npm - @galda/cli - Versions diffs - 0.10.113 → 0.10.115 - Mend

@galda/cli 0.10.113 → 0.10.115

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/LICENSE.md ADDED Viewed

@@ -0,0 +1,33 @@
+# Galda CLI license
+Copyright (c) 2026 Kodo Inc. All rights reserved.
+This software is proprietary and source-available. The source is distributed
+so that you can read, audit, and verify what runs on your machine. It is not
+open source.
+## You may
+- Install and run this software, for personal or commercial purposes, subject
+  to a valid Galda subscription where one is required.
+- Read, inspect, and audit the source code, including for security review.
+- Modify it locally for your own use.
+## You may not
+- Redistribute, resell, sublicense, or host this software, in whole or in
+  part, whether modified or unmodified.
+- Use the source code to build or operate a competing product or service.
+- Remove or obscure this notice.
+## No warranty
+This software is provided "as is", without warranty of any kind, express or
+implied, including but not limited to the warranties of merchantability,
+fitness for a particular purpose, and non-infringement. In no event shall the
+copyright holder be liable for any claim, damages, or other liability arising
+from, out of, or in connection with this software or its use.
+## Contact
+https://galda.app

package/app/index.html CHANGED Viewed

@@ -2,7 +2,7 @@
 <html lang="en">
 <head>
 <meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover">
 <title>Galda</title>
 <script>
   // app/index.html is a server-backed SPA, not a standalone artifact. Rendering the
@@ -31,7 +31,7 @@
   /* Design tokens + light/dark palette live in app/theme.css (design/CDO role).
      Everything below consumes those tokens; never hard-code colors here. */
   *{box-sizing:border-box}
-  html,body{height:100%}
+  html,body{height:100%;overflow-x:hidden;overscroll-behavior:none}
   body{margin:0;background:var(--canvas);color:var(--ink);font-family:var(--ui);
     font-size:14px;font-variant-numeric:tabular-nums;-webkit-font-smoothing:antialiased;display:flex;flex-direction:column;overflow:hidden}
   button{font:inherit}
@@ -333,6 +333,14 @@
     color:var(--ink2);font:inherit;font-size:12px;cursor:pointer;text-align:left;width:100%}
   .appopt:hover{background:rgba(var(--tint),.06);color:var(--ink)}
   .appopt.active{color:var(--ink);background:var(--hair2)}
+  /* A chooser is already open somewhere: dim the glyph, no surface, and no hover
+     answer — the row must not look pressable while it cannot open a second one. */
+  .appopt:disabled{cursor:default}
+  .appopt:disabled,.appopt:disabled .nm{color:var(--ink3)}
+  .appopt:disabled:hover{background:transparent}
+  /* the row's own rule sets .nm to full --ink, so say it again at that weight */
+  .ctxmenu .appopt.ctxopen:disabled .nm{color:var(--ink3)}
+  .ctxmenu .appopt.ctxopen:disabled svg{opacity:.45}
   .appopt svg{width:13px;height:13px;stroke:currentColor;stroke-width:1.7;fill:none;stroke-linecap:round;stroke-linejoin:round}
   .modelsel{position:relative}
   .modelbtn{font-family:var(--mono);font-size:10.5px;text-transform:capitalize}
@@ -2582,7 +2590,7 @@
      magnification / uniform brighten (§5.5: whole-panel uniform, no dark tint).
      DOM panel backgrounds/shadows/blur are stripped; text reads via R2 "wells"
      (local re-blur + tint behind dense text groups) + --tsh. ---- */
-  #glassgl{position:fixed;inset:0;width:100vw;height:100vh;display:none;z-index:-1;pointer-events:none}
+  #glassgl{position:fixed;inset:0;width:100dvw;height:100dvh;display:none;z-index:-1;pointer-events:none}
   body[data-theme="glass"]{background:#0a0a0b}
   body[data-theme="glass"][data-layout="flagship"]{background:transparent} /* WebGL draws the bg (photo is NOT the CSS #themebg here) */
   body[data-theme="glass"][data-layout="flagship"] #glassgl{display:block}
@@ -2654,7 +2662,7 @@
   /* ---- TB縁アニメ canvas (§6.5 確定: 既定=パルス×2番目色・TBのみ周回・Queは含まない).
      Same overlay recipe as the flagship #fx: fixed, pointer-transparent, drawn by the
      TBEDGE rAF loop (JS) which runs only while an animation is selected. ---- */
-  #fx{position:fixed;inset:0;width:100vw;height:100vh;pointer-events:none;z-index:9}
+  #fx{position:fixed;inset:0;width:100dvw;height:100dvh;pointer-events:none;z-index:9}
   /* ---- TB面 (compbg) × flagship: the layout/theme base rules above outrank the generic
      preset rule (cascade order), so re-layer the tint over each base surface here at the
      end of the sheet. §6.5: TB面は全テーマに重ねられる. ---- */
@@ -2834,7 +2842,7 @@
      moves Review/To Do into a right drawer, and exposes project switching from
      the top-left current-project button. Desktop flagship (>640px) is untouched. ---- */
   @media (max-width: 640px){
-    html,body{height:100dvh}
+    html,body{height:100dvh;overflow:hidden;overscroll-behavior:none;touch-action:pan-y}
     body[data-layout="flagship"]{overflow:hidden}
     body[data-layout="flagship"] #fsRoot{height:100dvh;flex-direction:column;padding:8px 24px max(14px, calc(env(safe-area-inset-bottom) + 10px));gap:8px;
       overflow:hidden;position:relative;--fscenterw:100%} /* Masa: side margins — narrower cards (8→18px) */
@@ -2886,7 +2894,7 @@
     /* Masa: composer was too tall — compact it (ChatGPT-like). Controls + send stay on ONE row
        (nowrap; the model/agent chips shrink first, the send never shrinks). */
     body[data-layout="flagship"] #fsRoot .composer{padding:8px 10px;gap:6px;border-radius:14px}
-    body[data-layout="flagship"] #fsRoot .composer textarea{font-size:15px;line-height:1.3;padding:1px 2px 0;max-height:90px}
+    body[data-layout="flagship"] #fsRoot .composer textarea{font-size:16px;line-height:1.3;padding:1px 2px 0;max-height:90px}
     body[data-layout="flagship"] #fsRoot .crow{flex-wrap:nowrap;gap:6px}
     /* collapse the agent button to its icon (drop the "Claude Code" label) so the row fits
        one line with the send fully visible; model + effort keep their text. */
@@ -11476,7 +11484,9 @@ function renderCtxBar(){
       // LRM, so the rtl clipping trims the HEAD of the path without reversing the text
       + `<span class="pt">\u200e${esc(folderShort(r.dir))}</span></button>`)
     .join('');
-  const openRow = `<button type="button" class="appopt ctxopen" id="ctxopenfolder" title="Open the OS folder chooser"><svg viewBox="0 0 24 24"><path d="M3 7a2 2 0 012-2h4l2 2h8a2 2 0 012 2v8a2 2 0 01-2 2H5a2 2 0 01-2-2z"/><path d="M12 11v6M9 14h6"/></svg><span class="nm">Open folder…</span></button>`;
+  // Redrawing the menu must not hand back a second chooser: carry the disabled
+  // state that setFolderPickerBusy() put on the live button.
+  const openRow = `<button type="button" class="appopt ctxopen${folderPickerBusy ? ' busy' : ''}" id="ctxopenfolder"${folderPickerBusy ? ' disabled' : ''} title="Open the OS folder chooser"><svg viewBox="0 0 24 24"><path d="M3 7a2 2 0 012-2h4l2 2h8a2 2 0 012 2v8a2 2 0 01-2 2H5a2 2 0 01-2-2z"/><path d="M12 11v6M9 14h6"/></svg><span class="nm">Open folder…</span></button>`;
   menu.innerHTML = `${opts}${openRow}<div class="ctxmsg" id="ctxdirmsg"></div>`;
 }
 // Workspace mode is fixed to the isolated worktree (clean separate checkout). The
@@ -11522,9 +11532,22 @@ async function setProjectFolder(dir){
 // project at the chosen path. This is also correct through the authenticated
 // relay: it forwards the request to the account owner's loopback engine, so the
 // picker opens on that owner's Mac rather than on the hosted relay.
+// One chooser at a time. The dialog opens over in the engine process and can take
+// a moment to appear (and may not come to the front at all), so a second tap used
+// to open a second dialog: ten taps left someone with ten dialogs to dismiss. The
+// request stays in flight for as long as the dialog is up, so "a request is out"
+// is exactly "a dialog is open" — no timer to guess with.
+let folderPickerBusy = false;
+function setFolderPickerBusy(busy){
+  folderPickerBusy = busy;
+  const btn = $('ctxopenfolder');
+  if (btn) { btn.disabled = busy; btn.classList.toggle('busy', busy); }
+}
 async function openFolderNative(){
+  if (folderPickerBusy) return;
   const msg = $('ctxdirmsg');
   const say = (t, bad) => { if (msg) { msg.textContent = t; msg.classList.toggle('bad', Boolean(bad)); } };
+  setFolderPickerBusy(true);
   say('Opening the folder chooser…');
   try {
     const r = await fetch(withKey('/api/choose-folder'), { method: 'POST' });
@@ -11534,6 +11557,7 @@ async function openFolderNative(){
     if (body.unsupported) { say('This engine can’t open a folder dialog on this system.', true); return; }
     say(body.error || 'Could not open the folder chooser.', true);
   } catch { say('Could not reach the engine.', true); }
+  finally { setFolderPickerBusy(false); }
 }
 $('ctxdirbtn').onclick = (e) => {
   e.stopPropagation();

package/bin/manager-for-ai.mjs CHANGED Viewed

@@ -149,21 +149,56 @@ await import(pathToFileURL(join(ROOT, 'engine', 'server.mjs')).href);
 // stable `<id>.<domain>` from any device. Local-first is preserved — the agent
 // still runs here; the relay is only a door. Opt-in via RELAY_URL for now; the
 // public build will default it to the deployed relay. See relay/DEPLOY.md.
+// The user can turn remote access OFF in Settings (docs/SECURITY.md). That is
+// the discoverable form of `RELAY_URL=`: no relay child, no outbound socket.
+// The switch is written by the SERVER process, so we read the file here and
+// watch it, letting the toggle take effect without restarting the CLI.
+const { readRelayPref, resolveRelayEnabled, RELAY_PREF_FILE } =
+  await import(pathToFileURL(join(ROOT, 'engine', 'relay-pref.mjs')).href);
+// Same resolution the server and relay-client use, spelled out here because the
+// DATA_DIR above is scoped to the single-instance check.
+const RELAY_DATA_DIR = process.env.MANAGER_HOME
+  ?? (existsSync(join(ROOT, '.git')) ? join(ROOT, 'engine') : join(homedir(), '.manager-for-ai'));
 if (process.env.RELAY_URL) {
   const { spawn } = await import('node:child_process');
   const { superviseRelay } = await import(pathToFileURL(join(ROOT, 'engine', 'relay-supervisor.mjs')).href);
+  const { watch } = await import('node:fs');
+  let sup = null; // non-null exactly while the relay child is supervised
   // Supervise the relay-client: if the CHILD exits (uncaught throw, single-
   // instance lock refuse) we bring it back with backoff, otherwise the app goes
   // silently offline ("Unsent"). A tight crash loop (a config/lock error) trips a
   // circuit breaker so we stop hammering and say why. relay-client heals its own
   // dropped socket; this heals the whole process dying. See engine/relay-supervisor.mjs.
-  const sup = superviseRelay({
-    spawn: () => spawn(process.execPath, [join(ROOT, 'engine', 'relay-client.mjs')], { stdio: 'inherit', env: process.env }),
-    log: ({ code, signal, delayMs }) => say(`relay-client exited (code ${code ?? 'n/a'}${signal ? `, ${signal}` : ''}) — restarting in ${Math.round(delayMs / 1000)}s`),
-    onGiveUp: () => say('relay-client keeps exiting immediately — giving up; run `npx @galda/cli --signin` or check RELAY_URL'),
-  });
-  const stop = () => sup.stop();
-  process.on('exit', stop);
-  for (const sig of ['SIGINT', 'SIGTERM']) process.on(sig, () => { stop(); process.exit(0); });
-  say(`relay: connecting to ${process.env.RELAY_URL} — your fixed URL goes live once you sign in`);
+  const startRelay = () => {
+    if (sup) return;
+    sup = superviseRelay({
+      spawn: () => spawn(process.execPath, [join(ROOT, 'engine', 'relay-client.mjs')], { stdio: 'inherit', env: process.env }),
+      log: ({ code, signal, delayMs }) => say(`relay-client exited (code ${code ?? 'n/a'}${signal ? `, ${signal}` : ''}) — restarting in ${Math.round(delayMs / 1000)}s`),
+      onGiveUp: () => say('relay-client keeps exiting immediately — giving up; run `npx @galda/cli --signin` or check RELAY_URL'),
+    });
+    say(`relay: connecting to ${process.env.RELAY_URL} — your fixed URL goes live once you sign in`);
+  };
+  const stopRelay = () => { sup?.stop(); sup = null; };
+  const applyPref = () => {
+    const want = resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref: readRelayPref(RELAY_DATA_DIR) });
+    if (want && !sup) startRelay();
+    else if (!want && sup) { stopRelay(); say('relay: remote access turned off in Settings — no outbound connection'); }
+  };
+  applyPref();
+  if (!sup) say('relay: remote access is off (Settings) — running fully local');
+  // The switch is written by the SERVER process (POST /api/relay-pref), so the
+  // only way we learn about a click is to watch the file. Same cross-process
+  // idiom as relay-status.json / relay-takeover.req.
+  try {
+    watch(RELAY_DATA_DIR, (_e, name) => { if (name === RELAY_PREF_FILE) applyPref(); }).unref();
+  } catch { /* watching is a nicety: the choice still applies on next start */ }
+  process.on('exit', stopRelay);
+  for (const sig of ['SIGINT', 'SIGTERM']) process.on(sig, () => { stopRelay(); process.exit(0); });
 }

package/docs/SECURITY.md ADDED Viewed

@@ -0,0 +1,183 @@
+# Security and permissions
+What Galda runs on your machine, what it can touch, and what leaves it.
+Every claim below is a statement about the code in this package. Source
+references are given so you can check them yourself in the published tarball
+(`npm pack @galda/cli`).
+日本語の要約は末尾の「日本語」節にあります。
+## What Galda is
+Galda does not contain an AI model and does not talk to one. It starts the
+Claude Code or Codex CLI that is already installed and signed in on your
+machine, and gives you a place to queue work and review the result.
+That has a direct consequence for your code: **your code is never uploaded to
+Galda for inference.** Claude Code and Codex connect to Anthropic or OpenAI
+directly, on your own subscription. Galda is not in that path and never sees
+that traffic.
+## Installation
+**Galda has no install scripts.** `package.json` declares only `start` and
+`test`; there is no `preinstall`, `install`, `postinstall`, or `prepare`.
+Nothing in this package executes as a side effect of `npm install` or `npx`.
+Code runs only when you start Galda yourself.
+To read the code before running it:
+```
+npm pack @galda/cli          # downloads the tarball, runs nothing
+tar -xzf galda-cli-*.tgz     # everything Galda ships is plain JavaScript
+```
+## The local server
+Galda runs an HTTP server on your machine.
+- It binds to **loopback only** (`127.0.0.1` and `::1`), so it is not reachable
+  from your network. See `engine/server.mjs`.
+- Every request requires an access key stored at `~/.manager-for-ai/secret.key`.
+- All state lives in `~/.manager-for-ai/`. Nothing is written elsewhere.
+To remove Galda completely:
+```
+rm -rf ~/.manager-for-ai
+```
+That is the whole uninstall. Galda installs no daemons, no login items, no
+kernel extensions, and no browser extensions.
+## What the agent is allowed to do
+Galda does not hand Claude Code or Codex a blank cheque. The tool set is an
+explicit allowlist (`engine/lib.mjs`, `WORKER_TOOLS`).
+**The agent can:**
+- Read and edit files, through the `Edit` / `Write` / `Read` / `Glob` / `Grep`
+  tools, inside the working copy for the task
+- Run named commands only: language runtimes and package managers (`node`,
+  `npm`, `npx`, `pnpm`, `yarn`, `bun`, `deno`, `python`, `pip`, `go`, `cargo`,
+  `ruby`, `make`), test and lint runners (`pytest`, `jest`, `vitest`, `tsc`,
+  `eslint`, `prettier`), and read-only shell utilities (`cat`, `ls`, `grep`,
+  `find`, `diff`, and similar)
+- Read the web (`WebFetch`, `WebSearch`)
+**The agent cannot:**
+- Run arbitrary shell commands. `Bash` is not granted; only the named commands
+  above are, each as an explicit allowlist entry
+- **Commit, push, checkout, reset, or otherwise change your repository state.**
+  Git is granted read-only: `git status`, `git log`, `git diff`, `git show`,
+  `git branch`, `git blame`, `git ls-files`, `git rev-parse`. Nothing else
+- Edit files through the shell. File changes go through the `Edit` / `Write`
+  tools, so every change appears in the diff you review
+**Work is isolated from your working tree.** Each task runs in a throwaway git
+worktree, not in the checkout you have open. Your branch, your staged changes,
+and your uncommitted work are not touched.
+## What leaves your machine
+Three separate paths. They are worth keeping apart.
+### 1. Model traffic — does not involve Galda
+Claude Code and Codex talk to Anthropic and OpenAI directly, using the
+subscription already configured on your machine. Galda neither proxies nor
+observes this. Their data handling is governed by their terms, not ours.
+### 2. The relay — on by default, and you can turn it off
+By default Galda opens an outbound WebSocket to `app.galda.app`. This is what
+lets you open your board from your phone without a tunnel, port forwarding, or
+ngrok.
+Be clear about what this means. The relay is a reverse HTTP tunnel: a request
+made from `app.galda.app` is forwarded over that socket, replayed against your
+local server, and the response body is streamed back
+(`engine/relay-client.mjs`).
+**Therefore everything your board displays passes through Galda's relay
+server:** task text, activity logs, review summaries, diffs, and proof
+screenshots.
+The connection is TLS-encrypted in transit. **It is not end-to-end encrypted**,
+which means Galda's relay server is in the path and could read what crosses it.
+We would rather write that down than let you assume otherwise. End-to-end
+encryption is on the roadmap and is not implemented today.
+**To turn the relay off entirely:**
+```
+RELAY_URL= npx @galda/cli
+```
+With no relay URL, the relay client is never started and no outbound socket is
+opened (`bin/manager-for-ai.mjs`). You lose remote access from your phone.
+Everything else works exactly the same.
+### 3. Your Galda account — licensing
+Galda checks your license. The verifying public key is compiled into the
+package, so the check itself is offline, but the token is refreshed
+periodically against the billing API. This carries your account identity, not
+your code.
+## Analytics
+Galda records a small set of product events so we can see how the tool is
+actually used and improve it. The list is exhaustive. If it is not named here,
+we do not collect it.
+**What we record:**
+| Event | Purpose |
+|---|---|
+| `signup`, `signin` | Account lifecycle |
+| `task_created`, `task_completed`, `task_failed`, `task_interrupted` | Completion and failure rates, so we can find what breaks |
+| `review_approved`, `review_dismissed` | Whether results are actually usable |
+| Which agent ran (Claude Code or Codex) | Where to spend engineering time |
+| App version, OS, Node version | Compatibility and regression tracking |
+| Crash and error events | Fixing crashes |
+Each carries a timestamp and a pseudonymous account id, and nothing else.
+**What we never record:**
+- The text of your requests
+- Your code, diffs, file contents, or file names
+- Repository names or paths
+- Proof screenshots and recordings
+**Paid business plans: analytics are off.** On business plans no product events
+are collected at all, the way Cursor forces Privacy Mode on for teams. You do
+not have to configure anything.
+**With the relay off, nothing is collected.** Not reduced, not anonymized:
+nothing. A mode sold as "nothing leaves your machine" that quietly reported
+usage would invalidate every other claim on this page, so it does not.
+## Reporting a vulnerability
+<!-- TODO(Masa): security contact address. -->
+## 日本語
+- Galda は AI モデルを内蔵せず、モデルと通信もしません。すでにあなたのマシンに
+  入っている Claude Code / Codex を起動するだけです。**あなたのコードが推論の
+  ために Galda へ送られることはありません。**
+- **インストール時に何も実行しません**（`postinstall` 等が存在しません）。
+- ローカルサーバは **`127.0.0.1` と `::1` にのみ bind** し、ネットワークからは
+  到達できません。アクセスキーが必須です。
+- エージェントに渡している **git は読み取り専用**です。`commit` `push`
+  `checkout` `reset` を持ちません。任意のシェル実行もできません。
+- 各タスクは**使い捨ての git worktree** で動き、あなたの作業ツリーには触れません。
+- 既定では、スマホから使えるように **ボードの表示内容が `app.galda.app` の
+  relay を通ります**（TLS 保護、**E2E 暗号化は未実装**＝経路上に Galda の
+  サーバがいます）。`RELAY_URL= npx @galda/cli` で relay を完全に切れます。
+- アンインストールは `rm -rf ~/.manager-for-ai` だけです。

package/engine/lib.mjs CHANGED Viewed

@@ -897,7 +897,14 @@ export function parseStreamEvents(line) {
       const arg = i.file_path ?? i.path ?? i.pattern ?? i.command ?? i.url ?? i.query ?? '';
       out.push({ kind: 'activity', text: `${p.name} ${String(arg)}`.trim().slice(0, 140) });
     } else if (p.type === 'text' && p.text?.trim()) {
-      out.push({ kind: 'activity', text: `✎ ${p.text.trim().replace(/\s+/g, ' ').slice(0, 110)}` });
+      // The worker talking, as opposed to the worker working. It was flattened
+      // into the same ✎-prefixed, 110-char activity line as every tool call,
+      // which is why a person who sent a request sat watching a tool log with
+      // nothing in it that reads as an answer (Masa's friend, 2026-07-31: three
+      // minutes and "no reply"). Kept whole and kept separate here; the caller
+      // still writes the short activity line, and can also show the first one as
+      // what it is — the agent's first words back.
+      out.push({ kind: 'say', text: p.text.trim() });
     }
   }
   return out;
@@ -4858,20 +4865,14 @@ export function shouldEmitSetupCompleted({ isMcpClient, alreadySeen, flagExists
   return Boolean(isMcpClient) && !alreadySeen && !flagExists;
 }
-// Onboarding funnel: a goal can only produce real changes if it runs inside a
-// real code repo. When the agent is started ad-hoc (e.g. `node bin/...` in the
-// user's HOME), the seeded default project points at a non-repo dir → the
-// worker no-ops (nothing to edit) yet the goal is marked "done" — the exact
-// blocker for "実装が始まる". This decides, BEFORE running, whether we must ask
-// the user which folder to work in. `isRepo` is passed in (the git probe is
-// I/O, done by the caller) so this stays pure/testable. Home is never a valid
-// work root — even a git-init'd home dir is "no project chosen yet".
-export function needsProjectFolder({ dir, homeDir, isRepo } = {}) {
-  if (!dir) return true;
-  const norm = (p) => String(p).replace(/\/+$/, '');
-  if (homeDir && norm(dir) === norm(homeDir)) return true;
-  return !isRepo;
-}
+// `needsProjectFolder` lived here until 2026-07-31. It decided, before running,
+// that a folder was not good enough to work in (HOME, or not a git repo) and
+// that the person had to answer a question first. Masa removed the question:
+// `claude -p` in a plain folder simply works — measured — so Galda asking is a
+// toll gate of our own invention, and the folder is now whatever the CLI was
+// started in, changeable on the composer chip by whoever cares. The builders
+// below stay: an install that was mid-question when it updated must still be
+// able to answer the one it already has.
 // The repo's own name: the last segment of its path. The composer chip prints this and
 // the folder menu prints it again on every row, so it lives here as one function — two

package/engine/relay-pref.mjs ADDED Viewed

@@ -0,0 +1,57 @@
+// Agent Manager — remote-access preference (the relay on/off switch)
+//
+// WHY THIS EXISTS: the relay is what lets you open your board from your phone,
+// and it is on by default. But everything the board displays crosses Galda's
+// relay server (see docs/SECURITY.md), so some people cannot or will not run
+// it — a security policy that forbids outbound connections, or simply not
+// wanting a third party in the path.
+//
+// That escape hatch already existed as `RELAY_URL= npx @galda/cli`, which is
+// an env var nobody discovers. This makes it a setting, the way Cursor puts
+// Privacy Mode in Settings rather than on the command line.
+//
+// The preference lives in a file in DATA_DIR because the two halves are
+// SEPARATE PROCESSES: the server (:4400) takes the click, the launcher owns
+// the relay child. Same idiom as relay-status.json / relay-takeover.req.
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+export const RELAY_PREF_FILE = 'relay-pref.json';
+export function relayPrefPath(dataDir) {
+  return join(dataDir, RELAY_PREF_FILE);
+}
+// Should the relay run? Pure — no clock, no I/O, no env.
+//
+//   relayUrl : the configured relay endpoint ('' / undefined = none built in)
+//   pref     : the user's saved choice (true | false | null when never set)
+//
+// Default is ON: a fresh install gets remote access, because that is the
+// product. Only an explicit `false` turns it off, so a corrupt or missing
+// preference file can never silently disable the feature.
+export function resolveRelayEnabled({ relayUrl, pref } = {}) {
+  if (!relayUrl) return false;
+  return pref !== false;
+}
+// Read the saved preference. Returns null when the user has never chosen, so
+// callers can tell "unset" from "explicitly on" — resolveRelayEnabled treats
+// both as on, but the UI may want to say so differently.
+export function readRelayPref(dataDir) {
+  try {
+    const raw = JSON.parse(readFileSync(relayPrefPath(dataDir), 'utf8'));
+    return typeof raw?.enabled === 'boolean' ? raw.enabled : null;
+  } catch {
+    return null; // never set, unreadable, or corrupt — all mean "no choice made"
+  }
+}
+// Save the preference. Throws on a real write failure so the endpoint can
+// report it rather than telling the user it saved something it did not.
+export function writeRelayPref(dataDir, enabled) {
+  const value = enabled === true;
+  writeFileSync(relayPrefPath(dataDir), JSON.stringify({ enabled: value, at: Date.now() }) + '\n');
+  return value;
+}

package/engine/server.mjs CHANGED Viewed

@@ -20,10 +20,11 @@ import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
-import { needsProjectFolder, folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse, isCommandOnPath, hostReadiness, parseRequestedWorkspaceDir } from './lib.mjs';
+import { folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse, isCommandOnPath, hostReadiness, parseRequestedWorkspaceDir } from './lib.mjs';
 import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, classifyWorkerFailure, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildReviewAttemptLedger, latestGoalOutcomeTask, buildDirtyWorkspacePrBlock, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, rebasePreviewUrl, shouldCreateGoalPR, normalizePullRequestUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, buildQueueWaits, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, autoFoldReviewsEnabled, parseGitUnifiedDiffLocations, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyPrSafety, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildVerificationInfraError, verificationInfraErrorFrom, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, testFailureReason, manualTestRetryPrompt, isNothingVerifiable, isNothingVerifiableForPR, isSuspiciouslyIncompleteDone, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, shouldUsePlannerForGoal, RUN_DECL_FILE, REQUIREMENT_EVIDENCE_FILE, parseRequirementEvidenceDocument, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, buildGoalMessage, serializeGoalMessage, parseGoalMessages, computeInternalQualityMetrics, classifyInternalQualityTaskError, resolveWorkspaceMode, goalSessionFor, setGoalAgentSession, switchGoalAgentSession, parseApprovalRequest } from './lib.mjs';
 import { migrateRequirementModel, validateRequirementModel } from './requirement-model.mjs';
 import { buildManagerVerificationChecks, buildRequirementVerificationEvidence, mergeRequirementVerificationEvidence } from './requirement-verification.mjs';
+import { readRelayPref, writeRelayPref, resolveRelayEnabled } from './relay-pref.mjs';
 import { createSerialQueue } from './lib.mjs';
 import { wantsPullRequest } from './lib.mjs';
 import { parseRequirementEvidence, unmappedChangedFiles, previewOpensSomethingElse } from './lib.mjs';
@@ -957,6 +958,26 @@ function addGoalMessage(goal, { from, via, text, at } = {}) {
   saveGoal(goal);
   return msg;
 }
+// The agent's first words back, put where a person looks for an answer.
+//
+// A request used to produce nothing that reads as a reply until the run ended —
+// minutes later. The output was never missing (every tool call streams into the
+// run log), but the run log is a log: `✎ …` lines clipped to 110 characters,
+// interleaved with `Edit app.js`. Masa's friend sent one message and waited three
+// minutes for something that never came, because the thing that came did not look
+// like an answer.
+//
+// So the FIRST thing the worker says on a run is recorded as its message on the
+// goal, verbatim — the same place its final report already lands. Galda writes
+// nothing of its own here and picks nothing: what to open with is the agent's
+// choice, and this only carries it.
+const workerOpenedWith = new Set();
+function sayFromWorker(goal, task, text) {
+  if (!goal || !task || workerOpenedWith.has(task.id)) return;
+  workerOpenedWith.add(task.id);
+  addGoalMessage(goal, { from: 'ai', via: task.reply ? 'thread' : 'composer', text });
+}
 function readGoalMessages(goalId) {
   try { return parseGoalMessages(readFileSync(goalMessagesFile(goalId), 'utf8')); }
   catch { return []; }
@@ -1270,7 +1291,7 @@ function sendTodos(t, todos) {
 }
 // ---- claude helpers --------------------------------------------------------
-function runClaude({ prompt, cwd, tools, onEvent, onTodos, resume, model, effort, permissionMode = 'acceptEdits', onChild }) {
+function runClaude({ prompt, cwd, tools, onEvent, onTodos, onSay, resume, model, effort, permissionMode = 'acceptEdits', onChild }) {
   return new Promise((done) => {
     const args = [
       '-p', prompt,
@@ -1298,6 +1319,13 @@ function runClaude({ prompt, cwd, tools, onEvent, onTodos, resume, model, effort
           if (ev.kind === 'result') { result = ev.text; usage = ev.usage; }
           else if (ev.kind === 'session') sessionId = ev.id;
           else if (ev.kind === 'todos') onTodos?.(ev.todos);
+          else if (ev.kind === 'say') {
+            // Two things from one event: the short line the run log has always
+            // shown, and the words themselves, so the caller can put the first
+            // ones in front of the person as an actual reply.
+            const short = `✎ ${ev.text.replace(/\s+/g, ' ').slice(0, 110)}`;
+            lastAct = short; onEvent?.(short); onSay?.(ev.text);
+          }
           else { if (ev.text?.trim()) lastAct = ev.text.trim(); onEvent?.(ev.text); }
         }
       }
@@ -1313,7 +1341,7 @@ function runClaude({ prompt, cwd, tools, onEvent, onTodos, resume, model, effort
 // The Codex half of the worker bridge. Same contract as runClaude, because
 // nothing downstream may care which agent ran: live activity, the agent's own
 // to-dos (the board), the thread id to talk to it again, usage, final message.
-function runCodex({ prompt, cwd, onEvent, onTodos, resume, permissionMode = 'acceptEdits', model, effort, images, onChild }) {
+function runCodex({ prompt, cwd, onEvent, onTodos, onSay, resume, permissionMode = 'acceptEdits', model, effort, images, onChild }) {
   return new Promise((done) => {
     const sandbox = permissionMode === 'plan' ? 'read-only' : 'workspace-write';
     const args = buildCodexArgs({ model: workerModel('codex', model), effort: workerEffort('codex', effort), sandbox, cwd, resume, images });
@@ -1342,6 +1370,7 @@ function runCodex({ prompt, cwd, onEvent, onTodos, resume, permissionMode = 'acc
           else if (ev.kind === 'message') {
             result = ev.text;
             onEvent?.(`✎ ${ev.text.trim().replace(/\s+/g, ' ').slice(0, 500)}`);
+            onSay?.(ev.text);
           } else if (ev.kind === 'error') {
             err += `${ev.text}\n`;
             onEvent?.(`Error ${ev.text}`);
@@ -3003,6 +3032,7 @@ async function runTask(task) {
       model: runModel, effort: runEffort, onEvent: (line) => sendAct(task, line),
       images: goal?.images,
       onTodos: (todos) => sendTodos(task, todos),
+      onSay: (text) => sayFromWorker(goal, task, text),
       onChild: (c) => trackGoalWorker(goal?.id, c),
     });
     if (goal?.cancelled) return; // goal deleted mid-run → don't resurrect the task / run the gate
@@ -3092,6 +3122,7 @@ async function runTask(task) {
       model: runModel, effort: runEffort, onEvent: (line) => sendAct(task, line),
       images: goal?.images,
       onTodos: (todos) => sendTodos(task, todos),
+      onSay: (text) => sayFromWorker(goal, task, text),
       onChild: (c) => trackGoalWorker(goal?.id, c),
     });
     if (goal?.cancelled) return; // deleted mid-run → stop, don't run verify/PR
@@ -3121,6 +3152,7 @@ async function runTask(task) {
         model: runModel, effort: runEffort, onEvent: (line) => sendAct(task, line),
         images: goal?.images,
         onTodos: (todos) => sendTodos(task, todos),
+      onSay: (text) => sayFromWorker(goal, task, text),
         onChild: (c) => trackGoalWorker(goal?.id, c),
       });
       if (goal?.cancelled) return;
@@ -4436,6 +4468,41 @@ const server = createServer(async (req, res) => {
     catch (e) { return json(res, 500, { error: String(e?.message ?? e) }); }
     return json(res, 200, { ok: true });
   }
+  // GET/POST /api/relay-pref — the remote-access switch in Settings.
+  // Remote access (the relay) is ON by default. Turning it off is the
+  // discoverable form of `RELAY_URL= npx @galda/cli`: with it off no outbound
+  // socket is opened and nothing your board displays crosses our server
+  // (docs/SECURITY.md). The launcher owns the relay child in ANOTHER process,
+  // so we persist the choice to a file it watches — same shape as
+  // relay-takeover.req above.
+  if (url.pathname === '/api/relay-pref' && req.method === 'GET') {
+    const pref = readRelayPref(DATA_DIR);
+    return json(res, 200, {
+      pref,
+      enabled: resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref }),
+      configured: Boolean(process.env.RELAY_URL),
+    });
+  }
+  if (url.pathname === '/api/relay-pref' && req.method === 'POST') {
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      let input;
+      try { input = JSON.parse(body || '{}'); } catch { return json(res, 400, { error: 'bad json' }); }
+      // A boolean and nothing else. "off"/0/undefined are how a security
+      // setting silently becomes the opposite of what was clicked.
+      if (typeof input?.enabled !== 'boolean') return json(res, 400, { error: 'enabled must be a boolean' });
+      let saved;
+      try { saved = writeRelayPref(DATA_DIR, input.enabled); }
+      catch (e) { return json(res, 500, { error: String(e?.message ?? e) }); }
+      return json(res, 200, {
+        pref: saved,
+        enabled: resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref: saved }),
+        configured: Boolean(process.env.RELAY_URL),
+      });
+    });
+    return;
+  }
   // POST /api/signout — forget the local license so the settings panel can
   // offer a plain "Log out" instead of requiring the `--signin` CLI flag to
   // switch Google accounts. Clears the on-disk token and the in-memory cache;
@@ -4672,19 +4739,21 @@ const server = createServer(async (req, res) => {
       try {
         const input = JSON.parse(body || '{}');
         if (typeof input.name === 'string' && input.name.trim()) project.name = input.name.trim().slice(0, 80);
-        // Moving a project to another folder. Refused loudly when the path is not
-        // somewhere work can happen: a folder that does not exist, or is HOME itself,
-        // or is not a git repository. Accepting it here would look like it worked and
-        // then fail silently on the next goal — the worst of the two failures, and the
-        // reason the "which folder?" card exists at all.
+        // Moving a project to another folder. The only thing refused is a folder
+        // that is not there — a path with nothing behind it is a typo, and every
+        // later failure would be reported somewhere far away from the mistake.
+        //
+        // "Not a git repository" used to be refused here too. It is not our call
+        // (Masa 2026-07-31): `claude -p` in a plain folder simply works, and a
+        // person who points Galda at one has said what they want. Such a folder
+        // gets no isolated worktree and can produce no pull request; that is a
+        // property of the folder, said where those things happen, not a reason to
+        // reject the choice.
         if (input.dir !== undefined) {
           const dir = String(input.dir ?? '').trim();
           if (!dir) return json(res, 400, { error: 'folder is required' });
           const abs = dir.startsWith('~') ? join(HOME, dir.slice(1)) : resolve(dir);
           if (!existsSync(abs)) return json(res, 400, { error: 'no such folder', dir: abs });
-          if (needsProjectFolder({ dir: abs, homeDir: HOME, isRepo: isGitRepo(abs) })) {
-            return json(res, 400, { error: 'not a git repository', dir: abs });
-          }
           project.dir = abs;
         }
         saveProjects();
@@ -4823,24 +4892,30 @@ const server = createServer(async (req, res) => {
         // no PR) — the reviewer just Approves (files it) or Dismisses (drops
         // it). This is how "needs my judgment" reaches the phone without kicking
         // off an implementation run.
-        // Onboarding funnel (docs/HANDOFF-ONBOARDING-conversational.md): a real
-        // implementation goal can only produce changes inside a real code repo.
-        // If the active project points at a non-repo (e.g. the HOME dir when the
-        // agent was started ad-hoc), running would no-op — nothing to edit — yet
-        // report "done". Instead of that fake "fixed", ask which folder first,
-        // reusing the needsInput clarifying card; the answer (POST /answer)
-        // rebinds this goal to the chosen repo, then planning proceeds. Skipped
-        // for pending/review items (they never spawn a worker).
+        // No folder question (Masa 2026-07-31: "フォルダは先に聞かないでいい…選びたい
+        // 人が選べばいい", and asked for parity with Claude Code, which was then
+        // measured: `claude -p` in a non-git folder just runs — it never asks which
+        // folder and never git-inits one).
+        //
+        // The first thing a new person met used to be an interrogation: which
+        // folder, then whether they wanted PRs, before a single word of their
+        // request was acted on. The folder half is gone. The folder is whatever
+        // the CLI was started in, shown on the composer chip, and changeable
+        // there by anyone who cares — which is the only place it was ever a real
+        // choice rather than a toll gate.
+        //
+        // The old worry (a non-repo folder means the worker edits nothing and we
+        // still say "done") is not answered by asking, and never was: goalWorkDir
+        // already falls back to the project folder itself when there is no git
+        // repo to cut a worktree from, so the work happens where the person is
+        // looking, exactly as Claude Code does. What such a folder cannot do is
+        // produce a pull request, and that is stated where PRs are decided, not
+        // guarded here.
         const runnable = !pending && !review && !approval;
-        const needsFolder = runnable && needsProjectFolder({ dir: project.dir, homeDir: HOME, isRepo: isGitRepo(project.dir) });
         const lang = /[぀-ヿ㐀-鿿]/.test(text) ? 'ja' : 'en';
-        const folderQuestion = needsFolder ? buildFolderQuestion(detectRepos(HOME), { lang }) : undefined;
-        // Task 5 (PR運用ヒアリング): once the folder is settled, ask — once per
-        // project, before its first runnable goal — whether this project wants
-        // PRs. Skipped this round if a folder question already claimed the
-        // needsInput slot; that goal gets rebound to a real repo via /answer
-        // and the NEXT goal for that project is what actually asks this.
-        const needsReviewPref = runnable && !needsFolder && needsReviewPreference({ askedBefore: project.reviewPrefAsked });
+        // Task 5 (PR運用ヒアリング): ask — once per project, before its first
+        // runnable goal — whether this project wants PRs.
+        const needsReviewPref = runnable && needsReviewPreference({ askedBefore: project.reviewPrefAsked });
         const reviewPrefQuestion = needsReviewPref ? buildReviewPreferenceQuestion({ lang }) : undefined;
         if (needsReviewPref) { project.reviewPrefAsked = true; saveProjects(); }
         // Clamp to whatever agent CLIs are actually installed on this machine
@@ -4856,8 +4931,8 @@ const server = createServer(async (req, res) => {
         if (review && existingPr && !importedPr) return json(res, 400, { error: 'existingPr must be a GitHub pull request URL' });
         const goal = {
           id: nextId++, projectId, text: text.trim().slice(0, 8000),
-          status: (needsFolder || needsReviewPref) ? 'needsInput' : approval ? 'needsApproval' : review ? 'review' : pending ? 'pending' : 'stacked',
-          question: folderQuestion || reviewPrefQuestion,
+          status: needsReviewPref ? 'needsInput' : approval ? 'needsApproval' : review ? 'review' : pending ? 'pending' : 'stacked',
+          question: reviewPrefQuestion,
           pauseReason: approval ? 'approval_required' : undefined,
           approvalRequest: approval ? {
             type: 'approval_required',
@@ -4911,7 +4986,7 @@ const server = createServer(async (req, res) => {
         // pending = deliberately shelved (Phase 2 material): never planned,
         // never queued, until POST /api/goals/:id/activate. review-only items
         // are terminal-until-human too, so they also skip planGoal.
-        if (runnable && !needsFolder && !needsReviewPref) startNextStacked(goal.projectId);
+        if (runnable && !needsReviewPref) startNextStacked(goal.projectId);
         json(res, 200, goal);
       } catch { json(res, 400, { error: 'bad json' }); }
     });
@@ -5991,7 +6066,11 @@ async function answerGoalQuestion(goal, question) {
         const handoffText = crossProject ? [
           `[Cross-project implementation handoff from #${goal.id}]`,
           `Original request: ${goal.text}`,
-          goal.reviewSummary?.summary ? `Reviewed result: ${goal.reviewSummary.summary}` : '',
+          // `.changed` is the reviewed result — summarizeForReview returns
+          // {title, check, changed} and never a `.summary`, so this line read a
+          // key that has never existed and dropped out of every handoff. The
+          // digest builder above already spells it `g.reviewSummary?.changed`.
+          goal.reviewSummary?.changed ? `Reviewed result: ${goal.reviewSummary.changed}` : '',
           latest?.result ? `Latest worker result: ${String(latest.result).slice(0, 3000)}` : '',
           `User's implementation request: ${text}`,
         ].filter(Boolean).join('\n\n') : text;

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.113",
+  "version": "0.10.115",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {
@@ -11,7 +11,7 @@
     "puppeteer-core": "^23.11.1",
     "ws": "^8.21.0"
   },
-  "license": "UNLICENSED",
+  "license": "SEE LICENSE IN LICENSE.md",
   "bin": {
     "cli": "bin/manager-for-ai.mjs",
     "galda": "bin/manager-for-ai.mjs",
@@ -26,6 +26,8 @@
     "SKILL.md",
     ".mcp.json",
     "README.md",
+    "LICENSE.md",
+    "docs/SECURITY.md",
     "CLAUDE.md",
     "!engine/chat-runs",
     "!engine/test",
@@ -41,10 +43,6 @@
   "engines": {
     "node": ">=20"
   },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/kodo-inc/agent-manager.git"
-  },
   "keywords": [
     "claude",
     "claude-code",
@@ -53,5 +51,9 @@
     "manager",
     "verification",
     "proof"
-  ]
+  ],
+  "homepage": "https://galda.app",
+  "bugs": {
+    "url": "https://galda.app/support"
+  }
 }