patchwarden 0.6.0 → 0.6.1

package/scripts/lifecycle-smoke.js

@@ -39,8 +39,8 @@ async function test(name, fn) {
   }
 }
 
-function git(args) {
-  const result = spawnSync("git", args, { cwd: repoPath, encoding: "utf-8" });
+function git(args, cwd = repoPath) {
+  const result = spawnSync("git", args, { cwd, encoding: "utf-8" });
   if (result.status !== 0) throw new Error(`git ${args.join(" ")} failed: ${result.stderr}`);
 }
 
@@ -159,6 +159,7 @@ try {
   const { auditTask } = await import("../dist/tools/auditTask.js");
   const { waitForTask } = await import("../dist/tools/waitForTask.js");
   const { runTask } = await import("../dist/runner/runTask.js");
+  const { reloadConfig } = await import("../dist/config.js");
 
   await test("list_agents reports configured executables", async () => {
     const result = listAgents();
@@ -454,6 +455,339 @@ try {
     }
   });
 
+  // ═══════════════════════════════════════════════════════════
+  // Phase 4: Tracked external dirty tests (separate workspace)
+  // ═══════════════════════════════════════════════════════════
+
+  await test("pre-existing tracked external dirty unchanged → warning only, done", async () => {
+    // Create a separate workspace with git at the root
+    const ws2 = join(tempRoot, "workspace-tracked-dirty");
+    const repo2 = join(ws2, "repo");
+    const ext2 = join(ws2, "external");
+    mkdirSync(repo2, { recursive: true });
+    mkdirSync(ext2, { recursive: true });
+    mkdirSync(join(ws2, ".patchwarden"), { recursive: true });
+    writeFileSync(join(ws2, ".patchwarden", "watcher-heartbeat.json"), JSON.stringify({
+      status: "running", pid: process.pid, instance_id: "td-watcher", launcher_pid: process.pid,
+      started_at: new Date().toISOString(), last_heartbeat_at: new Date().toISOString(),
+    }), "utf-8");
+
+    writeFileSync(join(repo2, "main.js"), "console.log('main');\n", "utf-8");
+    writeFileSync(join(ext2, "external-tracked.txt"), "external tracked content\n", "utf-8");
+
+    git(["init"], ws2);
+    git(["add", "repo/main.js", "external/external-tracked.txt"], ws2);
+    git(["-c", "user.name=T", "-c", "user.email=t@e", "commit", "-m", "init"], ws2);
+
+    // Now modify external file to create pre-existing dirty state
+    writeFileSync(join(ext2, "external-tracked.txt"), "pre-existing dirty content\n", "utf-8");
+
+    const cfg2 = join(tempRoot, "config-tracked-dirty.json");
+    writeFileSync(cfg2, JSON.stringify({
+      workspaceRoot: ws2,
+      plansDir: ".patchwarden/plans",
+      tasksDir: ".patchwarden/tasks",
+      agents: {
+        noop: { command: process.execPath, args: ["-e", "console.log('noop')"] },
+      },
+      allowedTestCommands: ["node --check main.js"],
+      maxReadFileBytes: 200000,
+      defaultTaskTimeoutSeconds: 10,
+      watcherStaleSeconds: 3600,
+    }, null, 2), "utf-8");
+
+    const oldConfig = process.env.PATCHWARDEN_CONFIG;
+    process.env.PATCHWARDEN_CONFIG = cfg2;
+    reloadConfig(cfg2);
+
+    const plan = savePlan({ title: "Noop with external dirty", content: "Do nothing." });
+    const task = createTask({ plan_id: plan.plan_id, agent: "noop", repo_path: "repo", verify_commands: ["node --check main.js"] });
+    const result = await runTask(task.task_id);
+
+    if (result.status !== "done") {
+      throw new Error(`Expected done, got: ${JSON.stringify(result)}`);
+    }
+    const structured = JSON.parse(readFileSync(join(task.path, "result.json"), "utf-8"));
+
+    // Must have pre-existing external dirty warning
+    if (!structured.warnings?.some((w) => w.includes("Pre-existing external dirty"))) {
+      throw new Error(`Missing pre-existing dirty warning: ${JSON.stringify(structured.warnings)}`);
+    }
+
+    // new_out_of_scope_changes must be empty (file didn't change during task)
+    if (structured.new_out_of_scope_changes?.length > 0) {
+      throw new Error(`Should have no new out-of-scope changes: ${JSON.stringify(structured.new_out_of_scope_changes)}`);
+    }
+
+    // verify_status should NOT be failed
+    if (structured.verify_status === "failed") {
+      throw new Error(`verify_status should not be failed: ${structured.verify_status}`);
+    }
+
+    // get_task_summary acceptance_status should NOT be failed
+    const summary = getTaskSummary(task.task_id);
+    if (summary.acceptance_status === "failed") {
+      throw new Error(`acceptance_status should not be failed: ${summary.acceptance_status}`);
+    }
+
+    // audit_task should NOT fail scope_changes
+    const audit = auditTask(task.task_id);
+    const scopeCheck = audit.checks.find((c) => c.name === "scope_changes");
+    if (!scopeCheck || scopeCheck.result !== "pass") {
+      throw new Error(`audit scope_changes should pass: ${JSON.stringify(scopeCheck)}`);
+    }
+
+    // Restore config AFTER all assertions
+    process.env.PATCHWARDEN_CONFIG = oldConfig;
+    reloadConfig(oldConfig);
+
+    // Print result.json key fields for reporting
+    console.log(`    [result.json] status=${structured.status}, verify_status=${structured.verify_status}, new_out_of_scope=${JSON.stringify(structured.new_out_of_scope_changes)}, preexisting=${JSON.stringify(structured.preexisting_external_dirty_files)}, warnings=${JSON.stringify(structured.warnings)}`);
+  });
+
+  await test("pre-existing tracked external dirty changed during task → failed_scope_violation", async () => {
+    const ws2 = join(tempRoot, "workspace-tracked-dirty2");
+    const repo2 = join(ws2, "repo");
+    const ext2 = join(ws2, "external");
+    mkdirSync(repo2, { recursive: true });
+    mkdirSync(ext2, { recursive: true });
+    mkdirSync(join(ws2, ".patchwarden"), { recursive: true });
+    writeFileSync(join(ws2, ".patchwarden", "watcher-heartbeat.json"), JSON.stringify({
+      status: "running", pid: process.pid, instance_id: "td-watcher2", launcher_pid: process.pid,
+      started_at: new Date().toISOString(), last_heartbeat_at: new Date().toISOString(),
+    }), "utf-8");
+
+    writeFileSync(join(repo2, "main.js"), "console.log('main');\n", "utf-8");
+    writeFileSync(join(ext2, "external-tracked.txt"), "external tracked content\n", "utf-8");
+
+    git(["init"], ws2);
+    git(["add", "repo/main.js", "external/external-tracked.txt"], ws2);
+    git(["-c", "user.name=T", "-c", "user.email=t@e", "commit", "-m", "init"], ws2);
+
+    // Modify external file BEFORE task (pre-existing dirty)
+    writeFileSync(join(ext2, "external-tracked.txt"), "pre-existing dirty content\n", "utf-8");
+
+    const cfg2 = join(tempRoot, "config-tracked-dirty2.json");
+    writeFileSync(cfg2, JSON.stringify({
+      workspaceRoot: ws2,
+      plansDir: ".patchwarden/plans",
+      tasksDir: ".patchwarden/tasks",
+      agents: {
+        extmod: { command: process.execPath, args: ["-e", "require('fs').appendFileSync('../external/external-tracked.txt',' modified by task\\n')"] },
+      },
+      allowedTestCommands: ["node --check main.js"],
+      maxReadFileBytes: 200000,
+      defaultTaskTimeoutSeconds: 10,
+      watcherStaleSeconds: 3600,
+    }, null, 2), "utf-8");
+
+    const oldConfig = process.env.PATCHWARDEN_CONFIG;
+    process.env.PATCHWARDEN_CONFIG = cfg2;
+    reloadConfig(cfg2);
+
+    const plan = savePlan({ title: "External dirty modifier", content: "Modify external tracked file." });
+    const task = createTask({ plan_id: plan.plan_id, agent: "extmod", repo_path: "repo", verify_commands: ["node --check main.js"] });
+    const result = await runTask(task.task_id);
+
+    if (result.status !== "failed_scope_violation") {
+      throw new Error(`Expected failed_scope_violation, got: ${JSON.stringify(result)}`);
+    }
+    const structured = JSON.parse(readFileSync(join(task.path, "result.json"), "utf-8"));
+
+    // new_out_of_scope_changes must contain the external tracked file
+    if (!structured.new_out_of_scope_changes?.some((f) => f.path.includes("external-tracked.txt"))) {
+      throw new Error(`Missing new out-of-scope change: ${JSON.stringify(structured.new_out_of_scope_changes)}`);
+    }
+
+    // verify_status must be failed
+    if (structured.verify_status !== "failed") {
+      throw new Error(`verify_status must be failed: ${structured.verify_status}`);
+    }
+
+    // rollback plan must contain the file
+    const rollbackPath = join(task.path, "rollback_scope_violation_plan.md");
+    if (!existsSync(rollbackPath)) throw new Error("rollback_scope_violation_plan.md missing");
+    const rollback = readFileSync(rollbackPath, "utf-8");
+    if (!rollback.includes("external-tracked.txt")) {
+      throw new Error(`Rollback plan missing external-tracked.txt: ${rollback}`);
+    }
+
+    // get_task_summary acceptance_status must be failed
+    const summary = getTaskSummary(task.task_id);
+    if (summary.acceptance_status !== "failed") {
+      throw new Error(`acceptance_status must be failed: ${summary.acceptance_status}`);
+    }
+
+    // audit_task verdict must be fail
+    const audit = auditTask(task.task_id);
+    if (audit.verdict !== "fail") {
+      throw new Error(`audit verdict must be fail: ${audit.verdict}`);
+    }
+
+    // Restore config AFTER all assertions
+    process.env.PATCHWARDEN_CONFIG = oldConfig;
+    reloadConfig(oldConfig);
+
+    console.log(`    [result.json] status=${structured.status}, verify_status=${structured.verify_status}, new_out_of_scope=${JSON.stringify(structured.new_out_of_scope_changes)}, preexisting=${JSON.stringify(structured.preexisting_external_dirty_files)}, warnings=${JSON.stringify(structured.warnings)}`);
+  });
+
+  await test("clean tracked external file changed during task → failed_scope_violation", async () => {
+    const ws2 = join(tempRoot, "workspace-tracked-dirty3");
+    const repo2 = join(ws2, "repo");
+    const ext2 = join(ws2, "external");
+    mkdirSync(repo2, { recursive: true });
+    mkdirSync(ext2, { recursive: true });
+    mkdirSync(join(ws2, ".patchwarden"), { recursive: true });
+    writeFileSync(join(ws2, ".patchwarden", "watcher-heartbeat.json"), JSON.stringify({
+      status: "running", pid: process.pid, instance_id: "td-watcher3", launcher_pid: process.pid,
+      started_at: new Date().toISOString(), last_heartbeat_at: new Date().toISOString(),
+    }), "utf-8");
+
+    writeFileSync(join(repo2, "main.js"), "console.log('main');\n", "utf-8");
+    writeFileSync(join(ext2, "external-tracked.txt"), "external tracked content\n", "utf-8");
+
+    git(["init"], ws2);
+    git(["add", "repo/main.js", "external/external-tracked.txt"], ws2);
+    git(["-c", "user.name=T", "-c", "user.email=t@e", "commit", "-m", "init"], ws2);
+
+    // External file is clean (committed state) — no pre-existing dirty
+
+    const cfg2 = join(tempRoot, "config-tracked-dirty3.json");
+    writeFileSync(cfg2, JSON.stringify({
+      workspaceRoot: ws2,
+      plansDir: ".patchwarden/plans",
+      tasksDir: ".patchwarden/tasks",
+      agents: {
+        extmod: { command: process.execPath, args: ["-e", "require('fs').appendFileSync('../external/external-tracked.txt',' modified by task\\n')"] },
+      },
+      allowedTestCommands: ["node --check main.js"],
+      maxReadFileBytes: 200000,
+      defaultTaskTimeoutSeconds: 10,
+      watcherStaleSeconds: 3600,
+    }, null, 2), "utf-8");
+
+    const oldConfig = process.env.PATCHWARDEN_CONFIG;
+    process.env.PATCHWARDEN_CONFIG = cfg2;
+    reloadConfig(cfg2);
+
+    const plan = savePlan({ title: "Clean external modifier", content: "Modify clean external tracked file." });
+    const task = createTask({ plan_id: plan.plan_id, agent: "extmod", repo_path: "repo", verify_commands: ["node --check main.js"] });
+    const result = await runTask(task.task_id);
+
+    if (result.status !== "failed_scope_violation") {
+      throw new Error(`Expected failed_scope_violation, got: ${JSON.stringify(result)}`);
+    }
+    const structured = JSON.parse(readFileSync(join(task.path, "result.json"), "utf-8"));
+
+    // new_out_of_scope_changes must contain the external tracked file (clean→dirty)
+    if (!structured.new_out_of_scope_changes?.some((f) => f.path.includes("external-tracked.txt"))) {
+      throw new Error(`Missing new out-of-scope change: ${JSON.stringify(structured.new_out_of_scope_changes)}`);
+    }
+
+    // verify_status must be failed
+    if (structured.verify_status !== "failed") {
+      throw new Error(`verify_status must be failed: ${structured.verify_status}`);
+    }
+
+    // get_task_summary acceptance_status must be failed
+    const summary = getTaskSummary(task.task_id);
+    if (summary.acceptance_status !== "failed") {
+      throw new Error(`acceptance_status must be failed: ${summary.acceptance_status}`);
+    }
+
+    // audit_task verdict must be fail
+    const audit = auditTask(task.task_id);
+    if (audit.verdict !== "fail") {
+      throw new Error(`audit verdict must be fail: ${audit.verdict}`);
+    }
+
+    // Restore config AFTER all assertions
+    process.env.PATCHWARDEN_CONFIG = oldConfig;
+    reloadConfig(oldConfig);
+
+    console.log(`    [result.json] status=${structured.status}, verify_status=${structured.verify_status}, new_out_of_scope=${JSON.stringify(structured.new_out_of_scope_changes)}, preexisting=${JSON.stringify(structured.preexisting_external_dirty_files)}, warnings=${JSON.stringify(structured.warnings)}`);
+  });
+
+  await test("tracked external file rename → failed_scope_violation", async () => {
+    const ws2 = join(tempRoot, "workspace-tracked-rename");
+    const repo2 = join(ws2, "repo");
+    const ext2 = join(ws2, "external");
+    mkdirSync(repo2, { recursive: true });
+    mkdirSync(ext2, { recursive: true });
+    mkdirSync(join(ws2, ".patchwarden"), { recursive: true });
+    writeFileSync(join(ws2, ".patchwarden", "watcher-heartbeat.json"), JSON.stringify({
+      status: "running", pid: process.pid, instance_id: "td-watcher-rename", launcher_pid: process.pid,
+      started_at: new Date().toISOString(), last_heartbeat_at: new Date().toISOString(),
+    }), "utf-8");
+
+    writeFileSync(join(repo2, "main.js"), "console.log('main');\n", "utf-8");
+    writeFileSync(join(ext2, "external-tracked.txt"), "external tracked content\n", "utf-8");
+
+    git(["init"], ws2);
+    git(["add", "repo/main.js", "external/external-tracked.txt"], ws2);
+    git(["-c", "user.name=T", "-c", "user.email=t@e", "commit", "-m", "init"], ws2);
+
+    // External file is clean (committed state) — no pre-existing dirty
+
+    const cfg2 = join(tempRoot, "config-tracked-rename.json");
+    writeFileSync(cfg2, JSON.stringify({
+      workspaceRoot: ws2,
+      plansDir: ".patchwarden/plans",
+      tasksDir: ".patchwarden/tasks",
+      agents: {
+        extrenamer: { command: process.execPath, args: ["-e", "require('fs').renameSync('../external/external-tracked.txt','../external/external-renamed.txt')"] },
+      },
+      allowedTestCommands: ["node --check main.js"],
+      maxReadFileBytes: 200000,
+      defaultTaskTimeoutSeconds: 10,
+      watcherStaleSeconds: 3600,
+    }, null, 2), "utf-8");
+
+    const oldConfig = process.env.PATCHWARDEN_CONFIG;
+    process.env.PATCHWARDEN_CONFIG = cfg2;
+    reloadConfig(cfg2);
+
+    const plan = savePlan({ title: "External rename", content: "Rename external tracked file." });
+    const task = createTask({ plan_id: plan.plan_id, agent: "extrenamer", repo_path: "repo", verify_commands: ["node --check main.js"] });
+    const result = await runTask(task.task_id);
+
+    if (result.status !== "failed_scope_violation") {
+      throw new Error(`Expected failed_scope_violation, got: ${JSON.stringify(result)}`);
+    }
+    const structured = JSON.parse(readFileSync(join(task.path, "result.json"), "utf-8"));
+
+    // new_out_of_scope_changes must contain rename evidence (old or new path)
+    const hasRenameEvidence = structured.new_out_of_scope_changes?.some(
+      (f) => f.path.includes("external-renamed.txt") || f.path.includes("external-tracked.txt") || f.change === "renamed"
+    );
+    if (!hasRenameEvidence) {
+      throw new Error(`Missing rename evidence in new_out_of_scope_changes: ${JSON.stringify(structured.new_out_of_scope_changes)}`);
+    }
+
+    // verify_status must be failed
+    if (structured.verify_status !== "failed") {
+      throw new Error(`verify_status must be failed: ${structured.verify_status}`);
+    }
+
+    // get_task_summary acceptance_status must be failed
+    const summary = getTaskSummary(task.task_id);
+    if (summary.acceptance_status !== "failed") {
+      throw new Error(`acceptance_status must be failed: ${summary.acceptance_status}`);
+    }
+
+    // audit_task verdict must be fail
+    const audit = auditTask(task.task_id);
+    if (audit.verdict !== "fail") {
+      throw new Error(`audit verdict must be fail: ${audit.verdict}`);
+    }
+
+    // Restore config AFTER all assertions
+    process.env.PATCHWARDEN_CONFIG = oldConfig;
+    reloadConfig(oldConfig);
+
+    console.log(`    [result.json] status=${structured.status}, verify_status=${structured.verify_status}, new_out_of_scope=${JSON.stringify(structured.new_out_of_scope_changes)}, preexisting=${JSON.stringify(structured.preexisting_external_dirty_files)}, warnings=${JSON.stringify(structured.warnings)}`);
+  });
+
   await test("timeout terminates a long-running agent", async () => {
     const plan = savePlan({ title: "Timeout", content: "Wait." });
     const task = createTask({ plan_id: plan.plan_id, agent: "slow", repo_path: "repo", timeout_seconds: 1 });

package/scripts/mcp-manifest-check.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -21,12 +21,32 @@ const transportEnv = {
   ...process.env,
   PATCHWARDEN_TOOL_PROFILE: profile,
 };
-if (process.env.PATCHWARDEN_CONFIG) {
-  transportEnv.PATCHWARDEN_CONFIG = process.env.PATCHWARDEN_CONFIG;
-} else if (existsSync(defaultConfigPath)) {
-  transportEnv.PATCHWARDEN_CONFIG = defaultConfigPath;
-} else {
-  delete transportEnv.PATCHWARDEN_CONFIG;
+
+// When checking chatgpt_direct profile, ensure enableDirectProfile is true
+// by creating a temporary config if needed.
+let tempConfigPath = null;
+if (profile === "chatgpt_direct") {
+  const baseConfig = existsSync(defaultConfigPath)
+    ? JSON.parse(readFileSync(defaultConfigPath, "utf-8"))
+    : {};
+  if (!baseConfig.enableDirectProfile) {
+    const { mkdtempSync, writeFileSync, rmSync } = await import("node:fs");
+    const { tmpdir } = await import("node:os");
+    const { join } = await import("node:path");
+    tempConfigPath = join(mkdtempSync(join(tmpdir(), "pw-direct-")), "config.json");
+    writeFileSync(tempConfigPath, JSON.stringify({ ...baseConfig, enableDirectProfile: true }, null, 2), "utf-8");
+    transportEnv.PATCHWARDEN_CONFIG = tempConfigPath;
+  }
+}
+
+if (!transportEnv.PATCHWARDEN_CONFIG) {
+  if (process.env.PATCHWARDEN_CONFIG) {
+    transportEnv.PATCHWARDEN_CONFIG = process.env.PATCHWARDEN_CONFIG;
+  } else if (existsSync(defaultConfigPath)) {
+    transportEnv.PATCHWARDEN_CONFIG = defaultConfigPath;
+  } else {
+    delete transportEnv.PATCHWARDEN_CONFIG;
+  }
 }
 
 const transport = new StdioClientTransport({
@@ -159,4 +179,7 @@ try {
   process.exitCode = 1;
 } finally {
   await client.close().catch(() => {});
+  if (tempConfigPath) {
+    try { rmSync(tempConfigPath, { force: true }); } catch {}
+  }
 }

package/scripts/mcp-smoke.js

@@ -126,8 +126,10 @@ try {
     "read_workspace_file",
     "retry_task",
     "run_verification",
+    "safe_status",
     "save_plan",
     "search_workspace",
+    "sync_file",
     "wait_for_task",
   ];
   if (JSON.stringify(names) !== JSON.stringify(expected)) {
@@ -139,7 +141,7 @@ try {
   if (!tools._meta || typeof tools._meta.tool_manifest_sha256 !== "string" || tools._meta.tool_manifest_sha256.length !== 64) {
     throw new Error(`tools/list _meta missing manifest hash: ${JSON.stringify(tools._meta || null)}`);
   }
-  if (tools._meta.tool_profile !== "full" || tools._meta.tool_count !== 28) {
+  if (tools._meta.tool_profile !== "full" || tools._meta.tool_count !== 30) {
     throw new Error(`tools/list _meta profile/count mismatch: ${JSON.stringify(tools._meta)}`);
   }
   if (typeof tools._meta.schema_epoch !== "string" || typeof tools._meta.server_version !== "string") {
@@ -210,7 +212,7 @@ try {
     test_command: "npm test",
   });
   if (
-    task.server_version !== "0.6.0" ||
+    task.server_version !== "0.6.1" ||
     !/^[a-f0-9]{64}$/.test(task.tool_manifest_sha256 || "") ||
     task.next_tool_call?.name !== "wait_for_task" ||
     task.next_tool_call?.arguments?.timeout_seconds !== 25
@@ -389,7 +391,7 @@ try {
   await disabledClient.close();
   ok("chatgpt_direct disabled exposes only health_check with diagnostic");
 
-  // 2. chatgpt_direct enabled: 9 tools + minimal create_direct_session
+  // 2. chatgpt_direct enabled: 10 tools + minimal create_direct_session
   const enabledConfigPath = join(tempRoot, "direct-enabled.json");
   const directRepo = join(workspaceRoot, "direct-fixture");
   mkdirSync(join(directRepo, "src"), { recursive: true });
@@ -447,12 +449,13 @@ try {
     "read_workspace_file",
     "run_verification",
     "search_workspace",
+    "sync_file",
   ];
   if (JSON.stringify(enabledNames) !== JSON.stringify(expectedDirect)) {
     throw new Error(`chatgpt_direct enabled tools mismatch: ${enabledNames.join(", ")}`);
   }
-  if (enabledTools._meta.tool_count !== 9) {
-    throw new Error(`chatgpt_direct enabled tool_count should be 9, got ${enabledTools._meta.tool_count}`);
+  if (enabledTools._meta.tool_count !== 10) {
+    throw new Error(`chatgpt_direct enabled tool_count should be 10, got ${enabledTools._meta.tool_count}`);
   }
 
   // Minimal create_direct_session
@@ -472,12 +475,12 @@ try {
   if (enabledHealth.direct_profile_enabled !== true) {
     throw new Error(`direct_profile_enabled should be true, got ${enabledHealth.direct_profile_enabled}`);
   }
-  if (enabledHealth.direct_tool_count !== 9) {
-    throw new Error(`direct_tool_count should be 9, got ${enabledHealth.direct_tool_count}`);
+  if (enabledHealth.direct_tool_count !== 10) {
+    throw new Error(`direct_tool_count should be 10, got ${enabledHealth.direct_tool_count}`);
   }
 
   await enabledClient.close();
-  ok("chatgpt_direct enabled exposes 9 tools and create_direct_session works");
+  ok("chatgpt_direct enabled exposes 10 tools and create_direct_session works");
 } catch (error) {
   fail("MCP smoke test", error);
 } finally {

package/scripts/pack-clean.js

@@ -3,11 +3,14 @@ import {
   cpSync,
   existsSync,
   mkdirSync,
+  readFileSync,
   readdirSync,
   rmSync,
   statSync,
+  writeFileSync,
 } from "node:fs";
 import { execFileSync } from "node:child_process";
+import { deflateRawSync } from "node:zlib";
 import { join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -16,6 +19,10 @@ const root = resolve(scriptDir, "..");
 const releaseDir = resolve(root, "release");
 const archivePath = resolve(root, "patchwarden-release.tar.gz");
 
+// Read version from package.json for zip naming
+const pkg = JSON.parse(readFileSync(resolve(root, "package.json"), "utf-8"));
+const zipArchivePath = resolve(root, `PatchWarden-v${pkg.version}.zip`);
+
 const include = [
   "dist",
   "docs",
@@ -45,6 +52,119 @@ const forbidden = [
   /(^|[\\/])kill-patchwarden\.(cmd|ps1)$/i,
 ];
 
+// ── Minimal zip writer helpers (POSIX paths, DEFLATE via zlib) ────
+// Defined before main execution so const CRC_TABLE is initialized.
+
+const CRC_TABLE = new Uint32Array(256);
+for (let i = 0; i < 256; i++) {
+  let c = i;
+  for (let j = 0; j < 8; j++) {
+    c = (c & 1) ? (0xEDB88320 ^ (c >>> 1)) : (c >>> 1);
+  }
+  CRC_TABLE[i] = c;
+}
+
+function crc32(buf) {
+  let c = 0xFFFFFFFF;
+  for (let i = 0; i < buf.length; i++) {
+    c = CRC_TABLE[(c ^ buf[i]) & 0xFF] ^ (c >>> 8);
+  }
+  return (c ^ 0xFFFFFFFF) >>> 0;
+}
+
+function dosDateTime(date) {
+  const dosTime = (date.getHours() << 11) | (date.getMinutes() << 5) | (date.getSeconds() >> 1);
+  const dosDate = (((date.getFullYear() - 1980) & 0x7F) << 9) | ((date.getMonth() + 1) << 5) | date.getDate();
+  return { dosTime, dosDate };
+}
+
+function createZip(files, outputPath) {
+  const localParts = [];
+  const centralParts = [];
+  let offset = 0;
+  const now = new Date();
+  const { dosTime, dosDate } = dosDateTime(now);
+
+  for (const file of files) {
+    const posixPath = file.path.replace(/\\/g, "/");
+    const nameBuf = Buffer.from(posixPath, "utf-8");
+    const content = file.content;
+    const compressed = deflateRawSync(content);
+    const useDeflate = compressed.length < content.length;
+    const method = useDeflate ? 8 : 0;
+    const data = useDeflate ? compressed : content;
+    const crc = crc32(content);
+
+    const lh = Buffer.alloc(30);
+    lh.writeUInt32LE(0x04034b50, 0);
+    lh.writeUInt16LE(20, 4);
+    lh.writeUInt16LE(0, 6);
+    lh.writeUInt16LE(method, 8);
+    lh.writeUInt16LE(dosTime, 10);
+    lh.writeUInt16LE(dosDate, 12);
+    lh.writeUInt32LE(crc, 14);
+    lh.writeUInt32LE(data.length, 18);
+    lh.writeUInt32LE(content.length, 22);
+    lh.writeUInt16LE(nameBuf.length, 26);
+    lh.writeUInt16LE(0, 28);
+
+    const localHeaderOffset = offset;
+    localParts.push(Buffer.concat([lh, nameBuf, data]));
+    offset += lh.length + nameBuf.length + data.length;
+
+    const cd = Buffer.alloc(46);
+    cd.writeUInt32LE(0x02014b50, 0);
+    cd.writeUInt16LE(20, 4);
+    cd.writeUInt16LE(20, 6);
+    cd.writeUInt16LE(0, 8);
+    cd.writeUInt16LE(method, 10);
+    cd.writeUInt16LE(dosTime, 12);
+    cd.writeUInt16LE(dosDate, 14);
+    cd.writeUInt32LE(crc, 16);
+    cd.writeUInt32LE(data.length, 20);
+    cd.writeUInt32LE(content.length, 24);
+    cd.writeUInt16LE(nameBuf.length, 28);
+    cd.writeUInt16LE(0, 30);
+    cd.writeUInt16LE(0, 32);
+    cd.writeUInt16LE(0, 34);
+    cd.writeUInt16LE(0, 36);
+    cd.writeUInt32LE(0, 38);
+    cd.writeUInt32LE(localHeaderOffset, 42);
+    centralParts.push(Buffer.concat([cd, nameBuf]));
+  }
+
+  const centralDir = Buffer.concat(centralParts);
+  const centralDirOffset = offset;
+
+  const eocd = Buffer.alloc(22);
+  eocd.writeUInt32LE(0x06054b50, 0);
+  eocd.writeUInt16LE(0, 4);
+  eocd.writeUInt16LE(0, 6);
+  eocd.writeUInt16LE(files.length, 8);
+  eocd.writeUInt16LE(files.length, 10);
+  eocd.writeUInt32LE(centralDir.length, 12);
+  eocd.writeUInt32LE(centralDirOffset, 16);
+  eocd.writeUInt16LE(0, 20);
+
+  writeFileSync(outputPath, Buffer.concat([...localParts, centralDir, eocd]));
+}
+
+function readZipEntryNames(zipPath) {
+  const buf = readFileSync(zipPath);
+  const names = [];
+  for (let i = 0; i < buf.length - 4; i++) {
+    if (buf.readUInt32LE(i) === 0x02014b50) {
+      const nameLen = buf.readUInt16LE(i + 28);
+      const extraLen = buf.readUInt16LE(i + 30);
+      const commentLen = buf.readUInt16LE(i + 32);
+      const name = buf.toString("utf-8", i + 46, i + 46 + nameLen);
+      names.push(name);
+      i += 45 + nameLen + extraLen + commentLen;
+    }
+  }
+  return names;
+}
+
 console.log("[pack-clean] Preparing clean release directory...");
 rmSync(releaseDir, { recursive: true, force: true });
 rmSync(archivePath, { force: true });
@@ -115,7 +235,43 @@ if (badArchiveEntries.length > 0) {
 
 const sizeKb = (statSync(archivePath).size / 1024).toFixed(1);
 console.log(`[pack-clean] Release directory: ${releaseFiles.length} files`);
-console.log(`[pack-clean] Archive: ${archivePath} (${sizeKb} KB)`);
+console.log(`[pack-clean] tar.gz Archive: ${archivePath} (${sizeKb} KB)`);
+
+// ── Create zip archive with POSIX path separators ─────────────────
+console.log("[pack-clean] Creating zip archive with POSIX paths...");
+rmSync(zipArchivePath, { force: true });
+
+const zipFiles = releaseFiles.map((file) => {
+  const rel = toPosix(relative(releaseDir, file));
+  return { path: rel, content: readFileSync(file) };
+});
+
+createZip(zipFiles, zipArchivePath);
+
+// Verify zip entries use POSIX separators
+const zipEntryNames = readZipEntryNames(zipArchivePath);
+const badZipEntries = zipEntryNames.filter((name) => name.includes("\\"));
+if (badZipEntries.length > 0) {
+  console.error("[pack-clean] Backslash path separators found in zip entries:");
+  for (const name of badZipEntries.slice(0, 20)) {
+    console.error(`  ${name}`);
+  }
+  rmSync(zipArchivePath, { force: true });
+  process.exit(1);
+}
+
+const badZipForbidden = zipEntryNames.filter(isForbidden);
+if (badZipForbidden.length > 0) {
+  console.error("[pack-clean] Forbidden files in zip archive:");
+  for (const entry of badZipForbidden) {
+    console.error(`  ${entry}`);
+  }
+  rmSync(zipArchivePath, { force: true });
+  process.exit(1);
+}
+
+const zipSizeKb = (statSync(zipArchivePath).size / 1024).toFixed(1);
+console.log(`[pack-clean] zip Archive: ${zipArchivePath} (${zipSizeKb} KB, ${zipEntryNames.length} entries)`);
 console.log("[pack-clean] OK");
 
 function listFiles(dir) {