Clear the linter's built-in findings, keeping the one that was deliberate

Six warnings from oxlint's default rules, five of them genuinely redundant:
`...(x ?? {})` in an object literal, where spreading undefined is already a
no-op, and a `Boolean()` wrapping an `if` condition.

The sixth is kept. `for (const held of [...this.held.keys()]) this.forget(held)`
looks like a pointless array copy, and oxlint is right that for..of accepts an
iterable directly — but forget() deletes from this.held, so the spread is
what makes the loop iterate a snapshot instead of the map it is mutating.
Disabled on that line with the reason written next to it.

That distinction is the whole reason to read lint output rather than apply
it: a rule that is correct in general was wrong about the one site here where
it mattered, and the site it was wrong about locks every held seed.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN

js/packages/cli/src/agent.ts

@@ -860,7 +860,12 @@ export class AgentDaemon {
         const fp = msg["fingerprint"];
         if (fp === undefined) {
           const n = this.held.size;
-          for (const held of [...this.held.keys()]) this.forget(held);
+          // The spread is deliberate, not redundant: forget() deletes from
+    // this.held, so this iterates a SNAPSHOT of the keys rather than the live
+    // map. oxlint's no-useless-spread is right that for..of accepts an
+    // iterable and wrong that it is safe here.
+    // oxlint-disable-next-line unicorn/no-useless-spread
+    for (const held of [...this.held.keys()]) this.forget(held);
           return { ok: true, locked: n };
         }
         const key = String(fp);

js/packages/cli/src/api/server.ts

@@ -361,7 +361,7 @@ export class ApiServer {
       }
 
       const result = await matched.route.handler(apiReq);
-      this.send(res, { ...result, headers: { ...corsHeaders, ...(result.headers ?? {}) } });
+      this.send(res, { ...result, headers: { ...corsHeaders, ...result.headers } });
     } catch (e) {
       const status = e instanceof HttpError ? e.status : 500;
       // Never let an internal message escape: stack traces and filesystem
@@ -382,7 +382,7 @@ export class ApiServer {
       // framed, sniffed, or cached.
       "cache-control": "no-store",
       "x-content-type-options": "nosniff",
-      ...(response.headers ?? {}),
+      ...response.headers,
     };
     let payload: Uint8Array;
     if (response.bytes) {

js/packages/cli/src/secrets.ts

@@ -53,7 +53,7 @@ export function materializeSecret(
         index: Number(id),
         genVersion: entry.gen_version ?? 1,
         policy: {
-          ...(options.basePolicy ?? {}),
+          ...options.basePolicy,
           ...passwordPolicyFromRecord((entry as { policy?: unknown }).policy),
         },
       });

js/packages/cli/test/api.test.ts

@@ -78,7 +78,7 @@ async function call(
     headers?: Record<string, string>;
   } = {},
 ): Promise<Res> {
-  const headers: Record<string, string> = { ...(opts.headers ?? {}) };
+  const headers: Record<string, string> = { ...opts.headers };
   const token = opts.token === undefined ? TOKEN : opts.token;
   if (token !== null) headers["authorization"] = `Bearer ${token}`;
   if (opts.password !== undefined) headers["x-seedpass-password"] = opts.password;

js/packages/core/src/vault/index0.ts

@@ -736,7 +736,7 @@ function buildCountsView(
     if (!isDict(entry)) continue;
     const kind = normalizeString(entry["kind"] ?? entry["type"] ?? "password");
     if (kind) counts[kind] = (counts[kind] ?? 0) + 1;
-    if (Boolean(entry["archived"] ?? entry["blacklisted"] ?? false)) archivedCount++;
+    if (entry["archived"] ?? entry["blacklisted"] ?? false) archivedCount++;
     timestamps.push(safeInt(entry["modified_ts"] ?? entry["updated"] ?? 0));
   }
   const sorted: Dict = {};