patchwarden 0.6.4 → 1.5.0

package/README.en.md

@@ -8,10 +8,9 @@
 [![Node.js](https://img.shields.io/badge/Node.js-%3E%3D18-339933.svg)](https://nodejs.org/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
-Current stable release: **v0.6.4**. See the
-[release notes](docs/release-v0.6.4.md),
-[migration guide](docs/migration-from-safe-bifrost.md), and
-[GitHub Release](https://github.com/jiezeng2004-design/PatchWarden/releases/tag/v0.6.4).
+Current source version: **v1.5.0**. See the
+[CHANGELOG](CHANGELOG.md), [migration guide](docs/migration-from-safe-bifrost.md), and
+[release checklist](docs/release-checklist.md). Verify GitHub Release / npm publication separately before release.
 
 PatchWarden is a local-first MCP safety and verification layer for AI coding
 agents, with workspace confinement, command allowlists, scope-violation
@@ -266,7 +265,7 @@ execution still requires a separate Watcher.
 New-Item -ItemType Directory .\patchwarden-runtime
 Set-Location .\patchwarden-runtime
 npm.cmd init -y
-npm.cmd install patchwarden@0.6.4
+npm.cmd install patchwarden@<published-version>
 Copy-Item .\node_modules\patchwarden\examples\config.example.json .\patchwarden.config.json
 $env:PATCHWARDEN_CONFIG = (Resolve-Path .\patchwarden.config.json)
 node .\node_modules\patchwarden\dist\runner\watch.js
@@ -275,10 +274,10 @@ node .\node_modules\patchwarden\dist\runner\watch.js
 An MCP client can launch:
 
 ```text
-npx.cmd -y patchwarden@0.6.4
+npx.cmd -y patchwarden@<published-version>
 ```
 
-Pin the version in important environments instead of using `latest`
+Replace `<published-version>` with a version that exists on npm/GitHub, and pin that version in important environments instead of using `latest`
 unconditionally.
 
 ## Complete configuration guide
@@ -331,7 +330,7 @@ Configuration fields:
 | `workspaceRoot` | Yes | The only workspace root PatchWarden may access. |
 | `plansDir` | Yes | Plan directory, normally `.patchwarden/plans`. |
 | `tasksDir` | Yes | Task and result directory, normally `.patchwarden/tasks`. |
-| `toolProfile` | No | `full` or `chatgpt_core`; use `full` for local clients. |
+| `toolProfile` | No | `full`, `chatgpt_core`, `chatgpt_direct`, or `chatgpt_search`; use `full` for local clients and `chatgpt_search` for compact discovery-driven clients. |
 | `agents` | Yes | Execution-agent allowlist; supports `{repo}` and `{prompt}` placeholders. |
 | `allowedTestCommands` | Yes | Exact allowlist for independent verification commands. |
 | `repoAllowedTestCommands` | No | Extra exact commands keyed by workspace-relative repository path; wildcards are unsupported. |
@@ -434,7 +433,7 @@ Pinned npm configuration:
 ```toml
 [mcp_servers.patchwarden]
 command = "npx.cmd"
-args = ["-y", "patchwarden@0.6.4"]
+args = ["-y", "patchwarden@<published-version>"]
 
 [mcp_servers.patchwarden.env]
 PATCHWARDEN_CONFIG = "D:\\path\\to\\patchwarden.config.json"
@@ -494,7 +493,7 @@ PatchWarden.cmd start core
 The launcher:
 
 - Builds `dist/index.js` if it is missing.
-- Verifies v0.6.4, the fixed 17-tool `chatgpt_core` catalog, and its schema
+- Verifies v1.5.0, the fixed 26-tool `chatgpt_core` catalog, and its schema
   manifest.
 - Reads or prompts for the Tunnel ID.
 - Reads or prompts for the runtime API key.
@@ -742,7 +741,7 @@ Optional token configuration:
 Set the token in the PowerShell process that starts the server:
 
 ```powershell
-$env:PATCHWARDEN_OWNER_TOKEN = "use-a-random-local-only-value"
+$env:PATCHWARDEN_OWNER_TOKEN = "<token>"
 ```
 
 Clients can send `Authorization: Bearer ...` or `x-patchwarden-token`. Never
@@ -931,18 +930,52 @@ names.
 
 ## MCP tools and profiles
 
-`chatgpt_core` is the fixed 17-tool profile used by the ChatGPT tunnel:
+`chatgpt_core` is the fixed 26-tool profile used by the ChatGPT tunnel:
 
 `health_check`, `list_agents`, `list_workspace`,
-`read_workspace_file`, `save_plan`, `create_task`,
+`read_workspace_file`, `save_plan`, `create_task`, `run_task_loop`,
+`recommend_agent_for_task`, `get_task_lineage`, `export_task_evidence_pack`,
+`get_project_policy`,
 `wait_for_task`, `get_task_summary`, `get_diff`, `get_result`,
 `get_result_json`, `get_test_log`, `get_task_status`, `list_tasks`,
-`cancel_task`, `audit_task`, and `safe_status`.
+`cancel_task`, `audit_task`, `safe_status`, `safe_result`, `safe_audit`, `safe_test_summary`, and `safe_diff_summary`.
 
 `get_task_summary` keeps the backward-compatible `standard` view by default.
 ChatGPT should request `view: "compact"` first; terminal `wait_for_task`
 responses also embed compact acceptance evidence only.
 
+`run_task_loop` is the v1.2 safe orchestration entrypoint. It only composes
+existing `create_task`, `wait_for_task`, safe summary, and `audit_task`
+behavior; it does not bypass the Watcher, command allowlist, workspace
+confinement, or local confirmation boundaries. `get_task_lineage` reads the
+bounded `.patchwarden/lineages/<lineage_id>/` summary without returning full
+logs or diffs.
+
+`get_project_policy` is the v1.3 read-only policy entrypoint. It returns the
+bounded effective `.patchwarden/project-policy.json` policy and release
+readiness summary without expanding command permissions. The v1.3 release mode
+tools, `release_check`, `release_prepare`, `release_verify`, and
+`release_cleanup`, are full-profile only and never perform publish, push, tag,
+or GitHub Release writes. The Control Center dashboard also shows bounded
+lineage, policy, and release status summaries without full logs, diffs, or
+secret-bearing content.
+
+v1.4 adds Direct-assisted loop verification. `run_task_loop` can opt into
+`direct_verify=true`; after the guarded task and audit succeed, PatchWarden
+creates a Direct session, runs only allowlisted verification commands, safe
+finalizes, safe audits, and records bounded Direct evidence in lineage. It does
+not call Direct patching tools, publish, push, tag, create releases, restart
+watchers, or return full stdout/stderr/diffs.
+
+v1.5 adds worktree-assisted loop isolation, bounded agent routing, and evidence
+pack export. `run_task_loop(isolation_mode="worktree")` creates an isolated git
+worktree for the task and records the worktree id, path, branch, and next action
+in lineage. It does not auto-merge or auto-delete the worktree. `agent="auto"`
+uses `recommend_agent_for_task` to select a configured agent before task
+creation. `export_task_evidence_pack` writes bounded `evidence.json` and
+`EVIDENCE.md` files under `.patchwarden/evidence-packs/<lineage_id>/` without
+stdout/stderr tails, full diffs, verification logs, or sensitive file content.
+
 `full` additionally provides:
 
 - `get_plan`
@@ -957,9 +990,9 @@ to `full`.
 
 ### ChatGPT Direct mode
 
-Direct mode exposes ten guarded tools so ChatGPT can create an editing
+Direct mode exposes fourteen guarded tools so ChatGPT can create an editing
 session, read and search source files, apply hash-bound JSON patches, run
-exactly allowlisted verification commands, finalize the evidence, and audit
+exactly allowlisted verification commands or a bounded verification bundle, finalize the evidence, and audit
 the result without a local execution agent.
 
 Enable it in the trusted local configuration while keeping the ordinary Core
@@ -981,7 +1014,7 @@ On first use, provide the `tunnel-client.exe` path and a Tunnel ID dedicated
 to the Direct Connector. The launcher uses the `patchwarden-direct` profile,
 stores runtime state under `%LOCALAPPDATA%\patchwarden\runtime-direct`, skips
 the Watcher, and retains the existing DPAPI credential handling. In a fresh
-ChatGPT conversation, `health_check` should report `chatgpt_direct`, ten
+ChatGPT conversation, `health_check` should report `chatgpt_direct`, fourteen
 tools, and `direct_profile_enabled=true`.
 
 ## Security boundaries and local data
@@ -1017,7 +1050,7 @@ Start with a dedicated test workspace and a repository you can recover.
 Upgrade a pinned npm installation:
 
 ```powershell
-npm.cmd install patchwarden@0.6.4
+npm.cmd install patchwarden@<published-version>
 ```
 
 Upgrade a source checkout:
@@ -1101,8 +1134,9 @@ and release-asset checksums independently.
 - [x] ChatGPT Connector / tunnel
 - [x] Doctor and runtime health checks
 - [x] Tool manifest and schema-drift detection
-- [ ] Worktree isolation
-- [ ] Multi-agent task queue
+- [x] Release Gate (five-stage pre-release verification)
+- [x] Worktree isolation
+- [x] Multi-agent routing
 - [ ] Local dashboard
 
 ## License

package/README.md

@@ -8,10 +8,9 @@
 [![Node.js](https://img.shields.io/badge/Node.js-%3E%3D18-339933.svg)](https://nodejs.org/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
-当前稳定版本：**v0.6.4**。查看
-[发布说明](docs/release-v0.6.4.md)、
-[迁移指南](docs/migration-from-safe-bifrost.md)和
-[GitHub Release](https://github.com/jiezeng2004-design/PatchWarden/releases/tag/v0.6.4)。
+当前源码版本：**v1.5.0**。查看
+[CHANGELOG](CHANGELOG.md)、[迁移指南](docs/migration-from-safe-bifrost.md)和
+[发布检查清单](docs/release-checklist.md)。GitHub Release / npm 发布状态需要在发布前单独核对。
 
 PatchWarden 是一个面向本地编程 Agent 的安全 MCP 桥接器。上游的
 ChatGPT、Codex、OpenCode 或其他 MCP 客户端负责规划与验收，
@@ -180,7 +179,7 @@ npm 包适合让 MCP 客户端通过固定版本启动 PatchWarden。为了执
 New-Item -ItemType Directory .\patchwarden-runtime
 Set-Location .\patchwarden-runtime
 npm.cmd init -y
-npm.cmd install patchwarden@0.6.4
+npm.cmd install patchwarden@<published-version>
 Copy-Item .\node_modules\patchwarden\examples\config.example.json .\patchwarden.config.json
 $env:PATCHWARDEN_CONFIG = (Resolve-Path .\patchwarden.config.json)
 node .\node_modules\patchwarden\dist\runner\watch.js
@@ -189,10 +188,10 @@ node .\node_modules\patchwarden\dist\runner\watch.js
 MCP 客户端可以使用：
 
 ```text
-npx.cmd -y patchwarden@0.6.4
+npx.cmd -y patchwarden@<published-version>
 ```
 
-建议固定版本号，不要在重要环境中无条件使用 `latest`。
+将 `<published-version>` 替换为已经在 npm/GitHub 上确认存在的版本；不要在重要环境中无条件使用 `latest`。
 
 ## 完整配置说明
 
@@ -244,7 +243,7 @@ Copy-Item .\examples\config.example.json .\patchwarden.config.json
 | `workspaceRoot` | 是 | PatchWarden 唯一允许访问的工作区根目录。 |
 | `plansDir` | 是 | 计划目录，通常使用 `.patchwarden/plans`。 |
 | `tasksDir` | 是 | 任务和结果目录，通常使用 `.patchwarden/tasks`。 |
-| `toolProfile` | 否 | `full` 或 `chatgpt_core`；本地客户端推荐 `full`。 |
+| `toolProfile` | 否 | `full`、`chatgpt_core`、`chatgpt_direct` 或 `chatgpt_search`；本地客户端推荐 `full`，动态工具发现场景使用 `chatgpt_search`。 |
 | `agents` | 是 | 可执行 Agent 白名单；支持 `{repo}` 和 `{prompt}` 占位符。 |
 | `allowedTestCommands` | 是 | 独立验证命令白名单，调用时必须精确匹配。 |
 | `repoAllowedTestCommands` | 否 | 按工作区相对仓库路径增加精确验证命令；不支持通配符。 |
@@ -342,7 +341,7 @@ npm.cmd run watch
 ```toml
 [mcp_servers.patchwarden]
 command = "npx.cmd"
-args = ["-y", "patchwarden@0.6.4"]
+args = ["-y", "patchwarden@<published-version>"]
 
 [mcp_servers.patchwarden.env]
 PATCHWARDEN_CONFIG = "D:\\path\\to\\patchwarden.config.json"
@@ -400,7 +399,7 @@ PatchWarden.cmd start core
 启动器会：
 
 - 检查 `dist/index.js`，缺失时自动构建。
-- 校验 `chatgpt_core` 的版本、16 个核心工具和 Schema Manifest。
+- 校验 `chatgpt_core` 的版本、26 个核心工具和 Schema Manifest。
 - 读取或提示输入 Tunnel ID。
 - 读取或提示输入运行时 API Key。
 - 使用 Windows DPAPI 保存凭据到 `%APPDATA%\patchwarden`。
@@ -837,18 +836,45 @@ PatchWarden v0.4.0 不自动读取旧 CLI、旧环境变量、旧 Header、旧
 
 ## MCP 工具与 Profile
 
-`chatgpt_core` 是固定的 17 工具 Profile，适合 ChatGPT Tunnel：
+`chatgpt_core` 是固定的 26 工具 Profile，适合 ChatGPT Tunnel：
 
 `health_check`、`list_agents`、`list_workspace`、
-`read_workspace_file`、`save_plan`、`create_task`、
+`read_workspace_file`、`save_plan`、`create_task`、`run_task_loop`、`recommend_agent_for_task`、
+`get_task_lineage`、`export_task_evidence_pack`、`get_project_policy`、
 `wait_for_task`、`get_task_summary`、`get_diff`、`get_result`、
 `get_result_json`、`get_test_log`、`get_task_status`、`list_tasks`、
-`cancel_task`、`audit_task`、`safe_status`。
+`cancel_task`、`audit_task`、`safe_status`、`safe_result`、`safe_audit`、`safe_test_summary`、`safe_diff_summary`。
 
 `get_task_summary` 默认保留兼容的 `standard` 视图；ChatGPT 应优先使用
 `view: "compact"`，终态 `wait_for_task` 也只内嵌 compact 验收证据。
 
-`full` 提供完整 30 工具本地开发目录，包含核心工具、管理工具和 Direct
+`run_task_loop` 是 v1.2 的安全编排入口：它只组合现有 `create_task`、`wait_for_task`、safe summary 和
+`audit_task`，不会绕过 Watcher、命令白名单、workspace confinement 或确认边界。`get_task_lineage`
+读取 `.patchwarden/lineages/<lineage_id>/` 中的有界链路摘要，不返回完整日志或 diff。
+
+v1.4 adds Direct-assisted loop verification. `run_task_loop(direct_verify=true)`
+will create a Direct session only after the watcher-driven task and normal audit
+succeed, run allowlisted Direct verification commands, safe-finalize, safe-audit,
+and write bounded Direct evidence into lineage. It does not call Direct patching
+tools, publish, push, tag, create releases, restart live services, or return full
+stdout/stderr/diffs.
+
+v1.5 adds worktree-assisted loop isolation, bounded agent routing, and evidence
+pack export. `run_task_loop(isolation_mode="worktree")` creates an isolated git
+worktree for the task and records the worktree id, path, branch, and next action
+in lineage. It does not auto-merge or auto-delete the worktree. `agent="auto"`
+uses `recommend_agent_for_task` to select a configured agent before task
+creation. `export_task_evidence_pack` writes bounded `evidence.json` and
+`EVIDENCE.md` files under `.patchwarden/evidence-packs/<lineage_id>/` without
+stdout/stderr tails, full diffs, verification logs, or sensitive file content.
+
+`get_project_policy` 是 v1.3 的只读策略入口，返回 `.patchwarden/project-policy.json`
+的有界 effective policy 与 release readiness，不会扩大命令白名单。v1.3 的
+`release_check`、`release_prepare`、`release_verify`、`release_cleanup` 仅在 `full`
+Profile 中可见，不执行 publish、push、tag 或 GitHub Release 写操作。Control Center
+Dashboard 会展示 lineage、policy 和 release status 的有界摘要，不返回完整日志、diff 或密钥内容。
+
+`full` 提供完整 64 工具本地开发目录，包含核心工具、管理工具和 Direct
 工具。除 `chatgpt_core` 外，常用额外管理工具包括：
 
 - `get_plan`
@@ -858,15 +884,15 @@ PatchWarden v0.4.0 不自动读取旧 CLI、旧环境变量、旧 Header、旧
 - `get_task_stdout_tail`
 - `get_task_log_tail`
 
-`chatgpt_direct` 是 v0.6.0 新增的 Direct 直接开发 Profile，v0.6.4 包含 10 个工具：
+`chatgpt_direct` 是 v0.6.0 新增的 Direct 直接开发 Profile，v1.4 包含 14 个工具：
 
 `health_check`、`list_workspace`、`create_direct_session`、
 `search_workspace`、`read_workspace_file`、`apply_patch`、
-`run_verification`、`finalize_direct_session`、`audit_session`、`sync_file`。
+`run_verification`、`run_direct_verification_bundle`、`finalize_direct_session`、`audit_session`、`safe_direct_summary`、`safe_finalize_direct_session`、`safe_audit_direct_session`、`sync_file`。
 
 `chatgpt_direct` 默认关闭，需要通过 `enableDirectProfile: true` 或
 `PATCHWARDEN_TOOL_PROFILE=chatgpt_direct` 显式启用。`chatgpt_core` 保持
-17 工具不变。
+26 工具清单。
 
 Tunnel 包装脚本会强制使用 `chatgpt_core`；普通本地开发默认使用 `full`。
 
@@ -921,7 +947,7 @@ Tunnel ID。启动器使用 `patchwarden-direct` Profile、独立的
 Tunnel API Key 仍通过现有 Windows DPAPI 缓存处理，不会写入仓库。
 
 连接 ChatGPT 后新建对话并先调用 `health_check`。预期
-`tool_profile=chatgpt_direct`、`tool_count=10`、
+`tool_profile=chatgpt_direct`、`tool_count=14`、
 `direct_profile_enabled=true`。已有对话可能缓存旧工具清单，需要重新连接
 Connector 后再新建对话。
 
@@ -984,7 +1010,7 @@ PatchWarden 能降低误操作风险，但不能替代人工审查。第一次
 升级 npm 固定版本：
 
 ```powershell
-npm.cmd install patchwarden@0.6.4
+npm.cmd install patchwarden@<published-version>
 ```
 
 源码升级：
@@ -1067,8 +1093,9 @@ Release 和发布资产校验值。
 - [x] ChatGPT Connector / Tunnel
 - [x] Doctor 与运行时健康检查
 - [x] Tool Manifest 与 Schema 漂移检测
-- [ ] Worktree 隔离
-- [ ] 多 Agent 任务队列
+- [x] Release Gate（发布前五阶段校验）
+- [x] Worktree 隔离
+- [x] 多 Agent 路由
 - [ ] 本地 Dashboard
 
 ## License

package/dist/agents/agentRouter.d.ts

@@ -0,0 +1,40 @@
+export interface AgentRouteInput {
+    goal?: string;
+    scope?: string[];
+    inline_plan?: string;
+    template?: string;
+    configuredAgents: string[];
+}
+export interface AgentRouteResult {
+    recommended_agent: string;
+    reason: string;
+    fallback: boolean;
+}
+export declare const AGENT_ROUTING_RULES: {
+    /** 大规模代码修改 → opencode */
+    readonly largeScope: {
+        readonly agent: "opencode";
+        readonly threshold: 10;
+    };
+    /** 单文件修改 → patchwarden-direct */
+    readonly singleFile: {
+        readonly agent: "patchwarden-direct";
+    };
+    /** 验收审计 → patchwarden-audit */
+    readonly audit: {
+        readonly agent: "patchwarden-audit";
+        readonly keywords: readonly ["审计", "audit", "验收", "verify"];
+    };
+    /** 复杂推理和重构 → codex */
+    readonly refactor: {
+        readonly agent: "codex";
+        readonly keywords: readonly ["重构", "refactor", "跨模块", "redesign"];
+    };
+    /** 文档整理 → claude（fallback 到 opencode） */
+    readonly documentation: {
+        readonly agent: "claude";
+        readonly fallbackAgent: "opencode";
+        readonly keywords: readonly ["文档", "readme", "changelog", "doc"];
+    };
+};
+export declare function routeAgent(input: AgentRouteInput): AgentRouteResult;

package/dist/agents/agentRouter.js

@@ -0,0 +1,95 @@
+import { PatchWardenError } from "../errors.js";
+// ── Routing rules (roadmap 9.3) ───────────────────────────────────
+export const AGENT_ROUTING_RULES = {
+    /** 大规模代码修改 → opencode */
+    largeScope: {
+        agent: "opencode",
+        threshold: 10, // scope.length > threshold
+    },
+    /** 单文件修改 → patchwarden-direct */
+    singleFile: {
+        agent: "patchwarden-direct",
+    },
+    /** 验收审计 → patchwarden-audit */
+    audit: {
+        agent: "patchwarden-audit",
+        keywords: ["审计", "audit", "验收", "verify"],
+    },
+    /** 复杂推理和重构 → codex */
+    refactor: {
+        agent: "codex",
+        keywords: ["重构", "refactor", "跨模块", "redesign"],
+    },
+    /** 文档整理 → claude（fallback 到 opencode） */
+    documentation: {
+        agent: "claude",
+        fallbackAgent: "opencode",
+        keywords: ["文档", "readme", "changelog", "doc"],
+    },
+};
+// ── Helpers ───────────────────────────────────────────────────────
+function containsAny(text, keywords) {
+    return keywords.some((keyword) => text.includes(keyword));
+}
+function resolveRoute(preferred, reason, configuredAgents) {
+    if (configuredAgents.includes(preferred)) {
+        return { recommended_agent: preferred, reason, fallback: false };
+    }
+    const fallback = configuredAgents[0];
+    return {
+        recommended_agent: fallback,
+        reason: `fallback: ${preferred} not configured, using ${fallback}`,
+        fallback: true,
+    };
+}
+// ── Route agent ───────────────────────────────────────────────────
+export function routeAgent(input) {
+    if (!input.configuredAgents || input.configuredAgents.length === 0) {
+        throw new PatchWardenError("no_agent_configured", "No agent is configured for routing.", "Configure at least one agent in patchwarden.config.json under the agents field.");
+    }
+    const scopeCount = input.scope?.length ?? 0;
+    const text = `${input.goal || ""} ${input.inline_plan || ""}`.toLowerCase();
+    // Rule 1: 大规模代码修改 → opencode (scope files > 10)
+    if (scopeCount > AGENT_ROUTING_RULES.largeScope.threshold) {
+        return resolveRoute(AGENT_ROUTING_RULES.largeScope.agent, `large scope (${scopeCount} files)`, input.configuredAgents);
+    }
+    // Rule 2: 单文件修改 → patchwarden-direct (scope files === 1)
+    if (scopeCount === 1) {
+        return resolveRoute(AGENT_ROUTING_RULES.singleFile.agent, "single file scope", input.configuredAgents);
+    }
+    // Rule 3: 验收审计 → patchwarden-audit
+    if (containsAny(text, AGENT_ROUTING_RULES.audit.keywords)) {
+        return resolveRoute(AGENT_ROUTING_RULES.audit.agent, "audit keywords", input.configuredAgents);
+    }
+    // Rule 4: 复杂推理和重构 → codex
+    if (containsAny(text, AGENT_ROUTING_RULES.refactor.keywords)) {
+        return resolveRoute(AGENT_ROUTING_RULES.refactor.agent, "refactor keywords", input.configuredAgents);
+    }
+    // Rule 5: 文档整理 → claude（fallback 到 opencode）
+    if (containsAny(text, AGENT_ROUTING_RULES.documentation.keywords)) {
+        const preferred = AGENT_ROUTING_RULES.documentation.agent;
+        const fallbackAgent = AGENT_ROUTING_RULES.documentation.fallbackAgent;
+        if (input.configuredAgents.includes(preferred)) {
+            return { recommended_agent: preferred, reason: "documentation keywords", fallback: false };
+        }
+        if (input.configuredAgents.includes(fallbackAgent)) {
+            return {
+                recommended_agent: fallbackAgent,
+                reason: `fallback: ${preferred} not configured, using ${fallbackAgent}`,
+                fallback: true,
+            };
+        }
+        const firstAgent = input.configuredAgents[0];
+        return {
+            recommended_agent: firstAgent,
+            reason: `fallback: ${preferred} not configured, using ${firstAgent}`,
+            fallback: true,
+        };
+    }
+    // Rule 6: 无匹配 → fallback 到 configuredAgents[0]
+    return {
+        recommended_agent: input.configuredAgents[0],
+        reason: `no specific routing rule matched, using default agent ${input.configuredAgents[0]}`,
+        fallback: true,
+    };
+}

package/dist/config.d.ts

@@ -15,7 +15,7 @@ export interface PatchWardenConfig {
     defaultTaskTimeoutSeconds: number;
     maxTaskTimeoutSeconds: number;
     watcherStaleSeconds: number;
-    toolProfile?: "full" | "chatgpt_core" | "chatgpt_direct";
+    toolProfile?: "full" | "chatgpt_core" | "chatgpt_direct" | "chatgpt_search";
     repoAliases?: Record<string, string>;
     enableAgentAssessment?: boolean;
     agentAssessmentTimeoutSeconds?: number;

package/dist/config.js

@@ -175,8 +175,12 @@ function normalizeConfig(config) {
     if (!Number.isInteger(config.watcherStaleSeconds) || config.watcherStaleSeconds < 5 || config.watcherStaleSeconds > 3600) {
         throw new Error("watcherStaleSeconds must be an integer from 5 to 3600");
     }
-    if (config.toolProfile !== undefined && config.toolProfile !== "full" && config.toolProfile !== "chatgpt_core" && config.toolProfile !== "chatgpt_direct") {
-        throw new Error('toolProfile must be "full", "chatgpt_core", or "chatgpt_direct"');
+    if (config.toolProfile !== undefined &&
+        config.toolProfile !== "full" &&
+        config.toolProfile !== "chatgpt_core" &&
+        config.toolProfile !== "chatgpt_direct" &&
+        config.toolProfile !== "chatgpt_search") {
+        throw new Error('toolProfile must be "full", "chatgpt_core", "chatgpt_direct", or "chatgpt_search"');
     }
     if (config.enableAgentAssessment !== undefined && typeof config.enableAgentAssessment !== "boolean") {
         throw new Error("enableAgentAssessment must be a boolean");