hanoman 0.1.38 → 0.1.40

package/dist/server.js

@@ -6092,6 +6092,7 @@ var init_api = __esm({
       // SPEC-233 · drop commit isolasi
       fsBrowse: (path2) => `${API}/fs/browse${path2 ? `?path=${encodeURIComponent(path2)}` : ""}`,
       terminalSessions: `${API}/terminal/sessions`,
+      terminalWorkspace: `${API}/terminal/workspace`,
       // SPEC-742 · ADR-0116 · pembersihan worktree yang masih tertunda sesudah sesi ditutup. Di bawah
       // prefix /terminal supaya ikut capability `sessions` yang sudah ada (cermin sessionHistory).
       terminalCleanups: `${API}/terminal/cleanups`,
@@ -6194,6 +6195,8 @@ var init_api = __esm({
       syncNow: `${API}/sync/now`,
       // SPEC-270 · ADR-0067 · antrean konflik rekonsil (cookie-authed)
       syncConflicts: `${API}/sync/conflicts`,
+      // SPEC-799 · ADR-0119 · penghapusan yang menunggu jendela online (cookie-only, cermin syncNow).
+      syncPending: `${API}/sync/pending`,
       syncConflictResolve: (entity, recordId) => `${API}/sync/conflicts/${encodeURIComponent(entity)}/${encodeURIComponent(recordId)}/resolve`,
       // SPEC-257 · ADR-0065 · agent token (kelola cookie-only) + katalog capability
       agentTokens: `${API}/agent-tokens`,
@@ -7701,6 +7704,70 @@ var init_changelog = __esm({
   }
 });
 
+// ../shared/src/terminal-workspace.ts
+var zSessionId, zTerminalGroup, zTerminalWorkspaceV1, zTerminalWorkspaceWrite, zTerminalWorkspaceSnapshot;
+var init_terminal_workspace = __esm({
+  "../shared/src/terminal-workspace.ts"() {
+    "use strict";
+    init_zod();
+    zSessionId = external_exports.string().trim().min(1).max(256);
+    zTerminalGroup = external_exports.object({
+      id: external_exports.string().trim().min(1).max(128),
+      name: external_exports.string().trim().min(1).max(80),
+      layout: external_exports.object({
+        rows: external_exports.number().int().min(1).max(12),
+        cols: external_exports.number().int().min(1).max(12),
+        cells: external_exports.array(zSessionId.nullable()).max(144)
+      }).strict().superRefine((layout, ctx) => {
+        if (layout.cells.length !== layout.rows * layout.cols) {
+          ctx.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["cells"],
+            message: "cells must match rows \xD7 cols"
+          });
+        }
+      })
+    }).strict();
+    zTerminalWorkspaceV1 = external_exports.object({
+      version: external_exports.literal(1),
+      groups: external_exports.array(zTerminalGroup).min(1).max(24)
+    }).strict().superRefine((workspace, ctx) => {
+      const groupIds = /* @__PURE__ */ new Set();
+      const sessionIds = /* @__PURE__ */ new Set();
+      workspace.groups.forEach((group2, groupIndex) => {
+        if (groupIds.has(group2.id)) {
+          ctx.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["groups", groupIndex, "id"],
+            message: "group id must be unique"
+          });
+        }
+        groupIds.add(group2.id);
+        group2.layout.cells.forEach((sessionId2, cellIndex) => {
+          if (sessionId2 === null) return;
+          if (sessionIds.has(sessionId2)) {
+            ctx.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: ["groups", groupIndex, "layout", "cells", cellIndex],
+              message: "sessionId must be unique across the workspace"
+            });
+          }
+          sessionIds.add(sessionId2);
+        });
+      });
+    });
+    zTerminalWorkspaceWrite = external_exports.object({
+      baseRevision: external_exports.number().int().min(0),
+      workspace: zTerminalWorkspaceV1
+    }).strict();
+    zTerminalWorkspaceSnapshot = external_exports.object({
+      workspace: zTerminalWorkspaceV1.nullable(),
+      revision: external_exports.number().int().min(0),
+      updatedAt: external_exports.string().datetime().nullable()
+    }).strict();
+  }
+});
+
 // ../shared/src/index.ts
 var init_src = __esm({
   "../shared/src/index.ts"() {
@@ -7732,6 +7799,7 @@ var init_src = __esm({
     init_auto_merge();
     init_changelog();
     init_cron_expr();
+    init_terminal_workspace();
   }
 });
 
@@ -10421,16 +10489,54 @@ var init_rename_project = __esm({
   }
 });
 
+// src/services/tombstone.ts
+async function findTombstone(entity, recordId) {
+  const row = await prisma.syncTombstone.findUnique({ where: { entity_recordId: { entity, recordId } } });
+  return row ? view(row) : null;
+}
+async function writeTombstone(entity, recordId, version2, data, deviceId) {
+  const prev = await findTombstone(entity, recordId);
+  if (prev && prev.version >= version2) return prev;
+  const row = await prisma.syncTombstone.upsert({
+    where: { entity_recordId: { entity, recordId } },
+    create: { entity, recordId, version: version2, data, deviceId: deviceId ?? null },
+    update: { version: version2, data, deviceId: deviceId ?? null, deletedAt: /* @__PURE__ */ new Date() }
+  });
+  return view(row);
+}
+async function clearTombstone(entity, recordId) {
+  await prisma.syncTombstone.deleteMany({ where: { entity, recordId } });
+}
+var view;
+var init_tombstone = __esm({
+  "src/services/tombstone.ts"() {
+    "use strict";
+    init_db();
+    view = (r) => ({
+      entity: r.entity,
+      recordId: r.recordId,
+      version: r.version,
+      data: r.data ?? {},
+      deletedAt: r.deletedAt,
+      deviceId: r.deviceId
+    });
+  }
+});
+
 // src/services/sync.ts
 var sync_exports = {};
 __export(sync_exports, {
+  PARENTS: () => PARENTS,
   SYNCED: () => SYNCED,
   __DATE_FIELDS: () => __DATE_FIELDS,
   __FIELDS: () => __FIELDS,
   __FIELDS_FOR_TEST: () => __FIELDS_FOR_TEST,
   applyPush: () => applyPush,
   backfillFeed: () => backfillFeed,
+  consumeTombstoneOnRecreate: () => consumeTombstoneOnRecreate,
+  deleteRow: () => deleteRow,
   isEntity: () => isEntity,
+  publishDelete: () => publishDelete,
   publishLocal: () => publishLocal,
   pull: () => pull,
   setAcceptedHook: () => setAcceptedHook,
@@ -10495,10 +10601,24 @@ async function snapshot(entity, id) {
   for (const f of FIELDS[entity]) data[f] = jsonSafe(row[f]);
   return { version: Number(row.version), data };
 }
-async function applyPush(entity, id, baseVersion, data, deviceId) {
+async function applyPush(entity, id, baseVersion, data, deviceId, op = "upsert") {
   validateSyncData(entity, data, { allowProjectRename: true });
+  if (op === "delete") {
+    const already = await findTombstone(entity, id);
+    if (already) return { ok: true, version: already.version };
+    const snap2 = await snapshot(entity, id);
+    const version2 = (snap2?.version ?? baseVersion) + 1;
+    if (snap2) await DELEGATE[entity].delete({ where: { id } });
+    await writeTombstone(entity, id, version2, snap2?.data ?? data, deviceId);
+    await publishDelete(entity, id);
+    return { ok: true, version: version2 };
+  }
   if (entity === "project" && typeof data.renamedFrom === "string" && data.renamedFrom && data.renamedFrom !== id) {
     const oldId = data.renamedFrom;
+    const destTomb = await findTombstone("project", id);
+    if (destTomb) {
+      return { ok: false, conflict: true, deleted: true, deletedVersion: destTomb.version, server: null };
+    }
     const already = await DELEGATE.project.findUnique({ where: { id }, select: { version: true } });
     if (already) return { ok: true, version: Number(already.version) };
     const old = await DELEGATE.project.findUnique({ where: { id: oldId }, select: { version: true } });
@@ -10512,17 +10632,24 @@ async function applyPush(entity, id, baseVersion, data, deviceId) {
       const snap2 = await snapshot("project", id);
       const logData = { ...snap2?.data ?? {}, renamedFrom: oldId };
       const log3 = await prisma.syncLog.create({
-        data: { entity: "project", recordId: id, version: newVersion2, data: logData, deviceId: deviceId ?? null }
+        data: { entity: "project", recordId: id, version: newVersion2, op: "upsert", data: logData, deviceId: deviceId ?? null }
       });
-      onAccepted?.({ entity: "project", recordId: id, version: newVersion2, data: logData, seq: String(log3.seq) });
+      onAccepted?.({ entity: "project", recordId: id, version: newVersion2, op: "upsert", data: logData, seq: String(log3.seq) });
       return { ok: true, version: newVersion2 };
     }
   }
+  const tomb = await findTombstone(entity, id);
   const existing = await DELEGATE[entity].findUnique({ where: { id }, select: { version: true } });
-  if (existing && Number(existing.version) !== baseVersion) {
-    return { ok: false, conflict: true, server: await snapshot(entity, id) };
+  const currentVersion = existing ? Number(existing.version) : tomb ? tomb.version : null;
+  if (currentVersion !== null && currentVersion !== baseVersion) {
+    return {
+      ok: false,
+      conflict: true,
+      server: await snapshot(entity, id),
+      ...tomb && !existing ? { deleted: true, deletedVersion: tomb.version } : {}
+    };
   }
-  const newVersion = existing ? Number(existing.version) + 1 : 1;
+  const newVersion = (currentVersion ?? 0) + 1;
   const writeData = coerce2(entity, data);
   const stamp2 = writeData.updatedAt ?? /* @__PURE__ */ new Date();
   await DELEGATE[entity].upsert({
@@ -10530,11 +10657,12 @@ async function applyPush(entity, id, baseVersion, data, deviceId) {
     create: { id, ...writeData, version: newVersion, updatedAt: stamp2 },
     update: { ...writeData, version: newVersion, updatedAt: stamp2 }
   });
+  if (tomb) await clearTombstone(entity, id);
   const snap = await snapshot(entity, id);
   const log2 = await prisma.syncLog.create({
-    data: { entity, recordId: id, version: newVersion, data: snap?.data ?? {}, deviceId: deviceId ?? null }
+    data: { entity, recordId: id, version: newVersion, op: "upsert", data: snap?.data ?? {}, deviceId: deviceId ?? null }
   });
-  onAccepted?.({ entity, recordId: id, version: newVersion, data: snap?.data ?? {}, seq: String(log2.seq) });
+  onAccepted?.({ entity, recordId: id, version: newVersion, op: "upsert", data: snap?.data ?? {}, seq: String(log2.seq) });
   return { ok: true, version: newVersion };
 }
 async function pull(sinceCursor, limit = 500) {
@@ -10547,7 +10675,13 @@ async function pull(sinceCursor, limit = 500) {
   const cursor = rows.length ? String(rows[rows.length - 1].seq) : sinceCursor || "0";
   return {
     cursor,
-    records: rows.map((r) => ({ entity: r.entity, recordId: r.recordId, version: r.version, data: r.data }))
+    records: rows.map((r) => ({
+      entity: r.entity,
+      recordId: r.recordId,
+      version: r.version,
+      op: r.op === "delete" ? "delete" : "upsert",
+      data: r.data
+    }))
   };
 }
 async function publishLocal(entity, id) {
@@ -10556,9 +10690,38 @@ async function publishLocal(entity, id) {
   const newVersion = snap.version + 1;
   await DELEGATE[entity].update({ where: { id }, data: { version: newVersion } });
   const log2 = await prisma.syncLog.create({
-    data: { entity, recordId: id, version: newVersion, data: snap.data ?? {}, deviceId: null }
+    data: { entity, recordId: id, version: newVersion, op: "upsert", data: snap.data ?? {}, deviceId: null }
   });
-  onAccepted?.({ entity, recordId: id, version: newVersion, data: snap.data ?? {}, seq: String(log2.seq) });
+  onAccepted?.({ entity, recordId: id, version: newVersion, op: "upsert", data: snap.data ?? {}, seq: String(log2.seq) });
+}
+async function deleteRow(entity, id) {
+  await DELEGATE[entity].delete({ where: { id } });
+}
+async function publishDelete(entity, id) {
+  const tomb = await findTombstone(entity, id);
+  if (!tomb) return;
+  const log2 = await prisma.syncLog.create({
+    data: {
+      entity,
+      recordId: id,
+      version: tomb.version,
+      op: "delete",
+      data: tomb.data,
+      deviceId: tomb.deviceId
+    }
+  });
+  onAccepted?.({ entity, recordId: id, version: tomb.version, op: "delete", data: tomb.data, seq: String(log2.seq) });
+}
+async function consumeTombstoneOnRecreate(entity, id) {
+  const tomb = await findTombstone(entity, id);
+  if (!tomb) return false;
+  const row = await DELEGATE[entity].findUnique({ where: { id }, select: { version: true } });
+  if (!row) return false;
+  await clearTombstone(entity, id);
+  if (Number(row.version) < tomb.version) {
+    await DELEGATE[entity].update({ where: { id }, data: { version: tomb.version } });
+  }
+  return true;
 }
 async function backfillFeed() {
   let published = 0;
@@ -10574,6 +10737,16 @@ async function backfillFeed() {
       published++;
     }
   }
+  for (const t of await prisma.syncTombstone.findMany({ select: { entity: true, recordId: true, version: true } })) {
+    if (!isEntity(t.entity)) continue;
+    const has = await prisma.syncLog.findFirst({
+      where: { entity: t.entity, recordId: t.recordId, version: t.version, op: "delete" },
+      select: { seq: true }
+    });
+    if (has) continue;
+    await publishDelete(t.entity, t.recordId);
+    published++;
+  }
   return published;
 }
 async function upsertLocal(entity, id, version2, data) {
@@ -10601,12 +10774,13 @@ async function upsertLocal(entity, id, version2, data) {
 function setAcceptedHook(hook) {
   onAccepted = hook;
 }
-var SYNCED, DELEGATE, FIELDS, DATE_FIELDS, __FIELDS, __DATE_FIELDS, NUMBER_FIELDS, BOOLEAN_FIELDS, JSON_FIELDS, onAccepted, __FIELDS_FOR_TEST;
+var SYNCED, DELEGATE, FIELDS, DATE_FIELDS, PARENTS, __FIELDS, __DATE_FIELDS, NUMBER_FIELDS, BOOLEAN_FIELDS, JSON_FIELDS, onAccepted, __FIELDS_FOR_TEST;
 var init_sync = __esm({
   "src/services/sync.ts"() {
     "use strict";
     init_db();
     init_rename_project();
+    init_tombstone();
     SYNCED = ["project", "spec", "vps", "sessionResult", "ticket", "ticketAttachment", "customAgent", "githubIssue"];
     DELEGATE = {
       project: prisma.project,
@@ -10680,6 +10854,13 @@ var init_sync = __esm({
       customAgent: ["createdAt", "updatedAt"],
       githubIssue: ["issueCreatedAt", "issueUpdatedAt", "pulledAt", "createdAt", "updatedAt"]
     };
+    PARENTS = {
+      spec: [{ field: "projectId", entity: "project" }],
+      ticket: [{ field: "projectId", entity: "project" }],
+      ticketAttachment: [{ field: "ticketId", entity: "ticket" }],
+      customAgent: [{ field: "projectId", entity: "project" }],
+      githubIssue: [{ field: "projectId", entity: "project" }]
+    };
     __FIELDS = FIELDS;
     __DATE_FIELDS = DATE_FIELDS;
     NUMBER_FIELDS = /* @__PURE__ */ new Set([
@@ -10822,6 +11003,134 @@ var init_codex_trust = __esm({
   }
 });
 
+// src/services/notifications.ts
+async function recordDrift(vpsId, vpsName, drift, snapshotId) {
+  if (drift.length === 0) return;
+  const ids = drift.map((d) => d.itemId);
+  const shown = ids.slice(0, 5).join(", ") + (ids.length > 5 ? `, +${ids.length - 5} lagi` : "");
+  const title = `Drift di "${vpsName}": ${drift.length} item regresi (${shown})`;
+  await prisma.notification.create({
+    data: { type: "drift", key: `drift:${vpsId}:${snapshotId}`, title, projectId: null }
+  }).catch(() => {
+  });
+}
+async function recordCompletion(specId, title, projectId) {
+  await prisma.spec.updateMany({ where: { id: specId, doneAt: null }, data: { doneAt: /* @__PURE__ */ new Date() } }).catch(() => {
+  });
+  const sessionId2 = specId.toLowerCase().replace(/[^a-z0-9_-]/g, "_");
+  await prisma.notification.create({
+    data: { type: "done", key: `done:${specId}`, specId, sessionId: sessionId2, title, projectId }
+  }).catch(() => {
+  });
+}
+async function recordSyncDelete(entity, recordId, version2, title) {
+  await prisma.notification.create({
+    data: { type: "sync", key: `sync-delete:${entity}:${recordId}:${version2}`, title, projectId: null }
+  }).catch(() => {
+  });
+}
+async function recordFailure(specId, title, projectId, reason) {
+  const sessionId2 = specId.toLowerCase().replace(/[^a-z0-9_-]/g, "_");
+  await prisma.notification.create({
+    data: { type: "fail", key: `fail:${specId}`, specId, sessionId: sessionId2, title: `Gagal: ${title} \u2014 ${reason}`, projectId }
+  }).catch(() => {
+  });
+}
+async function recordAutoMerge(specId, projectId, title) {
+  const sessionId2 = specId.toLowerCase().replace(/[^a-z0-9_-]/g, "_");
+  await prisma.notification.create({
+    data: { type: "automerge", key: `automerge:${specId}`, specId, sessionId: sessionId2, title, projectId }
+  }).catch(() => {
+  });
+}
+async function recordCleanupFailure(sessionId2, projectId, entry, reason) {
+  await prisma.notification.create({
+    data: {
+      type: "cleanup",
+      key: `cleanup:${entry}`,
+      sessionId: sessionId2,
+      projectId,
+      title: `Worktree sesi ${sessionId2} gagal dibersihkan \u2014 ${reason}`
+    }
+  }).catch(() => {
+  });
+}
+async function recordSourceChange(specId, projectId, title, from, to, seq) {
+  const sessionId2 = specId.toLowerCase().replace(/[^a-z0-9_-]/g, "_");
+  await prisma.notification.create({
+    data: {
+      type: "spec-source",
+      key: `source:${specId}:${seq}`,
+      specId,
+      sessionId: sessionId2,
+      title: `${specId} \xB7 type ${from} \u2192 ${to} \u2014 ${title}`,
+      projectId
+    }
+  }).catch(() => {
+  });
+}
+async function recordNewTicket(ticketId, projectId, projectName, category, title) {
+  const short = title.length > 80 ? title.slice(0, 77) + "\u2026" : title;
+  const t = `Keluhan baru di "${projectName}": ${category}: ${short}`;
+  await prisma.notification.create({
+    data: { type: "ticket", key: `ticket:${ticketId}`, projectId, title: t }
+  }).catch(() => {
+  });
+}
+async function recordLeadDecision(decisionId, title, projectId, specId, sessionId2) {
+  await prisma.notification.create({
+    data: { type: "lead", key: `lead:${decisionId}`, specId, sessionId: sessionId2, projectId, title }
+  }).catch(() => {
+  });
+}
+async function recordCronRun(cronId, cronName, projectId, dueAt, status, note) {
+  const verb = status === "launched" ? "berjalan" : status === "skipped" ? "dilewati" : "gagal";
+  const title = `Cron "${cronName}" ${verb}${note ? ` \u2014 ${note}` : ""}`;
+  await prisma.notification.create({
+    data: { type: "cron", key: `cron:${cronId}:${dueAt.toISOString()}`, title, projectId }
+  }).catch(() => {
+  });
+}
+async function scanDecisions(read2 = liveDecisions) {
+  const next = /* @__PURE__ */ new Set();
+  const fresh = [];
+  for (const s2 of read2()) {
+    if (!markerFilled(s2.decisionFile)) continue;
+    next.add(s2.id);
+    if (!awaiting.has(s2.id)) fresh.push(s2);
+  }
+  awaiting = next;
+  for (const s2 of fresh) {
+    const title = s2.specId ? (await prisma.spec.findUnique({ where: { id: s2.specId }, select: { title: true } }))?.title ?? s2.specId : s2.id;
+    await prisma.notification.create({
