@galda/cli 0.10.51 → 0.10.53

package/app/index.html

@@ -7695,6 +7695,7 @@ const AUTH_REASON_TEXT = {
   'logged-out': 'Not signed in to claude. Run `claude` in a terminal and /login, then relaunch the manager from that terminal — tasks are paused until then.',
   'bad-credentials': 'Worker sign-in failed. Check ANTHROPIC_API_KEY, or run `claude` and /login, then relaunch the manager from that terminal.',
   'probe-failed': 'Couldn’t verify claude sign-in. Ensure the `claude` CLI is installed and signed in, then relaunch the manager.',
+  'rate-limited': 'Claude has reached its usage limit. Claude tasks are queued until access resets; Codex tasks can continue now.',
 };
 function renderAuthBanner(auth){
   const bar = $('errbar');

package/engine/claude-models.mjs

@@ -0,0 +1,13 @@
+// Claude Code accepts these stable aliases and resolves them to the current
+// model versions for the active account and provider.
+export const CLAUDE_MODELS = Object.freeze([
+  'sonnet',
+  'fable',
+  'best',
+  'opus',
+  'haiku',
+  'default',
+  'sonnet[1m]',
+  'opus[1m]',
+  'opusplan',
+]);

package/engine/codex-models.mjs

@@ -0,0 +1,42 @@
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+export const FALLBACK_CODEX_MODELS = [
+  'gpt-5.6-sol',
+  'gpt-5.6-terra',
+  'gpt-5.6-luna',
+  'gpt-5.5',
+  'gpt-5.4',
+  'gpt-5.4-mini',
+  'gpt-5.3-codex-spark',
+];
+
+export function parseCodexModelCache(raw, fallback = FALLBACK_CODEX_MODELS) {
+  try {
+    const parsed = JSON.parse(String(raw));
+    const models = Array.isArray(parsed?.models)
+      ? parsed.models
+        .filter((model) => model?.visibility === 'list' && typeof model.slug === 'string')
+        .map((model) => model.slug.trim())
+        .filter(Boolean)
+      : [];
+    return models.length ? [...new Set(models)] : fallback.slice();
+  } catch {
+    return fallback.slice();
+  }
+}
+
+// Codex refreshes this cache itself. Reading it gives Galda the account's real
+// picker catalog without launching Codex, making a network request, or running
+// an installer. Older CLIs and first-run installs simply use the fallback.
+export function loadCodexModels({ cacheFile, readFile = readFileSync } = {}) {
+  const file = cacheFile
+    || process.env.MANAGER_CODEX_MODELS_FILE
+    || join(process.env.CODEX_HOME || join(homedir(), '.codex'), 'models_cache.json');
+  try {
+    return parseCodexModelCache(readFile(file, 'utf8'));
+  } catch {
+    return FALLBACK_CODEX_MODELS.slice();
+  }
+}

package/engine/server.mjs

@@ -20,10 +20,13 @@ import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
-import { needsProjectFolder, folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse } from './lib.mjs';
+import { needsProjectFolder, folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse, isCommandOnPath } from './lib.mjs';
 import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, REPLY_INTENTS, buildReplyIntentPrompt, parseReplyIntent, buildGoalMessage, serializeGoalMessage, parseGoalMessages } from './lib.mjs';
 import { createSerialQueue } from './lib.mjs';
 import { collectProjectRules } from './lib.mjs';
+import { FALLBACK_CODEX_MODELS, loadCodexModels } from './codex-models.mjs';
+import { CLAUDE_MODELS } from './claude-models.mjs';
+import { classifyWorkerPreflight, workerCanStart } from './worker-availability.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
 
@@ -71,8 +74,8 @@ const WORKER_TIMEOUT_MS = Number(process.env.MANAGER_WORKER_TIMEOUT_MS) || 15 *
 // review card showed a truncated report and called it evidence. Keep a cap —
 // this lands in persisted state — but one that fits a real answer.
 const RESULT_MAX = 20000;
-const MODELS = ['sonnet', 'opus', 'haiku'];
-const CODEX_MODELS = ['gpt-5.5', 'gpt-5.4', 'gpt-5.4-mini', 'gpt-5.3-codex-spark'];
+const MODELS = CLAUDE_MODELS;
+let CODEX_MODELS = FALLBACK_CODEX_MODELS.slice();
 const WORKER_AGENTS = ['claude-code', 'codex'];
 const CLAUDE_EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max'];
 const CODEX_EFFORTS = ['low', 'medium', 'high', 'xhigh'];
@@ -647,14 +650,25 @@ let _syncDirtyAgain = false;        // a save landed mid-push → coalesce into
 // Which worker agent CLIs are installed on this machine — the launcher
 // (bin/manager-for-ai.mjs) detects them (codex via a PATH lookup, never executed)
 // and passes the set here. Galda offers only these, so a Codex-only machine gets
-// a working board and a claude-only one never shows Codex. Defaults to Claude
-// Code when unset (tests / running the server directly).
-const envAgents = (process.env.MANAGER_AVAILABLE_AGENTS || 'claude-code')
+// a working board and a claude-only one never shows Codex.
+// The packaged launcher sets MANAGER_AVAILABLE_AGENTS after its safe CLI probe.
+// Direct starts (launchd, `npm start`, development) bypass that launcher, so do
+// the same non-executing PATH lookup here instead of silently becoming
+// Claude-only. Never invoke an agent, npx, or an installer during detection.
+const configuredAgents = process.env.MANAGER_AVAILABLE_AGENTS;
+const detectedAgents = configuredAgents === undefined
+  ? [
+      isCommandOnPath('claude', { pathEnv: process.env.PATH || '', sep: process.platform === 'win32' ? ';' : ':', pathExt: process.env.PATHEXT || '' }) && 'claude-code',
+      isCommandOnPath('codex', { pathEnv: process.env.PATH || '', sep: process.platform === 'win32' ? ';' : ':', pathExt: process.env.PATHEXT || '' }) && 'codex',
+    ].filter(Boolean).join(',')
+  : configuredAgents;
+const envAgents = (detectedAgents || 'claude-code')
   .split(',').map((a) => a.trim()).filter(Boolean);
 const AVAILABLE_AGENTS = resolveConnectedAgents({
   claude: envAgents.includes('claude-code'),
   codex: envAgents.includes('codex'),
 });
+if (AVAILABLE_AGENTS.includes('codex')) CODEX_MODELS = loadCodexModels();
 
 // ---- state ---------------------------------------------------------------
 // Restarts must not lose pending work: tasks that never started stay
@@ -1457,9 +1471,9 @@ function startNextStacked(projectId) {
 // standalone `claude` (runClaude), inheriting the launching shell's login. If
 // that shell has no usable credentials, every task fails late with "Not logged
 // in". We probe once at boot and hold the queue + raise a banner instead of
-// failing task after task. Optimistic default (ok:true) so we never falsely
-// block a correctly-authed setup during the ~1s probe.
-let workerAuth = { ok: true, reason: null, checkedAt: null };
+// failing task after task. Claude waits for the short probe; Codex is gated
+// independently and may start immediately.
+let workerAuth = { ok: null, reason: null, checkedAt: null };
 const publicAuth = () => ({ ok: workerAuth.ok, reason: workerAuth.reason });
 
 // Boot preflight: one cheap Read-only `claude` call; classify the result (pure,
@@ -1468,14 +1482,18 @@ const publicAuth = () => ({ ok: workerAuth.ok, reason: workerAuth.reason });
 async function probeWorkerAuth() {
   try {
     const out = await runClaude({ prompt: 'Reply with the single word: ok', cwd: ROOT, tools: 'Read', model: 'haiku' });
-    workerAuth = { ...classifyAuthProbe({ result: out?.result, code: out?.code }), checkedAt: Date.now() };
+    workerAuth = {
+      ...classifyWorkerPreflight(out, { classifyAuthProbe, isRateLimited }),
+      checkedAt: Date.now(),
+    };
   } catch {
     workerAuth = { ok: false, reason: 'probe-failed', checkedAt: Date.now() };
   }
   console.log(workerAuth.ok
     ? '[manager] worker auth preflight OK'
-    : `[manager] worker auth preflight FAILED (${workerAuth.reason}) — holding the queue. ${authBannerText(workerAuth.reason, 'en')}`);
+    : `[manager] Claude preflight unavailable (${workerAuth.reason}) — holding Claude tasks; Codex may continue.`);
   send({ ev: 'auth', auth: publicAuth() });
+  if (workerAuth.ok) for (const project of projects) pump(project.id);
   return workerAuth;
 }
 
