@aion0/forge 0.5.25 → 0.5.26

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/plugins/route.ts

@@ -0,0 +1,75 @@
+import { NextResponse } from 'next/server';
+import { listPlugins, getPlugin, installPlugin, uninstallPlugin, updatePluginConfig, listInstalledPlugins, getInstalledPlugin } from '@/lib/plugins/registry';
+import { executePluginAction } from '@/lib/plugins/executor';
+
+// GET: list plugins or get plugin details
+export async function GET(req: Request) {
+  const url = new URL(req.url);
+  const id = url.searchParams.get('id');
+  const installed = url.searchParams.get('installed');
+
+  if (id) {
+    // Try as plugin definition first, then as installed instance
+    const plugin = getPlugin(id);
+    const inst = getInstalledPlugin(id);
+    if (!plugin && !inst) return NextResponse.json({ error: 'Plugin not found' }, { status: 404 });
+    return NextResponse.json({
+      plugin: inst?.definition || plugin,
+      installed: !!inst,
+      config: inst?.config,
+      instanceName: inst?.instanceName,
+      source: inst?.source,
+    });
+  }
+
+  if (installed === 'true') {
+    return NextResponse.json({ plugins: listInstalledPlugins() });
+  }
+
+  return NextResponse.json({ plugins: listPlugins() });
+}
+
+// POST: install, uninstall, update config, or test a plugin action
+export async function POST(req: Request) {
+  const body = await req.json();
+  const { action, id, config, actionName, params } = body;
+
+  switch (action) {
+    case 'install': {
+      if (!id) return NextResponse.json({ error: 'id required' }, { status: 400 });
+      const ok = installPlugin(id, config || {}, body.source ? { source: body.source, name: body.name } : undefined);
+      return NextResponse.json({ ok });
+    }
+    case 'create_instance': {
+      const { source, name, instanceId } = body;
+      if (!source || !name) return NextResponse.json({ error: 'source and name required' }, { status: 400 });
+      const iid = instanceId || name.toLowerCase().replace(/[^a-z0-9]+/g, '-');
+      // Check for duplicate ID
+      const existing = getInstalledPlugin(iid);
+      if (existing) {
+        return NextResponse.json({ error: `Instance ID "${iid}" already exists (used by ${existing.instanceName || existing.definition.name}). Choose a different name.` }, { status: 409 });
+      }
+      const ok = installPlugin(iid, config || {}, { source, name });
+      return NextResponse.json({ ok, instanceId: iid });
+    }
+    case 'uninstall': {
+      if (!id) return NextResponse.json({ error: 'id required' }, { status: 400 });
+      const ok = uninstallPlugin(id);
+      return NextResponse.json({ ok });
+    }
+    case 'update_config': {
+      if (!id || !config) return NextResponse.json({ error: 'id and config required' }, { status: 400 });
+      const ok = updatePluginConfig(id, config);
+      return NextResponse.json({ ok });
+    }
+    case 'test': {
+      if (!id || !actionName) return NextResponse.json({ error: 'id and actionName required' }, { status: 400 });
+      const inst = getInstalledPlugin(id);
+      if (!inst) return NextResponse.json({ error: 'Plugin not installed' }, { status: 400 });
+      const result = await executePluginAction(inst, actionName, params || {});
+      return NextResponse.json(result);
+    }
+    default:
+      return NextResponse.json({ error: 'Unknown action' }, { status: 400 });
+  }
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/preview/[...path]/route.ts

