[mariojgt]

What changed

AGENT-INSTALL.md gets a short "Wiring any Node.js app" recipe under "Completing guard wiring".

Setup wires the frameworks it recognises by itself. For everything else it writes a generic guard and lists the wiring as a To do. The guide described that step only in general terms, and agents filled the gap by writing their own createProtection guard. A hand-written guard has no read-only rules credential, so it cannot fetch rule updates and its warning sends the agent to ask for the site key.

The recipe:

1. Use the guard file setup wrote (protect --check names it). Do not call createProtection yourself, copy the .patchstack/ cache, or move the guard's rules file.
2. Wrap the app's one request entry with the export that fits its shape:
   • fetch(request, …) entries (Workers, Bun, Deno, Hono, export default { fetch }) use protectFetch;
   • Node (req, res) (including Koa's app.callback()) uses patchstackMiddleware, before anything reads the body;
   • Express/Connect use app.use(patchstackMiddleware) first;
   • Fastify uses the plugin protect writes.
3. Run setup again, so the guard's rules file gets the site's current rules and the read-only credential. Then protect --check must exit 0.
4. Check a request reaches it, with protect --check --runtime or a local request test.
5. Anything else: if no shape fits, hand off; do not invent an adapter.

It also corrects the refresh interval the guide states. It is 5 minutes, plus a background re-check every 30 seconds while serving (#435, #443), not 45 minutes.

How it was verified

On a plain Node http server, which no adapter recognises:

• protect wrote patchstack/guard.js, and protect --check named it as unwired.
• After applying step 2's Node row exactly as written, protect --check reported the guard wired.
• protect --check --runtime confirmed a request reached the guard.
• A live ?file=../../etc/passwd request got 403 and / got 200.

The disclosure, capability and install-prompt checks pass, and the full npm test passes (4622).

Rollout

Docs only, in AGENT-INSTALL.md, which agents read from the published tarball. So the hostile field test is owed after the release that carries this, plus standard for doc accuracy.

🤖 Generated with Claude Code

[coderbuds]

🎯 Elite quality (96%) — Adds a clear, decision-table-driven recipe for wiring unrecognized Node.js apps, with explicit guardrails.

📦 Small

_{See how your team is trending →}

[mariojgt]

/review