patchwarden 1.5.1 → 1.6.1

package/dist/assessments/agentAssessor.js

@@ -1,8 +1,9 @@
-import { writeFileSync } from "node:fs";
-import { resolve, relative, isAbsolute } from "node:path";
+import { resolve, relative, isAbsolute, sep } from "node:path";
 import { buildAgentInvocation, buildAssessmentPrompt } from "../runner/agentInvocation.js";
 import { runSimpleProcessSync } from "../runner/simpleProcess.js";
 import { captureRepoSnapshot, compareSnapshots } from "../runner/changeCapture.js";
+import { atomicWriteFileSync, atomicWriteJsonFileSync } from "../utils/atomicFile.js";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
 const ASSESSMENT_MARKER = "===ASSESSMENT_JSON===";
 export async function runAgentAssessment(input) {
     const logPaths = {
@@ -26,9 +27,11 @@ export async function runAgentAssessment(input) {
         log_paths: logPaths,
     };
     // ── 1. Build prompt and write to file for {prompt_file} support ──
-    const assessmentPrompt = buildAssessmentPrompt(input.goal, input.planContent, input.repoPath);
+    const safeGoal = redactSensitiveContent(input.goal).content.slice(0, 10_000);
+    const safePlan = redactSensitiveContent(input.planContent).content.slice(0, 1024 * 1024);
+    const assessmentPrompt = buildAssessmentPrompt(safeGoal, safePlan, input.repoPath);
     const promptFilePath = resolve(input.assessmentDir, "agent-assessment-prompt.md");
-    writeFileSync(promptFilePath, assessmentPrompt, "utf-8");
+    atomicWriteFileSync(promptFilePath, assessmentPrompt);
     logPaths.prompt = promptFilePath;
     // ── 2. Before snapshot (repo-scoped) ──
     let repoBefore;
@@ -68,6 +71,8 @@ export async function runAgentAssessment(input) {
         maxStderrBytes: Math.max(16384, Math.floor(input.maxOutputBytes / 4)),
         stdoutPath: logPaths.stdout,
         stderrPath: logPaths.stderr,
+        environmentVariableNames: invocation.environmentVariableNames,
+        blockedEnvironmentVariableNames: invocation.blockedEnvironmentVariableNames,
     });
     // ── 5. After snapshot + read-only violation check ──
     let readOnlyViolation = false;
@@ -101,11 +106,11 @@ export async function runAgentAssessment(input) {
             stderr_truncated: result.stderrTruncated,
             log_paths: { ...logPaths, violation: resolve(input.assessmentDir, "agent-assessment-violation.json") },
         };
-        writeFileSync(summary.log_paths.violation, JSON.stringify({
+        atomicWriteJsonFileSync(summary.log_paths.violation, {
             violation: "read_only_violation",
             files: violationFiles,
             exit_code: result.exitCode,
-        }, null, 2), "utf-8");
+        });
         writeSummary(logPaths.assessment, summary);
         return summary;
     }
@@ -216,13 +221,17 @@ function parseAssessmentJson(stdout, repoPath) {
     const jsonEnd = jsonText.lastIndexOf("}");
     if (jsonStart < 0 || jsonEnd < 0 || jsonEnd <= jsonStart)
         return { output: null, sanitized_reasons };
-    let parsed;
+    let parsedValue;
     try {
-        parsed = JSON.parse(jsonText.slice(jsonStart, jsonEnd + 1));
+        parsedValue = JSON.parse(jsonText.slice(jsonStart, jsonEnd + 1));
     }
     catch {
         return { output: null, sanitized_reasons };
     }
+    if (!parsedValue || typeof parsedValue !== "object" || Array.isArray(parsedValue)) {
+        return { output: null, sanitized_reasons };
+    }
+    const parsed = parsedValue;
     // ── Strict validation ──
     if (parsed.risk_level !== "low" && parsed.risk_level !== "medium" && parsed.risk_level !== "high") {
         return { output: null, sanitized_reasons };
@@ -235,7 +244,7 @@ function parseAssessmentJson(stdout, repoPath) {
         return { output: null, sanitized_reasons };
     if (parsed.reason_codes.length > 50)
         return { output: null, sanitized_reasons };
-    const reasonCodes = parsed.reason_codes.filter((r) => typeof r === "string" && r.length <= 100);
+    const reasonCodes = parsed.reason_codes.filter((reason) => typeof reason === "string" && reason.length <= 100);
     if (reasonCodes.length !== parsed.reason_codes.length) {
         sanitized_reasons.push("reason_codes_filtered");
     }
@@ -257,7 +266,7 @@ function parseAssessmentJson(stdout, repoPath) {
         }
         const resolved = resolve(repoPath, p);
         const rel = relative(repoPath, resolved);
-        if (rel.startsWith("..")) {
+        if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
             pathsSanitized = true;
             continue;
         }
@@ -270,7 +279,7 @@ function parseAssessmentJson(stdout, repoPath) {
         return { output: null, sanitized_reasons };
     if (parsed.destructive_actions.length > 20)
         return { output: null, sanitized_reasons };
-    const destructiveActions = parsed.destructive_actions.filter((d) => typeof d === "string" && d.length <= 200);
+    const destructiveActions = parsed.destructive_actions.filter((action) => typeof action === "string" && action.length <= 200);
     if (typeof parsed.requires_user_confirm !== "boolean")
         return { output: null, sanitized_reasons };
     const notes = typeof parsed.notes === "string" ? parsed.notes.slice(0, 2000) : "";
@@ -289,5 +298,5 @@ function parseAssessmentJson(stdout, repoPath) {
     };
 }
 function writeSummary(path, summary) {
-    writeFileSync(path, JSON.stringify(summary, null, 2), "utf-8");
+    atomicWriteJsonFileSync(path, summary);
 }

package/dist/assessments/assessmentStore.js

@@ -1,11 +1,14 @@
-import { mkdirSync, writeFileSync, existsSync, readFileSync, renameSync, } from "node:fs";
+import { mkdirSync, existsSync, readFileSync, } from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
 import { resolve, join } from "node:path";
 import { getAssessmentsDir, getConfig, getRepoAllowedTestCommands } from "../config.js";
 import { guardPath } from "../security/pathGuard.js";
 import { PatchWardenError } from "../errors.js";
+import { redactSensitiveContent } from "../security/contentRedaction.js";
+import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
+import { withFileLockSync } from "../utils/lockedJsonFile.js";
 import { TOOL_SCHEMA_EPOCH } from "../version.js";
-import { getLastToolCatalogSnapshot } from "../tools/toolCatalog.js";
+import { getLastToolCatalogSnapshot } from "../tools/catalog/toolCatalog.js";
 import { captureRepoSnapshot } from "../runner/changeCapture.js";
 const SENSITIVE_PATH_RULES_SIGNATURE = "v1";
 const ARTIFACT_RULES_SIGNATURE = "v1";
@@ -71,7 +74,7 @@ export function createAssessment(input) {
         repo_path: input.repo_path,
         resolved_repo_path: input.resolved_repo_path,
         template: input.template || null,
-        goal: input.goal || null,
+        goal: input.goal ? redactSensitiveContent(input.goal).content : null,
         test_command: input.test_command || null,
         verify_commands: input.verify_commands || [],
         agent: input.agent,
@@ -83,7 +86,7 @@ export function createAssessment(input) {
         confirm_code: null,
         agent_assessment_summary: input.agent_assessment_summary || null,
     };
-    writeFileSync(join(dir, "assessment.json"), JSON.stringify(record, null, 2), "utf-8");
+    atomicWriteJsonFileSync(join(dir, "assessment.json"), record);
     return record;
 }
 export function readAssessment(assessmentId) {
@@ -160,6 +163,9 @@ export async function confirmAssessment(assessmentId) {
     if (!/^assessment_\d{8}_\d{6}_[0-9a-f]{32}$/.test(assessmentId)) {
         throw new PatchWardenError("assessment_id_invalid", "Local confirmation requires the full assessment_id (32 hexadecimal random characters).", "Copy the complete assessment_id from the assess_only response; assessment_short_id is display-only.");
     }
+    const config = getConfig();
+    const assessmentFile = resolve(getAssessmentsDir(config), assessmentId, "assessment.json");
+    guardPath(assessmentFile, config.workspaceRoot, config.assessmentsDir);
     const assessment = readAssessment(assessmentId);
     if (assessment.decision !== "needs_confirm" || !assessment.requires_confirm) {
         throw new PatchWardenError("assessment_confirmation_not_allowed", `Assessment "${assessmentId}" has decision "${assessment.decision}" and cannot be locally confirmed.`, assessment.decision === "blocked"
@@ -167,37 +173,39 @@ export async function confirmAssessment(assessmentId) {
             : "This assessment does not require confirmation; execute it with the minimal assessment_id call.");
     }
     const snapshot = await captureRepoSnapshot(assessment.resolved_repo_path);
-    const validation = validateAssessmentFreshness(assessmentId, snapshot, {
-        allow_unconfirmed: true,
-        // A standalone CLI has no active MCP profile snapshot. The execute path
-        // still performs the full tool-manifest check before creating the task.
-        skip_tool_manifest: true,
+    // Re-read and write while holding one cross-process lock. Concurrent local
+    // confirmers may compute snapshots in parallel, but they cannot replace one
+    // another's confirmation metadata from a stale assessment record.
+    return withFileLockSync(assessmentFile, () => {
+        const validation = validateAssessmentFreshness(assessmentId, snapshot, {
+            allow_unconfirmed: true,
+            // A standalone CLI has no active MCP profile snapshot. The execute path
+            // still performs the full tool-manifest check before creating the task.
+            skip_tool_manifest: true,
+        });
+        if (!validation.valid || !validation.assessment) {
+            throw new PatchWardenError(validation.failure_reason || "assessment_validation_failed", `Assessment "${assessmentId}" cannot be confirmed: ${validation.failure_reason || "validation_failed"}.`, "Run create_task with execution_mode=assess_only again, then confirm the new assessment locally.");
+        }
+        if (validation.assessment.decision !== "needs_confirm" || !validation.assessment.requires_confirm) {
+            throw new PatchWardenError("assessment_confirmation_not_allowed", `Assessment "${assessmentId}" is no longer eligible for local confirmation.`, "Run create_task with execution_mode=assess_only again.");
+        }
+        const confirmedAt = validation.assessment.confirmed_at || new Date().toISOString();
+        const confirmedRecord = {
+            ...validation.assessment,
+            confirmed: true,
+            confirmed_at: confirmedAt,
+            confirm_code: validation.assessment.confirm_code || randomBytes(8).toString("hex"),
+        };
+        atomicWriteJsonFileSync(assessmentFile, confirmedRecord);
+        return {
+            assessment_id: assessmentId,
+            decision: "needs_confirm",
+            confirmed: true,
+            confirmed_at: confirmedAt,
+            expires_at: confirmedRecord.expires_at,
+            next_action: "Call create_task with only execution_mode=execute and this full assessment_id.",
+        };
     });
-    if (!validation.valid || !validation.assessment) {
-        throw new PatchWardenError(validation.failure_reason || "assessment_validation_failed", `Assessment "${assessmentId}" cannot be confirmed: ${validation.failure_reason || "validation_failed"}.`, "Run create_task with execution_mode=assess_only again, then confirm the new assessment locally.");
-    }
-    const confirmedAt = validation.assessment.confirmed_at || new Date().toISOString();
-    const confirmedRecord = {
-        ...validation.assessment,
-        confirmed: true,
-        confirmed_at: confirmedAt,
-        confirm_code: validation.assessment.confirm_code || randomBytes(8).toString("hex"),
-    };
-    const config = getConfig();
-    const assessmentFile = resolve(getAssessmentsDir(config), assessmentId, "assessment.json");
-    guardPath(assessmentFile, config.workspaceRoot, config.assessmentsDir);
-    const temporaryFile = `${assessmentFile}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
-    guardPath(temporaryFile, config.workspaceRoot, config.assessmentsDir);
-    writeFileSync(temporaryFile, JSON.stringify(confirmedRecord, null, 2), "utf-8");
-    renameSync(temporaryFile, assessmentFile);
-    return {
-        assessment_id: assessmentId,
-        decision: "needs_confirm",
-        confirmed: true,
-        confirmed_at: confirmedAt,
-        expires_at: confirmedRecord.expires_at,
-        next_action: "Call create_task with only execution_mode=execute and this full assessment_id.",
-    };
 }
 export function computeWorkspaceFingerprint(snapshot) {
     const fileHashes = Object.entries(snapshot.files)

package/dist/config.d.ts

@@ -1,6 +1,9 @@
 export interface AgentConfig {
     command: string;
     args: string[];
+    envAllowlist?: string[];
+    adapter?: string;
+    model?: string;
 }
 export interface PatchWardenConfig {
     workspaceRoot: string;
@@ -29,6 +32,18 @@ export interface PatchWardenConfig {
     agentAssessmentMaxOutputBytes?: number;
     agentAssessmentAgentName?: string;
     enableDirectProfile?: boolean;
+    tunnelClientPath?: string;
+    tunnelProxy?: {
+        scope: "shared" | "separate";
+        core: {
+            mode: "environment" | "none" | "manual";
+            url?: string;
+        };
+        direct: {
+            mode: "environment" | "none" | "manual";
+            url?: string;
+        };
+    };
     directSessionsDir: string;
     directSessionTtlSeconds: number;
     directMaxPatchBytes: number;

package/dist/config.js

@@ -1,5 +1,6 @@
 import { readFileSync, existsSync } from "node:fs";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { basename, isAbsolute, relative, resolve, sep } from "node:path";
+import { validateWorkspaceRoot } from "./security/workspaceRootGuard.js";
 // ── Defaults ──────────────────────────────────────────────────────
 const DEFAULT_CONFIG = {
     workspaceRoot: process.cwd(),
@@ -7,16 +8,7 @@ const DEFAULT_CONFIG = {
     tasksDir: ".patchwarden/tasks",
     assessmentsDir: ".patchwarden/assessments",
     assessmentTtlSeconds: 3600,
-    agents: {
-        codex: {
-            command: "codex",
-            args: ["exec", "--cd", "{repo}", "{prompt}"],
-        },
-        opencode: {
-            command: "opencode",
-            args: ["run", "{prompt}"],
-        },
-    },
+    agents: {},
     allowedTestCommands: [
         "npm test",
         "npm run test",
@@ -123,6 +115,11 @@ function normalizeConfig(config) {
     if (!config.workspaceRoot || typeof config.workspaceRoot !== "string") {
         throw new Error("workspaceRoot must be a non-empty string");
     }
+    const workspaceValidation = validateWorkspaceRoot(config.workspaceRoot);
+    if (!workspaceValidation.ok) {
+        throw new Error(`Invalid workspaceRoot: ${workspaceValidation.reason} (${workspaceValidation.path})`);
+    }
+    config.workspaceRoot = workspaceValidation.path;
     if (!config.plansDir || typeof config.plansDir !== "string") {
         throw new Error("plansDir must be a non-empty string");
     }
@@ -138,6 +135,21 @@ function normalizeConfig(config) {
     if (!config.agents || typeof config.agents !== "object") {
         throw new Error("agents must be an object");
     }
+    const agents = {};
+    for (const [agentName, agent] of Object.entries(config.agents)) {
+        if (!agent || typeof agent !== "object" || typeof agent.command !== "string" || !Array.isArray(agent.args)) {
+            throw new Error(`agents["${agentName}"] must define command and args`);
+        }
+        const envAllowlist = agent.envAllowlist ?? [];
+        if (!Array.isArray(envAllowlist) || envAllowlist.some((name) => typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))) {
+            throw new Error(`agents["${agentName}"].envAllowlist must contain only environment variable names`);
+        }
+        const blockedNames = new Set(["CONTROL_PLANE_API_KEY", "PATCHWARDEN_OWNER_TOKEN", config.http?.ownerTokenEnv?.toUpperCase()]);
+        const blocked = envAllowlist.find((name) => blockedNames.has(name.toUpperCase()));
+        if (blocked)
+            throw new Error(`agents["${agentName}"].envAllowlist cannot include reserved variable "${blocked}"`);
+        agents[agentName] = { ...agent, args: [...agent.args], envAllowlist: [...new Set(envAllowlist)] };
+    }
     if (!Array.isArray(config.allowedTestCommands)) {
         throw new Error("allowedTestCommands must be an array");
     }
@@ -209,8 +221,10 @@ function normalizeConfig(config) {
         if (config.http.host !== undefined && typeof config.http.host !== "string") {
             throw new Error("http.host must be a string");
         }
-        if (config.http.ownerTokenEnv !== undefined && typeof config.http.ownerTokenEnv !== "string") {
-            throw new Error("http.ownerTokenEnv must be a string");
+        if (config.http.ownerTokenEnv !== undefined
+            && (typeof config.http.ownerTokenEnv !== "string"
+                || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(config.http.ownerTokenEnv))) {
+            throw new Error("http.ownerTokenEnv must be a valid environment variable name");
         }
     }
     if (config.enableRunTaskTool !== undefined && typeof config.enableRunTaskTool !== "boolean") {
@@ -235,6 +249,44 @@ function normalizeConfig(config) {
     if (config.enableDirectProfile !== undefined && typeof config.enableDirectProfile !== "boolean") {
         throw new Error("enableDirectProfile must be a boolean");
     }
+    if (config.tunnelClientPath !== undefined) {
+        if (typeof config.tunnelClientPath !== "string" || !isAbsolute(config.tunnelClientPath)) {
+            throw new Error("tunnelClientPath must be an absolute path");
+        }
+        if (basename(config.tunnelClientPath).toLowerCase() !== "tunnel-client.exe") {
+            throw new Error("tunnelClientPath must point to tunnel-client.exe");
+        }
+    }
+    if (config.tunnelProxy !== undefined) {
+        if (!config.tunnelProxy || typeof config.tunnelProxy !== "object" || !["shared", "separate"].includes(config.tunnelProxy.scope)) {
+            throw new Error("tunnelProxy.scope must be shared or separate");
+        }
+        for (const key of ["core", "direct"]) {
+            const endpoint = config.tunnelProxy[key];
+            if (!endpoint || typeof endpoint !== "object" || !["environment", "none", "manual"].includes(endpoint.mode)) {
+                throw new Error(`tunnelProxy.${key}.mode must be environment, none, or manual`);
+            }
+            if (endpoint.mode === "manual") {
+                if (typeof endpoint.url !== "string")
+                    throw new Error(`tunnelProxy.${key}.url is required in manual mode`);
+                let parsed;
+                try {
+                    parsed = new URL(endpoint.url);
+                }
+                catch {
+                    throw new Error(`tunnelProxy.${key}.url must be a valid URL`);
+                }
+                if (!["http:", "https:", "socks5:"].includes(parsed.protocol)) {
+                    throw new Error(`tunnelProxy.${key}.url must use http, https, or socks5`);
+                }
+                if (parsed.username || parsed.password)
+                    throw new Error(`tunnelProxy.${key}.url must not contain credentials`);
+            }
+            else if (endpoint.url !== undefined) {
+                throw new Error(`tunnelProxy.${key}.url is only allowed in manual mode`);
+            }
+        }
+    }
     if (!config.directSessionsDir || typeof config.directSessionsDir !== "string") {
         throw new Error("directSessionsDir must be a non-empty string");
     }
@@ -276,6 +328,7 @@ function normalizeConfig(config) {
     }
     return {
         ...config,
+        agents,
         workspaceRoot: resolve(config.workspaceRoot),
         allowedTestCommands: [...new Set(config.allowedTestCommands.map((command) => command.trim()))],
         repoAllowedTestCommands,

package/dist/control/fileManager.d.ts

@@ -0,0 +1,2 @@
+/** Launch a trusted platform file manager without inheriting ambient secrets. */
+export declare function launchFileManager(target: string, cwd: string): boolean;

package/dist/control/fileManager.js

@@ -0,0 +1,39 @@
+import { spawn } from "node:child_process";
+import { join } from "node:path";
+import { buildChildEnvironment, resolveTrustedExecutable } from "../runner/processSecurity.js";
+const FILE_MANAGER_ENVIRONMENT = [
+    "DISPLAY",
+    "WAYLAND_DISPLAY",
+    "DBUS_SESSION_BUS_ADDRESS",
+    "XDG_RUNTIME_DIR",
+];
+/** Launch a trusted platform file manager without inheriting ambient secrets. */
+export function launchFileManager(target, cwd) {
+    try {
+        const env = buildChildEnvironment({ cwd, allowedNames: FILE_MANAGER_ENVIRONMENT });
+        const requested = fileManagerCommand(env);
+        const command = resolveTrustedExecutable(requested, cwd, { pathValue: env.PATH });
+        const child = spawn(command, [target], {
+            cwd,
+            detached: true,
+            env,
+            stdio: "ignore",
+            windowsHide: true,
+        });
+        child.on("error", () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function fileManagerCommand(env) {
+    if (process.platform === "win32") {
+        const windowsRoot = env.SystemRoot || env.WINDIR;
+        return windowsRoot ? join(windowsRoot, "explorer.exe") : "explorer.exe";
+    }
+    if (process.platform === "darwin")
+        return "open";
+    return "xdg-open";
+}

package/dist/control/middleware/auth.d.ts

@@ -8,3 +8,9 @@
  */
 import { type IncomingMessage } from "node:http";
 export declare function checkControlToken(req: IncomingMessage): boolean;
+/**
+ * Reject non-loopback Host headers before exposing the browser-readable
+ * control token. Binding to 127.0.0.1 alone does not prevent DNS rebinding.
+ */
+export declare function isTrustedControlHost(req: IncomingMessage, expectedPort: number): boolean;
+export declare function isTrustedControlHostHeader(value: string | string[] | undefined, expectedPort: number): boolean;

package/dist/control/middleware/auth.js

@@ -1,8 +1,17 @@
+import { firstHeaderValue, timingSafeStringEqual } from "../../security/secretComparison.js";
+import { isTrustedLoopbackHostHeader } from "../../security/loopbackHost.js";
 import { controlToken } from "../shared.js";
 export function checkControlToken(req) {
-    const header = req.headers["x-patchwarden-control-token"];
-    const provided = Array.isArray(header) ? header[0] : header;
-    if (typeof provided !== "string" || provided.length === 0)
-        return false;
-    return provided === controlToken;
+    const provided = firstHeaderValue(req.headers["x-patchwarden-control-token"]);
+    return provided.length > 0 && timingSafeStringEqual(provided, controlToken);
+}
+/**
+ * Reject non-loopback Host headers before exposing the browser-readable
+ * control token. Binding to 127.0.0.1 alone does not prevent DNS rebinding.
+ */
+export function isTrustedControlHost(req, expectedPort) {
+    return isTrustedControlHostHeader(req.headers.host, expectedPort);
+}
+export function isTrustedControlHostHeader(value, expectedPort) {
+    return isTrustedLoopbackHostHeader(value, expectedPort);
 }

package/dist/control/middleware/static.js

@@ -5,7 +5,7 @@
  * assets, css) with path-traversal protection, plus the inline SVG favicon.
  * Content types are mapped from `CONTENT_TYPES` in shared.ts.
  */
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { extname, isAbsolute, relative, resolve } from "node:path";
 import { CONTENT_TYPES, CONTROL_CENTER_FAVICON, errorMessage, sendJson, uiRoot, } from "../shared.js";
 export function serveStatic(res, urlPath) {
@@ -45,9 +45,22 @@ export function serveStatic(res, urlPath) {
             sendJson(res, 404, { error: "Not found" });
             return;
         }
-        const ext = extname(candidate).toLowerCase();
+        // Resolve links before reading. Lexical `..` checks alone do not stop a
+        // symlink or junction inside `ui/` from pointing outside the bundle.
+        const realRoot = realpathSync(uiRoot);
+        const realCandidate = realpathSync(candidate);
+        const realRelative = relative(realRoot, realCandidate);
+        if (realRelative === "" || realRelative.startsWith("..") || isAbsolute(realRelative)) {
+            sendJson(res, 403, { error: "Forbidden" });
+            return;
+        }
+        if (!statSync(realCandidate).isFile()) {
+            sendJson(res, 404, { error: "Not found" });
+            return;
+        }
+        const ext = extname(realCandidate).toLowerCase();
         const contentType = CONTENT_TYPES[ext] || "application/octet-stream";
-        const content = readFileSync(candidate);
+        const content = readFileSync(realCandidate);
         res.writeHead(200, { "Content-Type": contentType });
         res.end(content);
     }

package/dist/control/routeTable.d.ts

@@ -0,0 +1,24 @@
+/**
+ * PatchWarden Control Center — declarative route table.
+ *
+ * Exports `buildRoutes(parsedUrl)` which returns the full `Route[]` array
+ * consumed by `server.ts`'s `handleRequest`. Routes that need query-string
+ * parameters (e.g. `/api/tasks`, `/api/logs/:category`) close over `parsedUrl`
+ * via the `query` helper, so each request gets its own self-contained table
+ * without module-scoped request state. This keeps concurrent requests safe.
+ *
+ * Ordering rules:
+ *   - GET routes first, POST routes second.
+ *   - Within each method, more specific patterns precede generic `:id`
+ *     patterns (e.g. `/api/tasks/stale` before `/api/tasks/:id`).
+ *   - Static asset routes (`/`, `/favicon.ico`, CSS/JS, `/pages/`,
+ *     `/partials/`, `/vendor/`) and `/control-token.json` are NOT in this
+ *     table — they remain priority branches in `server.ts`.
+ */
+import { type Route } from "./shared.js";
+/**
+ * Build the per-request `Route[]` table. `parsedUrl` is captured by closures
+ * so handlers that need query parameters can read `searchParams` without any
+ * module-scoped state.
+ */
+export declare function buildRoutes(parsedUrl: URL): Route[];