@galda/cli 0.10.16 → 0.10.19

package/engine/server.mjs

@@ -13,15 +13,15 @@
 
 import { createServer } from 'node:http';
 import { spawn, execFile, spawnSync } from 'node:child_process';
-import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, statSync, readdirSync } from 'node:fs';
+import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, statSync, readdirSync, unlinkSync } from 'node:fs';
 import { emitEvent } from './analytics-client.mjs';
-import { randomBytes, createHash } from 'node:crypto';
+import { randomBytes, createHash, randomUUID } from 'node:crypto';
 import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
-import { needsProjectFolder, folderLabel, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed } from './lib.mjs';
-import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable } from './lib.mjs';
+import { needsProjectFolder, folderLabel, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText } from './lib.mjs';
+import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision } from './lib.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
 
@@ -471,7 +471,7 @@ if (!existsSync(projectsFile)) {
   writeFileSync(projectsFile, JSON.stringify([{ id: 'default', name: basename(cwd), dir: cwd }], null, 2));
 }
 const projects = JSON.parse(readFileSync(projectsFile, 'utf8'));
-function saveProjects() { writeFileSync(projectsFile, JSON.stringify(projects, null, 2)); }
+function saveProjects() { writeFileSync(projectsFile, JSON.stringify(projects, null, 2)); markSyncDirty(); }
 function uniqueProjectId(name = 'project') {
   const base = String(name).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '').slice(0, 28) || 'project';
   let id = base, n = 2;
@@ -487,16 +487,49 @@ const logFile = join(logDir, 'tasks.jsonl');
 // four buckets goalGroupStatus/goalChip actually track (see lib.mjs).
 const workflowColumnsFile = join(DATA_DIR, 'workflow-columns.json');
 let workflowColumns = existsSync(workflowColumnsFile) ? JSON.parse(readFileSync(workflowColumnsFile, 'utf8')) : {};
-function saveWorkflowColumns() { writeFileSync(workflowColumnsFile, JSON.stringify(workflowColumns, null, 2)); }
+function saveWorkflowColumns() { writeFileSync(workflowColumnsFile, JSON.stringify(workflowColumns, null, 2)); markSyncDirty(); }
 function getColumns(projectId) { return workflowColumns[projectId] ?? DEFAULT_WORKFLOW_COLUMNS; }
 
 // Per-project review definition (task 45): configurable conditions for when
 // a finished goal lands in 'review' vs 'done'/'partial' — see lib.mjs.
 const reviewDefinitionsFile = join(DATA_DIR, 'review-definitions.json');
 let reviewDefinitions = existsSync(reviewDefinitionsFile) ? JSON.parse(readFileSync(reviewDefinitionsFile, 'utf8')) : {};
-function saveReviewDefinitions() { writeFileSync(reviewDefinitionsFile, JSON.stringify(reviewDefinitions, null, 2)); }
+function saveReviewDefinitions() { writeFileSync(reviewDefinitionsFile, JSON.stringify(reviewDefinitions, null, 2)); markSyncDirty(); }
 function getReviewDefinition(projectId) { return reviewDefinitions[projectId] ?? DEFAULT_REVIEW_DEFINITION; }
 
+// ---- cross-device board sync state (P3, docs/design/CROSS-DEVICE-SYNC-PLAN.md)
+// rev = the optimistic-lock version this device last saw/wrote; writerId = a
+// stable per-install id so the store can tell which device last wrote. Kept in
+// its own tiny file next to the other state so it survives restarts. The push/
+// pull machinery itself is defined further down (function declarations hoist);
+// this only sets up the persisted rev/writerId it needs.
+const SYNC_PUSH_DEBOUNCE_MS = 2500;
+const SYNC_HTTP_TIMEOUT_MS = 5000; // defined here (not in the push/pull block below) so the boot-time `await bootSyncPull()` can read it — a `const` there would be in its TDZ at boot
+const syncMetaFile = join(DATA_DIR, 'sync-meta.json');
+let syncMeta = { rev: 0, writerId: null };
+try { if (existsSync(syncMetaFile)) syncMeta = { ...syncMeta, ...JSON.parse(readFileSync(syncMetaFile, 'utf8')) }; }
+catch { /* corrupt meta → start clean (a fresh pull re-establishes rev) */ }
+if (!syncMeta.writerId) syncMeta.writerId = randomUUID();
+function saveSyncMeta() { try { writeFileSync(syncMetaFile, JSON.stringify(syncMeta)); } catch { /* best-effort */ } }
+saveSyncMeta();
+let _syncDisabled = false;          // set when the store says 501 (no bucket provisioned) — stop hammering
+let _syncHydrating = false;         // true while applying a pulled board, so our own saves don't re-arm a push
+let _syncPushTimer = null;
+let _syncPushInFlight = false;
+let _syncDirtyAgain = false;        // a save landed mid-push → coalesce into one follow-up push
+
+// Which worker agent CLIs are installed on this machine — the launcher
+// (bin/manager-for-ai.mjs) detects them (codex via a PATH lookup, never executed)
+// and passes the set here. Galda offers only these, so a Codex-only machine gets
+// a working board and a claude-only one never shows Codex. Defaults to Claude
+// Code when unset (tests / running the server directly).
+const envAgents = (process.env.MANAGER_AVAILABLE_AGENTS || 'claude-code')
+  .split(',').map((a) => a.trim()).filter(Boolean);
+const AVAILABLE_AGENTS = resolveConnectedAgents({
+  claude: envAgents.includes('claude-code'),
+  codex: envAgents.includes('codex'),
+});
+
 // ---- state ---------------------------------------------------------------
 // Restarts must not lose pending work: tasks that never started stay
 // queued; only mid-run work becomes 'interrupted' (retryable). Goals that
@@ -508,6 +541,14 @@ let tasks = replayed.tasks;
 let nextId = replayed.nextId;
 let prioCounter = replayed.prioCounter;
 
+// Cross-device sync (P3): before anything downstream (orphan reconcile, the
+// queues Map, workers) is built from this state, adopt a newer board from the
+// account if one exists — this is where a second device inherits the work on
+// boot. No-op unless billing + a license token are configured (local / dev /
+// free installs stay fully local), and time-boxed so a dead network can't hang
+// startup. If nothing to pull but we have local work, seed the store instead.
+await bootSyncPull();
+
 // Reap goals a dead server left with no live worker (Masa dogfood: the To Do
 // pile-up from a goal that never actually resumes) — see reconcileOrphanGoals
 // in lib.mjs for the exact rule (unit-tested there). Computed and applied to
@@ -582,7 +623,19 @@ function sendGoalEvent(obj, goal) {
     if (goalVisibleTo(goal, identity, MANAGER_OWNER_EMAIL)) res.write(data);
   }
 }
-function saveGoal(g) { appendFileSync(logFile, JSON.stringify({ ...g, kind: 'goal' }) + '\n'); sendGoalEvent({ ev: 'goal', goal: g }, g); }
+// Durable append to the restart-safe log. A failing disk (ENOSPC when the
+// volume is full, EACCES/EROFS) must NEVER freeze the board: without this guard
+// an appendFileSync throw inside a handler leaves the HTTP request hanging (no
+// response) AND skips the SSE broadcast that follows, so a delete/answer looks
+// like it did nothing — the question card stays stuck forever (Masa 2026-07-16).
+// We swallow the write error (logged), and let the in-memory mutation + SSE
+// proceed regardless. Durability is best-effort here; a live UI wins over a
+// perfectly-replayable log on a disk that can't be written to anyway.
+function logAppend(line) {
+  try { appendFileSync(logFile, line + '\n'); markSyncDirty(); return true; }
+  catch (e) { console.error(`[manager] log write failed (${e?.code || e}) — state not persisted this write, UI still updated`); return false; }
+}
+function saveGoal(g) { logAppend(JSON.stringify({ ...g, kind: 'goal' })); sendGoalEvent({ ev: 'goal', goal: g }, g); }
 // Persist the orphan-goal reclassification computed right after replayQueueLog
 // above (deferred to here because saveGoal/send/sseClients don't exist yet at
 // that point in the module) — writes it to the restart-safe log so it settles
@@ -594,7 +647,7 @@ for (const fix of orphanFixes) {
 }
 function saveTask(t) {
   const { activity, todos, ...persist } = t; // activity + todos are ephemeral (live only)
-  appendFileSync(logFile, JSON.stringify({ ...persist, kind: 'task' }) + '\n');
+  logAppend(JSON.stringify({ ...persist, kind: 'task' }));
   const goal = goals.find((g) => g.id === t.goalId);
   if (goal) sendGoalEvent({ ev: 'task', task: persist }, goal); else send({ ev: 'task', task: persist });
   emitTaskAnalytics(t);
@@ -648,6 +701,202 @@ function postHistory(t) {
     }).catch(() => {});
   } catch { /* never throw into the caller */ }
 }
+// ---- cross-device board sync: push / pull (P3) ----------------------------
+// docs/design/CROSS-DEVICE-SYNC-PLAN.md. This process owns the board (it holds
+// the state + the license token); it pushes a debounced snapshot to the sync
+// Worker (P2) and pulls on boot so a second device inherits the work. Opt-in:
+// disabled unless a billing URL AND a license token are present, and it degrades
+// silently (501 = bucket not provisioned) so local/dev/free installs are never
+// affected. Pure decisions live in lib.mjs (buildBoardSnapshot / decideBoardPull).
+// SYNC_HTTP_TIMEOUT_MS is declared up with the sync state (boot reads it early).
+function syncEnabled() { return Boolean(BILLING_API_URL) && !_syncDisabled && Boolean(readLicenseToken()); }
+function currentBoard() {
+  return buildBoardSnapshot({
+    projects,
+    tasksLog: existsSync(logFile) ? readFileSync(logFile, 'utf8') : '',
+    workflowColumns,
+    reviewDefinitions,
+  });
+}
+function localHasWork() { return goals.length > 0; }
+// Overwrite in-memory + on-disk state from a validated remote board. Only ever
+// called at boot (before queues/workers exist), so it can safely reassign the
+// module-level state vars and rewrite the append-only log wholesale — a pull is
+// a full replacement, not a merge. nextId/prioCounter come from the replay so
+// ids can't collide with the adopted goals/tasks.
+function hydrateFromBoard(snap) {
+  _syncHydrating = true;
+  try {
+    projects.length = 0;               // `const` array → mutate in place
+    for (const p of snap.projects) projects.push(p);
+    saveProjects();
+    workflowColumns = snap.workflowColumns; saveWorkflowColumns();
+    reviewDefinitions = snap.reviewDefinitions; saveReviewDefinitions();
+    try { writeFileSync(logFile, snap.tasksLog); }
+    catch (e) { console.log(`[sync] hydrate: log write failed (${e?.code || e})`); }
+    const r = replayQueueLog(snap.tasksLog || '', reviewDefinitions);
+    goals = r.goals; tasks = r.tasks; nextId = r.nextId; prioCounter = r.prioCounter;
+    // A pulled 'running' goal has no live worker on this device — reconcile it
+    // exactly as a restart would (same rule replayQueueLog callers use at boot).
+    for (const fix of reconcileOrphanGoals(goals, tasks)) {
+      const g = goals.find((x) => x.id === fix.id);
+      if (g) { g.status = fix.status; g.blocked = null; g.prError = fix.reason; }
+    }
+  } finally { _syncHydrating = false; }
+}
+// Schedule a debounced push. Coalesces bursts of saves into one PUT, and never
+// re-arms while we're applying a pulled board (that would ping-pong).
+function markSyncDirty() {
+  if (_syncHydrating || !syncEnabled()) return;
+  if (_syncPushTimer) return;
+  _syncPushTimer = setTimeout(() => { _syncPushTimer = null; pushBoard(); }, SYNC_PUSH_DEBOUNCE_MS);
+  if (_syncPushTimer.unref) _syncPushTimer.unref(); // never keep the process alive for a pending push
+}
+async function pushBoard() {
+  if (!syncEnabled()) return;
+  if (_syncPushInFlight) { _syncDirtyAgain = true; return; }
+  _syncPushInFlight = true;
+  try {
+    const token = readLicenseToken();
+    const res = await fetch(`${BILLING_API_URL}/sync/board`, {
+      method: 'PUT',
+      headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+      body: JSON.stringify({ baseRev: syncMeta.rev, board: currentBoard(), writerId: syncMeta.writerId }),
+      signal: AbortSignal.timeout(SYNC_HTTP_TIMEOUT_MS),
+    });
+    if (res.status === 501) { _syncDisabled = true; console.log('[sync] board store not provisioned (501) — cross-device sync disabled this session'); return; }
+    if (res.status === 409) {
+      // Another device advanced the board first. Cross-device is takeover, not
+      // concurrent editing (a non-goal): adopt the remote rev as our new base
+      // and re-push our board on top (last-writer-wins), so we converge in one
+      // extra round instead of hydrating mid-run.
+      const j = await res.json().catch(() => ({}));
+      if (typeof j.rev === 'number') { syncMeta.rev = j.rev; saveSyncMeta(); }
+      console.log(`[sync] push stale — rebased onto remote rev ${j.rev ?? '?'} and re-pushing`);
+      _syncDirtyAgain = true;
+      return;
+    }
+    if (!res.ok) { console.log(`[sync] push failed (HTTP ${res.status})`); return; }
+    const j = await res.json().catch(() => ({}));
+    if (typeof j.rev === 'number') { syncMeta.rev = j.rev; saveSyncMeta(); }
+  } catch (e) { console.log(`[sync] push error: ${e?.message || e}`); }
+  finally {
+    _syncPushInFlight = false;
+    if (_syncDirtyAgain) { _syncDirtyAgain = false; markSyncDirty(); }
+  }
+}
+// Boot-time pull. Adopts a newer remote board (device inherits the work); if
+// nothing to adopt but this device has local work, seeds the store so the FIRST
+// device populates it. Time-boxed; any failure leaves local state untouched.
+async function bootSyncPull() {
+  if (!BILLING_API_URL || _syncDisabled) return;
+  const token = readLicenseToken();
+  if (!token) return;
+  let res;
+  try {
+    res = await fetch(`${BILLING_API_URL}/sync/board`, {
+      headers: { authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(SYNC_HTTP_TIMEOUT_MS),
+    });
+  } catch (e) { console.log(`[sync] boot pull skipped (${e?.name === 'TimeoutError' ? 'timeout' : e?.message || e}) — starting from local state`); return; }
+  if (res.status === 501) { _syncDisabled = true; console.log('[sync] board store not provisioned (501) — cross-device sync disabled this session'); return; }
+  if (!res.ok) { console.log(`[sync] boot pull failed (HTTP ${res.status}) — starting from local state`); return; }
+  const remote = await res.json().catch(() => ({}));
+  const remoteRev = Number(remote?.rev) || 0;
+  const remoteSnap = remote?.board ? validateBoardSnapshot(remote.board) : null;
+  const decision = decideBoardPull({
+    localRev: syncMeta.rev,
+    remoteRev,
+    localHasWork: localHasWork(),
+    remoteHasWork: remoteSnap ? !boardIsEmpty(remoteSnap) : false,
+  });
+  if (decision.pull) {
+    if (!remoteSnap) { console.log('[sync] boot pull: remote board invalid/unsupported version — ignored, using local state'); return; }
+    if (decision.clobbersLocal) console.log('[sync] WARNING: adopting the account board over un-synced local work (last-writer-wins; concurrent offline editing is not supported)');
+    hydrateFromBoard(remoteSnap);
+    syncMeta.rev = remoteRev; saveSyncMeta();
+    console.log(`[sync] board inherited from account (rev ${remoteRev})`);
+    return;
+  }
+  // Nothing newer to adopt. If we're the first device with real work, seed it.
+  if (localHasWork() && syncEnabled()) { console.log('[sync] seeding account board from local state'); markSyncDirty(); }
+}
+
+// True while this device is running any work of its own — a planning/running
+// goal, or a live worker child. hydrateFromBoard rewrites the log wholesale and
+// swaps goals/tasks, which would orphan an in-flight worker's writes, so a live
+// takeover must refuse while busy (a boot pull never has this problem: nothing
+// is running yet). `goalWorkerChildren` is declared below but only read here at
+// request time, long after module init, so the forward reference is fine.
+function deviceBusy() {
+  return goalWorkerChildren.size > 0 || goals.some((g) => ['planning', 'running'].includes(g.status));
+}
+// Live (mid-session) takeover pull (P4): adopt the account's newer board into
+// this already-serving instance, on demand (the switch-UI's 切替 button). Boot
+// pull (bootSyncPull) inherits on startup; this is the same adoption triggered
+// while running. Refuses when this device is busy (deviceBusy) so it can never
+// yank the board out from under a live worker. On a successful 'pull' this
+// device now holds the account board at its rev; the caller reloads to render
+// it. Returns { ok, action, rev } — see liveTakeoverDecision for the actions.
+async function livePull() {
+  if (!syncEnabled()) return { ok: false, action: 'disabled' };
+  if (deviceBusy()) return { ok: false, action: 'busy' };
+  const token = readLicenseToken();
+  let res;
+  try {
+    res = await fetch(`${BILLING_API_URL}/sync/board`, {
+      headers: { authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(SYNC_HTTP_TIMEOUT_MS),
+    });
+  } catch (e) {
+    console.log(`[sync] live pull skipped (${e?.name === 'TimeoutError' ? 'timeout' : e?.message || e})`);
+    return { ok: false, action: 'error' };
+  }
+  if (res.status === 501) { _syncDisabled = true; return { ok: false, action: 'disabled' }; }
+  if (!res.ok) { console.log(`[sync] live pull failed (HTTP ${res.status})`); return { ok: false, action: 'error' }; }
+  const remote = await res.json().catch(() => ({}));
+  const remoteRev = Number(remote?.rev) || 0;
+  const remoteSnap = remote?.board ? validateBoardSnapshot(remote.board) : null;
+  const decision = liveTakeoverDecision({
+    syncEnabled: true,
+    busy: false,
+    remoteValid: Boolean(remoteSnap),
+    localRev: syncMeta.rev,
+    remoteRev,
+    localHasWork: localHasWork(),
+    remoteHasWork: remoteSnap ? !boardIsEmpty(remoteSnap) : false,
+  });
+  if (decision.action !== 'pull') return { ok: decision.action === 'current', action: decision.action, rev: syncMeta.rev };
+  if (decision.clobbersLocal) console.log('[sync] live takeover adopting account board over un-synced local work (last-writer-wins)');
+  hydrateFromBoard(remoteSnap);
+  syncMeta.rev = remoteRev; saveSyncMeta();
+  rebuildQueuesAfterAdopt();
+  console.log(`[sync] live takeover: board adopted from account (rev ${remoteRev})`);
+  return { ok: true, action: 'pull', rev: remoteRev };
+}
+// hydrateFromBoard replaces projects/goals/tasks, but the `queues` Map still
+// mirrors the OLD board: adopted projects have no entry (so /api/state throws
+// on queues.get(p.id).waiting), and adopted 'queued' tasks sit in no waiting
+// list. A boot pull never hits this — the Map is built from projects *after*
+// hydrate — but a live pull must rebuild it here. The pull was gated on
+// deviceBusy() being false, so nothing is running and the Map can be rebuilt
+// wholesale. This mirrors the boot re-queue/plan loop (server start, below):
+// re-queue pending tasks, pump, and plan any 'stacked' goal so the inherited
+// work actually resumes on this device — the whole point of a takeover.
+function rebuildQueuesAfterAdopt() {
+  queues.clear();
+  for (const p of projects) queues.set(p.id, { running: new Set(), waiting: [] });
+  for (const p of projects) {
+    const pending = tasks.filter((t) => t.projectId === p.id && t.status === 'queued').sort((a, b) => a.num - b.num);
+    queues.get(p.id).waiting.push(...pending);
+    pump(p.id);
+    for (const g of goals.filter((g) => g.projectId === p.id && g.status === 'stacked')) {
+      g.status = 'planning'; saveGoal(g);
+      planGoal(g).catch((e) => { g.status = 'failed'; g.prError = String(e).slice(0, 300); saveGoal(g); });
+    }
+  }
+}
+
 const ACTIVITY_LIMIT = 1000;
 function activityLine(line) {
   return String(line ?? '')
@@ -765,6 +1014,13 @@ function runCodex({ prompt, cwd, onEvent, permissionMode = 'acceptEdits', model,
     });
   });
 }
+// Small internal LLM calls (intent classification, proof summaries, board Q&A).
+// Prefer Claude Code + haiku, but fall back to whatever agent is installed so a
+// Codex-only machine still works — never a hardcoded `claude` that isn't there.
+function runUtility(args) {
+  const agent = pickUtilityAgent(AVAILABLE_AGENTS);
+  return runWorkerAgent({ agent, model: utilityModel(agent), ...args });
+}
 function runWorkerAgent({ agent, ...args }) {
   return workerAgent(agent) === 'codex' ? runCodex(args) : runClaude(args);
 }
@@ -986,6 +1242,62 @@ function startNextStacked(projectId) {
   });
 }
 
+// Worker auth preflight state. The manager runs every worker by spawning a
+// standalone `claude` (runClaude), inheriting the launching shell's login. If
+// that shell has no usable credentials, every task fails late with "Not logged
+// in". We probe once at boot and hold the queue + raise a banner instead of
+// failing task after task. Optimistic default (ok:true) so we never falsely
+// block a correctly-authed setup during the ~1s probe.
+let workerAuth = { ok: true, reason: null, checkedAt: null };
+const publicAuth = () => ({ ok: workerAuth.ok, reason: workerAuth.reason });
+
+// Boot preflight: one cheap Read-only `claude` call; classify the result (pure,
+// in lib) and broadcast so the UI can show/clear the banner. `claude -p` exits 0
+// even when logged out, so classifyAuthProbe reads the text, not the code.
+async function probeWorkerAuth() {
+  try {
+    const out = await runClaude({ prompt: 'Reply with the single word: ok', cwd: ROOT, tools: 'Read', model: 'haiku' });
+    workerAuth = { ...classifyAuthProbe({ result: out?.result, code: out?.code }), checkedAt: Date.now() };
+  } catch {
+    workerAuth = { ok: false, reason: 'probe-failed', checkedAt: Date.now() };
+  }
+  console.log(workerAuth.ok
+    ? '[manager] worker auth preflight OK'
+    : `[manager] worker auth preflight FAILED (${workerAuth.reason}) — holding the queue. ${authBannerText(workerAuth.reason, 'en')}`);
+  send({ ev: 'auth', auth: publicAuth() });
+  return workerAuth;
+}
+
+// Layer 2 of the intent router: a general planner clarify card has no builder to
+// re-render from, so when the user asks to switch language mid-question we ask
+// the model (cheap, Read-only, no repo edits) to RESTATE the pending question in
+// the target language — same intent, same options, just translated. Keeps the
+// goal in needsInput (the user still hasn't answered). On any failure we keep the
+// original card so the user is never stranded. Pure parsing lives in
+// parseRelocalizedQuestion (unit-tested); this is the I/O shell.
+async function relocalizeGeneralQuestion(goal, lang, res) {
+  const q0 = goal.question || {};
+  const langName = lang === 'en' ? 'English' : 'Japanese (日本語)';
+  const prompt = [
+    `Restate the following clarifying question in ${langName}. Keep the meaning and each option; only translate. Do not answer it, do not add new options.`,
+    `Question: ${q0.text ?? ''}`,
+    Array.isArray(q0.options) && q0.options.length ? `Options: ${JSON.stringify(q0.options)}` : 'Options: []',
+    'Return ONLY JSON: {"text": "...", "options": ["..."]}',
+  ].join('\n');
+  try {
+    const out = await runClaude({ prompt, cwd: ROOT, tools: 'Read', model: 'haiku' });
+    const restated = parseRelocalizedQuestion(out?.result);
+    goal.question = restated
+      ? { ...q0, text: restated.text, options: restated.options.length ? restated.options : (q0.options || []), lang }
+      : { ...q0, lang };
+  } catch {
+    goal.question = { ...q0, lang };
+  }
+  goal.status = 'needsInput';
+  saveGoal(goal);
+  return json(res, 200, goal);
+}
+
 async function planGoal(goal) {
   const project = projects.find((p) => p.id === goal.projectId);
   const prompt = [
@@ -1102,6 +1414,10 @@ async function authorVerify(task, goal, project) {
 // `lastStartAt` check in pump() below.
 const slowModeLastStart = new Map(); // projectId -> ms epoch of the last task start
 function pump(projectId) {
+  // Worker auth preflight failed → hold the queue (the UI banner tells the user
+  // to sign `claude` in and relaunch). Never spawn a worker that can only fail
+  // with "Not logged in". Cleared automatically once a probe succeeds.
+  if (!workerAuth.ok) return;
   const q = queues.get(projectId);
   // sortQueueByPriority is a stable sort: it only ever moves a task ahead of
   // a lower-priority one, never disturbs relative order within the same
@@ -2063,7 +2379,7 @@ async function summarizeForReview(goal, siblings, dir, reviewDefinition) {
     `ワーカー報告:\n${reports.slice(0, 1500)}`,
   ].join('\n');
   try {
-    const r = await runClaude({ prompt, cwd: dir, tools: 'Read', model: 'haiku' });
+    const r = await runUtility({ prompt, cwd: dir, tools: 'Read' });
     const m = r.result.match(/\{[\s\S]*\}/);
     if (m) { const o = JSON.parse(m[0]); return { check: String(o.check ?? '').replace(/\s+/g, ' ').slice(0, 120), changed: String(o.changed ?? '').replace(/\s+/g, ' ').slice(0, 120) || fallback.changed }; }
   } catch { /* fall through */ }
@@ -2530,7 +2846,7 @@ const server = createServer(async (req, res) => {
       price: await getBillingPrice(),
       siteUrl: BILLING_API_URL || null,
     };
-    return json(res, 200, { projects, goals: visibleGoals, tasks: trimTaskActivityForState(visibleTasks), models: MODELS, agentModels: { 'claude-code': MODELS, codex: CODEX_MODELS }, agentEfforts: { 'claude-code': CLAUDE_EFFORTS, codex: CODEX_EFFORTS }, agents: WORKER_AGENTS, connectCommand, queueOrder, externalActivity, workflowColumns: projectColumns, reviewDefinitions: projectReviewDefs, runningCounts, parallelLimits, uiVersion: uiVersion(), billing });
+    return json(res, 200, { projects, goals: visibleGoals, tasks: trimTaskActivityForState(visibleTasks), models: MODELS, agentModels: { 'claude-code': MODELS, codex: CODEX_MODELS }, agentEfforts: { 'claude-code': CLAUDE_EFFORTS, codex: CODEX_EFFORTS }, agents: AVAILABLE_AGENTS, connectCommand, queueOrder, externalActivity, workflowColumns: projectColumns, reviewDefinitions: projectReviewDefs, runningCounts, parallelLimits, uiVersion: uiVersion(), billing, auth: publicAuth() });
   }
 
   // Billing (docs/BILLING-LAUNCH-PLAN.md): activate the license key a user
@@ -2552,6 +2868,34 @@ const server = createServer(async (req, res) => {
     return;
   }
 
+  // GET /api/relay-status — is this account's relay slot held by ANOTHER device?
+  // The relay-client (a separate process) writes relay-status.json when it stands
+  // down after being evicted (see relay-client.mjs / lib.mjs relayReconnectDecision).
+  // P4's board reads this to show "Galda is running on another device → switch
+  // here". Best-effort: no file yet → idle.
+  if (url.pathname === '/api/relay-status' && req.method === 'GET') {
+    let st = { status: 'idle', stoodDown: false, identity: null, at: 0 };
+    try { st = { ...st, ...JSON.parse(readFileSync(join(DATA_DIR, 'relay-status.json'), 'utf8')) }; } catch { /* none yet */ }
+    return json(res, 200, { ...st, inUseElsewhere: st.stoodDown === true });
+  }
+  // POST /api/relay-takeover — the user pressed "switch to this device". Signal
+  // the relay-client (separate process) via a request file it watches; it clears
+  // the stand-down and reclaims the relay slot. UI wiring is P4.
+  if (url.pathname === '/api/relay-takeover' && req.method === 'POST') {
+    try { writeFileSync(join(DATA_DIR, 'relay-takeover.req'), String(Date.now())); }
+    catch (e) { return json(res, 500, { error: String(e?.message ?? e) }); }
+    return json(res, 200, { ok: true });
+  }
+  // POST /api/signout — forget the local license so the settings panel can
+  // offer a plain "Log out" instead of requiring the `--signin` CLI flag to
+  // switch Google accounts. Clears the on-disk token and the in-memory cache;
+  // idempotent when already signed out.
+  if (url.pathname === '/api/signout' && req.method === 'POST') {
+    if (existsSync(licenseFile)) unlinkSync(licenseFile);
+    licenseState = { email: null, isPaying: false, verifiedAt: 0 };
+    return json(res, 200, { ok: true });
+  }
+
   // GET /api/signin-url — mints a one-time nonce and returns the billing
   // Worker's /connect URL for "Sign in with Google". The app opens this in the
   // browser; Google bounces back to /oauth/callback (below) with a token.
@@ -2620,6 +2964,15 @@ const server = createServer(async (req, res) => {
     return json(res, 200, { licensed: true, isPaying: licenseState.isPaying });
   }
 
+  // Live cross-device takeover (P4): pull the account's newer board into this
+  // running instance on demand (the switch UI's 切替 button). Adopts only when
+  // this device is idle; 409 'busy' if it has active work (never yanks the board
+  // from a live worker). Key-gated like every /api route above.
+  if (url.pathname === '/api/sync/pull' && req.method === 'POST') {
+    const r = await livePull();
+    return json(res, r.action === 'busy' ? 409 : 200, r);
+  }
+
   if (url.pathname === '/api/projects' && req.method === 'POST') {
     let body = '';
     req.on('data', (d) => { body += d; });
@@ -2701,6 +3054,32 @@ const server = createServer(async (req, res) => {
         const { projectId, text, pr, images, model, effort, source, pending, review, note, mode, skill, agent } = JSON.parse(body);
         const project = projects.find((p) => p.id === projectId);
         if (!project || !text?.trim()) return json(res, 400, { error: 'projectId and text required' });
+        // Onboarding (docs/HANDOFF-ONBOARDING-conversational.md, SLICE 2): the
+        // composer is conversation-first. A chat/help/settings message ("what can
+        // you do?", "reply in English", a greeting) gets a conversational reply
+        // and must NOT become a To-Do. Classified BEFORE dedupe/billing/goal
+        // creation, so a chat turn never folds into a goal, never counts against
+        // the free-tier cap, and never persists a task. /later (pending) and
+        // /review are explicit user intent → skip classification. A cheap
+        // heuristic short-circuits obvious implementation requests (no LLM);
+        // anything else gets one Haiku round-trip that both classifies and writes
+        // the reply. LLM failure falls back to 'task' — never drop a real
+        // implementation ask (the folder guard below still prevents no-ops).
+        if (!pending && !review && classifyComposerIntentHeuristic(text.trim()) === 'chat') {
+          // Only a HIGH-confidence chat/help/settings message reaches the LLM —
+          // to write the reply, and to let the model veto back to 'task' if the
+          // heuristic over-fired. Everything else (clear tasks AND ambiguous
+          // 'unsure') goes straight to goal creation: bias to task keeps the
+          // common path LLM-free (no latency/tokens on real work) and the folder
+          // guard below still prevents no-ops. LLM failure → treat as task and
+          // fall through, so a real implementation ask is never dropped.
+          const intentLang = detectRequestLanguage(text);
+          try {
+            const r = await runUtility({ prompt: buildIntentPrompt(text.trim(), intentLang), cwd: ROOT, tools: 'Read' });
+            const parsed = parseIntentResponse(r.result);
+            if (parsed.intent === 'chat') return json(res, 200, { kind: 'chat', reply: parsed.reply.slice(0, 2000), lang: intentLang });
+          } catch { /* LLM unavailable → fall through to goal creation */ }
+        }
         // Dedupe (Masa: 被ったやつもまとめて): if this near-duplicates a goal
         // already in flight (running/review with a live worker session), fold it
         // in as a thread follow-up (context kept via session resume) instead of
@@ -2746,15 +3125,25 @@ const server = createServer(async (req, res) => {
         // for pending/review items (they never spawn a worker).
         const runnable = !pending && !review;
         const needsFolder = runnable && needsProjectFolder({ dir: project.dir, homeDir: HOME, isRepo: isGitRepo(project.dir) });
-        const folderQuestion = needsFolder
-          ? buildFolderQuestion(detectRepos(HOME), { lang: /[぀-ヿ㐀-鿿]/.test(text) ? 'ja' : 'en' })
-          : undefined;
-        const goalAgent = workerAgent(agent);
+        const lang = /[぀-ヿ㐀-鿿]/.test(text) ? 'ja' : 'en';
+        const folderQuestion = needsFolder ? buildFolderQuestion(detectRepos(HOME), { lang }) : undefined;
+        // Task 5 (PR運用ヒアリング): once the folder is settled, ask — once per
+        // project, before its first runnable goal — whether this project wants
+        // PRs. Skipped this round if a folder question already claimed the
+        // needsInput slot; that goal gets rebound to a real repo via /answer
+        // and the NEXT goal for that project is what actually asks this.
+        const needsReviewPref = runnable && !needsFolder && needsReviewPreference({ askedBefore: project.reviewPrefAsked });
+        const reviewPrefQuestion = needsReviewPref ? buildReviewPreferenceQuestion({ lang }) : undefined;
+        if (needsReviewPref) { project.reviewPrefAsked = true; saveProjects(); }
+        // Clamp to whatever agent CLIs are actually installed on this machine
+        // (connected-agents Phase A) — a requested/default agent that isn't
+        // present would otherwise spawn a worker doomed to fail at launch.
+        const goalAgent = pickAvailableAgent(workerAgent(agent), AVAILABLE_AGENTS);
         const priorFailureMemory = recentProjectFailureMemory(projectId, text.trim());
         const goal = {
           id: nextId++, projectId, text: text.trim().slice(0, 8000),
-          status: needsFolder ? 'needsInput' : review ? 'review' : pending ? 'pending' : 'planning',
-          question: folderQuestion,
+          status: (needsFolder || needsReviewPref) ? 'needsInput' : review ? 'review' : pending ? 'pending' : 'planning',
+          question: folderQuestion || reviewPrefQuestion,
           reviewOnly: review ? true : undefined,
           note: review && typeof note === 'string' && note.trim() ? note.trim().slice(0, 8000) : undefined,
           wantsPR: review ? false : resolveWantsPR(pr, text, getReviewDefinition(projectId).defaultWantsPR),
@@ -2784,7 +3173,7 @@ const server = createServer(async (req, res) => {
         // pending = deliberately shelved (Phase 2 material): never planned,
         // never queued, until POST /api/goals/:id/activate. review-only items
         // are terminal-until-human too, so they also skip planGoal.
-        if (runnable && !needsFolder) {
+        if (runnable && !needsFolder && !needsReviewPref) {
           planGoal(goal).catch((e) => {
             goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal);
           });
@@ -2819,7 +3208,7 @@ const server = createServer(async (req, res) => {
           '',
           `質問: ${question.trim().slice(0, 500)}`,
         ].join('\n');
-        const r = await runClaude({ prompt, cwd: ROOT, tools: 'Read', model: 'haiku' });
+        const r = await runUtility({ prompt, cwd: ROOT, tools: 'Read' });
         json(res, 200, { answer: r.result.trim().slice(0, 2000) });
       } catch (e) {
         json(res, 500, { error: String(e.message ?? e).slice(0, 200) });
@@ -2850,7 +3239,7 @@ const server = createServer(async (req, res) => {
       const q = queues.get(goal.projectId);
       if (q) q.waiting = q.waiting.filter((t) => t.goalId !== goal.id);
       goals = goals.filter((g) => g.id !== goal.id);
-      appendFileSync(logFile, JSON.stringify({ kind: 'goal', id: goal.id, deleted: true }) + '\n');
+      logAppend(JSON.stringify({ kind: 'goal', id: goal.id, deleted: true }));
       sendGoalEvent({ ev: 'goal-deleted', id: goal.id }, goal);
       startNextStacked(goal.projectId);
       pump(goal.projectId);
@@ -3100,6 +3489,52 @@ const server = createServer(async (req, res) => {
         planGoal(goal).catch((e) => { goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal); });
         return json(res, 200, goal);
       };
+      // Intent router (no free-text box is a dead-end). Before any per-kind
+      // handler treats `answer` as a literal, classify it. A reply that isn't a
+      // clean answer is NEVER coerced (the old bug where 「日本語で教えて」 typed
+      // into the folder box became a repo of that name). Two non-answer routes:
+      //   relocalize → the user asked to switch language; re-render the SAME
+      //     card in that language (folder/init via their builders; a general
+      //     planner card via the model, which can restate in any language).
+      //   escalate → free-form intent; for the filesystem-bound folder cards we
+      //     re-ask (with a localized hint) rather than invent a path; for a
+      //     general card, prose is a legit clarification and routes 'accept'.
+      const route = routeQuestionAnswer(answer, goal.question || {});
+      const qKind = goal.question?.kind;
+      if (route.route === 'relocalize') {
+        goal.lang = route.lang;
+        if (qKind === 'folder') {
+          goal.question = buildFolderQuestion(detectRepos(HOME), { lang: route.lang });
+          saveGoal(goal);
+          return json(res, 200, goal);
+        }
+        if (qKind === 'folder-init') {
+          const q0 = goal.question;
+          goal.question = buildFolderInitConfirm(q0.dir, { lang: route.lang, create: q0.create, homeDir: HOME });
+          saveGoal(goal);
+          return json(res, 200, goal);
+        }
+        // General planner clarify card: no builder to rebuild from, so ask the
+        // model (cheap, Read-only) to restate the pending question in `route.lang`.
+        relocalizeGeneralQuestion(goal, route.lang, res);
+        return;
+      }
+      if (route.route === 'escalate' && (qKind === 'folder' || qKind === 'folder-init')) {
+        // Couldn't read prose as a folder/decision → re-ask WITHOUT coercion,
+        // folding a localized hint into the card's text (no new UI field).
+        const lang = goal.question?.lang || goal.lang || 'ja';
+        if (qKind === 'folder-init') {
+          const q0 = goal.question;
+          goal.question = buildFolderInitConfirm(q0.dir, { lang, create: q0.create, homeDir: HOME });
+        } else {
+          goal.question = buildFolderQuestion(detectRepos(HOME), { lang });
+        }
+        goal.question.text = notUnderstoodNote(lang) + goal.question.text;
+        saveGoal(goal);
+        return json(res, 200, goal);
+      }
+      // route === 'accept' (or a general escalate, which folds into goal.text
+      // below) → fall through to the existing per-kind handlers unchanged.
       // Folder-choice answer (onboarding funnel): rebind the goal to the chosen
       // repo rather than appending to goal.text — a folder isn't a task
       // clarification. If the picked path is already a repo, bind it. If it's a
@@ -3157,6 +3592,28 @@ const server = createServer(async (req, res) => {
         }
         return bindAndPlan(dir);
       }
+      // Review-preference answer (task 5 onboarding funnel): fold into the
+      // project's review definition (defaultWantsPR) rather than goal.text —
+      // like the folder question, this is project setup, not a task detail.
+      if (goal.question?.kind === 'reviewPref') {
+        const project = projects.find((p) => p.id === goal.projectId);
+        const patch = resolveReviewPreferenceAnswer(answer, goal.question);
+        if (project) {
+          const merged = validateReviewDefinition({ ...getReviewDefinition(project.id), ...patch });
+          if (merged.ok) {
+            reviewDefinitions[project.id] = merged.definition;
+            saveReviewDefinitions();
+            send({ ev: 'review-definition', projectId: project.id, reviewDefinition: merged.definition });
+          }
+        }
+        goal.wantsPR = resolveWantsPR(undefined, goal.text, patch.defaultWantsPR);
+        goal.question = null;
+        goal.clarified = true;
+        goal.status = 'planning';
+        saveGoal(goal);
+        planGoal(goal).catch((e) => { goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal); });
+        return json(res, 200, goal);
+      }
       goal.text = `${goal.text}\n[確認: ${goal.question?.text ?? ''} → ${answer}]`;
       goal.clarified = true; // answered once → planGoal must never re-ask (persisted via saveGoal)
       goal.question = null;
@@ -3540,6 +3997,7 @@ server.listen(PORT, '127.0.0.1', () => {
     spawn('open', ['-g', openUrl], { stdio: 'ignore' }).unref();
   }
   console.log(`[manager] projects: ${projects.map((p) => `${p.id}=${p.dir}`).join('  ')}`);
+  probeWorkerAuth().catch(() => {}); // hold the queue + banner if `claude` isn't signed in
   syncAllExternal().catch(() => {});
   syncGoalMerges().catch(() => {});
   setInterval(() => {