feat: add private static browser generator

[dk3yyyy]

Summary

• add a separate static password/passphrase generator under docs/ without replacing the existing Python CLI or FastAPI interface
• generate credentials entirely in the browser with Web Crypto and rejection sampling
• bundle and validate the same 7,776-word EFF list used by the Python implementation
• add restrictive CSP, safe DOM rendering, keyboard-accessible controls, responsive layouts, and non-secret screen-reader status announcements
• add Node unit tests, Playwright desktop/mobile integration tests, static-source security checks, and CI coverage

Privacy and security properties

• no credential generation API or backend round-trip
• no telemetry, browser storage, credential history, or generated-value persistence
• runtime requests are limited to same-origin static assets and the bundled EFF wordlist
• no Math.random(), modulo-biased index selection, innerHTML, or inline runtime code
• exact password entropy calculation matches the Python inclusion-exclusion model

Verification

• uv run pytest tests/ -q — 113 passed
• npm test — 9 unit tests passed; 7 Chromium integration tests passed; 1 intentional mobile-only project skip
• Python compilation checks passed
• JavaScript syntax checks passed
• bundled/Python EFF wordlists match byte-for-byte
• entropy parity checked against Python to 12 decimal places
• Chromium runtime checks found no outbound requests, storage writes, CSP violations, or console errors
• desktop and Pixel 7 rendered visual QA passed without clipping or overflow
• npm audit --audit-level=high — 0 vulnerabilities
• independent review verdict — SHIP, no blocking issues

Deployment note

GitHub Pages remains disabled. This PR only adds Pages-ready static files; it does not enable, configure, or deploy GitHub Pages. Activation should be a separate reviewed action.

Summary by CodeRabbit

• New Features
  • Added a browser-based password and passphrase generator that runs locally without saving or transmitting generated credentials.
  • Supports customizable passwords, EFF passphrases, entropy and strength indicators, responsive layouts, keyboard navigation, and one-click copying.
  • Added fallback instructions when clipboard access is unavailable.
• Documentation
  • Expanded setup, web interface, development, and project structure guidance for the static demo and FastAPI interface.
• Quality Improvements
  • Added automated browser and unit coverage for generation, privacy, accessibility, security, and mobile behavior.

[coderabbitai]

Warning

Review limit reached

@dk3yyyy, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 32 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ba011e01-06cc-4bec-b417-684929e8a0a9

📥 Commits

Reviewing files that changed from the base of the PR and between 8436d64 and 19c1465.

📒 Files selected for processing (1)

• README.md

📝 Walkthrough

Walkthrough

The PR adds a static browser password and passphrase generator with cryptographic generation, entropy and strength reporting, accessible responsive UI behavior, local wordlist loading, Playwright and Python validation, and CI coverage for Node/browser tests and wordlist synchronization.

Changes

Static Generator

Layer / File(s)	Summary
Generation and entropy core docs/generator.mjs, tests-js/generator.test.mjs	Adds secure password/passphrase generation, wordlist validation, entropy calculations, strength labels, and deterministic unit tests.
Static browser interface docs/index.html, docs/styles.css, docs/app.mjs, docs/eff_large_wordlist.txt	Adds the local generator UI, responsive styling, accessibility behavior, result rendering, clipboard fallback, and bundled EFF wordlist.
Browser verification pipeline package.json, playwright.config.mjs, tests-browser/*, tests/test_static_site.py, .github/workflows/ci.yml, .gitignore	Adds Node/Playwright execution, browser and asset-security tests, CI integration, wordlist comparison, and ignored test artifacts.
Project documentation README.md	Documents the static demo, FastAPI interface, development commands, bundled assets, and test workflow.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant StaticUI
  participant Generator
  participant Wordlist
  User->>StaticUI: Select generation mode and options
  StaticUI->>Wordlist: Fetch EFF wordlist for passphrases
  Wordlist-->>StaticUI: Return local wordlist
  StaticUI->>Generator: Generate credential
  Generator-->>StaticUI: Return credential, entropy, and strength
  StaticUI-->>User: Render result and copy controls

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding a private static browser-based generator.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/static-github-pages-demo

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}