@galda/cli 0.10.82 → 0.10.84

package/app/index.html

@@ -5368,7 +5368,10 @@ function renderReviewChecklist(){
   // own test result — so a reviewer can judge at a glance, before scrolling.
   const grs = goal.reviewSummary ?? {};
   const gtr = goal.testResult;
-  const testLine = gtr?.ran ? `<span class="tbadge ${gtr.ok ? 'ok' : 'no'}">tests ${gtr.passed}✓${gtr.failed ? ` / ${gtr.failed}✗` : ''}</span>` : '';
+  const testPreflightFailed = gtr?.preflight && !gtr.preflight.ok;
+  const testLine = gtr?.ran ? (testPreflightFailed
+    ? `<span class="tbadge">tests need environment setup</span>`
+    : `<span class="tbadge ${gtr.ok ? 'ok' : 'no'}">tests ${gtr.passed}✓${gtr.failed ? ` / ${gtr.failed}✗` : ''}</span>`) : '';
   // #377-7 (Masa, recurring): the base UI is ALWAYS English — Japanese is a
   // per-project CONTENT customization, never chrome. So the fixed system labels
   // below stay English regardless of reviewDefinition.language; only the
@@ -5398,7 +5401,7 @@ function renderReviewChecklist(){
   vchips.push(`<span class="vchip none">${esc(workspaceModeText(goal))}</span>`);
   if (goal.workspaceWarning) vchips.push(`<span class="vchip human high">⚠ ${esc(goal.workspaceWarning.slice(0, 80))}</span>`);
   vchips.push(gtr?.ran
-    ? (gtr.ok ? `<span class="vchip ok">✓ ${VF.pass}</span>` : `<span class="vchip no">✗ ${VF.fail}</span>`)
+    ? (testPreflightFailed ? `<span class="vchip human">! tests need setup</span>` : gtr.ok ? `<span class="vchip ok">✓ ${VF.pass}</span>` : `<span class="vchip no">✗ ${VF.fail}</span>`)
     : `<span class="vchip none">— ${VF.untested}</span>`);
   vchips.push(hasProof ? `<span class="vchip ok">✓ ${VF.proof}</span>` : `<span class="vchip none">— ${VF.noproof}</span>`);
   if (risk?.shouldPause) vchips.push(`<span class="vchip human high">⚠ ${VF.human}</span>`);
@@ -11747,15 +11750,23 @@ function gearSetHTML(){
     ? acct + `<div class="srow"><div class="sl">Plan</div><span class="bx-pdot"><i></i>Paid</span></div>
        <div class="srow"><div class="sl">Billing<span class="sd">manage or cancel in Stripe</span></div><button class="bx-cchip" data-gportal="1">Manage</button></div>`
     : acct + freeUsage;
+  const st = state.stability;
+  const stability = st ? `<div class="srow"><div class="sl">Verification health<span class="sd">Last 24h · implementation ${st.implementationFailures} · environment ${st.verificationInfrastructure} · inconclusive ${st.timeoutsOrInconclusive} · worker holds ${st.workerHolds}</span></div><button class="optchip" data-gstability="1">Refresh</button></div>` : `<div class="srow"><div class="sl">Verification health<span class="sd">Loading…</span></div></div>`;
   return `
   <div class="srow"><div class="sl">Language<span class="sd">Review checklist language for this project</span></div>
     <button class="optchip${lang === 'auto' ? ' on' : ''}" data-gslang="auto">Auto</button>
     <button class="optchip${lang === 'en' ? ' on' : ''}" data-gslang="en">EN</button>
     <button class="optchip${lang === 'ja' ? ' on' : ''}" data-gslang="ja">JA</button></div>
   ${billingRow}
+  ${stability}
   ${gearRulesHTML()}
   <div class="srow dis"><div class="sl">Data folder<span class="sd">Runs are stored in the engine's chat-runs folder on the host</span></div></div>`;
 }
+async function loadStability(){
+  try { const r = await fetch(withKey('/api/stability')); state.stability = r.ok ? await r.json() : null; }
+  catch { state.stability = null; }
+  if ($('gearPop') && custTab === 'settings') buildGearPop();
+}
 // ONE-CONVERSATION §1.5a: the project's working rules — the file(s) the connected
 // AI actually reads (Claude Code → CLAUDE.md, Codex → AGENTS.md). Read-only: Galda
 // does NOT own these rules, it only surfaces them (editing is done in an editor or
@@ -11844,7 +11855,10 @@ function buildGearPop(){
     };
     const rulesBtn = pop.querySelector('[data-grules]');
     if (rulesBtn) rulesBtn.onclick = () => { state.rulesOpen = !state.rulesOpen; buildGearPop(); };
+    const stabilityBtn = pop.querySelector('[data-gstability]');
+    if (stabilityBtn) stabilityBtn.onclick = () => { state.stability = null; buildGearPop(); loadStability(); };
     loadProjectRules();
+    if (!state.stability) loadStability();
     return;
   }
   if (custTab === 'mcp') {

package/engine/lib.mjs

@@ -1474,7 +1474,7 @@ export function buildGoalPrBody({ lang, goal, goalTasks, files, owner, branch, p
 // 修正/追加/改善/調査 so an "追加したい" request never becomes "…の修正", and (c) a
 // failed/missing reply falls back to goal.text (no regression) — all without an
 // LLM call. The app's saReviewTitle reads reviewSummary.title first (PR-B).
-export function buildReviewSummaryPrompt({ lang, goalText, changed, reports }) {
+export function buildReviewSummaryPrompt({ lang, goalText, changed, reports, latestFeedback = '' }) {
   return [
     `あるゴールの実装が完了しました。レビューする人が一目で判断できるよう、やさしい${lang === 'ja' ? '日本語' : lang}で書いてください。`,
     '専門用語・長い説明は禁止。小学生でも分かる短い言い方。JSONのみ出力（前後に文章を書かない）:',
@@ -1483,6 +1483,7 @@ export function buildReviewSummaryPrompt({ lang, goalText, changed, reports }) {
       + '例:「Xの不具合」→「Xの修正」/「Yを追加したい」→「Yの追加」/「Zを速くしたい」→「Zの改善」/「なぜWか調べて」→「Wの調査」。',
     '',
     `ゴール: ${(goalText ?? '').slice(0, 300)}`,
+    latestFeedback ? `最新のユーザー返信（この再レビューで満たすべき条件。初回の結果ではなく、これへの対応をchanged/checkに書く）:\n${String(latestFeedback).slice(0, 1000)}` : null,
     `変更ファイル: ${(changed ?? []).join(', ') || '(なし)'}`,
     `ワーカー報告:\n${(reports ?? '').slice(0, 1500)}`,
   ].join('\n');
@@ -1650,6 +1651,8 @@ export function countInfraFlakes(text = '') {
     /Navigation timeout of \d+\s*ms exceeded/g,        // puppeteer page.goto
     /test timed out after \d+\s*ms/g,                  // node --test per-test timeout
     /\bTarget closed\b/g,                              // puppeteer: browser died mid-test
+    /puppeteer-core is not installed next to the Manager/g, // worktree/node_modules missing
+    /Cannot find module ['"]puppeteer-core['"]/g,          // same dependency failure, alternate Node wording
   ];
   return pats.reduce((n, re) => n + (String(text ?? '').match(re) || []).length, 0);
 }
@@ -3120,6 +3123,12 @@ export function workerPrompt(task, goal, lastFailure, agentName = 'claude-code',
     // TASK/DETAIL below is a paraphrase from the planner — when they differ,
     // follow the user's words.
     goal?.text ? `USER'S REQUEST (verbatim — the source of truth; deliver exactly this):\n${goal.text}` : '',
+    // A review reply is a new, explicit acceptance condition. It used to be
+    // present only as TASK DETAIL below the inherited session context, which
+    // made it easy for a resumed agent to keep describing the first attempt.
+    // Put it next to the original request and make the precedence explicit:
+    // the interface transports the user's words, it does not reinterpret them.
+    task?.reply && task?.detail ? `CURRENT USER FOLLOW-UP (verbatim — these are the acceptance conditions for THIS re-review):\n${task.detail}` : '',
     runContext ? (typeof runContext === 'string' ? runContext : buildWorkerContextBlock(runContext)) : '',
     '',
     `TASK ${task.num}: ${task.title}`,
@@ -3144,6 +3153,7 @@ export function workerPrompt(task, goal, lastFailure, agentName = 'claude-code',
     // instead of expanding scope"): the request, not our fear of scope, sets
     // the size of the work.
     '- Deliver what the request actually asks for. If it asks for multiple options, N variations, a visual, an artifact, or a full exploration, produce ALL of them — do not reduce it to one, and do not cut it short to finish faster.',
+    '- For a review follow-up, implement and report against CURRENT USER FOLLOW-UP above. Do not claim the first attempt as this attempt\'s result. Do not change shared theme tokens, seed/demo data, or unrelated indicators merely to make a manual check easier unless the user explicitly requested those changes; put test fixtures in test files only.',
     '- デザイン案・UI案・レイアウト案を求められた場合は、文章だけで完了にしない。画像を使わない案でも、比較して確認できるHTML等のartifactをプロジェクト内に作り、実際に開ける .manager-run.json を残す。',
     '- Keep the work bounded to the request: inspect only files needed; avoid broad repository scans unless they are necessary.',
     "- You may use the user's installed skills (Skill tool, e.g. /galda-doc) when one clearly fits the request.",

package/engine/server.mjs

@@ -2982,12 +2982,37 @@ const testRunQueue = createSerialQueue();
 // Manager-run tests (never trust the worker's "all green" claim): run the
 // project's own `npm test` in the goal's worktree and parse node --test's
 // "ℹ pass N / ℹ fail N" (or TAP "# pass/# fail"). Returns {ran,passed,failed,ok}.
-function runTestsOnce(dir) {
+function testNodePath(dir, dependencySourceDir = null) {
+  // node_modules is intentionally absent from git worktrees. Reuse the base
+  // checkout's installed dependencies before declaring every server/UI test a
+  // product regression; verification must never silently depend on `npm install`.
+  const sep = process.platform === 'win32' ? ';' : ':';
+  const local = [join(dir, 'node_modules'), dependencySourceDir && join(dependencySourceDir, 'node_modules'), join(ROOT, 'node_modules')]
+    .filter(Boolean).filter(existsSync);
+  return [...new Set([...local, ...(process.env.NODE_PATH ? process.env.NODE_PATH.split(sep) : [])])].join(sep);
+}
+function testEnvironmentPreflight(dir, dependencySourceDir = null) {
+  const nodePath = testNodePath(dir, dependencySourceDir);
+  const sources = nodePath ? nodePath.split(process.platform === 'win32' ? ';' : ':') : [];
+  const hasPuppeteer = sources.some((p) => existsSync(join(p, 'puppeteer-core', 'package.json')));
+  const npm = spawnSync('npm', ['--version'], { encoding: 'utf8' });
+  const checks = [
+    { id: 'node', ok: Boolean(process.execPath), detail: process.version },
+    { id: 'npm', ok: npm.status === 0, detail: npm.status === 0 ? npm.stdout.trim() : 'npm command unavailable' },
+    { id: 'dependencies', ok: sources.length > 0, detail: sources.length ? `${sources.length} node_modules source(s)` : 'node_modules not found' },
+    { id: 'puppeteer', ok: hasPuppeteer, detail: hasPuppeteer ? 'puppeteer-core available' : 'puppeteer-core missing; run npm install in the project directory' },
+  ];
+  return { ok: checks.every((c) => c.ok), checks };
+}
+function runTestsOnce(dir, dependencySourceDir = null) {
   // The timeout is env-overridable so tests can force the killed-run path fast;
   // production keeps the 4-minute default.
   const runTimeout = Number(process.env.MANAGER_TEST_TIMEOUT_MS) || 240000;
   return testRunQueue.run(() => new Promise((res) => {
-    execFile('npm', ['test'], { cwd: dir, timeout: runTimeout, env: { ...process.env }, maxBuffer: 8 * 1024 * 1024 }, (e, out = '', err = '') => {
+    const preflight = testEnvironmentPreflight(dir, dependencySourceDir);
+    if (!preflight.ok) return res({ passed: 0, failed: 0, preflight, timedOut: false, realAssertion: false, infraOnly: true, infraFlakes: 0, detail: preflight.checks.filter((c) => !c.ok).map((c) => c.detail).join('\n'), failingNames: [] });
+    const nodePath = testNodePath(dir, dependencySourceDir);
+    execFile('npm', ['test'], { cwd: dir, timeout: runTimeout, env: { ...process.env, ...(nodePath ? { NODE_PATH: nodePath } : {}) }, maxBuffer: 8 * 1024 * 1024 }, (e, out = '', err = '') => {
       const text = `${out}\n${err}`;
       const n = (re) => { const m = text.match(re); return m ? Number(m[1]) : null; };
       const passed = n(/ℹ pass (\d+)/) ?? n(/# pass (\d+)/) ?? n(/(\d+) passing/) ?? 0;
@@ -3015,21 +3040,21 @@ function runTestsOnce(dir) {
       const timedOut = Boolean(e && (e.killed || e.signal === 'SIGTERM' || e.code === 'ETIMEDOUT'));
       // Capture the failing test NAMES too (not just the count) so the gate can
       // diff them against the base's failures and block only on NEW ones.
-      res({ passed, failed, timedOut, realAssertion, infraOnly, infraFlakes, detail: testOutputExcerpt(text), failingNames: parseFailingTestNames(text) });
+      res({ passed, failed, preflight, timedOut, realAssertion, infraOnly, infraFlakes, detail: testOutputExcerpt(text), failingNames: parseFailingTestNames(text) });
     });
   }));
 }
-async function runProjectTests(dir) {
+async function runProjectTests(dir, dependencySourceDir = null) {
   let hasTest = false;
   try { hasTest = !!JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).scripts?.test; } catch { /* no package.json */ }
   if (!hasTest) return { ran: false };
-  let r = await runTestsOnce(dir);
+  let r = await runTestsOnce(dir, dependencySourceDir);
   // Flake resistance: the integration suite spawns real servers; under load a
   // startup can time out. Re-run once and take the fewer failures — a real
   // failure fails both runs, a flake clears on the retry — so a good goal is
   // never blocked on a flaky test.
   if (r.failed > 0) {
-    const r2 = await runTestsOnce(dir);
+    const r2 = await runTestsOnce(dir, dependencySourceDir);
     const kept = r2.failed <= r.failed ? r2 : r; // the run that saw fewer failures
     r = {
       passed: Math.max(r.passed, r2.passed),
@@ -3044,11 +3069,12 @@ async function runProjectTests(dir) {
       // the gate should see, so no good goal is blocked on a saturated boot.
       infraOnly: !!kept.infraOnly,
       infraFlakes: kept.infraFlakes ?? 0,
+      preflight: kept.preflight ?? r.preflight ?? null,
       detail: kept.detail || r.detail || r2.detail || '',
       failingNames: kept.failingNames ?? r.failingNames ?? [],
     };
   }
-  return { ran: true, passed: r.passed, failed: r.failed, ok: r.failed === 0, timedOut: !!r.timedOut, realAssertion: !!r.realAssertion, infraOnly: !!r.infraOnly, infraFlakes: r.infraFlakes ?? 0, detail: r.detail ?? '', failingNames: r.failingNames ?? [] };
+  return { ran: true, passed: r.passed, failed: r.failed, ok: r.failed === 0, timedOut: !!r.timedOut, realAssertion: !!r.realAssertion, infraOnly: !!r.infraOnly, infraFlakes: r.infraFlakes ?? 0, preflight: r.preflight ?? null, detail: r.detail ?? '', failingNames: r.failingNames ?? [] };
 }
 
 // Failing tests on the BASE (pre-change) checkout — the set the review gate
@@ -3144,7 +3170,7 @@ async function runRetestJob(goal, token) {
   } else {
     for (let i = 0; i < RETEST_RUNS; i++) {
       if (!live()) return; // cancelled (UNDO) / superseded / deleted → discard
-      const r = await runTestsOnce(wdir);
+      const r = await runTestsOnce(wdir, project.dir);
       if (!live()) return; // cancelled while this run was in flight
       results.push({ ran: true, passed: r.passed, failed: r.failed });
       goal.retest = { state: 'running', runs: results.length, total: RETEST_RUNS, startedAt: goal.retest?.startedAt };
@@ -3231,7 +3257,11 @@ async function summarizeForReview(goal, siblings, dir, reviewDefinition) {
   // An explicit ja/en on the project's review definition always overrides.
   const lang = reviewDefinition.language === 'auto' ? detectRequestLanguage(goal.text) : (reviewDefinition.language || 'ja');
   const changed = [...new Set(siblings.flatMap((t) => t.changedFiles ?? []))].slice(0, 20);
-  const reports = siblings.filter((t) => !t.reply).map((t) => `- ${t.title}: ${(t.result ?? '').replace(/\s+/g, ' ').slice(0, 300)}`).join('\n');
+  // A reply is a new implementation attempt, not just conversation. Excluding
+  // it here made the second Review render the first attempt's stale Result,
+  // even when the worker had completed the user's latest feedback.
