@galda/cli 0.10.50 → 0.10.52

package/app/index.html

@@ -276,6 +276,17 @@
      .gearpop{}, so out here it was invalid at computed-value time and fell back to
      transparent — measured rgba(0,0,0,0). The chips were never filled to begin with. */
   .ctxbar{display:flex;align-items:center;gap:6px;padding:0 2px 7px;background:none;border:0}
+  /* Feature A: "Replying to #NNN ✕" chip — neutral hairline pill above the composer
+     (real tokens only → theme-adaptive; the ✕ hover moves glyph colour only, §5.5). */
+  .replybind{display:flex;align-items:center;gap:6px;max-width:var(--fscenterw,760px);width:100%;margin:0 auto 6px;padding:0 2px}
+  .replybind[hidden]{display:none}
+  .replybind .rb-seg{display:inline-flex;align-items:center;gap:6px;padding:5px 11px;border-radius:999px;
+    border:1px solid var(--hair);background:var(--panel);font:500 12px/1 var(--ui);color:var(--ink2)}
+  .replybind .rb-seg b{color:var(--ink);font-weight:600;font-family:var(--mono);font-variant-numeric:tabular-nums}
+  .replybind .rb-x{display:grid;place-items:center;width:24px;height:24px;border:0;border-radius:7px;background:transparent;
+    color:var(--ink3);cursor:pointer;transition:color .12s;flex:0 0 24px}
+  .replybind .rb-x:hover{color:var(--ink)}
+  .replybind .rb-x svg{width:13px;height:13px;fill:none;stroke:currentColor;stroke-width:2;stroke-linecap:round;stroke-linejoin:round}
   .ctxchip{display:inline-flex;align-items:center;height:26px;padding:0;gap:0;border-radius:8px;
     border:1px solid var(--hair);background:transparent;position:relative;min-width:0}
   .ctxsel{position:relative}
@@ -2966,6 +2977,9 @@
              reply exists (progressive disclosure — DESIGN-RULES §1.5-3, "存在
              しないものの器を先に見せない"). -->
         <div class="peraanswer" id="chatReply" hidden></div>
+        <!-- Feature A: when the composer is bound to the focused goal, this chip shows
+             which conversation you're replying to; ✕ detaches back to new-goal mode. -->
+        <div class="replybind" id="replyBind" hidden><span class="rb-seg"><span id="replyBindLabel">Replying to</span> <b id="replyBindNum"></b></span><button type="button" class="rb-x" id="replyBindX" title="New goal instead" aria-label="Detach"><svg viewBox="0 0 24 24"><path d="M6 6l12 12M18 6 6 18"/></svg></button></div>
         <div class="composer">
           <div class="attachbar" id="attachbar" style="display:none"></div>
           <!-- Slash-command palette (Masa決定 2026-07-07: chips→slash). Floats
@@ -4260,6 +4274,7 @@ function mergeGoalTimeline(goals, externalActivity, projectId){
 // (.gsummary)が出ていればそこを、まだなければゴールメッセージ全体の末尾を狙う。
 function goToGoalInChat(goalId){
   state.selectedGoal = goalId;
+  renderReplyBind();   // Feature A: the composer's "Replying to #NNN" chip follows the focused goal — renderStream() alone skips it (only render() calls it)
   renderStream();
   const goalEl = document.querySelector(`#stream [data-goalmsg="${goalId}"]`);
   if (!goalEl) return;
@@ -6153,6 +6168,7 @@ $('gdRevisionInput').addEventListener('keydown', (e) => {
 function render(){
   renderProjects(); renderStream(); renderQueue(); renderTasks(); renderActPanel(); wireWfEditButtons();
   renderCtxBar();   // the folder above the composer follows the active project
+  renderReplyBind();   // Feature A: show/hide the "Replying to #NNN" chip for the focused goal
   renderFlagship();
   if (state.reviewOpenGoal != null) renderReviewChecklist();
   if (state.goalDetailOpen != null) renderGoalDetail();
@@ -6881,6 +6897,16 @@ function renderFsTodo(){
   const resumedGoalIds = new Set(pgoals.filter((g) => g.status === 'running' && g.startedAt).map((g) => g.id));
   const doingGoals = pgoals.filter((g) => g.status === 'running' && g.startedAt
     && !runningTaskGoalIds.has(g.id) && !pausedGoalIds.has(g.id));
+  // A reply that was OVER the parallel cap (engine PR #342): the goal is 'running'
+  // but startedAt is cleared, and its only pending work is a QUEUED reply task —
+  // which Doing needs startedAt for, and Next-up excludes (!t.reply). With no
+  // bucket it vanished. Surface these "parked" goals at the TOP of To Do ("最上部",
+  // Masa 2026-07-24) as Queued rows — not "Working on it" (nothing runs yet). They
+  // auto-promote to Doing the moment a slot frees and the engine sets startedAt.
