@galda/cli 0.10.27 → 0.10.32

package/engine/lib.mjs

@@ -3,7 +3,7 @@
 import { resolve, join, basename } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
-import { createPublicKey, verify as verifyRsaSignature } from 'node:crypto';
+import { createPublicKey, verify as verifyRsaSignature, createHash } from 'node:crypto';
 
 // Worker agents Galda can drive. Galda is NOT tied to Claude Code — it runs on
 // whichever agent CLI you have. Neither is auto-installed and codex is never even
@@ -2775,8 +2775,11 @@ export function nextResumeDelay(attempt, { baseMs = 5 * 60 * 1000, maxMs = 60 *
 
 // ---- billing entitlement gate (public self-serve launch, docs/BILLING-LAUNCH-PLAN.md) --
 // Mirrors workers/billing-api/src/entitlement.mjs's FREE_TIER_LIMITS/
-// checkFreeTierLimit/resolveEntitlement exactly (Masa decision 2026-07-12:
-// 5 pending goals, 19 lifetime goals, 1 project, $16/mo unlocks all three).
+// checkFreeTierLimit/resolveEntitlement exactly (Masa: 5 queued to-dos,
+// 20 total tasks, 1 project — matching galda.app's own words. Updated
+// 2026-07-17: lifetime cap 19→20 so the wall says the same number the sales
+// page promises ("20 total tasks"); it used to block the 20th create, one short
+// of the promise. Pro unlocks all three; price is Stripe-derived, not in code.)
 // Deliberately duplicated rather than imported: engine/ and workers/billing-api/
 // are independently deployed (a user's Mac vs Cloudflare) and independently
 // tested — sharing a module across that boundary would couple two things
@@ -2784,10 +2787,21 @@ export function nextResumeDelay(attempt, { baseMs = 5 * 60 * 1000, maxMs = 60 *
 // hand; both have their own test coverage against the same free-tier numbers.
 export const FREE_TIER_LIMITS = Object.freeze({
   maxPendingGoals: 5,
-  maxCumulativeGoals: 19,
+  maxCumulativeGoals: 20,
   maxProjects: 1,
 });
 
+// The statuses that occupy a "queued to-do" slot (the 5-slot wall). Narrower
+// than "every open goal" on purpose: a goal in `review` has finished its work
+// and is waiting on a human — that's not a to-do in flight, and galda.app sells
+// the slot as "queued to-dos", so review must not eat one (Masa 2026-07-17,
+// "5枠は実行待ちだけ"). Kept as its own named list rather than filtering an
+// "all open" constant so the intent is legible where it's read.
+export const QUEUED_GOAL_STATUSES = Object.freeze([
+  'stacked', 'sending', 'pending', 'planning', 'needsInput',
+  'running', 'partial', 'failed', 'interrupted', 'blocked', 'retesting',
+]);
+
 export function checkFreeTierLimit(usage) {
   const pendingCount = Number(usage?.pendingCount) || 0;
   const cumulativeCount = Number(usage?.cumulativeCount) || 0;
@@ -3320,3 +3334,28 @@ export function classifyRelayClientConflict({ existingLock, alive, newIdentity }
 export function shouldEscalateConnectGateHint(waitedMs, email, thresholdMs = 15000) {
   return Number(waitedMs) >= thresholdMs && Boolean(String(email ?? '').trim());
 }
+
+// --- device-flow (PKCE) sign-in helpers --------------------------------------
+// The browser no longer delivers the minted token to a live loopback port —
+// the engine POLLS the Worker to claim it (device-flow). PKCE ties the claim to
+// the engine that started the flow: the engine keeps a secret `verifier`, sends
+// only its SHA-256 `challenge` through the browser, and the Worker hands the
+// token back only to a claimant that can present the matching verifier. These
+// are pure so the crypto + response-shape parsing are unit-tested with no server.
+export function makeSigninChallenge(verifier) {
+  return createHash('sha256').update(String(verifier ?? '')).digest('base64url');
+}
+export function verifierMatchesChallenge(verifier, challenge) {
+  if (!verifier || !challenge) return false;
+  return makeSigninChallenge(verifier) === String(challenge);
+}
+// Normalize the Worker's /connect/claim JSON into a single shape the poller can
+// switch on. Worker returns {pending:true} before the browser lands, {error} on
+// failure, {token,email} once minted. Anything malformed reads as an error so a
+// bad response never masquerades as "still pending" forever.
+export function parseClaimResponse(obj) {
+  if (!obj || typeof obj !== 'object') return { state: 'error', error: 'malformed claim response' };
+  if (obj.error) return { state: 'error', error: String(obj.error) };
+  if (obj.token) return { state: 'ready', token: String(obj.token), email: obj.email != null ? String(obj.email) : undefined };
+  return { state: 'pending' };
+}

package/engine/server.mjs

@@ -20,8 +20,8 @@ import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
-import { needsProjectFolder, folderLabel, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText } from './lib.mjs';
-import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision } from './lib.mjs';
+import { needsProjectFolder, folderLabel, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse } from './lib.mjs';
+import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision } from './lib.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
 
@@ -177,6 +177,19 @@ const entitlementCache = new Map(); // billing email -> { isPaying, checkedAt }
 // it survives restarts.
 const licenseFile = join(DATA_DIR, 'license.token');
 let licenseState = { email: null, isPaying: false, verifiedAt: 0 }; // in-memory cache of the last successful verify (isPaying is the token's snapshot; the live gate re-checks)
+// Test-only seam: override the license-verify public key via env so tests can
+// sign tokens the running server actually accepts (the baked LICENSE_PUBLIC_JWK
+// has no committed private half, so the licensed-but-lapsed path is otherwise
+// untestable — see docs/HANDOFF-A2C-WORKERS-DEV-CLEANUP.md item 6). Unset in
+// prod → verifyLicenseToken falls back to the baked key. This is NOT a payment
+// bypass: forging an identity here only picks WHO the email is; whether they're
+// paying is still the live remote billing-api (fetchIsPaying). An env escape
+// hatch already exists on the gate (MANAGER_ENTITLEMENT_BYPASS=1) — same spirit.
+const LICENSE_PUBKEY_OVERRIDE = (() => {
+  const raw = process.env.MANAGER_LICENSE_PUBKEY;
+  if (!raw) return undefined;
+  try { return JSON.parse(raw); } catch { return undefined; }
+})();
 
 // Analytics identity (A+): once signed in, scope usage events to the ACCOUNT
 // (the billing Worker hashes this email → the same account_id the accounts table
@@ -191,26 +204,72 @@ let _freeExhaustedEmitted = false;
 // the nonce, round-trips it through the flow, and requires it back — so a random
 // page can't drive the local /oauth/callback with a token the user never asked for.
 const SIGNIN_NONCE_TTL_MS = 10 * 60 * 1000;
-const pendingSignins = new Map(); // nonce -> expiresAt
+const pendingSignins = new Map(); // nonce -> { expiresAt, verifier }
 function newSigninNonce() {
   const now = Date.now();
-  for (const [k, exp] of pendingSignins) if (exp < now) pendingSignins.delete(k); // opportunistic sweep
+  for (const [k, v] of pendingSignins) if (v.expiresAt < now) pendingSignins.delete(k); // opportunistic sweep
   const nonce = randomBytes(18).toString('base64url');
-  pendingSignins.set(nonce, now + SIGNIN_NONCE_TTL_MS);
-  return nonce;
+  const verifier = randomBytes(32).toString('base64url'); // PKCE secret — never leaves the engine
+  pendingSignins.set(nonce, { expiresAt: now + SIGNIN_NONCE_TTL_MS, verifier });
+  return { nonce, verifier };
 }
 function consumeSigninNonce(nonce) {
-  const exp = pendingSignins.get(nonce);
-  if (exp === undefined) return false;
+  const entry = pendingSignins.get(nonce);
+  if (entry === undefined) return false;
   pendingSignins.delete(nonce);
-  return exp >= Date.now();
+  return entry.expiresAt >= Date.now();
+}
+
+// Device-flow (PKCE) sign-in. The old loopback flow delivered the minted token
+// to http://127.0.0.1:<port>/oauth/callback — which dead-ends with
+// ERR_CONNECTION_REFUSED the moment that ephemeral port is gone (engine
+// restarted, MANAGER_PORT=0 instance exited). Instead the engine POLLS the
+// Worker to claim the token and the browser lands on a HOSTED success page, so
+// delivery never depends on the browser reaching a live local port.
+const activeSigninPolls = new Set(); // nonces with a live poller (one per nonce)
+function buildSigninUrl() {
+  const { nonce, verifier } = newSigninNonce();
+  const challenge = makeSigninChallenge(verifier);
+  startSigninPoll(nonce, verifier);
+  return `${BILLING_API_URL}/connect?state=${encodeURIComponent(nonce)}&challenge=${encodeURIComponent(challenge)}`;
+}
+// Best-effort background loop: GET /connect/claim every 2s until the token is
+// minted (ready), an error is stored, or the nonce's 10-min TTL lapses. On
+// success it activates the license and nudges the app over SSE (the same
+// 'signed-in'/'signin-error' events the popup postMessage used to carry). Never
+// throws — an unreachable Worker just means we try again next tick.
+async function startSigninPoll(nonce, verifier) {
+  if (!BILLING_API_URL || activeSigninPolls.has(nonce)) return;
+  activeSigninPolls.add(nonce);
+  const deadline = Date.now() + SIGNIN_NONCE_TTL_MS;
+  const stop = () => { activeSigninPolls.delete(nonce); pendingSignins.delete(nonce); };
+  try {
+    while (Date.now() < deadline) {
+      await new Promise((r) => { const t = setTimeout(r, 2000); t.unref?.(); });
+      if (!activeSigninPolls.has(nonce)) return; // stopped elsewhere
+      try {
+        const url = `${BILLING_API_URL}/connect/claim?state=${encodeURIComponent(nonce)}&verifier=${encodeURIComponent(verifier)}`;
+        const res = await fetch(url);
+        if (!res.ok) continue; // 403 mismatch / transient — keep trying until TTL
+        const parsed = parseClaimResponse(await res.json().catch(() => null));
+        if (parsed.state === 'ready') {
+          const result = await activateLicense(parsed.token);
+          if (result.ok) send({ ev: 'signed-in', email: result.email });
+          else send({ ev: 'signin-error', error: result.error });
+          return;
+        }
+        if (parsed.state === 'error') { send({ ev: 'signin-error', error: parsed.error }); return; }
+        // pending → loop again
+      } catch { /* best-effort — retry next tick */ }
+    }
+  } finally { stop(); }
 }
 
 async function loadLicenseFromDisk() {
   if (!existsSync(licenseFile)) return;
   const token = readFileSync(licenseFile, 'utf8').trim();
   if (!token) return;
-  const result = await verifyLicenseToken({ token });
+  const result = await verifyLicenseToken({ token, publicJwk: LICENSE_PUBKEY_OVERRIDE });
   if (result.valid) licenseState = { email: result.payload.email, isPaying: Boolean(result.payload.isPaying), verifiedAt: Date.now() };
 }
 loadLicenseFromDisk();
@@ -219,7 +278,7 @@ loadLicenseFromDisk();
 // token to disk that doesn't actually verify, so a bad paste can't silently
 // wedge the app into "licensed but broken".
 async function activateLicense(token) {
-  const result = await verifyLicenseToken({ token: String(token ?? '') });
+  const result = await verifyLicenseToken({ token: String(token ?? ''), publicJwk: LICENSE_PUBKEY_OVERRIDE });
   if (!result.valid) return { ok: false, error: `invalid license: ${result.reason}` };
   writeFileSync(licenseFile, String(token));
   licenseState = { email: result.payload.email, isPaying: Boolean(result.payload.isPaying), verifiedAt: Date.now() };
@@ -250,26 +309,32 @@ function signinResultPage(outcome) {
     `</script></body>`;
 }
 
-// "Currently occupying capacity" for the free-tier pending-goal cap — every
-// status short of a genuinely finished/dismissed one. Deliberately broad for
-// the same reason RATE_LIMIT_RE above is broad: undercounting here would let
-// someone quietly exceed the cap via an odd status, which costs more than
-// occasionally counting a goal that's nearly done.
-const OPEN_GOAL_STATUSES = ['stacked', 'sending', 'pending', 'planning', 'needsInput', 'running', 'partial', 'failed', 'interrupted', 'blocked', 'review', 'retesting'];
-
-// NOTE(billing, needs a product decision): `projectCount` is left at 0 —
-// projects are shared/global in this codebase today (see the "Projects ...
-// stay shared for everyone" comment above goalVisibleTo in lib.mjs), not
-// per-identity, so a per-user "max 1 project" cap has nothing correct to
-// gate yet (an unpaid user's 2nd project would affect every other user, not
-// just them). checkFreeTierLimit already supports projectCount > 1 the
-// moment that's resolved — see docs/BILLING-LAUNCH-PLAN.md.
+// The 5-slot "queued to-dos" cap counts QUEUED_GOAL_STATUSES (from lib.mjs) —
+// every open status EXCEPT `review`. A goal in review has finished its work and
+// is waiting on a human, so it isn't a to-do in flight, and galda.app sells the
+// slot as "queued to-dos" (Masa 2026-07-17, "5枠は実行待ちだけ"). Still broad
+// otherwise, for the same reason RATE_LIMIT_RE is: undercounting would let
+// someone quietly exceed the cap via an odd status. The list lives in lib.mjs
+// so the wall's meaning is defined next to checkFreeTierLimit and unit-tested.
+
+// `projectCount` is install-wide, not per-identity: projects are shared/global
+// in this codebase (see the "Projects ... stay shared for everyone" comment
+// above goalVisibleTo in lib.mjs) while only goals are partitioned by owner.
+// That asymmetry used to leave this at 0 pending a product decision (a per-user
+// "max 1 project" cap would have let one user's 2nd project block everyone
+// else's). Resolved 2026-07-17 (Masa): the shipping product is local-first —
+// app.galda.app reaches each user's OWN engine over the relay, so one install
+// is one user, and the license this gate consults (licenseState.email) is
+// already install-wide too. Counting every project on the install is therefore
+// the same scope billing already runs at. The stale caveat only applies to the
+// legacy Cloudflare Access multi-user mode, where several identities share one
+// install AND one license — there, a shared cap is already the status quo.
 function computeFreeTierUsage(identity) {
   const owned = goals.filter((g) => (g.owner ?? 'owner') === identity);
   return {
-    pendingCount: owned.filter((g) => OPEN_GOAL_STATUSES.includes(g.status)).length,
+    pendingCount: owned.filter((g) => QUEUED_GOAL_STATUSES.includes(g.status)).length,
     cumulativeCount: owned.length,
-    projectCount: 0,
+    projectCount: projects.length,
   };
 }
 
@@ -362,15 +427,25 @@ async function getBillingPrice() {
 // every installation (~/.claude/plans/toasty-rolling-marshmallow.md).
 // A personal/dev instance that wants to skip billing entirely should opt in
 // explicitly via MANAGER_ENTITLEMENT_BYPASS=1, not ride the 'owner' string.
-async function requireEntitlementGate(identity) {
+async function requireEntitlementGate(identity, intent = 'goal') {
   if (process.env.MANAGER_ENTITLEMENT_BYPASS === '1') return { allowed: true, blocked: null };
-  // Count the goal being created (existing + 1): computeFreeTierUsage counts
-  // only goals already on file and this gate runs *before* the new one is
+  // Count the thing being created (existing + 1): computeFreeTierUsage counts
+  // only what's already on file and this gate runs *before* the new one is
   // added, so "5 pending / 19 lifetime max" must block the 6th / 20th create,
   // not the 7th / 21st. (checkFreeTierLimit keeps its `> limit` semantics; we
   // feed it the post-create count. Display in /api/state stays the raw count.)
+  //
+  // Only the dimension the caller is actually spending gets its real count;
+  // the others are zeroed. checkFreeTierLimit weighs all three at once and
+  // mirrors billing-api byte-for-byte, so it must not learn about intents —
+  // the caller narrows the question instead. Without this, an install already
+  // holding 2 projects (created before the project cap was enforced) would
+  // trip 'project-limit' on every *goal* create and lose a feature it had:
+  // caps are enforced at the moment you spend, never retroactively.
   const existing = computeFreeTierUsage(identity);
-  const usage = { ...existing, pendingCount: existing.pendingCount + 1, cumulativeCount: existing.cumulativeCount + 1 };
+  const usage = intent === 'project'
+    ? { pendingCount: 0, cumulativeCount: 0, projectCount: existing.projectCount + 1 }
+    : { ...existing, pendingCount: existing.pendingCount + 1, cumulativeCount: existing.cumulativeCount + 1, projectCount: 0 };
   if (!checkFreeTierLimit(usage).blocked) return { allowed: true, blocked: null };
   const billingEmail = licenseState.email;
   if (!billingEmail) { const r = resolveEntitlement({ isOwner: false, isPaying: false, usage }); noteFreeExhausted(r); return r; }
@@ -2952,9 +3027,10 @@ const server = createServer(async (req, res) => {
   // browser; Google bounces back to /oauth/callback (below) with a token.
   if (url.pathname === '/api/signin-url' && req.method === 'GET') {
     if (!BILLING_API_URL) return json(res, 501, { error: 'sign-in not configured (MANAGER_BILLING_API_URL unset)' });
-    const nonce = newSigninNonce();
-    const signinUrl = `${BILLING_API_URL}/connect?port=${PORT}&state=${encodeURIComponent(nonce)}`;
-    return json(res, 200, { url: signinUrl });
+    // Device-flow: no loopback port. buildSigninUrl mints {nonce,verifier},
+    // returns the /connect URL carrying only the PKCE challenge, and kicks off
+    // the background poll that claims the token from the Worker.
+    return json(res, 200, { url: buildSigninUrl() });
   }
 
   // GET /oauth/callback?token&email&state | ?error&state — loopback landing for
@@ -3027,9 +3103,15 @@ const server = createServer(async (req, res) => {
   if (url.pathname === '/api/projects' && req.method === 'POST') {
     let body = '';
     req.on('data', (d) => { body += d; });
-    req.on('end', () => {
+    req.on('end', async () => {
       try {
         const input = JSON.parse(body || '{}');
+        // Billing (docs/BILLING-LAUNCH-PLAN.md §2/§5): a 2nd project is paid.
+        // Same 402 shape as POST /api/tasks so the client has one branch to
+        // handle. Gated here, on create, and nowhere else: projects that
+        // already exist keep working on the free tier.
+        const gate = await requireEntitlementGate(identityFor(req), 'project');
+        if (!gate.allowed) return json(res, 402, { error: 'free-tier limit reached', blocked: gate.blocked });
         const base = projects.find((p) => p.id === input.baseProjectId) ?? projects[0];
         const nameBase = String(input.name ?? 'New project').trim().slice(0, 80) || 'New project';
         let name = nameBase, n = 2;
@@ -4041,7 +4123,7 @@ server.listen(PORT, '127.0.0.1', () => {
       const signedIn = existsSync(licenseFile) && !FORCE_SIGNIN;
       openUrl = signedIn
         ? APP_URL
-        : `${BILLING_API_URL}/connect?port=${PORT}&state=${encodeURIComponent(newSigninNonce())}`;
+        : buildSigninUrl(); // device-flow: also starts the background claim poll
       console.log(signedIn
         ? `[manager] opening your app → ${APP_URL}`
         : `[manager] ${FORCE_SIGNIN ? 'switching account' : 'first run'}: opening one-click sign-in → ${openUrl}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.27",
+  "version": "0.10.32",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {