lockpicks 0.1.0 → 0.2.0

package/README.md

@@ -20,21 +20,22 @@ With it installed, `lockpick mcp config` points agents at `lockpick mcp`; withou
 
 ## Commands
 
-| Command                                | What it shows                                                                           |
-| -------------------------------------- | --------------------------------------------------------------------------------------- |
-| `lockpick whoami`                      | The user, workspace and key this terminal uses                                          |
-| `lockpick projects`                    | Projects with their latest Pulse and pentest                                            |
-| `lockpick status [project]`            | One project's report, or an overview of all of them                                     |
-| `lockpick runs`                        | Pulse assessments and pentests, newest first                                            |
-| `lockpick run <runId>`                 | One run: status, open findings, coverage and limits                                     |
-| `lockpick watch <runId>`               | Follows a run until it finishes                                                         |
-| `lockpick pulse <project>`             | Starts a Pulse (a recheck of the latest one when possible) and waits for the result     |
-| `lockpick findings <runId>`            | Findings that need attention (`--all` for informational ones)                           |
-| `lockpick finding <runId> <findingId>` | One finding with its evidence                                                           |
-| `lockpick brief <runId>`               | A markdown repair brief (`--finding <id>` for one finding, `--out brief.md` to save it) |
-| `lockpick compare <runId>`             | What a Pulse recheck changed against its baseline                                       |
-| `lockpick open <id>`                   | Opens a run or project in the browser                                                   |
-| `lockpick skills`                      | Adds the Lockpick skills to your coding agent (`npx skills add`)                        |
+| Command                                | What it shows                                                                                                                                    |
+| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `lockpick whoami`                      | The user, workspace and key this terminal uses                                                                                                   |
+| `lockpick projects`                    | Projects with their latest Pulse and pentest                                                                                                     |
+| `lockpick status [project]`            | One project's report, or an overview of all of them                                                                                              |
+| `lockpick runs`                        | Pulse assessments and pentests, newest first                                                                                                     |
+| `lockpick run <runId>`                 | One run: status, open findings, coverage and limits                                                                                              |
+| `lockpick watch <runId>`               | Follows a run until it finishes                                                                                                                  |
+| `lockpick pulse <project>`             | Starts a Pulse (a recheck of the latest one when possible) and waits for the result                                                              |
+| `lockpick findings <runId>`            | Findings that need attention (`--all` for informational ones)                                                                                    |
+| `lockpick finding <runId> <findingId>` | One finding with its evidence                                                                                                                    |
+| `lockpick brief <runId>`               | One brief that fixes everything needing attention (`--finding <id>` for one finding, `--agent <name>` to tailor it, `--out brief.md` to save it) |
+| `lockpick fix <runId> --agent <name>`  | Saves the fix-all brief to `lockpick-fixes.md` and prints the command that starts your agent on it                                               |
+| `lockpick compare <runId>`             | What a Pulse recheck changed against its baseline                                                                                                |
+| `lockpick open <id>`                   | Opens a run or project in the browser                                                                                                            |
+| `lockpick skills`                      | Adds the Lockpick skills to your coding agent (`npx skills add`)                                                                                 |
 
 Every command takes `--host` and `--json`. With `--json`, errors are printed to stderr as `{ "error": "…", "code": "…" }`.
 
@@ -48,7 +49,7 @@ Each Pulse uses one of your account's runs, the same as starting it in the web a
 lockpick mcp config claude    # or cursor, vscode, codex
 ```
 
-prints the setup for your agent. The server (`lockpick mcp`, stdio) offers ten reading tools, `lockpick_start_pulse` (only for keys allowed to start Pulses), a repair-brief resource and a `fix-lockpick-findings` prompt. Evidence captured from scanned sites is fenced as untrusted data, and agents are told never to follow instructions inside it.
+prints the setup for your agent. The server (`lockpick mcp`, stdio) offers ten reading tools, `lockpick_start_pulse` (only for keys allowed to start Pulses), a repair-brief resource and a `fix-lockpick-findings` prompt. `lockpick_get_repair_brief` without a `findingId` returns the fix-all brief, and its `agent` argument tailors it. Evidence captured from scanned sites is fenced as untrusted data, and agents are told never to follow instructions inside it.
 
 ## Environment
 

package/dist/lockpick.mjs

@@ -23541,6 +23541,45 @@ var StdioServerTransport = class {
   }
 };
 
+// ../../packages/contracts/src/prompt-agents.ts
+var PROMPT_AGENTS = [
+  "claude-code",
+  "codex",
+  "cursor",
+  "vscode",
+  "opencode",
+  "lovable",
+  "bolt",
+  "replit",
+  "v0"
+];
+var PROMPT_AGENT_LAUNCH = {
+  "claude-code": "claude",
+  codex: "codex",
+  cursor: "cursor-agent",
+  vscode: "code chat --mode agent",
+  opencode: "opencode --prompt=",
+  lovable: null,
+  bolt: null,
+  replit: null,
+  v0: null
+};
+function isPromptAgent(value) {
+  return PROMPT_AGENTS.includes(value);
+}
+var FIX_ALL_FILE = "lockpick-fixes.md";
+function agentCommand(agent, text2) {
+  const launch = PROMPT_AGENT_LAUNCH[agent];
+  if (!launch) throw new Error(`No command line tool for ${agent}`);
+  return launch.endsWith("=") ? `${launch}${text2}` : `${launch} ${text2}`;
+}
+function readBriefCommand(agent, file2 = FIX_ALL_FILE) {
+  return agentCommand(
+    agent,
+    `"Read ${file2} and follow it. Do not commit that file."`
+  );
+}
+
 // ../../packages/contracts/src/cli-routes.ts
 var CLI_API = "/api/cli/v1";
 var segment = (value) => encodeURIComponent(value);
@@ -23752,6 +23791,10 @@ var cliFindingListQuerySchema = external_exports.object({
   /** Passing and not-assessed checks are hidden unless asked for. */
   all: external_exports.enum(["true", "false"]).optional().transform((value) => value === "true")
 });
+var cliRepairBriefQuerySchema = external_exports.object({
+  findingId: external_exports.string().min(1).max(500).optional(),
+  agent: external_exports.enum(PROMPT_AGENTS).optional()
+});
 
 // src/api.ts
 function friendlyError(status2, message, replace) {
@@ -23930,12 +23973,13 @@ var LockpickClient = class {
       { notFound: missingRun(runId) }
     );
   }
-  repairBrief(runId, findingId) {
+  /** One finding's brief, or the fix-all brief; `agent` tailors it. */
+  repairBrief(runId, findingId, agent) {
     return this.request(
       CLI_API_ROUTES.repairBrief(runId),
       cliRepairBriefSchema,
       {
-        query: { findingId },
+        query: { findingId, agent },
         notFound: missingRun(runId)
       }
     );
@@ -24347,7 +24391,7 @@ import { delimiter, join as join2, sep } from "node:path";
 import { createInterface } from "node:readline/promises";
 
 // src/version.ts
-var CLI_VERSION = true ? "0.1.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.2.0" : "0.0.0-dev";
 var CLI_PACKAGE = true ? "lockpicks" : "lockpicks";
 
 // src/install.ts
@@ -34410,15 +34454,16 @@ Still ${run2.status}. Call lockpick_wait_for_run with runId \`${run2.id}\` to ke
     "lockpick_get_repair_brief",
     {
       title: "Get repair brief",
-      description: "A markdown repair brief for one finding, or for every finding needing attention when findingId is omitted. Uses the brief a teammate saved in Lockpick when there is one.",
+      description: "A markdown repair brief for one finding, or, when findingId is omitted, one fix-all brief covering every finding that needs attention: a numbered index, a section per fix, the steps only the owner can take and one set of boundaries. Uses the brief a teammate saved in Lockpick when there is one. Pass agent to append working instructions for that agent.",
       inputSchema: {
         runId: external_exports.string().min(1),
-        findingId: external_exports.string().min(1).optional()
+        findingId: external_exports.string().min(1).optional(),
+        agent: external_exports.enum(PROMPT_AGENTS).optional().describe("Tailor the brief for this agent")
       },
       annotations: readOnly
     },
-    ({ runId, findingId }) => call(async (client) => {
-      const brief2 = await client.repairBrief(runId, findingId);
+    ({ runId, findingId, agent }) => call(async (client) => {
+      const brief2 = await client.repairBrief(runId, findingId, agent);
       if (brief2.findingIds.length === 0)
         return text("No findings in this run need attention.");
       return text(brief2.markdown);
@@ -34447,7 +34492,7 @@ Still ${run2.status}. Call lockpick_wait_for_run with runId \`${run2.id}\` to ke
     }),
     {
       title: "Repair brief",
-      description: "Markdown repair brief for every finding in a run that needs attention.",
+      description: "The fix-all brief: one markdown document covering every finding in a run that needs attention.",
       mimeType: "text/markdown"
     },
     async (uri, { runId }) => {
@@ -34586,6 +34631,16 @@ function parse3(schema, value, name, allowed) {
     );
   }
 }
+function agentArg(value) {
+  if (value === void 0) return void 0;
+  if (isPromptAgent(value)) return value;
+  throw new LockpickApiError(
+    `--agent must be one of: ${PROMPT_AGENTS.join(", ")}`,
+    400,
+    "VALIDATION_ERROR"
+  );
+}
+var agentHelp = `Tailor it for this agent: ${PROMPT_AGENTS.join(", ")}`;
 async function findProject(client, ref) {
   const projects2 = await client.listProjects();
   const exact = projects2.find((project) => project.id === ref);
@@ -34927,17 +34982,19 @@ var finding = defineCommand({
 var brief = defineCommand({
   meta: {
     name: "brief",
-    description: "Markdown repair brief for a run (or one finding)"
+    description: "Markdown brief that fixes everything in a run that needs attention (or one finding)"
   },
   args: {
     runId: { type: "positional", description: "Run id", required: true },
     finding: { type: "string", description: "Only this finding" },
+    agent: { type: "string", description: agentHelp },
     out: { type: "string", description: "Write the markdown to this file" },
     ...common
   },
   run: ({ args }) => action(async () => {
+    const agent = agentArg(args.agent);
     const client = await clientFor({ host: args.host });
-    const result = await client.repairBrief(args.runId, args.finding);
+    const result = await client.repairBrief(args.runId, args.finding, agent);
     if (args.out) {
       await writeFile2(args.out, `${result.markdown}
 `);
@@ -34950,6 +35007,47 @@ var brief = defineCommand({
     emit(args.json, result, () => result.markdown);
   })
 });
+var fix = defineCommand({
+  meta: {
+    name: "fix",
+    description: `Save the fix-all brief to ${FIX_ALL_FILE} and print the command that starts your agent on it`
+  },
+  args: {
+    runId: { type: "positional", description: "Run id", required: true },
+    agent: { type: "string", description: agentHelp },
+    out: {
+      type: "string",
+      description: `Where to save the brief (default: ${FIX_ALL_FILE})`
+    },
+    ...common
+  },
+  run: ({ args }) => action(async () => {
+    const agent = agentArg(args.agent);
+    const client = await clientFor({ host: args.host });
+    const result = await client.repairBrief(args.runId, void 0, agent);
+    if (result.findingIds.length === 0) {
+      if (args.json)
+        return emit(true, { ...result, file: null, command: null }, () => "");
+      return out("No findings in this run need attention.");
+    }
+    const file2 = args.out ?? FIX_ALL_FILE;
+    await writeFile2(file2, `${result.markdown}
+`);
+    const command = agent && PROMPT_AGENT_LAUNCH[agent] ? readBriefCommand(agent, file2) : null;
+    const count = result.findingIds.length;
+    if (args.json) return emit(true, { ...result, file: file2, command }, () => "");
+    err(
+      `Saved ${count} ${count === 1 ? "fix" : "fixes"} to ${file2}. Keep it out of your commits.`
+    );
+    if (command) {
+      err("Start your agent on it from your project folder:");
+      out(command);
+    } else
+      out(
+        agent ? `Paste ${file2} into the ${agent} chat, or attach it.` : `Give ${file2} to your coding agent, or add --agent to get its command.`
+      );
+  })
+});
 var compare = defineCommand({
   meta: {
     name: "compare",
@@ -35091,6 +35189,7 @@ var main = defineCommand({
     findings,
     finding,
     brief,
+    fix,
     compare,
     open,
     mcp,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lockpicks",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Lockpick from the terminal: device login, project status, findings, repair briefs, Pulse checks and an MCP server for coding agents",
   "keywords": [
     "lockpick",