[NO-TICKET] Clarify HTML setup and strengthen agent install verification

[mariojgt]

What changed

Agent-assisted setup now gives standalone HTML sites a disclosure-widget path and finds a root Express server even when a frontend src/ directory exists. The field-test harness accepts named model commands and checks more of the resulting installation.

Why setup could look complete

A missing package.json only pointed agents back to a project root, while server discovery could overlook server.js beside src/. The harness could accept a development-only dependency or a UUID outside the widget, and an incomplete run or unavailable agent could leave a misleading result.

Fix

• Explain standalone HTML setup using the site's real public UUID, without adding Node tooling. State that the widget provides neither dependency scanning nor runtime protection.
• Keep Connect in regular dependencies, use the project's package manager, and wait for command results before reporting setup complete.
• Search the project for its server entry and cover the root Express case with a packaged fixture.
• Verify the widget tag, one provisioning request, build and install hooks, unchanged development scripts, sandbox persistence, dashboard URL, and installed CLI protection check.
• Require complete successful rounds, retain unavailable agents as failures, distinguish documentation retries from prompt reliability, and stop child processes on timeout.

Verified

• npm run build
• npm run typecheck — including all 8 templates.
• npm run capabilities:check
• npm test — 197 files passed; 3,252 tests passed, 7 skipped.
• node field-test/setup-demo.mjs --template express-npm — local packed installation, setup twice, no duplicate provisioning or wiring, and protection source check passed.
• Regression coverage includes standalone HTML left unchanged, root Express discovery, scorer false positives, missing agents, incomplete rounds, and process timeouts.

Out of scope, worth a follow-up

• The plain Vite smoke check still fails protection verification: its runtime is classified as unknown and its generic guard remains unwired. The stricter harness exposes this limitation.
• No live model matrix or hosted-platform acceptance test was run.
• Outstanding after release: node field-test/run.mjs --persona hostile --rounds 3 immediately after the release carrying these guide changes, as required by MAINTAINING.md. The agent harness installs the published package, so a run before publication cannot validate these unpublished instructions.

Docs: updated the installation reference, onboarding, maintainer guidance, and harness README. The canonical install prompt is unchanged.

---

• I reviewed the code, comments, fixtures, commit messages, generated output, and PR description for private Patchstack or customer information.
• Nothing here is third-party confidential or proprietary material — copied system prompts, private transcripts, unpublished documentation. Where I relied on something being public, I verified it rather than assumed it.

[mariojgt]

/review

[coderbuds]

Adds detailed HTML setup docs and robust agent install verification with comprehensive test coverage.

🎯 Quality: 62% Average · 📦 Size: Extra Large — strongly consider breaking this down

🛡️ Standards: Not checked — 1,075 lines changed, over your team's 400-line limit, and nothing checked before it was opened. Coding agents can call the assess-change-fit tool first, while a change this size is still cheap to split.

📈 This month: Your 143rd PR — above team average · Averaging Good

_{See how your team is trending →}