@prestyj/cli 5.7.0 → 5.9.0

package/dist/app-sidecar.js

@@ -23,7 +23,7 @@ import { runJsonMode } from "./modes/json-mode.js";
 import { runSubagentWorkerMode } from "./modes/subagent-worker-mode.js";
 import { AgentSession } from "./core/agent-session.js";
 import { RunLifecycle } from "./core/run-lifecycle.js";
-import { CHAT_AGENT_IDS, chatAgentSessionsDir, createChatAgent, parseChatAgentId, sessionsDirForChatAgent, switchChatAgent, } from "./chat-agents/index.js";
+import { CHAT_AGENT_IDS, chatAgentSessionsDir, createChatAgent, parseChatAgentId, switchChatAgent, } from "./chat-agents/index.js";
 import { buildJiwaTools, JiwaStore } from "./chat-agents/jiwa.js";
 import { buildMemoryTools, MemoryStore } from "./chat-agents/memory.js";
 import { buildNolanSystemPrompt, buildNolanAutopilotSystemPrompt } from "./core/nolan-prompt.js";
@@ -34,6 +34,8 @@ import { driveAutopilotCycle, frameAutopilotInjection } from "./core/autopilot-c
 import { validateNolanModelPref, effectiveNolanModel, } from "./core/nolan-model.js";
 import { normalizeAutopilotMarkersForHistory, normalizeAppMarkersForHistory, normalizeNolanTurnsForHistory, restoreUserRow, restoreAssistantTexts, autopilotMarkerCopySeed, } from "./core/session-history.js";
 import { AuthStorage } from "./core/auth-storage.js";
+import { cleanupToolOutputs } from "./tools/overflow.js";
+import { readCappedBody } from "./utils/http-body.js";
 import { fetchSubscriptionUsage, MOONSHOT_OAUTH_KEY, SubscriptionUsageError, XIAOMI_CREDITS_KEY, } from "@prestyj/core";
 import { loginAnthropic } from "./core/oauth/anthropic.js";
 import { loginOpenAI } from "./core/oauth/openai.js";
@@ -42,18 +44,20 @@ import { loginKimi } from "./core/oauth/kimi.js";
 import { AUTH_PROVIDERS } from "./core/auth-providers.js";
 import { ensureAppDirs, loadSavedSettings } from "./config.js";
 import { SettingsManager } from "./core/settings-manager.js";
-import { getModel, getMaxThinkingLevel, getContextWindow, MODELS } from "./core/model-registry.js";
+import { getModel, getDefaultThinkingLevel, getContextWindow, MODELS, } from "./core/model-registry.js";
 import { resolveStartOrFallback } from "./core/resolve-start.js";
-import { getGitBranch, isGitRepo } from "./utils/git.js";
+import { getGitBranch, getGitDirtyFileCount, isGitRepo } from "./utils/git.js";
+import { extractPlanSteps } from "./utils/plan-steps.js";
 import { getNextThinkingLevel, getSupportedThinkingLevels, isThinkingLevelSupported, } from "./core/thinking-level.js";
 import { PROMPT_COMMANDS } from "./core/prompt-commands.js";
 import { loadCustomCommands } from "./core/custom-commands.js";
-import { discoverProjects, listRecentSessions } from "./core/project-discovery.js";
+import { discoverProjects } from "./core/project-discovery.js";
+import { listSidecarSessions } from "./app-sidecar-sessions.js";
 import { loadTasksSync, saveTasksSync, pruneDoneTasksSync, getNextPendingTask, markTaskInProgress, } from "./core/task-store.js";
 import { initLogger, log } from "./core/logger.js";
 import { RADIO_STATIONS, getCurrentStation, getRadioVolume, playRadio, setRadioVolume, stopRadio, } from "./core/radio.js";
 import { enrichProcessPath } from "./core/shell-path.js";
-import { downscaleForPreview, validateVisionImage } from "./utils/image.js";
+import { downscaleForPreview, shrinkToFit, validateVisionImage } from "./utils/image.js";
 import { startServeMode } from "./modes/serve-mode.js";
 import { loadTelegramConfig, saveTelegramConfig, verifyBotToken } from "./core/telegram-config.js";
 import { loadServers, addServer, removeServer, getServer, parseMcpAddCommand, MCPClientManager, McpOAuthStore, } from "./core/mcp/index.js";
@@ -62,17 +66,22 @@ import { loadProgress, peekProgress, updateProgress } from "./core/progress/stor
 import { awardPrompt, awardCommits } from "./core/progress/engine.js";
 import { detectNewCommits, repoKey } from "./core/progress/git-xp.js";
 import { rebuildFromSessions } from "./core/progress/rebuild.js";
+import { captureSidecarError, flushSidecarErrors, shouldCaptureToolFailure, shouldCaptureUsagePollingError, wrapSidecarHandler, } from "./core/sidecar-error-reporter.js";
 const ALL_PROVIDERS = [
+    // US
     "anthropic",
-    "xiaomi",
     "openai",
     "gemini",
-    "glm",
+    "xai",
+    // China
     "moonshot",
+    "glm",
     "minimax",
+    "xiaomi",
     "deepseek",
-    "openrouter",
+    // Japan, then provider-agnostic gateway last
     "sakana",
+    "openrouter",
 ];
 function appSettingsFile() {
     return path.join(os.homedir(), ".ezcoder", "ezcoder-app.json");
@@ -163,6 +172,7 @@ async function persistModelSelection(settingsFile, provider, model) {
         await sm.set("defaultModel", model);
     }
     catch (err) {
+        captureSidecarError(err, "app-sidecar.settings.persist-model");
         log("WARN", "app-sidecar", "failed to persist model selection", { err: String(err) });
     }
 }
@@ -179,6 +189,7 @@ async function persistThinkingLevel(settingsFile, level) {
             await sm.set("thinkingLevel", level);
     }
     catch (err) {
+        captureSidecarError(err, "app-sidecar.settings.persist-thinking");
         log("WARN", "app-sidecar", "failed to persist thinking level", { err: String(err) });
     }
 }
@@ -196,19 +207,28 @@ async function prepareAttachments(cwd, attachments) {
         const fileName = `${Date.now().toString(36)}-${safe}`;
         const filePath = path.join(dir, fileName);
         const buf = Buffer.from(a.data, "base64");
-        // Validate image attachments before they become native image content blocks.
-        // A corrupt or unsupported-format image (e.g. a malformed .ico, or a .png
-        // with a bad IDAT) makes the provider reject the ENTIRE turn ("image data
-        // ... not a valid image") before the agent can respond. Downgrade such files
-        // to a plain "file" attachment so the model gets a path note and inspects
-        // them with its tools instead of the request 400ing.
+        // Validate and cap image attachments before they become native image content
+        // blocks. Anthropic applies a 2000 px per-dimension cap once conversation
+        // history contains more than 20 images, so every attachment must be safe for
+        // later turns too. Keep the original on disk, but send the resized bytes.
