@galda/cli 0.10.89 → 0.10.91

package/app/index.html

@@ -294,17 +294,6 @@
      .gearpop{}, so out here it was invalid at computed-value time and fell back to
      transparent — measured rgba(0,0,0,0). The chips were never filled to begin with. */
   .ctxbar{display:flex;align-items:center;gap:6px;padding:0 2px 7px;background:none;border:0}
-  /* Feature A: "Replying to #NNN ✕" chip — neutral hairline pill above the composer
-     (real tokens only → theme-adaptive; the ✕ hover moves glyph colour only, §5.5). */
-  .replybind{display:flex;align-items:center;gap:6px;max-width:var(--fscenterw,760px);width:100%;margin:0 auto 6px;padding:0 2px}
-  .replybind[hidden]{display:none}
-  .replybind .rb-seg{display:inline-flex;align-items:center;gap:6px;padding:5px 11px;border-radius:999px;
-    border:1px solid var(--hair);background:var(--panel);font:500 12px/1 var(--ui);color:var(--ink2)}
-  .replybind .rb-seg b{color:var(--ink);font-weight:600;font-family:var(--mono);font-variant-numeric:tabular-nums}
-  .replybind .rb-x{display:grid;place-items:center;width:24px;height:24px;border:0;border-radius:7px;background:transparent;
-    color:var(--ink3);cursor:pointer;transition:color .12s;flex:0 0 24px}
-  .replybind .rb-x:hover{color:var(--ink)}
-  .replybind .rb-x svg{width:13px;height:13px;fill:none;stroke:currentColor;stroke-width:2;stroke-linecap:round;stroke-linejoin:round}
   .ctxchip{display:inline-flex;align-items:center;height:26px;padding:0;gap:0;border-radius:8px;
     border:1px solid var(--hair);background:transparent;position:relative;min-width:0}
   .ctxsel{position:relative}
@@ -3037,9 +3026,6 @@
              reply exists (progressive disclosure — DESIGN-RULES §1.5-3, "存在
              しないものの器を先に見せない"). -->
         <div class="peraanswer" id="chatReply" hidden></div>
-        <!-- Feature A: when the composer is bound to the focused goal, this chip shows
-             which conversation you're replying to; ✕ detaches back to new-goal mode. -->
-        <div class="replybind" id="replyBind" hidden><span class="rb-seg"><span id="replyBindLabel">Replying to</span> <b id="replyBindNum"></b></span><button type="button" class="rb-x" id="replyBindX" title="New goal instead" aria-label="Detach"><svg viewBox="0 0 24 24"><path d="M6 6l12 12M18 6 6 18"/></svg></button></div>
         <div class="composer">
           <div class="attachbar" id="attachbar" style="display:none"></div>
           <!-- Slash-command palette (Masa決定 2026-07-07: chips→slash). Floats
@@ -4367,7 +4353,6 @@ function mergeGoalTimeline(goals, externalActivity, projectId){
 function goToGoalInChat(goalId, bindComposer = true){
   state.selectedGoal = goalId;
   if (bindComposer) state.composerDetachedGoal = null;
-  renderReplyBind();   // Feature A: the composer's "Replying to #NNN" chip follows the focused goal — renderStream() alone skips it (only render() calls it)
   renderStream();
   const goalEl = document.querySelector(`#stream [data-goalmsg="${goalId}"]`);
   if (!goalEl) return;
@@ -5860,6 +5845,18 @@ function renderReviewAttach(){
 // 関わらず全部「直して」で、「なんでこうしたの？」と聞いただけでゴールが Doing に戻り
 // ワーカーが走っていた。人はモードを普段選ばない——AI が迷った時だけ選ぶ。
 const REPLY_CHOICE_LABEL = { continue: 'Fix this', rescope: 'Rethink it', split: 'Separate ticket', answer: 'Just a question' };
+function replyChoiceLabel(choice){
+  if (choice?.startsWith('project:')) {
+    const id = choice.slice('project:'.length);
+    return `Implement in ${state.projects?.find((project) => project.id === id)?.name || id}`;
+  }
+  return REPLY_CHOICE_LABEL[choice] ?? choice;
+}
+function replyChoices(body){
+  const routes = body?.choices || REPLY_OUTCOMES_CLIENT;
+  const targets = (body?.projectChoices || []).filter((project) => !project.current).map((project) => `project:${project.id}`);
+  return [...routes, ...targets];
+}
 // The one waiting line's two labels. Local to the reply note on purpose — STATUS_LABEL
 // is the task/workflow vocabulary and this is neither (CDO §5).
 const REPLY_WAIT_ROUTING = 'Thinking…';
@@ -5867,9 +5864,9 @@ const REPLY_WAIT_ANSWERING = 'Answering…';
 function replyWorkerPayload(extra = {}){
   return { ...extra, agent: state.connectedApp, model: state.stickyModel, effort: state.stickyEffort };
 }
-async function postReply(goalId, text, outcome = 'auto'){
+async function postReply(goalId, text, outcome = 'auto', targetProjectId = null){
   const r = await fetch(withKey(`/api/goals/${goalId}/dismiss`), { method: 'POST',
-    headers: { 'content-type': 'application/json' }, body: JSON.stringify(replyWorkerPayload({ text, outcome })) });
+    headers: { 'content-type': 'application/json' }, body: JSON.stringify(replyWorkerPayload({ text, outcome, targetProjectId })) });
   if (!r.ok) throw new Error();
   return r.json();
 }
@@ -6009,7 +6006,7 @@ function saCardThreadHtml(it){
     : it.rstatus === 'working' ? replyWorkingHtml()
     : it.rstatus === 'unsure' ? (replyNoteRowHtml('Which one is this?')
         + `<div class="qchips">${(it.rchoices || []).map((c) =>
-          `<button type="button" class="qchip" data-rc="${esc(c)}" data-rcgoal="${it.goalId}">${esc(REPLY_CHOICE_LABEL[c] ?? c)}</button>`).join('')}</div>`)
+          `<button type="button" class="qchip" data-rc="${esc(c)}" data-rcgoal="${it.goalId}">${esc(replyChoiceLabel(c))}</button>`).join('')}</div>`)
     : '';
   return rows + trailer;
 }
@@ -6054,7 +6051,7 @@ function askReplyDestination(anchorSel, choices){
     // The You row stays above the chips so "this" has something to point at (CDO Q5).
     setReplyNote(anchorSel, replyPastHtml() + said + replyNoteRowHtml('Which one is this?')
       + `<div class="qchips">${(choices || []).map((c) =>
-        `<button type="button" class="qchip" data-rc="${esc(c)}">${esc(REPLY_CHOICE_LABEL[c] ?? c)}</button>`).join('')}</div>`, resolve);
+        `<button type="button" class="qchip" data-rc="${esc(c)}">${esc(replyChoiceLabel(c))}</button>`).join('')}</div>`, resolve);
   });
 }
 // answer (§1.3): nothing was built, so there is no task to watch — the reply comes
@@ -6085,9 +6082,11 @@ async function replyToGoal(goalId, text, anchorSel){
   showReplySent(anchorSel, text, Number(goalId));   // before the round trip: the words stay, and it says it is thinking
   let body = await postReply(goalId, text, 'auto');
   if (body.outcome === 'unsure') {
-    const picked = await askReplyDestination(anchorSel, body.choices);
+    const picked = await askReplyDestination(anchorSel, replyChoices(body));
     if (!picked) return null;
-    body = await postReply(goalId, text, picked);
+    body = picked.startsWith('project:')
+      ? await postReply(goalId, text, 'split', picked.slice('project:'.length))
+      : await postReply(goalId, text, picked);
   }
   // seen + 1: the question itself was just recorded; the answer is the one after it.
   if (body.outcome === 'answer') showAnswerWhenItArrives(anchorSel, goalId, seen + 1);
@@ -6237,13 +6236,14 @@ function summarizeAttention(goal, tasks){
     decision = ja
       ? 'worker に失敗したテスト出力を確認させ、回帰を修正して、プロジェクトのテストを再実行するよう指示してください。'
       : 'Ask the worker to inspect the failing test output, fix the regression, and rerun the project tests.';
-  } else if (/interrupted/i.test(goal.status || '') || /interrupted/i.test(compact)) {
+  } else if (failed?.status === 'interrupted' || /interrupted/i.test(goal.status || '') || /interrupted/i.test(compact)) {
+    const noReport = !compact;
     happened = ja
-      ? `必要だったこと: ${need}。${taskName ? `「${taskName}」の作業中に、` : ''}実行が中断されました: ${compact.slice(0, 140) || '詳細ログは取得できませんでした'}。`
-      : `Needed: ${need}. The run was interrupted${taskName ? ` while working on "${taskName}"` : ''}: ${compact.slice(0, 140) || 'no detailed log was captured'}.`;
+      ? `必要だったこと: ${need}。${taskName ? `「${taskName}」の作業中に、` : ''}${noReport ? 'Managerとworkerの接続が完了報告前に切れました。run limitだったとは確認できません' : `実行が中断されました: ${compact.slice(0, 140)}`}。`
+      : `Needed: ${need}. ${noReport ? 'The Manager lost its worker connection before a final report was saved; this is not confirmed as a run-limit stop' : `The run was interrupted${taskName ? ` while working on "${taskName}"` : ''}: ${compact.slice(0, 140)}`}.`;
     decision = ja
-      ? '具体的な次の一手を指定して Resume するか、不要なら Archive してください。'
-      : 'Resume with a concrete next step, or archive it if the work is no longer needed.';
+      ? '依頼を言い直したり範囲を狭めたりせず、そのまま Resume できます。既存の作業ファイルから続行します。'
+      : 'Resume the same request without rewording or narrowing it. Work continues from the existing files.';
   } else if (/blocked/i.test(goal.status || '') || compact) {
     happened = ja
       ? `必要だったこと: ${need}。Review に進む前に停止しました${compact ? `: ${compact.slice(0, 160)}` : ''}。`
@@ -6422,7 +6422,6 @@ $('gdRevisionInput').addEventListener('keydown', (e) => {
 function render(){
   renderProjects(); renderStream(); renderQueue(); renderTasks(); renderActPanel(); wireWfEditButtons();
   renderCtxBar();   // the folder above the composer follows the active project
-  renderReplyBind();   // Feature A: show/hide the "Replying to #NNN" chip for the focused goal
   renderFlagship();
   if (state.reviewOpenGoal != null) renderReviewChecklist();
   if (state.goalDetailOpen != null) renderGoalDetail();
@@ -6507,7 +6506,12 @@ function renderFsRail(){
     const running = pgoals.some((g) => fsBoardBucket(g, ptasks) === 'doing'
       && !(g.status === 'blocked' && g.blocked?.kind === 'paused'));
     const td = ptasks.filter((t) => ['running', 'queued'].includes(t.status)).length;
-    const rev = buildReviewDigest({ goals: pgoals, tasks: ptasks }).length;
+    // The rail's eye icon is the review/attention count. Needs-you goals
+    // (needsInput/needsApproval/blocked, minus Paused) block on the person the
+    // same way an open Review does, so they belong in the same count (Masa
+    // task 854: "needs youも目のアイコンのマークにいれれますか？").
+    const needsCount = pgoals.filter((g) => fsBoardBucket(g, ptasks) === 'needs').length;
+    const rev = buildReviewDigest({ goals: pgoals, tasks: ptasks }).length + needsCount;
     const pcount = `<span class="pcount" title="${rev} review${rev === 1 ? '' : 's'} ready · ${td} to-do">`
       + `<span class="pc-item rev${rev ? '' : ' zero'}">${FS_ICO_SCAN}${rev}</span>`
       + `<span class="pc-item td">${FS_ICO_TD}${td}</span></span>`;
@@ -7251,7 +7255,9 @@ function taskErrorMeta(t, goal){
   // Reclassify interrupted tasks from their concrete exit text instead of
   // trusting stale persisted metadata. Older records labelled an external
   // SIGTERM/restart as an Agent failure and permanently carried a Codex switch.
-  const inferred = inferErrorClass(t.result, t.agent || goal?.agent);
+  const inferred = t.status === 'interrupted' && !String(t.result || '').trim()
+    ? { owner: 'galda-infra', reason: 'interrupted', actionIds: ['retry', 'view-log'] }
+    : inferErrorClass(t.result, t.agent || goal?.agent);
   const raw = t.status === 'interrupted' ? inferred : (t.errorClass || inferred);
   const meta = { ...raw, actionIds: (raw.actionIds || []).filter((id) => !['run-with-codex', 'run-with-claude'].includes(id)) };
   const lang = failureLang(), C = FAILURE_COPY[lang];
@@ -9013,22 +9019,6 @@ function replyBinding(){
   if (REPLY_PLAIN.has(g.status)) return { goal: g, mode: 'plain' };
   return null;
 }
-// The visible, reversible "Replying to #NNN ✕" chip above the composer — never
-// silent (shown whenever bound), always detachable (✕ clears the binding).
-function renderReplyBind(){
-  const el = $('replyBind'); if (!el) return;
-  const b = replyBinding();
-  el.hidden = !b;
-  const inp = $('input');
-  if (b) {
-    const n = goalReviewNumber({ goal: b.goal, tasks: state.tasks }) ?? b.goal.id;
-    const numEl = $('replyBindNum'); if (numEl) numEl.textContent = '#' + n;
-    const lblEl = $('replyBindLabel'); if (lblEl) lblEl.textContent = b.mode === 'answer' ? 'Answering' : 'Replying to';
-    if (inp) inp.placeholder = b.mode === 'answer' ? `Answering #${n}…` : `Reply to #${n}…`;
-  } else if (inp) {
-    inp.placeholder = 'Describe a goal…  ( / for commands )';
-  }
-}
 async function send(){
   const { text, model, effort, mode, skill, later, review } = resolveComposer($('input').value);
   if (!text) return;
@@ -9264,7 +9254,7 @@ function closeSummaryPera(){ $('summaryOverlay').classList.remove('show'); }
 // 4 archived / 5 reverted — session-local; the server round-trip is what
 // settles it (see saSync's "returned to review" reset).
 // ============================================================================
-const SA = { open: false, items: [], diffs: {}, actLog: {}, msgs: {}, convOpen: new Set(), shotBox: {}, detOpen: new Set(), diffOpen: new Set(), attachments: {}, focusGid: null, focusScrolled: false, focusTimer: null, cur: null, solo: null };
+const SA = { open: false, items: [], diffs: {}, actLog: {}, msgs: {}, convOpen: new Set(), shotBox: {}, detOpen: new Set(), diffOpen: new Set(), attachments: {}, focusGid: null, focusScrolled: false, focusTimer: null, cur: null, solo: null, lastMarkup: null };
 function saReplyAttachmentsHtml(goalId){
   return (SA.attachments[goalId] || []).map((a, i) => `<span class="sa-replythumb"><img src="${esc(a.url)}" alt="Attached image"><button type="button" data-saarm="${goalId}:${i}" aria-label="Remove image">×</button></span>`).join('');
 }
@@ -9954,7 +9944,9 @@ function saItemHtml(it, i){
     const tests = it.testResult?.ran
       ? (it.testResult.ok ? 'Verification completed before the interruption.' : 'Verification remains incomplete or failed.')
       : 'Verification has not completed yet.';
-    const reason = String(t.result || 'The worker reached its run limit before finishing.').replace(/\s+/g, ' ').slice(0, 240);
+    const reason = String(t.result || (failureLang() === 'ja'
+      ? 'Managerとworkerの接続が完了報告前に切れました。run limitだったとは確認できません。作業ファイルを保持したままResumeできます。'
+      : 'The Manager lost its worker connection before a final report was saved. This is not confirmed as a run-limit stop. Resume keeps the existing work files.')).replace(/\s+/g, ' ').slice(0, 240);
     return `<div class="rinfra"><p class="rbody v"><b>Interrupted — resume available</b><br>${esc(reason)}</p>`
       + (last ? `<p class="rbody v">Last recorded step: ${esc(String(last).slice(0, 220))}</p>` : '')
       + (files.length ? `<p class="rbody v">Changed so far: ${esc(files.join(' · '))}</p>` : '')
@@ -10238,6 +10230,9 @@ function saRender(){
   const previousBody = S.querySelector('.sa-body');
   const previousScrollTop = previousBody?.scrollTop ?? 0;
   const restoreScroll = Boolean(previousBody) && SA.focusGid == null;
+  const focusedReplyGoal = document.activeElement?.matches?.('#seeall .sa-chat')
+    ? document.activeElement.dataset.goal
+    : null;
   const pending = SA.items.filter((x) => x.st === 0);
   const green = pending.filter((x) => !x.testResult || x.testResult.ok !== false).length;
   // Solo mode = a single "Needs you" goal opened as this card. It is not a review batch, so the
@@ -10248,8 +10243,16 @@ function saRender(){
   const curIdx = pending.findIndex((x) => x.goalId === SA.cur);
   const posLabel = solo ? '' : (pending.length && curIdx >= 0 ? `${curIdx + 1} / ${pending.length}` : '');
   const hdKeys = solo ? '↑↓ MOVE · ESC CLOSE' : '↑↓ MOVE · A APPROVE · D DISMISS · ESC CLOSE';
-  S.innerHTML = `<div class="sa-panel"><div class="sa-hd"><span class="t">${hdTitle}</span><span class="c">${c}</span><span class="sa-count">${posLabel}</span><span class="keys">${hdKeys}</span><button class="sa-x" data-saact="close:0">✕</button></div>
+  const markup = `<div class="sa-panel"><div class="sa-hd"><span class="t">${hdTitle}</span><span class="c">${c}</span><span class="sa-count">${posLabel}</span><span class="keys">${hdKeys}</span><button class="sa-x" data-saact="close:0">✕</button></div>
     <div class="sa-body">${SA.items.length ? SA.items.map((it, i) => saItemHtml(it, i)).join('') : '<div class="sa-empty">Nothing waiting for review.</div>'}</div></div>`;
+  // Most SSE goal/task events are unrelated to the card the person is reading.
+  // Replacing #seeall with identical markup destroyed and recreated every node,
+  // producing a blank flash and resetting browser-owned state. Keep the current
+  // dialog DOM when its semantic markup did not change; the board behind it can
+  // still refresh normally.
+  if (SA.lastMarkup === markup && S.querySelector('.sa-panel')) return;
+  SA.lastMarkup = markup;
+  S.innerHTML = markup;
   const body = S.querySelector('.sa-body');
   if (body && restoreScroll) body.scrollTop = previousScrollTop;
   // Once the person scrolls, their position wins over the short opening-focus
@@ -10303,6 +10306,10 @@ function saRender(){
       if (!SA.focusTimer) SA.focusTimer = setTimeout(() => { SA.focusGid = null; SA.focusTimer = null; }, 1400);
     });
   }
+  // A relevant status change may legitimately rebuild the card. Restore the
+  // empty reply box's focus afterwards; non-empty input is protected earlier
+  // by saSync and is never rebuilt at all.
+  if (focusedReplyGoal != null) S.querySelector(`.sa-chat[data-goal="${focusedReplyGoal}"]`)?.focus({ preventScroll: true });
 }
 // keep the open Ledger in sync with server state (SSE/refresh → render() → here).
 // An item whose goal has RETURNED to 'review' (retest ×3 green, rework done,
@@ -10350,6 +10357,7 @@ async function saFetchDiffs(){
 }
 function saOpen(focusGoalId, solo = false){
   SA.open = true;
+  SA.lastMarkup = null; // a newly opened/focused dialog always gets a clean first paint
   SA.solo = solo ? focusGoalId : null;   // solo = a single "Needs you" goal opened as one card
   SA.items = saLedgerRows().map((r) => ({ ...r, st: 0 }));
   SA.detOpen = new Set();
@@ -10380,7 +10388,7 @@ function saOpen(focusGoalId, solo = false){
   saFetchDiffs();
   saEnhanceShotBoxes();
 }
-function saClose(){ SA.open = false; SA.solo = null; SA.focusGid = null; if (SA.focusTimer) { clearTimeout(SA.focusTimer); SA.focusTimer = null; } $('seeall').classList.remove('open'); }
+function saClose(){ SA.open = false; SA.solo = null; SA.focusGid = null; SA.lastMarkup = null; if (SA.focusTimer) { clearTimeout(SA.focusTimer); SA.focusTimer = null; } $('seeall').classList.remove('open'); }
 // Continuous review (Masa 2026-07-08): move a persistent "current" card with
 // ↑↓ and auto-advance to the next pending after each verdict — same screen, same
 // Ledger, so approving flows without hunting for the next one.
@@ -10419,8 +10427,8 @@ async function saCall(ids, path, body){
 // (outcome:'auto', ONE-CONVERSATION §1.4) — this layer never guesses continue vs
 // question. Unlike saAct it does NOT show its outcome first: "Feedback sent" would
 // be a lie when the reply was a question.
-async function saReplyCall(it, text, outcome){
-  const r = await saCall(it.ids, 'dismiss', { text, outcome });
+async function saReplyCall(it, text, outcome, targetProjectId = null){
+  const r = await saCall(it.ids, 'dismiss', { text, outcome, targetProjectId });
   if (!r?.ok) throw new Error('reply failed');
   return r.json().catch(() => null);
 }
@@ -10527,7 +10535,7 @@ async function saSendReply(it, i, text){
   try {
     let body = await saReplyCall(it, workerText, 'auto');
     if (body?.outcome === 'unsure') {
-      it.inflight = false; it.rstatus = 'unsure'; it.rchoices = body.choices || REPLY_OUTCOMES_CLIENT;
+      it.inflight = false; it.rstatus = 'unsure'; it.rchoices = replyChoices(body);
       saPaintCard(goalId);
       const picked = await new Promise((resolve) => { it._routeResolve = resolve; });
       it._routeResolve = null;
@@ -10537,7 +10545,9 @@ async function saSendReply(it, i, text){
         saPaintCard(goalId); return;
       }
       it.inflight = true; it.rstatus = 'thinking'; saPaintCard(goalId);
-      body = await saReplyCall(it, workerText, picked);
+      body = picked.startsWith('project:')
+        ? await saReplyCall(it, workerText, 'split', picked.slice('project:'.length))
+        : await saReplyCall(it, workerText, picked);
     }
     it.inflight = false;
     if (body?.outcome === 'answer') {              // a question: the AI answers, the goal never moves
@@ -11270,8 +11280,6 @@ $('filein').addEventListener('change', () => {
   for (const f of $('filein').files) uploadFile(f);
   $('filein').value = '';
 });
-// Feature A: ✕ on the "Replying to #NNN" chip detaches → back to new-goal mode.
-$('replyBindX').onclick = () => { state.composerDetachedGoal = state.selectedGoal; render(); };
 const IS_MOBILE = () => window.matchMedia('(max-width: 760px)').matches;
 // Phones are chat-first: the Tasks sheet starts FOLDED so the first view is the
 // conversation + composer (the sheet is an 88vw overlay — default-open buried

package/engine/lib.mjs

@@ -46,6 +46,19 @@ export function isCommandOnPath(cmd, { pathEnv = '', sep = ':', pathExt = '', ex
   return false;
 }
 
+// A directory mention becomes an execution target only when the person labels
+// it as a working/development directory. Bare paths remain ordinary context so
+// a worker is never silently moved just because a filename appeared in prose.
+export function parseRequestedWorkspaceDir(text) {
+  const source = String(text ?? '');
+  const marker = /(?:working\s*directory|workdir|作業(?:ディレクトリ|場所)|開発場所)\s*(?:を|は|:|：|=|＝)?\s*/i;
+  const found = source.match(marker);
+  if (!found) return null;
+  const rest = source.slice((found.index ?? 0) + found[0].length);
+  const path = rest.match(/\/(?:[A-Za-z0-9._~@%+\-]+\/)*[A-Za-z0-9._~@%+\-]+\/?/);
+  return path ? path[0].replace(/\/+$/, '') || '/' : null;
+}
+
 // Galda makes small internal LLM calls (composer-intent classification, proof-card
 // summaries, board Q&A). These prefer Claude Code + haiku (cheap + fast), but must
 // still work on a Codex-only machine — so they run on whatever agent is available,
@@ -2458,6 +2471,55 @@ export function dismissGoal({ goalStatus, outcome = 'continue' } = {}) {
   return { ok: true, outcome: 'continue', status: 'running', spawnsWorker: true };
 }
 
+// `outcome:auto` is the contract used by every review reply box in the app.
+// Keep the routing decision in one place: the reply either asks a question,
+// requests a change, rescopes the ticket, starts separate work, or explicitly
+// remains unsure.  Returning unsure is safe because the UI already presents
+// these exact choices without moving the goal.
+export const REPLY_INTENTS = [...REPLY_OUTCOMES, 'unsure'];
+export function buildReplyIntentPrompt({ goalText, reply, currentProject = null, projects = [] } = {}) {
+  const projectLines = (projects ?? []).map((project) =>
+    `- ${project.id}: ${project.name || project.id} | root=${project.dir || '(unknown)'} | scope=${project.note || '(not specified)'}`);
+  return [
+    'You route replies in Agent Manager: a person delegated a coding task, an AI did it, and it came back for review. The person has now replied.',
+    'Decide what the reply ASKS FOR — exactly one of:',
+    '- "continue": fix or change the work that was just done.',
+    '- "rescope": stop and rethink; the request itself should now say something different.',
+    '- "split": a separate piece of work that should not touch this one.',
+    '- "answer": a question about the work. Nothing should be built or changed.',
+    '- "unsure": you genuinely cannot tell. Prefer this over guessing.',
+    'Judge the full meaning. A question followed by a requested change is "continue".',
+    'Also decide which project must receive the requested work.',
+    '- Keep targetProjectId equal to the current project for ordinary fixes to the reviewed work.',
+    '- If the current project is design/docs/prototype-only and the reply asks to implement or launch the chosen design in the real product, select the matching production/code project.',
+    '- Never infer a project that is not listed. If the target is ambiguous, use outcome "unsure" and targetProjectId null.',
+    'Output ONLY one line of raw JSON: {"outcome":"continue|rescope|split|answer|unsure","targetProjectId":"listed-id-or-null"}.',
+    '',
+    `Current project: ${currentProject?.id || '(unknown)'}`,
+    'Available projects:',
+    ...(projectLines.length ? projectLines : ['- (none)']),
+    '',
+    'The request that was worked on:',
+    String(goalText ?? '').slice(0, 2000),
+    '',
+    'Their reply:',
+    String(reply ?? '').slice(0, 4000),
+  ].join('\n');
+}
+
+export function parseReplyIntent(raw) {
+  const unread = { outcome: 'unsure', read: false };
+  if (!raw || typeof raw !== 'string') return unread;
+  const m = raw.match(/\{[\s\S]*\}/);
+  if (!m) return unread;
+  let obj;
+  try { obj = JSON.parse(m[0]); } catch { return unread; }
+  if (!REPLY_INTENTS.includes(obj?.outcome)) return unread;
+  const targetProjectId = typeof obj.targetProjectId === 'string' && obj.targetProjectId.trim()
+    ? obj.targetProjectId.trim() : null;
+  return { outcome: obj.outcome, targetProjectId, read: true };
+}
+
 // 宛先（docs/design/ONE-CONVERSATION.md §1.2）
 //
 // チャットで「#12 の件だけど」と書けたら、そのチケット宛て。**決定論で、我々の推測は
@@ -2904,12 +2966,10 @@ export function buildEphemeralSeedProjects(cwd) {
 // goal/task written once (e.g. a memo the user wants to survive a restart)
 // is never lost: later lines for the same id override earlier ones (last
 // write wins), and a goal write with `deleted:true` removes it. Mid-flight
-// work can't resume across a restart, so it's marked retryable rather than
-// silently dropped: a 'running' task becomes 'interrupted', a 'planning'
-// goal goes back to 'stacked', and a 'running' goal with no queued task left
-// settles via nextGoalStatus() — a wantsPR goal lands in 'review' just like
-// the normal completion path, even if the crash happened before the PR got
-// created (the caller re-attempts createGoalPR for those on restart).
+// work gets one bounded automatic recovery: a 'running' task becomes 'queued'
+// once and resumes from the files/session already on disk. A second interrupted
+// boot stays visible for human retry so a crash loop cannot relaunch forever.
+// A 'planning' goal still goes back to 'stacked'.
 // `reviewDefinitions` (projectId -> definition, as saved by
 // validateReviewDefinition) lets that settling honor each project's own
 // review definition (task 45); a project with none configured falls back to
@@ -2926,7 +2986,21 @@ export function replayQueueLog(rawText, reviewDefinitions = {}) {
     } catch { /* skip a corrupt line rather than lose the whole log */ }
   }
   for (const t of tasks) {
-    if (t.status === 'running') t.status = 'interrupted';
+    if (t.status !== 'running') continue;
+    // A Manager restart is an infrastructure interruption, not a request for
+    // human judgment. Resume the same task once from the files/session already
+    // on disk. The bounded counter prevents a crash-looping task from being
+    // relaunched forever; a second interrupted boot remains visibly retryable.
+    const recoveries = Number(t.restartRecoveries ?? 0);
+    if (recoveries < 1) {
+      t.status = 'queued';
+      t.restartRecoveries = recoveries + 1;
+      t.recoveredFromRestart = true;
+      t.startedAt = null;
+      t.finishedAt = null;
+    } else {
+      t.status = 'interrupted';
+    }
   }
   for (const g of goals) {
     if (g.status === 'planning') g.status = 'stacked';
@@ -3187,6 +3261,14 @@ export function workerPrompt(task, goal, lastFailure, agentName = 'claude-code',
   return [
     skill ? `FIRST, use the /${skill} skill via the Skill tool (invoke Skill with the "${skill}" skill) before doing anything else. Then carry out the task below.` : '',
     `You are a ${displayName} worker managed by "Manager for AI". Do the request below inside this project directory.`,
+    task?.projectContext ? [
+      'PROJECT BOUNDARY (source of truth):',
+      `- Project: ${task.projectContext.name || task.projectContext.id}`,
+      `- Root: ${task.projectContext.dir}`,
+      task.projectContext.note ? `- Scope/note: ${task.projectContext.note}` : '',
+      '- Your edits and claims apply only to this project. Never call a design/docs/prototype change a production implementation.',
+      '- If the request requires another project, do not pretend it was implemented here; report the exact project mismatch.',
+    ].filter(Boolean).join('\n') : '',
     goal?.priorFailureMemory?.length ? `\nMANAGER FAILURE MEMORY:\n${latestFailurePolicy(goal.priorFailureMemory)?.text}\nApply this prevention before starting.` : '',
     '',
     // The user's own words, verbatim and in full, are the source of truth.
@@ -3404,7 +3486,9 @@ export function parseRunDeclaration(text) {
   const compare = parseComparePair(raw.compare);
   const title = str(raw.title, 60);
   // Nothing to start, nothing to open, nothing named, and no pair to show = nothing to look at.
-  if (!cmd && !url && !file && !compare && !title) return null;
+  if (!cmd && !url && !file && !compare && !title) {
+    return runDeclError('no-open-target', 'declaration contains no command, URL, artifact file, comparison, or title');
+  }
   // Only http(s): the button opens this in the user's browser. A file:// (or
   // any other scheme) is a worker mistake with a specific fix — declare `file`
   // instead — not a JSON parse failure, so it gets its own reason.

package/engine/requirement-model.mjs

@@ -0,0 +1,196 @@
+export const REQUIREMENT_MODEL_VERSION = 1;
+
+const CLAIM_STATUSES = new Set(['addressed', 'partial', 'not-addressed']);
+const COVERAGE_STATUSES = new Set(['unverified', 'verified', 'failed', 'not-applicable']);
+
+function cleanText(value) {
+  return typeof value === 'string' ? value.trim() : '';
+}
+
+function stablePart(value) {
+  return String(value ?? 'unknown').replace(/[^a-zA-Z0-9_-]+/g, '-');
+}
+
+function requirementId(goalId, messageId) {
+  return `req-${stablePart(goalId)}-${stablePart(messageId)}`;
+}
+
+function attemptId(task) {
+  return cleanText(task?.attemptId) || `attempt-task-${stablePart(task?.id)}`;
+}
+
+function sourceForTask(task) {
+  if (!task?.reply) return 'user';
+  if (task.replyFrom === 'you') return 'user';
+  if (task.replyFrom === 'manager') return 'manager-policy';
+  return 'legacy-unknown';
+}
+
+function messageText(task) {
+  return cleanText(task?.reply ? task.detail : (task?.detail || task?.title));
+}
+
+function normalizeRequirement(value) {
+  const id = cleanText(value?.id);
+  const text = cleanText(value?.text);
+  if (!id || !text) return null;
+  return {
+    id,
+    source: cleanText(value.source) || 'legacy-unknown',
+    messageId: value.messageId == null ? null : String(value.messageId),
+    text,
+    ...(Array.isArray(value.span) && value.span.length === 2 ? { span: value.span } : {}),
+    ...(value.derivedFrom ? { derivedFrom: value.derivedFrom } : {}),
+    ...(value.supersedes ? { supersedes: value.supersedes } : {}),
+  };
+}
+
+function normalizeAttempt(value) {
+  const id = cleanText(value?.id);
+  if (!id) return null;
+  return {
+    id,
+    taskId: value.taskId ?? null,
+    status: cleanText(value.status) || 'unknown',
+    createdAt: value.createdAt ?? null,
+    finishedAt: value.finishedAt ?? null,
+    sessionId: value.sessionId ?? null,
+    worktree: value.worktree ?? null,
+  };
+}
+
+function normalizeEvidence(value) {
+  const requirementId = cleanText(value?.requirementId);
+  const attemptId = cleanText(value?.attemptId);
+  if (!requirementId || !attemptId) return null;
+  const claim = CLAIM_STATUSES.has(value.claim) ? value.claim : 'not-addressed';
+  const coverage = COVERAGE_STATUSES.has(value.coverage) ? value.coverage : 'unverified';
+  return {
+    requirementId,
+    attemptId,
+    taskId: value.taskId ?? null,
+    claim,
+    coverage,
+    evidence: cleanText(value.evidence),
+    files: [...new Set(Array.isArray(value.files) ? value.files.filter((item) => typeof item === 'string' && item) : [])],
+  };
+}
+
+function taskRequirementIds(task, requirements, legacyMap) {
+  const explicit = Array.isArray(task?.activeRequirementIds)
+    ? task.activeRequirementIds.filter((id) => requirements.some((requirement) => requirement.id === id))
+    : [];
+  if (explicit.length) return [...new Set(explicit)];
+
+  const own = legacyMap[`task-${task?.id}`];
+  if (own) return [own];
+  return requirements.length ? [requirements[0].id] : [];
+}
+
+/**
+ * Convert legacy goal/task records into the canonical requirement model.
+ * This function is pure and idempotent. It never removes legacy fields, so a
+ * rollback can continue reading the original records.
+ */
+export function migrateRequirementModel(goal, goalTasks = []) {
+  const requirements = (Array.isArray(goal?.requirements) ? goal.requirements : [])
+    .map(normalizeRequirement).filter(Boolean);
+  const attempts = (Array.isArray(goal?.attempts) ? goal.attempts : [])
+    .map(normalizeAttempt).filter(Boolean);
+  const evidence = (Array.isArray(goal?.requirementEvidence) ? goal.requirementEvidence : [])
+    .map(normalizeEvidence).filter(Boolean);
+  const legacyRequirementMap = { ...(goal?.legacyRequirementMap || {}) };
+
+  if (!requirements.length && cleanText(goal?.text)) {
+    const id = requirementId(goal.id, 'goal');
+    requirements.push({ id, source: 'user', messageId: `goal-${goal.id}`, text: cleanText(goal.text) });
+    legacyRequirementMap.goal = id;
+  }
+
+  for (const task of goalTasks) {
+    const text = messageText(task);
+    const shouldCreateRequirement = text && (task.reply ? sourceForTask(task) !== 'manager-policy' : !requirements.length);
+    if (shouldCreateRequirement) {
+      const legacyId = `task-${task.id}`;
+      const id = legacyRequirementMap[legacyId] || requirementId(goal?.id, legacyId);
+      if (!requirements.some((requirement) => requirement.id === id)) {
+        requirements.push({ id, source: sourceForTask(task), messageId: legacyId, text });
+      }
+      legacyRequirementMap[legacyId] = id;
+    }
+
+    const id = attemptId(task);
+    if (!attempts.some((attempt) => attempt.id === id)) {
+      attempts.push(normalizeAttempt({
+        id,
+        taskId: task.id,
+        status: task.status,
+        createdAt: task.createdAt,
+        finishedAt: task.finishedAt,
+        sessionId: task.sessionId ?? task.agentSessionId,
+        worktree: task.worktree,
+      }));
+    }
+
+    const requirementIds = taskRequirementIds(task, requirements, legacyRequirementMap);
+    for (const claim of task?.requirementEvidence?.requirements ?? []) {
+      const mappedId = legacyRequirementMap[claim.id] || (requirements.some((requirement) => requirement.id === claim.id) ? claim.id : null);
+      const targetIds = mappedId ? [mappedId] : requirementIds;
+      for (const targetId of targetIds) {
+        const row = normalizeEvidence({
+          requirementId: targetId,
+          attemptId: id,
+          taskId: task.id,
+          claim: claim.status,
+          coverage: 'unverified',
+          evidence: claim.evidence,
+          files: claim.files,
+        });
+        if (row && !evidence.some((item) => item.requirementId === row.requirementId && item.attemptId === row.attemptId && item.taskId === row.taskId)) {
+          evidence.push(row);
+        }
+      }
+    }
+  }
+
+  const tasks = goalTasks.map((task) => ({
+    ...task,
+    activeRequirementIds: taskRequirementIds(task, requirements, legacyRequirementMap),
+  }));
+
+  return {
+    goal: {
+      ...goal,
+      requirementModelVersion: REQUIREMENT_MODEL_VERSION,
+      requirements,
+      attempts,
+      requirementEvidence: evidence,
+      legacyRequirementMap,
+    },
+    tasks,
+  };
+}
+
+export function validateRequirementModel(goal, goalTasks = []) {
+  const errors = [];
+  const requirementIds = new Set();
+  const attemptIds = new Set();
+  for (const requirement of goal?.requirements ?? []) {
+    if (!requirement?.id || requirementIds.has(requirement.id)) errors.push(`invalid requirement id: ${requirement?.id ?? ''}`);
+    requirementIds.add(requirement?.id);
+  }
+  for (const attempt of goal?.attempts ?? []) {
+    if (!attempt?.id || attemptIds.has(attempt.id)) errors.push(`invalid attempt id: ${attempt?.id ?? ''}`);
+    attemptIds.add(attempt?.id);
+  }
+  for (const task of goalTasks) {
+    for (const id of task?.activeRequirementIds ?? []) {
+      if (!requirementIds.has(id)) errors.push(`task ${task.id} references unknown requirement ${id}`);
+    }
+  }
+  for (const row of goal?.requirementEvidence ?? []) {
+    if (!requirementIds.has(row?.requirementId)) errors.push(`evidence references unknown requirement ${row?.requirementId ?? ''}`);
+    if (!attemptIds.has(row?.attemptId)) errors.push(`evidence references unknown attempt ${row?.attemptId ?? ''}`);
+  }
+  return { ok: errors.length === 0, errors };
+}

package/engine/server.mjs

@@ -20,8 +20,8 @@ import { resolve, dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
-import { needsProjectFolder, folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse, isCommandOnPath } from './lib.mjs';
-import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, classifyWorkerFailure, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildReviewAttemptLedger, latestGoalOutcomeTask, buildDirtyWorkspacePrBlock, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, rebasePreviewUrl, shouldCreateGoalPR, normalizePullRequestUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, autoFoldReviewsEnabled, parseGitUnifiedDiffLocations, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyPrSafety, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildVerificationInfraError, verificationInfraErrorFrom, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, testFailureReason, manualTestRetryPrompt, isNothingVerifiable, isNothingVerifiableForPR, isSuspiciouslyIncompleteDone, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, shouldUsePlannerForGoal, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, buildGoalMessage, serializeGoalMessage, parseGoalMessages, computeInternalQualityMetrics, classifyInternalQualityTaskError, resolveWorkspaceMode, goalSessionFor, setGoalAgentSession, switchGoalAgentSession, parseApprovalRequest } from './lib.mjs';
+import { needsProjectFolder, folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse, isCommandOnPath, parseRequestedWorkspaceDir } from './lib.mjs';
+import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, classifyWorkerFailure, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildReviewAttemptLedger, latestGoalOutcomeTask, buildDirtyWorkspacePrBlock, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, rebasePreviewUrl, shouldCreateGoalPR, normalizePullRequestUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, autoFoldReviewsEnabled, parseGitUnifiedDiffLocations, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyPrSafety, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildVerificationInfraError, verificationInfraErrorFrom, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, testFailureReason, manualTestRetryPrompt, isNothingVerifiable, isNothingVerifiableForPR, isSuspiciouslyIncompleteDone, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, shouldUsePlannerForGoal, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, buildReplyIntentPrompt, parseReplyIntent, buildGoalMessage, serializeGoalMessage, parseGoalMessages, computeInternalQualityMetrics, classifyInternalQualityTaskError, resolveWorkspaceMode, goalSessionFor, setGoalAgentSession, switchGoalAgentSession, parseApprovalRequest } from './lib.mjs';
 import { createSerialQueue } from './lib.mjs';
 import { parseRequirementEvidence, unmappedChangedFiles } from './lib.mjs';
 import { isPrClosed } from './lib.mjs';
@@ -1524,6 +1524,27 @@ function removeGoalWorkDir(goal, project) {
   try { const repoRoot = gitSync(project.dir, ['rev-parse', '--show-toplevel']); gitSync(repoRoot, ['worktree', 'remove', '--force', wt]); } catch { /* best effort */ }
 }
 
+function projectForGoal(goal, project) {
+  return goal?.workspaceRoot ? { ...project, dir: goal.workspaceRoot } : project;
+}
+
+function rebindGoalWorkspace(goal, project, requestedDir) {
+  const abs = resolve(requestedDir);
+  if (!existsSync(abs)) return { ok: false, error: `Working directory is unavailable: ${abs}. Reconnect or choose the folder before starting work.` };
+  try { if (!statSync(abs).isDirectory()) return { ok: false, error: `Working directory is not a folder: ${abs}` }; } catch { return { ok: false, error: `Working directory cannot be read: ${abs}` }; }
+  if (!isGitRepo(abs)) return { ok: false, error: `Working directory is not a Git repository: ${abs}` };
+  removeGoalWorkDir(goal, project);
+  goal.workspaceRoot = abs;
+  // Claude Code's sandbox is fixed when a session starts. Never resume a
+  // session that was launched from the previous project directory.
+  goal.sessions = {};
+  goal.sessionId = null;
+  goal.sessionAgent = null;
+  goal.contextHandoff = null;
+  saveGoal(goal);
+  return { ok: true, dir: abs };
+}
+
 // External commit sync: pick up commits made outside this Manager (Claude
 // Code sessions run directly in the terminal, manual commits, other tools)
 // so they show up alongside Manager-run tasks for the same project. The
@@ -2288,13 +2309,15 @@ function pauseGoalForApproval(goal, task, request) {
 //
 // 設定は親から引き継ぐ（プロジェクト・エージェント・モデル・effort）。別件とはいえ
 // 同じ場所で同じ人が続けている作業なので、ここで選び直させる理由が無い。
-function createSplitGoal(parent, text, identity) {
+function createSplitGoal(parent, text, identity, targetProjectId = parent.projectId) {
+  const targetProject = projects.find((project) => project.id === targetProjectId);
+  if (!targetProject) throw new Error(`unknown target project: ${targetProjectId}`);
   const goal = {
-    id: nextId++, projectId: parent.projectId, text: text.slice(0, 8000), status: 'planning',
-    wantsPR: resolveWantsPR('auto', text, getReviewDefinition(parent.projectId).defaultWantsPR),
+    id: nextId++, projectId: targetProjectId, text: text.slice(0, 8000), status: 'planning',
+    wantsPR: resolveWantsPR('auto', text, getReviewDefinition(targetProjectId).defaultWantsPR),
     model: parent.model, effort: parent.effort, agent: parent.agent, mode: 'auto',
     skill: null, images: [], source: resolveGoalSource('app'), sourceRef: null,
-    executionPlan: buildExecutionPlan({ projectId: parent.projectId, text, previousSession: false }),
+    executionPlan: buildExecutionPlan({ projectId: targetProjectId, text, previousSession: false }),
     plan: null, pr: undefined, createdAt: new Date().toISOString(),
     // 片方向の印。表示は app（新しいカード「#N の会話から生まれました」／元のカード
     // 「→ #M を切り出しました」）。engine は数字を1つ持つだけ。
@@ -2444,6 +2467,13 @@ function readRunDeclaration(task, workDir) {
   // never broken) and wrote the exact same file:// url a second time. `run` is
   // `{ error, message }` here, distinct from the `null` case below.
   if (run && run.error) {
+    // Valid JSON with only note/check means there is simply nothing to open.
+    // That is common for explanation-only follow-ups and must not manufacture
+    // an "unreadable record" error in Review.
+    if (run.error === 'no-open-target') {
+      sendAct(task, 'run declaration ignored — this result has nothing to open.');
+      return;
+    }
     task.runDeclError = { reason: run.error, message: run.message, snippet: String(raw ?? '').slice(0, 200) };
     sendAct(task, `run declaration ignored — ${run.message}`);
     return;
@@ -2673,6 +2703,7 @@ async function startPreview(task) {
 async function runTask(task) {
   const project = projects.find((p) => p.id === task.projectId);
   const goal = goals.find((g) => g.id === task.goalId);
+  task.projectContext = project ? { id: project.id, name: project.name, dir: project.dir, note: project.note } : null;
   task.status = 'running'; task.startedAt = new Date().toISOString();
   // The goal's "started" clock is set by the first task that actually runs — the
   // signal the board uses to read a 'running' goal as DOING rather than QUEUED
@@ -2687,8 +2718,9 @@ async function runTask(task) {
 
   // The workspace mode is chosen at goal creation and then held through every
   // worker/review/PR step.
-  const workDir = goal ? goalWorkDir(goal, project) : project.dir;
-  const wproject = { ...project, dir: workDir };
+  const effectiveProject = goal ? projectForGoal(goal, project) : project;
+  const workDir = goal ? goalWorkDir(goal, effectiveProject) : effectiveProject.dir;
+  const wproject = { ...effectiveProject, dir: workDir };
   const workspaceMode = resolveWorkspaceMode(task.workspaceMode ?? goal?.workspaceMode ?? goal?.worktree);
   sendProcessAct(task, workspaceMode === 'direct-workspace'
     ? `Using direct workspace: ${workDir}`
@@ -2707,7 +2739,11 @@ async function runTask(task) {
   const planMode = goal?.mode === 'plan' && goal?.planPhase !== 'executing';
   const permissionMode = permissionModeFor(planMode ? 'plan' : (task.mode ?? goal?.mode));
   const entryUrl = (task.passCondition && !planMode) ? entryUrlFor(goal, wproject) : null;
-  const maxAttempts = entryUrl ? 3 : 1;
+  // One continuation is reserved for a worker that reaches the infrastructure
+  // time cap. Long research/report tasks commonly need just over one window;
+  // resume their saved session automatically instead of asking the customer to
+  // discover and press Retry. Normal failures still stop after one attempt.
+  const maxAttempts = entryUrl ? 3 : 2;
   const t0 = Date.now();
 
   // Thread replies resume the goal's Claude Code session — same context,
@@ -2872,6 +2908,10 @@ async function runTask(task) {
     if (r.sessionId && goal) { setGoalAgentSession(goal, runAgent, r.sessionId); saveGoal(goal); }
     approval = parseApprovalRequest(result);
     if (approval) break;
+    if (timedOut && attempt < maxAttempts) {
+      sendProcessAct(task, 'Run limit reached — automatically continuing the same task from its saved session.');
+      continue;
+    }
     if (!entryUrl) break;
     try {
       if (!verify) {
@@ -5224,6 +5264,13 @@ const server = createServer(async (req, res) => {
         if (!text?.trim()) return json(res, 400, { error: 'text required' });
         const worker = applyReplyWorker(goal, requested);
         if (!worker.ok) return json(res, 409, { error: worker.error });
+        const requestedDir = parseRequestedWorkspaceDir(text);
+        if (requestedDir) {
+          const project = projects.find((p) => p.id === goal.projectId);
+          if (!project) return json(res, 404, { error: 'project not found' });
+          const rebound = rebindGoalWorkspace(goal, project, requestedDir);
+          if (!rebound.ok) return json(res, 409, rebound);
+        }
         // Reply picks a parked goal back up into the work queue. 'review' MUST be
         // here: a completed goal awaiting your approve/reject is 'review', and a
         // reply to it means "not done — keep working" (Masa 2026-07-24: replied to
@@ -5447,6 +5494,30 @@ const server = createServer(async (req, res) => {
 // 「聞いてるだけ」への返事 (ONE-CONVERSATION.md §1.3 answer)。
 //
 // 答えるのは**作業した AI 本人**＝その agent の session を resume する。状況一覧しか
+// Resolve the app's `outcome:auto` contract before changing goal state. The
+// utility call is classification-only; the goal's own agent/session still
+// writes an answer or performs the requested change. If routing is unavailable,
+// return unsure so a customer chooses explicitly instead of accidentally
+// starting a ten-minute implementation worker for a question.
+async function judgeReplyIntent(goal, reply) {
+  try {
+    const currentProject = projects.find((project) => project.id === goal.projectId) ?? null;
+    const r = await runUtility({
+      prompt: buildReplyIntentPrompt({ goalText: goal.text, reply, currentProject, projects }),
+      cwd: ROOT,
+      tools: 'Read',
+    });
+    const parsed = parseReplyIntent(r.result);
+    if (!parsed.read) return { outcome: 'unsure', targetProjectId: null };
+    if (parsed.targetProjectId && !projects.some((project) => project.id === parsed.targetProjectId)) {
+      return { outcome: 'unsure', targetProjectId: null };
+    }
+    return { outcome: parsed.outcome, targetProjectId: parsed.targetProjectId };
+  } catch {
+    return { outcome: 'unsure', targetProjectId: null };
+  }
+}
+
 // 知らない別AIでは「なぜそうしたか」に答えられない（Masa確定 2026-07-22）。
 // コードは1文字も変わらない: ツールは Read だけ、permissionMode は 'plan'
 // （Codex 側は read-only サンドボックスに落ちる）。タスクも作らないので看板も
@@ -5497,20 +5568,29 @@ async function answerGoalQuestion(goal, question) {
     let body = '';
     req.on('data', (d) => { body += d; });
     req.on('end', async () => {
-      let text = '', outcome = 'continue', requested = {};
+      let text = '', outcome = 'continue', requested = {}, auto = false;
       try {
         requested = JSON.parse(body || '{}');
         text = String(requested.text ?? '').trim();
         if (REPLY_OUTCOMES.includes(requested.outcome)) outcome = requested.outcome;
+        auto = requested.outcome === 'auto';
       } catch {}
       const worker = applyReplyWorker(goal, requested);
       if (!worker.ok) return json(res, 409, { error: worker.error });
 
-      // A review reply is transport, not a classification request. Legacy clients
-      // send outcome:'auto'; it deliberately means the deterministic default:
-      // preserve the exact words and resume this goal's agent session. Specialized
-      // outcomes work only when an explicit UI action sends one of REPLY_OUTCOMES.
-      if (requested.outcome === 'auto' && !text) return json(res, 400, { error: 'text required' });
+      if (auto) {
+        if (!text) return json(res, 400, { error: 'text required' });
+        const routed = await judgeReplyIntent(goal, text);
+        outcome = routed.outcome;
+        requested.targetProjectId = routed.targetProjectId;
+        if (outcome === 'unsure') return json(res, 200, {
+          goal,
+          outcome,
+          choices: REPLY_OUTCOMES,
+          projectChoices: projects.map((project) => ({ id: project.id, name: project.name, current: project.id === goal.projectId })),
+        });
+        if (requested.targetProjectId && requested.targetProjectId !== goal.projectId) outcome = 'split';
+      }
       // 返事の行き先4種 (ONE-CONVERSATION.md §1.3). 既定は今までどおり continue なので、
       // outcome を送ってこない今の UI の挙動は1ミリも変わらない。
       const result = dismissGoal({ goalStatus: goal.status, outcome });
@@ -5523,8 +5603,23 @@ async function answerGoalQuestion(goal, question) {
         const gate = await requireEntitlementGate(identityFor(req));
         if (!gate.allowed) return json(res, 402, { error: 'free-tier limit reached', blocked: gate.blocked });
         addGoalMessage(goal, { from: 'you', via: 'review', text });
-        const born = createSplitGoal(goal, text, identityFor(req));
-        return json(res, 200, { goal, outcome, splitInto: born.id, born });
+        const targetProjectId = requested.targetProjectId || goal.projectId;
+        if (!projects.some((project) => project.id === targetProjectId)) return json(res, 400, { error: 'unknown target project' });
+        const crossProject = targetProjectId !== goal.projectId;
+        const latest = [...tasks].reverse().find((task) => task.goalId === goal.id && task.result);
+        const handoffText = crossProject ? [
+          `[Cross-project implementation handoff from #${goal.id}]`,
+          `Original request: ${goal.text}`,
+          goal.reviewSummary?.summary ? `Reviewed result: ${goal.reviewSummary.summary}` : '',
+          latest?.result ? `Latest worker result: ${String(latest.result).slice(0, 3000)}` : '',
+          `User's implementation request: ${text}`,
+        ].filter(Boolean).join('\n\n') : text;
+        const born = createSplitGoal(goal, handoffText, identityFor(req), targetProjectId);
+        if (crossProject) {
+          const target = projects.find((project) => project.id === targetProjectId);
+          addGoalMessage(goal, { from: 'manager', via: 'review', text: `Implementation was routed to ${target?.name || targetProjectId} (#${born.id}) instead of editing this project's review.` });
+        }
+        return json(res, 200, { goal, outcome, splitInto: born.id, born, targetProjectId });
       }
 
       // answer: 聞かれただけ。ゴールは review のまま、ワーカーも起こさない（§1.3）。
@@ -5735,6 +5830,13 @@ server.on('error', (e) => {
 });
 
 server.listen(PORT, '127.0.0.1', () => {
+  // Persist the bounded recovery counter before pumping. If auth is offline
+  // and the machine restarts again while the task is still queued, the ledger
+  // must remember that one automatic recovery was already attempted.
+  for (const task of tasks.filter((t) => t.recoveredFromRestart)) {
+    delete task.recoveredFromRestart;
+    saveTask(task);
+  }
   PORT = server.address().port; // the OS-assigned one when MANAGER_PORT=0
   try { server6.listen(PORT, '::1'); } catch { /* IPv6 loopback unavailable */ }
   console.log(`[manager] Manager for AI → http://localhost:${PORT}/?key=${ACCESS_KEY}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.89",
+  "version": "0.10.91",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {