patchwarden 1.5.1 → 1.6.1

package/docs/architecture.md

@@ -1,63 +1,23 @@
 # PatchWarden Architecture
 
-PatchWarden is designed as a narrow control layer between an MCP client and
-local coding agents.
+PatchWarden 是一个本地优先的 MCP（Model Context Protocol）安全桥接器，通过 5 种运行角色（MCP Server / Watcher / Agent / Control Center / Desktop App）协同，为 AI agent 提供任务编排、安全守卫、变更证据收集与审计能力。
 
-## Roles
+## 详细文档
 
-```text
-ChatGPT / Codex / OpenCode / another MCP client
-                    |
-                    v
-          PatchWarden MCP Server
-                    |
-          save_plan / create_task
-                    |
-                    v
-       .patchwarden/tasks/<task_id>/
-                    |
-              Watcher finds task
-                    |
-                    v
-       Local agent (OpenCode / Codex)
-                    |
-                    v
- result.json / diff.patch / verify.json / status.json
-                    |
-                    v
-       MCP client reads safe summaries and audit evidence
-```
+- [Code Wiki](./CODE_WIKI.md) —— 完整项目架构、模块职责、关键类与函数说明、依赖关系、运行方式、现有缺陷
+- [Threat Model](./threat-model.md) —— 安全威胁模型与防护设计
+- [Control Center](./control-center/README.md) —— Control Center HTTP 管理界面文档
+- [Desktop App](./desktop-app.md) —— Electron 桌面应用文档
+- [Direct Session Workflow](./direct-session-workflow.md) —— Direct 模式会话工作流
+- [Task Safe Review Workflow](./task-safe-review-workflow.md) —— 任务安全审查工作流
 
-## Core Components
+## 一致性与资源边界
 
-| Component | Responsibility |
-| --- | --- |
-| MCP server | Exposes constrained planning, task, summary, audit, and status tools. |
-| Watcher | Polls queued tasks and starts preconfigured local agents. |
-| Agent registry | Defines trusted agent commands and argument templates. |
-| Command guard | Allows only exact verification commands from trusted configuration. |
-| Path guard | Keeps task paths under `workspaceRoot` and reports out-of-scope changes. |
-| Sensitive path guard | Blocks known credential and private-data file names. |
-| Evidence writer | Records status, result, verification, changed files, and audit artifacts. |
-| Control Center | Provides safe-first local review pages for tasks, direct sessions, lineage, warnings, and evidence packs. |
+- `.patchwarden/` 只是证据存储位置，不是敏感路径豁免区；敏感文件名在任意目录深度都阻断。
+- Goal 状态变更由跨进程 mutation lock 串行化并原子落盘；非空 Goal 的子目标全部 accepted 后自动转为 `completed`。
+- 子目标任务以 Goal 保存的 `repo_path` 为权威并拒绝 mismatch；worktree create/merge/discard 共享该仓库的 lifecycle lock。
+- task diff/summary/log tail 采用有界读取，`audit_task` 对文档数量和总字节设置预算，持续 invocation/reconcile 日志采用锁内有界追加并明确标记截断。
 
-## Data Flow
+## 历史版本
 
-1. A client saves a plan or creates a task with an explicit `repo_path`.
-2. PatchWarden validates the repository path and requested verification
-   commands.
-3. The task is written under `.patchwarden/tasks/<task_id>/`.
-4. The Watcher starts the selected registered agent.
-5. PatchWarden captures task status, changed files, Git diff evidence where
-   available, verification output, and audit summaries.
-6. The client reviews safe summaries first and asks for deeper artifacts only
-   when needed.
-
-## Safety Design
-
-PatchWarden treats model instructions as untrusted input. The local maintainer
-controls the workspace root, allowed commands, registered agents, and release
-process. The project intentionally keeps push, publish, tag, GitHub Release,
-and live service changes outside ordinary task execution.
-
-For the security model, see `docs/threat-model.md`.
+历史架构文档与阶段性设计已归档至 [archive/](./archive/)。

package/docs/control-center/README.md

@@ -15,13 +15,13 @@ PatchWarden has three control layers:
 From the repository root:
 
 ```powershell
-.\PatchWarden-Desktop.cmd
-.\PatchWarden-Control.cmd
-.\PatchWarden-Control-Tray.cmd --foreground
+.\scripts\launchers\PatchWarden-Desktop.cmd
+.\scripts\launchers\PatchWarden-Control.cmd
+.\scripts\launchers\PatchWarden-Control-Tray.cmd --foreground
 .\PatchWarden.cmd status all
 ```
 
-Use `PatchWarden-Control.cmd` for normal desktop use. Use the tray when you only
+Use `scripts\launchers\PatchWarden-Control.cmd` for normal desktop use. Use the tray when you only
 need quick controls. Use `PatchWarden.cmd` when you need explicit CLI output or
 automation-friendly commands.
 

package/docs/dashboard-overview.md

@@ -1,12 +1,12 @@
 # Dashboard 概览
 
 > 本文基于 v1.5.1 源码编写；安装时请使用已验证发布的 <published-version>。
-> 入口：`PatchWarden-Control.cmd` 或托盘菜单中的 "Open Control Center"。
+> 入口：`scripts\launchers\PatchWarden-Control.cmd` 或托盘菜单中的 "Open Control Center"。
 
 ## 目的
 
 PatchWarden Dashboard（Control Center）把本地 Agent 工作流从“只能看的状态面板”
-升级为“可操作的工作流控制中心”。所有操作默认走 safe 摘要接口，完整日志、diff、
+升级为“可操作的工作流控制中心”。所有操作默认走 safe 摘要接口，有界日志、diff、
 test log 仅在折叠的“高级区”按需加载，不改变 PatchWarden 的安全边界。
 
 ## 核心概念
@@ -28,7 +28,7 @@ test log 仅在折叠的“高级区”按需加载，不改变 PatchWarden 的
 | --- | --- |
 | Dashboard | Repo selector、Health Score、服务状态、Release 卡片、Project Policy、Lineage、Evidence Pack、Stale 任务提示、最近任务列表、系统状态（含 Copy diagnostics） |
 | Tasks | 任务列表，支持按 repo_path / status / acceptance_status / warning_type / agent / date range 过滤 |
-| Task Detail | safe 摘要默认视图 + 折叠的高级区（完整 result / diff / test_log） |
+| Task Detail | safe 摘要默认视图 + 折叠的高级区（配置上限内的 result / diff / test_log） |
 | Direct Sessions | 按 active / finalized / audited / expired 分组的 Direct 会话 |
 | Audit / Warnings | 按 warning 类型聚合的诊断页 |
 | Workspace | workspace 一级目录与项目列表 |
@@ -72,7 +72,7 @@ release_mode 摘要。
 ## 安全边界
 
 - 所有 safe 接口返回有界摘要，不包含完整日志、stdout/stderr tail、diff、密钥内容。
-- 完整 result / diff / test_log 只在折叠的高级区按需加载，永不自动加载。
+- 有界 result / diff / test_log 只在折叠的高级区按需加载，永不自动加载。
 - Project Policy 卡片只读，不能从 UI 修改策略。
 - 不执行远程写操作（npm publish / git push / git tag / gh release）。
 - Diagnostics 输出经过 `redactSensitiveContent` 脱敏。

package/docs/desktop-app.md

@@ -0,0 +1,175 @@
+# PatchWarden Windows Desktop
+
+PatchWarden Desktop is the installable Windows shell for the existing local
+Control Center. It does not add a remote shell or replace the MCP server. The
+desktop process starts the same loopback-only Control Center, displays it in an
+isolated Electron window, and keeps quick controls in the system tray.
+
+## Install
+
+1. Download `PatchWarden-Setup-<version>-x64.exe` (installed) or
+   `PatchWarden-Portable-<version>-x64.zip` (no install), plus
+   `PatchWarden-Desktop-SHA256SUMS.txt` from the matching GitHub Release.
+2. Verify the SHA256 value before running the installer.
+3. Install for the current Windows user. Administrator access is not required.
+4. Select a dedicated workspace, review detected local CLIs and models, and let
+   the read-only doctor finish.
+
+## First-run routes
+
+The first screen asks whether PatchWarden will be used through **ChatGPT
+Tunnel** or **Local MCP**. Local MCP can skip Platform Tunnel configuration.
+For ChatGPT, use the same eight steps shown in both READMEs:
+
+1. Confirm Platform Tunnel access and enable developer mode for the target ChatGPT workspace.
+2. Create a Tunnel in [Platform Tunnel settings](https://platform.openai.com/settings/organization/tunnels) and associate that workspace.
+3. Detect or choose an existing `tunnel-client.exe` in Desktop Settings.
+4. Enter the Core Tunnel ID and dedicated Tunnel runtime API key used as `CONTROL_PLANE_API_KEY`. It is not an application `OPENAI_API_KEY`.
+5. Configure and test the environment, direct, or credential-free HTTP/HTTPS/SOCKS5 (Mixed) proxy.
+6. Configure the Core profile, run `tunnel-client doctor --explain --json`, and start Core. The runtime key travels from the isolated renderer to the main process over bounded IPC, then to a one-time PowerShell process over stdin. It is DPAPI-encrypted only after doctor succeeds and is never placed in repository config, HTTP APIs, command arguments, logs, or returned objects.
+7. Confirm Tunnel ready, Watcher healthy, and the fixed 26-tool `chatgpt_core` catalog on Getting Started.
+8. In ChatGPT **Settings → Plugins**, create a developer-mode app, choose the Tunnel, reconnect, open a new chat, and call `health_check`.
+
+The current term is **developer-mode app / Plugins**; older releases called it
+a Connector. Direct remains optional and must be enabled explicitly. Start All
+starts Core and reports Direct as skipped while Direct is disabled; Stop All
+still covers both profiles.
+
+The setup flow searches `PATH`, current-user application directories, and a
+bounded area next to the selected workspace for `tunnel-client.exe`. If it is
+not found, continue into the read-only console and open **Settings > MCP and
+tunnel**. Use **Detect** or the dedicated file picker; it accepts only an
+existing file named `tunnel-client.exe`. PatchWarden never downloads or runs
+new software automatically. Download the Windows x64 build only from the
+trusted release source named by your tunnel provider and compare its SHA256
+with that release before selecting it.
+
+Prerequisites are Windows x64, Node.js 18 or newer, and the configured
+tunnel-client used by the existing Core/Direct launcher chain. Electron runs
+the desktop window and Control Center child, but does not replace those runtime
+requirements.
+
+The first unsigned desktop release may show Windows SmartScreen. Verify the
+checksum and GitHub Release source before choosing to continue. No updater or
+login startup entry is installed in v1.
+
+## Local agents and models
+
+Desktop supports Codex, OpenCode, Claude Code, Gemini CLI, GitHub Copilot CLI,
+Qwen Code, Kimi Code, and Aider. Settings detects only verified native
+executables or known npm package entry points and never launches Windows shell
+shims through a command shell.
+
+Model discovery reads only allowlisted model fields from each agent's normal
+JSON/JSONC, TOML, or YAML settings. It does not read `.env`, API keys, browser
+state, provider secrets, or session history. Online model listing is never run
+automatically; the user must select the refresh control for an agent that
+supports a bounded model-list command. Choosing **Follow agent default** omits
+the model argument so the agent retains its own precedence rules.
+
+## Local state
+
+- Desktop config: `%LOCALAPPDATA%\PatchWarden\patchwarden.config.json`
+- Desktop preferences: `%LOCALAPPDATA%\PatchWarden\desktop-preferences.json`
+- Desktop startup log: `%LOCALAPPDATA%\PatchWarden\desktop.log`
+- Control Center logs: `%LOCALAPPDATA%\patchwarden\control-center`
+- Tasks and evidence remain below the selected workspace.
+
+If `PATCHWARDEN_CONFIG` points to a valid config, the desktop app uses that path
+instead of creating the LocalAppData config. Config changes are written
+atomically and the previous file is retained as a timestamped `.bak-*` copy.
+Uninstalling the app does not remove config, tasks, evidence, or workspace data.
+
+## Runtime behavior
+
+- The app binds only to `127.0.0.1:8090` and reuses an existing verified
+  PatchWarden Control Center on that address.
+- A foreign listener on port 8090 is reported; the app never kills it or takes
+  the port.
+- Closing the window hides it to the tray by default. `Exit desktop app` stops
+  only the Control Center child owned by that app process.
+- Desktop-owned utility and PowerShell children receive a minimal runtime and
+  proxy environment. Provider variables require an explicit Agent allow-list,
+  while Control/Tunnel owner credentials are always removed. Windows
+  PowerShell and `where.exe` are resolved from the system directory rather than
+  the selected workspace or its current directory.
+- Backend restarts are serialized. A restart waits for the exact owned child to
+  emit `exit` (or reach a bounded timeout), and a configuration change received
+  during an active restart schedules one further restart instead of racing it.
+- `Stop all and exit` explicitly requests the existing bounded stop action for
+  Core/Direct before closing.
+- Start/restart succeeds only after the selected tunnel health endpoint is
+  ready and the Core watcher heartbeat is healthy. Early supervisor exits and
+  timeouts are reported with a reason and next steps.
+- Background start uses `run-background-supervisor.ps1` so the lifecycle API
+  returns without holding the long-running supervisor's output handles. The
+  wrapper writes bounded `supervisor.stdout.log` and `supervisor.stderr.log`
+  files while `supervisor-status.json` records only PID, state, timestamps, and
+  log paths.
+- The legacy CMD, PowerShell tray, and browser Dashboard remain supported.
+
+## MCP and proxy settings
+
+The desktop settings page can enable the Direct profile and configure tunnel
+proxy behavior. Direct remains disabled until the user explicitly enables it.
+
+- **Use environment proxy** inherits `HTTPS_PROXY` when it is present.
+- **No proxy** removes proxy variables for the launcher-owned tunnel process.
+- **Manual proxy** accepts only `http`, `https`, or `socks5` URLs without an
+  embedded username or password.
+
+Core and Direct can share one proxy definition or use separate definitions.
+PatchWarden does not store proxy credentials in URLs or logs.
+
+## Build from source
+
+Run from the repository in Windows PowerShell:
+
+```powershell
+npm.cmd ci
+npm.cmd run build
+npm.cmd install --prefix desktop --cache .\.npm-cache
+npm.cmd run desktop:test
+npm.cmd run desktop:preflight
+npm.cmd run desktop:package
+```
+
+Artifacts are written below `release\desktop`. Desktop dependencies remain in
+the private `desktop` package and are not included in the `patchwarden` npm
+package.
+
+Desktop staging must include `scripts/checks/mcp-manifest-check.js` and the
+root package-lock production dependency closure below `resources/core/node_modules`.
+Validate the unpacked runtime from a directory outside the repository so it
+cannot accidentally resolve dependencies from the developer checkout.
+
+`npm.cmd run desktop:preflight` automates that isolated validation and writes a
+privacy-bounded receipt in a unique `release/desktop-preflight-*` directory.
+The receipt records the branch, commit, dirty-state hashes, toolchain versions,
+check durations, package file count, runtime manifest digest, unpacked
+executable digest, and UI smoke result. It stores no diff content, credentials,
+configuration values, or browser state. The smoke process uses temporary
+`LOCALAPPDATA` / `APPDATA`, a nonexistent isolated config, and launcher-owned
+processes only.
+
+Viewport DOM metrics, page readiness, and the single-instance result are hard
+smoke gates. Electron screenshots are best-effort evidence because Windows
+graphics capture can be unavailable in CI sessions; capture failures are
+counted in the receipt without crashing Desktop. Local visual acceptance can
+pass `--require-screenshots` to `desktop/scripts/smoke-unpacked.mjs`, or use
+`--no-capture` while an external UI automation tool owns Windows Graphics
+Capture.
+
+For a release candidate, run `npm.cmd run desktop:preflight:release`. It rejects
+dirty worktrees. The regular preflight remains available for validating an
+intentional local working-tree baseline before it is committed.
+
+## Release checklist
+
+1. From a clean checkout, run `npm.cmd run desktop:preflight:release`, then the
+   full core validation chain and `npm.cmd run desktop:package`.
+2. Install and uninstall on a clean Windows x64 environment without elevation.
+3. Verify first-run setup, tray behavior, restart, explicit exit, and retained
+   user data after uninstall.
+4. Compare the installer SHA256 with the generated checksum file.
+5. Publish GitHub assets manually. npm publication remains a separate action.

package/docs/evidence-pack-schema.md

@@ -155,13 +155,13 @@ lineage 的有界摘要，不含完整 rounds 详情或 warnings/errors 原文
 
 ```json
 {
-  "patchwarden_version": "1.5.1",
-  "package_version": "1.5.1",
+  "patchwarden_version": "1.6.1",
+  "package_version": "1.6.1",
   "commit": "bc950a2",
   "node_version": "v20.11.0",
   "os": { "platform": "win32", "arch": "x64" },
   "tool_profile": "full",
-  "schema_epoch": "2026-07-05-v13",
+  "schema_epoch": "2026-07-19-v15",
   "generated_at": "2026-07-09T12:00:00.000Z"
 }
 ```

package/docs/open-source-application.md

@@ -56,19 +56,24 @@ evidence packs.
 
 ## Current Public Evidence
 
-Snapshot checked on 2026-07-12:
+Remote snapshot checked on 2026-07-19:
 
 - GitHub repository: `jiezeng2004-design/PatchWarden`
 - Stars: 2
 - Forks: 0
-- Open issues: 9 (`#25`, `#26`, `#28`–`#34`)
-- Open pull requests: 2 (`#24`, `#37`, both draft)
-- GitHub latest release: `v1.5.0`
-- npm latest dist-tag: `patchwarden@1.5.0`
-- Local source version in `package.json`: `1.5.1`
+- Open issues: 9
+- Open pull requests: 4
+- GitHub latest release: `v1.6.0`, published on 2026-07-16
+- npm latest dist-tag: `patchwarden@1.5.1`
 
-The source version is ahead of the latest public Release/npm package. Treat
-`1.5.1` as pending release work until GitHub Release and npm are verified.
+Local workspace facts, kept separate from the public snapshot:
+
+- Local source version in `package.json`: `1.6.1`
+- Local working branch: `codex/windows-desktop-tunnel-fixes`
+
+Local source is `v1.6.1`; the 2026-07-19 remote snapshot still records GitHub
+Release `v1.6.0` and npm `latest` `1.5.1`. Treat the publication surfaces as out
+of sync; local builds do not establish that either remote surface was updated.
 
 ## Existing Project Evidence
 
@@ -76,7 +81,7 @@ Repository-facing evidence already present:
 
 - `README.md` and `README.en.md` explain the MCP bridge model, safety boundary,
   setup, ChatGPT/Codex/OpenCode usage, and local data handling.
-- `CHANGELOG.md` records ongoing releases from the 1.0 line through 1.5.x.
+- `CHANGELOG.md` records ongoing releases from the 1.0 line through 1.6.1.
 - `SECURITY.md` directs vulnerability reports to GitHub private security
   advisories.
 - `CONTRIBUTING.md` documents local verification and safety expectations.
@@ -112,8 +117,9 @@ Known gaps before submission:
 - collect 3 to 5 real user reports through GitHub issues or discussions
 - record a live screencast if stronger evidence is needed; a privacy-safe
   scripted GIF now exists for the public maintainer workflow
-- finish the `1.5.1` release only after PR/CI, GitHub Release, npm, and
-  `dist-tags.latest` are all verified
+- resolve the release lag through the reviewed workflow; local source is
+  `1.6.1`, while the last verified GitHub Release is `1.6.0` and npm `latest`
+  / `dist-tags.latest` are `1.5.1`
 - add small contributor-friendly roadmap issues such as macOS docs, Codex CLI
   examples, and a minimal demo repository
 

package/docs/release-checklist.md

@@ -3,7 +3,7 @@
 PatchWarden releases remain confirmation-gated. Creating a tag or GitHub Release does not publish npm automatically.
 
 1. Work on a release branch and update `package.json`, changelog/release notes, README, examples, and tool manifests together.
-2. Run the complete local quality gates from `AGENTS.md`.
+2. Run the complete local quality gates from `AGENTS.md`. For Desktop, run `npm.cmd run desktop:preflight:release` from a clean checkout before creating the installer.
 3. Open a pull request, wait for `CI gate`, review the diff and package contents, then merge.
 4. Create the version tag from the verified merge commit.
 5. Create the GitHub Release and attach only reviewed release artifacts and checksums.

package/docs/release-evidence.md

@@ -5,25 +5,28 @@ before submitting external applications or publishing a release.
 
 ## Current Snapshot
 
-Checked on 2026-07-12 from the PatchWarden workspace.
+Remote facts checked on 2026-07-19. Local source and branch values were read
+from the PatchWarden workspace and are not evidence that a public package was
+published.
 
 | Surface | Current evidence |
 | --- | --- |
-| Local branch | `codex/evidence-pack-v2` |
-| Local `package.json` | `patchwarden@1.5.1` |
-| GitHub latest release | `v1.5.0` |
-| GitHub release URL | https://github.com/jiezeng2004-design/PatchWarden/releases/tag/v1.5.0 |
-| GitHub release published at | 2026-07-07T11:36:48Z |
-| npm latest | `patchwarden@1.5.0` |
-| npm `dist-tags.latest` | `1.5.0` |
+| Local branch | `codex/windows-desktop-tunnel-fixes` |
+| Local `package.json` | `patchwarden@1.6.1` |
+| GitHub latest release | `v1.6.0` |
+| GitHub release URL | https://github.com/jiezeng2004-design/PatchWarden/releases/tag/v1.6.0 |
+| GitHub release published on | 2026-07-16 |
+| npm latest | `patchwarden@1.5.1` |
+| npm `dist-tags.latest` | `1.5.1` |
 | GitHub stars | 2 |
 | GitHub forks | 0 |
-| Open issues | 9 (`#25`, `#26`, `#28`–`#34`) |
-| Open pull requests | 2 (`#24`, `#37`, both draft) |
+| Open issues | 9 |
+| Open pull requests | 4 |
 
-Conclusion: `1.5.0` is the latest verified public release. The local `1.5.1`
-source state is ahead of the public release and should be treated as pending
-until PR, CI, GitHub Release, npm, and `dist-tags.latest` are all verified.
+Conclusion: local source is `v1.6.1`; the last verified GitHub Release is
+`v1.6.0`, while npm `latest` remains `1.5.1`. Do not describe the public
+release surfaces as synchronized until GitHub, npm, and `dist-tags.latest` are
+independently verified at the intended version.
 
 ## Commands Used
 
@@ -31,29 +34,36 @@ Windows PowerShell:
 
 ```powershell
 gh repo view jiezeng2004-design/PatchWarden --json nameWithOwner,stargazerCount,forkCount,issues,pullRequests,defaultBranchRef,pushedAt,url,description,licenseInfo,repositoryTopics,latestRelease,hasDiscussionsEnabled,hasIssuesEnabled,securityPolicyUrl
-gh release view v1.5.1 --repo jiezeng2004-design/PatchWarden --json tagName,name,publishedAt,isDraft,isPrerelease,url
+gh release view v1.6.0 --repo jiezeng2004-design/PatchWarden --json tagName,name,publishedAt,isDraft,isPrerelease,url
 gh release view --repo jiezeng2004-design/PatchWarden --json tagName,name,publishedAt,isDraft,isPrerelease,url
 npm.cmd view patchwarden version dist-tags --json --cache .\.npm-cache
 ```
 
-The npm query succeeded on 2026-07-12 with the repository-local `.npm-cache`:
-`version=1.5.0`, `dist-tags.latest=1.5.0`.
+The npm query was verified on 2026-07-19: `version=1.5.1` and
+`dist-tags.latest=1.5.1`.
 
-## Local Verification Snapshot
+## Local Verification Snapshot (Separate From Remote Truth)
 
-- `npm.cmd run build`: passed.
-- `npm.cmd run test:unit`: 716 tests, 714 passed, 2 skipped, 0 failed.
-- `npm.cmd run doctor:ci`: 83 OK, 0 warnings, 0 failures.
-- `npm.cmd run verify:package`: passed; 584 package files, no private local launchers.
-- `npm.cmd test`: passed in 284.5 seconds in an approved Windows child-process
-  environment. This includes 139 security smoke checks, 716 unit tests (714
-  passed, 2 skipped), 22 lifecycle checks, doctor, tunnel/watcher supervisors,
-  Windows control, MCP manifest, brand, and 32 Control Center checks.
+The following 2026-07-19 baseline checks describe the local working tree only.
+They do not prove GitHub/npm publication state, and the complete gate must be
+rerun after the current optimization work finishes.
+
+- Root TypeScript `--noEmit` and the Desktop TypeScript build: passed.
+- Targeted reliability/security tests: 49 passed; targeted Desktop backend
+  lifecycle tests: 8 passed.
+- `npm.cmd test`: passed on the second baseline run, including 139/139 security
+  checks, 747 passed and 2 skipped unit tests, 22/22 lifecycle checks, and
+  32/32 Control Center checks. An earlier run exposed one Git commit setup
+  flake; the test setup was then hardened.
 - `npm.cmd run test:mcp`: passed.
-- `npm.cmd run test:http-mcp`: 13 passed, 0 failed, including owner-token checks.
-- `npm.cmd run pack:clean` was not run here because it removes and recreates
-  release artifacts; run it only in an explicitly approved release-preparation
-  workspace.
+- `npm.cmd run test:http-mcp`: 13 passed, 0 failed.
+- `npm.cmd run desktop:test`: 41 passed, 0 failed at the baseline snapshot.
+- Root and Desktop dependency audits: 0 known vulnerabilities.
+- `npm.cmd run pack:clean` was not run for this historical baseline. Current
+  versions recreate only `release/package/` plus the two root package archives;
+  Desktop and preflight siblings under `release/` are preserved. It still
+  overwrites those package artifacts, so run it only during explicitly approved
+  release preparation.
 
 ## Release Verification Checklist
 

package/docs/task-safe-review-workflow.md

@@ -18,7 +18,7 @@
 - **safe_audit**：审计摘要，包含 artifact 完整性、scope_changes、命令白名单合规性
   的有界摘要。
 - **acceptance_status**：任务的验收状态，比 `status` 更能反映“是否真的通过”。
-- **Advanced 区**：折叠区域，包含完整 result / diff / test_log，需手动展开。
+- **Advanced 区**：折叠区域，包含配置上限内的 result / diff / test_log，需手动展开。
 
 ## 验收工作流
 
@@ -54,11 +54,11 @@ Task Detail 默认展示 safe 摘要视图：
 ### 4. 仅在必要时展开高级区
 
 只有当 safe 摘要无法定论时（例如 `manual_verification_required` 为 true，
-或 `fail_checks` 指向某个具体失败），才展开高级区查看完整产物：
+或 `fail_checks` 指向某个具体失败），才展开高级区查看配置上限内的产物：
 
-- 完整 result（JSON）
-- 完整 diff
-- 完整 test_log
+- 有界并脱敏的 result（JSON）
+- 有界并脱敏的 diff
+- 有界并脱敏的 test_log
 
 > 高级区内容不会自动加载，必须手动点击展开。展开不会触发任何写操作。
 

package/docs/threat-model.md

@@ -41,6 +41,11 @@ local confirmation tickets.
 | Prompt injection | Repository text instructs the model to ignore safety constraints. | Safety is enforced by local code and configuration, not by prompt instructions alone. |
 | Unsafe release claims | A local build passes and the agent claims npm/GitHub publish is complete. | Release docs require separate verification of PR/CI, GitHub Release, npm version, and `dist-tags.latest`. |
 | Evidence overload | A client requests full logs, diffs, or private task history by default. | Safe summary tools and bounded evidence packs are the preferred review surfaces. |
+| Evidence secret persistence | An agent writes a token into a normal source file and the Git diff duplicates it under `.patchwarden`. | Diff evidence is capped at 20 MiB, redacted before persistence, and credential-like content produces a policy violation. |
+| Artifact-directory confusion | A secret-shaped filename is placed under `.patchwarden` and assumed safe because it is an internal artifact. | The sensitive-name guard applies at every depth; `.patchwarden` has no blanket exemption. |
+| Concurrent Goal/worktree mutation | Two MCP processes accept subgoals or create/merge/discard worktrees at the same time and lose state or corrupt repository lifecycle. | Goal mutations share a cross-process lock and atomic replacement; worktree repository mutations share a lifecycle lock. |
+| Evidence resource exhaustion | Oversized task logs or a large documentation tree consume unbounded memory, response size, or disk. | Task and Control reads use bounded prefix/tail reads, audit scans enforce file/byte budgets, and persistent invocation/reconcile logs use locked bounded append with explicit truncation. |
+| DNS rebinding | A hostile web origin resolves to `127.0.0.1` and tries to read the Control token or call HTTP MCP. | Control Center and HTTP MCP reject Host headers other than the configured `127.0.0.1`/`localhost` origin. |
 | Live-service disruption | A task restarts tunnels, watchers, or unrelated processes. | Project rules forbid blanket process kills; live cutover must be explicit and separately approved. |
 
 ## Security Invariants
@@ -50,10 +55,23 @@ PatchWarden changes should preserve these invariants:
 - no general-purpose remote shell
 - all task repositories stay under `workspaceRoot`
 - agents are explicitly registered before use
+- child processes receive a minimal environment; provider variables require an
+  explicit per-agent `envAllowlist`, and Tunnel owner credentials are never
+  forwarded
 - model input cannot define arbitrary agent launch commands
 - verification commands use exact allowlist matching
-- sensitive paths remain blocked
+- sensitive paths remain blocked at every directory depth, including under
+  `.patchwarden`
 - task artifacts remain auditable and redacted where appropriate
+- Goal status mutations and worktree repository lifecycle changes are
+  cross-process serialized; a non-empty Goal becomes completed only after all
+  subgoals are accepted
+- subgoal tasks use the Goal's stored `repo_path` as authority and reject a
+  caller-supplied repository mismatch
+- task/audit/log read and append paths enforce explicit byte, line, or file
+  budgets and report truncation
+- Direct patch/sync accepts only bounded UTF-8 text, rejects credential-like
+  results, and serializes session mutations
 - scope violations are surfaced, not silently accepted
 - publish, push, tag, release, and live-service operations remain
   confirmation-gated

package/examples/config.example.json

@@ -6,11 +6,13 @@
   "agents": {
     "codex": {
       "command": "codex",
-      "args": ["exec", "--cd", "{repo}", "{prompt}"]
+      "args": ["exec", "--cd", "{repo}", "{prompt}"],
+      "envAllowlist": []
     },
     "opencode": {
       "command": "opencode",
-      "args": ["run", "{prompt}"]
+      "args": ["run", "{prompt}"],
+      "envAllowlist": []
     }
   },
   "allowedTestCommands": [