Vendors two rules from github.com/dmmulroy/anti-slop into
js/tools/oxlint/anti-slop and wires oxlint into the workspace. This is the
first JS linter in the repo.
TWO of the project's fifteen rules are enabled. The rest were measured
against this codebase and rejected, with reasons recorded in
oxlint.config.ts, because "why is this off" is the question a future reader
will have. Briefly: no-conditional-empty-object-spread has 77 hits that are
all correct, since that idiom is REQUIRED by exactOptionalPropertyTypes;
no-unsafe-dictionary-type and no-runtime-typeof have 176 hits that are
overwhelmingly the agent's untrusted socket protocol, where a precise type
would be false confidence and the per-field typeof checks ARE the boundary
validation both rules ask for; three more have zero hits because the suite
already uses real dependency seams rather than module mocks.
The two that are on catch the same move: an assertion that manufactures
certainty the code never established. That is the failure mode a vault cannot
afford, because a wrong belief about a decrypted record's shape is a wrong
belief about someone's secrets.
They find 44 sites, and no-widen-then-assert finds none. Deliberately NOT
wired into CI yet: a gate that lands red is a gate people learn to ignore.
The findings get triaged and fixed first, then the CI step goes in green.
Kept deliberately revertible and separate from any change it motivates:
nothing under packages/*/src imports it, it is dev-only, and the shipped CLI
bundles with no externals so it cannot reach the published artifact —
verified, the rebuilt bundle contains no reference to it.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN
- scripts/generate_ts_port_fixtures.py: deterministic fixtures from public
test mnemonics (passwords v1+v2, BIP-39/85, TOTP, Nostr keys, managed
seeds, fingerprints, index keys, entry schemas, V3 vault payload).
Byte-identical across runs; v1 values match the frozen entropy-integrity
vectors.
- js/: pnpm workspace with @seedpass/core and @seedpass/test-vectors.
Core implements BIP-85, password gen v1 (frozen) + v2, TOTP, Nostr keys,
fingerprints, vault index key, and V3 AES-GCM decrypt using only
noble/scure crypto + WebCrypto. Strict TS, no Node/DOM deps in core.
- 82 parity tests pass in Node and a jsdom browser-like environment.
- docs/typescript_port_compatibility_matrix.md tracks per-area status.
Co-Authored-By: Claude Fable 5 <[email protected]>
thePR0M3TH3ANandClaude Opus 5