@kenkaiiii/ggcoder 4.10.2 → 4.11.1

package/dist/app-sidecar.js

@@ -24,13 +24,19 @@ import { loginGemini } from "./core/oauth/gemini.js";
 import { loginKimi } from "./core/oauth/kimi.js";
 import { AUTH_PROVIDERS } from "./core/auth-providers.js";
 import { ensureAppDirs, loadSavedSettings } from "./config.js";
+import { SettingsManager } from "./core/settings-manager.js";
 import { getDefaultModel, getModel, getMaxThinkingLevel, getContextWindow, MODELS, } from "./core/model-registry.js";
-import { getGitBranch } from "./utils/git.js";
+import { getGitBranch, isGitRepo } from "./utils/git.js";
 import { getNextThinkingLevel, getSupportedThinkingLevels, isThinkingLevelSupported, } from "./core/thinking-level.js";
 import { PROMPT_COMMANDS } from "./core/prompt-commands.js";
 import { loadCustomCommands } from "./core/custom-commands.js";
 import { discoverProjects, listRecentSessions } from "./core/project-discovery.js";
+import { loadTasksSync, saveTasksSync, getNextPendingTask, markTaskInProgress, } from "./core/tasks-store.js";
 import { initLogger, log } from "./core/logger.js";
+import { RADIO_STATIONS, getCurrentStation, playRadio, stopRadio } from "./core/radio.js";
+import { enrichProcessPath } from "./core/shell-path.js";
+import { startServeMode } from "./modes/serve-mode.js";
+import { loadTelegramConfig, saveTelegramConfig, verifyBotToken } from "./core/telegram-config.js";
 const ALL_PROVIDERS = [
     "anthropic",
     "xiaomi",
@@ -65,6 +71,37 @@ async function saveAppSettings(settings) {
     await fs.mkdir(path.dirname(appSettingsFile()), { recursive: true });
     await fs.writeFile(appSettingsFile(), JSON.stringify(settings, null, 2), "utf-8");
 }
+/**
+ * Persist the active model selection to ~/.gg/settings.json so it survives app
+ * restarts. Mirrors the CLI's handleModelSelect persistence (App.tsx).
+ */
+async function persistModelSelection(settingsFile, provider, model) {
+    try {
+        const sm = new SettingsManager(settingsFile);
+        await sm.load();
+        await sm.set("defaultProvider", provider);
+        await sm.set("defaultModel", model);
+    }
+    catch (err) {
+        log("WARN", "app-sidecar", "failed to persist model selection", { err: String(err) });
+    }
+}
+/**
+ * Persist the thinking level to ~/.gg/settings.json so it survives app restarts.
+ * Mirrors the CLI's handleToggleThinking persistence (App.tsx).
+ */
+async function persistThinkingLevel(settingsFile, level) {
+    try {
+        const sm = new SettingsManager(settingsFile);
+        await sm.load();
+        await sm.set("thinkingEnabled", !!level);
+        if (level)
+            await sm.set("thinkingLevel", level);
+    }
+    catch (err) {
+        log("WARN", "app-sidecar", "failed to persist thinking level", { err: String(err) });
+    }
+}
 /** Validate a project folder name: lowercase letters, digits, dashes only. */
 function isValidProjectName(name) {
     return /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name);
@@ -88,6 +125,86 @@ async function prepareAttachments(cwd, attachments) {
     }
     return out;
 }
+const FILE_SEARCH_LIMIT = 20;
+/** Score a candidate path against a lowercased query. Higher is better; a
+ *  negative score means "no match". Basename hits beat path hits; prefix beats
+ *  substring; shorter paths break ties. */
+function scoreFile(relPath, name, query) {
+    const lcPath = relPath.toLowerCase();
+    const lcName = name.toLowerCase();
+    let score = -1;
+    if (lcName === query)
+        score = 1000;
+    else if (lcName.startsWith(query))
+        score = 800;
+    else if (lcName.includes(query))
+        score = 600;
+    else if (lcPath.startsWith(query))
+        score = 400;
+    else if (lcPath.includes(query))
+        score = 200;
+    else if (subsequenceMatch(lcPath, query))
+        score = 100;
+    if (score < 0)
+        return -1;
+    // Prefer shorter paths (closer to root, less nesting) on equal match class.
+    return score - relPath.length * 0.1;
+}
+/** True when every char of `needle` appears in `haystack` in order (fuzzy). */
+function subsequenceMatch(haystack, needle) {
+    let i = 0;
+    for (const ch of haystack) {
+        if (ch === needle[i])
+            i++;
+        if (i === needle.length)
+            return true;
+    }
+    return needle.length === 0;
+}
+async function searchProjectFiles(cwd, rawQuery) {
+    const fg = await import("fast-glob");
+    const ignore = await import("ignore");
+    const query = rawQuery.trim().toLowerCase();
+    let gitignore = [];
+    try {
+        const content = await fs.readFile(path.join(cwd, ".gitignore"), "utf-8");
+        gitignore = content
+            .split("\n")
+            .map((l) => l.trim())
+            .filter((l) => l && !l.startsWith("#"));
+    }
+    catch {
+        // No .gitignore — nothing extra to ignore.
+    }
+    const ig = ignore.default().add(gitignore);
+    // `stats: true` gives mtime without a second stat pass, so the empty-query
+    // "recent files" path is a single walk.
+    const entries = await fg.default("**/*", {
+        cwd,
+        dot: false,
+        onlyFiles: true,
+        ignore: ["**/node_modules/**", "**/.git/**", "**/.gg/**"],
+        suppressErrors: true,
+        followSymbolicLinks: false,
+        stats: true,
+    });
+    const files = entries.filter((e) => !ig.ignores(e.path));
+    if (!query) {
+        return files
+            .sort((a, b) => (b.stats?.mtimeMs ?? 0) - (a.stats?.mtimeMs ?? 0))
+            .slice(0, FILE_SEARCH_LIMIT)
+            .map((e) => ({ path: e.path, name: path.posix.basename(e.path) }));
+    }
+    const scored = [];
+    for (const e of files) {
+        const name = path.posix.basename(e.path);
+        const score = scoreFile(e.path, name, query);
+        if (score >= 0)
+            scored.push({ hit: { path: e.path, name }, score });
+    }
+    scored.sort((a, b) => b.score - a.score);
+    return scored.slice(0, FILE_SEARCH_LIMIT).map((s) => s.hit);
+}
 /**
  * Detect whether a restored user message is actually an injected self-correction
  * hook prompt, by its distinctive opening phrase. Returns the hook kind so the
@@ -103,6 +220,30 @@ function detectHookKind(text) {
         return "regrounding";
     return null;
 }
+// Separator AgentSession.prompt() inserts between a command's prompt body and
+// the user's trailing args. Must stay in sync with the expansion there.
+const COMMAND_ARGS_SEP = "\n\n## User Instructions\n\n";
+/**
+ * Reverse a prompt-template command's expansion. When a `/name` command runs,
+ * the agent persists the FULL expanded prompt body as the user message — so on
+ * resume the raw body would render instead of the short `/name` chip the user
+ * saw live. Given the candidate commands (built-in + custom) and a restored
+ * message body, recover the original `/name [args]` invocation. Returns null
+ * when the text isn't a known command body (an ordinary user message).
+ */
+function detectPromptCommand(text, candidates) {
+    for (const c of candidates) {
+        if (!c.prompt)
+            continue;
+        if (text === c.prompt)
+            return `/${c.name}`;
+        if (text.startsWith(c.prompt + COMMAND_ARGS_SEP)) {
+            const args = text.slice(c.prompt.length + COMMAND_ARGS_SEP.length).trim();
+            return args ? `/${c.name} ${args}` : `/${c.name}`;
+        }
+    }
+    return null;
+}
 /**
  * Pick a provider/model the user is actually logged into, preferring the saved
  * defaults. Mirrors the CLI's resolveActiveProvider without exporting internals.
@@ -138,6 +279,12 @@ async function main() {
     // ~/.gg/debug.log (initLogger truncates on each start).
     const sidecarLog = path.join(paths.agentDir, "gg-app-sidecar.log");
     initLogger(sidecarLog);
+    // The packaged desktop app launches from Finder/Dock with a minimal PATH that
+    // omits Homebrew/Cargo/version-manager dirs, so the agent can't find node,
+    // git, python, rg, etc. Enrich process.env.PATH from the login shell once,
+    // before anything spawns (bash tool, background tasks, LSP, git helpers all
+    // inherit it). Best-effort — never blocks startup beyond its internal cap.
+    await enrichProcessPath();
     const auth = new AuthStorage(paths.authFile);
     await auth.load();
     const saved = loadSavedSettings(paths.settingsFile);
@@ -193,6 +340,7 @@ async function main() {
     // branch is resolved once at startup and refreshed lazily; the context
     // window follows the active model.
     let gitBranch = await getGitBranch(cwd).catch(() => null);
+    let gitIsRepo = await isGitRepo(cwd).catch(() => false);
     function currentContextWindow() {
         const st = session.getState();
         return getContextWindow(st.model, { provider: st.provider });
@@ -203,6 +351,7 @@ async function main() {
         return {
             contextWindow: currentContextWindow(),
             gitBranch,
+            isGitRepo: gitIsRepo,
             tasks: session.listBackgroundProcesses(),
         };
     }
@@ -221,6 +370,10 @@ async function main() {
     session.eventBus.on("compaction_end", (d) => broadcast("compaction_end", d));
     let running = false;
     let titleGenerated = false;
+    // ── Telegram serve (remote control via Telegram) ───────────
+    // A single embedded serve session lives in this sidecar process. Only the main
+    // window's home screen exposes the controls, so there's one bot per app.
+    let serveController = null;
     // Resumed session: if it already has a conversation, generate its title now so
     // the title bar shows it immediately on load (not just after the next prompt).
     {
@@ -235,6 +388,84 @@ async function main() {
             });
         }
     }
+    // Core run lifecycle shared by /prompt and the task runner: flips `running`,
+    // brackets the run with run_start/run_end, refreshes the footer extras, and
+    // generates the session title once. `label` is the text shown live with the
+    // run_start frame.
+    async function runAgent(label, run) {
+        running = true;
+        broadcast("run_start", { text: label });
+        try {
+            await run();
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            broadcast("error", { message });
+            log("ERROR", "app-sidecar", "run failed", { message });
+        }
+        finally {
+            running = false;
+            // A run may have switched branches (git checkout) or spawned/finished
+            // background tasks — refresh the footer extras once it settles.
+            gitBranch = await getGitBranch(cwd).catch(() => gitBranch);
+            gitIsRepo = await isGitRepo(cwd).catch(() => gitIsRepo);
+            broadcast("run_end", {});
+            // Queue drains into the run as steering, so it's empty by run_end —
+            // sync the webview indicator.
+            broadcast("queued", { count: session.getQueuedCount() });
+            broadcast("extras", footerExtras());
+            // Generate a session title once, after the first run, for the title bar
+            // (best-effort, async — don't block the response).
+            if (!titleGenerated) {
+                titleGenerated = true;
+                void session.generateTitle().then((title) => {
+                    if (title)
+                        broadcast("session_title", { title });
+                });
+            }
+        }
+    }
+    // ── Task runner (project task list → sessions) ──────────────
+    // Mirrors the CLI's task flow: each task runs in its OWN fresh session, with a
+    // completion hint instructing the agent to mark the task done via the tasks
+    // tool. Run-all advances to the next pending task after each run finishes.
+    let taskRunAll = false;
+    async function runTaskById(taskId) {
+        const task = loadTasksSync(cwd).find((t) => t.id === taskId || t.id.startsWith(taskId));
+        if (!task)
+            return false;
+        // Fresh session per task so one task's context never bleeds into the next.
+        await session.newSession();
+        titleGenerated = false;
+        broadcast("session_reset", {});
+        markTaskInProgress(cwd, task.id);
+        broadcast("tasks_list", { tasks: loadTasksSync(cwd) });
+        broadcast("task_start", { id: task.id, title: task.title });
+        const shortId = task.id.slice(0, 8);
+        const completionHint = `\n\n---\nWhen you have fully completed this task, call the tasks tool to mark it done:\n` +
+            `tasks({ action: "done", id: "${shortId}" })`;
+        await runAgent(task.title, () => session.prompt(task.prompt + completionHint));
+        // The agent typically marks the task done via the tasks tool during the run;
+        // push the refreshed list so the webview's task modal reflects it.
+        broadcast("tasks_list", { tasks: loadTasksSync(cwd) });
+        return true;
+    }
+    async function runTasks(startId, all) {
+        taskRunAll = all;
+        let currentId = startId ?? getNextPendingTask(cwd)?.id ?? null;
+        while (currentId) {
+            const ran = await runTaskById(currentId);
+            if (!ran || !taskRunAll)
+                break;
+            const next = getNextPendingTask(cwd);
+            currentId = next ? next.id : null;
+            // Brief pause between tasks (mirrors the CLI cadence).
+            if (currentId)
+                await new Promise((resolve) => setTimeout(resolve, 500));
+        }
+        taskRunAll = false;
+        broadcast("tasks_run_done", {});
+    }
     // ── Provider auth (login) bridge ───────────────────────────
     // OAuth login functions are interactive (open a URL, sometimes prompt for a
     // pasted code). We run one at a time and surface every step over SSE so the
@@ -261,17 +492,29 @@ async function main() {
     }
     // Background tasks have no event source (the bash tool just spawns them), so
     // poll the process manager and broadcast only when the snapshot changes. This
-    // keeps the webview footer live without a busy render loop.
+    // keeps the webview footer live without a busy render loop. Adaptive cadence:
+    // tasks can only change while a run is active (the bash tool spawns them), so
+    // poll fast (1500ms) while running or while tasks exist, and back off to
+    // 5000ms when fully idle — fewer wakeups per idle window.
     let lastTasksJson = "[]";
-    const tasksPoll = setInterval(() => {
-        const tasks = session.listBackgroundProcesses();
-        const next = JSON.stringify(tasks);
-        if (next !== lastTasksJson) {
-            lastTasksJson = next;
-            broadcast("tasks", { tasks });
-        }
-    }, 1500);
-    tasksPoll.unref?.();
+    let tasksPoll;
+    let tasksPollStopped = false;
+    const scheduleTasksPoll = (delay) => {
+        if (tasksPollStopped)
+            return;
+        tasksPoll = setTimeout(() => {
+            const tasks = session.listBackgroundProcesses();
+            const next = JSON.stringify(tasks);
+            if (next !== lastTasksJson) {
+                lastTasksJson = next;
+                broadcast("tasks", { tasks });
+            }
+            const active = running || tasks.length > 0;
+            scheduleTasksPoll(active ? 1500 : 5000);
+        }, delay);
+        tasksPoll.unref?.();
+    };
+    scheduleTasksPoll(1500);
     function readBody(req) {
         return new Promise((resolve, reject) => {
             const chunks = [];
@@ -439,6 +682,18 @@ async function main() {
                 .catch(() => json(res, 200, { sessions: [] }));
             return;
         }
+        if (method === "GET" && url.startsWith("/files")) {
+            const q = new URL(url, `http://${host}`).searchParams.get("q") ?? "";
+            void searchProjectFiles(cwd, q)
+                .then((files) => json(res, 200, { files }))
+                .catch((err) => {
+                log("ERROR", "app-sidecar", "searchProjectFiles failed", {
+                    message: err instanceof Error ? err.message : String(err),
+                });
+                json(res, 200, { files: [] });
+            });
+            return;
+        }
         if (method === "GET" && url === "/history") {
             // Flatten the resumed conversation into the webview's transcript shape:
             // user + assistant TEXT only (tools live in the live panel, never the
@@ -446,24 +701,56 @@ async function main() {
             // hook prompts (injected as user messages) are tagged with their `hook`
             // kind so the webview renders the short "Hook engaged" line, not the raw
             // prompt body — matching how they appear live.
-            const history = session
-                .getMessages()
-                .filter((m) => m.role === "user" || m.role === "assistant")
-                .map((m) => {
-                // `m.content` is a union of differently-typed arrays (user vs
-                // assistant parts), so a type-predicate filter won't narrow cleanly.
-                // A structural `"text" in c` check extracts text from any text-bearing
-                // part regardless of the surrounding union.
-                const text = typeof m.content === "string"
-                    ? m.content
-                    : m.content
-                        .map((c) => c.type === "text" && "text" in c && typeof c.text === "string" ? c.text : "")
-                        .join("");
-                const hook = m.role === "user" ? detectHookKind(text) : null;
-                return { role: m.role, text, hook };
-            })
-                .filter((m) => m.text.trim().length > 0);
-            json(res, 200, { history });
+            //
+            // Prompt-template commands persist their FULL expanded body as the user
+            // message, so on resume we reverse the expansion (built-in + custom
+            // candidates) back to the short `/name [args]` chip the user saw live.
+            void (async () => {
+                const commandCandidates = [...PROMPT_COMMANDS, ...(await loadCustomCommands(cwd))];
+                const history = session
+                    .getMessages()
+                    .filter((m) => m.role === "user" || m.role === "assistant")
+                    .map((m) => {
+                    // `m.content` is a union of differently-typed arrays (user vs
+                    // assistant parts), so a type-predicate filter won't narrow cleanly.
+                    // A structural `"text" in c` check extracts text from any text-bearing
+                    // part regardless of the surrounding union.
+                    const text = typeof m.content === "string"
+                        ? m.content
+                        : m.content
+                            .map((c) => c.type === "text" && "text" in c && typeof c.text === "string" ? c.text : "")
+                            .join("");
+                    // Reconstruct image attachments as data URLs so they re-render on
+                    // resume — the webview only ever saw the live SSE stream, and the
+                    // persisted message holds the base64 bytes. Without this, attached
+                    // images vanish when returning to a session.
+                    const images = typeof m.content === "string"
+                        ? []
+                        : m.content.flatMap((c) => c.type === "image" ? [`data:${c.mediaType};base64,${c.data}`] : []);
+                    const hook = m.role === "user" ? detectHookKind(text) : null;
+                    // A compacted session persists its summary as a user message prefixed
+                    // with this marker. Tag it so the webview renders the quiet "Compacted
+                    // context" notice instead of dumping the full summary body.
+                    const compacted = m.role === "user" && !hook && text.startsWith("[Previous conversation summary]");
+                    // Recover a `/name [args]` command invocation from its expanded body
+                    // (skip messages already claimed as hooks or compaction summaries).
+                    const command = m.role === "user" && !hook && !compacted
+                        ? detectPromptCommand(text, commandCandidates)
+                        : null;
+                    return {
+                        role: m.role,
+                        text: command ?? text,
+                        images,
+                        hook,
+                        command: command !== null,
+                        compacted,
+                    };
+                })
+                    // Keep messages with text OR images — an image-only user turn has empty
+                    // text but must still appear.
+                    .filter((m) => m.text.trim().length > 0 || m.images.length > 0);
+                json(res, 200, { history });
+            })();
             return;
         }
         if (method === "GET" && url === "/commands") {
@@ -520,9 +807,7 @@ async function main() {
                     return;
                 }
                 json(res, 202, { accepted: true });
-                running = true;
-                broadcast("run_start", { text });
-                try {
+                await runAgent(text, async () => {
                     if (attachments.length > 0) {
                         // Persist each attachment under .gg/uploads so files are inspectable
                         // by the agent's tools, then prompt with the media as native blocks.
@@ -536,32 +821,84 @@ async function main() {
                         // while the webview keeps showing the short `/name`.
                         await session.prompt(text);
                     }
+                });
+            });
+            return;
+        }
+        if (method === "GET" && url === "/tasks") {
+            json(res, 200, { tasks: loadTasksSync(cwd) });
+            return;
+        }
+        // ── Radio ─────────────────────────────────────────────────
+        // Playback runs in THIS sidecar process, which is unique per window, so a
+        // station only plays in the window that started it.
+        if (method === "GET" && url === "/radio") {
+            json(res, 200, { stations: RADIO_STATIONS, current: getCurrentStation() });
+            return;
+        }
+        if (method === "POST" && url === "/radio") {
+            void readBody(req).then((raw) => {
+                let station;
+                try {
+                    station = JSON.parse(raw).station ?? "";
                 }
-                catch (err) {
-                    const message = err instanceof Error ? err.message : String(err);
-                    broadcast("error", { message });
-                    log("ERROR", "app-sidecar", "prompt failed", { message });
-                }
-                finally {
-                    running = false;
-                    // A run may have switched branches (git checkout) or spawned/finished
-                    // background tasks — refresh the footer extras once it settles.
-                    gitBranch = await getGitBranch(cwd).catch(() => gitBranch);
-                    broadcast("run_end", {});
-                    // Queue drains into the run as steering, so it's empty by run_end —
-                    // sync the webview indicator.
-                    broadcast("queued", { count: session.getQueuedCount() });
-                    broadcast("extras", footerExtras());
-                    // Generate a session title once, after the first run, for the title
-                    // bar (best-effort, async — don't block the response).
-                    if (!titleGenerated) {
-                        titleGenerated = true;
-                        void session.generateTitle().then((title) => {
-                            if (title)
-                                broadcast("session_title", { title });
-                        });
-                    }
+                catch {
+                    json(res, 400, { error: "invalid JSON body" });
+                    return;
+                }
+                if (!station || station === "off") {
+                    stopRadio();
+                    json(res, 200, { current: null });
+                    return;
+                }
+                const result = playRadio(station);
+                if (!result.ok) {
+                    json(res, 400, { error: result.error ?? "Radio failed to start." });
+                    return;
                 }
+                json(res, 200, { current: getCurrentStation() });
+            });
+            return;
+        }
+        if (method === "POST" && url === "/tasks/run") {
+            void readBody(req).then((raw) => {
+                let id;
+                let all;
+                try {
+                    const body = JSON.parse(raw);
+                    id = body.id ?? null;
+                    all = Boolean(body.all);
+                }
+                catch {
+                    json(res, 400, { error: "invalid JSON body" });
+                    return;
+                }
+                if (running) {
+                    json(res, 409, { error: "cannot run a task while the agent is running" });
+                    return;
+                }
+                json(res, 202, { accepted: true });
+                void runTasks(id, all);
+            });
+            return;
+        }
+        if (method === "POST" && url === "/tasks/delete") {
+            void readBody(req).then((raw) => {
+                let id;
+                try {
+                    id = JSON.parse(raw).id ?? "";
+                }
+                catch {
+                    json(res, 400, { error: "invalid JSON body" });
+                    return;
+                }
+                if (!id.trim()) {
+                    json(res, 400, { error: "missing task id" });
+                    return;
+                }
+                const remaining = loadTasksSync(cwd).filter((t) => t.id !== id && !t.id.startsWith(id));
+                saveTasksSync(cwd, remaining);
+                json(res, 200, { tasks: remaining });
             });
             return;
         }
@@ -610,6 +947,9 @@ async function main() {
                 if (prevLevel && !isThinkingLevelSupported(target.provider, target.id, prevLevel)) {
                     session.setThinkingLevel(getNextThinkingLevel(target.provider, target.id, undefined));
                 }
+                // Persist so the selection (and clamped thinking level) survives restarts.
+                await persistModelSelection(paths.settingsFile, target.provider, target.id);
+                await persistThinkingLevel(paths.settingsFile, session.getThinkingLevel());
                 const payload = {
                     thinkingLevel: session.getThinkingLevel() ?? null,
                     supportedThinkingLevels: getSupportedThinkingLevels(target.provider, target.id),
@@ -649,6 +989,8 @@ async function main() {
             const st = session.getState();
             const next = getNextThinkingLevel(st.provider, st.model, session.getThinkingLevel());
             session.setThinkingLevel(next);
+            // Persist so the thinking level survives app restarts (mirrors the CLI).
+            void persistThinkingLevel(paths.settingsFile, next);
             const payload = {
                 thinkingLevel: next ?? null,
                 supportedThinkingLevels: getSupportedThinkingLevels(st.provider, st.model),
@@ -662,6 +1004,8 @@ async function main() {
             abort = new AbortController();
             session.setSignal(abort.signal);
             running = false;
+            // Stop a run-all sweep so the next pending task isn't auto-started.
+            taskRunAll = false;
             // Drop any queued steering and return it so the webview can restore it to
             // the composer.
             const drained = session.drainQueue();
@@ -821,6 +1165,107 @@ async function main() {
             });
             return;
         }
+        // ── Telegram config (mirrors `ggcoder telegram`) ─────────
+        if (method === "GET" && url === "/telegram") {
+            void loadTelegramConfig().then((cfg) => {
+                if (!cfg) {
+                    json(res, 200, { configured: false });
+                    return;
+                }
+                // Never return the raw token to the webview — a short masked preview is
+                // enough to show "already set".
+                const t = cfg.botToken;
+                const tokenPreview = t.length > 14 ? `${t.slice(0, 10)}\u2026${t.slice(-4)}` : "set";
+                json(res, 200, { configured: true, userId: cfg.userId, tokenPreview });
+            });
+            return;
+        }
+        if (method === "POST" && url === "/telegram") {
+            void readBody(req).then(async (raw) => {
+                let botTokenInput;
+                let userIdInput;
+                try {
+                    const body = JSON.parse(raw);
+                    botTokenInput = (body.botToken ?? "").trim();
+                    userIdInput = String(body.userId ?? "").trim();
+                }
+                catch {
+                    json(res, 400, { error: "invalid JSON body" });
+                    return;
+                }
+                // Keep the existing token when the field is left blank (the webview shows
+                // a masked preview, not the real token).
+                const existing = await loadTelegramConfig();
+                const botToken = botTokenInput || existing?.botToken || "";
+                if (!botToken) {
+                    json(res, 400, { error: "Bot token is required." });
+                    return;
+                }
+                const userId = userIdInput ? parseInt(userIdInput, 10) : existing?.userId;
+                if (!userId || Number.isNaN(userId)) {
+                    json(res, 400, { error: "A numeric Telegram user ID is required." });
+                    return;
+                }
+                const verified = await verifyBotToken(botToken);
+                if (!verified.ok) {
+                    json(res, 400, { error: "Invalid bot token — Telegram rejected it." });
+                    return;
+                }
+                await saveTelegramConfig({ botToken, userId });
+                json(res, 200, { ok: true, userId, username: verified.username ?? null });
+            });
+            return;
+        }
+        // ── Serve lifecycle (mirrors `ggcoder serve`) ───────────
+        if (method === "GET" && url === "/serve") {
+            void loadTelegramConfig().then((cfg) => json(res, 200, { running: serveController !== null, configured: cfg !== null }));
+            return;
+        }
+        if (method === "POST" && url === "/serve/start") {
+            void (async () => {
+                if (serveController) {
+                    json(res, 200, { running: true });
+                    return;
+                }
+                const cfg = await loadTelegramConfig();
+                if (!cfg) {
+                    json(res, 400, { error: "Telegram isn't set up yet. Open Serve settings first." });
+                    return;
+                }
+                const st = session.getState();
+                try {
+                    serveController = await startServeMode({
+                        provider: st.provider,
+                        model: st.model,
+                        cwd,
+                        version: "app",
+                        thinkingLevel: session.getThinkingLevel() ?? undefined,
+                        telegram: { botToken: cfg.botToken, userId: cfg.userId },
+                        embedded: true,
+                    });
+                    broadcast("serve_change", { running: true });
+                    log("INFO", "app-sidecar", "serve started", { userId: cfg.userId });
+                    json(res, 200, { running: true });
+                }
+                catch (err) {
+                    serveController = null;
+                    json(res, 400, { error: err instanceof Error ? err.message : String(err) });
+                }
+            })();
+            return;
+        }
+        if (method === "POST" && url === "/serve/stop") {
+            void (async () => {
+                if (serveController) {
+                    await serveController.stop().catch(() => { });
+                    serveController = null;
+                    broadcast("serve_change", { running: false });
+                    log("INFO", "app-sidecar", "serve stopped");
+                }
+                json(res, 200, { running: false });
+            })();
+            return;
+        }
         json(res, 404, { error: "not found" });
     });
     server.listen(port, host, () => {
@@ -830,7 +1275,14 @@ async function main() {
         log("INFO", "app-sidecar", "listening", { port: String(addr.port), host });
     });
     const shutdown = async () => {
-        clearInterval(tasksPoll);
+        tasksPollStopped = true;
+        if (tasksPoll)
+            clearTimeout(tasksPoll);
+        // Kill any playing radio so the stream dies with its window.
+        stopRadio();
+        // Stop the Telegram serve loop + dispose its per-chat sessions.
+        if (serveController)
+            await serveController.stop().catch(() => { });
         for (const c of clients)
             c.res.end();
         server.close();