@galda/cli 0.10.9 → 0.10.10

package/app/index.html

@@ -2387,7 +2387,7 @@
   <div class="perahead" style="border-bottom:1px solid var(--hair)"><div class="peratitle">Settings</div><span style="flex:1"></span><button class="mbtn ghost" id="setClose">Close</button></div>
   <div style="padding:16px">
     <div class="setrow"><div><div class="setlabel">Content language</div><div class="setsub">UI is English; this sets the language of AI summaries and PR bodies.</div></div>
-      <div class="segbtn" id="langSeg"><button data-lang="en">English</button><button data-lang="ja">日本語</button></div></div>
+      <div class="segbtn" id="langSeg"><button data-lang="auto">Auto</button><button data-lang="en">English</button><button data-lang="ja">日本語</button></div></div>
   </div>
 </div></div>
 <!-- Slack-style centered delete confirmation, replacing native confirm() for every goal
@@ -2586,7 +2586,7 @@ function prioBadge(t){
 // Mirrors engine/lib.mjs DEFAULT_REVIEW_DEFINITION — kept in sync manually,
 // see the comment on DEFAULT_WORKFLOW_COLUMNS above.
 const DEFAULT_REVIEW_DEFINITION = {
-  requirePR: true, requireVerifyPass: false, description: '', defaultWantsPR: false, language: 'ja',
+  requirePR: true, requireVerifyPass: false, description: '', defaultWantsPR: false, language: 'auto',
   prSections: { summary: true, whatChanged: true, howToReview: true, tests: true, screenshots: true, risk: true },
   reviewCard: { screenshots: true, beforeAfter: false },
 };
@@ -2598,7 +2598,10 @@ function reviewDefinitionFor(projectId){ return state.reviewDefinitions[projectI
 // review-definitions.json entries are never re-validated on server load), so
 // merge with the defaults key-by-key here rather than assuming they exist.
 function reviewCardConfigFor(projectId){ return { ...DEFAULT_REVIEW_DEFINITION.reviewCard, ...(reviewDefinitionFor(projectId).reviewCard ?? {}) }; }
-function reviewLangFor(projectId){ return reviewDefinitionFor(projectId).language === 'en' ? 'en' : 'ja'; }
+// 'auto'|'ja'|'en' verbatim — 'auto' (default) means the Manager matches each
+// goal's own request language, same as the planner/worker; ja/en pin the
+// project to one language regardless of what a given goal was typed in.
+function reviewLangFor(projectId){ const l = reviewDefinitionFor(projectId).language; return (l === 'en' || l === 'ja') ? l : 'auto'; }
 
 function esc(s){ const d = document.createElement('div'); d.textContent = s ?? ''; return d.innerHTML; }
 
@@ -3911,6 +3914,7 @@ function renderRdEditor(){
 
     <div class="rdsub">出力言語 / Output language</div>
     <label class="rdrow"><select id="rdLanguage">
+        <option value="auto"${state.rdDraft.language === 'auto' ? ' selected' : ''}>Auto (match request)</option>
         <option value="ja"${state.rdDraft.language === 'ja' ? ' selected' : ''}>日本語</option>
         <option value="en"${state.rdDraft.language === 'en' ? ' selected' : ''}>English</option>
       </select>
@@ -7419,6 +7423,7 @@ function gearSetHTML(){
   }
   return `
   <div class="srow"><div class="sl">Language<span class="sd">Review checklist language for this project</span></div>
+    <button class="optchip${lang === 'auto' ? ' on' : ''}" data-gslang="auto">Auto</button>
     <button class="optchip${lang === 'en' ? ' on' : ''}" data-gslang="en">EN</button>
     <button class="optchip${lang === 'ja' ? ' on' : ''}" data-gslang="ja">JA</button></div>
   ${billingRow}

package/engine/lib.mjs

@@ -260,7 +260,7 @@ function primaryFailureCause({ usage = null, blockedKind = null, changedFiles =
 
 function failurePhase(kind) {
   if (kind === 'budget' || kind === 'rate-limit') return 'worker-run';
-  if (kind === 'test' || kind === 'proof' || kind === 'verify') return 'manager-verification';
+  if (kind === 'test' || kind === 'proof' || kind === 'verify' || kind === 'noop') return 'manager-verification';
   return 'execution';
 }
 
@@ -297,6 +297,12 @@ function failureSummaryFor({ kind, goalText, testResult, budgetReason, proofMiss
       yourCall: '不足している proof / 検証結果をそろえ、判断できる状態にしてから再提出します。',
     };
   }
+  if (kind === 'noop') {
+    return {
+      whatHappened: `必要だった作業「${needed}」は検証条件つきのタスクを含みますが、worker はファイル変更もproofも無いまま完了報告しました。`,
+      yourCall: '約束した検証(passCondition)が実行されなかった理由を確認し、必要なら worker にやり直しを指示します。',
+    };
+  }
   return {
     whatHappened: budgetReason ? String(budgetReason).slice(0, 180) : `必要だった作業「${needed}」が途中で止まりました。`,
     yourCall: '停止地点のログを読んで、同じ失敗を避ける最小ステップで再開します。',
@@ -1099,7 +1105,11 @@ export function resolveGoalSource(input) {
 // no explicit signal — it decides whether *this project* opens PRs by
 // default, separately from whether a PR-wanting goal must go through review.
 // `language` is the output language for the Manager's review-facing text
-// (e.g. summarizeForReview's plain-language headline) — 'ja' or 'en' only.
+// (e.g. summarizeForReview's plain-language headline) — 'auto' (match the
+// language the goal's own request was written in, same as the planner/worker —
+// see detectRequestLanguage) or an explicit 'ja'/'en' override for a project
+// that always wants one fixed language regardless of what any given goal was
+// typed in.
 // `prSections` toggles which sections createGoalPR includes in the PR body;
 // `reviewCard` toggles what the review checklist card shows for each task.
 export const DEFAULT_REVIEW_DEFINITION = {
@@ -1107,11 +1117,19 @@ export const DEFAULT_REVIEW_DEFINITION = {
   requireVerifyPass: false,
   description: '',
   defaultWantsPR: false,
-  language: 'ja',
+  language: 'auto',
   prSections: { summary: true, whatChanged: true, howToReview: true, tests: true, screenshots: true, risk: true },
   reviewCard: { screenshots: true, beforeAfter: false },
 };
 
+// Detects whether text was written in Japanese (kana/kanji present) or not, so
+// generated replies can match the language the request was written in
+// ("test" → English, "テスト" → 日本語) — worker close-out summaries, and (via
+// reviewDefinition.language === 'auto') review headlines/PR bodies.
+export function detectRequestLanguage(text) {
+  return /[぀-ヿ㐀-鿿]/.test(text || '') ? 'ja' : 'en';
+}
+
 // Normalize a nested boolean-flag object (prSections/reviewCard) key by key,
 // so a partial payload — or one missing the whole sub-object — can't
 // silently disable flags it never mentioned; each key falls back to its own
@@ -1138,7 +1156,7 @@ export function validateReviewDefinition(input) {
       requireVerifyPass: input.requireVerifyPass !== undefined ? !!input.requireVerifyPass : DEFAULT_REVIEW_DEFINITION.requireVerifyPass,
       description: input.description !== undefined ? String(input.description).slice(0, 500) : DEFAULT_REVIEW_DEFINITION.description,
       defaultWantsPR: input.defaultWantsPR !== undefined ? !!input.defaultWantsPR : DEFAULT_REVIEW_DEFINITION.defaultWantsPR,
-      language: (input.language === 'ja' || input.language === 'en') ? input.language : DEFAULT_REVIEW_DEFINITION.language,
+      language: (input.language === 'ja' || input.language === 'en' || input.language === 'auto') ? input.language : DEFAULT_REVIEW_DEFINITION.language,
       prSections: normalizeBoolMap(input.prSections, DEFAULT_REVIEW_DEFINITION.prSections),
       reviewCard: normalizeBoolMap(input.reviewCard, DEFAULT_REVIEW_DEFINITION.reviewCard),
     },
@@ -1160,6 +1178,20 @@ export function nextGoalStatus({ allDone, wantsPR, allVerified = true, reviewDef
   return allDone ? 'review' : 'partial';
 }
 
+// 段5 検証ゲート (Masa 2026-07-15: "proof無しは完了と言わない"): a task that carries
+// an EXPLICIT passCondition is a case where the user asked for proof — but if the
+// worker changed zero files, isUiChange() never matches (empty changedFiles), so
+// uiTasks stays empty and the existing proofMissing check (scoped to UI tasks)
+// never fires: the promised verification silently never happened. This is
+// deliberately narrower than "any 0-file goal" — a goal with NO passCondition
+// (an investigation/report-only ask) legitimately has nothing to prove and must
+// still reach Review for a human to read (see goal-guardrails-integration.test.mjs
+// (a2)/(a3): budget/cache-guardrail continuations correctly land in Review with
+// zero file changes because nothing was ever promised to be verified).
+export function isNothingVerifiable({ changedFiles = [], hasPassCondition = false, hasAnyProof = false } = {}) {
+  return hasPassCondition && changedFiles.length === 0 && !hasAnyProof;
+}
+
 // チェックリストUIで要件が全件Approveされたら goal を review→done へ進める。
 // 以前は「PRありgoalはマージが唯一の完了トリガー」として弾いていたが、それだと
 // 承認しても done が永続化されず次のrefreshで review に戻る不具合になっていた
@@ -2452,3 +2484,17 @@ export function resolveFolderAnswer(answer, folders = []) {
   if (a.startsWith('/') || a.startsWith('~')) return { dir: a };
   return null;
 }
+
+// Analytics identity (A+): a signed-in install scopes usage events to the
+// ACCOUNT (its email, which the billing Worker hashes into the same account_id
+// the accounts table carries) so per-user app activity joins WITHOUT a cookie;
+// otherwise the anonymous per-install id. Pure for unit-testing.
+export function pickAnalyticsUid(accountEmail, installId) {
+  return accountEmail || installId;
+}
+
+// Fire the free_exhausted funnel event only the first time a non-paying install
+// is actually blocked by the free-tier cap.
+export function shouldEmitFreeExhausted(alreadyEmitted, blocked) {
+  return !alreadyEmitted && Boolean(blocked);
+}

package/engine/server.mjs

@@ -21,7 +21,7 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
 import { needsProjectFolder, folderLabel, buildFolderQuestion, resolveFolderAnswer } from './lib.mjs';
-import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken, shouldEmitSetupCompleted } from './lib.mjs';
+import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable } from './lib.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
 
@@ -180,7 +180,7 @@ let licenseState = { email: null, isPaying: false, verifiedAt: 0 }; // in-memory
 // carries, so per-user app activity joins WITHOUT a cookie). Not signed in →
 // the anonymous per-install id. Raw email never lands in usage_events (the
 // Worker pseudonymizes it server-side).
-function analyticsUid() { return licenseState.email || ANALYTICS_UID; }
+function analyticsUid() { return pickAnalyticsUid(licenseState.email, ANALYTICS_UID); }
 let _freeExhaustedEmitted = false;
 
 // One-time nonces for the "Sign in with Google" loopback (GET /api/signin-url →
@@ -388,7 +388,7 @@ async function requireEntitlementGate(identity) {
 // blocked by the free-tier cap (the funnel dedupes by distinct account/install,
 // so once-per-session is enough).
 function noteFreeExhausted(result) {
-  if (_freeExhaustedEmitted || !result?.blocked) return;
+  if (!shouldEmitFreeExhausted(_freeExhaustedEmitted, result?.blocked)) return;
   _freeExhaustedEmitted = true;
   emitEvent('free_exhausted', analyticsUid());
 }
@@ -1374,15 +1374,15 @@ function testOutputExcerpt(text) {
 }
 
 function workerPrompt(task, goal, lastFailure) {
-  // Report back to the human in the SAME language they wrote the goal in (Masa
-  // 2026-07-15: "撃った言語で返す"). JP characters → Japanese, otherwise English.
-  const replyLang = /[぀-ヿ㐀-鿿]/.test(goal?.text || task?.title || '') ? '日本語' : 'English';
   // Optional skill the user attached to this goal. Empirically (scratch worker,
   // haiku, custom fixture skill) the reliably-firing form is an explicit Skill-tool
   // instruction as the FIRST line; a bare "/name" first line did not consistently
   // trigger the skill in `claude -p`. See commit body for the run evidence.
   const skill = task?.skill ?? goal?.skill;
   const agentName = workerAgent(task?.agent ?? goal?.agent) === 'codex' ? 'Codex' : 'Claude Code';
+  // Report back to the human in the SAME language they wrote the goal in (Masa
+  // 2026-07-15: "撃った言語で返す"). JP characters → Japanese, otherwise English.
+  const replyLang = detectRequestLanguage(goal?.text || task?.title || '') === 'ja' ? '日本語' : 'English';
   return [
     skill ? `FIRST, use the /${skill} skill via the Skill tool (invoke Skill with the "${skill}" skill) before doing anything else. Then carry out the task below.` : '',
     `You are a ${agentName} worker managed by "Manager for AI". Do ONLY the task below inside this project directory.`,
@@ -2044,7 +2044,11 @@ function computeGoalDiff(goal, project) {
 // plain-language review headline in the user's language: what to CHECK and what
 // CHANGED. Never trusts the worker to self-format.
 async function summarizeForReview(goal, siblings, dir, reviewDefinition) {
-  const lang = reviewDefinition.language || 'ja';
+  // 'auto' (default) matches the language the goal's own request was written
+  // in, same as the planner/worker (Masa 2026-07-15 follow-up to a8d69fe: "the
+  // review-column headline still defaults to ja — align it the same way").
+  // An explicit ja/en on the project's review definition always overrides.
+  const lang = reviewDefinition.language === 'auto' ? detectRequestLanguage(goal.text) : (reviewDefinition.language || 'ja');
   const changed = [...new Set(siblings.flatMap((t) => t.changedFiles ?? []))].slice(0, 20);
   const reports = siblings.filter((t) => !t.reply).map((t) => `- ${t.title}: ${(t.result ?? '').replace(/\s+/g, ' ').slice(0, 300)}`).join('\n');
   const fallback = { check: '', changed: (goal.plan?.[0] ?? goal.text ?? '').replace(/\s+/g, ' ').slice(0, 80) };
@@ -2253,6 +2257,16 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
   // EVERY task must carry a passing proof, not just UI tasks. Only ever tightens;
   // never conflicts with §6 (still can't reach Done without a human).
   const verifyFail = reviewDefinition.requireVerifyPass && !allVerified;
+  // 段5 検証ゲート厳格化 (Masa 2026-07-15: "proof無しは完了と言わない"): passCondition
+  // を約束したタスクなのに 0 ファイル変更で proof も無い＝約束した検証が実行されずに
+  // すり抜けたサイン（isUiChange は changedFiles が空だと絶対に一致しないため、既存の
+  // proofMissing(UIタスク限定)はこのケースを検知できない）。passCondition が無い調査
+  // 系ゴール（0ファイルが正当な完了）は対象外 — 人間が読んで判断すれば足りる。
+  const nothingVerifiable = isNothingVerifiable({
+    changedFiles,
+    hasPassCondition: siblings.some((t) => t.passCondition),
+    hasAnyProof: siblings.some((t) => t.proof),
+  });
   if (testsFailing) {
     const failure = recordGoalFailure(goal, {
       kind: 'test',
@@ -2285,22 +2299,24 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
       return;
     }
   }
-  if (testsFailing || proofMissing || proofFailing || verifyFail) {
+  if (testsFailing || proofMissing || proofFailing || verifyFail || nothingVerifiable) {
     if (!testsFailing) {
       recordGoalFailure(goal, {
-        kind: (proofMissing || proofFailing) ? 'proof' : 'verify',
+        kind: (proofMissing || proofFailing) ? 'proof' : nothingVerifiable ? 'noop' : 'verify',
         reason: proofMissing ? 'UI変更なのに proof(スクショ/動画) が取れていない'
           : proofFailing ? 'UI proof は撮れたが、依頼対象のUIを確認できていない'
+          : nothingVerifiable ? '検証条件つきのタスクなのに、ファイル変更も proof も無い（約束した検証が行われていない）'
           : '検証(proof)が全タスク分そろっていない（requireVerifyPass）',
         changedFiles,
         testResult: goal.testResult,
       });
     }
     goal.blocked = {
-      kind: testsFailing ? 'test' : (proofMissing || proofFailing) ? 'proof' : 'verify',
+      kind: testsFailing ? 'test' : (proofMissing || proofFailing) ? 'proof' : nothingVerifiable ? 'noop' : 'verify',
       reason: testsFailing ? `テスト失敗 ${goal.testResult.failed} 件（自動修正 ${Number(goal.autoRework?.testFailures ?? 0)} 回後も失敗）`
         : proofMissing ? 'UI変更なのに proof(スクショ/動画) が取れていない'
         : proofFailing ? 'UI proof は撮れたが、依頼対象のUIを確認できていない'
+        : nothingVerifiable ? '検証条件つきのタスクなのに、ファイル変更も proof も無い（約束した検証が行われていない）'
         : '検証(proof)が全タスク分そろっていない（requireVerifyPass）',
     };
     goal.status = 'blocked';
@@ -2349,9 +2365,11 @@ async function createGoalPR(goal, project, goalTasks, reviewDefinition = DEFAULT
     }
     const ownerRes = spawnSync('gh', ['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner'], { cwd: project.dir, encoding: 'utf8' });
     const owner = ownerRes.status === 0 ? ownerRes.stdout.trim() : null;
-    // PR body in the USER's language (reviewDefinition.language, default ja) —
-    // not forced English/bilingual (Masa: 「ユーザーの言語で」).
-    const lang = reviewDefinition.language || 'ja';
+    // PR body in the USER's language — default 'auto' matches the goal's own
+    // request language (same as planner/worker); an explicit ja/en override on
+    // the project's review definition always wins. Not forced English/bilingual
+    // (Masa: 「ユーザーの言語で」).
+    const lang = reviewDefinition.language === 'auto' ? detectRequestLanguage(goal.text) : (reviewDefinition.language || 'ja');
     const L = (en, ja) => (lang === 'en' ? en : ja);
     const bodyFor = (branch) => [
       ...(proofItems.length && owner ? [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.9",
+  "version": "0.10.10",
   "type": "module",
   "description": "Galda - hand off work to your Claude Code, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {