@prestyj/cli 5.8.0 → 5.10.0

package/dist/app-sidecar.js

@@ -21,9 +21,10 @@ import { parseArgs } from "node:util";
 import { environmentSecrets, formatError, redactValue } from "@prestyj/ai";
 import { runJsonMode } from "./modes/json-mode.js";
 import { runSubagentWorkerMode } from "./modes/subagent-worker-mode.js";
+import { setStreamDiagnostic } from "@prestyj/agent";
 import { AgentSession } from "./core/agent-session.js";
 import { RunLifecycle } from "./core/run-lifecycle.js";
-import { CHAT_AGENT_IDS, chatAgentSessionsDir, createChatAgent, parseChatAgentId, sessionsDirForChatAgent, switchChatAgent, } from "./chat-agents/index.js";
+import { CHAT_AGENT_IDS, chatAgentSessionsDir, createChatAgent, parseChatAgentId, switchChatAgent, } from "./chat-agents/index.js";
 import { buildJiwaTools, JiwaStore } from "./chat-agents/jiwa.js";
 import { buildMemoryTools, MemoryStore } from "./chat-agents/memory.js";
 import { buildNolanSystemPrompt, buildNolanAutopilotSystemPrompt } from "./core/nolan-prompt.js";
@@ -33,9 +34,12 @@ import { isWorkflowCommandText, countAssistantMessages, shouldStartAutopilotCycl
 import { driveAutopilotCycle, frameAutopilotInjection } from "./core/autopilot-cycle.js";
 import { validateNolanModelPref, effectiveNolanModel, } from "./core/nolan-model.js";
 import { normalizeAutopilotMarkersForHistory, normalizeAppMarkersForHistory, normalizeNolanTurnsForHistory, restoreUserRow, restoreAssistantTexts, autopilotMarkerCopySeed, } from "./core/session-history.js";
+import { sessionToMarkdown, defaultExportFilename, } from "./core/session-export.js";
 import { AuthStorage } from "./core/auth-storage.js";
 import { cleanupToolOutputs } from "./tools/overflow.js";
-import { fetchSubscriptionUsage, MOONSHOT_OAUTH_KEY, SubscriptionUsageError, XIAOMI_CREDITS_KEY, } from "@prestyj/core";
+import { readCappedBody } from "./utils/http-body.js";
+import { fetchSubscriptionUsage, MOONSHOT_OAUTH_KEY, SubscriptionUsageError, XIAOMI_CREDITS_KEY, discoverLocalModels, findProbedModel, formatLocalModelId, parseLocalModelId, probeEndpoint, toModelInfo as localModelInfo, } from "@prestyj/core";
+import { LocalEndpointError, addCustomEndpoint, listAllEndpoints, removeCustomEndpoint, syncEndpointCredentials, } from "./core/local-endpoint-store.js";
 import { loginAnthropic } from "./core/oauth/anthropic.js";
 import { loginOpenAI } from "./core/oauth/openai.js";
 import { loginGemini } from "./core/oauth/gemini.js";
@@ -43,19 +47,21 @@ import { loginKimi } from "./core/oauth/kimi.js";
 import { AUTH_PROVIDERS } from "./core/auth-providers.js";
 import { ensureAppDirs, loadSavedSettings } from "./config.js";
 import { SettingsManager } from "./core/settings-manager.js";
-import { getModel, getMaxThinkingLevel, getContextWindow, MODELS } from "./core/model-registry.js";
+import { getModel, getDefaultThinkingLevel, getContextWindow, getAllModels, clearRuntimeModels, registerRuntimeModels, } from "./core/model-registry.js";
 import { resolveStartOrFallback } from "./core/resolve-start.js";
 import { getGitBranch, getGitDirtyFileCount, isGitRepo } from "./utils/git.js";
+import { getGitHubOpenCounts, getGitHubRepoSlug } from "./utils/github.js";
 import { extractPlanSteps } from "./utils/plan-steps.js";
 import { getNextThinkingLevel, getSupportedThinkingLevels, isThinkingLevelSupported, } from "./core/thinking-level.js";
 import { PROMPT_COMMANDS } from "./core/prompt-commands.js";
 import { loadCustomCommands } from "./core/custom-commands.js";
-import { discoverProjects, listRecentSessions } from "./core/project-discovery.js";
+import { discoverProjects } from "./core/project-discovery.js";
+import { listSidecarSessions } from "./app-sidecar-sessions.js";
 import { loadTasksSync, saveTasksSync, pruneDoneTasksSync, getNextPendingTask, markTaskInProgress, } from "./core/task-store.js";
 import { initLogger, log } from "./core/logger.js";
 import { RADIO_STATIONS, getCurrentStation, getRadioVolume, playRadio, setRadioVolume, stopRadio, } from "./core/radio.js";
 import { enrichProcessPath } from "./core/shell-path.js";
-import { downscaleForPreview, validateVisionImage } from "./utils/image.js";
+import { downscaleForPreview, shrinkToFit, validateVisionImage } from "./utils/image.js";
 import { startServeMode } from "./modes/serve-mode.js";
 import { loadTelegramConfig, saveTelegramConfig, verifyBotToken } from "./core/telegram-config.js";
 import { loadServers, addServer, removeServer, getServer, parseMcpAddCommand, MCPClientManager, McpOAuthStore, } from "./core/mcp/index.js";
@@ -64,6 +70,7 @@ import { loadProgress, peekProgress, updateProgress } from "./core/progress/stor
 import { awardPrompt, awardCommits } from "./core/progress/engine.js";
 import { detectNewCommits, repoKey } from "./core/progress/git-xp.js";
 import { rebuildFromSessions } from "./core/progress/rebuild.js";
+import { captureSidecarError, flushSidecarErrors, shouldCaptureToolFailure, shouldCaptureUsagePollingError, wrapSidecarHandler, } from "./core/sidecar-error-reporter.js";
 const ALL_PROVIDERS = [
     // US
     "anthropic",
@@ -169,6 +176,7 @@ async function persistModelSelection(settingsFile, provider, model) {
         await sm.set("defaultModel", model);
     }
     catch (err) {
+        captureSidecarError(err, "app-sidecar.settings.persist-model");
         log("WARN", "app-sidecar", "failed to persist model selection", { err: String(err) });
     }
 }
@@ -185,6 +193,7 @@ async function persistThinkingLevel(settingsFile, level) {
             await sm.set("thinkingLevel", level);
     }
     catch (err) {
+        captureSidecarError(err, "app-sidecar.settings.persist-thinking");
         log("WARN", "app-sidecar", "failed to persist thinking level", { err: String(err) });
     }
 }
@@ -202,19 +211,28 @@ async function prepareAttachments(cwd, attachments) {
         const fileName = `${Date.now().toString(36)}-${safe}`;
         const filePath = path.join(dir, fileName);
         const buf = Buffer.from(a.data, "base64");
-        // Validate image attachments before they become native image content blocks.
-        // A corrupt or unsupported-format image (e.g. a malformed .ico, or a .png
-        // with a bad IDAT) makes the provider reject the ENTIRE turn ("image data
-        // ... not a valid image") before the agent can respond. Downgrade such files
-        // to a plain "file" attachment so the model gets a path note and inspects
-        // them with its tools instead of the request 400ing.
+        // Validate and cap image attachments before they become native image content
+        // blocks. Anthropic applies a 2000 px per-dimension cap once conversation
+        // history contains more than 20 images, so every attachment must be safe for
+        // later turns too. Keep the original on disk, but send the resized bytes.
+        // Corrupt or unsupported images become plain files so they cannot reject the
+        // entire provider request.
         let prepared = { ...a };
         if (a.kind === "image") {
-            const validatedType = await validateVisionImage(buf).catch(() => null);
-            if (validatedType)
-                prepared = { ...a, mediaType: validatedType };
-            else
+            try {
+                const resized = await shrinkToFit(buf, a.mediaType);
+                const validatedType = await validateVisionImage(resized.buffer);
+                prepared = validatedType
+                    ? {
+                        ...a,
+                        mediaType: validatedType,
+                        data: resized.buffer.toString("base64"),
+                    }
+                    : { ...a, kind: "file" };
+            }
+            catch {
                 prepared = { ...a, kind: "file" };
+            }
         }
         try {
             await fs.writeFile(filePath, buf);
@@ -227,6 +245,9 @@ async function prepareAttachments(cwd, attachments) {
     return out;
 }
 const FILE_SEARCH_LIMIT = 20;
+// Upper bound on files walked per search (baseline #8 memory cap). Far above the
+// 20-result output limit, so relevance/recency ranking is unaffected in practice.
+const FILE_SEARCH_SCAN_CAP = 50_000;
 /** Score a candidate path against a lowercased query. Higher is better; a
  *  negative score means "no match". Basename hits beat path hits; prefix beats
  *  substring; shorter paths break ties. */
@@ -279,8 +300,13 @@ async function searchProjectFiles(cwd, rawQuery) {
     }
     const ig = ignore.default().add(gitignore);
     // `stats: true` gives mtime without a second stat pass, so the empty-query
-    // "recent files" path is a single walk.
-    const entries = await fg.default("**/*", {
+    // "recent files" path is a single walk. Stream + hard scan cap (baseline #8):
+    // collecting the full result array retained ~0.9 MB per 1k files (18.5 MB at
+    // 20k), unbounded. Bail after FILE_SEARCH_SCAN_CAP entries so a giant repo
+    // can't balloon RSS; the newest/most-relevant matches still surface because
+    // the cap is far above the 20-result output limit.
+    const entries = [];
+    const scanStream = fg.default.stream("**/*", {
         cwd,
         dot: false,
         onlyFiles: true,
@@ -289,6 +315,17 @@ async function searchProjectFiles(cwd, rawQuery) {
         followSymbolicLinks: false,
         stats: true,
     });
+    for await (const entry of scanStream) {
+        entries.push(entry);
+        if (entries.length >= FILE_SEARCH_SCAN_CAP) {
+            scanStream.destroy();
+            log("DEBUG", "app-sidecar", "file search scan cap hit", {
+                cap: String(FILE_SEARCH_SCAN_CAP),
+                cwd,
+            });
+            break;
+        }
+    }
     const files = entries.filter((e) => !ig.ignores(e.path));
     if (!query) {
         return files
@@ -311,6 +348,11 @@ async function searchProjectFiles(cwd, rawQuery) {
  * hook prompt, by its distinctive opening phrase. Returns the hook kind so the
  * webview can render the short notice line instead of the full prompt body.
  */
+/** `?tools=` on /export. Anything unrecognised (including absent) falls back to
+ *  the human-facing `summary` default rather than dumping every payload. */
+function parseToolDetail(value) {
+    return value === "none" || value === "full" ? value : "summary";
+}
 function detectHookKind(text) {
     const t = text.trimStart();
     if (t.startsWith("Ideal? Review the actual work"))
@@ -418,6 +460,7 @@ async function runJsonModeIfRequested() {
             "max-turns": { type: "string" },
             "system-prompt": { type: "string" },
             tools: { type: "string" },
+            "mcp-servers": { type: "string" },
             "prompt-cache-key": { type: "string" },
         },
         allowPositionals: true,
@@ -434,16 +477,30 @@ async function runJsonModeIfRequested() {
             .filter(Boolean)
         : [];
     const allowedTools = parsedTools.length > 0 ? parsedTools : undefined;
+    // MCP servers the agent definition asked for. Without forwarding these, an
+    // allow-listed child connects no MCP at all and loses live code search.
+    const parsedMcpServers = values["mcp-servers"]
+        ? values["mcp-servers"]
+            .split(",")
+            .map((s) => s.trim())
+            .filter(Boolean)
+        : [];
+    const allowedMcpServers = parsedMcpServers.length > 0 ? parsedMcpServers : undefined;
     await runJsonMode({
         message: positionals[0] ?? "",
         provider: (values.provider ?? "anthropic"),
-        model: values.model ?? "claude-opus-4-8",
+        model: values.model ?? "claude-opus-5",
         cwd: process.cwd(),
         systemPrompt: values["system-prompt"],
         maxTurns: maxTurnsRaw ? parseInt(maxTurnsRaw, 10) : undefined,
         allowedTools,
+        allowedMcpServers,
         promptCacheKey: values["prompt-cache-key"],
-    }).catch((err) => {
+    }).catch(async (err) => {
+        captureSidecarError(err, "app-sidecar.json-mode", {
+            provider: String(values.provider ?? "anthropic"),
+        });
+        await flushSidecarErrors();
         process.stderr.write((err instanceof Error ? err.message : String(err)) + "\n");
         process.exit(1);
     });
@@ -452,13 +509,8 @@ async function runJsonModeIfRequested() {
 // ── Daemon-level HTTP helpers (shared by the session-management routes) ─────
 // The per-session route table has its own local copies; these serve the
 // daemon's own POST /session / DELETE /session routes.
-function daemonReadBody(req) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        req.on("data", (c) => chunks.push(c));
-        req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
-        req.on("error", reject);
-    });
+function daemonReadBody(req, res) {
+    return readCappedBody(req, res);
 }
 function daemonJson(res, status, body) {
     res.writeHead(status, {
@@ -486,6 +538,31 @@ async function main() {
     // ~/.ezcoder/debug.log (initLogger truncates on each start).
     const sidecarLog = path.join(paths.agentDir, "ezcoder-app-sidecar.log");
     initLogger(sidecarLog);
+    // The desktop sidecar previously omitted the stream diagnostic hook used by
+    // the CLI, leaving device-specific provider stalls impossible to distinguish from
+    // event-loop starvation or a broken streaming network path. Keep routine
+    // phases lightweight; timeout phases include non-sensitive runtime context.
+    setStreamDiagnostic((phase, data) => {
+        const includeRuntime = phase === "idle_timeout_fired" ||
+            phase === "hard_timeout_fired" ||
+            phase === "stall_exhausted";
+        log("INFO", "stream", phase, {
+            ...(data ?? {}),
+            ...(includeRuntime
+                ? {
+                    platform: process.platform,
+                    arch: process.arch,
+                    osRelease: os.release(),
+                    node: process.version,
+                    logicalCpus: os.cpus().length,
+                    totalMemoryMb: Math.round(os.totalmem() / 1024 / 1024),
+                    freeMemoryMb: Math.round(os.freemem() / 1024 / 1024),
+                    rssMb: Math.round(process.memoryUsage().rss / 1024 / 1024),
+                    processUptimeSec: Math.round(process.uptime()),
+                }
+                : {}),
+        });
+    });
     // Global last-resort guards, installed as early as the logger allows so they
     // cover the WHOLE lifecycle — including startup/initialize, the phase the
     // "sidecar did not start in time" bug lives in. The sidecar is a long-lived
@@ -544,18 +621,24 @@ async function main() {
     });
     const usageCache = new Map();
     const usageRequests = new Map();
-    // 429 backoff: when the provider rate-limits the usage endpoint, hold the
-    // error result until this timestamp instead of re-polling (and re-logging a
-    // WARN) every 60s — the old cadence hammered a limited endpoint for hours.
+    // 429 backoff: quota endpoints are auxiliary UI data. Honor Retry-After when
+    // provided; otherwise retain the unavailable snapshot for 30 minutes. Clamp
+    // the provider value so a malformed header can neither hammer the endpoint
+    // nor suppress usage data forever.
     const usageRateLimitedUntil = new Map();
-    const USAGE_RATE_LIMIT_BACKOFF_MS = 5 * 60_000;
+    const USAGE_RATE_LIMIT_FALLBACK_BACKOFF_MS = 30 * 60_000;
+    const USAGE_RATE_LIMIT_MIN_BACKOFF_MS = 60_000;
+    const USAGE_RATE_LIMIT_MAX_BACKOFF_MS = 24 * 60 * 60_000;
     async function fetchUsageProvider(provider) {
-        const displayName = provider === "anthropic" ? "Anthropic" : "Codex";
-        if (!(await auth.hasProviderAuth(provider))) {
+        const displayName = provider === "anthropic" ? "Anthropic" : provider === "openai" ? "Codex" : "Kimi";
+        // Kimi plan usage is tracked on the OAuth credential specifically — the
+        // Moonshot platform API key is metered per-token, not per plan window.
+        const authKey = provider === "moonshot" ? MOONSHOT_OAUTH_KEY : provider;
+        if (!(await auth.hasProviderAuth(authKey))) {
             return { provider, displayName, connected: false, windows: [], fetchedAt: Date.now() };
         }
         try {
-            let credentials = await auth.resolveCredentials(provider);
+            let credentials = await auth.resolveCredentials(authKey);
             try {
                 const snapshot = {
                     ...(await fetchSubscriptionUsage(provider, credentials)),
@@ -568,7 +651,7 @@ async function main() {
                 // A provider can revoke an access token before its stored expiry. Refresh
                 // once on 401, matching inference auth recovery, then retry the usage call.
                 if (error instanceof SubscriptionUsageError && error.status === 401) {
-                    credentials = await auth.resolveCredentials(provider, { forceRefresh: true });
+                    credentials = await auth.resolveCredentials(authKey, { forceRefresh: true });
                     const snapshot = {
                         ...(await fetchSubscriptionUsage(provider, credentials)),
                         connected: true,
@@ -581,11 +664,20 @@ async function main() {
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            log("WARN", "app-sidecar", "subscription usage fetch failed", { provider, message });
+            if (shouldCaptureUsagePollingError(error)) {
+                captureSidecarError(error, "app-sidecar.usage.fetch", { provider });
+            }
+            let backoffMs;
             if (error instanceof SubscriptionUsageError && error.status === 429) {
-                usageRateLimitedUntil.set(provider, Date.now() + USAGE_RATE_LIMIT_BACKOFF_MS);
+                backoffMs = Math.min(USAGE_RATE_LIMIT_MAX_BACKOFF_MS, Math.max(USAGE_RATE_LIMIT_MIN_BACKOFF_MS, error.retryAfterMs ?? USAGE_RATE_LIMIT_FALLBACK_BACKOFF_MS));
+                usageRateLimitedUntil.set(provider, Date.now() + backoffMs);
             }
-            const connected = await auth.hasProviderAuth(provider);
+            log("WARN", "app-sidecar", "subscription usage fetch failed", {
+                provider,
+                message,
+                ...(backoffMs !== undefined && { backoffMs: String(backoffMs) }),
+            });
+            const connected = await auth.hasProviderAuth(authKey);
             return {
                 provider,
                 displayName,
@@ -640,7 +732,7 @@ async function main() {
             return null;
         }
     }
-    const server = http.createServer((req, res) => {
+    const server = http.createServer(wrapSidecarHandler((req, res) => {
         const url = req.url ?? "/";
         const method = req.method ?? "GET";
         // CORS preflight — the webview origin differs from 127.0.0.1.
@@ -656,7 +748,9 @@ async function main() {
         // ── Daemon-level routes (session lifecycle) ──────────────────────────
         // Create a session for a window: { mode?, cwd, sessionPath? } → { sessionId }.
         if (method === "POST" && url === "/session") {
-            void daemonReadBody(req).then(async (raw) => {
+            void daemonReadBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let body = {};
                 try {
                     body = raw ? JSON.parse(raw) : {};
@@ -684,6 +778,7 @@ async function main() {
                 }
                 catch (err) {
                     const message = err instanceof Error ? err.message : String(err);
+                    captureSidecarError(err, "app-sidecar.session.create");
                     log("ERROR", "app-sidecar", "session create failed", { message });
                     daemonJson(res, 500, { error: message });
                 }
@@ -714,12 +809,13 @@ async function main() {
         if (method === "GET" && (url === "/usage" || url.startsWith("/usage?"))) {
             void (async () => {
                 const provider = new URL(url, `http://${host}`).searchParams.get("provider");
-                if (provider !== "anthropic" && provider !== "openai") {
+                if (provider !== "anthropic" && provider !== "openai" && provider !== "moonshot") {
                     daemonJson(res, 400, { error: "unsupported usage provider" });
                     return;
                 }
                 daemonJson(res, 200, await subscriptionUsage(provider));
             })().catch((error) => {
+                captureSidecarError(error, "app-sidecar.usage.request");
                 log("ERROR", "app-sidecar", "subscription usage request failed", {
                     message: error instanceof Error ? error.message : String(error),
                 });
@@ -735,7 +831,7 @@ async function main() {
             return;
         }
         ctx.handle(req, res, url, method);
-    });
+    }, "app-sidecar.http"));
     server.listen(port, host, () => {
         const addr = server.address();
         // The Rust shell reads this line to learn the daemon port.
@@ -752,6 +848,8 @@ async function main() {
         // Radio playback is app-wide (one stream across all windows), so it stops
         // at the daemon level, not per session.
         stopRadio();
+        // Close the ~/.ezcoder progress fs.watch handle (baseline #8 leak fix).
+        progress.dispose();
         await Promise.all([...sessions.values()].map((c) => c.dispose().catch(() => { })));
         server.close();
         process.exit(0);
@@ -880,6 +978,7 @@ async function createProgressManager(agentDir, broadcastAll) {
             broadcastAll(buildSnapshot(updated), originId);
         }
         catch (err) {
+            captureSidecarError(err, "app-sidecar.progress.award");
             log("DEBUG", "app-sidecar", "progress award failed", {
                 message: err instanceof Error ? err.message : String(err),
             });
@@ -888,6 +987,7 @@ async function createProgressManager(agentDir, broadcastAll) {
     // Watch ~/.ezcoder (dir watch survives the atomic tmp+rename) for progress.json
     // writes from other daemon processes; debounce, reload read-only, dedupe by nonce.
     let watchDebounce = null;
+    let progressWatcher = null;
     try {
         const watcher = fsWatch(agentDir, (_event, filename) => {
             if (filename !== "progress.json")
@@ -909,13 +1009,30 @@ async function createProgressManager(agentDir, broadcastAll) {
             }, 150);
         });
         watcher.unref();
+        progressWatcher = watcher;
     }
     catch (err) {
+        captureSidecarError(err, "app-sidecar.progress.watch");
         log("DEBUG", "app-sidecar", "progress watch unavailable", {
             message: err instanceof Error ? err.message : String(err),
         });
     }
-    return { snapshot, awardRun };
+    // Dispose closes the fs.watch handle (baseline #8: it was previously never
+    // closed — a per-daemon leak) and clears any pending debounce timer.
+    function dispose() {
+        if (watchDebounce) {
+            clearTimeout(watchDebounce);
+            watchDebounce = null;
+        }
+        try {
+            progressWatcher?.close();
+        }
+        catch {
+            // Already closed / never opened — nothing to do.
+        }
+        progressWatcher = null;
+    }
+    return { snapshot, awardRun, dispose };
 }
 /**
  * Build one in-process agent session: its AgentSession, SSE client set, event
@@ -934,6 +1051,10 @@ async function createSession(deps, opts) {
     // parsing); the daemon owns the real listen host.
     const host = "127.0.0.1";
     const saved = loadSavedSettings(paths.settingsFile);
+    // Native login/logout and other live sessions share auth.json. Refresh the
+    // daemon-level snapshot before choosing this session's provider so a project
+    // never boots against credentials that were just replaced or disconnected.
+    await auth.load();
     // Per-project model/thinking prefs win over the shared global settings.json:
     // each window (one project cwd) restores its own selection instead of every
     // window reading the same single global slot that the last writer clobbered
@@ -952,9 +1073,14 @@ async function createSession(deps, opts) {
         });
     }
     // Per-project thinking prefs win over the global settings.json fallback.
+    // With no saved level, the default follows the active credential's endpoint:
+    // Kimi K3 on the OAuth coding endpoint starts at its declared default (high),
+    // matching the official kimi-code CLI's plan-usage profile.
     const thinkEnabled = projectPrefs?.thinkingEnabled ?? saved.thinkingEnabled;
     const thinkingLevel = thinkEnabled
-        ? (projectPrefs?.thinkingLevel ?? saved.thinkingLevel ?? getMaxThinkingLevel(model))
+        ? (projectPrefs?.thinkingLevel ??
+            saved.thinkingLevel ??
+            getDefaultThinkingLevel(model, { baseUrl: auth.getStoredBaseUrl(provider) }))
         : undefined;
     // ── SSE fan-out (declared before the session so plan callbacks can use it) ─
     const clients = new Set();
@@ -991,6 +1117,25 @@ async function createSession(deps, opts) {
             // /help
             .replaceAll(/see \/help/gi, "check the help menu"));
     }
+    /**
+     * Guidance for a connection failure against the ACTIVE local endpoint, or
+     * undefined when that isn't the situation (so the generic wording stands).
+     * "Disable your VPN / allow us through the firewall" is useless advice for a
+     * server running on this machine — name what the user has to restart.
+     */
+    function localNetworkGuidance(source) {
+        if (source !== "network")
+            return undefined;
+        const state = session.getState();
+        if (state.provider !== "local")
+            return undefined;
+        const parsed = parseLocalModelId(state.model);
+        const probe = localProbes.find((p) => p.endpoint.id === parsed?.endpointId);
+        if (!probe)
+            return undefined;
+        return (`${probe.endpoint.label} stopped responding at ${probe.endpoint.baseUrl}. ` +
+            "Start it again and retry, or pick another model.");
+    }
     // Turn any thrown value into the same clear headline/message/guidance shape
     // the TUI shows (see gg-ai's formatError) instead of a bare `err.message`, log
     // the full detail, and broadcast it under `type` ("error" or "nolan_error").
@@ -1000,7 +1145,12 @@ async function createSession(deps, opts) {
     function broadcastError(type, logLabel, err) {
         const f = formatError(err);
         const message = f.message ? desktopGuidance(f.message) : undefined;
-        const guidance = desktopGuidance(f.guidance);
+        const guidance = localNetworkGuidance(f.source) ?? desktopGuidance(f.guidance);
+        captureSidecarError(err, `app-sidecar.${logLabel.replaceAll(" ", "-")}`, {
+            scope: type,
+            ...(f.provider ? { provider: f.provider } : {}),
+            ...(f.statusCode != null ? { status: String(f.statusCode) } : {}),
+        });
         log("ERROR", "app-sidecar", logLabel, {
             headline: f.headline,
             source: f.source,
@@ -1058,6 +1208,7 @@ async function createSession(deps, opts) {
                 chatAgent = nextAgent;
                 broadcast("chat_agent_change", { chatAgent: nextAgent });
                 await session.persistAppMarker("agent_handoff", { chatAgent: nextAgent }).catch((error) => {
+                    captureSidecarError(error, "app-sidecar.chat-agent.persist-handoff");
                     log("WARN", "app-sidecar", "agent handoff marker persist failed", {
                         message: error instanceof Error ? error.message : String(error),
                     });
@@ -1110,17 +1261,116 @@ async function createSession(deps, opts) {
         }
     }
     log("INFO", "app-sidecar", "session ready", { provider, model, mode, chatAgent, cwd });
+    // ── Local models (Ollama / LM Studio / llama.cpp / vLLM) ──
+    // Probing four HTTP endpoints must never delay readiness, so this runs in the
+    // background (same shape as backgroundMcpConnect) and pushes a models_change
+    // frame when it lands.
+    let localProbes = [];
+    async function scanLocalModels(force) {
+        const endpoints = await listAllEndpoints();
+        const { probes, models } = await discoverLocalModels(endpoints, { force });
+        localProbes = probes;
+        // Only endpoints that answered get a credential: writing one for a server
+        // that isn't running would make `hasProviderAuth("local")` true forever.
+        await syncEndpointCredentials(probes.filter((probe) => probe.reachable).map((probe) => probe.endpoint));
+        clearRuntimeModels((m) => m.provider === "local");
+        registerRuntimeModels(models);
+        log("INFO", "app-sidecar", "local model scan", {
+            reachable: probes.filter((p) => p.reachable).length + "/" + probes.length,
+            models: String(models.length),
+        });
+        return probes;
+    }
+    /** Endpoint rows + models, in the shape the Local models UI renders. */
+    function localStatePayload() {
+        return {
+            endpoints: localProbes.map((probe) => ({
+                id: probe.endpoint.id,
+                label: probe.endpoint.label,
+                baseUrl: probe.endpoint.baseUrl,
+                kind: probe.endpoint.kind,
+                custom: probe.endpoint.custom === true,
+                reachable: probe.reachable,
+                ...(probe.reason ? { reason: probe.reason } : {}),
+                models: probe.models.map((m) => ({
+                    id: formatLocalModelId(probe.endpoint.id, m.rawId),
+                    rawId: m.rawId,
+                    contextWindow: m.contextWindow,
+                    contextWindowKnown: m.contextWindowKnown,
+                    supportsTools: m.supportsTools,
+                    supportsImages: m.supportsImages,
+                    supportsThinking: m.supportsThinking,
+                    ...(m.loaded === undefined ? {} : { loaded: m.loaded }),
+                })),
+            })),
+        };
+    }
+    /**
+     * Why `modelId` can't be selected right now, or `undefined` when it can.
+     * Two real footguns get a clear answer instead of a mid-run provider error:
+     * a model with no tool calling (can't drive the agent at all), and a server
+     * that has since been shut down.
+     */
+    async function localModelBlocker(modelId) {
+        const parsed = parseLocalModelId(modelId);
+        if (!parsed)
+            return undefined;
+        const endpoints = await listAllEndpoints();
+        const endpoint = endpoints.find((e) => e.id === parsed.endpointId);
+        if (!endpoint)
+            return `Unknown local endpoint "${parsed.endpointId}" — re-scan for local models.`;
+        const probe = await probeEndpoint(endpoint);
+        // Keep the cached view honest: this probe is fresher than the last scan.
+        localProbes = localProbes.map((p) => (p.endpoint.id === endpoint.id ? probe : p));
+        if (!probe.reachable) {
+            return `${endpoint.label} isn't running at ${endpoint.baseUrl}. Start it and scan again.`;
+        }
+        const model = probe.models.find((m) => m.rawId === parsed.rawId);
+        if (!model) {
+            return `${endpoint.label} no longer serves "${parsed.rawId}".`;
+        }
+        if (!model.supportsTools) {
+            return `${parsed.rawId} has no tool calling, so it can't run the agent. Pick a tool-capable model.`;
+        }
+        registerRuntimeModels(probe.models.map((m) => localModelInfo(m, endpoint)));
+        return undefined;
+    }
+    /**
+     * A restored per-project pref can ask for thinking on a local model that
+     * turns out not to reason (capabilities are only known after a probe). Drop
+     * the level once we know, so the first prompt doesn't carry a
+     * `reasoning_effort` the server rejects.
+     */
+    function clampLocalThinking() {
+        const st = session.getState();
+        const level = session.getThinkingLevel();
+        if (!level || st.provider !== "local")
+            return;
+        if (isThinkingLevelSupported(st.provider, st.model, level))
+            return;
+        session.setThinkingLevel(undefined);
+        broadcast("thinking_change", {
+            thinkingLevel: null,
+            supportedThinkingLevels: getSupportedThinkingLevels(st.provider, st.model),
+        });
+    }
     // Workspace extras (context window, git status, background tasks). Git state
     // is resolved once at startup and refreshed after every run; the context
     // window follows the active model.
-    const [initialGitBranch, initialGitIsRepo, initialDirtyFileCount] = await Promise.all([
+    const [initialGitBranch, initialGitIsRepo, initialDirtyFileCount, initialGitHubSlug] = await Promise.all([
         getGitBranch(cwd).catch(() => null),
         isGitRepo(cwd).catch(() => false),
         getGitDirtyFileCount(cwd).catch(() => 0),
+        getGitHubRepoSlug(cwd).catch(() => null),
     ]);
     let gitBranch = initialGitBranch;
     let gitIsRepo = initialGitIsRepo;
     let gitDirtyFileCount = initialDirtyFileCount;
+    // Open issue/PR counts for the origin repo's GitHub slug, via the `gh` CLI's
+    // auth. null = unknown (gh missing/unauthed, non-GitHub origin) → chips hidden.
+    const gitHubSlug = initialGitHubSlug;
+    let gitHubIssues = null;
+    let gitHubPRs = null;
     function currentContextWindow() {
         const st = session.getState();
         return getContextWindow(st.model, { provider: st.provider, accountId: st.accountId });
@@ -1133,9 +1383,41 @@ async function createSession(deps, opts) {
             gitBranch,
             isGitRepo: gitIsRepo,
             gitDirtyFileCount,
+            gitHubIssues,
+            gitHubPRs,
+            gitHubRepoUrl: gitHubSlug ? `https://github.com/${gitHubSlug}` : null,
             tasks: session.listBackgroundProcesses(),
+            // Roots added with /add-dir — the header shows a badge when non-empty.
+            additionalRoots: session.getAdditionalRoots(),
         };
     }
+    void scanLocalModels(false)
+        .then(() => {
+        clampLocalThinking();
+        broadcast("extras", footerExtras());
+    })
+        .then(() => broadcast("models_change", { local: localStatePayload() }))
+        .catch((err) => {
+        // A discovery failure is never fatal — the user simply has no local
+        // models. Log it; don't push an error row into the transcript.
+        log("WARN", "app-sidecar", "local model scan failed", {
+            error: err instanceof Error ? err.message : String(err),
+        });
+    });
+    // Refresh the GitHub counts and broadcast only on change. Transient failures
+    // keep the last-known numbers so the chips don't flicker off on a timeout.
+    async function refreshGitHubCounts() {
+        if (!gitHubSlug)
+            return;
+        const counts = await getGitHubOpenCounts(gitHubSlug);
+        if (!counts)
+            return;
+        if (counts.issues !== gitHubIssues || counts.prs !== gitHubPRs) {
+            gitHubIssues = counts.issues;
+            gitHubPRs = counts.prs;
+            broadcast("extras", footerExtras());
+        }
+    }
     // tool_call_end carries no tool name (only the id), so remember each call's
     // name from tool_call_start to log a useful line on completion. Mirrors the
     // CLI's logging so the app sidecar's ~/.ezcoder/ezcoder-app-sidecar.log records tool
@@ -1184,6 +1466,7 @@ async function createSession(deps, opts) {
             .catch(() => false)
             .then(() => syncApprovedPlanProgress(generation))
             .catch((error) => {
+            captureSidecarError(error, "app-sidecar.plan.refresh-progress");
             log("WARN", "app-sidecar", "plan progress refresh failed", {
                 message: error instanceof Error ? error.message : String(error),
             });
@@ -1238,6 +1521,11 @@ async function createSession(deps, opts) {
     session.eventBus.on("tool_call_end", (d) => {
         const name = toolCallNames.get(d.toolCallId) ?? "unknown";
         toolCallNames.delete(d.toolCallId);
+        if (d.isError && shouldCaptureToolFailure(name, d.result)) {
+            // Expected model-correctable validation failures stay in the local log and
+            // conversation. Unexpected failures are reported without private result data.
+            captureSidecarError(new Error(`Tool ${name} failed`), `tool.${name}`, { tool: name });
+        }
         log(d.isError ? "ERROR" : "INFO", "tool", `Tool call ended: ${name}`, {
             id: d.toolCallId,
             durationMs: String(d.durationMs),
@@ -1264,6 +1552,9 @@ async function createSession(deps, opts) {
     session.eventBus.on("server_tool_call", (d) => broadcast("server_tool_call", d));
     session.eventBus.on("turn_end", (d) => broadcast("turn_end", d));
     session.eventBus.on("agent_done", (d) => broadcast("agent_done", d));
+    // Non-clean stop (max_tokens/refusal/provider error) — info-style frame so
+    // the webview can warn instead of presenting truncated output as complete.
+    session.eventBus.on("truncated", (d) => broadcast("truncated", d));
     session.eventBus.on("error", (d) => {
         broadcastError("error", "agent error", d.error);
     });
@@ -1568,6 +1859,9 @@ async function createSession(deps, opts) {
                 isGitRepo(cwd).catch(() => gitIsRepo),
                 getGitDirtyFileCount(cwd).catch(() => gitDirtyFileCount),
             ]);
+            // A run may have opened/closed issues or PRs — refresh fire-and-forget so
+            // teardown isn't delayed by the network. Broadcasts itself on change.
+            void refreshGitHubCounts();
             // Serialize behind any marker/tool-triggered refresh so the terminal
             // progress snapshot uses the live plan file. Once every canonical step
             // is complete, remove the approved plan from future system prompts and
@@ -1584,6 +1878,7 @@ async function createSession(deps, opts) {
                 catch (error) {
                     // Keep tracking when prompt cleanup fails; hiding the widget here
                     // would claim completion while the approved-plan contract remained.
+                    captureSidecarError(error, "app-sidecar.plan.cleanup");
                     log("WARN", "app-sidecar", "completed plan cleanup failed", {
                         message: error instanceof Error ? error.message : String(error),
                     });
@@ -2039,13 +2334,22 @@ async function createSession(deps, opts) {
         gitPoll.unref?.();
     };
     scheduleGitPoll(5000);
-    function readBody(req) {
-        return new Promise((resolve, reject) => {
-            const chunks = [];
-            req.on("data", (c) => chunks.push(c));
-            req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
-            req.on("error", reject);
-        });
+    // GitHub issue/PR counts change outside the app (web UI, teammates), so poll
+    // on a slow cadence. Network-bound, so keep it well under the search API's
+    // rate budget (2 calls per tick). No-op when the origin isn't a GitHub repo.
+    let gitHubPoll;
+    let gitHubPollStopped = false;
+    const scheduleGitHubPoll = (delay) => {
+        if (gitHubPollStopped)
+            return;
+        gitHubPoll = setTimeout(() => {
+            void refreshGitHubCounts().finally(() => scheduleGitHubPoll(60_000));
+        }, delay);
+        gitHubPoll.unref?.();
+    };
+    scheduleGitHubPoll(2000);
+    function readBody(req, res) {
+        return readCappedBody(req, res);
     }
     function json(res, status, body) {
         const payload = JSON.stringify(redactValue(body, { secrets: environmentSecrets(process.env) }));
@@ -2083,7 +2387,10 @@ async function createSession(deps, opts) {
             void memoryStore
                 .snapshot()
                 .then((snapshot) => json(res, 200, snapshot))
-                .catch((error) => json(res, 500, { error: error instanceof Error ? error.message : String(error) }));
+                .catch((error) => {
+                captureSidecarError(error, "app-sidecar.memory.snapshot");
+                json(res, 500, { error: error instanceof Error ? error.message : String(error) });
+            });
             return;
         }
         if (method === "DELETE" && url.startsWith("/memories/")) {
@@ -2096,14 +2403,20 @@ async function createSession(deps, opts) {
                 .forget(id)
                 .then(() => memoryStore.snapshot())
                 .then((snapshot) => json(res, 200, snapshot))
-                .catch((error) => json(res, 500, { error: error instanceof Error ? error.message : String(error) }));
+                .catch((error) => {
+                captureSidecarError(error, "app-sidecar.memory.forget");
+                json(res, 500, { error: error instanceof Error ? error.message : String(error) });
+            });
             return;
         }
         if (method === "GET" && url === "/jiwa") {
             void jiwaStore
                 .snapshot()
                 .then((snapshot) => json(res, 200, snapshot))
-                .catch((error) => json(res, 500, { error: error instanceof Error ? error.message : String(error) }));
+                .catch((error) => {
+                captureSidecarError(error, "app-sidecar.jiwa.snapshot");
+                json(res, 500, { error: error instanceof Error ? error.message : String(error) });
+            });
             return;
         }
         if (method === "DELETE" && url.startsWith("/jiwa/")) {
@@ -2116,7 +2429,10 @@ async function createSession(deps, opts) {
                 .forget(id)
                 .then(() => jiwaStore.snapshot())
                 .then((snapshot) => json(res, 200, snapshot))
-                .catch((error) => json(res, 500, { error: error instanceof Error ? error.message : String(error) }));
+                .catch((error) => {
+                captureSidecarError(error, "app-sidecar.jiwa.forget");
+                json(res, 500, { error: error instanceof Error ? error.message : String(error) });
+            });
             return;
         }
         if (method === "GET" && (url === "/events" || url.startsWith("/events?"))) {
@@ -2174,7 +2490,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/settings") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let projectsRoot;
                 try {
                     projectsRoot = JSON.parse(raw).projectsRoot ?? "";
@@ -2197,7 +2515,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/create-project") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let name;
                 try {
                     name = JSON.parse(raw).name ?? "";
@@ -2229,6 +2549,7 @@ async function createSession(deps, opts) {
                     json(res, 200, { path: dir });
                 }
                 catch (err) {
+                    captureSidecarError(err, "app-sidecar.project.create");
                     json(res, 500, { error: err instanceof Error ? err.message : String(err) });
                 }
             });
@@ -2239,6 +2560,7 @@ async function createSession(deps, opts) {
             void discoverProjects()
                 .then((projects) => json(res, 200, { projects }))
                 .catch((err) => {
+                captureSidecarError(err, "app-sidecar.projects.discover");
                 log("ERROR", "app-sidecar", "discoverProjects failed", {
                     message: err instanceof Error ? err.message : String(err),
                 });
@@ -2253,37 +2575,14 @@ async function createSession(deps, opts) {
                 return;
             }
             const requestedAgent = new URL(url, `http://${host}`).searchParams.get("chatAgent");
-            if (requestedAgent === "all") {
-                void Promise.all(CHAT_AGENT_IDS.map(async (agentId) => {
-                    const agentSessions = await listRecentSessions(target, 5, chatAgentSessionsDir(paths.sessionsDir, agentId));
-                    return agentSessions.map((item) => ({ ...item, chatAgent: agentId }));
-                }))
-                    .then(async (groups) => {
-                    const dated = await Promise.all(groups.flat().map(async (item) => ({
-                        item,
-                        mtime: await fs
-                            .stat(item.path)
-                            .then((stat) => stat.mtimeMs)
-                            .catch(() => 0),
-                    })));
-                    const recent = dated
-                        .sort((left, right) => right.mtime - left.mtime)
-                        .slice(0, 5)
-                        .map(({ item }) => item);
-                    json(res, 200, { sessions: recent });
-                })
-                    .catch(() => json(res, 200, { sessions: [] }));
-                return;
-            }
-            // The picker may be served by a sidecar currently running in Chat mode.
-            // An omitted chatAgent always means coding history; chat callers identify
-            // their namespace explicitly (one agent or "all").
-            const sessionsDir = requestedAgent
-                ? sessionsDirForChatAgent(paths.sessionsDir, requestedAgent)
-                : paths.sessionsDir;
-            void listRecentSessions(target, 5, sessionsDir)
+            // An omitted chatAgent means coding history; chat callers identify one
+            // agent or request the combined, recency-sorted "all" listing.
+            void listSidecarSessions(target, requestedAgent, paths.sessionsDir)
                 .then((sessions) => json(res, 200, { sessions }))
-                .catch(() => json(res, 200, { sessions: [] }));
+                .catch((error) => {
+                captureSidecarError(error, "app-sidecar.sessions.list");
+                json(res, 200, { sessions: [] });
+            });
             return;
         }
         if (method === "GET" && url.startsWith("/files")) {
@@ -2291,6 +2590,7 @@ async function createSession(deps, opts) {
             void searchProjectFiles(cwd, q)
                 .then((files) => json(res, 200, { files }))
                 .catch((err) => {
+                captureSidecarError(err, "app-sidecar.files.search");
                 log("ERROR", "app-sidecar", "searchProjectFiles failed", {
                     message: err instanceof Error ? err.message : String(err),
                 });
@@ -2298,6 +2598,30 @@ async function createSession(deps, opts) {
             });
             return;
         }
+        // Markdown transcript export for the app's download button. Serialized
+        // here rather than in the webview because the webview's transcript model
+        // deliberately keeps tool activity in the LiveToolPanel — exporting from
+        // there would hand the user a coding session with the coding missing.
+        // `?name=1` asks for the suggested filename only (the save dialog needs it
+        // before there is a path), so the markdown never crosses IPC twice.
+        if (method === "GET" && (url === "/export" || url.startsWith("/export?"))) {
+            const query = new URLSearchParams(url.slice(url.indexOf("?") + 1));
+            const st = session.getState();
+            const filename = defaultExportFilename(mode);
+            if (query.get("name") === "1") {
+                json(res, 200, { filename });
+                return;
+            }
+            const markdown = sessionToMarkdown({
+                mode,
+                cwd,
+                provider: st.provider,
+                model: st.model,
+                ...(st.sessionId ? { sessionId: st.sessionId } : {}),
+            }, session.getMessages(), { toolDetail: parseToolDetail(query.get("tools")) });
+            json(res, 200, { filename, markdown });
+            return;
+        }
         if (method === "GET" && url === "/history") {
             // Reconstruct the transcript from persisted messages so resume is 1:1 with
             // the live SSE stream. Walks ALL message types (not just user/assistant):
@@ -2617,21 +2941,41 @@ async function createSession(deps, opts) {
                     description: c.description,
                     source: "built-in",
                 }));
+                // Desktop-safe registry actions belong in the same picker as workflows.
+                // Most registry commands have dedicated app controls or TUI-only flows;
+                // multi-root management has no other affordance, so expose only these.
+                const workspaceActions = [
+                    {
+                        name: "add-dir",
+                        aliases: ["adddir"],
+                        description: "Add another project folder to this workspace",
+                        source: "built-in",
+                    },
+                    {
+                        name: "remove-dir",
+                        aliases: ["removedir"],
+                        description: "Remove an added project folder from this workspace",
+                        source: "built-in",
+                    },
+                ];
                 const custom = (await loadCustomCommands(cwd))
-                    // A custom command can't shadow a built-in name.
-                    .filter((c) => !PROMPT_COMMANDS.some((b) => b.name === c.name))
+                    // A custom command can't shadow a built-in name or app action.
+                    .filter((c) => !PROMPT_COMMANDS.some((b) => b.name === c.name) &&
+                    !workspaceActions.some((action) => action.name === c.name))
                     .map((c) => ({
                     name: c.name,
                     aliases: [],
                     description: c.description,
                     source: "custom",
                 }));
-                json(res, 200, { commands: [...builtins, ...custom] });
+                json(res, 200, { commands: [...workspaceActions, ...builtins, ...custom] });
             })();
             return;
         }
         if (method === "POST" && url === "/prompt") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let text;
                 let attachments;
                 let meta;
@@ -2758,7 +3102,9 @@ async function createSession(deps, opts) {
                 json(res, 404, { error: "Nolan is not available in EZ Chat." });
                 return;
             }
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let text;
                 try {
                     text = JSON.parse(raw).text ?? "";
@@ -2817,7 +3163,9 @@ async function createSession(deps, opts) {
                 json(res, 404, { error: "Autopilot is not available in EZ Chat." });
                 return;
             }
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let enabled;
                 try {
                     enabled = Boolean(JSON.parse(raw).enabled);
@@ -2838,7 +3186,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/enhance") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let text;
                 try {
                     text = JSON.parse(raw).text ?? "";
@@ -2859,6 +3209,7 @@ async function createSession(deps, opts) {
                 }
                 catch (err) {
                     const message = err instanceof Error ? err.message : String(err);
+                    captureSidecarError(err, "app-sidecar.prompt-enhancer");
                     log("ERROR", "app-sidecar", "enhance failed", { message });
                     json(res, 500, { error: message });
                 }
@@ -2886,7 +3237,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/radio/volume") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let volume;
                 try {
                     volume = Number(JSON.parse(raw).volume);
@@ -2909,7 +3262,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/radio") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let station;
                 try {
                     station = JSON.parse(raw).station ?? "";
@@ -2933,7 +3288,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/tasks/run") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let id;
                 let all;
                 try {
@@ -2955,7 +3312,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/tasks/add") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let title;
                 let prompt;
                 try {
@@ -2987,7 +3346,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/tasks/update") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let id;
                 let status;
                 let title;
@@ -3032,7 +3393,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/tasks/delete") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let id;
                 try {
                     id = JSON.parse(raw).id ?? "";
@@ -3064,18 +3427,38 @@ async function createSession(deps, opts) {
                         loggedIn.push(p);
                 }
                 // Just the names, grouped by provider in registry order — the UI shows
-                // a clean multi-column list of model ids.
-                const models = MODELS.filter((m) => loggedIn.includes(m.provider)).map((m) => ({
-                    id: m.id,
-                    name: m.name,
-                    provider: m.provider,
-                }));
+                // a clean multi-column list of model ids. Local models come from the
+                // runtime registry (populated by the background scan) and are always
+                // listed: their "login" is the endpoint answering a probe.
+                const models = getAllModels()
+                    .filter((m) => m.provider === "local" || loggedIn.includes(m.provider))
+                    .map((m) => {
+                    if (m.provider !== "local") {
+                        return { id: m.id, name: m.name, provider: m.provider };
+                    }
+                    const probed = findProbedModel(localProbes, m.id);
+                    return {
+                        id: m.id,
+                        name: m.name,
+                        provider: m.provider,
+                        local: true,
+                        endpoint: probed?.endpoint.label ?? parseLocalModelId(m.id)?.endpointId,
+                        // A local model that can't call tools can't run the agent — the UI
+                        // renders it disabled rather than hiding it, so the user learns why.
+                        supportsTools: probed?.model.supportsTools ?? true,
+                        contextWindow: m.contextWindow,
+                        contextWindowKnown: probed?.model.contextWindowKnown ?? false,
+                        supportsThinking: m.supportsThinking,
+                    };
+                });
                 json(res, 200, { models });
             })();
             return;
         }
         if (method === "POST" && url === "/model") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let modelId;
                 try {
                     modelId = JSON.parse(raw).model ?? "";
@@ -3096,6 +3479,13 @@ async function createSession(deps, opts) {
                 // Pick up any natively-written keys (desktop app) before resolving the
                 // new model's credentials, so switching to a just-added provider works.
                 await auth.reload();
+                if (target.provider === "local") {
+                    const problem = await localModelBlocker(target.id);
+                    if (problem) {
+                        json(res, 409, { error: problem });
+                        return;
+                    }
+                }
                 await session.switchModel(target.provider, target.id);
                 // Nolan follows EZ Coder's model only while un-pinned; a user-set Nolan
                 // override survives EZ Coder model switches untouched.
@@ -3147,7 +3537,9 @@ async function createSession(deps, opts) {
         // to BOTH Nolan sessions (chat + autopilot reviewer); a switch landing while
         // either is mid-run defers via the pending-model mechanics.
         if (method === "POST" && url === "/ken/model") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let modelId;
                 try {
                     const parsed = JSON.parse(raw).model;
@@ -3191,7 +3583,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/kill") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let id;
                 try {
                     id = JSON.parse(raw).id ?? "";
@@ -3269,6 +3663,7 @@ async function createSession(deps, opts) {
                     drained,
                 });
             })().catch((error) => {
+                captureSidecarError(error, "app-sidecar.run.cancel");
                 broadcast("cancel_failed", { error: "cancel_failed", runState: runLifecycle.state });
                 json(res, 500, {
                     error: "cancel_failed",
@@ -3296,6 +3691,7 @@ async function createSession(deps, opts) {
                 json(res, 200, { ok: true });
             })
                 .catch((err) => {
+                captureSidecarError(err, "app-sidecar.session.new");
                 json(res, 500, { error: err instanceof Error ? err.message : String(err) });
             });
             return;
@@ -3310,7 +3706,9 @@ async function createSession(deps, opts) {
         //   3. session_reset tells the webview to clear its transcript; it then runs
         //      the "implement it now" prompt in the clean session.
         if (method === "POST" && url === "/plan/accept") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let planPath;
                 try {
                     planPath = JSON.parse(raw).planPath || undefined;
@@ -3350,6 +3748,7 @@ async function createSession(deps, opts) {
                     json(res, 200, { ok: true, planTotal });
                 }
                 catch (err) {
+                    captureSidecarError(err, "app-sidecar.plan.accept");
                     json(res, 500, { error: err instanceof Error ? err.message : String(err) });
                 }
             });
@@ -3361,7 +3760,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/auth/apikey") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let provider = "";
                 let key;
                 let variant;
@@ -3404,7 +3805,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/auth/oauth/start") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let provider = "";
                 try {
                     provider = JSON.parse(raw).provider ?? "";
@@ -3446,6 +3849,7 @@ async function createSession(deps, opts) {
                         broadcast("auth_done", { provider });
                     }
                     catch (err) {
+                        captureSidecarError(err, "app-sidecar.auth.oauth", { provider });
                         broadcast("auth_error", {
                             provider,
                             message: err instanceof Error ? err.message : String(err),
@@ -3460,7 +3864,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/auth/oauth/code") {
-            void readBody(req).then((raw) => {
+            void readBody(req, res).then((raw) => {
+                if (raw === null)
+                    return;
                 let code;
                 try {
                     code = JSON.parse(raw).code ?? "";
@@ -3480,7 +3886,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/auth/logout") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let provider;
                 try {
                     provider = JSON.parse(raw).provider ?? "";
@@ -3503,6 +3911,84 @@ async function createSession(deps, opts) {
             });
             return;
         }
+        // ── Local models ──────────────────────────────────────
+        // GET returns the last scan (cheap, no probing) so opening the modal is
+        // instant; POST /local/scan is the explicit refresh.
+        if (method === "GET" && url === "/local") {
+            json(res, 200, localStatePayload());
+            return;
+        }
+        if (method === "POST" && url === "/local/scan") {
+            void scanLocalModels(true)
+                .then(() => {
+                broadcast("models_change", { local: localStatePayload() });
+                json(res, 200, localStatePayload());
+            })
+                .catch((err) => {
+                broadcastError("error", "local model scan failed", err);
+                json(res, 500, { error: "Local model scan failed — see the sidecar log." });
+            });
+            return;
+        }
+        if (method === "POST" && url === "/local/endpoints") {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
+                let body;
+                try {
+                    body = JSON.parse(raw);
+                }
+                catch {
+                    json(res, 400, { error: "invalid JSON body" });
+                    return;
+                }
+                try {
+                    const endpoint = await addCustomEndpoint({
+                        baseUrl: body.baseUrl ?? "",
+                        ...(body.label ? { label: body.label } : {}),
+                        ...(body.apiKey ? { apiKey: body.apiKey } : {}),
+                    });
+                    await scanLocalModels(true);
+                    broadcast("models_change", { local: localStatePayload() });
+                    json(res, 200, {
+                        endpoint: { id: endpoint.id, label: endpoint.label },
+                        ...localStatePayload(),
+                    });
+                }
+                catch (err) {
+                    // Validation errors are the user's typo, not a system fault — 400 with
+                    // the exact reason, and nothing in the transcript.
+                    if (err instanceof LocalEndpointError) {
+                        json(res, 400, { error: err.message });
+                        return;
+                    }
+                    broadcastError("error", "add local endpoint failed", err);
+                    json(res, 500, { error: "Could not save the endpoint — see the sidecar log." });
+                }
+            });
+            return;
+        }
+        if (method === "DELETE" && url.startsWith("/local/endpoints/")) {
+            const id = decodeURIComponent(url.slice("/local/endpoints/".length));
+            void (async () => {
+                try {
+                    await removeCustomEndpoint(id);
+                    clearRuntimeModels((m) => m.provider === "local" && parseLocalModelId(m.id)?.endpointId === id);
+                    await scanLocalModels(true);
+                    broadcast("models_change", { local: localStatePayload() });
+                    json(res, 200, localStatePayload());
+                }
+                catch (err) {
+                    if (err instanceof LocalEndpointError) {
+                        json(res, 400, { error: err.message });
+                        return;
+                    }
+                    broadcastError("error", "remove local endpoint failed", err);
+                    json(res, 500, { error: "Could not remove the endpoint — see the sidecar log." });
+                }
+            })();
+            return;
+        }
         // ── Telegram config (mirrors `ezcoder telegram`) ─────────
         if (method === "GET" && url === "/telegram") {
             void loadTelegramConfig().then((cfg) => {
@@ -3519,7 +4005,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/telegram") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let botTokenInput;
                 let userIdInput;
                 try {
@@ -3587,6 +4075,7 @@ async function createSession(deps, opts) {
                 }
                 catch (err) {
                     serveController = null;
+                    captureSidecarError(err, "app-sidecar.serve.start", { provider: st.provider });
                     json(res, 400, { error: err instanceof Error ? err.message : String(err) });
                 }
             })();
@@ -3613,6 +4102,7 @@ async function createSession(deps, opts) {
             void buildMcpRows(targetCwd)
                 .then((servers) => json(res, 200, { servers }))
                 .catch((err) => {
+                captureSidecarError(err, "app-sidecar.mcp.list");
                 log("ERROR", "app-sidecar", "buildMcpRows failed", {
                     message: err instanceof Error ? err.message : String(err),
                 });
@@ -3621,7 +4111,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/mcp/add") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let line;
                 let scopeValue;
                 let bodyCwd;
@@ -3669,6 +4161,7 @@ async function createSession(deps, opts) {
                     });
                 }
                 catch (err) {
+                    captureSidecarError(err, "app-sidecar.mcp.add", { server: config.name });
                     json(res, 500, {
                         error: err instanceof Error ? err.message : String(err),
                     });
@@ -3677,7 +4170,9 @@ async function createSession(deps, opts) {
             return;
         }
         if (method === "POST" && url === "/mcp/remove") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let name;
                 let scopeValue;
                 let bodyCwd;
@@ -3714,7 +4209,9 @@ async function createSession(deps, opts) {
         // `mcp_auth_error`. Responds 202 immediately and runs the flow in the
         // background (the browser round-trip can take a while).
         if (method === "POST" && url === "/mcp/login") {
-            void readBody(req).then(async (raw) => {
+            void readBody(req, res).then(async (raw) => {
+                if (raw === null)
+                    return;
                 let name;
                 let scopeValue;
                 let bodyCwd;
@@ -3758,6 +4255,7 @@ async function createSession(deps, opts) {
                     }
                 }
                 catch (err) {
+                    captureSidecarError(err, "app-sidecar.mcp.login", { server: name });
                     broadcast("mcp_auth_error", {
                         name,
                         message: err instanceof Error ? err.message : String(err),
@@ -3778,6 +4276,9 @@ async function createSession(deps, opts) {
         gitPollStopped = true;
         if (gitPoll)
             clearTimeout(gitPoll);
+        gitHubPollStopped = true;
+        if (gitHubPoll)
+            clearTimeout(gitHubPoll);
         // Stop the Telegram serve loop + dispose its per-chat sessions.
         if (serveController)
             await serveController.stop().catch(() => { });
@@ -3804,7 +4305,9 @@ async function createSession(deps, opts) {
         dispose,
     };
 }
-main().catch((err) => {
+main().catch(async (err) => {
+    captureSidecarError(err, "app-sidecar.main", { severity: "fatal" });
+    await flushSidecarErrors();
     const message = err instanceof Error ? err.message : String(err);
     process.stderr.write(`GG_APP_FATAL ${message}\n`);
     process.exit(1);