@galda/cli 0.10.7 → 0.10.9

package/bin/manager-for-ai.mjs

@@ -86,6 +86,13 @@ process.env.MANAGER_OPEN_BROWSER = process.env.MANAGER_OPEN_BROWSER ?? '1';
 // and serves the whole API (/connect, /checkout, /api/*). See [[no-a2c-tech]].
 process.env.MANAGER_BILLING_API_URL = process.env.MANAGER_BILLING_API_URL ?? 'https://galda.app';
 process.env.RELAY_URL = process.env.RELAY_URL ?? 'wss://app.galda.app/agent';
+// The named app the user actually works in (over the relay). The CLI opens THIS,
+// not the localhost board, in the hosted flow. Override for a self-hosted app.
+process.env.MANAGER_APP_URL = process.env.MANAGER_APP_URL ?? 'https://app.galda.app';
+// `npx @galda/cli --signin` forces the Google sign-in even if a license already
+// exists — the way to switch to a different account (a stale token otherwise
+// binds you to the previous account).
+if (process.argv.includes('--signin') || process.argv.includes('--login')) process.env.MANAGER_FORCE_SIGNIN = '1';
 // Choose a free port now and pin it for BOTH the server and the relay-client, so
 // a busy 4400 (another manager) no longer stops onboarding — no MANAGER_PORT by hand.
 const wantedPort = Number(process.env.MANAGER_PORT ?? 4400);

package/engine/lib.mjs

@@ -2400,3 +2400,55 @@ export async function verifyLicenseToken({ token, publicJwk = LICENSE_PUBLIC_JWK
 export function shouldEmitSetupCompleted({ isMcpClient, alreadySeen, flagExists }) {
   return Boolean(isMcpClient) && !alreadySeen && !flagExists;
 }
+
+// Onboarding funnel: a goal can only produce real changes if it runs inside a
+// real code repo. When the agent is started ad-hoc (e.g. `node bin/...` in the
+// user's HOME), the seeded default project points at a non-repo dir → the
+// worker no-ops (nothing to edit) yet the goal is marked "done" — the exact
+// blocker for "実装が始まる". This decides, BEFORE running, whether we must ask
+// the user which folder to work in. `isRepo` is passed in (the git probe is
+// I/O, done by the caller) so this stays pure/testable. Home is never a valid
+// work root — even a git-init'd home dir is "no project chosen yet".
+export function needsProjectFolder({ dir, homeDir, isRepo } = {}) {
+  if (!dir) return true;
+  const norm = (p) => String(p).replace(/\/+$/, '');
+  if (homeDir && norm(dir) === norm(homeDir)) return true;
+  return !isRepo;
+}
+
+// A short, ≤60-char display label for a repo dir, shown home-relative (~/…) so
+// the folder-choice options read cleanly on the board card.
+export function folderLabel(dir, homeDir = '') {
+  if (!dir) return '';
+  let d = String(dir);
+  const h = String(homeDir || '').replace(/\/+$/, '');
+  if (h && (d === h || d.startsWith(h + '/'))) d = '~' + d.slice(h.length);
+  return d.length <= 60 ? d : '…' + d.slice(-59);
+}
+
+// Build the "which folder should I work in?" clarifying question from detected
+// repos. Reuses the existing needsInput card ({text, options:string[]}), and
+// adds kind:'folder' + folders[] + lang so the /answer handler rebinds the
+// goal's project to the chosen repo (instead of appending to goal.text like a
+// task clarification). `folders` = [{label, dir}]. Options are capped/shaped to
+// what the board expects (≤8 entries, each ≤60 chars) with a trailing
+// "somewhere else" escape for a typed path.
+export function buildFolderQuestion(folders = [], { lang = 'ja' } = {}) {
+  const capped = folders.slice(0, 7).map((f) => ({ label: String(f.label || f.dir || ''), dir: f.dir }));
+  const other = lang === 'en' ? 'Somewhere else…' : '別の場所を指定…';
+  const text = lang === 'en' ? 'Which folder should I work in?' : 'どのフォルダで実装しますか？';
+  return { text, options: [...capped.map((f) => f.label), other], folders: capped, kind: 'folder', lang, other };
+}
+
+// Resolve a folder-choice answer (a picked option label, or a typed path) back
+// to an absolute dir. Returns { dir } or null (→ the "somewhere else" sentinel /
+// an unrecognized answer, which the caller re-asks on). Match by label first,
+// then exact dir, then treat an absolute-looking answer as a literal path.
+export function resolveFolderAnswer(answer, folders = []) {
+  const a = String(answer ?? '').trim();
+  if (!a) return null;
+  const hit = folders.find((f) => f.label === a || f.dir === a);
+  if (hit) return { dir: hit.dir };
+  if (a.startsWith('/') || a.startsWith('~')) return { dir: a };
+  return null;
+}

package/engine/server.mjs

@@ -13,13 +13,14 @@
 
 import { createServer } from 'node:http';
 import { spawn, execFile, spawnSync } from 'node:child_process';
-import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, statSync } from 'node:fs';
+import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, statSync, readdirSync } from 'node:fs';
 import { emitEvent } from './analytics-client.mjs';
 import { randomBytes, createHash } from 'node:crypto';
 import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
+import { needsProjectFolder, folderLabel, buildFolderQuestion, resolveFolderAnswer } from './lib.mjs';
 import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken, shouldEmitSetupCompleted } from './lib.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
@@ -53,7 +54,7 @@ function maybeEmitSetupCompleted(req) {
   _setupClientSeen = true;
   if (!shouldEmitSetupCompleted({ isMcpClient: true, alreadySeen: false, flagExists: existsSync(SETUP_FLAG) })) return;
   try { writeFileSync(SETUP_FLAG, String(Date.now())); } catch { /* best effort — still emit */ }
-  emitEvent('signup', ANALYTICS_UID, { source: 'mcp-connect' });
+  emitEvent('signup', analyticsUid(), { source: 'mcp-connect' });
 }
 // Per-worker run cap. Env-configurable so it can be tuned operationally and the
 // timeout→'interrupted' path is testable (a test sets a short value + a slow
@@ -151,6 +152,15 @@ const MANAGER_OWNER_EMAIL = process.env.MANAGER_OWNER_EMAIL ?? '';
 // still works standalone (e.g. for Collaborators / dev) with no billing-api
 // configured at all.
 const BILLING_API_URL = (process.env.MANAGER_BILLING_API_URL ?? '').replace(/\/$/, '');
+// The user's real UI in the hosted flow is the NAMED app (app.galda.app),
+// reached over the relay — never the localhost board (Masa 2026-07-15:
+// 「npm→ターミナル→app.galda.appに戻る / localhostでなくアプリ名で開くべき」).
+// The localhost board stays the entry only for local/dev (no billing) runs.
+const APP_URL = (process.env.MANAGER_APP_URL ?? '').replace(/\/$/, '');
+// Force the sign-in flow even when a license already exists — so a user can
+// switch to a different Google account (a stale token from a previous account
+// otherwise silently binds the relay to the wrong account). Set by `--signin`.
+const FORCE_SIGNIN = process.env.MANAGER_FORCE_SIGNIN === '1';
 const entitlementCache = new Map(); // billing email -> { isPaying, checkedAt }
 
 // License token (local-first identity, docs/BILLING-LAUNCH-PLAN.md): a signed
@@ -165,6 +175,14 @@ const entitlementCache = new Map(); // billing email -> { isPaying, checkedAt }
 const licenseFile = join(DATA_DIR, 'license.token');
 let licenseState = { email: null, isPaying: false, verifiedAt: 0 }; // in-memory cache of the last successful verify (isPaying is the token's snapshot; the live gate re-checks)
 
