@galda/cli 0.10.82 → 0.10.83

package/engine/server.mjs

@@ -2982,12 +2982,22 @@ const testRunQueue = createSerialQueue();
 // Manager-run tests (never trust the worker's "all green" claim): run the
 // project's own `npm test` in the goal's worktree and parse node --test's
 // "ℹ pass N / ℹ fail N" (or TAP "# pass/# fail"). Returns {ran,passed,failed,ok}.
-function runTestsOnce(dir) {
+function testNodePath(dir, dependencySourceDir = null) {
+  // node_modules is intentionally absent from git worktrees. Reuse the base
+  // checkout's installed dependencies before declaring every server/UI test a
+  // product regression; verification must never silently depend on `npm install`.
+  const sep = process.platform === 'win32' ? ';' : ':';
+  const local = [join(dir, 'node_modules'), dependencySourceDir && join(dependencySourceDir, 'node_modules'), join(ROOT, 'node_modules')]
+    .filter(Boolean).filter(existsSync);
+  return [...new Set([...local, ...(process.env.NODE_PATH ? process.env.NODE_PATH.split(sep) : [])])].join(sep);
+}
+function runTestsOnce(dir, dependencySourceDir = null) {
   // The timeout is env-overridable so tests can force the killed-run path fast;
   // production keeps the 4-minute default.
   const runTimeout = Number(process.env.MANAGER_TEST_TIMEOUT_MS) || 240000;
   return testRunQueue.run(() => new Promise((res) => {
-    execFile('npm', ['test'], { cwd: dir, timeout: runTimeout, env: { ...process.env }, maxBuffer: 8 * 1024 * 1024 }, (e, out = '', err = '') => {
+    const nodePath = testNodePath(dir, dependencySourceDir);
+    execFile('npm', ['test'], { cwd: dir, timeout: runTimeout, env: { ...process.env, ...(nodePath ? { NODE_PATH: nodePath } : {}) }, maxBuffer: 8 * 1024 * 1024 }, (e, out = '', err = '') => {
       const text = `${out}\n${err}`;
       const n = (re) => { const m = text.match(re); return m ? Number(m[1]) : null; };
       const passed = n(/ℹ pass (\d+)/) ?? n(/# pass (\d+)/) ?? n(/(\d+) passing/) ?? 0;
@@ -3019,17 +3029,17 @@ function runTestsOnce(dir) {
     });
   }));
 }
-async function runProjectTests(dir) {
+async function runProjectTests(dir, dependencySourceDir = null) {
   let hasTest = false;
   try { hasTest = !!JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).scripts?.test; } catch { /* no package.json */ }
   if (!hasTest) return { ran: false };
-  let r = await runTestsOnce(dir);
+  let r = await runTestsOnce(dir, dependencySourceDir);
   // Flake resistance: the integration suite spawns real servers; under load a
   // startup can time out. Re-run once and take the fewer failures — a real
   // failure fails both runs, a flake clears on the retry — so a good goal is
   // never blocked on a flaky test.
   if (r.failed > 0) {
-    const r2 = await runTestsOnce(dir);
+    const r2 = await runTestsOnce(dir, dependencySourceDir);
     const kept = r2.failed <= r.failed ? r2 : r; // the run that saw fewer failures
     r = {
       passed: Math.max(r.passed, r2.passed),
@@ -3144,7 +3154,7 @@ async function runRetestJob(goal, token) {
   } else {
     for (let i = 0; i < RETEST_RUNS; i++) {
       if (!live()) return; // cancelled (UNDO) / superseded / deleted → discard
-      const r = await runTestsOnce(wdir);
+      const r = await runTestsOnce(wdir, project.dir);
       if (!live()) return; // cancelled while this run was in flight
       results.push({ ran: true, passed: r.passed, failed: r.failed });
       goal.retest = { state: 'running', runs: results.length, total: RETEST_RUNS, startedAt: goal.retest?.startedAt };
@@ -3509,7 +3519,7 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
   const testGateOn = resolveTestGate({ reviewDefinition, env: process.env, force: forceTests });
   if (testGateOn && hasTestRelevantChanges(changedFiles)) {
     goalAct(`Running project tests in the goal worktree (${changedFiles.length} changed file${changedFiles.length === 1 ? '' : 's'}).`);
-    goal.testResult = await runProjectTests(wdir);
+    goal.testResult = await runProjectTests(wdir, project.dir);
     goalAct(`Project tests finished: ${goal.testResult.failed ?? 0} failed, ${goal.testResult.passed ?? 0} passed.`);
   } else if (!testGateOn) {
     goal.testResult = { ran: false, skipped: true, skippedReason: 'test gate off (opt-in: requireTests / MANAGER_VERIFY_GATE=on)' };
@@ -4185,6 +4195,16 @@ const server = createServer(async (req, res) => {
       for (const t of removedTasks) logAppend(JSON.stringify({ kind: 'task', id: t.id, deleted: true }));
       projects.splice(idx, 1);
       queues.delete(project.id);
+      // A deleted project's goals must not outlive it: project ids are derived
+      // from the name (uniqueProjectId), so a later "+ New project" click can
+      // regenerate the exact same id and — without this purge — inherit the
+      // old project's leftover goals as if they belonged to the brand-new one
+      // (Masa report 2026-07-27: new project shows Review items on creation).
+      for (const g of goals.filter((g) => g.projectId === project.id)) {
+        goals = goals.filter((x) => x.id !== g.id);
+        logAppend(JSON.stringify({ kind: 'goal', id: g.id, deleted: true }));
+        sendGoalEvent({ ev: 'goal-deleted', id: g.id }, g);
+      }
       saveProjects();
       send({ ev: 'projects', projects, deletedProjectId: project.id });
       return json(res, 200, { ok: true, projects, deletedProjectId: project.id });
@@ -5418,7 +5438,19 @@ async function answerGoalQuestion(goal, question) {
   if (upMatch) {
     const file = join(logDir, 'uploads', upMatch[1]);
     if (!existsSync(file)) { res.writeHead(404); return res.end('not found'); }
-    res.writeHead(200, { 'content-type': file.endsWith('.gif') ? 'image/gif' : file.endsWith('.jpg') || file.endsWith('.jpeg') ? 'image/jpeg' : 'image/png' });
+    // Worker-declared Open it artifacts and image attachments share `/upload`.
+    // Never guess that an unknown artifact is a PNG: it turns valid HTML, PDF,
+    // or text into a broken-image page. Known preview formats get their real
+    // browser type; an unknown file downloads safely instead of being misread.
+    const ext = (file.match(/\.([a-z0-9]+)$/i)?.[1] || '').toLowerCase();
+    const types = {
+      html: 'text/html; charset=utf-8', htm: 'text/html; charset=utf-8',
+      css: 'text/css; charset=utf-8', js: 'text/javascript; charset=utf-8', mjs: 'text/javascript; charset=utf-8',
+      json: 'application/json; charset=utf-8', txt: 'text/plain; charset=utf-8', md: 'text/markdown; charset=utf-8', csv: 'text/csv; charset=utf-8',
+      svg: 'image/svg+xml', png: 'image/png', gif: 'image/gif', jpg: 'image/jpeg', jpeg: 'image/jpeg', webp: 'image/webp', ico: 'image/x-icon',
+      pdf: 'application/pdf', mp4: 'video/mp4', webm: 'video/webm', wasm: 'application/wasm',
+    };
+    res.writeHead(200, { 'content-type': types[ext] || 'application/octet-stream' });
     return res.end(readFileSync(file));
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.82",
+  "version": "0.10.83",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {