Your coding agent doesn't know the bug in your exact version.
landmine reads your lockfile, finds the open GitHub issues filed against the exact versions you pin, and puts them where your agent reads them, with the workaround from the thread. Before it writes the code that hits them.
$npx landmines scan && npx landmines install --rulesFree and open source (MIT). Hooks for 20 agents, a rules section any agent reads. npx landmines uninstall removes all of it.
You
Agent · Edit src/db.ts
export async function closeDb() { await db.$client.end(); }
Agent · Edit src/db.ts (retry)
const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL ?? 'postgres://localhost/demo' }); export const db = drizzle(pool); export async function closeDb() { await pool.end(); }
Agent → you
- drizzle-orm@0.36.0 13
- date-fns@3.6.0 21
- pydantic@2.9.2 16
- typescript@5.6.3 14
- requests@2.32.3 6
- pg@8.13.1 1
Replayed from a real, headless Claude Code 2.1.304 session on examples/demo, abridged. The prompt didn't mention bugs. Transcripts and hook logs.
Claude Sonnet 5.5's pass rate on 21 held-out traps built from bugs filed after its training cutoff (72/84 → 83/84).
Wins without a loss in a confirmation run on unseen seeds, written down before it ran (p = 0.03).
Sessions where the agent used web search or Context7 when it had them. It didn't think to look.
Any agent
One command. Every agent in the repo.
install finds the agents configured in your project and writes each one its own pre-edit hook or plugin, plus a known-bugs section in AGENTS.md and CLAUDE.md (and GEMINI.md when Gemini CLI is set up) that any agent reads.
npm i -D landmines$ npx landmines install --rules Installed: claude hook in .claude/settings.json Claude Code picks up hook changes immediately. landmine runs before Edit/Write and blocks once per issue per session. Installed: cursor hook in .cursor/hooks.json Installed: gemini hook in .gemini/settings.json Gemini CLI warns before running project hooks for the first time. Command: npx --no-install landmines hook Rules created: AGENTS.md Rules created: CLAUDE.md Rules created: GEMINI.md
20 hooks and plugins · rules for the rest
Agents write the code. landmine knows where the bugs are.
One normaliser reads every agent's payload and answers in its own deny format. The rules section is plain markdown, so agents without a hook still get the list.
"live" means run end to end against the real agent. The others are built from each agent's docs and tested against its payload shapes. Details.
Traps passed, Claude Sonnet 5.5
21 held-out tasks × 2 seeds, shell access, requests phrased the way a user would ask. All four setups in one batch.
landmine-bench
Measured against what you'd use instead.
No public benchmark measured whether agents avoid bugs already filed against the version they're using, so we built one: 66 validated trap tasks, frozen dev/test splits, a contamination canary, and an open harness for any agent.
How it works
Lockfile in. Known bugs out. Before the edit.
Find the issues for your exact versions
Lockfile → exact versions → open GitHub issues that name them. Every hit is checked for the version, tied to code symbols, and given the most useful workaround from its thread. Optional: cards has a model read each issue once and write down what triggers it.
A short known-bugs list where it reads
A marker-delimited section in AGENTS.md / CLAUDE.md, ranked by the APIs your code actually uses, with the condition and workaround for each. Issue text is framed as untrusted.
measured: 86% → 99%Hook, MCP server and pre-commit
A pre-edit hook that pauses a matching edit once, an MCP server for "is this error a known bug?", and check --staged for CI. All offline after the scan.
Post your number
How many open bugs does your lockfile pin?
share prints one postable line and a README badge. It shares only counts and package names.
$npx landmines share$ npx landmines share landmine found 86 open GitHub issues filed against the exact versions this project pins, in 6 of 7 dependencies (most: date-fns (23), pydantic (22), typescript (18)). 53 point at specific APIs, 34 have a workaround in the thread. Check yours: npx landmines scan README badge: [](https://www.npmjs.com/package/landmines)
The fine print
What the numbers do and don't say.
Our benchmark
No public benchmark measures this, so the numbers come from landmine-bench, which we built. Frozen splits, confirmation runs written down before they ran, and every run published. Method and caveats.
Selection
Every trap is a bug landmine had already indexed. The benchmark measures whether landmine helps once a bug is in its index, not how many bugs it finds. Only open issues that name your exact version are found.
Prompt wording
With fully specified prompts the agent already avoids most traps (19/21 unaided against 21/21 with landmine). The gap shows up when the request reads like a real one.
The hook alone
The pre-edit hook didn't measurably beat no help. Telling the agent up front did, which is why the command above writes the rules section first.
Find the landmines before your agent steps on them.
One command per project. Commit .landmine/index.json and the whole team's agents share it.
$npx landmines scanAlso: npm i -D landmines · brew install devanshranjan10/tap/landmines · Node ≥ 22.12