@patchstack/connect 0.5.9 → 0.5.11

package/dist/cli.js

@@ -3082,7 +3082,7 @@ function ensureSourceMarker(cwd, shell, framework, checksum = null) {
 }
 
 // src/guide.ts
-import { existsSync as existsSync13, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync5 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync5 } from "fs";
 import path12 from "path";
 
 // src/architecture.ts
@@ -4311,7 +4311,7 @@ var nuxtAdapter = {
 };
 
 // src/protect/install/find-app.ts
-import { readFileSync as readFileSync8, existsSync as existsSync7, readdirSync as readdirSync3, lstatSync as lstatSync2 } from "fs";
+import { readFileSync as readFileSync8, readdirSync as readdirSync3, lstatSync as lstatSync2 } from "fs";
 import { join as join11, relative as relative3, dirname as dirname4 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([
   "node_modules",
@@ -4333,7 +4333,6 @@ var SKIP_DIRS2 = /* @__PURE__ */ new Set([
 ]);
 var MAX_DEPTH = 8;
 function findAppInstance(cwd, re) {
-  const root = existsSync7(join11(cwd, "src")) ? join11(cwd, "src") : cwd;
   const found = [];
   const walk2 = (dir, depth) => {
     if (depth > MAX_DEPTH) return;
@@ -4372,7 +4371,7 @@ function findAppInstance(cwd, re) {
       }
     }
   };
-  walk2(root, 0);
+  walk2(cwd, 0);
   if (found.length === 0) return null;
   const declared = declaredEntries(cwd);
   const chosen = found.slice().sort((a, b) => rankEntry({ ...a, declared: declared.has(a.relPath) }, { ...b, declared: declared.has(b.relPath) }))[0];
@@ -4430,16 +4429,16 @@ function importSpecifier(fromRel, toRel, preserveExtension = false) {
 }
 
 // src/protect/install/register.ts
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync9 } from "fs";
 import { join as join14, resolve as resolve3 } from "path";
 
 // src/protect/install/generic.ts
-import { readFileSync as readFileSync9, existsSync as existsSync9, readdirSync as readdirSync4, lstatSync as lstatSync3 } from "fs";
+import { readFileSync as readFileSync9, existsSync as existsSync8, readdirSync as readdirSync4, lstatSync as lstatSync3 } from "fs";
 import { join as join13, dirname as dirname6 } from "path";
 
 // src/protect/install/source-scope.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { dirname as dirname5, join as join12, resolve as resolve2 } from "path";
 
 // src/protect/install/node-flags.ts
@@ -4731,7 +4730,7 @@ function moduleKindOf(filePath, packageIsModule) {
 function resolvesToGuardModule(specifier, query) {
   const resolved = resolve2(dirname5(query.fromFile), specifier);
   if (withoutModuleExtension(resolved) !== join12(query.guardDir, "guard")) return false;
-  const existing = GUARD_FILENAMES.filter((name) => existsSync8(join12(query.guardDir, name)));
+  const existing = GUARD_FILENAMES.filter((name) => existsSync7(join12(query.guardDir, name)));
   if (existing.length === 0) return false;
   const extension = /(\.[A-Za-z0-9]+)$/.exec(specifier)?.[1] ?? "";
   if (!query.strictExtensions) return true;
@@ -4740,7 +4739,7 @@ function resolvesToGuardModule(specifier, query) {
     if (query.kind === "cjs") return existing.includes("guard.js");
     return true;
   }
-  if (existsSync8(resolved)) return true;
+  if (existsSync7(resolved)) return true;
   return query.kind === "ts" && extension === ".js" && existing.includes("guard.ts");
 }
 function withoutModuleExtension(filePath) {
@@ -4756,10 +4755,10 @@ function packageIsEsm(cwd) {
   }
 }
 function genericDir(cwd) {
-  return existsSync9(join13(cwd, "src")) ? "src/patchstack" : "patchstack";
+  return existsSync8(join13(cwd, "src")) ? "src/patchstack" : "patchstack";
 }
 function hasTypeScript(cwd) {
-  return existsSync9(join13(cwd, "tsconfig.json")) || candidateEntries(cwd).some((entry) => /\.tsx?$/.test(entry));
+  return existsSync8(join13(cwd, "tsconfig.json")) || candidateEntries(cwd).some((entry) => /\.tsx?$/.test(entry));
 }
 function genericGuardTarget(cwd) {
   if (hasTypeScript(cwd)) {
@@ -4773,7 +4772,7 @@ function genericGuardTarget(cwd) {
 function genericScaffoldFiles(cwd) {
   const dir = genericDir(cwd);
   const candidates = ["guard.ts", "guard.js", "guard.cjs", "rules.json"];
-  return candidates.map((file) => `${dir}/${file}`).filter((relative8) => existsSync9(join13(cwd, relative8)));
+  return candidates.map((file) => `${dir}/${file}`).filter((relative8) => existsSync8(join13(cwd, relative8)));
 }
 function scaffoldGeneric(cwd, opts, guardTemplate, guardFile) {
   const target = genericGuardTarget(cwd);
@@ -4788,7 +4787,7 @@ function scaffoldGeneric(cwd, opts, guardTemplate, guardFile) {
   const changed = [guardRel];
   if (!opts.demo) bakeSiteUuid(cwd, guardRel);
   const rulesDst = join13(dst, "rules.json");
-  if (opts.demo || !existsSync9(rulesDst)) {
+  if (opts.demo || !existsSync8(rulesDst)) {
     copyProjectFileSync(cwd, join13(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
     changed.push(`${dir}/rules.json`);
   }
@@ -4810,10 +4809,10 @@ function candidateEntries(cwd) {
     "app.ts",
     "app.js"
   ];
-  const hits = names.filter((n) => existsSync9(join13(cwd, n)));
+  const hits = names.filter((n) => existsSync8(join13(cwd, n)));
   try {
     const pkg = JSON.parse(read(join13(cwd, "package.json")));
-    if (typeof pkg.main === "string" && existsSync9(join13(cwd, pkg.main))) hits.push(pkg.main);
+    if (typeof pkg.main === "string" && existsSync8(join13(cwd, pkg.main))) hits.push(pkg.main);
   } catch {
   }
   return [...new Set(hits)];
@@ -4924,7 +4923,7 @@ function escapeForRegExp(value) {
 function genericVerify(cwd) {
   const dir = genericDir(cwd);
   const target = genericGuardTarget(cwd);
-  const present2 = GUARD_FILENAMES.find((name) => existsSync9(join13(cwd, dir, name)));
+  const present2 = GUARD_FILENAMES.find((name) => existsSync8(join13(cwd, dir, name)));
   const scaffolded = present2 !== void 0;
   const imported = scaffolded && guardIsImported(cwd, join13(cwd, dir, present2));
   return {
@@ -4962,7 +4961,7 @@ var NON_RUNTIME_DIRS = /* @__PURE__ */ new Set([
 function guardIsImported(cwd, guardPath) {
   const guardDir = dirname6(guardPath);
   const packageIsModule = packageIsEsm(cwd);
-  const root = existsSync9(join13(cwd, "src")) ? join13(cwd, "src") : cwd;
+  const root = existsSync8(join13(cwd, "src")) ? join13(cwd, "src") : cwd;
   let found = false;
   const walk2 = (d, depth) => {
     if (found || depth > 8) return;
@@ -5166,10 +5165,10 @@ function serverIsGuarded(cwd, spec, server, guardDir) {
   return !spec.callAfter || routesBefore(source, server.appVar, state.callIndex).length === 0;
 }
 function verifyRegister(cwd, spec) {
-  const dir = existsSync10(join14(cwd, "src")) ? "src/patchstack" : "patchstack";
+  const dir = existsSync9(join14(cwd, "src")) ? "src/patchstack" : "patchstack";
   const entry = findAppInstance(cwd, spec.appRe);
   const target = entry ? guardTarget(cwd, entry.relPath, spec) : null;
-  const scaffolded = target ? existsSync10(join14(cwd, dir, target.file)) : false;
+  const scaffolded = target ? existsSync9(join14(cwd, dir, target.file)) : false;
   const entrySource = entry ? read(join14(cwd, entry.relPath)) : "";
   const state = entry ? wiringState(entrySource, spec, entry.appVar, entry.relPath, { cwd, guardDir: dir }) : { importAtTopLevel: false, callInAppScope: false, ordered: false, callIndex: -1, appIndex: -1 };
   const wired = state.importAtTopLevel && state.callInAppScope && state.ordered;
@@ -5260,7 +5259,7 @@ var expressAdapter = {
 };
 
 // src/protect/install/reporting.ts
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { join as join15 } from "path";
 
 // src/protect/reporting-state.js
@@ -5321,7 +5320,7 @@ function explainReportingState(state) {
 function siteIdentity(cwd, env) {
   const rc = join15(cwd, ".patchstackrc.json");
   let recorded;
-  if (existsSync11(rc)) {
+  if (existsSync10(rc)) {
     try {
       recorded = JSON.parse(read(rc)).siteUuid;
     } catch {
@@ -5470,7 +5469,7 @@ function runVerify(cwd) {
 }
 
 // src/widget.ts
-import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
 import path11 from "path";
 var WIDGET_SCRIPT_URL = "https://cdn.patchstack.com/patchstack-widget.js";
 var WIDGET_MARKER_ATTR = "data-patchstack-connect-widget";
@@ -5509,7 +5508,7 @@ ${indent}</body>`;
 }
 function findSourceShell(cwd) {
   for (const candidate of SOURCE_SHELL_CANDIDATES) {
-    if (existsSync12(path11.join(cwd, candidate))) {
+    if (existsSync11(path11.join(cwd, candidate))) {
       return candidate;
     }
   }
@@ -5521,7 +5520,7 @@ function ensureSourceWidget(cwd, siteUuid, jsxShell = null) {
     return { shell: null, action: "no-shell" };
   }
   const file = path11.join(cwd, shell);
-  if (!existsSync12(file)) {
+  if (!existsSync11(file)) {
     return { shell: null, action: "no-shell" };
   }
   const before = readFileSync10(file, "utf8");
@@ -5606,7 +5605,7 @@ function detectPackageManager(cwd) {
     return declared;
   }
   for (const { filename, pm } of PM_BY_LOCKFILE) {
-    if (existsSync13(path12.join(cwd, filename))) {
+    if (existsSync12(path12.join(cwd, filename))) {
       return pm;
     }
   }
@@ -5703,7 +5702,7 @@ function resolveWidgetFileHint(cwd, framework) {
     ...GENERIC_WIDGET_FILES
   ];
   for (const candidate of candidates) {
-    if (existsSync13(path12.join(cwd, candidate))) {
+    if (existsSync12(path12.join(cwd, candidate))) {
       return candidate;
     }
   }
@@ -5823,7 +5822,11 @@ function renderGuideChecklist(state, useColor) {
   lines.push("");
   if (!state.hasPackageJson) {
     lines.push(todo("No package.json found in this directory."));
-    lines.push(detail("Run the guide from the project root."));
+    lines.push(detail("For a JS/Node app, run the guide from its package directory; check that package.json is readable and valid."));
+    lines.push(detail("For a standalone HTML/CSS/browser-JavaScript site, use the disclosure widget directly."));
+    lines.push(detail("Do not create a Node project, build hooks, or a server just to install the widget."));
+    lines.push(detail("Use the correct site UUID or widget snippet from the Patchstack dashboard; never invent one."));
+    lines.push(detail('See "Plain HTML sites" in AGENT-INSTALL.md. Widget-only setup provides no dependency scan or runtime protection.'));
     return lines.join("\n");
   }
   if (countRemainingSteps(state) > 0) {
@@ -5855,6 +5858,8 @@ function renderGuideChecklist(state, useColor) {
     lines.push(detail("Run \u2192 npx @patchstack/connect scan"));
     lines.push(detail("Reads the lockfile, registers the project, writes .patchstackrc.json,"));
     lines.push(detail("and prints a dashboard link. The CLI prints the link but never opens it."));
+    lines.push(detail("If your tool refuses to run this command, hand it to the person instead of working"));
+    lines.push(detail('around it \u2014 see "When your tool will not run this CLI" in the reference guide.'));
   }
   if (state.installScanWired) {
     lines.push(done("Dependency-install scan wired (postinstall)"));
@@ -5943,11 +5948,19 @@ function renderGuideChecklist(state, useColor) {
   }
   lines.push("");
   if (state.claimUrl !== null) {
-    lines.push(` ${paint(ANSI.cyan, "\u279C")} ${paint(ANSI.bold, "Dashboard link (open to view reports):")}`);
-    lines.push(`   ${paint(ANSI.cyan, state.claimUrl)}`);
-    lines.push(detail("Open this link in a browser. The CLI never opens it."));
-    lines.push(detail("Or from this terminal \u2192 npx @patchstack/connect claim"));
-    lines.push(detail("  (prints a link to sign in with, then attaches the site to that account)"));
+    lines.push(` ${paint(ANSI.cyan, "\u279C")} ${paint(ANSI.bold, "Connect this site to your Patchstack account:")}`);
+    let route = 1;
+    if (widgetTagInPlace(state)) {
+      lines.push(`   ${route++}. In the preview \u2014 while the site is unclaimed the widget shows a`);
+      lines.push('      "Connect this website" panel. Signing in there attaches the site.');
+    }
+    lines.push(`   ${route++}. In a browser \u2014 open the dashboard link (the CLI never opens it):`);
+    lines.push(`      ${paint(ANSI.cyan, state.claimUrl)}`);
+    lines.push(`   ${route}. From this terminal \u2192 npx @patchstack/connect claim`);
+    lines.push("      (prints a link to sign in with, then attaches the site to that account)");
+    lines.push(detail("Reports have no owner to reach until one of these completes. The site UUID ships"));
+    lines.push(detail("in the page and claiming is first-come, so an unclaimed site stays claimable by"));
+    lines.push(detail("anyone who loads it."));
     if (state.endpointOverride !== null) {
       lines.push(detail("(this URL inherits the endpoint override above)"));
     }
@@ -5957,9 +5970,11 @@ function renderGuideChecklist(state, useColor) {
   if (widgetTagInPlace(state)) {
     lines.push("");
     lines.push(` ${paint(ANSI.cyan, "\u279C")} ${paint(ANSI.bold, "Refresh the preview to see the widget:")}`);
-    lines.push('   The "Report a vulnerability" button loads with the page, so a preview that was');
-    lines.push("   already open still shows the HTML from before this change. Builders that hot");
-    lines.push("   reload refresh it themselves; if the button is missing, refresh the preview once.");
+    lines.push("   The widget loads with the page, so a preview that was already open still shows");
+    lines.push("   the HTML from before this change. Builders that hot reload refresh it themselves;");
+    lines.push("   if nothing appears, refresh the preview once.");
+    lines.push('   Unclaimed, the widget shows the "Connect this website" panel; the public');
+    lines.push('   "Report a vulnerability" button takes its place once the site is claimed.');
   }
   if (state.siteUuid !== null) {
     lines.push("");
@@ -6293,7 +6308,7 @@ async function claim2(config, onPrompt, deps = {}) {
 import { relative as relative4 } from "path";
 
 // src/protect/install/runtime/entry.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13, realpathSync as realpathSync4, statSync as statSync6 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync13, realpathSync as realpathSync4, statSync as statSync6 } from "fs";
 import { join as join16, resolve as resolve4, sep as sep2 } from "path";
 var CONVENTIONAL = [
   "server.js",
@@ -6390,14 +6405,14 @@ function resolveEntry(cwd) {
   }
   return {
     kind: "unavailable",
-    reason: existsSync14(join16(cwd, "package.json")) ? 'no directly loadable entry was found \u2014 declare one as a "start" script of the form `node <file>`, or run the check against a built output' : "there is no package.json here"
+    reason: existsSync13(join16(cwd, "package.json")) ? 'no directly loadable entry was found \u2014 declare one as a "start" script of the form `node <file>`, or run the check against a built output' : "there is no package.json here"
   };
 }
 
 // src/protect/install/runtime/probe.ts
 import { spawn } from "child_process";
 import { createHash as createHash3, randomBytes } from "crypto";
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import { request as httpRequest } from "http";
 import { request as httpsRequest, Agent as HttpsAgent } from "https";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -6425,7 +6440,7 @@ function preloadPath() {
   ];
   for (const candidate of candidates) {
     const path18 = fileURLToPath2(candidate);
-    if (existsSync15(path18)) return path18;
+    if (existsSync14(path18)) return path18;
   }
   return null;
 }
@@ -9623,14 +9638,21 @@ async function runScan(args, options = {}) {
   const linkUuid = response.uuid ?? config.siteUuid;
   if (!connected && (provisioning || claimLines.length > 0) && linkUuid !== null && linkUuid !== void 0 && linkUuid.length > 0) {
     console.log("");
-    console.log("Open this dashboard link to view vulnerability reports:");
-    console.log(`  ${buildClaimUrl(config.endpoint, linkUuid)}`);
+    console.log("Connect this site to your Patchstack account \u2014 any one of these:");
+    if (config.widget) {
+      console.log('  1. In the preview \u2014 the widget shows a "Connect this website" panel while the');
+      console.log("     site is unclaimed. Signing in there attaches it.");
+      console.log("  2. Open this dashboard link in a browser:");
+      console.log(`     ${buildClaimUrl(config.endpoint, linkUuid)}`);
+      console.log("  3. From this terminal: npx @patchstack/connect claim");
+    } else {
+      console.log("  1. Open this dashboard link in a browser:");
+      console.log(`     ${buildClaimUrl(config.endpoint, linkUuid)}`);
+      console.log("  2. From this terminal: npx @patchstack/connect claim");
+    }
     if (config.endpoint !== DEFAULT_ENDPOINT) {
       console.log("  (this URL inherits the endpoint override above)");
     }
-    console.log("");
-    console.log("Or attach it to your account from this terminal:");
-    console.log("  npx @patchstack/connect claim");
   }
   if (options.showRemainingSetup !== false) {
     try {
@@ -9656,7 +9678,8 @@ function reportSourceWidget(siteUuid, framework) {
     const result = ensureSourceWidget(process.cwd(), siteUuid, jsxShell);
     switch (result.action) {
       case "added":
-        console.log(`Widget: added the "Report a vulnerability" tag to ${result.shell}. Reload your preview to see it.`);
+        console.log(`Widget: added the disclosure widget tag to ${result.shell}. Reload your preview to see it.`);
+        console.log('  Unclaimed, it shows a "Connect this website" panel; the "Report a vulnerability" button replaces it once the site is claimed.');
         break;
       case "updated":
         console.log(`Widget: updated the managed tag in ${result.shell} to site ${siteUuid}.`);
@@ -9888,6 +9911,7 @@ async function runSetup(args) {
   const before = await collectGuideState(process.cwd());
   if (!before.hasPackageJson) {
     console.error("Error: no package.json found. Run setup from the project root.");
+    console.error("For a standalone HTML site, use the widget-only instructions in AGENT-INSTALL.md; do not create a Node project just to run setup.");
     return 1;
   }
   if (before.installed === null) {
@@ -9965,7 +9989,7 @@ function setupOutcome(state, protection, wired) {
   if (protection.install.status === "not-applicable" && protection.install.leftovers.length > 0) {
     warnings.push(`earlier guard scaffold does nothing here and can be deleted: ${protection.install.leftovers.join(", ")}`);
   }
-  if (state.claimUrl !== null) warnings.push("the site is not attached to an account until the dashboard link is opened or `npx @patchstack/connect claim` completes");
+  if (state.claimUrl !== null) warnings.push('the site is not attached to an account until someone signs in through the widget\'s "Connect this website" panel, the dashboard link is opened, or `npx @patchstack/connect claim` completes');
   if (warnings.length > 0) lines.push(["Warnings", warnings.join("; ")]);
   return lines;
 }
@@ -9983,7 +10007,9 @@ async function runStatus(args) {
   console.log(`Environment: ${config.environment}`);
   if (config.siteUuid !== null) {
     console.log(`Dashboard URL: ${buildClaimUrl(config.endpoint, config.siteUuid)}`);
-    console.log("  Not attached to an account yet? Run `npx @patchstack/connect claim`.");
+    console.log(`  Not attached to an account yet? Sign in through the widget's "Connect this`);
+    console.log('  website" panel on the preview, open the link above, or run');
+    console.log("  `npx @patchstack/connect claim`.");
     switch (await fetchSiteStatus(config)) {
       case "active":
         console.log("Site status:   active on Patchstack");