@@ -0,0 +1,64 @@
+import { NextResponse, type NextRequest } from 'next/server';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { getDataDir } from '@/lib/dirs';
+
+const CONFIG_FILE = join(getDataDir(), 'preview.json');
+
+function getPort(): number {
+  try {
+    const data = JSON.parse(readFileSync(CONFIG_FILE, 'utf-8'));
+    return data.port || 0;
+  } catch {
+    return 0;
+  }
+}
+
+async function proxy(req: NextRequest) {
+  const port = getPort();
+  if (!port) {
+    return NextResponse.json({ error: 'Preview not configured' }, { status: 503 });
+  }
+
+  const url = new URL(req.url);
+  const path = url.pathname.replace(/^\/api\/preview/, '') || '/';
+  const target = `http://localhost:${port}${path}${url.search}`;
+
+  try {
+    const headers: Record<string, string> = {};
+    req.headers.forEach((v, k) => {
+      if (!['host', 'connection', 'transfer-encoding'].includes(k.toLowerCase())) {
+        headers[k] = v;
+      }
+    });
+
+    const res = await fetch(target, {
+      method: req.method,
+      headers,
+      body: req.method !== 'GET' && req.method !== 'HEAD' ? await req.arrayBuffer() : undefined,
+      redirect: 'manual',
+    });
+
+    const responseHeaders = new Headers();
+    res.headers.forEach((v, k) => {
+      if (!['transfer-encoding', 'content-encoding'].includes(k.toLowerCase())) {
+        responseHeaders.set(k, v);
+      }
+    });
+
+    return new NextResponse(res.body, {
+      status: res.status,
+      headers: responseHeaders,
+    });
+  } catch {
+    return NextResponse.json({ error: `Cannot connect to localhost:${port}` }, { status: 502 });
+  }
+}
+
+export const GET = proxy;
+export const POST = proxy;
+export const PUT = proxy;
+export const DELETE = proxy;
+export const PATCH = proxy;
+export const HEAD = proxy;
+export const OPTIONS = proxy;

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/preview/route.ts

@@ -0,0 +1,156 @@
+import { NextResponse } from 'next/server';
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { spawn, execSync, type ChildProcess } from 'node:child_process';
+import { getDataDir, getConfigDir } from '@/lib/dirs';
+
+const CONFIG_FILE = join(getDataDir(), 'preview.json');
+
+interface PreviewEntry {
+  port: number;
+  url: string | null;
+  status: string;
+  label?: string;
+}
+
+// Persist state across hot-reloads
+const stateKey = Symbol.for('mw-preview-state');
+const g = globalThis as any;
+if (!g[stateKey]) g[stateKey] = { entries: new Map<number, { process: ChildProcess | null; url: string | null; status: string; label: string }>() };
+const state: { entries: Map<number, { process: ChildProcess | null; url: string | null; status: string; label: string }> } = g[stateKey];
+
+function getConfig(): PreviewEntry[] {
+  try {
+    const data = JSON.parse(readFileSync(CONFIG_FILE, 'utf-8'));
+    return Array.isArray(data) ? data : data.port ? [data] : [];
+  } catch {
+    return [];
+  }
+}
+
+function saveConfig(entries: PreviewEntry[]) {
+  const dir = dirname(CONFIG_FILE);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(CONFIG_FILE, JSON.stringify(entries, null, 2));
+}
+
+function getCloudflaredPath(): string | null {
+  const binPath = join(getConfigDir(), 'bin', 'cloudflared');
+  if (existsSync(binPath)) return binPath;
+  try {
+    return execSync('which cloudflared', { encoding: 'utf-8' }).trim();
+  } catch {
+    return null;
+  }
+}
+
+// GET — list all previews
+export async function GET() {
+  const entries: PreviewEntry[] = [];
+  for (const [port, s] of state.entries) {
+    entries.push({ port, url: s.url, status: s.status, label: s.label });
+  }
+  return NextResponse.json(entries);
+}
+
+// POST — start/stop/manage previews
+export async function POST(req: Request) {
+  const body = await req.json();
+
+  // Stop a preview
+  if (body.action === 'stop' && body.port) {
+    const entry = state.entries.get(body.port);
+    if (entry?.process) {
+      entry.process.kill('SIGTERM');
+    } else {
+      // Process ref lost (hot-reload) — kill by port match
+      try {
+        const pids = execSync(`pgrep -f 'cloudflared tunnel.*localhost:${body.port}'`, { encoding: 'utf-8', timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+        for (const pid of pids.split('\n').filter(Boolean)) {
+          try { process.kill(parseInt(pid), 'SIGTERM'); } catch {}
+        }
+      } catch {}
+    }
+    state.entries.delete(body.port);
+    syncConfig();
+    return NextResponse.json({ ok: true });
+  }
+
+  // Start a new preview
+  if (body.action === 'start' && body.port) {
+    const port = parseInt(body.port);
+    if (!port || port < 1 || port > 65535) {
+      return NextResponse.json({ error: 'Invalid port' }, { status: 400 });
+    }
+
+    // Already running?
+    const existing = state.entries.get(port);
+    if (existing && existing.status === 'running') {
+      return NextResponse.json({ port, url: existing.url, status: 'running', label: existing.label });
+    }
+
+    const binPath = getCloudflaredPath();
+    if (!binPath) {
+      return NextResponse.json({ error: 'cloudflared not installed. Start the main tunnel first.' }, { status: 500 });
+    }
+
+    const label = body.label || `localhost:${port}`;
+    state.entries.set(port, { process: null, url: null, status: 'starting', label });
+    syncConfig();
+
+    // Start tunnel
+    return new Promise<NextResponse>((resolve) => {
+      let resolved = false;
+      const child = spawn(binPath, ['tunnel', '--url', `http://localhost:${port}`], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+      });
+
+      const entry = state.entries.get(port)!;
+      entry.process = child;
+
+      const handleOutput = (data: Buffer) => {
+        const urlMatch = data.toString().match(/(https:\/\/[a-z0-9-]+\.trycloudflare\.com)/);
+        if (urlMatch && !entry.url) {
+          entry.url = urlMatch[1];
+          entry.status = 'running';
+          syncConfig();
+          if (!resolved) {
+            resolved = true;
+            resolve(NextResponse.json({ port, url: entry.url, status: 'running', label }));
+          }
+        }
+      };
+
+      child.stdout?.on('data', handleOutput);
+      child.stderr?.on('data', handleOutput);
+
+      child.on('exit', () => {
+        entry.process = null;
+        entry.status = 'stopped';
+        entry.url = null;
+        syncConfig();
+        if (!resolved) {
+          resolved = true;
+          resolve(NextResponse.json({ port, url: null, status: 'stopped', error: 'Tunnel exited' }));
+        }
+      });
+
+      setTimeout(() => {
+        if (!resolved) {
+          resolved = true;
+          resolve(NextResponse.json({ port, url: null, status: entry.status, error: 'Timeout' }));
+        }
+      }, 30000);
+    });
+  }
+
+  return NextResponse.json({ error: 'Unknown action' }, { status: 400 });
+}
+
+function syncConfig() {
+  const entries: PreviewEntry[] = [];
+  for (const [port, s] of state.entries) {
+    entries.push({ port, url: s.url, status: s.status, label: s.label });
+  }
+  saveConfig(entries);
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/project-pipelines/route.ts

@@ -0,0 +1,91 @@
+import { NextResponse } from 'next/server';
+import {
+  getBindings,
+  addBinding,
+  removeBinding,
+  updateBinding,
+  getRuns,
+  deleteRun,
+  triggerPipeline,
+  getNextRunTime,
+  scanAndTriggerIssues,
+  resetDedup,
+} from '@/lib/pipeline-scheduler';
+import { listWorkflows } from '@/lib/pipeline';
+
+// GET /api/project-pipelines?project=PATH
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url);
+  const projectPath = searchParams.get('project');
+  if (!projectPath) return NextResponse.json({ error: 'project required' }, { status: 400 });
+
+  const bindings = getBindings(projectPath).map(b => ({
+    ...b,
+    nextRunAt: getNextRunTime(b),
+  }));
+  const runs = getRuns(projectPath);
+  const workflows = listWorkflows().map(w => ({ name: w.name, description: w.description, builtin: w.builtin }));
+
+  return NextResponse.json({ bindings, runs, workflows });
+}
+
+// POST /api/project-pipelines
+export async function POST(req: Request) {
+  const body = await req.json();
+
+  if (body.action === 'add') {
+    const { projectPath, projectName, workflowName, config } = body;
+    if (!projectPath || !workflowName) return NextResponse.json({ error: 'projectPath and workflowName required' }, { status: 400 });
+    addBinding(projectPath, projectName || projectPath.split('/').pop(), workflowName, config);
+    return NextResponse.json({ ok: true });
+  }
+
+  if (body.action === 'remove') {
+    removeBinding(body.projectPath, body.workflowName);
+    return NextResponse.json({ ok: true });
+  }
+
+  if (body.action === 'update') {
+    updateBinding(body.projectPath, body.workflowName, { enabled: body.enabled, config: body.config });
+    return NextResponse.json({ ok: true });
+  }
+
+  if (body.action === 'trigger') {
+    const { projectPath, projectName, workflowName, input } = body;
+    if (!projectPath || !workflowName) return NextResponse.json({ error: 'projectPath and workflowName required' }, { status: 400 });
+    try {
+      const result = triggerPipeline(projectPath, projectName || projectPath.split('/').pop(), workflowName, input);
+      return NextResponse.json({ ok: true, ...result });
+    } catch (e: any) {
+      return NextResponse.json({ ok: false, error: e.message }, { status: 500 });
+    }
+  }
+
+  if (body.action === 'delete-run') {
+    deleteRun(body.id);
+    return NextResponse.json({ ok: true });
+  }
+
+  if (body.action === 'scan-now') {
+    const { projectPath, projectName, workflowName } = body;
+    if (!projectPath || !workflowName) return NextResponse.json({ error: 'projectPath and workflowName required' }, { status: 400 });
+    const bindings = getBindings(projectPath);
+    const binding = bindings.find(b => b.workflowName === workflowName);
+    if (!binding) return NextResponse.json({ error: 'Binding not found' }, { status: 404 });
+    try {
+      const result = scanAndTriggerIssues(binding);
+      return NextResponse.json({ ok: true, ...result });
+    } catch (e: any) {
+      return NextResponse.json({ ok: false, error: e.message }, { status: 500 });
+    }
+  }
+
+  if (body.action === 'reset-dedup') {
+    const { projectPath, workflowName, dedupKey } = body;
+    if (!projectPath || !workflowName || !dedupKey) return NextResponse.json({ error: 'projectPath, workflowName, dedupKey required' }, { status: 400 });
+    resetDedup(projectPath, workflowName, dedupKey);
+    return NextResponse.json({ ok: true });
+  }
+
+  return NextResponse.json({ error: 'Invalid action' }, { status: 400 });
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/project-sessions/route.ts

@@ -0,0 +1,61 @@
+import { NextResponse } from 'next/server';
+import { getFixedSession, setFixedSession, clearFixedSession, getAllFixedSessions } from '@/lib/project-sessions';
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+// GET: get fixed session for a project, or all bindings
+export async function GET(req: Request) {
+  const url = new URL(req.url);
+  const projectPath = url.searchParams.get('projectPath');
+  if (projectPath) {
+    // Also ensure mcp.json exists when querying
+    ensureMcpConfig(projectPath);
+    return NextResponse.json({ projectPath, fixedSessionId: getFixedSession(projectPath) || null });
+  }
+  return NextResponse.json(getAllFixedSessions());
+}
+
+// POST: set fixed session or ensure MCP config
+export async function POST(req: Request) {
+  const body = await req.json();
+  const { projectPath, fixedSessionId, action } = body;
+  if (!projectPath) return NextResponse.json({ error: 'projectPath required' }, { status: 400 });
+
+  // Ensure MCP config action
+  if (action === 'ensure_mcp') {
+    ensureMcpConfig(projectPath);
+    return NextResponse.json({ ok: true });
+  }
+
+  if (!fixedSessionId) {
+    clearFixedSession(projectPath);
+    return NextResponse.json({ ok: true, cleared: true });
+  }
+  setFixedSession(projectPath, fixedSessionId);
+  return NextResponse.json({ ok: true, projectPath, fixedSessionId });
+}
+
+/** Generate .forge/mcp.json in the project directory with workspace context baked in */
+function ensureMcpConfig(projectPath: string): void {
+  try {
+    const forgeDir = join(projectPath, '.forge');
+    const configPath = join(forgeDir, 'mcp.json');
+    const mcpPort = Number(process.env.MCP_PORT) || 8406;
+
+    // Resolve workspace + primary agent for this project
+    let wsParam = '';
+    try {
+      const { findWorkspaceByProject } = require('@/lib/workspace');
+      const ws = findWorkspaceByProject(projectPath);
+      if (ws) {
+        wsParam = `?workspaceId=${ws.id}`;
+      }
+    } catch {}
+
+    const config = { mcpServers: { forge: { type: 'sse', url: `http://localhost:${mcpPort}/sse${wsParam}` } } };
+
+    // Always rewrite (workspace context may have changed)
+    mkdirSync(forgeDir, { recursive: true });
+    writeFileSync(configPath, JSON.stringify(config, null, 2));
+  } catch {}
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/projects/route.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from 'next/server';
+import { scanProjects } from '@/lib/projects';
+import { applyDefaultTemplates, listTemplates } from '@/lib/claude-templates';
+
+// Track known projects to detect new ones
+const knownProjects = new Set<string>();
+
+export async function GET() {
+  const projects = scanProjects();
+
+  // Auto-apply default templates to newly detected projects
+  const hasDefaults = listTemplates().some(t => t.isDefault);
+  if (hasDefaults) {
+    for (const p of projects) {
+      if (!knownProjects.has(p.path)) {
+        knownProjects.add(p.path);
+        try { applyDefaultTemplates(p.path); } catch {}
+      }
+    }
+  } else {
+    // Still track projects even without defaults
+    for (const p of projects) knownProjects.add(p.path);
+  }
+
+  return NextResponse.json(projects);
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/sessions/[id]/chat/route.ts

@@ -0,0 +1,64 @@
+import { getSessionManager } from '@/lib/session-manager';
+import { chatStream } from '@/src/core/providers/chat';
+import type { ModelMessage } from 'ai';
+
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const { message } = await req.json();
+  const manager = getSessionManager();
+
+  const session = manager.get(id);
+  if (!session) {
+    return new Response(JSON.stringify({ error: 'Session not found' }), { status: 404 });
+  }
+
+  // Save user message
+  manager.addMessage(id, 'user', message, session.provider, session.model);
+
+  // Get memory-filtered messages
+  const memoryMessages = manager.getMemoryMessages(id);
+  const coreMessages: ModelMessage[] = memoryMessages.map(m => ({
+    role: m.role as 'user' | 'assistant',
+    content: m.content,
+  }));
+
+  manager.updateStatus(id, 'running');
+
+  // Stream response
+  const encoder = new TextEncoder();
+  const stream = new ReadableStream({
+    async start(controller) {
+      try {
+        const result = await chatStream({
+          provider: session.provider,
+          model: session.model || undefined,
+          systemPrompt: session.systemPrompt,
+          messages: coreMessages,
+          onToken(token) {
+            controller.enqueue(encoder.encode(`data: ${JSON.stringify({ token })}\n\n`));
+          },
+        });
+
+        // Save assistant message
+        manager.addMessage(id, 'assistant', result.content, result.provider, result.model);
+        manager.recordUsage(id, result);
+        manager.updateStatus(id, 'idle');
+
+        controller.enqueue(encoder.encode(`data: ${JSON.stringify({ done: true, usage: { input: result.inputTokens, output: result.outputTokens } })}\n\n`));
+        controller.close();
+      } catch (err: any) {
+        manager.updateStatus(id, 'error');
+        controller.enqueue(encoder.encode(`data: ${JSON.stringify({ error: err.message })}\n\n`));
+        controller.close();
+      }
+    },
+  });
+
+  return new Response(stream, {
+    headers: {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache',
+      Connection: 'keep-alive',
+    },
+  });
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/sessions/[id]/messages/route.ts

@@ -0,0 +1,9 @@
+import { NextResponse } from 'next/server';
+import { getSessionManager } from '@/lib/session-manager';
+
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const manager = getSessionManager();
+  const messages = manager.getMessages(id);
+  return NextResponse.json(messages);
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/sessions/[id]/route.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import { getSessionManager } from '@/lib/session-manager';
+
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const manager = getSessionManager();
+  const session = manager.get(id) || manager.getByName(id);
+  if (!session) return NextResponse.json({ error: 'Not found' }, { status: 404 });
+  return NextResponse.json(session);
+}
+
+export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const manager = getSessionManager();
+  manager.delete(id);
+  return NextResponse.json({ ok: true });
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/sessions/route.ts

@@ -0,0 +1,20 @@
+import { NextResponse } from 'next/server';
+import { getSessionManager } from '@/lib/session-manager';
+import { loadAllTemplates } from '@/src/config';
+
+export async function GET() {
+  const manager = getSessionManager();
+  const sessions = manager.list();
+  return NextResponse.json(sessions);
+}
+
+export async function POST(req: Request) {
+  const body = await req.json();
+  const manager = getSessionManager();
+  try {
+    const session = manager.create(body);
+    return NextResponse.json(session);
+  } catch (err: any) {
+    return NextResponse.json({ error: err.message }, { status: 400 });
+  }
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/settings/route.ts

@@ -0,0 +1,64 @@
+import { NextResponse } from 'next/server';
+import { loadSettings, loadSettingsMasked, saveSettings, type Settings } from '@/lib/settings';
+import { restartTelegramBot } from '@/lib/init';
+import { SECRET_FIELDS } from '@/lib/crypto';
+import { verifyAdmin } from '@/lib/password';
+
+export async function GET() {
+  return NextResponse.json(loadSettingsMasked());
+}
+
+export async function PUT(req: Request) {
+  const body = await req.json();
+
+  // Handle secret field updates separately
+  if (body._secretUpdate) {
+    const { field, adminPassword, newValue } = body._secretUpdate as {
+      field: string;
+      adminPassword: string;
+      newValue: string;
+    };
+
+    // Validate field name
+    if (!SECRET_FIELDS.includes(field as any)) {
+      return NextResponse.json({ ok: false, error: 'Invalid field' }, { status: 400 });
+    }
+
+    // Verify admin password
+    if (!verifyAdmin(adminPassword)) {
+      return NextResponse.json({ ok: false, error: 'Wrong password' }, { status: 403 });
+    }
+
+    // Update the specific field
+    const current = loadSettings();
+    (current as any)[field] = newValue;
+    saveSettings(current);
+
+    // Restart Telegram bot if token changed
+    if (field === 'telegramBotToken') {
+      restartTelegramBot();
+    }
+
+    return NextResponse.json({ ok: true });
+  }
+
+  // Normal settings update — strip masked secrets so we don't overwrite with placeholder
+  const settings = loadSettings();
+  const updated = body as Settings;
+
+  for (const field of SECRET_FIELDS) {
+    // Keep existing encrypted value if frontend sent masked placeholder
+    if (updated[field] === '••••••••' || updated[field] === '') {
+      updated[field] = settings[field];
+    }
+  }
+
+  // Remove internal fields
+  delete (updated as any)._secretStatus;
+
+  const changed = Object.keys(updated).filter(k => JSON.stringify((updated as any)[k]) !== JSON.stringify((settings as any)[k]) && !['telegramTunnelPassword', 'telegramBotToken'].includes(k));
+  if (changed.length > 0) console.log(`[settings] Updated: ${changed.join(', ')}`);
+  saveSettings(updated);
+  restartTelegramBot();
+  return NextResponse.json({ ok: true });
+}