hanoman 0.1.30 → 0.1.31

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.30",
-  "sha": "648c9bc",
-  "builtAt": "2026-08-13T21:27:38.407Z"
+  "version": "0.1.31",
+  "sha": "6ca5000",
+  "builtAt": "2026-08-14T06:09:59.969Z"
 }

package/dist/cli.js

@@ -5008,7 +5008,7 @@ var init_cron_expr = __esm({
 });
 
 // ../shared/src/dto.ts
-var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus, zCronExpr, zCreateCron, zPatchCron, zSchedulerCron, zSchedulerCronRun;
+var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zSetup, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus, zCronExpr, zCreateCron, zPatchCron, zSchedulerCron, zSchedulerCronRun;
 var init_dto = __esm({
   "../shared/src/dto.ts"() {
     "use strict";
@@ -5439,6 +5439,7 @@ var init_dto = __esm({
     zUserRole = external_exports.enum(USER_ROLES);
     zLogin = external_exports.object({ email: external_exports.string().email(), password: external_exports.string().min(1) });
     zSignup = external_exports.object({ email: external_exports.string().email(), password: external_exports.string().min(8) });
+    zSetup = zSignup.extend({ setupToken: external_exports.string().min(1) });
     zChangePassword = external_exports.object({
       currentPassword: external_exports.string().min(1),
       newPassword: external_exports.string().min(8)
@@ -5668,6 +5669,7 @@ var init_api = __esm({
       sessionTranscript: (id) => `${API}/terminal/history/${encodeURIComponent(id)}/transcript`,
       eventsWs: `${API}/events/ws`,
       // SPEC-199 · WebSocket siar dashboard (global, bukan per-sesi)
+      wsTickets: `${API}/ws-tickets`,
       vps: `${API}/vps`,
       vpsOne: (id) => `${API}/vps/${id}`,
       vpsAudit: (id) => `${API}/vps/${id}/audit`,
@@ -5902,7 +5904,7 @@ var init_config_registry = __esm({
         label: "URL hub",
         kind: "url",
         apply: "live",
-        category: "knob",
+        category: "credential",
         example: "https://hanoman.nafanesia.id",
         help: "Base URL hub tujuan sync (REST + WS). Kosong = instance ini murni HUB."
       },
@@ -7872,6 +7874,7 @@ function runServer(serverJs, env) {
   }));
 }
 async function start(argv, ctx) {
+  process.umask(63);
   let opts;
   try {
     opts = parseStartArgs(argv);
@@ -7894,8 +7897,9 @@ async function start(argv, ctx) {
   if (notice) ctx.stderr(`${notice}
 `);
   const home = resolveHome(ctx.env);
-  mkdirSync(home, { recursive: true });
-  mkdirSync(dirname3(dbFilePath(dbUrl)), { recursive: true });
+  mkdirSync(home, { recursive: true, mode: 448 });
+  chmodSync(home, 448);
+  mkdirSync(dirname3(dbFilePath(dbUrl)), { recursive: true, mode: 448 });
   if (!existsSync2(layout.server)) {
     ctx.stderr(`hanoman: bundle server tak ada di ${layout.server} \u2014 jalankan \`pnpm build\` dulu
 `);
@@ -7916,6 +7920,7 @@ ${hint}
       return 1;
     }
   }
+  if (existsSync2(dbFilePath(dbUrl))) chmodSync(dbFilePath(dbUrl), 384);
   const port = opts.port ?? Number(ctx.env.PORT ?? 8787);
   const host = opts.host ?? ctx.env.HOST ?? "127.0.0.1";
   ctx.stdout(`hanoman \xB7 http://${host === "0.0.0.0" ? "127.0.0.1" : host}:${port}
@@ -7998,7 +8003,12 @@ function doctorReport(p) {
     },
     { mark: p.homeWritable ? "\u2713" : "\u2717", text: `data dir ${p.homeWritable ? "bisa ditulis" : "TAK bisa ditulis"}`, fatal: !p.homeWritable },
     { mark: p.web ? "\u2713" : "!", text: p.web ? "aset dashboard ada" : "aset dashboard tak ada \u2014 API jalan, dashboard tidak", fatal: false },
-    { mark: "\xB7", text: `db ${p.db}`, fatal: false }
+    { mark: "\xB7", text: `db ${p.db}`, fatal: false },
+    {
+      mark: p.sandboxReady ? "\u2713" : p.sandboxRequired ? "\u2717" : "!",
+      text: p.sandboxReady ? `sandbox sesi rootless siap (${p.podman})` : `sandbox sesi belum siap${p.podman ? ` (${p.podman})` : " \u2014 podman tak ada"}`,
+      fatal: p.sandboxRequired && !p.sandboxReady
+    }
   ];
   for (const m of p.methods) {
     const agent = m.agent === "codex" ? "Codex CLI" : "Claude Code";
@@ -8046,6 +8056,21 @@ async function doctor(_argv, ctx) {
     const s2 = scanAgentSkills(a, ctx.env);
     return methodStatus(method, a, { skills: s2.skills.map((k) => k.id), packages: s2.packages });
   });
+  const podman = version("podman", ["--version"]);
+  const sandboxRequired = ctx.env.NODE_ENV === "production" || !!ctx.env.HANOMAN_PUBLIC_ORIGINS;
+  const rootless = podman ? version("podman", ["info", "--format", "{{.Host.Security.Rootless}}"]) === "true" : false;
+  const credentialDir = ctx.env.HANOMAN_AGENT_CREDENTIAL_DIR;
+  let credentialsReadable = false;
+  if (credentialDir) {
+    try {
+      accessSync(credentialDir, constants.R_OK);
+      credentialsReadable = true;
+    } catch {
+    }
+  }
+  const network = ctx.env.HANOMAN_SESSION_NETWORK ?? "hanoman-egress";
+  const networkReady = podman ? version("podman", ["network", "exists", network]) !== null : false;
+  const sandboxReady = ctx.env.HANOMAN_SESSION_SANDBOX === "podman" && rootless && credentialsReadable && !!ctx.env.HANOMAN_EGRESS_PROXY && networkReady;
   const r = doctorReport({
     node: process.version,
     git: version("git", ["--version"]),
@@ -8056,7 +8081,10 @@ async function doctor(_argv, ctx) {
     homeWritable,
     web: layout.web !== null,
     db,
-    methods
+    methods,
+    podman,
+    sandboxRequired,
+    sandboxReady
   });
   ctx.stdout(`hanoman doctor
 ${r.lines.join("\n")}