+// Analytics identity (A+): once signed in, scope usage events to the ACCOUNT
+// (the billing Worker hashes this email → the same account_id the accounts table
+// carries, so per-user app activity joins WITHOUT a cookie). Not signed in →
+// the anonymous per-install id. Raw email never lands in usage_events (the
+// Worker pseudonymizes it server-side).
+function analyticsUid() { return licenseState.email || ANALYTICS_UID; }
+let _freeExhaustedEmitted = false;
+
 // One-time nonces for the "Sign in with Google" loopback (GET /api/signin-url →
 // billing /connect → Google → billing → GET /oauth/callback). The engine issues
 // the nonce, round-trips it through the flow, and requires it back — so a random
@@ -215,12 +233,17 @@ function signinResultPage(outcome) {
   const body = outcome.ok
     ? `<h1>Signed in</h1><p>You're signed in as <b>${esc(outcome.email)}</b>. This tab will close automatically.</p>`
     : `<h1>Sign-in didn't complete</h1><p>${esc(outcome.error)}</p><p class="muted">Close this tab and click “Sign in with Google” again in the app.</p>`;
+  // When the sign-in was opened FROM the app tab (window.opener present), tell
+  // it and close. When it was opened by the CLI at startup (no opener — `open`
+  // can't script-close it), don't strand the user on a localhost page: send them
+  // to the named app so the flow is npm → terminal → app.galda.app.
+  const goApp = outcome.ok && APP_URL ? JSON.stringify(APP_URL) : 'null';
   return `<!doctype html><meta charset="utf-8"><title>Galda</title>` +
     `<body style="font:15px/1.6 -apple-system,system-ui,sans-serif;max-width:32rem;margin:12vh auto;padding:0 1.5rem;color:#111">` +
     `<style>h1{font-size:1.35rem;margin:0 0 .5rem}.muted{color:#888;font-size:.9rem}b{font-weight:600}</style>` +
     body +
-    `<script>try{if(window.opener)window.opener.postMessage(${payload},'*')}catch(e){}` +
-    (outcome.ok ? `setTimeout(function(){try{window.close()}catch(e){}},1200);` : '') +
+    `<script>var opened=false;try{if(window.opener){window.opener.postMessage(${payload},'*');opened=true;}}catch(e){}` +
+    (outcome.ok ? `var app=${goApp};setTimeout(function(){if(opened){try{window.close()}catch(e){}}else if(app){location.replace(app)}else{try{window.close()}catch(e){}}},900);` : '') +
     `</script></body>`;
 }
 
@@ -347,7 +370,7 @@ async function requireEntitlementGate(identity) {
   const usage = { ...existing, pendingCount: existing.pendingCount + 1, cumulativeCount: existing.cumulativeCount + 1 };
   if (!checkFreeTierLimit(usage).blocked) return { allowed: true, blocked: null };
   const billingEmail = licenseState.email;
-  if (!billingEmail) return resolveEntitlement({ isOwner: false, isPaying: false, usage });
+  if (!billingEmail) { const r = resolveEntitlement({ isOwner: false, isPaying: false, usage }); noteFreeExhausted(r); return r; }
   const cachedState = resolveCachedEntitlement({ cached: entitlementCache.get(billingEmail) ?? null });
   let isPaying = cachedState.isPaying;
   if (cachedState.needsRefresh) {
@@ -357,7 +380,17 @@ async function requireEntitlementGate(identity) {
       entitlementCache.set(billingEmail, { isPaying: fresh, checkedAt: Date.now() });
     }
   }
-  return resolveEntitlement({ isOwner: false, isPaying, usage });
+  const result = resolveEntitlement({ isOwner: false, isPaying, usage });
+  noteFreeExhausted(result);
+  return result;
+}
+// Emit one free_exhausted funnel event the first time a non-paying install is
+// blocked by the free-tier cap (the funnel dedupes by distinct account/install,
+// so once-per-session is enough).
+function noteFreeExhausted(result) {
+  if (_freeExhaustedEmitted || !result?.blocked) return;
+  _freeExhaustedEmitted = true;
+  emitEvent('free_exhausted', analyticsUid());
 }
 // The acting identity for a request: 'owner' for key-auth or
 // MANAGER_OWNER_EMAIL, else the verified Google email itself. Stamped onto
@@ -428,6 +461,10 @@ async function authFromCfAccess(req) {
   }
 }
 
+// Where to look for the user's repos (folder-choice options) and which dir is
+// "not a real project" (never a valid work root). Defaults to the OS home;
+// overridable for tests / operators whose repos live elsewhere.
+const HOME = process.env.MANAGER_SCAN_HOME || homedir();
 const projectsFile = join(DATA_DIR, 'projects.json');
 if (!existsSync(projectsFile)) {
   const cwd = process.cwd();
@@ -573,12 +610,12 @@ function emitTaskAnalytics(t) {
   if (!t || t.id == null) return;
   if (!_analyticsEmitted.has(`created:${t.id}`)) {
     _analyticsEmitted.add(`created:${t.id}`);
-    emitEvent('task_created', ANALYTICS_UID, { source: 'engine' });
+    emitEvent('task_created', analyticsUid(), { source: 'engine' });
   }
   const ev = _TERMINAL_EVENT[t.status];
   if (ev && !_analyticsEmitted.has(`${t.status}:${t.id}`)) {
     _analyticsEmitted.add(`${t.status}:${t.id}`);
-    emitEvent(ev, ANALYTICS_UID, { status: t.status, source: 'engine' });
+    emitEvent(ev, analyticsUid(), { status: t.status, source: 'engine' });
     postHistory(t);
   }
 }
@@ -784,6 +821,30 @@ function repoDefaultBranch(dir) {
   try { return gitSync(dir, ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD']).replace(/^origin\//, ''); }
   catch { return 'main'; }
 }
+// Non-throwing "is this a real git work tree?" probe. The onboarding guard uses
+// it to refuse running a goal against a non-repo (which would no-op) and to
+// validate a folder the user picks.
+function isGitRepo(dir) {
+  try { return !!dir && existsSync(dir) && gitSync(dir, ['rev-parse', '--is-inside-work-tree']) === 'true'; }
+  catch { return false; }
+}
+// Shallow-scan the user's HOME for candidate repos to offer as folder choices
+// (depth-1: direct children of HOME with a `.git` — matches how devs keep repos
+// side by side, and stays fast/safe vs. a deep `find`). The typed-path escape
+// in the folder question covers anything deeper.
+function detectRepos(homeDir) {
+  const out = [];
+  try {
+    for (const name of readdirSync(homeDir)) {
+      if (name.startsWith('.')) continue;
+      const dir = join(homeDir, name);
+      try {
+        if (statSync(dir).isDirectory() && existsSync(join(dir, '.git'))) out.push({ dir, label: folderLabel(dir, homeDir) });
+      } catch { /* unreadable entry — skip */ }
+    }
+  } catch { /* unreadable home — return whatever we have */ }
+  return out.slice(0, 12);
+}
 // Each goal works in its OWN git worktree, branched fresh from origin/<default>,
 // under <repo>/.manager-wt/goal-<id>. So: (1) the user's real working dir is
 // never touched; (2) each goal's diff contains only that goal's changes on top
@@ -2661,11 +2722,25 @@ const server = createServer(async (req, res) => {
         // no PR) — the reviewer just Approves (files it) or Dismisses (drops
         // it). This is how "needs my judgment" reaches the phone without kicking
         // off an implementation run.
+        // Onboarding funnel (docs/HANDOFF-ONBOARDING-conversational.md): a real
+        // implementation goal can only produce changes inside a real code repo.
+        // If the active project points at a non-repo (e.g. the HOME dir when the
+        // agent was started ad-hoc), running would no-op — nothing to edit — yet
+        // report "done". Instead of that fake "fixed", ask which folder first,
+        // reusing the needsInput clarifying card; the answer (POST /answer)
+        // rebinds this goal to the chosen repo, then planning proceeds. Skipped
+        // for pending/review items (they never spawn a worker).
+        const runnable = !pending && !review;
+        const needsFolder = runnable && needsProjectFolder({ dir: project.dir, homeDir: HOME, isRepo: isGitRepo(project.dir) });
+        const folderQuestion = needsFolder
+          ? buildFolderQuestion(detectRepos(HOME), { lang: /[぀-ヿ㐀-鿿]/.test(text) ? 'ja' : 'en' })
+          : undefined;
         const goalAgent = workerAgent(agent);
         const priorFailureMemory = recentProjectFailureMemory(projectId, text.trim());
         const goal = {
           id: nextId++, projectId, text: text.trim().slice(0, 8000),
-          status: review ? 'review' : pending ? 'pending' : 'planning',
+          status: needsFolder ? 'needsInput' : review ? 'review' : pending ? 'pending' : 'planning',
+          question: folderQuestion,
           reviewOnly: review ? true : undefined,
           note: review && typeof note === 'string' && note.trim() ? note.trim().slice(0, 8000) : undefined,
           wantsPR: review ? false : resolveWantsPR(pr, text, getReviewDefinition(projectId).defaultWantsPR),
@@ -2695,7 +2770,7 @@ const server = createServer(async (req, res) => {
         // pending = deliberately shelved (Phase 2 material): never planned,
         // never queued, until POST /api/goals/:id/activate. review-only items
         // are terminal-until-human too, so they also skip planGoal.
-        if (!pending && !review) {
+        if (runnable && !needsFolder) {
           planGoal(goal).catch((e) => {
             goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal);
           });
@@ -2994,6 +3069,34 @@ const server = createServer(async (req, res) => {
       let answer = '';
       try { answer = String(JSON.parse(body || '{}').answer ?? '').trim(); } catch {}
       if (!answer) return json(res, 400, { error: 'answer required' });
+      // Folder-choice answer (onboarding funnel): rebind the goal to the chosen
+      // repo rather than appending to goal.text — a folder isn't a task
+      // clarification. Validate it's a real repo (and not HOME); if not, re-ask
+      // with a fresh detected list so we never fall through to a no-op run.
+      if (goal.question?.kind === 'folder') {
+        const resolved = resolveFolderAnswer(answer, goal.question.folders || []);
+        let dir = resolved?.dir || answer;
+        if (dir.startsWith('~')) dir = join(HOME, dir.slice(1).replace(/^\/+/, ''));
+        if (dir !== HOME && isGitRepo(dir)) {
+          const existing = projects.find((p) => p.dir === dir);
+          let proj = existing;
+          if (!proj) {
+            proj = { id: uniqueProjectId(basename(dir)), name: basename(dir), dir };
+            projects.push(proj); saveProjects();
+          }
+          goal.projectId = proj.id;
+          goal.question = null;
+          goal.clarified = true;
+          goal.status = 'planning';
+          saveGoal(goal);
+          planGoal(goal).catch((e) => { goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal); });
+          return json(res, 200, goal);
+        }
+        // not a usable repo → keep asking (don't run a no-op)
+        goal.question = buildFolderQuestion(detectRepos(HOME), { lang: goal.question.lang || 'ja' });
+        saveGoal(goal);
+        return json(res, 200, goal);
+      }
       goal.text = `${goal.text}\n[確認: ${goal.question?.text ?? ''} → ${answer}]`;
       goal.clarified = true; // answered once → planGoal must never re-ask (persisted via saveGoal)
       goal.question = null;
@@ -3357,15 +3460,22 @@ server.on('error', (e) => {
 server.listen(PORT, '127.0.0.1', () => {
   console.log(`[manager] Manager for AI → http://localhost:${PORT}/?key=${ACCESS_KEY}`);
   if (process.env.MANAGER_OPEN_BROWSER === '1' && process.platform === 'darwin') {
-    // First run in the hosted flow (no license yet, billing worker configured):
-    // open the one-click Google device-link straight away instead of the local
-    // ?key board, so a non-engineer never sees a localhost URL or an access key —
-    // they sign in once and their hosted board comes alive (relay-client rebinds
-    // via its license.token watcher). Otherwise open the local board as before.
+    // Hosted flow (billing worker + named app configured): the user lives in
+    // app.galda.app, driven over the relay — they must NEVER be dropped on a
+    // localhost board or an access key (Masa 2026-07-15: 「npm→ターミナル→
+    // app.galda.appに戻る」). Not signed in (or switching accounts via --signin)
+    // → one-click Google sign-in; already signed in → straight to the app (the
+    // board comes alive as relay-client rebinds via its license.token watcher).
+    // The localhost ?key board stays the entry ONLY for local/dev (no billing).
     let openUrl = `http://localhost:${PORT}/?key=${ACCESS_KEY}`;
-    if (BILLING_API_URL && !existsSync(licenseFile)) {
-      openUrl = `${BILLING_API_URL}/connect?port=${PORT}&state=${encodeURIComponent(newSigninNonce())}`;
-      console.log('[manager] first run: opening one-click sign-in (no local key needed) → ' + openUrl);
+    if (BILLING_API_URL && APP_URL) {
+      const signedIn = existsSync(licenseFile) && !FORCE_SIGNIN;
+      openUrl = signedIn
+        ? APP_URL
+        : `${BILLING_API_URL}/connect?port=${PORT}&state=${encodeURIComponent(newSigninNonce())}`;
+      console.log(signedIn
+        ? `[manager] opening your app → ${APP_URL}`
+        : `[manager] ${FORCE_SIGNIN ? 'switching account' : 'first run'}: opening one-click sign-in → ${openUrl}`);
     }
     spawn('open', ['-g', openUrl], { stdio: 'ignore' }).unref();
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.7",
+  "version": "0.10.9",
   "type": "module",
   "description": "Galda - hand off work to your Claude Code, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {