@galda/cli 0.10.2 → 0.10.7

package/CLAUDE.md

@@ -33,6 +33,12 @@
   - 探索的な読み込み（横断 grep・場所探し・大きいファイル通読）は**既定で subagent に逃がし**、メイン文脈に全文を載せない。ピンポイントな1関数だけ直接読む。
   - 別エージェントへ渡す時は、チャット履歴でなく **1枚の handoff md** を書いて渡す。
 
+## デプロイ／インフラの掟（Masa明言 2026-07-15・全レーン必読）
+
+- **`a2c-tech.workers.dev` を絶対に使わない・コードやdocsに書かない**。これはクライアント企業 **A2C** の名を冠した Cloudflare workers.dev サブドメインで、Galda の製品・URL・設定に一切登場させてはいけない（見つけたら全て除去）。
+- Worker/API へは**必ず所有ドメイン `https://galda.app`（custom domain）経由**で参照する。`*.workers.dev` サブドメインを製品コードに焼き込まない（`MANAGER_BILLING_API_URL` 等の既定値は `https://galda.app`）。
+- **Cloudflare/wrangler にデプロイする前に `wrangler whoami` でデプロイ先アカウントを確認**し、Galda/Kodo 所有であること・workers.dev サブドメイン名に客先名や別プロジェクト名が出ていないことを確かめる。怪しければ止めて Masa に確認（本番デプロイは Masa 明示許可制）。
+
 ## 構成
 
 - `engine/server.mjs` … チャットアプリのサーバ（:4400・タスク分解・worker実行・SSE・PR作成）

package/app/index.html

@@ -1239,15 +1239,16 @@
   #fsRoot .nowdoing .nd-pct{margin-left:auto;font:600 11px/1 var(--mono);color:var(--ink2);font-variant-numeric:tabular-nums;flex:0 0 auto}
   #fsRoot .nowdoing .nd-bar{flex:1 0 100%;height:2px;border-radius:2px;background:var(--hair);overflow:hidden}
   #fsRoot .nowdoing .nd-bar i{display:block;height:100%;border-radius:2px;background:linear-gradient(90deg,var(--edgeA,#C7B5FF),var(--edgeB,#7C9EFF))}
-  /* H19/§8-2: bottom-anchor the feed. .fsstream is the scroll viewport turned into a
-     flex column so #fsFeed's margin-top:auto pushes content down — sparse/initial sits
-     just above the composer (no top-stuck limbo); once it overflows, margin-top:auto
-     collapses and it scrolls normally (latest at the bottom). Header (.chd/.nowdoing)
-     stays fixed above. */
+  /* was H19/§8-2 bottom-anchor (#fsFeed{margin-top:auto}): sparse/initial content sat
+     glued to the composer with a big blank gap above it — read as "text appears from
+     the bottom" (Masa bug report 2026-07-15, recurrence of an earlier fix). Feed now
+     always starts at the top of .fsstream like a normal chat log; new lines still
+     auto-follow to the bottom via the nearBottom check in renderFsFeed(). Header
+     (.chd/.nowdoing) stays fixed above. */
   #fsRoot .fsstream{flex:1;min-height:0;overflow-y:auto;display:flex;flex-direction:column;max-width:var(--fscenterw,760px);width:100%;margin:0 auto;scrollbar-width:none;position:relative;z-index:1;
     transition:max-width .28s cubic-bezier(.4,0,.2,1)}
   #fsRoot .fsstream::-webkit-scrollbar{display:none}
-  #fsFeed{display:flex;flex-direction:column;gap:8px;padding-top:2px;margin-top:auto}
+  #fsFeed{display:flex;flex-direction:column;gap:8px;padding-top:2px}
   #fsRoot .cc-say{font-size:13.5px;color:var(--ink)}
   /* Claude Code CLI language (HANDOFF-v45 §12, flagship .cc-t port): gap:0 — the bullet's
      own margin-right does the spacing, not a flex gap (keeps ⏺ tight against the tool name
@@ -2974,7 +2975,7 @@ function taskBlock(t){
     const lines = state.act[t.id] ?? [];
     body = `<div class="pbar"><i style="width:${progressFor(t)}%"></i></div><div class="pmeta">${progressMeta(t)}</div>
       ${todosHtml(t)}
-      <div class="tres runlog">${lines.map((l) => `<div class="actline">${esc(l)}</div>`).join('') || '<span class="actline">starting…</span>'}</div>`;
+      <div class="tres runlog" data-runlog="${t.id}">${lines.map((l) => `<div class="actline">${esc(l)}</div>`).join('') || '<span class="actline">starting…</span>'}</div>`;
   } else if (t.status === 'done') {
     const files = t.changedFiles?.length ? `<div class="files"><b>changed:</b> ${t.changedFiles.map(esc).join(' · ')}</div>` : '';
     const usage = formatUsage(t.usage);
@@ -3117,6 +3118,15 @@ function renderStream(){
   // render never yanks the view while they read old history.
   const wasNearBottom = streamEl.scrollHeight - streamEl.clientHeight - streamEl.scrollTop <= 100;
   const keepScroll = streamEl.scrollTop;
+  // Mirror of engine/lib.mjs nextRunlogScrollTop(): a running task's live log
+  // (.tres.runlog) has its OWN scroll region and its HTML is rebuilt every SSE
+  // render. Capture each one's geometry (keyed by task id) BEFORE the swap so we
+  // can keep a user who scrolled up to re-read earlier lines pinned there instead
+  // of yanking them to the bottom on every incoming activity line.
+  const runlogPre = new Map();
+  for (const el of streamEl.querySelectorAll('[data-runlog]')) {
+    runlogPre.set(el.dataset.runlog, { scrollTop: el.scrollTop, scrollHeight: el.scrollHeight, clientHeight: el.clientHeight });
+  }
   const items = mergeGoalTimeline(state.goals, state.externalActivity, state.active);
   // never-lose layer: memos not yet accepted by the server render from the
   // local outbox — visible, resendable, never silently gone
@@ -3168,7 +3178,10 @@ function renderStream(){
       inp.disabled = false;
     });
   }
-  for (const el of $('stream').querySelectorAll('.tres.runlog')) el.scrollTop = el.scrollHeight;
+  for (const el of $('stream').querySelectorAll('[data-runlog]')) {
+    const pre = runlogPre.get(el.dataset.runlog) ?? null;
+    el.scrollTop = !pre || (pre.scrollHeight - pre.clientHeight - pre.scrollTop <= 100) ? el.scrollHeight : pre.scrollTop;
+  }
   if (wasNearBottom) streamEl.scrollTop = streamEl.scrollHeight;
   else streamEl.scrollTop = keepScroll; // reading history: never yank the view
 }
@@ -5752,7 +5765,11 @@ function bootDisconnected(info){
   const gate = (e) => { if (e) e.preventDefault(); open(); };
   if (input) { input.readOnly = true; input.addEventListener('focus', gate); input.addEventListener('mousedown', gate); input.addEventListener('keydown', gate); }
   if (send) send.addEventListener('click', gate);
-  const cw = document.getElementById('composerWrap'); if (cw) cw.addEventListener('mousedown', gate);
+  // Keep the agent / model / effort pickers live so Codex users can switch to
+  // Codex (and see it's a first-class option) even before this device connects;
+  // only typing a goal or hitting send opens the connect explainer. (Masa 2026-07-15)
+  const cw = document.getElementById('composerWrap');
+  if (cw) cw.addEventListener('mousedown', (e) => { if (e.target.closest('#appsel, #modelsel, #effortsel')) return; gate(e); });
 
   // come alive automatically: when the relay stops flagging disconnected (the
   // engine connected → its live app is proxied), reload into the real board.

package/bin/manager-for-ai.mjs

@@ -10,9 +10,26 @@ import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join, resolve, dirname } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import { createServer } from 'node:net';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const say = (m) => console.log(`[galda] ${m}`);
+
+// Pick a free local port (starting at the requested one) so `npx @galda/cli`
+// JUST WORKS even when the default 4400 is already taken — e.g. another manager
+// is running on this machine. We do it HERE, before importing the server and
+// spawning the relay-client, and export MANAGER_PORT, so both halves agree on
+// the same port (the relay-client reads MANAGER_PORT too). No manual override.
+const canBind = (p) => new Promise((res) => {
+  const s = createServer();
+  s.once('error', () => res(false));
+  s.once('listening', () => s.close(() => res(true)));
+  s.listen(p, '127.0.0.1');
+});
+async function pickPort(start) {
+  for (let p = start; p < start + 30; p++) { if (await canBind(p)) return p; }
+  return start; // give up → the server's own EADDRINUSE guard will explain
+}
 // On Windows the `claude`/`ffmpeg` executables are .cmd/.ps1 shims that a bare
 // spawnSync can't resolve (ENOENT) — run through the shell there so PATHEXT
 // resolution kicks in. On macOS/Linux keep shell off (no injection surface).
@@ -29,6 +46,12 @@ if (claude.error || claude.status !== 0) {
 }
 say(`claude CLI: ${claude.stdout.trim()}`);
 
+// 1b) codex CLI (optional alternate worker). Informational only — so Codex users
+// see it's detected and supported, not just Claude Code. Galda can run workers on
+// either; you pick per task (Claude Code / Codex) in the board's composer.
+const codex = probe('codex', ['--version']);
+if (!codex.error && codex.status === 0) say(`codex CLI: ${codex.stdout.trim()} (Codex)`);
+
 // 2) Chrome (for verification proof) — recommended; warn if missing
 const chromeCandidates = [
   process.env.CHROME_PATH,
@@ -57,8 +80,18 @@ process.env.MANAGER_OPEN_BROWSER = process.env.MANAGER_OPEN_BROWSER ?? '1';
 // and `npm start` from the repo stay env-driven and don't hit the live worker.
 // The license public key is already baked in engine/lib.mjs (offline verify).
 // Opt out with an empty value: `MANAGER_BILLING_API_URL= RELAY_URL= npx @galda/cli`.
-process.env.MANAGER_BILLING_API_URL = process.env.MANAGER_BILLING_API_URL ?? 'https://agent-manager-billing-api.a2c-tech.workers.dev';
+// Use the OWNED custom domain (galda.app), never the Cloudflare workers.dev
+// subdomain — that subdomain is named after an unrelated client (a2c-tech) and
+// must never appear in Galda's product. galda.app is bound to the same Worker
+// and serves the whole API (/connect, /checkout, /api/*). See [[no-a2c-tech]].
+process.env.MANAGER_BILLING_API_URL = process.env.MANAGER_BILLING_API_URL ?? 'https://galda.app';
 process.env.RELAY_URL = process.env.RELAY_URL ?? 'wss://app.galda.app/agent';
+// Choose a free port now and pin it for BOTH the server and the relay-client, so
+// a busy 4400 (another manager) no longer stops onboarding — no MANAGER_PORT by hand.
+const wantedPort = Number(process.env.MANAGER_PORT ?? 4400);
+const port = await pickPort(wantedPort);
+if (port !== wantedPort) say(`port ${wantedPort} is busy — using ${port} instead`);
+process.env.MANAGER_PORT = String(port);
 await import(pathToFileURL(join(ROOT, 'engine', 'server.mjs')).href);
 
 // 5) fixed-URL relay (optional): if a relay is configured, connect this local

package/engine/analytics-client.mjs

@@ -9,7 +9,9 @@
 // are swallowed so analytics can never break a task run or block the caller.
 //
 // Hook points (wiring lives in engine/relay, kept out of this module):
-//   signup            → relay Google callback, right after the session is minted
+//   signup            → engine, once per install when the MCP client (Claude
+//                       Code / Codex) first connects = "setup completed"
+//                       (maybeEmitSetupCompleted in server.mjs)
 //   task_created      → engine, when a task/goal is accepted
 //   task_completed    → engine, task.status = 'done'
 //   task_failed       → engine, task.status = 'failed'

package/engine/lib.mjs

@@ -674,6 +674,20 @@ export function nextStreamScrollTop(pre, newScrollHeight, threshold = 100) {
     : pre.scrollTop;
 }
 
+// Same pin decision for the inner live worker-activity log (`.tres.runlog`) of a
+// running task, whose HTML is fully rebuilt on every SSE render. `pre` is the
+// element's geometry captured BEFORE the swap, or null if that runlog did not
+// exist last render (a task that just started). A brand-new log pins to the
+// bottom; an existing one follows the bottom only when the user was already near
+// it — otherwise it keeps the exact prior scrollTop so scrolling up to re-read
+// earlier lines mid-run is never yanked back down.
+export function nextRunlogScrollTop(pre, newScrollHeight, threshold = 100) {
+  if (!pre) return newScrollHeight;
+  return shouldAutoScroll(pre.scrollTop, pre.scrollHeight, pre.clientHeight, threshold)
+    ? newScrollHeight
+    : pre.scrollTop;
+}
+
 // GET /api/state payload for tasks (task 49): the browser's live activity
 // log (state.act) is otherwise only ever populated by streamed SSE 'act'
 // events, so a page refresh mid-run would blank a running task's log until
@@ -2376,3 +2390,13 @@ export async function verifyLicenseToken({ token, publicJwk = LICENSE_PUBLIC_JWK
   }
   return { valid: true, reason: null, payload };
 }
+
+// Setup-completion analytics: the `signup` event fires exactly ONCE per install,
+// the first time the MCP client (Claude Code / Codex) connects to the Manager.
+// Pure decision so it can be unit-tested without a live server or filesystem —
+// the caller supplies whether the request is from the MCP client, whether this
+// process already saw it this session, and whether the persisted once-ever flag
+// already exists on disk.
+export function shouldEmitSetupCompleted({ isMcpClient, alreadySeen, flagExists }) {
+  return Boolean(isMcpClient) && !alreadySeen && !flagExists;
+}

package/engine/mcp.mjs

@@ -24,7 +24,10 @@ const KEY = process.env.MANAGER_KEY
 
 async function api(path, opts = {}) {
   const sep = path.includes('?') ? '&' : '?';
-  const r = await fetch(`${BASE}${path}${sep}key=${KEY}`, opts);
+  // Tag every MCP→Manager call so the server can detect "connected to Claude
+  // Code / Codex" (the setup-completed signal) — see maybeEmitSetupCompleted.
+  const headers = { ...(opts.headers || {}), 'x-manager-client': 'mcp' };
+  const r = await fetch(`${BASE}${path}${sep}key=${KEY}`, { ...opts, headers });
   if (!r.ok) throw new Error(`Manager server ${r.status}: ${(await r.text()).slice(0, 200)}`);
   return r.json();
 }

package/engine/relay-client.mjs

@@ -8,7 +8,7 @@
 //
 //   RELAY_URL=wss://relay.example/agent RELAY_AGENT_TOKEN=… node engine/relay-client.mjs
 
-import { readFileSync, existsSync } from 'node:fs';
+import { readFileSync, existsSync, watch } from 'node:fs';
 import { resolve, dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
@@ -19,19 +19,40 @@ const DATA_DIR = process.env.MANAGER_HOME
 const LOCAL = process.env.MANAGER_LOCAL ?? `http://localhost:${process.env.MANAGER_PORT ?? 4400}`;
 const KEY = existsSync(join(DATA_DIR, 'secret.key')) ? readFileSync(join(DATA_DIR, 'secret.key'), 'utf8').trim() : '';
 const RELAY = process.env.RELAY_URL ?? 'ws://localhost:5500/agent';
+const DEV_EMAIL = process.env.RELAY_DEV_EMAIL ?? '';
+const LICENSE_FILE = join(DATA_DIR, 'license.token');
 // The relay (P3.1) authenticates the agent by its signed LICENSE TOKEN — only
 // the billing Worker can mint one for a verified email, so the relay binds this
 // socket to that email's id (no shared token, unspoofable). Falls back to an
 // explicit RELAY_AGENT_TOKEN, and to a dev email for local testing.
-const LICENSE = existsSync(join(DATA_DIR, 'license.token')) ? readFileSync(join(DATA_DIR, 'license.token'), 'utf8').trim() : '';
-const TOKEN = process.env.RELAY_AGENT_TOKEN ?? LICENSE;
-const DEV_EMAIL = process.env.RELAY_DEV_EMAIL ?? '';
+// Read FRESH each connect (not once at load): on first run the agent starts with
+// no token (bound to nobody); when the user signs in, license.token appears and
+// the watcher below reconnects, so the relay re-binds this socket to the real
+// identity and the user's hosted board comes alive — no CLI restart needed.
+function readToken() {
+  const lic = existsSync(LICENSE_FILE) ? readFileSync(LICENSE_FILE, 'utf8').trim() : '';
+  return process.env.RELAY_AGENT_TOKEN ?? lic;
+}
 
 const live = new Map(); // reqId -> AbortController
+let currentWs = null;
+let reconnectTimer = null;
+let lastToken = readToken();
+
+function scheduleReconnect(retryMs) {
+  if (reconnectTimer) return; // exactly one pending reconnect — never stack timers
+  reconnectTimer = setTimeout(() => { reconnectTimer = null; connect(Math.min(retryMs * 2, 15000)); }, retryMs);
+}
 
 function connect(retryMs = 1000) {
-  const auth = DEV_EMAIL ? `devEmail=${encodeURIComponent(DEV_EMAIL)}` : `token=${encodeURIComponent(TOKEN)}`;
+  // Single-socket invariant: never open a second socket while one is CONNECTING
+  // (0) or OPEN (1). Two live sockets with the same identity make the relay evict
+  // each other (server.mjs "replaced by a newer connection") → an infinite flap.
+  if (currentWs && (currentWs.readyState === 0 || currentWs.readyState === 1)) return;
+  if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = null; }
+  const auth = DEV_EMAIL ? `devEmail=${encodeURIComponent(DEV_EMAIL)}` : `token=${encodeURIComponent(readToken())}`;
   const ws = new WebSocket(`${RELAY}?${auth}`);
+  currentWs = ws;
   ws.onopen = () => { retryMs = 1000; console.log(`[agent] connected to relay ${RELAY}`); };
   ws.onmessage = async (ev) => {
     let m; try { m = JSON.parse(ev.data); } catch { return; }
@@ -73,10 +94,35 @@ function connect(retryMs = 1000) {
     }
   };
   ws.onclose = () => {
+    if (ws !== currentWs) return; // a superseded socket (we already moved on) — don't reconnect
     console.log(`[agent] relay connection lost — retrying in ${retryMs}ms`);
-    setTimeout(() => connect(Math.min(retryMs * 2, 15000)), retryMs);
+    scheduleReconnect(retryMs);
   };
   ws.onerror = () => { /* onclose follows */ };
 }
 
 connect();
+
+// Sign-in reconnect: when license.token appears/changes (the user just linked
+// this device), drop the current socket so connect() re-dials with the new
+// identity. Without this the first-run socket stays bound to nobody and the
+// hosted board never comes alive until the CLI is restarted. Watch the DIR (the
+// file may not exist yet on first run); best-effort (fs.watch unsupported → the
+// onclose retry loop still re-reads the token on the next natural reconnect).
+try {
+  watch(DATA_DIR, (_ev, f) => {
+    if (f && f !== 'license.token') return;
+    const t = readToken();
+    if (t && t !== lastToken) {
+      lastToken = t;
+      console.log('[agent] signed in — reconnecting to relay with your identity');
+      // Detach the old socket FIRST so its onclose is ignored (ws !== currentWs),
+      // then reconnect once, immediately, with a fresh backoff — no racing chains.
+      const old = currentWs;
+      currentWs = null;
+      if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = null; }
+      try { old?.close(); } catch { /* already gone */ }
+      connect(1000);
+    }
+  });
+} catch { /* fs.watch unavailable on this platform */ }

package/engine/server.mjs

@@ -20,7 +20,7 @@ import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
-import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken } from './lib.mjs';
+import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken, shouldEmitSetupCompleted } from './lib.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
 
@@ -41,6 +41,20 @@ const ACCESS_KEY = readFileSync(keyFile, 'utf8').trim();
 // access key so the raw credential NEVER leaves the machine (the billing Worker
 // hashes this again into its pseudonymous id). Not the access key itself.
 const ANALYTICS_UID = createHash('sha256').update('galda-analytics:' + ACCESS_KEY).digest('hex').slice(0, 24);
+// "Setup completed" = npx-installed AND connected to Claude Code / Codex. That
+// connection is the MCP client (engine/mcp.mjs) first reaching this server, so
+// we fire the `signup` event once, the first time an MCP-tagged request arrives,
+// and persist a flag so it counts once per install ever (not once per restart).
+const SETUP_FLAG = join(DATA_DIR, 'setup-completed.flag');
+let _setupClientSeen = false;
+function maybeEmitSetupCompleted(req) {
+  if (_setupClientSeen) return; // already decided this session — no repeat disk hit
+  if ((req.headers['x-manager-client'] || '') !== 'mcp') return;
+  _setupClientSeen = true;
+  if (!shouldEmitSetupCompleted({ isMcpClient: true, alreadySeen: false, flagExists: existsSync(SETUP_FLAG) })) return;
+  try { writeFileSync(SETUP_FLAG, String(Date.now())); } catch { /* best effort — still emit */ }
+  emitEvent('signup', ANALYTICS_UID, { source: 'mcp-connect' });
+}
 // Per-worker run cap. Env-configurable so it can be tuned operationally and the
 // timeout→'interrupted' path is testable (a test sets a short value + a slow
 // fake worker instead of waiting 10 real minutes).
@@ -915,6 +929,7 @@ async function planGoal(goal) {
   const project = projects.find((p) => p.id === goal.projectId);
   const prompt = [
     'あなたはユーザーの依頼を受けるプロダクトマネージャ。以下のユーザー依頼を、ユーザーから見た「成果物（トピック）」の単位で整理する。エンジニアリングの工程には分解しない。',
+    '【言語】ユーザーが読む文字列（各タスクの title、確認の question / options）は、末尾の「依頼:」と同じ言語で書く。英語の依頼には英語で、日本語の依頼には日本語で返す（例: "test" → 英語、"テスト" → 日本語）。detail（worker への指示）は言語自由。',
     '- 既定は 1トピック=1タスク。1つのまとまった依頼を実装工程に割らない（「PRDを作る」「パーサを追加」「テストを書く」「リファクタ」等を別タスクにしない）。それらは1人のworkerが内部で全部やる（実装→テスト→proof/検証まで一気通貫）。',
     '- 複数タスクに分けるのは、依頼に「明確に別々の成果物・トピック」が含まれる時「だけ」（例:「音声入力を追加して、あとビジュアル作成も」→ 音声入力 / ビジュアル作成 の2つ）。工程での分割は絶対にしない。',
     '- 被っている・言い換えているだけの依頼は、自分で理解して1つにまとめる。',
@@ -926,7 +941,7 @@ async function planGoal(goal) {
     // Once the user has answered a clarification, NEVER ask again — re-asking looped
     // the answered question back onto the board. Override the rule above for re-plans.
     goal.clarified ? '【最重要】ユーザーは既にこの依頼への確認質問に回答済み（依頼文末尾に [確認: … → …] として反映済み）。これ以上、確認質問(question)を返してはならない。回答を前提に、必ずタスクへ分解して返すこと。' : '',
-    '- 出力はJSONのみ（前後に文章を書かない）。通常: {"entry":"path|null","tasks":[{"title":"ユーザーから見た成果（短い日本語）","detail":"workerへの完全な指示","passCondition":"検証条件|null"}]} ／ 確認が要る時だけ: {"question":"...","options":["...","..."]}',
+    '- 出力はJSONのみ（前後に文章を書かない）。通常: {"entry":"path|null","tasks":[{"title":"ユーザーから見た成果（依頼と同じ言語で短く）","detail":"workerへの完全な指示","passCondition":"検証条件|null"}]} ／ 確認が要る時だけ: {"question":"...(依頼と同じ言語)","options":["...","..."]}',
     '',
     goal.priorFailureMemory?.length ? [
       '過去の失敗メモリ（同じ失敗を避けること）:',
@@ -1298,6 +1313,9 @@ function testOutputExcerpt(text) {
 }
 
 function workerPrompt(task, goal, lastFailure) {
+  // Report back to the human in the SAME language they wrote the goal in (Masa
+  // 2026-07-15: "撃った言語で返す"). JP characters → Japanese, otherwise English.
+  const replyLang = /[぀-ヿ㐀-鿿]/.test(goal?.text || task?.title || '') ? '日本語' : 'English';
   // Optional skill the user attached to this goal. Empirically (scratch worker,
   // haiku, custom fixture skill) the reliably-firing form is an explicit Skill-tool
   // instruction as the FIRST line; a bare "/name" first line did not consistently
@@ -1329,7 +1347,7 @@ function workerPrompt(task, goal, lastFailure) {
     '- 変更に対応するテストを書く。確認は該当テストファイル1つだけを1回実行する（例: node --test path/to/only-this.test.mjs）。プロジェクト全体の npm test を繰り返し回さない — 全体テストと最終検証は Manager 側が実行する。テストが適用できない変更は理由と手動確認手順を書く。',
     '- 検証しすぎない: 自分の変更が動くと確認できたら、それ以上ログを漁ったり再検証を重ねたりせず、すぐに報告して終える（時間と token の無駄を避ける）。',
     '- Do not commit (git is handled by the Manager).',
-    '- 最後に日本語で2〜4行：何を変えたか・どのファイルか・テスト結果・人間が確認すべき点。',
+    `- 最後に${replyLang}で2〜4行：何を変えたか・どのファイルか・テスト結果・人間が確認すべき点。`,
   ].filter(Boolean).join('\n');
 }
 
@@ -2357,6 +2375,8 @@ const server = createServer(async (req, res) => {
       res.setHeader('set-cookie', `mkey=${ACCESS_KEY}; HttpOnly; SameSite=Lax; Path=/; Max-Age=31536000`);
     }
   }
+  // Once past auth, the first MCP-client request marks setup as completed.
+  maybeEmitSetupCompleted(req);
 
   if (url.pathname === '/' || url.pathname === '/index.html') {
     // no-cache: browsers were keeping a STALE index.html (no cache header before),
@@ -3337,7 +3357,17 @@ server.on('error', (e) => {
 server.listen(PORT, '127.0.0.1', () => {
   console.log(`[manager] Manager for AI → http://localhost:${PORT}/?key=${ACCESS_KEY}`);
   if (process.env.MANAGER_OPEN_BROWSER === '1' && process.platform === 'darwin') {
-    spawn('open', ['-g', `http://localhost:${PORT}/?key=${ACCESS_KEY}`], { stdio: 'ignore' }).unref();
+    // First run in the hosted flow (no license yet, billing worker configured):
+    // open the one-click Google device-link straight away instead of the local
+    // ?key board, so a non-engineer never sees a localhost URL or an access key —
+    // they sign in once and their hosted board comes alive (relay-client rebinds
+    // via its license.token watcher). Otherwise open the local board as before.
+    let openUrl = `http://localhost:${PORT}/?key=${ACCESS_KEY}`;
+    if (BILLING_API_URL && !existsSync(licenseFile)) {
+      openUrl = `${BILLING_API_URL}/connect?port=${PORT}&state=${encodeURIComponent(newSigninNonce())}`;
+      console.log('[manager] first run: opening one-click sign-in (no local key needed) → ' + openUrl);
+    }
+    spawn('open', ['-g', openUrl], { stdio: 'ignore' }).unref();
   }
   console.log(`[manager] projects: ${projects.map((p) => `${p.id}=${p.dir}`).join('  ')}`);
   syncAllExternal().catch(() => {});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.2",
+  "version": "0.10.7",
   "type": "module",
   "description": "Galda - hand off work to your Claude Code, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {