@galda/cli 0.10.88 → 0.10.89

package/CLAUDE.md

@@ -105,6 +105,8 @@
 - Worker/API へは**必ず所有ドメイン `https://galda.app`（custom domain）経由**で参照する。`*.workers.dev` サブドメインを製品コードに焼き込まない（`MANAGER_BILLING_API_URL` 等の既定値は `https://galda.app`）。
 - **Cloudflare/wrangler にデプロイする前に `wrangler whoami` でデプロイ先アカウントを確認**し、Galda/Kodo 所有であること・workers.dev サブドメイン名に客先名や別プロジェクト名が出ていないことを確かめる。怪しければ止めて Masa に確認（本番デプロイは Masa 明示許可制）。
 - **リリースは4面**（① npm ② Fly ③ Worker ④ Masaの常駐インスタンス `~/manager-for-ai`:4400）。①だけ出して④を忘れると「直したのに直ってない」＋relay相互kickループ再発の実例あり（2026-07-16/17）。全文＝`docs/RELEASE-WORKFLOW.md`の「本番は1つじゃない」表。
+- **常駐Managerを直接 `kill`／`launchctl kickstart -k` しない**（2026-07-28、実行中3 workerを同時中断した実例）。再起動は対象checkoutで
+  `node tools/safe-restart-manager.mjs` を使う。このコマンドはDoing／Finalizingが1件でもあれば拒否する。拒否時は完了を待って再実行し、Agent切替で回避しない。
 
 ## relay接続（`app.galda.app`）を伴う作業の掟（Masa明言 2026-07-17・全レーン必読）
 

package/app/index.html

@@ -1558,6 +1558,14 @@
     line-height:1.15;padding:2.5px 10px;border-radius:7px;box-shadow:inset 0 0 0 1px var(--hair2)}
   #fsRoot .acts2 .errbtn:first-child{color:var(--ink2)}
   #fsRoot .errbtn:hover{background:var(--hover);color:var(--ink)}
+  /* The review/attention dialog is rendered in #seeall, outside #fsRoot.
+     Keep its recovery actions on the same designed component instead of
+     falling back to the browser's unstyled native button. */
+  #seeall .acts2{display:flex;gap:6px;margin-top:3px;align-items:center}
+  #seeall .errbtn{border:0;background:transparent;color:var(--ink3);font-family:var(--mono);font-size:10px;letter-spacing:.02em;cursor:pointer;
+    line-height:1.15;padding:2.5px 10px;border-radius:7px;box-shadow:inset 0 0 0 1px var(--hair2)}
+  #seeall .acts2 .errbtn:first-child{color:var(--ink2)}
+  #seeall .errbtn:hover{background:var(--hover);color:var(--ink)}
   /* AI question in the feed (q2 — §6.5: while current it lives in the chat feed).
      H18 / CDO HANDOFF-question-ui-2026-07-13: QUESTION card = hairline frame +
      2px --blue left rule + mono label + option chips + an always-on free-text
@@ -7189,6 +7197,7 @@ const FAILURE_COPY = {
     infra: {
       title: 'Galda基盤エラー',
       timeout: 'Galda側の実行上限や待ち時間で止まりました。変更内容の失敗とは限りません。',
+      interrupted: 'ローカルの実行が中断されました。変更内容やAgentの失敗とは限らないため、同じ作業を再開できます。',
       auth: '接続や認証確認で止まりました。接続を直してから再開できます。',
       relay: 'relay接続で止まりました。接続状態を確認してから再試行できます。',
       chrome: 'Chrome/ブラウザ確認で止まりました。画面確認環境の問題で、実装失敗とは限りません。',
@@ -7198,8 +7207,8 @@ const FAILURE_COPY = {
       unknown: 'Galdaの実行基盤で止まりました。ログを確認し、原因に応じて再試行できます。',
     },
     actions: {
-      retry: '再試行', resume: '再開', connect: 'Connect', check: '接続確認',
-      other: '別Agentで実行', log: 'ログ確認', tests: 'テスト再実行', pr: 'PR再試行',
+      retry: 'Retry', resume: 'Resume', connect: 'Connect', check: 'Check connection',
+      other: 'Try another Agent', log: 'View log', tests: 'Re-run tests', pr: 'Retry PR',
     },
   },
   en: {
@@ -7207,6 +7216,7 @@ const FAILURE_COPY = {
     infra: {
       title: 'Galda system issue',
       timeout: 'Galda stopped this at the run limit or a wait timed out. This is not necessarily a problem with the change.',
+      interrupted: 'The local run was interrupted. This does not necessarily reflect a problem with the change or agent; resume the same work.',
       auth: 'Connection or authentication failed. Reconnect, then continue.',
       relay: 'The relay connection failed. Check the connection, then retry.',
       chrome: 'Chrome/browser verification failed. The UI check environment stopped, not necessarily the implementation.',
@@ -7227,17 +7237,23 @@ function failureLang(){
 function inferErrorClass(text, agent){
   const low = String(text || '').toLowerCase();
   const infra = (reason, actionIds) => ({ owner: 'galda-infra', reason, actionIds });
-  if (/run limit|実行上限|timed out|timeout|タイムアウト/.test(low)) return infra('timeout', ['retry', 'run-with-codex', 'view-log']);
-  if (/spawn|enoent|eacces|command not found|worker tool exited early|作業ツールが途中で終了/.test(low)) return infra('worker-start', ['retry', 'run-with-codex', 'view-log']);
-  if (/auth probe|preflight|not logged in|logged out|not authenticated|authentication|unauthorized|invalid api key|bad credentials|401\b|403\b|接続が必要|認証/.test(low)) return infra('auth', ['connect', 'check-connection', 'run-with-codex', 'view-log']);
+  if (/run limit|実行上限|timed out|timeout|タイムアウト/.test(low)) return infra('timeout', ['retry', 'view-log']);
+  if (/worker was interrupted|作業が途中で中断|exit 143|sigterm|sigint/.test(low)) return infra('interrupted', ['retry', 'view-log']);
+  if (/spawn|enoent|eacces|command not found|worker tool exited early|作業ツールが途中で終了/.test(low)) return infra('worker-start', ['retry', 'view-log']);
+  if (/auth probe|preflight|not logged in|logged out|not authenticated|authentication|unauthorized|invalid api key|bad credentials|401\b|403\b|接続が必要|認証/.test(low)) return infra('auth', ['connect', 'check-connection', 'view-log']);
   if (/relay|websocket|socket|econnreset|econnrefused|billing-api unreachable|cf access|cloudflare access/.test(low)) return infra('relay', ['retry', 'connect', 'view-log']);
   if (/chrome|chromium|puppeteer|target closed|browser|navigation timeout|waiting failed|screenshot|headless/.test(low)) return infra('chrome', ['retry', 'view-log']);
   if (/test runner|node --test|npm test|project tests|server exited \(code \d+\) before it was ready|did not report ready in time|test timed out after|tap|not ok \d+/.test(low)) return infra('test-runner', ['retry-tests', 'view-log']);
   if (/pr step failed|openpr|pull request|github|gh:|gh auth|git push|git fetch|git .*failed|pr作成|pr failed/.test(low)) return infra('pr', ['retry-pr', 'view-log']);
-  return { owner: 'agent', reason: agent === 'codex' ? 'codex' : 'claude-code', actionIds: ['retry', 'run-with-codex', 'view-log'] };
+  return { owner: 'agent', reason: agent === 'codex' ? 'codex' : 'claude-code', actionIds: ['retry', 'view-log'] };
 }
 function taskErrorMeta(t, goal){
-  const meta = t.errorClass || inferErrorClass(t.result, t.agent || goal?.agent);
+  // Reclassify interrupted tasks from their concrete exit text instead of
+  // trusting stale persisted metadata. Older records labelled an external
+  // SIGTERM/restart as an Agent failure and permanently carried a Codex switch.
+  const inferred = inferErrorClass(t.result, t.agent || goal?.agent);
+  const raw = t.status === 'interrupted' ? inferred : (t.errorClass || inferred);
+  const meta = { ...raw, actionIds: (raw.actionIds || []).filter((id) => !['run-with-codex', 'run-with-claude'].includes(id)) };
   const lang = failureLang(), C = FAILURE_COPY[lang];
   const isInfra = meta.owner === 'galda-infra';
   return {
@@ -7251,20 +7267,16 @@ function goalBlockedErrorMeta(g){
   const raw = g.blocked?.errorClass || (g.blocked?.kind === 'test'
     ? { owner: 'galda-infra', reason: 'test-runner', actionIds: ['retry-tests', 'view-log'] }
     : inferErrorClass(g.blocked?.reason, g.agent));
+  const meta = { ...raw, actionIds: (raw.actionIds || []).filter((id) => !['run-with-codex', 'run-with-claude'].includes(id)) };
   const lang = failureLang(), C = FAILURE_COPY[lang];
-  const isInfra = raw.owner === 'galda-infra';
-  return { ...raw, title: isInfra ? C.infra.title : C.agent.title, body: isInfra ? (C.infra[raw.reason] || C.infra.unknown) : C.agent.body, copy: C };
+  const isInfra = meta.owner === 'galda-infra';
+  return { ...meta, title: isInfra ? C.infra.title : C.agent.title, body: isInfra ? (C.infra[meta.reason] || C.infra.unknown) : C.agent.body, copy: C };
 }
 function errorButtonsHtml(meta, { taskId = null, goalId = null, interrupted = false, agent = null, pr = false } = {}){
   const C = meta.copy.actions;
-  const canCodex = goalId != null && agent !== 'codex' && (state.agents || []).includes('codex');
   const out = [];
   for (const id of meta.actionIds || []) {
     if (id === 'retry' && taskId != null) out.push(`<button class="errbtn" data-fsretry="${taskId}">${interrupted ? C.resume : C.retry}</button>`);
-    // This keeps the existing agent-switch endpoint, but says what it really does
-    // for an interrupted run: continue the saved goal with another agent rather
-    // than imply a brand-new, contextless task will be created.
-    else if (id === 'run-with-codex' && canCodex) out.push(`<button class="errbtn" data-fscodex="${goalId}">${interrupted ? (failureLang() === 'ja' ? 'Codexで再開' : 'Resume with Codex') : C.other}</button>`);
     else if (id === 'connect') out.push(`<button class="errbtn" data-fsconnectworker="1">${C.connect}</button>`);
     else if (id === 'check-connection') out.push(`<button class="errbtn" data-fscheckworker="1">${C.check}</button>`);
     else if (id === 'retry-tests' && goalId != null) out.push(`<button class="errbtn" data-fsreverify="${goalId}">${C.tests}</button>`);

package/engine/lib.mjs

@@ -1258,13 +1258,20 @@ export function classifyWorkerFailure({ agent = 'claude-code', result = '', err
     actionIds,
   });
   if (timedOut || /run limit|実行上限|timed out|timeout|タイムアウト/.test(low)) {
-    return infra('timeout', ['retry', 'run-with-codex', 'view-log']);
+    return infra('timeout', ['retry', 'view-log']);
+  }
+  // SIGTERM/SIGINT means the local worker was stopped from outside the task
+  // (for example while the local Manager was restarting).  It says nothing
+  // about either the requested change or the chosen agent, so never turn this
+  // recovery path into a suggestion to switch agents.
+  if (code === 143 || code === 130 || /worker was interrupted|作業が途中で中断|exit 143|sigterm|sigint/.test(low)) {
+    return infra('interrupted', ['retry', 'view-log']);
   }
   if (/spawn|enoent|eacces|command not found|executable|worker tool exited early|作業ツールが途中で終了/.test(low)) {
-    return infra('worker-start', ['retry', 'run-with-codex', 'view-log']);
+    return infra('worker-start', ['retry', 'view-log']);
   }
   if (/auth probe|preflight|not logged in|logged out|not authenticated|authentication|unauthorized|invalid api key|bad credentials|401\b|403\b|接続が必要|認証/.test(low)) {
-    return infra('auth', ['connect', 'check-connection', 'run-with-codex', 'view-log']);
+    return infra('auth', ['connect', 'check-connection', 'view-log']);
   }
   if (/relay|websocket|socket|econnreset|econnrefused|billing-api unreachable|cf access|cloudflare access/.test(low)) {
     return infra('relay', ['retry', 'connect', 'view-log']);
@@ -1281,7 +1288,7 @@ export function classifyWorkerFailure({ agent = 'claude-code', result = '', err
   return {
     owner: 'agent',
     reason: agent === 'codex' ? 'codex' : 'claude-code',
-    actionIds: ['retry', agent === 'claude-code' ? 'run-with-codex' : 'run-with-claude', 'view-log'],
+    actionIds: ['retry', 'view-log'],
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.88",
+  "version": "0.10.89",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {