patchwarden 1.1.0 → 1.5.1

package/src/assessments/agentAssessor.ts

@@ -21,7 +21,7 @@ export interface AgentAssessorInput {
   config: PatchWardenConfig;
 }
 
-export function runAgentAssessment(input: AgentAssessorInput): AgentAssessmentSummary {
+export async function runAgentAssessment(input: AgentAssessorInput): Promise<AgentAssessmentSummary> {
   const logPaths: AgentAssessmentSummary["log_paths"] = {
     stdout: resolve(input.assessmentDir, "agent-assessment-stdout.log"),
     stderr: resolve(input.assessmentDir, "agent-assessment-stderr.log"),
@@ -53,7 +53,7 @@ export function runAgentAssessment(input: AgentAssessorInput): AgentAssessmentSu
   // ── 2. Before snapshot (repo-scoped) ──
   let repoBefore: RepoSnapshot;
   try {
-    repoBefore = captureRepoSnapshot(input.repoPath);
+    repoBefore = await captureRepoSnapshot(input.repoPath);
   } catch {
     // If we can't capture before snapshot, conservatively skip agent assessment
     emptySummary.status = "spawn_failed";
@@ -95,7 +95,7 @@ export function runAgentAssessment(input: AgentAssessorInput): AgentAssessmentSu
   let readOnlyViolation = false;
   let violationFiles: string[] = [];
   try {
-    const repoAfter = captureRepoSnapshot(input.repoPath);
+    const repoAfter = await captureRepoSnapshot(input.repoPath);
     const changes = compareSnapshots(repoBefore, repoAfter);
     if (changes.length > 0) {
       readOnlyViolation = true;

package/src/assessments/assessmentStore.ts

@@ -314,7 +314,7 @@ export function validateAssessmentFreshness(
  * This is intentionally not registered as an MCP tool: a remote client may
  * request confirmation, but it cannot grant confirmation to itself.
  */
-export function confirmAssessment(assessmentId: string): AssessmentConfirmationResult {
+export async function confirmAssessment(assessmentId: string): Promise<AssessmentConfirmationResult> {
   if (!/^assessment_\d{8}_\d{6}_[0-9a-f]{32}$/.test(assessmentId)) {
     throw new PatchWardenError(
       "assessment_id_invalid",
@@ -334,7 +334,7 @@ export function confirmAssessment(assessmentId: string): AssessmentConfirmationR
     );
   }
 
-  const snapshot = captureRepoSnapshot(assessment.resolved_repo_path);
+  const snapshot = await captureRepoSnapshot(assessment.resolved_repo_path);
   const validation = validateAssessmentFreshness(assessmentId, snapshot, {
     allow_unconfirmed: true,
     // A standalone CLI has no active MCP profile snapshot. The execute path

package/src/assessments/confirmCli.ts

@@ -10,20 +10,21 @@
 import { loadConfig } from "../config.js";
 import { confirmAssessment } from "./assessmentStore.js";
 import { errorPayload } from "../errors.js";
+import { logger } from "../logging.js";
 
 loadConfig();
 
 const assessmentId = process.argv[2];
 if (!assessmentId || process.argv.length !== 3) {
-  console.error("Usage: patchwarden-confirm <full_assessment_id>");
-  console.error("The display-only assessment_short_id is not accepted.");
+  logger.info("Usage: patchwarden-confirm <full_assessment_id>");
+  logger.info("The display-only assessment_short_id is not accepted.");
   process.exit(1);
 }
 
 try {
-  const result = confirmAssessment(assessmentId);
+  const result = await confirmAssessment(assessmentId);
   console.log(JSON.stringify(result, null, 2));
 } catch (error) {
-  console.error(JSON.stringify(errorPayload(error), null, 2));
+  logger.error("confirm_assessment_failed", { error: errorPayload(error) });
   process.exit(1);
 }

package/src/config.ts

@@ -23,6 +23,9 @@ export interface PatchWardenConfig {
   watcherStaleSeconds: number;
   toolProfile?: "full" | "chatgpt_core" | "chatgpt_direct" | "chatgpt_search";
   repoAliases?: Record<string, string>;
+  httpPort?: number;
+  http?: { port?: number; host?: string; ownerTokenEnv?: string };
+  enableRunTaskTool?: boolean;
   enableAgentAssessment?: boolean;
   agentAssessmentTimeoutSeconds?: number;
   agentAssessmentMaxOutputBytes?: number;
@@ -233,6 +236,40 @@ function normalizeConfig(config: PatchWardenConfig): PatchWardenConfig {
   ) {
     throw new Error('toolProfile must be "full", "chatgpt_core", "chatgpt_direct", or "chatgpt_search"');
   }
+  if (config.repoAliases !== undefined) {
+    if (typeof config.repoAliases !== "object" || config.repoAliases === null || Array.isArray(config.repoAliases)) {
+      throw new Error("repoAliases must be an object mapping alias names to repository paths");
+    }
+    for (const [alias, target] of Object.entries(config.repoAliases)) {
+      if (typeof target !== "string") {
+        throw new Error(`repoAliases["${alias}"] must be a string`);
+      }
+    }
+  }
+  if (config.httpPort !== undefined) {
+    if (typeof config.httpPort !== "number" || !Number.isInteger(config.httpPort) || config.httpPort < 1 || config.httpPort > 65535) {
+      throw new Error("httpPort must be an integer from 1 to 65535");
+    }
+  }
+  if (config.http !== undefined) {
+    if (typeof config.http !== "object" || config.http === null || Array.isArray(config.http)) {
+      throw new Error("http must be an object");
+    }
+    if (config.http.port !== undefined) {
+      if (typeof config.http.port !== "number" || !Number.isInteger(config.http.port) || config.http.port < 1 || config.http.port > 65535) {
+        throw new Error("http.port must be an integer from 1 to 65535");
+      }
+    }
+    if (config.http.host !== undefined && typeof config.http.host !== "string") {
+      throw new Error("http.host must be a string");
+    }
+    if (config.http.ownerTokenEnv !== undefined && typeof config.http.ownerTokenEnv !== "string") {
+      throw new Error("http.ownerTokenEnv must be a string");
+    }
+  }
+  if (config.enableRunTaskTool !== undefined && typeof config.enableRunTaskTool !== "boolean") {
+    throw new Error("enableRunTaskTool must be a boolean");
+  }
   if (config.enableAgentAssessment !== undefined && typeof config.enableAgentAssessment !== "boolean") {
     throw new Error("enableAgentAssessment must be a boolean");
   }

package/src/control/middleware/auth.ts

@@ -0,0 +1,17 @@
+/**
+ * Control Center auth middleware — control token validation.
+ *
+ * POST routes are gated behind an in-memory control token generated at boot.
+ * The token is exposed read-only via GET /control-token.json (handled by the
+ * server router) so the local dashboard can read it, but every mutating
+ * action must pass through `checkControlToken` first.
+ */
+import { type IncomingMessage } from "node:http";
+import { controlToken } from "../shared.js";
+
+export function checkControlToken(req: IncomingMessage): boolean {
+  const header = req.headers["x-patchwarden-control-token"];
+  const provided = Array.isArray(header) ? header[0] : header;
+  if (typeof provided !== "string" || provided.length === 0) return false;
+  return provided === controlToken;
+}

package/src/control/middleware/static.ts

@@ -0,0 +1,71 @@
+/**
+ * Control Center static file middleware.
+ *
+ * Serves the bundled `ui/` directory (dashboard pages, partials, vendor
+ * assets, css) with path-traversal protection, plus the inline SVG favicon.
+ * Content types are mapped from `CONTENT_TYPES` in shared.ts.
+ */
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { extname, isAbsolute, relative, resolve } from "node:path";
+import { type ServerResponse } from "node:http";
+import {
+  CONTENT_TYPES,
+  CONTROL_CENTER_FAVICON,
+  errorMessage,
+  sendJson,
+  uiRoot,
+} from "../shared.js";
+
+export function serveStatic(res: ServerResponse, urlPath: string): void {
+  let candidate = "";
+  try {
+    const normalized = urlPath.startsWith("/") ? urlPath.slice(1) : urlPath;
+    let decoded: string;
+    try {
+      decoded = decodeURIComponent(normalized);
+    } catch {
+      sendJson(res, 400, { error: "Invalid path encoding" });
+      return;
+    }
+    if (decoded.includes("\0")) {
+      sendJson(res, 400, { error: "Invalid path" });
+      return;
+    }
+    const segments = decoded.split("/").filter(Boolean);
+    if (segments.some((s) => s === "..")) {
+      sendJson(res, 403, { error: "Forbidden" });
+      return;
+    }
+    candidate = resolve(uiRoot, ...segments);
+    const rel = relative(uiRoot, candidate);
+    if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) {
+      sendJson(res, 403, { error: "Forbidden" });
+      return;
+    }
+  } catch (err) {
+    sendJson(res, 500, { error: errorMessage(err) });
+    return;
+  }
+  try {
+    if (!existsSync(candidate) || !statSync(candidate).isFile()) {
+      sendJson(res, 404, { error: "Not found" });
+      return;
+    }
+    const ext = extname(candidate).toLowerCase();
+    const contentType = CONTENT_TYPES[ext] || "application/octet-stream";
+    const content = readFileSync(candidate);
+    res.writeHead(200, { "Content-Type": contentType });
+    res.end(content);
+  } catch (err) {
+    sendJson(res, 500, { error: errorMessage(err) });
+  }
+}
+
+export function serveFavicon(res: ServerResponse): void {
+  res.writeHead(200, {
+    "Content-Type": "image/svg+xml; charset=utf-8",
+    "Cache-Control": "public, max-age=86400",
+    "X-Content-Type-Options": "nosniff",
+  });
+  res.end(CONTROL_CENTER_FAVICON);
+}

package/src/control/routes/audit.ts

@@ -0,0 +1,321 @@
+/**
+ * Control Center routes — audit aggregation, warnings, and log tails.
+ *
+ * `handleAudit` joins independent-review.md + audit.json across tasks and
+ * direct sessions. `handleWarnings` buckets audit/stale/verification warnings
+ * by type. `handleLogs` returns redacted stdout/stderr tails for core, direct,
+ * watcher, and control-center log categories.
+ */
+import { existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { type ServerResponse } from "node:http";
+import { type TaskEntry, listTasks } from "../../tools/listTasks.js";
+import { type WatcherStatusSnapshot } from "../../watcherStatus.js";
+import { redactSensitiveContent } from "../../security/contentRedaction.js";
+import { getDirectSessionsDir, getTasksDir } from "../../config.js";
+import {
+  classifyStaleTask,
+  fileMtimeIso,
+  parseReviewVerdict,
+  readWatcherStatusSafe,
+} from "../runtime.js";
+import {
+  config,
+  errorMessage,
+  findLatestLog,
+  getControlCenterLogDir,
+  getRuntimeRoot,
+  readFileTail,
+  readJsonFileSafe,
+  readTextFileSafe,
+  sendJson,
+} from "../shared.js";
+
+export type LogCategory = "core" | "direct" | "watcher" | "control-center";
+
+export function handleLogs(res: ServerResponse, category: LogCategory, tailLines: number): void {
+  try {
+    let dir: string;
+    let stdoutPath: string;
+    let stderrPath: string;
+    let stdoutExists: boolean;
+    let stderrExists: boolean;
+
+    if (category === "control-center") {
+      dir = getControlCenterLogDir();
+      stdoutPath = join(dir, "control-center.stdout.log");
+      stderrPath = join(dir, "control-center.stderr.log");
+      stdoutExists = existsSync(stdoutPath);
+      stderrExists = existsSync(stderrPath);
+    } else if (category === "watcher") {
+      dir = getRuntimeRoot(false);
+      const sp = findLatestLog(dir, /^watcher-.*\.stdout\.log$/);
+      const ep = findLatestLog(dir, /^watcher-.*\.stderr\.log$/);
+      stdoutPath = sp ?? "";
+      stderrPath = ep ?? "";
+      stdoutExists = sp !== null;
+      stderrExists = ep !== null;
+    } else {
+      // core | direct -> tunnel client logs in the matching runtime dir
+      dir = getRuntimeRoot(category === "direct");
+      stdoutPath = join(dir, "tunnel-client.stdout.log");
+      stderrPath = join(dir, "tunnel-client.stderr.log");
+      stdoutExists = existsSync(stdoutPath);
+      stderrExists = existsSync(stderrPath);
+    }
+
+    if (!stdoutExists && !stderrExists) {
+      sendJson(res, 200, {
+        stdout: "",
+        stderr: "",
+        category,
+        tail: tailLines,
+        reason: "log file not found",
+      });
+      return;
+    }
+
+    const stdoutRaw = stdoutExists ? readFileTail(stdoutPath, tailLines) : "";
+    const stderrRaw = stderrExists ? readFileTail(stderrPath, tailLines) : "";
+    const stdout = redactSensitiveContent(stdoutRaw).content;
+    const stderr = redactSensitiveContent(stderrRaw).content;
+    sendJson(res, 200, { stdout, stderr, category, tail: tailLines, reason: null });
+  } catch (err) {
+    sendJson(res, 200, { stdout: "", stderr: "", category, tail: tailLines, reason: errorMessage(err) });
+  }
+}
+
+export function handleAudit(res: ServerResponse): void {
+  try {
+    const audits: Array<Record<string, unknown>> = [];
+
+    // 1. tasks/*/independent-review.md (written by audit_task — the primary audit artifact)
+    // 2. tasks/*/audit.json (legacy/explicit JSON audit, if present)
+    const tasksDir = getTasksDir(config);
+    if (existsSync(tasksDir)) {
+      let taskEntries: import("node:fs").Dirent[] = [];
+      try {
+        taskEntries = readdirSync(tasksDir, { withFileTypes: true }).filter((e) => e.isDirectory());
+      } catch {
+        taskEntries = [];
+      }
+      for (const entry of taskEntries) {
+        const taskDir = join(tasksDir, entry.name);
+
+        // independent-review.md
+        const reviewFile = join(taskDir, "independent-review.md");
+        if (existsSync(reviewFile)) {
+          const content = readTextFileSafe(reviewFile) ?? "";
+          audits.push({
+            task_id: entry.name,
+            source: "independent-review.md",
+            verdict: parseReviewVerdict(content),
+            checked_at: fileMtimeIso(reviewFile),
+            content_excerpt: content.slice(0, 500),
+          });
+        }
+
+        // audit.json (explicit JSON audit if present)
+        const auditFile = join(taskDir, "audit.json");
+        if (existsSync(auditFile)) {
+          const data = readJsonFileSafe<Record<string, unknown>>(auditFile);
+          if (data) {
+            audits.push({
+              task_id: entry.name,
+              source: "audit.json",
+              checked_at: data.checked_at ?? fileMtimeIso(auditFile),
+              ...data,
+            });
+          }
+        }
+      }
+    }
+
+    // 3. direct-sessions/*/audit.json (written by Direct audit_session)
+    const sessionsDir = getDirectSessionsDir(config);
+    if (existsSync(sessionsDir)) {
+      let sessionEntries: import("node:fs").Dirent[] = [];
+      try {
+        sessionEntries = readdirSync(sessionsDir, { withFileTypes: true }).filter((e) => e.isDirectory());
+      } catch {
+        sessionEntries = [];
+      }
+      for (const entry of sessionEntries) {
+        const auditFile = join(sessionsDir, entry.name, "audit.json");
+        if (!existsSync(auditFile)) continue;
+        const data = readJsonFileSafe<Record<string, unknown>>(auditFile);
+        if (data) {
+          audits.push({
+            source: "direct-session",
+            session_id: data.session_id ?? entry.name,
+            checked_at: fileMtimeIso(auditFile),
+            ...data,
+          });
+        }
+      }
+    }
+
+    // Sort by checked_at descending (missing timestamps sort last).
+    audits.sort((a, b) => {
+      const ac = String(a.checked_at ?? "");
+      const bc = String(b.checked_at ?? "");
+      return bc.localeCompare(ac);
+    });
+    const limited = audits.slice(0, 50);
+    sendJson(res, 200, { audits: limited, total: limited.length });
+  } catch (err) {
+    sendJson(res, 200, { audits: [], reason: errorMessage(err) });
+  }
+}
+
+// ── Warnings aggregation ─────────────────────────────────────────
+
+interface WarningEntry {
+  type: string;
+  severity: "error" | "warning" | "info";
+  affected_tasks_count: number;
+  affected_tasks: string[];
+  likely_false_positive: boolean;
+  needs_fix: boolean;
+  blocked: boolean;
+  recommended_action: string;
+}
+
+/**
+ * Aggregate warnings from multiple sources:
+ *  - audit.json warnings/fail_checks/possible_false_positives/manual_verification_required
+ *  - stale task classification (heartbeat stale, collecting_artifacts stale, etc.)
+ *  - task status=failed_verification
+ *
+ * Each warning type is grouped into a bucket with affected task IDs. The
+ * handler is fault-tolerant: any per-task read failure is skipped, and a
+ * top-level failure returns an empty warnings array (never 500).
+ */
+export function handleWarnings(res: ServerResponse): void {
+  try {
+    const buckets: Record<string, Set<string>> = {
+      unrecorded_command_execution: new Set(),
+      artifact_hygiene: new Set(),
+      scope_changes: new Set(),
+      release_publish_claim: new Set(),
+      manual_verification_required: new Set(),
+      stale_task: new Set(),
+      failed_verification: new Set(),
+    };
+
+    const tasksDir = getTasksDir(config);
+    let taskList: TaskEntry[] = [];
+    let watcher: WatcherStatusSnapshot;
+    try {
+      const result = listTasks({ limit: 100 });
+      taskList = result.tasks;
+      watcher = result.watcher;
+    } catch (err) {
+      watcher = readWatcherStatusSafe();
+    }
+
+    const now = Date.now();
+
+    for (const task of taskList) {
+      const taskId = task.task_id;
+
+      // 1. Read audit.json for warning strings
+      const auditFile = join(tasksDir, taskId, "audit.json");
+      const audit = readJsonFileSafe<Record<string, unknown>>(auditFile);
+      if (audit) {
+        const warningTexts: string[] = [];
+        const collectStrings = (field: unknown) => {
+          if (Array.isArray(field)) {
+            for (const w of field) {
+              if (typeof w === "string") {
+                warningTexts.push(w);
+              } else if (w && typeof w === "object") {
+                const obj = w as Record<string, unknown>;
+                if (typeof obj.message === "string") warningTexts.push(obj.message);
+                else if (typeof obj.description === "string") warningTexts.push(obj.description);
+                else if (typeof obj.warning === "string") warningTexts.push(obj.warning);
+                else warningTexts.push(JSON.stringify(obj));
+              }
+            }
+          } else if (typeof field === "string") {
+            warningTexts.push(field);
+          }
+        };
+        collectStrings(audit.warnings);
+        collectStrings(audit.fail_checks);
+        collectStrings(audit.possible_false_positives);
+
+        for (const text of warningTexts) {
+          const lower = text.toLowerCase();
+          if (lower.includes("unrecorded") || lower.includes("command execution")) {
+            buckets.unrecorded_command_execution.add(taskId);
+          }
+          if (lower.includes("artifact") || lower.includes("hygiene")) {
+            buckets.artifact_hygiene.add(taskId);
+          }
+          if (lower.includes("scope") || lower.includes("out_of_scope")) {
+            buckets.scope_changes.add(taskId);
+          }
+          if (lower.includes("release") || lower.includes("publish")) {
+            buckets.release_publish_claim.add(taskId);
+          }
+        }
+
+        // manual_verification_required flag
+        if (audit.manual_verification_required === true) {
+          buckets.manual_verification_required.add(taskId);
+        }
+      }
+
+      // 2. Stale tasks
+      try {
+        const cls = classifyStaleTask(task, watcher, now);
+        if (cls.is_stale) {
+          buckets.stale_task.add(taskId);
+        }
+      } catch {
+        // skip stale classification failure
+      }
+
+      // 3. Failed verification
+      if (task.status === "failed_verification") {
+        buckets.failed_verification.add(taskId);
+      }
+    }
+
+    const warnings: WarningEntry[] = [];
+    const addWarning = (
+      type: string,
+      severity: "error" | "warning" | "info",
+      likelyFalsePositive: boolean,
+      needsFix: boolean,
+      blocked: boolean,
+      recommendedAction: string
+    ) => {
+      const tasks = buckets[type];
+      if (tasks.size === 0) return;
+      warnings.push({
+        type,
+        severity,
+        affected_tasks_count: tasks.size,
+        affected_tasks: Array.from(tasks),
+        likely_false_positive: likelyFalsePositive,
+        needs_fix: needsFix,
+        blocked,
+        recommended_action: recommendedAction,
+      });
+    };
+
+    addWarning("failed_verification", "error", false, true, false, "Re-run verification or fix the failing checks before retrying.");
+    addWarning("stale_task", "warning", false, false, false, "Reconcile or recreate stale tasks.");
+    addWarning("manual_verification_required", "warning", false, false, false, "Review the audit findings and manually verify the changes.");
+    addWarning("unrecorded_command_execution", "info", false, true, false, "Investigate unrecorded command executions; ensure watcher captures all commands.");
+    addWarning("release_publish_claim", "info", false, false, true, "Verify the release/publish claim against actual release artifacts before proceeding.");
+    addWarning("artifact_hygiene", "info", true, false, false, "Review artifact hygiene warnings; many are likely false positives.");
+    addWarning("scope_changes", "info", true, false, false, "Review scope changes; verify they are intentional before accepting.");
+
+    sendJson(res, 200, { warnings, total: warnings.length });
+  } catch (err) {
+    sendJson(res, 200, { warnings: [], total: 0, error: errorMessage(err) });
+  }
+}

package/src/control/routes/evidence.ts

@@ -0,0 +1,107 @@
+/**
+ * Control Center routes — evidence packs (/api/evidence-packs/*).
+ *
+ * Lists exported evidence packs (bounded to 50), reads a single pack detail,
+ * and exports a pack for a lineage on demand. The export endpoint is a POST
+ * route gated by the control token in the server router.
+ */
+import { existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { type ServerResponse } from "node:http";
+import {
+  exportTaskEvidencePack,
+  listEvidencePacks,
+  readEvidencePack,
+  type SafeEvidencePack,
+} from "../../tools/evidencePack.js";
+import { errorMessage, sendJson, config } from "../shared.js";
+
+function augmentEvidencePackSummary(pack: SafeEvidencePack): SafeEvidencePack & {
+  export_status: "exported" | "pending";
+  evidence_json_exists: boolean;
+  evidence_md_exists: boolean;
+  exported_at: string;
+} {
+  const jsonExists = existsSync(pack.files.json);
+  const mdExists = existsSync(pack.files.markdown);
+  return {
+    ...pack,
+    export_status: jsonExists ? "exported" : "pending",
+    evidence_json_exists: jsonExists,
+    evidence_md_exists: mdExists,
+    exported_at: pack.generated_at,
+  };
+}
+
+export function handleEvidencePacks(res: ServerResponse): void {
+  try {
+    const list = listEvidencePacks({ max_items: 50 });
+    const packs = list.evidence_packs.map((pack) => augmentEvidencePackSummary(pack));
+    // Detect lineages that exist but have no exported evidence pack yet, so the
+    // dashboard can show an "Export evidence pack" action for the most recent one.
+    const lineagesRoot = join(config.workspaceRoot, ".patchwarden", "lineages");
+    let lineageCount = 0;
+    const exportedIds = new Set(packs.map((p) => p.lineage_id));
+    const pendingLineageIds: string[] = [];
+    if (existsSync(lineagesRoot)) {
+      const dirs = readdirSync(lineagesRoot, { withFileTypes: true }).filter((e) => e.isDirectory());
+      lineageCount = dirs.length;
+      for (const dir of dirs) {
+        if (!exportedIds.has(dir.name)) pendingLineageIds.push(dir.name);
+      }
+    }
+    sendJson(res, 200, {
+      evidence_packs: packs,
+      total: packs.length,
+      truncated: list.truncated,
+      has_lineages: lineageCount > 0,
+      lineage_count: lineageCount,
+      pending_lineage_ids: pendingLineageIds.slice(0, 20),
+      reason: null,
+    });
+  } catch (err) {
+    sendJson(res, 200, { evidence_packs: [], total: 0, reason: errorMessage(err) });
+  }
+}
+
+export function handleEvidencePackDetail(res: ServerResponse, lineageId: string): void {
+  try {
+    if (!/^[A-Za-z0-9_-]+$/.test(lineageId)) {
+      sendJson(res, 400, { error: "Invalid lineage id" });
+      return;
+    }
+    const pack = readEvidencePack(lineageId);
+    if (!pack) {
+      sendJson(res, 404, { error: "Evidence pack not found" });
+      return;
+    }
+    sendJson(res, 200, augmentEvidencePackSummary(pack));
+  } catch (err) {
+    sendJson(res, 200, { lineage_id: lineageId, error: errorMessage(err), bounded: true });
+  }
+}
+
+export function handleEvidencePackExport(res: ServerResponse, lineageId: string): void {
+  try {
+    if (!/^[A-Za-z0-9_-]+$/.test(lineageId)) {
+      sendJson(res, 400, { error: "Invalid lineage id" });
+      return;
+    }
+    // Check lineage exists.
+    const lineageFile = join(config.workspaceRoot, ".patchwarden", "lineages", lineageId, "lineage.json");
+    if (!existsSync(lineageFile)) {
+      sendJson(res, 404, { error: "Lineage not found" });
+      return;
+    }
+    // Check if already exported.
+    const evidenceJsonPath = join(config.workspaceRoot, ".patchwarden", "evidence-packs", lineageId, "evidence.json");
+    if (existsSync(evidenceJsonPath)) {
+      sendJson(res, 200, { ok: true, already_exported: true, lineage_id: lineageId });
+      return;
+    }
+    const pack = exportTaskEvidencePack({ lineage_id: lineageId });
+    sendJson(res, 200, { ok: true, exported: true, lineage_id: lineageId, evidence_pack_id: pack.evidence_pack_id });
+  } catch (err) {
+    sendJson(res, 200, { ok: false, lineage_id: lineageId, error: errorMessage(err) });
+  }
+}