feat(protect): generic scaffold + wiring plan + protect --check (infra-free agent loop)#82
Merged
Merged
Conversation
|
Cohesive generic guard scaffold with robust wire-and-verify CLI integration. 🎯 Quality: 100% Elite · 📦 Size: Large — consider splitting if possible 📈 This month: Your 35th PR — above team average · Averaging Excellent |
Contributor
Author
|
/review |
mariojgt
approved these changes
Jul 15, 2026
…fra-free agent loop)
Close the "unmatched stack" gap without a hosted server or saas/hub: the CLI itself is the
channel to the builder's agent (it already runs the CLI and reads stdout).
- Unmatched stack no longer returns bare "unsupported" — `runProtect` scaffolds a
framework-agnostic guard (templates/generic-guard.ts → src/patchstack/{guard.ts,rules.json})
and prints a wiring plan with best-effort server-entry detection (candidate files + Express).
The generic guard exposes protectFetch(handler) (Web-Fetch) and patchstackMiddleware (Node/Express).
- `protect --check` (runVerify): inspects the app and reports whether the guard is wired, exit 1
if not — the feedback half of a wire-then-verify loop the agent (or CI) drives. Adapters own
their verify(); the generic path checks the guard is scaffolded AND imported into a source file.
- Adapter interface gains verify(); tanstack-supabase implements it (guard/client/start checks).
- AGENT-INSTALL documents the loop: auto-wire known stacks; otherwise scaffold → wire per plan →
`--check` to confirm. No MCP, no backend — all in the npm package.
+3 tests (generic scaffold+plan, verify not-wired→wired, tanstack verify). Verified end-to-end via
the shipped CLI. 447 tests pass, typecheck + build clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
patchstackdave
force-pushed
the
feat/protect-verify-and-plan
branch
from
26a9afa to
3487103
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #81. Closes the "unmatched stack" gap without a hosted MCP server or anything in saas/hub — the CLI itself is the channel to the builder's agent (which already runs the CLI and reads stdout).
Generic scaffold + wiring plan (no more silent skip / bare "unsupported")
On a stack no adapter matches,
runProtectnow scaffolds a framework-agnostic guard (templates/generic-guard.ts→src/patchstack/{guard.ts,rules.json}) and prints a wiring plan with best-effort server-entry detection (candidate files + Express). The generic guard exposesprotectFetch(handler)(Web-Fetch) andpatchstackMiddleware(Node/Express).protect --check— the verify half of the looprunVerifyinspects the app and reports whether the guard is wired, exit 1 if not. Adapters ownverify(); the generic path checks the guard is scaffolded and imported into a source file. This is the feedback channel the agent (or CI) drives: scaffold → wire per plan →--check→ iterate. All via CLI stdout + exit code — no server.Also
Adapterinterface gainsverify();tanstack-supabaseimplements it.AGENT-INSTALL.mddocuments the loop.Verified end-to-end via the shipped CLI (scaffold+plan →
--checkexit 1 → wire →--checkexit 0). +3 tests. 447 pass, typecheck + build clean.🤖 Generated with Claude Code