+  const parkedReplyGoals = pgoals.filter((g) => g.status === 'running' && !g.startedAt
+    && !pausedGoalIds.has(g.id) && !runningTaskGoalIds.has(g.id)
+    && list.some((t) => t.goalId === g.id && t.reply && t.status === 'queued')
+    && !list.some((t) => t.goalId === g.id && !t.reply && ['running', 'queued'].includes(t.status)));
   const tt = (s, n) => esc(String(s ?? '').replace(/\s+/g, ' ').slice(0, n ?? 70));
   // LATER = deliberately shelved goals (composer "Later" send → server status 'pending';
   // PRD §8.2 top gap — they were invisible in flagship). Staged disclosure: the cap
@@ -6939,6 +6965,10 @@ function renderFsTodo(){
     + needsInput.map((g) => `<div class="drow err int"><div class="trow now"><span class="st run int"></span>${noSpan(g.id)}<span class="tt">${tt(g.text || g.plan?.[0], 60)}</span><span class="stword int">Needs input</span></div>
       <div class="errline"><div class="msg"><span class="x int">?</span>${tt(g.question?.text || 'A question is waiting on you', 180)}</div>
       <div class="acts2"><button class="errbtn" data-fsglog="${g.id}">Answer</button></div></div></div>`).join('');
+  // Parked over-cap replies ride at the TOP of To Do (above the ordinary Next-up
+  // queue), as neutral "Queued" rows — the same goal-row shape as a resumed Doing
+  // goal but without the green "Working on it", because no worker is running yet.
+  const parkedRows = parkedReplyGoals.map((g) => `<div class="trow up" data-goalid="${g.id}"><span class="st"></span>${noSpan(g.id)}<span class="tt">${tt(g.reviewSummary?.check || g.plan?.[0] || g.text, 60)}</span><span class="stword" style="color:var(--ink3)">Queued</span>${fsActs(g.id)}</div>`).join('');
   const NCAP = 6;
   const upShown = fsUI.todoMore ? queued : queued.slice(0, NCAP);
   const seenGoals = new Set();
@@ -6964,7 +6994,7 @@ function renderFsTodo(){
   // queued.length specifically, since that suffix describes the Next-up sublist's own sort,
   // not the lane total.
   const needsCount = failed.filter((t) => !resumedGoalIds.has(t.goalId)).length + blocked.length + needsInput.length;
-  const todoTotal = running.length + doingGoals.length + needsCount + queued.length + later.length;
+  const todoTotal = running.length + doingGoals.length + parkedReplyGoals.length + needsCount + queued.length + later.length;
   // Free-tier pending counter (H22): on the free plan the header shows the wall
   // — pending goals out of the 5-slot cap — reddening at the cap and gone once
   // paid. Reads the SAME numbers the gate enforces (state.billing, never a local
@@ -6981,7 +7011,7 @@ function renderFsTodo(){
       ${(doingRows || paused) ? `<span class="tlcap tlcap-doing" style="padding-top:0">Doing<button class="tlcap-pause" data-fspause="1" aria-pressed="${paused ? 'true' : 'false'}" title="${paused ? 'Resume — 再開' : 'Pause — 一時停止'}">${paused ? '<svg viewBox="0 0 24 24"><path d="M8 5v14l11-7z"/></svg>' : '<svg viewBox="0 0 24 24"><rect x="6" y="5" width="4" height="14" rx="1"/><rect x="14" y="5" width="4" height="14" rx="1"/></svg>'}</button></span>${doingRows}` : ''}
       ${needsRows ? `<span class="tlcap needs"${(doingRows || paused) ? '' : ' style="padding-top:0"'}>Needs you</span>${needsRows}` : ''}
       ${rejected.length ? `<span class="tlcap rejcap"${(doingRows || paused) || needsRows ? '' : ' style="padding-top:0"'}>Dismissed<span class="num">${rejected.length}</span></span>${rejected.map((g) => `<div class="trow up rej"><span class="st rej"></span>${noSpan(g.id)}<span class="tt">${tt(g.text, 70)}</span><span class="acts"><button class="ab" data-fsreopen="${g.id}" title="Reopen — back to Review">${FS_ICONS.reopen}</button><button class="ab" data-fsrejdel="${g.id}" title="Delete — discard (closes the PR)">${FS_ICONS.del}</button></span></div>`).join('')}` : ''}
-      ${upRows ? `<span class="tlcap"${(doingRows || paused) || needsRows || rejected.length ? '' : ' style="padding-top:0"'}>Next up</span>${upRows}` : ''}
+      ${(parkedRows || upRows) ? `<span class="tlcap"${(doingRows || paused) || needsRows || rejected.length ? '' : ' style="padding-top:0"'}>Next up</span>${parkedRows}${upRows}` : ''}
       ${queued.length > NCAP ? `<div class="morefold" id="fsTodoMore">${fsUI.todoMore ? 'less' : `+${queued.length - NCAP} more`}<span class="g">›</span></div>` : ''}
       ${laterRows ? `<span class="tlcap">Later</span>${laterRows}` : ''}
       <button class="qadd" data-fsnew="1" title="New goal"><span class="paplus"></span>New</button>
@@ -8392,6 +8422,46 @@ function resolveComposer(raw){
     review: !!(msg.review || parsed.review),
   };
 }
+// Feature A (ONE-CONVERSATION §1.2/§1.4 "1本の会話"): the composer CONTINUES the
+// goal you're focused on (state.selectedGoal) instead of always making a new goal
+// — like Claude Code, where you keep talking to the same session. It binds only
+// when that goal is in the ACTIVE project AND in a repliable status: a review goal
+// routes to the AI-decide reply (continue/rescope/split/answer), an in-flight or
+// finished-rework goal takes a plain follow-up. Anything else (done, needsInput,
+// planning/stacked, or nothing selected) → new-goal mode, exactly as before.
+const REPLY_AUTO = new Set(['review']);
+const REPLY_PLAIN = new Set(['running', 'partial', 'failed', 'interrupted', 'blocked']);
+function replyBinding(){
+  const id = state.selectedGoal;
+  if (id == null) return null;
+  const g = state.goals.find((x) => x.id === id);
+  if (!g || g.projectId !== state.active) return null;   // stale after a project switch → new-goal mode
+  // needsInput has NO worker session yet (planGoal() sets it before any task/worker
+  // exists — see engine/server.mjs) — there's no "conversation" to resume via /reply
+  // (that endpoint 409s on needsInput; engine/lib.mjs:3010). Binding here routes to
+  // the SAME /answer endpoint the question card's own free-text box already uses
+  // (fsAnswerQuestion), so the composer becomes a second way to answer, not a new path.
+  if (g.status === 'needsInput' && g.question) return { goal: g, mode: 'answer' };
+  if (REPLY_AUTO.has(g.status)) return { goal: g, mode: 'auto' };
+  if (REPLY_PLAIN.has(g.status)) return { goal: g, mode: 'plain' };
+  return null;
+}
+// The visible, reversible "Replying to #NNN ✕" chip above the composer — never
+// silent (shown whenever bound), always detachable (✕ clears the binding).
+function renderReplyBind(){
+  const el = $('replyBind'); if (!el) return;
+  const b = replyBinding();
+  el.hidden = !b;
+  const inp = $('input');
+  if (b) {
+    const n = goalReviewNumber({ goal: b.goal, tasks: state.tasks }) ?? b.goal.id;
+    const numEl = $('replyBindNum'); if (numEl) numEl.textContent = '#' + n;
+    const lblEl = $('replyBindLabel'); if (lblEl) lblEl.textContent = b.mode === 'answer' ? 'Answering' : 'Replying to';
+    if (inp) inp.placeholder = b.mode === 'answer' ? `Answering #${n}…` : `Reply to #${n}…`;
+  } else if (inp) {
+    inp.placeholder = 'Describe a goal…  ( / for commands )';
+  }
+}
 async function send(){
   const { text, model, effort, mode, skill, later, review } = resolveComposer($('input').value);
   if (!text) return;
@@ -8402,6 +8472,54 @@ async function send(){
   const now = Date.now();
   if (text === _lastSend.text && now - _lastSend.ts < 1500) return;
   _lastSend = { text, ts: now };
+
+  // Feature A: bound to the focused goal → this is a REPLY, not a new goal.
+  // /later and /review are explicit "make a new ticket" intents → detach + fall through.
+  const bind = (later || review) ? null : replyBinding();
+  if (bind) {
+    const batt = state.attach.slice();
+    const fullText = batt.length
+      ? `${text}${text ? '\n\n' : ''}添付画像（workerはこのパスをReadで確認できます）: ${batt.map((a) => a.path).join(', ')}`
+      : text;
+    // same housekeeping as a normal send: the words appear in the feed at once.
+    (state.chatTurns[state.active] ||= []).push({ role: 'you', text, ts: Date.now() });
+    state.attach = [];
+    state.msg = { mode: null, model: null, effort: null, skill: null, later: false, review: false };
+    renderMsgHint();
+    $('input').value = ''; $('input').style.height = 'auto';
+    clearChatReply(); closePalette(); localStorage.removeItem('draft');
+    renderAttach(); render();
+    try {
+      if (bind.mode === 'answer') {
+        // needsInput → same /answer endpoint the question card's own free-text box
+        // uses (fsAnswerQuestion). Plain `text`, not `fullText`: /answer may read the
+        // reply as a literal folder path/choice (routeQuestionAnswer), and the
+        // attachment note appended below would break that matching.
+        const r = await fetch(withKey(`/api/goals/${bind.goal.id}/answer`), { method: 'POST',
+          headers: { 'content-type': 'application/json' }, body: JSON.stringify({ answer: text }) });
+        if (!r.ok) throw new Error();
+        const goal = await r.json();
+        if (goal?.id) upsert(state.goals, goal);
+        render();
+      } else if (bind.mode === 'auto') {
+        // review goal → the AI decides continue/rescope/split/answer (same path as the
+        // review card's own reply box), with the note anchored under the composer.
+        const body = await replyToGoal(bind.goal.id, fullText, '#input');
+        if (body) { upsert(state.goals, body.goal); if (body.task) upsert(state.tasks, body.task); render(); }
+      } else {
+        // running/partial/failed/interrupted/blocked → a plain follow-up on the same goal.
+        const r = await fetch(withKey(`/api/goals/${bind.goal.id}/reply`), { method: 'POST',
+          headers: { 'content-type': 'application/json' }, body: JSON.stringify({ text: fullText }) });
+        if (!r.ok) throw new Error();
+        const g = await r.json(); const goal = g.goal ?? g;
+        if (goal?.id) upsert(state.goals, goal);
+        if (g.task) upsert(state.tasks, g.task);
+        render();
+      }
+    } catch { showErr('Reply failed.'); }
+    return;   // never touches the outbox / POST /api/tasks
+  }
+
   const attach = state.attach.slice();
   const item = {
     oid: `o${Date.now()}-${Math.random().toString(36).slice(2, 7)}`,
@@ -10254,6 +10372,8 @@ $('filein').addEventListener('change', () => {
   for (const f of $('filein').files) uploadFile(f);
   $('filein').value = '';
 });
+// Feature A: ✕ on the "Replying to #NNN" chip detaches → back to new-goal mode.