+      data: { type: "decision", specId: s2.specId ?? null, sessionId: s2.id, projectId: s2.projectId || null, title }
+    });
+  }
+}
+async function notificationsFeed(p = {}) {
+  await scanDecisions();
+  const pageSize = p.limit ? Math.max(1, Math.floor(+p.limit) || 1) : DEFAULT_FEED_TAKE;
+  const page = p.page ? Math.max(1, Math.floor(+p.page) || 1) : 1;
+  const total = await prisma.notification.count();
+  const items = await prisma.notification.findMany({
+    orderBy: { createdAt: "desc" },
+    skip: (page - 1) * pageSize,
+    take: pageSize
+  });
+  const unread = await prisma.notification.count({ where: { readAt: null } });
+  return { items, unread, total, page, pageSize };
+}
+var awaiting, DEFAULT_FEED_TAKE;
+var init_notifications = __esm({
+  "src/services/notifications.ts"() {
+    "use strict";
+    init_db();
+    init_pty();
+    awaiting = /* @__PURE__ */ new Set();
+    DEFAULT_FEED_TAKE = 50;
+  }
+});
+
 // src/services/agent-token.ts
 import { randomBytes as randomBytes2, createHash, timingSafeEqual } from "node:crypto";
 function toAgentTokenView(t) {
@@ -16105,7 +16414,14 @@ function validateIncomingRecord(input) {
   if (!row.data || typeof row.data !== "object" || Array.isArray(row.data)) throw new Error("sync data invalid");
   if (Buffer.byteLength(JSON.stringify(input)) > MAX_SYNC_RECORD_BYTES) throw new Error("sync record terlalu besar");
   validateSyncData(row.entity, row.data, { allowProjectRename: true });
-  return { entity: row.entity, recordId: row.recordId, version: Number(row.version), data: row.data };
+  const op = row.op === void 0 || row.op === null || row.op === "upsert" ? "upsert" : row.op === "delete" ? "delete" : null;
+  return {
+    entity: row.entity,
+    recordId: row.recordId,
+    version: Number(row.version),
+    data: row.data,
+    op
+  };
 }
 async function getCursor() {
   const s2 = await prisma.syncState.findUnique({ where: { id: 1 } });
@@ -16114,15 +16430,50 @@ async function getCursor() {
 async function setCursor(cursor) {
   await prisma.syncState.upsert({ where: { id: 1 }, create: { id: 1, cursor }, update: { cursor } });
 }
-async function applyRemote(entity, recordId, version2, data) {
-  if (!isEntity(entity)) return;
+async function applyRemote(entity, recordId, version2, data, op = "upsert") {
+  if (!isEntity(entity)) return "dropped";
+  if (op === "delete") {
+    await applyRemoteDelete(entity, recordId, version2, data);
+    return "applied";
+  }
+  const tomb = await findTombstone(entity, recordId);
+  if (tomb) {
+    if (version2 <= tomb.version) return "dropped";
+    await clearTombstone(entity, recordId);
+  }
+  if (await parentTombstoned(entity, data)) return "dropped";
   await upsertLocal(entity, recordId, version2, data);
+  return "applied";
+}
+async function applyRemoteDelete(entity, recordId, version2, data) {
+  const existing = await snapshot(entity, recordId);
+  await writeTombstone(entity, recordId, version2, existing?.data ?? data);
+  if (existing) await deleteRow(entity, recordId);
+  const pending2 = await prisma.syncOutbox.findFirst({ where: { entity, recordId } });
+  if (!pending2) return;
+  await clearOutbox(entity, recordId);
+  if (existing) {
+    await recordSyncDelete(
+      entity,
+      recordId,
+      version2,
+      `Dihapus di peer: ${entity} ${recordId} \u2014 suntingan lokal yang belum tersinkron dibuang`
+    );
+  }
+}
+async function parentTombstoned(entity, data) {
+  for (const p of PARENTS[entity] ?? []) {
+    const v = data[p.field];
+    if (typeof v !== "string" || !v) continue;
+    if (await findTombstone(p.entity, v)) return true;
+  }
+  return false;
 }
 async function applyFeedFrame(msg) {
   if (!msg.entity || !msg.recordId) return true;
   try {
     const record2 = validateIncomingRecord({ ...msg, version: Number(msg.version ?? 0), data: msg.data ?? {} });
-    await applyRemote(record2.entity, record2.recordId, record2.version, record2.data);
+    if (record2.op) await applyRemote(record2.entity, record2.recordId, record2.version, record2.data, record2.op);
   } catch {
     feedHole = true;
     return false;
@@ -16131,7 +16482,7 @@ async function applyFeedFrame(msg) {
   return true;
 }
 async function syncOnce(transport) {
-  let pulled = 0, pushed = 0, conflicts = 0;
+  let pulled = 0, pushed = 0, conflicts = 0, deleted = 0, dropped = 0;
   const cursor = await getCursor();
   const outbox = await listOutbox();
   const pending2 = new Set(outbox.map((o) => `${o.entity}:${o.recordId}`));
@@ -16150,7 +16501,11 @@ async function syncOnce(transport) {
   const deferred = [];
   for (const rec of records) {
     if (!isEntity(rec.entity)) continue;
-    if (pending2.has(`${rec.entity}:${rec.recordId}`)) {
+    if (!rec.op) {
+      dropped++;
+      continue;
+    }
+    if (rec.op === "upsert" && pending2.has(`${rec.entity}:${rec.recordId}`)) {
       const local = await snapshot(rec.entity, rec.recordId);
       if (local && JSON.stringify(local.data) !== JSON.stringify(rec.data)) {
         await markConflict(
@@ -16163,8 +16518,10 @@ async function syncOnce(transport) {
       continue;
     }
     try {
-      await applyRemote(rec.entity, rec.recordId, rec.version, rec.data);
-      pulled++;
+      const r = await applyRemote(rec.entity, rec.recordId, rec.version, rec.data, rec.op);
+      if (r === "dropped") dropped++;
+      else if (rec.op === "delete") deleted++;
+      else pulled++;
     } catch {
       deferred.push(rec);
     }
@@ -16174,15 +16531,18 @@ async function syncOnce(transport) {
     const still = [];
     for (const rec of rest) {
       try {
-        await applyRemote(rec.entity, rec.recordId, rec.version, rec.data);
-        pulled++;
+        const r = await applyRemote(rec.entity, rec.recordId, rec.version, rec.data, rec.op ?? "upsert");
+        if (r === "dropped") dropped++;
+        else if (rec.op === "delete") deleted++;
+        else pulled++;
       } catch {
         still.push(rec);
       }
     }
     if (still.length === rest.length) {
       for (const rec of still) {
-        console.warn(`sync: record ${rec.entity}:${rec.recordId} tak bisa diterapkan (induk absen?) \u2014 dilewati`);
+        console.warn(`sync: record ${rec.entity}:${rec.recordId} tak bisa diterapkan \u2014 dilewati`);
+        dropped++;
       }
       break;
     }
@@ -16216,7 +16576,24 @@ async function syncOnce(transport) {
     }
     const snap = await snapshot(item.entity, item.recordId);
     if (!snap) {
-      await clearOutbox(item.entity, item.recordId);
+      const tomb = await findTombstone(item.entity, item.recordId);
+      if (!tomb) {
+        await clearOutbox(item.entity, item.recordId);
+        continue;
+      }
+      const res2 = await transport("POST", "/api/sync/push", {
+        records: [{
+          entity: item.entity,
+          id: item.recordId,
+          baseVersion: Math.max(tomb.version - 1, 0),
+          op: "delete",
+          data: tomb.data
+        }]
+      });
+      if (res2.body?.results?.[0]?.ok) {
+        await clearOutbox(item.entity, item.recordId);
+        pushed++;
+      }
       continue;
     }
     const res = await transport("POST", "/api/sync/push", {
@@ -16232,6 +16609,18 @@ async function syncOnce(transport) {
       await clearOutbox(item.entity, item.recordId);
       pushed++;
     } else if (r?.conflict) {
+      if (r.deleted) {
+        await applyRemote(
+          item.entity,
+          item.recordId,
+          Number(r.deletedVersion ?? snap.version + 1),
+          snap.data,
+          "delete"
+        );
+        await clearOutbox(item.entity, item.recordId);
+        deleted++;
+        continue;
+      }
       const server = r.server;
       if (server && JSON.stringify(server.data) !== JSON.stringify(snap.data)) {
         await markConflict(
@@ -16246,7 +16635,7 @@ async function syncOnce(transport) {
       }
     }
   }
-  return { pulled, pushed, conflicts };
+  return { pulled, pushed, conflicts, deleted, dropped };
 }
 function fetchTransport(base2, token) {
   return async (method, path2, body) => {
@@ -16277,13 +16666,15 @@ async function syncNow(opts) {
   const transport = fetchTransport(base2, token);
   if (!opts?.full) return syncOnce(transport);
   await setCursor("0");
-  const total = { pulled: 0, pushed: 0, conflicts: 0 };
+  const total = { pulled: 0, pushed: 0, conflicts: 0, deleted: 0, dropped: 0 };
   let seen = "0";
   for (let page = 0; page < FULL_PULL_MAX_PAGES; page++) {
     const s2 = await syncOnce(transport);
     total.pulled += s2.pulled;
     total.pushed += s2.pushed;
     total.conflicts += s2.conflicts;
+    total.deleted += s2.deleted;
+    total.dropped += s2.dropped;
     const now = await getCursor();
     if (now === seen) break;
     seen = now;
@@ -16366,6 +16757,8 @@ var init_sync_client = __esm({
     "use strict";
     init_db();
     init_sync();
+    init_tombstone();
+    init_notifications();
     init_conflicts();
     init_outbox();
     init_rename_project();
@@ -24738,11 +25131,42 @@ init_sync();
 async function notifySynced(entity, id) {
   try {
     if (!isEntity(entity)) return;
+    await consumeTombstoneOnRecreate(entity, id);
     if (effectiveStr("SYNC_SERVER_URL")) await enqueueOutbox(entity, id);
     else await publishLocal(entity, id);
   } catch {
   }
 }
+async function notifyDeleted(entity, id) {
+  try {
+    if (!isEntity(entity)) return;
+    if (effectiveStr("SYNC_SERVER_URL")) await enqueueOutbox(entity, id);
+    else await publishDelete(entity, id);
+  } catch {
+  }
+}
+
+// src/services/sync-delete.ts
+init_sync();
+init_tombstone();
+init_outbox();
+async function deleteSynced(entity, id, deviceId) {
+  const snap = await snapshot(entity, id);
+  if (!snap) return false;
+  await deleteRow(entity, id);
+  await writeTombstone(entity, id, snap.version + 1, snap.data, deviceId);
+  await notifyDeleted(entity, id);
+  return true;
+}
+async function listPendingDeletes() {
+  const out3 = [];
+  for (const item of await listOutbox()) {
+    const tomb = await findTombstone(item.entity, item.recordId);
+    if (!tomb) continue;
+    out3.push({ entity: item.entity, recordId: item.recordId, deletedAt: tomb.deletedAt.toISOString() });
+  }
+  return out3;
+}
 
 // src/services/branches.ts
 import { execFile as execFile2 } from "node:child_process";
@@ -24896,7 +25320,7 @@ async function projects_default(app2) {
     if (!await prisma.project.findUnique({ where: { id } })) return reply.code(404).send({ error: "not found" });
     const active = listSessions().filter((s2) => s2.projectId === id && !s2.exited).length;
     if (active) return reply.code(409).send({ error: `project "${id}" masih punya ${active} sesi aktif` });
-    await prisma.project.delete({ where: { id } });
+    await deleteSynced("project", id);
     return reply.code(204).send();
   });
   app2.get("/projects/:id/branches", async (req, reply) => {
@@ -25347,123 +25771,8 @@ function appendSourceHistory(current, entry) {
   return [...Array.isArray(current) ? current : [], entry];
 }
 
-// src/services/notifications.ts
-init_db();
-init_pty();
-async function recordDrift(vpsId, vpsName, drift, snapshotId) {
-  if (drift.length === 0) return;
-  const ids = drift.map((d) => d.itemId);
-  const shown = ids.slice(0, 5).join(", ") + (ids.length > 5 ? `, +${ids.length - 5} lagi` : "");
-  const title = `Drift di "${vpsName}": ${drift.length} item regresi (${shown})`;
-  await prisma.notification.create({
-    data: { type: "drift", key: `drift:${vpsId}:${snapshotId}`, title, projectId: null }
-  }).catch(() => {
-  });
-}
-async function recordCompletion(specId, title, projectId) {
-  await prisma.spec.updateMany({ where: { id: specId, doneAt: null }, data: { doneAt: /* @__PURE__ */ new Date() } }).catch(() => {
-  });
-  const sessionId2 = specId.toLowerCase().replace(/[^a-z0-9_-]/g, "_");
-  await prisma.notification.create({
-    data: { type: "done", key: `done:${specId}`, specId, sessionId: sessionId2, title, projectId }
-  }).catch(() => {
-  });
-}
-async function recordFailure(specId, title, projectId, reason) {
-  const sessionId2 = specId.toLowerCase().replace(/[^a-z0-9_-]/g, "_");
-  await prisma.notification.create({
-    data: { type: "fail", key: `fail:${specId}`, specId, sessionId: sessionId2, title: `Gagal: ${title} \u2014 ${reason}`, projectId }
-  }).catch(() => {
-  });
-}
-async function recordAutoMerge(specId, projectId, title) {
-  const sessionId2 = specId.toLowerCase().replace(/[^a-z0-9_-]/g, "_");
-  await prisma.notification.create({
-    data: { type: "automerge", key: `automerge:${specId}`, specId, sessionId: sessionId2, title, projectId }
-  }).catch(() => {
-  });
-}
-async function recordCleanupFailure(sessionId2, projectId, entry, reason) {
-  await prisma.notification.create({
-    data: {
-      type: "cleanup",
-      key: `cleanup:${entry}`,
-      sessionId: sessionId2,
-      projectId,
-      title: `Worktree sesi ${sessionId2} gagal dibersihkan \u2014 ${reason}`
-    }
-  }).catch(() => {
-  });
-}
-async function recordSourceChange(specId, projectId, title, from, to, seq) {
-  const sessionId2 = specId.toLowerCase().replace(/[^a-z0-9_-]/g, "_");
-  await prisma.notification.create({
-    data: {
-      type: "spec-source",
-      key: `source:${specId}:${seq}`,
-      specId,
-      sessionId: sessionId2,
-      title: `${specId} \xB7 type ${from} \u2192 ${to} \u2014 ${title}`,
-      projectId
-    }
-  }).catch(() => {
-  });
-}
-async function recordNewTicket(ticketId, projectId, projectName, category, title) {
-  const short = title.length > 80 ? title.slice(0, 77) + "\u2026" : title;
-  const t = `Keluhan baru di "${projectName}": ${category}: ${short}`;
-  await prisma.notification.create({
-    data: { type: "ticket", key: `ticket:${ticketId}`, projectId, title: t }
-  }).catch(() => {
-  });
-}
-async function recordLeadDecision(decisionId, title, projectId, specId, sessionId2) {
-  await prisma.notification.create({
-    data: { type: "lead", key: `lead:${decisionId}`, specId, sessionId: sessionId2, projectId, title }
