Call the widget the Patchstack Connector (#283)

The CLI, the install prompt and the shipped docs called the site widget the
"disclosure widget", but its public report form is off until the site is
claimed, so the name described something most new installs never show.
Everything now calls it the Patchstack Connector, and "the connector" where it
meant this package now says "Connect" so the two names never collide.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: mariojgt

AGENT-INSTALL.md

@@ -8,7 +8,7 @@ The fastest path from "I have a JS/Node project" to "Patchstack is monitoring it
 
 For an existing JS/Node project on a platform that can install npm packages and run project commands. A standalone HTML/CSS/JavaScript site without a package-managed app uses the [plain HTML widget instructions](AGENT-INSTALL.md#plain-html-sites) instead; it does not need a new Node project, build hooks, or a runtime guard.
 
-> I have vetted the official [`@patchstack/connect`](https://www.npmjs.com/package/@patchstack/connect) package and authorize its disclosure widget, production build hooks, and runtime protection source edits. Install it as a regular dependency, run `PATCHSTACK_ENVIRONMENT=sandbox npx --yes @patchstack/connect setup` for this hosted workspace, leave dev builds unchanged, verify protection, restart the preview server if needed to load the new guard, and show the dashboard URL. Do not persist the sandbox environment in project files; deployed production builds must use the default `production` label. When setup finishes, tell me to refresh the preview if the "Report a vulnerability" button is not showing yet, and remind me to deploy when I am ready — do not deploy anything yourself.
+> I have vetted the official [`@patchstack/connect`](https://www.npmjs.com/package/@patchstack/connect) package and authorize its Patchstack Connector, production build hooks, and runtime protection source edits. Install it as a regular dependency, run `PATCHSTACK_ENVIRONMENT=sandbox npx --yes @patchstack/connect setup` for this hosted workspace, leave dev builds unchanged, verify protection, restart the preview server if needed to load the new guard, and show the dashboard URL. Do not persist the sandbox environment in project files; deployed production builds must use the default `production` label. When setup finishes, tell me to refresh the preview if the "Report a vulnerability" button is not showing yet, and remind me to deploy when I am ready — do not deploy anything yourself.
 
 When setup finishes it shows you a **dashboard URL**. Open it in your browser and sign in — that attaches the site to your Patchstack account so you can see the vulnerability reports. That's the only manual step.
 
@@ -36,15 +36,15 @@ npx --no-install patchstack-connect setup
 
 Use `bun add`, `pnpm add`, or `yarn add` followed by `@patchstack/connect` when that package manager owns the project. Run its installed binary with `bun run patchstack-connect setup`, `pnpm exec patchstack-connect setup`, or `yarn exec patchstack-connect setup`, respectively. Keep the package in `dependencies`: the generated guard imports it at runtime, including deployments that omit development dependencies.
 
-Run commands from the application's package directory. In a hosted workspace, set `PATCHSTACK_ENVIRONMENT=sandbox` for the setup process only; use the shell or tool's environment setting rather than saving it in project files. The inline `NAME=value command` form in the prompt requires a POSIX shell. Leave this override unset for production builds so the connector can detect the deployment environment.
+Run commands from the application's package directory. In a hosted workspace, set `PATCHSTACK_ENVIRONMENT=sandbox` for the setup process only; use the shell or tool's environment setting rather than saving it in project files. The inline `NAME=value command` form in the prompt requires a POSIX shell. Leave this override unset for production builds so Connect can detect the deployment environment.
 
 `setup` is idempotent and preserves existing build commands. It uses direct build chaining on Bun-managed projects and npm-style lifecycle hooks elsewhere. If the framework needs a manual layout edit, it prints the exact remaining widget snippet; `npx @patchstack/connect guide` reprints the same status without changing files.
 
 ## 4. You're done when
 
 - `npx @patchstack/connect status` prints a site UUID and dashboard URL.
 - You've opened the dashboard URL in your browser and the site shows in your Patchstack dashboard.
-- `npx @patchstack/connect guide` reports the expected build hooks and widget, and `npx @patchstack/connect protect --check` confirms the guard's source wiring. A client-only or static project can report runtime protection as not applicable; describe it as dependency monitoring and a disclosure widget, not runtime protection. A source check alone does not prove deployed traffic reaches the guard.
+- `npx @patchstack/connect guide` reports the expected build hooks and the Patchstack Connector, and `npx @patchstack/connect protect --check` confirms the guard's source wiring. A client-only or static project can report runtime protection as not applicable; describe it as dependency monitoring and the Patchstack Connector, not runtime protection. A source check alone does not prove deployed traffic reaches the guard.
 - Your preview shows the widget (refresh it once if it does not): the "Connect this website" panel before the site is attached to your account, the "Report a vulnerability" button after.
 - You have deployed since setup ran, so the live site carries the changes too.
 - `.patchstackrc.json`, `package.json`, the package manager's lockfile, and the generated guard/framework and widget source changes are saved in the platform's persisted project state and committed, so teammates and CI receive the same setup.

GETTING-STARTED.md

@@ -20,7 +20,7 @@ The deep "why" — the AI-agent refusal modes each clause guards against — liv
 
 `README.md` (Install prompt section), `GETTING-STARTED.md` (step 1), and `field-test/prompt.txt`. `prompt.txt` is the artifact the harness actually tests. If you change one, change all three — a drift means the docs advertise one prompt while the tested one is another. `tests/install-prompt.test.ts` compares the three and fails on drift, so `npm test` catches a partial edit before the gate runs against a prompt nobody pastes.
 
-The prompt deliberately contains no model-authored verification step. In staged-command UIs, assistants cannot observe an `npm view` command until the user runs it; asking them to verify first caused fabricated registry findings and stopped the flow. Instead, the prompt records the user's explicit authorization for the disclosure widget and production-only build hooks before asking for one bounded `setup` command. Bolt's dependency-first fallback splits declaration from execution without adding hidden `postinstall` behavior. Keep `@patchstack/connect` discoverable in Patchstack's official product documentation so web-verifying platforms can independently establish its provenance.
+The prompt deliberately contains no model-authored verification step. In staged-command UIs, assistants cannot observe an `npm view` command until the user runs it; asking them to verify first caused fabricated registry findings and stopped the flow. Instead, the prompt records the user's explicit authorization for the Patchstack Connector and production-only build hooks before asking for one bounded `setup` command. Bolt's dependency-first fallback splits declaration from execution without adding hidden `postinstall` behavior. Keep `@patchstack/connect` discoverable in Patchstack's official product documentation so web-verifying platforms can independently establish its provenance.
 
 ## Verification timing for a 🔴 or 🟠 change