@galda/cli 0.10.121 → 0.10.122

package/engine/analytics-client.mjs

@@ -23,7 +23,7 @@
 //   review_approved / review_dismissed → on the review action
 
 import { readAnalyticsPref, resolveAnalyticsEnabled } from './analytics-pref.mjs';
-import { readRelayPref, resolveRelayEnabled } from './relay-pref.mjs';
+import { readRelayPref, resolveRemoteAccess, relayClientRunning } from './relay-pref.mjs';
 
 const BILLING_API_URL = (process.env.MANAGER_BILLING_API_URL ?? '').replace(/\/$/, '');
 
@@ -48,7 +48,9 @@ export function analyticsEnabled() {
   return resolveAnalyticsEnabled({
     configured: Boolean(BILLING_API_URL),
     pref: dataDir ? readAnalyticsPref(dataDir) : null,
-    relayEnabled: dataDir ? resolveRelayEnabled({ relayUrl, pref: readRelayPref(dataDir) }) : undefined,
+    relayEnabled: dataDir
+      ? resolveRemoteAccess({ relayUrl, pref: readRelayPref(dataDir), relayRunning: relayClientRunning(dataDir) }).enabled
+      : undefined,
   });
 }
 

package/engine/relay-pref.mjs

@@ -18,6 +18,7 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 export const RELAY_PREF_FILE = 'relay-pref.json';
+export const RELAY_LOCK_FILE = 'relay-client.lock';
 
 export function relayPrefPath(dataDir) {
   return join(dataDir, RELAY_PREF_FILE);
@@ -55,3 +56,43 @@ export function writeRelayPref(dataDir, enabled) {
   writeFileSync(relayPrefPath(dataDir), JSON.stringify({ enabled: value, at: Date.now() }) + '\n');
   return value;
 }
+
+// Is remote access actually on, from the server's point of view?
+//
+// `resolveRelayEnabled` above answers the LAUNCHER's question — "should I start a
+// relay?" — from the URL it was configured with. The server cannot use the same
+// answer, because it does not always have that env var: Masa's resident instance
+// is launched by launchd as `node engine/server.mjs`, not through
+// `bin/manager-for-ai.mjs` which is where RELAY_URL gets set. On 2026-08-02 that
+// made the server report `relayEnabled:false` while a relay-client was connected
+// and serving app.galda.app — so Settings said "remote access is off" to someone
+// whose remote access was on, and the analytics gate (analytics-pref.mjs) went
+// quiet on that install for a reason that was not true.
+//
+// A running relay-client is the ground truth: it holds a PID lock in the same
+// DATA_DIR, which is what bin/manager-for-ai.mjs already checks for its
+// duplicate-instance guard. Env is the fallback, not the authority.
+//
+//   pref === false  → off. The person said so, and that beats any evidence.
+//   otherwise       → on if a relay is running OR one is configured.
+export function resolveRemoteAccess({ relayUrl, pref, relayRunning } = {}) {
+  const configured = Boolean(relayUrl) || Boolean(relayRunning);
+  return { configured, enabled: configured && pref !== false };
+}
+
+// Read the relay-client's PID lock and ask the OS whether that process is alive.
+// `isAlive` is injected so the decision stays testable without spawning anything;
+// callers pass a real probe (see relayClientRunning below).
+export function relayLockIsLive(raw, isAlive) {
+  let lock;
+  try { lock = JSON.parse(String(raw ?? '')); } catch { return false; }
+  const pid = Number(lock?.pid);
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { return Boolean(isAlive(pid)); } catch { return false; }
+}
+
+export function relayClientRunning(dataDir) {
+  let raw = '';
+  try { raw = readFileSync(join(dataDir, RELAY_LOCK_FILE), 'utf8'); } catch { return false; }
+  return relayLockIsLive(raw, (pid) => { try { process.kill(pid, 0); return true; } catch { return false; } });
+}

package/engine/server.mjs

@@ -24,7 +24,7 @@ import { bootBanner, bootDestination, folderLabel, chooseFolderScript, parseChos
 import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, classifyWorkerFailure, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildReviewAttemptLedger, latestGoalOutcomeTask, buildDirtyWorkspacePrBlock, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, rebasePreviewUrl, shouldCreateGoalPR, normalizePullRequestUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, DEFAULT_PRIORITY, normalizePriority, isAcceptedPriority, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, buildQueueWaits, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, autoFoldReviewsEnabled, parseGitUnifiedDiffLocations, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyPrSafety, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildVerificationInfraError, verificationInfraErrorFrom, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, testFailureReason, manualTestRetryPrompt, isNothingVerifiable, isNothingVerifiableForPR, isSuspiciouslyIncompleteDone, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, shouldUsePlannerForGoal, RUN_DECL_FILE, REQUIREMENT_EVIDENCE_FILE, parseRequirementEvidenceDocument, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, buildGoalMessage, serializeGoalMessage, parseGoalMessages, computeInternalQualityMetrics, classifyInternalQualityTaskError, resolveWorkspaceMode, goalSessionFor, setGoalAgentSession, switchGoalAgentSession, parseApprovalRequest } from './lib.mjs';
 import { migrateRequirementModel, validateRequirementModel } from './requirement-model.mjs';
 import { buildManagerVerificationChecks, buildRequirementVerificationEvidence, mergeRequirementVerificationEvidence } from './requirement-verification.mjs';
-import { readRelayPref, writeRelayPref, resolveRelayEnabled } from './relay-pref.mjs';
+import { readRelayPref, writeRelayPref, resolveRemoteAccess, relayClientRunning } from './relay-pref.mjs';
 import { readAnalyticsPref, writeAnalyticsPref, resolveAnalyticsEnabled } from './analytics-pref.mjs';
 import { createSerialQueue } from './lib.mjs';
 import { wantsPullRequest } from './lib.mjs';
@@ -4463,6 +4463,16 @@ const server = createServer(async (req, res) => {
     return;
   }
 
+  // What the server can honestly say about remote access. NOT `RELAY_URL` alone:
+  // launchd starts this process as `node engine/server.mjs`, so the variable
+  // bin/manager-for-ai.mjs sets is simply absent there while a relay-client is
+  // connected and serving app.galda.app. A live relay lock is the ground truth.
+  const remoteAccess = () => resolveRemoteAccess({
+    relayUrl: process.env.RELAY_URL,
+    pref: readRelayPref(DATA_DIR),
+    relayRunning: relayClientRunning(DATA_DIR),
+  });
+
   // GET /api/relay-status — is this account's relay slot held by ANOTHER device?
   // The relay-client (a separate process) writes relay-status.json when it stands
   // down after being evicted (see relay-client.mjs / lib.mjs relayReconnectDecision).
@@ -4490,11 +4500,8 @@ const server = createServer(async (req, res) => {
   // relay-takeover.req above.
   if (url.pathname === '/api/relay-pref' && req.method === 'GET') {
     const pref = readRelayPref(DATA_DIR);
-    return json(res, 200, {
-      pref,
-      enabled: resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref }),
-      configured: Boolean(process.env.RELAY_URL),
-    });
+    const ra = remoteAccess();
+    return json(res, 200, { pref, enabled: ra.enabled, configured: ra.configured });
   }
   if (url.pathname === '/api/relay-pref' && req.method === 'POST') {
     let body = '';
@@ -4508,11 +4515,8 @@ const server = createServer(async (req, res) => {
       let saved;
       try { saved = writeRelayPref(DATA_DIR, input.enabled); }
       catch (e) { return json(res, 500, { error: String(e?.message ?? e) }); }
-      return json(res, 200, {
-        pref: saved,
-        enabled: resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref: saved }),
-        configured: Boolean(process.env.RELAY_URL),
-      });
+      const ra = resolveRemoteAccess({ relayUrl: process.env.RELAY_URL, pref: saved, relayRunning: relayClientRunning(DATA_DIR) });
+      return json(res, 200, { pref: saved, enabled: ra.enabled, configured: ra.configured });
     });
     return;
   }
@@ -4524,7 +4528,7 @@ const server = createServer(async (req, res) => {
   // nothing.
   if (url.pathname === '/api/analytics-pref' && req.method === 'GET') {
     const pref = readAnalyticsPref(DATA_DIR);
-    const relayEnabled = resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref: readRelayPref(DATA_DIR) });
+    const relayEnabled = remoteAccess().enabled;
     return json(res, 200, {
       pref,
       enabled: resolveAnalyticsEnabled({ configured: Boolean(BILLING_API_URL), pref, relayEnabled }),
@@ -4545,7 +4549,7 @@ const server = createServer(async (req, res) => {
       let saved;
       try { saved = writeAnalyticsPref(DATA_DIR, input.enabled); }
       catch (e) { return json(res, 500, { error: String(e?.message ?? e) }); }
-      const relayEnabled = resolveRelayEnabled({ relayUrl: process.env.RELAY_URL, pref: readRelayPref(DATA_DIR) });
+      const relayEnabled = remoteAccess().enabled;
       return json(res, 200, {
         pref: saved,
         enabled: resolveAnalyticsEnabled({ configured: Boolean(BILLING_API_URL), pref: saved, relayEnabled }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.121",
+  "version": "0.10.122",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {