patchwarden 0.4.0 → 0.6.0

package/dist/tools/searchWorkspace.js

@@ -0,0 +1,205 @@
+import { readdirSync, readFileSync, statSync, existsSync } from "node:fs";
+import { relative, join, extname } from "node:path";
+import { getConfig } from "../config.js";
+import { PatchWardenError } from "../errors.js";
+import { isSensitivePath } from "../security/sensitiveGuard.js";
+import { validateDirectSessionFreshness, } from "../direct/directSessionStore.js";
+import { guardDirectSessionActive } from "../direct/directGuards.js";
+// ── Constants ──────────────────────────────────────────────────────
+const SKIP_DIRECTORIES = new Set([
+    ".git",
+    ".patchwarden",
+    "node_modules",
+    "dist",
+    "release",
+    "coverage",
+    ".next",
+    ".turbo",
+]);
+const BINARY_EXTENSIONS = new Set([
+    ".exe",
+    ".dll",
+    ".so",
+    ".png",
+    ".jpg",
+    ".jpeg",
+    ".gif",
+    ".bmp",
+    ".ico",
+    ".webp",
+    ".pdf",
+    ".mp3",
+    ".mp4",
+    ".zip",
+    ".gz",
+    ".tar",
+    ".bin",
+    ".dat",
+    ".class",
+    ".jar",
+    ".wasm",
+    ".node",
+]);
+// Safety valve: stop scanning after this many total matches to prevent
+// runaway searches in large repositories with very common terms.
+const MAX_TOTAL_MATCHES = 10_000;
+// ── Tool implementation ────────────────────────────────────────────
+export function searchWorkspace(input) {
+    const config = getConfig();
+    // ── Validate session freshness ───────────────────────────────────
+    const validation = validateDirectSessionFreshness(input.session_id);
+    if (!validation.valid || !validation.session) {
+        throw new PatchWardenError(validation.failure_reason || "session_invalid", `Direct session "${input.session_id}" is not valid: ${validation.failure_reason}.`, "Create a new direct session with create_direct_session.", true, {
+            session_id: input.session_id,
+            failure_reason: validation.failure_reason,
+            operation: "search_workspace",
+        });
+    }
+    const session = validation.session;
+    guardDirectSessionActive(session);
+    // ── Validate query ───────────────────────────────────────────────
+    if (!input.query || input.query.trim() === "") {
+        throw new PatchWardenError("invalid_input", "query is required and must be a non-empty string.", "Provide a search query to look for in file contents.", true, { operation: "search_workspace", session_id: input.session_id });
+    }
+    // ── Resolve parameters ───────────────────────────────────────────
+    const maxResults = input.max_results ?? 20;
+    const caseSensitive = input.case_sensitive ?? false;
+    const maxPreviewChars = input.max_preview_chars ?? 200;
+    const includeGlobs = input.include_globs;
+    const query = caseSensitive ? input.query : input.query.toLowerCase();
+    const repoPath = session.resolved_repo_path;
+    if (!existsSync(repoPath)) {
+        throw new PatchWardenError("repo_not_found", `Session repo path "${repoPath}" no longer exists.`, "Create a new direct session with create_direct_session.", true, {
+            session_id: input.session_id,
+            resolved_repo_path: repoPath,
+            operation: "search_workspace",
+        });
+    }
+    // ── Recursive search ─────────────────────────────────────────────
+    const results = [];
+    let totalMatches = 0;
+    let truncated = false;
+    const visit = (directory) => {
+        if (truncated && totalMatches >= MAX_TOTAL_MATCHES)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(directory, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (totalMatches >= MAX_TOTAL_MATCHES) {
+                truncated = true;
+                return;
+            }
+            // Skip blacklisted directories
+            if (entry.isDirectory() && SKIP_DIRECTORIES.has(entry.name)) {
+                continue;
+            }
+            const fullPath = join(directory, entry.name);
+            const relPath = relative(repoPath, fullPath).replace(/\\/g, "/");
+            if (entry.isDirectory()) {
+                visit(fullPath);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            // Skip sensitive files
+            if (isSensitivePath(relPath))
+                continue;
+            // Skip binary files by extension
+            const ext = extname(entry.name).toLowerCase();
+            if (BINARY_EXTENSIONS.has(ext))
+                continue;
+            // Apply include_globs filter
+            if (includeGlobs && includeGlobs.length > 0) {
+                if (!matchesAnyGlob(relPath, includeGlobs))
+                    continue;
+            }
+            // Read file content and search line by line
+            let content;
+            try {
+                const fileStat = statSync(fullPath);
+                if (fileStat.size > config.directMaxFileBytes)
+                    continue;
+                content = readFileSync(fullPath, "utf-8");
+            }
+            catch {
+                continue;
+            }
+            const lines = content.split(/\r?\n/);
+            for (let i = 0; i < lines.length; i++) {
+                if (totalMatches >= MAX_TOTAL_MATCHES) {
+                    truncated = true;
+                    break;
+                }
+                const line = lines[i];
+                const haystack = caseSensitive ? line : line.toLowerCase();
+                if (haystack.includes(query)) {
+                    totalMatches++;
+                    if (results.length < maxResults) {
+                        const preview = line.length > maxPreviewChars
+                            ? line.slice(0, maxPreviewChars)
+                            : line;
+                        results.push({
+                            path: relPath,
+                            line: i + 1,
+                            preview,
+                        });
+                    }
+                    else {
+                        truncated = true;
+                    }
+                }
+            }
+        }
+    };
+    visit(repoPath);
+    return {
+        results,
+        total_matches: totalMatches,
+        truncated,
+    };
+}
+// ── Glob matching ──────────────────────────────────────────────────
+function matchesAnyGlob(filePath, globs) {
+    for (const pattern of globs) {
+        if (matchGlob(filePath, pattern))
+            return true;
+    }
+    return false;
+}
+/**
+ * Simple glob matching: "*" matches any sequence of characters (including
+ * path separators), "?" matches a single character.
+ *
+ * Examples:
+ *   "*.ts"       matches "foo.ts", "src/bar.ts"
+ *   "src/*.ts"   matches "src/foo.ts", "src/sub/bar.ts"
+ *   "*.test.ts"  matches "foo.test.ts", "src/bar.test.ts"
+ */
+function matchGlob(filePath, pattern) {
+    const normalizedPattern = pattern.replace(/\\/g, "/");
+    const regex = globToRegex(normalizedPattern);
+    return regex.test(filePath);
+}
+function globToRegex(pattern) {
+    let regexStr = "";
+    for (const char of pattern) {
+        if (char === "*") {
+            regexStr += ".*";
+        }
+        else if (char === "?") {
+            regexStr += ".";
+        }
+        else if (/[.+^${}()|[\]\\]/.test(char)) {
+            regexStr += "\\" + char;
+        }
+        else {
+            regexStr += char;
+        }
+    }
+    return new RegExp("^" + regexStr + "$");
+}

package/dist/tools/taskTemplates.js

@@ -19,7 +19,8 @@ export function expandTaskTemplate(input) {
         `## Goal\n${goal}`,
         "## Safety boundaries",
         "- Work only inside the resolved repository path.",
-        "- Do not commit, push, publish, expose credentials, or modify unrelated files.",
+        "- Leave repository changes uncommitted for review; remote operations are outside this task.",
+        "- Keep credentials private and do not modify unrelated files.",
         "- Report exact files inspected or changed and any remaining uncertainty.",
     ];
     switch (input.template) {

package/dist/tools/toolCatalog.d.ts

@@ -1,4 +1,4 @@
-export type ToolProfile = "full" | "chatgpt_core";
+export type ToolProfile = "full" | "chatgpt_core" | "chatgpt_direct";
 export interface CatalogTool {
     name: string;
     description: string;
@@ -13,7 +13,8 @@ export interface ToolCatalogSnapshot {
     tool_manifest_sha256: string;
 }
 export declare const CHATGPT_CORE_TOOL_NAMES: readonly ["health_check", "list_agents", "list_workspace", "read_workspace_file", "save_plan", "create_task", "wait_for_task", "get_task_summary", "get_diff", "get_result", "get_result_json", "get_test_log", "get_task_status", "list_tasks", "cancel_task", "audit_task"];
+export declare const CHATGPT_DIRECT_TOOL_NAMES: readonly ["health_check", "list_workspace", "create_direct_session", "search_workspace", "read_workspace_file", "apply_patch", "run_verification", "finalize_direct_session", "audit_session"];
 export declare function resolveToolProfile(configProfile?: string): ToolProfile;
-export declare function selectToolsForProfile<T extends CatalogTool>(tools: T[], profile: ToolProfile): T[];
+export declare function selectToolsForProfile<T extends CatalogTool>(tools: T[], profile: ToolProfile, enableDirectProfile?: boolean): T[];
 export declare function buildToolCatalogSnapshot(tools: CatalogTool[], profile: ToolProfile): ToolCatalogSnapshot;
 export declare function getLastToolCatalogSnapshot(): ToolCatalogSnapshot | null;

package/dist/tools/toolCatalog.js

@@ -18,22 +18,49 @@ export const CHATGPT_CORE_TOOL_NAMES = [
     "cancel_task",
     "audit_task",
 ];
+export const CHATGPT_DIRECT_TOOL_NAMES = [
+    "health_check",
+    "list_workspace",
+    "create_direct_session",
+    "search_workspace",
+    "read_workspace_file",
+    "apply_patch",
+    "run_verification",
+    "finalize_direct_session",
+    "audit_session",
+];
 let lastSnapshot = null;
 export function resolveToolProfile(configProfile) {
     const raw = (process.env.PATCHWARDEN_TOOL_PROFILE || configProfile || "full").trim();
-    if (raw !== "full" && raw !== "chatgpt_core") {
-        throw new Error(`Invalid tool profile "${raw}". Expected "full" or "chatgpt_core".`);
+    if (raw !== "full" && raw !== "chatgpt_core" && raw !== "chatgpt_direct") {
+        throw new Error(`Invalid tool profile "${raw}". Expected "full", "chatgpt_core", or "chatgpt_direct".`);
     }
     return raw;
 }
-export function selectToolsForProfile(tools, profile) {
+export function selectToolsForProfile(tools, profile, enableDirectProfile) {
     if (profile === "full")
         return tools;
     const byName = new Map(tools.map((tool) => [tool.name, tool]));
-    return CHATGPT_CORE_TOOL_NAMES.map((name) => {
+    if (profile === "chatgpt_core") {
+        return CHATGPT_CORE_TOOL_NAMES.map((name) => {
+            const tool = byName.get(name);
+            if (!tool)
+                throw new Error(`chatgpt_core tool profile requires missing tool "${name}".`);
+            return tool;
+        });
+    }
+    // chatgpt_direct
+    if (!enableDirectProfile) {
+        // Degraded mode: only expose health_check for diagnostics
+        const tool = byName.get("health_check");
+        if (!tool)
+            throw new Error(`chatgpt_direct degraded mode requires missing tool "health_check".`);
+        return [tool];
+    }
+    return CHATGPT_DIRECT_TOOL_NAMES.map((name) => {
         const tool = byName.get(name);
         if (!tool)
-            throw new Error(`chatgpt_core tool profile requires missing tool "${name}".`);
+            throw new Error(`chatgpt_direct tool profile requires missing tool "${name}".`);
         return tool;
     });
 }

package/dist/tools/waitForTask.d.ts

@@ -1,4 +1,4 @@
-import { type TaskSummaryOutput } from "./getTaskSummary.js";
+import { type TaskSummaryResult } from "./getTaskSummary.js";
 export interface WaitForTaskProgressSummary {
     phase: string;
     heartbeat_at: string;
@@ -19,7 +19,7 @@ export interface WaitForTaskOutput {
         name: "wait_for_task" | "audit_task" | "health_check";
         arguments: Record<string, unknown>;
     };
-    summary?: TaskSummaryOutput;
+    summary?: TaskSummaryResult;
     progress_summary?: WaitForTaskProgressSummary;
 }
 export declare function waitForTask(taskId: string, waitSeconds?: number): Promise<WaitForTaskOutput>;

package/dist/tools/waitForTask.js

@@ -54,6 +54,6 @@ export async function waitForTask(taskId, waitSeconds = 25) {
             : executionBlocked
                 ? { name: "health_check", arguments: {} }
                 : { name: "wait_for_task", arguments: { task_id: taskId, timeout_seconds: waitSeconds } },
-        ...(terminal ? { summary: getTaskSummary(taskId) } : { progress_summary: progressSummary }),
+        ...(terminal ? { summary: getTaskSummary(taskId, { view: "compact" }) } : { progress_summary: progressSummary }),
     };
 }

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const PATCHWARDEN_VERSION = "0.4.0";
-export declare const TOOL_SCHEMA_EPOCH = "2026-06-21-v3";
+export declare const PATCHWARDEN_VERSION = "0.6.0";
+export declare const TOOL_SCHEMA_EPOCH = "2026-06-22-v6";

package/dist/version.js

@@ -1,2 +1,2 @@
-export const PATCHWARDEN_VERSION = "0.4.0";
-export const TOOL_SCHEMA_EPOCH = "2026-06-21-v3";
+export const PATCHWARDEN_VERSION = "0.6.0";
+export const TOOL_SCHEMA_EPOCH = "2026-06-22-v6";

package/docs/chatgpt-usage.md

@@ -0,0 +1,101 @@
+# ChatGPT 调用规范 / ChatGPT usage guide
+
+## 中文
+
+这套约定用于降低长参数、长轮询、构建产物和完整日志触发连接器误拦截的概率，同时保留 PatchWarden 的本地安全边界和完整证据。
+
+1. 一个任务只处理一个目标；功能实现、耗时构建和 Git/发布收尾分开执行。
+2. 计划标题使用短英文 slug，详细说明放在目标或计划正文中。
+3. ChatGPT 优先使用守护模板：只读诊断用 `inspect_only`，小范围修改用 `feature_small`，修复已知失败用 `fix_tests`。模板不够表达目标时才使用 `inline_plan` 或保存的长计划。
+4. 创建任务时优先采用 assess → execute 两步流程。execute 必须直接使用 assess 返回的 `next_tool_call`，不要重复发送 goal、plan、repo、agent 或验证命令。
+5. 短任务可以调用 `wait_for_task(timeout_seconds: 25)`；长任务使用 `list_tasks(repo_path=..., active_only=true)` 和 `get_task_status`。
+6. 终态先读取 `get_task_summary(view: "compact")` 和 `audit_task`；证据不足时才读取 standard 摘要、完整 diff 或日志。
+7. 构建验证与源码任务分开。`artifact_hygiene` 会区分源码、已跟踪构建物、忽略产物、运行态文件和可疑变更。
+8. PatchWarden 保留未提交改动供人工审核；提交、推送和发布不属于普通任务范围。
+
+### assess → execute
+
+第一步发送完整目标：
+
+```json
+{
+  "tool": "create_task",
+  "execution_mode": "assess_only",
+  "template": "feature_small",
+  "goal": "Add a bounded activity timeline UI",
+  "agent": "opencode",
+  "repo_path": "my-project",
+  "verify_commands": ["npm test"]
+}
+```
+
+当 `decision` 为 `allow` 时，响应会包含结构化的最小调用：
+
+```json
+{
+  "next_tool_call": {
+    "name": "create_task",
+    "arguments": {
+      "execution_mode": "execute",
+      "assessment_id": "assessment_20260622_143000_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"
+    }
+  }
+}
+```
+
+请原样调用 `next_tool_call`。完整的 128-bit `assessment_id` 用于执行；`assessment_short_id` 仅用于展示。工作区、计划、策略或工具清单变化后会返回 `assessment_stale_*`，此时必须重新 assess。
+
+当 `decision` 为 `needs_confirm` 时，用户需要在使用同一份本地配置的终端运行：
+
+```powershell
+patchwarden-confirm assessment_20260622_143000_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
+```
+
+确认入口不属于 MCP 工具，远程调用者不能自行确认。确认后再原样调用返回的 `next_tool_call`；`blocked` 票据不能确认或执行。
+
+### audit_task 结果解释
+
+- `confirmed_failures`：证据已经明确的失败，例如非零测试退出码、越界变更或失败状态。
+- `possible_false_positives`：启发式规则可能产生的误报，例如文档属于其他包、构建物是有意跟踪的发布资产。
+- `manual_verification_required` / `manual_verification_items`：需要人工或远程权威来源核实的事项。
+
+因此 `verdict: "warn"` 不等于任务一定有错。应先核实上述字段，再决定是否接受结果。
+
+仓库专属验证命令只能配置在本机可信的 `patchwarden.config.json` 中：
+
+```json
+{
+  "repoAllowedTestCommands": {
+    "desktop-app": ["npm run release:check"]
+  }
+}
+```
+
+路径和命令都采用精确匹配，不支持通配符，也不会读取目标仓库的 `package.json` 自动授权。
+
+## English
+
+These conventions reduce connector false positives while preserving local
+safety boundaries and complete evidence.
+
+1. Keep one goal per task; separate feature work, expensive builds, and
+   Git/release handoff.
+2. Use a short English slug for the title.
+3. Prefer guarded templates: `inspect_only` for diagnosis, `feature_small` for
+   a scoped change, and `fix_tests` for a known failure. Use a long plan only
+   when a template cannot express the goal.
+4. Prefer assess → execute. Invoke the returned `next_tool_call` unchanged and
+   do not resend goal, plan, repository, agent, or verification arguments.
+5. Poll long tasks with `list_tasks` and `get_task_status`; inspect
+   `get_task_summary(view: "compact")` before full logs or diffs.
+6. Run build/package validation separately from source implementation.
+7. Changes remain uncommitted for review; commit, push, and publish are outside
+   the ordinary task scope.
+
+`needs_confirm` assessments must be confirmed locally with
+`patchwarden-confirm <full_assessment_id>`. The confirmation command is not an
+MCP tool. A `blocked` assessment cannot be confirmed.
+
+In `audit_task`, evidence-backed failures appear in `confirmed_failures`,
+heuristic warnings in `possible_false_positives`, and unresolved checks in
+`manual_verification_items`. A warning is not automatically a confirmed error.

package/docs/release-checklist.md

@@ -0,0 +1,14 @@
+# Manual release checklist
+
+PatchWarden releases remain confirmation-gated. Creating a tag or GitHub Release does not publish npm automatically.
+
+1. Work on a release branch and update `package.json`, changelog/release notes, README, examples, and tool manifests together.
+2. Run the complete local quality gates from `AGENTS.md`.
+3. Open a pull request, wait for `CI gate`, review the diff and package contents, then merge.
+4. Create the version tag from the verified merge commit.
+5. Create the GitHub Release and attach only reviewed release artifacts and checksums.
+6. Publish `patchwarden` to npm using process-scoped authentication; never store the raw token in the repository.
+7. Verify `gh release view`, the remote tag, `npm.cmd view patchwarden version`, and `dist-tags.latest`.
+8. Update or close the associated issue only after remote verification succeeds.
+
+Do not publish new versions under the frozen pre-rename package name.

package/docs/release-v0.6.0.md

@@ -0,0 +1,71 @@
+# PatchWarden v0.6.0
+
+PatchWarden v0.6.0 在保持 `chatgpt_core` 固定 16 工具兼容的同时，加入默认关闭的
+`chatgpt_direct` 安全直接开发模式、本地 assess → confirm → execute 闭环，以及更可靠的
+Windows Core/Direct 双通道运行管理。
+
+## 主要更新
+
+### ChatGPT Core 安全体验
+
+- `assess_only` 返回最小化的结构化 `next_tool_call`；execute 只需
+  `execution_mode` 和完整 `assessment_id`，不再重复传输目标、计划和仓库参数。
+- 中风险票据通过本地 `patchwarden-confirm <full_assessment_id>` 确认。该入口不是 MCP
+  工具，远程调用者不能自行放行。
+- 确认和执行会重新校验票据时效、工作区、计划、策略和工具 Manifest。
+- `audit_task` 将已确认失败、可能误报和人工核查项分开呈现。
+- `get_task_summary(view: "compact")` 和终态 `wait_for_task` 返回有界验收证据，避免长任务
+  结果淹没客户端上下文。
+
+### ChatGPT Direct 模式
+
+- 默认关闭；启用需设置 `enableDirectProfile: true` 并使用 `chatgpt_direct` Profile。
+- 固定 9 工具：健康检查、工作区列表、会话创建、搜索、文件读取、JSON 补丁、白名单
+  验证、会话完成和独立审计。
+- 所有写操作绑定 Direct session 和内容哈希；不支持任意 shell、删除/重命名、Git 推送、
+  npm 发布或远程部署。
+
+### Windows Core/Direct 控制与可观测性
+
+- 根目录统一使用 `PatchWarden.cmd`，支持 Core、Direct 或两者的
+  `start`、`stop`、`restart`、`status`、`health` 和受限 `kill`。
+- Core 和 Direct 分别使用 `127.0.0.1:8080` 与 `127.0.0.1:8081`，并自动校正各自
+  tunnel profile 的 health 地址。
+- supervisor 将 stdout/stderr 写入各自 runtime 目录；非零退出时显示 stderr 最后 30 行，
+  并把退出码、脱敏 tail 和日志路径写入 `tunnel-status.json`。
+- 修复 Core watcher 的 `XDG_CONFIG_HOME` 泄漏到 tunnel-client，导致 Core 错误读取
+  `%LOCALAPPDATA%\patchwarden\opencode-config\tunnel-client\patchwarden.yaml` 并反复退出的问题。
+- `stop` / `restart` 可清理 Profile 精确匹配的遗留 tunnel-client；无关端口占用只报告、不误杀。
+- `status` 支持 health endpoint fallback，陈旧 JSON 不再把实际 ready 的实例误报为 stopped。
+- 旧的单用途入口迁入 `scripts/launchers/`；个人 `.local/launchers/`、运行时配置、凭据和日志
+  不进入 Git、npm 包或 GitHub 发布资产。
+
+## 兼容性
+
+- `chatgpt_core` 仍为固定 16 工具；`chatgpt_direct` 为固定 9 工具。
+- schema epoch 为 `2026-06-22-v6`。
+- `assess_only`、`execute`、`assessment_id`、`plan_ref` 和既有任务记录保持兼容。
+- npm 包名保持 `patchwarden`；旧的 `safe-bifrost` 包继续冻结在 v0.3.0。
+
+## 验证
+
+发布候选通过以下门禁：
+
+```powershell
+npm.cmd run build
+npm.cmd test
+npm.cmd run check:tool-manifest
+npm.cmd run check:direct-tool-manifest
+npm.cmd run test:mcp
+npm.cmd run test:http-mcp
+npm.cmd run doctor:ci
+npm.cmd run pack:clean
+npm.cmd run verify:package
+git diff --check
+```
+
+本机双通道验收确认 Core 16 工具和 Direct 9 工具均为 `running`、`ready=true`，8080/8081
+由对应 `tunnel-client.exe` 监听，两个 `/readyz` 均返回 `ready`。
+
+GitHub Release 与 npm Registry 是独立发布面。创建 Tag/Release 不会自动发布 npm；npm 发布后
+仍需单独核对 `patchwarden@latest`、版本时间、dist-tag 和包完整性。

package/examples/config.example.json

@@ -33,6 +33,11 @@
     "cargo test",
     "go test ./..."
   ],
+  "repoAllowedTestCommands": {
+    "desktop-app": [
+      "npm run release:check"
+    ]
+  },
   "maxReadFileBytes": 200000,
   "defaultTaskTimeoutSeconds": 900,
   "maxTaskTimeoutSeconds": 3600,

package/examples/openai-tunnel/README.md

@@ -17,21 +17,28 @@ or local private paths.
 2. Run `npm.cmd run build`.
 3. Use `scripts/patchwarden-mcp-stdio.cmd` as the tunnel MCP command.
 4. Start `npm.cmd run watch` in a separate terminal.
-5. Start `tunnel-client run` or use `Start-PatchWarden-Tunnel.cmd`.
+5. Start `tunnel-client run` or use `PatchWarden.cmd start core`.
 6. Create a ChatGPT Connector using the tunnel channel.
 7. After a tunnel/schema refresh, reconnect the Connector and validate from a
    new ChatGPT conversation; an already-open conversation may retain its older
    tool catalog.
 
+For ChatGPT Direct editing, set `enableDirectProfile: true` in the trusted
+local config and run `PatchWarden.cmd start direct`. It uses
+`scripts/patchwarden-mcp-direct.cmd`, the separate `patchwarden-direct` Tunnel
+Client profile, no Watcher, and an isolated `runtime-direct` status directory.
+Use a separate Direct Connector/Tunnel ID so the fixed 16-tool Core catalog and
+the 9-tool Direct catalog never overwrite each other's cached schema.
+
 The Windows launcher prompts for the runtime API key once and stores only a
 Windows DPAPI-encrypted value under `%APPDATA%\patchwarden`. Use
-`Reset-PatchWarden-Tunnel-Key.cmd` to remove the saved credential.
+`PatchWarden.cmd reset-key` to remove the saved credential.
 
 Before the launcher starts the tunnel it performs a real MCP stdio handshake
 and requires the exact `chatgpt_core` manifest. Run
-`Check-PatchWarden-Health.cmd` to see the version, profile, tool names, schema
+`PatchWarden.cmd health` to see the version, profile, tool names, schema
 hash, process sources, and any mixed-version warnings. The check is read-only.
-The v0.4.0 core manifest contains 16 tools. A different count or schema hash
+The v0.4.1 core manifest contains 16 tools. A different count or schema hash
 requires a Connector refresh and validation from a new ChatGPT conversation.
 
 ## Architecture

package/examples/openai-tunnel/chatgpt-test-prompt.md

@@ -9,7 +9,7 @@ Use the patchwarden connector tools to verify the workflow.
 Step 1:
 Call health_check and list_agents. Continue only if the watcher and selected
 agent are available. Then call list_workspace for the configured workspace.
-Confirm schema_epoch is 2026-06-20-v2, tool_profile is chatgpt_core, and
+Confirm schema_epoch is 2026-06-22-v6, tool_profile is chatgpt_core, and
 tool_count is 16. If the watcher is stale or missing, stop the task flow and
 report the health_check recovery instruction.
 
@@ -17,30 +17,33 @@ Step 2:
 Call read_workspace_file for README.md.
 
 Step 3:
-Call save_plan with:
-
-title: Add Usage Section
-
-content:
+Prefer the feature_small template for this bounded change. Use goal:
 Add a "## Usage" section to the end of README.md. The section should include
 one sentence: "This repository was updated through PatchWarden."
 Do not modify other files. After the change, run the configured test command.
 
 Step 4:
-Call create_task with the returned plan_id, agent "opencode", an explicit
-repo_path for the target repository, and verify_commands ["npm test"]. Set
-timeout_seconds to 600.
+Call create_task with execution_mode "assess_only", template "feature_small",
+the goal above, agent "opencode", an explicit repo_path, verify_commands
+["npm test"], and timeout_seconds 600. If the decision is allow, invoke the
+returned next_tool_call exactly as provided. Do not resend the goal, plan,
+repository, agent, or verification arguments. If needs_confirm, stop and ask
+the user to run the returned local patchwarden-confirm command. Never execute
+a blocked assessment.
 
 Step 5:
-Immediately call wait_for_task with timeout_seconds 25. If it returns
-continuation_required: true, call wait_for_task again in this same assistant
-turn. Do not stop or reply to the user until terminal is true.
+For this short task, call wait_for_task with timeout_seconds 25. If it returns
+continuation_required: true, call it again in this same assistant turn. For a
+long task, prefer list_tasks(repo_path=..., active_only=true) and
+get_task_status instead of an extended wait loop.
 If execution_blocked is true or next_tool_call is health_check, do not keep
 polling; report the watcher recovery requirement.
 
 Step 6:
-When terminal is true, review the included summary, call get_task_summary and
-audit_task, then call get_diff, get_test_log, and get_result_json as needed.
+When terminal is true, review the included compact summary, call
+get_task_summary with view "compact", and call audit_task. Request the
+standard summary, diff, test log, or result JSON only when compact evidence is
+insufficient.
 
 Step 7:
 Summarize:
@@ -49,5 +52,6 @@ Summarize:
 - whether tests passed
 - whether any out-of-scope changes were detected
 - acceptance_status and audit verdict
+- confirmed_failures, possible_false_positives, and manual verification items
 - whether the diff is acceptable
 ```

package/examples/openai-tunnel/tunnel-client.example.yaml

@@ -14,6 +14,14 @@
 #   --tunnel-id tunnel_xxx \
 #   --mcp-command "C:/path/to/patchwarden/scripts/patchwarden-mcp-stdio.cmd"
 
+# Direct mode uses a separate profile and command:
+#
+# tunnel-client init \
+#   --sample sample_mcp_stdio_local \
+#   --profile patchwarden-direct \
+#   --tunnel-id tunnel_xxx \
+#   --mcp-command "C:/path/to/patchwarden/scripts/patchwarden-mcp-direct.cmd"
+
 mcp:
   commands:
     - channel: main