+        // Corrupt or unsupported images become plain files so they cannot reject the
+        // entire provider request.
         let prepared = { ...a };
         if (a.kind === "image") {
-            const validatedType = await validateVisionImage(buf).catch(() => null);
-            if (validatedType)
-                prepared = { ...a, mediaType: validatedType };
-            else
+            try {
+                const resized = await shrinkToFit(buf, a.mediaType);
+                const validatedType = await validateVisionImage(resized.buffer);
+                prepared = validatedType
+                    ? {
+                        ...a,
+                        mediaType: validatedType,
+                        data: resized.buffer.toString("base64"),
+                    }
+                    : { ...a, kind: "file" };
+            }
+            catch {
                 prepared = { ...a, kind: "file" };
+            }
         }
         try {
             await fs.writeFile(filePath, buf);
@@ -221,6 +241,9 @@ async function prepareAttachments(cwd, attachments) {
     return out;
 }
 const FILE_SEARCH_LIMIT = 20;
+// Upper bound on files walked per search (baseline #8 memory cap). Far above the
+// 20-result output limit, so relevance/recency ranking is unaffected in practice.
+const FILE_SEARCH_SCAN_CAP = 50_000;
 /** Score a candidate path against a lowercased query. Higher is better; a
  *  negative score means "no match". Basename hits beat path hits; prefix beats
  *  substring; shorter paths break ties. */
@@ -273,8 +296,13 @@ async function searchProjectFiles(cwd, rawQuery) {
     }
     const ig = ignore.default().add(gitignore);
     // `stats: true` gives mtime without a second stat pass, so the empty-query
-    // "recent files" path is a single walk.
-    const entries = await fg.default("**/*", {
+    // "recent files" path is a single walk. Stream + hard scan cap (baseline #8):
+    // collecting the full result array retained ~0.9 MB per 1k files (18.5 MB at
+    // 20k), unbounded. Bail after FILE_SEARCH_SCAN_CAP entries so a giant repo
+    // can't balloon RSS; the newest/most-relevant matches still surface because
+    // the cap is far above the 20-result output limit.
+    const entries = [];
+    const scanStream = fg.default.stream("**/*", {
         cwd,
         dot: false,
         onlyFiles: true,
@@ -283,6 +311,17 @@ async function searchProjectFiles(cwd, rawQuery) {
         followSymbolicLinks: false,
         stats: true,
     });
+    for await (const entry of scanStream) {
+        entries.push(entry);
+        if (entries.length >= FILE_SEARCH_SCAN_CAP) {
+            scanStream.destroy();
+            log("DEBUG", "app-sidecar", "file search scan cap hit", {
+                cap: String(FILE_SEARCH_SCAN_CAP),
+                cwd,
+            });
+            break;
+        }
+    }
     const files = entries.filter((e) => !ig.ignores(e.path));
     if (!query) {
         return files
@@ -437,7 +476,11 @@ async function runJsonModeIfRequested() {
         maxTurns: maxTurnsRaw ? parseInt(maxTurnsRaw, 10) : undefined,
         allowedTools,
         promptCacheKey: values["prompt-cache-key"],
-    }).catch((err) => {
+    }).catch(async (err) => {
+        captureSidecarError(err, "app-sidecar.json-mode", {
+            provider: String(values.provider ?? "anthropic"),
+        });
+        await flushSidecarErrors();
         process.stderr.write((err instanceof Error ? err.message : String(err)) + "\n");
         process.exit(1);
     });
@@ -446,13 +489,8 @@ async function runJsonModeIfRequested() {
 // ── Daemon-level HTTP helpers (shared by the session-management routes) ─────
 // The per-session route table has its own local copies; these serve the
 // daemon's own POST /session / DELETE /session routes.
-function daemonReadBody(req) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        req.on("data", (c) => chunks.push(c));
-        req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
-        req.on("error", reject);
-    });
+function daemonReadBody(req, res) {
+    return readCappedBody(req, res);
 }
 function daemonJson(res, status, body) {
     res.writeHead(status, {
@@ -505,6 +543,9 @@ async function main() {
     // before anything spawns (bash tool, background tasks, LSP, git helpers all
     // inherit it). Best-effort — never blocks startup beyond its internal cap.
     await enrichProcessPath();
+    // Sweep recoverable full tool outputs (~/.ezcoder/tool-output/) older than 48h.
+    // Fire-and-forget: cleanup must never delay or break startup.
+    void cleanupToolOutputs().catch(() => { });
     const auth = new AuthStorage(paths.authFile);
     await auth.load();
     // Every window's session lives here as an in-process object, keyed by the id
@@ -535,30 +576,63 @@ async function main() {
     });
     const usageCache = new Map();
     const usageRequests = new Map();
+    // 429 backoff: quota endpoints are auxiliary UI data. Honor Retry-After when
+    // provided; otherwise retain the unavailable snapshot for 30 minutes. Clamp
+    // the provider value so a malformed header can neither hammer the endpoint
+    // nor suppress usage data forever.
+    const usageRateLimitedUntil = new Map();
+    const USAGE_RATE_LIMIT_FALLBACK_BACKOFF_MS = 30 * 60_000;
+    const USAGE_RATE_LIMIT_MIN_BACKOFF_MS = 60_000;
+    const USAGE_RATE_LIMIT_MAX_BACKOFF_MS = 24 * 60 * 60_000;
     async function fetchUsageProvider(provider) {
-        const displayName = provider === "anthropic" ? "Anthropic" : "Codex";
-        if (!(await auth.hasProviderAuth(provider))) {
+        const displayName = provider === "anthropic" ? "Anthropic" : provider === "openai" ? "Codex" : "Kimi";
+        // Kimi plan usage is tracked on the OAuth credential specifically — the
+        // Moonshot platform API key is metered per-token, not per plan window.
+        const authKey = provider === "moonshot" ? MOONSHOT_OAUTH_KEY : provider;
+        if (!(await auth.hasProviderAuth(authKey))) {
             return { provider, displayName, connected: false, windows: [], fetchedAt: Date.now() };
         }
         try {
-            let credentials = await auth.resolveCredentials(provider);
+            let credentials = await auth.resolveCredentials(authKey);
             try {
-                return { ...(await fetchSubscriptionUsage(provider, credentials)), connected: true };
+                const snapshot = {
+                    ...(await fetchSubscriptionUsage(provider, credentials)),
+                    connected: true,
+                };
+                usageRateLimitedUntil.delete(provider);
+                return snapshot;
             }
             catch (error) {
                 // A provider can revoke an access token before its stored expiry. Refresh
                 // once on 401, matching inference auth recovery, then retry the usage call.
                 if (error instanceof SubscriptionUsageError && error.status === 401) {
-                    credentials = await auth.resolveCredentials(provider, { forceRefresh: true });
-                    return { ...(await fetchSubscriptionUsage(provider, credentials)), connected: true };
+                    credentials = await auth.resolveCredentials(authKey, { forceRefresh: true });
+                    const snapshot = {
+                        ...(await fetchSubscriptionUsage(provider, credentials)),
+                        connected: true,
+                    };
+                    usageRateLimitedUntil.delete(provider);
+                    return snapshot;
                 }
                 throw error;
             }
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            log("WARN", "app-sidecar", "subscription usage fetch failed", { provider, message });
-            const connected = await auth.hasProviderAuth(provider);
+            if (shouldCaptureUsagePollingError(error)) {
+                captureSidecarError(error, "app-sidecar.usage.fetch", { provider });
+            }
+            let backoffMs;
+            if (error instanceof SubscriptionUsageError && error.status === 429) {
+                backoffMs = Math.min(USAGE_RATE_LIMIT_MAX_BACKOFF_MS, Math.max(USAGE_RATE_LIMIT_MIN_BACKOFF_MS, error.retryAfterMs ?? USAGE_RATE_LIMIT_FALLBACK_BACKOFF_MS));
+                usageRateLimitedUntil.set(provider, Date.now() + backoffMs);
+            }
+            log("WARN", "app-sidecar", "subscription usage fetch failed", {
+                provider,
+                message,
+                ...(backoffMs !== undefined && { backoffMs: String(backoffMs) }),
+            });
+            const connected = await auth.hasProviderAuth(authKey);
             return {
                 provider,
                 displayName,
@@ -586,9 +660,12 @@ async function main() {
             const missingReset = result.connected &&
                 result.windows.length > 0 &&
                 result.windows.some((window) => window.resetsAt === undefined);
+            const rateLimitedUntil = usageRateLimitedUntil.get(provider) ?? 0;
             usageCache.set(provider, {
                 result,
-                expiresAt: Date.now() + (missingReset ? 10_000 : 60_000),
+                expiresAt: rateLimitedUntil > Date.now()
+                    ? rateLimitedUntil
+                    : Date.now() + (missingReset ? 10_000 : 60_000),
             });
             return result;
         }
@@ -610,7 +687,7 @@ async function main() {
             return null;
         }
     }
-    const server = http.createServer((req, res) => {
+    const server = http.createServer(wrapSidecarHandler((req, res) => {
         const url = req.url ?? "/";
         const method = req.method ?? "GET";
         // CORS preflight — the webview origin differs from 127.0.0.1.
@@ -626,7 +703,9 @@ async function main() {
         // ── Daemon-level routes (session lifecycle) ──────────────────────────
         // Create a session for a window: { mode?, cwd, sessionPath? } → { sessionId }.
         if (method === "POST" && url === "/session") {
-            void daemonReadBody(req).then(async (raw) => {
+            void daemonReadBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let body = {};
                 try {
                     body = raw ? JSON.parse(raw) : {};
@@ -654,6 +733,7 @@ async function main() {
                 }
                 catch (err) {
                     const message = err instanceof Error ? err.message : String(err);
+                    captureSidecarError(err, "app-sidecar.session.create");
                     log("ERROR", "app-sidecar", "session create failed", { message });
                     daemonJson(res, 500, { error: message });
                 }
@@ -684,12 +764,13 @@ async function main() {
         if (method === "GET" && (url === "/usage" || url.startsWith("/usage?"))) {
             void (async () => {
                 const provider = new URL(url, `http://${host}`).searchParams.get("provider");
-                if (provider !== "anthropic" && provider !== "openai") {
+                if (provider !== "anthropic" && provider !== "openai" && provider !== "moonshot") {
                     daemonJson(res, 400, { error: "unsupported usage provider" });
                     return;
                 }
                 daemonJson(res, 200, await subscriptionUsage(provider));
             })().catch((error) => {
+                captureSidecarError(error, "app-sidecar.usage.request");
                 log("ERROR", "app-sidecar", "subscription usage request failed", {
                     message: error instanceof Error ? error.message : String(error),
                 });
@@ -705,7 +786,7 @@ async function main() {
             return;
         }
         ctx.handle(req, res, url, method);
-    });
+    }, "app-sidecar.http"));
     server.listen(port, host, () => {
         const addr = server.address();
         // The Rust shell reads this line to learn the daemon port.
@@ -722,6 +803,8 @@ async function main() {
         // Radio playback is app-wide (one stream across all windows), so it stops
         // at the daemon level, not per session.
         stopRadio();
+        // Close the ~/.ezcoder progress fs.watch handle (baseline #8 leak fix).
+        progress.dispose();
         await Promise.all([...sessions.values()].map((c) => c.dispose().catch(() => { })));
         server.close();
         process.exit(0);
@@ -850,6 +933,7 @@ async function createProgressManager(agentDir, broadcastAll) {
             broadcastAll(buildSnapshot(updated), originId);
         }
         catch (err) {
+            captureSidecarError(err, "app-sidecar.progress.award");
             log("DEBUG", "app-sidecar", "progress award failed", {
                 message: err instanceof Error ? err.message : String(err),
             });
@@ -858,6 +942,7 @@ async function createProgressManager(agentDir, broadcastAll) {
     // Watch ~/.ezcoder (dir watch survives the atomic tmp+rename) for progress.json
     // writes from other daemon processes; debounce, reload read-only, dedupe by nonce.
     let watchDebounce = null;
+    let progressWatcher = null;
     try {
         const watcher = fsWatch(agentDir, (_event, filename) => {
             if (filename !== "progress.json")
@@ -879,13 +964,30 @@ async function createProgressManager(agentDir, broadcastAll) {
             }, 150);
         });
         watcher.unref();
+        progressWatcher = watcher;
     }
     catch (err) {
+        captureSidecarError(err, "app-sidecar.progress.watch");
         log("DEBUG", "app-sidecar", "progress watch unavailable", {
             message: err instanceof Error ? err.message : String(err),
         });
     }
-    return { snapshot, awardRun };
+    // Dispose closes the fs.watch handle (baseline #8: it was previously never
+    // closed — a per-daemon leak) and clears any pending debounce timer.
+    function dispose() {
+        if (watchDebounce) {
+            clearTimeout(watchDebounce);
+            watchDebounce = null;
+        }
+        try {
+            progressWatcher?.close();
+        }
+        catch {
+            // Already closed / never opened — nothing to do.
+        }
+        progressWatcher = null;
+    }
+    return { snapshot, awardRun, dispose };
 }
 /**
  * Build one in-process agent session: its AgentSession, SSE client set, event
@@ -904,6 +1006,10 @@ async function createSession(deps, opts) {
     // parsing); the daemon owns the real listen host.
     const host = "127.0.0.1";
     const saved = loadSavedSettings(paths.settingsFile);
+    // Native login/logout and other live sessions share auth.json. Refresh the
+    // daemon-level snapshot before choosing this session's provider so a project
+    // never boots against credentials that were just replaced or disconnected.
+    await auth.load();
     // Per-project model/thinking prefs win over the shared global settings.json:
     // each window (one project cwd) restores its own selection instead of every
     // window reading the same single global slot that the last writer clobbered
@@ -922,9 +1028,14 @@ async function createSession(deps, opts) {
         });
     }
     // Per-project thinking prefs win over the global settings.json fallback.
+    // With no saved level, the default follows the active credential's endpoint:
+    // Kimi K3 on the OAuth coding endpoint starts at its declared default (high),
+    // matching the official kimi-code CLI's plan-usage profile.
     const thinkEnabled = projectPrefs?.thinkingEnabled ?? saved.thinkingEnabled;
     const thinkingLevel = thinkEnabled
-        ? (projectPrefs?.thinkingLevel ?? saved.thinkingLevel ?? getMaxThinkingLevel(model))
+        ? (projectPrefs?.thinkingLevel ??
+            saved.thinkingLevel ??
+            getDefaultThinkingLevel(model, { baseUrl: auth.getStoredBaseUrl(provider) }))
         : undefined;
     // ── SSE fan-out (declared before the session so plan callbacks can use it) ─
     const clients = new Set();
@@ -971,6 +1082,11 @@ async function createSession(deps, opts) {
         const f = formatError(err);
         const message = f.message ? desktopGuidance(f.message) : undefined;
         const guidance = desktopGuidance(f.guidance);
+        captureSidecarError(err, `app-sidecar.${logLabel.replaceAll(" ", "-")}`, {
+            scope: type,
+            ...(f.provider ? { provider: f.provider } : {}),
+            ...(f.statusCode != null ? { status: String(f.statusCode) } : {}),
+        });
         log("ERROR", "app-sidecar", logLabel, {
             headline: f.headline,
             source: f.source,
@@ -1011,6 +1127,11 @@ async function createSession(deps, opts) {
         signal: abort.signal,
         // Keep MCP startup off the readiness path in both modes.
         backgroundMcpConnect: true,
+        // Keep restore-time auto-compaction off the readiness path too: its summary
+        // LLM call (30s timeout) used to freeze waitForReady — and with it the whole
+        // window (project picker, session list) — whenever a resumed session was
+        // over the context threshold. First prompt compacts instead, with UI events.
+        deferLoadCompaction: true,
     };
     let session;
     if (mode === "chat") {
@@ -1023,6 +1144,7 @@ async function createSession(deps, opts) {
                 chatAgent = nextAgent;
                 broadcast("chat_agent_change", { chatAgent: nextAgent });
                 await session.persistAppMarker("agent_handoff", { chatAgent: nextAgent }).catch((error) => {
+                    captureSidecarError(error, "app-sidecar.chat-agent.persist-handoff");
                     log("WARN", "app-sidecar", "agent handoff marker persist failed", {
                         message: error instanceof Error ? error.message : String(error),
                     });
@@ -1038,7 +1160,9 @@ async function createSession(deps, opts) {
                 // Unattended task runs cannot approve plans; implement directly instead.
                 if (taskRunActive)
                     return false;
+                deactivateApprovedPlan();
                 await session.setPlanMode(true);
+                broadcast("plan_progress", { total: 0, completed: [] });
                 broadcast("plan_enter", { reason: reason ?? "" });
                 void session.persistAppMarker("plan", { reason: reason ?? "" }).catch(() => { });
             },
@@ -1073,11 +1197,17 @@ async function createSession(deps, opts) {
         }
     }
     log("INFO", "app-sidecar", "session ready", { provider, model, mode, chatAgent, cwd });
-    // Footer extras (context window, git branch, background tasks). The git
-    // branch is resolved once at startup and refreshed lazily; the context
+    // Workspace extras (context window, git status, background tasks). Git state
+    // is resolved once at startup and refreshed after every run; the context
     // window follows the active model.
-    let gitBranch = await getGitBranch(cwd).catch(() => null);
-    let gitIsRepo = await isGitRepo(cwd).catch(() => false);
+    const [initialGitBranch, initialGitIsRepo, initialDirtyFileCount] = await Promise.all([
+        getGitBranch(cwd).catch(() => null),
+        isGitRepo(cwd).catch(() => false),
+        getGitDirtyFileCount(cwd).catch(() => 0),
+    ]);
+    let gitBranch = initialGitBranch;
+    let gitIsRepo = initialGitIsRepo;
+    let gitDirtyFileCount = initialDirtyFileCount;
     function currentContextWindow() {
         const st = session.getState();
         return getContextWindow(st.model, { provider: st.provider, accountId: st.accountId });
@@ -1089,6 +1219,7 @@ async function createSession(deps, opts) {
             contextWindow: currentContextWindow(),
             gitBranch,
             isGitRepo: gitIsRepo,
+            gitDirtyFileCount,
             tasks: session.listBackgroundProcesses(),
         };
     }
@@ -1098,8 +1229,94 @@ async function createSession(deps, opts) {
     // failures (e.g. repeated invalid-argument errors) instead of leaving the
     // fatal-abort path with no forensic trail.
     const toolCallNames = new Map();
+    // Approved-plan progress belongs beside the plan file, not in the webview.
+    // The implementation can rewrite/expand that file mid-run, so a step count
+    // frozen at approval time becomes dishonest (the exact stale-total bug the
+    // CLI already fixed). Re-read the live file after tools/markers, retain the
+    // last valid step section during transient edits, and send one authoritative
+    // snapshot to the app.
+    let approvedPlanPath = null;
+    let approvedPlanTotal = 0;
+    let approvedPlanMarkers = new Set();
+    let approvedPlanGeneration = 0;
+    let planMarkerTail = "";
+    let planProgressSync = Promise.resolve(false);
+    function planProgressPayload() {
+        const completed = [...approvedPlanMarkers]
+            .filter((step) => step >= 1 && step <= approvedPlanTotal)
+            .sort((a, b) => a - b);
+        return { total: approvedPlanTotal, completed };
+    }
+    async function syncApprovedPlanProgress(generation) {
+        const planPath = approvedPlanPath;
+        if (planPath === null || generation !== approvedPlanGeneration)
+            return false;
+        const content = await fs.readFile(planPath, "utf-8").catch(() => null);
+        if (approvedPlanPath !== planPath || generation !== approvedPlanGeneration)
+            return false;
+        if (content !== null) {
+            const freshTotal = extractPlanSteps(content).length;
+            // During an in-place rewrite the step section can briefly disappear.
+            // Keep the last real total instead of flashing 0 or declaring completion.
+            if (freshTotal > 0 || approvedPlanTotal === 0)
+                approvedPlanTotal = freshTotal;
+        }
+        broadcast("plan_progress", planProgressPayload());
+        return (approvedPlanTotal > 0 &&
+            Array.from({ length: approvedPlanTotal }, (_, index) => index + 1).every((step) => approvedPlanMarkers.has(step)));
+    }
+    function queueApprovedPlanProgressSync() {
+        const generation = approvedPlanGeneration;
+        planProgressSync = planProgressSync
+            .catch(() => false)
+            .then(() => syncApprovedPlanProgress(generation))
+            .catch((error) => {
+            captureSidecarError(error, "app-sidecar.plan.refresh-progress");
+            log("WARN", "app-sidecar", "plan progress refresh failed", {
+                message: error instanceof Error ? error.message : String(error),
+            });
+            return false;
+        });
+        return planProgressSync;
+    }
+    async function activateApprovedPlan(planPath) {
+        deactivateApprovedPlan();
+        await session.setApprovedPlan(planPath);
+        if (!planPath)
+            return 0;
+        approvedPlanPath = planPath;
+        await queueApprovedPlanProgressSync();
+        return approvedPlanTotal;
+    }
+    function deactivateApprovedPlan() {
+        approvedPlanGeneration++;
+        approvedPlanPath = null;
+        approvedPlanTotal = 0;
+        approvedPlanMarkers = new Set();
+        planMarkerTail = "";
+        planProgressSync = Promise.resolve(false);
+    }
+    function recordApprovedPlanMarkers(text) {
+        if (approvedPlanPath === null || !text)
+            return;
+        const candidate = planMarkerTail + text;
+        let changed = false;
+        for (const match of candidate.matchAll(/\[DONE:(\d+)\]/gi)) {
+            const step = Number.parseInt(match[1], 10);
+            if (step >= 1 && !approvedPlanMarkers.has(step)) {
+                approvedPlanMarkers.add(step);
+                changed = true;
+            }
+        }
+        planMarkerTail = candidate.slice(-32);
+        if (changed)
+            void queueApprovedPlanProgressSync();
+    }
     // Forward every relevant bus event to the webview.
-    session.eventBus.on("text_delta", (d) => broadcast("text_delta", d));
+    session.eventBus.on("text_delta", (d) => {
+        broadcast("text_delta", d);
+        recordApprovedPlanMarkers(d.text);
+    });
     session.eventBus.on("thinking_delta", (d) => broadcast("thinking_delta", d));
     session.eventBus.on("tool_call_start", (d) => {
         toolCallNames.set(d.toolCallId, d.name);
@@ -1109,6 +1326,11 @@ async function createSession(deps, opts) {
     session.eventBus.on("tool_call_end", (d) => {
         const name = toolCallNames.get(d.toolCallId) ?? "unknown";
         toolCallNames.delete(d.toolCallId);
+        if (d.isError && shouldCaptureToolFailure(name, d.result)) {
+            // Expected model-correctable validation failures stay in the local log and
+            // conversation. Unexpected failures are reported without private result data.
+            captureSidecarError(new Error(`Tool ${name} failed`), `tool.${name}`, { tool: name });
+        }
         log(d.isError ? "ERROR" : "INFO", "tool", `Tool call ended: ${name}`, {
             id: d.toolCallId,
             durationMs: String(d.durationMs),
@@ -1122,6 +1344,11 @@ async function createSession(deps, opts) {
         if (name === "tasks") {
             broadcast("tasks_list", { tasks: loadTasksSync(cwd) });
         }
+        // Any tool can mutate the approved plan (including bash), so refresh after
+        // every completed call while tracking is active. The file is tiny and this
+        // keeps the displayed total aligned before the next completion marker.
+        if (approvedPlanPath !== null)
+            void queueApprovedPlanProgressSync();
     });
     // Native server tools (e.g. Anthropic web_search) do NOT end the turn — text
     // streams before and after them in the SAME turn. The webview must reset its
@@ -1130,6 +1357,9 @@ async function createSession(deps, opts) {
     session.eventBus.on("server_tool_call", (d) => broadcast("server_tool_call", d));
     session.eventBus.on("turn_end", (d) => broadcast("turn_end", d));
     session.eventBus.on("agent_done", (d) => broadcast("agent_done", d));
+    // Non-clean stop (max_tokens/refusal/provider error) — info-style frame so
+    // the webview can warn instead of presenting truncated output as complete.
+    session.eventBus.on("truncated", (d) => broadcast("truncated", d));
     session.eventBus.on("error", (d) => {
         broadcastError("error", "agent error", d.error);
     });
@@ -1146,15 +1376,16 @@ async function createSession(deps, opts) {
     });
     const cancelledRunEndGenerations = new Set();
     let pendingCancelDrain = null;
-    let titleGenerated = false;
     // Bumped by /cancel — a run whose cancel generation changed mid-flight was
     // canceled and earns no XP.
     let cancelGeneration = 0;
     // Autopilot (auto-review) toggle for THIS window's project. Loaded from
     // ezcoder-app.json on boot; flipped via POST /autopilot. When on, POST /prompt runs
     // runAutopilotCycle after the user's turn settles — Nolan auto-reviews the work
-    // and drives the review→prompt→review loop.
+    // and drives the review→prompt→review loop. Nolan is the sole verification
+    // owner in this mode, so suppress the build session's redundant Ideal hook.
     let autopilot = mode === "code" && (await loadAutopilot(cwd));
+    session.setIdealReviewSuppressed(autopilot);
     // True while an autopilot review is in flight (used to defer nolanAuto model
     // switches, like nolanRunning does for chat Nolan, and to drive the spinner).
     let autopilotReviewing = false;
@@ -1351,6 +1582,9 @@ async function createSession(deps, opts) {
             // (often >5 min) regardless of the user's global speedProfile pick.
             forceLongCacheRetention: true,
         });
+        // Nolan is already the independent autopilot reviewer; recursively running
+        // his own Ideal self-review adds latency and can corrupt the verdict shape.
+        ken.setIdealReviewSuppressed(true);
         await ken.initialize();
         // Deliberately no bus bridge: the review is silent. Errors surface via the
         // runAutopilotReview try/catch as autopilot_error frames.
@@ -1361,20 +1595,6 @@ async function createSession(deps, opts) {
         });
         return ken;
     }
-    // Resumed session: if it already has a conversation, generate its title now so
-    // the title bar shows it immediately on load (not just after the next prompt).
-    {
-        const hasHistory = session
-            .getMessages()
-            .some((m) => m.role === "user" || m.role === "assistant");
-        if (hasHistory) {
-            titleGenerated = true;
-            void session.generateTitle().then((title) => {
-                if (title)
-                    broadcast("session_title", { title });
-            });
-        }
-    }
     function abortOwnedWork() {
         cancelGeneration++;
         abort.abort();
@@ -1437,10 +1657,35 @@ async function createSession(deps, opts) {
                 // Fire-and-forget — XP must never delay or break run teardown.
                 void progress.awardRun(cwd, runStartedAt, opts.id);
             }
-            // A run may have switched branches (git checkout) or spawned/finished
-            // background tasks — refresh the footer extras once it settles.
-            gitBranch = await getGitBranch(cwd).catch(() => gitBranch);
-            gitIsRepo = await isGitRepo(cwd).catch(() => gitIsRepo);
+            // A run may have switched branches, changed files, or spawned/finished
+            // background tasks. Refresh the workspace extras once it settles.
+            [gitBranch, gitIsRepo, gitDirtyFileCount] = await Promise.all([
+                getGitBranch(cwd).catch(() => gitBranch),
+                isGitRepo(cwd).catch(() => gitIsRepo),
+                getGitDirtyFileCount(cwd).catch(() => gitDirtyFileCount),
+            ]);
+            // Serialize behind any marker/tool-triggered refresh so the terminal
+            // progress snapshot uses the live plan file. Once every canonical step
+            // is complete, remove the approved plan from future system prompts and
+            // clear the widget before run_end paints the idle activity bar.
+            if (runSucceeded &&
+                !cancelled &&
+                approvedPlanPath !== null &&
+                (await queueApprovedPlanProgressSync())) {
+                try {
+                    await session.setApprovedPlan(undefined);
+                    deactivateApprovedPlan();
+                    broadcast("plan_progress", { total: 0, completed: [] });
+                }
+                catch (error) {
+                    // Keep tracking when prompt cleanup fails; hiding the widget here
+                    // would claim completion while the approved-plan contract remained.
+                    captureSidecarError(error, "app-sidecar.plan.cleanup");
+                    log("WARN", "app-sidecar", "completed plan cleanup failed", {
+                        message: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
             if (ownsGeneration)
                 finishOwnedGeneration(generation, false);
             // A cancelled injected run is still owned by the surrounding autopilot
@@ -1463,13 +1708,6 @@ async function createSession(deps, opts) {
             broadcast("tasks_list", { tasks: pruneDoneTasksSync(cwd) });
             broadcast("queued", { count: session.getQueuedCount() });
             broadcast("extras", footerExtras());
-            if (!titleGenerated) {
-                titleGenerated = true;
-                void session.generateTitle().then((title) => {
-                    if (title)
-                        broadcast("session_title", { title });
-                });
-            }
         }
     }
     // ── Autopilot orchestration ─────────────────────────────────
@@ -1574,6 +1812,7 @@ async function createSession(deps, opts) {
         const generation = runLifecycle.begin(abortOwnedWork).generation;
         pendingCancelDrain = null;
         autopilotActive = true;
+        session.setIdealReviewSuppressed(true);
         // Generation captured by the last plan review; acceptPlan re-checks it so
         // a user Accept/Reject landing mid-review always wins.
         let planGenAtReview = -1;
@@ -1600,22 +1839,22 @@ async function createSession(deps, opts) {
                     if (pendingPlanPath === null || planGeneration !== planGenAtReview)
                         return false;
                     const planPath = pendingPlanPath;
+                    let planTotal;
                     try {
-                        await session.newSession();
+                        await session.newSession(true);
                         injectedAutopilotPrompts = [];
-                        titleGenerated = false;
-                        await session.setApprovedPlan(planPath);
+                        planTotal = await activateApprovedPlan(planPath);
                     }
                     catch (err) {
                         broadcastError("autopilot_error", "autopilot plan accept failed", err);
                         return false;
                     }
                     clearPendingPlan();
-                    // Ordering is load-bearing: the webview reads its still-open plan
-                    // modal state (step count) on autopilot_plan_accepted, and
-                    // session_reset clears it — accepted must land first.
+                    // Keep the approval marker ahead of the reset, then seed the reset
+                    // with the sidecar's canonical count from the actual plan file.
                     broadcast("autopilot_plan_accepted", {});
-                    broadcast("session_reset", {});
+                    broadcast("session_reset", { planTotal });
+                    broadcast("plan_progress", planProgressPayload());
                     // Persisted into the NEW session so a resume shows the marker.
                     void session.persistAutopilotMarker("plan_approved");
                     return true;
@@ -1687,6 +1926,7 @@ async function createSession(deps, opts) {
         }
         finally {
             autopilotActive = false;
+            session.setIdealReviewSuppressed(autopilot);
             finishOwnedGeneration(generation, true);
             queueMicrotask(() => void runStrandedQueue());
         }
@@ -1786,9 +2026,9 @@ async function createSession(deps, opts) {
     async function runTaskByIdInner(task) {
         // Fresh session per task so one task's context never bleeds into the next.
         await session.newSession();
+        deactivateApprovedPlan();
         injectedAutopilotPrompts = [];
         clearPendingPlan();
-        titleGenerated = false;
         broadcast("session_reset", {});
         markTaskInProgress(cwd, task.id);
         broadcast("tasks_list", { tasks: loadTasksSync(cwd) });
@@ -1872,13 +2112,32 @@ async function createSession(deps, opts) {
         tasksPoll.unref?.();
     };
     scheduleTasksPoll(1500);
-    function readBody(req) {
-        return new Promise((resolve, reject) => {
-            const chunks = [];
-            req.on("data", (c) => chunks.push(c));
-            req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
-            req.on("error", reject);
-        });
+    // Files can change outside the agent (editor saves, terminal commits), so keep
+    // the dirty count current while idle. Branch/repo state already refreshes after
+    // agent runs; polling only the count avoids spawning three git processes per tick.
+    let gitPoll;
+    let gitPollStopped = false;
+    const scheduleGitPoll = (delay) => {
+        if (gitPollStopped)
+            return;
+        gitPoll = setTimeout(() => {
+            void getGitDirtyFileCount(cwd)
+                .catch(() => gitDirtyFileCount)
+                .then((nextDirtyFileCount) => {
+                if (gitPollStopped)
+                    return;
+                if (nextDirtyFileCount !== gitDirtyFileCount) {
+                    gitDirtyFileCount = nextDirtyFileCount;
+                    broadcast("extras", footerExtras());
+                }
+                scheduleGitPoll(5000);
+            });
+        }, delay);
+        gitPoll.unref?.();
+    };
+    scheduleGitPoll(5000);
+    function readBody(req, res) {
+        return readCappedBody(req, res);
     }
     function json(res, status, body) {
         const payload = JSON.stringify(redactValue(body, { secrets: environmentSecrets(process.env) }));
@@ -1916,7 +2175,10 @@ async function createSession(deps, opts) {
             void memoryStore
                 .snapshot()
                 .then((snapshot) => json(res, 200, snapshot))
-                .catch((error) => json(res, 500, { error: error instanceof Error ? error.message : String(error) }));
+                .catch((error) => {
+                captureSidecarError(error, "app-sidecar.memory.snapshot");
+                json(res, 500, { error: error instanceof Error ? error.message : String(error) });
+            });
             return;
         }
         if (method === "DELETE" && url.startsWith("/memories/")) {
@@ -1929,14 +2191,20 @@ async function createSession(deps, opts) {
                 .forget(id)
                 .then(() => memoryStore.snapshot())
                 .then((snapshot) => json(res, 200, snapshot))
-                .catch((error) => json(res, 500, { error: error instanceof Error ? error.message : String(error) }));
+                .catch((error) => {
+                captureSidecarError(error, "app-sidecar.memory.forget");
+                json(res, 500, { error: error instanceof Error ? error.message : String(error) });
+            });
             return;
         }
         if (method === "GET" && url === "/jiwa") {
             void jiwaStore
                 .snapshot()
                 .then((snapshot) => json(res, 200, snapshot))
-                .catch((error) => json(res, 500, { error: error instanceof Error ? error.message : String(error) }));
+                .catch((error) => {
+                captureSidecarError(error, "app-sidecar.jiwa.snapshot");
+                json(res, 500, { error: error instanceof Error ? error.message : String(error) });
+            });
             return;
         }
         if (method === "DELETE" && url.startsWith("/jiwa/")) {
@@ -1949,7 +2217,10 @@ async function createSession(deps, opts) {
                 .forget(id)
                 .then(() => jiwaStore.snapshot())
                 .then((snapshot) => json(res, 200, snapshot))
-                .catch((error) => json(res, 500, { error: error instanceof Error ? error.message : String(error) }));
+                .catch((error) => {
+                captureSidecarError(error, "app-sidecar.jiwa.forget");
+                json(res, 500, { error: error instanceof Error ? error.message : String(error) });
+            });
             return;
         }
         if (method === "GET" && (url === "/events" || url.startsWith("/events?"))) {
@@ -2007,7 +2278,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/settings") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let projectsRoot;
                 try {
                     projectsRoot = JSON.parse(raw).projectsRoot ?? "";
@@ -2030,7 +2303,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/create-project") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let name;
                 try {
                     name = JSON.parse(raw).name ?? "";
@@ -2062,6 +2337,7 @@ async function createSession(deps, opts) {
                     json(res, 200, { path: dir });
                 }
                 catch (err) {
+                    captureSidecarError(err, "app-sidecar.project.create");
                     json(res, 500, { error: err instanceof Error ? err.message : String(err) });
                 }
             });
@@ -2072,6 +2348,7 @@ async function createSession(deps, opts) {
             void discoverProjects()
                 .then((projects) => json(res, 200, { projects }))
                 .catch((err) => {
+                captureSidecarError(err, "app-sidecar.projects.discover");
                 log("ERROR", "app-sidecar", "discoverProjects failed", {
                     message: err instanceof Error ? err.message : String(err),
                 });
@@ -2086,37 +2363,14 @@ async function createSession(deps, opts) {
                 return;
             }
             const requestedAgent = new URL(url, `http://${host}`).searchParams.get("chatAgent");
-            if (requestedAgent === "all") {
-                void Promise.all(CHAT_AGENT_IDS.map(async (agentId) => {
-                    const agentSessions = await listRecentSessions(target, 5, chatAgentSessionsDir(paths.sessionsDir, agentId));
-                    return agentSessions.map((item) => ({ ...item, chatAgent: agentId }));
-                }))
-                    .then(async (groups) => {
-                    const dated = await Promise.all(groups.flat().map(async (item) => ({
-                        item,
-                        mtime: await fs
-                            .stat(item.path)
-                            .then((stat) => stat.mtimeMs)
-                            .catch(() => 0),
-                    })));
-                    const recent = dated
-                        .sort((left, right) => right.mtime - left.mtime)
-                        .slice(0, 5)
-                        .map(({ item }) => item);
-                    json(res, 200, { sessions: recent });
-                })
-                    .catch(() => json(res, 200, { sessions: [] }));
-                return;
-            }
-            // The picker may be served by a sidecar currently running in Chat mode.
-            // An omitted chatAgent always means coding history; chat callers identify
-            // their namespace explicitly (one agent or "all").
-            const sessionsDir = requestedAgent
-                ? sessionsDirForChatAgent(paths.sessionsDir, requestedAgent)
-                : paths.sessionsDir;
-            void listRecentSessions(target, 5, sessionsDir)
+            // An omitted chatAgent means coding history; chat callers identify one
+            // agent or request the combined, recency-sorted "all" listing.
+            void listSidecarSessions(target, requestedAgent, paths.sessionsDir)
                 .then((sessions) => json(res, 200, { sessions }))
-                .catch(() => json(res, 200, { sessions: [] }));
+                .catch((error) => {
+                captureSidecarError(error, "app-sidecar.sessions.list");
+                json(res, 200, { sessions: [] });
+            });
             return;
         }
         if (method === "GET" && url.startsWith("/files")) {
@@ -2124,6 +2378,7 @@ async function createSession(deps, opts) {
             void searchProjectFiles(cwd, q)
                 .then((files) => json(res, 200, { files }))
                 .catch((err) => {
+                captureSidecarError(err, "app-sidecar.files.search");
                 log("ERROR", "app-sidecar", "searchProjectFiles failed", {
                     message: err instanceof Error ? err.message : String(err),
                 });
@@ -2145,6 +2400,20 @@ async function createSession(deps, opts) {
             void (async () => {
                 const commandCandidates = [...PROMPT_COMMANDS, ...(await loadCustomCommands(cwd))];
                 const messages = session.getMessages();
+                // An Ideal hook is injected immediately after the assistant's candidate
+                // no-tool response. That response is review scratch, not a user-visible
+                // final answer. Live SSE drops it when the hook event arrives; mark the
+                // same assistant message here so resumed history stays identical.
+                const hiddenIdealDrafts = new Set();
+                for (let i = 0; i < messages.length - 1; i++) {
+                    const draft = messages[i];
+                    const hookPrompt = messages[i + 1];
+                    if (draft?.role !== "assistant" || hookPrompt?.role !== "user")
+                        continue;
+                    const restored = restoreUserRow(hookPrompt.content);
+                    if (detectHookKind(restored.text) === "ideal")
+                        hiddenIdealDrafts.add(draft);
+                }
                 // Pre-index tool results by toolCallId so we can pair tool calls with
                 // their results (for sub-agent status + image extraction).
                 const toolResultMap = new Map();
@@ -2362,10 +2631,11 @@ async function createSession(deps, opts) {
                             }
                         }
                     }
-                    else {
+                    else if (!hiddenIdealDrafts.has(msg)) {
                         // Assistant: one wire row per persisted text block — live streaming
                         // splits bubbles at server_tool_call boundaries, and the persisted
-                        // content keeps those blocks separate.
+                        // content keeps those blocks separate. Ideal-review candidate drafts
+                        // are intentionally omitted to match the live pre-final hook flow.
                         for (const blockText of restoreAssistantTexts(msg.content)) {
                             history.push({
                                 role: "assistant",
@@ -2449,7 +2719,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/prompt") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let text;
                 let attachments;
                 let meta;
@@ -2576,7 +2848,9 @@ async function createSession(deps, opts) {
                 json(res, 404, { error: "Nolan is not available in EZ Chat." });
                 return;
             }
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let text;
                 try {
                     text = JSON.parse(raw).text ?? "";
@@ -2635,7 +2909,9 @@ async function createSession(deps, opts) {
                 json(res, 404, { error: "Autopilot is not available in EZ Chat." });
                 return;
             }
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let enabled;
                 try {
                     enabled = Boolean(JSON.parse(raw).enabled);
@@ -2645,6 +2921,9 @@ async function createSession(deps, opts) {
                     return;
                 }
                 autopilot = enabled;
+                // A toggle-off during an active cycle takes effect after Nolan finishes;
+                // until then, injected build runs must not re-enable Ideal self-review.
+                session.setIdealReviewSuppressed(enabled || autopilotActive);
                 await saveAutopilot(cwd, enabled);
                 log("INFO", "app-sidecar", "autopilot toggled", { enabled: String(enabled) });
                 broadcast("autopilot", { autopilot: enabled });
@@ -2653,7 +2932,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/enhance") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let text;
                 try {
                     text = JSON.parse(raw).text ?? "";
@@ -2674,6 +2955,7 @@ async function createSession(deps, opts) {
                 }
                 catch (err) {
                     const message = err instanceof Error ? err.message : String(err);
+                    captureSidecarError(err, "app-sidecar.prompt-enhancer");
                     log("ERROR", "app-sidecar", "enhance failed", { message });
                     json(res, 500, { error: message });
                 }
@@ -2701,7 +2983,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/radio/volume") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let volume;
                 try {
                     volume = Number(JSON.parse(raw).volume);
@@ -2724,7 +3008,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/radio") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let station;
                 try {
                     station = JSON.parse(raw).station ?? "";
@@ -2748,7 +3034,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/tasks/run") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let id;
                 let all;
                 try {
@@ -2770,7 +3058,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/tasks/add") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let title;
                 let prompt;
                 try {
@@ -2802,7 +3092,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/tasks/update") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let id;
                 let status;
                 let title;
@@ -2847,7 +3139,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/tasks/delete") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let id;
                 try {
                     id = JSON.parse(raw).id ?? "";
@@ -2890,7 +3184,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/model") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let modelId;
                 try {
                     modelId = JSON.parse(raw).model ?? "";
@@ -2962,7 +3258,9 @@ async function createSession(deps, opts) {
         // to BOTH Nolan sessions (chat + autopilot reviewer); a switch landing while
         // either is mid-run defers via the pending-model mechanics.
         if (method === "POST" && url === "/ken/model") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let modelId;
                 try {
                     const parsed = JSON.parse(raw).model;
@@ -3006,7 +3304,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/kill") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let id;
                 try {
                     id = JSON.parse(raw).id ?? "";
@@ -3084,6 +3384,7 @@ async function createSession(deps, opts) {
                     drained,
                 });
             })().catch((error) => {
+                captureSidecarError(error, "app-sidecar.run.cancel");
                 broadcast("cancel_failed", { error: "cancel_failed", runState: runLifecycle.state });
                 json(res, 500, {
                     error: "cancel_failed",
@@ -3104,12 +3405,14 @@ async function createSession(deps, opts) {
                 if (mode === "chat") {
                     await session.persistAppMarker("agent_handoff", { chatAgent });
                 }
+                deactivateApprovedPlan();
                 injectedAutopilotPrompts = [];
                 clearPendingPlan();
                 broadcast("session_reset", {});
                 json(res, 200, { ok: true });
             })
                 .catch((err) => {
+                captureSidecarError(err, "app-sidecar.session.new");
                 json(res, 500, { error: err instanceof Error ? err.message : String(err) });
             });
             return;
@@ -3124,7 +3427,9 @@ async function createSession(deps, opts) {
         //   3. session_reset tells the webview to clear its transcript; it then runs
         //      the "implement it now" prompt in the clean session.
         if (method === "POST" && url === "/plan/accept") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let planPath;
                 try {
                     planPath = JSON.parse(raw).planPath || undefined;
@@ -3156,14 +3461,15 @@ async function createSession(deps, opts) {
                     broadcast("autopilot_ignored", {});
                 }
                 try {
-                    await session.newSession();
+                    await session.newSession(true);
                     injectedAutopilotPrompts = [];
-                    titleGenerated = false;
-                    await session.setApprovedPlan(planPath);
-                    broadcast("session_reset", {});
-                    json(res, 200, { ok: true });
+                    const planTotal = await activateApprovedPlan(planPath);
+                    broadcast("session_reset", { planTotal });
+                    broadcast("plan_progress", planProgressPayload());
+                    json(res, 200, { ok: true, planTotal });
                 }
                 catch (err) {
+                    captureSidecarError(err, "app-sidecar.plan.accept");
                     json(res, 500, { error: err instanceof Error ? err.message : String(err) });
                 }
             });
@@ -3175,7 +3481,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/auth/apikey") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let provider = "";
                 let key;
                 let variant;
@@ -3218,7 +3526,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/auth/oauth/start") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let provider = "";
                 try {
                     provider = JSON.parse(raw).provider ?? "";
@@ -3260,6 +3570,7 @@ async function createSession(deps, opts) {
                         broadcast("auth_done", { provider });
                     }
                     catch (err) {
+                        captureSidecarError(err, "app-sidecar.auth.oauth", { provider });
                         broadcast("auth_error", {
                             provider,
                             message: err instanceof Error ? err.message : String(err),
@@ -3274,7 +3585,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/auth/oauth/code") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let code;
                 try {
                     code = JSON.parse(raw).code ?? "";
@@ -3294,7 +3607,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/auth/logout") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let provider;
                 try {
                     provider = JSON.parse(raw).provider ?? "";
@@ -3333,7 +3648,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/telegram") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let botTokenInput;
                 let userIdInput;
                 try {
@@ -3401,6 +3718,7 @@ async function createSession(deps, opts) {
                 }
                 catch (err) {
                     serveController = null;
+                    captureSidecarError(err, "app-sidecar.serve.start", { provider: st.provider });
                     json(res, 400, { error: err instanceof Error ? err.message : String(err) });
                 }
             })();
@@ -3427,6 +3745,7 @@ async function createSession(deps, opts) {
             void buildMcpRows(targetCwd)
                 .then((servers) => json(res, 200, { servers }))
                 .catch((err) => {
+                captureSidecarError(err, "app-sidecar.mcp.list");
                 log("ERROR", "app-sidecar", "buildMcpRows failed", {
                     message: err instanceof Error ? err.message : String(err),
                 });
@@ -3435,7 +3754,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/mcp/add") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let line;
                 let scopeValue;
                 let bodyCwd;
@@ -3483,6 +3804,7 @@ async function createSession(deps, opts) {
                     });
                 }
                 catch (err) {
+                    captureSidecarError(err, "app-sidecar.mcp.add", { server: config.name });
                     json(res, 500, {
                         error: err instanceof Error ? err.message : String(err),
                     });
@@ -3491,7 +3813,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/mcp/remove") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let name;
                 let scopeValue;
                 let bodyCwd;
@@ -3528,7 +3852,9 @@ async function createSession(deps, opts) {
         // `mcp_auth_error`. Responds 202 immediately and runs the flow in the
         // background (the browser round-trip can take a while).
         if (method === "POST" && url === "/mcp/login") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let name;
                 let scopeValue;
                 let bodyCwd;
@@ -3572,6 +3898,7 @@ async function createSession(deps, opts) {
                     }
                 }
                 catch (err) {
+                    captureSidecarError(err, "app-sidecar.mcp.login", { server: name });
                     broadcast("mcp_auth_error", {
                         name,
                         message: err instanceof Error ? err.message : String(err),
@@ -3589,6 +3916,9 @@ async function createSession(deps, opts) {
         tasksPollStopped = true;
         if (tasksPoll)
             clearTimeout(tasksPoll);
+        gitPollStopped = true;
+        if (gitPoll)
+            clearTimeout(gitPoll);
         // Stop the Telegram serve loop + dispose its per-chat sessions.
         if (serveController)
             await serveController.stop().catch(() => { });
@@ -3615,7 +3945,9 @@ async function createSession(deps, opts) {
         dispose,
     };
 }
-main().catch((err) => {
+main().catch(async (err) => {
+    captureSidecarError(err, "app-sidecar.main", { severity: "fatal" });
+    await flushSidecarErrors();
     const message = err instanceof Error ? err.message : String(err);
     process.stderr.write(`GG_APP_FATAL ${message}\n`);
     process.exit(1);