@patchstack/connect 0.5.5 → 0.5.6

package/AGENT-INSTALL.md

@@ -120,7 +120,7 @@ This is a request, not a mechanism: nothing in the install depends on it. Do it
 
    **Bun-managed projects:** `bun run` does not execute npm-style `pre`/`post` scripts, so wire the build script directly instead: `"build": "patchstack-connect scan && <existing build command> && patchstack-connect mark-build"`.
 
-3. **Verify the disclosure widget** — a floating "Report a vulnerability" button. `scan` installs it automatically into a plain HTML shell, and `mark-build` carries it into built HTML. Only when `scan` reported that it found no editable shell (frameworks whose root layout is code, e.g. Next.js/Nuxt/Astro) add the one-liner it printed to the root layout yourself, just before `</body>` (never a JS entry point), reading `siteUuid` from `.patchstackrc.json`. On those same roots the widget also needs the production marker above the tag — `scan` adds it automatically to a JSX root, and prints it to paste when it finds no anchor. A server-rendered site without the marker serves the build-mode claim flow to its visitors:
+3. **Verify the disclosure widget** — a floating "Report a vulnerability" button. `scan` installs it automatically into a plain HTML shell **or a JSX root** (Next, Remix, React Router, TanStack Start, Gatsby), and `mark-build` carries it into built HTML. Only when `scan` reported that it found no editable shell at all — a root whose head mechanism is not a plain script tag, e.g. Nuxt's `useHead` or an Astro layout — add the one-liner it printed to the root layout yourself, just before `</body>` (never a JS entry point), reading `siteUuid` from `.patchstackrc.json`. On those same roots the widget also needs the production marker above the tag — `scan` adds it automatically to a JSX root, and prints it to paste when it finds no anchor. A server-rendered site without the marker serves the build-mode claim flow to its visitors:
 
    ```html
    <script src="https://cdn.patchstack.com/patchstack-widget.js" data-site-uuid="<SITE_UUID>" defer></script>

package/README.md

@@ -306,6 +306,7 @@ The widget is a floating "Report a vulnerability" button — a disclosure channe
   <script src="https://cdn.patchstack.com/patchstack-widget.js" data-site-uuid="<SITE_UUID>" defer data-patchstack-connect-widget="true"></script>
   ```
 
+- **`scan`** installs the widget tag into a plain HTML shell, and — where there is none — into a JSX root (`src/routes/__root.tsx`, `app/layout.tsx`, …), just before `</body>`. The same tag serves both: JSX reads `defer` as a boolean attribute and passes `data-*` through. A server-rendered app has no HTML shell at all, so without this its published site carries no widget and Patchstack never hears from the live page.
 - **`scan`** also adds the production marker when the root shell is JSX rather than HTML (`src/routes/__root.tsx`, `app/layout.tsx`, …), above the widget tag and guarded by the framework's production expression. A server-rendered app emits no built HTML for `mark-build` to stamp, so without it the widget reads the published site as build mode and shows the claim flow to visitors instead of the report form.
 
   Re-runs update the tag in place (the `data-patchstack-connect-widget` attribute marks it as connector-managed); a pre-existing manual widget tag is left untouched. `--dry-run` never edits anything; a failed post still skips the widget tag (it needs the site UUID) but the production marker may already have been written, since it runs before the post. Projects whose root layout is code rather than HTML (Next.js, Nuxt, Astro, …) get the exact snippet and target file printed instead — `guide` shows framework-specific placement.

package/dist/cli.js

@@ -2513,12 +2513,16 @@ function productionGate(framework) {
 function hasJsxShell(framework) {
   return framework !== null && JSX_SHELL_FRAMEWORKS.has(framework);
 }
-function buildSourceMarkerSnippet(framework) {
+function buildSourceMarkerSnippet(framework, checksum = null) {
   const gate = productionGate(framework);
+  const statements = ["window.__PATCHSTACK_PROD__=true;"];
+  if (checksum !== null && checksum !== "") {
+    statements.push(`window.__PATCHSTACK_BUILD__=${JSON.stringify(checksum)};`);
+  }
   return `{${gate} && (
   <script
     ${MARKER_ATTR}="true"
-    dangerouslySetInnerHTML={{ __html: 'window.__PATCHSTACK_PROD__=true;' }}
+    dangerouslySetInnerHTML={{ __html: '${statements.join("")}' }}
   />
 )}`;
 }
@@ -2581,7 +2585,7 @@ function findJsxShellAnchor(source, tagName) {
   }
   return null;
 }
-function ensureMarkerInJsxShell(source, framework) {
+function ensureMarkerInJsxShell(source, framework, checksum = null) {
   if (!hasJsxShell(framework)) {
     return { source, action: "unsupported" };
   }
@@ -2589,7 +2593,7 @@ function ensureMarkerInJsxShell(source, framework) {
   if (stripped.includes(PROD_MARKER_GLOBAL)) {
     return { source: stripped, action: "manual" };
   }
-  const block = (indent) => [REGION_OPEN, ...buildSourceMarkerSnippet(framework).split("\n"), REGION_CLOSE].map((line) => `${indent}${line}`).join("\n");
+  const block = (indent) => [REGION_OPEN, ...buildSourceMarkerSnippet(framework, checksum).split("\n"), REGION_CLOSE].map((line) => `${indent}${line}`).join("\n");
   for (const tagName of ["head", "body"]) {
     const anchor = findJsxShellAnchor(stripped, tagName);
     if (anchor === null) continue;
@@ -2604,13 +2608,13 @@ ${block(indent)}${separator}${remainder}`,
   }
   return { source: stripped, action: "no-anchor" };
 }
-function ensureSourceMarker(cwd, shell, framework) {
+function ensureSourceMarker(cwd, shell, framework, checksum = null) {
   if (shell === null) {
     return { shell: null, source: "", action: "no-anchor" };
   }
   const file = path9.resolve(cwd, shell);
   const before = readFileSync2(file, "utf8");
-  const result = ensureMarkerInJsxShell(before, framework);
+  const result = ensureMarkerInJsxShell(before, framework, checksum);
   if (result.source !== before) {
     writeFileSync(file, result.source);
   }
@@ -5051,12 +5055,15 @@ function findSourceShell(cwd) {
   }
   return null;
 }
-function ensureSourceWidget(cwd, siteUuid) {
-  const shell = findSourceShell(cwd);
+function ensureSourceWidget(cwd, siteUuid, jsxShell = null) {
+  const shell = findSourceShell(cwd) ?? jsxShell;
   if (shell === null) {
     return { shell: null, action: "no-shell" };
   }
   const file = path11.join(cwd, shell);
+  if (!existsSync12(file)) {
+    return { shell: null, action: "no-shell" };
+  }
   const before = readFileSync9(file, "utf8");
   const { html, action } = ensureWidgetInHtml(before, siteUuid);
   if (html !== before) {
@@ -8927,8 +8934,9 @@ async function runScan(args, options = {}) {
     const cleared = applyBuildStamp(process.cwd(), null);
     if (cleared.kind === "cleared") console.log(`Removed the previous map binding from ${cleared.file}.`);
   }
+  const shellFramework = detectStack(payload.packages).framework;
   if (config.widget) {
-    reportSourceMarker(detectStack(payload.packages).framework);
+    reportSourceMarker(shellFramework, computeManifestChecksum(payload.packages));
   }
   const provisioning = config.siteUuid === null;
   if (provisioning) {
@@ -8974,7 +8982,7 @@ async function runScan(args, options = {}) {
   const connected = response.claim?.state === "claimed" || response.claim?.state === "owned-by-you";
   const effectiveUuid = config.siteUuid ?? response.uuid ?? null;
   if (config.widget && effectiveUuid !== null && effectiveUuid.length > 0) {
-    reportSourceWidget(effectiveUuid);
+    reportSourceWidget(effectiveUuid, shellFramework);
   }
   const linkUuid = response.uuid ?? config.siteUuid;
   if (!connected && (provisioning || claimLines.length > 0) && linkUuid !== null && linkUuid !== void 0 && linkUuid.length > 0) {
@@ -9005,9 +9013,11 @@ async function runScan(args, options = {}) {
   }
   return 0;
 }
-function reportSourceWidget(siteUuid) {
+function reportSourceWidget(siteUuid, framework) {
   try {
-    const result = ensureSourceWidget(process.cwd(), siteUuid);
+    const hint = hasJsxShell(framework) ? resolveWidgetFileHint(process.cwd(), framework) : null;
+    const jsxShell = hint !== null && !hint.toLowerCase().endsWith(".html") ? hint : null;
+    const result = ensureSourceWidget(process.cwd(), siteUuid, jsxShell);
     switch (result.action) {
       case "added":
         console.log(`Widget: added the "Report a vulnerability" tag to ${result.shell}. Reload your preview to see it.`);
@@ -9026,7 +9036,7 @@ function reportSourceWidget(siteUuid) {
         console.log(`  ${buildWidgetTag(siteUuid)}`);
         break;
       case "no-shell":
-        console.log("Widget: no plain HTML shell found (index.html / public/index.html / src/app.html).");
+        console.log("Widget: no root shell found to edit (index.html / public/index.html / src/app.html, or a JSX root).");
         console.log("Add this tag to your root layout before </body> (run `guide` for framework-specific placement):");
         console.log(`  ${buildWidgetTag(siteUuid)}`);
         break;
@@ -9038,13 +9048,13 @@ function reportSourceWidget(siteUuid) {
     console.warn(`Widget: skipped (${err.message}).`);
   }
 }
-function reportSourceMarker(framework) {
+function reportSourceMarker(framework, checksum = null) {
   try {
     const shell = resolveWidgetFileHint(process.cwd(), framework);
     if (shell === null || shell.toLowerCase().endsWith(".html")) {
       return;
     }
-    const result = ensureSourceMarker(process.cwd(), shell, framework);
+    const result = ensureSourceMarker(process.cwd(), shell, framework, checksum);
     switch (result.action) {
       case "added":
         console.log(`Production marker: added to ${shell} (guarded by ${productionGate(framework)}).`);