lockpicks 0.7.1 → 0.8.0-go.11

package/bin/lockpick.exe

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+// The `lockpicks` npm launcher for the Go build of the Lockpick CLI, shipped
+// as bin/lockpick.exe: it finds the platform package npm installed
+// (`@lockpicks/cli-<os>-<cpu>`, an optional dependency) and runs its binary.
+// The preinstall script (install.cjs) replaces this file with that binary
+// wherever the package manager allows, so this is the fallback: install
+// scripts skipped (`--ignore-scripts`, pnpm, bun without trust), yarn 2 and
+// later, or yarn 1 and bun on Windows. LOCKPICK_LAUNCH tells the binary how
+// it was launched, decided from this script's path exactly as the TypeScript
+// CLI's launchKind decides it from its own (and as the binary decides it
+// from its own path when it is the command).
+'use strict';
+
+const { spawn } = require('node:child_process');
+const { readFileSync, realpathSync } = require('node:fs');
+const { delimiter, join, sep } = require('node:path');
+
+const PACKAGE_DIR = `${sep}lockpicks${sep}`;
+
+function real(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return null;
+  }
+}
+
+// The version of the lockpicks install that holds file, or null.
+function installedVersion(file) {
+  const at = file.lastIndexOf(PACKAGE_DIR);
+  if (at < 0) return null;
+  try {
+    const manifest = JSON.parse(
+      readFileSync(
+        join(file.slice(0, at + PACKAGE_DIR.length), 'package.json'),
+        'utf8'
+      )
+    );
+    return manifest.name === 'lockpicks' && typeof manifest.version === 'string'
+      ? manifest.version
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+// `path` when a `lockpick` on PATH is this file or another install of this
+// package at this version (an older or newer global must not take over an
+// npx run's MCP entry); then `npx`, `package` or `checkout`.
+function launchKind(script, pathEnv, version) {
+  const self = real(script) ?? script;
+  const parts = self.split(sep);
+  const installed = parts.includes('node_modules');
+  const onPath = pathEnv.split(delimiter).some((dir) => {
+    const found =
+      dir && !dir.split(sep).includes('node_modules')
+        ? real(join(dir, 'lockpick'))
+        : null;
+    return (
+      found !== null &&
+      (found === self || (installed && installedVersion(found) === version))
+    );
+  });
+  if (onPath) return 'path';
+  if (parts.includes('_npx')) return 'npx';
+  return installed ? 'package' : 'checkout';
+}
+
+// Node itself reads `--env-file` and `--env-file-if-exists` from every
+// argument up to a literal `--`, this script's own included, and loads the
+// file into its environment before any JavaScript runs: a `NODE_OPTIONS` in
+// it has already run its preloads by now, and its other variables would
+// reach the binary. That is Node's behaviour, met by every Node launcher, and
+// nothing here can undo it (the binary as the command, above, never meets
+// it); the CLI's flag for a repository's env file is `--dotenv` so no one is
+// told to pass it. Refuse the old name rather than hand the binary an
+// environment the file chose.
+const args = process.argv.slice(2);
+const end = args.indexOf('--');
+const nodeEnvFile = (end === -1 ? args : args.slice(0, end)).find((arg) =>
+  /^--env-file(?:-if-exists)?(?:=|$)/.test(arg)
+);
+if (nodeEnvFile !== undefined) {
+  process.stderr.write(
+    `✖ ${nodeEnvFile.split('=')[0]} is read by Node.js itself, before Lockpick starts, and loads that file into Node's own environment.\n` +
+      'Name the file with --dotenv instead, for example: lockpick deep local . --dotenv .env\n'
+  );
+  process.exit(2);
+}
+
+const target = `@lockpicks/cli-${process.platform}-${process.arch}`;
+let binary;
+try {
+  binary = join(
+    require.resolve(`${target}/package.json`).slice(0, -'package.json'.length),
+    'bin',
+    process.platform === 'win32' ? 'lockpick.exe' : 'lockpick'
+  );
+} catch {
+  // npm installs the binary as an optional dependency. `--omit=optional`,
+  // `--no-optional`, an `omit=optional` npmrc or a mirror without the
+  // platform package skip it; anything else has no build at all.
+  const { version, optionalDependencies } = require('../package.json');
+  process.stderr.write(
+    target in (optionalDependencies ?? {})
+      ? `✖ Lockpick's binary for ${process.platform}-${process.arch} (the npm package ${target}) is not installed.\n` +
+          'npm skips it when optional dependencies are turned off (--omit=optional, --no-optional or omit=optional in an npmrc),\n' +
+          'or when a registry mirror does not carry it. Reinstall with optional dependencies:\n' +
+          `  npm install -g --allow-scripts=lockpicks lockpicks@${version} --include=optional   (a global install)\n` +
+          `  npm install lockpicks@${version} --include=optional                                (in a project)\n` +
+          `If it is still missing, check \`npm config get omit\` and that your registry serves ${target}.\n`
+      : `✖ Lockpick has no build for ${process.platform}-${process.arch}.\n` +
+          'The Node.js build of the CLI runs anywhere Node.js does: npm install -g lockpicks@0.7\n'
+  );
+  process.exit(1);
+}
+
+// The binary runs as a child so this launcher can pass on what reaches it:
+// SIGINT, SIGTERM and SIGHUP (and Ctrl+Break on Windows) go to the binary,
+// this process exits with the binary's code or signal, and the binary is
+// killed if this process exits first. LOCKPICK_LAUNCHER_PID lets the binary
+// stop on its own when this process is killed outright (SIGKILL, taskkill /F).
+const child = spawn(binary, args, {
+  stdio: 'inherit',
+  env: {
+    ...process.env,
+    LOCKPICK_LAUNCH: launchKind(
+      process.argv[1] ?? '',
+      process.env.PATH ?? '',
+      require('../package.json').version
+    ),
+    LOCKPICK_LAUNCHER_PID: String(process.pid),
+  },
+});
+const forwarded = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+if (process.platform === 'win32') forwarded.push('SIGBREAK');
+for (const signal of forwarded)
+  process.on(signal, () => {
+    if (child.exitCode === null && child.signalCode === null)
+      child.kill(signal);
+  });
+process.on('exit', () => {
+  if (child.exitCode === null && child.signalCode === null) child.kill();
+});
+child.on('error', (error) => {
+  process.stderr.write(`✖ Could not start ${binary}: ${error.message}\n`);
+  process.exit(1);
+});
+child.on('exit', (code, signal) => {
+  if (signal) {
+    // Die of the same signal, so the shell sees what the binary saw.
+    for (const name of forwarded) process.removeAllListeners(name);
+    process.kill(process.pid, signal);
+    return;
+  }
+  process.exit(code ?? 1);
+});

package/install.cjs

@@ -0,0 +1,81 @@
+// The `lockpicks` preinstall script: it puts this platform's Lockpick binary
+// where npm links the `lockpick` and `lockpicks` commands, so they run the
+// binary itself and Node never reads their arguments (Node loads an
+// `--env-file` named anywhere on its own command line before any JavaScript
+// runs, a `NODE_OPTIONS` preload in it included).
+//
+// bin/lockpick.exe ships as the JavaScript launcher (lockpick.cjs). This
+// script replaces it with a hard link to, or a copy of, the binary in
+// `@lockpicks/cli-<os>-<cpu>`, only where the package manager links the
+// commands after this script runs and runs the file they name as it is:
+//
+//   - npm, everywhere (install, ci, update, rebuild, exec and npx link bins
+//     after preinstall; on Windows cmd-shim then sees no `#!` and calls the
+//     .exe directly). npm 12 runs it only when allowed
+//     (`--allow-scripts=lockpicks`, or the `allow-scripts` config);
+//   - yarn 1 and bun, on macOS and Linux, which link commands as symlinks.
+//
+// Anywhere else (pnpm, whose command scripts can already say `node <file>`
+// when its build runs, as after `pnpm approve-builds`; yarn 2 and later, which
+// run every bin with Node; yarn 1 and bun on Windows, whose shims are written
+// before the script; `--ignore-scripts` or npm 12 without allow-scripts; a
+// skipped optional dependency) the
+// JavaScript launcher stays and runs the binary as before. Nothing here
+// fails an install, reaches the network or runs the binary.
+'use strict';
+
+const fs = require('node:fs');
+const { dirname, join } = require('node:path');
+
+function linksAfterScript(agent, platform) {
+  if (/^npm\//.test(agent)) return true;
+  return platform !== 'win32' && /^(?:yarn\/1\.|bun\/)/.test(agent);
+}
+
+function install() {
+  if (
+    !linksAfterScript(process.env.npm_config_user_agent ?? '', process.platform)
+  )
+    return;
+  const { version } = require('./package.json');
+  const target = `@lockpicks/cli-${process.platform}-${process.arch}`;
+  let manifest;
+  try {
+    manifest = require.resolve(`${target}/package.json`, {
+      paths: [__dirname],
+    });
+  } catch {
+    return; // optional dependencies skipped, or no build for this platform
+  }
+  // A hoisted copy of another version is not this package's binary.
+  if (require(manifest).version !== version) return;
+  const binary = join(
+    dirname(manifest),
+    'bin',
+    process.platform === 'win32' ? 'lockpick.exe' : 'lockpick'
+  );
+  if (!fs.statSync(binary).isFile()) return;
+  // Renamed into place, never written through: bun and pnpm hard-link
+  // package files from their stores, and a half-written launcher must never
+  // be left behind.
+  const launcher = join(__dirname, 'bin', 'lockpick.exe');
+  const temp = `${launcher}.${process.pid}.tmp`;
+  try {
+    fs.rmSync(temp, { force: true });
+    try {
+      fs.linkSync(binary, temp);
+    } catch {
+      fs.copyFileSync(binary, temp);
+    }
+    fs.chmodSync(temp, 0o755);
+    fs.renameSync(temp, launcher);
+  } finally {
+    fs.rmSync(temp, { force: true });
+  }
+}
+
+try {
+  install();
+} catch {
+  // The JavaScript launcher is still in place and runs the binary.
+}

package/package.json

@@ -1,7 +1,19 @@
 {
-  "name": "lockpicks",
-  "version": "0.7.1",
+  "bin": {
+    "lockpick": "bin/lockpick.exe",
+    "lockpicks": "bin/lockpick.exe"
+  },
   "description": "Lockpick from the terminal: device login, project status, findings, repair briefs, Pulse scans and an MCP server for coding agents",
+  "engines": {
+    "node": "\u003e=20.9.0"
+  },
+  "files": [
+    "bin",
+    "install.cjs",
+    "README.md",
+    "LICENSE",
+    "THIRD-PARTY-NOTICES.txt"
+  ],
   "keywords": [
     "lockpick",
     "security",
@@ -9,22 +21,27 @@
     "cli",
     "box"
   ],
-  "type": "module",
-  "bin": {
-    "lockpick": "./dist/lockpick.mjs",
-    "lockpicks": "./dist/lockpick.mjs"
+  "license": "SEE LICENSE IN LICENSE",
+  "name": "lockpicks",
+  "optionalDependencies": {
+    "@lockpicks/cli-darwin-arm64": "0.8.0-go.11",
+    "@lockpicks/cli-darwin-x64": "0.8.0-go.11",
+    "@lockpicks/cli-linux-arm": "0.8.0-go.11",
+    "@lockpicks/cli-linux-arm64": "0.8.0-go.11",
+    "@lockpicks/cli-linux-x64": "0.8.0-go.11",
+    "@lockpicks/cli-win32-arm64": "0.8.0-go.11",
+    "@lockpicks/cli-win32-x64": "0.8.0-go.11"
   },
-  "files": [
-    "dist",
-    "README.md",
-    "LICENSE",
-    "THIRD-PARTY-NOTICES.txt"
-  ],
-  "dependencies": {
-    "@napi-rs/keyring": "^2.1.0"
+  "publishConfig": {
+    "access": "public"
   },
-  "engines": {
-    "node": ">=20.9.0"
+  "repository": {
+    "directory": "apps/cli-go",
+    "type": "git",
+    "url": "git+https://github.com/promptadvisers/lockpick.git"
+  },
+  "scripts": {
+    "preinstall": "node install.cjs"
   },
-  "license": "SEE LICENSE IN LICENSE"
-}
+  "version": "0.8.0-go.11"
+}

package/dist/local/safe-io-darwin-arm64.provenance.json

@@ -1,37 +0,0 @@
-{
-  "schemaVersion": 1,
-  "platform": "darwin",
-  "arch": "arm64",
-  "nodeApiVersion": 8,
-  "nodeHeadersVersion": "20.9.0",
-  "compiler": "Apple clang version 17.0.0 (clang-1700.0.13.5)",
-  "compilerSha256": "7f30f076d0e9c38f772a76449fca9da8cf97f6a3d43b94c90a00e4f9ce7ad39e",
-  "compilerArguments": [
-    "-std=c11",
-    "-O2",
-    "-Wall",
-    "-Wextra",
-    "-Werror",
-    "-fPIC",
-    "-D_POSIX_C_SOURCE=200809L",
-    "-D_DARWIN_C_SOURCE=1",
-    "-D_DEFAULT_SOURCE=1",
-    "-DNAPI_VERSION=8",
-    "-I<node-headers>",
-    "-bundle",
-    "-undefined",
-    "dynamic_lookup",
-    "<safe-io.c>",
-    "-o",
-    "<native-artifact>"
-  ],
-  "sourceSha256": "90cccce979b991f5c0c33e6c286dc76bcb4e69b85c3c89156e9ec29a3dc606e4",
-  "headers": {
-    "node_api.h": "a5a3e1ff20963d44d92587376202d727d1daf2606dca96c082c876d3a322b5c5",
-    "node_api_types.h": "8d5d854088d5725fec9775510e0aeeeb790a41ad083c49bb721d950b86e6bd61",
-    "js_native_api.h": "94c40b848fca067b0f2bade48ee5cf162fbe379ea6edf6087f94faf41d827461",
-    "js_native_api_types.h": "7d805521f313d58ab00395b55019dbee8fa71cee21ef89e09521998e879a97b4",
-    "node_version.h": "5f8e3f33a99a8a220c3d56409e1e4b4a6143e43b3dff184b78828536b11b9ab8"
-  },
-  "binarySha256": "2d5efe59b1845a66a4516440d900f0fe6c0db7d9c471ddaed941d49071f16f26"
-}

package/dist/local/safe-io-darwin-x64.provenance.json

@@ -1,37 +0,0 @@
-{
-  "schemaVersion": 1,
-  "platform": "darwin",
-  "arch": "x64",
-  "nodeApiVersion": 8,
-  "nodeHeadersVersion": "20.9.0",
-  "compiler": "Apple clang version 17.0.0 (clang-1700.0.13.5)",
-  "compilerSha256": "7f30f076d0e9c38f772a76449fca9da8cf97f6a3d43b94c90a00e4f9ce7ad39e",
-  "compilerArguments": [
-    "-std=c11",
-    "-O2",
-    "-Wall",
-    "-Wextra",
-    "-Werror",
-    "-fPIC",
-    "-D_POSIX_C_SOURCE=200809L",
-    "-D_DARWIN_C_SOURCE=1",
-    "-D_DEFAULT_SOURCE=1",
-    "-DNAPI_VERSION=8",
-    "-I<node-headers>",
-    "-bundle",
-    "-undefined",
-    "dynamic_lookup",
-    "<safe-io.c>",
-    "-o",
-    "<native-artifact>"
-  ],
-  "sourceSha256": "90cccce979b991f5c0c33e6c286dc76bcb4e69b85c3c89156e9ec29a3dc606e4",
-  "headers": {
-    "node_api.h": "a5a3e1ff20963d44d92587376202d727d1daf2606dca96c082c876d3a322b5c5",
-    "node_api_types.h": "8d5d854088d5725fec9775510e0aeeeb790a41ad083c49bb721d950b86e6bd61",
-    "js_native_api.h": "94c40b848fca067b0f2bade48ee5cf162fbe379ea6edf6087f94faf41d827461",
-    "js_native_api_types.h": "7d805521f313d58ab00395b55019dbee8fa71cee21ef89e09521998e879a97b4",
-    "node_version.h": "5f8e3f33a99a8a220c3d56409e1e4b4a6143e43b3dff184b78828536b11b9ab8"
-  },
-  "binarySha256": "5d8f57fc535c3beb540e622affc0acd2ce7a383c98355b8f7493534b03d0d984"
-}

package/dist/local/safe-io-linux-arm64.provenance.json

@@ -1,35 +0,0 @@
-{
-  "schemaVersion": 1,
-  "platform": "linux",
-  "arch": "arm64",
-  "nodeApiVersion": 8,
-  "nodeHeadersVersion": "20.9.0",
-  "compiler": "cc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0",
-  "compilerSha256": "6c3baa3d21eea32b960de4ad2d366d484ce1dd837eb85f4904e656758bfa1a6b",
-  "compilerArguments": [
-    "-std=c11",
-    "-O2",
-    "-Wall",
-    "-Wextra",
-    "-Werror",
-    "-fPIC",
-    "-D_POSIX_C_SOURCE=200809L",
-    "-D_DARWIN_C_SOURCE=1",
-    "-D_DEFAULT_SOURCE=1",
-    "-DNAPI_VERSION=8",
-    "-I<node-headers>",
-    "-shared",
-    "<safe-io.c>",
-    "-o",
-    "<native-artifact>"
-  ],
-  "sourceSha256": "90cccce979b991f5c0c33e6c286dc76bcb4e69b85c3c89156e9ec29a3dc606e4",
-  "headers": {
-    "node_api.h": "a5a3e1ff20963d44d92587376202d727d1daf2606dca96c082c876d3a322b5c5",
-    "node_api_types.h": "8d5d854088d5725fec9775510e0aeeeb790a41ad083c49bb721d950b86e6bd61",
-    "js_native_api.h": "94c40b848fca067b0f2bade48ee5cf162fbe379ea6edf6087f94faf41d827461",
-    "js_native_api_types.h": "7d805521f313d58ab00395b55019dbee8fa71cee21ef89e09521998e879a97b4",
-    "node_version.h": "5f8e3f33a99a8a220c3d56409e1e4b4a6143e43b3dff184b78828536b11b9ab8"
-  },
-  "binarySha256": "5b4d74de3d5227b85ee1c3d19afc97c5f216c754dd74242d57e8c17869f13c5f"
-}

package/dist/local/safe-io-linux-x64.provenance.json

@@ -1,35 +0,0 @@
-{
-  "schemaVersion": 1,
-  "platform": "linux",
-  "arch": "x64",
-  "nodeApiVersion": 8,
-  "nodeHeadersVersion": "20.9.0",
-  "compiler": "cc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0",
-  "compilerSha256": "821af3c74506283c179ca413bb33e6b528805a4dd8a5c09df125e5ad560a9e89",
-  "compilerArguments": [
-    "-std=c11",
-    "-O2",
-    "-Wall",
-    "-Wextra",
-    "-Werror",
-    "-fPIC",
-    "-D_POSIX_C_SOURCE=200809L",
-    "-D_DARWIN_C_SOURCE=1",
-    "-D_DEFAULT_SOURCE=1",
-    "-DNAPI_VERSION=8",
-    "-I<node-headers>",
-    "-shared",
-    "<safe-io.c>",
-    "-o",
-    "<native-artifact>"
-  ],
-  "sourceSha256": "90cccce979b991f5c0c33e6c286dc76bcb4e69b85c3c89156e9ec29a3dc606e4",
-  "headers": {
-    "node_api.h": "a5a3e1ff20963d44d92587376202d727d1daf2606dca96c082c876d3a322b5c5",
-    "node_api_types.h": "8d5d854088d5725fec9775510e0aeeeb790a41ad083c49bb721d950b86e6bd61",
-    "js_native_api.h": "94c40b848fca067b0f2bade48ee5cf162fbe379ea6edf6087f94faf41d827461",
-    "js_native_api_types.h": "7d805521f313d58ab00395b55019dbee8fa71cee21ef89e09521998e879a97b4",
-    "node_version.h": "5f8e3f33a99a8a220c3d56409e1e4b4a6143e43b3dff184b78828536b11b9ab8"
-  },
-  "binarySha256": "4f497e60ffabb4f7c089a054fd086b815a827dbac7071aab6f662ce18dfda264"
-}