@galda/cli 0.10.115 → 0.10.116

package/engine/lib.mjs

@@ -5355,6 +5355,67 @@ export function shouldEscalateConnectGateHint(waitedMs, email, thresholdMs = 150
 // for this" signal is a concrete MANAGER_PORT: the launcher (bin/manager-for-ai
 // .mjs) resolves a real port BEFORE spawn, while every ephemeral spawn uses
 // MANAGER_PORT=0 (OS-assigned). So port 0 is never a browser-opening boot.
+// What the terminal says when Galda starts.
+//
+// It used to say one log line among several — `[manager] Manager for AI →
+// http://localhost:4400/?key=…` — and then open a tab in the background, in
+// whatever browser the machine calls default. Masa's friend never saw that tab
+// (2026-07-31): it opened behind their windows in a browser they do not use, and
+// nothing on screen told them where their own copy of Galda was. The address is
+// the one thing a person needs, so it gets its own line and an instruction, and
+// the auto-opened tab is described as what it is — a convenience that may have
+// missed.
+//
+// Three destinations, and the wording differs because the links differ:
+//   local  — http://localhost:PORT/?key=…  safe to paste anywhere on this Mac,
+//            in any browser, as often as you like.
+//   app    — the hosted app; already signed in.
+//   signin — a ONE-TIME sign-in link. Which browser it is opened in decides
+//            which browser ends up signed in, so that choice is stated before
+//            it is made rather than explained afterwards in a 400 page.
+// WHERE this install's Galda actually is. Decided from how it was installed, not
+// from whether a browser could be opened: `npx @galda/cli` configures the billing
+// + app URLs and those people live in the hosted app, while the localhost ?key
+// board is the entry only for local/dev. Reading this off the auto-open branch
+// (as the first version of the banner did) told a hosted user on Linux — or
+// anyone with MANAGER_OPEN_BROWSER=0 — to open a localhost board with an access
+// key, which the hosted flow has always refused to do.
+export function bootDestination({ hosted, signedIn, localUrl, appUrl, signinUrl } = {}) {
+  if (!hosted) return { url: String(localUrl ?? ''), mode: 'local' };
+  return signedIn
+    ? { url: String(appUrl ?? ''), mode: 'app' }
+    : { url: String(signinUrl ?? ''), mode: 'signin' };
+}
+
+export function bootBanner({ url, mode = 'local', opened = false } = {}) {
+  const address = String(url ?? '');
+  if (!address) return [];
+  const head = {
+    local: 'Galda is running. Open this in your browser:',
+    app: 'Galda is running. Open your board:',
+    signin: 'Galda is running. Sign in to continue — open this in the browser you want to use Galda in:',
+  }[mode] ?? 'Galda is running. Open this in your browser:';
+  const foot = {
+    local: 'Paste it into any browser on this Mac — the key is part of the address.',
+    app: 'Paste it into any browser you are signed in to.',
+    signin: 'This link works once. Whichever browser opens it is the one that ends up signed in.',
+  }[mode];
+  return [
+    '',
+    `  ${head}`,
+    '',
+    `      ${address}`,
+    '',
+    `  ${foot}`,
+    // Said even when we opened a tab — especially then, for a sign-in link:
+    // the tab we opened is what chose the browser, and the person may not have
+    // seen it happen.
+    ...(opened ? ['  (A tab may already have opened in your default browser. If you did not see it,'
+      + ' or you use a different browser, use the address above.)'] : []),
+    '',
+  ];
+}
+
 export function shouldOpenBrowserOnBoot({ openBrowser, platform, managerPort } = {}) {
   if (String(openBrowser) !== '1') return false;
   if (platform !== 'darwin') return false;

