vulkro-sf fix

Generates a reviewable fix for each finding that has a well-defined one: a patch to the scanned file, the Setup page where the same change is made by hand, and sf commands to validate and deploy it. It never deploys and never changes the org.

vulkro-sf fix .                                  # summary with Setup links and commands
vulkro-sf fix . --format diff | git apply        # apply every verified patch
vulkro-sf fix . --format bundle --out fixes.zip  # patched files, diffs, README, scripts

Examples: removing ModifyAllData from a permission set, requiring PKCE on a connected app, making an Apex class with sharing, adding WITH USER_MODE to a query. Every patch is verified by scanning the patched project again, and kept only when its finding is gone and no new finding appears in the file.

Flag	What it does
[PATH]	SFDX project or retrieved metadata. Default ..
--format <table|json|diff|bundle>	Output format. Default table.
--finding <id>	Fix only these findings (repeatable or comma-separated; alias --id).
--out <path>	Where bundle writes: an empty folder or a .zip. Default vulkro-sf-fix-bundle.
--instance-url <url>	Your org's URL, for complete Setup links.
--no-verify	Skip the verification re-scan (the output says the patches are unverified).

AI fixes for Apex

--ai asks the local model set up with vulkro-sf ai for a minimal patch to CRUD and FLS, sharing, and SOQL injection findings. Each patch is kept as verified only if the class still parses, the finding is gone and no new finding appears; otherwise it is refused with a reason.

Flag	What it does
--ai	Show the AI patches (read-only).
--ai --write	Apply only the verified AI patches, each printed first.
--ai-model, --ai-url, --no-ai	Override the model for this run, or turn AI off.

AI fixes are advisory and never change the exit code.

Exit codes

Code	Meaning
0	No findings.
1	Findings reported.
2	Error.