hanoman 0.1.32 → 0.1.34

package/dist/server.js

@@ -8929,6 +8929,61 @@ var init_telegram_operator = __esm({
   }
 });
 
+// ../runner/src/spawn-helper.ts
+import { readdirSync as readdirSync2, existsSync as existsSync4, statSync, chmodSync } from "node:fs";
+import { dirname as dirname4, join as join3 } from "node:path";
+function spawnHelperPaths(ptyDir, listDir, exists) {
+  const dirs = [join3(ptyDir, "build", "Release")];
+  for (const name2 of listDir(join3(ptyDir, "prebuilds"))) dirs.push(join3(ptyDir, "prebuilds", name2));
+  return dirs.map((d) => join3(d, "spawn-helper")).filter(exists);
+}
+function ensureSpawnHelpersExecutable(paths2, ops) {
+  const fixed = [];
+  for (const p of paths2) {
+    try {
+      const mode = ops.mode(p) & 4095;
+      if ((mode & 73) === 73) continue;
+      ops.chmod(p, mode | 73);
+      fixed.push(p);
+    } catch {
+    }
+  }
+  return fixed;
+}
+function repairSpawnHelper(resolve19, notify) {
+  let ptyDir;
+  try {
+    ptyDir = dirname4(resolve19("node-pty/package.json"));
+  } catch {
+    return [];
+  }
+  const paths2 = spawnHelperPaths(ptyDir, (d) => {
+    try {
+      return readdirSync2(d);
+    } catch {
+      return [];
+    }
+  }, existsSync4);
+  const fixed = ensureSpawnHelpersExecutable(paths2, {
+    mode: (p) => statSync(p).mode,
+    chmod: (p, m) => chmodSync(p, m)
+  });
+  if (fixed.length) notify?.("hanoman \xB7 memperbaiki izin `spawn-helper` node-pty (sekali per instalasi)\n");
+  return fixed;
+}
+function ensureSpawnHelperOnce(resolve19, notify) {
+  if (repaired) return [];
+  repaired = true;
+  return repairSpawnHelper(resolve19, notify);
+}
+var repaired;
+var init_spawn_helper = __esm({
+  "../runner/src/spawn-helper.ts"() {
+    "use strict";
+    repaired = false;
+  }
+});
+
 // ../runner/src/index.ts
 var init_src2 = __esm({
   "../runner/src/index.ts"() {
@@ -8948,6 +9003,7 @@ var init_src2 = __esm({
     init_paths();
     init_skills();
     init_telegram_operator();
+    init_spawn_helper();
   }
 });
 
@@ -9083,7 +9139,7 @@ var init_tap = __esm({
 
 // src/db.ts
 import { mkdirSync as mkdirSync2 } from "node:fs";
-import { dirname as dirname4, resolve as resolve7 } from "node:path";
+import { dirname as dirname5, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { PrismaClient } from "@prisma/client";
 var schemaDir, notice, url, base, prisma;
@@ -9093,13 +9149,13 @@ var init_db = __esm({
     init_env();
     init_src2();
     init_tap();
-    schemaDir = resolve7(dirname4(fileURLToPath2(import.meta.url)), "../prisma");
+    schemaDir = resolve7(dirname5(fileURLToPath2(import.meta.url)), "../prisma");
     process.umask(63);
     notice = dbUrlNotice(process.env);
     if (notice) console.warn(notice);
     url = resolveDbUrl(process.env, schemaDir);
     process.env.DATABASE_URL = url;
-    mkdirSync2(dirname4(dbFilePath(url)), { recursive: true, mode: 448 });
+    mkdirSync2(dirname5(dbFilePath(url)), { recursive: true, mode: 448 });
     base = new PrismaClient();
     prisma = base.$extends(webhookTap(base));
   }
@@ -9115,7 +9171,7 @@ var init_stage_machine = __esm({
 });
 
 // src/services/session-phases.ts
-import { readFileSync as readFileSync3, readdirSync as readdirSync2 } from "node:fs";
+import { readFileSync as readFileSync3, readdirSync as readdirSync3 } from "node:fs";
 function recorded(file) {
   const out3 = /* @__PURE__ */ new Map();
   let raw2;
@@ -9163,7 +9219,7 @@ function planComplete(worktree, specId) {
     const dir2 = `${worktree}/${rel}`;
     let names;
     try {
-      names = readdirSync2(dir2);
+      names = readdirSync3(dir2);
     } catch {
       continue;
     }
@@ -9453,9 +9509,9 @@ var init_tui_dialog = __esm({
 });
 
 // src/services/secret-box.ts
-import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync } from "node:fs";
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-import { dirname as dirname5, join as join3 } from "node:path";
+import { dirname as dirname6, join as join4 } from "node:path";
 function isEncrypted(value) {
   return value.startsWith(ENC_PREFIX);
 }
@@ -9487,7 +9543,7 @@ function fromEnv(raw2) {
   return null;
 }
 function secretKeyPath() {
-  return join3(resolveHome(), "secret.key");
+  return join4(resolveHome(), "secret.key");
 }
 function secretKey() {
   if (cached) return cached;
@@ -9499,16 +9555,16 @@ function secretKey() {
     return key2;
   }
   const path2 = secretKeyPath();
-  if (existsSync4(path2)) {
+  if (existsSync5(path2)) {
     const key2 = Buffer.from(readFileSync4(path2, "utf8").trim(), "base64url");
     if (key2.length !== KEY_BYTES) throw new Error(`kunci di ${path2} rusak \u2014 panjangnya bukan 32 byte`);
     cached = key2;
     return key2;
   }
   const key = randomBytes(KEY_BYTES);
-  mkdirSync3(dirname5(path2), { recursive: true });
+  mkdirSync3(dirname6(path2), { recursive: true });
   writeFileSync(path2, key.toString("base64url"), { mode: 384 });
-  chmodSync(path2, 384);
+  chmodSync2(path2, 384);
   cached = key;
   return key;
 }
@@ -9693,9 +9749,10 @@ var init_session_sandbox = __esm({
 // src/services/pty.ts
 import { spawn } from "node-pty";
 import { execFileSync } from "node:child_process";
+import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
-import { mkdirSync as mkdirSync4, statSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname6 } from "node:path";
+import { mkdirSync as mkdirSync4, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname7 } from "node:path";
 import { tmpdir } from "node:os";
 function tmux(...args) {
   try {
@@ -9778,7 +9835,7 @@ function createSession(projectId, cwd, opts = {}) {
   let promptFile;
   if (!opts.command && opts.prompt) {
     promptFile = promptFilePath(id);
-    mkdirSync4(dirname6(promptFile), { recursive: true, mode: 448 });
+    mkdirSync4(dirname7(promptFile), { recursive: true, mode: 448 });
     writeFileSync2(promptFile, opts.prompt + rosterBlock, { mode: 384 });
     promptArg = `"$(cat ${sq(promptFile)})"`;
   }
@@ -9790,7 +9847,7 @@ function createSession(projectId, cwd, opts = {}) {
     let goalGate;
     if (agent === "codex" && opts.goal && opts.flow && opts.specId) {
       goalGate = goalGatePath(id);
-      mkdirSync4(dirname6(goalGate), { recursive: true, mode: 448 });
+      mkdirSync4(dirname7(goalGate), { recursive: true, mode: 448 });
       writeFileSync2(goalGate, codexGoalScript({
         flow: opts.flow,
         specId: opts.specId,
@@ -9806,7 +9863,7 @@ function createSession(projectId, cwd, opts = {}) {
       const json = renderAgentsJson(customDefs);
       if (json) {
         agentsFile = agentsFilePath(id);
-        mkdirSync4(dirname6(agentsFile), { recursive: true, mode: 448 });
+        mkdirSync4(dirname7(agentsFile), { recursive: true, mode: 448 });
         writeFileSync2(agentsFile, json, { mode: 384 });
       }
     }
@@ -9826,7 +9883,7 @@ function createSession(projectId, cwd, opts = {}) {
     for (const [k, v] of Object.entries(rootBypassEnv())) envPairs.push(`${k}=${sq(v)}`);
   }
   if (opts.phaseFile) {
-    mkdirSync4(dirname6(opts.phaseFile), { recursive: true });
+    mkdirSync4(dirname7(opts.phaseFile), { recursive: true });
     envPairs.push(`HANOMAN_PHASE_FILE=${sq(opts.phaseFile)}`);
   }
   for (const [k, v] of Object.entries(opts.env ?? {})) envPairs.push(`${k}=${sq(v)}`);
@@ -9837,7 +9894,7 @@ function createSession(projectId, cwd, opts = {}) {
     phaseFile: opts.phaseFile,
     promptFile
   });
-  if (opts.decisionFile) mkdirSync4(dirname6(opts.decisionFile), { recursive: true });
+  if (opts.decisionFile) mkdirSync4(dirname7(opts.decisionFile), { recursive: true });
   tmux(
     "set-option",
     "-g",
@@ -10132,6 +10189,7 @@ function detachAll() {
   for (const id of [...attached.keys()]) drop(id);
 }
 function spawnPty(...args) {
+  ensureSpawnHelperOnce(createRequire(import.meta.url).resolve, (m) => process.stdout.write(m));
   try {
     return spawn("tmux", ["-L", socket(), "-f", "/dev/null", ...args], {
       name: "xterm-256color",
@@ -10164,7 +10222,7 @@ var init_pty = __esm({
     POLL_MS = 500;
     markerFilled = (f) => {
       try {
-        return statSync(f).size > 0;
+        return statSync2(f).size > 0;
       } catch {
         return false;
       }
@@ -24258,8 +24316,8 @@ import fastifyStatic from "@fastify/static";
 import websocket from "@fastify/websocket";
 import cookie from "@fastify/cookie";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
-import { dirname as dirname12 } from "node:path";
-import { existsSync as existsSync15 } from "node:fs";
+import { dirname as dirname13 } from "node:path";
+import { existsSync as existsSync16 } from "node:fs";
 
 // src/web-dir.ts
 import { resolve } from "node:path";
@@ -24322,13 +24380,13 @@ init_stage_machine();
 init_src();
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { existsSync as existsSync5, rmSync as rmSync2 } from "node:fs";
+import { existsSync as existsSync6, rmSync as rmSync2 } from "node:fs";
 import { resolve as resolve9 } from "node:path";
 
 // src/services/safe-repo-path.ts
 import { constants } from "node:fs";
 import { lstat, mkdir, open as open2, realpath, rename, unlink } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, join as join4, relative, resolve as resolve8, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join5, relative, resolve as resolve8, sep as sep2 } from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { closeSync, fstatSync, lstatSync, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync5, realpathSync as realpathSync2, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
 var PathContainmentError = class extends Error {
@@ -24358,7 +24416,7 @@ async function ensureRepoParents(root, rel) {
   const parts = components(rel).slice(0, -1);
   let current = base2;
   for (const part of parts) {
-    current = join4(current, part);
+    current = join5(current, part);
     try {
       await mkdir(current, { mode: 448 });
     } catch (error) {
@@ -24375,7 +24433,7 @@ function ensureRepoParentsSync(root, rel) {
   const parts = components(rel).slice(0, -1);
   let current = base2;
   for (const part of parts) {
-    current = join4(current, part);
+    current = join5(current, part);
     try {
       mkdirSync5(current, { mode: 448 });
     } catch (error) {
@@ -24391,7 +24449,7 @@ async function resolveRepoEntry(root, rel, opts = {}) {
   const parts = components(rel);
   let current = base2;
   for (let i = 0; i < parts.length; i++) {
-    current = join4(current, parts[i]);
+    current = join5(current, parts[i]);
     const stat2 = await lstat(current).catch((error) => {
       if (error.code === "ENOENT" && opts.allowMissingFinal && i === parts.length - 1) return null;
       return denied("komponen tidak ada");
@@ -24411,7 +24469,7 @@ function assertSafeRepoPathSync(root, rel, allowMissingFinal = false, allowMissi
   const parts = components(rel);
   let current = base2;
   for (let i = 0; i < parts.length; i++) {
-    current = join4(current, parts[i]);
+    current = join5(current, parts[i]);
     try {
       const stat2 = lstatSync(current);
       if (stat2.isSymbolicLink()) denied("symlink");
@@ -24441,7 +24499,7 @@ function writeRepoFileAtomicSync(root, rel, data) {
   const parent = resolve8(path2, "..");
   const parentRel = relative(realpathSync2(root), parent);
   if (parentRel) assertSafeRepoPathSync(root, parentRel);
-  const temp = join4(parent, `.hanoman-${randomUUID2()}.tmp`);
+  const temp = join5(parent, `.hanoman-${randomUUID2()}.tmp`);
   const fd = openSync(temp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 384);
   try {
     writeFileSync3(fd, data);
@@ -24488,7 +24546,7 @@ async function writeRepoFileAtomic(root, rel, data) {
   await mkdir(entry.parent, { recursive: false, mode: 448 }).catch((error) => {
     if (error.code !== "EEXIST") throw error;
   });
-  const temp = join4(entry.parent, `.hanoman-${randomUUID2()}.tmp`);
+  const temp = join5(entry.parent, `.hanoman-${randomUUID2()}.tmp`);
   const handle = await open2(temp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 384);
   try {
     await handle.writeFile(data);
@@ -24533,12 +24591,12 @@ function docsDirOf(repoDir) {
 }
 function resolveIndex(repoDir, docsDir) {
   const rel = `${docsDir}/README.md`;
-  return existsSync5(resolve9(repoDir, rel)) ? rel : "";
+  return existsSync6(resolve9(repoDir, rel)) ? rel : "";
 }
 var catOf = (rel) => rel.includes("/") ? rel.slice(0, rel.lastIndexOf("/")) : ".";
 var nameOf = (rel) => rel.includes("/") ? rel.slice(rel.lastIndexOf("/") + 1) : rel;
 async function scanRepoDocs(repoDir) {
-  if (!repoDir || !existsSync5(repoDir)) return { coverage: 0, tree: [] };
+  if (!repoDir || !existsSync6(repoDir)) return { coverage: 0, tree: [] };
   const files = await listRepoDocs(repoDir);
   const docsDir = docsDirOf(repoDir);
   const index = resolveIndex(repoDir, docsDir);
@@ -24586,7 +24644,7 @@ function writeDocFile(repoDir, rel, content) {
 }
 function deleteDocFile(repoDir, rel) {
   const abs = docAbsPath(repoDir, rel);
-  if (!existsSync5(abs)) return false;
+  if (!existsSync6(abs)) return false;
   rmSync2(abs);
   return true;
 }
@@ -24873,13 +24931,13 @@ async function projects_default(app2) {
 // src/routes/specs.ts
 init_src();
 init_src2();
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 
 // src/services/integrate.ts
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
 import { rmSync as rmSync3 } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 var sanitize = (id) => id.toLowerCase().replace(/[^a-z0-9_-]/g, "_");
 var sourceBranch = (specId) => `hanoman/${sanitize(specId)}`;
 var exec3 = promisify3(execFile3);
@@ -24923,7 +24981,7 @@ async function integrateBranch(repoDir, src, op, target2) {
   const tgt = await resolveTarget(repoDir, target2);
   if (!tgt) return { status: "error", code: 400, error: `target "${target2}" tidak dikenal` };
   await sh(repoDir, ["fetch", "origin"]);
-  const wt = join5(repoDir, ".worktrees", `merge-${sanitize(src.mergeId)}`);
+  const wt = join6(repoDir, ".worktrees", `merge-${sanitize(src.mergeId)}`);
   await reclaim(repoDir, wt);
   const baseRef = op === "merge" ? tgt.ref : source;
   const baseSha = await out(repoDir, ["rev-parse", "--verify", "--end-of-options", `${baseRef}^{commit}`]);
@@ -24984,7 +25042,7 @@ async function mergeIntoCurrent(repoDir, source, opts = {}) {
   const src = await resolveGraphSource(repoDir, source);
   if (!src) return { status: "error", code: 400, error: `source "${source}" tak dikenal` };
   await sh(repoDir, ["fetch", "origin"]);
-  const wt = join5(repoDir, ".worktrees", `merge-${sanitize(current)}`);
+  const wt = join6(repoDir, ".worktrees", `merge-${sanitize(current)}`);
   await reclaim(repoDir, wt);
   const baseSha = await out(repoDir, ["rev-parse", "--verify", "--end-of-options", `refs/heads/${current}^{commit}`]);
   if (!await ok(repoDir, ["worktree", "add", "--detach", "-q", wt, baseSha]))
@@ -25022,7 +25080,7 @@ async function replayCurrent(repoDir, source, cmd) {
   const current = await out(repoDir, ["rev-parse", "--abbrev-ref", "HEAD"]);
   if (!current || current === "HEAD")
     return { status: "error", code: 409, error: "HEAD detached \u2014 checkout sebuah branch dulu" };
-  const wt = join5(repoDir, ".worktrees", `merge-${sanitize(current)}`);
+  const wt = join6(repoDir, ".worktrees", `merge-${sanitize(current)}`);
   await reclaim(repoDir, wt);
   const baseSha = await out(repoDir, ["rev-parse", "--verify", "--end-of-options", `refs/heads/${current}^{commit}`]);
   if (!await ok(repoDir, ["worktree", "add", "--detach", "-q", wt, baseSha]))
@@ -25071,15 +25129,15 @@ import { execFile as execFile4 } from "node:child_process";
 import { promisify as promisify4 } from "node:util";
 import { mkdtemp, copyFile, rm } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join6, resolve as resolve10 } from "node:path";
+import { join as join7, resolve as resolve10 } from "node:path";
 var exec4 = promisify4(execFile4);
 var GIT3 = { maxBuffer: 1 << 24 };
 var MAX = 256 * 1024;
-var worktreeDir = (repoDir, specId) => join6(repoDir, ".worktrees", specId.toLowerCase().replace(/[^a-z0-9_-]/g, "_"));
+var worktreeDir = (repoDir, specId) => join7(repoDir, ".worktrees", specId.toLowerCase().replace(/[^a-z0-9_-]/g, "_"));
 async function withTempIndex(wt, fn2) {
   const idx = (await exec4("git", ["rev-parse", "--git-path", "index"], { cwd: wt, ...GIT3 })).stdout.trim();
-  const dir2 = await mkdtemp(join6(tmpdir2(), "hanoman-idx-"));
-  const tmp = join6(dir2, "index");
+  const dir2 = await mkdtemp(join7(tmpdir2(), "hanoman-idx-"));
+  const tmp = join7(dir2, "index");
   await copyFile(resolve10(wt, idx), tmp);
   const env = { ...process.env, GIT_INDEX_FILE: tmp };
   try {
@@ -28388,7 +28446,7 @@ ${item.context}` : item.context;
   });
   const specWithProject = (id) => prisma.spec.findUnique({ where: { id }, include: { project: true } });
   const resolveReview = async (repoDir, spec) => {
-    if (existsSync6(worktreeDir(repoDir, spec.id))) return { wt: true };
+    if (existsSync7(worktreeDir(repoDir, spec.id))) return { wt: true };
     if (spec.baseSha && spec.headSha && await shaResolvable(repoDir, spec.baseSha) && await shaResolvable(repoDir, spec.headSha))
       return { wt: false, base: spec.baseSha, head: spec.headSha };
     const r = await specCommitRange(repoDir, spec.id);
@@ -28629,7 +28687,7 @@ import { spawn as spawn2 } from "node:child_process";
 // src/services/git-remotes.ts
 import { execFile as execFile5 } from "node:child_process";
 import { promisify as promisify5 } from "node:util";
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 var exec5 = promisify5(execFile5);
 var GIT4 = { maxBuffer: 1 << 24, encoding: "utf8" };
 function parseRemote(url2) {
@@ -28648,7 +28706,7 @@ function prUrl(remoteUrl, branch, base2 = "main") {
   return null;
 }
 async function listRemotes(repoDir) {
-  if (!repoDir || !existsSync7(repoDir)) return [];
+  if (!repoDir || !existsSync8(repoDir)) return [];
   try {
     const { stdout } = await exec5("git", ["remote", "-v"], { cwd: repoDir, ...GIT4 });
     const map = /* @__PURE__ */ new Map();
@@ -28689,7 +28747,7 @@ import { promisify as promisify7 } from "node:util";
 // src/services/git-ide.ts
 import { execFile as execFile6 } from "node:child_process";
 import { promisify as promisify6 } from "node:util";
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync9 } from "node:fs";
 import { resolve as resolve11 } from "node:path";
 var exec6 = promisify6(execFile6);
 var GIT5 = { maxBuffer: 1 << 24 };
@@ -28701,7 +28759,7 @@ function repoAbsPath(repoDir, rel, allowMissingFinal = false) {
   return resolve11(repoDir, rel);
 }
 async function listRepoTree(repoDir, ref = "") {
-  if (!repoDir || !existsSync8(repoDir)) return [];
+  if (!repoDir || !existsSync9(repoDir)) return [];
   try {
     const { stdout } = ref ? await exec6("git", ["ls-tree", "-r", "--name-only", "-z", ref], { cwd: repoDir, ...GIT5 }) : await exec6("git", ["ls-files", "--cached", "--others", "--exclude-standard", "-z"], { cwd: repoDir, ...GIT5 });
     return [...new Set(splitZ2(stdout))].sort();
@@ -28727,7 +28785,7 @@ async function currentBranch(repoDir) {
 }
 async function repoStatus(repoDir) {
   const empty = { branch: "", ahead: 0, behind: 0, staged: [], unstaged: [], untracked: [], clean: true };
-  if (!repoDir || !existsSync8(repoDir)) return empty;
+  if (!repoDir || !existsSync9(repoDir)) return empty;
   try {
     const { stdout } = await exec6("git", ["status", "--porcelain=v1", "-z", "-b"], { cwd: repoDir, ...GIT5 });
     const parts = stdout.split("\0");
@@ -28760,7 +28818,7 @@ async function repoStatus(repoDir) {
   }
 }
 async function listStashes(repoDir) {
-  if (!repoDir || !existsSync8(repoDir)) return [];
+  if (!repoDir || !existsSync9(repoDir)) return [];
   try {
     const { stdout } = await exec6("git", ["stash", "list", `--format=%gd${US}%s${US}%aI`], { cwd: repoDir, ...GIT5 });
     return stdout.split("\n").filter(Boolean).map((line) => {
@@ -28772,7 +28830,7 @@ async function listStashes(repoDir) {
   }
 }
 async function listGraph(repoDir, limit = 200, opts = {}) {
-  if (!repoDir || !existsSync8(repoDir)) return { commits: [], current: "", total: 0 };
+  if (!repoDir || !existsSync9(repoDir)) return { commits: [], current: "", total: 0 };
   try {
     const fmt = ["%H", "%P", "%an", "%aI", "%s", "%D"].join(US);
     const refArgs = opts.branches?.length ? ["--end-of-options", ...opts.branches] : [
@@ -28842,7 +28900,7 @@ async function changedOf(repoDir, sha) {
 }
 async function compareCommits(repoDir, from, to) {
   const empty = { from, to, changed: [] };
-  if (!repoDir || !existsSync8(repoDir)) return empty;
+  if (!repoDir || !existsSync9(repoDir)) return empty;
   try {
     const [num, name2] = await Promise.all([
       exec6("git", ["diff", "--numstat", "-z", "--no-renames", "--end-of-options", from, to], { cwd: repoDir, ...GIT5 }),
@@ -28854,7 +28912,7 @@ async function compareCommits(repoDir, from, to) {
   }
 }
 async function searchCommits(repoDir, q, by = "all") {
-  if (!repoDir || !existsSync8(repoDir) || !q) return [];
+  if (!repoDir || !existsSync9(repoDir) || !q) return [];
   const run2 = async (extra) => {
     try {
       return (await exec6("git", ["log", "--all", "--format=%H", ...extra], { cwd: repoDir, ...GIT5 })).stdout.split("\n").filter(Boolean);
@@ -29101,7 +29159,7 @@ async function runGitOp(repoDir, op) {
   }
 }
 async function workingStatus(repoDir) {
-  if (!repoDir || !existsSync8(repoDir)) return { branch: "", staged: [], unstaged: [] };
+  if (!repoDir || !existsSync9(repoDir)) return { branch: "", staged: [], unstaged: [] };
   const [branch, staged, unstaged] = await Promise.all([
     currentBranch(repoDir),
     changedFiles(repoDir, ["--cached"]),
@@ -29110,7 +29168,7 @@ async function workingStatus(repoDir) {
   return { branch, staged, unstaged };
 }
 async function workingFileDiff(repoDir, path2, staged) {
-  if (!repoDir || !existsSync8(repoDir)) return null;
+  if (!repoDir || !existsSync9(repoDir)) return null;
   repoAbsPath(repoDir, path2, true);
   const changed = staged ? await changedFiles(repoDir, ["--cached"]) : await withTempIndex(repoDir, (env) => changedFiles(repoDir, [], env));
   const cf = changed.find((c) => c.path === path2);
@@ -29588,15 +29646,15 @@ async function finishGraphOp(reply, id, repoDir, r, verb) {
 // src/routes/fs.ts
 import { readdir } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
-import { resolve as resolve12, dirname as dirname8, join as join7 } from "node:path";
+import { resolve as resolve12, dirname as dirname9, join as join8 } from "node:path";
 async function fs_default(app2) {
   app2.get("/fs/browse", async (req, reply) => {
     const q = req.query.path;
     const dir2 = q && q.trim() ? resolve12(q.trim()) : homedir4();
     try {
       const ents = await readdir(dir2, { withFileTypes: true });
-      const entries = ents.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, path: join7(dir2, e.name) })).sort((a, b) => a.name.localeCompare(b.name));
-      const parent = dirname8(dir2);
+      const entries = ents.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, path: join8(dir2, e.name) })).sort((a, b) => a.name.localeCompare(b.name));
+      const parent = dirname9(dir2);
       return { path: dir2, parent: parent === dir2 ? null : parent, entries };
     } catch {
       return reply.code(400).send({ error: `tak bisa membaca folder "${dir2}"` });
@@ -29609,7 +29667,7 @@ init_db();
 init_src();
 init_src2();
 init_session_phases();
-import { existsSync as existsSync9 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 init_settings2();
 init_codex_trust();
 
@@ -29930,11 +29988,32 @@ function wsControlOrigins(env) {
 function assertWsOrigin(origin, allowed) {
   if (!origin || !allowed.has(origin)) throw new Error("WebSocket Origin rejected");
 }
+function wsAllowlistFor(configured, host2, env) {
+  if (configured.size > 0 || env.NODE_ENV === "production") return configured;
+  const value = host2?.trim().toLowerCase();
+  if (!value) return configured;
+  let parsed;
+  try {
+    parsed = new URL(`http://${value}`);
+  } catch {
+    return configured;
+  }
+  if (!parsed.host || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) return configured;
+  const hosts = /* @__PURE__ */ new Set([parsed.host]);
+  if (parsed.port === "80" || parsed.port === "443") hosts.add(parsed.hostname);
+  const allowed = /* @__PURE__ */ new Set();
+  for (const candidate of hosts) {
+    allowed.add(`http://${candidate}`);
+    allowed.add(`https://${candidate}`);
+  }
+  return allowed;
+}
 function admitBrowserWs(req, target2, allowedOrigins) {
   const origin = typeof req.headers.origin === "string" ? req.headers.origin : void 0;
   if (!origin && process.env.NODE_ENV === "test" && allowedOrigins.size === 0)
     return { kind: "test", id: "test" };
-  assertWsOrigin(origin, allowedOrigins);
+  const host2 = typeof req.headers.host === "string" ? req.headers.host : void 0;
+  assertWsOrigin(origin, wsAllowlistFor(allowedOrigins, host2, process.env));
   const token = ticketFromProtocol(req.headers["sec-websocket-protocol"]);
   if (!token) throw new Error("WebSocket ticket required");
   const principal = consumeWsTicket(token, target2);
@@ -30022,7 +30101,7 @@ init_db();
 import { execFile as execFile8 } from "node:child_process";
 import { readdir as readdir2, rm as rm2 } from "node:fs/promises";
 import { promisify as promisify9 } from "node:util";
-import { join as join8, resolve as resolve14 } from "node:path";
+import { join as join9, resolve as resolve14 } from "node:path";
 var TICK_MS = 6e4;
 var trashDirOf = (repoDir) => resolve14(repoDir, ".worktrees", ".trash");
 var exec8 = promisify9(execFile8);
@@ -30081,7 +30160,7 @@ async function sweepRepo(repoDir, projectId, deps = prodReaperDeps) {
   }
   let removed = 0;
   for (const entry of entries) {
-    const path2 = join8(dir2, entry);
+    const path2 = join9(dir2, entry);
     const known = pending.get(path2);
     const row = known ?? { path: path2, repoDir, projectId, entry, sessionId: sessionIdOf(entry), since: Date.now() };
     pending.set(path2, row);
@@ -30401,7 +30480,7 @@ async function terminal_default(app2, opts) {
     if (!s2) return { ok: false, code: 404, msg: "not found" };
     const repoDir = await resolveRepoDir(s2.projectId);
     if (!repoDir) return { ok: false, code: 409, msg: "project belum punya repoDir" };
-    if (!s2.cwd.includes("/.worktrees/") || !existsSync9(s2.cwd))
+    if (!s2.cwd.includes("/.worktrees/") || !existsSync10(s2.cwd))
       return { ok: false, code: 409, msg: "belum ada worktree untuk di-review \u2014 jalankan/lanjutkan sesi dulu" };
     return { ok: true, id: s2.id, repoDir };
   };
@@ -30533,7 +30612,7 @@ async function terminal_default(app2, opts) {
 // src/routes/vps.ts
 init_db();
 init_src();
-import { readFileSync as readFileSync10, existsSync as existsSync12 } from "node:fs";
+import { readFileSync as readFileSync10, existsSync as existsSync13 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 
 // src/vps/catalog/catalog.data.ts
@@ -30623,7 +30702,7 @@ init_config2();
 import { spawn as spawn3 } from "node:child_process";
 import { mkdtempSync, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname9, join as join9 } from "node:path";
+import { dirname as dirname10, join as join10 } from "node:path";
 var sshBin = () => effectiveStr("HANOMAN_SSH_BIN") ?? "ssh";
 function consoleArgv(t) {
   return [
@@ -30638,8 +30717,8 @@ function consoleArgv(t) {
   ];
 }
 function askpassScript() {
-  const dir2 = mkdtempSync(join9(tmpdir3(), "hanoman-askpass-"));
-  const path2 = join9(dir2, "askpass.sh");
+  const dir2 = mkdtempSync(join10(tmpdir3(), "hanoman-askpass-"));
+  const path2 = join10(dir2, "askpass.sh");
   writeFileSync4(path2, `#!/bin/sh
 printf '%s' "$HANOMAN_SSH_PASSWORD"
 `, { mode: 448 });
@@ -30679,7 +30758,7 @@ function sshExec(t, remoteCmd, opts = {}) {
     const timer9 = setTimeout(() => p.kill("SIGKILL"), opts.timeoutMs ?? 6e4);
     const done = (r) => {
       clearTimeout(timer9);
-      if (askpass) rmSync4(dirname9(askpass), { recursive: true, force: true });
+      if (askpass) rmSync4(dirname10(askpass), { recursive: true, force: true });
       resolve19(r);
     };
     p.stdout.on("data", (d) => {
@@ -30700,16 +30779,16 @@ function sshExec(t, remoteCmd, opts = {}) {
 // src/services/vps-audit.ts
 init_db();
 import { readFileSync as readFileSync7 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 
 // src/runner/deps.ts
-import { existsSync as existsSync10 } from "node:fs";
-import { dirname as dirname10, join as join10 } from "node:path";
+import { existsSync as existsSync11 } from "node:fs";
+import { dirname as dirname11, join as join11 } from "node:path";
 function repoRootFrom(startDir) {
   let dir2 = startDir;
   for (let i = 0; i < 8; i++) {
-    if (existsSync10(join10(dir2, "pnpm-workspace.yaml"))) return dir2;
-    const parent = dirname10(dir2);
+    if (existsSync11(join11(dir2, "pnpm-workspace.yaml"))) return dir2;
+    const parent = dirname11(dir2);
     if (parent === dir2) break;
     dir2 = parent;
   }
@@ -30813,7 +30892,7 @@ function parseHealth(out3) {
   return { uptime: h.uptime ?? "", disk: h.disk ?? "", mem: h.mem ?? "", load: h.load ?? "" };
 }
 var target = (v) => ({ host: v.host, port: v.port, user: v.user, keyPath: v.keyPath });
-var scriptPath = (f) => join11(repoRoot(), "server", "scripts", "vps", f);
+var scriptPath = (f) => join12(repoRoot(), "server", "scripts", "vps", f);
 async function itemStatesOf(vpsId) {
   const rows = await prisma.vpsItemState.findMany({ where: { vpsId } });
   return Object.fromEntries(rows.map((s2) => [s2.itemId, { na: s2.na, attested: s2.attested }]));
@@ -30960,15 +31039,15 @@ async function buildChecklist(vpsId) {
 // src/services/vps-key.ts
 init_config2();
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync9 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join12 } from "node:path";
-var keyDir = () => effectiveStr("HANOMAN_SSH_KEY_DIR") ?? join12(homedir5(), ".hanoman");
+import { join as join13 } from "node:path";
+var keyDir = () => effectiveStr("HANOMAN_SSH_KEY_DIR") ?? join13(homedir5(), ".hanoman");
 function ensureHanomanKey() {
   const dir2 = keyDir();
-  const privPath = join12(dir2, "id_ed25519");
+  const privPath = join13(dir2, "id_ed25519");
   const pubPath = `${privPath}.pub`;
-  if (!existsSync11(privPath)) {
+  if (!existsSync12(privPath)) {
     mkdirSync8(dir2, { recursive: true, mode: 448 });
     execFileSync2(
       "ssh-keygen",
@@ -30995,7 +31074,7 @@ async function bootstrapKey(t, password) {
 init_pty();
 init_settings2();
 function keyMissing(v) {
-  return !!v.keyPath && !existsSync12(v.keyPath);
+  return !!v.keyPath && !existsSync13(v.keyPath);
 }
 async function vps_default(app2) {
   app2.get("/vps", async () => prisma.vps.findMany({ orderBy: { createdAt: "asc" } }));
@@ -31207,7 +31286,7 @@ init_config2();
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { readFileSync as readFileSync11 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 var USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 var TTL_MS2 = 3e4;
 var lastOk = null;
@@ -31220,7 +31299,7 @@ var LABELS = {
 var humanize = (k) => k.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
 var nowIso = () => (/* @__PURE__ */ new Date()).toISOString();
 function credsFile() {
-  return join13(effectiveStr("CLAUDE_CONFIG_DIR") ?? join13(homedir7(), ".claude"), ".credentials.json");
+  return join14(effectiveStr("CLAUDE_CONFIG_DIR") ?? join14(homedir7(), ".claude"), ".credentials.json");
 }
 function readAccessToken() {
   if (process.platform === "darwin" && !effectiveStr("CLAUDE_CONFIG_DIR")) {
@@ -31294,14 +31373,14 @@ async function getLimits() {
 // src/services/codex-limits.ts
 import { open as open3, readdir as readdir3, stat } from "node:fs/promises";
 import { homedir as homedir8 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 var TTL_MS3 = 3e4;
 var STALE_AFTER_MS = 12 * 36e5;
 var TAIL_BYTES = 512 * 1024;
 var MAX_FILES = 8;
 var cache2 = null;
 var freshUntil2 = 0;
-var codexSessionsDir = () => join14(process.env.CODEX_HOME ?? join14(homedir8(), ".codex"), "sessions");
+var codexSessionsDir = () => join15(process.env.CODEX_HOME ?? join15(homedir8(), ".codex"), "sessions");
 var UNAVAILABLE = { status: "unavailable", windows: [], fetchedAt: null, plan: null };
 function windowLabel(minutes) {
   if (minutes === 300) return "Sesi 5 jam";
@@ -31334,7 +31413,7 @@ async function recentRollouts(dir2) {
     return [];
   }
   const stamped = await Promise.all(entries.map(async (rel) => {
-    const full = join14(dir2, rel);
+    const full = join15(dir2, rel);
     try {
       return { full, mtime: (await stat(full)).mtimeMs };
     } catch {
@@ -31462,7 +31541,7 @@ init_src();
 init_src();
 init_config2();
 import { readFileSync as readFileSync12 } from "node:fs";
-import { resolve as resolve15, dirname as dirname11 } from "node:path";
+import { resolve as resolve15, dirname as dirname12 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var UPDATE_COMMAND = "npm i -g hanoman@latest";
 function composeUpdate(x) {
@@ -31487,7 +31566,7 @@ var lastFetchAt = 0;
 var lastLatest = null;
 var lastStatus = "unavailable";
 function runningVersion() {
-  const here = dirname11(fileURLToPath3(import.meta.url));
+  const here = dirname12(fileURLToPath3(import.meta.url));
   for (const p of [resolve15(here, "build-info.json"), resolve15(here, "../package.json")]) {
     try {
       const v = JSON.parse(readFileSync12(p, "utf8")).version;
@@ -31844,17 +31923,17 @@ init_config2();
 init_safe_outbound_request();
 init_src2();
 import { mkdir as mkdir2, writeFile, readFile as readFile2, unlink as unlink2 } from "node:fs/promises";
-import { join as join15, resolve as resolve16 } from "node:path";
+import { join as join16, resolve as resolve16 } from "node:path";
 function uploadDir() {
-  return resolve16(effectiveStr("HANOMAN_UPLOAD_DIR") ?? join15(resolveHome(), "uploads"));
+  return resolve16(effectiveStr("HANOMAN_UPLOAD_DIR") ?? join16(resolveHome(), "uploads"));
 }
 async function readUpload(storageKey) {
   const safe = storageKey.replace(/[/\\]/g, "");
-  return readFile2(join15(uploadDir(), safe));
+  return readFile2(join16(uploadDir(), safe));
 }
 async function readUploadOrFetch(storageKey) {
   const safe = storageKey.replace(/[/\\]/g, "");
-  const target2 = join15(uploadDir(), safe);
+  const target2 = join16(uploadDir(), safe);
   try {
     return await readFile2(target2);
   } catch {
@@ -31881,7 +31960,7 @@ async function readUploadOrFetch(storageKey) {
 }
 async function deleteUpload(storageKey) {
   const safe = storageKey.replace(/[/\\]/g, "");
-  await unlink2(join15(uploadDir(), safe)).catch(() => {
+  await unlink2(join16(uploadDir(), safe)).catch(() => {
   });
 }
 
@@ -32034,10 +32113,10 @@ init_config2();
 init_src2();
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { mkdir as mkdir3, writeFile as writeFile2, readFile as readFile3, unlink as unlink3 } from "node:fs/promises";
-import { join as join16, resolve as resolve17, basename as basename4 } from "node:path";
+import { join as join17, resolve as resolve17, basename as basename4 } from "node:path";
 var MAX_TRANSCRIPT_BYTES = 1024 * 1024;
 function transcriptDir() {
-  return resolve17(effectiveStr("HANOMAN_TRANSCRIPT_DIR") ?? join16(resolveHome(), "transcripts"));
+  return resolve17(effectiveStr("HANOMAN_TRANSCRIPT_DIR") ?? join17(resolveHome(), "transcripts"));
 }
 function clamp(text) {
   const buf = Buffer.from(text, "utf8");
@@ -32055,20 +32134,20 @@ async function saveTranscript(text) {
   const dir2 = transcriptDir();
   await mkdir3(dir2, { recursive: true, mode: 448 });
   const key = `${randomUUID4()}.log`;
-  await writeFile2(join16(dir2, key), body, { encoding: "utf8", mode: 384 });
+  await writeFile2(join17(dir2, key), body, { encoding: "utf8", mode: 384 });
   return { key, bytes: Buffer.byteLength(body, "utf8"), truncated };
 }
 async function readTranscript(key) {
   if (!key) return null;
   try {
-    return await readFile3(join16(transcriptDir(), basename4(key)), "utf8");
+    return await readFile3(join17(transcriptDir(), basename4(key)), "utf8");
   } catch {
     return null;
   }
 }
 async function deleteTranscript(key) {
   if (!key) return;
-  await unlink3(join16(transcriptDir(), basename4(key))).catch(() => {
+  await unlink3(join17(transcriptDir(), basename4(key))).catch(() => {
   });
 }
 
@@ -32354,7 +32433,7 @@ init_db();
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { spawn as spawn4 } from "node:child_process";
 import { mkdir as mkdir4, rename as rename2, unlink as unlink4, writeFile as writeFile3 } from "node:fs/promises";
-import { basename as basename5, isAbsolute as isAbsolute4, join as join17 } from "node:path";
+import { basename as basename5, isAbsolute as isAbsolute4, join as join18 } from "node:path";
 
 // ../node_modules/.pnpm/strtok3@10.3.5/node_modules/strtok3/lib/stream/Errors.js
 var defaultMessages = "End-Of-Stream";
@@ -36280,7 +36359,7 @@ var is_default = {
 
 // ../node_modules/.pnpm/sharp@0.35.3_@types+node@20.19.43/node_modules/sharp/dist/sharp.mjs
 var import_detect_libc2 = __toESM(require_detect_libc(), 1);
-import { createRequire } from "node:module";
+import { createRequire as createRequire2 } from "node:module";
 
 // ../node_modules/.pnpm/sharp@0.35.3_@types+node@20.19.43/node_modules/sharp/dist/libvips.mjs
 var import_semver = __toESM(require_semver2(), 1);
@@ -36704,7 +36783,7 @@ var libvips_default = {
 };
 
 // ../node_modules/.pnpm/sharp@0.35.3_@types+node@20.19.43/node_modules/sharp/dist/sharp.mjs
-var require2 = createRequire(import.meta.url);
+var require2 = createRequire2(import.meta.url);
 var { version } = package_default;
 var { runtimePlatformArch: runtimePlatformArch2, isUnsupportedNodeRuntime: isUnsupportedNodeRuntime2, prebuiltPlatforms: prebuiltPlatforms2, minimumLibvipsVersion: minimumLibvipsVersion2 } = libvips_default;
 var runtimePlatform = runtimePlatformArch2();
@@ -39585,9 +39664,9 @@ var output_default = (Sharp2) => {
 // ../node_modules/.pnpm/sharp@0.35.3_@types+node@20.19.43/node_modules/sharp/dist/utility.mjs
 var import_detect_libc3 = __toESM(require_detect_libc(), 1);
 import events from "node:events";
-import { createRequire as createRequire2 } from "node:module";
+import { createRequire as createRequire3 } from "node:module";
 import { availableParallelism } from "node:os";
-var require3 = createRequire2(import.meta.url);
+var require3 = createRequire3(import.meta.url);
 var runtimePlatform2 = libvips_default.runtimePlatformArch();
 var libvipsVersion = sharp_default.libvipsVersion();
 var format = sharp_default.format();
@@ -39817,10 +39896,10 @@ async function processUpload(input, deps = {}) {
   if (usage2.project + normalized.byteLength > UPLOAD_LIMITS.projectBytes || usage2.global + normalized.byteLength > UPLOAD_LIMITS.globalBytes)
     throw new UploadError("UPLOAD_QUOTA", "storage quota exceeded");
   const storageDir = deps.storageDir ?? uploadDir();
-  const quarantineDir = join17(storageDir, ".quarantine");
+  const quarantineDir = join18(storageDir, ".quarantine");
   await mkdir4(quarantineDir, { recursive: true, mode: 448 });
   await mkdir4(storageDir, { recursive: true, mode: 448 });
-  const quarantine = join17(quarantineDir, `${randomUUID6()}.upload`);
+  const quarantine = join18(quarantineDir, `${randomUUID6()}.upload`);
   const storageKey = `${randomUUID6()}${type.extension}`;
   await writeFile3(quarantine, normalized, { mode: 384, flag: "wx" });
   try {
@@ -39828,7 +39907,7 @@ async function processUpload(input, deps = {}) {
     const finalUsage = await (deps.usage ?? defaultUsage)(input.projectId);
     if (finalUsage.project + normalized.byteLength > UPLOAD_LIMITS.projectBytes || finalUsage.global + normalized.byteLength > UPLOAD_LIMITS.globalBytes)
       throw new UploadError("UPLOAD_QUOTA", "storage quota exceeded");
-    await rename2(quarantine, join17(storageDir, storageKey));
+    await rename2(quarantine, join18(storageDir, storageKey));
   } catch (error) {
     await unlink4(quarantine).catch(() => {
     });
@@ -40753,7 +40832,7 @@ function leadPrompt(q, c) {
 
 // src/services/lead/verdict.ts
 init_src();
-import { existsSync as existsSync13 } from "node:fs";
+import { existsSync as existsSync14 } from "node:fs";
 import { isAbsolute as isAbsolute5, resolve as resolvePath, relative as relative2 } from "node:path";
 function extractJsonBlock(raw2) {
   const re = /```json\s*\n([\s\S]*?)```/g;
@@ -40791,7 +40870,7 @@ function keepExistingRefs(refs2, repoDir) {
     const full = resolvePath(repoDir, ref);
     const rel = relative2(repoDir, full);
     if (rel.startsWith("..")) continue;
-    if (existsSync13(full)) out3.push(ref);
+    if (existsSync14(full)) out3.push(ref);
   }
   return [...new Set(out3)];
 }
@@ -40946,7 +41025,7 @@ import { execFile as execFile10 } from "node:child_process";
 import { randomUUID as randomUUID7 } from "node:crypto";
 import { mkdirSync as mkdirSync9, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 var binFor = (agent) => agent === "codex" ? effectiveStr("HANOMAN_CODEX_BIN") ?? "codex" : effectiveStr("HANOMAN_CLAUDE_BIN") ?? "claude";
 function leadArgv(o) {
   if (o.agent === "codex") {
@@ -40974,11 +41053,11 @@ function leadProcess(prompt, o, env = process.env) {
   const mode = env.HANOMAN_SESSION_SANDBOX ?? (env.NODE_ENV === "production" ? "required" : "off");
   if (mode === "off") return { file, args: directArgs, cwd: o.cwd, cleanup: () => {
   } };
-  const promptDir = join18(tmpdir4(), "hanoman-prompts");
+  const promptDir = join19(tmpdir4(), "hanoman-prompts");
   mkdirSync9(promptDir, { recursive: true, mode: 448 });
-  const promptFile = join18(promptDir, `oneshot-${randomUUID7()}`);
+  const promptFile = join19(promptDir, `oneshot-${randomUUID7()}`);
   writeFileSync5(promptFile, prompt, { flag: "wx", mode: 384 });
-  const workspace = o.cwd ?? join18(tmpdir4(), `hanoman-oneshot-${randomUUID7()}`);
+  const workspace = o.cwd ?? join19(tmpdir4(), `hanoman-oneshot-${randomUUID7()}`);
   if (!o.cwd) mkdirSync9(workspace, { recursive: false, mode: 448 });
   try {
     const argsWithoutPrompt = directArgs.slice(0, -1);
@@ -42433,7 +42512,7 @@ init_db();
 init_db();
 import { execFile as execFile11 } from "node:child_process";
 import { promisify as promisify11 } from "node:util";
-import { existsSync as existsSync14 } from "node:fs";
+import { existsSync as existsSync15 } from "node:fs";
 
 // src/services/changelog/scrub.ts
 var MERGE = /^merge\s+(branch|pull request|remote-tracking branch|tag)\b/i;
@@ -42500,7 +42579,7 @@ var US2 = "";
 var RS = "";
 var NO_REPO = "project ini belum ditautkan ke repo di mesin ini";
 var NO_TAG = "repo project ini belum punya tag rilis";
-var usable = (repoDir) => !!repoDir && existsSync14(repoDir);
+var usable = (repoDir) => !!repoDir && existsSync15(repoDir);
 async function listTags(repoDir) {
   if (!usable(repoDir)) return { tags: [], head: null, reason: NO_REPO };
   try {
@@ -42763,7 +42842,7 @@ init_db();
 init_src();
 import { readFileSync as readFileSync13 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 var home = () => process.env.HOME || homedir9();
 var readJson2 = (path2) => {
   try {
@@ -42780,7 +42859,7 @@ var serversOf = (node) => {
 var codexServers = () => {
   let text;
   try {
-    text = readFileSync13(join19(home(), ".codex", "config.toml"), "utf8");
+    text = readFileSync13(join20(home(), ".codex", "config.toml"), "utf8");
   } catch {
     return [];
   }
@@ -42793,12 +42872,12 @@ var codexServers = () => {
 };
 function mcpServerNames(repoDir) {
   const names = [];
-  const claudeJson = readJson2(join19(home(), ".claude.json"));
+  const claudeJson = readJson2(join20(home(), ".claude.json"));
   names.push(...serversOf(claudeJson));
   if (repoDir) {
     const projects = claudeJson?.projects;
     if (projects && typeof projects === "object") names.push(...serversOf(projects[repoDir]));
-    names.push(...serversOf(readJson2(join19(repoDir, ".mcp.json"))));
+    names.push(...serversOf(readJson2(join20(repoDir, ".mcp.json"))));
   }
   names.push(...codexServers());
   return [...new Set(names.filter(Boolean))].sort((a, b) => a.localeCompare(b));
@@ -44252,13 +44331,13 @@ init_db();
 // src/services/bootstrap.ts
 import { createHash as createHash9, randomBytes as randomBytes9, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
 import { chmod, lstat as lstat2, mkdir as mkdir5, readFile as readFile4, unlink as unlink5, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 var TTL_MS5 = 15 * 6e4;
 var SETUP_TOKEN_FILE = "setup.token";
 var BootstrapError = class extends Error {
   code = "BOOTSTRAP_PROOF";
 };
-var tokenPath = (home3) => join20(home3, SETUP_TOKEN_FILE);
+var tokenPath = (home3) => join21(home3, SETUP_TOKEN_FILE);
 async function readStored(home3) {
   try {
     const info = await lstat2(tokenPath(home3));
@@ -44693,7 +44772,7 @@ var PUBLIC = /* @__PURE__ */ new Set([
   "GET /api/agent-integration.md"
 ]);
 function buildApp({ requireAuth = true, agentDocFile, env = process.env } = {}) {
-  const docFile = agentDocFile !== void 0 ? agentDocFile : pickGuideFile(dirname12(fileURLToPath4(import.meta.url)), env, existsSync15);
+  const docFile = agentDocFile !== void 0 ? agentDocFile : pickGuideFile(dirname13(fileURLToPath4(import.meta.url)), env, existsSync16);
   const ingress = loadIngressPolicy(env);
   const app2 = Fastify({ logger: false, trustProxy: trustProxyFromEnv(env) });
   app2.addHook("onRequest", async (req, reply) => {
@@ -44791,7 +44870,7 @@ function buildApp({ requireAuth = true, agentDocFile, env = process.env } = {})
     await api.register(client_accounts_default);
   }, { prefix: "/api" });
   if (shouldServeWeb(env)) {
-    const dist = pickWebDir(dirname12(fileURLToPath4(import.meta.url)), env, existsSync15);
+    const dist = pickWebDir(dirname13(fileURLToPath4(import.meta.url)), env, existsSync16);
     if (dist) {
       app2.register(fastifyStatic, { root: dist });
       app2.setNotFoundHandler((req, reply) => req.url.startsWith("/api") ? reply.code(404).send({ error: "not found" }) : reply.sendFile("index.html"));