hanoman 0.1.3 → 0.1.5

package/dist/server.js

@@ -4151,7 +4151,7 @@ var init_enums = __esm({
     "use strict";
     init_zod();
     zStage = external_exports.enum(["brainstorming", "objective", "spec-ready", "planned", "executing", "done"]);
-    zSpecSource = external_exports.enum(["brief", "qa", "audit", "cross-audit", "help"]);
+    zSpecSource = external_exports.enum(["brief", "qa", "audit", "cross-audit", "help", "goal"]);
     zDocStatus = external_exports.enum(["ok", "drift", "broken"]);
     zPriority = external_exports.enum(["tinggi", "sedang", "rendah"]);
     zProjectKind = external_exports.enum(["from-scratch", "existing"]);
@@ -4184,7 +4184,7 @@ function cmpVersion(a, b) {
   }
   return 0;
 }
-var zProject, zBriefPayload, zQaPayload, zSpec, NOTIFY_SOUNDS, E_5_6, E_LUNA, E_BASE, CODEX_MODELS, RETIRED_CODEX_MODELS, zCodex, CODEX_DEFAULTS, zSourceCommon, zScheduler, SCHEDULER_DEFAULTS, zGoal, GOAL_DEFAULTS, zConflict, CONFLICT_DEFAULTS, zSetting, zNotification, zDocFile, zDeviceTokenView;
+var zProject, zBriefPayload, zQaPayload, zGoalPayload, zSpec, NOTIFY_SOUNDS, E_5_6, E_LUNA, E_BASE, CODEX_MODELS, RETIRED_CODEX_MODELS, zCodex, CODEX_DEFAULTS, zSourceCommon, zScheduler, SCHEDULER_DEFAULTS, zGoal, GOAL_DEFAULTS, zConflict, CONFLICT_DEFAULTS, zSetting, zNotification, zDocFile, zDeviceTokenView;
 var init_entities = __esm({
   "../shared/src/entities.ts"() {
     "use strict";
@@ -4223,6 +4223,12 @@ var init_entities = __esm({
       // SPEC-244 · qa dinaikkan dari audit → sinyal skip fase Audit (ADR-0059)
       fromErrorGroup: external_exports.string().optional()
     });
+    zGoalPayload = external_exports.object({
+      goal: external_exports.string(),
+      done: external_exports.string(),
+      constraints: external_exports.string(),
+      priority: zPriority
+    });
     zSpec = external_exports.object({
       id: external_exports.string(),
       projectId: external_exports.string(),
@@ -4232,7 +4238,8 @@ var init_entities = __esm({
       priority: zPriority,
       author: external_exports.string(),
       objective: external_exports.string(),
-      payload: external_exports.union([zBriefPayload, zQaPayload]).nullable(),
+      payload: external_exports.union([zBriefPayload, zQaPayload, zGoalPayload]).nullable(),
+      // SPEC-407 · +goal
       branchFrom: external_exports.string().nullable(),
       // SPEC-143 · null = default project (main)
       baseSha: external_exports.string().nullable()
@@ -4446,9 +4453,9 @@ var init_agent = __esm({
 
 // ../shared/src/dto.ts
 function flowForSource(source) {
-  return source === "qa" ? "qa" : source === "audit" ? "audit" : source === "cross-audit" ? "cross-audit" : "feature";
+  return source === "qa" ? "qa" : source === "audit" ? "audit" : source === "cross-audit" ? "cross-audit" : source === "goal" ? "goal" : "feature";
 }
-var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zCreateLink, zUpdateProject, zCreateSpec, zPatchSpec, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerState, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, zLogin, zSignup, zChangePassword, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, zStackFrame, zSymbolicatedFrame, zSourceMapUpload, zIngestPayload, zErrorGroupView, zErrorEventView, zErrorGroupDetail, zIngestKeyView, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus;
+var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zCreateLink, zUpdateProject, zCreateSpec, zPatchSpec, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerState, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, zLogin, zSignup, zChangePassword, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zStackFrame, zSymbolicatedFrame, zSourceMapUpload, zIngestPayload, zErrorGroupView, zErrorEventView, zErrorGroupDetail, zIngestKeyView, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus;
 var init_dto = __esm({
   "../shared/src/dto.ts"() {
     "use strict";
@@ -4517,11 +4524,12 @@ var init_dto = __esm({
       source: zSpecSource,
       title: external_exports.string().min(1),
       priority: zPriority,
-      payload: external_exports.union([zBriefPayload, zQaPayload]),
+      payload: external_exports.union([zBriefPayload, zQaPayload, zGoalPayload]),
       branchFrom: external_exports.string().min(1).optional()
     }).superRefine((o, ctx) => {
-      const isQa = "severity" in o.payload;
-      if (o.source === "qa" !== isQa)
+      const shape = "severity" in o.payload ? "qa" : "goal" in o.payload ? "goal" : "brief";
+      const want = o.source === "qa" ? "qa" : o.source === "goal" ? "goal" : "brief";
+      if (shape !== want)
         ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["payload"], message: "bentuk payload tak cocok dengan source" });
     });
     zPatchSpec = external_exports.object({
@@ -4531,7 +4539,8 @@ var init_dto = __esm({
       // SPEC-186 · edit konten selagi item belum dimulai. Ditolak server bila sudah mulai.
       title: external_exports.string().min(1).optional(),
       priority: zPriority.optional(),
-      payload: external_exports.union([zBriefPayload, zQaPayload]).optional()
+      payload: external_exports.union([zBriefPayload, zQaPayload, zGoalPayload]).optional()
+      // SPEC-407 · +goal
     });
     zIntegrate = external_exports.object({
       op: external_exports.enum(["merge", "rebase"]),
@@ -4596,7 +4605,7 @@ var init_dto = __esm({
       queue: external_exports.array(zSchedulerQueueItem),
       sessions: external_exports.array(zSchedulerSessionView)
     });
-    zFlow = external_exports.enum(["feature", "qa", "scaffold", "reverse", "prd", "audit", "breakdown", "cross-audit"]);
+    zFlow = external_exports.enum(["feature", "qa", "scaffold", "reverse", "prd", "audit", "breakdown", "cross-audit", "goal"]);
     zPrdBrief = external_exports.object({
       title: external_exports.string().min(1),
       context: external_exports.string(),
@@ -4742,6 +4751,8 @@ var init_dto = __esm({
     });
     zAttest = external_exports.object({ note: external_exports.string().max(500).optional() });
     zRemediate = external_exports.object({ items: external_exports.array(external_exports.string()).min(1).max(64) });
+    UPDATE_RESTART_EXIT = 75;
+    zUpdateApplyBody = external_exports.object({ confirm: external_exports.boolean().optional() });
     zStackFrame = external_exports.object({
       function: external_exports.string().max(500).optional(),
       filename: external_exports.string().max(2e3).optional(),
@@ -5520,6 +5531,22 @@ var init_verify_scope = __esm({
   }
 });
 
+// ../runner/src/goal-spec.ts
+function readGoalPayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return null;
+  const p = payload;
+  const goal = str(p.goal);
+  if (!goal) return null;
+  return { goal, done: str(p.done), constraints: str(p.constraints) };
+}
+var str;
+var init_goal_spec = __esm({
+  "../runner/src/goal-spec.ts"() {
+    "use strict";
+    str = (v) => typeof v === "string" ? v.trim() : "";
+  }
+});
+
 // ../runner/src/prompt.ts
 function startPrompt(flow, spec, branchTo, autonomy, verifyScope) {
   const detail = spec.payload ? `
@@ -5560,7 +5587,7 @@ Detail: ${JSON.stringify(spec.payload)}` : "";
   const auditDecided = resume.recorded.some((line) => line.startsWith("Audit "));
   return [
     `hanoman ${flow} \u2014 MELANJUTKAN sesi backlog yang sudah berjalan. Ikuti internal/docs sebagai Source of Truth; perbarui docs yang tersentuh dan link-nya di index, dalam commit yang sama.`,
-    resumeClause(resume, branchTo),
+    resumeClause(resume, branchTo, PIPELINES[flow].includes("Plan")),
     phaseInstruction(PIPELINES[flow]),
     auditDecided ? "" : auditDecisionInstruction(flow),
     autonomyClause(autonomy),
@@ -5572,6 +5599,27 @@ Judul: ${spec.title}
 Objective: ${spec.objective}${detail}`
   ].filter(Boolean).join("\n\n");
 }
+function startGoalPrompt(spec, branchTo, opts = {}) {
+  const g = readGoalPayload(spec.payload);
+  const detail = [
+    `Goal: ${g?.goal ?? spec.objective}`,
+    g?.done ? `Selesai bila: ${g.done}` : "",
+    g?.constraints ? `Batasan: ${g.constraints}` : ""
+  ].filter(Boolean).join("\n");
+  return [
+    "hanoman goal \u2014 sesi ini mengejar SATU goal sampai tercapai. TIDAK ada fase Brainstorm, Objective, Spec, maupun Plan: jangan menulis design doc, jangan menulis plan berkotak, jangan memecah pekerjaan ini jadi backlog baru. Langsung kerjakan goal-nya. Tetap ikuti internal/docs sebagai Source of Truth; perbarui docs yang tersentuh dan link-nya di index, dalam commit yang sama.",
+    opts.resume ? resumeClause(opts.resume, branchTo, false) : "",
+    detail,
+    phaseInstruction(PIPELINES.goal),
+    "Fase Verifikasi bukan formalitas: jalankan perintah yang membuktikan goal-nya tercapai (test/typecheck/benchmark/perintah yang relevan) dan baca outputnya. Klaim tanpa output bukan bukti.",
+    autonomyClause(opts.autonomy),
+    scopeClause("goal", opts.verifyScope),
+    skillInstruction(PIPELINES.goal),
+    `Setelah fase terakhir: commit, lalu \`git push origin HEAD:refs/heads/${branchTo}\`. Worktree ini detached HEAD \u2014 itu memang disengaja.`,
+    `Backlog item ${spec.id} \xB7 sumber ${spec.source} \xB7 prioritas ${spec.priority}
+Judul: ${spec.title}`
+  ].filter(Boolean).join("\n\n");
+}
 function startProjectPrompt(flow, project, branchTo) {
   return [
     `hanoman ${flow}. Susun Source of Truth repo ini dari kodenya di internal/docs/**, mengikuti STANDAR DOCS di bagian bawah prompt ini.`,
@@ -5676,12 +5724,13 @@ Judul: ${spec.title}
 Objective: ${spec.objective}${detail}`
   ].filter(Boolean).join("\n\n");
 }
-var PIPELINES, AUTONOMY_CLAUSE, AUTONOMY_CLAUSE_FULL, autonomyClause, phaseInstruction, PHASE_SKILLS, skillInstruction, auditDecisionInstruction, ESCALATION_CONTRACT, auditOnlyInstruction, auditContinuationInstruction, scopeClause, resumeClause, RESUMED_WORKTREE_NOTE, REVERSE_PHASE_GUIDE, SCAFFOLD_PHASE_GUIDE, projectLine, crossAuditLogGuide, CROSS_AUDIT_FOCUS;
+var PIPELINES, AUTONOMY_CLAUSE, AUTONOMY_CLAUSE_FULL, autonomyClause, phaseInstruction, PHASE_SKILLS, skillInstruction, auditDecisionInstruction, ESCALATION_CONTRACT, auditOnlyInstruction, auditContinuationInstruction, writesCode, scopeClause, resumeClause, RESUMED_WORKTREE_NOTE, REVERSE_PHASE_GUIDE, SCAFFOLD_PHASE_GUIDE, projectLine, crossAuditLogGuide, CROSS_AUDIT_FOCUS;
 var init_prompt = __esm({
   "../runner/src/prompt.ts"() {
     "use strict";
     init_reverse_standard();
     init_verify_scope();
+    init_goal_spec();
     PIPELINES = {
       feature: ["Brainstorm", "Objective", "Spec", "Plan", "Execute"],
       qa: ["Audit", "Spec", "Plan", "Execute"],
@@ -5692,7 +5741,11 @@ var init_prompt = __esm({
       breakdown: ["Analisis", "Breakdown"],
       // SPEC-337 · ADR-0075 · audit lintas project: fase & stage-map identik audit-only, scope-nya
       // yang berbeda (project utama + tetangga ProjectLink).
-      "cross-audit": ["Audit", "Laporan"]
+      "cross-audit": ["Audit", "Laporan"],
+      // SPEC-407 · ADR-0089 · backlog goal: tak ada fase perencanaan sama sekali. `Goal` = kerjakan,
+      // `Verifikasi` = buktikan. Kedua nama unik lintas PIPELINES — syarat peta REACHED di server,
+      // yang berkunci nama fase saja.
+      goal: ["Goal", "Verifikasi"]
     };
     AUTONOMY_CLAUSE = 'Jalankan seluruh pipeline sampai tuntas tanpa berhenti di batas antar-fase. Checkpoint "review"/"approval"/"need review" milik skill superpowers BUKAN titik berhenti di sini \u2014 lanjut saja ke fase berikutnya. Berhenti HANYA saat butuh keputusan manusia sejati (percabangan yang mengubah bentuk kerja: data model, kontrak API, scope); saat itu tanyakan di terminal ini dan tunggu jawabannya. Selain itu, terus lanjut.';
     AUTONOMY_CLAUSE_FULL = "Kamu berjalan TANPA pengawas \u2014 tak ada manusia yang menonton terminal ini untuk menjawab. Putuskan sendiri di SETIAP percabangan (termasuk yang mengubah bentuk kerja: data model, kontrak API, scope) berdasarkan Source of Truth dan penilaian terbaikmu; JANGAN berhenti bertanya. Tembus seluruh pipeline sampai stage `done`, lalu commit & push. Jangan menunggu review/persetujuan siapa pun \u2014 catat asumsi & keputusan penting di pesan commit agar bisa di-review pasca-fakta. Merge ke branch utama tetap dilakukan manusia, bukan kamu.";
@@ -5712,7 +5765,10 @@ Execute BELUM selesai selama plan (\`docs/superpowers/plans/**\`) masih punya ta
         "superpowers:executing-plans",
         "superpowers:test-driven-development",
         "superpowers:verification-before-completion"
-      ]
+      ],
+      // SPEC-407 · fase `Goal` sengaja TANPA skill: seluruh inti flow ini adalah membebaskan sesi
+      // dari proses kaku. Yang tetap dijaga cuma pintu keluarnya.
+      Verifikasi: ["superpowers:verification-before-completion"]
     };
     skillInstruction = (phases) => {
       const lines2 = phases.filter((p) => PHASE_SKILLS[p]).map((p) => `- ${p}: ${PHASE_SKILLS[p].join(", ")}`);
@@ -5752,17 +5808,19 @@ ${lines2.join("\n")}` : "";
         return `Backlog brief ini LANJUTAN dari audit ${fromAudit}. Worktree ini lahir dari branch audit itu, jadi dokumen audit sudah ada di ${doc}. BACA dokumen itu lebih dulu dan pakai sebagai bahan fase Brainstorm & Objective \u2014 temuannya sudah terbukti, jangan menginvestigasi ulang dari nol. Semua fase tetap dijalankan: dokumen audit memuat TEMUAN, bukan bentuk solusi, jadi perancangan fitur tetap pekerjaanmu.`;
       return `Backlog qa ini LANJUTAN dari audit ${fromAudit}. Worktree ini lahir dari branch audit itu, jadi dokumen audit sudah ada di ${doc}. JANGAN mengulang investigasi fase Audit dari nol \u2014 baca dokumen audit itu sebagai temuan, tandai fase Audit dilewati (\`echo "Audit skipped" >> "$HANOMAN_PHASE_FILE"\`), lalu ambil keputusan pasca-Audit: perbaikan jelas & kecil \u2192 langsung Execute (tandai \`Spec skipped\` dan \`Plan skipped\` bila sesuai); selain itu Spec \u2192 Plan \u2192 Execute penuh.`;
     };
-    scopeClause = (flow, scope) => scope && PIPELINES[flow].includes("Execute") ? verifyScopeClause(scope) : "";
-    resumeClause = (r, branchTo) => {
+    writesCode = (flow) => PIPELINES[flow].includes("Execute") || PIPELINES[flow].includes("Goal");
+    scopeClause = (flow, scope) => scope && writesCode(flow) ? verifyScopeClause(scope) : "";
+    resumeClause = (r, branchTo, hasPlan = true) => {
       const fase = r.recorded.length ? `Fase yang SUDAH tercatat di $HANOMAN_PHASE_FILE: ${r.recorded.join(" \xB7 ")}. JANGAN mengulang fase itu dan JANGAN menulis ulang barisnya.` : "Belum ada fase yang tercatat di $HANOMAN_PHASE_FILE \u2014 worktree ini sendiri yang jadi alasan melanjutkan.";
-      const lanjut = r.next ? `Lanjutkan dari fase: ${r.next}.` : "Semua fase sudah tercatat. Periksa apakah plan di `docs/superpowers/plans/**` masih menyisakan task `- [ ]` dan selesaikan sisanya; bila sudah bersih, tinggal commit & push.";
+      const lanjut = r.next ? `Lanjutkan dari fase: ${r.next}.` : hasPlan ? "Semua fase sudah tercatat. Periksa apakah plan di `docs/superpowers/plans/**` masih menyisakan task `- [ ]` dan selesaikan sisanya; bila sudah bersih, tinggal commit & push." : "Semua fase sudah tercatat. Buktikan sekali lagi goal-nya benar-benar tercapai, lalu commit & push.";
       const worktree = r.worktreeKept ? "Worktree ini adalah worktree sesi sebelumnya apa adanya \u2014 termasuk perubahan yang belum di-commit." : `Worktree ini DIBANGUN ULANG dari tip branch sesi \`${branchTo}\`: commit sesi sebelumnya ada, tetapi perubahan yang belum sempat di-commit TIDAK ada.`;
+      const baca = hasPlan ? "Sebelum menulis apa pun: baca `git log --oneline` dan `git status`, lalu plan di `docs/superpowers/plans/**` untuk backlog item ini (`- [x]` sudah selesai, `- [ ]` belum). Jangan menulis ulang yang sudah ada." : "Sebelum menulis apa pun: baca `git log --oneline` dan `git status` untuk melihat apa yang sudah dikerjakan. Jangan menulis ulang yang sudah ada.";
       return [
         "Sesi ini MELANJUTKAN pekerjaan sesi sebelumnya untuk backlog item yang sama \u2014 bukan memulai dari nol.",
         fase,
         lanjut,
         worktree,
-        "Sebelum menulis apa pun: baca `git log --oneline` dan `git status`, lalu plan di `docs/superpowers/plans/**` untuk backlog item ini (`- [x]` sudah selesai, `- [ ]` belum). Jangan menulis ulang yang sudah ada."
+        baca
       ].join(" ");
     };
     RESUMED_WORKTREE_NOTE = "Catatan: worktree ini BUKAN kosong \u2014 ia berisi pekerjaan sesi sebelumnya untuk tugas yang sama (sesi itu berhenti sebelum selesai). Baca `git log --oneline` dan `git status` lebih dulu, lalu lanjutkan dari sana alih-alih menulis ulang semuanya dari awal.";
@@ -5930,7 +5988,21 @@ var init_settings = __esm({
 });
 
 // ../runner/src/goal.ts
-function defaultGoalCondition({ flow, specId, branchTo }) {
+function goalFlowCondition(specId, branchTo, spec) {
+  const g = readGoalPayload(spec?.payload);
+  const goal = g?.goal || (spec?.objective ?? "").trim() || "(goal tak tercatat di backlog item)";
+  const bukti = g?.done || goal;
+  return [
+    `Sesi goal hanoman ${specId}. GOAL: ${goal}`,
+    "Sesi ini hanya boleh berhenti bila transkrip TERBARU memuat bukti langsung semua hal berikut:",
+    `1. goal tercapai \u2014 ${bukti};`,
+    `2. output \`cat "$HANOMAN_PHASE_FILE"\` yang memuat satu baris untuk SETIAP fase ${PIPELINES.goal.join(" \u2192 ")}, masing-masing berakhiran \`done\` atau \`skipped\`;`,
+    `3. output \`git push origin HEAD:refs/heads/${branchTo}\` yang SUKSES sesudah commit terakhir.`,
+    "Bila salah satu bukti tak ada di transkrip terbaru, kondisi BELUM terpenuhi: jalankan perintah verifikasinya, tuntaskan yang masih kurang, lalu lanjutkan \u2014 jangan berhenti."
+  ].join("\n");
+}
+function defaultGoalCondition({ flow, specId, branchTo, spec }) {
+  if (flow === "goal") return goalFlowCondition(specId, branchTo, spec);
   const phases = PIPELINES[flow];
   const planGate = phases.includes("Plan") && phases.includes("Execute");
   const clauses = [
@@ -5964,6 +6036,7 @@ var init_goal = __esm({
   "../runner/src/goal.ts"() {
     "use strict";
     init_prompt();
+    init_goal_spec();
     GOAL_MAX = 4e3;
     goalOneLine = (cond) => cond.replace(/\s+/g, " ").trim();
     GOAL_CHUNK = 500;
@@ -6128,6 +6201,7 @@ var init_src2 = __esm({
     init_git();
     init_settings();
     init_goal();
+    init_goal_spec();
     init_codex_settings();
     init_agent_cli();
     init_verify_scope();
@@ -6199,7 +6273,8 @@ function readPhases(file, flow) {
 function stageFor(phases) {
   let best = -1;
   for (const p of phases) {
-    if (p.name === "Execute" && p.state === "active") best = Math.max(best, STAGES.indexOf("executing"));
+    if ((p.name === "Execute" || p.name === "Goal") && p.state === "active")
+      best = Math.max(best, STAGES.indexOf("executing"));
     if (p.state !== "done" && p.state !== "skipped") continue;
     const s = REACHED[p.name];
     if (s) best = Math.max(best, STAGES.indexOf(s));
@@ -6244,7 +6319,11 @@ var init_session_phases = __esm({
       Spec: "spec-ready",
       Plan: "planned",
       Laporan: "done",
-      Execute: "done"
+      Execute: "done",
+      // SPEC-407 · ADR-0089 · flow goal (Goal → Verifikasi): fase kerja mencapai `executing`, fase
+      // verifikasi yang mencapai `done`. Kedua nama unik lintas PIPELINES — peta ini berkunci nama.
+      Goal: "executing",
+      Verifikasi: "done"
     };
   }
 });
@@ -12269,7 +12348,7 @@ var require_parseParams = __commonJS({
     var STATE_VALUE = 1;
     var STATE_CHARSET = 2;
     var STATE_LANG = 3;
-    function parseParams(str) {
+    function parseParams(str2) {
       const res = [];
       let state = STATE_KEY;
       let charset = "";
@@ -12277,9 +12356,9 @@ var require_parseParams = __commonJS({
       let escaping = false;
       let p = 0;
       let tmp = "";
-      const len = str.length;
+      const len = str2.length;
       for (var i = 0; i < len; ++i) {
-        const char = str[i];
+        const char = str2[i];
         if (char === "\\" && inquote) {
           if (escaping) {
             escaping = false;
@@ -12292,7 +12371,7 @@ var require_parseParams = __commonJS({
             if (inquote) {
               inquote = false;
               state = STATE_KEY;
-              while (i + 1 < len && str[i + 1] !== ";") {
+              while (i + 1 < len && str2[i + 1] !== ";") {
                 ++i;
               }
             } else {
@@ -12811,29 +12890,29 @@ var require_Decoder = __commonJS({
     function Decoder() {
       this.buffer = void 0;
     }
-    Decoder.prototype.write = function(str) {
-      str = str.replace(RE_PLUS, " ");
+    Decoder.prototype.write = function(str2) {
+      str2 = str2.replace(RE_PLUS, " ");
       let res = "";
       let i = 0;
       let p = 0;
-      const len = str.length;
+      const len = str2.length;
       for (; i < len; ++i) {
         if (this.buffer !== void 0) {
-          if (!HEX[str.charCodeAt(i)]) {
+          if (!HEX[str2.charCodeAt(i)]) {
             res += "%" + this.buffer;
             this.buffer = void 0;
             --i;
           } else {
-            this.buffer += str[i];
+            this.buffer += str2[i];
             ++p;
             if (this.buffer.length === 2) {
               res += String.fromCharCode(parseInt(this.buffer, 16));
               this.buffer = void 0;
             }
           }
-        } else if (str[i] === "%") {
+        } else if (str2[i] === "%") {
           if (i > p) {
-            res += str.substring(p, i);
+            res += str2.substring(p, i);
             p = i;
           }
           this.buffer = "";
@@ -12841,7 +12920,7 @@ var require_Decoder = __commonJS({
         }
       }
       if (p < len && this.buffer === void 0) {
-        res += str.substring(p);
+        res += str2.substring(p);
       }
       return res;
     };
@@ -13505,9 +13584,9 @@ var require_generateId = __commonJS({
     }
     module.exports.generateId = function generateIdFn() {
       let num = 0;
-      let str = seed();
+      let str2 = seed();
       return function generateId() {
-        return num === 255 ? (str = seed()) + HEX[num = 0] : str + HEX[++num];
+        return num === 255 ? (str2 = seed()) + HEX[num = 0] : str2 + HEX[++num];
       };
     }();
   }
@@ -15450,10 +15529,10 @@ function cleanUrl(href) {
 }
 var noopTest = { exec: () => null };
 function splitCells(tableRow, count) {
-  const row = tableRow.replace(/\|/g, (match, offset, str) => {
+  const row = tableRow.replace(/\|/g, (match, offset, str2) => {
     let escaped = false;
     let curr = offset;
-    while (--curr >= 0 && str[curr] === "\\")
+    while (--curr >= 0 && str2[curr] === "\\")
       escaped = !escaped;
     if (escaped) {
       return "|";
@@ -15481,14 +15560,14 @@ function splitCells(tableRow, count) {
   }
   return cells;
 }
-function rtrim(str, c, invert) {
-  const l = str.length;
+function rtrim(str2, c, invert) {
+  const l = str2.length;
   if (l === 0) {
     return "";
   }
   let suffLen = 0;
   while (suffLen < l) {
-    const currChar = str.charAt(l - suffLen - 1);
+    const currChar = str2.charAt(l - suffLen - 1);
     if (currChar === c && !invert) {
       suffLen++;
     } else if (currChar !== c && invert) {
@@ -15497,19 +15576,19 @@ function rtrim(str, c, invert) {
       break;
     }
   }
-  return str.slice(0, l - suffLen);
+  return str2.slice(0, l - suffLen);
 }
-function findClosingBracket(str, b) {
-  if (str.indexOf(b[1]) === -1) {
+function findClosingBracket(str2, b) {
+  if (str2.indexOf(b[1]) === -1) {
     return -1;
   }
   let level = 0;
-  for (let i = 0; i < str.length; i++) {
-    if (str[i] === "\\") {
+  for (let i = 0; i < str2.length; i++) {
+    if (str2[i] === "\\") {
       i++;
-    } else if (str[i] === b[0]) {
+    } else if (str2[i] === b[0]) {
       level++;
-    } else if (str[i] === b[1]) {
+    } else if (str2[i] === b[1]) {
       level--;
       if (level < 0) {
         return i;
@@ -17839,6 +17918,13 @@ async function liveSpecs(filter = {}) {
 // src/routes/specs.ts
 var branchUnknown = async (repoDir, branch) => !(await branchFromCandidates(repoDir)).includes(branch);
 function deriveSpecFields(source, payload, manualPriority) {
+  if (source === "goal") {
+    const pick = (v) => typeof v === "string" ? v.trim() : "";
+    return {
+      priority: manualPriority,
+      objective: pick(payload?.goal) || pick(payload?.done) || "\u2014 goal belum diisi."
+    };
+  }
   const isQa = source === "qa";
   const priority = isQa && payload && "severity" in payload ? payload.severity === "minor" ? "sedang" : "tinggi" : manualPriority;
   const objective = isQa && payload && "actual" in payload ? payload.actual || payload.steps || "\u2014 audit untuk menelusuri akar masalah." : payload && "outcome" in payload ? payload.outcome || payload.context || "\u2014 brainstorm untuk memperjelas objective." : "";
@@ -17878,7 +17964,7 @@ async function specs_default(app2) {
             source: b.source,
             stage: "brainstorming",
             priority,
-            author: isQa ? `QA \xB7 ${author}` : b.source === "audit" ? `Audit \xB7 ${author}` : b.source === "cross-audit" ? `Audit lintas \xB7 ${author}` : author,
+            author: isQa ? `QA \xB7 ${author}` : b.source === "audit" ? `Audit \xB7 ${author}` : b.source === "cross-audit" ? `Audit lintas \xB7 ${author}` : b.source === "goal" ? `Goal \xB7 ${author}` : author,
             objective,
             payload: b.payload,
             branchFrom: b.branchFrom ?? null
@@ -19299,6 +19385,14 @@ function resumeState(repoDir, worktree, branchTo, headSha) {
   const base = realGit.revParse(repoDir, `origin/${branchTo}`) ?? realGit.revParse(repoDir, branchTo) ?? (headSha ? realGit.revParse(repoDir, headSha) : null);
   return base ? { worktreeKept: false, base } : null;
 }
+function buildResumeCtx(repoDir, id, flow, worktreeKept) {
+  const phases = readPhases(phaseFilePath(repoDir, id), flow);
+  return {
+    recorded: phases.filter((p) => p.state === "done" || p.state === "skipped").map((p) => `${p.name} ${p.state}`),
+    next: phases.find((p) => p.state === "active")?.name,
+    worktreeKept
+  };
+}
 async function startSpecSession(spec, opts) {
   const repoDir = await resolveRepoDir(spec.projectId);
   if (!repoDir) throw new LaunchError(`project "${spec.projectId}" belum di-bind ke checkout lokal`, "needs-bind");
@@ -19315,11 +19409,14 @@ async function startSpecSession(spec, opts) {
   const worktree = `${repoDir}/.worktrees/${id}`;
   const branchTo = `hanoman/${id}`;
   const resume = !isContinue && spec.baseSha ? resumeState(repoDir, worktree, branchTo, spec.headSha) : null;
-  const goal = opts.goal ?? setting.goal.enabled ? resolveGoalCondition(
-    { flow: opts.flow, specId: spec.id, branchTo },
-    opts.goalCondition,
-    setting.goal.condition
-  ) : void 0;
+  const isGoalFlow = opts.flow === "goal";
+  const goalArgs = {
+    flow: opts.flow,
+    specId: spec.id,
+    branchTo,
+    spec: { payload: spec.payload ?? void 0, objective: spec.objective }
+  };
+  const goal = isGoalFlow || (opts.goal ?? setting.goal.enabled) ? resolveGoalCondition(goalArgs, opts.goalCondition, isGoalFlow ? null : setting.goal.condition) : void 0;
   const verifyScope = opts.verifyScope ?? setting.verifyScope;
   if (agent === "codex") ensureCodexTrust(repoDir);
   let baseSha;
@@ -19342,17 +19439,18 @@ async function startSpecSession(spec, opts) {
     objective: spec.objective,
     payload: spec.payload ?? void 0
   };
+  const resumeCtx = resume ? buildResumeCtx(repoDir, id, opts.flow, resume.worktreeKept) : void 0;
   let prompt;
-  if (isContinue) {
+  if (isGoalFlow) {
+    prompt = startGoalPrompt(brief, branchTo, {
+      autonomy: opts.autonomy,
+      verifyScope,
+      resume: resumeCtx
+    });
+  } else if (isContinue) {
     prompt = continuePrompt(opts.flow, brief, branchTo, opts.autonomy, verifyScope);
-  } else if (resume) {
-    const phases = readPhases(phaseFilePath(repoDir, id), opts.flow);
-    const ctx = {
-      recorded: phases.filter((p) => p.state === "done" || p.state === "skipped").map((p) => `${p.name} ${p.state}`),
-      next: phases.find((p) => p.state === "active")?.name,
-      worktreeKept: resume.worktreeKept
-    };
-    prompt = resumePrompt(opts.flow, brief, branchTo, ctx, opts.autonomy, verifyScope);
+  } else if (resumeCtx) {
+    prompt = resumePrompt(opts.flow, brief, branchTo, resumeCtx, opts.autonomy, verifyScope);
   } else {
     prompt = startPrompt(opts.flow, brief, branchTo, opts.autonomy, verifyScope);
   }
@@ -20681,6 +20779,9 @@ async function codex(app2) {
   app2.get("/codex/version", async () => codexVersionInfo());
 }
 
+// src/routes/update.ts
+init_src();
+
 // src/services/update.ts
 init_src();
 init_config2();
@@ -20695,7 +20796,11 @@ function composeUpdate(x) {
     latestVersion: x.latestVersion,
     registry: { status: x.registryStatus, checkedAt: x.checkedAt },
     updateAvailable: available,
-    command: available ? UPDATE_COMMAND : ""
+    command: available ? UPDATE_COMMAND : "",
+    // Diwariskan apa adanya. Ia fakta tentang cara proses ini dilahirkan, bukan kesimpulan
+    // tentang ada-tidaknya update — menurunkannya dari `available` akan menyembunyikan
+    // instalasi tak-tersupervisi tepat saat tombolnya paling ingin ditekan.
+    canApply: x.canApply
   };
 }
 var RESULT_TTL_MS = 15e3;
@@ -20716,6 +20821,15 @@ function runningVersion() {
   }
   return "0.0.0";
 }
+function supervised() {
+  const v = process.env.HANOMAN_SUPERVISOR;
+  return v === "1" || v === "true";
+}
+var exiter = null;
+function requestRestartForUpdate() {
+  const delay = effectiveInt("HANOMAN_UPDATE_RESTART_DELAY_MS") ?? 250;
+  setTimeout(() => (exiter ?? ((c) => process.exit(c)))(UPDATE_RESTART_EXIT), delay);
+}
 async function maybeFetch() {
   if (!effectiveBool("HANOMAN_UPDATE_FETCH")) return;
   if (lastFetchAt && Date.now() - lastFetchAt < FETCH_TTL_MS) return;
@@ -20748,15 +20862,30 @@ async function getUpdateStatus() {
     currentVersion: runningVersion(),
     latestVersion: lastLatest,
     registryStatus: lastStatus,
-    checkedAt: lastFetchAt ? new Date(lastFetchAt).toISOString() : null
+    checkedAt: lastFetchAt ? new Date(lastFetchAt).toISOString() : null,
+    canApply: supervised()
   });
   cached = { at: Date.now(), value };
   return value;
 }
 
 // src/routes/update.ts
+init_pty();
 async function update(app2) {
   app2.get("/update", async () => getUpdateStatus());
+  app2.post("/update/apply", async (req, reply) => {
+    const parsed = zUpdateApplyBody.safeParse(req.body ?? {});
+    if (!parsed.success) return reply.code(400).send({ error: "bad-body" });
+    const u = await getUpdateStatus();
+    if (!u.canApply) return reply.code(409).send({ error: "unsupervised" });
+    if (!u.updateAvailable) return reply.code(409).send({ error: "up-to-date", current: u.currentVersion });
+    const liveSessions = listSessions().filter((s) => !s.exited).length;
+    const from = u.currentVersion;
+    const to = u.latestVersion;
+    if (!parsed.data.confirm) return reply.code(409).send({ error: "confirm-required", liveSessions, from, to });
+    requestRestartForUpdate();
+    return reply.code(202).send({ accepted: true, from, to, liveSessions });
+  });
 }
 
 // src/services/events.ts
@@ -23197,7 +23326,8 @@ function capabilityForRoute(method, path) {
   const seg = path.replace(/^\/api\/?/, "").replace(/\/+$/, "").split("/").filter(Boolean);
   const top = seg[0] ?? "";
   if (top === "auth" || top === "agent-tokens" || top === "device-tokens" || top === "sync") return "COOKIE_ONLY";
-  if (top === "limits" || top === "update" || top === "events" || top === "fs" || top === "health") return "GLOBAL_READ";
+  if (top === "limits" || top === "update" || top === "events" || top === "fs" || top === "health")
+    return read ? "GLOBAL_READ" : "COOKIE_ONLY";
   if (top === "scheduler") return rw("settings");
   if (top === "settings" || top === "config") return rw("settings");
   if (top === "specs") return rw("backlog");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hanoman",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Orchestrator + dashboard workflow docs-driven untuk sesi Claude Code / Codex",
   "type": "module",
   "repository": {
@@ -11,7 +11,8 @@
     "hanoman": "bin/hanoman.mjs"
   },
   "scripts": {
-    "postinstall": "prisma generate --schema prisma/schema.prisma || true"
+    "postinstall": "prisma generate --schema prisma/schema.prisma || true",
+    "prepublishOnly": "node dist/cli.js __verify"
   },
   "engines": {
     "node": ">=20"
@@ -25,17 +26,15 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@fastify/cookie": "^9.4.0",
+    "fastify": "^4.28.0",
     "@fastify/static": "^7.0.0",
     "@fastify/websocket": "^10.0.1",
-    "@prisma/client": "^6.19.3",
-    "fastify": "^4.28.0",
+    "@fastify/cookie": "^9.4.0",
+    "@prisma/client": "^6.19.0",
     "node-pty": "^1.1.0",
     "pdfkit": "^0.19.1",
+    "prisma": "^6.19.0",
     "pg": "^8.13.1"
   },
-  "license": "MIT",
-  "devDependencies": {
-    "prisma": "^6.19.3"
-  }
+  "license": "MIT"
 }