hanoman 0.1.24 → 0.1.26

package/dist/server.js

@@ -5233,11 +5233,93 @@ var init_prd_status = __esm({
   }
 });
 
+// ../shared/src/cron-expr.ts
+function parseField(raw, lo, hi) {
+  const out3 = /* @__PURE__ */ new Set();
+  for (const part of raw.split(",")) {
+    const slash = part.indexOf("/");
+    const rangePart = slash === -1 ? part : part.slice(0, slash);
+    const stepPart = slash === -1 ? void 0 : part.slice(slash + 1);
+    let step = 1;
+    if (stepPart !== void 0) {
+      if (!/^\d{1,2}$/.test(stepPart)) return null;
+      step = Number(stepPart);
+      if (step < 1) return null;
+    }
+    let from;
+    let to;
+    if (rangePart === "*") {
+      from = lo;
+      to = hi;
+    } else if (/^\d{1,2}$/.test(rangePart)) {
+      from = Number(rangePart);
+      to = stepPart === void 0 ? from : hi;
+    } else {
+      const m = /^(\d{1,2})-(\d{1,2})$/.exec(rangePart);
+      if (!m) return null;
+      from = Number(m[1]);
+      to = Number(m[2]);
+    }
+    if (from < lo || to > hi || from > to) return null;
+    for (let v = from; v <= to; v += step) out3.add(v);
+  }
+  return out3.size ? out3 : null;
+}
+function parseCron(expr) {
+  const parts = expr.trim().split(/\s+/);
+  if (parts.length !== 5) return null;
+  const sets = [];
+  for (let i = 0; i < 5; i++) {
+    const [lo, hi] = BOUNDS[i];
+    const s2 = parseField(parts[i], lo, hi);
+    if (!s2) return null;
+    sets.push(s2);
+  }
+  return {
+    minute: sets[0],
+    hour: sets[1],
+    dom: sets[2],
+    month: sets[3],
+    dow: new Set([...sets[4]].map((n2) => n2 === 7 ? 0 : n2)),
+    domRestricted: parts[2] !== "*",
+    dowRestricted: parts[4] !== "*"
+  };
+}
+function dayMatches(spec, d) {
+  if (!spec.month.has(d.getMonth() + 1)) return false;
+  const dom = spec.dom.has(d.getDate());
+  const dow = spec.dow.has(d.getDay());
+  return spec.domRestricted && spec.dowRestricted ? dom || dow : dom && dow;
+}
+function nextRun(spec, after, limitDays = 400) {
+  const hours = [...spec.hour].sort((a, b) => a - b);
+  const minutes = [...spec.minute].sort((a, b) => a - b);
+  const t = after.getTime();
+  for (let d = 0; d <= limitDays; d++) {
+    const day = new Date(after.getFullYear(), after.getMonth(), after.getDate() + d);
+    if (!dayMatches(spec, day)) continue;
+    for (const h of hours) {
+      for (const mi of minutes) {
+        const cand = new Date(day.getFullYear(), day.getMonth(), day.getDate(), h, mi, 0, 0);
+        if (cand.getTime() > t) return cand;
+      }
+    }
+  }
+  return null;
+}
+var BOUNDS;
+var init_cron_expr = __esm({
+  "../shared/src/cron-expr.ts"() {
+    "use strict";
+    BOUNDS = [[0, 59], [0, 23], [1, 31], [1, 12], [0, 7]];
+  }
+});
+
 // ../shared/src/dto.ts
 function flowForSource(source) {
   return source === "qa" ? "qa" : source === "audit" ? "audit" : source === "goal" ? "goal" : "feature";
 }
-var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus;
+var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus, zCronExpr, zCreateCron, zPatchCron, zSchedulerCron, zSchedulerCronRun;
 var init_dto = __esm({
   "../shared/src/dto.ts"() {
     "use strict";
@@ -5248,6 +5330,7 @@ var init_dto = __esm({
     init_prd_status();
     init_enums();
     init_spec_source();
+    init_cron_expr();
     zIssueDeviceToken = external_exports.object({ name: external_exports.string().min(1) });
     zSessionResult = external_exports.object({
       id: external_exports.string(),
@@ -5724,6 +5807,53 @@ var init_dto = __esm({
       status: external_exports.string(),
       createdAt: external_exports.string()
     });
+    zCronExpr = external_exports.string().trim().refine((v) => parseCron(v) !== null, "cron expression tak sah");
+    zCreateCron = external_exports.object({
+      project: external_exports.string().min(1),
+      name: external_exports.string().trim().min(1).max(120),
+      expr: zCronExpr,
+      prompt: external_exports.string().trim().min(1).max(8e3),
+      agent: zAgent.optional(),
+      model: external_exports.string().optional(),
+      effort: external_exports.string().optional(),
+      enabled: external_exports.boolean().default(false)
+      // default aman: cron baru lahir nonaktif
+    });
+    zPatchCron = external_exports.object({
+      name: external_exports.string().trim().min(1).max(120).optional(),
+      expr: zCronExpr.optional(),
+      prompt: external_exports.string().trim().min(1).max(8e3).optional(),
+      agent: zAgent.nullable().optional(),
+      model: external_exports.string().nullable().optional(),
+      effort: external_exports.string().nullable().optional(),
+      enabled: external_exports.boolean().optional()
+    });
+    zSchedulerCron = external_exports.object({
+      id: external_exports.string(),
+      projectId: external_exports.string(),
+      name: external_exports.string(),
+      expr: external_exports.string(),
+      prompt: external_exports.string(),
+      agent: external_exports.string().nullable(),
+      model: external_exports.string().nullable(),
+      effort: external_exports.string().nullable(),
+      enabled: external_exports.boolean(),
+      nextRunAt: external_exports.string().nullable(),
+      lastRunAt: external_exports.string().nullable(),
+      createdAt: external_exports.string()
+    });
+    zSchedulerCronRun = external_exports.object({
+      id: external_exports.string(),
+      cronId: external_exports.string(),
+      projectId: external_exports.string(),
+      dueAt: external_exports.string(),
+      startedAt: external_exports.string().nullable(),
+      status: external_exports.string(),
+      sessionId: external_exports.string().nullable(),
+      note: external_exports.string().nullable(),
+      manual: external_exports.boolean(),
+      createdAt: external_exports.string()
+    });
   }
 });
 
@@ -5870,6 +6000,13 @@ var init_api = __esm({
       schedulerQueueRequeue: (id) => `${API}/scheduler/queue/${encodeURIComponent(id)}/requeue`,
       // SPEC-523 · antrean sebagai daftar berhalaman (page/limit + status), lepas dari `state`.
       schedulerQueue: `${API}/scheduler/queue`,
+      // SPEC-646 · ADR-0112 · cronjob per project. Di bawah prefix `scheduler` seperti tetangganya,
+      // TAPI capability-nya bukan turunan otomatis: `capabilityForRoute` memberi `crons` cabang
+      // COOKIE_ONLY sendiri — sebuah cron adalah `POST /terminal/sessions` yang ditunda.
+      schedulerCrons: `${API}/scheduler/crons`,
+      schedulerCron: (id) => `${API}/scheduler/crons/${encodeURIComponent(id)}`,
+      schedulerCronRunNow: (id) => `${API}/scheduler/crons/${encodeURIComponent(id)}/run`,
+      schedulerCronRuns: (id) => `${API}/scheduler/crons/${encodeURIComponent(id)}/runs`,
       // SPEC-409 · ADR-0091 · hanoman-lead. Semua HTTP (polling) — tak ada kanal WS baru (AC-26).
       leadConfig: `${API}/lead/config`,
       leadStatus: `${API}/lead/status`,
@@ -7442,6 +7579,7 @@ var init_src = __esm({
     init_mcp();
     init_auto_merge();
     init_changelog();
+    init_cron_expr();
   }
 });
 
@@ -7815,6 +7953,20 @@ Stack: ${project.stack || "\u2014"}`,
 ${REVERSE_STANDARD}`
   ].filter(Boolean).join("\n\n");
 }
+function cronPrompt(project, cron) {
+  return [
+    `hanoman cron "${cron.name}". Pemeriksaan rutin terjadwal di project ini \u2014 bukan sesi backlog: tak ada fase, tak ada plan, tak ada stage yang harus digerakkan.`,
+    `Bila kamu menemukan masalah yang layak dikerjakan, FILEKAN sebagai backlog item lewat \`POST /api/specs\` (lihat docs/agent-integration.md untuk bentuk payload & auth), jangan hanya melaporkannya ke terminal \u2014 temuan yang cuma tertulis di log sesi akan hilang. Satu masalah = satu backlog item, judul spesifik.`,
+    `Jangan mengerjakan sendiri perbaikan besar dalam sesi ini kecuali instruksi di bawah memintanya.`,
+    CODE_STYLE_CLAUSE,
+    `Worktree ini detached HEAD \u2014 memang disengaja. Bila kamu memang perlu meninggalkan perubahan berkas, commit dan katakan itu di ringkasan akhir; jangan gagal diam-diam.`,
+    `Project ${project.id} \xB7 ${project.name}
+Deskripsi: ${project.desc || "\u2014"}
+Stack: ${project.stack || "\u2014"}`,
+    `=== INSTRUKSI OPERATOR ===
+${cron.prompt}`
+  ].join("\n\n");
+}
 var PIPELINES, AUTONOMY_CLAUSE, AUTONOMY_CLAUSE_FULL, autonomyClause, phaseInstruction, PHASE_SKILLS, skillInstruction, auditDecisionInstruction, ESCALATION_CONTRACT, auditOnlyInstruction, auditContinuationInstruction, writesCode, scopeClause, codeStyleClause, resumeClause, RESUMED_WORKTREE_NOTE, REVERSE_PHASE_GUIDE, SCAFFOLD_PHASE_GUIDE;
 var init_prompt = __esm({
   "../runner/src/prompt.ts"() {
@@ -19607,6 +19759,14 @@ async function recordLeadDecision(decisionId, title, projectId, specId, sessionI
   }).catch(() => {
   });
 }
+async function recordCronRun(cronId, cronName, projectId, dueAt, status, note) {
+  const verb = status === "launched" ? "berjalan" : status === "skipped" ? "dilewati" : "gagal";
+  const title = `Cron "${cronName}" ${verb}${note ? ` \u2014 ${note}` : ""}`;
+  await prisma.notification.create({
+    data: { type: "cron", key: `cron:${cronId}:${dueAt.toISOString()}`, title, projectId }
+  }).catch(() => {
+  });
+}
 var awaiting = /* @__PURE__ */ new Set();
 async function scanDecisions(read = liveDecisions) {
   const next = /* @__PURE__ */ new Set();
@@ -26094,10 +26254,64 @@ async function pruneOldTickets(now = Date.now()) {
   }
 }
 
+// src/services/ticket-intake.ts
+init_db();
+var TICKET_UPLOAD = {
+  MAX_FILES: 3,
+  MAX_BYTES: 5 * 1024 * 1024,
+  OK_MIME: /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/webp"])
+};
+async function parseTicketUpload(req) {
+  const fields = {};
+  const files = [];
+  try {
+    for await (const part of req.parts()) {
+      if (part.type === "file") {
+        const buf = await part.toBuffer();
+        if (part.file?.truncated || !TICKET_UPLOAD.OK_MIME.has(part.mimetype) || files.length >= TICKET_UPLOAD.MAX_FILES) continue;
+        files.push({ buf, mime: part.mimetype, name: String(part.filename ?? "gambar") });
+      } else {
+        fields[part.fieldname] = String(part.value ?? "");
+      }
+    }
+  } catch {
+    return null;
+  }
+  return { fields, files };
+}
+async function intakeTicket(input) {
+  const { ticket, key } = await createTicket({
+    projectId: input.projectId,
+    category: input.category,
+    title: input.title,
+    detail: input.detail,
+    reporterEmail: input.reporterEmail
+  });
+  await notifySynced("ticket", ticket.id);
+  for (const f of input.files) {
+    const { storageKey, size } = await saveUpload(f.buf, f.mime);
+    const att = await prisma.ticketAttachment.create({
+      data: {
+        ticketId: ticket.id,
+        projectId: input.projectId,
+        filename: f.name.slice(0, 200),
+        mimeType: f.mime,
+        size,
+        storageKey
+      }
+    });
+    await notifySynced("ticketAttachment", att.id);
+  }
+  await recordNewTicket(ticket.id, input.projectId, input.projectName, input.category, input.title);
+  void pruneOldTickets();
+  return { ticket, key };
+}
+
 // src/services/help-ratelimit.ts
 init_config2();
 var ipBuckets = /* @__PURE__ */ new Map();
 var projBuckets = /* @__PURE__ */ new Map();
+var acctBuckets = /* @__PURE__ */ new Map();
 function take(map, k, cap, now) {
   const b = map.get(k) ?? { tokens: cap, ts: now };
   b.tokens = Math.min(cap, b.tokens + (now - b.ts) * cap / 6e4);
@@ -26115,13 +26329,15 @@ function helpRateOk(projectId, ip, now = Date.now()) {
   const projCap = effectiveInt("HANOMAN_HELP_RATE_PER_MIN_PROJECT") ?? 20;
   return take(ipBuckets, ip, ipCap, now) && take(projBuckets, projectId, projCap, now);
 }
+function portalTicketRateOk(userId, projectId, now = Date.now()) {
+  const acctCap = effectiveInt("HANOMAN_PORTAL_TICKET_RATE_PER_MIN") ?? 5;
+  const projCap = effectiveInt("HANOMAN_HELP_RATE_PER_MIN_PROJECT") ?? 20;
+  return take(acctBuckets, userId, acctCap, now) && take(projBuckets, projectId, projCap, now);
+}
 
 // src/routes/help.ts
 var CATEGORIES = ["bug", "fitur", "pertanyaan", "lainnya"];
 var HONEYPOT_FIELD = "hc_trap";
-var OK_MIME = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/webp"]);
-var MAX_FILES2 = 3;
-var MAX_BYTES = 5 * 1024 * 1024;
 var zField = external_exports.object({
   category: zTicketCategory,
   title: external_exports.string().min(1).max(200),
@@ -26141,21 +26357,9 @@ async function help_default(app2) {
     if (!p || !p.helpEnabled) return reply.code(404).send({ error: "not found" });
     if (!helpRateOk(slug, req.ip)) return reply.code(429).send({ error: "terlalu banyak permintaan" });
     if (!req.isMultipart?.()) return reply.code(400).send({ error: "butuh multipart/form-data" });
-    const fields = {};
-    const files = [];
-    try {
-      for await (const part of req.parts()) {
-        if (part.type === "file") {
-          const buf = await part.toBuffer();
-          if (part.file?.truncated || !OK_MIME.has(part.mimetype) || files.length >= MAX_FILES2) continue;
-          files.push({ buf, mime: part.mimetype, name: String(part.filename ?? "gambar") });
-        } else {
-          fields[part.fieldname] = String(part.value ?? "");
-        }
-      }
-    } catch {
-      return reply.code(400).send({ error: "unggahan tak valid" });
-    }
+    const upload = await parseTicketUpload(req);
+    if (!upload) return reply.code(400).send({ error: "unggahan tak valid" });
+    const { fields, files } = upload;
     if (fields[HONEYPOT_FIELD]) {
       console.warn(`help: honeypot terpicu \xB7 project=${slug} ip=${req.ip}`);
       return reply.code(200).send({ ok: true });
@@ -26167,23 +26371,15 @@ async function help_default(app2) {
       email: fields.email
     });
     if (!parsed.success) return reply.code(400).send({ error: "field wajib tak lengkap / tak valid" });
-    const { ticket, key } = await createTicket({
+    const { ticket, key } = await intakeTicket({
       projectId: slug,
+      projectName: p.name,
       category: parsed.data.category,
       title: parsed.data.title,
       detail: parsed.data.detail,
-      reporterEmail: parsed.data.email
+      reporterEmail: parsed.data.email,
+      files
     });
-    await notifySynced("ticket", ticket.id);
-    for (const f of files) {
-      const { storageKey, size } = await saveUpload(f.buf, f.mime);
-      const att = await prisma.ticketAttachment.create({
-        data: { ticketId: ticket.id, projectId: slug, filename: f.name.slice(0, 200), mimeType: f.mime, size, storageKey }
-      });
-      await notifySynced("ticketAttachment", att.id);
-    }
-    await recordNewTicket(ticket.id, slug, p.name, parsed.data.category, parsed.data.title);
-    void pruneOldTickets();
     const statusPath = `/help/${encodeURIComponent(slug)}/status/${encodeURIComponent(key)}`;
     return reply.code(201).send({ number: ticket.number, key, statusPath });
   });
@@ -26504,6 +26700,104 @@ async function isQueued(id) {
   return row?.status === "queued";
 }
 
+// src/services/scheduler/cron.ts
+init_db();
+init_src();
+var GRACE_MS = 30 * 6e4;
+function computeNextRun(expr, after) {
+  const spec = parseCron(expr);
+  return spec ? nextRun(spec, after) : null;
+}
+function latestDue(expr, from, now) {
+  let cursor = from;
+  let due = null;
+  let missed = -1;
+  for (let i = 0; i < 2e4; i++) {
+    const nxt = computeNextRun(expr, cursor);
+    if (!nxt || nxt.getTime() > now) break;
+    due = nxt;
+    missed++;
+    cursor = nxt;
+  }
+  return due ? { due, missed: Math.max(0, missed) } : null;
+}
+async function sweepCronDue(now) {
+  const crons = await prisma.schedulerCron.findMany({
+    where: { enabled: true, nextRunAt: { lte: new Date(now) } }
+  });
+  for (const cron of crons) await materialize(cron, now);
+  await expireStale(now);
+}
+async function materialize(cron, now) {
+  const from = new Date(cron.nextRunAt.getTime() - 1);
+  const hit = latestDue(cron.expr, from, now);
+  await prisma.schedulerCron.update({
+    where: { id: cron.id },
+    data: { nextRunAt: computeNextRun(cron.expr, new Date(now)) }
+  });
+  if (!hit) return;
+  const late2 = now - hit.due.getTime() > GRACE_MS;
+  const missedNote = hit.missed > 0 ? `terlewat ${hit.missed} jatuh tempo \u2014 scheduler tak berjalan` : "terlewat \u2014 scheduler tak berjalan saat jatuh tempo";
+  try {
+    await prisma.schedulerCronRun.create({
+      data: {
+        cronId: cron.id,
+        projectId: cron.projectId,
+        dueAt: hit.due,
+        ...late2 ? { status: "skipped", note: missedNote } : {}
+      }
+    });
+  } catch {
+    return;
+  }
+  if (late2) await recordCronRun(cron.id, cron.name, cron.projectId, hit.due, "skipped", missedNote);
+}
+async function expireStale(now) {
+  const stale = await prisma.schedulerCronRun.findMany({
+    where: { status: "queued", dueAt: { lt: new Date(now - GRACE_MS) } }
+  });
+  for (const run2 of stale) {
+    const note = run2.note ?? "tak terluncurkan sampai batas keterlambatan";
+    await prisma.schedulerCronRun.update({ where: { id: run2.id }, data: { status: "skipped", note } });
+    const cron = await prisma.schedulerCron.findUnique({ where: { id: run2.cronId } });
+    await recordCronRun(run2.cronId, cron?.name ?? run2.cronId, run2.projectId, run2.dueAt, "skipped", note);
+  }
+}
+function queuedCronRuns() {
+  return prisma.schedulerCronRun.findMany({ where: { status: "queued" }, orderBy: { dueAt: "asc" } });
+}
+async function markCronLaunched(id, sessionId2) {
+  const { count } = await prisma.schedulerCronRun.updateMany({
+    where: { id, status: "queued" },
+    data: { status: "launched", sessionId: sessionId2, startedAt: /* @__PURE__ */ new Date(), note: null }
+  });
+  return count > 0;
+}
+async function markCronFailed(id, note) {
+  await prisma.schedulerCronRun.updateMany({ where: { id, status: "queued" }, data: { status: "failed", note } });
+}
+async function markCronSkipped(id, note) {
+  await prisma.schedulerCronRun.updateMany({ where: { id, status: "queued" }, data: { status: "skipped", note } });
+}
+async function noteCronRun(id, note) {
+  const row = await prisma.schedulerCronRun.findUnique({ where: { id }, select: { note: true } });
+  if (row?.note === note) return;
+  await prisma.schedulerCronRun.updateMany({ where: { id, status: "queued" }, data: { note } });
+}
+async function listCronRunsPage(cronId, f = {}) {
+  const where = { cronId };
+  const total = await prisma.schedulerCronRun.count({ where });
+  const pageSize = f.limit ? Math.max(1, Math.floor(+f.limit) || 1) : total || 1;
+  const page = f.page ? Math.max(1, Math.floor(+f.page) || 1) : 1;
+  const items = await prisma.schedulerCronRun.findMany({
+    where,
+    orderBy: { dueAt: "desc" },
+    skip: (page - 1) * pageSize,
+    take: pageSize
+  });
+  return { items, total, page, pageSize };
+}
+
 // src/services/scheduler/registry.ts
 var sources = /* @__PURE__ */ new Map();
 var lastRun = /* @__PURE__ */ new Map();
@@ -26598,6 +26892,127 @@ async function scheduler_default(app2) {
       pageSize: r.pageSize
     };
   });
+  const cronView = (c) => ({
+    id: c.id,
+    projectId: c.projectId,
+    name: c.name,
+    expr: c.expr,
+    prompt: c.prompt,
+    agent: c.agent,
+    model: c.model,
+    effort: c.effort,
+    enabled: c.enabled,
+    nextRunAt: c.nextRunAt ? c.nextRunAt.toISOString() : null,
+    lastRunAt: c.lastRunAt ? c.lastRunAt.toISOString() : null,
+    createdAt: c.createdAt.toISOString()
+  });
+  const runView = (r) => ({
+    id: r.id,
+    cronId: r.cronId,
+    projectId: r.projectId,
+    dueAt: r.dueAt.toISOString(),
+    startedAt: r.startedAt ? r.startedAt.toISOString() : null,
+    status: r.status,
+    sessionId: r.sessionId,
+    note: r.note,
+    manual: r.manual,
+    createdAt: r.createdAt.toISOString()
+  });
+  app2.get("/scheduler/crons", async (req) => {
+    const { projectId, page, limit } = req.query;
+    const where = projectId ? { projectId } : void 0;
+    const total = await prisma.schedulerCron.count({ where });
+    const pageSize = limit ? Math.max(1, Math.floor(+limit) || 1) : total || 1;
+    const p = page ? Math.max(1, Math.floor(+page) || 1) : 1;
+    const items = await prisma.schedulerCron.findMany({
+      where,
+      orderBy: { createdAt: "desc" },
+      skip: (p - 1) * pageSize,
+      take: pageSize
+    });
+    return { items: items.map(cronView), total, page: p, pageSize };
+  });
+  app2.post("/scheduler/crons", async (req, reply) => {
+    const parsed = zCreateCron.safeParse(req.body);
+    if (!parsed.success) return reply.code(400).send({ error: parsed.error.flatten() });
+    const d = parsed.data;
+    if (!await prisma.project.findUnique({ where: { id: d.project } }))
+      return reply.code(404).send({ error: "project not found" });
+    const created = await prisma.schedulerCron.create({
+      data: {
+        projectId: d.project,
+        name: d.name,
+        expr: d.expr,
+        prompt: d.prompt,
+        agent: d.agent ?? null,
+        model: d.model ?? null,
+        effort: d.effort ?? null,
+        enabled: d.enabled,
+        // Dihitung sekarang walau cron-nya nonaktif: kolomnya juga yang memberi makan preview
+        // "jalan berikutnya" di daftar, dan menghitungnya baru saat diaktifkan membuat baris yang
+        // baru dibuat tampak tak berjadwal.
+        nextRunAt: computeNextRun(d.expr, /* @__PURE__ */ new Date())
+      }
+    });
+    return reply.code(201).send(cronView(created));
+  });
+  app2.patch("/scheduler/crons/:id", async (req, reply) => {
+    const { id } = req.params;
+    const parsed = zPatchCron.safeParse(req.body ?? {});
+    if (!parsed.success) return reply.code(400).send({ error: parsed.error.flatten() });
+    const cur = await prisma.schedulerCron.findUnique({ where: { id } });
+    if (!cur) return reply.code(404).send({ error: "cron tak ada" });
+    const d = parsed.data;
+    const recompute = d.expr !== void 0 || cur.nextRunAt === null;
+    const updated = await prisma.schedulerCron.update({
+      where: { id },
+      data: {
+        ...d.name !== void 0 ? { name: d.name } : {},
+        ...d.expr !== void 0 ? { expr: d.expr } : {},
+        ...d.prompt !== void 0 ? { prompt: d.prompt } : {},
+        ...d.agent !== void 0 ? { agent: d.agent } : {},
+        ...d.model !== void 0 ? { model: d.model } : {},
+        ...d.effort !== void 0 ? { effort: d.effort } : {},
+        ...d.enabled !== void 0 ? { enabled: d.enabled } : {},
+        ...recompute ? { nextRunAt: computeNextRun(d.expr ?? cur.expr, /* @__PURE__ */ new Date()) } : {}
+      }
+    });
+    return cronView(updated);
+  });
+  app2.delete("/scheduler/crons/:id", async (req, reply) => {
+    const { id } = req.params;
+    if (!await prisma.schedulerCron.findUnique({ where: { id } }))
+      return reply.code(404).send({ error: "cron tak ada" });
+    await prisma.schedulerCronRun.deleteMany({ where: { cronId: id } });
+    await prisma.schedulerCron.delete({ where: { id } });
+    return reply.code(204).send();
+  });
+  app2.post("/scheduler/crons/:id/run", async (req, reply) => {
+    const { id } = req.params;
+    const cron = await prisma.schedulerCron.findUnique({ where: { id } });
+    if (!cron) return reply.code(404).send({ error: "cron tak ada" });
+    const cfg = await getScheduler();
+    if (!cfg.enabled) return reply.code(409).send({ error: "scheduler sedang berhenti \u2014 aktifkan dulu di panel Kendali" });
+    if (cfg.paused) return reply.code(409).send({ error: "scheduler sedang dijeda \u2014 lanjutkan dulu di panel Kendali" });
+    const pending = await prisma.schedulerCronRun.findFirst({ where: { cronId: id, status: "queued" } });
+    if (pending) return reply.code(409).send({ error: "masih ada run yang menunggu dijalankan", runId: pending.id });
+    try {
+      const run2 = await prisma.schedulerCronRun.create({
+        data: { cronId: id, projectId: cron.projectId, dueAt: /* @__PURE__ */ new Date(), manual: true }
+      });
+      return reply.code(201).send(runView(run2));
+    } catch {
+      return reply.code(409).send({ error: "run untuk jatuh tempo ini sudah ada" });
+    }
+  });
+  app2.get("/scheduler/crons/:id/runs", async (req, reply) => {
+    const { id } = req.params;
+    if (!await prisma.schedulerCron.findUnique({ where: { id } }))
+      return reply.code(404).send({ error: "cron tak ada" });
+    const { page, limit } = req.query;
+    const r = await listCronRunsPage(id, { page, limit });
+    return { items: r.items.map(runView), total: r.total, page: r.page, pageSize: r.pageSize };
+  });
 }
 
 // src/routes/lead.ts
@@ -30038,18 +30453,20 @@ async function webhooks_default(app2) {
 }
 
 // src/routes/portal.ts
+init_zod();
 init_src();
 init_db();
 
 // src/services/client-access.ts
 init_db();
 var segments = (path) => path.replace(/^\/api\/?/, "").replace(/\/+$/, "").split("/").filter(Boolean);
+var isPortalTicketSubmit = (method, seg) => method === "POST" && seg.length === 4 && seg[1] === "projects" && seg[3] === "tickets";
 function clientRouteAllowed(method, path) {
   const seg = segments(path);
   if (seg.includes("..")) return false;
   const top = seg[0] ?? "";
   const read = method === "GET" || method === "HEAD";
-  if (top === "portal") return read;
+  if (top === "portal") return read || isPortalTicketSubmit(method, seg);
   if (top === "help") return true;
   if (top === "auth") {
     const sub = seg[1] ?? "";
@@ -30071,6 +30488,11 @@ async function hasProjectAccess(userId, projectId) {
 
 // src/routes/portal.ts
 var NOT_FOUND = { error: "not found" };
+var zPortalTicket = external_exports.object({
+  category: zTicketCategory,
+  title: external_exports.string().min(1).max(200),
+  detail: external_exports.string().min(1).max(1e4)
+});
 async function specStages(ids) {
   const wanted = [...new Set(ids.filter((v) => !!v))];
   if (!wanted.length) return /* @__PURE__ */ new Map();
@@ -30080,8 +30502,9 @@ async function specStages(ids) {
 async function portal_default(app2) {
   app2.get("/portal/projects", async (req) => {
     const ids = await clientProjectIds(req.user.id);
+    const { page, limit } = req.query;
     const rows = await prisma.project.findMany({ where: { id: { in: ids } }, orderBy: { name: "asc" } });
-    return { items: rows.map(toPortalProject) };
+    return paginate(rows.map(toPortalProject), page, limit);
   });
   app2.get("/portal/projects/:id/backlog", async (req, reply) => {
     const { id } = req.params;
@@ -30113,6 +30536,31 @@ async function portal_default(app2) {
     const stages = await specStages([t.specId]);
     return toPortalTicketDetail(t, stages.get(t.specId ?? "") ?? null);
   });
+  app2.post("/portal/projects/:id/tickets", async (req, reply) => {
+    const { id } = req.params;
+    const p = await prisma.project.findUnique({ where: { id } });
+    if (!p || !await hasProjectAccess(req.user.id, id)) return reply.code(404).send(NOT_FOUND);
+    if (!portalTicketRateOk(req.user.id, id)) return reply.code(429).send({ error: "terlalu banyak permintaan" });
+    if (!req.isMultipart?.()) return reply.code(400).send({ error: "butuh multipart/form-data" });
+    const upload = await parseTicketUpload(req);
+    if (!upload) return reply.code(400).send({ error: "unggahan tak valid" });
+    const parsed = zPortalTicket.safeParse({
+      category: upload.fields.category,
+      title: upload.fields.title,
+      detail: upload.fields.detail
+    });
+    if (!parsed.success) return reply.code(400).send({ error: "field wajib tak lengkap / tak valid" });
+    const { ticket } = await intakeTicket({
+      projectId: id,
+      projectName: p.name,
+      category: parsed.data.category,
+      title: parsed.data.title,
+      detail: parsed.data.detail,
+      reporterEmail: req.user.email,
+      files: upload.files
+    });
+    return reply.code(201).send(toPortalTicket(ticket, null));
+  });
 }
 
 // src/routes/client-accounts.ts
@@ -30416,7 +30864,10 @@ function capabilityForRoute(method, path) {
   if (top === "auth" || top === "agent-tokens" || top === "device-tokens" || top === "sync" || top === "portal" || top === "client-accounts") return "COOKIE_ONLY";
   if (top === "limits" || top === "update" || top === "events" || top === "fs" || top === "health")
     return read ? "GLOBAL_READ" : "COOKIE_ONLY";
-  if (top === "scheduler") return rw("settings");
+  if (top === "scheduler") {
+    if (seg[1] === "crons") return "COOKIE_ONLY";
+    return rw("settings");
+  }
   if (top === "lead") return rw("lead");
   if (top === "custom-agents") return rw("agents");
   if (top === "telegram") {
@@ -30723,14 +31174,69 @@ init_db();
 init_src();
 
 // src/services/scheduler/governor.ts
+init_db();
 var ALREADY_DONE_NOTE = "spec sudah selesai \u2014 tak diluncurkan";
 var canceledRaceNote = (sessionId2) => `dibatalkan saat sesi ${sessionId2} sudah terlanjur lahir \u2014 sesi dibiarkan hidup, tutup dari Terminal bila tak diperlukan`;
+var CAP_FULL_NOTE = "cap penuh \u2014 tak ada slot sesi";
+var cronLiveNote = (sessionId2) => `sesi cron sebelumnya masih berjalan (${sessionId2})`;
+var CRON_GONE_NOTE = "cron sudah dihapus atau dinonaktifkan";
+var CRON_OPTOUT_NOTE = "project belum di-opt-in scheduler";
+async function drainCronRuns(slots, deps) {
+  for (const run2 of await queuedCronRuns()) {
+    const cron = await prisma.schedulerCron.findUnique({ where: { id: run2.cronId } });
+    const close = async (status, note) => {
+      if (status === "skipped") await markCronSkipped(run2.id, note);
+      else await markCronFailed(run2.id, note);
+      await recordCronRun(run2.cronId, cron?.name ?? run2.cronId, run2.projectId, run2.dueAt, status, note);
+    };
+    if (!cron || !cron.enabled) {
+      await close("skipped", CRON_GONE_NOTE);
+      continue;
+    }
+    const project = await prisma.project.findUnique({
+      where: { id: cron.projectId },
+      select: { schedulerOptIn: true }
+    });
+    if (!project?.schedulerOptIn) {
+      await close("skipped", CRON_OPTOUT_NOTE);
+      continue;
+    }
+    const live = deps.liveCron(cron.id);
+    if (live) {
+      await close("skipped", cronLiveNote(live));
+      continue;
+    }
+    if (slots <= 0) {
+      await noteCronRun(run2.id, CAP_FULL_NOTE);
+      continue;
+    }
+    try {
+      const sessionId2 = await deps.launchCron({
+        id: cron.id,
+        projectId: cron.projectId,
+        name: cron.name,
+        prompt: cron.prompt,
+        agent: cron.agent,
+        model: cron.model,
+        effort: cron.effort
+      });
+      if (await markCronLaunched(run2.id, sessionId2))
+        await recordCronRun(cron.id, cron.name, cron.projectId, run2.dueAt, "launched", null);
+      await prisma.schedulerCron.update({ where: { id: cron.id }, data: { lastRunAt: /* @__PURE__ */ new Date() } });
+      slots--;
+    } catch (e) {
+      await close("failed", e.message);
+    }
+  }
+  return slots;
+}
 var draining = false;
 async function drain(cfg, deps) {
   if (draining) return;
   draining = true;
   try {
     let slots = cfg.maxConcurrent - deps.liveCount();
+    slots = await deps.drainCrons(slots);
     if (slots <= 0) return;
     for (const item of await queued2()) {
       if (slots <= 0) break;
@@ -30762,6 +31268,44 @@ async function drain(cfg, deps) {
   }
 }
 
+// src/services/scheduler/cron-session.ts
+init_db();
+init_src2();
+init_settings2();
+init_codex_trust();
+init_pty();
+var cronSessionId = (cronId) => `cron-${cronId.toLowerCase().replace(/[^a-z0-9_-]/g, "_")}`;
+function liveCronSession(cronId) {
+  const s2 = getSession(cronSessionId(cronId));
+  return s2 && !s2.exited ? s2.id : null;
+}
+async function startCronSession(cron) {
+  const repoDir = await resolveRepoDir(cron.projectId);
+  if (!repoDir) throw new Error(`project "${cron.projectId}" belum di-bind ke checkout lokal`);
+  const project = await prisma.project.findUnique({ where: { id: cron.projectId } });
+  if (!project) throw new Error(`project "${cron.projectId}" tak ada`);
+  const { agent, model, effort } = await terminalAgentDefaults({
+    agent: cron.agent ?? void 0,
+    model: cron.model ?? void 0,
+    effort: cron.effort ?? void 0
+  });
+  if (agent === "codex") ensureCodexTrust(repoDir);
+  const id = cronSessionId(cron.id);
+  const wt = `${repoDir}/.worktrees/${id}`;
+  if (!realGit.worktreeAlive(wt)) realGit.addWorktree(repoDir, wt, "HEAD");
+  const s2 = createSession(cron.projectId, wt, {
+    id,
+    agent,
+    model,
+    effort,
+    prompt: cronPrompt(
+      { id: project.id, name: project.name, desc: project.desc, stack: project.stack },
+      { name: cron.name, prompt: cron.prompt }
+    )
+  });
+  return { id: s2.id };
+}
+
 // src/services/scheduler/reconcile.ts
 init_db();
 init_src2();
@@ -30854,6 +31398,11 @@ async function tick3(now, deps, end2 = prodEnd) {
     await end2.scanDecisions();
   } catch {
   }
+  try {
+    await sweepCronDue(now);
+  } catch (e) {
+    console.error("scheduler cron sweep:", e);
+  }
   if (cfg.paused) return;
   try {
     await drain(cfg, deps);
@@ -30886,7 +31435,12 @@ var prodDeps = {
     if (!spec) throw new Error(`spec ${item.specId} tak ada`);
     const r = await startSpecSession(spec, { flow: flowForSource(spec.source), autonomy });
     return r.id;
-  }
+  },
+  // SPEC-646 · ADR-0112 · cron memakai anggaran slot yang sama dengan antrean spec.
+  drainCrons: (slots) => drainCronRuns(slots, {
+    liveCron: liveCronSession,
+    launchCron: async (cron) => (await startCronSession(cron)).id
+  })
 };
 var TICK_MS2 = 1e4;
 var timer4;