+$('replyBindX').onclick = () => { state.selectedGoal = null; render(); };
 const IS_MOBILE = () => window.matchMedia('(max-width: 760px)').matches;
 // Phones are chat-first: the Tasks sheet starts FOLDED so the first view is the
 // conversation + composer (the sheet is an 88vw overlay — default-open buried

package/engine/claude-models.mjs

@@ -0,0 +1,13 @@
+// Claude Code accepts these stable aliases and resolves them to the current
+// model versions for the active account and provider.
+export const CLAUDE_MODELS = Object.freeze([
+  'sonnet',
+  'fable',
+  'best',
+  'opus',
+  'haiku',
+  'default',
+  'sonnet[1m]',
+  'opus[1m]',
+  'opusplan',
+]);

package/engine/codex-models.mjs

@@ -0,0 +1,42 @@
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+export const FALLBACK_CODEX_MODELS = [
+  'gpt-5.6-sol',
+  'gpt-5.6-terra',
+  'gpt-5.6-luna',
+  'gpt-5.5',
+  'gpt-5.4',
+  'gpt-5.4-mini',
+  'gpt-5.3-codex-spark',
+];
+
+export function parseCodexModelCache(raw, fallback = FALLBACK_CODEX_MODELS) {
+  try {
+    const parsed = JSON.parse(String(raw));
+    const models = Array.isArray(parsed?.models)
+      ? parsed.models
+        .filter((model) => model?.visibility === 'list' && typeof model.slug === 'string')
+        .map((model) => model.slug.trim())
+        .filter(Boolean)
+      : [];
+    return models.length ? [...new Set(models)] : fallback.slice();
+  } catch {
+    return fallback.slice();
+  }
+}
+
+// Codex refreshes this cache itself. Reading it gives Galda the account's real
+// picker catalog without launching Codex, making a network request, or running
+// an installer. Older CLIs and first-run installs simply use the fallback.
+export function loadCodexModels({ cacheFile, readFile = readFileSync } = {}) {
+  const file = cacheFile
+    || process.env.MANAGER_CODEX_MODELS_FILE
+    || join(process.env.CODEX_HOME || join(homedir(), '.codex'), 'models_cache.json');
+  try {
+    return parseCodexModelCache(readFile(file, 'utf8'));
+  } catch {
+    return FALLBACK_CODEX_MODELS.slice();
+  }
+}

package/engine/lib.mjs

@@ -1609,6 +1609,8 @@ export function resolveGoalSource(input) {
 export const DEFAULT_REVIEW_DEFINITION = {
   requirePR: true,
   requireVerifyPass: false,
+  // OFF by default (Masa 2026-07-25). Opt-in per project; see resolveTestGate.
+  requireTests: false,
   description: '',
   defaultWantsPR: false,
   language: 'auto',
@@ -1616,6 +1618,25 @@ export const DEFAULT_REVIEW_DEFINITION = {
   reviewCard: { screenshots: true, beforeAfter: false },
 };
 
+// Should Galda run its OWN project test suite as a blocking gate? OFF by default
+// (Masa 2026-07-25). Galda is a thin interface over Claude Code: the worker
+// already runs the repo's own tests per its CLAUDE.md and reports proof, so
+// Galda running the full suite a SECOND time only manufactured false
+// "テスト失敗 N件" Failures under machine saturation (audit 2026-07-24 — the same
+// code produced 93→94 / 5→4 varying red counts). With the gate off we never run
+// those tests and so never block/rework on them; the worker's report + proof is
+// what the human reviews. A project (or Masa's own instance) opts INTO a hard,
+// CI-style blocking gate via reviewDefinition.requireTests or MANAGER_VERIFY_GATE=on.
+// `force` is the explicit human "再検証 / Retry" action — a deliberate, per-goal
+// request that always runs the tests regardless of the default.
