patchwarden 0.4.0 → 0.6.1

package/scripts/mcp-manifest-check.js

@@ -1,35 +1,64 @@
 #!/usr/bin/env node
+import { existsSync, readFileSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { CHATGPT_CORE_TOOL_NAMES } from "../dist/tools/toolCatalog.js";
+import { CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES } from "../dist/tools/toolCatalog.js";
 
 const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
 const jsonOnly = process.argv.includes("--json");
-const expectedTools = [...CHATGPT_CORE_TOOL_NAMES];
+const profileIndex = process.argv.indexOf("--profile");
+const profile = profileIndex >= 0 ? process.argv[profileIndex + 1] : "chatgpt_core";
+if (profile !== "chatgpt_core" && profile !== "chatgpt_direct") {
+  throw new Error(`Unsupported manifest profile "${profile}".`);
+}
+const expectedTools = profile === "chatgpt_direct"
+  ? [...CHATGPT_DIRECT_TOOL_NAMES]
+  : [...CHATGPT_CORE_TOOL_NAMES];
+const defaultConfigPath = resolve(root, "patchwarden.config.json");
+const transportEnv = {
+  ...process.env,
+  PATCHWARDEN_TOOL_PROFILE: profile,
+};
+
+// When checking chatgpt_direct profile, ensure enableDirectProfile is true
+// by creating a temporary config if needed.
+let tempConfigPath = null;
+if (profile === "chatgpt_direct") {
+  const baseConfig = existsSync(defaultConfigPath)
+    ? JSON.parse(readFileSync(defaultConfigPath, "utf-8"))
+    : {};
+  if (!baseConfig.enableDirectProfile) {
+    const { mkdtempSync, writeFileSync, rmSync } = await import("node:fs");
+    const { tmpdir } = await import("node:os");
+    const { join } = await import("node:path");
+    tempConfigPath = join(mkdtempSync(join(tmpdir(), "pw-direct-")), "config.json");
+    writeFileSync(tempConfigPath, JSON.stringify({ ...baseConfig, enableDirectProfile: true }, null, 2), "utf-8");
+    transportEnv.PATCHWARDEN_CONFIG = tempConfigPath;
+  }
+}
 
-const transport = process.platform === "win32"
-  ? new StdioClientTransport({
-      command: "cmd.exe",
-      args: ["/d", "/c", resolve(root, "scripts", "patchwarden-mcp-stdio.cmd")],
-      cwd: root,
-      stderr: "pipe",
-    })
-  : new StdioClientTransport({
-      command: process.execPath,
-      args: [resolve(root, "dist", "index.js")],
-      cwd: root,
-      env: {
-        ...process.env,
-        PATCHWARDEN_CONFIG: resolve(root, "patchwarden.config.json"),
-        PATCHWARDEN_TOOL_PROFILE: "chatgpt_core",
-      },
-      stderr: "pipe",
-    });
+if (!transportEnv.PATCHWARDEN_CONFIG) {
+  if (process.env.PATCHWARDEN_CONFIG) {
+    transportEnv.PATCHWARDEN_CONFIG = process.env.PATCHWARDEN_CONFIG;
+  } else if (existsSync(defaultConfigPath)) {
+    transportEnv.PATCHWARDEN_CONFIG = defaultConfigPath;
+  } else {
+    delete transportEnv.PATCHWARDEN_CONFIG;
+  }
+}
+
+const transport = new StdioClientTransport({
+  command: process.execPath,
+  args: [resolve(root, "dist", "index.js")],
+  cwd: root,
+  env: transportEnv,
+  stderr: "pipe",
+});
 
 const client = new Client(
-  { name: "patchwarden-manifest-check", version: "0.4.0" },
+  { name: "patchwarden-manifest-check", version: "0.6.0" },
   { capabilities: {} }
 );
 
@@ -38,10 +67,10 @@ try {
   const listed = await client.listTools();
   const names = listed.tools.map((tool) => tool.name);
   if (JSON.stringify(names) !== JSON.stringify(expectedTools)) {
-    throw new Error(`chatgpt_core tool list mismatch. Expected ${expectedTools.join(", ")}; got ${names.join(", ")}`);
+    throw new Error(`${profile} tool list mismatch. Expected ${expectedTools.join(", ")}; got ${names.join(", ")}`);
   }
   // Layer 2: tools/list must carry _meta with manifest hash for catalog sync
-  if (!listed._meta || listed._meta.tool_profile !== "chatgpt_core" || listed._meta.tool_count !== expectedTools.length) {
+  if (!listed._meta || listed._meta.tool_profile !== profile || listed._meta.tool_count !== expectedTools.length) {
     throw new Error(`tools/list _meta missing or wrong profile/count: ${JSON.stringify(listed._meta || null)}`);
   }
   if (typeof listed._meta.tool_manifest_sha256 !== "string" || listed._meta.tool_manifest_sha256.length !== 64) {
@@ -50,51 +79,77 @@ try {
   if (typeof listed._meta.schema_epoch !== "string" || typeof listed._meta.server_version !== "string") {
     throw new Error(`tools/list _meta missing schema_epoch/server_version: ${JSON.stringify(listed._meta)}`);
   }
-  const createTask = listed.tools.find((tool) => tool.name === "create_task");
-  const createProperties = Object.keys(createTask?.inputSchema?.properties || {});
-  for (const requiredProperty of ["inline_plan", "verify_commands"]) {
-    if (!createProperties.includes(requiredProperty)) {
-      throw new Error(`create_task schema is missing ${requiredProperty}`);
+  if (profile === "chatgpt_core") {
+    const createTask = listed.tools.find((tool) => tool.name === "create_task");
+    const createProperties = Object.keys(createTask?.inputSchema?.properties || {});
+    for (const requiredProperty of ["inline_plan", "verify_commands"]) {
+      if (!createProperties.includes(requiredProperty)) {
+        throw new Error(`create_task schema is missing ${requiredProperty}`);
+      }
+    }
+    const waitTool = listed.tools.find((tool) => tool.name === "wait_for_task");
+    const waitProperties = Object.keys(waitTool?.inputSchema?.properties || {});
+    if (!waitProperties.includes("timeout_seconds") || !waitProperties.includes("wait_seconds")) {
+      throw new Error("wait_for_task schema must expose timeout_seconds and wait_seconds");
+    }
+    const healthProperties = Object.keys(listed.tools.find((tool) => tool.name === "health_check")?.inputSchema?.properties || {});
+    if (!healthProperties.includes("detail")) throw new Error("health_check schema must expose detail");
+    const listTaskProperties = Object.keys(listed.tools.find((tool) => tool.name === "list_tasks")?.inputSchema?.properties || {});
+    if (!listTaskProperties.includes("repo_path") || !listTaskProperties.includes("active_only")) {
+      throw new Error("list_tasks schema must expose repo_path and active_only");
+    }
+    const summaryProperties = Object.keys(listed.tools.find((tool) => tool.name === "get_task_summary")?.inputSchema?.properties || {});
+    if (!summaryProperties.includes("view") || !summaryProperties.includes("max_items")) {
+      throw new Error("get_task_summary schema must expose view and max_items");
+    }
+  } else {
+    const directRequirements = {
+      create_direct_session: ["repo_path"],
+      apply_patch: ["session_id", "path", "expected_sha256", "operations"],
+      run_verification: ["session_id", "command"],
+      finalize_direct_session: ["session_id"],
+      audit_session: ["session_id"],
+    };
+    for (const [toolName, requiredProperties] of Object.entries(directRequirements)) {
+      const tool = listed.tools.find((entry) => entry.name === toolName);
+      const properties = Object.keys(tool?.inputSchema?.properties || {});
+      for (const property of requiredProperties) {
+        if (!properties.includes(property)) {
+          throw new Error(`${toolName} schema is missing ${property}`);
+        }
+      }
     }
-  }
-  const waitTool = listed.tools.find((tool) => tool.name === "wait_for_task");
-  const waitProperties = Object.keys(waitTool?.inputSchema?.properties || {});
-  if (!waitProperties.includes("timeout_seconds") || !waitProperties.includes("wait_seconds")) {
-    throw new Error("wait_for_task schema must expose timeout_seconds and wait_seconds");
-  }
-  const healthProperties = Object.keys(listed.tools.find((tool) => tool.name === "health_check")?.inputSchema?.properties || {});
-  if (!healthProperties.includes("detail")) throw new Error("health_check schema must expose detail");
-  const listTaskProperties = Object.keys(listed.tools.find((tool) => tool.name === "list_tasks")?.inputSchema?.properties || {});
-  if (!listTaskProperties.includes("repo_path") || !listTaskProperties.includes("active_only")) {
-    throw new Error("list_tasks schema must expose repo_path and active_only");
   }
   const healthResult = await client.callTool({ name: "health_check", arguments: {} });
   if (healthResult.isError) throw new Error(String(healthResult.content?.[0]?.text || "health_check failed"));
   const health = JSON.parse(String(healthResult.content?.[0]?.text || "{}"));
   if (
-    health.tool_profile !== "chatgpt_core" ||
+    health.tool_profile !== profile ||
     health.tool_count !== expectedTools.length ||
-    !health.tool_manifest_sha256
+    !health.tool_manifest_sha256 ||
+    (profile === "chatgpt_direct" && health.direct_profile_enabled !== true)
   ) {
     throw new Error(`health_check catalog mismatch: ${JSON.stringify(health)}`);
   }
-  const hiddenResult = await client.callTool({ name: "get_plan", arguments: { plan_id: "stale-client-probe" } });
-  const hiddenPayload = JSON.parse(String(hiddenResult.content?.[0]?.text || "{}"));
-  if (
-    !hiddenResult.isError ||
-    hiddenPayload.reason !== "tool_catalog_mismatch" ||
-    hiddenPayload.refresh_required !== true ||
-    hiddenPayload.tool_manifest_sha256 !== health.tool_manifest_sha256
-  ) {
-    throw new Error(`hidden tool mismatch guidance is incomplete: ${JSON.stringify(hiddenPayload)}`);
-  }
-  // Layer 3: mismatch error must carry next_tool_call and connector_refresh_steps for self-healing
-  if (hiddenPayload.next_tool_call?.name !== "health_check" || hiddenPayload.next_tool_call?.arguments?.detail !== "self_diagnostic") {
-    throw new Error(`mismatch next_tool_call missing or wrong: ${JSON.stringify(hiddenPayload.next_tool_call || null)}`);
-  }
-  if (!Array.isArray(hiddenPayload.connector_refresh_steps) || hiddenPayload.connector_refresh_steps.length < 3) {
-    throw new Error(`mismatch connector_refresh_steps missing or too short: ${JSON.stringify(hiddenPayload.connector_refresh_steps || null)}`);
+  if (profile === "chatgpt_core") {
+    const hiddenResult = await client.callTool({ name: "get_plan", arguments: { plan_id: "stale-client-probe" } });
+    const hiddenPayload = JSON.parse(String(hiddenResult.content?.[0]?.text || "{}"));
+    if (
+      !hiddenResult.isError ||
+      hiddenPayload.reason !== "tool_catalog_mismatch" ||
+      hiddenPayload.refresh_required !== true ||
+      hiddenPayload.tool_manifest_sha256 !== health.tool_manifest_sha256
+    ) {
+      throw new Error(`hidden tool mismatch guidance is incomplete: ${JSON.stringify(hiddenPayload)}`);
+    }
+    if (hiddenPayload.next_tool_call?.name !== "health_check" || hiddenPayload.next_tool_call?.arguments?.detail !== "self_diagnostic") {
+      throw new Error(`mismatch next_tool_call missing or wrong: ${JSON.stringify(hiddenPayload.next_tool_call || null)}`);
+    }
+    if (!Array.isArray(hiddenPayload.connector_refresh_steps) || hiddenPayload.connector_refresh_steps.length < 3) {
+      throw new Error(`mismatch connector_refresh_steps missing or too short: ${JSON.stringify(hiddenPayload.connector_refresh_steps || null)}`);
+    }
   }
+
   const output = {
     ok: true,
     server_version: health.server_version,
@@ -103,11 +158,18 @@ try {
     tool_count: health.tool_count,
     tool_names: health.tool_names,
     tool_manifest_sha256: health.tool_manifest_sha256,
-    required_schema: {
+    required_schema: profile === "chatgpt_core" ? {
       create_task: ["inline_plan", "verify_commands"],
       wait_for_task: ["timeout_seconds", "wait_seconds"],
       health_check: ["detail"],
       list_tasks: ["repo_path", "active_only"],
+      get_task_summary: ["view", "max_items"],
+    } : {
+      create_direct_session: ["repo_path"],
+      apply_patch: ["session_id", "path", "expected_sha256", "operations"],
+      run_verification: ["session_id", "command"],
+      finalize_direct_session: ["session_id"],
+      audit_session: ["session_id"],
     },
   };
   console.log(jsonOnly ? JSON.stringify(output) : JSON.stringify(output, null, 2));
@@ -117,4 +179,7 @@ try {
   process.exitCode = 1;
 } finally {
   await client.close().catch(() => {});
+  if (tempConfigPath) {
+    try { rmSync(tempConfigPath, { force: true }); } catch {}
+  }
 }

package/scripts/mcp-smoke.js

@@ -101,9 +101,13 @@ try {
   const tools = await client.listTools();
   const names = tools.tools.map((tool) => tool.name).sort();
   const expected = [
+    "apply_patch",
+    "audit_session",
     "audit_task",
     "cancel_task",
+    "create_direct_session",
     "create_task",
+    "finalize_direct_session",
     "get_diff",
     "get_plan",
     "get_result",
@@ -121,7 +125,11 @@ try {
     "list_workspace",
     "read_workspace_file",
     "retry_task",
+    "run_verification",
+    "safe_status",
     "save_plan",
+    "search_workspace",
+    "sync_file",
     "wait_for_task",
   ];
   if (JSON.stringify(names) !== JSON.stringify(expected)) {
@@ -133,7 +141,7 @@ try {
   if (!tools._meta || typeof tools._meta.tool_manifest_sha256 !== "string" || tools._meta.tool_manifest_sha256.length !== 64) {
     throw new Error(`tools/list _meta missing manifest hash: ${JSON.stringify(tools._meta || null)}`);
   }
-  if (tools._meta.tool_profile !== "full" || tools._meta.tool_count !== 22) {
+  if (tools._meta.tool_profile !== "full" || tools._meta.tool_count !== 30) {
     throw new Error(`tools/list _meta profile/count mismatch: ${JSON.stringify(tools._meta)}`);
   }
   if (typeof tools._meta.schema_epoch !== "string" || typeof tools._meta.server_version !== "string") {
@@ -204,7 +212,7 @@ try {
     test_command: "npm test",
   });
   if (
-    task.server_version !== "0.4.0" ||
+    task.server_version !== "0.6.1" ||
     !/^[a-f0-9]{64}$/.test(task.tool_manifest_sha256 || "") ||
     task.next_tool_call?.name !== "wait_for_task" ||
     task.next_tool_call?.arguments?.timeout_seconds !== 25
@@ -298,10 +306,17 @@ try {
   if (!summary.terminal || summary.acceptance_status !== "ready_for_review") {
     throw new Error(`unexpected terminal summary: ${JSON.stringify(summary)}`);
   }
+  const compactSummary = await parseToolJson("get_task_summary", { task_id: task.task_id, view: "compact", max_items: 2 });
+  if (compactSummary.view !== "compact" || "log_tails" in compactSummary || compactSummary.artifact_hygiene?.max_items !== 2) {
+    throw new Error(`unexpected compact summary: ${JSON.stringify(compactSummary)}`);
+  }
   const waited = await parseToolJson("wait_for_task", { task_id: task.task_id, timeout_seconds: 1 });
   if (!waited.terminal || waited.continuation_required || waited.next_tool_call?.name !== "audit_task") {
     throw new Error(`wait_for_task did not return terminal acceptance: ${JSON.stringify(waited)}`);
   }
+  if (waited.summary?.view !== "compact" || "log_tails" in (waited.summary || {})) {
+    throw new Error(`wait_for_task did not embed compact evidence: ${JSON.stringify(waited.summary)}`);
+  }
   const legacyWaited = await parseToolJson("wait_for_task", { task_id: task.task_id, wait_seconds: 1 });
   if (!legacyWaited.terminal) throw new Error("legacy wait_seconds alias stopped working");
   const conflictingWait = await client.callTool({
@@ -323,6 +338,149 @@ try {
   }
   await client.close();
   ok("runner executes a task and writes result files");
+
+  // ── Direct profile checks (lightweight) ──────────────────────────
+
+  // 1. chatgpt_direct disabled: only health_check exposed
+  const disabledConfigPath = join(tempRoot, "direct-disabled.json");
+  writeFileSync(
+    disabledConfigPath,
+    JSON.stringify({
+      workspaceRoot,
+      plansDir: ".patchwarden/plans",
+      tasksDir: ".patchwarden/tasks",
+      agents: { codex: { command: "node", args: ["-e", "console.log('agent')"] } },
+      allowedTestCommands: ["npm test"],
+      maxReadFileBytes: 200000,
+      enableDirectProfile: false,
+    }, null, 2),
+    "utf-8"
+  );
+
+  const disabledTransport = new StdioClientTransport({
+    command: "node",
+    args: ["dist/index.js"],
+    cwd: root,
+    env: {
+      PATCHWARDEN_CONFIG: disabledConfigPath,
+      PATCHWARDEN_TOOL_PROFILE: "chatgpt_direct",
+    },
+    stderr: "pipe",
+  });
+  const disabledClient = new Client(
+    { name: "patchwarden-direct-disabled", version: "0.1.0" },
+    { capabilities: {} }
+  );
+  await disabledClient.connect(disabledTransport);
+
+  const disabledTools = await disabledClient.listTools();
+  const disabledNames = disabledTools.tools.map((t) => t.name).sort();
+  if (disabledNames.length !== 1 || disabledNames[0] !== "health_check") {
+    throw new Error(`chatgpt_direct disabled should expose only health_check, got: ${disabledNames.join(", ")}`);
+  }
+  if (disabledTools._meta.tool_count !== 1) {
+    throw new Error(`chatgpt_direct disabled tool_count should be 1, got ${disabledTools._meta.tool_count}`);
+  }
+
+  const disabledHealth = JSON.parse(
+    (await disabledClient.callTool({ name: "health_check", arguments: {} })).content?.[0]?.text || "{}"
+  );
+  if (disabledHealth.direct_profile_enabled !== false) {
+    throw new Error(`direct_profile_enabled should be false, got ${disabledHealth.direct_profile_enabled}`);
+  }
+  await disabledClient.close();
+  ok("chatgpt_direct disabled exposes only health_check with diagnostic");
+
+  // 2. chatgpt_direct enabled: 10 tools + minimal create_direct_session
+  const enabledConfigPath = join(tempRoot, "direct-enabled.json");
+  const directRepo = join(workspaceRoot, "direct-fixture");
+  mkdirSync(join(directRepo, "src"), { recursive: true });
+  writeFileSync(join(directRepo, "src", "index.ts"), "export const x = 1;\n", "utf-8");
+  writeFileSync(join(directRepo, "package.json"), JSON.stringify({
+    name: "direct-fixture",
+    private: true,
+    scripts: { test: 'node -e "console.log(\'ok\')"' },
+  }, null, 2), "utf-8");
+
+  writeFileSync(
+    enabledConfigPath,
+    JSON.stringify({
+      workspaceRoot,
+      plansDir: ".patchwarden/plans",
+      tasksDir: ".patchwarden/tasks",
+      agents: { codex: { command: "node", args: ["-e", "console.log('agent')"] } },
+      allowedTestCommands: ["npm test"],
+      maxReadFileBytes: 200000,
+      enableDirectProfile: true,
+      directAllowedCommands: ["npm test", "npm run build", "npm run lint"],
+      directSessionsDir: ".patchwarden/direct-sessions",
+      directSessionTtlSeconds: 3600,
+      directMaxPatchBytes: 200000,
+      directMaxFileBytes: 500000,
+    }, null, 2),
+    "utf-8"
+  );
+
+  const enabledTransport = new StdioClientTransport({
+    command: "node",
+    args: ["dist/index.js"],
+    cwd: root,
+    env: {
+      PATCHWARDEN_CONFIG: enabledConfigPath,
+      PATCHWARDEN_TOOL_PROFILE: "chatgpt_direct",
+    },
+    stderr: "pipe",
+  });
+  const enabledClient = new Client(
+    { name: "patchwarden-direct-enabled", version: "0.1.0" },
+    { capabilities: {} }
+  );
+  await enabledClient.connect(enabledTransport);
+
+  const enabledTools = await enabledClient.listTools();
+  const enabledNames = enabledTools.tools.map((t) => t.name).sort();
+  const expectedDirect = [
+    "apply_patch",
+    "audit_session",
+    "create_direct_session",
+    "finalize_direct_session",
+    "health_check",
+    "list_workspace",
+    "read_workspace_file",
+    "run_verification",
+    "search_workspace",
+    "sync_file",
+  ];
+  if (JSON.stringify(enabledNames) !== JSON.stringify(expectedDirect)) {
+    throw new Error(`chatgpt_direct enabled tools mismatch: ${enabledNames.join(", ")}`);
+  }
+  if (enabledTools._meta.tool_count !== 10) {
+    throw new Error(`chatgpt_direct enabled tool_count should be 10, got ${enabledTools._meta.tool_count}`);
+  }
+
+  // Minimal create_direct_session
+  const sessionResult = JSON.parse(
+    (await enabledClient.callTool({
+      name: "create_direct_session",
+      arguments: { repo_path: "direct-fixture", title: "smoke test" },
+    })).content?.[0]?.text || "{}"
+  );
+  if (!sessionResult.session_id || !sessionResult.session_id.startsWith("direct_")) {
+    throw new Error(`create_direct_session failed: ${JSON.stringify(sessionResult)}`);
+  }
+
+  const enabledHealth = JSON.parse(
+    (await enabledClient.callTool({ name: "health_check", arguments: {} })).content?.[0]?.text || "{}"
+  );
+  if (enabledHealth.direct_profile_enabled !== true) {
+    throw new Error(`direct_profile_enabled should be true, got ${enabledHealth.direct_profile_enabled}`);
+  }
+  if (enabledHealth.direct_tool_count !== 10) {
+    throw new Error(`direct_tool_count should be 10, got ${enabledHealth.direct_tool_count}`);
+  }
+
+  await enabledClient.close();
+  ok("chatgpt_direct enabled exposes 10 tools and create_direct_session works");
 } catch (error) {
   fail("MCP smoke test", error);
 } finally {

package/scripts/pack-clean.js

@@ -3,11 +3,14 @@ import {
   cpSync,
   existsSync,
   mkdirSync,
+  readFileSync,
   readdirSync,
   rmSync,
   statSync,
+  writeFileSync,
 } from "node:fs";
 import { execFileSync } from "node:child_process";
+import { deflateRawSync } from "node:zlib";
 import { join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -16,16 +19,17 @@ const root = resolve(scriptDir, "..");
 const releaseDir = resolve(root, "release");
 const archivePath = resolve(root, "patchwarden-release.tar.gz");
 
+// Read version from package.json for zip naming
+const pkg = JSON.parse(readFileSync(resolve(root, "package.json"), "utf-8"));
+const zipArchivePath = resolve(root, `PatchWarden-v${pkg.version}.zip`);
+
 const include = [
   "dist",
   "docs",
   "examples",
   "scripts",
   "src",
-  "Start-PatchWarden-Tunnel.cmd",
-  "Restart-PatchWarden.cmd",
-  "Check-PatchWarden-Health.cmd",
-  "Reset-PatchWarden-Tunnel-Key.cmd",
+  "PatchWarden.cmd",
   ".gitignore",
   "LICENSE",
   "README.md",
@@ -44,8 +48,123 @@ const forbidden = [
   /\.dpapi$/i,
   /(^|[\\/])\.env$/,
   /\.log$/,
+  /^docs[\\/]optimization-proposal\.md$/i,
+  /(^|[\\/])kill-patchwarden\.(cmd|ps1)$/i,
 ];
 
+// ── Minimal zip writer helpers (POSIX paths, DEFLATE via zlib) ────
+// Defined before main execution so const CRC_TABLE is initialized.
+
+const CRC_TABLE = new Uint32Array(256);
+for (let i = 0; i < 256; i++) {
+  let c = i;
+  for (let j = 0; j < 8; j++) {
+    c = (c & 1) ? (0xEDB88320 ^ (c >>> 1)) : (c >>> 1);
+  }
+  CRC_TABLE[i] = c;
+}
+
+function crc32(buf) {
+  let c = 0xFFFFFFFF;
+  for (let i = 0; i < buf.length; i++) {
+    c = CRC_TABLE[(c ^ buf[i]) & 0xFF] ^ (c >>> 8);
+  }
+  return (c ^ 0xFFFFFFFF) >>> 0;
+}
+
+function dosDateTime(date) {
+  const dosTime = (date.getHours() << 11) | (date.getMinutes() << 5) | (date.getSeconds() >> 1);
+  const dosDate = (((date.getFullYear() - 1980) & 0x7F) << 9) | ((date.getMonth() + 1) << 5) | date.getDate();
+  return { dosTime, dosDate };
+}
+
+function createZip(files, outputPath) {
+  const localParts = [];
+  const centralParts = [];
+  let offset = 0;
+  const now = new Date();
+  const { dosTime, dosDate } = dosDateTime(now);
+
+  for (const file of files) {
+    const posixPath = file.path.replace(/\\/g, "/");
+    const nameBuf = Buffer.from(posixPath, "utf-8");
+    const content = file.content;
+    const compressed = deflateRawSync(content);
+    const useDeflate = compressed.length < content.length;
+    const method = useDeflate ? 8 : 0;
+    const data = useDeflate ? compressed : content;
+    const crc = crc32(content);
+
+    const lh = Buffer.alloc(30);
+    lh.writeUInt32LE(0x04034b50, 0);
+    lh.writeUInt16LE(20, 4);
+    lh.writeUInt16LE(0, 6);
+    lh.writeUInt16LE(method, 8);
+    lh.writeUInt16LE(dosTime, 10);
+    lh.writeUInt16LE(dosDate, 12);
+    lh.writeUInt32LE(crc, 14);
+    lh.writeUInt32LE(data.length, 18);
+    lh.writeUInt32LE(content.length, 22);
+    lh.writeUInt16LE(nameBuf.length, 26);
+    lh.writeUInt16LE(0, 28);
+
+    const localHeaderOffset = offset;
+    localParts.push(Buffer.concat([lh, nameBuf, data]));
+    offset += lh.length + nameBuf.length + data.length;
+
+    const cd = Buffer.alloc(46);
+    cd.writeUInt32LE(0x02014b50, 0);
+    cd.writeUInt16LE(20, 4);
+    cd.writeUInt16LE(20, 6);
+    cd.writeUInt16LE(0, 8);
+    cd.writeUInt16LE(method, 10);
+    cd.writeUInt16LE(dosTime, 12);
+    cd.writeUInt16LE(dosDate, 14);
+    cd.writeUInt32LE(crc, 16);
+    cd.writeUInt32LE(data.length, 20);
+    cd.writeUInt32LE(content.length, 24);
+    cd.writeUInt16LE(nameBuf.length, 28);
+    cd.writeUInt16LE(0, 30);
+    cd.writeUInt16LE(0, 32);
+    cd.writeUInt16LE(0, 34);
+    cd.writeUInt16LE(0, 36);
+    cd.writeUInt32LE(0, 38);
+    cd.writeUInt32LE(localHeaderOffset, 42);
+    centralParts.push(Buffer.concat([cd, nameBuf]));
+  }
+
+  const centralDir = Buffer.concat(centralParts);
+  const centralDirOffset = offset;
+
+  const eocd = Buffer.alloc(22);
+  eocd.writeUInt32LE(0x06054b50, 0);
+  eocd.writeUInt16LE(0, 4);
+  eocd.writeUInt16LE(0, 6);
+  eocd.writeUInt16LE(files.length, 8);
+  eocd.writeUInt16LE(files.length, 10);
+  eocd.writeUInt32LE(centralDir.length, 12);
+  eocd.writeUInt32LE(centralDirOffset, 16);
+  eocd.writeUInt16LE(0, 20);
+
+  writeFileSync(outputPath, Buffer.concat([...localParts, centralDir, eocd]));
+}
+
+function readZipEntryNames(zipPath) {
+  const buf = readFileSync(zipPath);
+  const names = [];
+  for (let i = 0; i < buf.length - 4; i++) {
+    if (buf.readUInt32LE(i) === 0x02014b50) {
+      const nameLen = buf.readUInt16LE(i + 28);
+      const extraLen = buf.readUInt16LE(i + 30);
+      const commentLen = buf.readUInt16LE(i + 32);
+      const name = buf.toString("utf-8", i + 46, i + 46 + nameLen);
+      names.push(name);
+      i += 45 + nameLen + extraLen + commentLen;
+    }
+  }
+  return names;
+}
+
 console.log("[pack-clean] Preparing clean release directory...");
 rmSync(releaseDir, { recursive: true, force: true });
 rmSync(archivePath, { force: true });
@@ -116,7 +235,43 @@ if (badArchiveEntries.length > 0) {
 
 const sizeKb = (statSync(archivePath).size / 1024).toFixed(1);
 console.log(`[pack-clean] Release directory: ${releaseFiles.length} files`);
-console.log(`[pack-clean] Archive: ${archivePath} (${sizeKb} KB)`);
+console.log(`[pack-clean] tar.gz Archive: ${archivePath} (${sizeKb} KB)`);
+
+// ── Create zip archive with POSIX path separators ─────────────────
+console.log("[pack-clean] Creating zip archive with POSIX paths...");
+rmSync(zipArchivePath, { force: true });
+
+const zipFiles = releaseFiles.map((file) => {
+  const rel = toPosix(relative(releaseDir, file));
+  return { path: rel, content: readFileSync(file) };
+});
+
+createZip(zipFiles, zipArchivePath);
+
+// Verify zip entries use POSIX separators
+const zipEntryNames = readZipEntryNames(zipArchivePath);
+const badZipEntries = zipEntryNames.filter((name) => name.includes("\\"));
+if (badZipEntries.length > 0) {
+  console.error("[pack-clean] Backslash path separators found in zip entries:");
+  for (const name of badZipEntries.slice(0, 20)) {
+    console.error(`  ${name}`);
+  }
+  rmSync(zipArchivePath, { force: true });
+  process.exit(1);
+}
+
+const badZipForbidden = zipEntryNames.filter(isForbidden);
+if (badZipForbidden.length > 0) {
+  console.error("[pack-clean] Forbidden files in zip archive:");
+  for (const entry of badZipForbidden) {
+    console.error(`  ${entry}`);
+  }
+  rmSync(zipArchivePath, { force: true });
+  process.exit(1);
+}
+
+const zipSizeKb = (statSync(zipArchivePath).size / 1024).toFixed(1);
+console.log(`[pack-clean] zip Archive: ${zipArchivePath} (${zipSizeKb} KB, ${zipEntryNames.length} entries)`);
 console.log("[pack-clean] OK");
 
 function listFiles(dir) {