[NO-TICKET] Save the claim link and recognise a claimed site in scan, status and guide

[daniloradovic]

What changed

• scan saves the link that connects the site to a Patchstack account in .patchstackrc.json (claimUrl) when it creates the site, so the link is not lost with the terminal output.
• scan, status and claim now learn whether the site has an owner. scan and status ask the claim page's public preview (GET monitor/claim/preview?site=<uuid>); claim already knows when it finishes. When the site has an owner, they write "claimed": true to .patchstackrc.json and drop claimUrl.
• scan stops asking once the file says claimed, so a build does not make the request on every run.
• guide still sends nothing over the network. It marks "Connect project to Patchstack account" done from that note.
• status prints a Connected: line (yes / not yet / could not be verified) instead of always saying "Not connected yet?".

Why

The claim link was only printed. A tool that hides command output had no way to show it, and an agent that missed it had nowhere to look it up. And when someone claimed the site in the browser, nothing told the CLI, so scan and guide kept saying "connect this project to your Patchstack account" after it was done.

How it behaves

Situation	scan	guide
Site just created	Saves claimUrl; asks once; not connected	Not connected, shows the link
Claimed in the browser	Asks, sees an owner, writes claimed: true, ✔ connected	✔ connected
File already says claimed	Does not ask; ✔ connected	✔ connected
Claim token connected it	Writes claimed: true without asking	✔ connected
Lookup fails or times out	Not connected, file untouched; never fails the scan	Unchanged

The lookup sends no credential and nothing about the project; the site UUID is the whole request. AGENT-INSTALL.md lists it with the other endpoints, and the command table now shows what scan, status and claim write.

Verified

• npm test: 4154 passed, 7 skipped. That includes new tests for the lookup, the config writer, guide reading the note, and a packaged-bin test where a scan sees an owner, writes the note, and doesn't ask on the next run.
• npm run typecheck, npm run build, npm run capabilities:check.
• Ran the built CLI's status against a local fake server for both states, and checked the .patchstackrc.json it left each time.

Outstanding

This changes guide output and AGENT-INSTALL.md, so the hostile field test (node field-test/run.mjs --persona hostile --rounds 3, plus standard for doc accuracy) needs to run right after the release that carries it.

🤖 Generated with Claude Code

[coderbuds]

Adds claim tracking with clear state persistence and comprehensive tests.

🎯 Quality: 87% Excellent · 📦 Size: Large — consider splitting if possible

🤖 Authorship: Agent-written — Claude Code, going by its own attribution. Whether a person read it is unknown; coding agents can call the report-ai-usage tool to say.

📈 This month: Your 205th PR — above team average · Averaging Good

_{See how your team is trending →}

[daniloradovic]

/review