patchwarden 0.4.0 → 0.6.1

package/docs/chatgpt-usage.md

@@ -0,0 +1,101 @@
+# ChatGPT 调用规范 / ChatGPT usage guide
+
+## 中文
+
+这套约定用于降低长参数、长轮询、构建产物和完整日志触发连接器误拦截的概率，同时保留 PatchWarden 的本地安全边界和完整证据。
+
+1. 一个任务只处理一个目标；功能实现、耗时构建和 Git/发布收尾分开执行。
+2. 计划标题使用短英文 slug，详细说明放在目标或计划正文中。
+3. ChatGPT 优先使用守护模板：只读诊断用 `inspect_only`，小范围修改用 `feature_small`，修复已知失败用 `fix_tests`。模板不够表达目标时才使用 `inline_plan` 或保存的长计划。
+4. 创建任务时优先采用 assess → execute 两步流程。execute 必须直接使用 assess 返回的 `next_tool_call`，不要重复发送 goal、plan、repo、agent 或验证命令。
+5. 短任务可以调用 `wait_for_task(timeout_seconds: 25)`；长任务使用 `list_tasks(repo_path=..., active_only=true)` 和 `get_task_status`。
+6. 终态先读取 `get_task_summary(view: "compact")` 和 `audit_task`；证据不足时才读取 standard 摘要、完整 diff 或日志。
+7. 构建验证与源码任务分开。`artifact_hygiene` 会区分源码、已跟踪构建物、忽略产物、运行态文件和可疑变更。
+8. PatchWarden 保留未提交改动供人工审核；提交、推送和发布不属于普通任务范围。
+
+### assess → execute
+
+第一步发送完整目标：
+
+```json
+{
+  "tool": "create_task",
+  "execution_mode": "assess_only",
+  "template": "feature_small",
+  "goal": "Add a bounded activity timeline UI",
+  "agent": "opencode",
+  "repo_path": "my-project",
+  "verify_commands": ["npm test"]
+}
+```
+
+当 `decision` 为 `allow` 时，响应会包含结构化的最小调用：
+
+```json
+{
+  "next_tool_call": {
+    "name": "create_task",
+    "arguments": {
+      "execution_mode": "execute",
+      "assessment_id": "assessment_20260622_143000_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"
+    }
+  }
+}
+```
+
+请原样调用 `next_tool_call`。完整的 128-bit `assessment_id` 用于执行；`assessment_short_id` 仅用于展示。工作区、计划、策略或工具清单变化后会返回 `assessment_stale_*`，此时必须重新 assess。
+
+当 `decision` 为 `needs_confirm` 时，用户需要在使用同一份本地配置的终端运行：
+
+```powershell
+patchwarden-confirm assessment_20260622_143000_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
+```
+
+确认入口不属于 MCP 工具，远程调用者不能自行确认。确认后再原样调用返回的 `next_tool_call`；`blocked` 票据不能确认或执行。
+
+### audit_task 结果解释
+
+- `confirmed_failures`：证据已经明确的失败，例如非零测试退出码、越界变更或失败状态。
+- `possible_false_positives`：启发式规则可能产生的误报，例如文档属于其他包、构建物是有意跟踪的发布资产。
+- `manual_verification_required` / `manual_verification_items`：需要人工或远程权威来源核实的事项。
+
+因此 `verdict: "warn"` 不等于任务一定有错。应先核实上述字段，再决定是否接受结果。
+
+仓库专属验证命令只能配置在本机可信的 `patchwarden.config.json` 中：
+
+```json
+{
+  "repoAllowedTestCommands": {
+    "desktop-app": ["npm run release:check"]
+  }
+}
+```
+
+路径和命令都采用精确匹配，不支持通配符，也不会读取目标仓库的 `package.json` 自动授权。
+
+## English
+
+These conventions reduce connector false positives while preserving local
+safety boundaries and complete evidence.
+
+1. Keep one goal per task; separate feature work, expensive builds, and
+   Git/release handoff.
+2. Use a short English slug for the title.
+3. Prefer guarded templates: `inspect_only` for diagnosis, `feature_small` for
+   a scoped change, and `fix_tests` for a known failure. Use a long plan only
+   when a template cannot express the goal.
+4. Prefer assess → execute. Invoke the returned `next_tool_call` unchanged and
+   do not resend goal, plan, repository, agent, or verification arguments.
+5. Poll long tasks with `list_tasks` and `get_task_status`; inspect
+   `get_task_summary(view: "compact")` before full logs or diffs.
+6. Run build/package validation separately from source implementation.
+7. Changes remain uncommitted for review; commit, push, and publish are outside
+   the ordinary task scope.
+
+`needs_confirm` assessments must be confirmed locally with
+`patchwarden-confirm <full_assessment_id>`. The confirmation command is not an
+MCP tool. A `blocked` assessment cannot be confirmed.
+
+In `audit_task`, evidence-backed failures appear in `confirmed_failures`,
+heuristic warnings in `possible_false_positives`, and unresolved checks in
+`manual_verification_items`. A warning is not automatically a confirmed error.

package/docs/performance-notes.md

@@ -0,0 +1,55 @@
+# PatchWarden Performance Notes
+
+## Current State (v0.6.1)
+
+### Identified Optimization Opportunities
+
+The following performance optimizations have been identified for future implementation. They are documented here rather than implemented in v0.6.1 to avoid introducing risk to the core task execution path.
+
+### 1. Async Git Operations in changeCapture.ts
+
+**Current**: `runGit()` uses `spawnSync()` which blocks the event loop during git operations.
+
+**Proposed**: Replace with `execFile()` (async) and use `Promise.all()` for independent git queries in `captureRepoSnapshot()`.
+
+**Risk**: Medium — changes the core change capture path. Requires careful testing of all snapshot/diff/scope scenarios.
+
+**Expected Benefit**: ~200-500ms improvement per task for repos with many files, as multiple git queries can run concurrently.
+
+### 2. Streaming File Hash
+
+**Current**: `computeFileSha256()` reads the entire file into memory with `readFileSync()`.
+
+**Proposed**: Use `createReadStream()` + `crypto.createHash()` for streaming hash computation.
+
+**Risk**: Low — isolated to hash computation, no semantic change.
+
+**Expected Benefit**: Reduces peak memory usage for large files (e.g., release artifacts > 5MB).
+
+### 3. Workspace Snapshot Caching
+
+**Current**: `walkWorkspace()` traverses the entire workspace directory tree on every snapshot.
+
+**Proposed**: Cache the directory listing and invalidate on file modification events.
+
+**Risk**: High — requires file system watchers and cache invalidation logic. Could introduce stale data bugs.
+
+**Expected Benefit**: ~100-1000ms improvement for large workspaces with many repos.
+
+### 4. Parallel Task Status Reads
+
+**Current**: `listTasks()` reads each task's `status.json` sequentially.
+
+**Proposed**: Use `Promise.all()` to read multiple task status files concurrently.
+
+**Risk**: Low — read-only operation, no semantic change.
+
+**Expected Benefit**: ~50-200ms improvement when listing 10+ tasks.
+
+## Decision for v0.6.1
+
+All four optimizations are deferred to a future release. The current synchronous implementation is correct and well-tested. Changing the core paths would require extensive regression testing that is beyond the scope of this stability release.
+
+## Monitoring
+
+The structured logging module (`src/logging.ts`) added in v0.6.1 provides the infrastructure to measure tool call durations (`duration_ms` in audit logs). Once deployed, real-world timing data can be collected to prioritize which optimization to implement first.

package/docs/release-checklist.md

@@ -0,0 +1,14 @@
+# Manual release checklist
+
+PatchWarden releases remain confirmation-gated. Creating a tag or GitHub Release does not publish npm automatically.
+
+1. Work on a release branch and update `package.json`, changelog/release notes, README, examples, and tool manifests together.
+2. Run the complete local quality gates from `AGENTS.md`.
+3. Open a pull request, wait for `CI gate`, review the diff and package contents, then merge.
+4. Create the version tag from the verified merge commit.
+5. Create the GitHub Release and attach only reviewed release artifacts and checksums.
+6. Publish `patchwarden` to npm using process-scoped authentication; never store the raw token in the repository.
+7. Verify `gh release view`, the remote tag, `npm.cmd view patchwarden version`, and `dist-tags.latest`.
+8. Update or close the associated issue only after remote verification succeeds.
+
+Do not publish new versions under the frozen pre-rename package name.

package/docs/release-v0.6.0.md

@@ -0,0 +1,71 @@
+# PatchWarden v0.6.0
+
+PatchWarden v0.6.0 在保持 `chatgpt_core` 固定 16 工具兼容的同时，加入默认关闭的
+`chatgpt_direct` 安全直接开发模式、本地 assess → confirm → execute 闭环，以及更可靠的
+Windows Core/Direct 双通道运行管理。
+
+## 主要更新
+
+### ChatGPT Core 安全体验
+
+- `assess_only` 返回最小化的结构化 `next_tool_call`；execute 只需
+  `execution_mode` 和完整 `assessment_id`，不再重复传输目标、计划和仓库参数。
+- 中风险票据通过本地 `patchwarden-confirm <full_assessment_id>` 确认。该入口不是 MCP
+  工具，远程调用者不能自行放行。
+- 确认和执行会重新校验票据时效、工作区、计划、策略和工具 Manifest。
+- `audit_task` 将已确认失败、可能误报和人工核查项分开呈现。
+- `get_task_summary(view: "compact")` 和终态 `wait_for_task` 返回有界验收证据，避免长任务
+  结果淹没客户端上下文。
+
+### ChatGPT Direct 模式
+
+- 默认关闭；启用需设置 `enableDirectProfile: true` 并使用 `chatgpt_direct` Profile。
+- 固定 9 工具：健康检查、工作区列表、会话创建、搜索、文件读取、JSON 补丁、白名单
+  验证、会话完成和独立审计。
+- 所有写操作绑定 Direct session 和内容哈希；不支持任意 shell、删除/重命名、Git 推送、
+  npm 发布或远程部署。
+
+### Windows Core/Direct 控制与可观测性
+
+- 根目录统一使用 `PatchWarden.cmd`，支持 Core、Direct 或两者的
+  `start`、`stop`、`restart`、`status`、`health` 和受限 `kill`。
+- Core 和 Direct 分别使用 `127.0.0.1:8080` 与 `127.0.0.1:8081`，并自动校正各自
+  tunnel profile 的 health 地址。
+- supervisor 将 stdout/stderr 写入各自 runtime 目录；非零退出时显示 stderr 最后 30 行，
+  并把退出码、脱敏 tail 和日志路径写入 `tunnel-status.json`。
+- 修复 Core watcher 的 `XDG_CONFIG_HOME` 泄漏到 tunnel-client，导致 Core 错误读取
+  `%LOCALAPPDATA%\patchwarden\opencode-config\tunnel-client\patchwarden.yaml` 并反复退出的问题。
+- `stop` / `restart` 可清理 Profile 精确匹配的遗留 tunnel-client；无关端口占用只报告、不误杀。
+- `status` 支持 health endpoint fallback，陈旧 JSON 不再把实际 ready 的实例误报为 stopped。
+- 旧的单用途入口迁入 `scripts/launchers/`；个人 `.local/launchers/`、运行时配置、凭据和日志
+  不进入 Git、npm 包或 GitHub 发布资产。
+
+## 兼容性
+
+- `chatgpt_core` 仍为固定 16 工具；`chatgpt_direct` 为固定 9 工具。
+- schema epoch 为 `2026-06-22-v6`。
+- `assess_only`、`execute`、`assessment_id`、`plan_ref` 和既有任务记录保持兼容。
+- npm 包名保持 `patchwarden`；旧的 `safe-bifrost` 包继续冻结在 v0.3.0。
+
+## 验证
+
+发布候选通过以下门禁：
+
+```powershell
+npm.cmd run build
+npm.cmd test
+npm.cmd run check:tool-manifest
+npm.cmd run check:direct-tool-manifest
+npm.cmd run test:mcp
+npm.cmd run test:http-mcp
+npm.cmd run doctor:ci
+npm.cmd run pack:clean
+npm.cmd run verify:package
+git diff --check
+```
+
+本机双通道验收确认 Core 16 工具和 Direct 9 工具均为 `running`、`ready=true`，8080/8081
+由对应 `tunnel-client.exe` 监听，两个 `/readyz` 均返回 `ready`。
+
+GitHub Release 与 npm Registry 是独立发布面。创建 Tag/Release 不会自动发布 npm；npm 发布后
+仍需单独核对 `patchwarden@latest`、版本时间、dist-tag 和包完整性。

package/docs/release-v0.6.1.md

@@ -0,0 +1,75 @@
+# PatchWarden v0.6.1 Release Notes
+
+**Release Date**: 2026-06-25
+
+## Overview
+
+PatchWarden v0.6.1 is a stability and observability release. It addresses watcher heartbeat false positives, adds Chinese path reliability, introduces two new tools (`safe_status` and `sync_file`), and adds comprehensive security guard unit tests.
+
+## New Features
+
+### safe_status Tool
+
+A minimal task lifecycle status tool that returns task state without exposing diff, log content, or file contents. Useful when upper-layer security policies block content-bearing tools.
+
+```json
+{
+  "task_id": "task-001",
+  "status": "running",
+  "phase": "executing_agent",
+  "last_heartbeat_at": "2026-06-24T10:00:12Z",
+  "current_command": "codex exec",
+  "watcher_state": "healthy"
+}
+```
+
+### sync_file Tool
+
+Copy a file from source to target within a Direct session repo. Both paths must be inside the session's `repo_path`. Supports optional sha256 verification for both source and target.
+
+### Android Build Doctor
+
+When a managed project contains an `android_app` directory, the health check now includes Android build environment diagnostics: Java version, JAVA_HOME, ANDROID_HOME, SDK platform, build-tools, Gradle wrapper, and APK output path.
+
+## Bug Fixes
+
+- **Watcher stale false positive**: Long-running tasks no longer cause the watcher to be incorrectly reported as stale. The watcher status now falls back to checking running task heartbeats.
+- **Chinese path encoding**: All file I/O operations verified to use UTF-8 encoding. Health check now reports `path_encoding` status.
+- **Tracked external dirty detection**: `captureRepoSnapshot` now correctly identifies tracked-but-modified external files via `dirty_paths` field parsed from `git status --porcelain`. The regex now includes `R` (rename) status, fixing dead code that previously never executed for renamed files.
+- **Release zip path separators**: The packaging script (`pack-clean.js`) now creates zip archives with POSIX `/` path separators instead of Windows backslashes. Linux `unzip` no longer reports `warning: appears to use backslashes as path separators`.
+
+## Security
+
+- 136 unit tests covering all security guards (path guard, sensitive guard, command guard, direct guards)
+- Tests use Node's built-in `node:test` — zero new dependencies
+
+## Observability
+
+- Structured JSON logging to stderr (never stdout, to avoid polluting MCP JSON-RPC)
+- Tool call audit logs with duration tracking
+- Global `unhandledRejection` and `uncaughtException` handlers
+
+## Tool Profile Changes
+
+| Profile | v0.6.0 | v0.6.1 |
+|---------|--------|--------|
+| full | 28 | 30 |
+| chatgpt_core | 16 | 17 |
+| chatgpt_direct | 9 | 10 |
+
+## Migration
+
+No breaking changes. All new fields are optional. New tools are additive and do not affect existing tools.
+
+## Verification
+
+- TypeScript compilation: PASS
+- Unit tests: 136 pass, 0 fail, 1 skipped (Windows symlink)
+- Smoke tests: 139 pass, 0 fail
+- Lifecycle tests: 22 pass, 0 fail (includes tracked external file rename regression test)
+- Doctor CI: PASS (81 OK, 0 WARN, 0 FAIL on the release check host)
+- Tool manifest check: PASS
+- Package manifest check: PASS (260 files)
+- Brand check: PASS (128 tracked files)
+- MCP HTTP tests: 13 pass, 0 fail
+- Release zip: POSIX path separators verified (261 entries, no backslashes)

package/examples/config.example.json

@@ -33,6 +33,11 @@
     "cargo test",
     "go test ./..."
   ],
+  "repoAllowedTestCommands": {
+    "desktop-app": [
+      "npm run release:check"
+    ]
+  },
   "maxReadFileBytes": 200000,
   "defaultTaskTimeoutSeconds": 900,
   "maxTaskTimeoutSeconds": 3600,

package/examples/openai-tunnel/README.md

@@ -17,21 +17,28 @@ or local private paths.
 2. Run `npm.cmd run build`.
 3. Use `scripts/patchwarden-mcp-stdio.cmd` as the tunnel MCP command.
 4. Start `npm.cmd run watch` in a separate terminal.
-5. Start `tunnel-client run` or use `Start-PatchWarden-Tunnel.cmd`.
+5. Start `tunnel-client run` or use `PatchWarden.cmd start core`.
 6. Create a ChatGPT Connector using the tunnel channel.
 7. After a tunnel/schema refresh, reconnect the Connector and validate from a
    new ChatGPT conversation; an already-open conversation may retain its older
    tool catalog.
 
+For ChatGPT Direct editing, set `enableDirectProfile: true` in the trusted
+local config and run `PatchWarden.cmd start direct`. It uses
+`scripts/patchwarden-mcp-direct.cmd`, the separate `patchwarden-direct` Tunnel
+Client profile, no Watcher, and an isolated `runtime-direct` status directory.
+Use a separate Direct Connector/Tunnel ID so the fixed 16-tool Core catalog and
+the 9-tool Direct catalog never overwrite each other's cached schema.
+
 The Windows launcher prompts for the runtime API key once and stores only a
 Windows DPAPI-encrypted value under `%APPDATA%\patchwarden`. Use
-`Reset-PatchWarden-Tunnel-Key.cmd` to remove the saved credential.
+`PatchWarden.cmd reset-key` to remove the saved credential.
 
 Before the launcher starts the tunnel it performs a real MCP stdio handshake
 and requires the exact `chatgpt_core` manifest. Run
-`Check-PatchWarden-Health.cmd` to see the version, profile, tool names, schema
+`PatchWarden.cmd health` to see the version, profile, tool names, schema
 hash, process sources, and any mixed-version warnings. The check is read-only.
-The v0.4.0 core manifest contains 16 tools. A different count or schema hash
+The v0.4.1 core manifest contains 16 tools. A different count or schema hash
 requires a Connector refresh and validation from a new ChatGPT conversation.
 
 ## Architecture

package/examples/openai-tunnel/chatgpt-test-prompt.md

@@ -9,7 +9,7 @@ Use the patchwarden connector tools to verify the workflow.
 Step 1:
 Call health_check and list_agents. Continue only if the watcher and selected
 agent are available. Then call list_workspace for the configured workspace.
-Confirm schema_epoch is 2026-06-20-v2, tool_profile is chatgpt_core, and
+Confirm schema_epoch is 2026-06-22-v6, tool_profile is chatgpt_core, and
 tool_count is 16. If the watcher is stale or missing, stop the task flow and
 report the health_check recovery instruction.
 
@@ -17,30 +17,33 @@ Step 2:
 Call read_workspace_file for README.md.
 
 Step 3:
-Call save_plan with:
-
-title: Add Usage Section
-
-content:
+Prefer the feature_small template for this bounded change. Use goal:
 Add a "## Usage" section to the end of README.md. The section should include
 one sentence: "This repository was updated through PatchWarden."
 Do not modify other files. After the change, run the configured test command.
 
 Step 4:
-Call create_task with the returned plan_id, agent "opencode", an explicit
-repo_path for the target repository, and verify_commands ["npm test"]. Set
-timeout_seconds to 600.
+Call create_task with execution_mode "assess_only", template "feature_small",
+the goal above, agent "opencode", an explicit repo_path, verify_commands
+["npm test"], and timeout_seconds 600. If the decision is allow, invoke the
+returned next_tool_call exactly as provided. Do not resend the goal, plan,
+repository, agent, or verification arguments. If needs_confirm, stop and ask
+the user to run the returned local patchwarden-confirm command. Never execute
+a blocked assessment.
 
 Step 5:
-Immediately call wait_for_task with timeout_seconds 25. If it returns
-continuation_required: true, call wait_for_task again in this same assistant
-turn. Do not stop or reply to the user until terminal is true.
+For this short task, call wait_for_task with timeout_seconds 25. If it returns
+continuation_required: true, call it again in this same assistant turn. For a
+long task, prefer list_tasks(repo_path=..., active_only=true) and
+get_task_status instead of an extended wait loop.
 If execution_blocked is true or next_tool_call is health_check, do not keep
 polling; report the watcher recovery requirement.
 
 Step 6:
-When terminal is true, review the included summary, call get_task_summary and
-audit_task, then call get_diff, get_test_log, and get_result_json as needed.
+When terminal is true, review the included compact summary, call
+get_task_summary with view "compact", and call audit_task. Request the
+standard summary, diff, test log, or result JSON only when compact evidence is
+insufficient.
 
 Step 7:
 Summarize:
@@ -49,5 +52,6 @@ Summarize:
 - whether tests passed
 - whether any out-of-scope changes were detected
 - acceptance_status and audit verdict
+- confirmed_failures, possible_false_positives, and manual verification items
 - whether the diff is acceptable
 ```

package/examples/openai-tunnel/tunnel-client.example.yaml

@@ -14,6 +14,14 @@
 #   --tunnel-id tunnel_xxx \
 #   --mcp-command "C:/path/to/patchwarden/scripts/patchwarden-mcp-stdio.cmd"
 
+# Direct mode uses a separate profile and command:
+#
+# tunnel-client init \
+#   --sample sample_mcp_stdio_local \
+#   --profile patchwarden-direct \
+#   --tunnel-id tunnel_xxx \
+#   --mcp-command "C:/path/to/patchwarden/scripts/patchwarden-mcp-direct.cmd"
+
 mcp:
   commands:
     - channel: main

package/package.json

@@ -1,25 +1,27 @@
 {
   "name": "patchwarden",
-  "version": "0.4.0",
+  "version": "0.6.1",
   "description": "A secure local MCP bridge: clients save plans, local agents execute tasks, and results are returned through workspace-scoped files.",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {
     "patchwarden": "dist/index.js",
+    "patchwarden-confirm": "dist/assessments/confirmCli.js",
     "patchwarden-runner": "dist/runner/cli.js"
   },
   "files": [
     "dist/",
     "docs/",
+    "!docs/optimization-proposal.md",
     "src/",
     "examples/",
     "scripts/",
-    "Start-PatchWarden-Tunnel.cmd",
-    "Restart-PatchWarden.cmd",
-    "Check-PatchWarden-Health.cmd",
-    "Reset-PatchWarden-Tunnel-Key.cmd",
+    "!scripts/kill-patchwarden.ps1",
+    "!scripts/launchers/Kill-PatchWarden.cmd",
+    "PatchWarden.cmd",
     "README.md",
+    "README.en.md",
     "LICENSE",
     "tsconfig.json"
   ],
@@ -31,25 +33,28 @@
     "runner": "node dist/runner/cli.js",
     "watch": "node dist/runner/watch.js",
     "doctor": "node dist/doctor.js",
-    "test": "node dist/smoke-test.js && node scripts/lifecycle-smoke.js && node scripts/doctor-smoke.js && node scripts/tunnel-supervisor-smoke.js && node scripts/watcher-supervisor-smoke.js && node scripts/mcp-manifest-check.js && node scripts/brand-check.js",
+    "doctor:ci": "node dist/doctor.js --allow-default-config",
+    "test:unit": "node scripts/unit-tests.js",
+    "test": "node dist/smoke-test.js && node scripts/unit-tests.js && node scripts/lifecycle-smoke.js && node scripts/doctor-smoke.js && node scripts/tunnel-supervisor-smoke.js && node scripts/watcher-supervisor-smoke.js && node scripts/control-smoke.js && node scripts/mcp-manifest-check.js && node scripts/brand-check.js",
     "test:lifecycle": "npm run build && node scripts/lifecycle-smoke.js",
     "test:doctor": "npm run build && node scripts/doctor-smoke.js",
     "test:tunnel-supervisor": "npm run build && node scripts/tunnel-supervisor-smoke.js",
     "test:watcher-supervisor": "npm run build && node scripts/watcher-supervisor-smoke.js",
     "check:tool-manifest": "npm run build && node scripts/mcp-manifest-check.js",
+    "check:direct-tool-manifest": "npm run build && node scripts/mcp-manifest-check.js --profile chatgpt_direct",
     "check:brand": "node scripts/brand-check.js",
     "test:mcp": "npm run build && node scripts/mcp-smoke.js",
     "test:http-mcp": "npm run build && node scripts/http-mcp-smoke.js",
     "pretest": "npm run build",
     "pack:clean": "npm run build && node scripts/pack-clean.js",
-    "verify:package": "npm run build && npm pack --dry-run"
+    "verify:package": "npm run build && node scripts/package-manifest-check.js"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
-    "typescript": "^5.0.0"
+    "typescript": "^6.0.3"
   },
   "engines": {
     "node": ">=18.0.0"

package/scripts/brand-check.js

@@ -1,25 +1,45 @@
 #!/usr/bin/env node
 import { execFileSync } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
 
 const allowedLegacyFiles = new Set([
   ".gitignore",
   ".npmignore",
   "README.md",
+  "README.en.md",
   "docs/migration-from-safe-bifrost.md",
   "docs/release-v0.3.0.md",
   "docs/release-v0.4.0.md",
+  "docs/release-v0.6.0.md",
   "scripts/brand-check.js",
   "scripts/pack-clean.js",
 ]);
 const legacyPattern = /safe-bifrost|Safe-Bifrost|SAFE_BIFROST|SafeBifrost|safe_bifrost/;
-const trackedFiles = execFileSync(
-  "git",
-  ["ls-files", "--cached", "--others", "--exclude-standard"],
-  { encoding: "utf-8" }
-)
-  .split(/\r?\n/)
-  .filter(Boolean);
+
+const EXCLUDE_DIRS = new Set(["node_modules", ".npm-cache", "dist", "release", ".patchwarden", ".git", "logs", "tmp", "coverage", "build", "out", ".next"]);
+
+let trackedFiles;
+let inGit = false;
+try {
+  trackedFiles = execFileSync(
+    "git",
+    ["ls-files", "--cached", "--others", "--exclude-standard"],
+    { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }
+  )
+    .split(/\r?\n/)
+    .filter(Boolean);
+  inGit = true;
+} catch {
+  // Not a git repository — fall back to filesystem walk
+  console.warn("[brand-check] Not a Git repository; using filesystem walk.");
+  trackedFiles = walkFiles(".");
+  if (trackedFiles.length === 0) {
+    console.warn("[brand-check] WARNING: no files found in non-Git walk. Exiting cleanly.");
+    process.exit(0);
+  }
+}
+
 const failures = [];
 
 for (const file of trackedFiles) {
@@ -29,9 +49,13 @@ for (const file of trackedFiles) {
     failures.push(`${normalized}: legacy brand in path`);
     continue;
   }
-  const content = readFileSync(file);
-  if (!content.includes(0) && legacyPattern.test(content.toString("utf-8"))) {
-    failures.push(`${normalized}: legacy brand in content`);
+  try {
+    const content = readFileSync(file);
+    if (!content.includes(0) && legacyPattern.test(content.toString("utf-8"))) {
+      failures.push(`${normalized}: legacy brand in content`);
+    }
+  } catch {
+    // skip unreadable files
   }
 }
 
@@ -41,4 +65,26 @@ if (failures.length > 0) {
   process.exit(1);
 }
 
-console.log(`[brand-check] OK: ${trackedFiles.length} tracked files checked.`);
+const label = inGit ? "tracked files checked" : "files scanned (non-Git fallback)";
+console.log(`[brand-check] OK: ${trackedFiles.length} ${label}.`);
+
+function walkFiles(root) {
+  const results = [];
+  const visit = (dir) => {
+    if (results.length > 10000) return;
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (results.length > 10000) break;
+      if (e.isDirectory()) {
+        if (EXCLUDE_DIRS.has(e.name)) continue;
+        visit(join(dir, e.name));
+      } else if (e.isFile()) {
+        const rel = relative(root, join(dir, e.name)).replace(/\\/g, "/");
+        results.push(rel);
+      }
+    }
+  };
+  visit(root);
+  return results;
+}