@patchstack/connect 0.5.20 → 0.5.21

package/AGENT-INSTALL.md

@@ -277,6 +277,8 @@ Handle it in this order:
 
 - `apiKey` (in `.patchstackrc.local.json`, which is git-ignored; also `PATCHSTACK_API_KEY`, WP format `{secret}-{oauth.id}`) — one credential for both paths. It authenticates **Pulse ingest** (manifest, attack-surface map, package removal, rule detections), where it is exchanged for a short-lived token rather than sent directly, and **block-log reporting** through the connector `POST /api/logs/log`, so "Threats blocked" fills in the dashboard.
 
+A production build of a registered site that has **no** credential — a hosted builder's publish, which builds from the committed project and so never sees the git-ignored key file — cannot send its manifest. `scan` and `mark-build` then POST `monitor/pulse/build/<your site uuid>` instead, with no credential and exactly three fields: the manifest checksum, `environment: "production"`, and (`mark-build` only) the marker result. **No package names, no address, no name, no environment variable values.** Patchstack accepts it only when the checksum is the build it last scanned for this site, and shows the build as reported rather than deployed until the live page is seen running it. A publish that changed your packages is refused; set `PATCHSTACK_API_KEY` for that build.
+
 It is server-only. Never put it in the widget tag, client bundles, or public env vars (`NEXT_PUBLIC_*`, etc.). Prefer `PATCHSTACK_API_KEY` in production; the git-ignored `.patchstackrc.local.json` is fine for local DX. If it is lost, `npx @patchstack/connect login` recovers it via dashboard approval — do not delete the file and re-provision, which would create a second site. Opt out of reporting with `PATCHSTACK_TELEMETRY=off`. If the project must not carry the widget, persist `"widget": false` in `.patchstackrc.json`; otherwise the next scan re-adds it.
 
    A `pulseAuth` field is still honoured if a project has one, and `PATCHSTACK_PULSE_AUTH` still overrides it, for deployments that authenticate Pulse ingest with a different credential from block-logs. Do not add either yourself: they are unnecessary when the two share one credential, which is the default.

package/README.md

@@ -262,7 +262,7 @@ group, and a verification that can leave a server running is worse than an unans
 
 No other command runs your application. `protect`, `protect --check`, `setup`, `guide`, `scan`,
 `status` and `mark-build` only read and write files, and — for `scan` and `mark-build` — report the
-dependency manifest they read.
+dependency manifest they read, or only its checksum from a production build that has no API key.
 
 ## Configuration
 
@@ -310,7 +310,7 @@ The site UUID identifies the site and is **not** a secret — the Patchstack Con
 
 If it is ever lost, `npx @patchstack/connect login` recovers it — approval happens in the dashboard and rotates the credential.
 
-The credential's file is never committed, so CI needs `PATCHSTACK_API_KEY` in the environment (and `PATCHSTACK_SITE_UUID` too where `.patchstackrc.json` is also absent). Precedence is CLI flag → env var → `.patchstackrc.local.json` → `.patchstackrc.json`.
+The credential's file is never committed, so CI needs `PATCHSTACK_API_KEY` in the environment (and `PATCHSTACK_SITE_UUID` too where `.patchstackrc.json` is also absent). A production build that has the site UUID but no key — a hosted builder's publish, typically — reports only that the build ran: it POSTs the manifest checksum to `monitor/pulse/build/<uuid>` without a credential and without the package list, and Patchstack accepts it only for the build it last scanned. Set the key there if the publish can change your packages. Precedence is CLI flag → env var → `.patchstackrc.local.json` → `.patchstackrc.json`.
 
 A `pulseAuth` field is still read if present, and `PATCHSTACK_PULSE_AUTH` still overrides, for deployments that authenticate Pulse ingest with a different credential from block-logs. Neither is written by default, and neither is needed when the two share one.
 

package/dist/cli.js

@@ -1876,11 +1876,79 @@ async function postManifestWithEnvironmentFallback(config, payload, marker = nul
       environmentUsed: config.environment
     };
   } catch (err) {
+    if (err instanceof PatchstackError && err.code === "UNAUTHORIZED" && reportsBuildWithoutCredential(config)) {
+      return {
+        response: await postBuildReport(config, computeManifestChecksum(payload.packages), marker),
+        environmentUsed: "production"
+      };
+    }
     if (config.environment !== "local" || !environmentRejected(err)) throw err;
     const fallback = { ...config, environment: "sandbox" };
     return { response: await postManifest(fallback, payload, marker), environmentUsed: "sandbox" };
   }
 }
+function reportsBuildWithoutCredential(config) {
+  const hasCredential = typeof config.pulseAuth === "string" && config.pulseAuth.length > 0;
+  return !hasCredential && config.environment === "production" && config.siteUuid !== null && config.siteUuid !== "";
+}
+function buildReportUrl(manifestEndpoint, siteUuid) {
+  const url = new URL(manifestEndpoint);
+  const path17 = url.pathname.replace(/\/$/, "");
+  const id = encodeURIComponent(siteUuid);
+  url.pathname = path17.endsWith("/manifest") ? `${path17.slice(0, -"/manifest".length)}/build/${id}` : `/monitor/pulse/build/${id}`;
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+async function postBuildReport(config, checksum, marker = null) {
+  const siteUuid = config.siteUuid ?? "";
+  const url = buildReportUrl(config.endpoint, siteUuid);
+  assertConnectableEndpoint(config, url);
+  const needsKey = authFailureMessage(401, config) ?? "Set PATCHSTACK_API_KEY where this build runs.";
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "User-Agent": "@patchstack/connect"
+      },
+      body: JSON.stringify({ checksum, environment: "production", ...marker !== null ? { marker } : {} }),
+      signal: AbortSignal.timeout(config.timeoutMs)
+    });
+  } catch (cause) {
+    throw new PatchstackError(
+      isTimeoutError(cause) ? `Patchstack request to ${url} timed out after ${config.timeoutMs}ms. Override with PATCHSTACK_TIMEOUT_MS.` : `Could not reach Patchstack at ${url}. Check your network connection.`,
+      isTimeoutError(cause) ? "NETWORK_TIMEOUT" : "NETWORK_ERROR",
+      cause
+    );
+  }
+  let parsed = null;
+  try {
+    const text = await readBoundedText(response);
+    parsed = text.length > 0 ? JSON.parse(text) : null;
+  } catch {
+    parsed = null;
+  }
+  if (response.status === 422) {
+    throw new PatchstackError(
+      safeDisplayString(parsed?.error) ?? `This build is not the one Patchstack last scanned. ${needsKey}`,
+      "UNAUTHORIZED"
+    );
+  }
+  if (response.status < 200 || response.status >= 300) {
+    throw new PatchstackError(needsKey, "UNAUTHORIZED");
+  }
+  const result = parsed?.result;
+  return {
+    uuid: siteUuid,
+    stored: false,
+    checksum,
+    reason: "build-reported",
+    message: result === "already-reported" ? "Patchstack already knew this build was published" : "Told Patchstack this build was published. There is no API key here, so the package list was not sent again"
+  };
+}
 async function postManifest(config, payload, marker = null) {
   const url = buildEndpointUrl(config.endpoint, config.siteUuid);
   const timeoutMs = config.timeoutMs;
@@ -10463,6 +10531,8 @@ async function runScan(args, options = {}) {
     say(`Stored manifest #${response.manifest_id} (checksum ${response.checksum}).`);
   } else if (response.reason === "duplicate") {
     report.done.unshift(checked, "No changes since the last check");
+  } else if (response.reason === "build-reported") {
+    report.done.unshift(checked, response.message ?? "Reported this production build");
   } else {
     report.missing.push({
       text: "Patchstack did not save this check",
@@ -10508,7 +10578,7 @@ async function runScan(args, options = {}) {
   if (config.widget && effectiveUuid !== null && effectiveUuid.length > 0) {
     reportSourceWidget(effectiveUuid, shellFramework, report);
   }
-  const synced = effectiveUuid !== null && effectiveUuid.length > 0 && (response.stored || response.reason === "duplicate");
+  const synced = effectiveUuid !== null && effectiveUuid.length > 0 && (response.stored || response.reason === "duplicate" || response.reason === "build-reported");
   const outcome = {
     connected,
     synced,