@galda/cli 0.10.114 → 0.10.116

package/engine/lib.mjs

@@ -897,7 +897,14 @@ export function parseStreamEvents(line) {
       const arg = i.file_path ?? i.path ?? i.pattern ?? i.command ?? i.url ?? i.query ?? '';
       out.push({ kind: 'activity', text: `${p.name} ${String(arg)}`.trim().slice(0, 140) });
     } else if (p.type === 'text' && p.text?.trim()) {
-      out.push({ kind: 'activity', text: `✎ ${p.text.trim().replace(/\s+/g, ' ').slice(0, 110)}` });
+      // The worker talking, as opposed to the worker working. It was flattened
+      // into the same ✎-prefixed, 110-char activity line as every tool call,
+      // which is why a person who sent a request sat watching a tool log with
+      // nothing in it that reads as an answer (Masa's friend, 2026-07-31: three
+      // minutes and "no reply"). Kept whole and kept separate here; the caller
+      // still writes the short activity line, and can also show the first one as
+      // what it is — the agent's first words back.
+      out.push({ kind: 'say', text: p.text.trim() });
     }
   }
   return out;
@@ -4858,20 +4865,14 @@ export function shouldEmitSetupCompleted({ isMcpClient, alreadySeen, flagExists
   return Boolean(isMcpClient) && !alreadySeen && !flagExists;
 }
 
-// Onboarding funnel: a goal can only produce real changes if it runs inside a
-// real code repo. When the agent is started ad-hoc (e.g. `node bin/...` in the
-// user's HOME), the seeded default project points at a non-repo dir → the
-// worker no-ops (nothing to edit) yet the goal is marked "done" — the exact
-// blocker for "実装が始まる". This decides, BEFORE running, whether we must ask
-// the user which folder to work in. `isRepo` is passed in (the git probe is
-// I/O, done by the caller) so this stays pure/testable. Home is never a valid
-// work root — even a git-init'd home dir is "no project chosen yet".
-export function needsProjectFolder({ dir, homeDir, isRepo } = {}) {
-  if (!dir) return true;
-  const norm = (p) => String(p).replace(/\/+$/, '');
-  if (homeDir && norm(dir) === norm(homeDir)) return true;
-  return !isRepo;
-}
+// `needsProjectFolder` lived here until 2026-07-31. It decided, before running,
+// that a folder was not good enough to work in (HOME, or not a git repo) and
+// that the person had to answer a question first. Masa removed the question:
+// `claude -p` in a plain folder simply works — measured — so Galda asking is a
+// toll gate of our own invention, and the folder is now whatever the CLI was
+// started in, changeable on the composer chip by whoever cares. The builders
+// below stay: an install that was mid-question when it updated must still be
+// able to answer the one it already has.
 
 // The repo's own name: the last segment of its path. The composer chip prints this and
 // the folder menu prints it again on every row, so it lives here as one function — two
@@ -5354,6 +5355,67 @@ export function shouldEscalateConnectGateHint(waitedMs, email, thresholdMs = 150
 // for this" signal is a concrete MANAGER_PORT: the launcher (bin/manager-for-ai
 // .mjs) resolves a real port BEFORE spawn, while every ephemeral spawn uses
 // MANAGER_PORT=0 (OS-assigned). So port 0 is never a browser-opening boot.
+// What the terminal says when Galda starts.
+//
+// It used to say one log line among several — `[manager] Manager for AI →
+// http://localhost:4400/?key=…` — and then open a tab in the background, in
+// whatever browser the machine calls default. Masa's friend never saw that tab
+// (2026-07-31): it opened behind their windows in a browser they do not use, and
+// nothing on screen told them where their own copy of Galda was. The address is
+// the one thing a person needs, so it gets its own line and an instruction, and
+// the auto-opened tab is described as what it is — a convenience that may have
+// missed.
+//
+// Three destinations, and the wording differs because the links differ:
+//   local  — http://localhost:PORT/?key=…  safe to paste anywhere on this Mac,
+//            in any browser, as often as you like.
+//   app    — the hosted app; already signed in.
+//   signin — a ONE-TIME sign-in link. Which browser it is opened in decides
+//            which browser ends up signed in, so that choice is stated before
+//            it is made rather than explained afterwards in a 400 page.
+// WHERE this install's Galda actually is. Decided from how it was installed, not
+// from whether a browser could be opened: `npx @galda/cli` configures the billing
+// + app URLs and those people live in the hosted app, while the localhost ?key
+// board is the entry only for local/dev. Reading this off the auto-open branch
+// (as the first version of the banner did) told a hosted user on Linux — or
+// anyone with MANAGER_OPEN_BROWSER=0 — to open a localhost board with an access
+// key, which the hosted flow has always refused to do.
+export function bootDestination({ hosted, signedIn, localUrl, appUrl, signinUrl } = {}) {
+  if (!hosted) return { url: String(localUrl ?? ''), mode: 'local' };
+  return signedIn
+    ? { url: String(appUrl ?? ''), mode: 'app' }
+    : { url: String(signinUrl ?? ''), mode: 'signin' };
+}
+
+export function bootBanner({ url, mode = 'local', opened = false } = {}) {
+  const address = String(url ?? '');
+  if (!address) return [];
+  const head = {
+    local: 'Galda is running. Open this in your browser:',
+    app: 'Galda is running. Open your board:',
+    signin: 'Galda is running. Sign in to continue — open this in the browser you want to use Galda in:',
+  }[mode] ?? 'Galda is running. Open this in your browser:';
+  const foot = {
+    local: 'Paste it into any browser on this Mac — the key is part of the address.',
+    app: 'Paste it into any browser you are signed in to.',
+    signin: 'This link works once. Whichever browser opens it is the one that ends up signed in.',
+  }[mode];
+  return [
+    '',
+    `  ${head}`,
+    '',
+    `      ${address}`,
+    '',
+    `  ${foot}`,
+    // Said even when we opened a tab — especially then, for a sign-in link:
+    // the tab we opened is what chose the browser, and the person may not have
+    // seen it happen.
+    ...(opened ? ['  (A tab may already have opened in your default browser. If you did not see it,'
+      + ' or you use a different browser, use the address above.)'] : []),
+    '',
+  ];
+}
+
 export function shouldOpenBrowserOnBoot({ openBrowser, platform, managerPort } = {}) {
   if (String(openBrowser) !== '1') return false;
   if (platform !== 'darwin') return false;

package/engine/server.mjs

@@ -20,7 +20,7 @@ import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
-import { needsProjectFolder, folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse, isCommandOnPath, hostReadiness, parseRequestedWorkspaceDir } from './lib.mjs';
+import { bootBanner, bootDestination, folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse, isCommandOnPath, hostReadiness, parseRequestedWorkspaceDir } from './lib.mjs';
 import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, classifyWorkerFailure, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildReviewAttemptLedger, latestGoalOutcomeTask, buildDirtyWorkspacePrBlock, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, rebasePreviewUrl, shouldCreateGoalPR, normalizePullRequestUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, buildQueueWaits, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, autoFoldReviewsEnabled, parseGitUnifiedDiffLocations, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyPrSafety, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildVerificationInfraError, verificationInfraErrorFrom, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, testFailureReason, manualTestRetryPrompt, isNothingVerifiable, isNothingVerifiableForPR, isSuspiciouslyIncompleteDone, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, shouldUsePlannerForGoal, RUN_DECL_FILE, REQUIREMENT_EVIDENCE_FILE, parseRequirementEvidenceDocument, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, buildGoalMessage, serializeGoalMessage, parseGoalMessages, computeInternalQualityMetrics, classifyInternalQualityTaskError, resolveWorkspaceMode, goalSessionFor, setGoalAgentSession, switchGoalAgentSession, parseApprovalRequest } from './lib.mjs';
 import { migrateRequirementModel, validateRequirementModel } from './requirement-model.mjs';
 import { buildManagerVerificationChecks, buildRequirementVerificationEvidence, mergeRequirementVerificationEvidence } from './requirement-verification.mjs';
@@ -958,6 +958,26 @@ function addGoalMessage(goal, { from, via, text, at } = {}) {
   saveGoal(goal);
   return msg;
 }
+// The agent's first words back, put where a person looks for an answer.
+//
+// A request used to produce nothing that reads as a reply until the run ended —
+// minutes later. The output was never missing (every tool call streams into the
+// run log), but the run log is a log: `✎ …` lines clipped to 110 characters,
+// interleaved with `Edit app.js`. Masa's friend sent one message and waited three
+// minutes for something that never came, because the thing that came did not look
+// like an answer.
+//
+// So the FIRST thing the worker says on a run is recorded as its message on the
+// goal, verbatim — the same place its final report already lands. Galda writes
+// nothing of its own here and picks nothing: what to open with is the agent's
+// choice, and this only carries it.
+const workerOpenedWith = new Set();
+function sayFromWorker(goal, task, text) {
+  if (!goal || !task || workerOpenedWith.has(task.id)) return;
+  workerOpenedWith.add(task.id);
+  addGoalMessage(goal, { from: 'ai', via: task.reply ? 'thread' : 'composer', text });
+}
+
 function readGoalMessages(goalId) {
   try { return parseGoalMessages(readFileSync(goalMessagesFile(goalId), 'utf8')); }
   catch { return []; }
@@ -1271,7 +1291,7 @@ function sendTodos(t, todos) {
 }
 
 // ---- claude helpers --------------------------------------------------------
-function runClaude({ prompt, cwd, tools, onEvent, onTodos, resume, model, effort, permissionMode = 'acceptEdits', onChild }) {
+function runClaude({ prompt, cwd, tools, onEvent, onTodos, onSay, resume, model, effort, permissionMode = 'acceptEdits', onChild }) {
   return new Promise((done) => {
     const args = [
       '-p', prompt,
@@ -1299,6 +1319,13 @@ function runClaude({ prompt, cwd, tools, onEvent, onTodos, resume, model, effort
           if (ev.kind === 'result') { result = ev.text; usage = ev.usage; }
           else if (ev.kind === 'session') sessionId = ev.id;
           else if (ev.kind === 'todos') onTodos?.(ev.todos);
+          else if (ev.kind === 'say') {
+            // Two things from one event: the short line the run log has always
+            // shown, and the words themselves, so the caller can put the first
+            // ones in front of the person as an actual reply.
+            const short = `✎ ${ev.text.replace(/\s+/g, ' ').slice(0, 110)}`;
+            lastAct = short; onEvent?.(short); onSay?.(ev.text);
+          }
           else { if (ev.text?.trim()) lastAct = ev.text.trim(); onEvent?.(ev.text); }
         }
       }
@@ -1314,7 +1341,7 @@ function runClaude({ prompt, cwd, tools, onEvent, onTodos, resume, model, effort
 // The Codex half of the worker bridge. Same contract as runClaude, because
 // nothing downstream may care which agent ran: live activity, the agent's own
 // to-dos (the board), the thread id to talk to it again, usage, final message.
-function runCodex({ prompt, cwd, onEvent, onTodos, resume, permissionMode = 'acceptEdits', model, effort, images, onChild }) {
+function runCodex({ prompt, cwd, onEvent, onTodos, onSay, resume, permissionMode = 'acceptEdits', model, effort, images, onChild }) {
   return new Promise((done) => {
     const sandbox = permissionMode === 'plan' ? 'read-only' : 'workspace-write';
     const args = buildCodexArgs({ model: workerModel('codex', model), effort: workerEffort('codex', effort), sandbox, cwd, resume, images });
@@ -1343,6 +1370,7 @@ function runCodex({ prompt, cwd, onEvent, onTodos, resume, permissionMode = 'acc
           else if (ev.kind === 'message') {
             result = ev.text;
             onEvent?.(`✎ ${ev.text.trim().replace(/\s+/g, ' ').slice(0, 500)}`);
+            onSay?.(ev.text);
           } else if (ev.kind === 'error') {
             err += `${ev.text}\n`;
             onEvent?.(`Error ${ev.text}`);
@@ -3004,6 +3032,7 @@ async function runTask(task) {
       model: runModel, effort: runEffort, onEvent: (line) => sendAct(task, line),
       images: goal?.images,
       onTodos: (todos) => sendTodos(task, todos),
+      onSay: (text) => sayFromWorker(goal, task, text),
       onChild: (c) => trackGoalWorker(goal?.id, c),
     });
     if (goal?.cancelled) return; // goal deleted mid-run → don't resurrect the task / run the gate
@@ -3093,6 +3122,7 @@ async function runTask(task) {
       model: runModel, effort: runEffort, onEvent: (line) => sendAct(task, line),
       images: goal?.images,
       onTodos: (todos) => sendTodos(task, todos),
+      onSay: (text) => sayFromWorker(goal, task, text),
       onChild: (c) => trackGoalWorker(goal?.id, c),
     });
     if (goal?.cancelled) return; // deleted mid-run → stop, don't run verify/PR
@@ -3122,6 +3152,7 @@ async function runTask(task) {
         model: runModel, effort: runEffort, onEvent: (line) => sendAct(task, line),
         images: goal?.images,
         onTodos: (todos) => sendTodos(task, todos),
+      onSay: (text) => sayFromWorker(goal, task, text),
         onChild: (c) => trackGoalWorker(goal?.id, c),
       });
       if (goal?.cancelled) return;
@@ -4708,19 +4739,21 @@ const server = createServer(async (req, res) => {
       try {
         const input = JSON.parse(body || '{}');
         if (typeof input.name === 'string' && input.name.trim()) project.name = input.name.trim().slice(0, 80);
-        // Moving a project to another folder. Refused loudly when the path is not
-        // somewhere work can happen: a folder that does not exist, or is HOME itself,
-        // or is not a git repository. Accepting it here would look like it worked and
-        // then fail silently on the next goal — the worst of the two failures, and the
-        // reason the "which folder?" card exists at all.
+        // Moving a project to another folder. The only thing refused is a folder
+        // that is not there — a path with nothing behind it is a typo, and every
+        // later failure would be reported somewhere far away from the mistake.
+        //
+        // "Not a git repository" used to be refused here too. It is not our call
+        // (Masa 2026-07-31): `claude -p` in a plain folder simply works, and a
+        // person who points Galda at one has said what they want. Such a folder
+        // gets no isolated worktree and can produce no pull request; that is a
+        // property of the folder, said where those things happen, not a reason to
+        // reject the choice.
         if (input.dir !== undefined) {
           const dir = String(input.dir ?? '').trim();
           if (!dir) return json(res, 400, { error: 'folder is required' });
           const abs = dir.startsWith('~') ? join(HOME, dir.slice(1)) : resolve(dir);
           if (!existsSync(abs)) return json(res, 400, { error: 'no such folder', dir: abs });
-          if (needsProjectFolder({ dir: abs, homeDir: HOME, isRepo: isGitRepo(abs) })) {
-            return json(res, 400, { error: 'not a git repository', dir: abs });
-          }
           project.dir = abs;
         }
         saveProjects();
@@ -4859,24 +4892,30 @@ const server = createServer(async (req, res) => {
         // no PR) — the reviewer just Approves (files it) or Dismisses (drops
         // it). This is how "needs my judgment" reaches the phone without kicking
         // off an implementation run.
-        // Onboarding funnel (docs/HANDOFF-ONBOARDING-conversational.md): a real
-        // implementation goal can only produce changes inside a real code repo.
-        // If the active project points at a non-repo (e.g. the HOME dir when the
-        // agent was started ad-hoc), running would no-op — nothing to edit — yet
-        // report "done". Instead of that fake "fixed", ask which folder first,
-        // reusing the needsInput clarifying card; the answer (POST /answer)
-        // rebinds this goal to the chosen repo, then planning proceeds. Skipped
-        // for pending/review items (they never spawn a worker).
+        // No folder question (Masa 2026-07-31: "フォルダは先に聞かないでいい…選びたい
+        // 人が選べばいい", and asked for parity with Claude Code, which was then
+        // measured: `claude -p` in a non-git folder just runs — it never asks which
+        // folder and never git-inits one).
+        //
+        // The first thing a new person met used to be an interrogation: which
+        // folder, then whether they wanted PRs, before a single word of their
+        // request was acted on. The folder half is gone. The folder is whatever
+        // the CLI was started in, shown on the composer chip, and changeable
+        // there by anyone who cares — which is the only place it was ever a real
+        // choice rather than a toll gate.
+        //
+        // The old worry (a non-repo folder means the worker edits nothing and we
+        // still say "done") is not answered by asking, and never was: goalWorkDir
+        // already falls back to the project folder itself when there is no git
+        // repo to cut a worktree from, so the work happens where the person is
+        // looking, exactly as Claude Code does. What such a folder cannot do is
+        // produce a pull request, and that is stated where PRs are decided, not
+        // guarded here.
         const runnable = !pending && !review && !approval;
-        const needsFolder = runnable && needsProjectFolder({ dir: project.dir, homeDir: HOME, isRepo: isGitRepo(project.dir) });
         const lang = /[぀-ヿ㐀-鿿]/.test(text) ? 'ja' : 'en';
-        const folderQuestion = needsFolder ? buildFolderQuestion(detectRepos(HOME), { lang }) : undefined;
-        // Task 5 (PR運用ヒアリング): once the folder is settled, ask — once per
-        // project, before its first runnable goal — whether this project wants
-        // PRs. Skipped this round if a folder question already claimed the
-        // needsInput slot; that goal gets rebound to a real repo via /answer
-        // and the NEXT goal for that project is what actually asks this.
-        const needsReviewPref = runnable && !needsFolder && needsReviewPreference({ askedBefore: project.reviewPrefAsked });
+        // Task 5 (PR運用ヒアリング): ask — once per project, before its first
+        // runnable goal — whether this project wants PRs.
+        const needsReviewPref = runnable && needsReviewPreference({ askedBefore: project.reviewPrefAsked });
         const reviewPrefQuestion = needsReviewPref ? buildReviewPreferenceQuestion({ lang }) : undefined;
         if (needsReviewPref) { project.reviewPrefAsked = true; saveProjects(); }
         // Clamp to whatever agent CLIs are actually installed on this machine
@@ -4892,8 +4931,8 @@ const server = createServer(async (req, res) => {
         if (review && existingPr && !importedPr) return json(res, 400, { error: 'existingPr must be a GitHub pull request URL' });
         const goal = {
           id: nextId++, projectId, text: text.trim().slice(0, 8000),
-          status: (needsFolder || needsReviewPref) ? 'needsInput' : approval ? 'needsApproval' : review ? 'review' : pending ? 'pending' : 'stacked',
-          question: folderQuestion || reviewPrefQuestion,
+          status: needsReviewPref ? 'needsInput' : approval ? 'needsApproval' : review ? 'review' : pending ? 'pending' : 'stacked',
+          question: reviewPrefQuestion,
           pauseReason: approval ? 'approval_required' : undefined,
           approvalRequest: approval ? {
             type: 'approval_required',
@@ -4947,7 +4986,7 @@ const server = createServer(async (req, res) => {
         // pending = deliberately shelved (Phase 2 material): never planned,
         // never queued, until POST /api/goals/:id/activate. review-only items
         // are terminal-until-human too, so they also skip planGoal.
-        if (runnable && !needsFolder && !needsReviewPref) startNextStacked(goal.projectId);
+        if (runnable && !needsReviewPref) startNextStacked(goal.projectId);
         json(res, 200, goal);
       } catch { json(res, 400, { error: 'bad json' }); }
     });
@@ -6027,7 +6066,11 @@ async function answerGoalQuestion(goal, question) {
         const handoffText = crossProject ? [
           `[Cross-project implementation handoff from #${goal.id}]`,
           `Original request: ${goal.text}`,
-          goal.reviewSummary?.summary ? `Reviewed result: ${goal.reviewSummary.summary}` : '',
+          // `.changed` is the reviewed result — summarizeForReview returns
+          // {title, check, changed} and never a `.summary`, so this line read a
+          // key that has never existed and dropped out of every handoff. The
+          // digest builder above already spells it `g.reviewSummary?.changed`.
+          goal.reviewSummary?.changed ? `Reviewed result: ${goal.reviewSummary.changed}` : '',
           latest?.result ? `Latest worker result: ${String(latest.result).slice(0, 3000)}` : '',
           `User's implementation request: ${text}`,
         ].filter(Boolean).join('\n\n') : text;
@@ -6261,7 +6304,25 @@ server.listen(PORT, '127.0.0.1', () => {
   }
   PORT = server.address().port; // the OS-assigned one when MANAGER_PORT=0
   try { server6.listen(PORT, '::1'); } catch { /* IPv6 loopback unavailable */ }
-  console.log(`[manager] Manager for AI → http://localhost:${PORT}/?key=${ACCESS_KEY}`);
+  const localUrl = `http://localhost:${PORT}/?key=${ACCESS_KEY}`;
+  // WHERE this person's Galda is depends on how it was installed, not on whether
+  // we managed to open a tab. `npx @galda/cli` sets the billing + app URLs, and
+  // those people live in the hosted app; the localhost ?key board is the entry
+  // only for local/dev (MANAGER_BILLING_API_URL= opt-out, or `npm start` in the
+  // repo). Deciding this from the auto-open branch — as this first did — told a
+  // hosted user on Linux, or anyone with MANAGER_OPEN_BROWSER=0, to open a
+  // localhost board with an access key: the one thing the flow below has always
+  // refused to do.
+  const hostedFlow = Boolean(BILLING_API_URL && APP_URL);
+  const alreadySignedIn = existsSync(licenseFile) && !FORCE_SIGNIN;
+  // buildSigninUrl() also starts the background claim poll — which is exactly
+  // what a person about to open that link by hand needs running, so it is called
+  // only on the branch that will actually show it.
+  const { url: bannerUrl, mode: bannerMode } = bootDestination({
+    hosted: hostedFlow, signedIn: alreadySignedIn, localUrl, appUrl: APP_URL,
+    signinUrl: hostedFlow && !alreadySignedIn ? buildSigninUrl() : '',
+  });
+  let bannerOpened = false;
   if (shouldOpenBrowserOnBoot({ openBrowser: process.env.MANAGER_OPEN_BROWSER, platform: process.platform, managerPort: process.env.MANAGER_PORT })) {
     // Hosted flow (billing worker + named app configured): the user lives in
     // app.galda.app, driven over the relay — they must NEVER be dropped on a
@@ -6270,18 +6331,10 @@ server.listen(PORT, '127.0.0.1', () => {
     // → one-click Google sign-in; already signed in → straight to the app (the
     // board comes alive as relay-client rebinds via its license.token watcher).
     // The localhost ?key board stays the entry ONLY for local/dev (no billing).
-    let openUrl = `http://localhost:${PORT}/?key=${ACCESS_KEY}`;
-    if (BILLING_API_URL && APP_URL) {
-      const signedIn = existsSync(licenseFile) && !FORCE_SIGNIN;
-      openUrl = signedIn
-        ? APP_URL
-        : buildSigninUrl(); // device-flow: also starts the background claim poll
-      console.log(signedIn
-        ? `[manager] opening your app → ${APP_URL}`
-        : `[manager] ${FORCE_SIGNIN ? 'switching account' : 'first run'}: opening one-click sign-in → ${openUrl}`);
-    }
-    spawn('open', ['-g', openUrl], { stdio: 'ignore' }).unref();
+    bannerOpened = true;
+    spawn('open', ['-g', bannerUrl], { stdio: 'ignore' }).unref();
   }
+  for (const line of bootBanner({ url: bannerUrl, mode: bannerMode, opened: bannerOpened })) console.log(line);
   console.log(`[manager] projects: ${projects.map((p) => `${p.id}=${p.dir}`).join('  ')}`);
   if (shouldProbeClaudeAuth(AVAILABLE_AGENTS)) probeWorkerAuth().catch(() => {}); // hold Claude tasks + banner if Claude is unavailable
   setInterval(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.114",
+  "version": "0.10.116",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {