[feat] Detect and inject a build-stack descriptor in mark-build#35
Merged
Conversation
mark-build now derives a coarse stack descriptor from the lockfile (framework, UI, bundler, deployment runtime, and the vibe/builder platform such as Lovable) plus the NAMES of hosting-related build-env vars, and injects it as `window.__PATCHSTACK_STACK__` alongside the existing production flag and build fingerprint. The disclosure widget reads this to report how each site was built, so Patchstack learns the deployment landscape it protects across every vibe platform — without shipping a runtime probe onto the host server. Detection is a data-driven registry (add a row to teach a new stack) and only surfaces coarse labels and env-var key names, never values. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Adds robust stack detection and injection with clear patterns and solid tests. 🎯 Quality: 100% Elite · 📦 Size: Large — consider splitting if possible 📈 This month: Your 215th PR — above team average · Averaging Excellent |
Contributor
Author
|
/review |
mariojgt
approved these changes
Jul 13, 2026
ejntaylor
added a commit
that referenced
this pull request
Jul 13, 2026
Resolves the import conflict in src/cli.ts — both features coexist. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
mark-buildnow derives a coarse stack descriptor from the lockfile plus the build-time environment and injects it aswindow.__PATCHSTACK_STACK__in every built HTML file, alongside the existing__PATCHSTACK_PROD__flag and__PATCHSTACK_BUILD__fingerprint.The descriptor captures:
next,nuxt,tanstack-start,remix,astro,sveltekit, …react,vue,svelte,solid,angular, …vite,webpack,rspack, …cloudflare-workers,vercel,netlify)lovable,replit, …)CF_PAGES,VERCEL_REGION, …), reusing server-insight's env-fingerprint patternsWhy
The disclosure widget can't introspect the host's server — it runs only in the browser. But the connector runs in Node at build time, where the lockfile is ground truth for the framework/toolchain and
process.envcarries hosting fingerprints. Stamping that into the page lets the widget report how each site was built and hosted, so Patchstack learns its deployment landscape across every vibe platform — without shipping a runtime probe onto the host server.Detection is a data-driven registry (
src/stack.ts) — add one row to teach a new framework, bundler, or platform.Safety
mark-buildnever fails the build.Tests
tests/stack.test.ts— detection registry + env-key allowlisting.tests/mark-build.test.ts— snippet injects/omits the stack correctly.🤖 Generated with Claude Code