[NO-TICKET] Call the widget the Patchstack Connector

[mariojgt]

What changed

Connect now calls the site widget the Patchstack Connector everywhere it names it: the guide checklist, scan output and help text, the static-site note protect prints, the install prompt, and the shipped docs (README.md, AGENT-INSTALL.md, GETTING-STARTED.md, MAINTAINING.md).

Why

The old name, "disclosure widget", describes the public report form. That form is off until the site is claimed, so on a new install the widget shows the "Connect this website" panel instead, and the name described something the user had not seen yet. A few lines went further and called it the "Report a vulnerability" widget, which is wrong for the same reason.

Fix

• guide checklist lines now read Patchstack Connector installed, Patchstack Connector disabled by config, Fix the Patchstack Connector yourself…, and Add the Patchstack Connector… (was Add the "Report a vulnerability" widget…).
• scan prints Widget: added the Patchstack Connector tag to ….
• The install prompt authorizes "its Patchstack Connector" instead of "its disclosure widget". The three copies (README.md, GETTING-STARTED.md, field-test/prompt.txt) stay identical.
• Where the docs said the widget is a "Report a vulnerability" button, they now describe it by claim state: the connect panel until the site is claimed, then the report button.
• Where "the connector" meant this npm package, it now says "Connect", so the package and the widget no longer share a name. References to the connector POST /api/logs/log endpoint are unchanged, since that names an API endpoint.
• The README section is renamed to The Patchstack Connector, and its in-page links now point to the new anchor.
• The uninstall walkthrough now says "Remove the Patchstack Connector snippets", matching the uninstall prompt the widget hands out.

Verified

• npm run typecheck, npm run build and npm run capabilities:check pass (no capability vocabulary change).
• npm test: 197 files, 3255 passed, 7 skipped. That includes the install-prompt test that keeps the three prompt copies identical.

Field test still owed

• Before shipping: the install prompt changed, so node field-test/run.mjs --persona hostile --rounds 3 has to pass on this branch before release. It has not been run yet.
• After the release: the guide output and AGENT-INSTALL.md changed too. The harness installs the published tarball, so those need the same hostile run right after the release that carries them. Until then, the disclosure tests and capabilities:check are what cover them.

Out of scope, worth a follow-up

• The prompt's last clause still tells the agent to have the user refresh "if the "Report a vulnerability" button is not showing yet". On an unclaimed site the connect panel shows instead. A test pins that wording, and changing it changes what the prompt asks for, so it deserves its own change and its own hostile run.
• "Patchstack Connector" is also the name of the Drupal connector in Patchstack's public docs. The two now share a name across products.

Docs: the public documentation pages for JavaScript/Node projects are renamed in a companion docs PR.

🤖 Generated with Claude Code

[coderbuds]

Renamed 'disclosure widget' to 'Patchstack Connector' consistently across docs and code.

🎯 Quality: 77% Good · 📦 Size: Medium

📈 This month: Your 139th PR — above team average · Averaging Good

_{See how your team is trending →}

[mariojgt]

/review