From 74a5c23dfb0989f60afc132255ef2dd7391a201c Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <adambrettmalin@protonmail.com>
Date: Thu, 20 Aug 2026 13:02:55 -0400
Subject: [PATCH] Clear the linter's built-in findings, keeping the one that
 was deliberate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Six warnings from oxlint's default rules, five of them genuinely redundant:
`...(x ?? {})` in an object literal, where spreading undefined is already a
no-op, and a `Boolean()` wrapping an `if` condition.

The sixth is kept. `for (const held of [...this.held.keys()]) this.forget(held)`
looks like a pointless array copy, and oxlint is right that for..of accepts an
iterable directly — but forget() deletes from this.held, so the spread is
what makes the loop iterate a snapshot instead of the map it is mutating.
Disabled on that line with the reason written next to it.

That distinction is the whole reason to read lint output rather than apply
it: a rule that is correct in general was wrong about the one site here where
it mattered, and the site it was wrong about locks every held seed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN
---
 js/packages/cli/src/agent.ts         | 7 ++++++-
 js/packages/cli/src/api/server.ts    | 4 ++--
 js/packages/cli/src/secrets.ts       | 2 +-
 js/packages/cli/test/api.test.ts     | 2 +-
 js/packages/core/src/vault/index0.ts | 2 +-
 5 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/js/packages/cli/src/agent.ts b/js/packages/cli/src/agent.ts
index 8a6eb8d2..fea732d9 100644
--- a/js/packages/cli/src/agent.ts
+++ b/js/packages/cli/src/agent.ts
@@ -860,7 +860,12 @@ export class AgentDaemon {
         const fp = msg["fingerprint"];
         if (fp === undefined) {
           const n = this.held.size;
-          for (const held of [...this.held.keys()]) this.forget(held);
+          // The spread is deliberate, not redundant: forget() deletes from
+    // this.held, so this iterates a SNAPSHOT of the keys rather than the live
+    // map. oxlint's no-useless-spread is right that for..of accepts an
+    // iterable and wrong that it is safe here.
+    // oxlint-disable-next-line unicorn/no-useless-spread
+    for (const held of [...this.held.keys()]) this.forget(held);
           return { ok: true, locked: n };
         }
         const key = String(fp);
diff --git a/js/packages/cli/src/api/server.ts b/js/packages/cli/src/api/server.ts
index 88160f66..399a6dc9 100644
--- a/js/packages/cli/src/api/server.ts
+++ b/js/packages/cli/src/api/server.ts
@@ -361,7 +361,7 @@ export class ApiServer {
       }
 
       const result = await matched.route.handler(apiReq);
-      this.send(res, { ...result, headers: { ...corsHeaders, ...(result.headers ?? {}) } });
+      this.send(res, { ...result, headers: { ...corsHeaders, ...result.headers } });
     } catch (e) {
       const status = e instanceof HttpError ? e.status : 500;
       // Never let an internal message escape: stack traces and filesystem
@@ -382,7 +382,7 @@ export class ApiServer {
       // framed, sniffed, or cached.
       "cache-control": "no-store",
       "x-content-type-options": "nosniff",
-      ...(response.headers ?? {}),
+      ...response.headers,
     };
     let payload: Uint8Array;
     if (response.bytes) {
diff --git a/js/packages/cli/src/secrets.ts b/js/packages/cli/src/secrets.ts
index 2283878f..d0cd1369 100644
--- a/js/packages/cli/src/secrets.ts
+++ b/js/packages/cli/src/secrets.ts
@@ -53,7 +53,7 @@ export function materializeSecret(
         index: Number(id),
         genVersion: entry.gen_version ?? 1,
         policy: {
-          ...(options.basePolicy ?? {}),
+          ...options.basePolicy,
           ...passwordPolicyFromRecord((entry as { policy?: unknown }).policy),
         },
       });
diff --git a/js/packages/cli/test/api.test.ts b/js/packages/cli/test/api.test.ts
index bde4eec0..3138446c 100644
--- a/js/packages/cli/test/api.test.ts
+++ b/js/packages/cli/test/api.test.ts
@@ -78,7 +78,7 @@ async function call(
     headers?: Record<string, string>;
   } = {},
 ): Promise<Res> {
-  const headers: Record<string, string> = { ...(opts.headers ?? {}) };
+  const headers: Record<string, string> = { ...opts.headers };
   const token = opts.token === undefined ? TOKEN : opts.token;
   if (token !== null) headers["authorization"] = `Bearer ${token}`;
   if (opts.password !== undefined) headers["x-seedpass-password"] = opts.password;
diff --git a/js/packages/core/src/vault/index0.ts b/js/packages/core/src/vault/index0.ts
index 184a2653..8d21686f 100644
--- a/js/packages/core/src/vault/index0.ts
+++ b/js/packages/core/src/vault/index0.ts
@@ -736,7 +736,7 @@ function buildCountsView(
     if (!isDict(entry)) continue;
     const kind = normalizeString(entry["kind"] ?? entry["type"] ?? "password");
     if (kind) counts[kind] = (counts[kind] ?? 0) + 1;
-    if (Boolean(entry["archived"] ?? entry["blacklisted"] ?? false)) archivedCount++;
+    if (entry["archived"] ?? entry["blacklisted"] ?? false) archivedCount++;
     timestamps.push(safeInt(entry["modified_ts"] ?? entry["updated"] ?? 0));
   }
   const sorted: Dict = {};