@galda/cli 0.10.2 → 0.10.5

package/CLAUDE.md

@@ -33,6 +33,12 @@
   - 探索的な読み込み（横断 grep・場所探し・大きいファイル通読）は**既定で subagent に逃がし**、メイン文脈に全文を載せない。ピンポイントな1関数だけ直接読む。
   - 別エージェントへ渡す時は、チャット履歴でなく **1枚の handoff md** を書いて渡す。
 
+## デプロイ／インフラの掟（Masa明言 2026-07-15・全レーン必読）
+
+- **`a2c-tech.workers.dev` を絶対に使わない・コードやdocsに書かない**。これはクライアント企業 **A2C** の名を冠した Cloudflare workers.dev サブドメインで、Galda の製品・URL・設定に一切登場させてはいけない（見つけたら全て除去）。
+- Worker/API へは**必ず所有ドメイン `https://galda.app`（custom domain）経由**で参照する。`*.workers.dev` サブドメインを製品コードに焼き込まない（`MANAGER_BILLING_API_URL` 等の既定値は `https://galda.app`）。
+- **Cloudflare/wrangler にデプロイする前に `wrangler whoami` でデプロイ先アカウントを確認**し、Galda/Kodo 所有であること・workers.dev サブドメイン名に客先名や別プロジェクト名が出ていないことを確かめる。怪しければ止めて Masa に確認（本番デプロイは Masa 明示許可制）。
+
 ## 構成
 
 - `engine/server.mjs` … チャットアプリのサーバ（:4400・タスク分解・worker実行・SSE・PR作成）

package/app/index.html

@@ -5752,7 +5752,11 @@ function bootDisconnected(info){
   const gate = (e) => { if (e) e.preventDefault(); open(); };
   if (input) { input.readOnly = true; input.addEventListener('focus', gate); input.addEventListener('mousedown', gate); input.addEventListener('keydown', gate); }
   if (send) send.addEventListener('click', gate);
-  const cw = document.getElementById('composerWrap'); if (cw) cw.addEventListener('mousedown', gate);
+  // Keep the agent / model / effort pickers live so Codex users can switch to
+  // Codex (and see it's a first-class option) even before this device connects;
+  // only typing a goal or hitting send opens the connect explainer. (Masa 2026-07-15)
+  const cw = document.getElementById('composerWrap');
+  if (cw) cw.addEventListener('mousedown', (e) => { if (e.target.closest('#appsel, #modelsel, #effortsel')) return; gate(e); });
 
   // come alive automatically: when the relay stops flagging disconnected (the
   // engine connected → its live app is proxied), reload into the real board.

package/bin/manager-for-ai.mjs

@@ -29,6 +29,12 @@ if (claude.error || claude.status !== 0) {
 }
 say(`claude CLI: ${claude.stdout.trim()}`);
 
+// 1b) codex CLI (optional alternate worker). Informational only — so Codex users
+// see it's detected and supported, not just Claude Code. Galda can run workers on
+// either; you pick per task (Claude Code / Codex) in the board's composer.
+const codex = probe('codex', ['--version']);
+if (!codex.error && codex.status === 0) say(`codex CLI: ${codex.stdout.trim()} (Codex)`);
+
 // 2) Chrome (for verification proof) — recommended; warn if missing
 const chromeCandidates = [
   process.env.CHROME_PATH,
@@ -57,7 +63,11 @@ process.env.MANAGER_OPEN_BROWSER = process.env.MANAGER_OPEN_BROWSER ?? '1';
 // and `npm start` from the repo stay env-driven and don't hit the live worker.
 // The license public key is already baked in engine/lib.mjs (offline verify).
 // Opt out with an empty value: `MANAGER_BILLING_API_URL= RELAY_URL= npx @galda/cli`.
-process.env.MANAGER_BILLING_API_URL = process.env.MANAGER_BILLING_API_URL ?? 'https://agent-manager-billing-api.a2c-tech.workers.dev';
+// Use the OWNED custom domain (galda.app), never the Cloudflare workers.dev
+// subdomain — that subdomain is named after an unrelated client (a2c-tech) and
+// must never appear in Galda's product. galda.app is bound to the same Worker
+// and serves the whole API (/connect, /checkout, /api/*). See [[no-a2c-tech]].
+process.env.MANAGER_BILLING_API_URL = process.env.MANAGER_BILLING_API_URL ?? 'https://galda.app';
 process.env.RELAY_URL = process.env.RELAY_URL ?? 'wss://app.galda.app/agent';
 await import(pathToFileURL(join(ROOT, 'engine', 'server.mjs')).href);
 

package/engine/analytics-client.mjs

@@ -9,7 +9,9 @@
 // are swallowed so analytics can never break a task run or block the caller.
 //
 // Hook points (wiring lives in engine/relay, kept out of this module):
-//   signup            → relay Google callback, right after the session is minted
+//   signup            → engine, once per install when the MCP client (Claude
+//                       Code / Codex) first connects = "setup completed"
+//                       (maybeEmitSetupCompleted in server.mjs)
 //   task_created      → engine, when a task/goal is accepted
 //   task_completed    → engine, task.status = 'done'
 //   task_failed       → engine, task.status = 'failed'

package/engine/lib.mjs

@@ -2376,3 +2376,13 @@ export async function verifyLicenseToken({ token, publicJwk = LICENSE_PUBLIC_JWK
   }
   return { valid: true, reason: null, payload };
 }
+
+// Setup-completion analytics: the `signup` event fires exactly ONCE per install,
+// the first time the MCP client (Claude Code / Codex) connects to the Manager.
+// Pure decision so it can be unit-tested without a live server or filesystem —
+// the caller supplies whether the request is from the MCP client, whether this
+// process already saw it this session, and whether the persisted once-ever flag
+// already exists on disk.
+export function shouldEmitSetupCompleted({ isMcpClient, alreadySeen, flagExists }) {
+  return Boolean(isMcpClient) && !alreadySeen && !flagExists;
+}

package/engine/mcp.mjs

@@ -24,7 +24,10 @@ const KEY = process.env.MANAGER_KEY
 
 async function api(path, opts = {}) {
   const sep = path.includes('?') ? '&' : '?';
-  const r = await fetch(`${BASE}${path}${sep}key=${KEY}`, opts);
+  // Tag every MCP→Manager call so the server can detect "connected to Claude
+  // Code / Codex" (the setup-completed signal) — see maybeEmitSetupCompleted.
+  const headers = { ...(opts.headers || {}), 'x-manager-client': 'mcp' };
+  const r = await fetch(`${BASE}${path}${sep}key=${KEY}`, { ...opts, headers });
   if (!r.ok) throw new Error(`Manager server ${r.status}: ${(await r.text()).slice(0, 200)}`);
   return r.json();
 }

package/engine/relay-client.mjs

@@ -8,7 +8,7 @@
 //
 //   RELAY_URL=wss://relay.example/agent RELAY_AGENT_TOKEN=… node engine/relay-client.mjs
 
-import { readFileSync, existsSync } from 'node:fs';
+import { readFileSync, existsSync, watch } from 'node:fs';
 import { resolve, dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
@@ -19,19 +19,40 @@ const DATA_DIR = process.env.MANAGER_HOME
 const LOCAL = process.env.MANAGER_LOCAL ?? `http://localhost:${process.env.MANAGER_PORT ?? 4400}`;
 const KEY = existsSync(join(DATA_DIR, 'secret.key')) ? readFileSync(join(DATA_DIR, 'secret.key'), 'utf8').trim() : '';
 const RELAY = process.env.RELAY_URL ?? 'ws://localhost:5500/agent';
+const DEV_EMAIL = process.env.RELAY_DEV_EMAIL ?? '';
+const LICENSE_FILE = join(DATA_DIR, 'license.token');
 // The relay (P3.1) authenticates the agent by its signed LICENSE TOKEN — only
 // the billing Worker can mint one for a verified email, so the relay binds this
 // socket to that email's id (no shared token, unspoofable). Falls back to an
 // explicit RELAY_AGENT_TOKEN, and to a dev email for local testing.
-const LICENSE = existsSync(join(DATA_DIR, 'license.token')) ? readFileSync(join(DATA_DIR, 'license.token'), 'utf8').trim() : '';
-const TOKEN = process.env.RELAY_AGENT_TOKEN ?? LICENSE;
-const DEV_EMAIL = process.env.RELAY_DEV_EMAIL ?? '';
+// Read FRESH each connect (not once at load): on first run the agent starts with
+// no token (bound to nobody); when the user signs in, license.token appears and
+// the watcher below reconnects, so the relay re-binds this socket to the real
+// identity and the user's hosted board comes alive — no CLI restart needed.
+function readToken() {
+  const lic = existsSync(LICENSE_FILE) ? readFileSync(LICENSE_FILE, 'utf8').trim() : '';
+  return process.env.RELAY_AGENT_TOKEN ?? lic;
+}
 
 const live = new Map(); // reqId -> AbortController
+let currentWs = null;
+let reconnectTimer = null;
+let lastToken = readToken();
+
+function scheduleReconnect(retryMs) {
+  if (reconnectTimer) return; // exactly one pending reconnect — never stack timers
+  reconnectTimer = setTimeout(() => { reconnectTimer = null; connect(Math.min(retryMs * 2, 15000)); }, retryMs);
+}
 
 function connect(retryMs = 1000) {
-  const auth = DEV_EMAIL ? `devEmail=${encodeURIComponent(DEV_EMAIL)}` : `token=${encodeURIComponent(TOKEN)}`;
+  // Single-socket invariant: never open a second socket while one is CONNECTING
+  // (0) or OPEN (1). Two live sockets with the same identity make the relay evict
+  // each other (server.mjs "replaced by a newer connection") → an infinite flap.
+  if (currentWs && (currentWs.readyState === 0 || currentWs.readyState === 1)) return;
+  if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = null; }
+  const auth = DEV_EMAIL ? `devEmail=${encodeURIComponent(DEV_EMAIL)}` : `token=${encodeURIComponent(readToken())}`;
   const ws = new WebSocket(`${RELAY}?${auth}`);
+  currentWs = ws;
   ws.onopen = () => { retryMs = 1000; console.log(`[agent] connected to relay ${RELAY}`); };
   ws.onmessage = async (ev) => {
     let m; try { m = JSON.parse(ev.data); } catch { return; }
@@ -73,10 +94,35 @@ function connect(retryMs = 1000) {
     }
   };
   ws.onclose = () => {
+    if (ws !== currentWs) return; // a superseded socket (we already moved on) — don't reconnect
     console.log(`[agent] relay connection lost — retrying in ${retryMs}ms`);
-    setTimeout(() => connect(Math.min(retryMs * 2, 15000)), retryMs);
+    scheduleReconnect(retryMs);
   };
   ws.onerror = () => { /* onclose follows */ };
 }
 
 connect();
+
+// Sign-in reconnect: when license.token appears/changes (the user just linked
+// this device), drop the current socket so connect() re-dials with the new
+// identity. Without this the first-run socket stays bound to nobody and the
+// hosted board never comes alive until the CLI is restarted. Watch the DIR (the
+// file may not exist yet on first run); best-effort (fs.watch unsupported → the
+// onclose retry loop still re-reads the token on the next natural reconnect).
+try {
+  watch(DATA_DIR, (_ev, f) => {
+    if (f && f !== 'license.token') return;
+    const t = readToken();
+    if (t && t !== lastToken) {
+      lastToken = t;
+      console.log('[agent] signed in — reconnecting to relay with your identity');
+      // Detach the old socket FIRST so its onclose is ignored (ws !== currentWs),
+      // then reconnect once, immediately, with a fresh backoff — no racing chains.
+      const old = currentWs;
+      currentWs = null;
+      if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = null; }
+      try { old?.close(); } catch { /* already gone */ }
+      connect(1000);
+    }
+  });
+} catch { /* fs.watch unavailable on this platform */ }

package/engine/server.mjs

@@ -20,7 +20,7 @@ import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
-import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken } from './lib.mjs';
+import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken, shouldEmitSetupCompleted } from './lib.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
 
@@ -41,6 +41,20 @@ const ACCESS_KEY = readFileSync(keyFile, 'utf8').trim();
 // access key so the raw credential NEVER leaves the machine (the billing Worker
 // hashes this again into its pseudonymous id). Not the access key itself.
 const ANALYTICS_UID = createHash('sha256').update('galda-analytics:' + ACCESS_KEY).digest('hex').slice(0, 24);
+// "Setup completed" = npx-installed AND connected to Claude Code / Codex. That
+// connection is the MCP client (engine/mcp.mjs) first reaching this server, so
+// we fire the `signup` event once, the first time an MCP-tagged request arrives,
+// and persist a flag so it counts once per install ever (not once per restart).
+const SETUP_FLAG = join(DATA_DIR, 'setup-completed.flag');
+let _setupClientSeen = false;
+function maybeEmitSetupCompleted(req) {
+  if (_setupClientSeen) return; // already decided this session — no repeat disk hit
+  if ((req.headers['x-manager-client'] || '') !== 'mcp') return;
+  _setupClientSeen = true;
+  if (!shouldEmitSetupCompleted({ isMcpClient: true, alreadySeen: false, flagExists: existsSync(SETUP_FLAG) })) return;
+  try { writeFileSync(SETUP_FLAG, String(Date.now())); } catch { /* best effort — still emit */ }
+  emitEvent('signup', ANALYTICS_UID, { source: 'mcp-connect' });
+}
 // Per-worker run cap. Env-configurable so it can be tuned operationally and the
 // timeout→'interrupted' path is testable (a test sets a short value + a slow
 // fake worker instead of waiting 10 real minutes).
@@ -2357,6 +2371,8 @@ const server = createServer(async (req, res) => {
       res.setHeader('set-cookie', `mkey=${ACCESS_KEY}; HttpOnly; SameSite=Lax; Path=/; Max-Age=31536000`);
     }
   }
+  // Once past auth, the first MCP-client request marks setup as completed.
+  maybeEmitSetupCompleted(req);
 
   if (url.pathname === '/' || url.pathname === '/index.html') {
     // no-cache: browsers were keeping a STALE index.html (no cache header before),
@@ -3337,7 +3353,17 @@ server.on('error', (e) => {
 server.listen(PORT, '127.0.0.1', () => {
   console.log(`[manager] Manager for AI → http://localhost:${PORT}/?key=${ACCESS_KEY}`);
   if (process.env.MANAGER_OPEN_BROWSER === '1' && process.platform === 'darwin') {
-    spawn('open', ['-g', `http://localhost:${PORT}/?key=${ACCESS_KEY}`], { stdio: 'ignore' }).unref();
+    // First run in the hosted flow (no license yet, billing worker configured):
+    // open the one-click Google device-link straight away instead of the local
+    // ?key board, so a non-engineer never sees a localhost URL or an access key —
+    // they sign in once and their hosted board comes alive (relay-client rebinds
+    // via its license.token watcher). Otherwise open the local board as before.
+    let openUrl = `http://localhost:${PORT}/?key=${ACCESS_KEY}`;
+    if (BILLING_API_URL && !existsSync(licenseFile)) {
+      openUrl = `${BILLING_API_URL}/connect?port=${PORT}&state=${encodeURIComponent(newSigninNonce())}`;
+      console.log('[manager] first run: opening one-click sign-in (no local key needed) → ' + openUrl);
+    }
+    spawn('open', ['-g', openUrl], { stdio: 'ignore' }).unref();
   }
   console.log(`[manager] projects: ${projects.map((p) => `${p.id}=${p.dir}`).join('  ')}`);
   syncAllExternal().catch(() => {});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.2",
+  "version": "0.10.5",
   "type": "module",
   "description": "Galda - hand off work to your Claude Code, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {