@patchstack/connect 0.5.22 → 0.5.24

package/AGENT-INSTALL.md

@@ -160,8 +160,10 @@ Only when the person asks you to publish the site. Two things decide whether Pat
   ```
 
   An app with a server needs this for runtime protection: the guard fetches its rules with the key. Without it the deploy is still recognised as long as the packages have not changed since the last scan, but nothing is protected. Never put the key in a committed file, in a public variable (`NEXT_PUBLIC_*`, `VITE_*`), or in your reply.
+- **A host that builds the site itself but is not named under "How each environment is labelled"** — ChatGPT Sites (`*.chatgpt.site`, published from Codex) is one — gives Patchstack nothing that says "production", so its builds report `local` and the live site is never recognised as deployed. In that host's environment settings for the published site, set two variables: `PATCHSTACK_API_KEY`, read from `.patchstackrc.local.json` as above, and `PATCHSTACK_ENVIRONMENT=production`. Set the label only where the published build reads it, never in a committed file, and not in settings a preview or the local dev server also reads. Then publish again: the deployed site keeps serving the build from before setup until it is rebuilt.
 - **Check the live site after deploying**, and tell the person what you found:
   - `curl -s <live url> | grep -ac __PATCHSTACK_PROD__` prints `1` or more. `0` means the build did not know it was production, and the widget will treat the live site as a preview.
+  - A site published privately answers `curl` with the host's sign-in page, so the check above prints `0` whatever was deployed — check the status code first (`curl -s -o /dev/null -w "%{http_code}" <live url>`). On a `401`, `403` or a redirect to a sign-in page, ask the person to open the live site while signed in and run `window.__PATCHSTACK_BUILD__` in the browser console: a short build ID means the marker is live, `undefined` means it is not. Patchstack cannot read a private page either, so its dashboard shows the deploy as reported, not confirmed, until a signed-in visit lets the widget report the build. Tell the person that, rather than describing the deploy as confirmed.
   - `curl -s -o /dev/null -w "%{http_code}" <live url>/.patchstackrc.local.json` is not `200`. A `200` means the API key was published: delete the deploy and tell the person.
   - The owner reaches their dashboard on the live site by adding `#patchstack` to the address, for example `https://example.com/#patchstack`. Visitors never see the owner panels there.
 

package/dist/cli.js

@@ -7181,6 +7181,17 @@ function npmPackageOf(spec) {
 // src/map/sinks.ts
 import { createHash as createHash4 } from "crypto";
 
+// src/map/capabilities.ts
+var PACKAGE_SINK_MODELS = [
+  {
+    package: "node-serialize",
+    api: "unserialize",
+    sinkKind: "eval",
+    argumentRole: "code",
+    candidateFamily: "code-injection"
+  }
+];
+
 // src/map/scope.ts
 var scopeCache = /* @__PURE__ */ new WeakMap();
 function declarationOf(id, ts) {
@@ -7300,9 +7311,10 @@ var FS_PACKAGES = ["fs-extra", "graceful-fs", "memfs"];
 var isFsPackage = (pkg) => /^node:fs(\/promises)?$/.test(pkg) || FS_PACKAGES.includes(pkg);
 var EXEC_PACKAGES = ["execa", "cross-spawn", "shelljs", "zx"];
 var isExecPackage = (pkg) => pkg === "node:child_process" || EXEC_PACKAGES.includes(pkg);
-var DESERIALIZE_CALLS = /^unserialize$/;
-var DESERIALIZE_PACKAGES = ["node-serialize"];
-var isDeserializePackage = (pkg) => DESERIALIZE_PACKAGES.includes(pkg);
+var deserializeModel = (pkg, api) => PACKAGE_SINK_MODELS.find(
+  (model) => model.sinkKind === "eval" && model.package === pkg && (api === void 0 || model.api === api)
+);
+var isDeserializePackage = (pkg) => deserializeModel(pkg) !== void 0;
 function recognizedSinkKinds(pkg) {
   const kinds = [];
   if (isDbPackage(pkg)) kinds.push("db");
@@ -7449,7 +7461,7 @@ function directSinks(node, ts, bindings, ctx) {
           if (EXEC_CALLS.test(method) && b.pkg && isExecPackage(b.pkg)) {
             push({ kind: "exec", package: b.pkg, op: method, attribution: "import", ...spanOf(n) });
           }
-          if (DESERIALIZE_CALLS.test(method) && b.pkg && isDeserializePackage(b.pkg)) {
+          if (b.pkg && deserializeModel(b.pkg, method)) {
             push({ kind: "eval", provider: b.root, package: b.pkg, op: method, attribution: "import", ...spanOf(n) });
           }
           if (HTTP_MEMBER_METHODS.has(method)) {
@@ -7479,7 +7491,7 @@ function directSinks(node, ts, bindings, ctx) {
           push({ kind: "exec", package: pkg, op: name, attribution: "import", ...spanOf(n) });
         }
         if (name === "eval" && trueGlobal) push({ kind: "eval", op: "eval", attribution: "global", ...spanOf(n) });
-        if (DESERIALIZE_CALLS.test(name) && pkg && isDeserializePackage(pkg)) {
+        if (pkg && deserializeModel(pkg, name)) {
           push({ kind: "eval", package: pkg, op: name, attribution: "import", ...spanOf(n) });
         }
       }
@@ -7558,7 +7570,10 @@ var CANDIDATE_FAMILIES = {
 };
 function argumentRoleOf(sinkKind, method, index, total = 0) {
   if (sinkKind === "eval" && method === "Function") return index === total - 1 ? "code" : "args";
-  if (sinkKind === "eval" && method === "unserialize") return index === 0 ? "code" : "unknown";
+  const packageModel = PACKAGE_SINK_MODELS.find(
+    (model) => model.sinkKind === sinkKind && model.api === method
+  );
+  if (packageModel) return index === 0 ? packageModel.argumentRole : "unknown";
   const table = method ? ARGUMENT_ROLES[sinkKind]?.[method] : void 0;
   return table?.[index] ?? "unknown";
 }