+export function resolveTestGate({ reviewDefinition = DEFAULT_REVIEW_DEFINITION, env = {}, force = false } = {}) {
+  if (force) return true;
+  const v = String(env.MANAGER_VERIFY_GATE ?? '').trim().toLowerCase();
+  if (v === 'on' || v === '1' || v === 'true') return true;
+  if (v === 'off' || v === '0' || v === 'false') return false;
+  return !!(reviewDefinition && reviewDefinition.requireTests);
+}
+
 // Detects whether text was written in Japanese (kana/kanji present) or not, so
 // generated replies can match the language the request was written in
 // ("test" → English, "テスト" → 日本語) — worker close-out summaries, and (via
@@ -1730,6 +1751,7 @@ export function validateReviewDefinition(input) {
     definition: {
       requirePR: input.requirePR !== undefined ? !!input.requirePR : DEFAULT_REVIEW_DEFINITION.requirePR,
       requireVerifyPass: input.requireVerifyPass !== undefined ? !!input.requireVerifyPass : DEFAULT_REVIEW_DEFINITION.requireVerifyPass,
+      requireTests: input.requireTests !== undefined ? !!input.requireTests : DEFAULT_REVIEW_DEFINITION.requireTests,
       description: input.description !== undefined ? String(input.description).slice(0, 500) : DEFAULT_REVIEW_DEFINITION.description,
       defaultWantsPR: input.defaultWantsPR !== undefined ? !!input.defaultWantsPR : DEFAULT_REVIEW_DEFINITION.defaultWantsPR,
       language: (input.language === 'ja' || input.language === 'en' || input.language === 'auto') ? input.language : DEFAULT_REVIEW_DEFINITION.language,

package/engine/server.mjs

@@ -20,10 +20,12 @@ import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
-import { needsProjectFolder, folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse } from './lib.mjs';
-import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, REPLY_INTENTS, buildReplyIntentPrompt, parseReplyIntent, buildGoalMessage, serializeGoalMessage, parseGoalMessages } from './lib.mjs';
+import { needsProjectFolder, folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse, isCommandOnPath } from './lib.mjs';
+import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, REPLY_INTENTS, buildReplyIntentPrompt, parseReplyIntent, buildGoalMessage, serializeGoalMessage, parseGoalMessages } from './lib.mjs';
 import { createSerialQueue } from './lib.mjs';
 import { collectProjectRules } from './lib.mjs';
+import { FALLBACK_CODEX_MODELS, loadCodexModels } from './codex-models.mjs';
+import { CLAUDE_MODELS } from './claude-models.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
 
@@ -71,8 +73,8 @@ const WORKER_TIMEOUT_MS = Number(process.env.MANAGER_WORKER_TIMEOUT_MS) || 15 *
 // review card showed a truncated report and called it evidence. Keep a cap —
 // this lands in persisted state — but one that fits a real answer.
 const RESULT_MAX = 20000;
-const MODELS = ['sonnet', 'opus', 'haiku'];
-const CODEX_MODELS = ['gpt-5.5', 'gpt-5.4', 'gpt-5.4-mini', 'gpt-5.3-codex-spark'];
+const MODELS = CLAUDE_MODELS;
+let CODEX_MODELS = FALLBACK_CODEX_MODELS.slice();
 const WORKER_AGENTS = ['claude-code', 'codex'];
 const CLAUDE_EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max'];
 const CODEX_EFFORTS = ['low', 'medium', 'high', 'xhigh'];
@@ -647,14 +649,25 @@ let _syncDirtyAgain = false;        // a save landed mid-push → coalesce into
 // Which worker agent CLIs are installed on this machine — the launcher
 // (bin/manager-for-ai.mjs) detects them (codex via a PATH lookup, never executed)
 // and passes the set here. Galda offers only these, so a Codex-only machine gets
-// a working board and a claude-only one never shows Codex. Defaults to Claude
-// Code when unset (tests / running the server directly).
-const envAgents = (process.env.MANAGER_AVAILABLE_AGENTS || 'claude-code')
+// a working board and a claude-only one never shows Codex.
+// The packaged launcher sets MANAGER_AVAILABLE_AGENTS after its safe CLI probe.
+// Direct starts (launchd, `npm start`, development) bypass that launcher, so do
+// the same non-executing PATH lookup here instead of silently becoming
+// Claude-only. Never invoke an agent, npx, or an installer during detection.
+const configuredAgents = process.env.MANAGER_AVAILABLE_AGENTS;
+const detectedAgents = configuredAgents === undefined
+  ? [
+      isCommandOnPath('claude', { pathEnv: process.env.PATH || '', sep: process.platform === 'win32' ? ';' : ':', pathExt: process.env.PATHEXT || '' }) && 'claude-code',
+      isCommandOnPath('codex', { pathEnv: process.env.PATH || '', sep: process.platform === 'win32' ? ';' : ':', pathExt: process.env.PATHEXT || '' }) && 'codex',
+    ].filter(Boolean).join(',')
+  : configuredAgents;
+const envAgents = (detectedAgents || 'claude-code')
   .split(',').map((a) => a.trim()).filter(Boolean);
 const AVAILABLE_AGENTS = resolveConnectedAgents({
   claude: envAgents.includes('claude-code'),
   codex: envAgents.includes('codex'),
 });
+if (AVAILABLE_AGENTS.includes('codex')) CODEX_MODELS = loadCodexModels();
 
 // ---- state ---------------------------------------------------------------
 // Restarts must not lose pending work: tasks that never started stay
@@ -1952,7 +1965,26 @@ function queueReplyTask(goal, text, { from = 'manager', via = 'composer' } = {})
   };
   tasks.push(task);
   saveTask(task);
-  queues.get(goal.projectId).waiting.push(task);
+  const q = queues.get(goal.projectId);
+  q.waiting.push(task);
+  // "空き分は即Doing・あふれ分はTo Do" (Masa 2026-07-24). A re-queued reply used to
+  // keep the goal's stale startedAt from its first run, so the card read DOING even
+  // when no worker could start: reply to N in-review cards with a parallel cap of 2
+  // and all N said "Working on it" while only 2 actually ran. Decide startedAt the
+  // same way pump() will on the next tick — if THIS task is within the runnable set
+  // for the currently-free slots it starts now, so keep it DOING; otherwise it waits
+  // in To Do (QUEUED) until a slot frees, where runTask() sets startedAt and it
+  // auto-promotes to DOING. Only for a goal with no live worker of its own: a
+  // follow-up reply to an already-running goal must stay DOING (its clock stands).
+  if (goal.status === 'running' && ![...q.running].some((t) => t.goalId === goal.id)) {
+    const slow = slowModeSettings();
+    const projectCap = slow.enabled ? Math.min(PROJECT_MAX_PARALLEL, slow.maxParallel) : PROJECT_MAX_PARALLEL;
+    const slots = Math.min(projectCap - q.running.size, GLOBAL_MAX_PARALLEL - globalRunningCount());
+    const runningGoalIds = [...q.running].map((t) => t.goalId);
+    const startsNow = nextRunnableTasks(q.waiting, runningGoalIds, slow.enabled ? 1 : slots).some((t) => t.id === task.id);
+    goal.startedAt = startsNow ? new Date().toISOString() : null;
+    saveGoal(goal);
+  }
   // Spawn the worker on the NEXT event-loop turn, not synchronously here. runTask() runs
   // straight through to its first await — and that stretch includes goalWorkDir()'s
   // `git worktree add` (measured 1.78s on a checkout with ~135 worktrees). Callers like
@@ -2234,7 +2266,14 @@ async function runTask(task) {
   const project = projects.find((p) => p.id === task.projectId);
   const goal = goals.find((g) => g.id === task.goalId);
   task.status = 'running'; task.startedAt = new Date().toISOString();
-  if (goal && !goal.startedAt && !task.reply) { goal.startedAt = task.startedAt; saveGoal(goal); }
+  // The goal's "started" clock is set by the first task that actually runs — the
+  // signal the board uses to read a 'running' goal as DOING rather than QUEUED
+  // (app GOAL_CHIP). A reply task counts too now: an over-cap re-queued reply
+  // parks the goal in To Do with startedAt cleared (see queueReplyTask), and this
+  // is where it flips to DOING the moment a worker slot frees and it starts. The
+  // `!goal.startedAt` guard still protects an already-running goal (a follow-up
+  // reply while its worker is live never resets the clock).
+  if (goal && !goal.startedAt) { goal.startedAt = task.startedAt; saveGoal(goal); }
   saveTask(task);
   sendProcessAct(task, `Working on "${task.title}"${task.reply ? ' as a follow-up' : ''}.`);
 
@@ -2992,7 +3031,7 @@ function computeGoalRisk(goal, project, siblings) {
 // UI change — capturing it (3 tries) if missing. Any failure → 'blocked' (shown
 // in Attention with the reason); otherwise → review/done via nextGoalStatus.
 // Nothing reaches Review that a human can't judge.
-async function verifyGate(goal, prProject, siblings, baseProject, activityTask = null) {
+async function verifyGate(goal, prProject, siblings, baseProject, activityTask = null, { forceTests = false } = {}) {
   const goalAct = (line) => { if (activityTask) sendProcessAct(activityTask, line); };
   const wdir = prProject.dir;
   const reviewDefinition = getReviewDefinition(goal.projectId);
@@ -3000,10 +3039,20 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
   const allDone = siblings.every(taskCountsAsComplete);
   const allVerified = judged.length > 0 && judged.every((t) => t.proof?.pass === true);
   const changedFiles = [...new Set(siblings.flatMap((t) => t.changedFiles ?? []))].filter((f) => f && !SCRATCH_FILE_RE.test(f));
-  if (hasTestRelevantChanges(changedFiles)) {
+  // Galda's own test gate is OFF by default (Masa 2026-07-25) — the worker already
+  // ran the repo's own tests per its CLAUDE.md, and running the full suite again
+  // here only manufactured false Failures under machine saturation. Opt in per
+  // project (requireTests) or via MANAGER_VERIFY_GATE=on; the human "再検証/Retry"
+  // path forces it on for that one goal. When off, testResult.ran stays false, so
+  // testsFailing below is false and the goal never blocks or auto-reworks on tests.
+  const testGateOn = resolveTestGate({ reviewDefinition, env: process.env, force: forceTests });
+  if (testGateOn && hasTestRelevantChanges(changedFiles)) {
     goalAct(`Running project tests in the goal worktree (${changedFiles.length} changed file${changedFiles.length === 1 ? '' : 's'}).`);
     goal.testResult = await runProjectTests(wdir);
     goalAct(`Project tests finished: ${goal.testResult.failed ?? 0} failed, ${goal.testResult.passed ?? 0} passed.`);
+  } else if (!testGateOn) {
+    goal.testResult = { ran: false, skipped: true, skippedReason: 'test gate off (opt-in: requireTests / MANAGER_VERIFY_GATE=on)' };
+    goalAct("Skipped Galda's test gate (off by default): the worker runs the repo's own tests per its CLAUDE.md — enable a blocking gate with requireTests / MANAGER_VERIFY_GATE=on.");
   } else {
     goal.testResult = { ran: false, skipped: true, skippedReason: changedFiles.length ? 'documentation-only change' : 'no changed files' };
     goalAct(`Skipped project tests: ${goal.testResult.skippedReason}.`);
@@ -4410,7 +4459,9 @@ const server = createServer(async (req, res) => {
     if (!project) return json(res, 404, { error: 'project not found' });
     const siblings = tasks.filter((t) => t.goalId === goal.id);
     const wdir = (goalWorkDirs.get(goal.id) && existsSync(goalWorkDirs.get(goal.id))) ? goalWorkDirs.get(goal.id) : project.dir;
-    await verifyGate(goal, { ...project, dir: wdir }, siblings, project);
+    // 再検証 is the explicit human "run the tests now" — force the gate on for this
+    // one goal even when the default (automatic) gate is off.
+    await verifyGate(goal, { ...project, dir: wdir }, siblings, project, null, { forceTests: true });
     saveGoal(goal);
     return json(res, 200, goal);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.50",
+  "version": "0.10.52",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {