@galda/cli 0.10.120 → 0.10.122

package/app/index.html

@@ -12843,6 +12843,7 @@ function gearSetHTML(){
   <div class="srow"><div class="sl">About Galda<span class="sd">What it is, what the agent can touch, and what leaves this machine</span></div>
     <button class="optchip" data-gabout="1">Open</button></div>
   ${remoteAccessRow()}
+  ${shareUsageDataRow()}
   ${stability}
   ${gearRulesHTML()}
   ${hostReadinessRow()}
@@ -12953,6 +12954,46 @@ function remoteAccessRow(){
     <button class="optchip${on ? ' on' : ''}" data-grelay="on">On</button>
     <button class="optchip${on ? '' : ' on'}" data-grelay="off">Off</button></div>`;
 }
+// "Share usage data" — the usage-analytics switch (engine: /api/analytics-pref).
+//
+// The label is not a choice: data-controls.html tells people to look for
+// Settings → Privacy → "Share usage data", and until 2026-08-02 that string
+// appeared nowhere in this file. Renaming the row means editing that document
+// in the same breath.
+//
+// Sits directly under Remote access because they are the same kind of promise,
+// and because one overrides the other: with the relay off nothing is sent at
+// all (docs/SECURITY.md), so the chips are shown as off and out of service —
+// a switch that controls nothing must not look live (§3 段階開示).
+function shareUsageDataRow(){
+  const ap = state.analyticsPref;
+  if (!ap || !ap.configured) return '';   // nothing configured to send to
+  const relayOff = ap.relayEnabled === false;
+  const on = ap.enabled === true;
+  const desc = relayOff
+    ? 'Off — remote access is off, so nothing is sent at all.'
+    : on
+      ? 'On — a few product events (a task started, finished, failed). Never your prompts, code, or file paths.'
+      : 'Off — no usage events are sent.';
+  const dis = relayOff ? ' disabled' : '';
+  return `<div class="srow"><div class="sl">Share usage data<span class="sd">${esc(desc)}</span></div>
+    <button class="optchip${on ? ' on' : ''}" data-ganalytics="on"${dis}>On</button>
+    <button class="optchip${on ? '' : ' on'}" data-ganalytics="off"${dis}>Off</button></div>`;
+}
+async function loadAnalyticsPref(){
+  try { const r = await fetch(withKey('/api/analytics-pref')); state.analyticsPref = r.ok ? await r.json() : null; }
+  catch { state.analyticsPref = null; }
+  if ($('gearPop') && custTab === 'settings') buildGearPop();
+}
+async function saveAnalyticsPref(enabled){
+  const r = await fetch(withKey('/api/analytics-pref'), {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ enabled }),
+  });
+  if (!r.ok) return showErr('Failed to save.');
+  state.analyticsPref = await r.json();
+  if ($('gearPop').classList.contains('open')) buildGearPop();
+}
 async function loadRelayPref(){
   try { const r = await fetch(withKey('/api/relay-pref')); state.relayPref = r.ok ? await r.json() : null; }
   catch { state.relayPref = null; }
@@ -12965,6 +13006,9 @@ async function saveRelayPref(enabled){
   });
   if (!r.ok) return showErr('Failed to save.');
   state.relayPref = await r.json();
+  // Remote access decides whether anything is sent at all, so the row below it
+  // is now saying something different — ask the engine rather than guess.
+  await loadAnalyticsPref();
   if ($('gearPop').classList.contains('open')) buildGearPop();
 }
 async function loadStability(){
@@ -13059,6 +13103,7 @@ function buildGearPop(){
     wireGearCommon(pop);
     for (const b of pop.querySelectorAll('[data-gslang]')) b.onclick = () => saveLang(b.dataset.gslang);
     for (const b of pop.querySelectorAll('[data-grelay]')) b.onclick = () => saveRelayPref(b.dataset.grelay === 'on');
+    for (const b of pop.querySelectorAll('[data-ganalytics]')) b.onclick = () => saveAnalyticsPref(b.dataset.ganalytics === 'on');
     for (const b of pop.querySelectorAll('[data-gabout]')) b.onclick = () => openAbout();
     const signBtn = pop.querySelector('[data-gsignin]');
     if (signBtn) signBtn.onclick = async () => {
@@ -13086,6 +13131,7 @@ function buildGearPop(){
     loadProjectRules();
     if (!state.stability) loadStability();
     if (!state.relayPref) loadRelayPref();
+    if (!state.analyticsPref) loadAnalyticsPref();
     return;
   }
   if (custTab === 'mcp') {

package/docs/SECURITY.md

@@ -154,17 +154,17 @@ Each carries a timestamp and a pseudonymous account id, and nothing else.
 - Repository names or paths
 - Proof screenshots and recordings
 
-**Paid business plans: analytics are off.** On business plans no product events
-are collected at all, the way Cursor forces Privacy Mode on for teams. You do
-not have to configure anything.
-
-**With the relay off, nothing is collected.** Not reduced, not anonymized:
-nothing. A mode sold as "nothing leaves your machine" that quietly reported
-usage would invalidate every other claim on this page, so it does not.
+**Analytics do not follow the relay switch today.** Turning remote access off
+stops the tunnel, but the product events above are still sent. If you want
+zero analytics, start Galda with the endpoint unset:
+`MANAGER_BILLING_API_URL= npx @galda/cli`. The client is a no-op without it
+(`engine/analytics-client.mjs`). An in-app off switch is being implemented,
+and this section will be updated when it ships.
 
 ## Reporting a vulnerability
 
-<!-- TODO(Masa): security contact address. -->
+Write to hello@galda.app. Please include what you did, what you saw, and the
+version of Galda you were running.
 
 ## 日本語
 

package/engine/analytics-client.mjs

@@ -2,6 +2,10 @@
 // (docs/DATA-RETENTION-PLAN.md). Posts a single Tier-A event to the billing-api
 // /events endpoint.
 //
+// OFF SWITCH: `emitEvent` sends nothing when the person has turned "Share usage
+// data" off, and nothing when remote access is off — see analytics-pref.mjs for
+// why the second one is not optional.
+//
 // PRIVACY: NEVER pass prompt / task text / file paths. Only an event type, a
 // user identifier (the endpoint hashes it into a pseudonymous id), and
 // allow-listed non-sensitive meta (project_hash / plan / status / model /
@@ -18,16 +22,42 @@
 //   task_interrupted  → engine, task.status = 'interrupted'
 //   review_approved / review_dismissed → on the review action
 
+import { readAnalyticsPref, resolveAnalyticsEnabled } from './analytics-pref.mjs';
+import { readRelayPref, resolveRemoteAccess, relayClientRunning } from './relay-pref.mjs';
+
 const BILLING_API_URL = (process.env.MANAGER_BILLING_API_URL ?? '').replace(/\/$/, '');
 
+// Where the two preference files live, and what the relay is configured with.
+// Supplied by whoever owns those (server.mjs at boot) rather than recomputed
+// here: DATA_DIR has fallbacks this module has no business duplicating, and a
+// second copy of that logic is how a switch ends up reading a file nobody writes.
+let prefContext = { dataDir: null, relayUrl: process.env.RELAY_URL ?? '' };
+export function setAnalyticsContext({ dataDir, relayUrl } = {}) {
+  prefContext = {
+    dataDir: dataDir ?? prefContext.dataDir,
+    relayUrl: relayUrl ?? prefContext.relayUrl,
+  };
+}
+
+// Read at every event, not cached: a person who has just turned the switch off
+// expects the next thing they do not to be reported, and a cache would make that
+// depend on when the process last restarted. Events are rare (a task starting,
+// a task finishing), so two small file reads cost nothing worth keeping.
 export function analyticsEnabled() {
-  return Boolean(BILLING_API_URL);
+  const { dataDir, relayUrl } = prefContext;
+  return resolveAnalyticsEnabled({
+    configured: Boolean(BILLING_API_URL),
+    pref: dataDir ? readAnalyticsPref(dataDir) : null,
+    relayEnabled: dataDir
+      ? resolveRemoteAccess({ relayUrl, pref: readRelayPref(dataDir), relayRunning: relayClientRunning(dataDir) }).enabled
+      : undefined,
+  });
 }
 
 // type: one of the EVENT_TYPES; uid: account email/id (hashed server-side);
 // meta: optional allow-listed non-sensitive fields only.
 export function emitEvent(type, uid, meta) {
-  if (!BILLING_API_URL) return; // analytics off when unconfigured — no-op
+  if (!analyticsEnabled()) return; // unconfigured, switched off, or relay off — no-op
   try {
     fetch(`${BILLING_API_URL}/events`, {
       method: 'POST',

package/engine/analytics-pref.mjs

@@ -0,0 +1,67 @@
+// Agent Manager — usage-analytics preference (the "Share usage data" switch)
+//
+// WHY THIS EXISTS: two published documents already promised this switch and the
+// product did not have it (found 2026-08-02).
+//
+//   docs/SECURITY.md   — "With the relay off, nothing is collected. Not reduced,
+//                         not anonymized: nothing."
+//   data-controls.html — "Product telemetry … can be turned off completely in
+//                         Settings → Privacy → 'Share usage data'."
+//
+// Neither was true. `emitEvent` was guarded by `if (!BILLING_API_URL) return`
+// and nothing else: it never looked at the relay preference, and the setting the
+// second document names by string did not exist anywhere in the app. A promise
+// in a security document that the code does not keep is worse than no promise —
+// it is the one thing a person cannot check for themselves.
+//
+// Deliberately the same shape as relay-pref.mjs (a file in DATA_DIR, read at
+// use, default ON), because these two switches are read together and a person
+// setting one will look for the other in the same place.
+
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+export const ANALYTICS_PREF_FILE = 'analytics-pref.json';
+
+export function analyticsPrefPath(dataDir) {
+  return join(dataDir, ANALYTICS_PREF_FILE);
+}
+
+// Should a usage event be sent? Pure — no clock, no I/O, no env.
+//
+//   configured   : is there a billing/analytics endpoint at all (BILLING_API_URL)
+//   pref         : the user's saved choice (true | false | null when never set)
+//   relayEnabled : is remote access on (resolveRelayEnabled)
+//
+// Default is ON: a fresh install reports the handful of Tier-A events described
+// in docs/DATA-RETENTION-PLAN.md. Only an explicit `false` turns it off, so a
+// corrupt or missing preference file can never silently disable it either way.
+//
+// Relay off wins over everything. SECURITY.md sells that mode as "nothing leaves
+// your machine", so a usage event escaping it would invalidate every other claim
+// on that page. Someone who turns off remote access has not opted into analytics
+// by omission — they have said the opposite in the plainest way the product offers.
+export function resolveAnalyticsEnabled({ configured, pref, relayEnabled } = {}) {
+  if (!configured) return false;
+  if (relayEnabled === false) return false;
+  return pref !== false;
+}
+
+// Read the saved preference. Returns null when the user has never chosen, so
+// callers can tell "unset" from "explicitly on".
+export function readAnalyticsPref(dataDir) {
+  try {
+    const raw = JSON.parse(readFileSync(analyticsPrefPath(dataDir), 'utf8'));
+    return typeof raw?.enabled === 'boolean' ? raw.enabled : null;
+  } catch {
+    return null; // never set, unreadable, or corrupt — all mean "no choice made"
+  }
+}
+
+// Save the preference. Throws on a real write failure so the endpoint can report
+// it rather than telling the user it saved something it did not.
+export function writeAnalyticsPref(dataDir, enabled) {
+  const value = enabled === true;
+  writeFileSync(analyticsPrefPath(dataDir), JSON.stringify({ enabled: value, at: Date.now() }) + '\n');
+  return value;
+}

package/engine/relay-pref.mjs

@@ -18,6 +18,7 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 export const RELAY_PREF_FILE = 'relay-pref.json';
+export const RELAY_LOCK_FILE = 'relay-client.lock';
 
 export function relayPrefPath(dataDir) {
   return join(dataDir, RELAY_PREF_FILE);
@@ -55,3 +56,43 @@ export function writeRelayPref(dataDir, enabled) {
   writeFileSync(relayPrefPath(dataDir), JSON.stringify({ enabled: value, at: Date.now() }) + '\n');
   return value;
 }
+
+// Is remote access actually on, from the server's point of view?
+//
+// `resolveRelayEnabled` above answers the LAUNCHER's question — "should I start a
+// relay?" — from the URL it was configured with. The server cannot use the same
+// answer, because it does not always have that env var: Masa's resident instance
+// is launched by launchd as `node engine/server.mjs`, not through
+// `bin/manager-for-ai.mjs` which is where RELAY_URL gets set. On 2026-08-02 that
+// made the server report `relayEnabled:false` while a relay-client was connected
+// and serving app.galda.app — so Settings said "remote access is off" to someone
+// whose remote access was on, and the analytics gate (analytics-pref.mjs) went
+// quiet on that install for a reason that was not true.
+//
+// A running relay-client is the ground truth: it holds a PID lock in the same
+// DATA_DIR, which is what bin/manager-for-ai.mjs already checks for its
+// duplicate-instance guard. Env is the fallback, not the authority.
+//
+//   pref === false  → off. The person said so, and that beats any evidence.
+//   otherwise       → on if a relay is running OR one is configured.
+export function resolveRemoteAccess({ relayUrl, pref, relayRunning } = {}) {
+  const configured = Boolean(relayUrl) || Boolean(relayRunning);
+  return { configured, enabled: configured && pref !== false };
+}
+
+// Read the relay-client's PID lock and ask the OS whether that process is alive.
+// `isAlive` is injected so the decision stays testable without spawning anything;
+// callers pass a real probe (see relayClientRunning below).
+export function relayLockIsLive(raw, isAlive) {
+  let lock;
+  try { lock = JSON.parse(String(raw ?? '')); } catch { return false; }
+  const pid = Number(lock?.pid);
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { return Boolean(isAlive(pid)); } catch { return false; }
+}
+
+export function relayClientRunning(dataDir) {
+  let raw = '';
+  try { raw = readFileSync(join(dataDir, RELAY_LOCK_FILE), 'utf8'); } catch { return false; }
+  return relayLockIsLive(raw, (pid) => { try { process.kill(pid, 0); return true; } catch { return false; } });
+}

package/engine/server.mjs

@@ -14,7 +14,7 @@
 import { createServer } from 'node:http';
 import { spawn, execFile, spawnSync } from 'node:child_process';
 import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, statSync, readdirSync, unlinkSync, rmSync } from 'node:fs';
-import { emitEvent } from './analytics-client.mjs';
+import { emitEvent, setAnalyticsContext } from './analytics-client.mjs';
 import { randomBytes, createHash, randomUUID } from 'node:crypto';
 import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
@@ -24,7 +24,8 @@ import { bootBanner, bootDestination, folderLabel, chooseFolderScript, parseChos
 import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, classifyWorkerFailure, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildReviewAttemptLedger, latestGoalOutcomeTask, buildDirtyWorkspacePrBlock, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, rebasePreviewUrl, shouldCreateGoalPR, normalizePullRequestUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, DEFAULT_PRIORITY, normalizePriority, isAcceptedPriority, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, buildQueueWaits, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, autoFoldReviewsEnabled, parseGitUnifiedDiffLocations, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyPrSafety, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildVerificationInfraError, verificationInfraErrorFrom, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, testFailureReason, manualTestRetryPrompt, isNothingVerifiable, isNothingVerifiableForPR, isSuspiciouslyIncompleteDone, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, shouldUsePlannerForGoal, RUN_DECL_FILE, REQUIREMENT_EVIDENCE_FILE, parseRequirementEvidenceDocument, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, buildGoalMessage, serializeGoalMessage, parseGoalMessages, computeInternalQualityMetrics, classifyInternalQualityTaskError, resolveWorkspaceMode, goalSessionFor, setGoalAgentSession, switchGoalAgentSession, parseApprovalRequest } from './lib.mjs';
 import { migrateRequirementModel, validateRequirementModel } from './requirement-model.mjs';
 import { buildManagerVerificationChecks, buildRequirementVerificationEvidence, mergeRequirementVerificationEvidence } from './requirement-verification.mjs';
-import { readRelayPref, writeRelayPref, resolveRelayEnabled } from './relay-pref.mjs';
+import { readRelayPref, writeRelayPref, resolveRemoteAccess, relayClientRunning } from './relay-pref.mjs';
+import { readAnalyticsPref, writeAnalyticsPref, resolveAnalyticsEnabled } from './analytics-pref.mjs';
 import { createSerialQueue } from './lib.mjs';
 import { wantsPullRequest } from './lib.mjs';
 import { parseRequirementEvidence, unmappedChangedFiles, previewOpensSomethingElse } from './lib.mjs';
@@ -43,6 +44,10 @@ const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const DATA_DIR = process.env.MANAGER_HOME
   ?? (existsSync(join(ROOT, '.git')) ? join(ROOT, 'engine') : join(homedir(), '.manager-for-ai'));
 mkdirSync(DATA_DIR, { recursive: true });
+// The analytics client reads the "Share usage data" and remote-access
+// preferences out of DATA_DIR before every event; it is told where that is
+// rather than recomputing the fallbacks above.
+setAnalyticsContext({ dataDir: DATA_DIR, relayUrl: process.env.RELAY_URL ?? '' });
 // MANAGER_PORT=0 asks the OS for a free port; the real one is only known once
 // the listen below succeeds, so this is rebound there (before anything prints
 // or links to it).
@@ -4458,6 +4463,16 @@ const server = createServer(async (req, res) => {
     return;
   }
 
+  // What the server can honestly say about remote access. NOT `RELAY_URL` alone:
+  // launchd starts this process as `node engine/server.mjs`, so the variable
+  // bin/manager-for-ai.mjs sets is simply absent there while a relay-client is
+  // connected and serving app.galda.app. A live relay lock is the ground truth.
+  const remoteAccess = () => resolveRemoteAccess({
+    relayUrl: process.env.RELAY_URL,
+    pref: readRelayPref(DATA_DIR),
+    relayRunning: relayClientRunning(DATA_DIR),
+  });
+
   // GET /api/relay-status — is this account's relay slot held by ANOTHER device?
   // The relay-client (a separate process) writes relay-status.json when it stands
   // down after being evicted (see relay-client.mjs / lib.mjs relayReconnectDecision).
@@ -4485,11 +4500,8 @@ const server = createServer(async (req, res) => {
   // relay-takeover.req above.
   if (url.pathname === '/api/relay-pref' && req.method === 'GET') {
     const pref = readRelayPref(DATA_DIR);
-    return json(res, 200, {
-      pref,
-      enabled: resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref }),
-      configured: Boolean(process.env.RELAY_URL),
-    });
+    const ra = remoteAccess();
+    return json(res, 200, { pref, enabled: ra.enabled, configured: ra.configured });
   }
   if (url.pathname === '/api/relay-pref' && req.method === 'POST') {
     let body = '';
@@ -4503,10 +4515,46 @@ const server = createServer(async (req, res) => {
       let saved;
       try { saved = writeRelayPref(DATA_DIR, input.enabled); }
       catch (e) { return json(res, 500, { error: String(e?.message ?? e) }); }
+      const ra = resolveRemoteAccess({ relayUrl: process.env.RELAY_URL, pref: saved, relayRunning: relayClientRunning(DATA_DIR) });
+      return json(res, 200, { pref: saved, enabled: ra.enabled, configured: ra.configured });
+    });
+    return;
+  }
+  // The "Share usage data" switch (docs/SECURITY.md, data-controls.html). Same
+  // shape as /api/relay-pref above, because they are the same kind of promise and
+  // the settings panel shows them together. `enabled` is what actually happens —
+  // it is false when analytics are unconfigured OR remote access is off, whatever
+  // this preference says, so the UI can never show "on" for something that sends
+  // nothing.
+  if (url.pathname === '/api/analytics-pref' && req.method === 'GET') {
+    const pref = readAnalyticsPref(DATA_DIR);
+    const relayEnabled = remoteAccess().enabled;
+    return json(res, 200, {
+      pref,
+      enabled: resolveAnalyticsEnabled({ configured: Boolean(BILLING_API_URL), pref, relayEnabled }),
+      configured: Boolean(BILLING_API_URL),
+      relayEnabled,
+    });
+  }
+  if (url.pathname === '/api/analytics-pref' && req.method === 'POST') {
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      let input;
+      try { input = JSON.parse(body || '{}'); } catch { return json(res, 400, { error: 'bad json' }); }
+      // A boolean and nothing else — same reason as the relay switch: "off"/0/
+      // undefined is how a privacy setting silently becomes the opposite of what
+      // was clicked.
+      if (typeof input?.enabled !== 'boolean') return json(res, 400, { error: 'enabled must be a boolean' });
+      let saved;
+      try { saved = writeAnalyticsPref(DATA_DIR, input.enabled); }
+      catch (e) { return json(res, 500, { error: String(e?.message ?? e) }); }
+      const relayEnabled = remoteAccess().enabled;
       return json(res, 200, {
         pref: saved,
-        enabled: resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref: saved }),
-        configured: Boolean(process.env.RELAY_URL),
+        enabled: resolveAnalyticsEnabled({ configured: Boolean(BILLING_API_URL), pref: saved, relayEnabled }),
+        configured: Boolean(BILLING_API_URL),
+        relayEnabled,
       });
     });
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.120",
+  "version": "0.10.122",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {