patchwarden 0.6.1 → 1.1.0

package/scripts/control/start-control-center.ps1

@@ -0,0 +1,263 @@
+#Requires -Version 5.1
+param(
+  [switch]$NoBrowser,
+  [switch]$Foreground,
+  [switch]$Background
+)
+
+$ErrorActionPreference = "Stop"
+
+# ── Argument reconciliation ──────────────────────────────────────
+# -Foreground and -Background are mutually exclusive. When neither is
+# supplied, default to -Background (detach node, exit after readiness).
+if ($Foreground -and $Background) {
+  Write-Host "[error] -Foreground and -Background are mutually exclusive." -ForegroundColor Red
+  exit 1
+}
+if (-not $Foreground -and -not $Background) {
+  $Background = $true
+}
+
+$ProjectRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
+$ControlCenterEntry = Join-Path $ProjectRoot "dist\controlCenter.js"
+$ControlCenterEntryFull = [System.IO.Path]::GetFullPath($ControlCenterEntry)
+$ProjectRootFull = [System.IO.Path]::GetFullPath($ProjectRoot).TrimEnd("\")
+$ListenPort = 8090
+$ListenUrl = "http://127.0.0.1:$ListenPort/"
+$RuntimeDirectory = Join-Path $env:LOCALAPPDATA "patchwarden\control-center"
+$StatusFile = Join-Path $RuntimeDirectory "control-center-status.json"
+$StdoutLog = Join-Path $RuntimeDirectory "control-center.stdout.log"
+$StderrLog = Join-Path $RuntimeDirectory "control-center.stderr.log"
+$MaxWaitSeconds = 15
+$PollIntervalSeconds = 1
+
+Set-Location -LiteralPath $ProjectRoot
+
+# ── Helpers ──────────────────────────────────────────────────────
+
+function Test-ControlCenterCommandLine {
+  param([string]$CommandLine)
+  if (-not $CommandLine) { return $false }
+  $normalizedCommand = $CommandLine.Replace("/", "\").ToLowerInvariant()
+  $normalizedEntry = $ControlCenterEntryFull.ToLowerInvariant()
+  $normalizedRoot = $ProjectRootFull.ToLowerInvariant()
+  return $normalizedCommand.Contains($normalizedEntry) -or (
+    $normalizedCommand.Contains("dist\controlcenter.js") -and
+    $normalizedCommand.Contains($normalizedRoot)
+  )
+}
+
+function Get-ControlCenterProcesses {
+  Get-CimInstance Win32_Process -Filter "Name = 'node.exe'" -ErrorAction SilentlyContinue |
+    Where-Object { Test-ControlCenterCommandLine ([string]$_.CommandLine) }
+}
+
+function Read-StatusFile {
+  if (-not (Test-Path -LiteralPath $StatusFile)) { return $null }
+  try {
+    return Get-Content -LiteralPath $StatusFile -Raw -Encoding UTF8 | ConvertFrom-Json
+  } catch {
+    return $null
+  }
+}
+
+function Test-PortOwnedByControlCenter {
+  # Returns $true if a process is listening on $ListenPort AND it is our control
+  # center node process. Returns $false if nothing is listening. Throws a
+  # descriptive message if a foreign process owns the port.
+  $listeners = @()
+  try {
+    $listeners = Get-NetTCPConnection -LocalPort $ListenPort -State Listen -ErrorAction Stop |
+      Sort-Object OwningProcess -Unique
+  } catch {
+    return $false  # nothing listening
+  }
+  foreach ($listener in $listeners) {
+    $owner = Get-CimInstance Win32_Process -Filter "ProcessId = $($listener.OwningProcess)" -ErrorAction SilentlyContinue
+    if (-not $owner) { continue }
+    if (Test-ControlCenterCommandLine ([string]$owner.CommandLine)) {
+      return $true
+    } else {
+      Write-Host "[error] Port $ListenPort is already used by a non-PatchWarden process." -ForegroundColor Red
+      Write-Host "[error] PID $($owner.ProcessId): $($owner.CommandLine)" -ForegroundColor DarkRed
+      Write-Host "[error] Close that process manually, then rerun this script." -ForegroundColor Yellow
+      exit 1
+    }
+  }
+  return $false
+}
+
+function Get-StderrTail {
+  if (-not (Test-Path -LiteralPath $StderrLog)) { return "" }
+  try {
+    $content = Get-Content -LiteralPath $StderrLog -Raw -Encoding UTF8 -ErrorAction Stop
+    if (-not $content) { return "" }
+    $trimmed = ($content -replace '[\r\n]+', ' ').Trim()
+    if ($trimmed.Length -gt 500) { $trimmed = $trimmed.Substring(0, 500) }
+    return $trimmed
+  } catch {
+    return ""
+  }
+}
+
+# ── Single-instance detection ────────────────────────────────────
+# 1. Read the status file. If it points at a live control center (port
+#    responds AND pid is alive AND command line matches), just open the
+#    browser and exit — do NOT spawn a second server.
+# 2. If the port is occupied by a foreign process, error out.
+# 3. Otherwise start a fresh instance.
+
+$existing = Read-StatusFile
+if ($existing) {
+  $existingPid = 0
+  [int]::TryParse([string]$existing.pid, [ref]$existingPid) | Out-Null
+  $existingPort = 0
+  [int]::TryParse([string]$existing.port, [ref]$existingPort) | Out-Null
+
+  $pidAlive = $false
+  if ($existingPid -gt 0) {
+    $proc = Get-CimInstance Win32_Process -Filter "ProcessId = $existingPid" -ErrorAction SilentlyContinue
+    if ($proc -and (Test-ControlCenterCommandLine ([string]$proc.CommandLine))) {
+      $pidAlive = $true
+    }
+  }
+
+  if ($pidAlive -and $existingPort -gt 0) {
+    $probeUrl = "http://127.0.0.1:$existingPort/api/control-center-status"
+    try {
+      $resp = Invoke-WebRequest -Uri $probeUrl -UseBasicParsing -TimeoutSec 2 -ErrorAction Stop
+      if ($resp.StatusCode -eq 200) {
+        $body = $resp.Content | ConvertFrom-Json
+        if ($body.running -eq $true) {
+          $existingUrl = "http://127.0.0.1:$existingPort/"
+          Write-Host "[ok] PatchWarden Control Center is already running (PID $existingPid)." -ForegroundColor Green
+          Write-Host "[ok] URL: $existingUrl" -ForegroundColor Green
+          if (-not $NoBrowser) {
+            Write-Host "[open] Launching browser at $existingUrl"
+            Start-Process $existingUrl
+          }
+          exit 0
+        }
+      }
+    } catch {
+      # Status file exists but the probe failed — stale entry. Fall through
+      # to a fresh start after cleaning up.
+      Write-Host "[warn] Status file exists but the server did not respond; starting a new instance." -ForegroundColor DarkYellow
+    }
+  } else {
+    Write-Host "[warn] Status file references a dead PID; starting a new instance." -ForegroundColor DarkYellow
+  }
+}
+
+# Detect foreign port occupation before spawning.
+Test-PortOwnedByControlCenter | Out-Null
+# If we reach here, either nothing is listening or our own (now-dead) process
+# was the listener. Clean up any orphaned node processes for this entry point.
+$orphans = @(Get-ControlCenterProcesses)
+if ($orphans.Count -gt 0) {
+  Write-Host "[cleanup] Stopping $($orphans.Count) orphaned Control Center node process(es)." -ForegroundColor DarkYellow
+  foreach ($p in $orphans) {
+    try { Stop-Process -Id $p.ProcessId -Force -ErrorAction Stop } catch {}
+  }
+  Start-Sleep -Milliseconds 500
+}
+
+# ── Build if needed ──────────────────────────────────────────────
+
+$nodeCommand = Get-Command node.exe -ErrorAction SilentlyContinue
+if (-not $nodeCommand) {
+  Write-Host "[error] node.exe was not found on PATH." -ForegroundColor Red
+  exit 1
+}
+
+if (-not (Test-Path -LiteralPath $ControlCenterEntryFull)) {
+  Write-Host "[build] dist/controlCenter.js not found. Running npm.cmd run build..." -ForegroundColor Yellow
+  npm.cmd run build
+  if ($LASTEXITCODE -ne 0) {
+    Write-Host "[error] npm.cmd run build exited with code $LASTEXITCODE." -ForegroundColor Red
+    exit 1
+  }
+  if (-not (Test-Path -LiteralPath $ControlCenterEntryFull)) {
+    Write-Host "[error] Build completed but dist/controlCenter.js is still missing." -ForegroundColor Red
+    exit 1
+  }
+  Write-Host "[build] Build complete." -ForegroundColor Green
+}
+
+New-Item -ItemType Directory -Force -Path $RuntimeDirectory | Out-Null
+Remove-Item -LiteralPath $StdoutLog, $StderrLog -Force -ErrorAction SilentlyContinue
+
+# ── Foreground mode: node attached to this console, logs stream live ──
+if ($Foreground) {
+  Write-Host "[run] Starting PatchWarden Control Center on $ListenUrl (foreground)" -ForegroundColor Cyan
+  Write-Host "[run] Press Ctrl+C to stop. Logs stream below."
+  # In foreground mode the node process inherits this console; the status file
+  # is still written by the server itself on listen().
+  & $nodeCommand.Source $ControlCenterEntryFull
+  exit $LASTEXITCODE
+}
+
+# ── Background mode (default): detached node, this script exits after ready ──
+Write-Host "[run] Starting PatchWarden Control Center on $ListenUrl (background)" -ForegroundColor Cyan
+$process = Start-Process -FilePath $nodeCommand.Source `
+  -ArgumentList @($ControlCenterEntryFull) `
+  -WorkingDirectory $ProjectRoot `
+  -RedirectStandardOutput $StdoutLog `
+  -RedirectStandardError $StderrLog `
+  -PassThru -WindowStyle Hidden
+
+Write-Host "[run] node PID $($process.Id)."
+
+# Brief wait to detect truly immediate exits.
+Start-Sleep -Milliseconds 500
+if ($process.HasExited) {
+  $exitCode = $process.ExitCode
+  $stderrTail = Get-StderrTail
+  Write-Host "[error] node process exited immediately with code $exitCode." -ForegroundColor Red
+  if ($stderrTail) {
+    Write-Host "[error] stderr: $stderrTail" -ForegroundColor DarkRed
+  }
+  exit 1
+}
+
+# Poll for port readiness.
+$ready = $false
+for ($attempt = 1; $attempt -le $MaxWaitSeconds; $attempt++) {
+  try { $process.Refresh() } catch {}
+  if ($process.HasExited) {
+    $exitCode = $process.ExitCode
+    $stderrTail = Get-StderrTail
+    Write-Host "[error] node process exited with code $exitCode before the port became ready." -ForegroundColor Red
+    if ($stderrTail) {
+      Write-Host "[error] stderr: $stderrTail" -ForegroundColor DarkRed
+    }
+    exit 1
+  }
+  try {
+    $response = Invoke-WebRequest -Uri $ListenUrl -UseBasicParsing -TimeoutSec 2 -ErrorAction Stop
+    if ($response.StatusCode -ge 200 -and $response.StatusCode -lt 500) {
+      $ready = $true
+      break
+    }
+  } catch {
+    # Not ready yet; keep polling.
+  }
+  Start-Sleep -Seconds $PollIntervalSeconds
+}
+
+if (-not $ready) {
+  Write-Host "[error] Control Center did not become ready on $ListenUrl within $MaxWaitSeconds seconds." -ForegroundColor Red
+  try { Stop-Process -Id $process.Id -Force -ErrorAction Stop } catch {}
+  exit 1
+}
+
+Write-Host "[ok] PatchWarden Control Center is ready at $ListenUrl" -ForegroundColor Green
+
+if (-not $NoBrowser) {
+  Write-Host "[open] Launching default browser at $ListenUrl"
+  Start-Process $ListenUrl
+}
+
+Write-Host "[info] node PID $($process.Id); stdout log: $StdoutLog; stderr log: $StderrLog"
+Write-Host "[info] Re-run this script to open the existing instance instead of starting a new one."
+Write-Host "[info] Stop with: Stop-Process -Id $($process.Id)"

package/scripts/{start-patchwarden-tunnel.ps1 → control/start-patchwarden-tunnel.ps1}

@@ -1,10 +1,10 @@
-param(
+param(
   [string]$TunnelId = $env:PATCHWARDEN_TUNNEL_ID,
   [string]$Profile = "patchwarden",
   [ValidateSet("chatgpt_core", "chatgpt_direct")]
   [string]$ToolProfile = "chatgpt_core",
   [string]$ProxyUrl = $(if ($env:HTTPS_PROXY) { $env:HTTPS_PROXY } else { "http://127.0.0.1:7892" }),
-  [string]$TunnelClientExe = $env:TUNNEL_CLIENT_EXE,
+  [string]$TunnelClientExe = $(if ($env:TUNNEL_CLIENT_EXE) { $env:TUNNEL_CLIENT_EXE } else { $env:PATCHWARDEN_TUNNEL_CLIENT_EXE }),
   [string]$OpencodeBin = $env:OPENCODE_BIN_DIR,
   [string]$ConfigPath = $env:PATCHWARDEN_CONFIG,
   [string]$CredentialPath = $(if ($env:PATCHWARDEN_CREDENTIAL_PATH) { $env:PATCHWARDEN_CREDENTIAL_PATH } else { Join-Path $env:APPDATA "patchwarden\control-plane-api-key.dpapi" }),
@@ -16,6 +16,7 @@ param(
   [int]$WatcherHealthyResetSeconds = 60,
   [switch]$SkipWatcher,
   [switch]$ForgetSavedApiKey,
+  [switch]$NoTunnelWebUi,
   [string]$HealthListenAddr = ""
 )
 
@@ -29,12 +30,12 @@ if ([string]::IsNullOrWhiteSpace($HealthListenAddr)) {
   }
 }
 
-$ProjectRoot = Split-Path -Parent $PSScriptRoot
+$ProjectRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
 if (-not $ConfigPath) {
   $ConfigPath = Join-Path $ProjectRoot "patchwarden.config.json"
 }
 $McpLauncherName = if ($ToolProfile -eq "chatgpt_direct") { "patchwarden-mcp-direct.cmd" } else { "patchwarden-mcp-stdio.cmd" }
-$McpStdioLauncher = Join-Path $ProjectRoot "scripts\$McpLauncherName"
+$McpStdioLauncher = Join-Path $ProjectRoot "scripts\mcp\$McpLauncherName"
 $McpStdioLauncherForTunnel = $McpStdioLauncher -replace "\\", "/"
 $OpencodeConfigHome = Join-Path $env:LOCALAPPDATA "patchwarden\opencode-config"
 $ProfilePath = Join-Path $env:APPDATA "tunnel-client\$Profile.yaml"
@@ -57,6 +58,7 @@ $script:WatcherManaged = $false
 $script:WatcherRestartAttempts = 0
 $script:WatcherHealthySince = $null
 $script:WatcherRestartExhausted = $false
+$DefaultTunnelClientPath = "D:\ai_agent\tunnel-client-v0.0.9--context-conduit-topaz-windows-amd64\tunnel-client.exe"
 
 if ($ToolProfile -eq "chatgpt_direct") {
   $SkipWatcher = $true
@@ -501,7 +503,34 @@ if (-not $TunnelClientExe) {
   }
 }
 
+# Search common installation locations
+$commonPaths = @(
+  $DefaultTunnelClientPath
+  Join-Path $env:LOCALAPPDATA "patchwarden\tunnel-client.exe"
+  Join-Path $env:APPDATA "tunnel-client\tunnel-client.exe"
+  Join-Path $env:USERPROFILE "tunnel-client\tunnel-client.exe"
+)
+if (-not $TunnelClientExe) {
+  foreach ($candidate in $commonPaths) {
+    if (Test-Path -LiteralPath $candidate) {
+      $TunnelClientExe = $candidate
+      Write-Host "[detect] Found tunnel-client.exe: $TunnelClientExe" -ForegroundColor Green
+      break
+    }
+  }
+}
+
 if (-not $TunnelClientExe) {
+  Write-Host ""
+  Write-Host "[input] tunnel-client.exe not found on PATH or common locations." -ForegroundColor Yellow
+  Write-Host "        Please provide the full path."
+  Write-Host ""
+  Write-Host "        To search for it manually, try one of these commands:" -ForegroundColor Cyan
+  Write-Host "          Get-ChildItem -Path `$env:LOCALAPPDATA -Recurse -Filter tunnel-client.exe -ErrorAction SilentlyContinue" -ForegroundColor Gray
+  Write-Host "          Get-ChildItem -Path `$env:APPDATA -Recurse -Filter tunnel-client.exe -ErrorAction SilentlyContinue" -ForegroundColor Gray
+  Write-Host "          Get-ChildItem -Path C:\ -Recurse -Filter tunnel-client.exe -ErrorAction SilentlyContinue" -ForegroundColor Gray
+  Write-Host "        Or download it from: https://platform.openai.com/docs/guides/mcp-connector" -ForegroundColor Cyan
+  Write-Host ""
   $TunnelClientExe = Read-Host "Path to tunnel-client.exe"
 }
 
@@ -521,6 +550,19 @@ Assert-File -Path $TunnelClientExe -Name "tunnel-client.exe"
 Assert-File -Path $ConfigPath -Name "patchwarden.config.json"
 Assert-File -Path $McpStdioLauncher -Name $McpLauncherName
 
+# Auto-read Tunnel ID from existing profile YAML if not already set
+if (-not $TunnelId -and (Test-Path -LiteralPath $ProfilePath)) {
+  try {
+    $profileContent = Get-Content -LiteralPath $ProfilePath -Raw -Encoding UTF8
+    if ($profileContent -match 'tunnel_id:\s*"([^"]+)"') {
+      $TunnelId = $matches[1]
+      Write-Host "[detect] Tunnel ID read from profile $Profile`: $TunnelId" -ForegroundColor Green
+    }
+  } catch {
+    Write-Host "[warn] Could not read Tunnel ID from $ProfilePath`: $($_.Exception.Message)" -ForegroundColor Yellow
+  }
+}
+
 if (-not $TunnelId) {
   $TunnelId = Read-Host "Tunnel ID"
 }
@@ -538,7 +580,7 @@ if (-not (Test-Path -LiteralPath (Join-Path $ProjectRoot "dist\index.js"))) {
 New-Item -ItemType Directory -Force -Path $RuntimeDirectory | Out-Null
 $env:PATCHWARDEN_CONFIG = $ConfigPath
 Write-Host "[manifest] Verifying the exact $ToolProfile stdio MCP tool catalog..."
-$manifestOutput = (& node (Join-Path $ProjectRoot "scripts\mcp-manifest-check.js") --profile $ToolProfile --json 2>&1 | Out-String).Trim()
+$manifestOutput = (& node (Join-Path $ProjectRoot "scripts\checks\mcp-manifest-check.js") --profile $ToolProfile --json 2>&1 | Out-String).Trim()
 if ($LASTEXITCODE -ne 0) {
   Write-TunnelStatus -Status "stopped" -ReasonCode "tool_manifest_check_failed" -LastError "The tunnel MCP tool manifest preflight failed."
   throw "Tool manifest preflight failed: $manifestOutput"
@@ -630,7 +672,7 @@ Write-Host "[run-config] cwd: $ProjectRoot"
 Write-Host ""
 
 $attempt = 0
-$openUi = $true
+$openUi = -not $NoTunnelWebUi
 try {
   while ($true) {
     $attempt++

package/scripts/control/stop-patchwarden.ps1

@@ -0,0 +1,114 @@
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+  One-click shutdown for PatchWarden desktop use.
+.DESCRIPTION
+  Stops Core/Direct through the consolidated manager, then closes the local
+  Control Center and tray processes that belong to this project path.
+#>
+param(
+  [switch]$KeepControlCenter,
+  [switch]$KeepTray
+)
+
+$ErrorActionPreference = "Stop"
+$ProjectRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
+$ProjectRootFull = [System.IO.Path]::GetFullPath($ProjectRoot).TrimEnd("\")
+$Manager = Join-Path $PSScriptRoot "manage-patchwarden.ps1"
+$ControlCenterEntry = Join-Path $ProjectRoot "dist\controlCenter.js"
+$ControlCenterEntryFull = [System.IO.Path]::GetFullPath($ControlCenterEntry)
+$TrayScript = Join-Path $PSScriptRoot "control-center-tray.ps1"
+$TrayScriptFull = [System.IO.Path]::GetFullPath($TrayScript)
+$RuntimeDirectory = Join-Path $env:LOCALAPPDATA "patchwarden\control-center"
+$StatusFile = Join-Path $RuntimeDirectory "control-center-status.json"
+
+Set-Location -LiteralPath $ProjectRoot
+
+function Normalize-CommandLine {
+  param([string]$CommandLine)
+  if (-not $CommandLine) { return "" }
+  return $CommandLine.Replace("/", "\").ToLowerInvariant()
+}
+
+function Test-ControlCenterProcess {
+  param($ProcessInfo)
+  $normalizedCommand = Normalize-CommandLine ([string]$ProcessInfo.CommandLine)
+  $normalizedEntry = $ControlCenterEntryFull.ToLowerInvariant()
+  $normalizedRoot = $ProjectRootFull.ToLowerInvariant()
+  return $normalizedCommand.Contains($normalizedEntry) -or (
+    $normalizedCommand.Contains("dist\controlcenter.js") -and
+    $normalizedCommand.Contains($normalizedRoot)
+  )
+}
+
+function Test-TrayProcess {
+  param($ProcessInfo)
+  $normalizedCommand = Normalize-CommandLine ([string]$ProcessInfo.CommandLine)
+  $normalizedTray = $TrayScriptFull.ToLowerInvariant()
+  $normalizedRoot = $ProjectRootFull.ToLowerInvariant()
+  return $normalizedCommand.Contains($normalizedTray) -or (
+    $normalizedCommand.Contains("control-center-tray.ps1") -and
+    $normalizedCommand.Contains($normalizedRoot)
+  )
+}
+
+function Stop-MatchingProcesses {
+  param(
+    [Parameter(Mandatory = $true)][string]$Label,
+    [Parameter(Mandatory = $true)][scriptblock]$Predicate
+  )
+
+  $processes = @(
+    Get-CimInstance Win32_Process -ErrorAction SilentlyContinue |
+      Where-Object {
+        [int]$_.ProcessId -ne $PID -and (& $Predicate $_)
+      }
+  )
+
+  if ($processes.Count -eq 0) {
+    Write-Host "[stop] No $Label process found." -ForegroundColor DarkGray
+    return
+  }
+
+  foreach ($proc in $processes) {
+    Write-Host "[stop] Closing $Label PID $($proc.ProcessId)." -ForegroundColor Yellow
+    try {
+      Stop-Process -Id $proc.ProcessId -ErrorAction SilentlyContinue
+    } catch {
+      Write-Host "[stop] PID $($proc.ProcessId) already exited or is inaccessible." -ForegroundColor DarkGray
+    }
+  }
+
+  Start-Sleep -Milliseconds 800
+
+  foreach ($proc in $processes) {
+    $stillRunning = Get-Process -Id $proc.ProcessId -ErrorAction SilentlyContinue
+    if ($stillRunning) {
+      Write-Host "[stop] PID $($proc.ProcessId) did not exit cleanly; forcing stop." -ForegroundColor Yellow
+      Stop-Process -Id $proc.ProcessId -Force -ErrorAction SilentlyContinue
+    }
+  }
+}
+
+if (-not (Test-Path -LiteralPath $Manager)) {
+  throw "Manager script not found: $Manager"
+}
+
+Write-Host "[stop] Stopping PatchWarden Core/Direct services..." -ForegroundColor Cyan
+& powershell.exe -NoProfile -ExecutionPolicy Bypass -File $Manager stop all
+if ($LASTEXITCODE -ne 0) {
+  exit $LASTEXITCODE
+}
+
+if (-not $KeepControlCenter) {
+  Stop-MatchingProcesses -Label "Control Center" -Predicate ${function:Test-ControlCenterProcess}
+  if (Test-Path -LiteralPath $StatusFile) {
+    Remove-Item -LiteralPath $StatusFile -Force -ErrorAction SilentlyContinue
+  }
+}
+
+if (-not $KeepTray) {
+  Stop-MatchingProcesses -Label "tray" -Predicate ${function:Test-TrayProcess}
+}
+
+Write-Host "[ok] PatchWarden shutdown complete." -ForegroundColor Green

package/scripts/launchers/Check-PatchWarden-Health.cmd

@@ -1,6 +1,6 @@
 @echo off
 setlocal
 cd /d "%~dp0..\.."
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0..\manage-patchwarden.ps1" status all
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0..\control\manage-patchwarden.ps1" status all
 echo.
 pause

package/scripts/launchers/Reset-PatchWarden-Tunnel-Key.cmd

@@ -1,6 +1,6 @@
 @echo off
 setlocal
 cd /d "%~dp0..\.."
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0..\start-patchwarden-tunnel.ps1" -ForgetSavedApiKey
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0..\control\start-patchwarden-tunnel.ps1" -ForgetSavedApiKey
 echo.
 pause

package/scripts/launchers/Restart-PatchWarden.cmd

@@ -1,6 +1,6 @@
 @echo off
 setlocal
 cd /d "%~dp0..\.."
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0..\manage-patchwarden.ps1" restart core
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0..\control\manage-patchwarden.ps1" restart core
 echo.
 pause

package/scripts/launchers/Start-PatchWarden-Direct-Tunnel.cmd

@@ -1,7 +1,7 @@
 @echo off
 setlocal
 cd /d "%~dp0..\.."
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0..\start-patchwarden-tunnel.ps1" -ToolProfile chatgpt_direct -Profile patchwarden-direct -HealthListenAddr 127.0.0.1:8081 -SkipWatcher
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0..\control\start-patchwarden-tunnel.ps1" -ToolProfile chatgpt_direct -Profile patchwarden-direct -HealthListenAddr 127.0.0.1:8081 -SkipWatcher
 echo.
 echo PatchWarden Direct tunnel launcher exited.
 pause

package/scripts/launchers/Start-PatchWarden-Tunnel.cmd

@@ -1,7 +1,7 @@
 @echo off
 setlocal
 cd /d "%~dp0..\.."
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0..\start-patchwarden-tunnel.ps1" -ToolProfile chatgpt_core -Profile patchwarden -HealthListenAddr 127.0.0.1:8080
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0..\control\start-patchwarden-tunnel.ps1" -ToolProfile chatgpt_core -Profile patchwarden -HealthListenAddr 127.0.0.1:8080
 echo.
 echo PatchWarden Core tunnel launcher exited.
 pause

package/scripts/{patchwarden-mcp-direct.cmd → mcp/patchwarden-mcp-direct.cmd}

@@ -1,6 +1,6 @@
 @echo off
 setlocal
-set "PROJECT_ROOT=%~dp0.."
+set "PROJECT_ROOT=%~dp0..\.."
 if not defined PATCHWARDEN_CONFIG set "PATCHWARDEN_CONFIG=%PROJECT_ROOT%\patchwarden.config.json"
 set "PATCHWARDEN_TOOL_PROFILE=chatgpt_direct"
 cd /d "%PROJECT_ROOT%"

package/scripts/{patchwarden-mcp-stdio.cmd → mcp/patchwarden-mcp-stdio.cmd}

@@ -1,6 +1,6 @@
 @echo off
 setlocal
-set "PROJECT_ROOT=%~dp0.."
+set "PROJECT_ROOT=%~dp0..\.."
 if not defined PATCHWARDEN_CONFIG set "PATCHWARDEN_CONFIG=%PROJECT_ROOT%\patchwarden.config.json"
 set "PATCHWARDEN_TOOL_PROFILE=chatgpt_core"
 cd /d "%PROJECT_ROOT%"

package/scripts/{pack-clean.js → release/pack-clean.js}

@@ -15,7 +15,7 @@ import { join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const scriptDir = resolve(fileURLToPath(new URL(".", import.meta.url)));
-const root = resolve(scriptDir, "..");
+const root = resolve(scriptDir, "..", "..");
 const releaseDir = resolve(root, "release");
 const archivePath = resolve(root, "patchwarden-release.tar.gz");
 
@@ -29,7 +29,13 @@ const include = [
   "examples",
   "scripts",
   "src",
+  "ui",
   "PatchWarden.cmd",
+  "PatchWarden-Control.cmd",
+  "PatchWarden-Control-Tray.cmd",
+  "PatchWarden-Desktop.cmd",
+  "Restart-PatchWarden-Control.cmd",
+  "Stop-PatchWarden.cmd",
   ".gitignore",
   "LICENSE",
   "README.md",
@@ -42,6 +48,8 @@ const forbidden = [
   /(^|[\\/])node_modules([\\/]|$)/,
   /(^|[\\/])\.patchwarden([\\/]|$)/,
   /(^|[\\/])\.safe-bifrost([\\/]|$)/,
+  /(^|[\\/])\.local([\\/]|$)/,
+  /(^|[\\/])\.tmp([\\/]|$)/,
   /(^|[\\/])patchwarden\.config\.json$/,
   /(^|[\\/])safe-bifrost\.config\.json$/,
   /\.local\.(cmd|ps1)$/i,