lazyclaw 5.4.4 → 6.0.1

package/daemon/routes/ops.mjs

@@ -0,0 +1,185 @@
+// Daemon route handlers (ops), extracted verbatim from makeHandler (D5).
+// Each handler takes the per-request dispatch context `c` and returns the
+// HTTP response. Bodies are unchanged; only the dispatch wrapper is new.
+import { fs, nodePath, PROVIDERS, PROVIDER_INFO, maskApiKey, costFromUsage, RATE_CARD_SHAPE, composeSystemPrompt, listSkills, loadSkill, skillPath, installSkill, removeSkill, parseFrontmatter, skillsDefaultConfigDir, indexDb, skillSynth, sandboxListBackends, summarizeState, listWorkflowSessions, loadWorkflowState, aggregateNodeStats, validateConfig, validateRates, fileExists, readJson, readTextBody, writeJson, writeSseHead, writeSse, statusForProviderError, checkCostCap, accumulateMetricsFromCost, resolveProvider } from './_deps.mjs';
+
+export async function trainerStatus(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Reads cfg.trainer.{provider, model, schedule, budget, recipe}
+          // and reports last-run state from <configDir>/trainer-state.json
+          // if present. No standalone trainer module yet; this is a thin
+          // config-surface endpoint the dashboard reads at refresh.
+          const cfg = ctx.readConfig();
+          const t = (cfg.trainer && typeof cfg.trainer === 'object') ? cfg.trainer : {};
+          let lastRunAt = null, callsToday = null;
+          try {
+            const statePath = nodePath.join(gwConfigDir || skillsDefaultConfigDir(), 'trainer-state.json');
+            if (fs.existsSync(statePath)) {
+              const st = JSON.parse(fs.readFileSync(statePath, 'utf8'));
+              lastRunAt = st?.lastRunAt || null;
+              // callsToday: count entries whose ts is within the current
+              // UTC day. State writer is the (future) trainer; reader
+              // tolerates absence.
+              const today = new Date().toISOString().slice(0, 10);
+              if (Array.isArray(st?.calls)) {
+                callsToday = st.calls.filter((c) => String(c.ts || '').startsWith(today)).length;
+              } else if (typeof st?.callsToday === 'number') {
+                callsToday = st.callsToday;
+              }
+            }
+          } catch { /* missing/corrupt state → null */ }
+          return writeJson(res, 200, {
+            provider: t.provider || null,
+            model: t.model || null,
+            schedule: t.schedule || null,
+            budget: t.budget != null ? Number(t.budget) : null,
+            recipe: t.recipe || null,
+            lastRunAt,
+            callsToday,
+          });
+}
+
+export async function recall(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // GET /recall?q=...&scope=sessions|skills|trajectories|memories|all&k=N
+          const q = url.searchParams.get('q');
+          if (!q) return writeJson(res, 400, { error: 'missing q query parameter' });
+          const scopeParam = url.searchParams.get('scope') || 'all';
+          const scope = scopeParam === 'all'
+            ? ['sessions', 'skills', 'trajectories', 'memories']
+            : scopeParam.split(',').map((x) => x.trim()).filter(Boolean);
+          const kParam = url.searchParams.get('k');
+          const k = kParam ? Math.max(1, Math.min(50, parseInt(kParam, 10) || 10)) : 10;
+          try {
+            const r = indexDb.recall(q, { configDir: gwConfigDir, scope, k });
+            return writeJson(res, 200, r);
+          } catch (e) {
+            return writeJson(res, 500, { error: e?.message || String(e) });
+          }
+}
+
+export async function sandboxList(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          const cfg = ctx.readConfig();
+          const sb = (cfg.sandbox && typeof cfg.sandbox === 'object') ? cfg.sandbox : {};
+          const active = sb.default || 'local';
+          const profiles = sandboxListBackends().map((name) => {
+            const section = sb[name];
+            const configured = !!section && typeof section === 'object';
+            let summary = '';
+            if (configured) {
+              if (name === 'docker' && section.image) summary = `image: ${section.image}`;
+              else if (name === 'ssh' && section.host) summary = `host: ${section.host}`;
+              else if (name === 'singularity' && section.image) summary = `image: ${section.image}`;
+              else if (name === 'modal' && section.app) summary = `app: ${section.app}`;
+              else if (name === 'daytona' && section.workspace) summary = `workspace: ${section.workspace}`;
+              else if (name === 'local' && section.confiner) summary = `confiner: ${section.confiner}`;
+            }
+            return { name, configured, summary };
+          });
+          return writeJson(res, 200, { profiles, active });
+}
+
+export async function sandboxTest(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // POST /sandbox/<name>/test — opens a session against the named
+          // backend, runs `echo hello`, returns { ok, durationMs, stdout }.
+          const name = url.pathname.match(/^\/sandbox\/([^/]+)\/test$/)[1];
+          try {
+            const sandboxMod = await import('../../sandbox/index.mjs');
+            const cfg = ctx.readConfig();
+            // Synthesise a one-off cfg.sandbox.default override so we can
+            // test a backend without mutating the user's persisted choice.
+            const probeCfg = {
+              ...cfg,
+              sandbox: { ...(cfg.sandbox || {}), default: name },
+            };
+            const t0 = Date.now();
+            const box = sandboxMod.resolveSandbox(probeCfg, null);
+            const sess = await box.open();
+            let result;
+            try {
+              result = await sess.exec(['echo', 'hello'], { stdio: 'pipe' });
+            } finally {
+              try { await sess.close(); } catch { /* ignore */ }
+            }
+            const durationMs = Date.now() - t0;
+            const ok = result.code === 0;
+            return writeJson(res, ok ? 200 : 500, {
+              ok,
+              durationMs,
+              code: result.code,
+              stdout: String(result.stdout || '').slice(0, 200),
+              stderr: String(result.stderr || '').slice(0, 200),
+            });
+          } catch (e) {
+            return writeJson(res, 500, { ok: false, error: e?.message || String(e), code: e?.code });
+          }
+}
+
+export async function sandboxUse(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          if (typeof ctx.writeConfig !== 'function') {
+            return writeJson(res, 405, { error: 'mutation disabled' });
+          }
+          let body;
+          try { body = await readJson(req); }
+          catch (e) { return writeJson(res, 400, { error: e?.message || String(e) }); }
+          const name = body && String(body.name || '').trim();
+          if (!name) return writeJson(res, 400, { error: 'name is required' });
+          if (!sandboxListBackends().includes(name)) {
+            return writeJson(res, 400, { error: `unknown sandbox backend: ${name}` });
+          }
+          const cfg = ctx.readConfig();
+          cfg.sandbox = { ...(cfg.sandbox || {}), default: name };
+          ctx.writeConfig(cfg);
+          return writeJson(res, 200, { ok: true, active: name });
+}
+
+export async function channels(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Aggregate cfg.channels.<name> + any channel-specific runtime
+          // state we expose. Keeps the dashboard from having to know
+          // each channel module's shape.
+          const cfg = ctx.readConfig();
+          const chCfg = (cfg.channels && typeof cfg.channels === 'object') ? cfg.channels : {};
+          // Known built-in channel names (matches channels/ + channels-*).
+          const KNOWN = ['slack', 'matrix', 'telegram', 'discord', 'email', 'signal', 'whatsapp', 'voice', 'http'];
+          const out = [];
+          for (const name of KNOWN) {
+            const sec = chCfg[name];
+            if (!sec && !cfg[`${name}-bot-token`] && !cfg[`${name}-token`]) continue;
+            out.push({
+              name,
+              enabled: !!(sec && (sec.enabled !== false)),
+              lastInboundAt: sec?.lastInboundAt || null,
+              boundAgent: sec?.agent || sec?.boundAgent || null,
+            });
+          }
+          // Surface any additional configured channels we didn't enumerate.
+          for (const name of Object.keys(chCfg)) {
+            if (KNOWN.includes(name)) continue;
+            const sec = chCfg[name] || {};
+            out.push({
+              name,
+              enabled: sec.enabled !== false,
+              lastInboundAt: sec.lastInboundAt || null,
+              boundAgent: sec.agent || sec.boundAgent || null,
+            });
+          }
+          return writeJson(res, 200, { channels: out });
+}
+
+export async function indexRebuild(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          try {
+            // reindexAll, not rebuild: a bare rebuild zeroes the FTS index and
+            // never repopulates, so this route used to silently wipe recall.
+            indexDb.reindexAll(gwConfigDir);
+            ctx.indexLastRebuiltAt = new Date().toISOString();
+            return writeJson(res, 200, { ok: true, rebuiltAt: ctx.indexLastRebuiltAt });
+          } catch (e) {
+            return writeJson(res, 500, { ok: false, error: e?.message || String(e) });
+          }
+}
+

package/daemon/routes/providers.mjs

@@ -0,0 +1,211 @@
+// Daemon route handlers (providers), extracted verbatim from makeHandler (D5).
+// Each handler takes the per-request dispatch context `c` and returns the
+// HTTP response. Bodies are unchanged; only the dispatch wrapper is new.
+import { fs, nodePath, PROVIDERS, PROVIDER_INFO, maskApiKey, costFromUsage, RATE_CARD_SHAPE, composeSystemPrompt, listSkills, loadSkill, skillPath, installSkill, removeSkill, parseFrontmatter, skillsDefaultConfigDir, indexDb, skillSynth, sandboxListBackends, summarizeState, listWorkflowSessions, loadWorkflowState, aggregateNodeStats, validateConfig, validateRates, fileExists, readJson, readTextBody, writeJson, writeSseHead, writeSse, statusForProviderError, checkCostCap, accumulateMetricsFromCost, resolveProvider } from './_deps.mjs';
+
+export async function providersList(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // ?filter=<substr>&limit=<N> mirror v3.33+ list flags.
+          // The dashboard reads `custom` / `builtinOpenAICompat` / `endpoint`
+          // / `docs` to render the right pills + tooltips; CLI callers only
+          // need `name` / `requiresApiKey` / `suggestedModels` and ignore
+          // the extras (additive change, no migration).
+          let out = Object.keys(PROVIDERS).map(name => {
+            const meta = PROVIDER_INFO[name] || { name };
+            return {
+              name,
+              requiresApiKey: !!meta.requiresApiKey,
+              defaultModel: meta.defaultModel || null,
+              suggestedModels: meta.suggestedModels || [],
+              endpoint: meta.endpoint || null,
+              docs: meta.docs || null,
+              custom: !!meta.custom,
+              builtinOpenAICompat: !!meta.builtinOpenAICompat,
+              baseUrl: meta.baseUrl || null,
+              envKey: meta.envKey || null,
+              keyPrefix: meta.keyPrefix || null,
+            };
+          });
+          const filter = url.searchParams.get('filter');
+          if (filter) {
+            const f = filter.toLowerCase();
+            out = out.filter(p => p.name.toLowerCase().includes(f));
+          }
+          const limitStr = url.searchParams.get('limit');
+          if (limitStr) {
+            const n = parseInt(limitStr, 10);
+            if (Number.isFinite(n) && n > 0) out = out.slice(0, n);
+          }
+          return writeJson(res, 200, out);
+}
+
+export async function providerGet(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // GET /providers/<name> — full per-provider metadata
+          // (mirrors CLI `lazyclaw providers info <name>`).
+          // The `name !== 'test'` guard keeps `/providers/test`
+          // (parallel batch endpoint) from being intercepted here;
+          // switch-case order ensures the literal `GET /providers/test`
+          // case runs first anyway, but the guard makes the intent
+          // explicit for future readers.
+          const name = providerMatch[1];
+          const meta = PROVIDER_INFO[name];
+          if (!meta) {
+            return writeJson(res, 404, {
+              error: 'unknown provider',
+              name,
+              knownProviders: Object.keys(PROVIDERS),
+            });
+          }
+          return writeJson(res, 200, meta);
+}
+
+export async function providersTest(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Mirror of CLI v3.55 `lazyclaw providers test` (no name).
+          // A dashboard's "key validity" badge calls this once and
+          // gets a per-provider verdict in one round trip. HTTP
+          // status mirrors CLI exit code:
+          //   200 — every provider returned a non-empty reply
+          //   503 — at least one provider failed (Service Unavailable;
+          //         "the system is partially unhealthy")
+          // 503 is the right code because a dashboard observing it
+          // can render a yellow status without parsing the body.
+          const cfg = ctx.readConfig();
+          const apiKey = cfg['api-key'] || '';
+          const sharedPrompt = url.searchParams.get('prompt') || 'ping';
+          const tAll = Date.now();
+          const results = await Promise.all(
+            Object.entries(PROVIDERS).map(async ([pid, provider]) => {
+              const meta = PROVIDER_INFO[pid] || {};
+              const model = url.searchParams.get('model') || cfg.model || meta.defaultModel || 'unknown';
+              const t0 = Date.now();
+              try {
+                let reply = '';
+                const stream = provider.sendMessage([{ role: 'user', content: sharedPrompt }], { apiKey, model });
+                for await (const chunk of stream) {
+                  if (typeof chunk === 'string') reply += chunk;
+                }
+                return {
+                  name: pid, ok: reply.length > 0, model,
+                  durationMs: Date.now() - t0,
+                  replyLength: reply.length,
+                };
+              } catch (err) {
+                return {
+                  name: pid, ok: false, model,
+                  durationMs: Date.now() - t0,
+                  error: err?.message || String(err),
+                  code: err?.code || null,
+                };
+              }
+            }),
+          );
+          const allOk = results.every(r => r.ok);
+          return writeJson(res, allOk ? 200 : 503, {
+            ok: allOk,
+            totalDurationMs: Date.now() - tAll,
+            results,
+          });
+}
+
+export async function providerTest(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // GET /providers/<name>/test — single-provider 1-token reachability
+          // probe. Same shape as one entry of GET /providers/test, but the
+          // endpoint stops on the first failure and exposes the reply body
+          // (truncated) so the dashboard can show a real signal of life.
+          const name = providerTestMatch[1];
+          const provider = PROVIDERS[name];
+          if (!provider) return writeJson(res, 404, { error: `unknown provider: ${name}` });
+          const cfg = ctx.readConfig();
+          const apiKey = cfg['api-key'] || '';
+          const meta = PROVIDER_INFO[name] || {};
+          const model = url.searchParams.get('model') || cfg.model || meta.defaultModel || 'unknown';
+          const prompt = url.searchParams.get('prompt') || 'ping';
+          const t0 = Date.now();
+          try {
+            let reply = '';
+            const stream = provider.sendMessage([{ role: 'user', content: prompt }], { apiKey, model });
+            for await (const chunk of stream) {
+              if (typeof chunk === 'string') reply += chunk;
+            }
+            return writeJson(res, reply.length > 0 ? 200 : 503, {
+              ok: reply.length > 0,
+              name, model,
+              durationMs: Date.now() - t0,
+              replyLength: reply.length,
+              reply: reply.slice(0, 500),
+            });
+          } catch (err) {
+            return writeJson(res, 503, {
+              ok: false, name, model,
+              durationMs: Date.now() - t0,
+              error: err?.message || String(err),
+              code: err?.code || null,
+            });
+          }
+}
+
+export async function providersCreate(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Register or overwrite a custom OpenAI-compatible provider.
+          // Body: { name, baseUrl, apiKey?, defaultModel? }. Persists into
+          // cfg.customProviders[] and hot-registers via the registry's
+          // registerCustomProviders() so the new entry is callable in this
+          // same process. 405 when the daemon was started without
+          // writeConfig (read-only mode). The same name as a built-in
+          // OpenAI-compat alias is allowed and overrides the built-in.
+          if (typeof ctx.writeConfig !== 'function') {
+            return writeJson(res, 405, { error: 'mutation disabled — daemon was started without writeConfig' });
+          }
+          let body;
+          try { body = await readJson(req); }
+          catch (e) { return writeJson(res, 400, { error: e?.message || String(e) }); }
+          const reg = await import('../../providers/registry.mjs');
+          let name;
+          try { name = reg.validateCustomProviderName(body.name); }
+          catch (e) { return writeJson(res, 400, { error: e.message }); }
+          if (!body.baseUrl || typeof body.baseUrl !== 'string' || !/^https?:\/\//i.test(body.baseUrl)) {
+            return writeJson(res, 400, { error: 'baseUrl must be a string starting with http:// or https://' });
+          }
+          const cfg = ctx.readConfig();
+          cfg.customProviders = Array.isArray(cfg.customProviders) ? cfg.customProviders : [];
+          const idx = cfg.customProviders.findIndex((p) => p && p.name === name);
+          const entry = {
+            name,
+            baseUrl: String(body.baseUrl).replace(/\/+$/, ''),
+            apiKey: body.apiKey || undefined,
+            defaultModel: body.defaultModel || undefined,
+          };
+          if (idx >= 0) cfg.customProviders[idx] = { ...cfg.customProviders[idx], ...entry };
+          else cfg.customProviders.push(entry);
+          ctx.writeConfig(cfg);
+          try { reg.registerCustomProviders(cfg); } catch { /* keep going */ }
+          const overridesBuiltin = typeof reg.isBuiltinOpenAICompatName === 'function'
+            ? reg.isBuiltinOpenAICompatName(name)
+            : false;
+          return writeJson(res, 200, { ok: true, name, baseUrl: entry.baseUrl, overridesBuiltin });
+}
+
+export async function providerDelete(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // DELETE /providers/<name> — drop a custom registration. Idempotent:
+          // 200 with `removed: false` when the name wasn't a custom entry.
+          // Built-in providers can't be deleted; their PROVIDERS row is
+          // restored on next process boot if the user previously overrode it.
+          if (typeof ctx.writeConfig !== 'function') {
+            return writeJson(res, 405, { error: 'mutation disabled' });
+          }
+          const name = providerMatch[1];
+          const cfg = ctx.readConfig();
+          if (!Array.isArray(cfg.customProviders) || cfg.customProviders.length === 0) {
+            return writeJson(res, 200, { ok: true, name, removed: false });
+          }
+          const before = cfg.customProviders.length;
+          cfg.customProviders = cfg.customProviders.filter((p) => !(p && p.name === name));
+          const removed = cfg.customProviders.length < before;
+          if (removed) ctx.writeConfig(cfg);
+          return writeJson(res, 200, { ok: true, name, removed });
+}
+

package/daemon/routes/rates.mjs

@@ -0,0 +1,90 @@
+// Daemon route handlers (rates), extracted verbatim from makeHandler (D5).
+// Each handler takes the per-request dispatch context `c` and returns the
+// HTTP response. Bodies are unchanged; only the dispatch wrapper is new.
+import { fs, nodePath, PROVIDERS, PROVIDER_INFO, maskApiKey, costFromUsage, RATE_CARD_SHAPE, composeSystemPrompt, listSkills, loadSkill, skillPath, installSkill, removeSkill, parseFrontmatter, skillsDefaultConfigDir, indexDb, skillSynth, sandboxListBackends, summarizeState, listWorkflowSessions, loadWorkflowState, aggregateNodeStats, validateConfig, validateRates, fileExists, readJson, readTextBody, writeJson, writeSseHead, writeSse, statusForProviderError, checkCostCap, accumulateMetricsFromCost, resolveProvider } from './_deps.mjs';
+
+export async function ratesList(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Read-only view of cfg.rates so a dashboard's cost panel
+          // can render the configured cards without shelling to the
+          // CLI. No write surface exposed — rate-card edits go
+          // through the CLI (operator-curated, deliberate).
+          // ?filter=<substr>&limit=<N> mirror v3.33+ list flags.
+          const cfg = ctx.readConfig();
+          const rates = cfg.rates && typeof cfg.rates === 'object' ? cfg.rates : {};
+          let entries = Object.entries(rates);
+          const filter = url.searchParams.get('filter');
+          if (filter) {
+            const f = filter.toLowerCase();
+            entries = entries.filter(([key]) => key.toLowerCase().includes(f));
+          }
+          const limitStr = url.searchParams.get('limit');
+          if (limitStr) {
+            const n = parseInt(limitStr, 10);
+            if (Number.isFinite(n) && n > 0) entries = entries.slice(0, n);
+          }
+          return writeJson(res, 200, Object.fromEntries(entries));
+}
+
+export async function ratesValidate(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Mirror of v3.30's `lazyclaw rates validate`. Same shape
+          // (single source of truth in rates-validate.mjs). HTTP
+          // status reflects ok/issues so a UI's cost-config badge
+          // can branch on HTTP code: 200 ok, 422 issues
+          // (Unprocessable Entity, same pattern as /config/validate
+          // in v3.40).
+          const cfg = ctx.readConfig();
+          const result = validateRates(cfg.rates, PROVIDERS);
+          return writeJson(res, result.ok ? 200 : 422, result);
+}
+
+export async function ratesShape(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Mirror of `lazyclaw rates shape`. Returns the zero-filled
+          // reference rate-card template so a dashboard config panel
+          // or a script that scaffolds a new card can get the required
+          // fields without shelling to the CLI.
+          return writeJson(res, 200, RATE_CARD_SHAPE);
+}
+
+export async function ratePut(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // PUT /rates/<key> — set a rate card. Body is the card object
+          // ({ in, out, "cache-read"?, "cache-create"?, currency? }). The
+          // payload is merged into cfg.rates and validated as a whole;
+          // 422 on validation failure. 405 when writeConfig is unset.
+          if (typeof ctx.writeConfig !== 'function') {
+            return writeJson(res, 405, { error: 'mutation disabled' });
+          }
+          const key = decodeURIComponent(ratesKeyMatch[1]);
+          let body;
+          try { body = await readJson(req); }
+          catch (e) { return writeJson(res, 400, { error: e?.message || String(e) }); }
+          if (!body || typeof body !== 'object') return writeJson(res, 400, { error: 'body must be a JSON object' });
+          const cfg = ctx.readConfig();
+          cfg.rates = cfg.rates && typeof cfg.rates === 'object' ? cfg.rates : {};
+          cfg.rates[key] = body;
+          const v = validateRates(cfg.rates, PROVIDERS);
+          if (!v.ok) return writeJson(res, 422, v);
+          ctx.writeConfig(cfg);
+          return writeJson(res, 200, { ok: true, key, card: cfg.rates[key] });
+}
+
+export async function rateDelete(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // DELETE /rates/<key> — idempotent: 200 with `removed: false`
+          // when the card didn't exist.
+          if (typeof ctx.writeConfig !== 'function') {
+            return writeJson(res, 405, { error: 'mutation disabled' });
+          }
+          const key = decodeURIComponent(ratesKeyMatch[1]);
+          const cfg = ctx.readConfig();
+          if (!cfg.rates || typeof cfg.rates !== 'object' || !(key in cfg.rates)) {
+            return writeJson(res, 200, { ok: true, key, removed: false });
+          }
+          delete cfg.rates[key];
+          ctx.writeConfig(cfg);
+          return writeJson(res, 200, { ok: true, key, removed: true });
+}
+