@@ -1641,10 +1659,8 @@ async function authorVerify(task, goal, project) {
 // `lastStartAt` check in pump() below.
 const slowModeLastStart = new Map(); // projectId -> ms epoch of the last task start
 function pump(projectId) {
-  // Worker auth preflight failed → hold the queue (the UI banner tells the user
-  // to sign `claude` in and relaunch). Never spawn a worker that can only fail
-  // with "Not logged in". Cleared automatically once a probe succeeds.
-  if (!workerAuth.ok) return;
+  // A Claude sign-in or usage hold must not stop an installed Codex worker.
+  // Claude work stays queued until a later probe succeeds.
   // Project paused by the user (Doing列の一時停止 / chat) → hold this project's
   // queue exactly like the auth hold above. Resume flips the flag and pumps.
   if (isProjectPaused(projectId)) return;
@@ -1671,7 +1687,8 @@ function pump(projectId) {
     if (wait > 0) { setTimeout(() => pump(projectId), wait); return; }
   }
   const runningGoalIds = [...q.running].map((t) => t.goalId);
-  const toStart = nextRunnableTasks(q.waiting, runningGoalIds, slow.enabled ? 1 : slots);
+  const eligible = q.waiting.filter((task) => workerCanStart({ agent: task.agent, auth: workerAuth }));
+  const toStart = nextRunnableTasks(eligible, runningGoalIds, slow.enabled ? 1 : slots);
   for (const task of toStart) {
     const i = q.waiting.indexOf(task);
     if (i !== -1) q.waiting.splice(i, 1);
@@ -1968,7 +1985,9 @@ function queueReplyTask(goal, text, { from = 'manager', via = 'composer' } = {})
     const projectCap = slow.enabled ? Math.min(PROJECT_MAX_PARALLEL, slow.maxParallel) : PROJECT_MAX_PARALLEL;
     const slots = Math.min(projectCap - q.running.size, GLOBAL_MAX_PARALLEL - globalRunningCount());
     const runningGoalIds = [...q.running].map((t) => t.goalId);
-    const startsNow = nextRunnableTasks(q.waiting, runningGoalIds, slow.enabled ? 1 : slots).some((t) => t.id === task.id);
+    const eligible = q.waiting.filter((candidate) => workerCanStart({ agent: candidate.agent, auth: workerAuth }));
+    const startsNow = workerCanStart({ agent: task.agent, auth: workerAuth })
+      && nextRunnableTasks(eligible, runningGoalIds, slow.enabled ? 1 : slots).some((candidate) => candidate.id === task.id);
     goal.startedAt = startsNow ? new Date().toISOString() : null;
     saveGoal(goal);
   }
@@ -4900,7 +4919,10 @@ server.listen(PORT, '127.0.0.1', () => {
     spawn('open', ['-g', openUrl], { stdio: 'ignore' }).unref();
   }
   console.log(`[manager] projects: ${projects.map((p) => `${p.id}=${p.dir}`).join('  ')}`);
-  probeWorkerAuth().catch(() => {}); // hold the queue + banner if `claude` isn't signed in
+  probeWorkerAuth().catch(() => {}); // hold Claude tasks + banner if Claude is unavailable
+  setInterval(() => {
+    if (!workerAuth.ok) probeWorkerAuth().catch(() => {});
+  }, 5 * 60_000).unref();
   syncAllExternal().catch(() => {});
   syncGoalMerges().catch(() => {});
   setInterval(() => {

package/engine/worker-availability.mjs

@@ -0,0 +1,8 @@
+export function classifyWorkerPreflight({ result = '', code = 0 } = {}, { classifyAuthProbe, isRateLimited }) {
+  if (isRateLimited(result)) return { ok: false, reason: 'rate-limited' };
+  return classifyAuthProbe({ result, code });
+}
+
+export function workerCanStart({ agent, auth } = {}) {
+  return auth?.ok === true || agent === 'codex';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.51",
+  "version": "0.10.53",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {