@galda/cli 0.10.24 → 0.10.30

package/engine/lib.mjs

@@ -1069,6 +1069,7 @@ export function goalGroupStatus(goalStatus, startedAt) {
   if (goalStatus === 'planning' || goalStatus === 'running') return 'doing';
   if (goalStatus === 'review') return 'review';
   if (goalStatus === 'retesting') return 'doing'; // Ledger Dismiss → engine re-testing ×3 (v45 §5.3)
+  if (goalStatus === 'folded') return 'review'; // PRD §6.5: rendered inside the Review section, not Done
   if (goalStatus === 'blocked') return 'attn'; // §4E: blocked is Attention, not Done
   if (goalStatus === 'needsInput') return 'todo'; // smart intake: awaiting an answer
   return 'done'; // includes 'reverted' (terminal)
@@ -1101,6 +1102,7 @@ export function goalChip(goalStatus, columns, startedAt) {
   if (goalStatus === 'done') return [pickColumnLabel(columns, 'done', 'DONE'), ''];
   if (goalStatus === 'retesting') return ['RE-TESTING', 'doing']; // Ledger Dismiss → retest ×3 (v45 §5.3)
   if (goalStatus === 'reverted') return ['REVERTED', '']; // Ledger Revert: terminal, distinct from archived
+  if (goalStatus === 'folded') return ['FOLDED', '']; // PRD §6.5: settled, not failed — no red/badge class, matches 'done'/'reverted'
   if (goalStatus === 'blocked') return ['BLOCKED', 'blocked']; // §4E: distinct state (reason + reverify), not FAIL/Done
   if (goalStatus === 'needsInput') return ['確認待ち', 'blocked']; // smart intake: awaiting an answer
   return ['FAIL', ''];
@@ -1595,6 +1597,44 @@ export function detectConflicts(goal, otherGoals) {
     .map((g) => g.id);
 }
 
+// ---- the review gate (PRD §6.5) --------------------------------------------
+// Detection alone was never the point: a flag that says "this conflicts with
+// #38" still leaves the human to untangle two PRs that edit the same lines.
+// PRD §6.5 requires that PRs sitting in Review never conflict WITH EACH OTHER,
+// so work that lands on the same paths must land on the SAME PR.
+//
+// This is the last of the three gates (queue / doing / review) and the only one
+// that knows the truth: by the time a goal finishes, its changed files are
+// measured, not guessed. So the promise rests here, and the earlier gates are
+// free to be wrong — being wrong costs a re-run, never a conflict.
+//
+// Why the caller re-runs the folded goal's intent inside the target's worktree
+// instead of replaying its diff: engine/pr.mjs COPIES changed files into the PR
+// worktree (cp -R) rather than merging them, so aiming this goal's PR at the
+// target's branch would silently overwrite the target's version of any shared
+// file. Re-running lets the worker SEE the target's changes and build on them,
+// which means there is never a conflict to resolve in the first place.
+//
+// `candidates` are same-project goals already awaiting review (each
+// `{ id, changedFiles }`). Returns the id to fold into, or null to open a
+// normal PR.
+//
+// Deliberately folds ONLY when exactly one review goal overlaps. With two or
+// more, folding is not merely insufficient, it is harmful: pulling goal B into
+// A's PR drags B's paths along, so A's PR starts colliding with C's where it
+// did not before. That cluster wants one shared PR, which we cannot build by
+// bolting onto an already-open one — so we leave those flagged (the old
+// behaviour) rather than make the pile worse. Known remainder, named in the
+// handoff, not silently swallowed.
+export function pickFoldTarget(goal, candidates) {
+  const files = goal?.changedFiles ?? [];
+  if (!files.length) return null;
+  const overlapping = (candidates ?? []).filter(
+    (g) => g && g.id !== goal.id && goalsConflict(files, g.changedFiles),
+  );
+  return overlapping.length === 1 ? overlapping[0].id : null;
+}
+
 // Which of `commits` (newest-first, as returned by parseGitLog) are new
 // since we last synced up to `lastSeenHash`? null means nothing has been
 // seen yet, so every commit is new. If lastSeenHash isn't found in the
@@ -2735,8 +2775,11 @@ export function nextResumeDelay(attempt, { baseMs = 5 * 60 * 1000, maxMs = 60 *
 
 // ---- billing entitlement gate (public self-serve launch, docs/BILLING-LAUNCH-PLAN.md) --
 // Mirrors workers/billing-api/src/entitlement.mjs's FREE_TIER_LIMITS/
-// checkFreeTierLimit/resolveEntitlement exactly (Masa decision 2026-07-12:
-// 5 pending goals, 19 lifetime goals, 1 project, $16/mo unlocks all three).
+// checkFreeTierLimit/resolveEntitlement exactly (Masa: 5 queued to-dos,
+// 20 total tasks, 1 project — matching galda.app's own words. Updated
+// 2026-07-17: lifetime cap 19→20 so the wall says the same number the sales
+// page promises ("20 total tasks"); it used to block the 20th create, one short
+// of the promise. Pro unlocks all three; price is Stripe-derived, not in code.)
 // Deliberately duplicated rather than imported: engine/ and workers/billing-api/
 // are independently deployed (a user's Mac vs Cloudflare) and independently
 // tested — sharing a module across that boundary would couple two things
@@ -2744,10 +2787,21 @@ export function nextResumeDelay(attempt, { baseMs = 5 * 60 * 1000, maxMs = 60 *
 // hand; both have their own test coverage against the same free-tier numbers.
 export const FREE_TIER_LIMITS = Object.freeze({
   maxPendingGoals: 5,
-  maxCumulativeGoals: 19,
+  maxCumulativeGoals: 20,
   maxProjects: 1,
 });
 
+// The statuses that occupy a "queued to-do" slot (the 5-slot wall). Narrower
+// than "every open goal" on purpose: a goal in `review` has finished its work
+// and is waiting on a human — that's not a to-do in flight, and galda.app sells
+// the slot as "queued to-dos", so review must not eat one (Masa 2026-07-17,
+// "5枠は実行待ちだけ"). Kept as its own named list rather than filtering an
+// "all open" constant so the intent is legible where it's read.
+export const QUEUED_GOAL_STATUSES = Object.freeze([
+  'stacked', 'sending', 'pending', 'planning', 'needsInput',
+  'running', 'partial', 'failed', 'interrupted', 'blocked', 'retesting',
+]);
+
 export function checkFreeTierLimit(usage) {
   const pendingCount = Number(usage?.pendingCount) || 0;
   const cumulativeCount = Number(usage?.cumulativeCount) || 0;

package/engine/server.mjs

@@ -21,7 +21,7 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
 import { needsProjectFolder, folderLabel, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText } from './lib.mjs';
-import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision } from './lib.mjs';
+import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision } from './lib.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
 
@@ -177,6 +177,19 @@ const entitlementCache = new Map(); // billing email -> { isPaying, checkedAt }
 // it survives restarts.
 const licenseFile = join(DATA_DIR, 'license.token');
 let licenseState = { email: null, isPaying: false, verifiedAt: 0 }; // in-memory cache of the last successful verify (isPaying is the token's snapshot; the live gate re-checks)
+// Test-only seam: override the license-verify public key via env so tests can
+// sign tokens the running server actually accepts (the baked LICENSE_PUBLIC_JWK
+// has no committed private half, so the licensed-but-lapsed path is otherwise
+// untestable — see docs/HANDOFF-A2C-WORKERS-DEV-CLEANUP.md item 6). Unset in
+// prod → verifyLicenseToken falls back to the baked key. This is NOT a payment
+// bypass: forging an identity here only picks WHO the email is; whether they're
+// paying is still the live remote billing-api (fetchIsPaying). An env escape
+// hatch already exists on the gate (MANAGER_ENTITLEMENT_BYPASS=1) — same spirit.
+const LICENSE_PUBKEY_OVERRIDE = (() => {
+  const raw = process.env.MANAGER_LICENSE_PUBKEY;
+  if (!raw) return undefined;
+  try { return JSON.parse(raw); } catch { return undefined; }
+})();
 
 // Analytics identity (A+): once signed in, scope usage events to the ACCOUNT
 // (the billing Worker hashes this email → the same account_id the accounts table
@@ -210,7 +223,7 @@ async function loadLicenseFromDisk() {
   if (!existsSync(licenseFile)) return;
   const token = readFileSync(licenseFile, 'utf8').trim();
   if (!token) return;
-  const result = await verifyLicenseToken({ token });
+  const result = await verifyLicenseToken({ token, publicJwk: LICENSE_PUBKEY_OVERRIDE });
   if (result.valid) licenseState = { email: result.payload.email, isPaying: Boolean(result.payload.isPaying), verifiedAt: Date.now() };
 }
 loadLicenseFromDisk();
@@ -219,7 +232,7 @@ loadLicenseFromDisk();
 // token to disk that doesn't actually verify, so a bad paste can't silently
 // wedge the app into "licensed but broken".
 async function activateLicense(token) {
-  const result = await verifyLicenseToken({ token: String(token ?? '') });
+  const result = await verifyLicenseToken({ token: String(token ?? ''), publicJwk: LICENSE_PUBKEY_OVERRIDE });
   if (!result.valid) return { ok: false, error: `invalid license: ${result.reason}` };
   writeFileSync(licenseFile, String(token));
   licenseState = { email: result.payload.email, isPaying: Boolean(result.payload.isPaying), verifiedAt: Date.now() };
@@ -250,26 +263,32 @@ function signinResultPage(outcome) {
     `</script></body>`;
 }
 
-// "Currently occupying capacity" for the free-tier pending-goal cap — every
-// status short of a genuinely finished/dismissed one. Deliberately broad for
-// the same reason RATE_LIMIT_RE above is broad: undercounting here would let
-// someone quietly exceed the cap via an odd status, which costs more than
-// occasionally counting a goal that's nearly done.
-const OPEN_GOAL_STATUSES = ['stacked', 'sending', 'pending', 'planning', 'needsInput', 'running', 'partial', 'failed', 'interrupted', 'blocked', 'review', 'retesting'];
-
-// NOTE(billing, needs a product decision): `projectCount` is left at 0 —
-// projects are shared/global in this codebase today (see the "Projects ...
-// stay shared for everyone" comment above goalVisibleTo in lib.mjs), not
-// per-identity, so a per-user "max 1 project" cap has nothing correct to
-// gate yet (an unpaid user's 2nd project would affect every other user, not
-// just them). checkFreeTierLimit already supports projectCount > 1 the
-// moment that's resolved — see docs/BILLING-LAUNCH-PLAN.md.
+// The 5-slot "queued to-dos" cap counts QUEUED_GOAL_STATUSES (from lib.mjs) —
+// every open status EXCEPT `review`. A goal in review has finished its work and
+// is waiting on a human, so it isn't a to-do in flight, and galda.app sells the
+// slot as "queued to-dos" (Masa 2026-07-17, "5枠は実行待ちだけ"). Still broad
+// otherwise, for the same reason RATE_LIMIT_RE is: undercounting would let
+// someone quietly exceed the cap via an odd status. The list lives in lib.mjs
+// so the wall's meaning is defined next to checkFreeTierLimit and unit-tested.
+
+// `projectCount` is install-wide, not per-identity: projects are shared/global
+// in this codebase (see the "Projects ... stay shared for everyone" comment
+// above goalVisibleTo in lib.mjs) while only goals are partitioned by owner.
+// That asymmetry used to leave this at 0 pending a product decision (a per-user
+// "max 1 project" cap would have let one user's 2nd project block everyone
+// else's). Resolved 2026-07-17 (Masa): the shipping product is local-first —
+// app.galda.app reaches each user's OWN engine over the relay, so one install
+// is one user, and the license this gate consults (licenseState.email) is
+// already install-wide too. Counting every project on the install is therefore
+// the same scope billing already runs at. The stale caveat only applies to the
+// legacy Cloudflare Access multi-user mode, where several identities share one
+// install AND one license — there, a shared cap is already the status quo.
 function computeFreeTierUsage(identity) {
   const owned = goals.filter((g) => (g.owner ?? 'owner') === identity);
   return {
-    pendingCount: owned.filter((g) => OPEN_GOAL_STATUSES.includes(g.status)).length,
+    pendingCount: owned.filter((g) => QUEUED_GOAL_STATUSES.includes(g.status)).length,
     cumulativeCount: owned.length,
-    projectCount: 0,
+    projectCount: projects.length,
   };
 }
 
@@ -362,15 +381,25 @@ async function getBillingPrice() {
 // every installation (~/.claude/plans/toasty-rolling-marshmallow.md).
 // A personal/dev instance that wants to skip billing entirely should opt in
 // explicitly via MANAGER_ENTITLEMENT_BYPASS=1, not ride the 'owner' string.
-async function requireEntitlementGate(identity) {
+async function requireEntitlementGate(identity, intent = 'goal') {
   if (process.env.MANAGER_ENTITLEMENT_BYPASS === '1') return { allowed: true, blocked: null };
-  // Count the goal being created (existing + 1): computeFreeTierUsage counts
-  // only goals already on file and this gate runs *before* the new one is
+  // Count the thing being created (existing + 1): computeFreeTierUsage counts
+  // only what's already on file and this gate runs *before* the new one is
   // added, so "5 pending / 19 lifetime max" must block the 6th / 20th create,
   // not the 7th / 21st. (checkFreeTierLimit keeps its `> limit` semantics; we
   // feed it the post-create count. Display in /api/state stays the raw count.)
+  //
+  // Only the dimension the caller is actually spending gets its real count;
+  // the others are zeroed. checkFreeTierLimit weighs all three at once and
+  // mirrors billing-api byte-for-byte, so it must not learn about intents —
+  // the caller narrows the question instead. Without this, an install already
+  // holding 2 projects (created before the project cap was enforced) would
+  // trip 'project-limit' on every *goal* create and lose a feature it had:
+  // caps are enforced at the moment you spend, never retroactively.
   const existing = computeFreeTierUsage(identity);
-  const usage = { ...existing, pendingCount: existing.pendingCount + 1, cumulativeCount: existing.cumulativeCount + 1 };
+  const usage = intent === 'project'
+    ? { pendingCount: 0, cumulativeCount: 0, projectCount: existing.projectCount + 1 }
+    : { ...existing, pendingCount: existing.pendingCount + 1, cumulativeCount: existing.cumulativeCount + 1, projectCount: 0 };
   if (!checkFreeTierLimit(usage).blocked) return { allowed: true, blocked: null };
   const billingEmail = licenseState.email;
   if (!billingEmail) { const r = resolveEntitlement({ isOwner: false, isPaying: false, usage }); noteFreeExhausted(r); return r; }
@@ -2478,7 +2507,55 @@ async function finishGoalIfComplete(goal, project, activityTask = null) {
   // network needed) — this goal's changed files are already final at this
   // point (all its tasks are done), so its conflictsWith is accurate even if
   // PR creation itself fails (e.g. no `gh` auth) or is still no-op'd (no code).
-  updateGoalConflicts(goal);
+  const conflicts = updateGoalConflicts(goal);
+  // PRD §6.5 — the review gate. conflictsWith above only DESCRIBES the
+  // collision; this acts on it. A goal that landed on the same paths as one
+  // already awaiting review must not open a SECOND PR: both would edit the same
+  // lines and fight when they land, which is exactly the "10 goals, 10
+  // conflicting PRs" morning §6.5 exists to kill. Same-place work goes onto the
+  // same PR, so what sits in Review never conflicts with itself.
+  //
+  // This is the last of the three gates (queue / doing / review) and the only
+  // one that carries the promise: the files compared here are measured, not
+  // predicted. That is what lets the earlier, cheaper gates guess — a wrong
+  // guess costs the re-run below, never a conflict.
+  //
+  // We re-run this goal's intent inside the target's worktree rather than
+  // replaying its diff, because openPR COPIES changed files into the PR
+  // worktree instead of merging them: aiming this goal at the target's branch
+  // would silently overwrite the target's version of any shared file. Re-running
+  // lets the worker SEE the target's changes and build on them, so there is
+  // never a conflict to resolve. It costs one extra worker pass — the price of
+  // gates 1/2 having missed, paid in tokens instead of in the user's morning.
+  //
+  // Same owner only: folding across owners would splice one user's work onto
+  // another's PR and echo its text back — the same leak the intake-side fold
+  // guards against with a visibility check.
+  const foldTarget = conflicts.length
+    ? goals.find((g) => g.id === pickFoldTarget(
+      { id: goal.id, changedFiles: goalChangedFileUnion(goal.id) },
+      goals
+        .filter((c) => c.id !== goal.id
+          && c.projectId === goal.projectId
+          && c.status === 'review'
+          && (c.owner ?? 'owner') === (goal.owner ?? 'owner'))
+        .map((c) => ({ id: c.id, changedFiles: goalChangedFileUnion(c.id) })),
+    ))
+    : null;
+  if (foldTarget) {
+    goalAct(`Same files as goal ${foldTarget.id} — folding onto its PR instead of opening a second one.`);
+    // The target re-opens: it has new work to do, and createGoalPR's rework path
+    // will push the result onto the PR branch it already owns.
+    foldTarget.status = 'running';
+    queueReplyTask(foldTarget, goal.text.slice(0, 8000));
+    saveGoal(foldTarget);
+    // The folded goal keeps its row (PRD §3.5: a submission is never dropped) —
+    // it becomes a pointer at the goal that now carries its work.
+    goal.status = 'folded';
+    goal.foldedInto = foldTarget.id;
+    saveGoal(goal);
+    return;
+  }
   // Computed BEFORE createGoalPR (not inside verifyGate, which used to run
   // after) so the PR body's "確認ポイント" headline is available the first
   // time the PR is opened, not only on the review card (Masa 2026-07-16).
@@ -2979,9 +3056,15 @@ const server = createServer(async (req, res) => {
   if (url.pathname === '/api/projects' && req.method === 'POST') {
     let body = '';
     req.on('data', (d) => { body += d; });
-    req.on('end', () => {
+    req.on('end', async () => {
       try {
         const input = JSON.parse(body || '{}');
+        // Billing (docs/BILLING-LAUNCH-PLAN.md §2/§5): a 2nd project is paid.
+        // Same 402 shape as POST /api/tasks so the client has one branch to
+        // handle. Gated here, on create, and nowhere else: projects that
+        // already exist keep working on the free tier.
+        const gate = await requireEntitlementGate(identityFor(req), 'project');
+        if (!gate.allowed) return json(res, 402, { error: 'free-tier limit reached', blocked: gate.blocked });
         const base = projects.find((p) => p.id === input.baseProjectId) ?? projects[0];
         const nameBase = String(input.name ?? 'New project').trim().slice(0, 80) || 'New project';
         let name = nameBase, n = 2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.24",
+  "version": "0.10.30",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {