@galda/cli 0.10.119 → 0.10.121

package/app/index.html

@@ -674,6 +674,18 @@
   .peratab.on{color:var(--ink);border-color:var(--ink3);background:rgba(var(--tint),.06)}
   .peraask{display:flex;gap:8px;align-items:center;padding:10px 16px 6px}
   .peraask input{flex:1;background:var(--glass);border:1px solid var(--hair2);border-radius:10px;color:var(--ink);font-size:12.5px;padding:8px 12px;outline:none}
+  /* First-run nudge + the npx answer. Deliberately not a painted panel or a
+     boxed card: a box reads as "tappable" (DESIGN-RULES §5.6). This is a line
+     of text and a stroke pointing into the input it is about. */
+  .cnudge{display:none;align-items:center;justify-content:center;gap:10px;margin:14px auto 0;opacity:0;transform:translateY(-3px);
+    transition:opacity .28s ease,transform .28s ease}
+  .cnudge.show{display:flex;opacity:1;transform:none}
+  .cnudge-t{font-size:12.5px;line-height:1.5;color:var(--ink2)}
+  .cnudge-a{width:12px;height:20px;flex:0 0 auto;border-left:1.5px solid var(--ink3);border-bottom:1.5px solid var(--ink3);
+    border-bottom-left-radius:7px;position:relative;opacity:.85}
+  .cnudge-a:after{content:'';position:absolute;right:-1px;bottom:-4px;width:6px;height:6px;
+    border-right:1.5px solid var(--ink3);border-bottom:1.5px solid var(--ink3);transform:rotate(-45deg)}
+    padding:10px 12px;font-family:var(--mono);font-size:12.5px;color:var(--ink);overflow-x:auto;white-space:nowrap}
   .peraanswer{margin:0 16px 8px;font-size:12.5px;line-height:1.55;color:var(--ink2);white-space:pre-wrap;background:rgba(var(--tint),.03);border:1px solid var(--hair2);border-radius:10px;padding:10px 12px}
   .peraanswer.loading{color:var(--ink3);font-style:italic}
   .peraanswer.error{color:var(--danger)}
@@ -3283,6 +3295,13 @@
       <div class="nowdoing" id="fsNowDoing" hidden></div>
       <!-- Clawd HERO (§4.5 初期状態): filled by JS (CLAWD generator), shown via #fsRoot.clawdhero -->
       <div id="fsClawdHero" aria-hidden="true"></div>
+      <!-- Under the waiting hero, pointing down at the box a new person is meant
+           to use. "CONNECTED / WAITING FOR GOALS" says our state; this says
+           theirs. Shown only while the board has nothing on it. -->
+      <div class="cnudge" id="composerNudge">
+        <span class="cnudge-t">Type what you want done, down there.</span>
+        <span class="cnudge-a" aria-hidden="true"></span>
+      </div>
       <!-- H23 mobile empty-state hero (flagship .m-hero) — chips fill the composer (#input) -->
       <div class="m-hero"><h2>What should we build?</h2><p>Describe a goal in plain language. Claude Code runs it, checks its own work, and only calls it done with proof.</p><div class="m-chips"><button class="m-chip">Fix the failing test in lib.mjs</button><button class="m-chip">Add a token-usage counter</button><button class="m-chip">Summarize the open PRs</button></div></div>
       <div class="fsstream"><div id="fsFeed"></div></div>
@@ -3474,6 +3493,20 @@
       <div class="segbtn" id="langSeg"><button data-lang="auto">Auto</button><button data-lang="en">English</button><button data-lang="ja">日本語</button></div></div>
   </div>
 </div></div>
+<!-- "What is Galda? / What can it access?" — the orientation panel.
+     WHY IT EXISTS: the first engineer we handed Galda to reached for the gear
+     button before typing anything. He was not lost, he was CHECKING: people
+     want to know what a tool can touch before they hand it a repository. This
+     answers that where they already are, instead of sending them to a website.
+     Rendered from a constant, entirely locally: NO agent run, NO tokens, no
+     network. Spending someone's quota and 40 seconds to produce a text answer
+     they could have read instantly would be a bad trade, and it would teach
+     the wrong idea of what Galda is (it is not a chatbot).
+     Same overlay/modal parts as Settings above — no new component. -->
+<div class="overlay revfloat" id="aboutOverlay"><div class="modal" style="width:min(560px,94vw)">
+  <div class="perahead" style="border-bottom:1px solid var(--hair)"><div class="peratitle" id="aboutTitle">What is Galda?</div><span style="flex:1"></span><button class="mbtn ghost" id="aboutClose">Close</button></div>
+  <div style="padding:16px;max-height:min(70vh,620px);overflow:auto" id="aboutBody"></div>
+</div></div>
 <!-- Slack-style centered delete confirmation, replacing native confirm() for every goal
      delete (restores a lost decision — see docs/confirmed-behaviors.md). Reusable via the
      confirmDelete({title,preview}) -> Promise<boolean> helper. -->
@@ -6782,6 +6815,7 @@ $('gdRevisionInput').addEventListener('keydown', (e) => {
 });
 
 function render(){
+  renderComposerNudge();
   renderProjects(); renderStream(); renderQueue(); renderTasks(); renderActPanel(); wireWfEditButtons();
   renderCtxBar();   // the folder above the composer follows the active project
   renderFlagship();
@@ -9127,7 +9161,8 @@ function bootDisconnected(info){
       background:rgba(4,4,6,.72);-webkit-backdrop-filter:blur(7px);backdrop-filter:blur(7px)}
     #connectGate.on{display:flex}
     #connectGate .cg-card{position:relative;width:100%;max-width:440px;background:var(--panel,#0d0d0f);border:1px solid var(--hair2,rgba(255,255,255,.12));
-      border-radius:18px;padding:30px 28px;text-align:center;box-shadow:0 30px 80px -30px #000}
+      border-radius:18px;padding:28px 26px;text-align:left;box-shadow:0 30px 80px -30px #000;
+      max-height:calc(100vh - 44px);overflow:auto}
     #connectGate h2{font:700 20px/1.3 var(--ui,system-ui);letter-spacing:-.02em;margin:0 0 8px;color:var(--ink,#e9e7e2)}
     #connectGate p{font-size:13.5px;line-height:1.7;color:var(--ink2,#a3a097);margin:0 0 18px}
     #connectGate .cg-cmd{display:flex;align-items:center;justify-content:space-between;gap:12px;background:#0a0a0b;
@@ -9139,6 +9174,14 @@ function bootDisconnected(info){
     #connectGate .cg-hint{font-size:12px;line-height:1.6;color:var(--ink3,#6b6862);margin:0 0 16px}
     #connectGate .cg-hint a{color:var(--blue,#8fb0ff);text-decoration:none}
     #connectGate .cg-hint a:hover{text-decoration:underline}
+    #connectGate .cg-trust{margin:18px 0 0;padding:16px 0 0;border-top:1px solid var(--hair2,rgba(255,255,255,.10))}
+    #connectGate .cg-blanket{font-size:12.5px;line-height:1.6;color:var(--ink,#e9e7e2);font-weight:600;margin:0}
+    #connectGate .cg-acchead{font:500 10px/1 var(--mono,monospace);letter-spacing:.09em;text-transform:uppercase;color:var(--ink3,#6b6862);margin:16px 0 6px}
+    #connectGate .cg-accrow{font-size:12px;line-height:1.45;color:var(--ink2,#a3a097);padding:0 0 0 12px;margin:0 0 6px;position:relative}
+    #connectGate .cg-accrow:before{content:'';position:absolute;left:0;top:7px;width:4px;height:1px;background:var(--ink3,#6b6862);opacity:.7}
+    #connectGate .cg-seclink{margin:14px 0 0;font-size:12px}
+    #connectGate .cg-seclink a{color:var(--blue,#8fb0ff);text-decoration:none}
+    #connectGate .cg-acct{margin:18px 0 0;padding:16px 0 0;border-top:1px solid var(--hair2,rgba(255,255,255,.10))}
     #connectGate .cg-who{font-size:12px;color:var(--ink3,#6b6862);margin:0 0 4px}
     #connectGate .cg-who b{color:var(--ink2,#a3a097)}
     #connectGate .cg-switch{font-size:12px;color:var(--ink3,#6b6862);margin:14px 0 0;transition:color .2s}
@@ -9153,6 +9196,7 @@ function bootDisconnected(info){
     #connectGate .cg-switch.escalated{color:var(--danger);font-weight:600}
     #connectGate .cg-switch.escalated a{color:var(--danger);text-decoration:underline}
     #connectGate .cg-x{position:absolute;top:14px;right:16px;width:28px;height:28px;border:0;background:transparent;color:var(--ink3,#6b6862);font-size:20px;line-height:1;cursor:pointer}
+    #connectGate .cg-waitwrap{display:flex;justify-content:center}
     #connectGate .cg-wait{display:inline-flex;align-items:center;gap:7px;font:500 10.5px/1 var(--mono,monospace);letter-spacing:.08em;color:var(--ink3,#6b6862);margin-top:16px}
     #connectGate .cg-wait i{width:6px;height:6px;border-radius:50%;background:var(--green,#3DDC97);animation:cgpulse 1.8s ease-in-out infinite}
     @keyframes cgpulse{0%,100%{box-shadow:0 0 0 0 color-mix(in srgb,var(--green,#3DDC97) 50%,transparent)}50%{box-shadow:0 0 6px 2px color-mix(in srgb,var(--green,#3DDC97) 35%,transparent)}}
@@ -9172,9 +9216,21 @@ function bootDisconnected(info){
     + '<a href="https://claude.com/claude-code" target="_blank" rel="noreferrer">Claude Code</a> or '
     + '<a href="https://openai.com/codex/" target="_blank" rel="noreferrer">Codex</a>, then run the same command '
     + '— Galda uses whichever agent you have.</p>'
+    // The gate said what to run and never what it would do. "npx? what else is
+    // it going to touch?" is the actual reason people stop here, so the answer
+    // sits with the command. Facts only, in step with docs/SECURITY.md.
+    + '<div class="cg-trust">'
+    + '<p class="cg-blanket">No admin access, no background service, nothing that starts on its own. '
+    + 'Plain JavaScript you can read before you run it, and one folder you can delete.</p>'
+    + '<div class="cg-acchead">What it can access</div>'
+    + NPX_ONBOARDING.access.map(function(t){ return '<div class="cg-accrow">' + esc(t) + '</div>'; }).join('')
+    + '<p class="cg-seclink"><a href="https://galda.app/security" target="_blank" rel="noreferrer">Security and permissions \u2192</a></p>'
+    + '</div>'
+    + '<div class="cg-acct">'
     + '<p class="cg-who">Signed in as <b></b></p>'
     + '<p class="cg-switch">Already running Galda under a different account? Run <code>npx @galda/cli --signin</code> and pick this one. Or <a href="/logout">switch Google account →</a></p>'
-    + '<div class="cg-wait"><i></i>WAITING FOR THIS DEVICE</div></div>';
+    + '</div>'
+    + '<div class="cg-waitwrap"><div class="cg-wait"><i></i>WAITING FOR THIS DEVICE</div></div></div>';
   document.body.appendChild(ov);
   ov.querySelector('.cg-who b').textContent = email || 'your account';
   const open = () => ov.classList.add('on');
@@ -11961,6 +12017,13 @@ $('histBtn').onclick = openHistory;
 $('setBtn').onclick = openSettings;
 $('histClose').onclick = () => $('historyOverlay').classList.remove('show');
 $('setClose').onclick = () => $('settingsOverlay').classList.remove('show');
+// About panel: Close, tapping the backdrop, and Esc all dismiss it (DESIGN-RULES
+// §設定画面 — a dialog must close when you click somewhere unrelated).
+$('aboutClose').onclick = () => closeAbout();
+$('aboutOverlay').onclick = (e) => { if (e.target === $('aboutOverlay')) closeAbout(); };
+document.addEventListener('keydown', (e) => {
+  if (e.key === 'Escape' && $('aboutOverlay')?.classList.contains('show')) { e.stopPropagation(); closeAbout(); }
+}, true);
 $('historyOverlay').addEventListener('click', (e) => { if (e.target === $('historyOverlay')) $('historyOverlay').classList.remove('show'); });
 $('settingsOverlay').addEventListener('click', (e) => { if (e.target === $('settingsOverlay')) $('settingsOverlay').classList.remove('show'); });
 for (const b of $('langSeg').querySelectorAll('button')) b.onclick = () => saveLang(b.dataset.lang);
@@ -12777,11 +12840,177 @@ function gearSetHTML(){
     <button class="optchip${lang === 'en' ? ' on' : ''}" data-gslang="en">EN</button>
     <button class="optchip${lang === 'ja' ? ' on' : ''}" data-gslang="ja">JA</button></div>
   ${billingRow}
+  <div class="srow"><div class="sl">About Galda<span class="sd">What it is, what the agent can touch, and what leaves this machine</span></div>
+    <button class="optchip" data-gabout="1">Open</button></div>
+  ${remoteAccessRow()}
+  ${shareUsageDataRow()}
   ${stability}
   ${gearRulesHTML()}
   ${hostReadinessRow()}
   <div class="srow dis"><div class="sl">Data folder<span class="sd">Runs are stored in the engine's chat-runs folder on the host</span></div></div>`;
 }
+// The npx moment, moved to where the intent is.
+//
+// A person who signed up on the web lands on a board with nothing behind it:
+// Galda drives the Claude Code / Codex on THEIR machine, and that is not
+// running yet. Until now the only thing they were told was "Galda is offline —
+// reconnecting…", which is true and useless: it describes our state, not their
+// next step. That is the "run npx" dead end.
+//
+// So the answer arrives when they reach for the composer, which is the moment
+// they have decided to do something. And it has to answer the real hesitation,
+// not just print a command: "npx? what else is it going to do to my machine?"
+//
+// Every line below is a fact about the shipped package, kept in step with
+// docs/SECURITY.md and the same block on galda.app. Do not promise here what
+// is not true there.
+const NPX_ONBOARDING = {
+  why: 'This is a command, not a website, because Galda runs the Claude Code or Codex already installed on your machine, on your own subscription. A website cannot reach them.',
+  blanket: 'No admin access, no background service, nothing that starts on its own. Plain JavaScript you can read before you run it, and one folder you can delete.',
+  access: [
+    'Your project files and tests, inside a throwaway copy',
+    'Its git is read-only: no commit, no push, no checkout, no reset',
+    'Never your working tree, your branch, or your uncommitted changes',
+    'A fixed allowlist of commands, not arbitrary shell',
+    'Nothing at all at install time',
+  ],
+};
+
+// The nudge: with no agent behind the board, point at the composer instead of
+// leaving a new person to guess. Only while there is nothing to do here — it
+// disappears the moment an agent connects.
+function renderComposerNudge(){
+  const n = $('composerNudge');
+  if (!n) return;
+  // Only while there is genuinely nothing here. The moment a first goal exists
+  // the board explains itself and a standing instruction becomes clutter.
+  const empty = !(state.goals || []).length && !(state.tasks || []).length;
+  n.classList.toggle('show', empty);
+}
+
+// The orientation panel's content. A constant, not a request: this renders with
+// zero tokens and no network, because the answer never depends on the project.
+//
+// Every line here is a fact about the shipped code, kept in step with
+// docs/SECURITY.md. Do not add a promise here that is not true there.
+const ABOUT_GALDA = [
+  { h: 'What Galda is', p: [
+    'Galda hands your work to Claude Code or Codex and brings back something you can review.',
+    'It has no AI of its own. It starts the agent already installed and signed in on this machine, on your own subscription, so there is no extra API cost — and your code is never uploaded to Galda to be run through a model.',
+  ] },
+  { h: 'What the agent can do', p: [
+    'Read and edit files, and run tests, inside a private copy of your project.',
+    'Run named commands only — language runtimes, package managers, test and lint runners, and read-only shell tools. Not arbitrary shell.',
+  ] },
+  { h: 'What the agent cannot do', p: [
+    'It cannot commit, push, checkout, or reset. Its git access is read-only: status, log, diff, show, branch, blame, ls-files, rev-parse. Nothing else.',
+    'It cannot touch your working tree. Every task runs in a throwaway git worktree, so your branch and your uncommitted changes are left alone.',
+  ] },
+  { h: 'What leaves this machine', p: [
+    'Model traffic goes from Claude Code or Codex straight to Anthropic or OpenAI. Galda is not in that path.',
+    'With remote access on, what this board displays passes through Galda’s relay so you can open it from your phone. It is encrypted in transit but not end to end, so treat Galda’s server as being in the path.',
+    'Turn remote access off in Settings and no outbound connection is opened at all.',
+  ] },
+  { h: 'Removing it', p: [
+    'Galda installs no background services and runs nothing at install time. Deleting ~/.manager-for-ai removes everything it keeps.',
+  ] },
+];
+function openAbout(){
+  const body = $('aboutBody');
+  if (body) {
+    body.innerHTML = ABOUT_GALDA.map((s) => `
+      <div class="setrow" style="display:block">
+        <div class="setlabel">${esc(s.h)}</div>
+        ${s.p.map((t) => `<div class="setsub" style="margin-top:4px">${esc(t)}</div>`).join('')}
+      </div>`).join('');
+  }
+  $('aboutOverlay')?.classList.add('show');
+}
+function closeAbout(){ $('aboutOverlay')?.classList.remove('show'); }
+// Reachable from the first-run composer link too, once that lands.
+window.openAbout = openAbout;
+
+// Remote access = the relay. On, you can open this board from your phone; the
+// price is that what the board shows crosses Galda's relay server (it is a
+// reverse HTTP tunnel, TLS but not end-to-end encrypted — docs/SECURITY.md).
+// Off, no outbound socket is opened at all.
+//
+// This row exists because that switch already worked and nobody could find it:
+// it was the env var `RELAY_URL=`. The people who most need it are the ones who
+// will never read a source comment. Cursor puts Privacy Mode in Settings for
+// the same reason. Same shape as Language above — a server setting that applies
+// the moment it is chosen, not part of the visual edit session.
+//
+// No row at all when this build has no relay configured (§3 段階開示: never show
+// a switch that controls nothing).
+function remoteAccessRow(){
+  const rp = state.relayPref;
+  if (!rp || !rp.configured) return '';
+  const on = rp.enabled === true;
+  const desc = on
+    ? 'On — reach this board from your phone. What the board shows passes through Galda’s relay.'
+    : 'Off — nothing leaves this machine. This board is not reachable from your phone.';
+  return `<div class="srow"><div class="sl">Remote access<span class="sd">${esc(desc)}</span></div>
+    <button class="optchip${on ? ' on' : ''}" data-grelay="on">On</button>
+    <button class="optchip${on ? '' : ' on'}" data-grelay="off">Off</button></div>`;
+}
+// "Share usage data" — the usage-analytics switch (engine: /api/analytics-pref).
+//
+// The label is not a choice: data-controls.html tells people to look for
+// Settings → Privacy → "Share usage data", and until 2026-08-02 that string
+// appeared nowhere in this file. Renaming the row means editing that document
+// in the same breath.
+//
+// Sits directly under Remote access because they are the same kind of promise,
+// and because one overrides the other: with the relay off nothing is sent at
+// all (docs/SECURITY.md), so the chips are shown as off and out of service —
+// a switch that controls nothing must not look live (§3 段階開示).
+function shareUsageDataRow(){
+  const ap = state.analyticsPref;
+  if (!ap || !ap.configured) return '';   // nothing configured to send to
+  const relayOff = ap.relayEnabled === false;
+  const on = ap.enabled === true;
+  const desc = relayOff
+    ? 'Off — remote access is off, so nothing is sent at all.'
+    : on
+      ? 'On — a few product events (a task started, finished, failed). Never your prompts, code, or file paths.'
+      : 'Off — no usage events are sent.';
+  const dis = relayOff ? ' disabled' : '';
+  return `<div class="srow"><div class="sl">Share usage data<span class="sd">${esc(desc)}</span></div>
+    <button class="optchip${on ? ' on' : ''}" data-ganalytics="on"${dis}>On</button>
+    <button class="optchip${on ? '' : ' on'}" data-ganalytics="off"${dis}>Off</button></div>`;
+}
+async function loadAnalyticsPref(){
+  try { const r = await fetch(withKey('/api/analytics-pref')); state.analyticsPref = r.ok ? await r.json() : null; }
+  catch { state.analyticsPref = null; }
+  if ($('gearPop') && custTab === 'settings') buildGearPop();
+}
+async function saveAnalyticsPref(enabled){
+  const r = await fetch(withKey('/api/analytics-pref'), {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ enabled }),
+  });
+  if (!r.ok) return showErr('Failed to save.');
+  state.analyticsPref = await r.json();
+  if ($('gearPop').classList.contains('open')) buildGearPop();
+}
+async function loadRelayPref(){
+  try { const r = await fetch(withKey('/api/relay-pref')); state.relayPref = r.ok ? await r.json() : null; }
+  catch { state.relayPref = null; }
+  if ($('gearPop') && custTab === 'settings') buildGearPop();
+}
+async function saveRelayPref(enabled){
+  const r = await fetch(withKey('/api/relay-pref'), {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ enabled }),
+  });
+  if (!r.ok) return showErr('Failed to save.');
+  state.relayPref = await r.json();
+  // Remote access decides whether anything is sent at all, so the row below it
+  // is now saying something different — ask the engine rather than guess.
+  await loadAnalyticsPref();
+  if ($('gearPop').classList.contains('open')) buildGearPop();
+}
 async function loadStability(){
   try { const r = await fetch(withKey('/api/stability')); state.stability = r.ok ? await r.json() : null; }
   catch { state.stability = null; }
@@ -12873,6 +13102,9 @@ function buildGearPop(){
     pop.innerHTML = gearTabsHTML() + gearSetHTML();
     wireGearCommon(pop);
     for (const b of pop.querySelectorAll('[data-gslang]')) b.onclick = () => saveLang(b.dataset.gslang);
+    for (const b of pop.querySelectorAll('[data-grelay]')) b.onclick = () => saveRelayPref(b.dataset.grelay === 'on');
+    for (const b of pop.querySelectorAll('[data-ganalytics]')) b.onclick = () => saveAnalyticsPref(b.dataset.ganalytics === 'on');
+    for (const b of pop.querySelectorAll('[data-gabout]')) b.onclick = () => openAbout();
     const signBtn = pop.querySelector('[data-gsignin]');
     if (signBtn) signBtn.onclick = async () => {
       const msg = pop.querySelector('#licKeyMsg');
@@ -12898,6 +13130,8 @@ function buildGearPop(){
     if (stabilityBtn) stabilityBtn.onclick = () => { state.stability = null; buildGearPop(); loadStability(); };
     loadProjectRules();
     if (!state.stability) loadStability();
+    if (!state.relayPref) loadRelayPref();
+    if (!state.analyticsPref) loadAnalyticsPref();
     return;
   }
   if (custTab === 'mcp') {

package/docs/SECURITY.md

@@ -154,17 +154,17 @@ Each carries a timestamp and a pseudonymous account id, and nothing else.
 - Repository names or paths
 - Proof screenshots and recordings
 
-**Paid business plans: analytics are off.** On business plans no product events
-are collected at all, the way Cursor forces Privacy Mode on for teams. You do
-not have to configure anything.
-
-**With the relay off, nothing is collected.** Not reduced, not anonymized:
-nothing. A mode sold as "nothing leaves your machine" that quietly reported
-usage would invalidate every other claim on this page, so it does not.
+**Analytics do not follow the relay switch today.** Turning remote access off
+stops the tunnel, but the product events above are still sent. If you want
+zero analytics, start Galda with the endpoint unset:
+`MANAGER_BILLING_API_URL= npx @galda/cli`. The client is a no-op without it
+(`engine/analytics-client.mjs`). An in-app off switch is being implemented,
+and this section will be updated when it ships.
 
 ## Reporting a vulnerability
 
-<!-- TODO(Masa): security contact address. -->
+Write to hello@galda.app. Please include what you did, what you saw, and the
+version of Galda you were running.
 
 ## 日本語
 

package/engine/analytics-client.mjs

@@ -2,6 +2,10 @@
 // (docs/DATA-RETENTION-PLAN.md). Posts a single Tier-A event to the billing-api
 // /events endpoint.
 //
+// OFF SWITCH: `emitEvent` sends nothing when the person has turned "Share usage
+// data" off, and nothing when remote access is off — see analytics-pref.mjs for
+// why the second one is not optional.
+//
 // PRIVACY: NEVER pass prompt / task text / file paths. Only an event type, a
 // user identifier (the endpoint hashes it into a pseudonymous id), and
 // allow-listed non-sensitive meta (project_hash / plan / status / model /
@@ -18,16 +22,40 @@
 //   task_interrupted  → engine, task.status = 'interrupted'
 //   review_approved / review_dismissed → on the review action
 
+import { readAnalyticsPref, resolveAnalyticsEnabled } from './analytics-pref.mjs';
+import { readRelayPref, resolveRelayEnabled } from './relay-pref.mjs';
+
 const BILLING_API_URL = (process.env.MANAGER_BILLING_API_URL ?? '').replace(/\/$/, '');
 
+// Where the two preference files live, and what the relay is configured with.
+// Supplied by whoever owns those (server.mjs at boot) rather than recomputed
+// here: DATA_DIR has fallbacks this module has no business duplicating, and a
+// second copy of that logic is how a switch ends up reading a file nobody writes.
+let prefContext = { dataDir: null, relayUrl: process.env.RELAY_URL ?? '' };
+export function setAnalyticsContext({ dataDir, relayUrl } = {}) {
+  prefContext = {
+    dataDir: dataDir ?? prefContext.dataDir,
+    relayUrl: relayUrl ?? prefContext.relayUrl,
+  };
+}
+
+// Read at every event, not cached: a person who has just turned the switch off
+// expects the next thing they do not to be reported, and a cache would make that
+// depend on when the process last restarted. Events are rare (a task starting,
+// a task finishing), so two small file reads cost nothing worth keeping.
 export function analyticsEnabled() {
-  return Boolean(BILLING_API_URL);
+  const { dataDir, relayUrl } = prefContext;
+  return resolveAnalyticsEnabled({
+    configured: Boolean(BILLING_API_URL),
+    pref: dataDir ? readAnalyticsPref(dataDir) : null,
+    relayEnabled: dataDir ? resolveRelayEnabled({ relayUrl, pref: readRelayPref(dataDir) }) : undefined,
+  });
 }
 
 // type: one of the EVENT_TYPES; uid: account email/id (hashed server-side);
 // meta: optional allow-listed non-sensitive fields only.
 export function emitEvent(type, uid, meta) {
-  if (!BILLING_API_URL) return; // analytics off when unconfigured — no-op
+  if (!analyticsEnabled()) return; // unconfigured, switched off, or relay off — no-op
   try {
     fetch(`${BILLING_API_URL}/events`, {
       method: 'POST',

package/engine/analytics-pref.mjs

@@ -0,0 +1,67 @@
+// Agent Manager — usage-analytics preference (the "Share usage data" switch)
+//
+// WHY THIS EXISTS: two published documents already promised this switch and the
+// product did not have it (found 2026-08-02).
+//
+//   docs/SECURITY.md   — "With the relay off, nothing is collected. Not reduced,
+//                         not anonymized: nothing."
+//   data-controls.html — "Product telemetry … can be turned off completely in
+//                         Settings → Privacy → 'Share usage data'."
+//
+// Neither was true. `emitEvent` was guarded by `if (!BILLING_API_URL) return`
+// and nothing else: it never looked at the relay preference, and the setting the
+// second document names by string did not exist anywhere in the app. A promise
+// in a security document that the code does not keep is worse than no promise —
+// it is the one thing a person cannot check for themselves.
+//
+// Deliberately the same shape as relay-pref.mjs (a file in DATA_DIR, read at
+// use, default ON), because these two switches are read together and a person
+// setting one will look for the other in the same place.
+
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+export const ANALYTICS_PREF_FILE = 'analytics-pref.json';
+
+export function analyticsPrefPath(dataDir) {
+  return join(dataDir, ANALYTICS_PREF_FILE);
+}
+
+// Should a usage event be sent? Pure — no clock, no I/O, no env.
+//
+//   configured   : is there a billing/analytics endpoint at all (BILLING_API_URL)
+//   pref         : the user's saved choice (true | false | null when never set)
+//   relayEnabled : is remote access on (resolveRelayEnabled)
+//
+// Default is ON: a fresh install reports the handful of Tier-A events described
+// in docs/DATA-RETENTION-PLAN.md. Only an explicit `false` turns it off, so a
+// corrupt or missing preference file can never silently disable it either way.
+//
+// Relay off wins over everything. SECURITY.md sells that mode as "nothing leaves
+// your machine", so a usage event escaping it would invalidate every other claim
+// on that page. Someone who turns off remote access has not opted into analytics
+// by omission — they have said the opposite in the plainest way the product offers.
+export function resolveAnalyticsEnabled({ configured, pref, relayEnabled } = {}) {
+  if (!configured) return false;
+  if (relayEnabled === false) return false;
+  return pref !== false;
+}
+
+// Read the saved preference. Returns null when the user has never chosen, so
+// callers can tell "unset" from "explicitly on".
+export function readAnalyticsPref(dataDir) {
+  try {
+    const raw = JSON.parse(readFileSync(analyticsPrefPath(dataDir), 'utf8'));
+    return typeof raw?.enabled === 'boolean' ? raw.enabled : null;
+  } catch {
+    return null; // never set, unreadable, or corrupt — all mean "no choice made"
+  }
+}
+
+// Save the preference. Throws on a real write failure so the endpoint can report
+// it rather than telling the user it saved something it did not.
+export function writeAnalyticsPref(dataDir, enabled) {
+  const value = enabled === true;
+  writeFileSync(analyticsPrefPath(dataDir), JSON.stringify({ enabled: value, at: Date.now() }) + '\n');
+  return value;
+}

package/engine/server.mjs

@@ -14,7 +14,7 @@
 import { createServer } from 'node:http';
 import { spawn, execFile, spawnSync } from 'node:child_process';
 import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, statSync, readdirSync, unlinkSync, rmSync } from 'node:fs';
-import { emitEvent } from './analytics-client.mjs';
+import { emitEvent, setAnalyticsContext } from './analytics-client.mjs';
 import { randomBytes, createHash, randomUUID } from 'node:crypto';
 import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
@@ -25,6 +25,7 @@ import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refineP
 import { migrateRequirementModel, validateRequirementModel } from './requirement-model.mjs';
 import { buildManagerVerificationChecks, buildRequirementVerificationEvidence, mergeRequirementVerificationEvidence } from './requirement-verification.mjs';
 import { readRelayPref, writeRelayPref, resolveRelayEnabled } from './relay-pref.mjs';
+import { readAnalyticsPref, writeAnalyticsPref, resolveAnalyticsEnabled } from './analytics-pref.mjs';
 import { createSerialQueue } from './lib.mjs';
 import { wantsPullRequest } from './lib.mjs';
 import { parseRequirementEvidence, unmappedChangedFiles, previewOpensSomethingElse } from './lib.mjs';
@@ -43,6 +44,10 @@ const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const DATA_DIR = process.env.MANAGER_HOME
   ?? (existsSync(join(ROOT, '.git')) ? join(ROOT, 'engine') : join(homedir(), '.manager-for-ai'));
 mkdirSync(DATA_DIR, { recursive: true });
+// The analytics client reads the "Share usage data" and remote-access
+// preferences out of DATA_DIR before every event; it is told where that is
+// rather than recomputing the fallbacks above.
+setAnalyticsContext({ dataDir: DATA_DIR, relayUrl: process.env.RELAY_URL ?? '' });
 // MANAGER_PORT=0 asks the OS for a free port; the real one is only known once
 // the listen below succeeds, so this is rebound there (before anything prints
 // or links to it).
@@ -4511,6 +4516,45 @@ const server = createServer(async (req, res) => {
     });
     return;
   }
+  // The "Share usage data" switch (docs/SECURITY.md, data-controls.html). Same
+  // shape as /api/relay-pref above, because they are the same kind of promise and
+  // the settings panel shows them together. `enabled` is what actually happens —
+  // it is false when analytics are unconfigured OR remote access is off, whatever
+  // this preference says, so the UI can never show "on" for something that sends
+  // nothing.
+  if (url.pathname === '/api/analytics-pref' && req.method === 'GET') {
+    const pref = readAnalyticsPref(DATA_DIR);
+    const relayEnabled = resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref: readRelayPref(DATA_DIR) });
+    return json(res, 200, {
+      pref,
+      enabled: resolveAnalyticsEnabled({ configured: Boolean(BILLING_API_URL), pref, relayEnabled }),
+      configured: Boolean(BILLING_API_URL),
+      relayEnabled,
+    });
+  }
+  if (url.pathname === '/api/analytics-pref' && req.method === 'POST') {
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      let input;
+      try { input = JSON.parse(body || '{}'); } catch { return json(res, 400, { error: 'bad json' }); }
+      // A boolean and nothing else — same reason as the relay switch: "off"/0/
+      // undefined is how a privacy setting silently becomes the opposite of what
+      // was clicked.
+      if (typeof input?.enabled !== 'boolean') return json(res, 400, { error: 'enabled must be a boolean' });
+      let saved;
+      try { saved = writeAnalyticsPref(DATA_DIR, input.enabled); }
+      catch (e) { return json(res, 500, { error: String(e?.message ?? e) }); }
+      const relayEnabled = resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref: readRelayPref(DATA_DIR) });
+      return json(res, 200, {
+        pref: saved,
+        enabled: resolveAnalyticsEnabled({ configured: Boolean(BILLING_API_URL), pref: saved, relayEnabled }),
+        configured: Boolean(BILLING_API_URL),
+        relayEnabled,
+      });
+    });
+    return;
+  }
   // POST /api/signout — forget the local license so the settings panel can
   // offer a plain "Log out" instead of requiring the `--signin` CLI flag to
   // switch Google accounts. Clears the on-disk token and the in-memory cache;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.119",
+  "version": "0.10.121",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {