lazyclaw 6.0.0 → 6.0.1

package/daemon/lib/auth.mjs

@@ -0,0 +1,58 @@
+// Auth-token + origin gate helpers for the daemon. Pure — used only by
+// the pre-switch middleware in makeHandler.
+
+/**
+ * Constant-time string equality. Plain `===` would short-circuit on the
+ * first mismatching byte, leaking timing info that lets an attacker on
+ * a shared host narrow the secret one byte at a time. We compare every
+ * byte with XOR + accumulator.
+ */
+export function constantTimeEqual(a, b) {
+  const aStr = String(a ?? '');
+  const bStr = String(b ?? '');
+  if (aStr.length !== bStr.length) return false;
+  let diff = 0;
+  for (let i = 0; i < aStr.length; i++) {
+    diff |= aStr.charCodeAt(i) ^ bStr.charCodeAt(i);
+  }
+  return diff === 0;
+}
+
+export function isAuthorized(req, expectedToken) {
+  if (!expectedToken) return true;  // auth disabled
+  const header = req.headers['authorization'] || '';
+  const m = /^Bearer\s+(.+)$/i.exec(header);
+  if (!m) return false;
+  return constantTimeEqual(m[1].trim(), expectedToken);
+}
+
+/**
+ * Origin gate — protect against DNS-rebinding / CSRF where a page in
+ * the user's browser posts to 127.0.0.1:<our port>. Browsers always
+ * attach `Origin` for cross-origin POSTs (and increasingly for GETs);
+ * CLI tools (curl, fetch from a script) usually don't.
+ *
+ * Policy:
+ *   - No `Origin` header → assume non-browser caller, allow.
+ *   - `Origin` set → must be in `allowedOrigins`. Empty allowlist
+ *     means "reject all browser-originated requests" — the default,
+ *     because the daemon is designed for CLI/script callers.
+ *   - `allowLoopback: true` (set by `lazyclaw dashboard`) additionally
+ *     accepts any `Origin` that looks like loopback (`http://127.0.0.1:*`,
+ *     `http://localhost:*`, `http://[::1]:*`). Safe because the daemon
+ *     binds only to 127.0.0.1, so an attacker can't reach us with a
+ *     loopback Origin unless they're already on the box. DNS rebinding
+ *     can't forge `127.0.0.1` as a hostname — that resolves before
+ *     `fetch()` ever issues the request.
+ *
+ * Returns true when the request should proceed, false when it should
+ * be rejected with 403.
+ */
+const LOOPBACK_ORIGIN_RE = /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/i;
+export function isOriginAllowed(req, allowedOrigins, allowLoopback) {
+  const origin = req.headers['origin'];
+  if (!origin) return true;
+  if (allowLoopback && LOOPBACK_ORIGIN_RE.test(origin)) return true;
+  if (!allowedOrigins || allowedOrigins.length === 0) return false;
+  return allowedOrigins.includes(origin);
+}

package/daemon/lib/cost.mjs

@@ -0,0 +1,30 @@
+// Cost-cap enforcement + per-handler metrics accumulation for the daemon.
+// Pure — operates only on the passed-in metrics/costCap objects.
+
+// Has the cumulative cost in any capped currency reached the cap?
+// Returns the offending currency + amount + cap so the caller can
+// surface it cleanly, or null when no cap is breached.
+export function checkCostCap(metrics, costCap) {
+  if (!costCap) return null;
+  for (const [cur, cap] of Object.entries(costCap)) {
+    if (!Number.isFinite(cap) || cap <= 0) continue;
+    const spent = metrics.costsByCurrency[cur] || 0;
+    if (spent >= cap) return { currency: cur, spent: Math.round(spent * 1_000_000) / 1_000_000, cap };
+  }
+  return null;
+}
+
+// Bump per-handler metrics from a single request's cost+usage. Keys
+// cost by currency so heterogeneous fleets (USD-priced anthropic, EUR
+// regional contracts) don't silently sum mismatched numbers. Tokens
+// are unit-free → single counter.
+export function accumulateMetricsFromCost(metrics, usage, cost) {
+  if (cost && Number.isFinite(cost.cost)) {
+    const cur = cost.currency || 'USD';
+    metrics.costsByCurrency[cur] = (metrics.costsByCurrency[cur] || 0) + cost.cost;
+  }
+  if (usage) {
+    if (Number.isFinite(usage.inputTokens)) metrics.tokensTotal.inputTokens += usage.inputTokens;
+    if (Number.isFinite(usage.outputTokens)) metrics.tokensTotal.outputTokens += usage.outputTokens;
+  }
+}

package/daemon/lib/provider.mjs

@@ -0,0 +1,69 @@
+// Provider resolution for the daemon: composes the base provider with
+// opt-in cache / fallback / retry wrappers per request.
+
+import { PROVIDERS } from '../../providers/registry.mjs';
+import { withRateLimitRetry } from '../../providers/retry.mjs';
+import { withFallback } from '../../providers/fallback.mjs';
+import { withResponseCache } from '../../providers/cache.mjs';
+
+// Resolve the provider for a request. Composes opt-in wrappers in this
+// order (innermost first):
+//   1. cache  — wraps the base provider so cache hits never trigger
+//               fallback or retry (a hit is a successful response).
+//   2. fallback — chain of alternates; pre-yield recoverable errors fall
+//                 through; mid-stream errors bubble.
+//   3. retry  — outermost so each retry covers the full chain (retry
+//               exhausts → 429 to client).
+// `cachedByName` is a per-handler Map shared across requests so the
+// cache state actually persists between calls. Without that the cache
+// would be empty on every request.
+//
+// Returns { provider } on success or { error } when the primary or any
+// listed fallback name is unknown.
+export function resolveProvider(body, providerName, cachedByName, logger) {
+  if (!PROVIDERS[providerName]) return { error: `unknown provider: ${providerName}` };
+  // The decorator callbacks emit one debug line each — useful for ops who
+  // set --log debug to diagnose why a request is slow or which provider
+  // actually served it. With the default level (info) these are silent.
+  const dbg = (msg, fields) => { if (logger) logger.debug(msg, fields); };
+  const wrapWithCache = (name) => {
+    if (!cachedByName) return PROVIDERS[name];
+    if (!cachedByName.has(name)) {
+      cachedByName.set(name, withResponseCache(PROVIDERS[name], {
+        maxEntries: cachedByName._opts?.maxEntries,
+        ttlMs: cachedByName._opts?.ttlMs,
+        onHit:  ({ keyHash, size }) => dbg('cache.hit',  { provider: name, keyHash: keyHash.slice(0, 12), size }),
+        onMiss: ({ keyHash })       => dbg('cache.miss', { provider: name, keyHash: keyHash.slice(0, 12) }),
+      }));
+    }
+    return cachedByName.get(name);
+  };
+  // Cache only when the request explicitly opts in. The handler-level
+  // Map is shared so two requests with body.cache=true to the same base
+  // provider hit the same cache.
+  const useCache = !!body?.cache;
+  let prov = useCache ? wrapWithCache(providerName) : PROVIDERS[providerName];
+  if (Array.isArray(body?.fallback) && body.fallback.length > 0) {
+    const chain = [prov];
+    for (const name of body.fallback) {
+      if (!PROVIDERS[name]) return { error: `unknown fallback provider: ${name}` };
+      chain.push(useCache ? wrapWithCache(name) : PROVIDERS[name]);
+    }
+    prov = withFallback(chain, {
+      onFallback: ({ from, to, err }) => dbg('provider.fallback', {
+        from, to, errorCode: err?.code || null, errorMsg: String(err?.message || err).slice(0, 120),
+      }),
+    });
+  }
+  const r = body?.retry;
+  if (r && Number.isFinite(r.attempts) && r.attempts > 0) {
+    prov = withRateLimitRetry(prov, {
+      attempts: r.attempts,
+      maxBackoffMs: r.maxBackoffMs,
+      onRetry: ({ attempt, retryAfterMs, err }) => dbg('provider.retry', {
+        attempt, retryAfterMs, errorCode: err?.code || null,
+      }),
+    });
+  }
+  return { provider: prov };
+}

package/daemon/lib/respond.mjs

@@ -0,0 +1,83 @@
+// HTTP request/response helpers for the daemon: body readers, JSON/SSE
+// writers, provider-error status mapping, and a small fs existence check.
+// Pure — no daemon state — so any route module can import these freely.
+
+import fs from 'node:fs';
+
+export async function fileExists(p) {
+  try { await fs.promises.access(p); return true; }
+  catch { return false; }
+}
+
+export function readJson(req) {
+  return new Promise((resolve, reject) => {
+    let buf = '';
+    req.setEncoding('utf8');
+    req.on('data', d => { buf += d; if (buf.length > 5 * 1024 * 1024) { reject(new Error('body too large')); req.destroy(); } });
+    req.on('end', () => {
+      if (!buf) return resolve({});
+      try { resolve(JSON.parse(buf)); }
+      catch (e) { reject(new Error(`invalid JSON body: ${e.message}`)); }
+    });
+    req.on('error', reject);
+  });
+}
+
+// Raw body reader — used for `PUT /skills/<name>` where the body is
+// markdown rather than JSON. Same 1 MiB cap as the CLI's `--from-url`
+// path so HTTP can't sneak past the safeguard the CLI enforces.
+export const SKILL_MAX_BYTES = 1_048_576;
+export function readTextBody(req, maxBytes = SKILL_MAX_BYTES) {
+  return new Promise((resolve, reject) => {
+    let buf = '';
+    req.setEncoding('utf8');
+    req.on('data', d => {
+      buf += d;
+      if (buf.length > maxBytes) {
+        reject(new Error(`body exceeds ${maxBytes} bytes`));
+        req.destroy();
+      }
+    });
+    req.on('end', () => resolve(buf));
+    req.on('error', reject);
+  });
+}
+
+export function writeJson(res, status, obj, extraHeaders = {}) {
+  const body = JSON.stringify(obj);
+  res.writeHead(status, {
+    'content-type': 'application/json; charset=utf-8',
+    'content-length': Buffer.byteLength(body),
+    ...extraHeaders,
+  });
+  res.end(body);
+}
+
+// Map provider error codes to HTTP statuses so clients can branch on
+// res.status instead of parsing error messages. Returns
+// { status, headers? } so 429 can attach a Retry-After.
+//
+// Exported for unit testing without spinning up an actual provider that
+// would only fail under live network conditions.
+export function statusForProviderError(err) {
+  if (err?.code === 'INVALID_KEY') return { status: 401 };
+  if (err?.code === 'RATE_LIMIT') {
+    const retrySeconds = Math.max(1, Math.ceil((err.retryAfterMs || 1000) / 1000));
+    return { status: 429, headers: { 'retry-after': String(retrySeconds) } };
+  }
+  if (err?.status && err.status >= 400 && err.status < 600) return { status: err.status };
+  return { status: 502 };
+}
+
+export function writeSseHead(res) {
+  res.writeHead(200, {
+    'content-type': 'text/event-stream; charset=utf-8',
+    'cache-control': 'no-cache, no-transform',
+    'connection': 'close',
+  });
+}
+
+export function writeSse(res, event, data) {
+  if (event) res.write(`event: ${event}\n`);
+  res.write(`data: ${JSON.stringify(data)}\n\n`);
+}

package/daemon/route_table.mjs

@@ -0,0 +1,96 @@
+// Ordered route table for the daemon. The dispatch loop in makeHandler
+// walks this array top-to-bottom and runs the first entry whose `m`
+// predicate matches the request — FIRST MATCH WINS.
+//
+// The order here is IDENTICAL to the original makeHandler `switch (true)`
+// case order. Several predicates are exclusion-based (e.g.
+// `providerMatch[1] !== 'test'`, `configKeyMatch[1] !== 'validate'`) and
+// rely on that ordering to stay correct. DO NOT REORDER.
+//
+// `m(c)` receives the per-request dispatch context built in makeHandler
+// (route/method/url + the pre-computed path-param regex matches). `h(c)`
+// is the matching route handler.
+
+import * as meta from './routes/meta.mjs';
+import * as providers from './routes/providers.mjs';
+import * as rates from './routes/rates.mjs';
+import * as config from './routes/config.mjs';
+import * as sessions from './routes/sessions.mjs';
+import * as workflows from './routes/workflows.mjs';
+import * as skills from './routes/skills.mjs';
+import * as conversation from './routes/conversation.mjs';
+import * as registry from './routes/registry.mjs';
+import * as ops from './routes/ops.mjs';
+
+export const ROUTES = [
+  { m: (c) => c.route === 'GET /' || c.route === 'GET /dashboard', h: meta.dashboard },
+  { m: (c) => c.route === 'GET /dashboard.css', h: meta.dashboardCss },
+  { m: (c) => c.route === 'GET /dashboard.js', h: meta.dashboardJs },
+  { m: (c) => c.route === 'GET /version', h: meta.version },
+  { m: (c) => c.route === 'POST /exec/request', h: conversation.execRequest },
+  { m: (c) => c.route === 'GET /health' || c.route === 'GET /healthz', h: meta.health },
+  { m: (c) => c.route === 'GET /metrics', h: meta.metrics },
+  { m: (c) => c.route === 'GET /providers', h: providers.providersList },
+  { m: (c) => c.req.method === 'GET' && !!c.providerMatch && c.providerMatch[1] !== 'test', h: providers.providerGet },
+  { m: (c) => c.route === 'GET /providers/test', h: providers.providersTest },
+  { m: (c) => c.req.method === 'GET' && !!c.providerTestMatch, h: providers.providerTest },
+  { m: (c) => c.route === 'POST /providers', h: providers.providersCreate },
+  { m: (c) => c.req.method === 'DELETE' && !!c.providerMatch && c.providerMatch[1] !== 'test', h: providers.providerDelete },
+  { m: (c) => c.route === 'GET /rates', h: rates.ratesList },
+  { m: (c) => c.route === 'GET /rates/validate', h: rates.ratesValidate },
+  { m: (c) => c.route === 'GET /rates/shape', h: rates.ratesShape },
+  { m: (c) => c.req.method === 'PUT' && !!c.ratesKeyMatch && c.ratesKeyMatch[1] !== 'validate' && c.ratesKeyMatch[1] !== 'shape', h: rates.ratePut },
+  { m: (c) => c.req.method === 'DELETE' && !!c.ratesKeyMatch && c.ratesKeyMatch[1] !== 'validate' && c.ratesKeyMatch[1] !== 'shape', h: rates.rateDelete },
+  { m: (c) => c.route === 'GET /status', h: meta.status },
+  { m: (c) => c.route === 'GET /config/validate', h: config.configValidate },
+  { m: (c) => c.route === 'GET /config', h: config.configGet },
+  { m: (c) => c.req.method === 'GET' && !!c.configKeyMatch && c.configKeyMatch[1] !== 'validate', h: config.configKeyGet },
+  { m: (c) => c.req.method === 'PUT' && !!c.configKeyMatch && c.configKeyMatch[1] !== 'validate', h: config.configKeyPut },
+  { m: (c) => c.req.method === 'DELETE' && !!c.configKeyMatch && c.configKeyMatch[1] !== 'validate', h: config.configKeyDelete },
+  { m: (c) => c.route === 'GET /doctor', h: meta.doctor },
+  { m: (c) => c.route === 'GET /sessions', h: sessions.sessionsList },
+  { m: (c) => c.route === 'GET /sessions/search', h: sessions.sessionsSearch },
+  { m: (c) => c.req.method === 'GET' && !!c.sessionExportMatch, h: sessions.sessionExport },
+  { m: (c) => c.req.method === 'GET' && !!c.sessionMatch, h: sessions.sessionGet },
+  { m: (c) => c.route === 'GET /workflows/aggregate', h: workflows.workflowsAggregate },
+  { m: (c) => c.route === 'GET /workflows', h: workflows.workflowsList },
+  { m: (c) => c.req.method === 'GET' && !!c.workflowMatch, h: workflows.workflowGet },
+  { m: (c) => c.route === 'GET /skills', h: skills.skillsList },
+  { m: (c) => c.route === 'GET /skills/suggestions', h: skills.skillsSuggestions },
+  { m: (c) => c.route === 'POST /skills/synth', h: skills.skillsSynth },
+  { m: (c) => c.route === 'GET /skills/search', h: skills.skillsSearch },
+  { m: (c) => c.req.method === 'GET' && !!c.skillMatch, h: skills.skillGet },
+  { m: (c) => c.req.method === 'PUT' && !!c.skillMatch, h: skills.skillPut },
+  { m: (c) => c.req.method === 'DELETE' && !!c.skillMatch, h: skills.skillDelete },
+  { m: (c) => c.req.method === 'DELETE' && !!c.sessionMatch, h: sessions.sessionDelete },
+  { m: (c) => c.req.method === 'DELETE' && !!c.workflowMatch, h: workflows.workflowDelete },
+  { m: (c) => c.route === 'POST /chat', h: conversation.chat },
+  { m: (c) => c.route === 'POST /inbound', h: conversation.inbound },
+  { m: (c) => c.route === 'POST /handoff', h: conversation.handoff },
+  { m: (c) => c.route === 'POST /agent', h: conversation.agent },
+  { m: (c) => c.route === 'GET /agents', h: registry.agentsList },
+  { m: (c) => c.route === 'POST /agents', h: registry.agentsCreate },
+  { m: (c) => c.req.method === 'GET' && /^\/agents\/([^/]+)$/.test(c.url.pathname), h: registry.agentGet },
+  { m: (c) => c.req.method === 'PATCH' && /^\/agents\/([^/]+)$/.test(c.url.pathname), h: registry.agentPatch },
+  { m: (c) => c.req.method === 'DELETE' && /^\/agents\/([^/]+)$/.test(c.url.pathname), h: registry.agentDelete },
+  { m: (c) => c.req.method === 'GET' && /^\/agents\/([^/]+)\/memory$/.test(c.url.pathname), h: registry.agentMemoryGet },
+  { m: (c) => c.req.method === 'PUT' && /^\/agents\/([^/]+)\/memory$/.test(c.url.pathname), h: registry.agentMemoryPut },
+  { m: (c) => c.req.method === 'DELETE' && /^\/agents\/([^/]+)\/memory$/.test(c.url.pathname), h: registry.agentMemoryDelete },
+  { m: (c) => c.route === 'GET /teams', h: registry.teamsList },
+  { m: (c) => c.route === 'POST /teams', h: registry.teamsCreate },
+  { m: (c) => c.req.method === 'GET' && /^\/teams\/([^/]+)$/.test(c.url.pathname), h: registry.teamGet },
+  { m: (c) => c.req.method === 'PATCH' && /^\/teams\/([^/]+)$/.test(c.url.pathname), h: registry.teamPatch },
+  { m: (c) => c.req.method === 'DELETE' && /^\/teams\/([^/]+)$/.test(c.url.pathname), h: registry.teamDelete },
+  { m: (c) => c.route === 'GET /tasks', h: registry.tasksList },
+  { m: (c) => c.req.method === 'GET' && /^\/tasks\/([^/]+)\/transcript$/.test(c.url.pathname), h: registry.taskTranscript },
+  { m: (c) => c.req.method === 'GET' && /^\/tasks\/([^/]+)$/.test(c.url.pathname), h: registry.taskGet },
+  { m: (c) => c.req.method === 'DELETE' && /^\/tasks\/([^/]+)$/.test(c.url.pathname), h: registry.taskDelete },
+  { m: (c) => c.req.method === 'POST' && /^\/tasks\/([^/]+)\/(done|abandon)$/.test(c.url.pathname), h: registry.taskAction },
+  { m: (c) => c.route === 'GET /trainer/status', h: ops.trainerStatus },
+  { m: (c) => c.route === 'GET /recall', h: ops.recall },
+  { m: (c) => c.route === 'GET /sandbox', h: ops.sandboxList },
+  { m: (c) => c.req.method === 'POST' && /^\/sandbox\/([^/]+)\/test$/.test(c.url.pathname), h: ops.sandboxTest },
+  { m: (c) => c.route === 'POST /sandbox/use', h: ops.sandboxUse },
+  { m: (c) => c.route === 'GET /channels', h: ops.channels },
+  { m: (c) => c.route === 'POST /index/rebuild', h: ops.indexRebuild },
+];

package/daemon/routes/_deps.mjs

@@ -0,0 +1,36 @@
+// Dependency barrel for daemon route modules. Re-exports every
+// module-level helper/import that route handler bodies reference, so each
+// route module can pull them with a single import and the handler bodies
+// stay byte-identical to their original form in makeHandler.
+
+import fs from 'node:fs';
+import nodePath from 'node:path';
+export { fs, nodePath };
+
+export { PROVIDERS, PROVIDER_INFO, maskApiKey } from '../../providers/registry.mjs';
+export { costFromUsage, RATE_CARD_SHAPE } from '../../providers/rates.mjs';
+export {
+  composeSystemPrompt, listSkills, loadSkill, skillPath, installSkill,
+  removeSkill, parseFrontmatter, defaultConfigDir as skillsDefaultConfigDir,
+} from '../../skills.mjs';
+export * as indexDb from '../../mas/index_db.mjs';
+export * as skillSynth from '../../mas/skill_synth.mjs';
+export { listBackends as sandboxListBackends } from '../../sandbox/index.mjs';
+export {
+  summarizeState, listSessions as listWorkflowSessions,
+  loadStateFile as loadWorkflowState, aggregateNodeStats,
+} from '../../workflow/summary.mjs';
+export { validateConfig } from '../../config-validate.mjs';
+export { validateRates } from '../../rates-validate.mjs';
+
+export {
+  fileExists, readJson, readTextBody, writeJson, writeSseHead, writeSse,
+  statusForProviderError,
+} from '../lib/respond.mjs';
+export { checkCostCap, accumulateMetricsFromCost } from '../lib/cost.mjs';
+export { resolveProvider } from '../lib/provider.mjs';
+// F5/F6 — cross-channel handoff: the threads store + the rollback-aware
+// migration helper, so the conversation routes can bind inbound messages to a
+// persistent thread/session and re-point them across channels.
+export { openThreads } from '../../channels/threads.mjs';
+export { handoffWithRollback } from '../../channels/handoff.mjs';

package/daemon/routes/config.mjs

@@ -0,0 +1,99 @@
+// Daemon route handlers (config), extracted verbatim from makeHandler (D5).
+// Each handler takes the per-request dispatch context `c` and returns the
+// HTTP response. Bodies are unchanged; only the dispatch wrapper is new.
+import { fs, nodePath, PROVIDERS, PROVIDER_INFO, maskApiKey, costFromUsage, RATE_CARD_SHAPE, composeSystemPrompt, listSkills, loadSkill, skillPath, installSkill, removeSkill, parseFrontmatter, skillsDefaultConfigDir, indexDb, skillSynth, sandboxListBackends, summarizeState, listWorkflowSessions, loadWorkflowState, aggregateNodeStats, validateConfig, validateRates, fileExists, readJson, readTextBody, writeJson, writeSseHead, writeSse, statusForProviderError, checkCostCap, accumulateMetricsFromCost, resolveProvider } from './_deps.mjs';
+
+export async function configValidate(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Mirror of v3.39's `lazyclaw config validate`. Same shape
+          // (single source of truth in config-validate.mjs). HTTP
+          // status reflects ok/issues so a UI's "config status"
+          // badge can branch on HTTP code: 200 = ok, 422 = issues
+          // (Unprocessable Entity — semantically right for "the
+          // config you supplied is malformed").
+          const cfg = ctx.readConfig();
+          const { ok, issues, warnings } = validateConfig(cfg, PROVIDERS);
+          return writeJson(res, ok ? 200 : 422, {
+            ok,
+            keys: Object.keys(cfg),
+            issues,
+            warnings,
+          });
+}
+
+export async function configGet(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Mirror of `lazyclaw config list`. Returns every stored key
+          // with the api-key value masked — lets a dashboard or script
+          // inspect the active configuration without shelling to the CLI.
+          const cfg = ctx.readConfig();
+          const safe = { ...cfg };
+          if (safe['api-key']) safe['api-key'] = maskApiKey(safe['api-key']);
+          return writeJson(res, 200, safe);
+}
+
+export async function configKeyGet(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Mirror of `lazyclaw config get <key>`. The `!== 'validate'`
+          // guard ensures the literal GET /config/validate case (above)
+          // is never shadowed by this dynamic handler.
+          const key = configKeyMatch[1];
+          const cfg = ctx.readConfig();
+          if (!(key in cfg)) {
+            return writeJson(res, 404, { error: 'key not found', key });
+          }
+          const raw = cfg[key];
+          const value = key === 'api-key' ? maskApiKey(raw) : raw;
+          return writeJson(res, 200, { key, value });
+}
+
+export async function configKeyPut(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // PUT /config/<key>  body: { value: <any> }
+          // Mirror of `lazyclaw config set <key> <value>`. Re-validates the
+          // whole config after the write so we never persist a broken state.
+          // Nested cargo (customProviders / rates / authProfiles) goes
+          // through its own dedicated endpoint — guarded here so a
+          // dashboard PUT can't bypass schema validation.
+          if (typeof ctx.writeConfig !== 'function') {
+            return writeJson(res, 405, { error: 'mutation disabled' });
+          }
+          const key = configKeyMatch[1];
+          if (key === 'customProviders' || key === 'rates' || key === 'authProfiles') {
+            return writeJson(res, 400, {
+              error: `use the dedicated endpoint for "${key}" — POST /providers · PUT /rates/<key> · authProfiles via CLI`,
+            });
+          }
+          let body;
+          try { body = await readJson(req); }
+          catch (e) { return writeJson(res, 400, { error: e?.message || String(e) }); }
+          const value = body && Object.prototype.hasOwnProperty.call(body, 'value') ? body.value : undefined;
+          const cfg = ctx.readConfig();
+          if (value === null || value === undefined) delete cfg[key];
+          else cfg[key] = value;
+          const v = validateConfig(cfg, PROVIDERS);
+          if (!v.ok) return writeJson(res, 422, v);
+          ctx.writeConfig(cfg);
+          const stored = key === 'api-key' && typeof cfg[key] === 'string' ? maskApiKey(cfg[key]) : cfg[key];
+          return writeJson(res, 200, { ok: true, key, value: stored });
+}
+
+export async function configKeyDelete(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // DELETE /config/<key> — same as `lazyclaw config delete`.
+          // Idempotent: 200 with `removed: false` when the key wasn't
+          // present.
+          if (typeof ctx.writeConfig !== 'function') {
+            return writeJson(res, 405, { error: 'mutation disabled' });
+          }
+          const key = configKeyMatch[1];
+          if (key === 'customProviders' || key === 'rates' || key === 'authProfiles') {
+            return writeJson(res, 400, { error: `delete via the dedicated endpoint for "${key}"` });
+          }
+          const cfg = ctx.readConfig();
+          if (!(key in cfg)) return writeJson(res, 200, { ok: true, key, removed: false });
+          delete cfg[key];
+          ctx.writeConfig(cfg);
+          return writeJson(res, 200, { ok: true, key, removed: true });
+}
+