Thanks for the thorough review, @manelsen — the config read path analysis is spot on. Here is our plan before we push a revision:

Blocker — GET /api/config path filtering

We will go with Option B (allowlist), matching the approach used for mutations.

Step 1 — Add pub fn isAllowedReadPath to src/config_mutator.zig

A new, separate allowlist for reads — narrower than the mutation list because read access has a different threat model. The mutation allowlist allows channels., security., and models.providers. prefixes that can all contain API keys and tokens. The read allowlist will cover only clearly non-sensitive dotted paths (e.g. default_temperature, reasoning_effort, gateway.port, gateway.host, tunnel.provider, agents.defaults.model.primary, and the memory. and scheduler. prefixes). The channels.*, security.*, and models.providers.* prefixes will be absent from the read list.

Step 2 — Guard handleConfig in src/api/api.zig

After extracting path_param, add before the getPathValueJson call:

if (!config_mutator.isAllowedReadPath(path_param)) {
    try ctx.sendError("403 Forbidden", "PATH_FORBIDDEN", "that config path is not readable via the API");
    return;
}

Step 3 — Add regression tests

Two new test cases in src/api/api.zig:

• GET /api/config?path=models.providers.0.api_key → 403 PATH_FORBIDDEN
• GET /api/config?path=channels.telegram.accounts.default.bot_token → 403 PATH_FORBIDDEN

Plus a positive case (default_temperature) to confirm the allowlist is wired correctly.

Also add tests for isAllowedReadPath in config_mutator.zig covering at least one forbidden prefix and one allowed path.

Minor notes we will also address

sendError doc comment — we will add a // NOTE: message must contain no JSON-special characters (callers pass string literals or @errorName output only) comment above the function in context.zig.

Docs markdown typo — the diff introduces a leading space on ## Endpoints (becomes ## Endpoints). We will restore the correct heading while keeping the line change.

Once these are in we will run zig build test --summary all to confirm 0 failures and 0 leaks before pushing the revision.

All review comments have been addressed — summary below.

Blocker — GET /api/config key exposure (Option B, allowlist)
Added pub fn isAllowedReadPath(path: []const u8) bool to config_mutator.zig with an explicit allowlist of 11 safe paths (default_provider, default_model, gateway.port, gateway.host, gateway.admin_api, gateway.rate_limit, gateway.timeout_secs, gateway.max_body_bytes, scheduler.enabled, scheduler.max_jobs) plus prefix matches for diagnostics. and scheduler.. handleConfig returns 403 PATH_FORBIDDEN for anything not on the list. Security-sensitive paths (models.providers.*.api_key, channels.*.bot_token, security.*, etc.) are absent by design. Tests added for both the forbidden-path 403 and a passing allowed-path case.

sendError message safety
Added a doc comment to sendError in context.zig noting that callers must ensure message contains no JSON-special characters.

Docs heading typo
Fixed the leading-space on the ## Endpoints heading in gateway-api.md.

Zig 0.16 compatibility
The branch has been rebased onto main (362e93f) and api.zig updated to the Zig 0.16 API: std.Io.Writer.Allocating writer pattern, health.snapshot(allocator) with defer deinit, and []SnapshotComponent slice iteration. Builds and tests clean (1 pre-existing failure in tools.web_search also present on main).