lazyclaw 6.0.0 → 6.1.0

package/daemon/routes/meta.mjs

@@ -0,0 +1,239 @@
+// Daemon route handlers (meta), extracted verbatim from makeHandler (D5).
+// Each handler takes the per-request dispatch context `c` and returns the
+// HTTP response. Bodies are unchanged; only the dispatch wrapper is new.
+import { fs, nodePath, PROVIDERS, PROVIDER_INFO, maskApiKey, costFromUsage, RATE_CARD_SHAPE, composeSystemPrompt, listSkills, loadSkill, skillPath, installSkill, removeSkill, parseFrontmatter, skillsDefaultConfigDir, indexDb, skillSynth, sandboxListBackends, summarizeState, listWorkflowSessions, loadWorkflowState, aggregateNodeStats, validateConfig, validateRates, fileExists, readJson, readTextBody, writeJson, writeSseHead, writeSse, statusForProviderError, checkCostCap, accumulateMetricsFromCost, resolveProvider } from './_deps.mjs';
+import { fileURLToPath } from 'node:url';
+
+// Serve a static asset that lives alongside the dashboard HTML in web/.
+// Used for the split-out dashboard.css / dashboard.js (CLAUDE.md §7: one
+// file = one responsibility). Same loopback origin as the JSON API, so no
+// CORS handling is needed. Returns 404 (not the dashboard's 503 install
+// hint) since a missing asset is a narrower failure.
+function serveWebFile(c, filename, contentType) {
+  const { res } = c;
+  try {
+    const here = nodePath.dirname(fileURLToPath(import.meta.url));
+    const filePath = nodePath.join(here, '..', '..', 'web', filename);
+    const body = fs.readFileSync(filePath);
+    res.writeHead(200, { 'content-type': contentType, 'cache-control': 'no-cache' });
+    return res.end(body);
+  } catch (e) {
+    res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
+    return res.end(`not found: ${filename} (${e?.message || e})\n`);
+  }
+}
+
+export async function dashboardCss(c) {
+  return serveWebFile(c, 'dashboard.css', 'text/css; charset=utf-8');
+}
+
+export async function dashboardJs(c) {
+  return serveWebFile(c, 'dashboard.js', 'text/javascript; charset=utf-8');
+}
+
+export async function dashboard(c) {
+  const { res } = c;
+          // Serve the lazyclaw-only web dashboard (a single static
+          // HTML in src/lazyclaw/web/). Co-resident with the JSON
+          // API so a single port handles both — no CORS song and
+          // dance, no separate static server. Falls back to a
+          // helpful text response when the file is missing (someone
+          // ran the daemon out of a partial install).
+          try {
+            const fs = await import('node:fs');
+            const path = await import('node:path');
+            const url = await import('node:url');
+            const here = path.dirname(url.fileURLToPath(import.meta.url));
+            const htmlPath = path.join(here, '..', '..', 'web', 'dashboard.html');
+            const body = fs.readFileSync(htmlPath, 'utf8');
+            res.writeHead(200, {
+              'content-type': 'text/html; charset=utf-8',
+              'cache-control': 'no-cache',
+            });
+            return res.end(body);
+          } catch (e) {
+            res.writeHead(503, { 'content-type': 'text/plain; charset=utf-8' });
+            return res.end(
+              `lazyclaw daemon is up but the dashboard HTML wasn't found.\n` +
+              `Try \`lazyclaw version\` to confirm install integrity, or hit any /api endpoint directly.\n\n` +
+              `error: ${e?.message || e}\n`,
+            );
+          }
+}
+
+export async function version(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          return writeJson(res, 200, { version: ctx.version(), nodeVersion: process.version, platform: `${process.platform}-${process.arch}` });
+}
+
+export async function health(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Conventional liveness check — always 200 if the process
+          // is alive enough to hit the route. No config inspection
+          // (use /doctor for readiness), no provider probing — this
+          // is the "is the daemon up?" probe that load balancers
+          // and watchdog scripts expect at this path. m15: K8s
+          // readiness probes default to /healthz so we alias.
+          return writeJson(res, 200, {
+            ok: true,
+            status: 'alive',
+            uptimeMs: Date.now() - metrics.startedAtMs,
+            timestamp: new Date().toISOString(),
+          });
+}
+
+export async function metrics(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Aggregate per-handler counters. cacheStats are pulled per
+          // wrapped provider — we report a sum across all populated
+          // entries so the figure reflects total cache activity.
+          let cacheHits = 0, cacheMisses = 0, cacheSize = 0;
+          if (cachedByName) {
+            for (const wrapped of cachedByName.values()) {
+              const s = typeof wrapped.cacheStats === 'function' ? wrapped.cacheStats() : null;
+              if (s) {
+                cacheHits += s.hits || 0;
+                cacheMisses += s.misses || 0;
+                cacheSize += s.size || 0;
+              }
+            }
+          }
+          // Cumulative tokens / cost — meaningful only when callers used
+          // body.usage / body.cost. The fields are always present (zero
+          // by default) so monitoring tooling sees a stable schema.
+          const tokensTotal = { ...metrics.tokensTotal };
+          const costs = {};
+          for (const [cur, n] of Object.entries(metrics.costsByCurrency)) {
+            // Round to six decimals here too, matching costFromUsage's
+            // precision so monitoring deltas line up with per-request
+            // breakdowns.
+            costs[cur] = Math.round(n * 1_000_000) / 1_000_000;
+          }
+          // Workflow snapshot — opportunistic. We scan the state dir
+          // once per /metrics call and count per bucket. This is
+          // cheap unless the user has thousands of state files; for
+          // truly large fleets the operator can disable by passing
+          // ctx.workflowMetrics === false.
+          let workflows = null;
+          if (ctx.workflowMetrics !== false) {
+            try {
+              const stateDir = ctx.workflowStateDir();
+              if (fs.existsSync(stateDir)) {
+                const sessions = listWorkflowSessions(stateDir);
+                workflows = { total: sessions.length, done: 0, resumable: 0, failed: 0, running: 0 };
+                for (const s of sessions) {
+                  if (s.summary.done)        workflows.done++;
+                  if (s.summary.resumable)   workflows.resumable++;
+                  if (s.summary.failed > 0)  workflows.failed++;
+                  if (s.summary.running > 0) workflows.running++;
+                }
+              } else {
+                workflows = { total: 0, done: 0, resumable: 0, failed: 0, running: 0 };
+              }
+            } catch {
+              // Don't fail /metrics because the state dir is unreadable —
+              // expose the gap as null and keep monitoring alive.
+              workflows = null;
+            }
+          }
+          return writeJson(res, 200, {
+            uptimeMs: Date.now() - metrics.startedAtMs,
+            requestsTotal: metrics.requestsTotal,
+            requestsByStatus: metrics.requestsByStatus,
+            rateLimitDenied: metrics.rateLimitDenied,
+            cache: cachedByName ? { hits: cacheHits, misses: cacheMisses, size: cacheSize } : null,
+            tokensTotal,
+            costsByCurrency: costs,
+            workflows,
+            timestamp: new Date().toISOString(),
+          });
+}
+
+export async function status(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          const cfg = ctx.readConfig();
+          // v5: surface a one-line summary of trainer / index / sandbox so
+          // the dashboard banner doesn't need three more round-trips.
+          const trainerCfg = (cfg.trainer && typeof cfg.trainer === 'object') ? cfg.trainer : {};
+          const sandboxBackend = (cfg.sandbox && typeof cfg.sandbox === 'object' && cfg.sandbox.default) || 'local';
+          let indexRows = null;
+          try {
+            const db = indexDb.openIndex(gwConfigDir, { runIntegrityCheck: false });
+            const r = db.prepare(
+              "SELECT (SELECT COUNT(*) FROM fts_sessions) + (SELECT COUNT(*) FROM fts_skills) " +
+              " + (SELECT COUNT(*) FROM fts_trajectories) + (SELECT COUNT(*) FROM fts_memories) AS n"
+            ).get();
+            indexRows = r && typeof r.n === 'number' ? r.n : null;
+          } catch { /* index may not exist yet */ }
+          // Migration backup path is conventionally <configDir>/backup-v4/.
+          let migrateBackup = null;
+          try {
+            const p = nodePath.join(gwConfigDir || skillsDefaultConfigDir(), 'backup-v4');
+            if (fs.existsSync(p)) migrateBackup = p;
+          } catch { /* ignore */ }
+          return writeJson(res, 200, {
+            provider: cfg.provider || null,
+            model: cfg.model || null,
+            keyMasked: maskApiKey(cfg['api-key']),
+            v5: {
+              trainer: {
+                provider: trainerCfg.provider || null,
+                model: trainerCfg.model || null,
+              },
+              sandboxBackend,
+              indexRows,
+              migrateBackup,
+            },
+          });
+}
+
+export async function doctor(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Mirror the CLI doctor output — same field set so any tool that
+          // already knows how to read CLI doctor JSON can hit this endpoint.
+          const cfg = ctx.readConfig();
+          const issues = [];
+          if (!cfg.provider) issues.push('config.provider is missing');
+          if (cfg.provider && cfg.provider !== 'mock' && !cfg['api-key']) {
+            issues.push(`config['api-key'] is missing for provider "${cfg.provider}"`);
+          }
+          if (cfg.provider && !Object.prototype.hasOwnProperty.call(PROVIDERS, cfg.provider)) {
+            issues.push(`unknown provider "${cfg.provider}"`);
+          }
+          // v5: FTS5 index integrity. Failure here is degraded-not-fatal —
+          // surfaced as an issue but doesn't take the daemon down.
+          let indexBlock = null;
+          try {
+            const integ = indexDb.integrityCheck(gwConfigDir);
+            const db = indexDb.openIndex(gwConfigDir, { runIntegrityCheck: false });
+            const rowCounts = {};
+            for (const t of ['fts_sessions', 'fts_skills', 'fts_trajectories', 'fts_memories']) {
+              try { rowCounts[t] = db.prepare(`SELECT COUNT(*) AS n FROM ${t}`).get().n; }
+              catch { rowCounts[t] = null; }
+            }
+            indexBlock = {
+              ok: !!integ.ok,
+              result: integ.result || null,
+              rowCounts,
+              lastRebuiltAt: ctx.indexLastRebuiltAt || null,
+            };
+            if (!integ.ok) issues.push(`FTS5 index integrity_check returned ${integ.result}`);
+          } catch (e) {
+            indexBlock = { ok: false, error: e?.message || String(e), rowCounts: {}, lastRebuiltAt: null };
+            issues.push(`FTS5 index unavailable: ${e?.message || e}`);
+          }
+          const ok = issues.length === 0;
+          return writeJson(res, ok ? 200 : 503, {
+            ok,
+            provider: cfg.provider || null,
+            model: cfg.model || null,
+            hasApiKey: !!cfg['api-key'],
+            nodeVersion: process.version,
+            platform: `${process.platform}-${process.arch}`,
+            issues,
+            knownProviders: Object.keys(PROVIDERS),
+            index: indexBlock,
+            timestamp: new Date().toISOString(),
+          });
+}
+

package/daemon/routes/ops.mjs

@@ -0,0 +1,165 @@
+// Daemon route handlers (ops), extracted verbatim from makeHandler (D5).
+// Each handler takes the per-request dispatch context `c` and returns the
+// HTTP response. Bodies are unchanged; only the dispatch wrapper is new.
+import { fs, nodePath, PROVIDERS, PROVIDER_INFO, maskApiKey, costFromUsage, RATE_CARD_SHAPE, composeSystemPrompt, listSkills, loadSkill, skillPath, installSkill, removeSkill, parseFrontmatter, skillsDefaultConfigDir, indexDb, skillSynth, sandboxListBackends, summarizeState, listWorkflowSessions, loadWorkflowState, aggregateNodeStats, validateConfig, validateRates, fileExists, readJson, readTextBody, writeJson, writeSseHead, writeSse, statusForProviderError, checkCostCap, accumulateMetricsFromCost, resolveProvider } from './_deps.mjs';
+
+// Channel meta + status now live in config_features.mjs (single source for the
+// daemon route, the CLI `channels` command, and the /channels slash). Re-export
+// KNOWN_CHANNELS so existing importers (the drift-guard test) keep working.
+export { KNOWN_CHANNELS } from '../../config_features.mjs';
+import { channelStatusList } from '../../config_features.mjs';
+
+export async function trainerStatus(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Reads cfg.trainer.{provider, model, schedule, budget, recipe}
+          // and reports last-run state from <configDir>/trainer-state.json
+          // if present. No standalone trainer module yet; this is a thin
+          // config-surface endpoint the dashboard reads at refresh.
+          const cfg = ctx.readConfig();
+          const t = (cfg.trainer && typeof cfg.trainer === 'object') ? cfg.trainer : {};
+          let lastRunAt = null, callsToday = null;
+          try {
+            const statePath = nodePath.join(gwConfigDir || skillsDefaultConfigDir(), 'trainer-state.json');
+            if (fs.existsSync(statePath)) {
+              const st = JSON.parse(fs.readFileSync(statePath, 'utf8'));
+              lastRunAt = st?.lastRunAt || null;
+              // callsToday: count entries whose ts is within the current
+              // UTC day. State writer is the (future) trainer; reader
+              // tolerates absence.
+              const today = new Date().toISOString().slice(0, 10);
+              if (Array.isArray(st?.calls)) {
+                callsToday = st.calls.filter((c) => String(c.ts || '').startsWith(today)).length;
+              } else if (typeof st?.callsToday === 'number') {
+                callsToday = st.callsToday;
+              }
+            }
+          } catch { /* missing/corrupt state → null */ }
+          return writeJson(res, 200, {
+            provider: t.provider || null,
+            model: t.model || null,
+            schedule: t.schedule || null,
+            budget: t.budget != null ? Number(t.budget) : null,
+            recipe: t.recipe || null,
+            lastRunAt,
+            callsToday,
+          });
+}
+
+export async function recall(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // GET /recall?q=...&scope=sessions|skills|trajectories|memories|all&k=N
+          const q = url.searchParams.get('q');
+          if (!q) return writeJson(res, 400, { error: 'missing q query parameter' });
+          const scopeParam = url.searchParams.get('scope') || 'all';
+          const scope = scopeParam === 'all'
+            ? ['sessions', 'skills', 'trajectories', 'memories']
+            : scopeParam.split(',').map((x) => x.trim()).filter(Boolean);
+          const kParam = url.searchParams.get('k');
+          const k = kParam ? Math.max(1, Math.min(50, parseInt(kParam, 10) || 10)) : 10;
+          try {
+            const r = indexDb.recall(q, { configDir: gwConfigDir, scope, k });
+            return writeJson(res, 200, r);
+          } catch (e) {
+            return writeJson(res, 500, { error: e?.message || String(e) });
+          }
+}
+
+export async function sandboxList(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          const cfg = ctx.readConfig();
+          const sb = (cfg.sandbox && typeof cfg.sandbox === 'object') ? cfg.sandbox : {};
+          const active = sb.default || 'local';
+          const profiles = sandboxListBackends().map((name) => {
+            const section = sb[name];
+            const configured = !!section && typeof section === 'object';
+            let summary = '';
+            if (configured) {
+              if (name === 'docker' && section.image) summary = `image: ${section.image}`;
+              else if (name === 'ssh' && section.host) summary = `host: ${section.host}`;
+              else if (name === 'singularity' && section.image) summary = `image: ${section.image}`;
+              else if (name === 'modal' && section.app) summary = `app: ${section.app}`;
+              else if (name === 'daytona' && section.workspace) summary = `workspace: ${section.workspace}`;
+              else if (name === 'local' && section.confiner) summary = `confiner: ${section.confiner}`;
+            }
+            return { name, configured, summary };
+          });
+          return writeJson(res, 200, { profiles, active });
+}
+
+export async function sandboxTest(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // POST /sandbox/<name>/test — opens a session against the named
+          // backend, runs `echo hello`, returns { ok, durationMs, stdout }.
+          const name = url.pathname.match(/^\/sandbox\/([^/]+)\/test$/)[1];
+          try {
+            const sandboxMod = await import('../../sandbox/index.mjs');
+            const cfg = ctx.readConfig();
+            // Synthesise a one-off cfg.sandbox.default override so we can
+            // test a backend without mutating the user's persisted choice.
+            const probeCfg = {
+              ...cfg,
+              sandbox: { ...(cfg.sandbox || {}), default: name },
+            };
+            const t0 = Date.now();
+            const box = sandboxMod.resolveSandbox(probeCfg, null);
+            const sess = await box.open();
+            let result;
+            try {
+              result = await sess.exec(['echo', 'hello'], { stdio: 'pipe' });
+            } finally {
+              try { await sess.close(); } catch { /* ignore */ }
+            }
+            const durationMs = Date.now() - t0;
+            const ok = result.code === 0;
+            return writeJson(res, ok ? 200 : 500, {
+              ok,
+              durationMs,
+              code: result.code,
+              stdout: String(result.stdout || '').slice(0, 200),
+              stderr: String(result.stderr || '').slice(0, 200),
+            });
+          } catch (e) {
+            return writeJson(res, 500, { ok: false, error: e?.message || String(e), code: e?.code });
+          }
+}
+
+export async function sandboxUse(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          if (typeof ctx.writeConfig !== 'function') {
+            return writeJson(res, 405, { error: 'mutation disabled' });
+          }
+          let body;
+          try { body = await readJson(req); }
+          catch (e) { return writeJson(res, 400, { error: e?.message || String(e) }); }
+          const name = body && String(body.name || '').trim();
+          if (!name) return writeJson(res, 400, { error: 'name is required' });
+          if (!sandboxListBackends().includes(name)) {
+            return writeJson(res, 400, { error: `unknown sandbox backend: ${name}` });
+          }
+          const cfg = ctx.readConfig();
+          cfg.sandbox = { ...(cfg.sandbox || {}), default: name };
+          ctx.writeConfig(cfg);
+          return writeJson(res, 200, { ok: true, active: name });
+}
+
+export async function channels(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Aggregate cfg.channels.<name> via the shared status helper so the
+          // dashboard, CLI, and /channels slash all report identically.
+          const cfg = ctx.readConfig();
+          return writeJson(res, 200, { channels: channelStatusList(cfg) });
+}
+
+export async function indexRebuild(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          try {
+            // reindexAll, not rebuild: a bare rebuild zeroes the FTS index and
+            // never repopulates, so this route used to silently wipe recall.
+            indexDb.reindexAll(gwConfigDir);
+            ctx.indexLastRebuiltAt = new Date().toISOString();
+            return writeJson(res, 200, { ok: true, rebuiltAt: ctx.indexLastRebuiltAt });
+          } catch (e) {
+            return writeJson(res, 500, { ok: false, error: e?.message || String(e) });
+          }
+}
+

package/daemon/routes/providers.mjs

@@ -0,0 +1,211 @@
+// Daemon route handlers (providers), extracted verbatim from makeHandler (D5).
+// Each handler takes the per-request dispatch context `c` and returns the
+// HTTP response. Bodies are unchanged; only the dispatch wrapper is new.
+import { fs, nodePath, PROVIDERS, PROVIDER_INFO, maskApiKey, costFromUsage, RATE_CARD_SHAPE, composeSystemPrompt, listSkills, loadSkill, skillPath, installSkill, removeSkill, parseFrontmatter, skillsDefaultConfigDir, indexDb, skillSynth, sandboxListBackends, summarizeState, listWorkflowSessions, loadWorkflowState, aggregateNodeStats, validateConfig, validateRates, fileExists, readJson, readTextBody, writeJson, writeSseHead, writeSse, statusForProviderError, checkCostCap, accumulateMetricsFromCost, resolveProvider } from './_deps.mjs';
+
+export async function providersList(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // ?filter=<substr>&limit=<N> mirror v3.33+ list flags.
+          // The dashboard reads `custom` / `builtinOpenAICompat` / `endpoint`
+          // / `docs` to render the right pills + tooltips; CLI callers only
+          // need `name` / `requiresApiKey` / `suggestedModels` and ignore
+          // the extras (additive change, no migration).
+          let out = Object.keys(PROVIDERS).map(name => {
+            const meta = PROVIDER_INFO[name] || { name };
+            return {
+              name,
+              requiresApiKey: !!meta.requiresApiKey,
+              defaultModel: meta.defaultModel || null,
+              suggestedModels: meta.suggestedModels || [],
+              endpoint: meta.endpoint || null,
+              docs: meta.docs || null,
+              custom: !!meta.custom,
+              builtinOpenAICompat: !!meta.builtinOpenAICompat,
+              baseUrl: meta.baseUrl || null,
+              envKey: meta.envKey || null,
+              keyPrefix: meta.keyPrefix || null,
+            };
+          });
+          const filter = url.searchParams.get('filter');
+          if (filter) {
+            const f = filter.toLowerCase();
+            out = out.filter(p => p.name.toLowerCase().includes(f));
+          }
+          const limitStr = url.searchParams.get('limit');
+          if (limitStr) {
+            const n = parseInt(limitStr, 10);
+            if (Number.isFinite(n) && n > 0) out = out.slice(0, n);
+          }
+          return writeJson(res, 200, out);
+}
+
+export async function providerGet(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // GET /providers/<name> — full per-provider metadata
+          // (mirrors CLI `lazyclaw providers info <name>`).
+          // The `name !== 'test'` guard keeps `/providers/test`
+          // (parallel batch endpoint) from being intercepted here;
+          // switch-case order ensures the literal `GET /providers/test`
+          // case runs first anyway, but the guard makes the intent
+          // explicit for future readers.
+          const name = providerMatch[1];
+          const meta = PROVIDER_INFO[name];
+          if (!meta) {
+            return writeJson(res, 404, {
+              error: 'unknown provider',
+              name,
+              knownProviders: Object.keys(PROVIDERS),
+            });
+          }
+          return writeJson(res, 200, meta);
+}
+
+export async function providersTest(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Mirror of CLI v3.55 `lazyclaw providers test` (no name).
+          // A dashboard's "key validity" badge calls this once and
+          // gets a per-provider verdict in one round trip. HTTP
+          // status mirrors CLI exit code:
+          //   200 — every provider returned a non-empty reply
+          //   503 — at least one provider failed (Service Unavailable;
+          //         "the system is partially unhealthy")
+          // 503 is the right code because a dashboard observing it
+          // can render a yellow status without parsing the body.
+          const cfg = ctx.readConfig();
+          const apiKey = cfg['api-key'] || '';
+          const sharedPrompt = url.searchParams.get('prompt') || 'ping';
+          const tAll = Date.now();
+          const results = await Promise.all(
+            Object.entries(PROVIDERS).map(async ([pid, provider]) => {
+              const meta = PROVIDER_INFO[pid] || {};
+              const model = url.searchParams.get('model') || cfg.model || meta.defaultModel || 'unknown';
+              const t0 = Date.now();
+              try {
+                let reply = '';
+                const stream = provider.sendMessage([{ role: 'user', content: sharedPrompt }], { apiKey, model });
+                for await (const chunk of stream) {
+                  if (typeof chunk === 'string') reply += chunk;
+                }
+                return {
+                  name: pid, ok: reply.length > 0, model,
+                  durationMs: Date.now() - t0,
+                  replyLength: reply.length,
+                };
+              } catch (err) {
+                return {
+                  name: pid, ok: false, model,
+                  durationMs: Date.now() - t0,
+                  error: err?.message || String(err),
+                  code: err?.code || null,
+                };
+              }
+            }),
+          );
+          const allOk = results.every(r => r.ok);
+          return writeJson(res, allOk ? 200 : 503, {
+            ok: allOk,
+            totalDurationMs: Date.now() - tAll,
+            results,
+          });
+}
+
+export async function providerTest(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // GET /providers/<name>/test — single-provider 1-token reachability
+          // probe. Same shape as one entry of GET /providers/test, but the
+          // endpoint stops on the first failure and exposes the reply body
+          // (truncated) so the dashboard can show a real signal of life.
+          const name = providerTestMatch[1];
+          const provider = PROVIDERS[name];
+          if (!provider) return writeJson(res, 404, { error: `unknown provider: ${name}` });
+          const cfg = ctx.readConfig();
+          const apiKey = cfg['api-key'] || '';
+          const meta = PROVIDER_INFO[name] || {};
+          const model = url.searchParams.get('model') || cfg.model || meta.defaultModel || 'unknown';
+          const prompt = url.searchParams.get('prompt') || 'ping';
+          const t0 = Date.now();
+          try {
+            let reply = '';
+            const stream = provider.sendMessage([{ role: 'user', content: prompt }], { apiKey, model });
+            for await (const chunk of stream) {
+              if (typeof chunk === 'string') reply += chunk;
+            }
+            return writeJson(res, reply.length > 0 ? 200 : 503, {
+              ok: reply.length > 0,
+              name, model,
+              durationMs: Date.now() - t0,
+              replyLength: reply.length,
+              reply: reply.slice(0, 500),
+            });
+          } catch (err) {
+            return writeJson(res, 503, {
+              ok: false, name, model,
+              durationMs: Date.now() - t0,
+              error: err?.message || String(err),
+              code: err?.code || null,
+            });
+          }
+}
+
+export async function providersCreate(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Register or overwrite a custom OpenAI-compatible provider.
+          // Body: { name, baseUrl, apiKey?, defaultModel? }. Persists into
+          // cfg.customProviders[] and hot-registers via the registry's
+          // registerCustomProviders() so the new entry is callable in this
+          // same process. 405 when the daemon was started without
+          // writeConfig (read-only mode). The same name as a built-in
+          // OpenAI-compat alias is allowed and overrides the built-in.
+          if (typeof ctx.writeConfig !== 'function') {
+            return writeJson(res, 405, { error: 'mutation disabled — daemon was started without writeConfig' });
+          }
+          let body;
+          try { body = await readJson(req); }
+          catch (e) { return writeJson(res, 400, { error: e?.message || String(e) }); }
+          const reg = await import('../../providers/registry.mjs');
+          let name;
+          try { name = reg.validateCustomProviderName(body.name); }
+          catch (e) { return writeJson(res, 400, { error: e.message }); }
+          if (!body.baseUrl || typeof body.baseUrl !== 'string' || !/^https?:\/\//i.test(body.baseUrl)) {
+            return writeJson(res, 400, { error: 'baseUrl must be a string starting with http:// or https://' });
+          }
+          const cfg = ctx.readConfig();
+          cfg.customProviders = Array.isArray(cfg.customProviders) ? cfg.customProviders : [];
+          const idx = cfg.customProviders.findIndex((p) => p && p.name === name);
+          const entry = {
+            name,
+            baseUrl: String(body.baseUrl).replace(/\/+$/, ''),
+            apiKey: body.apiKey || undefined,
+            defaultModel: body.defaultModel || undefined,
+          };
+          if (idx >= 0) cfg.customProviders[idx] = { ...cfg.customProviders[idx], ...entry };
+          else cfg.customProviders.push(entry);
+          ctx.writeConfig(cfg);
+          try { reg.registerCustomProviders(cfg); } catch { /* keep going */ }
+          const overridesBuiltin = typeof reg.isBuiltinOpenAICompatName === 'function'
+            ? reg.isBuiltinOpenAICompatName(name)
+            : false;
+          return writeJson(res, 200, { ok: true, name, baseUrl: entry.baseUrl, overridesBuiltin });
+}
+
+export async function providerDelete(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // DELETE /providers/<name> — drop a custom registration. Idempotent:
+          // 200 with `removed: false` when the name wasn't a custom entry.
+          // Built-in providers can't be deleted; their PROVIDERS row is
+          // restored on next process boot if the user previously overrode it.
+          if (typeof ctx.writeConfig !== 'function') {
+            return writeJson(res, 405, { error: 'mutation disabled' });
+          }
+          const name = providerMatch[1];
+          const cfg = ctx.readConfig();
+          if (!Array.isArray(cfg.customProviders) || cfg.customProviders.length === 0) {
+            return writeJson(res, 200, { ok: true, name, removed: false });
+          }
+          const before = cfg.customProviders.length;
+          cfg.customProviders = cfg.customProviders.filter((p) => !(p && p.name === name));
+          const removed = cfg.customProviders.length < before;
+          if (removed) ctx.writeConfig(cfg);
+          return writeJson(res, 200, { ok: true, name, removed });
+}
+