npm - @galda/cli - Versions diffs - 0.10.113 → 0.10.114 - Mend

@galda/cli 0.10.113 → 0.10.114

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/LICENSE.md ADDED Viewed

@@ -0,0 +1,33 @@
+# Galda CLI license
+Copyright (c) 2026 Kodo Inc. All rights reserved.
+This software is proprietary and source-available. The source is distributed
+so that you can read, audit, and verify what runs on your machine. It is not
+open source.
+## You may
+- Install and run this software, for personal or commercial purposes, subject
+  to a valid Galda subscription where one is required.
+- Read, inspect, and audit the source code, including for security review.
+- Modify it locally for your own use.
+## You may not
+- Redistribute, resell, sublicense, or host this software, in whole or in
+  part, whether modified or unmodified.
+- Use the source code to build or operate a competing product or service.
+- Remove or obscure this notice.
+## No warranty
+This software is provided "as is", without warranty of any kind, express or
+implied, including but not limited to the warranties of merchantability,
+fitness for a particular purpose, and non-infringement. In no event shall the
+copyright holder be liable for any claim, damages, or other liability arising
+from, out of, or in connection with this software or its use.
+## Contact
+https://galda.app

package/app/index.html CHANGED Viewed

@@ -2,7 +2,7 @@
 <html lang="en">
 <head>
 <meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover">
 <title>Galda</title>
 <script>
   // app/index.html is a server-backed SPA, not a standalone artifact. Rendering the
@@ -31,7 +31,7 @@
   /* Design tokens + light/dark palette live in app/theme.css (design/CDO role).
      Everything below consumes those tokens; never hard-code colors here. */
   *{box-sizing:border-box}
-  html,body{height:100%}
+  html,body{height:100%;overflow-x:hidden;overscroll-behavior:none}
   body{margin:0;background:var(--canvas);color:var(--ink);font-family:var(--ui);
     font-size:14px;font-variant-numeric:tabular-nums;-webkit-font-smoothing:antialiased;display:flex;flex-direction:column;overflow:hidden}
   button{font:inherit}
@@ -333,6 +333,14 @@
     color:var(--ink2);font:inherit;font-size:12px;cursor:pointer;text-align:left;width:100%}
   .appopt:hover{background:rgba(var(--tint),.06);color:var(--ink)}
   .appopt.active{color:var(--ink);background:var(--hair2)}
+  /* A chooser is already open somewhere: dim the glyph, no surface, and no hover
+     answer — the row must not look pressable while it cannot open a second one. */
+  .appopt:disabled{cursor:default}
+  .appopt:disabled,.appopt:disabled .nm{color:var(--ink3)}
+  .appopt:disabled:hover{background:transparent}
+  /* the row's own rule sets .nm to full --ink, so say it again at that weight */
+  .ctxmenu .appopt.ctxopen:disabled .nm{color:var(--ink3)}
+  .ctxmenu .appopt.ctxopen:disabled svg{opacity:.45}
   .appopt svg{width:13px;height:13px;stroke:currentColor;stroke-width:1.7;fill:none;stroke-linecap:round;stroke-linejoin:round}
   .modelsel{position:relative}
   .modelbtn{font-family:var(--mono);font-size:10.5px;text-transform:capitalize}
@@ -2582,7 +2590,7 @@
      magnification / uniform brighten (§5.5: whole-panel uniform, no dark tint).
      DOM panel backgrounds/shadows/blur are stripped; text reads via R2 "wells"
      (local re-blur + tint behind dense text groups) + --tsh. ---- */
-  #glassgl{position:fixed;inset:0;width:100vw;height:100vh;display:none;z-index:-1;pointer-events:none}
+  #glassgl{position:fixed;inset:0;width:100dvw;height:100dvh;display:none;z-index:-1;pointer-events:none}
   body[data-theme="glass"]{background:#0a0a0b}
   body[data-theme="glass"][data-layout="flagship"]{background:transparent} /* WebGL draws the bg (photo is NOT the CSS #themebg here) */
   body[data-theme="glass"][data-layout="flagship"] #glassgl{display:block}
@@ -2654,7 +2662,7 @@
   /* ---- TB縁アニメ canvas (§6.5 確定: 既定=パルス×2番目色・TBのみ周回・Queは含まない).
      Same overlay recipe as the flagship #fx: fixed, pointer-transparent, drawn by the
      TBEDGE rAF loop (JS) which runs only while an animation is selected. ---- */
-  #fx{position:fixed;inset:0;width:100vw;height:100vh;pointer-events:none;z-index:9}
+  #fx{position:fixed;inset:0;width:100dvw;height:100dvh;pointer-events:none;z-index:9}
   /* ---- TB面 (compbg) × flagship: the layout/theme base rules above outrank the generic
      preset rule (cascade order), so re-layer the tint over each base surface here at the
      end of the sheet. §6.5: TB面は全テーマに重ねられる. ---- */
@@ -2834,7 +2842,7 @@
      moves Review/To Do into a right drawer, and exposes project switching from
      the top-left current-project button. Desktop flagship (>640px) is untouched. ---- */
   @media (max-width: 640px){
-    html,body{height:100dvh}
+    html,body{height:100dvh;overflow:hidden;overscroll-behavior:none;touch-action:pan-y}
     body[data-layout="flagship"]{overflow:hidden}
     body[data-layout="flagship"] #fsRoot{height:100dvh;flex-direction:column;padding:8px 24px max(14px, calc(env(safe-area-inset-bottom) + 10px));gap:8px;
       overflow:hidden;position:relative;--fscenterw:100%} /* Masa: side margins — narrower cards (8→18px) */
@@ -2886,7 +2894,7 @@
     /* Masa: composer was too tall — compact it (ChatGPT-like). Controls + send stay on ONE row
        (nowrap; the model/agent chips shrink first, the send never shrinks). */
     body[data-layout="flagship"] #fsRoot .composer{padding:8px 10px;gap:6px;border-radius:14px}
-    body[data-layout="flagship"] #fsRoot .composer textarea{font-size:15px;line-height:1.3;padding:1px 2px 0;max-height:90px}
+    body[data-layout="flagship"] #fsRoot .composer textarea{font-size:16px;line-height:1.3;padding:1px 2px 0;max-height:90px}
     body[data-layout="flagship"] #fsRoot .crow{flex-wrap:nowrap;gap:6px}
     /* collapse the agent button to its icon (drop the "Claude Code" label) so the row fits
        one line with the send fully visible; model + effort keep their text. */
@@ -11476,7 +11484,9 @@ function renderCtxBar(){
       // LRM, so the rtl clipping trims the HEAD of the path without reversing the text
       + `<span class="pt">\u200e${esc(folderShort(r.dir))}</span></button>`)
     .join('');
-  const openRow = `<button type="button" class="appopt ctxopen" id="ctxopenfolder" title="Open the OS folder chooser"><svg viewBox="0 0 24 24"><path d="M3 7a2 2 0 012-2h4l2 2h8a2 2 0 012 2v8a2 2 0 01-2 2H5a2 2 0 01-2-2z"/><path d="M12 11v6M9 14h6"/></svg><span class="nm">Open folder…</span></button>`;
+  // Redrawing the menu must not hand back a second chooser: carry the disabled
+  // state that setFolderPickerBusy() put on the live button.
+  const openRow = `<button type="button" class="appopt ctxopen${folderPickerBusy ? ' busy' : ''}" id="ctxopenfolder"${folderPickerBusy ? ' disabled' : ''} title="Open the OS folder chooser"><svg viewBox="0 0 24 24"><path d="M3 7a2 2 0 012-2h4l2 2h8a2 2 0 012 2v8a2 2 0 01-2 2H5a2 2 0 01-2-2z"/><path d="M12 11v6M9 14h6"/></svg><span class="nm">Open folder…</span></button>`;
   menu.innerHTML = `${opts}${openRow}<div class="ctxmsg" id="ctxdirmsg"></div>`;
 }
 // Workspace mode is fixed to the isolated worktree (clean separate checkout). The
@@ -11522,9 +11532,22 @@ async function setProjectFolder(dir){
 // project at the chosen path. This is also correct through the authenticated
 // relay: it forwards the request to the account owner's loopback engine, so the
 // picker opens on that owner's Mac rather than on the hosted relay.
+// One chooser at a time. The dialog opens over in the engine process and can take
+// a moment to appear (and may not come to the front at all), so a second tap used
+// to open a second dialog: ten taps left someone with ten dialogs to dismiss. The
+// request stays in flight for as long as the dialog is up, so "a request is out"
+// is exactly "a dialog is open" — no timer to guess with.
+let folderPickerBusy = false;
+function setFolderPickerBusy(busy){
+  folderPickerBusy = busy;
+  const btn = $('ctxopenfolder');
+  if (btn) { btn.disabled = busy; btn.classList.toggle('busy', busy); }
+}
 async function openFolderNative(){
+  if (folderPickerBusy) return;
   const msg = $('ctxdirmsg');
   const say = (t, bad) => { if (msg) { msg.textContent = t; msg.classList.toggle('bad', Boolean(bad)); } };
+  setFolderPickerBusy(true);
   say('Opening the folder chooser…');
   try {
     const r = await fetch(withKey('/api/choose-folder'), { method: 'POST' });
@@ -11534,6 +11557,7 @@ async function openFolderNative(){
     if (body.unsupported) { say('This engine can’t open a folder dialog on this system.', true); return; }
     say(body.error || 'Could not open the folder chooser.', true);
   } catch { say('Could not reach the engine.', true); }
+  finally { setFolderPickerBusy(false); }
 }
 $('ctxdirbtn').onclick = (e) => {
   e.stopPropagation();

package/bin/manager-for-ai.mjs CHANGED Viewed

@@ -149,21 +149,56 @@ await import(pathToFileURL(join(ROOT, 'engine', 'server.mjs')).href);
 // stable `<id>.<domain>` from any device. Local-first is preserved — the agent
 // still runs here; the relay is only a door. Opt-in via RELAY_URL for now; the
 // public build will default it to the deployed relay. See relay/DEPLOY.md.
+// The user can turn remote access OFF in Settings (docs/SECURITY.md). That is
+// the discoverable form of `RELAY_URL=`: no relay child, no outbound socket.
+// The switch is written by the SERVER process, so we read the file here and
+// watch it, letting the toggle take effect without restarting the CLI.
+const { readRelayPref, resolveRelayEnabled, RELAY_PREF_FILE } =
+  await import(pathToFileURL(join(ROOT, 'engine', 'relay-pref.mjs')).href);
+// Same resolution the server and relay-client use, spelled out here because the
+// DATA_DIR above is scoped to the single-instance check.
+const RELAY_DATA_DIR = process.env.MANAGER_HOME
+  ?? (existsSync(join(ROOT, '.git')) ? join(ROOT, 'engine') : join(homedir(), '.manager-for-ai'));
 if (process.env.RELAY_URL) {
   const { spawn } = await import('node:child_process');
   const { superviseRelay } = await import(pathToFileURL(join(ROOT, 'engine', 'relay-supervisor.mjs')).href);
+  const { watch } = await import('node:fs');
+  let sup = null; // non-null exactly while the relay child is supervised
   // Supervise the relay-client: if the CHILD exits (uncaught throw, single-
   // instance lock refuse) we bring it back with backoff, otherwise the app goes
   // silently offline ("Unsent"). A tight crash loop (a config/lock error) trips a
   // circuit breaker so we stop hammering and say why. relay-client heals its own
   // dropped socket; this heals the whole process dying. See engine/relay-supervisor.mjs.
-  const sup = superviseRelay({
-    spawn: () => spawn(process.execPath, [join(ROOT, 'engine', 'relay-client.mjs')], { stdio: 'inherit', env: process.env }),
-    log: ({ code, signal, delayMs }) => say(`relay-client exited (code ${code ?? 'n/a'}${signal ? `, ${signal}` : ''}) — restarting in ${Math.round(delayMs / 1000)}s`),
-    onGiveUp: () => say('relay-client keeps exiting immediately — giving up; run `npx @galda/cli --signin` or check RELAY_URL'),
-  });
-  const stop = () => sup.stop();
-  process.on('exit', stop);
-  for (const sig of ['SIGINT', 'SIGTERM']) process.on(sig, () => { stop(); process.exit(0); });
-  say(`relay: connecting to ${process.env.RELAY_URL} — your fixed URL goes live once you sign in`);
+  const startRelay = () => {
+    if (sup) return;
+    sup = superviseRelay({
+      spawn: () => spawn(process.execPath, [join(ROOT, 'engine', 'relay-client.mjs')], { stdio: 'inherit', env: process.env }),
+      log: ({ code, signal, delayMs }) => say(`relay-client exited (code ${code ?? 'n/a'}${signal ? `, ${signal}` : ''}) — restarting in ${Math.round(delayMs / 1000)}s`),
+      onGiveUp: () => say('relay-client keeps exiting immediately — giving up; run `npx @galda/cli --signin` or check RELAY_URL'),
+    });
+    say(`relay: connecting to ${process.env.RELAY_URL} — your fixed URL goes live once you sign in`);
+  };
+  const stopRelay = () => { sup?.stop(); sup = null; };
+  const applyPref = () => {
+    const want = resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref: readRelayPref(RELAY_DATA_DIR) });
+    if (want && !sup) startRelay();
+    else if (!want && sup) { stopRelay(); say('relay: remote access turned off in Settings — no outbound connection'); }
+  };
+  applyPref();
+  if (!sup) say('relay: remote access is off (Settings) — running fully local');
+  // The switch is written by the SERVER process (POST /api/relay-pref), so the
+  // only way we learn about a click is to watch the file. Same cross-process
+  // idiom as relay-status.json / relay-takeover.req.
+  try {
+    watch(RELAY_DATA_DIR, (_e, name) => { if (name === RELAY_PREF_FILE) applyPref(); }).unref();
+  } catch { /* watching is a nicety: the choice still applies on next start */ }
+  process.on('exit', stopRelay);
+  for (const sig of ['SIGINT', 'SIGTERM']) process.on(sig, () => { stopRelay(); process.exit(0); });
 }

package/docs/SECURITY.md ADDED Viewed

@@ -0,0 +1,183 @@
+# Security and permissions
+What Galda runs on your machine, what it can touch, and what leaves it.
+Every claim below is a statement about the code in this package. Source
+references are given so you can check them yourself in the published tarball
+(`npm pack @galda/cli`).
+日本語の要約は末尾の「日本語」節にあります。
+## What Galda is
+Galda does not contain an AI model and does not talk to one. It starts the
+Claude Code or Codex CLI that is already installed and signed in on your
+machine, and gives you a place to queue work and review the result.
+That has a direct consequence for your code: **your code is never uploaded to
+Galda for inference.** Claude Code and Codex connect to Anthropic or OpenAI
+directly, on your own subscription. Galda is not in that path and never sees
+that traffic.
+## Installation
+**Galda has no install scripts.** `package.json` declares only `start` and
+`test`; there is no `preinstall`, `install`, `postinstall`, or `prepare`.
+Nothing in this package executes as a side effect of `npm install` or `npx`.
+Code runs only when you start Galda yourself.
+To read the code before running it:
+```
+npm pack @galda/cli          # downloads the tarball, runs nothing
+tar -xzf galda-cli-*.tgz     # everything Galda ships is plain JavaScript
+```
+## The local server
+Galda runs an HTTP server on your machine.
+- It binds to **loopback only** (`127.0.0.1` and `::1`), so it is not reachable
+  from your network. See `engine/server.mjs`.
+- Every request requires an access key stored at `~/.manager-for-ai/secret.key`.
+- All state lives in `~/.manager-for-ai/`. Nothing is written elsewhere.
+To remove Galda completely:
+```
+rm -rf ~/.manager-for-ai
+```
+That is the whole uninstall. Galda installs no daemons, no login items, no
+kernel extensions, and no browser extensions.
+## What the agent is allowed to do
+Galda does not hand Claude Code or Codex a blank cheque. The tool set is an
+explicit allowlist (`engine/lib.mjs`, `WORKER_TOOLS`).
+**The agent can:**
+- Read and edit files, through the `Edit` / `Write` / `Read` / `Glob` / `Grep`
+  tools, inside the working copy for the task
+- Run named commands only: language runtimes and package managers (`node`,
+  `npm`, `npx`, `pnpm`, `yarn`, `bun`, `deno`, `python`, `pip`, `go`, `cargo`,
+  `ruby`, `make`), test and lint runners (`pytest`, `jest`, `vitest`, `tsc`,
+  `eslint`, `prettier`), and read-only shell utilities (`cat`, `ls`, `grep`,
+  `find`, `diff`, and similar)
+- Read the web (`WebFetch`, `WebSearch`)
+**The agent cannot:**
+- Run arbitrary shell commands. `Bash` is not granted; only the named commands
+  above are, each as an explicit allowlist entry
+- **Commit, push, checkout, reset, or otherwise change your repository state.**
+  Git is granted read-only: `git status`, `git log`, `git diff`, `git show`,
+  `git branch`, `git blame`, `git ls-files`, `git rev-parse`. Nothing else
+- Edit files through the shell. File changes go through the `Edit` / `Write`
+  tools, so every change appears in the diff you review
+**Work is isolated from your working tree.** Each task runs in a throwaway git
+worktree, not in the checkout you have open. Your branch, your staged changes,
+and your uncommitted work are not touched.
+## What leaves your machine
+Three separate paths. They are worth keeping apart.
+### 1. Model traffic — does not involve Galda
+Claude Code and Codex talk to Anthropic and OpenAI directly, using the
+subscription already configured on your machine. Galda neither proxies nor
+observes this. Their data handling is governed by their terms, not ours.
+### 2. The relay — on by default, and you can turn it off
+By default Galda opens an outbound WebSocket to `app.galda.app`. This is what
+lets you open your board from your phone without a tunnel, port forwarding, or
+ngrok.
+Be clear about what this means. The relay is a reverse HTTP tunnel: a request
+made from `app.galda.app` is forwarded over that socket, replayed against your
+local server, and the response body is streamed back
+(`engine/relay-client.mjs`).
+**Therefore everything your board displays passes through Galda's relay
+server:** task text, activity logs, review summaries, diffs, and proof
+screenshots.
+The connection is TLS-encrypted in transit. **It is not end-to-end encrypted**,
+which means Galda's relay server is in the path and could read what crosses it.
+We would rather write that down than let you assume otherwise. End-to-end
+encryption is on the roadmap and is not implemented today.
+**To turn the relay off entirely:**
+```
+RELAY_URL= npx @galda/cli
+```
+With no relay URL, the relay client is never started and no outbound socket is
+opened (`bin/manager-for-ai.mjs`). You lose remote access from your phone.
+Everything else works exactly the same.
+### 3. Your Galda account — licensing
+Galda checks your license. The verifying public key is compiled into the
+package, so the check itself is offline, but the token is refreshed
+periodically against the billing API. This carries your account identity, not
+your code.
+## Analytics
+Galda records a small set of product events so we can see how the tool is
+actually used and improve it. The list is exhaustive. If it is not named here,
+we do not collect it.
+**What we record:**
+| Event | Purpose |
+|---|---|
+| `signup`, `signin` | Account lifecycle |
+| `task_created`, `task_completed`, `task_failed`, `task_interrupted` | Completion and failure rates, so we can find what breaks |
+| `review_approved`, `review_dismissed` | Whether results are actually usable |
+| Which agent ran (Claude Code or Codex) | Where to spend engineering time |
+| App version, OS, Node version | Compatibility and regression tracking |
+| Crash and error events | Fixing crashes |
+Each carries a timestamp and a pseudonymous account id, and nothing else.
+**What we never record:**
+- The text of your requests
+- Your code, diffs, file contents, or file names
+- Repository names or paths
+- Proof screenshots and recordings
+**Paid business plans: analytics are off.** On business plans no product events
+are collected at all, the way Cursor forces Privacy Mode on for teams. You do
+not have to configure anything.
+**With the relay off, nothing is collected.** Not reduced, not anonymized:
+nothing. A mode sold as "nothing leaves your machine" that quietly reported
+usage would invalidate every other claim on this page, so it does not.
+## Reporting a vulnerability
+<!-- TODO(Masa): security contact address. -->
+## 日本語
+- Galda は AI モデルを内蔵せず、モデルと通信もしません。すでにあなたのマシンに
+  入っている Claude Code / Codex を起動するだけです。**あなたのコードが推論の
+  ために Galda へ送られることはありません。**
+- **インストール時に何も実行しません**（`postinstall` 等が存在しません）。
+- ローカルサーバは **`127.0.0.1` と `::1` にのみ bind** し、ネットワークからは
+  到達できません。アクセスキーが必須です。
+- エージェントに渡している **git は読み取り専用**です。`commit` `push`
+  `checkout` `reset` を持ちません。任意のシェル実行もできません。
+- 各タスクは**使い捨ての git worktree** で動き、あなたの作業ツリーには触れません。
+- 既定では、スマホから使えるように **ボードの表示内容が `app.galda.app` の
+  relay を通ります**（TLS 保護、**E2E 暗号化は未実装**＝経路上に Galda の
+  サーバがいます）。`RELAY_URL= npx @galda/cli` で relay を完全に切れます。
+- アンインストールは `rm -rf ~/.manager-for-ai` だけです。

package/engine/relay-pref.mjs ADDED Viewed

@@ -0,0 +1,57 @@
+// Agent Manager — remote-access preference (the relay on/off switch)
+//
+// WHY THIS EXISTS: the relay is what lets you open your board from your phone,
+// and it is on by default. But everything the board displays crosses Galda's
+// relay server (see docs/SECURITY.md), so some people cannot or will not run
+// it — a security policy that forbids outbound connections, or simply not
+// wanting a third party in the path.
+//
+// That escape hatch already existed as `RELAY_URL= npx @galda/cli`, which is
+// an env var nobody discovers. This makes it a setting, the way Cursor puts
+// Privacy Mode in Settings rather than on the command line.
+//
+// The preference lives in a file in DATA_DIR because the two halves are
+// SEPARATE PROCESSES: the server (:4400) takes the click, the launcher owns
+// the relay child. Same idiom as relay-status.json / relay-takeover.req.
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+export const RELAY_PREF_FILE = 'relay-pref.json';
+export function relayPrefPath(dataDir) {
+  return join(dataDir, RELAY_PREF_FILE);
+}
+// Should the relay run? Pure — no clock, no I/O, no env.
+//
+//   relayUrl : the configured relay endpoint ('' / undefined = none built in)
+//   pref     : the user's saved choice (true | false | null when never set)
+//
+// Default is ON: a fresh install gets remote access, because that is the
+// product. Only an explicit `false` turns it off, so a corrupt or missing
+// preference file can never silently disable the feature.
+export function resolveRelayEnabled({ relayUrl, pref } = {}) {
+  if (!relayUrl) return false;
+  return pref !== false;
+}
+// Read the saved preference. Returns null when the user has never chosen, so
+// callers can tell "unset" from "explicitly on" — resolveRelayEnabled treats
+// both as on, but the UI may want to say so differently.
+export function readRelayPref(dataDir) {
+  try {
+    const raw = JSON.parse(readFileSync(relayPrefPath(dataDir), 'utf8'));
+    return typeof raw?.enabled === 'boolean' ? raw.enabled : null;
+  } catch {
+    return null; // never set, unreadable, or corrupt — all mean "no choice made"
+  }
+}
+// Save the preference. Throws on a real write failure so the endpoint can
+// report it rather than telling the user it saved something it did not.
+export function writeRelayPref(dataDir, enabled) {
+  const value = enabled === true;
+  writeFileSync(relayPrefPath(dataDir), JSON.stringify({ enabled: value, at: Date.now() }) + '\n');
+  return value;
+}

package/engine/server.mjs CHANGED Viewed

@@ -24,6 +24,7 @@ import { needsProjectFolder, folderLabel, chooseFolderScript, parseChosenFolder,
 import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, classifyWorkerFailure, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildReviewAttemptLedger, latestGoalOutcomeTask, buildDirtyWorkspacePrBlock, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, rebasePreviewUrl, shouldCreateGoalPR, normalizePullRequestUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, buildQueueWaits, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, autoFoldReviewsEnabled, parseGitUnifiedDiffLocations, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyPrSafety, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildVerificationInfraError, verificationInfraErrorFrom, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, testFailureReason, manualTestRetryPrompt, isNothingVerifiable, isNothingVerifiableForPR, isSuspiciouslyIncompleteDone, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, shouldUsePlannerForGoal, RUN_DECL_FILE, REQUIREMENT_EVIDENCE_FILE, parseRequirementEvidenceDocument, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, buildGoalMessage, serializeGoalMessage, parseGoalMessages, computeInternalQualityMetrics, classifyInternalQualityTaskError, resolveWorkspaceMode, goalSessionFor, setGoalAgentSession, switchGoalAgentSession, parseApprovalRequest } from './lib.mjs';
 import { migrateRequirementModel, validateRequirementModel } from './requirement-model.mjs';
 import { buildManagerVerificationChecks, buildRequirementVerificationEvidence, mergeRequirementVerificationEvidence } from './requirement-verification.mjs';
+import { readRelayPref, writeRelayPref, resolveRelayEnabled } from './relay-pref.mjs';
 import { createSerialQueue } from './lib.mjs';
 import { wantsPullRequest } from './lib.mjs';
 import { parseRequirementEvidence, unmappedChangedFiles, previewOpensSomethingElse } from './lib.mjs';
@@ -4436,6 +4437,41 @@ const server = createServer(async (req, res) => {
     catch (e) { return json(res, 500, { error: String(e?.message ?? e) }); }
     return json(res, 200, { ok: true });
   }
+  // GET/POST /api/relay-pref — the remote-access switch in Settings.
+  // Remote access (the relay) is ON by default. Turning it off is the
+  // discoverable form of `RELAY_URL= npx @galda/cli`: with it off no outbound
+  // socket is opened and nothing your board displays crosses our server
+  // (docs/SECURITY.md). The launcher owns the relay child in ANOTHER process,
+  // so we persist the choice to a file it watches — same shape as
+  // relay-takeover.req above.
+  if (url.pathname === '/api/relay-pref' && req.method === 'GET') {
+    const pref = readRelayPref(DATA_DIR);
+    return json(res, 200, {
+      pref,
+      enabled: resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref }),
+      configured: Boolean(process.env.RELAY_URL),
+    });
+  }
+  if (url.pathname === '/api/relay-pref' && req.method === 'POST') {
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      let input;
+      try { input = JSON.parse(body || '{}'); } catch { return json(res, 400, { error: 'bad json' }); }
+      // A boolean and nothing else. "off"/0/undefined are how a security
+      // setting silently becomes the opposite of what was clicked.
+      if (typeof input?.enabled !== 'boolean') return json(res, 400, { error: 'enabled must be a boolean' });
+      let saved;
+      try { saved = writeRelayPref(DATA_DIR, input.enabled); }
+      catch (e) { return json(res, 500, { error: String(e?.message ?? e) }); }
+      return json(res, 200, {
+        pref: saved,
+        enabled: resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref: saved }),
+        configured: Boolean(process.env.RELAY_URL),
+      });
+    });
+    return;
+  }
   // POST /api/signout — forget the local license so the settings panel can
   // offer a plain "Log out" instead of requiring the `--signin` CLI flag to
   // switch Google accounts. Clears the on-disk token and the in-memory cache;

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.113",
+  "version": "0.10.114",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {
@@ -11,7 +11,7 @@
     "puppeteer-core": "^23.11.1",
     "ws": "^8.21.0"
   },
-  "license": "UNLICENSED",
+  "license": "SEE LICENSE IN LICENSE.md",
   "bin": {
     "cli": "bin/manager-for-ai.mjs",
     "galda": "bin/manager-for-ai.mjs",
@@ -26,6 +26,8 @@
     "SKILL.md",
     ".mcp.json",
     "README.md",
+    "LICENSE.md",
+    "docs/SECURITY.md",
     "CLAUDE.md",
     "!engine/chat-runs",
     "!engine/test",
@@ -41,10 +43,6 @@
   "engines": {
     "node": ">=20"
   },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/kodo-inc/agent-manager.git"
-  },
   "keywords": [
     "claude",
     "claude-code",
@@ -53,5 +51,9 @@
     "manager",
     "verification",
     "proof"
-  ]
+  ],
+  "homepage": "https://galda.app",
+  "bugs": {
+    "url": "https://galda.app/support"
+  }
 }