@galda/cli 0.10.33 → 0.10.34

package/bin/manager-for-ai.mjs

@@ -11,7 +11,7 @@ import { existsSync } from 'node:fs';
 import { join, resolve, dirname } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { createServer } from 'node:net';
-import { isCommandOnPath, resolveConnectedAgents } from '../engine/lib.mjs';
+import { isCommandOnPath, resolveConnectedAgents, resolveOpenBrowserDefault } from '../engine/lib.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const say = (m) => console.log(`[galda] ${m}`);
@@ -78,7 +78,11 @@ if (ffmpeg.error || ffmpeg.status !== 0) {
 }
 
 // 4) start the server (state in ~/.manager-for-ai unless MANAGER_HOME is set)
-process.env.MANAGER_OPEN_BROWSER = process.env.MANAGER_OPEN_BROWSER ?? '1';
+// Default to opening a browser only for an interactive (human) run. A worker or
+// CI that shells out to this CLI is non-interactive (piped stdout) and must never
+// pop a Google sign-in window on the user's desktop — 2026-07-18 incident. An
+// explicit MANAGER_OPEN_BROWSER (including empty) is always respected.
+process.env.MANAGER_OPEN_BROWSER = resolveOpenBrowserDefault({ existing: process.env.MANAGER_OPEN_BROWSER, isTTY: Boolean(process.stdout.isTTY) });
 // Public-build defaults (this CLI is the shipped entry point): point at the
 // deployed billing worker + the fixed-URL relay unless the operator overrides.
 // Set on env BEFORE importing the server so it reads them like any other config.

package/engine/lib.mjs

@@ -3353,6 +3353,20 @@ export function shouldOpenBrowserOnBoot({ openBrowser, platform, managerPort } =
   return true;
 }
 
+// The launcher (bin/manager-for-ai.mjs) side of the same rule: what to DEFAULT
+// MANAGER_OPEN_BROWSER to when the operator did not set it. shouldOpenBrowserOnBoot
+// is the belt on the spawn side (ephemeral port-0 boots never open); this is the
+// belt on the entry side. A human who ran `npx @galda/cli` in a terminal has an
+// interactive stdout (isTTY); a worker / CI / automation that shells out to the
+// CLI to "verify against a real server" is non-interactive (piped) — and must
+// never pop a Google sign-in window on the user's desktop (that path resolves a
+// real port, so the port-0 belt alone would not catch it). An explicit value
+// (including empty, meaning "self-hosted, no hosted flow") is always respected.
+export function resolveOpenBrowserDefault({ existing, isTTY } = {}) {
+  if (existing !== undefined && existing !== null) return String(existing);
+  return isTTY ? '1' : '0';
+}
+
 // --- device-flow (PKCE) sign-in helpers --------------------------------------
 // The browser no longer delivers the minted token to a live loopback port —
 // the engine POLLS the Worker to claim it (device-flow). PKCE ties the claim to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.33",
+  "version": "0.10.34",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {