lockpicks 0.6.0 → 0.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +35 -0
- package/dist/local/scan-worker.mjs +63488 -63307
- package/dist/lockpick.mjs +88596 -29905
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -154,3 +154,38 @@ This candidate implements current secrets, parsed dotenv and JS/TS public assign
|
|
|
154
154
|
Local MCP scanning is explicitly enabled with `lockpick mcp --local-root /absolute/repository`; repeat the flag for additional permitted roots. For generated client configuration, use `lockpick mcp config <client> --local-root /absolute/repository` (and `--apply` to install it). This cannot be combined with `--hosted`. The default MCP configuration does not expose `lockpick_scan_local`.
|
|
155
155
|
|
|
156
156
|
The local tool takes a project ID, an absolute repository path within a configured root, check IDs and the same explicit relative inputs as the CLI. It uses the same admission/worker coordinator, rechecks authorization on every call, permits one local scan at a time and forwards cancellation to the worker. Results are not uploaded to Lockpick, but the calling MCP agent or model can see the redacted findings and paths. Do not enable local MCP if that disclosure is inappropriate for the repository.
|
|
157
|
+
|
|
158
|
+
### Project dismissal policies (0.7.0)
|
|
159
|
+
|
|
160
|
+
Pull a policy using a project manager account with the sites scope:
|
|
161
|
+
|
|
162
|
+
```sh
|
|
163
|
+
lockpick dismissals --project <project-id> --file .lockpick-dismissals.json
|
|
164
|
+
lockpick deep local ./project --project <project-id> --dismissals .lockpick-dismissals.json
|
|
165
|
+
```
|
|
166
|
+
|
|
167
|
+
Pull refuses to overwrite a file. Add local finding identities, categories and
|
|
168
|
+
reasons to the version-1 policy, then explicitly sync metadata with
|
|
169
|
+
`lockpick dismissals --project <project-id> --file .lockpick-dismissals.json --push`.
|
|
170
|
+
Sync does not upload source files or local reports. Review reasons before
|
|
171
|
+
committing a policy: they are free text and may contain private details.
|
|
172
|
+
|
|
173
|
+
The file contains `version`, `projectId` and `dismissals`. Each entry contains
|
|
174
|
+
`fingerprint`, `codeHash`, `ruleVersion`, `severity`, `category`, `reason`,
|
|
175
|
+
`dismissedAt` and `dismissedBy`. Unknown fields and duplicate fingerprints are
|
|
176
|
+
rejected. Import records the authenticated importer as actor. Legacy marks
|
|
177
|
+
without identity/version/reason metadata cannot be exported as durable policies.
|
|
178
|
+
Use report identities to create local entries; never copy source into this file.
|
|
179
|
+
Categories: `false_positive`, `accepted_risk`, `mitigated_elsewhere`,
|
|
180
|
+
`intentionally_public`, `third_party`. Changed code hashes, rule versions or
|
|
181
|
+
severity reopen findings with the original reason. Accepted findings do not fail
|
|
182
|
+
local severity gates; incomplete coverage still fails its existing gate.
|
|
183
|
+
|
|
184
|
+
Hosted reports show adjusted scores and separate accepted findings. Deep Local
|
|
185
|
+
has its own deterministic coverage and no fabricated hosted numeric score.
|
|
186
|
+
Online admission still occurs; local source and reports stay local.
|
|
187
|
+
|
|
188
|
+
A policy is an explicit snapshot. Pull a fresh file after dashboard edits or undo,
|
|
189
|
+
and review it before the next local run. Push upserts the listed entries; it
|
|
190
|
+
does not delete dashboard dismissals absent from the file. Use project settings
|
|
191
|
+
to undo a stored dismissal.
|