@galda/cli 0.10.19 → 0.10.21

package/CLAUDE.md

@@ -7,10 +7,16 @@
 - `毎回、実装したものにはテストを書いて、実行する`。
   - engine/ の変更 → `node --test --test-concurrency=1 'engine/test/*.test.mjs'` が緑になるまで完了と言わない。
   - 🔴 **`--test-concurrency=1` は必須**（Masa報告のカオス調査で発見・2026-07-16）。既定（CPUコア数）だと
-    58ファイルが同時に実サーバを立ててポートを奪い合い、**同じコードで赤が毎回入れ替わる**
-    （実測: 1回目=2件赤 → 2回目=別の4件赤。`multi-user-server` はサーバが起動せず18msで全滅）。
-    直列なら **527 pass / 1 fail / 1 skip** で安定し、所要時間もほぼ同じ（約102秒）。
+    58ファイルが同時に実サーバと Chrome を立てて**マシンを飽和させ、同じコードで赤が毎回入れ替わる**。
     **「テスト緑」がコードの状態でなく運を報告している状態を放置しない**＝規律の土台。
+    - **原因の半分は 2026-07-17 に構造で潰した**（PR: test-port-allocation）。各テストが
+      `4600 + (pid % 40)` 式で**ポートを手書きし隣接バンドで衝突**していた分は、`MANAGER_PORT=0`＋
+      `engine/test/helpers/start-server.mjs` に一本化して**原理的に消えた**（OSは同じポートを2つに渡さない）。
+      `multi-user-server` の「18msで全滅」はこれ。**テストで新しくポートを書かない**＝ヘルパを使う。
+    - **残る半分は資源の飽和**（実サーバ＋Chrome の総量）。実測 2026-07-17: 並列だと1回目3件赤→2回目2件赤で
+      **まだ揺れる上に遅い**（並列152秒 vs 直列135秒）。**並列に戻す根拠は無い**＝直列のまま。
+      直列は2回連続で **584 pass / 既知の赤1件** と完全一致。
+      次に上限を上げたければ、テストが実サーバを立てる設計自体（in-process 化等）を変えること。
   - 既知の赤1件＝`persist-failure`(full-disk resilience)。**素の `origin/main` でも落ちる**（`fix/persist-log-disk-full` が未マージ）。
     自分の変更のせいかは、素の main と比べて判定する。
   - 新しいロジックは可能な限り純関数として `engine/lib.mjs` 等に切り出し、`engine/test/` にテストを追加する。
@@ -67,6 +73,14 @@
 - **`a2c-tech.workers.dev` を絶対に使わない・コードやdocsに書かない**。これはクライアント企業 **A2C** の名を冠した Cloudflare workers.dev サブドメインで、Galda の製品・URL・設定に一切登場させてはいけない（見つけたら全て除去）。
 - Worker/API へは**必ず所有ドメイン `https://galda.app`（custom domain）経由**で参照する。`*.workers.dev` サブドメインを製品コードに焼き込まない（`MANAGER_BILLING_API_URL` 等の既定値は `https://galda.app`）。
 - **Cloudflare/wrangler にデプロイする前に `wrangler whoami` でデプロイ先アカウントを確認**し、Galda/Kodo 所有であること・workers.dev サブドメイン名に客先名や別プロジェクト名が出ていないことを確かめる。怪しければ止めて Masa に確認（本番デプロイは Masa 明示許可制）。
+- **リリースは4面**（① npm ② Fly ③ Worker ④ Masaの常駐インスタンス `~/manager-for-ai`:4400）。①だけ出して④を忘れると「直したのに直ってない」＋relay相互kickループ再発の実例あり（2026-07-16/17）。全文＝`docs/RELEASE-WORKFLOW.md`の「本番は1つじゃない」表。
+
+## relay接続（`app.galda.app`）を伴う作業の掟（Masa明言 2026-07-17・全レーン必読）
+
+- **relayは1アカウント=同時1接続のみ**。同じ`MANAGER_HOME`（既定`~/.manager-for-ai`）を指す2つ目のプロセスを起動すると、実本番アカウントの接続を奪い合い、"無限ループ"（app.galda.appのリロード連打）を引き起こす。**6回繰り返した実績のあるインシデントクラス**（`docs/RUNBOOK-relay-mutual-kick.md`参照）。
+- `engine/relay-client.mjs`は2026-07-17からPIDロックで2つ目の起動を自動拒否するが、**手動検証で`node engine/relay-client.mjs`や`npx @galda/cli`を叩く時は、必ず隔離した`MANAGER_HOME`を使う**（本番の`~/.manager-for-ai`を素で使わない）。
+- **"無限ループ"に見えても原因は2系統ある**（プロセスが1個だけの時は相互kickではない＝**アカウント不一致**。ローカルのライセンスemailとブラウザのGoogleサインインemailが違うと、プロセスは正常なのに永遠に「未接続」に見える）。`docs/RUNBOOK-relay-mutual-kick.md`の「診断の分岐」でプロセス数を数えてから対応を選ぶ。
+- 「無限ループが起きてる」と報告されたら、コードを読みに行く前に**必ず**`docs/RUNBOOK-relay-mutual-kick.md`の診断手順（`ps aux | grep relay-client`から）に従う。
 
 ## 構成
 

package/app/index.html

@@ -6057,8 +6057,16 @@ function bootDisconnected(info){
     #connectGate .cg-hint a:hover{text-decoration:underline}
     #connectGate .cg-who{font-size:12px;color:var(--ink3,#6b6862);margin:0 0 4px}
     #connectGate .cg-who b{color:var(--ink2,#a3a097)}
-    #connectGate .cg-switch{font-size:12px;color:var(--ink3,#6b6862);margin:14px 0 0}
+    #connectGate .cg-switch{font-size:12px;color:var(--ink3,#6b6862);margin:14px 0 0;transition:color .2s}
     #connectGate .cg-switch a{color:var(--blue,#8fb0ff);text-decoration:none}
+    /* A long wait (15s+) almost always means an account mismatch, not a slow
+       first connect (Masa 2026-07-17: kept re-running npx, kept landing back
+       here — the always-on caption below was too easy to miss). Escalate to
+       the existing warning tone (--amber, same as failed-step/review chips)
+       — color only, no filled box, per the hover/attention convention used
+       everywhere else in this app. */
+    #connectGate .cg-switch.escalated{color:var(--amber);font-weight:600}
+    #connectGate .cg-switch.escalated a{color:var(--amber);text-decoration:underline}
     #connectGate .cg-x{position:absolute;top:14px;right:16px;width:28px;height:28px;border:0;background:transparent;color:var(--ink3,#6b6862);font-size:20px;line-height:1;cursor:pointer}
     #connectGate .cg-wait{display:inline-flex;align-items:center;gap:7px;font:500 10.5px/1 var(--mono,monospace);letter-spacing:.08em;color:var(--ink3,#6b6862);margin-top:16px}
     #connectGate .cg-wait i{width:6px;height:6px;border-radius:50%;background:var(--green,#3DDC97);animation:cgpulse 1.8s ease-in-out infinite}
@@ -6111,11 +6119,26 @@ function bootDisconnected(info){
   // `setInterval` + `if (status !== 503) reload` poll, which amplified any agent
   // flap into an infinite reload (the ~10-failure "無限ループ").
   const cgWait = ov.querySelector('.cg-wait');
+  const cgSwitch = ov.querySelector('.cg-switch');
+  // Escalate the account-mismatch hint after a long wait (2026-07-17: mirrors
+  // engine/lib.mjs shouldEscalateConnectGateHint — inlined, this file can't
+  // import engine/lib.mjs). A genuine first connect takes a few seconds; a
+  // wait that crosses 15s is almost always the local agent being signed in
+  // under a DIFFERENT email than this browser (relay identity is per-email,
+  // so re-running `npx @galda/cli` — which reconnects that SAME mismatched
+  // identity — never helps; only `--signin` does). Naming the actual signed-
+  // in email turns "I have no idea what's wrong" into "oh, wrong account".
+  const CG_ESCALATE_MS = 15000;
+  const escalateTimer = (email && cgSwitch) ? setTimeout(() => {
+    cgSwitch.classList.add('escalated');
+    cgSwitch.innerHTML = `Still waiting? Galda may already be running on this computer under a <b>different account</b> than <b>${email.replace(/[<>&]/g, (c) => ({ '<': '&lt;', '>': '&gt;', '&': '&amp;' }[c]))}</b>. Run <code>npx @galda/cli --signin</code> in that terminal and pick this account. Or <a href="/logout">switch this browser →</a>`;
+  }, CG_ESCALATE_MS) : null;
   try {
     const es = new EventSource('/presence');
     es.addEventListener('presence', (e) => {
       let d; try { d = JSON.parse(e.data); } catch { return; }
       if (d.state === 'connected') {
+        if (escalateTimer) clearTimeout(escalateTimer);
         // Confirm the engine is REALLY reachable before reloading. A stale/spurious
         // 'connected' presence otherwise reloads us into a white flash that lands
         // right back on this same connect screen — the welcome animation plays, then

package/engine/lib.mjs

@@ -3112,3 +3112,41 @@ export function relayReconnectDecision(state, event) {
       return { state: s, dial: false, reason: 'noop' };
   }
 }
+
+// --- Relay-client single-instance guard (2026-07-17, five incidents deep) -----
+// Every relay mutual-kick incident so far (#86/#88/#106, and the one that
+// prompted this) traces back to the SAME root: nothing has ever stopped more
+// than one relay-client process from authenticating as the same account at
+// once — a background launchd instance, a fresh `npx @galda/cli`, and an
+// engineer's ad-hoc `node engine/relay-client.mjs` test run can all share the
+// same DATA_DIR (and therefore the same license.token) with zero coordination.
+// relayReconnectDecision() makes each INDIVIDUAL process behave correctly once
+// evicted; it can't stop a THIRD, FOURTH, FIFTH process from starting fresh —
+// a fresh start isn't a "reconnect", so the reducer never even sees it. This
+// closes that gap at the one point it can be closed structurally: refuse to
+// start a second live process against the same DATA_DIR at all, the same
+// pattern tools/lane.mjs uses for hot-file locks (fail at start time, not
+// after the fact). `alive` is passed in (not computed here) so this stays a
+// pure decision — the caller does the actual process.kill(pid, 0) liveness
+// check (real I/O, not testable as a pure function).
+export function shouldRefuseRelayClientStart({ existingLock, alive } = {}) {
+  if (!existingLock || !Number.isFinite(existingLock.pid)) return { refuse: false, reason: 'no-lock' };
+  if (!alive) return { refuse: false, reason: 'stale-lock' };
+  return { refuse: true, reason: 'already-running', holderPid: existingLock.pid };
+}
+
+// --- Connect-gate account-mismatch escalation (2026-07-17) ------------------
+// A genuinely fresh "run npx @galda/cli" wait is short — the agent connects
+// within a few seconds. A wait that runs long almost always means one thing:
+// the local agent IS running, but it's licensed under a DIFFERENT email than
+// the one signed in on this browser (relay identity is per-email, so they
+// never meet). Before this, the only guidance for that exact scenario was a
+// small always-on caption easy to miss among the first-time-setup copy — a
+// user just re-runs `npx @galda/cli` (which reconnects the SAME already-
+// mismatched identity) and waits again, forever. Escalating the hint once the
+// wait crosses a threshold — with the actual signed-in email substituted in —
+// turns "I have no idea what's wrong" into "oh, wrong account" (see
+// docs/RUNBOOK-relay-mutual-kick.md's account-mismatch entry).
+export function shouldEscalateConnectGateHint(waitedMs, email, thresholdMs = 15000) {
+  return Number(waitedMs) >= thresholdMs && Boolean(String(email ?? '').trim());
+}

package/engine/relay-client.mjs

@@ -12,7 +12,7 @@ import { readFileSync, writeFileSync, existsSync, watch, unlinkSync } from 'node
 import { resolve, dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
-import { licenseTokenIdentity, relayReconnectDecision } from './lib.mjs';
+import { licenseTokenIdentity, relayReconnectDecision, shouldRefuseRelayClientStart } from './lib.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const DATA_DIR = process.env.MANAGER_HOME
@@ -182,7 +182,43 @@ function handleTakeover() {
   if (d.dial) { console.log('[agent] taking over this account on this device (user requested)'); redialNow(); }
 }
 
+// Single-instance guard (2026-07-17): refuse to start a second relay-client
+// against the same DATA_DIR. See lib.mjs shouldRefuseRelayClientStart for why —
+// this is the one point that actually stops the "N processes, one account"
+// mutual-kick class of incident, rather than making each process behave
+// better once it's already one of several. RELAY_CLIENT_FORCE=1 overrides for
+// the rare legitimate case (you know two are up and you're taking over by hand).
+const LOCK_FILE = join(DATA_DIR, 'relay-client.lock');
+function readLock() {
+  try { return JSON.parse(readFileSync(LOCK_FILE, 'utf8')); } catch { return null; }
+}
+function isPidAlive(pid) {
+  if (!Number.isFinite(pid)) return false;
+  try { process.kill(pid, 0); return true; } catch { return false; }
+}
+function writeLock() {
+  try { writeFileSync(LOCK_FILE, JSON.stringify({ pid: process.pid, startedAt: Date.now() })); } catch { /* best-effort */ }
+}
+function releaseLock() {
+  try {
+    const l = readLock();
+    if (l && l.pid === process.pid) unlinkSync(LOCK_FILE);
+  } catch { /* already gone */ }
+}
+
 if (!process.env.RELAY_CLIENT_NO_START) {
+  const existingLock = readLock();
+  const guard = shouldRefuseRelayClientStart({ existingLock, alive: existingLock ? isPidAlive(existingLock.pid) : false });
+  if (guard.refuse && !process.env.RELAY_CLIENT_FORCE) {
+    console.error(`[agent] relay-client: another instance is already running for this account (pid ${guard.holderPid}, ${DATA_DIR}).`);
+    console.error('[agent] Running two at once is exactly what causes the relay mutual-kick loop — stop the other one first.');
+    console.error('[agent] If you are certain (e.g. taking over by hand), set RELAY_CLIENT_FORCE=1 and re-run.');
+    process.exit(1);
+  }
+  writeLock();
+  process.on('exit', releaseLock);
+  for (const sig of ['SIGINT', 'SIGTERM']) process.on(sig, () => { releaseLock(); process.exit(0); });
+
   connect();
 
   // Watch DATA_DIR for two triggers (the file may not exist yet on first run;

package/engine/server.mjs

@@ -31,7 +31,10 @@ const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const DATA_DIR = process.env.MANAGER_HOME
   ?? (existsSync(join(ROOT, '.git')) ? join(ROOT, 'engine') : join(homedir(), '.manager-for-ai'));
 mkdirSync(DATA_DIR, { recursive: true });
-const PORT = Number(process.env.MANAGER_PORT ?? 4400);
+// MANAGER_PORT=0 asks the OS for a free port; the real one is only known once
+// the listen below succeeds, so this is rebound there (before anything prints
+// or links to it).
+let PORT = Number(process.env.MANAGER_PORT ?? 4400);
 
 // Access key: required for every request when the server is exposed beyond
 // localhost (e.g. through a tunnel). Auto-generated once, kept out of git.
@@ -3958,7 +3961,6 @@ const server = createServer(async (req, res) => {
 // Same request handler, loopback-only, best-effort (skip if ::1 unavailable).
 const server6 = createServer(server.listeners('request')[0]);
 server6.on('error', (e) => console.log(`[manager] ::1 listen skipped: ${e.code}`));
-try { server6.listen(PORT, '::1'); } catch { /* IPv6 loopback unavailable */ }
 
 // Guard the primary IPv4 listen the same way the ::1 twin is guarded: without
 // this, a busy port emits an unhandled 'error' and Node prints a raw stack
@@ -3975,6 +3977,8 @@ server.on('error', (e) => {
 });
 
 server.listen(PORT, '127.0.0.1', () => {
+  PORT = server.address().port; // the OS-assigned one when MANAGER_PORT=0
+  try { server6.listen(PORT, '::1'); } catch { /* IPv6 loopback unavailable */ }
   console.log(`[manager] Manager for AI → http://localhost:${PORT}/?key=${ACCESS_KEY}`);
   if (process.env.MANAGER_OPEN_BROWSER === '1' && process.platform === 'darwin') {
     // Hosted flow (billing worker + named app configured): the user lives in

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.19",
+  "version": "0.10.21",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {
     "start": "node engine/server.mjs",
-    "test": "node --test --test-concurrency=2 'engine/test/*.test.mjs'"
+    "test": "node --test --test-concurrency=1 'engine/test/*.test.mjs'"
   },
   "dependencies": {
     "puppeteer-core": "^23.11.1",