@galda/cli 0.10.94 → 0.10.96

package/engine/completion-contract.mjs

@@ -40,8 +40,46 @@ export const COMPLETION_CONTRACT_PROMPT = [
   '- The latest explicit user instruction can revise an older product decision or code comment. Treat old comments as context, not proof that the requested change is impossible. If the change has consequences, explain them and implement the latest request; only a real safety, permission, legal, or external-system constraint is a blocker.',
   '- A test must assert the observable outcome the user requested. Never replace the request with a tooltip, explanation, or a test that permanently preserves the opposite behavior.',
   '- Do not report a change request as complete with “cannot fix”, “直せません”, or equivalent. If a real external blocker remains, state the concrete blocker and leave the work explicitly unfinished instead of presenting it for Review as completed.',
+  '- You own the routing decision. When the run is not complete, append exactly one single-line receipt: MANAGER_OUTCOME: {"outcome":"needs-input|blocked|rebind-workspace","summary":"short reason","question":"question for the user when needed","options":["optional choice"],"workingDirectory":"absolute path for rebind-workspace"}. Do not emit this receipt for completed work. Galda transports this declaration verbatim; it does not reinterpret your prose.',
 ].join('\n');
 
+const MANAGER_OUTCOMES = new Set(['needs-input', 'blocked', 'rebind-workspace']);
+
+// A transport receipt written by the worker, not a Manager inference. Keep the
+// schema deliberately tiny: the agent decides what happened; Galda only checks
+// that the envelope is safe to route.
+export function parseManagerOutcome(raw) {
+  const m = String(raw ?? '').match(/MANAGER_OUTCOME:\s*(\{[^\n]+\})/);
+  if (!m) return null;
+  let value;
+  try { value = JSON.parse(m[1]); } catch { return null; }
+  if (!MANAGER_OUTCOMES.has(value?.outcome)) return null;
+  const summary = typeof value.summary === 'string' ? value.summary.trim().slice(0, 500) : '';
+  const question = typeof value.question === 'string' ? value.question.trim().slice(0, 300) : '';
+  const options = Array.isArray(value.options)
+    ? value.options.map((x) => typeof x === 'string' ? x.trim().slice(0, 60) : '').filter(Boolean).slice(0, 4)
+    : [];
+  const workingDirectory = typeof value.workingDirectory === 'string' ? value.workingDirectory.trim().slice(0, 1000) : '';
+  if (value.outcome === 'needs-input' && !question) return null;
+  if (value.outcome === 'blocked' && !summary) return null;
+  if (value.outcome === 'rebind-workspace' && !workingDirectory.startsWith('/')) return null;
+  return { outcome: value.outcome, summary, question, options, workingDirectory };
+}
+
+// Existing requirement evidence is also an explicit worker declaration. A
+// worker cannot say `partial`/`not-addressed` and simultaneously be routed to
+// Review as complete. This is schema consistency, not semantic judgment.
+export function incompleteEvidenceOutcome(evidence) {
+  const incomplete = (evidence?.requirements ?? []).filter((r) => ['partial', 'not-addressed'].includes(r?.status));
+  if (!incomplete.length) return null;
+  return {
+    outcome: 'blocked',
+    summary: incomplete.map((r) => r.evidence || `${r.id}: ${r.status}`).filter(Boolean).join('; ').slice(0, 500)
+      || 'The worker declared one or more requirements incomplete.',
+    question: '', options: [], workingDirectory: '',
+  };
+}
+
 export function completionContractIssue({ request = '', followUp = '', result = '', status = '', changedFiles = [] } = {}) {
   if (status !== 'done') return null;
   const requested = `${request}\n${followUp}`;

package/engine/server.mjs

@@ -26,7 +26,7 @@ import { createSerialQueue } from './lib.mjs';
 import { parseRequirementEvidence, unmappedChangedFiles } from './lib.mjs';
 import { isPrClosed } from './lib.mjs';
 import { collectProjectRules } from './lib.mjs';
-import { COMPLETION_CONTRACT_PROMPT, completionContractIssue } from './completion-contract.mjs';
+import { COMPLETION_CONTRACT_PROMPT, completionContractIssue, parseManagerOutcome, incompleteEvidenceOutcome } from './completion-contract.mjs';
 import { FALLBACK_CODEX_MODELS, loadCodexModels } from './codex-models.mjs';
 import { CLAUDE_MODELS } from './claude-models.mjs';
 import { classifyWorkerPreflight, shouldProbeClaudeAuth, workerCanStart } from './worker-availability.mjs';
@@ -1425,8 +1425,19 @@ function gitStatusPaths(lines = []) {
 function newAttemptId(goal, task) {
   return `goal-${goal?.id ?? 'none'}-task-${task.id}-${Date.now()}-${randomBytes(3).toString('hex')}`;
 }
-function noteGoalTaskBaseline(goal, project, workDir, before) {
-  if (!goal || goal.prBaseline) return;
+// `refresh` re-measures a baseline that already exists. Without it the snapshot
+// is write-once: whatever the shared checkout happened to look like when the
+// goal's FIRST task started is what classifyPrSafety judges forever. So a goal
+// that began while some unrelated file was dirty is permanently unable to
+// produce a PR — "PR creation skipped: this goal started in a dirty shared
+// workspace" re-emits on every close-out even after the workspace was cleaned
+// minutes later, and no amount of asking can fix it. Measured on the operator's
+// instance 2026-07-25..29: goals #729 #733 #731 are all stuck this way.
+// Re-measuring is only correct while there is no PR yet — once a branch exists
+// it is the reference, and moving the baseline under it would compare the work
+// against the wrong starting point.
+function noteGoalTaskBaseline(goal, project, workDir, before, { refresh = false } = {}) {
+  if (!goal || (goal.prBaseline && !refresh)) return;
   const repoRoot = gitSyncOrNull(workDir, ['rev-parse', '--show-toplevel']);
   const branch = repoRoot ? gitSyncOrNull(workDir, ['branch', '--show-current']) : null;
   const head = repoRoot ? gitSyncOrNull(workDir, ['rev-parse', 'HEAD']) : null;
@@ -2299,6 +2310,66 @@ function pauseGoalForApproval(goal, task, request) {
   return true;
 }
 
+// The worker decides where its result belongs. Galda does not classify prose;
+// it only validates and transports the explicit receipt (or the worker's
+// existing partial/not-addressed evidence) into the corresponding board state.
+function routeWorkerOutcome(goal, task, project) {
+  if (!goal || !task || task.status !== 'done') return false;
+  const outcome = parseManagerOutcome(task.result) || incompleteEvidenceOutcome(task.requirementEvidence);
+  if (!outcome) return false; // backwards-compatible completed run
+  task.managerOutcome = outcome;
+  task.finishedAt = new Date().toISOString();
+
+  if (outcome.outcome === 'rebind-workspace') {
+    const rebound = rebindGoalWorkspace(goal, project, outcome.workingDirectory);
+    if (rebound.ok) {
+      task.status = 'skipped';
+      task.result = `${task.result}\n\n[Galda: continuing in ${rebound.dir} with a fresh session]`.slice(0, RESULT_MAX);
+      saveTask(task);
+      goal.status = 'running';
+      goal.startedAt = null;
+      goal.question = null;
+      goal.blocked = null;
+      saveGoal(goal);
+      const continuation = queueReplyTask(goal, [
+        `Continue the same request in the newly bound working directory: ${rebound.dir}`,
+        outcome.summary,
+        'Inspect the files already present there and complete the original request. Do not repeat the old sandbox diagnosis.',
+      ].filter(Boolean).join('\n'), { from: 'manager', via: 'system' });
+      continuation.workspaceRebindContinuation = true;
+      saveTask(continuation);
+      sendProcessAct(task, `Worker requested a workspace rebind; continuing in ${rebound.dir} with a fresh session.`);
+      return true;
+    }
+    // An unsafe/unavailable path is not silently retried in the old sandbox.
+    outcome.outcome = 'needs-input';
+    outcome.question = rebound.error;
+    outcome.options = [];
+    outcome.summary = rebound.error;
+  }
+
+  // This turn ended successfully as a routing hand-off, not as a failed unit
+  // of implementation. Keeping it `interrupted` would poison the eventual
+  // closeout even after the user answers and the continuation completes.
+  task.status = 'skipped';
+  saveTask(task);
+  goal.startedAt = null;
+  if (outcome.outcome === 'needs-input') {
+    goal.status = 'needsInput';
+    goal.blocked = null;
+    goal.question = { kind: 'worker', text: outcome.question, options: outcome.options };
+    sendProcessAct(task, `Worker asked for input: ${outcome.question}`);
+  } else {
+    goal.status = 'blocked';
+    goal.question = null;
+    goal.blocked = { kind: 'worker-outcome', reason: outcome.summary };
+    sendProcessAct(task, `Worker declared the work blocked: ${outcome.summary}`);
+  }
+  saveGoal(goal);
+  startNextStacked(goal.projectId);
+  return true;
+}
+
 // split (docs/design/ONE-CONVERSATION.md §1.3): 「それは別件」と返された時の受け皿。
 // 元のゴールには触らない——新しいチケットを1枚起こし、そこに「どこから生まれたか」だけ
 // 片方向の印（bornFrom）を残す。
@@ -2731,7 +2802,9 @@ async function runTask(task) {
   task.attemptId = task.attemptId || newAttemptId(goal, task);
   if (goal) {
     goal.latestAttemptId = task.attemptId;
-    noteGoalTaskBaseline(goal, project, workDir, before);
+    // A reply is a fresh attempt: re-measure the workspace so a baseline taken
+    // when the checkout happened to be dirty cannot outlive the mess itself.
+    noteGoalTaskBaseline(goal, project, workDir, before, { refresh: !!task.reply && !goal.pr });
   }
   sendProcessAct(task, `Checked starting git state (${before.length} changed file${before.length === 1 ? '' : 's'} before this task).`);
   // Plan mode makes no edits, so there is nothing to verify — never author a
@@ -2808,6 +2881,9 @@ async function runTask(task) {
     task.unmappedChangedFiles = unmappedChangedFiles(task.changedFiles, task.requirementEvidence);
     task.requirementVerification = { proof: task.proof ?? null, run: task.run ?? null, changedFiles: task.changedFiles };
     sendProcessAct(task, `Detected ${task.changedFiles.length} changed file${task.changedFiles.length === 1 ? '' : 's'} from this follow-up.`);
+    // An explicit worker receipt takes precedence over Galda's legacy prose
+    // guard. The agent owns this decision; Manager only transports it.
+    if (routeWorkerOutcome(goal, task, project)) return;
     const completionIssue = completionContractIssue({
       request: goal?.text,
       followUp: task.detail,
@@ -3030,6 +3106,9 @@ async function runTask(task) {
   task.unmappedChangedFiles = unmappedChangedFiles(task.changedFiles, task.requirementEvidence);
   task.requirementVerification = { proof: task.proof ?? null, run: task.run ?? null, changedFiles: task.changedFiles };
   sendProcessAct(task, `Detected ${task.changedFiles.length} changed file${task.changedFiles.length === 1 ? '' : 's'} from this task.`);
+  // An explicit worker receipt takes precedence over Galda's legacy prose
+  // guard. The agent owns this decision; Manager only transports it.
+  if (routeWorkerOutcome(goal, task, project)) return;
   // task 450: taskStatusAfterVerify decided 'done' from `code` alone, before
   // changedFiles existed to check against. Don't trust a clean exit code by
   // itself — a worker that changed nothing and left a cut-off-looking result
@@ -3886,7 +3965,15 @@ async function createGoalPR(goal, project, goalTasks, reviewDefinition = DEFAULT
   if (!shouldCreateGoalPR(goal, files)) {
     goal.pr = null;
     goal.prBranch = null;
-    goal.prError = null;
+    // Two different situations used to leave the same silent hole. "No PR was
+    // asked for" is nothing to explain — clear the error. But "a PR WAS asked
+    // for and none exists" is a fact the person needs, and nulling prError here
+    // erased the only field the Review card renders a reason from, so the card
+    // showed a PR-less goal with no explanation at all (goals #725 #751 on the
+    // operator's instance: status done, wantsPR true, pr null, prError empty).
+    goal.prError = goal.wantsPR === true
+      ? 'PRを作成できませんでした: 変更されたファイルが1つもありません（実装が行われていない可能性があります）/ Cannot open a PR: this run produced no file changes.'
+      : null;
     saveGoal(goal);
     goalAct(goal.wantsPR === false
       ? 'Deliverable is No PR, so PR creation is skipped even though files changed.'
@@ -5122,6 +5209,18 @@ const server = createServer(async (req, res) => {
       let answer = '';
       try { answer = String(JSON.parse(body || '{}').answer ?? '').trim(); } catch {}
       if (!answer) return json(res, 400, { error: 'answer required' });
+      // A worker-authored question is a transport pause, not a new planning
+      // cycle. Preserve the worker session and pass the user's answer straight
+      // back to it; Galda must not reinterpret or rewrite the answer.
+      if (goal.question?.kind === 'worker') {
+        goal.question = null;
+        goal.blocked = null;
+        goal.status = 'running';
+        goal.startedAt = null;
+        saveGoal(goal);
+        const replyTask = queueReplyTask(goal, answer, { from: 'you', via: 'question' });
+        return json(res, 200, { ...goal, replyTaskId: replyTask.id });
+      }
       // Bind this goal to a project rooted at `dir` and start planning. Shared by
       // the "picked a repo" and "git-init'd a new folder" paths below.
       const bindAndPlan = (dir) => {
@@ -5313,6 +5412,20 @@ const server = createServer(async (req, res) => {
           goal.blocked = null;
           saveGoal(goal);
         }
+        // "PR出して" has to count here too. This is the route EVERY follow-up reply
+        // takes (the review card switches to it once a card is in conversation) and
+        // the one MCP manager_reply uses, so until now a PR asked for on the second
+        // reply — or from an agent session — could never take effect: the deliverable
+        // was only ever upgraded in /dismiss. Measured on the operator's instance
+        // 2026-07-25..29: 「あれ、prいるよね？」then「PR作成して」(#790) and
+        // 「問題ないのでpr出して！」then「あれ、問題ないのでpr作ってください」(#800) —
+        // both asked twice and got no PR either time.
+        // Upgrade only: this can turn the deliverable on, never off, so a later
+        // unrelated reply cannot silently withdraw a PR the person already asked for.
+        if (resolveWantsPR('auto', text, false) && goal.wantsPR !== true) {
+          goal.wantsPR = true;
+          saveGoal(goal);
+        }
         json(res, 200, queueReplyTask(goal, text.trim(), { from: 'you', via: 'thread' }));
       } catch { json(res, 400, { error: 'bad json' }); }
     });
@@ -5391,6 +5504,41 @@ const server = createServer(async (req, res) => {
     return json(res, 200, goal);
   }
 
+  // PR再試行 / Retry PR. The Review card has offered this button all along and it
+  // has never had a route to call — fsRetryPrGoal POSTs here, the server had no
+  // match for it, and the press 404'd and showed an error. So the one repair the
+  // failure message advertises ("commit/stash/revert those unrelated changes,
+  // then rerun") was unreachable from the product: the person cleaned the
+  // workspace and had no way to say "now try again".
+  //
+  // Deliberately narrow — this only re-runs PR creation. It starts no worker and
+  // changes no code, so it is safe to press repeatedly: either the PR appears or
+  // the same honest reason comes back.
+  const retryPrMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/retry-pr$/);
+  if (retryPrMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(retryPrMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    if (goal.pr) return json(res, 409, { error: 'this goal already has a pull request' });
+    const project = projects.find((p) => p.id === goal.projectId);
+    if (!project) return json(res, 404, { error: 'project not found' });
+    // Asking to retry the PR IS asking for a PR — a goal that was created as
+    // No PR but whose owner now presses this wants one.
+    goal.wantsPR = true;
+    // The frozen dirty-workspace verdict is exactly what this button exists to
+    // clear. Re-measure against the workspace as it is NOW, which is the state
+    // the person just repaired.
+    const wdir = (goalWorkDirs.get(goal.id) && existsSync(goalWorkDirs.get(goal.id))) ? goalWorkDirs.get(goal.id) : project.dir;
+    goal.prBaseline = null;
+    goal.prSafety = null;
+    goal.prError = null;
+    noteGoalTaskBaseline(goal, project, wdir, await gitChanges(wdir));
+    const siblings = tasks.filter((t) => t.goalId === goal.id);
+    await createGoalPR(goal, { ...project, dir: wdir }, siblings, getReviewDefinition(goal.projectId), null);
+    saveGoal(goal);
+    return json(res, 200, { goal, pr: goal.pr ?? null, prError: goal.prError ?? null });
+  }
+
   // Archive: retire an UNFINISHED goal (partial/failed/interrupted/blocked)
   // cleanly — spawning no rework. DELETE only accepts stacked/pending, and
   // dismiss on a partial goal queues a "差し戻し" rework task, so a goal that
@@ -5678,7 +5826,12 @@ async function answerGoalQuestion(goal, question) {
       // Manager close-out below owns commit/push/PR creation. Keep this
       // monotonic: an explicit later PR request upgrades a No-PR/auto goal,
       // while ordinary feedback never silently downgrades an existing PR goal.
-      if (result.spawnsWorker && resolveWantsPR('auto', text, false)) goal.wantsPR = true;
+      // Not gated on spawnsWorker: what the person wants DELIVERED is independent
+      // of where their words were routed. A PR asked for while parking the goal
+      // (rescope) or while asking a question (answer) is still a PR they asked
+      // for, and it must survive until close-out rather than being dropped
+      // because this particular reply happened not to wake a worker.
+      if (resolveWantsPR('auto', text, false)) goal.wantsPR = true;
       goal.status = result.status;
       saveGoal(goal);
       // rescope はワーカーを起こさない——「いったん止めて考え直す」なので、走り出したら

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.94",
+  "version": "0.10.96",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {