@galda/cli 0.10.39 → 0.10.40

package/app/index.html

@@ -2028,6 +2028,20 @@
   /* "Open it" is waiting on a real process to boot (up to ~15s), so the chip says so
      rather than looking dead. Dim + no pointer, no spinner — §5.5 薄く・主張しない. */
   .redesign .mx.mwait{opacity:.55;pointer-events:none}
+  /* the AI's own screenshots: full width, own aspect, hairline edge (§5.5 縁は1px以下).
+     No grid, no crop — one shot is often a comparison sheet and dies when shrunk. */
+  .redesign .rshot{margin:0 0 16px}
+  .redesign .rshot:last-child{margin-bottom:0}
+  .redesign .rshot img{display:block;width:100%;height:auto;border-radius:10px;border:1px solid var(--hair)}
+  .redesign .rshot figcaption{margin-top:6px;font-family:var(--mono);font-size:11px;color:var(--ink3)}
+  /* before/after pair + the red box over what actually changed (pixel-diffed here from
+     the worker's own two shots — no box appears unless the pixels really differ) */
+  .redesign .beforeafter .proofimg{width:100%;height:auto;max-height:none;object-fit:initial;display:block;border-radius:8px;border:1px solid var(--hair)}
+  .redesign .ba-imgwrap{position:relative}
+  .redesign .ba-imgwrap .proofimg{margin-top:0}
+  .redesign .ba-box{position:absolute;border:1.5px solid var(--danger);border-radius:2px;pointer-events:none}
+  .redesign .ba-zoomhd{margin:14px 0 8px;font-family:var(--mono);font-size:11px;letter-spacing:.04em;text-transform:uppercase;color:var(--ink3)}
+  .redesign .ba-zoomimg{display:block;width:100%;height:auto;border-radius:8px;border:1px solid var(--hair)}
   .redesign .rfiles{margin:12px 0 0;font-family:var(--mono);font-size:12px;color:var(--ink2);line-height:1.75}
   .redesign .rfiles .a{color:#3fd07a;font-style:normal}.redesign .rfiles .d{color:#ff7b72;font-style:normal}
   /* Request accordion (spec §3) — chevron › rotate 90, body indented, no left rule */
@@ -2100,22 +2114,25 @@
      in at the bottom of the opened body. */
   .redesign .ract{margin-top:24px !important}
   .redesign .ract>.rsec-h{margin-bottom:10px !important}
-  .redesign .lacc>summary{list-style:none;cursor:pointer;display:flex;gap:9px;align-items:baseline}
+  .redesign .lacc>summary{list-style:none;cursor:pointer;display:flex;gap:14px;align-items:baseline}
   .redesign .lacc>summary::-webkit-details-marker{display:none}
-  .redesign .lacc .ltog{flex:0 0 auto;color:var(--ink3);font-style:normal;line-height:1;transition:transform .14s}
+  .redesign .lacc .ltog{flex:0 0 auto;color:var(--ink2);font-style:normal;font-size:1.15em;line-height:1.25;transition:transform .14s}
   .redesign .lacc[open]>summary .ltog{transform:rotate(90deg)}
   .redesign .lacc .lfirst{flex:1;min-width:0}
   .redesign .lacc .lbody{margin-top:12px;padding-left:18px}
   /* transcript rows — Linear-clean, borderless (You / tool mono / res green / Claude) */
   .redesign .rtx{border:0;background:none}
-  .redesign .txr{display:flex;gap:12px;padding:5px 0;font-size:13px;line-height:1.55}
-  .redesign .txr .w{flex:0 0 46px;font-size:11px;color:var(--ink3);padding-top:1px}
+  .redesign .txr{display:flex;gap:12px;padding:5px 0;font-size:13px;line-height:1.55;align-items:baseline}
+  .redesign .txr .w{flex:0 0 46px;font-size:11px;color:var(--ink3)}
   .redesign .txr.you .w,.redesign .txr.cl .w{color:var(--ink);font-weight:600}
   .redesign .txr .m{flex:1;min-width:0;color:var(--ink2)}
   .redesign .txr.cl .m{color:var(--ink)}
   .redesign .txr.tool .m{color:var(--ink2);font-family:var(--mono);font-size:12px}
   .redesign .txr.tool .m b{color:var(--ink);font-weight:600}
   .redesign .txr.res .m{font-family:var(--mono);font-size:12px;color:var(--green)}
+  /* Manager's own progress notes inside the implementation log: commentary, not results.
+     Green would read as "passed" (§5.5 UIクロームは薄く・優しく・主張しない). */
+  .redesign .txr.note .m{font-family:var(--mono);font-size:12px;color:var(--ink3)}
   /* Discussion (review back-and-forth) folded at the bottom of Activity's body */
   .redesign .lbody .rthread{display:flex;flex-direction:column;gap:16px;margin:0}
   .redesign .lbody .rmsg .who{font-size:12px;font-weight:600;color:var(--ink);margin-bottom:4px}
@@ -3758,11 +3775,105 @@ function proofMediaHtml(taskId, proof, altLabel){
 // us, not by the work: the "before" shot came from the same photo-staging pass that P1
 // removed on the engine side (#228), and in practice it never existed at all, so every
 // card fell through to the single shot anyway. Callers now ask for that shot directly.
-// (P1, Masa 2026-07-21) The before/after diff-box machinery (computeDiffBox,
-// baLoadImage, baZoomDataUrl, beforeAfterBoxedHtml) was deleted here. It pixel-diffed a
-// "before" capture against an "after" one to draw a red box around what changed — real
-// craft, built on a pair that the engine no longer stages (#228) and that never existed
-// outside this repo anyway. With no before shot there is nothing to compare.
+// Red box (restored 2026-07-22 on Masa's ask). This machinery was deleted in #230 with
+// the staged before/after pair, because the 'before' was a photo WE took of a screen
+// that had nothing to do with the change. It comes back on a different footing: the two
+// images are both the worker's own shots, taken by the agent that did the work, and the
+// box is computed here from those two PNGs by pixel comparison — nothing is invented, a
+// box only appears when the pixels really differ in one region.
+// minCoverage lowered 2026-07-22: the old 0.05% floor was tuned on a 640x200 proof pair.
+// A real worker shot is a whole 900-1440px page, where a genuine change (a dot going
+// green, a label swapping) is well under that floor and was being thrown away as noise.
+// 30 pixels differing by more than `threshold` is a change someone made on purpose;
+// compression noise does not clear a 24-point RGB delta.
+function computeDiffBox(beforeImg, afterImg, { threshold = 24, minPixels = 30, maxCoverage = 0.7, pad = 0.03 } = {}) {
+  const w = beforeImg.naturalWidth, h = beforeImg.naturalHeight;
+  if (w !== afterImg.naturalWidth || h !== afterImg.naturalHeight) return null; // different-shaped images: don't guess
+  const c1 = document.createElement('canvas'); c1.width = w; c1.height = h;
+  const c2 = document.createElement('canvas'); c2.width = w; c2.height = h;
+  c1.getContext('2d').drawImage(beforeImg, 0, 0, w, h);
+  c2.getContext('2d').drawImage(afterImg, 0, 0, w, h);
+  const d1 = c1.getContext('2d').getImageData(0, 0, w, h).data;
+  const d2 = c2.getContext('2d').getImageData(0, 0, w, h).data;
+  let minX = w, minY = h, maxX = -1, maxY = -1, diffPx = 0;
+  for (let y = 0; y < h; y++) {
+    for (let x = 0; x < w; x++) {
+      const i = (y * w + x) * 4;
+      const d = Math.abs(d1[i] - d2[i]) + Math.abs(d1[i + 1] - d2[i + 1]) + Math.abs(d1[i + 2] - d2[i + 2]);
+      if (d > threshold) {
+        diffPx++;
+        if (x < minX) minX = x; if (x > maxX) maxX = x;
+        if (y < minY) minY = y; if (y > maxY) maxY = y;
+      }
+    }
+  }
+  const total = w * h;
+  if (maxX < 0 || diffPx < minPixels) return null; // no real difference — don't box a no-op
+  if (diffPx / total > maxCoverage) return null; // diff too diffuse to be "a spot" — a full redesign shouldn't get a red box either
+  const padPx = Math.round(Math.max(w, h) * pad);
+  minX = Math.max(0, minX - padPx); minY = Math.max(0, minY - padPx);
+  maxX = Math.min(w, maxX + padPx); maxY = Math.min(h, maxY + padPx);
+  return { x: minX, y: minY, w: maxX - minX, h: maxY - minY };
+}
+function baLoadImage(src){
+  return new Promise((resolve, reject) => {
+    const im = new Image();
+    im.onload = () => resolve(im);
+    im.onerror = () => reject(new Error(`image failed to load: ${src}`));
+    im.src = src;
+  });
+}
+// Crop {x,y,w,h} out of a decoded image and scale it up into a small inset — same
+// aspect ratio as the box, never stretched. Magnification is capped at 6x so a
+// near-single-pixel box doesn't blow up into mush.
+function baZoomDataUrl(img, box, maxW = 420, maxH = 200){
+  const scale = Math.min(maxW / box.w, maxH / box.h, 6);
+  const outW = Math.max(1, Math.round(box.w * scale));
+  const outH = Math.max(1, Math.round(box.h * scale));
+  const c = document.createElement('canvas'); c.width = outW; c.height = outH;
+  c.getContext('2d').drawImage(img, box.x, box.y, box.w, box.h, 0, 0, outW, outH);
+  return c.toDataURL('image/png');
+}
+// A before/after pair exists only when the AI SAYS two of its shots are the same view
+// before and after (task.run.compare = [beforeName, afterName]). Masa 2026-07-22: an
+// earlier version of this guessed the pair from file names containing "before"/"after",
+// which is this layer inventing a relationship it cannot know — the same mistake as the
+// intake AI writing the pass condition. A request for three options has no "after"; only
+// the agent that did the work knows which images relate, so only it can say so.
+//
+// Nothing declares `compare` yet (the engine keeps cmd/url/note/check), so no card draws
+// a box today. The machinery below stays wired: the day the worker can declare a pair,
+// it lights up with no further app change.
+function saShotPair(shots, declared){
+  const list = shots ?? [];
+  const pair = Array.isArray(declared) ? declared : null;
+  if (!pair || pair.length !== 2) return null;
+  const find = (n) => list.find((s) => s.name === n || String(s.url || '').endsWith(String(n)));
+  const before = find(pair[0]), after = find(pair[1]);
+  return before && after && before !== after ? { before, after } : null;
+}
+function saPlainPairHtml(pair){
+  const col = (sh, label) => `<div class="ba-col"><span class="balabel">${label}</span><img class="proofimg" src="${esc(sh.url)}" alt="${esc(label)}" loading="lazy"></div>`;
+  return `<div class="beforeafter">${col(pair.before, 'Before')}${col(pair.after, 'After')}</div>`;
+}
+// Renders the pair with the changed region boxed on both, plus a cropped enlargement.
+// Returns null on every fallback (not two images, load failure, no clean box, different
+// sizes) so the caller keeps showing the plain shots — never a guessed box.
+async function shotsBoxedHtml(before, after){
+  if (!before?.url || !after?.url) return null;
+  let bImg, aImg;
+  try { [bImg, aImg] = await Promise.all([baLoadImage(before.url), baLoadImage(after.url)]); }
+  catch { return null; }
+  const box = computeDiffBox(bImg, aImg);
+  if (!box) return null;
+  const w = bImg.naturalWidth, h = bImg.naturalHeight;
+  const st = `left:${(box.x / w * 100).toFixed(3)}%;top:${(box.y / h * 100).toFixed(3)}%;width:${(box.w / w * 100).toFixed(3)}%;height:${(box.h / h * 100).toFixed(3)}%`;
+  const frame = (img, label) => `<div class="ba-col"><span class="balabel">${label}</span><div class="ba-imgwrap"><img class="proofimg" src="${img.src}" alt="${label.toLowerCase()}" loading="lazy"><div class="ba-box" style="${st}"></div></div></div>`;
+  const zoom = (dataUrl, label) => `<div class="ba-col"><img class="ba-zoomimg" src="${dataUrl}" alt="zoomed ${label}"></div>`;
+  return `<div class="beforeafter">${frame(bImg, 'Before')}${frame(aImg, 'After')}</div>`
+    + `<div class="ba-zoomhd">Zoomed on the boxed area</div>`
+    + `<div class="beforeafter ba-zoomrow">${zoom(baZoomDataUrl(bImg, box), 'before')}${zoom(baZoomDataUrl(aImg, box), 'after')}</div>`;
+}
 // swap the still for the real video only on demand, one at a time
 document.addEventListener('click', (e) => {
   const w = e.target.closest('.proofwrap');
@@ -7992,7 +8103,7 @@ function closeSummaryPera(){ $('summaryOverlay').classList.remove('show'); }
 // 4 archived / 5 reverted — session-local; the server round-trip is what
 // settles it (see saSync's "returned to review" reset).
 // ============================================================================
-const SA = { open: false, items: [], diffs: {}, detOpen: new Set(), focusGid: null, focusScrolled: false, focusTimer: null, cur: null };
+const SA = { open: false, items: [], diffs: {}, actLog: {}, shotBox: {}, detOpen: new Set(), focusGid: null, focusScrolled: false, focusTimer: null, cur: null };
 window.SA = SA; // top-level const isn't a window property; external checks probe window.SA (same convention as window.state above)
 const SA_SVG = {
   ok: '<svg viewBox="0 0 24 24"><path d="M4 12l5 5L20 6"/></svg>',
@@ -8046,6 +8157,25 @@ function saRows(){
         const t = ts.find((x) => x.goalId === g?.id && !x.reply);
         return Array.isArray(t?.todosFinal) ? t.todosFinal : [];
       })(),
+      // Screenshots the worker took of what it built (#229). Measured 2026-07-22 on real
+      // runs: it takes 1-3 depending on the ask — three variants as three shots, or four
+      // variants as ONE comparison sheet. A single shot is not a lazy shot, so none of
+      // these get thumbnailed down.
+      //
+      // Folded goals count: a goal folded into this one keeps its own tasks, and those
+      // tasks carry shots. Reading only the primary goal's tasks makes real deliverables
+      // vanish from the screen (measured: #4 folded into #3, its images disappeared).
+      shots: (() => {
+        const ids = [...r.goalIds, ...folded.map((f) => f.id)];
+        return ts.filter((t) => ids.includes(t.goalId)).flatMap((t) => t.shots ?? []);
+      })(),
+      // The task whose implementation log the engine froze at completion (P1.5). The
+      // lines are NOT in state — 1000 of them per task would bloat every page load — so
+      // this is just the id to ask for when the reviewer opens Activity.
+      logTaskId: (() => {
+        const t = ts.find((x) => x.goalId === g?.id && !x.reply && x.activityLog);
+        return t?.id ?? null;
+      })(),
       // P1 (Masa 2026-07-21): the AI's own final report, verbatim and untrimmed — the
       // card renders it as Markdown and interprets nothing. This is the deliverable for
       // every ask that has no running thing to open ("research this", "explain that"),
@@ -8068,9 +8198,7 @@ function saRows(){
       testResult: (typeof (g?.reviewSummary?.tests) === 'string')
         ? { ran: true, ok: true, passed: parseInt(g.reviewSummary.tests, 10) || 0, failed: 0, label: g.reviewSummary.tests }
         : r.testResult,
-      answer: g?.reviewSummary?.answer ?? null,
       activity: Array.isArray(g?.reviewSummary?.activity) ? g.reviewSummary.activity : null,
-      discussion: Array.isArray(g?.reviewSummary?.discussion) ? g.reviewSummary.discussion : null,
       changedDesc: g?.reviewSummary?.changed ?? null,
       metaFiles: Array.isArray(g?.reviewSummary?.files) ? g.reviewSummary.files : null,
       metaAdd: g?.reviewSummary?.a ?? null, metaDel: g?.reviewSummary?.d ?? null,
@@ -8085,7 +8213,6 @@ function saRows(){
       recordingUrl: pt?.proof?.mp4 ? withKey(`/proof/${pt.id}/${pt.proof.mp4}`) : (typeof g?.reviewSummary?.recording === 'string' ? g.reviewSummary.recording : null),
       // Local URL (spec §5): a running localhost the reviewer can open ("Local localhost:4809 ↗").
       // Falls back to the existing "Local run ↗" (runlocal) button when absent.
-      localUrl: g?.reviewSummary?.localUrl ?? null,
       // Client-side diff fallback: the git-backed /diff endpoint is null for seeded/
       // offline goals, so "What changed" never renders. A unified-diff string stored on
       // the goal (or any of its tasks) lets saGhDiffHtml render locally with no server.
@@ -8111,35 +8238,30 @@ function saRows(){
 // (P1, Masa 2026-07-21) saMetaRowHtml() was deleted here — the pre-redesign meta row,
 // uncalled since the review-card redesign. Its "Run locally" chip only ever opened a
 // note saying no run command was wired; the card's Open it chip now starts the real one.
-// Context: closed by default, one-line verbatim-quote summary, chevron large and at
-// the far right (H23 §2). Quotes goal.text — the user's own words — never
-// task.detail/title (AI-authored; an earlier round of this design mistakenly quoted
-// the AI's own read on the request as "your ask" and it wasn't recognizable).
-function saContextHtml(it, gk){
-  const goalTxt = it.goalText;
-  const summary = goalTxt
-    ? `"${esc(goalTxt.length > 60 ? `${goalTxt.slice(0, 60)}…` : goalTxt)}"`
-    : 'No verbatim ask on record for this goal.';
-  const split = it.siblings
-    ? `<div class="lg-splitnote"><div class="hd">Split into ${it.siblings.length} goals — nothing else was dropped</div><ul>${it.siblings.map((s) => `<li class="${s.cur ? 'cur' : ''}">${s.no != null ? `#${esc(s.no)} ` : ''}${esc(s.title)}${s.cur ? ' <b>(this one)</b>' : ''}</li>`).join('')}</ul></div>`
-    : '';
-  const did = it.did?.length ? `<div class="lg-bullethd">What we did</div><ul class="lg-bullets">${it.did.map((s) => `<li>${esc(s)}</li>`).join('')}</ul>` : '';
-  const look = it.look?.length ? `<div class="lg-bullethd">What to look at</div><ul class="lg-bullets">${it.look.map((s) => `<li>${esc(s)}</li>`).join('')}</ul>` : '';
-  const inner = (split || did || look) ? `${split}${did}${look}` : '<div class="lg-notfound">Nothing else on record for this goal.</div>';
-  const open = SA.detOpen.has(`${gk}:ctx`) ? ' open' : '';
-  return `<details class="lg-goal" data-detkey="${gk}:ctx"${open}><summary><span class="k">Context</span><span class="v">${summary}</span><i class="gtoggle">›</i></summary><div class="lg-context">${inner}</div></details>`;
-}
-// (P1, Masa 2026-07-21) saEvidenceHtml() was deleted here. It rendered the four
-// "evidence hero" shapes for the pre-redesign card — including the 'missing' one that
-// told the reviewer "No capture — this touched the UI and should have one". Nothing has
-// called it since the review-card redesign, and its premise (we owe you a screenshot)
-// is exactly what P1 removes. The report the AI wrote, plus Open it, is the evidence.
+// (saContextHtml() was deleted here — Masa 2026-07-22. The pre-redesign Context fold:
+// verbatim quote, 'What we did' / 'What to look at' bullets, sibling split note. Nothing
+// has called it since the review-card redesign; Request and Result carry that ground now.)
 // Unified-diff → GitHub two-gutter model (REVIEW-CARD-SPEC §7 "GitHub diff = Bright"):
 // walk the @@ hunk headers to recover the old/new line numbers, emit one row per line
 // {o:oldNo|null, n:newNo|null, t:'add'|'del'|'ctx', c:text}. Word-level highlight is
 // NOT fabricated from a raw diff (the product never invents evidence) — the Bright
 // line+gutter tint carries the change and .gh-hi simply stays absent. Pure, so it is
 // extracted and unit-tested in engine/test/review-card-diff.test.mjs.
+// How many body rows the diff really has, ignoring the display cap. A big change used
+// to be cut at 80 rows with nothing said (SPEC §7 asks for "…+N 行 · GitHub で開く ↗"
+// precisely so a reviewer is never shown a slice that looks like the whole thing).
+// Same skip rules as saUnifiedToGh below — headers and @@ markers are not rows.
+function saDiffRowCount(diff){
+  let n = 0;
+  for (const raw of String(diff || '').split('\n')) {
+    if (raw === '') continue;
+    if (/^(diff --git|index |--- |\+\+\+ |new file|deleted file|old mode|new mode|similarity|rename |Binary )/.test(raw)) continue;
+    if (/^@@ -\d+(?:,\d+)? \+\d+(?:,\d+)? @@/.test(raw)) continue;
+    if (raw.startsWith('\\')) continue;
+    n++;
+  }
+  return n;
+}
 function saUnifiedToGh(diff, max){
   const cap = max || 80; const out = []; let o = 0, n = 0;
   for (const raw of String(diff || '').split('\n')) {
@@ -8155,10 +8277,13 @@ function saUnifiedToGh(diff, max){
   }
   return out;
 }
-function saGhDiffHtml(diff){
+function saGhDiffHtml(diff, pr){
   const rows = saUnifiedToGh(diff);
   if (!rows.length) return '';
-  return saGhDiffRowsHtml(rows);
+  // Say what was left out. Before this, a 5000-line change rendered its first 80 rows
+  // and stopped — a quiet lie, and the one thing SPEC §7 names as forbidden.
+  const more = Math.max(0, saDiffRowCount(diff) - rows.length);
+  return saGhDiffRowsHtml(rows, more, pr || '');
 }
 // One Activity transcript row (spec §3): You / tool (mono, bold name) / res (green) /
 // Claude. Mirrors the flagship artifact's tx mapping so the pulldown pixel-matches.
@@ -8168,6 +8293,18 @@ function saTxRowHtml(e){
   if (e[0] === 'user') return `<div class="txr you"><span class="w">You</span><span class="m">${esc(e[1])}</span></div>`;
   return `<div class="txr cl"><span class="w">Claude</span><span class="m">${esc(e[1])}</span></div>`;
 }
+// One line of the frozen implementation log. The worker's own tool calls come through
+// as "Read app/index.html" / "Bash npm test"; the Manager's own progress notes are
+// prefixed with ✎ by sendProcessAct() and read as commentary, so they take the quieter
+// row. Nothing is parsed beyond that split — the line is shown as it was written.
+function saLogRowHtml(line){
+  const s = String(line ?? '');
+  if (s.startsWith('✎')) return `<div class="txr note"><span class="w"></span><span class="m">${esc(s.replace(/^✎\s*/, ''))}</span></div>`;
+  const m = s.match(/^([A-Z][A-Za-z]*)\s+([\s\S]*)$/);
+  return m
+    ? `<div class="txr tool"><span class="w">tool</span><span class="m"><b>${esc(m[1])}</b> ${esc(m[2])}</span></div>`
+    : `<div class="txr cl"><span class="w"></span><span class="m">${esc(s)}</span></div>`;
+}
 // Structured GitHub diff (REVIEW-CARD-SPEC §7): renders {o,n,t,c,h} rows with a
 // word-level highlight (h) and, for a huge change, a "…+N 行 · GitHub で開く ↗"
 // footer (only linking to GitHub when a PR exists). Mirrors the flagship artifact's
@@ -8207,7 +8344,15 @@ function saWorkflowHtml(it){
   // P1 (Masa 2026-07-21): "Proof captured □" is gone. We no longer go take photos of
   // the work, so an empty box there was scoring the goal against a step that isn't
   // part of the process any more — a permanent unchecked box nobody could ever check.
-  const steps = [['Implemented', 'ok'], ['Tested', ran ? 'ok' : 'todo'], ['In review', 'now'], ['Merge', 'todo'], ['Deploy', 'todo']];
+  // "Deploy" is gone too (Masa 2026-07-22): nothing in the product observes a deploy,
+  // so that box could never be ticked — the same permanent-□ problem as Proof captured.
+  // Merge stays because it IS observed: the PR poller flips the goal to done on merge.
+  //
+  // (PRD §5.5-A/15 asks for the USER'S OWN pipeline — PRD→design→implement→check→PR→
+  // merge→deploy, varying per person. There is no place to record such a pipeline yet,
+  // so inventing one here would be this layer guessing someone's process. Left as a
+  // decision, not faked.)
+  const steps = [['Implemented', 'ok'], ['Tested', ran ? 'ok' : 'todo'], ['In review', 'now'], ['Merge', 'todo']];
   return '<div class="rwf">' + steps.map(([s, st]) => `<div class="wf-s ${st}"><span class="mk">${st === 'ok' ? '✓' : st === 'now' ? '→' : '□'}</span>${s}</div>`).join('') + '</div>';
 }
 function saItemHtml(it, i){
@@ -8250,9 +8395,9 @@ function saItemHtml(it, i){
   const kind = saEvidenceKind(filePaths, hasProofImg, gtr);
   const gk = it.goalId;
   const rs = it.goal?.reviewSummary || {};
-  // Conversational task (no code change): drops Proof + What changed, shows an Answer
-  // instead (spec §11); its Activity IS the conversation.
-  const isConv = Boolean(it.answer);
+  // A conversational task (no code change) has no Proof / What changed to show. Its
+  // Result IS the answer (P1) — the old separate Answer section is gone.
+  const isConv = !it.report && !filePaths.length;
   // ── meta (spec §5) — fully data-driven / hide-empty: each chip renders only when its
   // data exists (no PR → no PR chip · no tests → no Tests · no file totals → no Files ·
   // no recording → no Verify). PR = bold green, no underline (a real <a href>). ──
@@ -8269,10 +8414,9 @@ function saItemHtml(it, i){
   if (testsLabel) chips.push(`<span class="mx"><span class="mk">Tests</span> <b class="ok">${esc(testsLabel)}</b></span>`);
   // Files: hide-empty — only with changed files AND totals (a bare-count chip reads odd).
   if (nf && fAdd) chips.push(`<span class="mx"><span class="mk">Files</span> <b>${nf}</b> <span class="mmut">· <i class="a">${esc(fAdd)}</i> <i class="d">${esc(fDel)}</i></span></span>`);
-  // Local: an open localhost URL (neutral, not green). A bare host:port isn't navigable in
-  // the demo, so it renders as a non-navigating chip; a real URL opens in a new tab.
-  if (it.localUrl) { const lu = String(it.localUrl); const isUrl = /^https?:/.test(lu);
-    chips.push(`<a class="mx mlink"${isUrl ? ` href="${esc(lu)}" target="_blank" rel="noopener"` : ' style="cursor:pointer"'} title="Open the running app"><span class="mk">Local</span> <b>${esc(lu.replace(/^https?:\/\//, ''))}</b>${arw}</a>`); }
+  // (The Local chip was deleted here — Masa 2026-07-22. It read reviewSummary.localUrl,
+  // a key parseReviewSummary never emits, so it only ever appeared in demo data; and the
+  // real thing it promised is the Open it section.)
   // (Open it is NOT a meta chip — Masa 2026-07-22. It was saying the same thing as the
   // Open it section below, in the PR chip's vocabulary, so the card spoke two languages
   // about one thing. It lives in the body now, in the same typography as every other
@@ -8333,6 +8477,21 @@ function saItemHtml(it, i){
   // change explains itself here, and an image the AI pasted shows up here as an image.
   // We interpret nothing; mdLite only turns Markdown into the shapes it already means. ──
   const reportBody = it.report ? `<div class="rreport">${mdLite(it.report, { images: false })}</div>` : '';
+  // ── Screenshots (P2, Masa 2026-07-22): the pictures the AI took of its own result.
+  // Full width, at their own aspect — a four-variant comparison sheet is unreadable
+  // shrunk into a thumbnail, and that is the shape the AI actually produces. The file
+  // name it chose is the caption (it names them variant-1-linear.png / compare.png), so
+  // it labels its own work; we add nothing. ──
+  // A before/after pair is two shots the worker named as such — it decides whether the
+  // change had a "before" worth shooting, we only recognise the naming. Anything else is
+  // shown as the plain list.
+  const shotPair = saShotPair(it.shots, it.run?.compare);
+  const boxed = shotPair ? SA.shotBox[it.goalId] : null;
+  const shotsBody = shotPair
+    ? `<div class="rshotpair" data-shotpair="${it.goalId}">${typeof boxed === 'string' ? boxed : saPlainPairHtml(shotPair)}</div>`
+    : it.shots?.length
+      ? it.shots.map((sh) => `<figure class="rshot"><img src="${esc(sh.url)}" alt="${esc(sh.name || 'screenshot')}" loading="lazy"><figcaption>${esc(String(sh.name || '').replace(/\.[a-z]+$/i, ''))}</figcaption></figure>`).join('')
+      : '';
   // ── Proof (spec §6/§11): before/after (identical size) when a real image exists; a
   // run-log for logic-only tests; dropped entirely for a conversational task. ──
   let proofInner = '';
@@ -8355,7 +8514,7 @@ function saItemHtml(it, i){
       : (clientDiff && filePaths.length) ? `<div class="rfiles">${filePaths.map((p) => esc(p)).join('<br>')}</div>` : '';
   const diffHtml = it.ghRows
     ? saGhDiffRowsHtml(it.ghRows, it.diffTotal || 0, it.pr || '')
-    : hasGitDiff ? saGhDiffHtml(d.diff) : clientDiff ? saGhDiffHtml(clientDiff) : '';
+    : hasGitDiff ? saGhDiffHtml(d.diff, it.pr) : clientDiff ? saGhDiffHtml(clientDiff, it.pr) : '';
   const changedBody = isConv ? '' : (changedDescHtml + filesListHtml + diffHtml);
   // ── sensitive-area note (real: classifyChangeRisk forced the pause) ──
   const risk = it.risk;
@@ -8373,17 +8532,30 @@ function saItemHtml(it, i){
   const txArr = (it.activity && it.activity.length)
     ? it.activity.map((e) => saTxRowHtml(e))
     : ((!reportBody && it.did?.length) ? it.did.map((s) => saTxRowHtml(['claude', s])) : []);
-  const discArr = it.discussion || it.thread || null;
-  const threadHtml = (discArr && discArr.length)
-    ? discArr.map((m) => `<div class="rmsg${m[0] === 'you' ? ' you' : ''}"><div class="who">${m[0] === 'you' ? 'You' : 'Manager'}</div><div class="msg">${esc(m[1])}</div></div>`).join('')
-    : '';
+  // (Discussion was deleted here — Masa 2026-07-22. It read reviewSummary.discussion,
+  // which parseReviewSummary never emits, so it never rendered on a real goal; replies
+  // already live in the card's own reply box.)
+  const threadHtml = '';
+  // ── Activity = the implementation log (P1.5, Masa 2026-07-22): what the AI actually
+  // did, read AFTER it finished. Fetched only when the section is opened — a task's log
+  // runs to ~500KB and most cards are never expanded — so the closed state is one line
+  // and the lines arrive on the first open (same "only when asked" shape as Open it).
+  // Once fetched they live in SA.actLog so an SSE rebuild doesn't wipe them.
+  const logLines = it.logTaskId != null ? SA.actLog[it.logTaskId] : null;
+  const logHtml = Array.isArray(logLines)
+    ? (logLines.length
+      ? logLines.map((l) => saLogRowHtml(l)).join('')
+      : '<div class="txr res"><span class="w"></span><span class="m">Nothing was logged for this one.</span></div>')
+    : '<div class="txr res"><span class="w"></span><span class="m">Loading…</span></div>';
   const actOpen = SA.detOpen.has(`${gk}:act`) ? ' open' : '';
   const txFirst = txArr[0] || '<div class="txr"><span class="w"></span><span class="m">Activity</span></div>';
   const txRest = txArr.slice(1).join('');
   const discInner = threadHtml ? `<div class="rsub">Discussion</div><div class="rthread">${threadHtml}</div>` : '';
   const activitySec = (txArr.length || threadHtml)
     ? `<section class="rsec ract"><div class="rsec-h">Activity</div><details class="lacc" data-detkey="${gk}:act"${actOpen}><summary><i class="ltog">›</i><div class="rtx lfirst">${txFirst}</div></summary><div class="lbody">${txRest ? `<div class="rtx">${txRest}</div>` : ''}${discInner}</div></details></section>`
-    : '';
+    : it.logTaskId != null
+      ? `<section class="rsec ract"><div class="rsec-h">Activity</div><details class="lacc" data-detkey="${gk}:act" data-actlog="${it.logTaskId}"${actOpen}><summary><i class="ltog">›</i><div class="rtx lfirst">${saTxRowHtml(['user', it.goalText || it.title])}</div></summary><div class="lbody"><div class="rtx" data-actbody="${it.logTaskId}">${logHtml}</div>${discInner}</div></details></section>`
+      : '';
   const S = (label, body) => body ? `<section class="rsec"><div class="rsec-h">${label}</div>${body}</section>` : '';
   return `<div class="sa-item lg redesign${it.goalId === SA.cur ? ' cur' : ''}" data-gid="${it.goalId}">
     <div class="rhead"><span class="rtag">${it.no != null ? `#${it.no}` : ''}</span><span class="rst"><span class="rdot"></span>In review</span></div>
@@ -8394,11 +8566,10 @@ function saItemHtml(it, i){
     ${S('Also carries', carriesBody)}
     ${S('What to check', checkBody)}
     ${S('Result', reportBody)}
+    ${S('Screenshots', shotsBody)}
     ${S('Steps', stepsBody)}
-    ${S('Answer', it.answer ? `<p class="rbody">${esc(it.answer)}</p>` : '')}
     ${S('Proof', proofInner)}
     ${S('What changed', changedBody)}
-    ${S('Not done', it.risk?.summary ? `<p class="rbody rrisk">${esc(it.risk.summary)}</p>` : '')}
     ${riskHtml}
     ${activitySec}
     ${S('Workflow', saWorkflowHtml(it))}
@@ -8413,6 +8584,40 @@ function saScrollCardToTop(el){
   if (!body || !el) return;
   body.scrollTop += el.getBoundingClientRect().top - body.getBoundingClientRect().top;
 }
+// Fetch one task's frozen implementation log and paint it into the open card. Cached in
+// SA.actLog (including an empty result) so a card can be opened and closed without
+// asking twice. A failure writes an honest line rather than an empty box — the log
+// either exists or it doesn't, and we say which.
+async function saLoadActivityLog(taskId){
+  if (!Number.isFinite(taskId) || SA.actLog[taskId] !== undefined) return;
+  SA.actLog[taskId] = null; // in flight — keeps a second toggle from re-fetching
+  let lines = [];
+  try {
+    const r = await fetch(withKey(`/api/tasks/${taskId}/activity`));
+    lines = r.ok ? ((await r.json()).lines ?? []) : [];
+  } catch { lines = []; }
+  SA.actLog[taskId] = lines;
+  const body = document.querySelector(`#seeall [data-actbody="${taskId}"]`);
+  if (!body) return;
+  body.innerHTML = lines.length
+    ? lines.map((l) => saLogRowHtml(l)).join('')
+    : '<div class="txr res"><span class="w"></span><span class="m">Nothing was logged for this one.</span></div>';
+}
+// After first paint, compute the red box for any card showing a before/after pair and
+// patch that card's node directly — a full re-render here would close every open
+// pulldown just to draw a box. Cached per goal (null included) so it runs once.
+async function saEnhanceShotBoxes(){
+  const targets = SA.items.filter((it) => saShotPair(it.shots, it.run?.compare) && SA.shotBox[it.goalId] === undefined);
+  await Promise.all(targets.map(async (it) => {
+    const pair = saShotPair(it.shots, it.run?.compare);
+    let html = null;
+    try { html = await shotsBoxedHtml(pair.before, pair.after); } catch { html = null; }
+    SA.shotBox[it.goalId] = html;
+    if (!html || !SA.open) return;
+    const host = document.querySelector(`#seeall [data-shotpair="${it.goalId}"]`);
+    if (host) host.innerHTML = html;
+  }));
+}
 function saRender(){
   const S = $('seeall'); if (!S) return;
   const pending = SA.items.filter((x) => x.st === 0);
@@ -8429,7 +8634,14 @@ function saRender(){
     det.addEventListener('toggle', () => {
       const k = det.dataset.detkey;
       if (det.open) SA.detOpen.add(k); else SA.detOpen.delete(k);
+      // Opening Activity is what fetches the implementation log (Masa 2026-07-22:
+      // "開いた時だけ取りに行く"). Closed cards cost nothing; a reopened one is served
+      // from SA.actLog.
+      if (det.open && det.dataset.actlog) saLoadActivityLog(Number(det.dataset.actlog));
     });
+    // A card re-rendered while its Activity was already open (SSE tick) keeps the log
+    // it had — the fetch below no-ops once SA.actLog holds the answer.
+    if (det.open && det.dataset.actlog) saLoadActivityLog(Number(det.dataset.actlog));
   }
   // "ないものは載せない" (Masa): a Proof <img> whose file is missing/broken must never
   // show a broken-image placeholder. proofImg is only a stored filename, so a file that
@@ -8511,6 +8723,7 @@ function saOpen(focusGoalId){
     if (el) saScrollCardToTop(el);
   });
   saFetchDiffs();
+  saEnhanceShotBoxes();
 }
 function saClose(){ SA.open = false; SA.focusGid = null; if (SA.focusTimer) { clearTimeout(SA.focusTimer); SA.focusTimer = null; } $('seeall').classList.remove('open'); }
 // Continuous review (Masa 2026-07-08): move a persistent "current" card with

package/engine/lib.mjs

@@ -534,6 +534,96 @@ export function parseStreamEvents(line) {
   return out;
 }
 
+// ---- CODEX BRIDGE ----------------------------------------------------------
+// The same three wires the product is built out of — the board (the agent's own
+// to-dos), the implementation log (what it actually did), and the thread it can
+// be talked to again in — read from `codex exec --json` instead of `claude -p
+// --output-format stream-json`. Everything above this line stays agent-agnostic:
+// the bridge's whole job is to speak Codex's event vocabulary into the one this
+// engine already has, so nothing downstream branches on which agent ran.
+//
+// The shapes below are transcribed from a real `codex exec --json` run
+// (codex-cli 0.142.4) — see engine/test/codex-bridge.test.mjs, whose fixtures
+// are that run's stdout verbatim rather than a schema we imagined.
+export function parseCodexTodos(items) {
+  return (Array.isArray(items) ? items : [])
+    .map((i) => ({ content: String(i?.text ?? '').trim(), status: i?.completed ? 'completed' : 'pending' }))
+    .filter((t) => t.content);
+}
+
+// Codex reports usage with its own key names AND its own arithmetic: its
+// `input_tokens` INCLUDES the cached ones, where claude reports cache reads as a
+// separate bucket that input_tokens excludes. Adding both as-is counted the
+// cached tokens twice, so the ledger showed a Codex run as far more expensive
+// than it was (measured: ~92k of a ~108k turn was cache). Subtract, so a number
+// from either agent means the same thing.
+export function parseCodexUsage(usage) {
+  if (!usage) return null;
+  const total = usage.input_tokens ?? usage.inputTokens ?? 0;
+  const cached = usage.cached_input_tokens ?? usage.cache_read_input_tokens ?? 0;
+  return {
+    input_tokens: Math.max(0, total - cached),
+    output_tokens: usage.output_tokens ?? usage.outputTokens ?? 0,
+    cache_creation_input_tokens: usage.cache_creation_input_tokens ?? 0,
+    cache_read_input_tokens: cached,
+  };
+}
+
+// Parse one line of `codex exec --json` output into the same event vocabulary
+// parseStreamEvents returns ('session' | 'todos' | 'activity' | 'message' |
+// 'usage'). 'message' rather than 'result' because Codex emits an agent_message
+// per narration step, not once at the end — the caller keeps the last one.
+export function parseCodexEvents(line) {
+  let ev;
+  try { ev = JSON.parse(line); } catch { return []; }
+  if (!ev || typeof ev !== 'object') return [];
+  if (ev.type === 'thread.started' && ev.thread_id) return [{ kind: 'session', id: String(ev.thread_id) }];
+  if (ev.type === 'turn.completed') return [{ kind: 'usage', usage: parseCodexUsage(ev.usage) }];
+  if (ev.type === 'error' && ev.message) return [{ kind: 'error', text: String(ev.message) }];
+  if (!['item.started', 'item.updated', 'item.completed'].includes(ev.type)) return [];
+  const item = ev.item ?? {};
+  if (item.type === 'todo_list') {
+    const todos = parseCodexTodos(item.items);
+    return todos.length ? [{ kind: 'todos', todos }] : [];
+  }
+  if (item.type === 'agent_message' && ev.type === 'item.completed' && item.text) {
+    return [{ kind: 'message', text: String(item.text) }];
+  }
+  // Commands are announced when they start (the log should move while the
+  // worker works, not after) and only mentioned again when they fail.
+  if (item.type === 'command_execution' && item.command) {
+    if (ev.type === 'item.started') return [{ kind: 'activity', text: `Run ${String(item.command)}`.slice(0, 140) }];
+    if (ev.type === 'item.completed' && item.exit_code) {
+      return [{ kind: 'activity', text: `Run ${String(item.command)} (exit ${item.exit_code})`.slice(0, 140) }];
+    }
+    return [];
+  }
+  // File edits are the bulk of what a worker does and were entirely missing from
+  // the log on Codex — the run read as "a few commands and then, somehow, a PR".
+  if (item.type === 'file_change' && ev.type === 'item.completed') {
+    const verb = { add: 'Write', delete: 'Delete' };
+    return (Array.isArray(item.changes) ? item.changes : [])
+      .filter((c) => c?.path)
+      .slice(0, 8)
+      .map((c) => ({ kind: 'activity', text: `${verb[c.kind] ?? 'Edit'} ${String(c.path)}`.slice(0, 140) }));
+  }
+  if (item.type === 'error' && item.message && ev.type === 'item.completed') {
+    return [{ kind: 'error', text: String(item.message) }];
+  }
+  return [];
+}
+
+// Argument list for one `codex exec` run. `resume` continues an existing thread
+// (the id from a previous run's thread.started) — that subcommand takes neither
+// --cd nor --sandbox, so the working directory comes from the spawn's cwd and
+// the sandbox from -c sandbox_mode. Verified against codex-cli 0.142.4.
+export function buildCodexArgs({ model, effort, sandbox, cwd, resume } = {}) {
+  const common = ['--json', '-m', model, '-c', `model_reasoning_effort="${effort}"`, '--skip-git-repo-check'];
+  return resume
+    ? ['exec', 'resume', String(resume), ...common, '-c', `sandbox_mode="${sandbox}"`, '-']
+    : ['exec', ...common, '--sandbox', sandbox, '--cd', cwd, '-'];
+}
+
 // Parse the planner's reply into { entry, tasks }. Accepts either a JSON
 // object {entry, tasks:[...]} or a bare JSON array anywhere in the text;
 // falls back to a single task made from the raw request. Each task may carry
@@ -2219,6 +2309,15 @@ export function workerPrompt(task, goal, lastFailure, agentName = 'claude-code')
     lastFailure ? `\nPREVIOUS ATTEMPT FAILED EXTERNAL VERIFICATION: ${lastFailure}\nYour previous changes are on disk. Diagnose and fix.` : '',
     '',
     'RULES:',
+    // The board is a window onto the agent's own plan — it holds nothing this
+    // layer invented. That only works if the agent keeps a plan where we can see
+    // it. Claude Code reaches for TodoWrite on its own; Codex has the same list
+    // but skips it on anything small (measured 2026-07-22: gpt-5.4-mini emitted
+    // no todo_list even when the REQUEST said "in three steps" — it does emit one
+    // when told to track the work in its to-do list). So ask, once, for every
+    // agent — the instruction is about how to work, never about what the request
+    // is, so no request-type branching enters here.
+    '- 作業の手順は最初に自分の Todo リスト（Claude Code なら TodoWrite、Codex なら todo list）に書き出し、進むたびに更新すること。人はこの Todo を見て進み具合を知る。',
     '- Edit only files inside this directory and this project. Stay on this request; do not wander into unrelated work.',
     // Deliverable fidelity (replaces the old "make the smallest safe change
     // instead of expanding scope"): the request, not our fear of scope, sets
@@ -2251,7 +2350,14 @@ export function workerPrompt(task, goal, lastFailure, agentName = 'claude-code')
     // to use it — that is the worker's call, like the run declaration above.
     // Telling it "screenshot UI changes" would be this layer deciding what kind
     // of request it is, which is the behaviour that produced off-target proof.
-    `- 画面・見た目のあるものを作ったなら、自分でスクリーンショットを撮って見せてよい: \`node ${SHOT_CLI} <URL または HTMLファイル> ${SHOT_DIR}/<名前>.png [--full] [--wait-for <CSSセレクタ>]\`（headless Chrome・前面に出ない）。${SHOT_DIR}/ に置いた画像は Manager が回収して人に見せる（diff には入らない）。撮ったものは Read で自分でも見返せる。`,
+    // ...but only to an agent that can actually take one. Codex runs its shell
+    // inside a sandbox that Chrome cannot start under (measured 2026-07-22 on
+    // codex-cli 0.142.4: the camera fails under `workspace-write` and works only
+    // with the sandbox off — opening network access does not help). Offering it
+    // anyway is not a harmless extra line: the Codex worker tried four times,
+    // then reported the failure instead of the work. Do not ask an agent for
+    // something this machine has proven it cannot do (Masa 2026-07-22).
+    agentName === 'codex' ? '' : `- 画面・見た目のあるものを作ったなら、自分でスクリーンショットを撮って見せてよい: \`node ${SHOT_CLI} <URL または HTMLファイル> ${SHOT_DIR}/<名前>.png [--full] [--wait-for <CSSセレクタ>]\`（headless Chrome・前面に出ない）。${SHOT_DIR}/ に置いた画像は Manager が回収して人に見せる（diff には入らない）。撮ったものは Read で自分でも見返せる。`,
     `- 最後に${replyLang}で2〜4行：何を変えたか・どのファイルか・テスト結果・人間が確認すべき点。`,
   ].filter(Boolean).join('\n');
 }

package/engine/server.mjs

@@ -21,7 +21,7 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
 import { needsProjectFolder, folderLabel, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse } from './lib.mjs';
-import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyVerifyGate, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames } from './lib.mjs';
+import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyVerifyGate, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames } from './lib.mjs';
 import { createSerialQueue } from './lib.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
@@ -1080,54 +1080,49 @@ function runClaude({ prompt, cwd, tools, onEvent, onTodos, resume, model, effort
     });
   });
 }
-function parseCodexUsage(usage) {
-  if (!usage) return null;
-  return {
-    input_tokens: usage.input_tokens ?? usage.inputTokens ?? 0,
-    output_tokens: usage.output_tokens ?? usage.outputTokens ?? 0,
-    cache_creation_input_tokens: usage.cache_creation_input_tokens ?? 0,
-    cache_read_input_tokens: usage.cached_input_tokens ?? usage.cache_read_input_tokens ?? 0,
-  };
-}
-function runCodex({ prompt, cwd, onEvent, permissionMode = 'acceptEdits', model, effort, onChild }) {
+// The Codex half of the worker bridge. Same contract as runClaude, because
+// nothing downstream may care which agent ran: live activity, the agent's own
+// to-dos (the board), the thread id to talk to it again, usage, final message.
+function runCodex({ prompt, cwd, onEvent, onTodos, resume, permissionMode = 'acceptEdits', model, effort, onChild }) {
   return new Promise((done) => {
     const sandbox = permissionMode === 'plan' ? 'read-only' : 'workspace-write';
-    const args = ['exec', '--json', '-m', workerModel('codex', model), '-c', `model_reasoning_effort="${workerEffort('codex', effort)}"`, '--sandbox', sandbox, '--skip-git-repo-check', '--cd', cwd, '-'];
+    const args = buildCodexArgs({ model: workerModel('codex', model), effort: workerEffort('codex', effort), sandbox, cwd, resume });
     const child = spawn('codex', args, { cwd, stdio: ['pipe', 'pipe', 'pipe'] });
     onChild?.(child);
     child.stdin.end(prompt);
-    let result = '', err = '', buf = '', usage = null, timedOut = false, lastAct = '';
+    let result = '', err = '', buf = '', sessionId = null, usage = null, timedOut = false, lastAct = '';
     const timer = setTimeout(() => { timedOut = true; child.kill('SIGTERM'); }, WORKER_TIMEOUT_MS);
     child.stdout.on('data', (d) => {
       buf += d;
       const lines = buf.split('\n'); buf = lines.pop();
       for (const line of lines) {
         if (!line.trim()) continue;
-        try {
-          const ev = JSON.parse(line);
-          if (ev.type === 'item.completed') {
-            const item = ev.item ?? {};
-            if (item.type === 'agent_message' && item.text) {
-              result = item.text;
-              onEvent?.(`✎ ${item.text.trim().replace(/\s+/g, ' ').slice(0, 500)}`);
-            } else if (item.type === 'error' && item.message) onEvent?.(`Error ${item.message}`);
-            else if (item.type === 'command_execution' && item.command) { lastAct = `Run ${item.command}`; onEvent?.(lastAct); }
-          } else if (ev.type === 'turn.completed') {
-            usage = parseCodexUsage(ev.usage);
-          } else if (ev.type === 'error' && ev.message) {
-            err += `${ev.message}\n`;
-            onEvent?.(`Error ${ev.message}`);
-          }
-        } catch {
-          if (line.trim()) lastAct = line.trim().slice(0, 240);
-          onEvent?.(line.trim().slice(0, 240));
+        const evs = parseCodexEvents(line);
+        // A line we cannot parse is still the worker talking — show it rather
+        // than swallow it (how this ran before the bridge existed).
+        if (!evs.length && !line.trim().startsWith('{')) {
+          lastAct = line.trim().slice(0, 240);
+          onEvent?.(lastAct);
+          continue;
+        }
+        for (const ev of evs) {
+          if (ev.kind === 'session') sessionId = ev.id;
+          else if (ev.kind === 'usage') usage = ev.usage;
+          else if (ev.kind === 'todos') onTodos?.(ev.todos);
+          else if (ev.kind === 'message') {
+            result = ev.text;
+            onEvent?.(`✎ ${ev.text.trim().replace(/\s+/g, ' ').slice(0, 500)}`);
+          } else if (ev.kind === 'error') {
+            err += `${ev.text}\n`;
+            onEvent?.(`Error ${ev.text}`);
+          } else { lastAct = ev.text; onEvent?.(ev.text); }
         }
       }
     });
     child.stderr.on('data', (d) => { err += d; });
     child.on('close', (code) => {
       clearTimeout(timer);
-      done({ code, timedOut, result: workerResultText({ result, err, code, timedOut, lastAct, timeoutMs: WORKER_TIMEOUT_MS }), sessionId: null, usage });
+      done({ code, timedOut, result: workerResultText({ result, err, code, timedOut, lastAct, timeoutMs: WORKER_TIMEOUT_MS }), sessionId, usage });
     });
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.39",
+  "version": "0.10.40",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {