@galda/cli 0.10.8 → 0.10.10

package/app/index.html

@@ -2387,7 +2387,7 @@
   <div class="perahead" style="border-bottom:1px solid var(--hair)"><div class="peratitle">Settings</div><span style="flex:1"></span><button class="mbtn ghost" id="setClose">Close</button></div>
   <div style="padding:16px">
     <div class="setrow"><div><div class="setlabel">Content language</div><div class="setsub">UI is English; this sets the language of AI summaries and PR bodies.</div></div>
-      <div class="segbtn" id="langSeg"><button data-lang="en">English</button><button data-lang="ja">日本語</button></div></div>
+      <div class="segbtn" id="langSeg"><button data-lang="auto">Auto</button><button data-lang="en">English</button><button data-lang="ja">日本語</button></div></div>
   </div>
 </div></div>
 <!-- Slack-style centered delete confirmation, replacing native confirm() for every goal
@@ -2586,7 +2586,7 @@ function prioBadge(t){
 // Mirrors engine/lib.mjs DEFAULT_REVIEW_DEFINITION — kept in sync manually,
 // see the comment on DEFAULT_WORKFLOW_COLUMNS above.
 const DEFAULT_REVIEW_DEFINITION = {
-  requirePR: true, requireVerifyPass: false, description: '', defaultWantsPR: false, language: 'ja',
+  requirePR: true, requireVerifyPass: false, description: '', defaultWantsPR: false, language: 'auto',
   prSections: { summary: true, whatChanged: true, howToReview: true, tests: true, screenshots: true, risk: true },
   reviewCard: { screenshots: true, beforeAfter: false },
 };
@@ -2598,7 +2598,10 @@ function reviewDefinitionFor(projectId){ return state.reviewDefinitions[projectI
 // review-definitions.json entries are never re-validated on server load), so
 // merge with the defaults key-by-key here rather than assuming they exist.
 function reviewCardConfigFor(projectId){ return { ...DEFAULT_REVIEW_DEFINITION.reviewCard, ...(reviewDefinitionFor(projectId).reviewCard ?? {}) }; }
-function reviewLangFor(projectId){ return reviewDefinitionFor(projectId).language === 'en' ? 'en' : 'ja'; }
+// 'auto'|'ja'|'en' verbatim — 'auto' (default) means the Manager matches each
+// goal's own request language, same as the planner/worker; ja/en pin the
+// project to one language regardless of what a given goal was typed in.
+function reviewLangFor(projectId){ const l = reviewDefinitionFor(projectId).language; return (l === 'en' || l === 'ja') ? l : 'auto'; }
 
 function esc(s){ const d = document.createElement('div'); d.textContent = s ?? ''; return d.innerHTML; }
 
@@ -3911,6 +3914,7 @@ function renderRdEditor(){
 
     <div class="rdsub">出力言語 / Output language</div>
     <label class="rdrow"><select id="rdLanguage">
+        <option value="auto"${state.rdDraft.language === 'auto' ? ' selected' : ''}>Auto (match request)</option>
         <option value="ja"${state.rdDraft.language === 'ja' ? ' selected' : ''}>日本語</option>
         <option value="en"${state.rdDraft.language === 'en' ? ' selected' : ''}>English</option>
       </select>
@@ -7419,6 +7423,7 @@ function gearSetHTML(){
   }
   return `
   <div class="srow"><div class="sl">Language<span class="sd">Review checklist language for this project</span></div>
+    <button class="optchip${lang === 'auto' ? ' on' : ''}" data-gslang="auto">Auto</button>
     <button class="optchip${lang === 'en' ? ' on' : ''}" data-gslang="en">EN</button>
     <button class="optchip${lang === 'ja' ? ' on' : ''}" data-gslang="ja">JA</button></div>
   ${billingRow}

package/bin/manager-for-ai.mjs

@@ -86,6 +86,13 @@ process.env.MANAGER_OPEN_BROWSER = process.env.MANAGER_OPEN_BROWSER ?? '1';
 // and serves the whole API (/connect, /checkout, /api/*). See [[no-a2c-tech]].
 process.env.MANAGER_BILLING_API_URL = process.env.MANAGER_BILLING_API_URL ?? 'https://galda.app';
 process.env.RELAY_URL = process.env.RELAY_URL ?? 'wss://app.galda.app/agent';
+// The named app the user actually works in (over the relay). The CLI opens THIS,
+// not the localhost board, in the hosted flow. Override for a self-hosted app.
+process.env.MANAGER_APP_URL = process.env.MANAGER_APP_URL ?? 'https://app.galda.app';
+// `npx @galda/cli --signin` forces the Google sign-in even if a license already
+// exists — the way to switch to a different account (a stale token otherwise
+// binds you to the previous account).
+if (process.argv.includes('--signin') || process.argv.includes('--login')) process.env.MANAGER_FORCE_SIGNIN = '1';
 // Choose a free port now and pin it for BOTH the server and the relay-client, so
 // a busy 4400 (another manager) no longer stops onboarding — no MANAGER_PORT by hand.
 const wantedPort = Number(process.env.MANAGER_PORT ?? 4400);

package/engine/lib.mjs

@@ -260,7 +260,7 @@ function primaryFailureCause({ usage = null, blockedKind = null, changedFiles =
 
 function failurePhase(kind) {
   if (kind === 'budget' || kind === 'rate-limit') return 'worker-run';
-  if (kind === 'test' || kind === 'proof' || kind === 'verify') return 'manager-verification';
+  if (kind === 'test' || kind === 'proof' || kind === 'verify' || kind === 'noop') return 'manager-verification';
   return 'execution';
 }
 
@@ -297,6 +297,12 @@ function failureSummaryFor({ kind, goalText, testResult, budgetReason, proofMiss
       yourCall: '不足している proof / 検証結果をそろえ、判断できる状態にしてから再提出します。',
     };
   }
+  if (kind === 'noop') {
+    return {
+      whatHappened: `必要だった作業「${needed}」は検証条件つきのタスクを含みますが、worker はファイル変更もproofも無いまま完了報告しました。`,
+      yourCall: '約束した検証(passCondition)が実行されなかった理由を確認し、必要なら worker にやり直しを指示します。',
+    };
+  }
   return {
     whatHappened: budgetReason ? String(budgetReason).slice(0, 180) : `必要だった作業「${needed}」が途中で止まりました。`,
     yourCall: '停止地点のログを読んで、同じ失敗を避ける最小ステップで再開します。',
@@ -1099,7 +1105,11 @@ export function resolveGoalSource(input) {
 // no explicit signal — it decides whether *this project* opens PRs by
 // default, separately from whether a PR-wanting goal must go through review.
 // `language` is the output language for the Manager's review-facing text
-// (e.g. summarizeForReview's plain-language headline) — 'ja' or 'en' only.
+// (e.g. summarizeForReview's plain-language headline) — 'auto' (match the
+// language the goal's own request was written in, same as the planner/worker —
+// see detectRequestLanguage) or an explicit 'ja'/'en' override for a project
+// that always wants one fixed language regardless of what any given goal was
+// typed in.
 // `prSections` toggles which sections createGoalPR includes in the PR body;
 // `reviewCard` toggles what the review checklist card shows for each task.
 export const DEFAULT_REVIEW_DEFINITION = {
@@ -1107,11 +1117,19 @@ export const DEFAULT_REVIEW_DEFINITION = {
   requireVerifyPass: false,
   description: '',
   defaultWantsPR: false,
-  language: 'ja',
+  language: 'auto',
   prSections: { summary: true, whatChanged: true, howToReview: true, tests: true, screenshots: true, risk: true },
   reviewCard: { screenshots: true, beforeAfter: false },
 };
 
+// Detects whether text was written in Japanese (kana/kanji present) or not, so
+// generated replies can match the language the request was written in
+// ("test" → English, "テスト" → 日本語) — worker close-out summaries, and (via
+// reviewDefinition.language === 'auto') review headlines/PR bodies.
+export function detectRequestLanguage(text) {
+  return /[぀-ヿ㐀-鿿]/.test(text || '') ? 'ja' : 'en';
+}
+
 // Normalize a nested boolean-flag object (prSections/reviewCard) key by key,
 // so a partial payload — or one missing the whole sub-object — can't
 // silently disable flags it never mentioned; each key falls back to its own
@@ -1138,7 +1156,7 @@ export function validateReviewDefinition(input) {
       requireVerifyPass: input.requireVerifyPass !== undefined ? !!input.requireVerifyPass : DEFAULT_REVIEW_DEFINITION.requireVerifyPass,
       description: input.description !== undefined ? String(input.description).slice(0, 500) : DEFAULT_REVIEW_DEFINITION.description,
       defaultWantsPR: input.defaultWantsPR !== undefined ? !!input.defaultWantsPR : DEFAULT_REVIEW_DEFINITION.defaultWantsPR,
-      language: (input.language === 'ja' || input.language === 'en') ? input.language : DEFAULT_REVIEW_DEFINITION.language,
+      language: (input.language === 'ja' || input.language === 'en' || input.language === 'auto') ? input.language : DEFAULT_REVIEW_DEFINITION.language,
       prSections: normalizeBoolMap(input.prSections, DEFAULT_REVIEW_DEFINITION.prSections),
       reviewCard: normalizeBoolMap(input.reviewCard, DEFAULT_REVIEW_DEFINITION.reviewCard),
     },
@@ -1160,6 +1178,20 @@ export function nextGoalStatus({ allDone, wantsPR, allVerified = true, reviewDef
   return allDone ? 'review' : 'partial';
 }
 
+// 段5 検証ゲート (Masa 2026-07-15: "proof無しは完了と言わない"): a task that carries
+// an EXPLICIT passCondition is a case where the user asked for proof — but if the
+// worker changed zero files, isUiChange() never matches (empty changedFiles), so
+// uiTasks stays empty and the existing proofMissing check (scoped to UI tasks)
+// never fires: the promised verification silently never happened. This is
+// deliberately narrower than "any 0-file goal" — a goal with NO passCondition
+// (an investigation/report-only ask) legitimately has nothing to prove and must
+// still reach Review for a human to read (see goal-guardrails-integration.test.mjs
+// (a2)/(a3): budget/cache-guardrail continuations correctly land in Review with
+// zero file changes because nothing was ever promised to be verified).
+export function isNothingVerifiable({ changedFiles = [], hasPassCondition = false, hasAnyProof = false } = {}) {
+  return hasPassCondition && changedFiles.length === 0 && !hasAnyProof;
+}
+
 // チェックリストUIで要件が全件Approveされたら goal を review→done へ進める。
 // 以前は「PRありgoalはマージが唯一の完了トリガー」として弾いていたが、それだと
 // 承認しても done が永続化されず次のrefreshで review に戻る不具合になっていた
@@ -2452,3 +2484,17 @@ export function resolveFolderAnswer(answer, folders = []) {
   if (a.startsWith('/') || a.startsWith('~')) return { dir: a };
   return null;
 }
+
+// Analytics identity (A+): a signed-in install scopes usage events to the
+// ACCOUNT (its email, which the billing Worker hashes into the same account_id
+// the accounts table carries) so per-user app activity joins WITHOUT a cookie;
+// otherwise the anonymous per-install id. Pure for unit-testing.
+export function pickAnalyticsUid(accountEmail, installId) {
+  return accountEmail || installId;
+}
+
+// Fire the free_exhausted funnel event only the first time a non-paying install
+// is actually blocked by the free-tier cap.
+export function shouldEmitFreeExhausted(alreadyEmitted, blocked) {
+  return !alreadyEmitted && Boolean(blocked);
+}

package/engine/server.mjs

@@ -21,7 +21,7 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
 import { needsProjectFolder, folderLabel, buildFolderQuestion, resolveFolderAnswer } from './lib.mjs';
-import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken, shouldEmitSetupCompleted } from './lib.mjs';
+import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable } from './lib.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
 
@@ -54,7 +54,7 @@ function maybeEmitSetupCompleted(req) {
   _setupClientSeen = true;
   if (!shouldEmitSetupCompleted({ isMcpClient: true, alreadySeen: false, flagExists: existsSync(SETUP_FLAG) })) return;
   try { writeFileSync(SETUP_FLAG, String(Date.now())); } catch { /* best effort — still emit */ }
-  emitEvent('signup', ANALYTICS_UID, { source: 'mcp-connect' });
+  emitEvent('signup', analyticsUid(), { source: 'mcp-connect' });
 }
 // Per-worker run cap. Env-configurable so it can be tuned operationally and the
 // timeout→'interrupted' path is testable (a test sets a short value + a slow
@@ -152,6 +152,15 @@ const MANAGER_OWNER_EMAIL = process.env.MANAGER_OWNER_EMAIL ?? '';
 // still works standalone (e.g. for Collaborators / dev) with no billing-api
 // configured at all.
 const BILLING_API_URL = (process.env.MANAGER_BILLING_API_URL ?? '').replace(/\/$/, '');
+// The user's real UI in the hosted flow is the NAMED app (app.galda.app),
+// reached over the relay — never the localhost board (Masa 2026-07-15:
+// 「npm→ターミナル→app.galda.appに戻る / localhostでなくアプリ名で開くべき」).
+// The localhost board stays the entry only for local/dev (no billing) runs.
+const APP_URL = (process.env.MANAGER_APP_URL ?? '').replace(/\/$/, '');
+// Force the sign-in flow even when a license already exists — so a user can
+// switch to a different Google account (a stale token from a previous account
+// otherwise silently binds the relay to the wrong account). Set by `--signin`.
+const FORCE_SIGNIN = process.env.MANAGER_FORCE_SIGNIN === '1';
 const entitlementCache = new Map(); // billing email -> { isPaying, checkedAt }
 
 // License token (local-first identity, docs/BILLING-LAUNCH-PLAN.md): a signed
@@ -166,6 +175,14 @@ const entitlementCache = new Map(); // billing email -> { isPaying, checkedAt }
 const licenseFile = join(DATA_DIR, 'license.token');
 let licenseState = { email: null, isPaying: false, verifiedAt: 0 }; // in-memory cache of the last successful verify (isPaying is the token's snapshot; the live gate re-checks)
 
+// Analytics identity (A+): once signed in, scope usage events to the ACCOUNT
+// (the billing Worker hashes this email → the same account_id the accounts table
+// carries, so per-user app activity joins WITHOUT a cookie). Not signed in →
+// the anonymous per-install id. Raw email never lands in usage_events (the
+// Worker pseudonymizes it server-side).
+function analyticsUid() { return pickAnalyticsUid(licenseState.email, ANALYTICS_UID); }
+let _freeExhaustedEmitted = false;
+
 // One-time nonces for the "Sign in with Google" loopback (GET /api/signin-url →
 // billing /connect → Google → billing → GET /oauth/callback). The engine issues
 // the nonce, round-trips it through the flow, and requires it back — so a random
@@ -216,12 +233,17 @@ function signinResultPage(outcome) {
   const body = outcome.ok
     ? `<h1>Signed in</h1><p>You're signed in as <b>${esc(outcome.email)}</b>. This tab will close automatically.</p>`
     : `<h1>Sign-in didn't complete</h1><p>${esc(outcome.error)}</p><p class="muted">Close this tab and click “Sign in with Google” again in the app.</p>`;
+  // When the sign-in was opened FROM the app tab (window.opener present), tell
+  // it and close. When it was opened by the CLI at startup (no opener — `open`
+  // can't script-close it), don't strand the user on a localhost page: send them
+  // to the named app so the flow is npm → terminal → app.galda.app.
+  const goApp = outcome.ok && APP_URL ? JSON.stringify(APP_URL) : 'null';
   return `<!doctype html><meta charset="utf-8"><title>Galda</title>` +
     `<body style="font:15px/1.6 -apple-system,system-ui,sans-serif;max-width:32rem;margin:12vh auto;padding:0 1.5rem;color:#111">` +
     `<style>h1{font-size:1.35rem;margin:0 0 .5rem}.muted{color:#888;font-size:.9rem}b{font-weight:600}</style>` +
     body +
-    `<script>try{if(window.opener)window.opener.postMessage(${payload},'*')}catch(e){}` +
-    (outcome.ok ? `setTimeout(function(){try{window.close()}catch(e){}},1200);` : '') +
+    `<script>var opened=false;try{if(window.opener){window.opener.postMessage(${payload},'*');opened=true;}}catch(e){}` +
+    (outcome.ok ? `var app=${goApp};setTimeout(function(){if(opened){try{window.close()}catch(e){}}else if(app){location.replace(app)}else{try{window.close()}catch(e){}}},900);` : '') +
     `</script></body>`;
 }
 
@@ -348,7 +370,7 @@ async function requireEntitlementGate(identity) {
   const usage = { ...existing, pendingCount: existing.pendingCount + 1, cumulativeCount: existing.cumulativeCount + 1 };
   if (!checkFreeTierLimit(usage).blocked) return { allowed: true, blocked: null };
   const billingEmail = licenseState.email;
-  if (!billingEmail) return resolveEntitlement({ isOwner: false, isPaying: false, usage });
+  if (!billingEmail) { const r = resolveEntitlement({ isOwner: false, isPaying: false, usage }); noteFreeExhausted(r); return r; }
   const cachedState = resolveCachedEntitlement({ cached: entitlementCache.get(billingEmail) ?? null });
   let isPaying = cachedState.isPaying;
   if (cachedState.needsRefresh) {
@@ -358,7 +380,17 @@ async function requireEntitlementGate(identity) {
       entitlementCache.set(billingEmail, { isPaying: fresh, checkedAt: Date.now() });
     }
   }
-  return resolveEntitlement({ isOwner: false, isPaying, usage });
+  const result = resolveEntitlement({ isOwner: false, isPaying, usage });
+  noteFreeExhausted(result);
+  return result;
+}
+// Emit one free_exhausted funnel event the first time a non-paying install is
+// blocked by the free-tier cap (the funnel dedupes by distinct account/install,
+// so once-per-session is enough).
+function noteFreeExhausted(result) {
+  if (!shouldEmitFreeExhausted(_freeExhaustedEmitted, result?.blocked)) return;
+  _freeExhaustedEmitted = true;
+  emitEvent('free_exhausted', analyticsUid());
 }
 // The acting identity for a request: 'owner' for key-auth or
 // MANAGER_OWNER_EMAIL, else the verified Google email itself. Stamped onto
@@ -578,12 +610,12 @@ function emitTaskAnalytics(t) {
   if (!t || t.id == null) return;
   if (!_analyticsEmitted.has(`created:${t.id}`)) {
     _analyticsEmitted.add(`created:${t.id}`);
-    emitEvent('task_created', ANALYTICS_UID, { source: 'engine' });
+    emitEvent('task_created', analyticsUid(), { source: 'engine' });
   }
   const ev = _TERMINAL_EVENT[t.status];
   if (ev && !_analyticsEmitted.has(`${t.status}:${t.id}`)) {
     _analyticsEmitted.add(`${t.status}:${t.id}`);
-    emitEvent(ev, ANALYTICS_UID, { status: t.status, source: 'engine' });
+    emitEvent(ev, analyticsUid(), { status: t.status, source: 'engine' });
     postHistory(t);
   }
 }
@@ -1342,15 +1374,15 @@ function testOutputExcerpt(text) {
 }
 
 function workerPrompt(task, goal, lastFailure) {
-  // Report back to the human in the SAME language they wrote the goal in (Masa
-  // 2026-07-15: "撃った言語で返す"). JP characters → Japanese, otherwise English.
-  const replyLang = /[぀-ヿ㐀-鿿]/.test(goal?.text || task?.title || '') ? '日本語' : 'English';
   // Optional skill the user attached to this goal. Empirically (scratch worker,
   // haiku, custom fixture skill) the reliably-firing form is an explicit Skill-tool
   // instruction as the FIRST line; a bare "/name" first line did not consistently
   // trigger the skill in `claude -p`. See commit body for the run evidence.
   const skill = task?.skill ?? goal?.skill;
   const agentName = workerAgent(task?.agent ?? goal?.agent) === 'codex' ? 'Codex' : 'Claude Code';
+  // Report back to the human in the SAME language they wrote the goal in (Masa
+  // 2026-07-15: "撃った言語で返す"). JP characters → Japanese, otherwise English.
+  const replyLang = detectRequestLanguage(goal?.text || task?.title || '') === 'ja' ? '日本語' : 'English';
   return [
     skill ? `FIRST, use the /${skill} skill via the Skill tool (invoke Skill with the "${skill}" skill) before doing anything else. Then carry out the task below.` : '',
     `You are a ${agentName} worker managed by "Manager for AI". Do ONLY the task below inside this project directory.`,
@@ -2012,7 +2044,11 @@ function computeGoalDiff(goal, project) {
 // plain-language review headline in the user's language: what to CHECK and what
 // CHANGED. Never trusts the worker to self-format.
 async function summarizeForReview(goal, siblings, dir, reviewDefinition) {
-  const lang = reviewDefinition.language || 'ja';
+  // 'auto' (default) matches the language the goal's own request was written
+  // in, same as the planner/worker (Masa 2026-07-15 follow-up to a8d69fe: "the
+  // review-column headline still defaults to ja — align it the same way").
+  // An explicit ja/en on the project's review definition always overrides.
+  const lang = reviewDefinition.language === 'auto' ? detectRequestLanguage(goal.text) : (reviewDefinition.language || 'ja');
   const changed = [...new Set(siblings.flatMap((t) => t.changedFiles ?? []))].slice(0, 20);
   const reports = siblings.filter((t) => !t.reply).map((t) => `- ${t.title}: ${(t.result ?? '').replace(/\s+/g, ' ').slice(0, 300)}`).join('\n');
   const fallback = { check: '', changed: (goal.plan?.[0] ?? goal.text ?? '').replace(/\s+/g, ' ').slice(0, 80) };
@@ -2221,6 +2257,16 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
   // EVERY task must carry a passing proof, not just UI tasks. Only ever tightens;
   // never conflicts with §6 (still can't reach Done without a human).
   const verifyFail = reviewDefinition.requireVerifyPass && !allVerified;
+  // 段5 検証ゲート厳格化 (Masa 2026-07-15: "proof無しは完了と言わない"): passCondition
+  // を約束したタスクなのに 0 ファイル変更で proof も無い＝約束した検証が実行されずに
+  // すり抜けたサイン（isUiChange は changedFiles が空だと絶対に一致しないため、既存の
+  // proofMissing(UIタスク限定)はこのケースを検知できない）。passCondition が無い調査
+  // 系ゴール（0ファイルが正当な完了）は対象外 — 人間が読んで判断すれば足りる。
+  const nothingVerifiable = isNothingVerifiable({
+    changedFiles,
+    hasPassCondition: siblings.some((t) => t.passCondition),
+    hasAnyProof: siblings.some((t) => t.proof),
+  });
   if (testsFailing) {
     const failure = recordGoalFailure(goal, {
       kind: 'test',
@@ -2253,22 +2299,24 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
       return;
     }
   }
-  if (testsFailing || proofMissing || proofFailing || verifyFail) {
+  if (testsFailing || proofMissing || proofFailing || verifyFail || nothingVerifiable) {
     if (!testsFailing) {
       recordGoalFailure(goal, {
-        kind: (proofMissing || proofFailing) ? 'proof' : 'verify',
+        kind: (proofMissing || proofFailing) ? 'proof' : nothingVerifiable ? 'noop' : 'verify',
         reason: proofMissing ? 'UI変更なのに proof(スクショ/動画) が取れていない'
           : proofFailing ? 'UI proof は撮れたが、依頼対象のUIを確認できていない'
+          : nothingVerifiable ? '検証条件つきのタスクなのに、ファイル変更も proof も無い（約束した検証が行われていない）'
           : '検証(proof)が全タスク分そろっていない（requireVerifyPass）',
         changedFiles,
         testResult: goal.testResult,
       });
     }
     goal.blocked = {
-      kind: testsFailing ? 'test' : (proofMissing || proofFailing) ? 'proof' : 'verify',
+      kind: testsFailing ? 'test' : (proofMissing || proofFailing) ? 'proof' : nothingVerifiable ? 'noop' : 'verify',
       reason: testsFailing ? `テスト失敗 ${goal.testResult.failed} 件（自動修正 ${Number(goal.autoRework?.testFailures ?? 0)} 回後も失敗）`
         : proofMissing ? 'UI変更なのに proof(スクショ/動画) が取れていない'
         : proofFailing ? 'UI proof は撮れたが、依頼対象のUIを確認できていない'
+        : nothingVerifiable ? '検証条件つきのタスクなのに、ファイル変更も proof も無い（約束した検証が行われていない）'
         : '検証(proof)が全タスク分そろっていない（requireVerifyPass）',
     };
     goal.status = 'blocked';
@@ -2317,9 +2365,11 @@ async function createGoalPR(goal, project, goalTasks, reviewDefinition = DEFAULT
     }
     const ownerRes = spawnSync('gh', ['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner'], { cwd: project.dir, encoding: 'utf8' });
     const owner = ownerRes.status === 0 ? ownerRes.stdout.trim() : null;
-    // PR body in the USER's language (reviewDefinition.language, default ja) —
-    // not forced English/bilingual (Masa: 「ユーザーの言語で」).
-    const lang = reviewDefinition.language || 'ja';
+    // PR body in the USER's language — default 'auto' matches the goal's own
+    // request language (same as planner/worker); an explicit ja/en override on
+    // the project's review definition always wins. Not forced English/bilingual
+    // (Masa: 「ユーザーの言語で」).
+    const lang = reviewDefinition.language === 'auto' ? detectRequestLanguage(goal.text) : (reviewDefinition.language || 'ja');
     const L = (en, ja) => (lang === 'en' ? en : ja);
     const bodyFor = (branch) => [
       ...(proofItems.length && owner ? [
@@ -3428,15 +3478,22 @@ server.on('error', (e) => {
 server.listen(PORT, '127.0.0.1', () => {
   console.log(`[manager] Manager for AI → http://localhost:${PORT}/?key=${ACCESS_KEY}`);
   if (process.env.MANAGER_OPEN_BROWSER === '1' && process.platform === 'darwin') {
-    // First run in the hosted flow (no license yet, billing worker configured):
-    // open the one-click Google device-link straight away instead of the local
-    // ?key board, so a non-engineer never sees a localhost URL or an access key —
-    // they sign in once and their hosted board comes alive (relay-client rebinds
-    // via its license.token watcher). Otherwise open the local board as before.
+    // Hosted flow (billing worker + named app configured): the user lives in
+    // app.galda.app, driven over the relay — they must NEVER be dropped on a
+    // localhost board or an access key (Masa 2026-07-15: 「npm→ターミナル→
+    // app.galda.appに戻る」). Not signed in (or switching accounts via --signin)
+    // → one-click Google sign-in; already signed in → straight to the app (the
+    // board comes alive as relay-client rebinds via its license.token watcher).
+    // The localhost ?key board stays the entry ONLY for local/dev (no billing).
     let openUrl = `http://localhost:${PORT}/?key=${ACCESS_KEY}`;
-    if (BILLING_API_URL && !existsSync(licenseFile)) {
-      openUrl = `${BILLING_API_URL}/connect?port=${PORT}&state=${encodeURIComponent(newSigninNonce())}`;
-      console.log('[manager] first run: opening one-click sign-in (no local key needed) → ' + openUrl);
+    if (BILLING_API_URL && APP_URL) {
+      const signedIn = existsSync(licenseFile) && !FORCE_SIGNIN;
+      openUrl = signedIn
+        ? APP_URL
+        : `${BILLING_API_URL}/connect?port=${PORT}&state=${encodeURIComponent(newSigninNonce())}`;
+      console.log(signedIn
+        ? `[manager] opening your app → ${APP_URL}`
+        : `[manager] ${FORCE_SIGNIN ? 'switching account' : 'first run'}: opening one-click sign-in → ${openUrl}`);
     }
     spawn('open', ['-g', openUrl], { stdio: 'ignore' }).unref();
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.8",
+  "version": "0.10.10",
   "type": "module",
   "description": "Galda - hand off work to your Claude Code, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {