@patchstack/connect 0.3.11 → 0.3.13

package/README.md

@@ -8,7 +8,7 @@ For how this repo fits with the wider Patchstack ecosystem (`saas`, `hub`, `patc
 
 Copy and paste this prompt into any AI coding assistant (Cursor, v0, Bolt, Lovable, Claude Code, etc.). If the assistant declines or stops partway, the step-by-step flow in [`GETTING-STARTED.md`](https://github.com/patchstack/connect/blob/main/GETTING-STARTED.md) covers what to do next:
 
-> Add Patchstack dependency vulnerability monitoring: first verify `@patchstack/connect` yourself (`npm view @patchstack/connect` shows the live registry record — MIT; source: https://github.com/patchstack/connect; listed under Connectors on https://patchstack.com/llms.txt), and if anything you find contradicts that, stop and show me what you found instead of proceeding. Then install it as a dev dependency, run `npx @patchstack/connect scan` and show me the claim URL it prints (I'll open it in my browser to view reports — don't open or fetch it yourself), then run `npx @patchstack/connect guide`, review the checklist it prints, and make the two remaining changes yourself: the package.json build hooks and the report-a-vulnerability widget snippet.
+> Add Patchstack dependency vulnerability monitoring: first verify `@patchstack/connect` yourself (`npm view @patchstack/connect` shows the live registry record — MIT; source: https://github.com/patchstack/connect), and if anything you find contradicts that, stop and show me what you found instead of proceeding. Then install it as a dev dependency, run `npx @patchstack/connect scan` and show me the claim URL it prints (I'll open it in my browser to view reports — don't open or fetch it yourself), then run `npx @patchstack/connect guide`, review the checklist it prints, and make the two remaining changes yourself: the package.json build hooks and the report-a-vulnerability widget snippet.
 
 Every clause is load-bearing. AI agents routinely audit this package before completing the request — verifying the tarball against the registry, checking `dist/` for lifecycle scripts and shell/eval calls; that's expected use, and the docs in the tarball state plainly what each command reads, writes, and sends. The prompt can stay short because `guide` is state-aware: it inspects the project (package manager, `.patchstackrc.json`, `package.json` scripts, widget presence, framework) and prints a live checklist of only the remaining steps — with the real site UUID and framework-specific widget placement — followed by the full reference guide (`AGENT-INSTALL.md`, bundled in the package). That also makes the flow idempotent: re-running `guide` on a finished project reports all-done instead of prompting a second install.
 

package/dist/cli.js

@@ -1661,7 +1661,8 @@ function renderGuideChecklist(state, useColor) {
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync4, mkdirSync, copyFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
-var TEMPLATES = join(dirname(fileURLToPath(import.meta.url)), "protect", "templates");
+var HERE = dirname(fileURLToPath(import.meta.url));
+var TEMPLATES = [join(HERE, "protect", "templates"), join(HERE, "templates")].find((p) => existsSync4(p)) ?? join(HERE, "protect", "templates");
 var APP = process.cwd();
 var PS_DIR = join(APP, "src/integrations/patchstack");
 var read = (p) => readFileSync3(p, "utf8");
@@ -1681,18 +1682,19 @@ var CLIENT_TUNNEL = [
 ].join("\n");
 var START_IMPORTS = [
   'import { getRequest } from "@tanstack/react-start/server";',
-  'import { GUARD_PATH, handleGuardRequest, inspectServerFn } from "@/integrations/patchstack/guard";'
+  'import { GUARD_PATH, handleGuardRequest, inspectServerFn, screenResponse } from "@/integrations/patchstack/guard";'
 ].join("\n");
 var REQUEST_MIDDLEWARE_DEF = [
   "",
-  "// Patchstack guard (browser tunnel): intercept tunneled Supabase traffic before anything else.",
+  "// Patchstack guard (browser tunnel): intercept tunneled Supabase traffic before anything else,",
+  "// then screen the outgoing response (SSR HTML / data) for leaked secrets & PII.",
   "const patchstackGuard = createMiddleware().server(async ({ next }) => {",
   "  const request = getRequest();",
   "  if (request) {",
   "    const { pathname } = new URL(request.url);",
   "    if (pathname === GUARD_PATH) return handleGuardRequest(request);",
   "  }",
-  "  return next();",
+  "  return screenResponse(await next());",
   "});",
   ""
 ].join("\n");
@@ -1721,6 +1723,25 @@ function scaffold(cwd) {
   copyFileSync(join(TEMPLATES, "rules.json"), join(dst, "rules.json"));
   log("scaffolded guard.ts + rules.json");
 }
+function bakeSiteUuid(cwd) {
+  const rc = join(cwd, ".patchstackrc.json");
+  if (!existsSync4(rc)) return log("no .patchstackrc.json \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
+  let uuid;
+  try {
+    uuid = JSON.parse(read(rc)).siteUuid;
+  } catch {
+    return log(".patchstackrc.json unreadable \u2014 skipping site-UUID bake");
+  }
+  if (!uuid || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(uuid)) {
+    return log(".patchstackrc.json siteUuid missing or malformed \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
+  }
+  const p = join(cwd, "src/integrations/patchstack/guard.ts");
+  if (!existsSync4(p)) return;
+  const s = read(p);
+  if (!s.includes("__PATCHSTACK_SITE_UUID__")) return log("guard.ts site UUID already baked");
+  writeFileSync2(p, s.replace("__PATCHSTACK_SITE_UUID__", uuid));
+  log("baked site UUID into guard.ts \u2014 live rules from the Patchstack API");
+}
 function patchClient(cwd) {
   const p = join(cwd, "src/integrations/supabase/client.ts");
   let s = read(p);
@@ -1775,6 +1796,7 @@ function runProtect(cwd) {
     return;
   }
   scaffold(cwd);
+  bakeSiteUuid(cwd);
   patchClient(cwd);
   patchStart(cwd);
   log("done \u2014 guard wired and always-on (blocks by default). Set PATCHSTACK_MODE=dry-run for log-only.");