Four fixed outright (M-1, M-2, L-4, L-7, L-8), one mitigated with the
derivation change deliberately deferred (L-1), two surfaced rather than
changed because their resolution is frozen for parity (L-2, L-3), and two
resolved as documented-behaviour with the reasoning written down (L-5, L-6).
The L-1 v2 design is now written up in TODO.md rather than left as a one-line
recommendation: keep v1 frozen, add derivation_version alongside the existing
gen_version pattern, domain-separate with an HMAC step rather than new BIP-85
app numbers, land both implementations together with cross-impl fixtures, and
make the upgrade opt-in per entry. Sequenced after the outside review on
purpose.
Also recorded: three defects found while fixing, none of which the audit had
reached — Python's publish_delta manifest republish, the fetch-limit downgrade
path, and merge_index_payloads mutating its argument.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN
The audit report gains a remediation table and per-finding status; TODO gains
the same detail where the rest of the work is tracked.
Two entries are closed as "resolved" rather than "fixed", and say why: L-5's
unanchored label_regex matches Python's re.search and anchoring it in one
implementation only would silently narrow every token already issued, and
L-6's argv-level containment needs a token-format change in both
implementations. Recording the reasoning matters more than the checkbox — a
future reader finding an unanchored regex should find the decision, not
rediscover the finding.
Also noted as still unported rather than silently skipped:
restore_latest_backup, nostr_max_retries and nostr_retry_delay.
M-1, L-1, L-2 and L-3 remain open; all four are protocol-level and need a
matching change in Python. No GPT-family review has run yet, so the
independent-review blocker is unchanged.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN
Python builds its PasswordGenerator with
`policy=self.config_manager.get_password_policy()` and merges an entry's own
`policy` block over that base per derivation. The port merged the entry block
over hardcoded defaults and never read the profile config at all, so every
entry in a profile with a non-default policy derived a *different password*
than Python. Nothing failed anywhere; it reached the user as a wrong password,
which is indistinguishable from data loss at the point of use.
materializeSecret now takes a `basePolicy` and merges the entry block over it.
All three callers supply the profile config's policy:
- program.ts via basePolicyForOptions, resolved lazily so `entry list` and
friends don't pay a second BIP-39 seed derivation for a policy they never
use. `--vault` names an index file rather than a profile, so the config is
looked for beside it and falls back to defaults when absent.
- agent.ts from join(appDir, fingerprint), so a token-scoped reveal returns
what the owner sees.
- the TUI through a new sessionSecret helper that every menu path goes
through, so a future call site cannot silently omit the base.
`util generate-password` is deliberately unchanged: it has no entry and no
profile, so its flags are the whole policy. It now says so in its own help
text rather than leaving the reader to infer it.
Evidence: js/packages/cli/test/passwordPolicy.test.ts covers config-only v2,
an entry overriding exactly one field, config-only v1 and exclude_ambiguous,
against values computed by the Python implementation — each also asserted
unequal to what the pre-fix code produced, so a regression fails loudly rather
than needing someone to notice a changed constant. Mutation-verified twice:
dropping basePolicy from the merge in secrets.ts, and making
basePolicyForOptions return {}, each turn all four red.
Found by the 2026-08-18 independent audit (js/SECURITY_AUDIT.md). The parity
fixture suite could not have caught this: those fixtures call generatePassword
with one already-resolved policy, so they prove the algorithm and say nothing
about where the policy came from.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN
Full manual review of js/packages/core and js/packages/cli plus supply
chain. No critical or high findings. Two mediums: a same-second snapshot
tie-break that lets a restore return stale state (the flaky nostr CLI
test is this bug), and config-level password policy being ignored in TS
derivation, diverging from Python. Lows and informational notes cover
the app-32 path sharing, inert settings, token regex anchoring, and
plaintext-import fingerprint binding.
Co-Authored-By: Claude Fable 5 <[email protected]>
thePR0M3TH3ANandClaude Opus 5