@galda/cli 0.10.83 → 0.10.85

package/engine/server.mjs

@@ -21,8 +21,9 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
 import { needsProjectFolder, folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse, isCommandOnPath } from './lib.mjs';
-import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, classifyWorkerFailure, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, latestGoalOutcomeTask, buildDirtyWorkspacePrBlock, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, rebasePreviewUrl, shouldCreateGoalPR, normalizePullRequestUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, autoFoldReviewsEnabled, parseGitUnifiedDiffLocations, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyPrSafety, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildVerificationInfraError, verificationInfraErrorFrom, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, testFailureReason, manualTestRetryPrompt, isNothingVerifiable, isNothingVerifiableForPR, isSuspiciouslyIncompleteDone, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, shouldUsePlannerForGoal, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, buildGoalMessage, serializeGoalMessage, parseGoalMessages, computeInternalQualityMetrics, classifyInternalQualityTaskError, resolveWorkspaceMode, goalSessionFor, setGoalAgentSession, switchGoalAgentSession } from './lib.mjs';
+import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, classifyWorkerFailure, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildReviewAttemptLedger, latestGoalOutcomeTask, buildDirtyWorkspacePrBlock, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, rebasePreviewUrl, shouldCreateGoalPR, normalizePullRequestUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, autoFoldReviewsEnabled, parseGitUnifiedDiffLocations, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyPrSafety, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildVerificationInfraError, verificationInfraErrorFrom, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, testFailureReason, manualTestRetryPrompt, isNothingVerifiable, isNothingVerifiableForPR, isSuspiciouslyIncompleteDone, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, shouldUsePlannerForGoal, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, buildGoalMessage, serializeGoalMessage, parseGoalMessages, computeInternalQualityMetrics, classifyInternalQualityTaskError, resolveWorkspaceMode, goalSessionFor, setGoalAgentSession, switchGoalAgentSession, parseApprovalRequest } from './lib.mjs';
 import { createSerialQueue } from './lib.mjs';
+import { parseRequirementEvidence, unmappedChangedFiles } from './lib.mjs';
 import { isPrClosed } from './lib.mjs';
 import { collectProjectRules } from './lib.mjs';
 import { FALLBACK_CODEX_MODELS, loadCodexModels } from './codex-models.mjs';
@@ -1397,7 +1398,7 @@ function cancelGoalWork(goal) {
   killGoalWorkers(goal.id);
   const q = queues.get(goal.projectId);
   if (q) q.waiting = q.waiting.filter((t) => t.goalId !== goal.id);
-  for (const t of tasks.filter((t) => t.goalId === goal.id && ['queued', 'running', 'interrupted'].includes(t.status))) {
+  for (const t of tasks.filter((t) => t.goalId === goal.id && ['queued', 'running', 'interrupted', 'awaitingApproval'].includes(t.status))) {
     t.status = 'cancelled'; t.finishedAt = new Date().toISOString(); saveTask(t);
   }
 }
@@ -2208,11 +2209,17 @@ function queueReplyTask(goal, text, { from = 'manager', via = 'composer' } = {})
   const task = {
     id: nextId++, num: (nums.length ? Math.max(...nums) : 0) + 1,
     goalId: goal.id, projectId: goal.projectId, reply: true, model: goal.model, effort: goal.effort, agent: goal.agent,
-    title: text.replace(/\s+/g, ' ').slice(0, 60), detail: promptText.slice(0, 4000),
+    title: text.replace(/\s+/g, ' ').slice(0, 60), detail: promptText.slice(0, 4000), replyFrom: from,
     workspaceMode: resolveWorkspaceMode(goal.workspaceMode ?? goal.worktree),
     worktree: goal.worktree === false ? false : undefined,
     passCondition: null, status: 'queued', createdAt: new Date().toISOString(), priority: '中',
     result: null, changedFiles: [], secs: null, activity: [], proof: null, usage: null,
+    userRequirementHistory: tasks.filter((t) => t.goalId === goal.id && (!t.reply || t.replyFrom === 'you')).slice(-12).map((t) => ({ text: t.reply ? t.detail : t.title, status: t.status })),
+    // Transport the prior attempts as facts; the worker, not Manager, decides
+    // what to implement in response to the new user reply.
+    requirementHistory: tasks.filter((t) => t.goalId === goal.id).slice(-12).map((t) => ({
+      text: t.reply ? t.detail : t.title, status: t.status, reply: !!t.reply,
+    })),
   };
   tasks.push(task);
   saveTask(task);
@@ -2252,6 +2259,24 @@ function queueReplyTask(goal, text, { from = 'manager', via = 'composer' } = {})
   return task;
 }
 
+function pauseGoalForApproval(goal, task, request) {
+  if (!goal || !task || !request) return false;
+  const requestedAt = new Date().toISOString();
+  goal.status = 'needsApproval';
+  goal.startedAt = null;
+  goal.pauseReason = 'approval_required';
+  goal.approvalRequest = { ...request, requestedAt, pausedTaskId: task.id, external: false };
+  goal.approvalDecision = null;
+  task.status = 'awaitingApproval';
+  task.result = request.question;
+  task.finishedAt = null;
+  saveTask(task);
+  saveGoal(goal);
+  sendProcessAct(task, `Paused for your approval: ${request.question}`);
+  startNextStacked(goal.projectId);
+  return true;
+}
+
 // split (docs/design/ONE-CONVERSATION.md §1.3): 「それは別件」と返された時の受け皿。
 // 元のゴールには触らない——新しいチケットを1枚起こし、そこに「どこから生まれたか」だけ
 // 片方向の印（bornFrom）を残す。
@@ -2723,8 +2748,11 @@ async function runTask(task) {
     task.secs = Math.round((Date.now() - t0) / 1000);
     task.status = r.code === 0 ? 'done' : 'failed';
     task.result = r.result.slice(0, RESULT_MAX);
+    task.requirementEvidence = parseRequirementEvidence(task.result);
     task.usage = sumUsage([r.usage]);
     if (r.sessionId && goal) { setGoalAgentSession(goal, runAgent, r.sessionId); saveGoal(goal); }
+    const approval = parseApprovalRequest(r.result);
+    if (approval && pauseGoalForApproval(goal, task, approval)) return;
     // A follow-up owns its own evidence too. Previously only the initial task
     // consumed .manager-run.json, so replies either left the new declaration
     // behind or Review kept showing an older task's title/URL.
@@ -2734,6 +2762,8 @@ async function runTask(task) {
     inheritPreviousRunDeclaration(task, goal?.id);
     const afterR = await gitChanges(workDir);
     task.changedFiles = afterR.filter((l) => !before.includes(l)).map((l) => l.slice(3));
+    task.unmappedChangedFiles = unmappedChangedFiles(task.changedFiles, task.requirementEvidence);
+    task.requirementVerification = { proof: task.proof ?? null, run: task.run ?? null, changedFiles: task.changedFiles };
     sendProcessAct(task, `Detected ${task.changedFiles.length} changed file${task.changedFiles.length === 1 ? '' : 's'} from this follow-up.`);
     task.finishedAt = new Date().toISOString();
     task.resultAttemptId = task.attemptId;
@@ -2760,7 +2790,7 @@ async function runTask(task) {
 
   // No `lastFailure` any more: it existed only to tell the next attempt why our
   // check had rejected the last one, and there is no next attempt now.
-  let verify = null, verdict = null, code = 0, result = '', usages = [], timedOut = false;
+  let verify = null, verdict = null, code = 0, result = '', usages = [], timedOut = false, approval = null;
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     let callT0 = Date.now();
     const plan = goal?.executionPlan;
@@ -2822,6 +2852,8 @@ async function runTask(task) {
       ? `Worker attempt ${attempt} was stopped at the ${Math.round(WORKER_TIMEOUT_MS / 60000)}-minute run limit (exit ${code}).`
       : `Worker attempt ${attempt} finished with exit code ${code}.`);
     if (r.sessionId && goal) { setGoalAgentSession(goal, runAgent, r.sessionId); saveGoal(goal); }
+    approval = parseApprovalRequest(result);
+    if (approval) break;
     if (!entryUrl) break;
     try {
       if (!verify) {
@@ -2859,6 +2891,11 @@ async function runTask(task) {
   }
 
   if (goal?.cancelled) return; // deleted during the verify loop → don't resurrect the task
+  if (approval) {
+    task.secs = Math.round((Date.now() - t0) / 1000);
+    task.usage = sumUsage(usages);
+    if (pauseGoalForApproval(goal, task, approval)) return;
+  }
   task.secs = Math.round((Date.now() - t0) / 1000);
   // Status decision, most-authoritative first (taskStatusAfterVerify in lib):
   //  1. an independent verify PASS = verified success — wins even if the worker
@@ -2885,6 +2922,7 @@ async function runTask(task) {
   // force-stopped task states WHY so the Attention card explains itself.
   if (forcedStop && (!result || result === '(no output)')) result = workerExitReason(code, timedOut, WORKER_TIMEOUT_MS);
   task.result = result.slice(0, RESULT_MAX);
+  task.requirementEvidence = parseRequirementEvidence(task.result);
   task.usage = sumUsage(usages);
   if (verdict) {
     const label = verdict.pass ? 'PASS' : verdict.inconclusive ? 'INCONCLUSIVE (自動確認できず・要確認)' : 'FAIL';
@@ -2930,6 +2968,8 @@ async function runTask(task) {
   reconcileComparePair(task);
   const after = await gitChanges(workDir);
   task.changedFiles = after.filter((l) => !before.includes(l)).map((l) => l.slice(3));
+  task.unmappedChangedFiles = unmappedChangedFiles(task.changedFiles, task.requirementEvidence);
+  task.requirementVerification = { proof: task.proof ?? null, run: task.run ?? null, changedFiles: task.changedFiles };
   sendProcessAct(task, `Detected ${task.changedFiles.length} changed file${task.changedFiles.length === 1 ? '' : 's'} from this task.`);
   // task 450: taskStatusAfterVerify decided 'done' from `code` alone, before
   // changedFiles existed to check against. Don't trust a clean exit code by
@@ -2991,11 +3031,26 @@ function testNodePath(dir, dependencySourceDir = null) {
     .filter(Boolean).filter(existsSync);
   return [...new Set([...local, ...(process.env.NODE_PATH ? process.env.NODE_PATH.split(sep) : [])])].join(sep);
 }
+function testEnvironmentPreflight(dir, dependencySourceDir = null) {
+  const nodePath = testNodePath(dir, dependencySourceDir);
+  const sources = nodePath ? nodePath.split(process.platform === 'win32' ? ';' : ':') : [];
+  const hasPuppeteer = sources.some((p) => existsSync(join(p, 'puppeteer-core', 'package.json')));
+  const npm = spawnSync('npm', ['--version'], { encoding: 'utf8' });
+  const checks = [
+    { id: 'node', ok: Boolean(process.execPath), detail: process.version },
+    { id: 'npm', ok: npm.status === 0, detail: npm.status === 0 ? npm.stdout.trim() : 'npm command unavailable' },
+    { id: 'dependencies', ok: sources.length > 0, detail: sources.length ? `${sources.length} node_modules source(s)` : 'node_modules not found' },
+    { id: 'puppeteer', ok: hasPuppeteer, detail: hasPuppeteer ? 'puppeteer-core available' : 'puppeteer-core missing; run npm install in the project directory' },
+  ];
+  return { ok: checks.every((c) => c.ok), checks };
+}
 function runTestsOnce(dir, dependencySourceDir = null) {
   // The timeout is env-overridable so tests can force the killed-run path fast;
   // production keeps the 4-minute default.
   const runTimeout = Number(process.env.MANAGER_TEST_TIMEOUT_MS) || 240000;
   return testRunQueue.run(() => new Promise((res) => {
+    const preflight = testEnvironmentPreflight(dir, dependencySourceDir);
+    if (!preflight.ok) return res({ passed: 0, failed: 0, preflight, timedOut: false, realAssertion: false, infraOnly: true, infraFlakes: 0, detail: preflight.checks.filter((c) => !c.ok).map((c) => c.detail).join('\n'), failingNames: [] });
     const nodePath = testNodePath(dir, dependencySourceDir);
     execFile('npm', ['test'], { cwd: dir, timeout: runTimeout, env: { ...process.env, ...(nodePath ? { NODE_PATH: nodePath } : {}) }, maxBuffer: 8 * 1024 * 1024 }, (e, out = '', err = '') => {
       const text = `${out}\n${err}`;
@@ -3025,7 +3080,7 @@ function runTestsOnce(dir, dependencySourceDir = null) {
       const timedOut = Boolean(e && (e.killed || e.signal === 'SIGTERM' || e.code === 'ETIMEDOUT'));
       // Capture the failing test NAMES too (not just the count) so the gate can
       // diff them against the base's failures and block only on NEW ones.
-      res({ passed, failed, timedOut, realAssertion, infraOnly, infraFlakes, detail: testOutputExcerpt(text), failingNames: parseFailingTestNames(text) });
+      res({ passed, failed, preflight, timedOut, realAssertion, infraOnly, infraFlakes, detail: testOutputExcerpt(text), failingNames: parseFailingTestNames(text) });
     });
   }));
 }
@@ -3054,11 +3109,12 @@ async function runProjectTests(dir, dependencySourceDir = null) {
       // the gate should see, so no good goal is blocked on a saturated boot.
       infraOnly: !!kept.infraOnly,
       infraFlakes: kept.infraFlakes ?? 0,
+      preflight: kept.preflight ?? r.preflight ?? null,
       detail: kept.detail || r.detail || r2.detail || '',
       failingNames: kept.failingNames ?? r.failingNames ?? [],
     };
   }
-  return { ran: true, passed: r.passed, failed: r.failed, ok: r.failed === 0, timedOut: !!r.timedOut, realAssertion: !!r.realAssertion, infraOnly: !!r.infraOnly, infraFlakes: r.infraFlakes ?? 0, detail: r.detail ?? '', failingNames: r.failingNames ?? [] };
+  return { ran: true, passed: r.passed, failed: r.failed, ok: r.failed === 0, timedOut: !!r.timedOut, realAssertion: !!r.realAssertion, infraOnly: !!r.infraOnly, infraFlakes: r.infraFlakes ?? 0, preflight: r.preflight ?? null, detail: r.detail ?? '', failingNames: r.failingNames ?? [] };
 }
 
 // Failing tests on the BASE (pre-change) checkout — the set the review gate
@@ -3241,7 +3297,11 @@ async function summarizeForReview(goal, siblings, dir, reviewDefinition) {
   // An explicit ja/en on the project's review definition always overrides.
   const lang = reviewDefinition.language === 'auto' ? detectRequestLanguage(goal.text) : (reviewDefinition.language || 'ja');
   const changed = [...new Set(siblings.flatMap((t) => t.changedFiles ?? []))].slice(0, 20);
-  const reports = siblings.filter((t) => !t.reply).map((t) => `- ${t.title}: ${(t.result ?? '').replace(/\s+/g, ' ').slice(0, 300)}`).join('\n');
+  // A reply is a new implementation attempt, not just conversation. Excluding
+  // it here made the second Review render the first attempt's stale Result,
+  // even when the worker had completed the user's latest feedback.
+  const reports = siblings.map((t) => `${t.reply ? '[follow-up] ' : ''}- ${t.title}: ${(t.result ?? '').replace(/\s+/g, ' ').slice(0, 300)}`).join('\n');
+  const latestFeedback = [...siblings].reverse().find((t) => t.reply && t.detail)?.detail ?? '';
   // The name of the work, from the agent that did it (task.run.title). It wins
   // over both the summarizer and the request text: the summarizer only ever read
   // the same request the user typed, and the request text is the sentence the
@@ -3255,7 +3315,7 @@ async function summarizeForReview(goal, siblings, dir, reviewDefinition) {
     changed: (goal.plan?.[0] ?? goal.text ?? '').replace(/\s+/g, ' ').slice(0, 80),
   };
   if (!changed.length && !reports) return fallback;
-  const prompt = buildReviewSummaryPrompt({ lang, goalText: goal.text, changed, reports });
+  const prompt = buildReviewSummaryPrompt({ lang, goalText: goal.text, changed, reports, latestFeedback });
   try {
     const r = await runUtility({ prompt, cwd: dir, tools: 'Read' });
     const summary = parseReviewSummary(r.result, fallback);
@@ -3438,6 +3498,7 @@ async function finishGoalIfComplete(goal, project, activityTask = null) {
   // after) so the PR body's "確認ポイント" headline is available the first
   // time the PR is opened, not only on the review card (Masa 2026-07-16).
   goalAct('Writing the review summary from the worker report and diff.');
+  goal.reviewAttempt = buildReviewAttemptLedger({ goal, tasks: siblings });
   goal.reviewSummary = await summarizeForReview(goal, siblings, wdir, reviewDefinition);
   if (activityTask?.attemptId) goal.reviewSummaryAttemptId = activityTask.attemptId;
   goalAct('Checking changed files and preparing the PR branch if code changed.');
@@ -3519,7 +3580,7 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
   const testGateOn = resolveTestGate({ reviewDefinition, env: process.env, force: forceTests });
   if (testGateOn && hasTestRelevantChanges(changedFiles)) {
     goalAct(`Running project tests in the goal worktree (${changedFiles.length} changed file${changedFiles.length === 1 ? '' : 's'}).`);
-    goal.testResult = await runProjectTests(wdir, project.dir);
+    goal.testResult = await runProjectTests(wdir, baseProject?.dir);
     goalAct(`Project tests finished: ${goal.testResult.failed ?? 0} failed, ${goal.testResult.passed ?? 0} passed.`);
   } else if (!testGateOn) {
     goal.testResult = { ran: false, skipped: true, skippedReason: 'test gate off (opt-in: requireTests / MANAGER_VERIFY_GATE=on)' };
@@ -3571,6 +3632,11 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
   if (goal.testResult.ran && goal.testResult.infraOnly && !goal.testResult.inconclusive) {
     goalAct(`Project tests: all ${goal.testResult.infraFlakes || goal.testResult.failed || ''} failure(s) were infra flakes (a real server could not boot / a wait timed out under machine load), not code regressions — not blocking. Re-run when the machine is idle to confirm.`.replace(/\s{2,}/g, ' '));
   }
+  if (goal.testResult.ran && goal.testResult.preflight && !goal.testResult.preflight.ok) {
+    const missing = goal.testResult.preflight.checks.filter((c) => !c.ok).map((c) => c.id).join(', ');
+    goal.testResult.inconclusive = true;
+    goalAct(`Project tests were not started: verification preflight failed (${missing}). This is an environment issue, not an implementation failure. Fix the listed dependency or tool, then re-run verification.`);
+  }
   // Baseline diff (Masa 2026-07-19): block ONLY on failures THIS change
   // introduced. A test already red on the base — e.g. persist-failure on clean
   // origin/main — is pre-existing noise and must not knock a proof-verified
@@ -3942,6 +4008,23 @@ const server = createServer(async (req, res) => {
     return json(res, 200, { projects: projectsWithBranch, goals: visibleGoals, tasks: trimTaskActivityForState(visibleTasks), models: MODELS, agentModels: { 'claude-code': MODELS, codex: CODEX_MODELS }, agentEfforts: { 'claude-code': CLAUDE_EFFORTS, codex: CODEX_EFFORTS }, agents: AVAILABLE_AGENTS, connectCommand, queueOrder, externalActivity, workflowColumns: projectColumns, reviewDefinitions: projectReviewDefs, runningCounts, parallelLimits, uiVersion: uiVersion(), billing, auth: publicAuth() });
   }
 
+  // Read-only stability snapshot: separates implementation failures from
+  // verification infrastructure so operational trends can be monitored without
+  // scraping human-facing cards. The browser dashboard can consume this later.
+  if (url.pathname === '/api/stability' && req.method === 'GET') {
+    const since = Date.now() - 24 * 60 * 60 * 1000;
+    const recentGoals = goals.filter((g) => Date.parse(g.createdAt ?? '') >= since);
+    const count = (fn) => recentGoals.filter(fn).length;
+    return json(res, 200, {
+      since: new Date(since).toISOString(), generatedAt: new Date().toISOString(), total: recentGoals.length,
+      implementationFailures: count((g) => ['failed', 'partial'].includes(g.status) && !g.verificationInfraError),
+      verificationInfrastructure: count((g) => Boolean(g.verificationInfraError)),
+      timeoutsOrInconclusive: count((g) => Boolean(g.testResult?.inconclusive)),
+      workerHolds: count((g) => ['rate-limit', 'budget'].includes(g.blocked?.kind)),
+      readyForReview: count((g) => g.status === 'review'),
+    });
+  }
+
   // Billing (docs/BILLING-LAUNCH-PLAN.md): activate the license key a user
   // copies from galda.app after paying. GET reports whether one is on file
   // (for the settings panel); POST verifies+persists a newly pasted token.
@@ -4276,14 +4359,14 @@ const server = createServer(async (req, res) => {
     req.on('data', (d) => { body += d; });
     req.on('end', async () => {
       try {
-        const { projectId, text, pr, existingPr, images, model, effort, source, pending, review, note, mode, skill, agent, worktree, workspaceMode } = JSON.parse(body);
+        const { projectId, text, pr, existingPr, images, model, effort, source, pending, review, approval, action, scope, resumeInstruction, note, mode, skill, agent, worktree, workspaceMode } = JSON.parse(body);
         const project = projects.find((p) => p.id === projectId);
         if (!project || !text?.trim()) return json(res, 400, { error: 'projectId and text required' });
         // Chat-driven play/pause (Masa: "チャットで再生一時停止はおせる"). Deterministic
         // (no LLM), checked BEFORE the intent router below: a short command-like
         // "止めて"/"再開" toggles THIS project's pause state and returns a chat reply
         // — it never becomes a To-Do. /later and /review skip this like the router.
-        if (!pending && !review) {
+        if (!pending && !review && !approval) {
           const pauseIntent = detectPauseIntent(text.trim());
           if (pauseIntent === 'pause') {
             pauseProject(projectId);
@@ -4307,7 +4390,7 @@ const server = createServer(async (req, res) => {
         // words then become a new ticket, which is what happens today anyway — a typo
         // must never make a request disappear.
         const identity = identityFor(req);
-        if (!pending && !review) {
+        if (!pending && !review && !approval) {
           const addr = parseGoalAddress(text);
           const target = addr && goals.find((g) => g.id === addr.goalId
             && g.projectId === projectId
@@ -4331,7 +4414,7 @@ const server = createServer(async (req, res) => {
         // anything else gets one Haiku round-trip that both classifies and writes
         // the reply. LLM failure falls back to 'task' — never drop a real
         // implementation ask (the folder guard below still prevents no-ops).
-        if (!pending && !review && classifyComposerIntentHeuristic(text.trim()) === 'chat') {
+        if (!pending && !review && !approval && classifyComposerIntentHeuristic(text.trim()) === 'chat') {
           // Only a HIGH-confidence chat/help/settings message reaches the LLM —
           // to write the reply, and to let the model veto back to 'task' if the
           // heuristic over-fired. Everything else (clear tasks AND ambiguous
@@ -4374,7 +4457,7 @@ const server = createServer(async (req, res) => {
         // reusing the needsInput clarifying card; the answer (POST /answer)
         // rebinds this goal to the chosen repo, then planning proceeds. Skipped
         // for pending/review items (they never spawn a worker).
-        const runnable = !pending && !review;
+        const runnable = !pending && !review && !approval;
         const needsFolder = runnable && needsProjectFolder({ dir: project.dir, homeDir: HOME, isRepo: isGitRepo(project.dir) });
         const lang = /[぀-ヿ㐀-鿿]/.test(text) ? 'ja' : 'en';
         const folderQuestion = needsFolder ? buildFolderQuestion(detectRepos(HOME), { lang }) : undefined;
@@ -4399,17 +4482,27 @@ const server = createServer(async (req, res) => {
         if (review && existingPr && !importedPr) return json(res, 400, { error: 'existingPr must be a GitHub pull request URL' });
         const goal = {
           id: nextId++, projectId, text: text.trim().slice(0, 8000),
-          status: (needsFolder || needsReviewPref) ? 'needsInput' : review ? 'review' : pending ? 'pending' : 'stacked',
+          status: (needsFolder || needsReviewPref) ? 'needsInput' : approval ? 'needsApproval' : review ? 'review' : pending ? 'pending' : 'stacked',
           question: folderQuestion || reviewPrefQuestion,
+          pauseReason: approval ? 'approval_required' : undefined,
+          approvalRequest: approval ? {
+            type: 'approval_required',
+            action: String(action || 'continue').trim().slice(0, 120),
+            question: text.trim().slice(0, 500),
+            scope: Array.isArray(scope) ? scope.map((x) => String(x).trim().slice(0, 300)).filter(Boolean).slice(0, 20) : [],
+            resumeInstruction: String(resumeInstruction || '').trim().slice(0, 1000),
+            requestedAt: new Date().toISOString(), external: true,
+          } : undefined,
+          approvalDecision: null,
           reviewOnly: review ? true : undefined,
           note: review && typeof note === 'string' && note.trim() ? note.trim().slice(0, 8000) : undefined,
-          wantsPR: review ? Boolean(importedPr) : resolveWantsPR(pr, text, getReviewDefinition(projectId).defaultWantsPR),
+          wantsPR: (review || approval) ? Boolean(importedPr) : resolveWantsPR(pr, text, getReviewDefinition(projectId).defaultWantsPR),
           model: workerModel(goalAgent, model),
           effort: workerEffort(goalAgent, effort),
           agent: goalAgent,
           // MODE (Auto/Plan): plan = propose a plan first, approve to execute.
           // review-only goals never run a worker, so mode is moot → 'auto'.
-          mode: (!review && GOAL_MODES.includes(mode)) ? mode : 'auto',
+          mode: (!review && !approval && GOAL_MODES.includes(mode)) ? mode : 'auto',
           // SKILL: an optional user/project skill (or command) to invoke first.
           skill: (typeof skill === 'string' && skill.trim()) ? skill.trim().slice(0, 80) : null,
           // WORKSPACE MODE: isolated-worktree is the default and uses a clean per-goal
@@ -4855,6 +4948,69 @@ const server = createServer(async (req, res) => {
   }
 
   // Slack-style thread reply on a goal: resumes the goal's worker session
+  // A Needs you decision is not a Review verdict. It either resumes the same
+  // goal/session with an explicit permission boundary, or ends the paused work.
+  const approvalMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/approval$/);
+  if (approvalMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(approvalMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    if (goal.status !== 'needsApproval' || !goal.approvalRequest) return json(res, 409, { error: 'goal is not awaiting approval' });
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      let decision = '', instruction = '';
+      try {
+        const parsed = JSON.parse(body || '{}');
+        decision = String(parsed.decision ?? '').trim();
+        instruction = String(parsed.instruction ?? '').trim().slice(0, 2000);
+      } catch { return json(res, 400, { error: 'bad json' }); }
+      if (!['proceed', 'edit', 'cancel'].includes(decision)) return json(res, 400, { error: 'decision must be proceed, edit, or cancel' });
+      if (decision === 'edit' && !instruction) return json(res, 400, { error: 'instruction required for edit' });
+      const decidedAt = new Date().toISOString();
+      goal.approvalDecision = { decision, instruction: instruction || undefined, decidedAt };
+      const request = goal.approvalRequest;
+
+      // MCP/external agents cannot be resumed by this process. Persist the
+      // decision for manager_status polling and close this human-only card.
+      if (request.external) {
+        goal.status = decision === 'cancel' ? 'skipped' : 'done';
+        goal.pauseReason = null;
+        saveGoal(goal);
+        startNextStacked(goal.projectId);
+        return json(res, 200, goal);
+      }
+
+      const paused = tasks.find((t) => t.id === request.pausedTaskId && t.goalId === goal.id);
+      if (decision === 'cancel') {
+        const q = queues.get(goal.projectId);
+        if (q) q.waiting = q.waiting.filter((t) => t.goalId !== goal.id);
+        for (const t of tasks.filter((t) => t.goalId === goal.id && ['queued', 'awaitingApproval'].includes(t.status))) {
+          t.status = 'cancelled'; t.finishedAt = decidedAt; saveTask(t);
+        }
+        goal.status = 'skipped'; goal.pauseReason = null; goal.startedAt = null;
+        saveGoal(goal); startNextStacked(goal.projectId);
+        return json(res, 200, goal);
+      }
+
+      if (paused) {
+        paused.status = 'done';
+        paused.finishedAt = decidedAt;
+        paused.result = `Approval received: ${request.question}`;
+        saveTask(paused);
+      }
+      const scopeText = request.scope?.length ? `\n許可された範囲:\n- ${request.scope.join('\n- ')}` : '';
+      const resumeText = decision === 'edit'
+        ? `承認条件が更新されました。次の指示の範囲で同じ作業を再開し、最後まで完了してください。\n${instruction}`
+        : `${request.resumeInstruction || `「${request.action}」の実行が承認されました。同じ作業を再開し、最後まで完了してください。`}${scopeText}`;
+      goal.status = 'running'; goal.pauseReason = null; goal.startedAt = null;
+      saveGoal(goal);
+      const replyTask = queueReplyTask(goal, resumeText, { from: 'you', via: 'approval' });
+      return json(res, 200, { ...goal, replyTaskId: replyTask.id });
+    });
+    return;
+  }
+
   // Smart intake: answer a planner clarifying question → fold it into the goal
   // and re-plan (no new worker; same goal continues to decomposition).
   const answerMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/answer$/);
@@ -5028,6 +5184,7 @@ const server = createServer(async (req, res) => {
     const goal = goals.find((g) => g.id === Number(replyMatch[1]));
     if (!goal) return json(res, 404, { error: 'goal not found' });
     if (!requireGoalOwnership(req, res, goal)) return;
+    if (goal.status === 'needsApproval') return json(res, 409, { error: 'goal is awaiting an approval decision — use /approval' });
     if (['stacked', 'planning'].includes(goal.status)) return json(res, 409, { error: 'goal not started yet — edit it instead' });
     let body = '';
     req.on('data', (d) => { body += d; });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.83",
+  "version": "0.10.85",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {