited ACL is user-scoped and assert THAT, or set one explicitly. + +**P1 — security decisions, each needing a call rather than a fix** + +3. **An unencrypted portable backup is unauthenticated**, and import accepts + it silently. Its checksum and fingerprint both live in the same + attacker-supplied file. Python behaves identically, so this is a shared + design property — whatever is decided has to land on both sides. +4. **The API's settable config keys are a superset of Python's.** Deliberate + (TypeScript can set the password-policy keys Python's API cannot), but it + IS a divergence: a client setting a policy key succeeds here and gets 400 + there. Widen Python or document the surfaces as non-identical. + +**P2 — correctness and coverage** + +5. **`src/nostr/client.py` needs migrating to nostr-sdk 0.44+.** Pinned at + `<0.44` because 0.44 removed `NostrSigner.keys` and changed `Client`'s + constructor. Oracle-side: it has to keep working for parity testing. +6. **`textual` is an undeclared dependency**, so the entire TUI test surface + skips on Linux and macOS and has been passing by not running. Decide + whether the TUI is supported or optional — and note that if Python is + retiring, this may resolve by deletion rather than by fixing. +7. **`manager.py` sits 0.74 points above its coverage floor**, and its + uncovered half is interactive prompt handling. Raising it honestly means + extracting logic out of the `input()` loops. +8. **A nested export path answers 500 instead of a refusal.** `atomicWrite` + does not create parent directories; the path is caller-supplied, so this + should be a 400 naming the missing directory. +9. **The JavaScript SBOM needs a pnpm-native generator.** The old step used + the npm tool against a pnpm workspace and never produced anything. + +**P3 — now cheap, given today's results** + +10. **Promote the reproducible-build check from experiment to required.** All + three platforms produced a byte-identical bundle + (`4915bb47…`), so the invariant holds. Remove + `continue-on-error` from the `reproducible` job in ts-platform.yml. +11. **Slim ts-parity.yml.** Its `parity` job now duplicates ts-platform's + Ubuntu work (typecheck, tests, build, smoke, pack). Left alone + deliberately so a new workflow and a restructure did not land together; + safe to do now that ts-platform is green on all three. + ### Blockers before real secrets - [~] **Independent security review — restated, since there is no third party.**