package/engine/server.mjs

@@ -20,7 +20,7 @@ import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
-import { folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse, isCommandOnPath, hostReadiness, parseRequestedWorkspaceDir } from './lib.mjs';
+import { bootBanner, bootDestination, folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse, isCommandOnPath, hostReadiness, parseRequestedWorkspaceDir } from './lib.mjs';
 import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, classifyWorkerFailure, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildReviewAttemptLedger, latestGoalOutcomeTask, buildDirtyWorkspacePrBlock, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, rebasePreviewUrl, shouldCreateGoalPR, normalizePullRequestUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, buildQueueWaits, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, autoFoldReviewsEnabled, parseGitUnifiedDiffLocations, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyPrSafety, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildVerificationInfraError, verificationInfraErrorFrom, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, testFailureReason, manualTestRetryPrompt, isNothingVerifiable, isNothingVerifiableForPR, isSuspiciouslyIncompleteDone, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, shouldUsePlannerForGoal, RUN_DECL_FILE, REQUIREMENT_EVIDENCE_FILE, parseRequirementEvidenceDocument, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, buildGoalMessage, serializeGoalMessage, parseGoalMessages, computeInternalQualityMetrics, classifyInternalQualityTaskError, resolveWorkspaceMode, goalSessionFor, setGoalAgentSession, switchGoalAgentSession, parseApprovalRequest } from './lib.mjs';
 import { migrateRequirementModel, validateRequirementModel } from './requirement-model.mjs';
 import { buildManagerVerificationChecks, buildRequirementVerificationEvidence, mergeRequirementVerificationEvidence } from './requirement-verification.mjs';
@@ -6304,7 +6304,25 @@ server.listen(PORT, '127.0.0.1', () => {
   }
   PORT = server.address().port; // the OS-assigned one when MANAGER_PORT=0
   try { server6.listen(PORT, '::1'); } catch { /* IPv6 loopback unavailable */ }
-  console.log(`[manager] Manager for AI → http://localhost:${PORT}/?key=${ACCESS_KEY}`);
+  const localUrl = `http://localhost:${PORT}/?key=${ACCESS_KEY}`;
+  // WHERE this person's Galda is depends on how it was installed, not on whether
+  // we managed to open a tab. `npx @galda/cli` sets the billing + app URLs, and
+  // those people live in the hosted app; the localhost ?key board is the entry
+  // only for local/dev (MANAGER_BILLING_API_URL= opt-out, or `npm start` in the
+  // repo). Deciding this from the auto-open branch — as this first did — told a
+  // hosted user on Linux, or anyone with MANAGER_OPEN_BROWSER=0, to open a
+  // localhost board with an access key: the one thing the flow below has always
+  // refused to do.
+  const hostedFlow = Boolean(BILLING_API_URL && APP_URL);
+  const alreadySignedIn = existsSync(licenseFile) && !FORCE_SIGNIN;
+  // buildSigninUrl() also starts the background claim poll — which is exactly
+  // what a person about to open that link by hand needs running, so it is called
+  // only on the branch that will actually show it.
+  const { url: bannerUrl, mode: bannerMode } = bootDestination({
+    hosted: hostedFlow, signedIn: alreadySignedIn, localUrl, appUrl: APP_URL,
+    signinUrl: hostedFlow && !alreadySignedIn ? buildSigninUrl() : '',
+  });
+  let bannerOpened = false;
   if (shouldOpenBrowserOnBoot({ openBrowser: process.env.MANAGER_OPEN_BROWSER, platform: process.platform, managerPort: process.env.MANAGER_PORT })) {
     // Hosted flow (billing worker + named app configured): the user lives in
     // app.galda.app, driven over the relay — they must NEVER be dropped on a
@@ -6313,18 +6331,10 @@ server.listen(PORT, '127.0.0.1', () => {
     // → one-click Google sign-in; already signed in → straight to the app (the
     // board comes alive as relay-client rebinds via its license.token watcher).
     // The localhost ?key board stays the entry ONLY for local/dev (no billing).
-    let openUrl = `http://localhost:${PORT}/?key=${ACCESS_KEY}`;
-    if (BILLING_API_URL && APP_URL) {
-      const signedIn = existsSync(licenseFile) && !FORCE_SIGNIN;
-      openUrl = signedIn
-        ? APP_URL
-        : buildSigninUrl(); // device-flow: also starts the background claim poll
-      console.log(signedIn
-        ? `[manager] opening your app → ${APP_URL}`
-        : `[manager] ${FORCE_SIGNIN ? 'switching account' : 'first run'}: opening one-click sign-in → ${openUrl}`);
-    }
-    spawn('open', ['-g', openUrl], { stdio: 'ignore' }).unref();
+    bannerOpened = true;
+    spawn('open', ['-g', bannerUrl], { stdio: 'ignore' }).unref();
   }
+  for (const line of bootBanner({ url: bannerUrl, mode: bannerMode, opened: bannerOpened })) console.log(line);
   console.log(`[manager] projects: ${projects.map((p) => `${p.id}=${p.dir}`).join('  ')}`);
   if (shouldProbeClaudeAuth(AVAILABLE_AGENTS)) probeWorkerAuth().catch(() => {}); // hold Claude tasks + banner if Claude is unavailable
   setInterval(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.115",
+  "version": "0.10.116",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {