@ojokesusu/lintasai 1.1.2

package/update-kit.ps1

@@ -0,0 +1,907 @@
+<#
+.SYNOPSIS
+  update-kit.ps1 - Update kit lintasAI di proyek ke versi terbaru via re-clone fresh.
+
+.DESCRIPTION
+  Workflow atomic (zero half-state):
+    1. Backup .claude-kit/ lama → .claude-kit.backup-<timestamp>
+    2. Clone fresh dari GitHub ke .claude-kit/ baru
+    3. Hapus .git/ internal supaya tidak konflik dengan git proyek user
+    4. Re-run setup-pola-b.ps1 -Force (anti-overwrite preserve docs/ existing)
+    5. Tampilkan diff CHANGELOG lama vs baru + action items
+
+  Cara B (re-clone fresh) sesuai README — paling clean, no merge conflict
+  possible, atomic operation.
+
+.PARAMETER NoBackup
+  Skip backup .claude-kit/ lama (irreversible). Default: backup aktif.
+
+.PARAMETER RepoUrl
+  Override GitHub URL (untuk fork private kamu sendiri).
+  Default: https://github.com/ojokesusu/lintasAI.git
+
+.PARAMETER Branch
+  Branch yang di-clone. Default: main.
+
+.PARAMETER DryRun
+  Preview tindakan tanpa eksekusi nyata.
+
+.PARAMETER AllowUntrustedRepo
+  Bypass RepoUrl allowlist check (kalau pakai fork private / mirror tidak
+  terdaftar di $allowedRepoUrls). Tanpa flag ini, RepoUrl di luar allowlist
+  akan prompt user (interactive) atau abort (non-interactive).
+  UNSAFE — pakai cuma kalau yakin sumber tepercaya atau di CI.
+
+.PARAMETER Force
+  [DEPRECATED] Backward-compat alias untuk -AllowUntrustedRepo (RepoUrl
+  allowlist bypass). Akan menampilkan deprecation warning. Pakai
+  -AllowUntrustedRepo untuk explicit intent.
+  CATATAN: -Force TIDAK lagi bypass GPG verify-tag. Untuk GPG bypass pakai
+  -AllowUnsignedTag (separation of concerns).
+
+.PARAMETER AllowUnsignedTag
+  Bypass GPG tag signature verification (fail-closed by default).
+  Default: false — kalau tag tidak signed atau pubkey owner tidak ter-import,
+  update DI-ABORT (no interactive prompt). Pakai flag ini cuma kalau owner
+  belum publish signed release / kamu sengaja jalanin dari fork tanpa key.
+  Detail setup pubkey owner: docs/SIGNED_RELEASE.md.
+
+.NOTES
+  Versi  : 1.0
+  Tanggal: 2026-06-01
+  Kit    :
+  Run    : .\.claude-kit\update-kit.ps1
+  Atau   : powershell -ExecutionPolicy Bypass -File .\.claude-kit\update-kit.ps1
+
+  Jalankan dari root proyek (folder yang ada .claude-kit/ di dalamnya).
+
+  Catatan keamanan:
+  - Script tidak modify file di luar .claude-kit/. docs/ + .github/ proyek user AMAN
+    (anti-overwrite dari setup-pola-b.ps1).
+  - Kalau git clone gagal (network/auth issue), backup akan di-rollback otomatis
+    untuk recovery.
+#>
+
+[CmdletBinding()]
+param(
+    [switch]$NoBackup,
+    [string]$RepoUrl = 'https://github.com/ojokesusu/lintasAI.git',
+    [string]$Branch = 'main',
+    [switch]$DryRun,
+    [switch]$AllowUntrustedRepo,
+    [switch]$Force,
+    [switch]$AllowUnsignedTag
+)
+
+$ErrorActionPreference = 'Stop'
+
+# ---- Deprecation handling: -Force jadi alias backward-compat untuk -AllowUntrustedRepo ----
+# Sebelumnya -Force overloaded (GPG bypass + RepoUrl bypass). GPG bypass sekarang lewat
+# -AllowUnsignedTag; -Force narrowed jadi alias RepoUrl-allowlist-bypass saja, dengan warn.
+if ($Force) {
+    Write-Host ''
+    Write-Host '[DEPRECATED] -Force flag. Pakai -AllowUntrustedRepo.' -ForegroundColor Yellow
+    Write-Host '             -Force masih bekerja sebagai alias untuk RepoUrl-allowlist bypass,' -ForegroundColor Yellow
+    Write-Host '             tapi akan dihapus di versi mendatang. Ganti pemanggilan script kamu.' -ForegroundColor Yellow
+    Write-Host '             Untuk GPG bypass, pakai -AllowUnsignedTag (bukan -Force lagi).' -ForegroundColor Yellow
+    Write-Host ''
+    if (-not $AllowUntrustedRepo) { $AllowUntrustedRepo = $true }
+}
+
+# ---- Resolve paths (do this FIRST, sebelum Move-Item rename folder) ----
+$kitDir = if ($PSScriptRoot) { $PSScriptRoot } elseif ($MyInvocation.MyCommand.Path) { Split-Path -Parent $MyInvocation.MyCommand.Path } else { (Get-Location).Path }
+$kitFolderName = Split-Path -Leaf $kitDir
+$projectRoot = Split-Path -Parent $kitDir
+$timestamp = Get-Date -Format 'yyyyMMdd-HHmmss'
+$backupDir = "$kitDir.backup-$timestamp"
+
+# === UPDATE STRATEGY ENHANCEMENT (v1.0.0+) ===
+# 4 helper functions + hook integration. See section 4.5 di CLAUDE_universal_v1.md.
+
+
+# ---- Section: Get-LatestChangelogEntry ----
+# Baca .claude-kit/CHANGELOG.md, ambil entry version paling atas (versi terbaru).
+# Konvensi CHANGELOG: heading "## vX.Y.Z" atau "## [vX.Y.Z]" di awal baris.
+# Return hashtable: @{ Version = 'v1.2.0'; Body = '...isi entry...' }
+# Kalau gagal parse, return $null (caller harus handle).
+function Get-LatestChangelogEntry {
+    param(
+        [string]$ChangelogPath = ".\.claude-kit\CHANGELOG.md"
+    )
+
+    try {
+        if (-not (Test-Path $ChangelogPath)) {
+            Write-Host "[WARN] CHANGELOG.md tidak ketemu di $ChangelogPath" -ForegroundColor Yellow
+            return $null
+        }
+
+        # Baca raw biar BOM-safe; -Encoding UTF8 di PS 5.1 sudah handle BOM otomatis.
+        $lines = Get-Content -Path $ChangelogPath -Encoding UTF8 -ErrorAction Stop
+
+        $latestVersion = $null
+        $bodyLines     = New-Object System.Collections.Generic.List[string]
+        $inLatest      = $false
+
+        # Pattern fleksibel: "## v1.2.0", "## [v1.2.0]", "## v1.2.0 — 2026-06-04"
+        $versionPattern = '^##\s*\[?(v\d+\.\d+\.\d+)\]?'
+
+        foreach ($line in $lines) {
+            if ($line -match $versionPattern) {
+                if ($null -eq $latestVersion) {
+                    # Heading versi pertama yang ketemu = versi terbaru (CHANGELOG urut desc).
+                    $latestVersion = $Matches[1]
+                    $inLatest = $true
+                    continue
+                } else {
+                    # Heading versi kedua = stop, body entry pertama udah komplit.
+                    break
+                }
+            }
+
+            if ($inLatest) {
+                $bodyLines.Add($line) | Out-Null
+            }
+        }
+
+        if ($null -eq $latestVersion) {
+            Write-Host "[WARN] Tidak ada heading versi (## vX.Y.Z) di CHANGELOG" -ForegroundColor Yellow
+            return $null
+        }
+
+        $body = ($bodyLines -join "`n").Trim()
+
+        return @{
+            Version = $latestVersion
+            Body    = $body
+        }
+    }
+    catch {
+        Write-Host "[ERROR] Gagal parse CHANGELOG: $($_.Exception.Message)" -ForegroundColor Red
+        return $null
+    }
+}
+
+
+# ---- Section: Classify-UpdateTier ----
+# Klasifikasi tier dari isi CHANGELOG entry. Return string: "Tier 1" / "Tier 2" / "Tier 3" / "Tier 4".
+# Urutan cek (paling spesifik dulu): SCAN-REQUIRED -> BREAKING -> Tier 2 keywords -> Tier 1 default.
+function Classify-UpdateTier {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$EntryBody
+    )
+
+    try {
+        if ([string]::IsNullOrWhiteSpace($EntryBody)) {
+            # Entry kosong dianggap minor patch.
+            return "Tier 1"
+        }
+
+        # Cek label eksplisit lebih dulu (paling spesifik).
+        if ($EntryBody -match '\[SCAN-REQUIRED\]') {
+            return "Tier 4"
+        }
+
+        if ($EntryBody -match '\[BREAKING\]') {
+            return "Tier 3"
+        }
+
+        # Tier 2 = fitur/aturan baru. Keyword spesifik biar tidak false-positive.
+        $tier2Keywords = @(
+            'tambah section',
+            'fitur baru',
+            'aturan AI',
+            'aturan baru',
+            'panduan baru',
+            'section baru',
+            'rule baru',
+            'tambah fitur',
+            'tambah aturan',
+            'tambah panduan'
+        )
+
+        foreach ($kw in $tier2Keywords) {
+            # -match case-insensitive by default di PS.
+            if ($EntryBody -match [regex]::Escape($kw)) {
+                return "Tier 2"
+            }
+        }
+
+        # Default: Tier 1 (typo, fix kecil, perbaikan ringan).
+        return "Tier 1"
+    }
+    catch {
+        Write-Host "[WARN] Classify error, fallback Tier 1: $($_.Exception.Message)" -ForegroundColor Yellow
+        return "Tier 1"
+    }
+}
+
+
+# ---- Section: Format-UpdateSummary ----
+# Compose ringkasan ramah staff non-programmer, pakai analogi tools digital populer.
+# Return string multi-line siap di-Write-Host.
+function Format-UpdateSummary {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tier,
+        [Parameter(Mandatory = $true)]
+        [hashtable]$Entry
+    )
+
+    $version = $Entry.Version
+    $body    = $Entry.Body
+
+    # Map tier -> analogi + action staff.
+    $analogi = ""
+    $action  = ""
+
+    switch ($Tier) {
+        "Tier 1" {
+            $analogi = "Tier 1 (kayak WhatsApp minor update, 2.23.10 -> 2.23.11)"
+            $action  = "Action: udah selesai. Tinggal pakai biasa, ga ada yang berubah cara kerjanya."
+        }
+        "Tier 2" {
+            $analogi = "Tier 2 (kayak iPhone iOS 17.3 -> 17.4 minor, ada fitur baru)"
+            $action  = "Action: AI bakal otomatis pakai aturan/fitur baru sesi berikutnya. Restart chat = aman."
+        }
+        "Tier 3" {
+            $analogi = "Tier 3 BREAKING (kayak iPhone iOS 16 -> iOS 17 major, backup wajib)"
+            $action  = "Action: BACA migration notes di CHANGELOG, jalanin PS commands yang tertera. Backup udah otomatis di .bak."
+        }
+        "Tier 4" {
+            $analogi = "Tier 4 SCAN-REQUIRED (kayak Tokopedia ganti algoritma kategori, perlu re-mapping)"
+            $action  = "Action: paste ulang isi JALANKAN_KIT.md ke Claude Code. AI bakal re-scan project & re-bootstrap."
+        }
+        default {
+            $analogi = "Unknown tier — treat as Tier 1 (paling aman)"
+            $action  = "Action: pakai biasa, monitor sesi berikutnya."
+        }
+    }
+
+    # Build summary string.
+    $sb = New-Object System.Text.StringBuilder
+    [void]$sb.AppendLine("")
+    [void]$sb.AppendLine("============================================================")
+    [void]$sb.AppendLine("  Kit Update Summary — $version")
+    [void]$sb.AppendLine("============================================================")
+    [void]$sb.AppendLine("Klasifikasi: $analogi")
+    [void]$sb.AppendLine("")
+    [void]$sb.AppendLine($action)
+    [void]$sb.AppendLine("")
+    [void]$sb.AppendLine("--- CHANGELOG entry (verbatim) ---")
+    if ([string]::IsNullOrWhiteSpace($body)) {
+        [void]$sb.AppendLine("(entry kosong)")
+    } else {
+        # Trim biar tidak kebanyakan whitespace.
+        [void]$sb.AppendLine($body)
+    }
+    [void]$sb.AppendLine("============================================================")
+
+    return $sb.ToString()
+}
+
+
+# ---- Section: Invoke-BackupCleanup ----
+# Bersihin .bak files di project root:
+#   1) Hapus yang > 30 hari old.
+#   2) Per "base filename" (mis. AGENTS.md.backup-*), keep max 3 yang terbaru.
+# Aman: kalau folder gak ada / gak ada .bak, return 0 tanpa error.
+function Invoke-BackupCleanup {
+    param(
+        [string]$ProjectRoot = ".",
+        [int]$MaxAgeDays     = 30,
+        [int]$KeepLatest     = 3
+    )
+
+    try {
+        if (-not (Test-Path $ProjectRoot)) {
+            Write-Host "[WARN] Project root tidak ada: $ProjectRoot" -ForegroundColor Yellow
+            return 0
+        }
+
+        # Tangkep dua pola backup: *.bak DAN *.backup-* (sesuai existing AGENTS.md.backup-YYYYMMDD-HHMMSS).
+        $backupFiles = @()
+        $backupFiles += Get-ChildItem -Path $ProjectRoot -Filter "*.bak" -File -ErrorAction SilentlyContinue
+        $backupFiles += Get-ChildItem -Path $ProjectRoot -Filter "*.backup-*" -File -ErrorAction SilentlyContinue
+
+        if (-not $backupFiles -or $backupFiles.Count -eq 0) {
+            Write-Host "Cleanup: tidak ada backup file ditemukan." -ForegroundColor DarkGray
+            return 0
+        }
+
+        $removed   = 0
+        $cutoff    = (Get-Date).AddDays(-1 * $MaxAgeDays)
+
+        # --- Step 1: hapus yang udah > MaxAgeDays ---
+        foreach ($f in $backupFiles) {
+            if ($f.LastWriteTime -lt $cutoff) {
+                try {
+                    Remove-Item -Path $f.FullName -Force -ErrorAction Stop
+                    $removed++
+                }
+                catch {
+                    Write-Host "[WARN] Gagal hapus $($f.Name): $($_.Exception.Message)" -ForegroundColor Yellow
+                }
+            }
+        }
+
+        # --- Step 2: per base-name, keep latest N saja ---
+        # "Base name" = nama file sebelum suffix .bak / .backup-*. Contoh:
+        #   AGENTS.md.backup-20260601-160733  -> base "AGENTS.md"
+        #   docs.md.bak                       -> base "docs.md"
+        $remaining = @()
+        $remaining += Get-ChildItem -Path $ProjectRoot -Filter "*.bak" -File -ErrorAction SilentlyContinue
+        $remaining += Get-ChildItem -Path $ProjectRoot -Filter "*.backup-*" -File -ErrorAction SilentlyContinue
+
+        $groups = $remaining | Group-Object -Property {
+            $name = $_.Name
+            if ($name -match '^(.+?)\.backup-') { return $Matches[1] }
+            if ($name -match '^(.+?)\.bak$')    { return $Matches[1] }
+            return $name
+        }
+
+        foreach ($grp in $groups) {
+            if ($grp.Count -le $KeepLatest) { continue }
+
+            # Sort desc by LastWriteTime, ambil yang setelah index KeepLatest = excess (paling lama).
+            $sorted = $grp.Group | Sort-Object -Property LastWriteTime -Descending
+            $excess = $sorted | Select-Object -Skip $KeepLatest
+
+            foreach ($f in $excess) {
+                try {
+                    Remove-Item -Path $f.FullName -Force -ErrorAction Stop
+                    $removed++
+                }
+                catch {
+                    Write-Host "[WARN] Gagal hapus $($f.Name): $($_.Exception.Message)" -ForegroundColor Yellow
+                }
+            }
+        }
+
+        Write-Host "Cleanup: removed $removed old backup(s) (> $MaxAgeDays hari atau di luar latest-$KeepLatest)." -ForegroundColor DarkGray
+        return $removed
+    }
+    catch {
+        Write-Host "[ERROR] Backup cleanup gagal total: $($_.Exception.Message)" -ForegroundColor Red
+        return 0
+    }
+}
+
+# === END UPDATE STRATEGY ENHANCEMENT (functions) ===
+
+
+# ---- Validasi posisi ----
+if ($kitFolderName -ne '.claude-kit') {
+    Write-Host "PERINGATAN: Folder kit ini bernama '$kitFolderName', bukan '.claude-kit'." -ForegroundColor Yellow
+    Write-Host "          Script update-kit.ps1 dirancang untuk Pola B (.claude-kit/ di root proyek)." -ForegroundColor Yellow
+    Write-Host "          Tetap lanjut? Sebagian fitur (rename atomic) mungkin tidak presisi." -ForegroundColor Yellow
+}
+
+Write-Host ""
+Write-Host "=== Update Kit lintasAI ===" -ForegroundColor Cyan
+Write-Host "Kit folder    : $kitDir"
+Write-Host "Project root  : $projectRoot"
+Write-Host "Repo URL      : $RepoUrl"
+Write-Host "Branch        : $Branch"
+Write-Host "Backup        : $(if ($NoBackup) { 'DISABLED (-NoBackup)' } else { $backupDir })"
+if ($DryRun) {
+    Write-Host "Mode          : DRY-RUN (tidak ada perubahan file)" -ForegroundColor Yellow
+}
+Write-Host ""
+
+# ---- Pre-check: git installed ----
+try {
+    $gitVersion = & git --version 2>$null
+    Write-Host "OK    Git terdeteksi: $gitVersion" -ForegroundColor Green
+} catch {
+    Write-Host "ERROR: git tidak terinstall atau tidak di PATH." -ForegroundColor Red
+    Write-Host "       Install dari https://git-scm.com/ lalu buka PowerShell baru." -ForegroundColor Red
+    exit 1
+}
+
+# ---- Pre-check: RepoUrl allowlist (anti-supply-chain) ----
+# Cegah update dari fork/mirror tak dikenal yang bisa inject kode jahat.
+# Kalau user override $RepoUrl ke URL di luar allowlist, harus konfirm eksplisit.
+$allowedRepoUrls = @(
+    'https://github.com/ojokesusu/lintasAI.git'
+)
+if ($RepoUrl -notin $allowedRepoUrls) {
+    Write-Warning "RepoUrl '$RepoUrl' BUKAN di allowlist. Default: github.com/ojokesusu/lintasAI."
+    Write-Warning "Detail setup repo tepercaya: docs/SIGNED_RELEASE.md"
+    if (-not $AllowUntrustedRepo) {
+        $choice = try { Read-Host "Lanjut clone dari URL tidak terdaftar? (y/N)" } catch { "n" }
+        if ($choice -ne 'y') { throw "Update aborted: untrusted RepoUrl (pakai -AllowUntrustedRepo untuk bypass)" }
+        Write-Warning "User bypass allowlist (UNSAFE)"
+    } else {
+        Write-Warning "-AllowUntrustedRepo aktif: skip allowlist check (UNSAFE)"
+    }
+}
+
+# ---- Pre-check: detect current kit version (dari .install-manifest.json) ----
+$manifestPath = Join-Path $kitDir '.install-manifest.json'
+$currentVersion = $null
+$manifestPresent = $false
+if (Test-Path $manifestPath) {
+    $manifestPresent = $true
+    try {
+        $manifestRaw = Get-Content -Path $manifestPath -Raw -Encoding UTF8 -ErrorAction Stop
+        $manifestObj = $manifestRaw | ConvertFrom-Json -ErrorAction Stop
+        if ($manifestObj -and $manifestObj.metadata -and $manifestObj.metadata.kit_version) {
+            $currentVersion = [string]$manifestObj.metadata.kit_version
+        }
+    } catch {
+        Write-Host "WARN  Gagal parse .install-manifest.json: $($_.Exception.Message)" -ForegroundColor Yellow
+    }
+}
+
+$canCheckRemote = [bool]$currentVersion
+if ($currentVersion) {
+    Write-Host "OK    Versi sekarang (manifest): $currentVersion" -ForegroundColor Green
+} elseif ($manifestPresent) {
+    Write-Host "WARN  manifest ada tapi metadata.kit_version kosong — skip version check." -ForegroundColor Yellow
+    $currentVersion = 'unknown'
+} else {
+    Write-Host "INFO  .install-manifest.json tidak ada — asumsi fresh install, skip version check." -ForegroundColor Cyan
+    $currentVersion = 'unknown'
+}
+
+# ---- Pre-check: query remote latest tag via git ls-remote ----
+# Hanya dijalankan kalau ada manifest + kit_version (artinya ada baseline buat dibandingin).
+if ($canCheckRemote -and -not $DryRun) {
+    Write-Host ""
+    Write-Host "Cek versi terbaru di remote..." -ForegroundColor Cyan
+
+    $latestVersion = $null
+    $lsRemoteOk = $false
+    try {
+        $oldEA = $ErrorActionPreference
+        $ErrorActionPreference = 'Continue'
+
+        # Jangan pakai 2>&1 di native exe (PS 5.1 promote stderr ke ErrorRecord).
+        # stderr akan auto ke console; kita cuma butuh stdout.
+        $remoteRefs = & git ls-remote --tags $RepoUrl
+        $lsExit = $LASTEXITCODE
+
+        $ErrorActionPreference = $oldEA
+
+        if ($lsExit -eq 0 -and $remoteRefs) {
+            $lsRemoteOk = $true
+
+            # Parse tags: format "<sha>\trefs/tags/vX.Y.Z" (optional ^{} dereference suffix).
+            $semverRegex = 'refs/tags/(v\d+\.\d+\.\d+)(?:\^\{\})?$'
+            $tagList = New-Object System.Collections.Generic.List[string]
+            foreach ($refLine in $remoteRefs) {
+                if ($refLine -match $semverRegex) {
+                    $tagList.Add($Matches[1]) | Out-Null
+                }
+            }
+
+            if ($tagList.Count -gt 0) {
+                # Sort version-descending: strip leading 'v', cast ke [version], desc.
+                $sorted = $tagList | Sort-Object -Unique | Sort-Object -Property @{
+                    Expression = { [version]($_ -replace '^v','') }
+                    Descending = $true
+                }
+                $latestVersion = @($sorted)[0]
+            }
+        }
+    } catch {
+        $ErrorActionPreference = $oldEA
+        Write-Host "WARN  git ls-remote exception: $($_.Exception.Message)" -ForegroundColor Yellow
+    }
+
+    if (-not $lsRemoteOk) {
+        Write-Host "WARN  Gagal query remote tag (network/auth issue?)." -ForegroundColor Yellow
+        $ans = $null
+        try {
+            $ans = Read-Host "Lanjut update tanpa cek versi? [y/N]"
+        } catch {
+            # Non-interactive host -> default 'n'.
+            $ans = 'n'
+        }
+        if ([string]::IsNullOrWhiteSpace($ans)) { $ans = 'n' }
+        if ($ans -notmatch '^[Yy]') {
+            Write-Host "Dibatalkan oleh user." -ForegroundColor Yellow
+            exit 0
+        }
+        Write-Host "Lanjut update tanpa cek versi (atas konfirmasi user)..." -ForegroundColor Yellow
+    } elseif ([string]::IsNullOrWhiteSpace($latestVersion)) {
+        Write-Host "WARN  Tag remote tidak ditemukan/parse-able — fall back: lanjut update dengan warning." -ForegroundColor Yellow
+    } else {
+        # Normalize: kit_version di manifest mungkin "1.0.0" tanpa 'v', remote tag pakai 'vX.Y.Z'.
+        $currentNorm = ($currentVersion -replace '^v','').Trim()
+        $latestNorm  = ($latestVersion  -replace '^v','').Trim()
+
+        if ($currentNorm -eq $latestNorm) {
+            Write-Host "[OK] Sudah versi terbaru ($currentVersion). Tidak ada update." -ForegroundColor Green
+            exit 0
+        }
+
+        # Compare semver-aware: kalau current >= latest, treat as up-to-date juga.
+        try {
+            $cv = [version]$currentNorm
+            $lv = [version]$latestNorm
+            if ($cv -ge $lv) {
+                Write-Host "[OK] Versi lokal ($currentVersion) >= remote latest ($latestVersion). Tidak ada update." -ForegroundColor Green
+                exit 0
+            }
+        } catch {
+            # Cast gagal -> fallback ke string compare di atas; lanjut update.
+        }
+
+        Write-Host "[INFO] Update tersedia: $currentVersion -> $latestVersion" -ForegroundColor Cyan
+    }
+}
+
+# ---- Step 1: Backup existing .claude-kit/ ----
+if (-not $NoBackup) {
+    if ($DryRun) {
+        Write-Host "[DRY] Akan backup: $kitDir -> $backupDir" -ForegroundColor Yellow
+    } else {
+        Write-Host ""
+        Write-Host "Step 1: Backup .claude-kit/ lama..." -ForegroundColor Cyan
+        try {
+            Move-Item -Path $kitDir -Destination $backupDir -Force
+            Write-Host "OK    Backup: $backupDir" -ForegroundColor Green
+        } catch {
+            Write-Host "ERROR: Backup gagal: $_" -ForegroundColor Red
+            Write-Host "       Kemungkinan ada file yang di-lock (editor open, antivirus scan)." -ForegroundColor Red
+            exit 1
+        }
+    }
+} else {
+    Write-Host "Step 1: Skip backup (-NoBackup aktif)" -ForegroundColor Yellow
+    # Tanpa backup, hapus langsung (irreversible)
+    if (-not $DryRun) {
+        try {
+            Remove-Item -Path $kitDir -Recurse -Force
+            Write-Host "OK    Kit lama dihapus." -ForegroundColor Green
+        } catch {
+            Write-Host "ERROR: Gagal hapus kit lama: $_" -ForegroundColor Red
+            exit 1
+        }
+    }
+}
+
+# ---- Step 2: Clone fresh ke .claude-kit/ baru ----
+Write-Host ""
+Write-Host "Step 2: Clone fresh dari GitHub..." -ForegroundColor Cyan
+if ($DryRun) {
+    Write-Host "[DRY] git clone --depth 1 -b $Branch $RepoUrl '$kitDir'" -ForegroundColor Yellow
+} else {
+    Push-Location $projectRoot
+    # CRITICAL FIX (v1.0.0): wrap git clone di try/catch dengan ErrorActionPreference='Continue'
+    # supaya $LASTEXITCODE bisa di-cek tanpa stderr promote ke terminating error.
+    # Bug sebelumnya: $ErrorActionPreference='Stop' di scope file + 2>&1 di native exe
+    # bikin stderr 'fatal:' jadi terminating error yang bypass cek $LASTEXITCODE → rollback gak jalan.
+    $cloneOk = $false
+    $cloneErrorMsg = ''
+    try {
+        # Local ErrorActionPreference=Continue supaya native stderr tidak terminating
+        $oldErrorAction = $ErrorActionPreference
+        $ErrorActionPreference = 'Continue'
+
+        # JANGAN pakai 2>&1 di native exe (PS 5.1 promote stderr lines ke ErrorRecord).
+        # Stderr akan auto-ditampilkan ke console oleh native exe.
+        # Pakai try/catch + cek $LASTEXITCODE untuk control flow.
+        & git clone --depth 1 -b $Branch $RepoUrl '.claude-kit'
+        $cloneExitCode = $LASTEXITCODE
+
+        $ErrorActionPreference = $oldErrorAction
+
+        if ($cloneExitCode -eq 0) {
+            $cloneOk = $true
+            Write-Host "OK    Clone selesai." -ForegroundColor Green
+        } else {
+            $cloneErrorMsg = "git clone exit code: $cloneExitCode (cek pesan error di atas)"
+        }
+    } catch {
+        $cloneErrorMsg = "git clone exception: $_"
+        $ErrorActionPreference = $oldErrorAction
+    } finally {
+        Pop-Location
+    }
+
+    if (-not $cloneOk) {
+        Write-Host ""
+        Write-Host "ERROR: $cloneErrorMsg" -ForegroundColor Red
+
+        # Rollback: restore backup (CRITICAL: must run kalau clone gagal)
+        if (-not $NoBackup -and (Test-Path $backupDir)) {
+            Write-Host ""
+            Write-Host "ROLLBACK: restore backup folder..." -ForegroundColor Yellow
+            try {
+                # Hapus folder partial .claude-kit kalau ada (clone gagal kadang bikin folder kosong)
+                if (Test-Path $kitDir) {
+                    Remove-Item -Path $kitDir -Recurse -Force -ErrorAction SilentlyContinue
+                }
+                Move-Item -Path $backupDir -Destination $kitDir -Force
+                Write-Host "OK    Backup restored. Kit lama aktif lagi di $kitDir" -ForegroundColor Green
+            } catch {
+                Write-Host "GAGAL rollback: $_" -ForegroundColor Red
+                Write-Host "       MANUAL restore: Move-Item '$backupDir' '$kitDir'" -ForegroundColor Yellow
+            }
+        } else {
+            Write-Host "TIDAK ada backup untuk restore (-NoBackup aktif atau backup folder tidak ada)." -ForegroundColor Yellow
+        }
+        exit 1
+    }
+}
+
+# ---- Step 2b: Verify tag signature (GPG) sebelum hapus .git/ ----
+# BUG FIX: sebelumnya call `git verify-tag $Branch` di mana $Branch = "main".
+# verify-tag butuh TAG name, bukan branch name -> selalu fail -> fall through
+# ke prompt y/N = security theater. Sekarang resolve tag eksak dari HEAD dulu,
+# fallback ke latest tag remote, baru call verify-tag dengan nama tag betulan.
+# FAIL-CLOSED: kalau verify gagal -> throw. Bypass cuma via -AllowUnsignedTag
+# (bukan -Force; separation of concerns: -Force = allowlist, -AllowUnsignedTag = GPG).
+$signatureValid = $false
+if (-not $DryRun -and (Test-Path (Join-Path $kitDir '.git'))) {
+    Write-Host ""
+    Write-Host "Step 2b: Verify tag signature (GPG)..." -ForegroundColor Cyan
+
+    # --- Resolve actual tag NAME pointing to cloned HEAD ---
+    # `--depth 1 -b main` clone biasanya checkout commit yang juga ditag (latest release).
+    # `git describe --exact-match --tags HEAD` return tag name persis kalau HEAD == tag commit,
+    # otherwise exit non-zero. Itu signal yang kita mau (no fuzzy match).
+    $resolvedTag = $null
+    $oldEA = $ErrorActionPreference
+    $ErrorActionPreference = 'Continue'
+    try {
+        $describeOut = & git -C $kitDir describe --exact-match --tags HEAD 2>$null
+        $describeExit = $LASTEXITCODE
+        if ($describeExit -eq 0 -and $describeOut) {
+            $resolvedTag = ($describeOut | Select-Object -First 1).ToString().Trim()
+            Write-Host "  Tag di HEAD (describe --exact-match): $resolvedTag" -ForegroundColor DarkGray
+        }
+    } catch {
+        # Swallow — fallback path di bawah.
+    }
+    $ErrorActionPreference = $oldEA
+
+    # --- Fallback: latest tag dari ls-remote (kalau HEAD bukan tag commit) ---
+    if (-not $resolvedTag) {
+        Write-Host "  HEAD bukan exact tag — fallback ke latest tag via ls-remote..." -ForegroundColor DarkGray
+        $oldEA = $ErrorActionPreference
+        $ErrorActionPreference = 'Continue'
+        try {
+            $lsTags = & git ls-remote --tags $RepoUrl 2>$null
+            if ($LASTEXITCODE -eq 0 -and $lsTags) {
+                $semverRegex = 'refs/tags/(v\d+\.\d+\.\d+)(?:\^\{\})?$'
+                $fallbackTagList = New-Object System.Collections.Generic.List[string]
+                foreach ($refLine in $lsTags) {
+                    if ($refLine -match $semverRegex) {
+                        $fallbackTagList.Add($Matches[1]) | Out-Null
+                    }
+                }
+                if ($fallbackTagList.Count -gt 0) {
+                    $sortedFallback = $fallbackTagList | Sort-Object -Unique | Sort-Object -Property @{
+                        Expression = { [version]($_ -replace '^v','') }
+                        Descending = $true
+                    }
+                    $resolvedTag = @($sortedFallback)[0]
+                    Write-Host "  Latest tag remote: $resolvedTag" -ForegroundColor DarkGray
+
+                    # Pastikan tag ada di local clone object DB (--depth 1 -b main biasanya tidak fetch tags lain).
+                    # Fetch tag spesifik dulu supaya verify-tag bisa baca object-nya.
+                    & git -C $kitDir fetch --depth 1 origin "refs/tags/${resolvedTag}:refs/tags/${resolvedTag}" 2>$null | Out-Null
+                }
+            }
+        } catch {
+            # Swallow — handled di bawah kalau $resolvedTag tetap null.
+        }
+        $ErrorActionPreference = $oldEA
+    }
+
+    if (-not $resolvedTag) {
+        # Tidak ada tag sama sekali — FAIL-CLOSED kecuali user explicit bypass.
+        if ($AllowUnsignedTag) {
+            Write-Warning "Tidak ada tag GPG yang bisa di-resolve, tapi -AllowUnsignedTag aktif. Skip verify (UNSAFE)."
+        } else {
+            throw "Update aborted: tidak ada tag yang bisa di-resolve dari HEAD maupun ls-remote (release belum di-tag?). Pakai -AllowUnsignedTag untuk bypass (UNSAFE). Setup pubkey: docs/SIGNED_RELEASE.md"
+        }
+    } else {
+        # --- Verify-tag dengan tag NAME (bukan branch) ---
+        $oldEA = $ErrorActionPreference
+        $ErrorActionPreference = 'Continue'
+        $verifyOutput = & git -C $kitDir verify-tag $resolvedTag 2>&1
+        $verifyExit = $LASTEXITCODE
+        $ErrorActionPreference = $oldEA
+
+        if ($verifyExit -eq 0) {
+            Write-Host "[OK] Tag $resolvedTag GPG signature verified" -ForegroundColor Green
+            $signatureValid = $true
+        } else {
+            Write-Warning "[FAIL] Tag $resolvedTag bukan GPG-signed valid (atau pubkey owner tidak ter-import)"
+            Write-Host "Detail: $verifyOutput"
+            Write-Host "Setup pubkey owner: docs/SIGNED_RELEASE.md" -ForegroundColor Yellow
+            if ($AllowUnsignedTag) {
+                Write-Warning "Bypass via -AllowUnsignedTag aktif: lanjut tanpa verifikasi (UNSAFE)."
+                $signatureValid = $false
+            } else {
+                # FAIL-CLOSED: tidak ada prompt y/N. Kalau mau bypass harus explicit flag.
+                throw "Update aborted: GPG verify-tag $resolvedTag gagal. Pakai -AllowUnsignedTag untuk bypass (UNSAFE)."
+            }
+        }
+    }
+}
+
+# ---- Step 3: Hapus .git/ internal ----
+$gitInternal = Join-Path $kitDir '.git'
+Write-Host ""
+Write-Host "Step 3: Hapus .git/ internal supaya tidak konflik dengan git proyek..." -ForegroundColor Cyan
+if ($DryRun) {
+    Write-Host "[DRY] Remove-Item $gitInternal -Recurse -Force" -ForegroundColor Yellow
+} elseif (Test-Path $gitInternal) {
+    try {
+        Remove-Item -Path $gitInternal -Recurse -Force
+        Write-Host "OK    .git/ internal dihapus." -ForegroundColor Green
+    } catch {
+        Write-Host "WARN  Gagal hapus .git/: $_" -ForegroundColor Yellow
+        Write-Host "      Bisa nested git issue. Hapus manual: Remove-Item '$gitInternal' -Recurse -Force" -ForegroundColor Yellow
+    }
+}
+
+# ---- Step 4: Re-run setup-pola-b.ps1 ----
+$setupScript = Join-Path $kitDir 'setup-pola-b.ps1'
+Write-Host ""
+Write-Host "Step 4: Re-run setup-pola-b.ps1 (anti-overwrite untuk docs/ existing)..." -ForegroundColor Cyan
+if ($DryRun) {
+    Write-Host ("[DRY] Call: '{0}' -Force" -f $setupScript) -ForegroundColor Yellow
+} elseif (Test-Path $setupScript) {
+    try {
+        & $setupScript -Force
+    } catch {
+        Write-Host "WARN  setup-pola-b.ps1 error: $_" -ForegroundColor Yellow
+        Write-Host "      File kit sudah ter-copy, tapi setup mungkin gak komplit." -ForegroundColor Yellow
+        Write-Host "      Run manual: .\.claude-kit\setup-pola-b.ps1 -Force" -ForegroundColor Yellow
+    }
+} else {
+    Write-Host "WARN  setup-pola-b.ps1 tidak ada di kit baru — skip." -ForegroundColor Yellow
+}
+
+# ---- Step 5: Detect new version + diff CHANGELOG ----
+if (-not $DryRun) {
+    $newChangelog = Join-Path $kitDir 'CHANGELOG.md'
+    $newVersion = 'unknown'
+    if (Test-Path $newChangelog) {
+        $match = Select-String -Path $newChangelog -Pattern '## \[(\d+\.\d+\.\d+)\]' -List -ErrorAction SilentlyContinue
+        if ($match) {
+            $newVersion = $match.Matches[0].Groups[1].Value
+        }
+    }
+
+    Write-Host ""
+    Write-Host "=== Update selesai ===" -ForegroundColor Cyan
+    Write-Host "Versi lama   : v$currentVersion"
+    Write-Host "Versi baru   : v$newVersion"
+
+    if ($currentVersion -ne $newVersion -and $newVersion -ne 'unknown') {
+        Write-Host ""
+        Write-Host "Update v$currentVersion -> v$newVersion sukses!" -ForegroundColor Green
+
+        # ---- Scan CHANGELOG entry v$newVersion untuk label [BREAKING] / [SCAN-REQUIRED] ----
+        $breakingFound = $false
+        $scanRequiredFound = $false
+        if (Test-Path $newChangelog) {
+            $clContent = Get-Content $newChangelog -Raw -Encoding UTF8
+            # Ambil bagian dari "## [<newVersion>]" sampai "## [" berikutnya (atau EOF)
+            $pattern = "(?ms)## \[$([regex]::Escape($newVersion))\].*?(?=^## \[|\Z)"
+            $entryMatch = [regex]::Match($clContent, $pattern)
+            if ($entryMatch.Success) {
+                $entryText = $entryMatch.Value
+                if ($entryText -match '\[BREAKING\]') { $breakingFound = $true }
+                if ($entryText -match '\[SCAN-REQUIRED\]') { $scanRequiredFound = $true }
+            }
+        }
+
+        if ($breakingFound -or $scanRequiredFound) {
+            Write-Host ""
+            Write-Host "================================================================" -ForegroundColor Red
+            Write-Host "  PERHATIAN: VERSI INI ADA PERUBAHAN PENTING" -ForegroundColor Red
+            Write-Host "================================================================" -ForegroundColor Red
+            if ($breakingFound) {
+                Write-Host "  [BREAKING] Ada perubahan yang tidak backward-compatible." -ForegroundColor Red
+                Write-Host "             Baca CHANGELOG ENTRY v$newVersion sebelum lanjut kerja." -ForegroundColor Red
+            }
+            if ($scanRequiredFound) {
+                Write-Host "  [SCAN-REQUIRED] Wajib regenerate docs/ supaya kompatibel." -ForegroundColor Red
+                Write-Host "                  Re-paste isi .claude-kit\PROJECT_LIFECYCLE_PROMPT_v1.md (Stage B: Bootstrap Docs)" -ForegroundColor Red
+                Write-Host "                  ke Claude Code untuk regenerate docs lama." -ForegroundColor Red
+            }
+            Write-Host "================================================================" -ForegroundColor Red
+        }
+
+        Write-Host ""
+        Write-Host "Action items recommended:" -ForegroundColor Cyan
+        Write-Host "  1. Baca CHANGELOG entry [v$newVersion]:"
+        Write-Host "     $newChangelog"
+        Write-Host "  2. Verify file baru di docs/ + .github/ (kalau ada di release notes)."
+        Write-Host "  3. Update AGENTS.md di root proyek:"
+        Write-Host "     Ganti 'Versi kit di .claude-kit/: vX.Y.Z' -> v$newVersion"
+        if (-not $breakingFound -and -not $scanRequiredFound) {
+            Write-Host "  4. Tidak ada label [BREAKING]/[SCAN-REQUIRED] — docs/ kamu AMAN, gak perlu scan ulang."
+            Write-Host "  5. Kalau CHANGELOG sebut workflow change di JALANKAN_KIT.md:"
+            Write-Host "     Re-paste isi .claude-kit\JALANKAN_KIT.md ke Claude Code."
+        } else {
+            Write-Host "  4. WAJIB ikuti instruksi PERHATIAN di atas sebelum kerja lanjut."
+        }
+    } elseif ($currentVersion -eq $newVersion) {
+        Write-Host ""
+        Write-Host "Tidak ada perubahan versi (v$currentVersion). Update mungkin cuma minor patch/refinement." -ForegroundColor Cyan
+        Write-Host "Cek CHANGELOG untuk detail."
+    }
+
+    if (-not $NoBackup -and (Test-Path $backupDir)) {
+        Write-Host ""
+        Write-Host "Backup lama tersimpan di:" -ForegroundColor Cyan
+        Write-Host "  $backupDir"
+        Write-Host ""
+        Write-Host "Hapus backup kalau sudah yakin update sukses:" -ForegroundColor Cyan
+        Write-Host "  Remove-Item '$backupDir' -Recurse -Force"
+    }
+}
+
+Write-Host ""
+
+# === Tier classification + backup cleanup hooks ===
+#   - $KitPath      : path .claude-kit/ di project (default ".\.claude-kit")
+# Kalau nama beda, sesuaikan parameter pemanggilan di bawah.
+
+try {
+    Write-Host "" 
+    Write-Host "[*] Klasifikasi tier update dari CHANGELOG..." -ForegroundColor Cyan
+
+    # Resolve changelog path defensif (kalau $KitPath belum di-set, fallback default).
+    $changelogPath = ".\.claude-kit\CHANGELOG.md"
+    if ($KitPath) {
+        $candidate = Join-Path $KitPath "CHANGELOG.md"
+        if (Test-Path $candidate) { $changelogPath = $candidate }
+    }
+
+    $entry = Get-LatestChangelogEntry -ChangelogPath $changelogPath
+
+    if ($null -ne $entry) {
+        $tier = Classify-UpdateTier -EntryBody $entry.Body
+        $summary = Format-UpdateSummary -Tier $tier -Entry $entry
+
+        # Warna terminal sesuai tier (visual cue cepat buat staff).
+        $color = "Green"
+        switch ($tier) {
+            "Tier 1" { $color = "Green" }
+            "Tier 2" { $color = "Cyan" }
+            "Tier 3" { $color = "Yellow" }
+            "Tier 4" { $color = "Magenta" }
+        }
+
+        Write-Host $summary -ForegroundColor $color
+    } else {
+        Write-Host "[WARN] Skip tier classification — CHANGELOG tidak bisa di-parse." -ForegroundColor Yellow
+    }
+}
+catch {
+    # Jangan gagalkan update cuma karena classification error.
+    Write-Host "[WARN] Tier classification error (non-fatal): $($_.Exception.Message)" -ForegroundColor Yellow
+}
+
+# [B] Backup cleanup — paling akhir, sebelum exit.
+try {
+    Write-Host ""
+    Write-Host "[*] Bersih-bersih backup lama..." -ForegroundColor Cyan
+
+    $rootForCleanup = "."
+    if ($ProjectRoot) { $rootForCleanup = $ProjectRoot }
+
+    [void](Invoke-BackupCleanup -ProjectRoot $rootForCleanup -MaxAgeDays 30 -KeepLatest 3)
+}
+catch {
+    Write-Host "[WARN] Backup cleanup non-fatal error: $($_.Exception.Message)" -ForegroundColor Yellow
+}
+
+# =============================================================================
+# END ENHANCEMENT
+# =============================================================================
+# === END hooks ===
+
+Write-Host "OK update-kit.ps1 selesai." -ForegroundColor Green
+exit 0