[ENG-3386] Signal Patchstack when the package is uninstalled from a project - #103
Merged
Merged
Conversation
Prompt-driven uninstalls previously left the site record on Patchstack
untouched — a claimed site kept consuming a site slot with no nudge to
its owner, and AGENT-INSTALL.md documented account-side deletion as
impossible.
Add `patchstack-connect uninstall`: it POSTs a package-removed signal to
the new /monitor/pulse/package-removed/{uuid} endpoint. The server
deletes an unclaimed (anonymous) site record outright and only flags a
claimed one — the UUID is a public identifier, so the signal can be
forged and must never destroy account data. The command is signal-only
(local file removal stays with the uninstall steps) and never fails the
flow: an unreachable server warns and moves on.
AGENT-INSTALL.md's Uninstalling section runs the command as step 5,
while the package and .patchstackrc.json still exist, and now ends by
telling the user their claimed site keeps using a slot until removed in
the dashboard — replacing the "there is no CLI command for account-side
deletion" guidance.
Requires the SaaS endpoint to be deployed first: against an older
backend the 404 is reported as "site record no longer exists".
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Well-focused uninstall feature with clear docs, CLI integration, and client logic. 🎯 Quality: 100% Elite · 📦 Size: Medium 📈 This month: Your 81st PR — above team average · Averaging Excellent |
Contributor
Author
|
/review |
mariojgt
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ref ENG-3386 (closes via patchstack/saas#1096)
Problem
When an AI agent removes Patchstack from a vibe-coded project by prompt, the site record on SaaS lives on and keeps consuming a site slot. AGENT-INSTALL.md explicitly said account-side deletion was impossible from the CLI.
Changes
patchstack-connect uninstallcommand — POSTs a package-removed signal toPOST /monitor/pulse/package-removed/{uuid}(new endpoint in patchstack/saas#1096). Signal-only: local file removal stays with the documented uninstall steps, and a failed/unreachable signal warns without failing the flow.postPackageRemoved/buildPackageRemovedUrlin client.ts — endpoint-override aware (same/manifestsuffix mapping as the rules URL), never throws.patchstackrc.jsonstill exist), and the closing guidance now instructs agents to report the site UUID + dashboard link instead of "there is no CLI command for account-side deletion". Authenticating or removing a claimed site on the user's behalf remains forbidden.Why signal-only and non-destructive
The site UUID ships in the widget snippet on every page of the built site — it is public. A UUID-authorized hard delete of claimed sites would let anyone delete someone's site from their account. The signal is safe precisely because forging it can only cause a "did you remove Patchstack?" prompt.
Testing
Release order
Publish to npm only after patchstack/saas#1096 is deployed — against an older backend the CLI misreports the route 404 as "site record no longer exists".
🤖 Generated with Claude Code