@galda/cli 0.10.14 → 0.10.16

package/app/index.html

@@ -610,7 +610,10 @@
   .confetti-piece{position:fixed;pointer-events:none;z-index:9999;will-change:transform,opacity}
 
   /* connect modal */
-  .overlay{position:fixed;inset:0;background:rgba(0,0,0,.55);backdrop-filter:blur(6px);z-index:60;display:none;place-items:center}
+  .overlay{position:fixed;inset:0;background:rgba(0,0,0,.55);backdrop-filter:blur(6px);z-index:90;display:none;place-items:center}
+  /* z-index:90 (was 60): the customize-panel discard confirm (#deleteConfirmOverlay, shares this
+     class) can now fire while .gearpop (the customize panel, z-index:80) is open — it was
+     rendering BEHIND the panel it's confirming a discard for (Masa 2026-07-16, real screenshot). */
   .overlay.show{display:grid}
   .modal{width:640px;max-width:92vw;background:var(--surface);border:1px solid var(--hair2);border-radius:16px;padding:20px 22px;box-shadow:0 24px 70px rgba(0,0,0,.6)}
   .modal h3{margin:0 0 6px;font-size:15px;letter-spacing:-.01em}
@@ -619,6 +622,12 @@
     border-radius:9px;padding:11px 12px;white-space:pre-wrap;word-break:break-all;line-height:1.55}
   .modal .mrow{display:flex;gap:8px;margin-top:10px}
   .mbtn{height:30px;padding:0 14px;border-radius:9px;border:0;background:var(--iri);color:var(--on-accent);font-size:12.5px;font-weight:600;cursor:pointer}
+  /* the bare .mbtn fill is --iri, the AI-signature rainbow (logo/send-ring only per DESIGN-RULES
+     §5.5 "虹はAI要素だけ") — it must never be a generic button fill. .primary is the actual
+     neutral affirmative-action look, lifted from the customize panel's own existing Save button
+     (.gearpop .cfoot .cbtn.save below: same --ink/--invink tokens) rather than inventing a new
+     one (CDO decision, Masa 2026-07-16: "todo削除や他UIを参考にしてほしい"). */
+  .mbtn.primary{background:var(--ink);color:var(--invink)}
   .mbtn.ghost{background:transparent;border:1px solid var(--hair2);color:var(--ink2)}
   /* Soft destructive (DESIGN-RULES §7 決定ログ 2026-07-07深夜3: See allアクション色=Soft確定
      — 淡赤面＋濃赤文字。redは面を塗らない小要素専用の原則に沿い、フル赤塗りは使わない）. */
@@ -1074,8 +1083,10 @@
      the layout starts at the three cards. Frame = 14px all around (flagship .app{inset:14px}).
      Dev escape hatch: ?dev=1 (or localStorage devbar=1) adds body.devbar to show the bar. */
   body[data-layout="flagship"]:not(.devbar) .top{display:none}
-  body[data-layout="flagship"] #fsRoot{flex:1;min-height:0;display:flex;gap:12px;padding:14px;
-    --fscenterw:760px} /* single source of truth for the reading column — .fsstream (feed) and
+  body[data-layout="flagship"] #fsRoot{flex:1;min-height:0;display:flex;gap:12px;padding:14px;position:relative;
+    --fscenterw:760px} /* position:relative so .railgrip (a direct child, kept outside .fsrail's
+    overflow:hidden — see below) can be placed via left:calc(var(--railw)...) and never get clipped.
+    single source of truth for the reading column — .fsstream (feed) and
     .compwrap (composer) both read this var so they can never drift apart (fix: composer was
     reported "narrow vs the text above" — both already used the same 760px, but as two separate
     literals; centralising removes the risk of future edits widening one without the other) */
@@ -1092,17 +1103,23 @@
   #fsRoot .fsrail{flex:0 0 var(--railw,168px);display:flex;flex-direction:column;padding:14px 10px;position:relative;transition:flex-basis .28s cubic-bezier(.4,0,.2,1);
     min-width:0;overflow:hidden} /* CDO reference: the rail is a narrow lane; long project names ellipsize inside it instead of widening the whole left side */
   #fsRoot .fsrail.noanim{transition:none}
-  #fsRoot .railgrip{position:absolute;right:0;top:0;bottom:0;width:12px;cursor:col-resize;z-index:5}
-  /* right:0 (was -15px): the rail has overflow:hidden for name-ellipsizing, which CLIPPED a grip
-     that poked out; and .fscenter covered that spot. Sitting on the rail's inner right edge keeps
-     it un-clipped, un-covered, and over the 10px right padding (no project-button overlap). */
-  /* right:-15px = -3px - 12px(#fsRoot gap). The grab area must land on the boundary the user
-     actually SEES: in Gradient the rail melts into the background (transparent, no box-shadow),
-     so the perceived edge is .fscenter's own left border (its box-shadow hairline), which sits
-     one flex gap (12px) to the right of the rail's own right edge. Was centred on the rail's
-     invisible edge; now centred on the visible center-panel edge, in every theme (Masa 2026-07-08). */
+  /* .railgrip is a DIRECT CHILD OF #fsRoot (moved out of .fsrail in the markup below), not a
+     descendant of the rail — .fsrail has overflow:hidden for name-ellipsizing, and any part of a
+     child that pokes past an overflow:hidden ancestor's box is both unpainted AND un-hit-testable,
+     so a grip nested inside the rail can never straddle the rail's own edge (only sit fully inside
+     it, biased away from the visible seam — Masa 2026-07-16). Positioned via left:calc(14px + var(--railw))
+     so it tracks the live rail width automatically (no JS repositioning needed) and is centered
+     exactly on the visible edge, mirroring .lanegrip's left:-3px/width:7px pattern on the other side.
+     The leading 14px is #fsRoot's own left padding (line ~1085): left/top on an absolutely positioned
+     child resolve against the PADDING edge of its containing block, not the content edge where the
+     flex children (.fsrail etc.) actually start — omitting it left the whole grip sitting 14px too
+     far left of the seam (caught from a real screenshot, Masa 2026-07-16 2nd pass). */
+  #fsRoot .railgrip{position:absolute;top:0;bottom:0;left:calc(14px + var(--railw, 168px) - 4px);width:7px;cursor:col-resize;z-index:5}
+  /* Gradient theme: the rail is transparent (no box-shadow edge of its own), so the seam the user
+     actually SEES is .fscenter's own left edge, one flex gap (12px) further right (Masa 2026-07-08). */
+  body[data-theme="gradient"] #fsRoot .railgrip{left:calc(14px + var(--railw, 168px) + 8px)}
   #fsRoot .railgrip::after{content:"";position:absolute;right:3px;top:50%;transform:translateY(-50%);width:2px;height:34px;border-radius:2px;background:var(--hair2);opacity:0;transition:opacity .15s}
-  #fsRoot .fsrail:hover .railgrip::after{opacity:1}
+  #fsRoot .fsrail:hover ~ .railgrip::after,#fsRoot .railgrip:hover::after{opacity:1}
   #fsRoot.railfold .railgrip{display:none}
   #fsRoot .fslogo{display:flex;align-items:center;gap:9px;margin:2px 0 16px 6px;height:22px;flex:0 0 auto}
   #fsRoot .logoring{width:22px;height:22px;flex:0 0 22px;border-radius:50%;
@@ -2175,7 +2192,6 @@
   <div id="fsRoot" data-rv="3">
     <div class="fscard fsrail">
       <button class="railtg" id="fsRailTg" title="Fold the rail"></button><!-- panel icon filled by tgUpdate (v45 §4) -->
-      <div class="railgrip" id="fsRgrip" title="Drag to resize"></div>
       <button class="fsprojbtn" id="fsProjBtn" title="Switch project"><span class="pname" id="fsProjBtnName"></span><svg viewBox="0 0 24 24"><path d="M6 9l6 6 6-6"/></svg></button>
       <div class="fslogo"><span class="logoring"></span><span class="logoname">Galda</span></div>
       <!-- gear = RIGHT END of the Projects row (HANDOFF-v45 §2, flagship .lbrow port):
@@ -2193,6 +2209,10 @@
       <button class="fshamb" id="fsHamburger" title="Open To Do and Review"><svg viewBox="0 0 24 24"><path d="M5 7h14M5 12h14M5 17h14"/></svg></button>
       <div id="fsProjects"></div>
     </div>
+    <!-- .railgrip lives here (sibling of .fsrail, not a child — see the CSS comment above)
+         so it can straddle the rail's visible edge without being clipped by .fsrail's
+         overflow:hidden (Masa 2026-07-16). -->
+    <div class="railgrip" id="fsRgrip" title="Drag to resize"></div>
     <div class="fscard fscenter">
       <div id="fsBand"></div>
       <button id="fsBandBtn" title="Change the band image"><svg viewBox="0 0 24 24"><rect x="3" y="5" width="18" height="14" rx="2"/><path d="M3 15l5-4 4 3 4-5 5 6"/></svg></button>
@@ -2274,7 +2294,7 @@
     <div class="mrow">
       <span style="flex:1"></span>
       <button class="mbtn ghost" id="wfcancel">Cancel</button>
-      <button class="mbtn" id="wfsave">Save</button>
+      <button class="mbtn primary" id="wfsave">Save</button>
     </div>
     <div class="wferr" id="wferr"></div>
   </div>
@@ -5437,10 +5457,15 @@ function renderClawdHero(){
   const defaultLaneW = 372, defaultRailW = 108, minReadableCenterW = 640;
   const canRestoreFlagshipWidths = (railW, laneW) =>
     window.innerWidth - 28 - 24 - railW - laneW >= minReadableCenterW;
+  // rail's own live max: however wide it can go without crushing the center column below
+  // minReadableCenterW, given however wide the lane currently is — no more flat 280px ceiling
+  // that stopped rightward drags well short of the window edge (Masa 2026-07-16: "もっと広げ
+  // られるようにできる？"). Floors at 72 (the min) on a narrow/laned-out window.
+  const railMax = () => Math.max(72, window.innerWidth - 28 - 24 - lane.getBoundingClientRect().width - minReadableCenterW);
   const saved = Number(localStorage.getItem('fsLaneW'));
   const savedRail = Number(localStorage.getItem('fsRailW'));
   const restoreLane = saved >= 280 && saved <= 540;
-  const restoreRail = savedRail >= 72 && savedRail <= 280;
+  const restoreRail = savedRail >= 72 && savedRail <= railMax();
   if (restoreLane && canRestoreFlagshipWidths(restoreRail ? savedRail : defaultRailW, saved)) {
     root.style.setProperty('--lanew', `${saved}px`);
   }
@@ -5456,16 +5481,17 @@ function renderClawdHero(){
     drag = false; lane.classList.remove('noanim');
     localStorage.setItem('fsLaneW', String(parseInt(root.style.getPropertyValue('--lanew')) || 372));
   });
-  // rail width drag: 72–144px, persisted (flagship .railgrip port, v36 JS; grip hides when folded)
+  // rail width drag: 72px – railMax() (freely widens, only bounded by keeping the center column
+  // readable), persisted (flagship .railgrip port, v36 JS; grip hides when folded)
   const rail = root.querySelector('.fsrail'), rgrip = $('fsRgrip');
-  if (restoreRail && savedRail <= 144 && canRestoreFlagshipWidths(savedRail, restoreLane ? saved : defaultLaneW)) {
+  if (restoreRail && canRestoreFlagshipWidths(savedRail, restoreLane ? saved : defaultLaneW)) {
     root.style.setProperty('--railw', `${savedRail}px`);
   }
   let rsx = 0, rsw = 0, rdrag = false;
   rgrip.addEventListener('mousedown', (e) => { rdrag = true; rsx = e.clientX; rsw = rail.getBoundingClientRect().width; rail.classList.add('noanim'); e.preventDefault(); });
   document.addEventListener('mousemove', (e) => {
     if (!rdrag) return;
-    const w = Math.max(72, Math.min(144, rsw + (e.clientX - rsx)));
+    const w = Math.max(72, Math.min(railMax(), rsw + (e.clientX - rsx)));
     root.style.setProperty('--railw', `${w}px`);
   });
   document.addEventListener('mouseup', () => {
@@ -5792,7 +5818,7 @@ function bootDisconnected(info){
     + '<p>Galda runs on your own machine. Run this where you use Claude Code or Codex — this board comes alive the moment it connects, no refresh needed:</p>'
     + '<div class="cg-cmd"><code>npx @galda/cli</code><button class="cg-copy">Copy</button></div>'
     + '<p class="cg-who">Signed in as <b></b></p>'
-    + '<p class="cg-switch">Wrong account? <a href="/logout">Switch account →</a></p>'
+    + '<p class="cg-switch">Already running Galda under a different account? Run <code>npx @galda/cli --signin</code> and pick this one. Or <a href="/logout">switch this browser →</a></p>'
     + '<div class="cg-wait"><i></i>WAITING FOR THIS DEVICE</div></div>';
   document.body.appendChild(ov);
   ov.querySelector('.cg-who b').textContent = email || 'your account';
@@ -5814,20 +5840,24 @@ function bootDisconnected(info){
   const cw = document.getElementById('composerWrap');
   if (cw) cw.addEventListener('mousedown', (e) => { if (e.target.closest('#appsel, #modelsel, #effortsel')) return; gate(e); });
 
-  // Come alive automatically: while this device's engine is offline the relay
-  // 503s every engine-backed path (only /, /theme.css, /fonts.css are served);
-  // the instant the agent connects, the same path is proxied to the live engine
-  // (200). So we probe an engine-only endpoint by STATUS and reload when it stops
-  // 503-ing. We must NOT decide this by fetching `/` and grepping its HTML for a
-  // sentinel: this very poll's source contains the string '__GALDA_DISCONNECTED',
-  // so it is baked into every proxied copy of the page — the match is ALWAYS
-  // "found", the reload never fires, and the tab stays stuck on the connect
-  // screen forever ("npx said done but nothing happens"). (fix: status, not body)
-  setInterval(() => {
-    fetch('/api/state', { cache: 'no-store', credentials: 'same-origin' })
-      .then((r) => { if (r.status !== 503) location.reload(); })
-      .catch(() => {});
-  }, 4000);
+  // Come alive automatically — WITHOUT polling-and-reloading (Masa 2026-07-16).
+  // The relay pushes a 'connected' event over SSE the instant THIS account's agent
+  // is STABLY online (debounced on the relay side), and we reload exactly once on
+  // that edge. Event-driven + debounced makes a reload loop structurally
+  // impossible: a flapping agent never reaches the stable-connect edge, so it
+  // shows "reconnecting" instead of triggering reloads. This replaces the old
+  // `setInterval` + `if (status !== 503) reload` poll, which amplified any agent
+  // flap into an infinite reload (the ~10-failure "無限ループ").
+  const cgWait = ov.querySelector('.cg-wait');
+  try {
+    const es = new EventSource('/presence');
+    es.addEventListener('presence', (e) => {
+      let d; try { d = JSON.parse(e.data); } catch { return; }
+      if (d.state === 'connected') { es.close(); location.reload(); } // one reload, only on a stable connect
+      else if (cgWait) cgWait.innerHTML = '<i></i>WAITING FOR THIS DEVICE';
+    });
+    window.addEventListener('beforeunload', () => { try { es.close(); } catch {} });
+  } catch { /* no EventSource (ancient browser) → stay on the gate; never loops */ }
 }
 
 async function boot(){
@@ -6734,11 +6764,27 @@ for (const b of $('langSeg').querySelectorAll('button')) b.onclick = () => saveL
 // true (Delete) or false (Cancel/backdrop-click/Escape) — every caller `await`s it, never
 // deletes on native confirm() any more.
 let _delConfirmResolve = null;
-function confirmDelete({ title, body, preview } = {}){
+// dismissValue: what backdrop-click/Escape resolve to. Defaults to false (= the cancelLabel
+// button's own value) for every existing delete-confirmation caller, where that's the safe/no-op
+// outcome. custCancel() (Discard/Save on the customize panel) overrides this to true/"save",
+// because there Discard — not Save — is the LEFT/cancelLabel-slot button (Masa 2026-07-16: wants
+// Discard positioned left); dismissing the dialog must still land on the non-destructive choice
+// regardless of which label happens to sit in which slot.
+let _delDismissValue = false;
+function confirmDelete({ title, body, preview, confirmLabel, cancelLabel, dismissValue = false, confirmDanger = true, cancelDanger = false } = {}){
   $('delModalTitle').textContent = title || 'Delete this goal?';
   $('delModalBody').textContent = body || "This can't be undone.";
+  $('delConfirmBtn').textContent = confirmLabel || 'Delete';
+  $('delCancelBtn').textContent = cancelLabel || 'Cancel';
+  // confirmLabel is danger-red by default (every existing caller is a real delete); cancelLabel
+  // is plain ghost by default. custCancel() flips both — Discard (danger-red) sits in the
+  // cancelLabel slot, Save (plain) in the confirmLabel slot — since Discard is the one Masa
+  // wants positioned left, not the one that happens to be "the button confirmDelete() calls confirm".
+  $('delConfirmBtn').className = 'mbtn' + (confirmDanger ? ' danger' : ' primary');
+  $('delCancelBtn').className = 'mbtn' + (cancelDanger ? ' danger' : ' ghost');
   const pv = $('delPreviewTitle');
   if (preview) { pv.textContent = preview; pv.style.display = ''; } else { pv.textContent = ''; pv.style.display = 'none'; }
+  _delDismissValue = dismissValue;
   $('deleteConfirmOverlay').classList.add('show');
   return new Promise((resolve) => { _delConfirmResolve = resolve; });
 }
@@ -6750,8 +6796,8 @@ function closeDeleteConfirm(result){
 }
 $('delCancelBtn').onclick = () => closeDeleteConfirm(false);
 $('delConfirmBtn').onclick = () => closeDeleteConfirm(true);
-$('deleteConfirmOverlay').addEventListener('click', (e) => { if (e.target === $('deleteConfirmOverlay')) closeDeleteConfirm(false); });
-document.addEventListener('keydown', (e) => { if (e.key === 'Escape' && $('deleteConfirmOverlay').classList.contains('show')) closeDeleteConfirm(false); });
+$('deleteConfirmOverlay').addEventListener('click', (e) => { if (e.target === $('deleteConfirmOverlay')) closeDeleteConfirm(_delDismissValue); });
+document.addEventListener('keydown', (e) => { if (e.key === 'Escape' && $('deleteConfirmOverlay').classList.contains('show')) closeDeleteConfirm(_delDismissValue); });
 $('input').addEventListener('keydown', (e) => {
   // Palette navigation takes priority while it is open (Claude-Code keys).
   if (state.palette && !e.isComposing) {
@@ -7668,7 +7714,37 @@ function custSave(){
   set('tbAnim', cust.tban); set('tbColor', cust.tbc); // logoPal no longer persisted — logo is code-fixed (v45 §3)
   custSnap = null; $('gearPop').classList.remove('open');
 }
-function custCancel(){
+function custHasUnsavedChanges(){
+  if (!custSnap) return false;
+  if (state.theme !== custSnap.theme || fsUI.band !== custSnap.band) return true;
+  return JSON.stringify(cust) !== JSON.stringify(custSnap.cust);
+}
+// Discarding used to happen instantly on any outside tap / Esc / gear re-click — one careless
+// click outside the panel silently threw away everything just picked (Masa 2026-07-16: "外枠
+// タップしたら一瞬で元に戻るのがストレスだから"). Now it only reverts after confirmation, reusing
+// the same Slack-style modal as goal delete (confirmDelete), copy in the project's own review
+// language (reviewLangFor) since this is the one UI dialog whose audience is the user, not a
+// worker's report. _custCancelling guards re-entrancy: the confirm modal's own Escape/backdrop
+// handlers can re-trigger this same Escape/outside-tap listener while it's already awaiting.
+let _custCancelling = false;
+async function custCancel(){
+  if (_custCancelling) return;
+  if (custHasUnsavedChanges()) {
+    _custCancelling = true;
+    const ja = reviewLangFor(state.active) === 'ja';
+    // Discard sits LEFT (Masa 2026-07-16, 2nd pass — mirrors the macOS "unsaved changes"
+    // layout). Because Discard, not Save, occupies the cancelLabel slot this time, backdrop
+    // click/Escape must be told explicitly to resolve as Save (dismissValue: true) — the shared
+    // default (false = whatever's in the cancelLabel slot) would otherwise silently discard on
+    // an accidental Escape/outside-click on the CONFIRM DIALOG ITSELF, the exact class of bug
+    // this whole feature exists to prevent.
+    const saveChosen = await confirmDelete(ja
+      ? { title: '変更を保存しますか?', body: '配色・テーマの変更が保存されていません。', confirmLabel: '保存', cancelLabel: '破棄', confirmDanger: false, cancelDanger: true, dismissValue: true }
+      : { title: 'Save your changes?', body: "Your color and theme customizations haven't been saved.", confirmLabel: 'Save', cancelLabel: 'Discard', confirmDanger: false, cancelDanger: true, dismissValue: true });
+    _custCancelling = false;
+    if (saveChosen) { custSave(); return; }
+    // else: Discard was explicitly clicked (backdrop/Escape can no longer produce this) — revert below.
+  }
   if (custSnap) { Object.assign(cust, custSnap.cust); state.theme = custSnap.theme; fsUI.band = custSnap.band; custSnap = null; custApplyAll(); }
   $('gearPop').classList.remove('open');
 }

package/engine/lib.mjs

@@ -708,31 +708,71 @@ export function trimTaskActivityForState(tasks) {
 }
 
 // PROOF.md for a goal PR: one section per verified task, GIF auto-plays.
-export function buildGoalProofMd({ goalText, items }) {
+// `lang` picks a single language (matches the goal's own request language,
+// same detection as the PR body) instead of the old EN+JA bilingual dump —
+// a proof doc that mixes both isn't "in the requester's language".
+export function buildGoalProofMd({ goalText, items, lang = 'ja' }) {
+  const L = (en, ja) => (lang === 'en' ? en : ja);
   return [
-    `# Proof / 動作確認`,
+    L('# Proof', '# 動作確認'),
     ``,
-    `Goal / ゴール: ${String(goalText ?? '').replace(/\s+/g, ' ').slice(0, 300)}`,
+    `${L('Goal', 'ゴール')}: ${String(goalText ?? '').replace(/\s+/g, ' ').slice(0, 300)}`,
     ``,
-    `Each task below was verified independently by Manager for AI in a headless browser (deterministic check, no LLM at verification time).`,
-    `以下の各タスクは Manager for AI が headless ブラウザで独立検証しました（検証はdeterministic・検証時にLLMは使いません）。`,
+    L('Each task below was verified independently by Manager for AI in a headless browser (deterministic check, no LLM at verification time).',
+      '以下の各タスクは Manager for AI が headless ブラウザで独立検証しました（検証はdeterministic・検証時にLLMは使いません）。'),
     ``,
     ...items.flatMap((it) => [
       `## ${it.num} ${it.title}`,
       ``,
-      `Pass condition / 成功条件: ${it.passCondition}`,
+      `${L('Pass condition', '成功条件')}: ${it.passCondition}`,
       ``,
-      it.beforeShotName ? `Before / 変更前:\n\n![before](./${it.beforeShotName})\n` : '',
-      it.beforeShotName ? `After / 変更後:\n` : '',
+      it.beforeShotName ? `${L('Before', '変更前')}:\n\n![before](./${it.beforeShotName})\n` : '',
+      it.beforeShotName ? `${L('After', '変更後')}:\n` : '',
       it.gifName ? `![demo](./${it.gifName})\n` : '',
       it.shotName ? `![proof](./${it.shotName})\n` : '',
-      it.videoName ? `Full-quality video / 高画質mp4: [${it.videoName}](./${it.videoName})\n` : '',
-      `Result / 結果: ${it.detail}`,
+      it.videoName ? `${L('Full-quality video', '高画質mp4')}: [${it.videoName}](./${it.videoName})\n` : '',
+      `${L('Result', '結果')}: ${it.detail}`,
       ``,
     ]),
   ].filter((l) => l !== '').join('\n');
 }
 
+// PR body for a finished goal (Masa 2026-07-16: "1時間後に見ても一目で分かる"):
+// the plain-language "what to check / what changed" headline (already
+// generated per-goal by summarizeForReview, same request-language `lang`)
+// goes FIRST, above proof/goal/task detail, so a reviewer returning later
+// doesn't have to re-read the raw worker log to know what to look at.
+export function buildGoalPrBody({ lang, goal, goalTasks, files, owner, branch, proofRel, proofItemsCount, reviewDescription, reviewSummary }) {
+  const L = (en, ja) => (lang === 'en' ? en : ja);
+  return [
+    ...((reviewSummary?.check || reviewSummary?.changed) ? [
+      L('## Check first', '## 確認ポイント'),
+      '',
+      ...(reviewSummary.check ? [L(`Check: ${reviewSummary.check}`, `確認: ${reviewSummary.check}`)] : []),
+      ...(reviewSummary.changed ? [L(`Changed: ${reviewSummary.changed}`, `変更: ${reviewSummary.changed}`)] : []),
+      '',
+    ] : []),
+    ...(proofItemsCount && owner ? [
+      L('## Proof — one tap, plays in place', '## 動作確認 — 1タップでその場で再生'),
+      '',
+      `https://github.com/${owner}/blob/${branch}/${proofRel}/PROOF.md`,
+      '',
+    ] : []),
+    L('## Goal', '## ゴール'),
+    '',
+    goal.text.slice(0, 1500),
+    '',
+    ...buildReviewRuleSection(reviewDescription),
+    L(`Implemented by Manager for AI: the goal was decomposed into ${goalTasks.length} task(s), each executed by a Claude Code worker (flat-rate, no extra API), tests written and run per task.${proofItemsCount ? ' Tasks with a pass condition were verified independently in a headless browser.' : ''}`,
+      `Manager for AI が実装: ゴールを${goalTasks.length}個のタスクに分解し、Claude Code worker が順に実行（既存サブスク・追加API無し・タスク毎にテストを作成し実行）。${proofItemsCount ? '成功条件つきタスクは headless ブラウザで独立検証済み。' : ''}`),
+    '',
+    L('## Tasks and worker reports', '## タスクとworker報告'),
+    ...goalTasks.map((t) => `\n### ${t.num} ${t.title} — ${t.status} (${t.secs}s)\n${(t.result ?? '').slice(0, 800)}`),
+    '',
+    L(`Changed files: ${files.map((f) => `\`${f}\``).join(' ')}`, `変更ファイル: ${files.map((f) => `\`${f}\``).join(' ')}`),
+  ].join('\n');
+}
+
 // A finished task's changed files look like a UI edit: app/ (the Manager's
 // own UI dir, or an equivalent frontend root) plus common frontend source
 // extensions. Pure/deterministic — no LLM — so it can gate proof capture
@@ -2485,6 +2525,56 @@ export function resolveFolderAnswer(answer, folders = []) {
   return null;
 }
 
+// Onboarding funnel, part 2: the user picked "somewhere else…" and typed a path
+// that ISN'T already a git repo. Before, the server just re-asked the same
+// folder question forever (a repo-less / vibe-coder user could never get past
+// setup). This decides what to offer instead. All filesystem probes (does it
+// exist / is it a directory / is it already a repo) are done by the CALLER and
+// passed in, so this stays pure/testable. Returns:
+//   { action: 'use' }                    already a repo → bind as-is
+//   { action: 'init', create: false }    existing non-repo dir → offer `git init` here
+//   { action: 'init', create: true }     path doesn't exist yet → offer to create it + `git init`
+//   { action: 'reject', reason }         HOME (never a work root) or a path that is a file → re-ask
+export function classifyFolderTarget({ dir, homeDir, exists, isDirectory, isRepo } = {}) {
+  if (!dir) return { action: 'reject', reason: 'empty' };
+  const norm = (p) => String(p).replace(/\/+$/, '');
+  if (homeDir && norm(dir) === norm(homeDir)) return { action: 'reject', reason: 'home' };
+  if (isRepo) return { action: 'use' };
+  if (!exists) return { action: 'init', create: true };
+  if (!isDirectory) return { action: 'reject', reason: 'not-a-dir' };
+  return { action: 'init', create: false };
+}
+
+// Build the confirm card shown before we `git init` a non-repo folder. Reuses
+// the same needsInput card shape ({text, options:string[]}) but tags it
+// kind:'folder-init' so the /answer handler runs the init (instead of another
+// folder rebind). `create` = the folder doesn't exist yet and we'll make it.
+// The chosen dir + create flag ride along on the question so the handler is
+// authoritative about WHAT it's initializing (never re-derived from free text).
+export function buildFolderInitConfirm(dir, { lang = 'ja', create = false, homeDir = '' } = {}) {
+  const label = folderLabel(dir, homeDir);
+  const yes = lang === 'en'
+    ? (create ? 'Create it and start a new project here' : 'Start a new project here')
+    : (create ? '作成して、ここで新規プロジェクトを始める' : 'ここで新規プロジェクトを始める');
+  const no = lang === 'en' ? 'Pick another folder…' : '別の場所を選ぶ…';
+  const text = lang === 'en'
+    ? `“${label}” isn’t a Git repository yet. ${create ? 'Create it and start' : 'Start'} a new project here (git init)? Your existing files won’t be touched.`
+    : `「${label}」はまだGitリポジトリではありません。${create ? '作成して、' : ''}ここで新しいプロジェクトを始めますか？（git init・既存のファイルには手を触れません）`;
+  return { text, options: [yes, no], kind: 'folder-init', lang, dir, create, yes, no };
+}
+
+// Interpret the confirm-card answer → true (do the init) / false (decline →
+// re-ask the folder question). Match the exact "yes" option we offered, or a
+// plain affirmative word; anything else (incl. the "pick another folder" option)
+// declines. Defaults to decline on empty/unknown so we never init by accident.
+export function isFolderInitConfirmed(answer, question = {}) {
+  const a = String(answer ?? '').trim();
+  if (!a) return false;
+  if (question.yes && a === question.yes) return true;
+  if (question.no && a === question.no) return false;
+  return /^(yes|y|はい|ok|する|始める)$/i.test(a);
+}
+
 // Analytics identity (A+): a signed-in install scopes usage events to the
 // ACCOUNT (its email, which the billing Worker hashes into the same account_id
 // the accounts table carries) so per-user app activity joins WITHOUT a cookie;

package/engine/server.mjs

@@ -20,8 +20,8 @@ import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
-import { needsProjectFolder, folderLabel, buildFolderQuestion, resolveFolderAnswer } from './lib.mjs';
-import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable } from './lib.mjs';
+import { needsProjectFolder, folderLabel, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed } from './lib.mjs';
+import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable } from './lib.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
 
@@ -2160,6 +2160,11 @@ async function finishGoalIfComplete(goal, project, activityTask = null) {
   // point (all its tasks are done), so its conflictsWith is accurate even if
   // PR creation itself fails (e.g. no `gh` auth) or is still no-op'd (no code).
   updateGoalConflicts(goal);
+  // Computed BEFORE createGoalPR (not inside verifyGate, which used to run
+  // after) so the PR body's "確認ポイント" headline is available the first
+  // time the PR is opened, not only on the review card (Masa 2026-07-16).
+  goalAct('Writing the review summary from the worker report and diff.');
+  goal.reviewSummary = await summarizeForReview(goal, siblings, wdir, reviewDefinition);
   goalAct('Checking changed files and preparing the PR branch if code changed.');
   await createGoalPR(goal, prProject, siblings, reviewDefinition, activityTask);
   // goal 427 §4: classify the change's risk from the SAME changed-files/diff
@@ -2228,8 +2233,13 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
     goal.testResult = { ran: false, skipped: true, skippedReason: changedFiles.length ? 'documentation-only change' : 'no changed files' };
     goalAct(`Skipped project tests: ${goal.testResult.skippedReason}.`);
   }
-  goalAct('Writing the review summary from the worker report and diff.');
-  goal.reviewSummary = await summarizeForReview(goal, siblings, wdir, reviewDefinition);
+  // Normally already set by finishGoalIfComplete before the PR was opened
+  // (so the PR body can include it too); only fall back here for the
+  // standalone /reverify path or any older goal that never got one.
+  if (!goal.reviewSummary) {
+    goalAct('Writing the review summary from the worker report and diff.');
+    goal.reviewSummary = await summarizeForReview(goal, siblings, wdir, reviewDefinition);
+  }
   const uiTasks = siblings.filter((t) => isUiChange(t.changedFiles));
   // Only require/capture proof for projects we can actually boot & screenshot
   // (Manager-shaped). A generic web repo that edits a stylesheet can't be
@@ -2371,26 +2381,12 @@ async function createGoalPR(goal, project, goalTasks, reviewDefinition = DEFAULT
     // (Masa: 「ユーザーの言語で」).
     const lang = reviewDefinition.language === 'auto' ? detectRequestLanguage(goal.text) : (reviewDefinition.language || 'ja');
     const L = (en, ja) => (lang === 'en' ? en : ja);
-    const bodyFor = (branch) => [
-      ...(proofItems.length && owner ? [
-        L('## Proof — one tap, plays in place', '## 動作確認 — 1タップでその場で再生'),
-        '',
-        `https://github.com/${owner}/blob/${branch}/${proofRel}/PROOF.md`,
-        '',
-      ] : []),
-      L('## Goal', '## ゴール'),
-      '',
-      goal.text.slice(0, 1500),
-      '',
-      ...buildReviewRuleSection(reviewDefinition.description),
-      L(`Implemented by Manager for AI: the goal was decomposed into ${goalTasks.length} task(s), each executed by a Claude Code worker (flat-rate, no extra API), tests written and run per task.${proofItems.length ? ' Tasks with a pass condition were verified independently in a headless browser.' : ''}`,
-        `Manager for AI が実装: ゴールを${goalTasks.length}個のタスクに分解し、Claude Code worker が順に実行（既存サブスク・追加API無し・タスク毎にテストを作成し実行）。${proofItems.length ? '成功条件つきタスクは headless ブラウザで独立検証済み。' : ''}`),
-      '',
-      L('## Tasks and worker reports', '## タスクとworker報告'),
-      ...goalTasks.map((t) => `\n### ${t.num} ${t.title} — ${t.status} (${t.secs}s)\n${(t.result ?? '').slice(0, 800)}`),
-      '',
-      L(`Changed files: ${files.map((f) => `\`${f}\``).join(' ')}`, `変更ファイル: ${files.map((f) => `\`${f}\``).join(' ')}`),
-    ].join('\n');
+    const bodyFor = (branch) => buildGoalPrBody({
+      lang, goal, goalTasks, files, owner, branch, proofRel,
+      proofItemsCount: proofItems.length,
+      reviewDescription: reviewDefinition.description,
+      reviewSummary: goal.reviewSummary,
+    });
     const title = `Manager for AI: ${isRework ? L('rework — ', '再作業 — ') : ''}${goal.plan?.[0] ?? goal.text.slice(0, 60)}${goal.plan?.length > 1 ? L(` +${goal.plan.length - 1} more`, ` 他${goal.plan.length - 1}件`) : ''}`;
     const { url, branch } = openPR({
       repoDir: project.dir, slug: `goal-${goal.id}`,
@@ -2401,7 +2397,7 @@ async function createGoalPR(goal, project, goalTasks, reviewDefinition = DEFAULT
       extraCopies,
       extraWrites: proofItems.length ? [{
         destRel: `${proofRel}/PROOF.md`,
-        content: buildGoalProofMd({ goalText: goal.text, items: proofItems }),
+        content: buildGoalProofMd({ goalText: goal.text, items: proofItems, lang }),
       }] : [],
       ...(isRework ? { existingBranch: goal.prBranch, existingPrUrl: goal.pr } : {}),
     });
@@ -3087,34 +3083,80 @@ const server = createServer(async (req, res) => {
       let answer = '';
       try { answer = String(JSON.parse(body || '{}').answer ?? '').trim(); } catch {}
       if (!answer) return json(res, 400, { error: 'answer required' });
+      // Bind this goal to a project rooted at `dir` and start planning. Shared by
+      // the "picked a repo" and "git-init'd a new folder" paths below.
+      const bindAndPlan = (dir) => {
+        const existing = projects.find((p) => p.dir === dir);
+        let proj = existing;
+        if (!proj) {
+          proj = { id: uniqueProjectId(basename(dir)), name: basename(dir), dir };
+          projects.push(proj); saveProjects();
+        }
+        goal.projectId = proj.id;
+        goal.question = null;
+        goal.clarified = true;
+        goal.status = 'planning';
+        saveGoal(goal);
+        planGoal(goal).catch((e) => { goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal); });
+        return json(res, 200, goal);
+      };
       // Folder-choice answer (onboarding funnel): rebind the goal to the chosen
       // repo rather than appending to goal.text — a folder isn't a task
-      // clarification. Validate it's a real repo (and not HOME); if not, re-ask
-      // with a fresh detected list so we never fall through to a no-op run.
+      // clarification. If the picked path is already a repo, bind it. If it's a
+      // non-repo dir (or a path that doesn't exist yet), DON'T loop re-asking —
+      // offer to start a new project there via `git init` (the repo-less /
+      // vibe-coder onboarding path). HOME / a file → re-ask.
       if (goal.question?.kind === 'folder') {
         const resolved = resolveFolderAnswer(answer, goal.question.folders || []);
         let dir = resolved?.dir || answer;
         if (dir.startsWith('~')) dir = join(HOME, dir.slice(1).replace(/^\/+/, ''));
-        if (dir !== HOME && isGitRepo(dir)) {
-          const existing = projects.find((p) => p.dir === dir);
-          let proj = existing;
-          if (!proj) {
-            proj = { id: uniqueProjectId(basename(dir)), name: basename(dir), dir };
-            projects.push(proj); saveProjects();
-          }
-          goal.projectId = proj.id;
-          goal.question = null;
-          goal.clarified = true;
-          goal.status = 'planning';
+        const lang = goal.question.lang || 'ja';
+        const cls = classifyFolderTarget({
+          dir, homeDir: HOME,
+          exists: existsSync(dir),
+          isDirectory: (() => { try { return statSync(dir).isDirectory(); } catch { return false; } })(),
+          isRepo: isGitRepo(dir),
+        });
+        if (cls.action === 'use') return bindAndPlan(dir);
+        if (cls.action === 'init') {
+          // Non-repo folder → confirm before we create a repo (non-destructive,
+          // but a repo-less user should see what we're about to do).
+          goal.question = buildFolderInitConfirm(dir, { lang, create: cls.create, homeDir: HOME });
           saveGoal(goal);
-          planGoal(goal).catch((e) => { goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal); });
           return json(res, 200, goal);
         }
-        // not a usable repo → keep asking (don't run a no-op)
-        goal.question = buildFolderQuestion(detectRepos(HOME), { lang: goal.question.lang || 'ja' });
+        // reject (HOME or a file) → re-ask with a fresh detected list
+        goal.question = buildFolderQuestion(detectRepos(HOME), { lang });
         saveGoal(goal);
         return json(res, 200, goal);
       }
+      // Confirm card for "start a new project here (git init)?". Yes → run the
+      // init (guarded: create the dir if needed, NEVER touch existing files,
+      // NEVER re-init an existing repo), then bind + plan like a picked repo.
+      // Anything else → back to the folder list.
+      if (goal.question?.kind === 'folder-init') {
+        const q = goal.question;
+        const lang = q.lang || 'ja';
+        if (!isFolderInitConfirmed(answer, q)) {
+          goal.question = buildFolderQuestion(detectRepos(HOME), { lang });
+          saveGoal(goal);
+          return json(res, 200, goal);
+        }
+        const dir = q.dir;
+        try {
+          if (dir === HOME) throw new Error('refusing to init HOME as a project');
+          if (q.create && !existsSync(dir)) mkdirSync(dir, { recursive: true });
+          if (!statSync(dir).isDirectory()) throw new Error('target is not a directory');
+          if (!isGitRepo(dir)) gitSync(dir, ['init', '--quiet']); // adds .git only; leaves files as-is
+        } catch (e) {
+          // couldn't init → don't run a no-op; surface why and re-ask
+          goal.question = buildFolderQuestion(detectRepos(HOME), { lang });
+          goal.prError = `git init failed: ${String(e?.message || e).slice(0, 200)}`;
+          saveGoal(goal);
+          return json(res, 200, goal);
+        }
+        return bindAndPlan(dir);
+      }
       goal.text = `${goal.text}\n[確認: ${goal.question?.text ?? ''} → ${answer}]`;
       goal.clarified = true; // answered once → planGoal must never re-ask (persisted via saveGoal)
       goal.question = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.14",
+  "version": "0.10.16",
   "type": "module",
   "description": "Galda - hand off work to your Claude Code, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {