Module debug 

Admin API for debug mode: trace listing/retrieval and the plugin sandbox.

Every route except GET /api/debug/config responds 404 while debug.enabled is false. A 403 would confirm the surface exists, and these endpoints dump request contexts and execute plugins — the highest value target on the box. The 404 is defence in depth behind the Basic Auth layer, not a replacement for it.

Discoverability is preserved two ways: each gated rejection logs a warning naming the exact config key, and GET /api/debug/config always answers so the web UI can render an explanatory empty state instead of a mystery.

Functions

bad_request 🔒

clear_traces 🔒

DELETE /api/debug/traces — empties the buffer.

disabled 🔒

The 404 returned when debug mode is off, matching the shape the rest of the Admin API uses for a missing resource.

get_config 🔒

GET /api/debug/config — the effective debug settings.

get_trace 🔒

GET /api/debug/traces/{id} — one trace with computed changes.

list_traces 🔒

GET /api/debug/traces — summaries, newest first.

router

Builds the router for the /api/debug/* endpoints.

run_sandbox 🔒

POST /api/debug/sandbox — run ad-hoc nodes or a named policy against a synthetic context.