+  const reports = siblings.map((t) => `${t.reply ? '[follow-up] ' : ''}- ${t.title}: ${(t.result ?? '').replace(/\s+/g, ' ').slice(0, 300)}`).join('\n');
+  const latestFeedback = [...siblings].reverse().find((t) => t.reply && t.detail)?.detail ?? '';
   // The name of the work, from the agent that did it (task.run.title). It wins
   // over both the summarizer and the request text: the summarizer only ever read
   // the same request the user typed, and the request text is the sentence the
@@ -3245,7 +3275,7 @@ async function summarizeForReview(goal, siblings, dir, reviewDefinition) {
     changed: (goal.plan?.[0] ?? goal.text ?? '').replace(/\s+/g, ' ').slice(0, 80),
   };
   if (!changed.length && !reports) return fallback;
-  const prompt = buildReviewSummaryPrompt({ lang, goalText: goal.text, changed, reports });
+  const prompt = buildReviewSummaryPrompt({ lang, goalText: goal.text, changed, reports, latestFeedback });
   try {
     const r = await runUtility({ prompt, cwd: dir, tools: 'Read' });
     const summary = parseReviewSummary(r.result, fallback);
@@ -3509,7 +3539,7 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
   const testGateOn = resolveTestGate({ reviewDefinition, env: process.env, force: forceTests });
   if (testGateOn && hasTestRelevantChanges(changedFiles)) {
     goalAct(`Running project tests in the goal worktree (${changedFiles.length} changed file${changedFiles.length === 1 ? '' : 's'}).`);
-    goal.testResult = await runProjectTests(wdir);
+    goal.testResult = await runProjectTests(wdir, baseProject?.dir);
     goalAct(`Project tests finished: ${goal.testResult.failed ?? 0} failed, ${goal.testResult.passed ?? 0} passed.`);
   } else if (!testGateOn) {
     goal.testResult = { ran: false, skipped: true, skippedReason: 'test gate off (opt-in: requireTests / MANAGER_VERIFY_GATE=on)' };
@@ -3561,6 +3591,11 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
   if (goal.testResult.ran && goal.testResult.infraOnly && !goal.testResult.inconclusive) {
     goalAct(`Project tests: all ${goal.testResult.infraFlakes || goal.testResult.failed || ''} failure(s) were infra flakes (a real server could not boot / a wait timed out under machine load), not code regressions — not blocking. Re-run when the machine is idle to confirm.`.replace(/\s{2,}/g, ' '));
   }
+  if (goal.testResult.ran && goal.testResult.preflight && !goal.testResult.preflight.ok) {
+    const missing = goal.testResult.preflight.checks.filter((c) => !c.ok).map((c) => c.id).join(', ');
+    goal.testResult.inconclusive = true;
+    goalAct(`Project tests were not started: verification preflight failed (${missing}). This is an environment issue, not an implementation failure. Fix the listed dependency or tool, then re-run verification.`);
+  }
   // Baseline diff (Masa 2026-07-19): block ONLY on failures THIS change
   // introduced. A test already red on the base — e.g. persist-failure on clean
   // origin/main — is pre-existing noise and must not knock a proof-verified
@@ -3932,6 +3967,23 @@ const server = createServer(async (req, res) => {
     return json(res, 200, { projects: projectsWithBranch, goals: visibleGoals, tasks: trimTaskActivityForState(visibleTasks), models: MODELS, agentModels: { 'claude-code': MODELS, codex: CODEX_MODELS }, agentEfforts: { 'claude-code': CLAUDE_EFFORTS, codex: CODEX_EFFORTS }, agents: AVAILABLE_AGENTS, connectCommand, queueOrder, externalActivity, workflowColumns: projectColumns, reviewDefinitions: projectReviewDefs, runningCounts, parallelLimits, uiVersion: uiVersion(), billing, auth: publicAuth() });
   }
 
+  // Read-only stability snapshot: separates implementation failures from
+  // verification infrastructure so operational trends can be monitored without
+  // scraping human-facing cards. The browser dashboard can consume this later.
+  if (url.pathname === '/api/stability' && req.method === 'GET') {
+    const since = Date.now() - 24 * 60 * 60 * 1000;
+    const recentGoals = goals.filter((g) => Date.parse(g.createdAt ?? '') >= since);
+    const count = (fn) => recentGoals.filter(fn).length;
+    return json(res, 200, {
+      since: new Date(since).toISOString(), generatedAt: new Date().toISOString(), total: recentGoals.length,
+      implementationFailures: count((g) => ['failed', 'partial'].includes(g.status) && !g.verificationInfraError),
+      verificationInfrastructure: count((g) => Boolean(g.verificationInfraError)),
+      timeoutsOrInconclusive: count((g) => Boolean(g.testResult?.inconclusive)),
+      workerHolds: count((g) => ['rate-limit', 'budget'].includes(g.blocked?.kind)),
+      readyForReview: count((g) => g.status === 'review'),
+    });
+  }
+
   // Billing (docs/BILLING-LAUNCH-PLAN.md): activate the license key a user
   // copies from galda.app after paying. GET reports whether one is on file
   // (for the settings panel); POST verifies+persists a newly pasted token.
@@ -4185,6 +4237,16 @@ const server = createServer(async (req, res) => {
       for (const t of removedTasks) logAppend(JSON.stringify({ kind: 'task', id: t.id, deleted: true }));
       projects.splice(idx, 1);
       queues.delete(project.id);
+      // A deleted project's goals must not outlive it: project ids are derived
+      // from the name (uniqueProjectId), so a later "+ New project" click can
+      // regenerate the exact same id and — without this purge — inherit the
+      // old project's leftover goals as if they belonged to the brand-new one
+      // (Masa report 2026-07-27: new project shows Review items on creation).
+      for (const g of goals.filter((g) => g.projectId === project.id)) {
+        goals = goals.filter((x) => x.id !== g.id);
+        logAppend(JSON.stringify({ kind: 'goal', id: g.id, deleted: true }));
+        sendGoalEvent({ ev: 'goal-deleted', id: g.id }, g);
+      }
       saveProjects();
       send({ ev: 'projects', projects, deletedProjectId: project.id });
       return json(res, 200, { ok: true, projects, deletedProjectId: project.id });
@@ -5418,7 +5480,19 @@ async function answerGoalQuestion(goal, question) {
   if (upMatch) {
     const file = join(logDir, 'uploads', upMatch[1]);
     if (!existsSync(file)) { res.writeHead(404); return res.end('not found'); }
-    res.writeHead(200, { 'content-type': file.endsWith('.gif') ? 'image/gif' : file.endsWith('.jpg') || file.endsWith('.jpeg') ? 'image/jpeg' : 'image/png' });
+    // Worker-declared Open it artifacts and image attachments share `/upload`.
+    // Never guess that an unknown artifact is a PNG: it turns valid HTML, PDF,
+    // or text into a broken-image page. Known preview formats get their real
+    // browser type; an unknown file downloads safely instead of being misread.
+    const ext = (file.match(/\.([a-z0-9]+)$/i)?.[1] || '').toLowerCase();
+    const types = {
+      html: 'text/html; charset=utf-8', htm: 'text/html; charset=utf-8',
+      css: 'text/css; charset=utf-8', js: 'text/javascript; charset=utf-8', mjs: 'text/javascript; charset=utf-8',
+      json: 'application/json; charset=utf-8', txt: 'text/plain; charset=utf-8', md: 'text/markdown; charset=utf-8', csv: 'text/csv; charset=utf-8',
+      svg: 'image/svg+xml', png: 'image/png', gif: 'image/gif', jpg: 'image/jpeg', jpeg: 'image/jpeg', webp: 'image/webp', ico: 'image/x-icon',
+      pdf: 'application/pdf', mp4: 'video/mp4', webm: 'video/webm', wasm: 'application/wasm',
+    };
+    res.writeHead(200, { 'content-type': types[ext] || 'application/octet-stream' });
     return res.end(readFileSync(file));
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.82",
+  "version": "0.10.84",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {