diff --git a/js/packages/cli/src/agent.ts b/js/packages/cli/src/agent.ts
index 8a6eb8d2..fea732d9 100644
--- a/js/packages/cli/src/agent.ts
+++ b/js/packages/cli/src/agent.ts
@@ -860,7 +860,12 @@ export class AgentDaemon {
         const fp = msg["fingerprint"];
         if (fp === undefined) {
           const n = this.held.size;
-          for (const held of [...this.held.keys()]) this.forget(held);
+          // The spread is deliberate, not redundant: forget() deletes from
+    // this.held, so this iterates a SNAPSHOT of the keys rather than the live
+    // map. oxlint's no-useless-spread is right that for..of accepts an
+    // iterable and wrong that it is safe here.
+    // oxlint-disable-next-line unicorn/no-useless-spread
+    for (const held of [...this.held.keys()]) this.forget(held);
           return { ok: true, locked: n };
         }
         const key = String(fp);
diff --git a/js/packages/cli/src/api/server.ts b/js/packages/cli/src/api/server.ts
index 88160f66..399a6dc9 100644
--- a/js/packages/cli/src/api/server.ts
+++ b/js/packages/cli/src/api/server.ts
@@ -361,7 +361,7 @@ export class ApiServer {
       }
 
       const result = await matched.route.handler(apiReq);
-      this.send(res, { ...result, headers: { ...corsHeaders, ...(result.headers ?? {}) } });
+      this.send(res, { ...result, headers: { ...corsHeaders, ...result.headers } });
     } catch (e) {
       const status = e instanceof HttpError ? e.status : 500;
       // Never let an internal message escape: stack traces and filesystem
@@ -382,7 +382,7 @@ export class ApiServer {
       // framed, sniffed, or cached.
       "cache-control": "no-store",
       "x-content-type-options": "nosniff",
-      ...(response.headers ?? {}),
+      ...response.headers,
     };
     let payload: Uint8Array;
     if (response.bytes) {
diff --git a/js/packages/cli/src/secrets.ts b/js/packages/cli/src/secrets.ts
index 2283878f..d0cd1369 100644
--- a/js/packages/cli/src/secrets.ts
+++ b/js/packages/cli/src/secrets.ts
@@ -53,7 +53,7 @@ export function materializeSecret(
         index: Number(id),
         genVersion: entry.gen_version ?? 1,
         policy: {
-          ...(options.basePolicy ?? {}),
+          ...options.basePolicy,
           ...passwordPolicyFromRecord((entry as { policy?: unknown }).policy),
         },
       });
diff --git a/js/packages/cli/test/api.test.ts b/js/packages/cli/test/api.test.ts
index bde4eec0..3138446c 100644
--- a/js/packages/cli/test/api.test.ts
+++ b/js/packages/cli/test/api.test.ts
@@ -78,7 +78,7 @@ async function call(
     headers?: Record<string, string>;
   } = {},
 ): Promise<Res> {
-  const headers: Record<string, string> = { ...(opts.headers ?? {}) };
+  const headers: Record<string, string> = { ...opts.headers };
   const token = opts.token === undefined ? TOKEN : opts.token;
   if (token !== null) headers["authorization"] = `Bearer ${token}`;
   if (opts.password !== undefined) headers["x-seedpass-password"] = opts.password;
diff --git a/js/packages/core/src/vault/index0.ts b/js/packages/core/src/vault/index0.ts
index 184a2653..8d21686f 100644
--- a/js/packages/core/src/vault/index0.ts
+++ b/js/packages/core/src/vault/index0.ts
@@ -736,7 +736,7 @@ function buildCountsView(
     if (!isDict(entry)) continue;
     const kind = normalizeString(entry["kind"] ?? entry["type"] ?? "password");
     if (kind) counts[kind] = (counts[kind] ?? 0) + 1;
-    if (Boolean(entry["archived"] ?? entry["blacklisted"] ?? false)) archivedCount++;
+    if (entry["archived"] ?? entry["blacklisted"] ?? false) archivedCount++;
     timestamps.push(safeInt(entry["modified_ts"] ?? entry["updated"] ?? 0));
   }
   const sorted: Dict = {};