[mariojgt]

What changed

Setup can end with two To do lines:

• Some attacks are only reported, not blocked yet
• Could not confirm whether rules for this app are ready

Both mean the same thing: the app's map was uploaded but could not be linked to the guard, so rules written for this app's own inputs can only report. The guide says To do lines are the agent's to finish, but nothing told the agent how to finish these two. In a recent Lovable install it passed them on to the person, who was left asking whether the app was protected.

AGENT-INSTALL.md

• New guidance for both lines: run npx @patchstack/connect setup --verbose, read the reason on the could not bind this map to the runtime guard — <reason> line, fix it, then rerun setup until the line is gone. It gives the fix for each reason the code can report:
  • no guard rules file;
  • more than one candidate rules file;
  • invalid JSON or not a rules bundle;
  • unreadable or unwritable.
• "Still being prepared" needs nothing.
• How to answer "is my app protected?" in three parts:
  • the protection is installed;
  • Patchstack's rules only report until the site is connected to an account that includes protection (the SaaS serves dry-run enforcement until then);
  • the live app has none of it until the person publishes again.

Setup output (src/cli.ts)

• The hint on the map-link line now points to setup --verbose. It used to say "Finish adding protection, then run setup again."
• When there is no link, the readiness line says it clears once the link is fixed. It used to say the app would check again by itself, which never happens without a link.

Tests

• npm run typecheck and npm run build are green, as are the disclosure, capability and install-prompt checks.
• Full npm test: 4603 passed. 4 failed under full-suite load and all pass when run on their own: three timing tests and the plain-wording setup test, which hit its 5s timeout.

Rollout

Both AGENT-INSTALL.md and the setup output change, and agents read the published tarball. So the hostile field test is owed after the release that carries this, plus standard or lovable for doc accuracy.

🤖 Generated with Claude Code

[coderbuds]

🎯 Elite quality (95%) — Docs and CLI hints now point agents to the exact verbose reason and its fixes.

📦 Small

_{See how your team is trending →}

[mariojgt]

/review