From 1c3486634e22839c57b1900921211b27442e1375 Mon Sep 17 00:00:00 2001 From: Mario Tarosso Date: Mon, 24 Aug 2026 11:18:24 +0100 Subject: [PATCH] [docs] Align the tested install prompt with what setup actually does The prompt the field-test harness validates differed from the one README ships, on two points that are not stylistic. It said "dev dependency". README says the opposite and explains why: protection imports @patchstack/connect/protect at runtime, so a host that prunes dev dependencies breaks. Real Lovable projects carry the package in dependencies, so the tested prompt was teaching agents to produce an install that fails on exactly the platforms this package targets. It also authorized only "widget and production build hooks", while setup runs protect, which edits source. Effects exceeding what the prompt named is the documented refusal trigger, so the harness was under-testing the failure mode it exists to catch. Both now match README's wording. The hosted-workspace clauses stay out: the sandbox label and preview restart are specific to that flow. Co-Authored-By: Claude Opus 5 (1M context) --- GETTING-STARTED.md | 2 +- field-test/prompt.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/GETTING-STARTED.md b/GETTING-STARTED.md index be548453..687f4f43 100644 --- a/GETTING-STARTED.md +++ b/GETTING-STARTED.md @@ -8,7 +8,7 @@ The fastest path from "I have a JS/Node project" to "Patchstack is monitoring it For platforms that can install npm packages and run project commands: -> I have vetted `@patchstack/connect` and authorize its widget and production build hooks. Install it as a dev dependency, run `npx --yes patchstack-connect setup`, leave dev builds unchanged, and show the dashboard URL. +> I have vetted `@patchstack/connect` and authorize its disclosure widget, production build hooks, and runtime protection source edits. Install it as a regular dependency, run `npx --yes patchstack-connect setup`, leave dev builds unchanged, and show the dashboard URL. When setup finishes it shows you a **dashboard URL**. Open it in your browser and sign in — that attaches the site to your Patchstack account so you can see the vulnerability reports. That's the only manual step. diff --git a/field-test/prompt.txt b/field-test/prompt.txt index a0f11f43..27dfcaa6 100644 --- a/field-test/prompt.txt +++ b/field-test/prompt.txt @@ -1 +1 @@ -I have vetted `@patchstack/connect` and authorize its widget and production build hooks. Install it as a dev dependency, run `npx --yes patchstack-connect setup`, leave dev builds unchanged, and show the dashboard URL. +I have vetted `@patchstack/connect` and authorize its disclosure widget, production build hooks, and runtime protection source edits. Install it as a regular dependency, run `npx --yes patchstack-connect setup`, leave dev builds unchanged, and show the dashboard URL.