@galda/cli 0.10.8 → 0.10.9

package/bin/manager-for-ai.mjs

@@ -86,6 +86,13 @@ process.env.MANAGER_OPEN_BROWSER = process.env.MANAGER_OPEN_BROWSER ?? '1';
 // and serves the whole API (/connect, /checkout, /api/*). See [[no-a2c-tech]].
 process.env.MANAGER_BILLING_API_URL = process.env.MANAGER_BILLING_API_URL ?? 'https://galda.app';
 process.env.RELAY_URL = process.env.RELAY_URL ?? 'wss://app.galda.app/agent';
+// The named app the user actually works in (over the relay). The CLI opens THIS,
+// not the localhost board, in the hosted flow. Override for a self-hosted app.
+process.env.MANAGER_APP_URL = process.env.MANAGER_APP_URL ?? 'https://app.galda.app';
+// `npx @galda/cli --signin` forces the Google sign-in even if a license already
+// exists — the way to switch to a different account (a stale token otherwise
+// binds you to the previous account).
+if (process.argv.includes('--signin') || process.argv.includes('--login')) process.env.MANAGER_FORCE_SIGNIN = '1';
 // Choose a free port now and pin it for BOTH the server and the relay-client, so
 // a busy 4400 (another manager) no longer stops onboarding — no MANAGER_PORT by hand.
 const wantedPort = Number(process.env.MANAGER_PORT ?? 4400);

package/engine/server.mjs

@@ -54,7 +54,7 @@ function maybeEmitSetupCompleted(req) {
   _setupClientSeen = true;
   if (!shouldEmitSetupCompleted({ isMcpClient: true, alreadySeen: false, flagExists: existsSync(SETUP_FLAG) })) return;
   try { writeFileSync(SETUP_FLAG, String(Date.now())); } catch { /* best effort — still emit */ }
-  emitEvent('signup', ANALYTICS_UID, { source: 'mcp-connect' });
+  emitEvent('signup', analyticsUid(), { source: 'mcp-connect' });
 }
 // Per-worker run cap. Env-configurable so it can be tuned operationally and the
 // timeout→'interrupted' path is testable (a test sets a short value + a slow
@@ -152,6 +152,15 @@ const MANAGER_OWNER_EMAIL = process.env.MANAGER_OWNER_EMAIL ?? '';
 // still works standalone (e.g. for Collaborators / dev) with no billing-api
 // configured at all.
 const BILLING_API_URL = (process.env.MANAGER_BILLING_API_URL ?? '').replace(/\/$/, '');
+// The user's real UI in the hosted flow is the NAMED app (app.galda.app),
+// reached over the relay — never the localhost board (Masa 2026-07-15:
+// 「npm→ターミナル→app.galda.appに戻る / localhostでなくアプリ名で開くべき」).
+// The localhost board stays the entry only for local/dev (no billing) runs.
+const APP_URL = (process.env.MANAGER_APP_URL ?? '').replace(/\/$/, '');
+// Force the sign-in flow even when a license already exists — so a user can
+// switch to a different Google account (a stale token from a previous account
+// otherwise silently binds the relay to the wrong account). Set by `--signin`.
+const FORCE_SIGNIN = process.env.MANAGER_FORCE_SIGNIN === '1';
 const entitlementCache = new Map(); // billing email -> { isPaying, checkedAt }
 
 // License token (local-first identity, docs/BILLING-LAUNCH-PLAN.md): a signed
@@ -166,6 +175,14 @@ const entitlementCache = new Map(); // billing email -> { isPaying, checkedAt }
 const licenseFile = join(DATA_DIR, 'license.token');
 let licenseState = { email: null, isPaying: false, verifiedAt: 0 }; // in-memory cache of the last successful verify (isPaying is the token's snapshot; the live gate re-checks)
 
+// Analytics identity (A+): once signed in, scope usage events to the ACCOUNT
+// (the billing Worker hashes this email → the same account_id the accounts table
+// carries, so per-user app activity joins WITHOUT a cookie). Not signed in →
+// the anonymous per-install id. Raw email never lands in usage_events (the
+// Worker pseudonymizes it server-side).
+function analyticsUid() { return licenseState.email || ANALYTICS_UID; }
+let _freeExhaustedEmitted = false;
+
 // One-time nonces for the "Sign in with Google" loopback (GET /api/signin-url →
 // billing /connect → Google → billing → GET /oauth/callback). The engine issues
 // the nonce, round-trips it through the flow, and requires it back — so a random
@@ -216,12 +233,17 @@ function signinResultPage(outcome) {
   const body = outcome.ok
     ? `<h1>Signed in</h1><p>You're signed in as <b>${esc(outcome.email)}</b>. This tab will close automatically.</p>`
     : `<h1>Sign-in didn't complete</h1><p>${esc(outcome.error)}</p><p class="muted">Close this tab and click “Sign in with Google” again in the app.</p>`;
+  // When the sign-in was opened FROM the app tab (window.opener present), tell
+  // it and close. When it was opened by the CLI at startup (no opener — `open`
+  // can't script-close it), don't strand the user on a localhost page: send them
+  // to the named app so the flow is npm → terminal → app.galda.app.
+  const goApp = outcome.ok && APP_URL ? JSON.stringify(APP_URL) : 'null';
   return `<!doctype html><meta charset="utf-8"><title>Galda</title>` +
     `<body style="font:15px/1.6 -apple-system,system-ui,sans-serif;max-width:32rem;margin:12vh auto;padding:0 1.5rem;color:#111">` +
     `<style>h1{font-size:1.35rem;margin:0 0 .5rem}.muted{color:#888;font-size:.9rem}b{font-weight:600}</style>` +
     body +
-    `<script>try{if(window.opener)window.opener.postMessage(${payload},'*')}catch(e){}` +
-    (outcome.ok ? `setTimeout(function(){try{window.close()}catch(e){}},1200);` : '') +
+    `<script>var opened=false;try{if(window.opener){window.opener.postMessage(${payload},'*');opened=true;}}catch(e){}` +
+    (outcome.ok ? `var app=${goApp};setTimeout(function(){if(opened){try{window.close()}catch(e){}}else if(app){location.replace(app)}else{try{window.close()}catch(e){}}},900);` : '') +
     `</script></body>`;
 }
 
@@ -348,7 +370,7 @@ async function requireEntitlementGate(identity) {
   const usage = { ...existing, pendingCount: existing.pendingCount + 1, cumulativeCount: existing.cumulativeCount + 1 };
   if (!checkFreeTierLimit(usage).blocked) return { allowed: true, blocked: null };
   const billingEmail = licenseState.email;
-  if (!billingEmail) return resolveEntitlement({ isOwner: false, isPaying: false, usage });
+  if (!billingEmail) { const r = resolveEntitlement({ isOwner: false, isPaying: false, usage }); noteFreeExhausted(r); return r; }
   const cachedState = resolveCachedEntitlement({ cached: entitlementCache.get(billingEmail) ?? null });
   let isPaying = cachedState.isPaying;
   if (cachedState.needsRefresh) {
@@ -358,7 +380,17 @@ async function requireEntitlementGate(identity) {
       entitlementCache.set(billingEmail, { isPaying: fresh, checkedAt: Date.now() });
     }
   }
-  return resolveEntitlement({ isOwner: false, isPaying, usage });
+  const result = resolveEntitlement({ isOwner: false, isPaying, usage });
+  noteFreeExhausted(result);
+  return result;
+}
+// Emit one free_exhausted funnel event the first time a non-paying install is
+// blocked by the free-tier cap (the funnel dedupes by distinct account/install,
+// so once-per-session is enough).
+function noteFreeExhausted(result) {
+  if (_freeExhaustedEmitted || !result?.blocked) return;
+  _freeExhaustedEmitted = true;
+  emitEvent('free_exhausted', analyticsUid());
 }
 // The acting identity for a request: 'owner' for key-auth or
 // MANAGER_OWNER_EMAIL, else the verified Google email itself. Stamped onto
@@ -578,12 +610,12 @@ function emitTaskAnalytics(t) {
   if (!t || t.id == null) return;
   if (!_analyticsEmitted.has(`created:${t.id}`)) {
     _analyticsEmitted.add(`created:${t.id}`);
-    emitEvent('task_created', ANALYTICS_UID, { source: 'engine' });
+    emitEvent('task_created', analyticsUid(), { source: 'engine' });
   }
   const ev = _TERMINAL_EVENT[t.status];
   if (ev && !_analyticsEmitted.has(`${t.status}:${t.id}`)) {
     _analyticsEmitted.add(`${t.status}:${t.id}`);
-    emitEvent(ev, ANALYTICS_UID, { status: t.status, source: 'engine' });
+    emitEvent(ev, analyticsUid(), { status: t.status, source: 'engine' });
     postHistory(t);
   }
 }
@@ -3428,15 +3460,22 @@ server.on('error', (e) => {
 server.listen(PORT, '127.0.0.1', () => {
   console.log(`[manager] Manager for AI → http://localhost:${PORT}/?key=${ACCESS_KEY}`);
   if (process.env.MANAGER_OPEN_BROWSER === '1' && process.platform === 'darwin') {
-    // First run in the hosted flow (no license yet, billing worker configured):
-    // open the one-click Google device-link straight away instead of the local
-    // ?key board, so a non-engineer never sees a localhost URL or an access key —
-    // they sign in once and their hosted board comes alive (relay-client rebinds
-    // via its license.token watcher). Otherwise open the local board as before.
+    // Hosted flow (billing worker + named app configured): the user lives in
+    // app.galda.app, driven over the relay — they must NEVER be dropped on a
+    // localhost board or an access key (Masa 2026-07-15: 「npm→ターミナル→
+    // app.galda.appに戻る」). Not signed in (or switching accounts via --signin)
+    // → one-click Google sign-in; already signed in → straight to the app (the
+    // board comes alive as relay-client rebinds via its license.token watcher).
+    // The localhost ?key board stays the entry ONLY for local/dev (no billing).
     let openUrl = `http://localhost:${PORT}/?key=${ACCESS_KEY}`;
-    if (BILLING_API_URL && !existsSync(licenseFile)) {
-      openUrl = `${BILLING_API_URL}/connect?port=${PORT}&state=${encodeURIComponent(newSigninNonce())}`;
-      console.log('[manager] first run: opening one-click sign-in (no local key needed) → ' + openUrl);
+    if (BILLING_API_URL && APP_URL) {
+      const signedIn = existsSync(licenseFile) && !FORCE_SIGNIN;
+      openUrl = signedIn
+        ? APP_URL
+        : `${BILLING_API_URL}/connect?port=${PORT}&state=${encodeURIComponent(newSigninNonce())}`;
+      console.log(signedIn
+        ? `[manager] opening your app → ${APP_URL}`
+        : `[manager] ${FORCE_SIGNIN ? 'switching account' : 'first run'}: opening one-click sign-in → ${openUrl}`);
     }
     spawn('open', ['-g', openUrl], { stdio: 'ignore' }).unref();
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.8",
+  "version": "0.10.9",
   "type": "module",
   "description": "Galda - hand off work to your Claude Code, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {