patchwarden 0.6.1 → 1.1.0

package/PatchWarden-Control-Tray.cmd

@@ -0,0 +1,11 @@
+@echo off
+setlocal
+cd /d "%~dp0"
+if /i "%~1"=="--foreground" (
+  powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0scripts\control\control-center-tray.ps1" %*
+  set EXITCODE=%ERRORLEVEL%
+  endlocal & exit /b %EXITCODE%
+)
+
+start "" powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "%~dp0scripts\control\control-center-tray.ps1" %*
+endlocal & exit /b 0

package/PatchWarden-Control.cmd

@@ -0,0 +1,6 @@
+@echo off
+setlocal
+cd /d "%~dp0"
+powershell -ExecutionPolicy Bypass -NoProfile -File "%~dp0scripts\control\start-control-center.ps1" %*
+set EXITCODE=%ERRORLEVEL%
+endlocal & exit /b %EXITCODE%

package/PatchWarden-Desktop.cmd

@@ -0,0 +1,5 @@
+@echo off
+setlocal
+cd /d "%~dp0"
+start "" powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "%~dp0scripts\control\control-center-tray.ps1" %*
+endlocal & exit /b 0

package/PatchWarden.cmd

@@ -20,7 +20,7 @@ set "HTTPS_PROXY=%PATCHWARDEN_PROXY_URL%"
 set "ALL_PROXY=%PATCHWARDEN_PROXY_URL%"
 set "NO_PROXY=localhost,127.0.0.1,::1"
 
-set "SCRIPTS_DIR=%~dp0scripts"
+set "SCRIPTS_DIR=%~dp0scripts\control"
 set "MANAGER=%SCRIPTS_DIR%\manage-patchwarden.ps1"
 
 if not exist "%MANAGER%" (

package/README.en.md

@@ -8,16 +8,18 @@
 [![Node.js](https://img.shields.io/badge/Node.js-%3E%3D18-339933.svg)](https://nodejs.org/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
-Current stable release: **v0.6.0**. See the
-[release notes](docs/release-v0.6.0.md),
-[migration guide](docs/migration-from-safe-bifrost.md), and
-[GitHub Release](https://github.com/jiezeng2004-design/PatchWarden/releases/tag/v0.6.0).
+Current source version: **v1.1.0**. See the
+[CHANGELOG](CHANGELOG.md), [migration guide](docs/migration-from-safe-bifrost.md), and
+[release checklist](docs/release-checklist.md). Verify GitHub Release / npm publication separately before release.
 
-PatchWarden is a security-focused MCP bridge for local coding agents.
-ChatGPT, Codex, OpenCode, or another MCP client can plan and review work;
+PatchWarden is a local-first MCP safety and verification layer for AI coding
+agents, with workspace confinement, command allowlists, scope-violation
+detection, and auditable task evidence.
+
+ChatGPT, Codex, OpenCode, or another MCP client can plan and review work.
 PatchWarden stores that plan as a workspace-scoped task, lets a preconfigured
-local agent execute it, and returns results, diffs, and independent
-verification evidence.
+local agent execute it, and returns results, diffs, artifact manifests, and
+independent verification evidence.
 
 ![PatchWarden ChatGPT connector demo](docs/assets/patchwarden-chatgpt-demo.svg)
 
@@ -30,6 +32,8 @@ verification evidence.
 ## Contents
 
 - [What PatchWarden solves](#what-patchwarden-solves)
+- [How PatchWarden differs](#how-patchwarden-differs)
+- [Evidence example](#evidence-example)
 - [Runtime architecture](#runtime-architecture)
 - [Requirements](#requirements)
 - [Five-minute quick start](#five-minute-quick-start)
@@ -77,6 +81,83 @@ PatchWarden is not designed for:
 - Managing an entire drive, home directory, or directory full of private data.
 - Unattended commits, pushes, releases, or production changes.
 
+## How PatchWarden differs
+
+PatchWarden sits between an MCP client and local coding tools. It is not a
+replacement for every adjacent layer:
+
+| Layer | Primary job | PatchWarden's role |
+| --- | --- | --- |
+| Sandbox | Isolate a process or filesystem at runtime. | Add task-level policy, evidence, verification, and review records around local agent work. |
+| Coding agent | Edit code and run local tools. | Launch only preconfigured agents with trusted argument templates and bounded repositories. |
+| Generic MCP server | Expose tools to an MCP client. | Expose a constrained task workflow instead of a broad shell or arbitrary filesystem access. |
+
+The first reusable capability to evaluate independently is:
+
+> Artifact manifest + verified completion evidence
+
+This capability is intentionally small: a task can finish with structured
+status, changed-file groups, release-artifact metadata, verification records,
+and scope-violation evidence in JSON. Other projects can inspect or adapt that
+evidence model without adopting PatchWarden's full runtime.
+
+## Evidence example
+
+A completed task writes bounded, reviewable artifacts under
+`.patchwarden/tasks/<task_id>/`. The high-signal files are:
+
+- `result.json` - final status, verification status, changed-file groups, and warnings.
+- `artifact_manifest.json` - generated artifacts with size, type, and SHA-256.
+- `verify.json` - exact verification commands and exit codes.
+- `diff.patch` - complete source diff when Git evidence is available.
+- `rollback_scope_violation_plan.md` - review plan when a task changes files outside `repo_path`.
+
+Example compact evidence:
+
+```json
+{
+  "task_id": "task_20260625_010513_ad59bb",
+  "status": "done",
+  "verify_status": "passed",
+  "changed_file_groups": {
+    "source_changes": 2,
+    "docs_changes": 1,
+    "config_changes": 0,
+    "test_changes": 1,
+    "release_artifacts": 1,
+    "runtime_generated_files": 0
+  },
+  "artifact_status": "collected",
+  "artifact_manifest": {
+    "artifacts": [
+      {
+        "path": "release/app.zip",
+        "type": "zip",
+        "size": 467725,
+        "sha256": "03731a12990718325d3cb9ecdc9dbc899fc840e8ef6e2de3e810577999b5f864"
+      }
+    ]
+  },
+  "new_out_of_scope_changes": []
+}
+```
+
+
+A scope violation remains explicit:
+
+```json
+{
+  "status": "failed_scope_violation",
+  "verify_status": "failed",
+  "new_out_of_scope_changes": [
+    {
+      "path": "external/external-renamed.txt",
+      "change": "modified"
+    }
+  ]
+}
+```
+
 ## Runtime architecture
 
 ```text
@@ -184,7 +265,7 @@ execution still requires a separate Watcher.
 New-Item -ItemType Directory .\patchwarden-runtime
 Set-Location .\patchwarden-runtime
 npm.cmd init -y
-npm.cmd install patchwarden@0.6.0
+npm.cmd install patchwarden@<published-version>
 Copy-Item .\node_modules\patchwarden\examples\config.example.json .\patchwarden.config.json
 $env:PATCHWARDEN_CONFIG = (Resolve-Path .\patchwarden.config.json)
 node .\node_modules\patchwarden\dist\runner\watch.js
@@ -193,10 +274,10 @@ node .\node_modules\patchwarden\dist\runner\watch.js
 An MCP client can launch:
 
 ```text
-npx.cmd -y patchwarden@0.6.0
+npx.cmd -y patchwarden@<published-version>
 ```
 
-Pin the version in important environments instead of using `latest`
+Replace `<published-version>` with a version that exists on npm/GitHub, and pin that version in important environments instead of using `latest`
 unconditionally.
 
 ## Complete configuration guide
@@ -249,7 +330,7 @@ Configuration fields:
 | `workspaceRoot` | Yes | The only workspace root PatchWarden may access. |
 | `plansDir` | Yes | Plan directory, normally `.patchwarden/plans`. |
 | `tasksDir` | Yes | Task and result directory, normally `.patchwarden/tasks`. |
-| `toolProfile` | No | `full` or `chatgpt_core`; use `full` for local clients. |
+| `toolProfile` | No | `full`, `chatgpt_core`, `chatgpt_direct`, or `chatgpt_search`; use `full` for local clients and `chatgpt_search` for compact discovery-driven clients. |
 | `agents` | Yes | Execution-agent allowlist; supports `{repo}` and `{prompt}` placeholders. |
 | `allowedTestCommands` | Yes | Exact allowlist for independent verification commands. |
 | `repoAllowedTestCommands` | No | Extra exact commands keyed by workspace-relative repository path; wildcards are unsupported. |
@@ -352,7 +433,7 @@ Pinned npm configuration:
 ```toml
 [mcp_servers.patchwarden]
 command = "npx.cmd"
-args = ["-y", "patchwarden@0.6.0"]
+args = ["-y", "patchwarden@<published-version>"]
 
 [mcp_servers.patchwarden.env]
 PATCHWARDEN_CONFIG = "D:\\path\\to\\patchwarden.config.json"
@@ -412,7 +493,7 @@ PatchWarden.cmd start core
 The launcher:
 
 - Builds `dist/index.js` if it is missing.
-- Verifies v0.6.0, the fixed 16-tool `chatgpt_core` catalog, and its schema
+- Verifies v1.1.0, the fixed 21-tool `chatgpt_core` catalog, and its schema
   manifest.
 - Reads or prompts for the Tunnel ID.
 - Reads or prompts for the runtime API key.
@@ -446,7 +527,7 @@ the expanded tunnel examples.
 
 ### Launcher default
 
-`scripts/start-patchwarden-tunnel.ps1` first reads `HTTPS_PROXY` from the
+`scripts/control/start-patchwarden-tunnel.ps1` first reads `HTTPS_PROXY` from the
 current process. If it is absent, the launcher defaults to:
 
 ```text
@@ -606,6 +687,7 @@ mean the task is wrong.
 | `result.md` | Human-readable execution report. |
 | `result.json` | Structured result, paths, changes, warnings, and next steps. |
 | `diff.patch` | Complete task change evidence. |
+| `artifact_manifest.json` | Generated artifact paths, types, sizes, and SHA-256 hashes. |
 | `file-stats.json` | Per-file addition and deletion statistics. |
 | `verify.json` | Structured record for every independent verification command. |
 | `verify.log` | Human-readable independent verification output. |
@@ -659,7 +741,7 @@ Optional token configuration:
 Set the token in the PowerShell process that starts the server:
 
 ```powershell
-$env:PATCHWARDEN_OWNER_TOKEN = "use-a-random-local-only-value"
+$env:PATCHWARDEN_OWNER_TOKEN = "<token>"
 ```
 
 Clients can send `Authorization: Bearer ...` or `x-patchwarden-token`. Never
@@ -695,8 +777,11 @@ available from PowerShell:
 .\PatchWarden.cmd restart all
 .\PatchWarden.cmd status all
 .\PatchWarden.cmd kill all
+.\Stop-PatchWarden.cmd
 ```
 
+For daily desktop use, start with `PatchWarden-Desktop.cmd`; it starts the tray and keeps Control Center available without opening extra browser windows. Use `PatchWarden-Control-Tray.cmd --foreground` only for tray debugging, `PatchWarden-Control.cmd` for the full local Web dashboard, and `Stop-PatchWarden.cmd` for one-click shutdown of Core/Direct, Control Center, and the tray.
+
 The old single-purpose launchers remain under `scripts/launchers/` as a
 compatibility layer. Personal launchers live under `.local/launchers/` and
 remain excluded from Git and release packages. `stop` and `restart` correlate
@@ -768,7 +853,7 @@ terminate unrelated PatchWarden, OpenCode, or Codex instances.
 | --- | --- | --- |
 | Tunnel connection keeps timing out | No proxy is listening on default port 7892 | Find the real HTTP/Mixed port, set `HTTPS_PROXY`, and start from the same terminal. |
 | Logs show 403 and `unsupported_country_region_territory` | Unsupported proxy exit region | Switch exit region and restart the tunnel. |
-| `list_workspace` only shows `tunnel-client.exe` | MCP started in the wrong directory or did not receive the config path | Use `scripts/patchwarden-mcp-stdio.cmd`. |
+| `list_workspace` only shows `tunnel-client.exe` | MCP started in the wrong directory or did not receive the config path | Use `scripts/mcp/patchwarden-mcp-stdio.cmd`. |
 | MCP is connected, but tasks do not run | Watcher is missing or stale | Start `npm.cmd run watch` and inspect `health_check`. |
 | `Agent command not found` | Agent is not on PATH, or Codex Desktop was mistaken for the CLI | Run `where.exe` and use the real CLI path in `agents.command`. |
 | Verification command is rejected | It does not exactly match the allowlist | Add the exact command to `allowedTestCommands`. |
@@ -845,13 +930,13 @@ names.
 
 ## MCP tools and profiles
 
-`chatgpt_core` is the fixed 16-tool profile used by the ChatGPT tunnel:
+`chatgpt_core` is the fixed 21-tool profile used by the ChatGPT tunnel:
 
 `health_check`, `list_agents`, `list_workspace`,
 `read_workspace_file`, `save_plan`, `create_task`,
 `wait_for_task`, `get_task_summary`, `get_diff`, `get_result`,
 `get_result_json`, `get_test_log`, `get_task_status`, `list_tasks`,
-`cancel_task`, and `audit_task`.
+`cancel_task`, `audit_task`, `safe_status`, `safe_result`, `safe_audit`, `safe_test_summary`, and `safe_diff_summary`.
 
 `get_task_summary` keeps the backward-compatible `standard` view by default.
 ChatGPT should request `view: "compact"` first; terminal `wait_for_task`
@@ -871,7 +956,7 @@ to `full`.
 
 ### ChatGPT Direct mode
 
-Direct mode exposes nine guarded tools so ChatGPT can create an editing
+Direct mode exposes thirteen guarded tools so ChatGPT can create an editing
 session, read and search source files, apply hash-bound JSON patches, run
 exactly allowlisted verification commands, finalize the evidence, and audit
 the result without a local execution agent.
@@ -895,7 +980,7 @@ On first use, provide the `tunnel-client.exe` path and a Tunnel ID dedicated
 to the Direct Connector. The launcher uses the `patchwarden-direct` profile,
 stores runtime state under `%LOCALAPPDATA%\patchwarden\runtime-direct`, skips
 the Watcher, and retains the existing DPAPI credential handling. In a fresh
-ChatGPT conversation, `health_check` should report `chatgpt_direct`, nine
+ChatGPT conversation, `health_check` should report `chatgpt_direct`, thirteen
 tools, and `direct_profile_enabled=true`.
 
 ## Security boundaries and local data
@@ -931,7 +1016,7 @@ Start with a dedicated test workspace and a repository you can recover.
 Upgrade a pinned npm installation:
 
 ```powershell
-npm.cmd install patchwarden@0.6.0
+npm.cmd install patchwarden@<published-version>
 ```
 
 Upgrade a source checkout:
@@ -997,6 +1082,8 @@ and release-asset checksums independently.
 
 ## Related documentation
 
+- [v0.6.4 release notes](docs/release-v0.6.4.md)
+- [v0.6.1 release notes](docs/release-v0.6.1.md)
 - [v0.6.0 release notes](docs/release-v0.6.0.md)
 - [ChatGPT usage guide](docs/chatgpt-usage.md)
 - [Migration guide](docs/migration-from-safe-bifrost.md)
@@ -1013,8 +1100,9 @@ and release-asset checksums independently.
 - [x] ChatGPT Connector / tunnel
 - [x] Doctor and runtime health checks
 - [x] Tool manifest and schema-drift detection
-- [ ] Worktree isolation
-- [ ] Multi-agent task queue
+- [x] Release Gate (five-stage pre-release verification)
+- [x] Worktree isolation
+- [x] Multi-agent routing
 - [ ] Local dashboard
 
 ## License

package/README.md

@@ -8,16 +8,19 @@
 [![Node.js](https://img.shields.io/badge/Node.js-%3E%3D18-339933.svg)](https://nodejs.org/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
-当前稳定版本：**v0.6.1**。查看
-[发布说明](docs/release-v0.6.1.md)、
-[迁移指南](docs/migration-from-safe-bifrost.md)和
-[GitHub Release](https://github.com/jiezeng2004-design/PatchWarden/releases/tag/v0.6.1)。
+当前源码版本：**v1.1.0**。查看
+[CHANGELOG](CHANGELOG.md)、[迁移指南](docs/migration-from-safe-bifrost.md)和
+[发布检查清单](docs/release-checklist.md)。GitHub Release / npm 发布状态需要在发布前单独核对。
 
 PatchWarden 是一个面向本地编程 Agent 的安全 MCP 桥接器。上游的
 ChatGPT、Codex、OpenCode 或其他 MCP 客户端负责规划与验收，
 PatchWarden 负责把计划保存成工作区内任务，再由预先配置的本地 Agent
 执行，并返回结果、代码差异和独立测试记录。
 
+统一英文定位：
+
+> PatchWarden is a local-first MCP safety and verification layer for AI coding agents, with workspace confinement, command allowlists, scope-violation detection, and auditable task evidence.
+
 ![PatchWarden ChatGPT connector demo](docs/assets/patchwarden-chatgpt-demo.svg)
 
 > [!IMPORTANT]
@@ -96,6 +99,7 @@ ChatGPT / Codex / OpenCode / 其他 MCP 客户端
        MCP 客户端读取、审计、人工验收
 ```
 
+
 一次完整运行通常包含三个角色：
 
 1. **MCP Server**：由 Codex、OpenCode 或 Tunnel 启动。
@@ -175,7 +179,7 @@ npm 包适合让 MCP 客户端通过固定版本启动 PatchWarden。为了执
 New-Item -ItemType Directory .\patchwarden-runtime
 Set-Location .\patchwarden-runtime
 npm.cmd init -y
-npm.cmd install patchwarden@0.6.0
+npm.cmd install patchwarden@<published-version>
 Copy-Item .\node_modules\patchwarden\examples\config.example.json .\patchwarden.config.json
 $env:PATCHWARDEN_CONFIG = (Resolve-Path .\patchwarden.config.json)
 node .\node_modules\patchwarden\dist\runner\watch.js
@@ -184,10 +188,10 @@ node .\node_modules\patchwarden\dist\runner\watch.js
 MCP 客户端可以使用：
 
 ```text
-npx.cmd -y patchwarden@0.6.0
+npx.cmd -y patchwarden@<published-version>
 ```
 
-建议固定版本号，不要在重要环境中无条件使用 `latest`。
+将 `<published-version>` 替换为已经在 npm/GitHub 上确认存在的版本；不要在重要环境中无条件使用 `latest`。
 
 ## 完整配置说明
 
@@ -239,7 +243,7 @@ Copy-Item .\examples\config.example.json .\patchwarden.config.json
 | `workspaceRoot` | 是 | PatchWarden 唯一允许访问的工作区根目录。 |
 | `plansDir` | 是 | 计划目录，通常使用 `.patchwarden/plans`。 |
 | `tasksDir` | 是 | 任务和结果目录，通常使用 `.patchwarden/tasks`。 |
-| `toolProfile` | 否 | `full` 或 `chatgpt_core`；本地客户端推荐 `full`。 |
+| `toolProfile` | 否 | `full`、`chatgpt_core`、`chatgpt_direct` 或 `chatgpt_search`；本地客户端推荐 `full`，动态工具发现场景使用 `chatgpt_search`。 |
 | `agents` | 是 | 可执行 Agent 白名单；支持 `{repo}` 和 `{prompt}` 占位符。 |
 | `allowedTestCommands` | 是 | 独立验证命令白名单，调用时必须精确匹配。 |
 | `repoAllowedTestCommands` | 否 | 按工作区相对仓库路径增加精确验证命令；不支持通配符。 |
@@ -337,7 +341,7 @@ npm.cmd run watch
 ```toml
 [mcp_servers.patchwarden]
 command = "npx.cmd"
-args = ["-y", "patchwarden@0.6.0"]
+args = ["-y", "patchwarden@<published-version>"]
 
 [mcp_servers.patchwarden.env]
 PATCHWARDEN_CONFIG = "D:\\path\\to\\patchwarden.config.json"
@@ -395,7 +399,7 @@ PatchWarden.cmd start core
 启动器会：
 
 - 检查 `dist/index.js`，缺失时自动构建。
-- 校验 `chatgpt_core` 的版本、16 个核心工具和 Schema Manifest。
+- 校验 `chatgpt_core` 的版本、21 个核心工具和 Schema Manifest。
 - 读取或提示输入 Tunnel ID。
 - 读取或提示输入运行时 API Key。
 - 使用 Windows DPAPI 保存凭据到 `%APPDATA%\patchwarden`。
@@ -426,7 +430,7 @@ ChatGPT Connector 创建时：
 
 ### 一键脚本的默认值
 
-`scripts/start-patchwarden-tunnel.ps1` 优先读取当前进程的
+`scripts/control/start-patchwarden-tunnel.ps1` 优先读取当前进程的
 `HTTPS_PROXY`。如果没有设置，它会默认使用：
 
 ```text
@@ -568,6 +572,7 @@ ChatGPT 任务应优先选择前三个守护模板：只读诊断使用 `inspect
 | `result.md` | 人类可读的执行报告。 |
 | `result.json` | 结构化结果、路径、变更、警告和后续建议。 |
 | `diff.patch` | 完整任务差异证据。 |
+| `artifact_manifest.json` | 构建或发布产物的路径、类型、大小与 SHA-256。 |
 | `file-stats.json` | 文件级增删统计。 |
 | `verify.json` | 每条独立验证命令的结构化记录。 |
 | `verify.log` | 独立验证的可读日志。 |
@@ -653,8 +658,11 @@ Direct 两种模式的启动、停止、重启与状态。也可以在 PowerShel
 .\PatchWarden.cmd restart all
 .\PatchWarden.cmd status all
 .\PatchWarden.cmd kill all
+.\Stop-PatchWarden.cmd
 ```
 
+日常桌面入口：`PatchWarden-Desktop.cmd` 启动托盘并确保 Control Center 可用，不自动打开额外浏览器窗口。只有调试托盘时才使用 `PatchWarden-Control-Tray.cmd --foreground`；需要完整 Web 控制台时打开 `PatchWarden-Control.cmd`；需要一键收尾时使用 `Stop-PatchWarden.cmd` 关闭 Core/Direct、Control Center 和托盘。
+
 旧的单用途入口保留在 `scripts/launchers/` 作为兼容层；个人入口位于
 `.local/launchers/`，并继续被 Git 和发布包排除。`stop` / `restart` 会同时检查
 运行状态、精确的 Tunnel Profile、项目启动器和进程树，因此可以清理同一 Profile
@@ -726,13 +734,13 @@ Core Agent 和 Direct 可以**同时运行**，使用不同的 `tunnel-client` p
 **Core 启动示例：**
 
 ```cmd
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%CD%\scripts\start-patchwarden-tunnel.ps1" -ToolProfile chatgpt_core -Profile patchwarden -HealthListenAddr 127.0.0.1:8080
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%CD%\scripts\control\start-patchwarden-tunnel.ps1" -ToolProfile chatgpt_core -Profile patchwarden -HealthListenAddr 127.0.0.1:8080
 ```
 
 **Direct 启动示例：**
 
 ```cmd
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%CD%\scripts\start-patchwarden-tunnel.ps1" -ToolProfile chatgpt_direct -Profile patchwarden-direct -HealthListenAddr 127.0.0.1:8081 -SkipWatcher
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%CD%\scripts\control\start-patchwarden-tunnel.ps1" -ToolProfile chatgpt_direct -Profile patchwarden-direct -HealthListenAddr 127.0.0.1:8081 -SkipWatcher
 ```
 
 如果使用 `.local\launchers\` 下的个人启动器，也需要同步追加对应
@@ -751,7 +759,7 @@ powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%CD%\scripts\start-patc
 | --- | --- | --- |
 | Tunnel 一直连接超时 | 默认 7892 没有代理服务 | 确认实际 HTTP/Mixed 端口，设置 `HTTPS_PROXY` 后从同一窗口启动。 |
 | 日志出现 403 和 `unsupported_country_region_territory` | 代理出口区域不受支持 | 切换出口区域，再重启 Tunnel。 |
-| `list_workspace` 只看到 `tunnel-client.exe` | MCP 从错误目录启动或没收到配置路径 | 使用 `scripts/patchwarden-mcp-stdio.cmd`。 |
+| `list_workspace` 只看到 `tunnel-client.exe` | MCP 从错误目录启动或没收到配置路径 | 使用 `scripts/mcp/patchwarden-mcp-stdio.cmd`。 |
 | MCP 显示 connected，但任务不执行 | Watcher 没启动或心跳过期 | 启动 `npm.cmd run watch`，再看 `health_check`。 |
 | `Agent command not found` | Agent 不在 PATH，或 Codex Desktop 被误当成 CLI | 运行 `where.exe`，必要时在 `agents.command` 写真实 CLI 路径。 |
 | 验证命令被拒绝 | 与白名单不是逐字一致 | 把确切命令加入 `allowedTestCommands`，不要扩大成任意 Shell。 |
@@ -828,19 +836,19 @@ PatchWarden v0.4.0 不自动读取旧 CLI、旧环境变量、旧 Header、旧
 
 ## MCP 工具与 Profile
 
-`chatgpt_core` 是固定的 16 工具 Profile，适合 ChatGPT Tunnel：
+`chatgpt_core` 是固定的 21 工具 Profile，适合 ChatGPT Tunnel：
 
 `health_check`、`list_agents`、`list_workspace`、
 `read_workspace_file`、`save_plan`、`create_task`、
 `wait_for_task`、`get_task_summary`、`get_diff`、`get_result`、
 `get_result_json`、`get_test_log`、`get_task_status`、`list_tasks`、
-`cancel_task`、`audit_task`。
+`cancel_task`、`audit_task`、`safe_status`、`safe_result`、`safe_audit`、`safe_test_summary`、`safe_diff_summary`。
 
 `get_task_summary` 默认保留兼容的 `standard` 视图；ChatGPT 应优先使用
 `view: "compact"`，终态 `wait_for_task` 也只内嵌 compact 验收证据。
 
-`full` 在 `chatgpt_core` 基础上额外提供 6 个管理工具，合计 22 个核心
-工具；启用 Direct 后再追加 6 个 Direct 工具，共 28 个工具（22 + 6）：
+`full` 提供完整 54 工具本地开发目录，包含核心工具、管理工具和 Direct
+工具。除 `chatgpt_core` 外，常用额外管理工具包括：
 
 - `get_plan`
 - `kill_task`
@@ -849,15 +857,15 @@ PatchWarden v0.4.0 不自动读取旧 CLI、旧环境变量、旧 Header、旧
 - `get_task_stdout_tail`
 - `get_task_log_tail`
 
-`chatgpt_direct` 是 v0.6.0 新增的 Direct 直接开发 Profile，包含 9 个工具：
+`chatgpt_direct` 是 v0.6.0 新增的 Direct 直接开发 Profile，v1.1 包含 13 个工具：
 
 `health_check`、`list_workspace`、`create_direct_session`、
 `search_workspace`、`read_workspace_file`、`apply_patch`、
-`run_verification`、`finalize_direct_session`、`audit_session`。
+`run_verification`、`finalize_direct_session`、`audit_session`、`safe_direct_summary`、`safe_finalize_direct_session`、`safe_audit_direct_session`、`sync_file`。
 
 `chatgpt_direct` 默认关闭，需要通过 `enableDirectProfile: true` 或
 `PATCHWARDEN_TOOL_PROFILE=chatgpt_direct` 显式启用。`chatgpt_core` 保持
-16 工具不变。
+21 工具清单。
 
 Tunnel 包装脚本会强制使用 `chatgpt_core`；普通本地开发默认使用 `full`。
 
@@ -912,7 +920,7 @@ Tunnel ID。启动器使用 `patchwarden-direct` Profile、独立的
 Tunnel API Key 仍通过现有 Windows DPAPI 缓存处理，不会写入仓库。
 
 连接 ChatGPT 后新建对话并先调用 `health_check`。预期
-`tool_profile=chatgpt_direct`、`tool_count=9`、
+`tool_profile=chatgpt_direct`、`tool_count=13`、
 `direct_profile_enabled=true`。已有对话可能缓存旧工具清单，需要重新连接
 Connector 后再新建对话。
 
@@ -975,7 +983,7 @@ PatchWarden 能降低误操作风险，但不能替代人工审查。第一次
 升级 npm 固定版本：
 
 ```powershell
-npm.cmd install patchwarden@0.6.0
+npm.cmd install patchwarden@<published-version>
 ```
 
 源码升级：
@@ -1040,6 +1048,8 @@ Release 和发布资产校验值。
 
 ## 相关文档
 
+- [v0.6.4 发布说明](docs/release-v0.6.4.md)
+- [v0.6.1 发布说明](docs/release-v0.6.1.md)
 - [v0.6.0 发布说明](docs/release-v0.6.0.md)
 - [ChatGPT 调用规范](docs/chatgpt-usage.md)
 - [旧版本迁移指南](docs/migration-from-safe-bifrost.md)
@@ -1056,8 +1066,9 @@ Release 和发布资产校验值。
 - [x] ChatGPT Connector / Tunnel
 - [x] Doctor 与运行时健康检查
 - [x] Tool Manifest 与 Schema 漂移检测
-- [ ] Worktree 隔离
-- [ ] 多 Agent 任务队列
+- [x] Release Gate（发布前五阶段校验）
+- [x] Worktree 隔离
+- [x] 多 Agent 路由
 - [ ] 本地 Dashboard
 
 ## License

package/Restart-PatchWarden-Control.cmd

@@ -0,0 +1,6 @@
+@echo off
+setlocal
+cd /d "%~dp0"
+powershell -ExecutionPolicy Bypass -NoProfile -File "%~dp0scripts\control\restart-control-center.ps1" %*
+set EXITCODE=%ERRORLEVEL%
+endlocal & exit /b %EXITCODE%

package/Stop-PatchWarden.cmd

@@ -0,0 +1,11 @@
+@echo off
+setlocal
+cd /d "%~dp0"
+powershell -ExecutionPolicy Bypass -NoProfile -File "%~dp0scripts\control\stop-patchwarden.ps1" %*
+set EXITCODE=%ERRORLEVEL%
+if not "%EXITCODE%"=="0" (
+  echo.
+  echo PatchWarden stop exited with code %EXITCODE%.
+  pause
+)
+endlocal & exit /b %EXITCODE%

package/dist/agents/agentRouter.d.ts

@@ -0,0 +1,40 @@
+export interface AgentRouteInput {
+    goal?: string;
+    scope?: string[];
+    inline_plan?: string;
+    template?: string;
+    configuredAgents: string[];
+}
+export interface AgentRouteResult {
+    recommended_agent: string;
+    reason: string;
+    fallback: boolean;
+}
+export declare const AGENT_ROUTING_RULES: {
+    /** 大规模代码修改 → opencode */
+    readonly largeScope: {
+        readonly agent: "opencode";
+        readonly threshold: 10;
+    };
+    /** 单文件修改 → patchwarden-direct */
+    readonly singleFile: {
+        readonly agent: "patchwarden-direct";
+    };
+    /** 验收审计 → patchwarden-audit */
+    readonly audit: {
+        readonly agent: "patchwarden-audit";
+        readonly keywords: readonly ["审计", "audit", "验收", "verify"];
+    };
+    /** 复杂推理和重构 → codex */
+    readonly refactor: {
+        readonly agent: "codex";
+        readonly keywords: readonly ["重构", "refactor", "跨模块", "redesign"];
+    };
+    /** 文档整理 → claude（fallback 到 opencode） */
+    readonly documentation: {
+        readonly agent: "claude";
+        readonly fallbackAgent: "opencode";
+        readonly keywords: readonly ["文档", "readme", "changelog", "doc"];
+    };
+};
+export declare function routeAgent(input: AgentRouteInput): AgentRouteResult;