patchwarden 0.6.1 → 1.1.0

package/scripts/{control-smoke.js → checks/control-smoke.js}

@@ -11,8 +11,8 @@ if (process.platform !== "win32") {
 }
 
 const scriptDir = resolve(fileURLToPath(new URL(".", import.meta.url)));
-const root = resolve(scriptDir, "..");
-const manager = join(scriptDir, "manage-patchwarden.ps1");
+const root = resolve(scriptDir, "..", "..");
+const manager = join(root, "scripts", "control", "manage-patchwarden.ps1");
 const temp = mkdtempSync(join(tmpdir(), "patchwarden-control-smoke-"));
 const mockConfig = join(temp, "patchwarden.config.json");
 writeFileSync(mockConfig, JSON.stringify({
@@ -76,7 +76,7 @@ try {
     ready: false,
     pid: null,
     tool_profile: "chatgpt_direct",
-    tool_count: 9,
+    tool_count: 13,
     tools_ready: true,
   }), "utf8");
   writeFileSync(join(directRuntime, "tunnel-client.pid"), String(fakeTunnel.pid), "utf8");
@@ -114,7 +114,7 @@ try {
     reason_code: "stale_fixture",
     last_error: "stale failure",
     tool_profile: "chatgpt_core",
-    tool_count: 16,
+    tool_count: 21,
     tools_ready: true,
   }), "utf8");
   healthServer = spawn(
@@ -139,7 +139,13 @@ try {
 
   const expectedFiles = [
     "PatchWarden.cmd",
-    "scripts/manage-patchwarden.ps1",
+    "PatchWarden-Control.cmd",
+    "PatchWarden-Control-Tray.cmd",
+    "PatchWarden-Desktop.cmd",
+    "Restart-PatchWarden-Control.cmd",
+    "Stop-PatchWarden.cmd",
+    "scripts/control/manage-patchwarden.ps1",
+    "scripts/control/stop-patchwarden.ps1",
     "scripts/launchers/Start-PatchWarden-Tunnel.cmd",
     "scripts/launchers/Start-PatchWarden-Direct-Tunnel.cmd",
   ];
@@ -152,6 +158,14 @@ try {
   if (!rootEntry.includes("manage-patchwarden.ps1")) {
     throw new Error("PatchWarden.cmd does not invoke the consolidated manager");
   }
+  const stopEntry = readFileSync(join(root, "Stop-PatchWarden.cmd"), "utf8");
+  if (!stopEntry.includes("scripts\\control\\stop-patchwarden.ps1")) {
+    throw new Error("Stop-PatchWarden.cmd does not invoke the one-click shutdown script");
+  }
+  const desktopEntry = readFileSync(join(root, "PatchWarden-Desktop.cmd"), "utf8");
+  if (!desktopEntry.includes("control-center-tray.ps1") || !desktopEntry.includes("WindowStyle Hidden")) {
+    throw new Error("PatchWarden-Desktop.cmd must launch the tray hidden as the daily desktop entry");
+  }
   console.log("ok - control handles orphan cleanup, scoped kill, port conflicts, health fallback, and Core/Direct lifecycle actions");
 } finally {
   if (fakeTunnel?.exitCode === null) fakeTunnel.kill();

package/scripts/{doctor-smoke.js → checks/doctor-smoke.js}

@@ -5,7 +5,7 @@ import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
-const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+const root = resolve(fileURLToPath(new URL("../..", import.meta.url)));
 const tempRoot = mkdtempSync(join(tmpdir(), "patchwarden-doctor-"));
 const workspaceRoot = join(tempRoot, "workspace");
 const configPath = join(tempRoot, "patchwarden.config.json");
@@ -42,6 +42,7 @@ try {
     "[OK]   Task directory writable",
     "[OK]   Example task directory read/write",
     "[OK]   allowedTestCommands is non-empty",
+    "[OK]   Release gate module loadable",
   ];
   for (const line of requiredLines) {
     if (!result.stdout.includes(line)) throw new Error(`doctor output missing stable line: ${line}`);

package/scripts/{http-mcp-smoke.js → checks/http-mcp-smoke.js}

@@ -11,10 +11,10 @@ import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { setTimeout as sleep } from "node:timers/promises";
-import { CHATGPT_CORE_TOOL_NAMES } from "../dist/tools/toolCatalog.js";
+import { CHATGPT_CORE_TOOL_NAMES } from "../../dist/tools/toolCatalog.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
-const root = resolve(__dirname, "..");
+const root = resolve(__dirname, "..", "..");
 const serverPath = resolve(root, "dist", "httpServer.js");
 
 const host = "127.0.0.1";

package/scripts/{lifecycle-smoke.js → checks/lifecycle-smoke.js}

@@ -12,6 +12,10 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 
+// v0.7.2: tasks complete with "done_by_agent" (pending acceptance) instead of "done".
+// Both are valid successful completion statuses for lifecycle smoke tests.
+const isDoneStatus = (s) => s === "done" || s === "done_by_agent";
+
 const tempRoot = mkdtempSync(join(tmpdir(), "patchwarden-lifecycle-"));
 const workspaceRoot = join(tempRoot, "workspace");
 const repoPath = join(workspaceRoot, "repo");
@@ -148,18 +152,18 @@ try {
   );
   process.env.PATCHWARDEN_CONFIG = configPath;
 
-  const { savePlan } = await import("../dist/tools/savePlan.js");
-  const { createTask } = await import("../dist/tools/createTask.js");
-  const { getTaskStatus } = await import("../dist/tools/getTaskStatus.js");
-  const { cancelTask } = await import("../dist/tools/cancelTask.js");
-  const { killTask } = await import("../dist/tools/killTask.js");
-  const { getDiff } = await import("../dist/tools/taskOutputs.js");
-  const { listAgents } = await import("../dist/tools/listAgents.js");
-  const { getTaskSummary } = await import("../dist/tools/getTaskSummary.js");
-  const { auditTask } = await import("../dist/tools/auditTask.js");
-  const { waitForTask } = await import("../dist/tools/waitForTask.js");
-  const { runTask } = await import("../dist/runner/runTask.js");
-  const { reloadConfig } = await import("../dist/config.js");
+  const { savePlan } = await import("../../dist/tools/savePlan.js");
+  const { createTask } = await import("../../dist/tools/createTask.js");
+  const { getTaskStatus } = await import("../../dist/tools/getTaskStatus.js");
+  const { cancelTask } = await import("../../dist/tools/cancelTask.js");
+  const { killTask } = await import("../../dist/tools/killTask.js");
+  const { getDiff } = await import("../../dist/tools/taskOutputs.js");
+  const { listAgents } = await import("../../dist/tools/listAgents.js");
+  const { getTaskSummary } = await import("../../dist/tools/getTaskSummary.js");
+  const { auditTask } = await import("../../dist/tools/auditTask.js");
+  const { waitForTask } = await import("../../dist/tools/waitForTask.js");
+  const { runTask } = await import("../../dist/runner/runTask.js");
+  const { reloadConfig } = await import("../../dist/config.js");
 
   await test("list_agents reports configured executables", async () => {
     const result = listAgents();
@@ -178,7 +182,7 @@ try {
       verify_commands: ["node --check main.js", "node --check second.js"],
     });
     const result = await runTask(task.task_id);
-    if (result.status !== "done") throw new Error(`Writer task ended ${result.status}: ${result.error}`);
+    if (!isDoneStatus(result.status)) throw new Error(`Writer task ended ${result.status}: ${result.error}`);
     const status = getTaskStatus(task.task_id);
     const changed = status.changed_files || [];
     if (!changed.some((file) => file.path === "README.md" && file.change === "modified")) {
@@ -253,7 +257,7 @@ try {
     });
     const result = await runTask(task.task_id);
     const verify = JSON.parse(readFileSync(join(task.path, "verify.json"), "utf-8"));
-    if (result.status !== "done" || verify.status !== "passed" || verify.commands.length !== 1) {
+    if (!isDoneStatus(result.status) || verify.status !== "passed" || verify.commands.length !== 1) {
       throw new Error(`Legacy verification mismatch: ${JSON.stringify({ result, verify })}`);
     }
     if (verify.commands[0].cwd !== repoPath || !("stdout_tail" in verify.commands[0]) || !("stderr_tail" in verify.commands[0])) {
@@ -265,7 +269,7 @@ try {
     const plan = savePlan({ title: "No diff", content: "Do not change files." });
     const task = createTask({ plan_id: plan.plan_id, agent: "noop", repo_path: "repo" });
     const result = await runTask(task.task_id);
-    if (result.status !== "done") throw new Error(`No-op task failed: ${JSON.stringify(result)}`);
+    if (!isDoneStatus(result.status)) throw new Error(`No-op task failed: ${JSON.stringify(result)}`);
     const diff = getDiff(task.task_id);
     const verify = JSON.parse(readFileSync(join(task.path, "verify.json"), "utf-8"));
     if (verify.status !== "skipped") throw new Error(`Expected skipped verification: ${JSON.stringify(verify)}`);
@@ -286,7 +290,7 @@ try {
     const plan = savePlan({ title: "Large diff", content: "Create a large text file." });
     const task = createTask({ plan_id: plan.plan_id, agent: "largewriter", repo_path: "repo" });
     const result = await runTask(task.task_id);
-    if (result.status !== "done") throw new Error(`Large task failed: ${JSON.stringify(result)}`);
+    if (!isDoneStatus(result.status)) throw new Error(`Large task failed: ${JSON.stringify(result)}`);
     const diff = getDiff(task.task_id);
     const patchSize = readFileSync(join(task.path, "diff.patch"), "utf-8").length;
     if (!diff.truncated || !diff.patch_head || !diff.diff_patch_path || patchSize <= diff.content.length) {
@@ -298,7 +302,7 @@ try {
     const plan = savePlan({ title: "Non-Git evidence", content: "Modify files in a non-Git repository." });
     const task = createTask({ plan_id: plan.plan_id, agent: "writer", repo_path: "plain-repo" });
     const result = await runTask(task.task_id);
-    if (result.status !== "done") throw new Error(`Non-Git task failed: ${JSON.stringify(result)}`);
+    if (!isDoneStatus(result.status)) throw new Error(`Non-Git task failed: ${JSON.stringify(result)}`);
     const diff = getDiff(task.task_id);
     if (
       diff.patch_mode !== "hash_only" ||
@@ -313,7 +317,7 @@ try {
     const plan = savePlan({ title: "Binary evidence", content: "Create a binary fixture." });
     const task = createTask({ plan_id: plan.plan_id, agent: "binarywriter", repo_path: "repo" });
     const result = await runTask(task.task_id);
-    if (result.status !== "done") throw new Error(`Binary task failed: ${JSON.stringify(result)}`);
+    if (!isDoneStatus(result.status)) throw new Error(`Binary task failed: ${JSON.stringify(result)}`);
     const diff = getDiff(task.task_id);
     if (diff.patch_mode !== "textual" || !diff.content.includes("GIT binary patch")) {
       throw new Error(`Binary patch evidence mismatch: ${JSON.stringify(diff)}`);
@@ -324,7 +328,7 @@ try {
     const plan = savePlan({ title: "Artifact hygiene", content: "Generate representative task outputs." });
     const task = createTask({ plan_id: plan.plan_id, agent: "artifactwriter", repo_path: "repo" });
     const result = await runTask(task.task_id);
-    if (result.status !== "done") throw new Error(`Artifact task failed: ${JSON.stringify(result)}`);
+    if (!isDoneStatus(result.status)) throw new Error(`Artifact task failed: ${JSON.stringify(result)}`);
     const standard = getTaskSummary(task.task_id);
     const compact = getTaskSummary(task.task_id, { view: "compact", max_items: 1 });
     const counts = standard.artifact_hygiene?.counts || {};
@@ -353,7 +357,7 @@ try {
     const plan = savePlan({ title: "Delete fixture", content: "Delete the designated fixture file." });
     const task = createTask({ plan_id: plan.plan_id, agent: "deleter", repo_path: "repo" });
     const result = await runTask(task.task_id);
-    if (result.status !== "done") throw new Error(`Delete task failed: ${JSON.stringify(result)}`);
+    if (!isDoneStatus(result.status)) throw new Error(`Delete task failed: ${JSON.stringify(result)}`);
     const diff = getDiff(task.task_id);
     if (!diff.file_stats?.some((file) => file.path === "delete-me.txt" && file.status === "deleted")) {
       throw new Error(`Deleted file stats missing: ${JSON.stringify(diff.file_stats)}`);
@@ -504,7 +508,7 @@ try {
     const task = createTask({ plan_id: plan.plan_id, agent: "noop", repo_path: "repo", verify_commands: ["node --check main.js"] });
     const result = await runTask(task.task_id);
 
-    if (result.status !== "done") {
+    if (!isDoneStatus(result.status)) {
       throw new Error(`Expected done, got: ${JSON.stringify(result)}`);
     }
     const structured = JSON.parse(readFileSync(join(task.path, "result.json"), "utf-8"));

package/scripts/{mcp-manifest-check.js → checks/mcp-manifest-check.js}

@@ -4,18 +4,20 @@ import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES } from "../dist/tools/toolCatalog.js";
+import { CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, CHATGPT_SEARCH_TOOL_NAMES } from "../../dist/tools/toolCatalog.js";
 
-const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+const root = resolve(fileURLToPath(new URL("../..", import.meta.url)));
 const jsonOnly = process.argv.includes("--json");
 const profileIndex = process.argv.indexOf("--profile");
 const profile = profileIndex >= 0 ? process.argv[profileIndex + 1] : "chatgpt_core";
-if (profile !== "chatgpt_core" && profile !== "chatgpt_direct") {
+if (profile !== "chatgpt_core" && profile !== "chatgpt_direct" && profile !== "chatgpt_search") {
   throw new Error(`Unsupported manifest profile "${profile}".`);
 }
 const expectedTools = profile === "chatgpt_direct"
   ? [...CHATGPT_DIRECT_TOOL_NAMES]
-  : [...CHATGPT_CORE_TOOL_NAMES];
+  : profile === "chatgpt_search"
+    ? [...CHATGPT_SEARCH_TOOL_NAMES]
+    : [...CHATGPT_CORE_TOOL_NAMES];
 const defaultConfigPath = resolve(root, "patchwarden.config.json");
 const transportEnv = {
   ...process.env,
@@ -102,13 +104,31 @@ try {
     if (!summaryProperties.includes("view") || !summaryProperties.includes("max_items")) {
       throw new Error("get_task_summary schema must expose view and max_items");
     }
-  } else {
+    const safeRequirements = {
+      safe_result: ["task_id"],
+      safe_audit: ["task_id"],
+      safe_test_summary: ["task_id"],
+      safe_diff_summary: ["task_id"],
+    };
+    for (const [toolName, requiredProperties] of Object.entries(safeRequirements)) {
+      const tool = listed.tools.find((entry) => entry.name === toolName);
+      const properties = Object.keys(tool?.inputSchema?.properties || {});
+      for (const property of requiredProperties) {
+        if (!properties.includes(property)) {
+          throw new Error(`${toolName} schema is missing ${property}`);
+        }
+      }
+    }
+  } else if (profile === "chatgpt_direct") {
     const directRequirements = {
       create_direct_session: ["repo_path"],
       apply_patch: ["session_id", "path", "expected_sha256", "operations"],
       run_verification: ["session_id", "command"],
       finalize_direct_session: ["session_id"],
       audit_session: ["session_id"],
+      safe_direct_summary: ["session_id"],
+      safe_finalize_direct_session: ["session_id"],
+      safe_audit_direct_session: ["session_id"],
     };
     for (const [toolName, requiredProperties] of Object.entries(directRequirements)) {
       const tool = listed.tools.find((entry) => entry.name === toolName);
@@ -119,6 +139,21 @@ try {
         }
       }
     }
+  } else {
+    const searchRequirements = {
+      discover_tools: ["query"],
+      explain_tool: ["name"],
+      invoke_discovered_tool: ["toolName", "arguments", "discoveryToken"],
+    };
+    for (const [toolName, requiredProperties] of Object.entries(searchRequirements)) {
+      const tool = listed.tools.find((entry) => entry.name === toolName);
+      const properties = Object.keys(tool?.inputSchema?.properties || {});
+      for (const property of requiredProperties) {
+        if (!properties.includes(property)) {
+          throw new Error(`${toolName} schema is missing ${property}`);
+        }
+      }
+    }
   }
   const healthResult = await client.callTool({ name: "health_check", arguments: {} });
   if (healthResult.isError) throw new Error(String(healthResult.content?.[0]?.text || "health_check failed"));
@@ -127,7 +162,8 @@ try {
     health.tool_profile !== profile ||
     health.tool_count !== expectedTools.length ||
     !health.tool_manifest_sha256 ||
-    (profile === "chatgpt_direct" && health.direct_profile_enabled !== true)
+    (profile === "chatgpt_direct" && health.direct_profile_enabled !== true) ||
+    (profile === "chatgpt_search" && health.search_tool_count !== expectedTools.length)
   ) {
     throw new Error(`health_check catalog mismatch: ${JSON.stringify(health)}`);
   }
@@ -164,12 +200,23 @@ try {
       health_check: ["detail"],
       list_tasks: ["repo_path", "active_only"],
       get_task_summary: ["view", "max_items"],
-    } : {
+      safe_result: ["task_id"],
+      safe_audit: ["task_id"],
+      safe_test_summary: ["task_id"],
+      safe_diff_summary: ["task_id"],
+    } : profile === "chatgpt_direct" ? {
       create_direct_session: ["repo_path"],
       apply_patch: ["session_id", "path", "expected_sha256", "operations"],
       run_verification: ["session_id", "command"],
       finalize_direct_session: ["session_id"],
       audit_session: ["session_id"],
+      safe_direct_summary: ["session_id"],
+      safe_finalize_direct_session: ["session_id"],
+      safe_audit_direct_session: ["session_id"],
+    } : {
+      discover_tools: ["query"],
+      explain_tool: ["name"],
+      invoke_discovered_tool: ["toolName", "arguments", "discoveryToken"],
     },
   };
   console.log(jsonOnly ? JSON.stringify(output) : JSON.stringify(output, null, 2));

package/scripts/{mcp-smoke.js → checks/mcp-smoke.js}

@@ -14,7 +14,9 @@ import { fileURLToPath } from "node:url";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 
-const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+const root = resolve(fileURLToPath(new URL("../..", import.meta.url)));
+const packageJson = JSON.parse(readFileSync(join(root, "package.json"), "utf-8"));
+const expectedServerVersion = packageJson.version;
 const tempRoot = mkdtempSync(join(tmpdir(), "patchwarden-mcp-"));
 const workspaceRoot = join(tempRoot, "workspace");
 const configPath = join(tempRoot, "patchwarden.config.json");
@@ -101,12 +103,21 @@ try {
   const tools = await client.listTools();
   const names = tools.tools.map((tool) => tool.name).sort();
   const expected = [
+    "accept_subgoal",
     "apply_patch",
     "audit_session",
     "audit_task",
     "cancel_task",
+    "check_release_gate",
     "create_direct_session",
+    "create_goal",
+    "create_subgoal_task",
     "create_task",
+    "diagnose_task",
+    "discard_worktree",
+    "discover_tools",
+    "explain_tool",
+    "export_handoff",
     "finalize_direct_session",
     "get_diff",
     "get_plan",
@@ -119,16 +130,31 @@ try {
     "get_task_summary",
     "get_test_log",
     "health_check",
+    "invoke_discovered_tool",
     "kill_task",
     "list_agents",
+    "list_goals",
     "list_tasks",
     "list_workspace",
+    "merge_worktree",
+    "read_goal",
     "read_workspace_file",
+    "reconcile_tasks",
+    "reject_subgoal",
     "retry_task",
     "run_verification",
+    "safe_audit",
+    "safe_audit_direct_session",
+    "safe_diff_summary",
+    "safe_direct_summary",
+    "safe_finalize_direct_session",
+    "safe_result",
     "safe_status",
+    "safe_test_summary",
     "save_plan",
     "search_workspace",
+    "suggest_next_subgoal",
+    "summarize_goal_progress",
     "sync_file",
     "wait_for_task",
   ];
@@ -141,7 +167,7 @@ try {
   if (!tools._meta || typeof tools._meta.tool_manifest_sha256 !== "string" || tools._meta.tool_manifest_sha256.length !== 64) {
     throw new Error(`tools/list _meta missing manifest hash: ${JSON.stringify(tools._meta || null)}`);
   }
-  if (tools._meta.tool_profile !== "full" || tools._meta.tool_count !== 30) {
+  if (tools._meta.tool_profile !== "full" || tools._meta.tool_count !== 54) {
     throw new Error(`tools/list _meta profile/count mismatch: ${JSON.stringify(tools._meta)}`);
   }
   if (typeof tools._meta.schema_epoch !== "string" || typeof tools._meta.server_version !== "string") {
@@ -212,7 +238,7 @@ try {
     test_command: "npm test",
   });
   if (
-    task.server_version !== "0.6.1" ||
+    task.server_version !== expectedServerVersion ||
     !/^[a-f0-9]{64}$/.test(task.tool_manifest_sha256 || "") ||
     task.next_tool_call?.name !== "wait_for_task" ||
     task.next_tool_call?.arguments?.timeout_seconds !== 25
@@ -294,8 +320,8 @@ try {
 
   const statusPath = join(task.path, "status.json");
   const statusAfter = JSON.parse(readFileSync(statusPath, "utf-8"));
-  if (statusAfter.status !== "done") {
-    throw new Error(`runner status should be done, got ${statusAfter.status}`);
+  if (statusAfter.status !== "done" && statusAfter.status !== "done_by_agent") {
+    throw new Error(`runner status should be done or done_by_agent, got ${statusAfter.status}`);
   }
   for (const fileName of ["result.md", "result.json", "diff.patch", "git.diff", "file-stats.json", "test.log", "verify.json", "verify.log"]) {
     if (!existsSync(join(task.path, fileName))) {
@@ -391,7 +417,7 @@ try {
   await disabledClient.close();
   ok("chatgpt_direct disabled exposes only health_check with diagnostic");
 
-  // 2. chatgpt_direct enabled: 10 tools + minimal create_direct_session
+  // 2. chatgpt_direct enabled: 13 tools + minimal create_direct_session
   const enabledConfigPath = join(tempRoot, "direct-enabled.json");
   const directRepo = join(workspaceRoot, "direct-fixture");
   mkdirSync(join(directRepo, "src"), { recursive: true });
@@ -448,14 +474,17 @@ try {
     "list_workspace",
     "read_workspace_file",
     "run_verification",
+    "safe_audit_direct_session",
+    "safe_direct_summary",
+    "safe_finalize_direct_session",
     "search_workspace",
     "sync_file",
   ];
   if (JSON.stringify(enabledNames) !== JSON.stringify(expectedDirect)) {
     throw new Error(`chatgpt_direct enabled tools mismatch: ${enabledNames.join(", ")}`);
   }
-  if (enabledTools._meta.tool_count !== 10) {
-    throw new Error(`chatgpt_direct enabled tool_count should be 10, got ${enabledTools._meta.tool_count}`);
+  if (enabledTools._meta.tool_count !== 13) {
+    throw new Error(`chatgpt_direct enabled tool_count should be 13, got ${enabledTools._meta.tool_count}`);
   }
 
   // Minimal create_direct_session
@@ -475,12 +504,12 @@ try {
   if (enabledHealth.direct_profile_enabled !== true) {
     throw new Error(`direct_profile_enabled should be true, got ${enabledHealth.direct_profile_enabled}`);
   }
-  if (enabledHealth.direct_tool_count !== 10) {
-    throw new Error(`direct_tool_count should be 10, got ${enabledHealth.direct_tool_count}`);
+  if (enabledHealth.direct_tool_count !== 13) {
+    throw new Error(`direct_tool_count should be 13, got ${enabledHealth.direct_tool_count}`);
   }
 
   await enabledClient.close();
-  ok("chatgpt_direct enabled exposes 10 tools and create_direct_session works");
+  ok("chatgpt_direct enabled exposes 13 tools and create_direct_session works");
 } catch (error) {
   fail("MCP smoke test", error);
 } finally {

package/scripts/{package-manifest-check.js → checks/package-manifest-check.js}

@@ -45,7 +45,8 @@ if (leaked.length > 0) {
 
 const required = [
   "PatchWarden.cmd",
-  "scripts/manage-patchwarden.ps1",
+  "PatchWarden-Desktop.cmd",
+  "scripts/control/manage-patchwarden.ps1",
   "scripts/launchers/Start-PatchWarden-Tunnel.cmd",
   "scripts/launchers/Start-PatchWarden-Direct-Tunnel.cmd",
 ];

package/scripts/{tunnel-supervisor-smoke.js → checks/tunnel-supervisor-smoke.js}

@@ -10,7 +10,7 @@ if (process.platform !== "win32") {
   process.exit(0);
 }
 
-const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+const root = resolve(fileURLToPath(new URL("../..", import.meta.url)));
 const temp = mkdtempSync(join(tmpdir(), "patchwarden-tunnel-smoke-"));
 const mockJs = join(temp, "mock-tunnel-client.js");
 const mockCmd = join(temp, "mock-tunnel-client.cmd");
@@ -57,7 +57,7 @@ if(command==='run'){
     MOCK_TUNNEL_STATE: stateFile,
   };
   const result = spawnSync("powershell.exe", [
-    "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", join(root, "scripts", "start-patchwarden-tunnel.ps1"),
+    "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", join(root, "scripts", "control", "start-patchwarden-tunnel.ps1"),
     "-TunnelId", "tunnel_smoke_fixture",
     "-TunnelClientExe", mockCmd,
     "-ConfigPath", mockConfig,

package/scripts/{unit-tests.js → checks/unit-tests.js}

@@ -5,7 +5,7 @@ import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const scriptDir = resolve(fileURLToPath(new URL(".", import.meta.url)));
-const root = resolve(scriptDir, "..");
+const root = resolve(scriptDir, "..", "..");
 const unitDir = resolve(root, "dist", "test", "unit");
 
 if (!existsSync(unitDir)) {

package/scripts/{watcher-supervisor-smoke.js → checks/watcher-supervisor-smoke.js}

@@ -19,7 +19,7 @@ if (process.platform !== "win32") {
   process.exit(0);
 }
 
-const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+const root = resolve(fileURLToPath(new URL("../..", import.meta.url)));
 const temp = mkdtempSync(join(tmpdir(), "patchwarden-watcher-supervisor-"));
 const children = [];
 
@@ -87,23 +87,29 @@ async function runExternalScenario() {
 function createFixture(name) {
   const project = join(temp, name, "patchwarden-fixture");
   const scripts = join(project, "scripts");
+  const controlScripts = join(scripts, "control");
+  const mcpScripts = join(scripts, "mcp");
+  const checkScripts = join(scripts, "checks");
   const runner = join(project, "dist", "runner");
   const workspace = join(project, "workspace");
   mkdirSync(scripts, { recursive: true });
+  mkdirSync(controlScripts, { recursive: true });
+  mkdirSync(mcpScripts, { recursive: true });
+  mkdirSync(checkScripts, { recursive: true });
   mkdirSync(runner, { recursive: true });
   mkdirSync(workspace, { recursive: true });
-  cpSync(join(root, "scripts", "start-patchwarden-tunnel.ps1"), join(scripts, "start-patchwarden-tunnel.ps1"));
-  writeFileSync(join(scripts, "patchwarden-mcp-stdio.cmd"), "@echo off\r\nexit /b 0\r\n", "utf-8");
+  cpSync(join(root, "scripts", "control", "start-patchwarden-tunnel.ps1"), join(controlScripts, "start-patchwarden-tunnel.ps1"));
+  writeFileSync(join(mcpScripts, "patchwarden-mcp-stdio.cmd"), "@echo off\r\nexit /b 0\r\n", "utf-8");
   const manifestFixture = JSON.stringify({
     ok: true,
     server_version: "0.6.0",
     schema_epoch: "2026-06-22-v6",
     tool_profile: "chatgpt_core",
-    tool_count: 16,
+    tool_count: 21,
     tool_names: [],
     tool_manifest_sha256: "a".repeat(64),
   });
-  writeFileSync(join(scripts, "mcp-manifest-check.js"), `process.stdout.write(${JSON.stringify(manifestFixture)});\n`, "utf-8");
+  writeFileSync(join(checkScripts, "mcp-manifest-check.js"), `process.stdout.write(${JSON.stringify(manifestFixture)});\n`, "utf-8");
   writeFileSync(join(project, "dist", "index.js"), "", "utf-8");
   const watcherAttemptPath = join(project, "watcher-attempt.txt");
   const watcherPath = join(runner, "watch.js");
@@ -140,7 +146,7 @@ function createFixture(name) {
 
 function runLauncher(fixture, mode, maxRestarts, lifetimeMs) {
   return spawnSync("powershell.exe", [
-    "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", join(fixture.project, "scripts", "start-patchwarden-tunnel.ps1"),
+    "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", join(fixture.project, "scripts", "control", "start-patchwarden-tunnel.ps1"),
     "-TunnelId", "tunnel_watcher_fixture",
     "-TunnelClientExe", fixture.mockCmd,
     "-ProxyUrl", "http://127.0.0.1:1",
@@ -161,7 +167,7 @@ function fixtureEnv(fixture, mode, lifetimeMs) {
     ...process.env,
     APPDATA: fixture.appData,
     LOCALAPPDATA: fixture.localAppData,
-    CONTROL_PLANE_API_KEY: "watcher-supervisor-smoke-secret",
+    CONTROL_PLANE_API_KEY: "test-key",
     WATCHER_FIXTURE_MODE: mode,
     TUNNEL_FIXTURE_LIFETIME_MS: String(lifetimeMs),
   };