@galda/cli 0.10.120 → 0.10.121

package/app/index.html

@@ -12843,6 +12843,7 @@ function gearSetHTML(){
   <div class="srow"><div class="sl">About Galda<span class="sd">What it is, what the agent can touch, and what leaves this machine</span></div>
     <button class="optchip" data-gabout="1">Open</button></div>
   ${remoteAccessRow()}
+  ${shareUsageDataRow()}
   ${stability}
   ${gearRulesHTML()}
   ${hostReadinessRow()}
@@ -12953,6 +12954,46 @@ function remoteAccessRow(){
     <button class="optchip${on ? ' on' : ''}" data-grelay="on">On</button>
     <button class="optchip${on ? '' : ' on'}" data-grelay="off">Off</button></div>`;
 }
+// "Share usage data" — the usage-analytics switch (engine: /api/analytics-pref).
+//
+// The label is not a choice: data-controls.html tells people to look for
+// Settings → Privacy → "Share usage data", and until 2026-08-02 that string
+// appeared nowhere in this file. Renaming the row means editing that document
+// in the same breath.
+//
+// Sits directly under Remote access because they are the same kind of promise,
+// and because one overrides the other: with the relay off nothing is sent at
+// all (docs/SECURITY.md), so the chips are shown as off and out of service —
+// a switch that controls nothing must not look live (§3 段階開示).
+function shareUsageDataRow(){
+  const ap = state.analyticsPref;
+  if (!ap || !ap.configured) return '';   // nothing configured to send to
+  const relayOff = ap.relayEnabled === false;
+  const on = ap.enabled === true;
+  const desc = relayOff
+    ? 'Off — remote access is off, so nothing is sent at all.'
+    : on
+      ? 'On — a few product events (a task started, finished, failed). Never your prompts, code, or file paths.'
+      : 'Off — no usage events are sent.';
+  const dis = relayOff ? ' disabled' : '';
+  return `<div class="srow"><div class="sl">Share usage data<span class="sd">${esc(desc)}</span></div>
+    <button class="optchip${on ? ' on' : ''}" data-ganalytics="on"${dis}>On</button>
+    <button class="optchip${on ? '' : ' on'}" data-ganalytics="off"${dis}>Off</button></div>`;
+}
+async function loadAnalyticsPref(){
+  try { const r = await fetch(withKey('/api/analytics-pref')); state.analyticsPref = r.ok ? await r.json() : null; }
+  catch { state.analyticsPref = null; }
+  if ($('gearPop') && custTab === 'settings') buildGearPop();
+}
+async function saveAnalyticsPref(enabled){
+  const r = await fetch(withKey('/api/analytics-pref'), {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ enabled }),
+  });
+  if (!r.ok) return showErr('Failed to save.');
+  state.analyticsPref = await r.json();
+  if ($('gearPop').classList.contains('open')) buildGearPop();
+}
 async function loadRelayPref(){
   try { const r = await fetch(withKey('/api/relay-pref')); state.relayPref = r.ok ? await r.json() : null; }
   catch { state.relayPref = null; }
@@ -12965,6 +13006,9 @@ async function saveRelayPref(enabled){
   });
   if (!r.ok) return showErr('Failed to save.');
   state.relayPref = await r.json();
+  // Remote access decides whether anything is sent at all, so the row below it
+  // is now saying something different — ask the engine rather than guess.
+  await loadAnalyticsPref();
   if ($('gearPop').classList.contains('open')) buildGearPop();
 }
 async function loadStability(){
@@ -13059,6 +13103,7 @@ function buildGearPop(){
     wireGearCommon(pop);
     for (const b of pop.querySelectorAll('[data-gslang]')) b.onclick = () => saveLang(b.dataset.gslang);
     for (const b of pop.querySelectorAll('[data-grelay]')) b.onclick = () => saveRelayPref(b.dataset.grelay === 'on');
+    for (const b of pop.querySelectorAll('[data-ganalytics]')) b.onclick = () => saveAnalyticsPref(b.dataset.ganalytics === 'on');
     for (const b of pop.querySelectorAll('[data-gabout]')) b.onclick = () => openAbout();
     const signBtn = pop.querySelector('[data-gsignin]');
     if (signBtn) signBtn.onclick = async () => {
@@ -13086,6 +13131,7 @@ function buildGearPop(){
     loadProjectRules();
     if (!state.stability) loadStability();
     if (!state.relayPref) loadRelayPref();
+    if (!state.analyticsPref) loadAnalyticsPref();
     return;
   }
   if (custTab === 'mcp') {

package/docs/SECURITY.md

@@ -154,17 +154,17 @@ Each carries a timestamp and a pseudonymous account id, and nothing else.
 - Repository names or paths
 - Proof screenshots and recordings
 
-**Paid business plans: analytics are off.** On business plans no product events
-are collected at all, the way Cursor forces Privacy Mode on for teams. You do
-not have to configure anything.
-
-**With the relay off, nothing is collected.** Not reduced, not anonymized:
-nothing. A mode sold as "nothing leaves your machine" that quietly reported
-usage would invalidate every other claim on this page, so it does not.
+**Analytics do not follow the relay switch today.** Turning remote access off
+stops the tunnel, but the product events above are still sent. If you want
+zero analytics, start Galda with the endpoint unset:
+`MANAGER_BILLING_API_URL= npx @galda/cli`. The client is a no-op without it
+(`engine/analytics-client.mjs`). An in-app off switch is being implemented,
+and this section will be updated when it ships.
 
 ## Reporting a vulnerability
 
-<!-- TODO(Masa): security contact address. -->
+Write to hello@galda.app. Please include what you did, what you saw, and the
+version of Galda you were running.
 
 ## 日本語
 

package/engine/analytics-client.mjs

@@ -2,6 +2,10 @@
 // (docs/DATA-RETENTION-PLAN.md). Posts a single Tier-A event to the billing-api
 // /events endpoint.
 //
+// OFF SWITCH: `emitEvent` sends nothing when the person has turned "Share usage
+// data" off, and nothing when remote access is off — see analytics-pref.mjs for
+// why the second one is not optional.
+//
 // PRIVACY: NEVER pass prompt / task text / file paths. Only an event type, a
 // user identifier (the endpoint hashes it into a pseudonymous id), and
 // allow-listed non-sensitive meta (project_hash / plan / status / model /
@@ -18,16 +22,40 @@
 //   task_interrupted  → engine, task.status = 'interrupted'
 //   review_approved / review_dismissed → on the review action
 
+import { readAnalyticsPref, resolveAnalyticsEnabled } from './analytics-pref.mjs';
+import { readRelayPref, resolveRelayEnabled } from './relay-pref.mjs';
+
 const BILLING_API_URL = (process.env.MANAGER_BILLING_API_URL ?? '').replace(/\/$/, '');
 
+// Where the two preference files live, and what the relay is configured with.
+// Supplied by whoever owns those (server.mjs at boot) rather than recomputed
+// here: DATA_DIR has fallbacks this module has no business duplicating, and a
+// second copy of that logic is how a switch ends up reading a file nobody writes.
+let prefContext = { dataDir: null, relayUrl: process.env.RELAY_URL ?? '' };
+export function setAnalyticsContext({ dataDir, relayUrl } = {}) {
+  prefContext = {
+    dataDir: dataDir ?? prefContext.dataDir,
+    relayUrl: relayUrl ?? prefContext.relayUrl,
+  };
+}
+
+// Read at every event, not cached: a person who has just turned the switch off
+// expects the next thing they do not to be reported, and a cache would make that
+// depend on when the process last restarted. Events are rare (a task starting,
+// a task finishing), so two small file reads cost nothing worth keeping.
 export function analyticsEnabled() {
-  return Boolean(BILLING_API_URL);
+  const { dataDir, relayUrl } = prefContext;
+  return resolveAnalyticsEnabled({
+    configured: Boolean(BILLING_API_URL),
+    pref: dataDir ? readAnalyticsPref(dataDir) : null,
+    relayEnabled: dataDir ? resolveRelayEnabled({ relayUrl, pref: readRelayPref(dataDir) }) : undefined,
+  });
 }
 
 // type: one of the EVENT_TYPES; uid: account email/id (hashed server-side);
 // meta: optional allow-listed non-sensitive fields only.
 export function emitEvent(type, uid, meta) {
-  if (!BILLING_API_URL) return; // analytics off when unconfigured — no-op
+  if (!analyticsEnabled()) return; // unconfigured, switched off, or relay off — no-op
   try {
     fetch(`${BILLING_API_URL}/events`, {
       method: 'POST',

package/engine/analytics-pref.mjs

@@ -0,0 +1,67 @@
+// Agent Manager — usage-analytics preference (the "Share usage data" switch)
+//
+// WHY THIS EXISTS: two published documents already promised this switch and the
+// product did not have it (found 2026-08-02).
+//
+//   docs/SECURITY.md   — "With the relay off, nothing is collected. Not reduced,
+//                         not anonymized: nothing."
+//   data-controls.html — "Product telemetry … can be turned off completely in
+//                         Settings → Privacy → 'Share usage data'."
+//
+// Neither was true. `emitEvent` was guarded by `if (!BILLING_API_URL) return`
+// and nothing else: it never looked at the relay preference, and the setting the
+// second document names by string did not exist anywhere in the app. A promise
+// in a security document that the code does not keep is worse than no promise —
+// it is the one thing a person cannot check for themselves.
+//
+// Deliberately the same shape as relay-pref.mjs (a file in DATA_DIR, read at
+// use, default ON), because these two switches are read together and a person
+// setting one will look for the other in the same place.
+
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+export const ANALYTICS_PREF_FILE = 'analytics-pref.json';
+
+export function analyticsPrefPath(dataDir) {
+  return join(dataDir, ANALYTICS_PREF_FILE);
+}
+
+// Should a usage event be sent? Pure — no clock, no I/O, no env.
+//
+//   configured   : is there a billing/analytics endpoint at all (BILLING_API_URL)
+//   pref         : the user's saved choice (true | false | null when never set)
+//   relayEnabled : is remote access on (resolveRelayEnabled)
+//
+// Default is ON: a fresh install reports the handful of Tier-A events described
+// in docs/DATA-RETENTION-PLAN.md. Only an explicit `false` turns it off, so a
+// corrupt or missing preference file can never silently disable it either way.
+//
+// Relay off wins over everything. SECURITY.md sells that mode as "nothing leaves
+// your machine", so a usage event escaping it would invalidate every other claim
+// on that page. Someone who turns off remote access has not opted into analytics
+// by omission — they have said the opposite in the plainest way the product offers.
+export function resolveAnalyticsEnabled({ configured, pref, relayEnabled } = {}) {
+  if (!configured) return false;
+  if (relayEnabled === false) return false;
+  return pref !== false;
+}
+
+// Read the saved preference. Returns null when the user has never chosen, so
+// callers can tell "unset" from "explicitly on".
+export function readAnalyticsPref(dataDir) {
+  try {
+    const raw = JSON.parse(readFileSync(analyticsPrefPath(dataDir), 'utf8'));
+    return typeof raw?.enabled === 'boolean' ? raw.enabled : null;
+  } catch {
+    return null; // never set, unreadable, or corrupt — all mean "no choice made"
+  }
+}
+
+// Save the preference. Throws on a real write failure so the endpoint can report
+// it rather than telling the user it saved something it did not.
+export function writeAnalyticsPref(dataDir, enabled) {
+  const value = enabled === true;
+  writeFileSync(analyticsPrefPath(dataDir), JSON.stringify({ enabled: value, at: Date.now() }) + '\n');
+  return value;
+}

package/engine/server.mjs

@@ -14,7 +14,7 @@
 import { createServer } from 'node:http';
 import { spawn, execFile, spawnSync } from 'node:child_process';
 import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, statSync, readdirSync, unlinkSync, rmSync } from 'node:fs';
-import { emitEvent } from './analytics-client.mjs';
+import { emitEvent, setAnalyticsContext } from './analytics-client.mjs';
 import { randomBytes, createHash, randomUUID } from 'node:crypto';
 import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
@@ -25,6 +25,7 @@ import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refineP
 import { migrateRequirementModel, validateRequirementModel } from './requirement-model.mjs';
 import { buildManagerVerificationChecks, buildRequirementVerificationEvidence, mergeRequirementVerificationEvidence } from './requirement-verification.mjs';
 import { readRelayPref, writeRelayPref, resolveRelayEnabled } from './relay-pref.mjs';
+import { readAnalyticsPref, writeAnalyticsPref, resolveAnalyticsEnabled } from './analytics-pref.mjs';
 import { createSerialQueue } from './lib.mjs';
 import { wantsPullRequest } from './lib.mjs';
 import { parseRequirementEvidence, unmappedChangedFiles, previewOpensSomethingElse } from './lib.mjs';
@@ -43,6 +44,10 @@ const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const DATA_DIR = process.env.MANAGER_HOME
   ?? (existsSync(join(ROOT, '.git')) ? join(ROOT, 'engine') : join(homedir(), '.manager-for-ai'));
 mkdirSync(DATA_DIR, { recursive: true });
+// The analytics client reads the "Share usage data" and remote-access
+// preferences out of DATA_DIR before every event; it is told where that is
+// rather than recomputing the fallbacks above.
+setAnalyticsContext({ dataDir: DATA_DIR, relayUrl: process.env.RELAY_URL ?? '' });
 // MANAGER_PORT=0 asks the OS for a free port; the real one is only known once
 // the listen below succeeds, so this is rebound there (before anything prints
 // or links to it).
@@ -4511,6 +4516,45 @@ const server = createServer(async (req, res) => {
     });
     return;
   }
+  // The "Share usage data" switch (docs/SECURITY.md, data-controls.html). Same
+  // shape as /api/relay-pref above, because they are the same kind of promise and
+  // the settings panel shows them together. `enabled` is what actually happens —
+  // it is false when analytics are unconfigured OR remote access is off, whatever
+  // this preference says, so the UI can never show "on" for something that sends
+  // nothing.
+  if (url.pathname === '/api/analytics-pref' && req.method === 'GET') {
+    const pref = readAnalyticsPref(DATA_DIR);
+    const relayEnabled = resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref: readRelayPref(DATA_DIR) });
+    return json(res, 200, {
+      pref,
+      enabled: resolveAnalyticsEnabled({ configured: Boolean(BILLING_API_URL), pref, relayEnabled }),
+      configured: Boolean(BILLING_API_URL),
+      relayEnabled,
+    });
+  }
+  if (url.pathname === '/api/analytics-pref' && req.method === 'POST') {
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      let input;
+      try { input = JSON.parse(body || '{}'); } catch { return json(res, 400, { error: 'bad json' }); }
+      // A boolean and nothing else — same reason as the relay switch: "off"/0/
+      // undefined is how a privacy setting silently becomes the opposite of what
+      // was clicked.
+      if (typeof input?.enabled !== 'boolean') return json(res, 400, { error: 'enabled must be a boolean' });
+      let saved;
+      try { saved = writeAnalyticsPref(DATA_DIR, input.enabled); }
+      catch (e) { return json(res, 500, { error: String(e?.message ?? e) }); }
+      const relayEnabled = resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref: readRelayPref(DATA_DIR) });
+      return json(res, 200, {
+        pref: saved,
+        enabled: resolveAnalyticsEnabled({ configured: Boolean(BILLING_API_URL), pref: saved, relayEnabled }),
+        configured: Boolean(BILLING_API_URL),
+        relayEnabled,
+      });
+    });
+    return;
+  }
   // POST /api/signout — forget the local license so the settings panel can
   // offer a plain "Log out" instead of requiring the `--signin` CLI flag to
   // switch Google accounts. Clears the on-disk token and the in-memory cache;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.120",
+  "version": "0.10.121",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {