feat(protect): generic scaffold + wiring plan + protect --check (infra-free agent loop)

[patchstackdave]

Stacked on #81. Closes the "unmatched stack" gap without a hosted MCP server or anything in saas/hub — the CLI itself is the channel to the builder's agent (which already runs the CLI and reads stdout).

Generic scaffold + wiring plan (no more silent skip / bare "unsupported")

On a stack no adapter matches, runProtect now scaffolds a framework-agnostic guard (templates/generic-guard.ts → src/patchstack/{guard.ts,rules.json}) and prints a wiring plan with best-effort server-entry detection (candidate files + Express). The generic guard exposes protectFetch(handler) (Web-Fetch) and patchstackMiddleware (Node/Express).

protect --check — the verify half of the loop

runVerify inspects the app and reports whether the guard is wired, exit 1 if not. Adapters own verify(); the generic path checks the guard is scaffolded and imported into a source file. This is the feedback channel the agent (or CI) drives: scaffold → wire per plan → --check → iterate. All via CLI stdout + exit code — no server.

Also

• Adapter interface gains verify(); tanstack-supabase implements it.
• AGENT-INSTALL.md documents the loop.

Verified end-to-end via the shipped CLI (scaffold+plan → --check exit 1 → wire → --check exit 0). +3 tests. 447 pass, typecheck + build clean.

Note: AGENT-INSTALL.md changed, so per CLAUDE.md a field-test run is advisable before publishing.

🤖 Generated with Claude Code

[coderbuds]

Cohesive generic guard scaffold with robust wire-and-verify CLI integration.

🎯 Quality: 100% Elite · 📦 Size: Large — consider splitting if possible

📈 This month: Your 35th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[patchstackdave]

/review