Canceling since a higher priority waiting request for ci-CI-refs/pull/242/merge exists

Process completed with exit code 1.

AssertionError: expected '# @patchstack/connect\n\nConnect a Ja…' not to match /every (?:HTTP )?listener/i - Expected: /every (?:HTTP )?listener/i + Received: "# @patchstack/connect Connect a JavaScript / Node.js application to [Patchstack](https://patchstack.com) for continuous vulnerability monitoring. Scans your `package-lock.json` and reports installed packages so Patchstack can match them against its vulnerability database and notify you when something needs patching. ## Agent-assisted setup Copy this request into a coding assistant, or run the same command yourself: > I have vetted the official [`@patchstack/connect`](https://www.npmjs.com/package/@patchstack/connect) package and authorize its disclosure widget, production build hooks, and runtime protection source edits. Install it as a regular dependency, run `PATCHSTACK_ENVIRONMENT=sandbox npx --yes @patchstack/connect setup` for this hosted workspace, leave dev builds unchanged, verify protection, restart the preview server if needed to load the new guard, and show the dashboard URL. Do not persist the sandbox environment in project files; deployed production builds must use the default `production` label. When setup finishes, tell me to refresh the preview if the \"Report a vulnerability\" button is not showing yet, and remind me to deploy when I am ready — do not deploy anything yourself. `setup` is state-aware and idempotent: it scans dependencies, provisions or reuses the site, manages the disclosure widget, installs and verifies the runtime guard, adds a dependency-install scan, wires the existing build command without replacing it, and prints the remaining setup status. It never runs the project build. `guide` provides the same project-specific status without changing files. ## Quick start (zero configuration) ```bash npm install --save @patchstack/connect && npx @patchstack/connect setup ``` > **Use your project's own package manager.** On Bun-managed projects (including many Lovable projects) install with `bun add @patchstack/connect` instead — running `npm install` there plants a `package-lock.json` that the platform's native dependency flow never updates again, leaving a stale lockfile next to the live one. The connector detects and works around that (see *Stale lockfiles* below), but not creating the fossil is better. Protection imports `@patchstack/connect/protect` at runtime, so deployments that prune dev dependencies need the package in `dependencies`. > **Hosted builders:** set `PATCHSTACK_ENVIRONMENT=sandbox` in the workspace process environment (or scope it to the setup command above), persist every file written by `setup`, and restart any already-running server so it loads the new middleware. Do not write `\"environment\": \"sandbox\"` to the committed `.patchstackrc.json`: the same project files reach production, where scans should inherit no override and default to `production`. TanStack Start + Supabase (the server shape emitted by Lovable) is auto-wired: browser Supabase traffic is tunneled through a same-origin guard, server-function arguments are inspected, and responses are screened. A client-only SPA has no server request path to protect; setup will leave a generic scaffold and `protect --check` will remain red until the host adds a server/edge seam. Set `PATCHSTACK_ROUTE_WAF=1` when the deployment should additionally screen every TanStack route request. That's it. `setup`: 1. Reads your lockfile (see *Supported lockfiles*). 2. POSTs the package list to Patchstack with **no** UUID. 3. Patchstack provisions a fresh site and returns its UUID. 4. The connector writes the UUID to `.patchstackrc.json` so the next `scan` targets the same site. 5. The connector installs the disclosure widget's `<script>` tag into your root HTML shell (see *The disclosure widget* below) so the \"Report a vulnerability\" button shows up on the next preview reload. On a server-rendered root it also adds the production marker, which is what tells the widget to switch from build mode to visitor report intake on the published site. 6. Installs th

AssertionError: expected [ Array(1) ] to deeply equal [] - Expected + Received - [] + [ + "src/protect/install/runtime/report-listeners.cjs", + ] ❯ tests/execution-disclosure.test.ts:217:83

Canceling since a higher priority waiting request for ci-CI-refs/pull/242/merge exists

Process completed with exit code 1.

AssertionError: expected '# @patchstack/connect\n\nConnect a Ja…' not to match /every (?:HTTP )?listener/i - Expected: /every (?:HTTP )?listener/i + Received: "# @patchstack/connect Connect a JavaScript / Node.js application to [Patchstack](https://patchstack.com) for continuous vulnerability monitoring. Scans your `package-lock.json` and reports installed packages so Patchstack can match them against its vulnerability database and notify you when something needs patching. ## Agent-assisted setup Copy this request into a coding assistant, or run the same command yourself: > I have vetted the official [`@patchstack/connect`](https://www.npmjs.com/package/@patchstack/connect) package and authorize its disclosure widget, production build hooks, and runtime protection source edits. Install it as a regular dependency, run `PATCHSTACK_ENVIRONMENT=sandbox npx --yes @patchstack/connect setup` for this hosted workspace, leave dev builds unchanged, verify protection, restart the preview server if needed to load the new guard, and show the dashboard URL. Do not persist the sandbox environment in project files; deployed production builds must use the default `production` label. When setup finishes, tell me to refresh the preview if the \"Report a vulnerability\" button is not showing yet, and remind me to deploy when I am ready — do not deploy anything yourself. `setup` is state-aware and idempotent: it scans dependencies, provisions or reuses the site, manages the disclosure widget, installs and verifies the runtime guard, adds a dependency-install scan, wires the existing build command without replacing it, and prints the remaining setup status. It never runs the project build. `guide` provides the same project-specific status without changing files. ## Quick start (zero configuration) ```bash npm install --save @patchstack/connect && npx @patchstack/connect setup ``` > **Use your project's own package manager.** On Bun-managed projects (including many Lovable projects) install with `bun add @patchstack/connect` instead — running `npm install` there plants a `package-lock.json` that the platform's native dependency flow never updates again, leaving a stale lockfile next to the live one. The connector detects and works around that (see *Stale lockfiles* below), but not creating the fossil is better. Protection imports `@patchstack/connect/protect` at runtime, so deployments that prune dev dependencies need the package in `dependencies`. > **Hosted builders:** set `PATCHSTACK_ENVIRONMENT=sandbox` in the workspace process environment (or scope it to the setup command above), persist every file written by `setup`, and restart any already-running server so it loads the new middleware. Do not write `\"environment\": \"sandbox\"` to the committed `.patchstackrc.json`: the same project files reach production, where scans should inherit no override and default to `production`. TanStack Start + Supabase (the server shape emitted by Lovable) is auto-wired: browser Supabase traffic is tunneled through a same-origin guard, server-function arguments are inspected, and responses are screened. A client-only SPA has no server request path to protect; setup will leave a generic scaffold and `protect --check` will remain red until the host adds a server/edge seam. Set `PATCHSTACK_ROUTE_WAF=1` when the deployment should additionally screen every TanStack route request. That's it. `setup`: 1. Reads your lockfile (see *Supported lockfiles*). 2. POSTs the package list to Patchstack with **no** UUID. 3. Patchstack provisions a fresh site and returns its UUID. 4. The connector writes the UUID to `.patchstackrc.json` so the next `scan` targets the same site. 5. The connector installs the disclosure widget's `<script>` tag into your root HTML shell (see *The disclosure widget* below) so the \"Report a vulnerability\" button shows up on the next preview reload. On a server-rendered root it also adds the production marker, which is what tells the widget to switch from build mode to visitor report intake on the published site. 6. Installs th

AssertionError: expected [ Array(1) ] to deeply equal [] - Expected + Received - [] + [ + "src/protect/install/runtime/report-listeners.cjs", + ] ❯ tests/execution-disclosure.test.ts:217:83

Canceling since a higher priority waiting request for ci-CI-refs/pull/242/merge exists

Process completed with exit code 1.

AssertionError: expected '# @patchstack/connect\n\nConnect a Ja…' not to match /every (?:HTTP )?listener/i - Expected: /every (?:HTTP )?listener/i + Received: "# @patchstack/connect Connect a JavaScript / Node.js application to [Patchstack](https://patchstack.com) for continuous vulnerability monitoring. Scans your `package-lock.json` and reports installed packages so Patchstack can match them against its vulnerability database and notify you when something needs patching. ## Agent-assisted setup Copy this request into a coding assistant, or run the same command yourself: > I have vetted the official [`@patchstack/connect`](https://www.npmjs.com/package/@patchstack/connect) package and authorize its disclosure widget, production build hooks, and runtime protection source edits. Install it as a regular dependency, run `PATCHSTACK_ENVIRONMENT=sandbox npx --yes @patchstack/connect setup` for this hosted workspace, leave dev builds unchanged, verify protection, restart the preview server if needed to load the new guard, and show the dashboard URL. Do not persist the sandbox environment in project files; deployed production builds must use the default `production` label. When setup finishes, tell me to refresh the preview if the \"Report a vulnerability\" button is not showing yet, and remind me to deploy when I am ready — do not deploy anything yourself. `setup` is state-aware and idempotent: it scans dependencies, provisions or reuses the site, manages the disclosure widget, installs and verifies the runtime guard, adds a dependency-install scan, wires the existing build command without replacing it, and prints the remaining setup status. It never runs the project build. `guide` provides the same project-specific status without changing files. ## Quick start (zero configuration) ```bash npm install --save @patchstack/connect && npx @patchstack/connect setup ``` > **Use your project's own package manager.** On Bun-managed projects (including many Lovable projects) install with `bun add @patchstack/connect` instead — running `npm install` there plants a `package-lock.json` that the platform's native dependency flow never updates again, leaving a stale lockfile next to the live one. The connector detects and works around that (see *Stale lockfiles* below), but not creating the fossil is better. Protection imports `@patchstack/connect/protect` at runtime, so deployments that prune dev dependencies need the package in `dependencies`. > **Hosted builders:** set `PATCHSTACK_ENVIRONMENT=sandbox` in the workspace process environment (or scope it to the setup command above), persist every file written by `setup`, and restart any already-running server so it loads the new middleware. Do not write `\"environment\": \"sandbox\"` to the committed `.patchstackrc.json`: the same project files reach production, where scans should inherit no override and default to `production`. TanStack Start + Supabase (the server shape emitted by Lovable) is auto-wired: browser Supabase traffic is tunneled through a same-origin guard, server-function arguments are inspected, and responses are screened. A client-only SPA has no server request path to protect; setup will leave a generic scaffold and `protect --check` will remain red until the host adds a server/edge seam. Set `PATCHSTACK_ROUTE_WAF=1` when the deployment should additionally screen every TanStack route request. That's it. `setup`: 1. Reads your lockfile (see *Supported lockfiles*). 2. POSTs the package list to Patchstack with **no** UUID. 3. Patchstack provisions a fresh site and returns its UUID. 4. The connector writes the UUID to `.patchstackrc.json` so the next `scan` targets the same site. 5. The connector installs the disclosure widget's `<script>` tag into your root HTML shell (see *The disclosure widget* below) so the \"Report a vulnerability\" button shows up on the next preview reload. On a server-rendered root it also adds the production marker, which is what tells the widget to switch from build mode to visitor report intake on the published site. 6. Installs th

AssertionError: expected [ Array(1) ] to deeply equal [] - Expected + Received - [] + [ + "src/protect/install/runtime/report-listeners.cjs", + ] ❯ tests/execution-disclosure.test.ts:217:83

Canceling since a higher priority waiting request for ci-CI-refs/pull/242/merge exists

Process completed with exit code 1.

AssertionError: expected '# @patchstack/connect\n\nConnect a Ja…' not to match /every (?:HTTP )?listener/i - Expected: /every (?:HTTP )?listener/i + Received: "# @patchstack/connect Connect a JavaScript / Node.js application to [Patchstack](https://patchstack.com) for continuous vulnerability monitoring. Scans your `package-lock.json` and reports installed packages so Patchstack can match them against its vulnerability database and notify you when something needs patching. ## Agent-assisted setup Copy this request into a coding assistant, or run the same command yourself: > I have vetted the official [`@patchstack/connect`](https://www.npmjs.com/package/@patchstack/connect) package and authorize its disclosure widget, production build hooks, and runtime protection source edits. Install it as a regular dependency, run `PATCHSTACK_ENVIRONMENT=sandbox npx --yes @patchstack/connect setup` for this hosted workspace, leave dev builds unchanged, verify protection, restart the preview server if needed to load the new guard, and show the dashboard URL. Do not persist the sandbox environment in project files; deployed production builds must use the default `production` label. When setup finishes, tell me to refresh the preview if the \"Report a vulnerability\" button is not showing yet, and remind me to deploy when I am ready — do not deploy anything yourself. `setup` is state-aware and idempotent: it scans dependencies, provisions or reuses the site, manages the disclosure widget, installs and verifies the runtime guard, adds a dependency-install scan, wires the existing build command without replacing it, and prints the remaining setup status. It never runs the project build. `guide` provides the same project-specific status without changing files. ## Quick start (zero configuration) ```bash npm install --save @patchstack/connect && npx @patchstack/connect setup ``` > **Use your project's own package manager.** On Bun-managed projects (including many Lovable projects) install with `bun add @patchstack/connect` instead — running `npm install` there plants a `package-lock.json` that the platform's native dependency flow never updates again, leaving a stale lockfile next to the live one. The connector detects and works around that (see *Stale lockfiles* below), but not creating the fossil is better. Protection imports `@patchstack/connect/protect` at runtime, so deployments that prune dev dependencies need the package in `dependencies`. > **Hosted builders:** set `PATCHSTACK_ENVIRONMENT=sandbox` in the workspace process environment (or scope it to the setup command above), persist every file written by `setup`, and restart any already-running server so it loads the new middleware. Do not write `\"environment\": \"sandbox\"` to the committed `.patchstackrc.json`: the same project files reach production, where scans should inherit no override and default to `production`. TanStack Start + Supabase (the server shape emitted by Lovable) is auto-wired: browser Supabase traffic is tunneled through a same-origin guard, server-function arguments are inspected, and responses are screened. A client-only SPA has no server request path to protect; setup will leave a generic scaffold and `protect --check` will remain red until the host adds a server/edge seam. Set `PATCHSTACK_ROUTE_WAF=1` when the deployment should additionally screen every TanStack route request. That's it. `setup`: 1. Reads your lockfile (see *Supported lockfiles*). 2. POSTs the package list to Patchstack with **no** UUID. 3. Patchstack provisions a fresh site and returns its UUID. 4. The connector writes the UUID to `.patchstackrc.json` so the next `scan` targets the same site. 5. The connector installs the disclosure widget's `<script>` tag into your root HTML shell (see *The disclosure widget* below) so the \"Report a vulnerability\" button shows up on the next preview reload. On a server-rendered root it also adds the production marker, which is what tells the widget to switch from build mode to visitor report intake on the published site. 6. Installs th

AssertionError: expected [ Array(1) ] to deeply equal [] - Expected + Received - [] + [ + "src/protect/install/runtime/report-listeners.cjs", + ] ❯ tests/execution-disclosure.test.ts:217:83

Canceling since a higher priority waiting request for ci-CI-refs/pull/242/merge exists

Process completed with exit code 1.

AssertionError: expected '# @patchstack/connect\n\nConnect a Ja…' not to match /every (?:HTTP )?listener/i - Expected: /every (?:HTTP )?listener/i + Received: "# @patchstack/connect Connect a JavaScript / Node.js application to [Patchstack](https://patchstack.com) for continuous vulnerability monitoring. Scans your `package-lock.json` and reports installed packages so Patchstack can match them against its vulnerability database and notify you when something needs patching. ## Agent-assisted setup Copy this request into a coding assistant, or run the same command yourself: > I have vetted the official [`@patchstack/connect`](https://www.npmjs.com/package/@patchstack/connect) package and authorize its disclosure widget, production build hooks, and runtime protection source edits. Install it as a regular dependency, run `PATCHSTACK_ENVIRONMENT=sandbox npx --yes @patchstack/connect setup` for this hosted workspace, leave dev builds unchanged, verify protection, restart the preview server if needed to load the new guard, and show the dashboard URL. Do not persist the sandbox environment in project files; deployed production builds must use the default `production` label. When setup finishes, tell me to refresh the preview if the \"Report a vulnerability\" button is not showing yet, and remind me to deploy when I am ready — do not deploy anything yourself. `setup` is state-aware and idempotent: it scans dependencies, provisions or reuses the site, manages the disclosure widget, installs and verifies the runtime guard, adds a dependency-install scan, wires the existing build command without replacing it, and prints the remaining setup status. It never runs the project build. `guide` provides the same project-specific status without changing files. ## Quick start (zero configuration) ```bash npm install --save @patchstack/connect && npx @patchstack/connect setup ``` > **Use your project's own package manager.** On Bun-managed projects (including many Lovable projects) install with `bun add @patchstack/connect` instead — running `npm install` there plants a `package-lock.json` that the platform's native dependency flow never updates again, leaving a stale lockfile next to the live one. The connector detects and works around that (see *Stale lockfiles* below), but not creating the fossil is better. Protection imports `@patchstack/connect/protect` at runtime, so deployments that prune dev dependencies need the package in `dependencies`. > **Hosted builders:** set `PATCHSTACK_ENVIRONMENT=sandbox` in the workspace process environment (or scope it to the setup command above), persist every file written by `setup`, and restart any already-running server so it loads the new middleware. Do not write `\"environment\": \"sandbox\"` to the committed `.patchstackrc.json`: the same project files reach production, where scans should inherit no override and default to `production`. TanStack Start + Supabase (the server shape emitted by Lovable) is auto-wired: browser Supabase traffic is tunneled through a same-origin guard, server-function arguments are inspected, and responses are screened. A client-only SPA has no server request path to protect; setup will leave a generic scaffold and `protect --check` will remain red until the host adds a server/edge seam. Set `PATCHSTACK_ROUTE_WAF=1` when the deployment should additionally screen every TanStack route request. That's it. `setup`: 1. Reads your lockfile (see *Supported lockfiles*). 2. POSTs the package list to Patchstack with **no** UUID. 3. Patchstack provisions a fresh site and returns its UUID. 4. The connector writes the UUID to `.patchstackrc.json` so the next `scan` targets the same site. 5. The connector installs the disclosure widget's `<script>` tag into your root HTML shell (see *The disclosure widget* below) so the \"Report a vulnerability\" button shows up on the next preview reload. On a server-rendered root it also adds the production marker, which is what tells the widget to switch from build mode to visitor report intake on the published site. 6. Installs th

AssertionError: expected [ Array(1) ] to deeply equal [] - Expected + Received - [] + [ + "src/protect/install/runtime/report-listeners.cjs", + ] ❯ tests/execution-disclosure.test.ts:217:83

Canceling since a higher priority waiting request for ci-CI-refs/pull/242/merge exists

Process completed with exit code 1.

AssertionError: expected '# @patchstack/connect\n\nConnect a Ja…' not to match /every (?:HTTP )?listener/i - Expected: /every (?:HTTP )?listener/i + Received: "# @patchstack/connect Connect a JavaScript / Node.js application to [Patchstack](https://patchstack.com) for continuous vulnerability monitoring. Scans your `package-lock.json` and reports installed packages so Patchstack can match them against its vulnerability database and notify you when something needs patching. ## Agent-assisted setup Copy this request into a coding assistant, or run the same command yourself: > I have vetted the official [`@patchstack/connect`](https://www.npmjs.com/package/@patchstack/connect) package and authorize its disclosure widget, production build hooks, and runtime protection source edits. Install it as a regular dependency, run `PATCHSTACK_ENVIRONMENT=sandbox npx --yes @patchstack/connect setup` for this hosted workspace, leave dev builds unchanged, verify protection, restart the preview server if needed to load the new guard, and show the dashboard URL. Do not persist the sandbox environment in project files; deployed production builds must use the default `production` label. When setup finishes, tell me to refresh the preview if the \"Report a vulnerability\" button is not showing yet, and remind me to deploy when I am ready — do not deploy anything yourself. `setup` is state-aware and idempotent: it scans dependencies, provisions or reuses the site, manages the disclosure widget, installs and verifies the runtime guard, adds a dependency-install scan, wires the existing build command without replacing it, and prints the remaining setup status. It never runs the project build. `guide` provides the same project-specific status without changing files. ## Quick start (zero configuration) ```bash npm install --save @patchstack/connect && npx @patchstack/connect setup ``` > **Use your project's own package manager.** On Bun-managed projects (including many Lovable projects) install with `bun add @patchstack/connect` instead — running `npm install` there plants a `package-lock.json` that the platform's native dependency flow never updates again, leaving a stale lockfile next to the live one. The connector detects and works around that (see *Stale lockfiles* below), but not creating the fossil is better. Protection imports `@patchstack/connect/protect` at runtime, so deployments that prune dev dependencies need the package in `dependencies`. > **Hosted builders:** set `PATCHSTACK_ENVIRONMENT=sandbox` in the workspace process environment (or scope it to the setup command above), persist every file written by `setup`, and restart any already-running server so it loads the new middleware. Do not write `\"environment\": \"sandbox\"` to the committed `.patchstackrc.json`: the same project files reach production, where scans should inherit no override and default to `production`. TanStack Start + Supabase (the server shape emitted by Lovable) is auto-wired: browser Supabase traffic is tunneled through a same-origin guard, server-function arguments are inspected, and responses are screened. A client-only SPA has no server request path to protect; setup will leave a generic scaffold and `protect --check` will remain red until the host adds a server/edge seam. Set `PATCHSTACK_ROUTE_WAF=1` when the deployment should additionally screen every TanStack route request. That's it. `setup`: 1. Reads your lockfile (see *Supported lockfiles*). 2. POSTs the package list to Patchstack with **no** UUID. 3. Patchstack provisions a fresh site and returns its UUID. 4. The connector writes the UUID to `.patchstackrc.json` so the next `scan` targets the same site. 5. The connector installs the disclosure widget's `<script>` tag into your root HTML shell (see *The disclosure widget* below) so the \"Report a vulnerability\" button shows up on the next preview reload. On a server-rendered root it also adds the production marker, which is what tells the widget to switch from build mode to visitor report intake on the published site. 6. Installs th

AssertionError: expected [ Array(1) ] to deeply equal [] - Expected + Received - [] + [ + "src/protect/install/runtime/report-listeners.cjs", + ] ❯ tests/execution-disclosure.test.ts:217:83

Canceling since a higher priority waiting request for ci-CI-refs/pull/242/merge exists

The operation was canceled.

Process completed with exit code 1.

Not every required job succeeded: validate windows-smoke