-  }).catch(() => {
-  });
-}
-async function recordCronRun(cronId, cronName, projectId, dueAt, status, note) {
-  const verb = status === "launched" ? "berjalan" : status === "skipped" ? "dilewati" : "gagal";
-  const title = `Cron "${cronName}" ${verb}${note ? ` \u2014 ${note}` : ""}`;
-  await prisma.notification.create({
-    data: { type: "cron", key: `cron:${cronId}:${dueAt.toISOString()}`, title, projectId }
-  }).catch(() => {
-  });
-}
-var awaiting = /* @__PURE__ */ new Set();
-async function scanDecisions(read2 = liveDecisions) {
-  const next = /* @__PURE__ */ new Set();
-  const fresh = [];
-  for (const s2 of read2()) {
-    if (!markerFilled(s2.decisionFile)) continue;
-    next.add(s2.id);
-    if (!awaiting.has(s2.id)) fresh.push(s2);
-  }
-  awaiting = next;
-  for (const s2 of fresh) {
-    const title = s2.specId ? (await prisma.spec.findUnique({ where: { id: s2.specId }, select: { title: true } }))?.title ?? s2.specId : s2.id;
-    await prisma.notification.create({
-      data: { type: "decision", specId: s2.specId ?? null, sessionId: s2.id, projectId: s2.projectId || null, title }
-    });
-  }
-}
-var DEFAULT_FEED_TAKE = 50;
-async function notificationsFeed(p = {}) {
-  await scanDecisions();
-  const pageSize = p.limit ? Math.max(1, Math.floor(+p.limit) || 1) : DEFAULT_FEED_TAKE;
-  const page = p.page ? Math.max(1, Math.floor(+p.page) || 1) : 1;
-  const total = await prisma.notification.count();
-  const items = await prisma.notification.findMany({
-    orderBy: { createdAt: "desc" },
-    skip: (page - 1) * pageSize,
-    take: pageSize
-  });
-  const unread = await prisma.notification.count({ where: { readAt: null } });
-  return { items, unread, total, page, pageSize };
-}
-
 // src/routes/specs.ts
+init_notifications();
 init_stage_machine();
 
 // src/services/stage-artifacts.ts
@@ -28121,6 +28430,7 @@ init_db();
 init_pty();
 init_session_phases();
 init_stage_machine();
+init_notifications();
 
 // src/services/spec-head.ts
 init_db();
@@ -28403,7 +28713,7 @@ ${item.context}` : item.context;
   app2.delete("/specs/:id", async (req, reply) => {
     const { id } = req.params;
     const gone = await prisma.spec.findUnique({ where: { id }, select: { projectId: true } });
-    await prisma.spec.delete({ where: { id } }).catch(() => {
+    await deleteSynced("spec", id).catch(() => {
     });
     if (gone) {
       const rows = await prisma.spec.findMany({
@@ -28489,6 +28799,7 @@ ${item.context}` : item.context;
 
 // src/routes/notifications.ts
 init_db();
+init_notifications();
 async function notifications_default(app2) {
   app2.get("/notifications", async (req) => notificationsFeed(req.query));
   app2.post("/notifications/read", async (_req, reply) => {
@@ -30110,6 +30421,7 @@ import { execFile as execFile8 } from "node:child_process";
 import { readdir as readdir2, rm as rm2 } from "node:fs/promises";
 import { promisify as promisify9 } from "node:util";
 import { join as join9, resolve as resolve14 } from "node:path";
+init_notifications();
 var TICK_MS = 6e4;
 var trashDirOf = (repoDir) => resolve14(repoDir, ".worktrees", ".trash");
 var exec8 = promisify9(execFile8);
@@ -30235,6 +30547,7 @@ async function recordSessionResult(input) {
 }
 
 // src/routes/terminal.ts
+init_notifications();
 init_stage_machine();
 init_pty();
 var TERMINAL_WS_MESSAGES_PER_MINUTE = 6e3;
@@ -30618,6 +30931,93 @@ async function terminal_default(app2, opts) {
   });
 }
 
+// src/routes/terminal-workspace.ts
+init_src();
+
+// src/services/terminal-workspace.ts
+init_src();
+init_db();
+import "@prisma/client";
+var InvalidStoredTerminalWorkspaceError = class extends Error {
+  constructor() {
+    super("stored terminal workspace is invalid");
+  }
+};
+async function readTerminalWorkspace(userId) {
+  const user = await prisma.user.findUniqueOrThrow({
+    where: { id: userId },
+    select: {
+      terminalWorkspace: true,
+      terminalWorkspaceRevision: true,
+      terminalWorkspaceUpdatedAt: true
+    }
+  });
+  if (user.terminalWorkspace === null) {
+    return {
+      workspace: null,
+      revision: user.terminalWorkspaceRevision,
+      updatedAt: user.terminalWorkspaceUpdatedAt?.toISOString() ?? null
+    };
+  }
+  const parsed = zTerminalWorkspaceV1.safeParse(user.terminalWorkspace);
+  if (!parsed.success) throw new InvalidStoredTerminalWorkspaceError();
+  return {
+    workspace: parsed.data,
+    revision: user.terminalWorkspaceRevision,
+    updatedAt: user.terminalWorkspaceUpdatedAt?.toISOString() ?? null
+  };
+}
+async function writeTerminalWorkspace(userId, input) {
+  await readTerminalWorkspace(userId);
+  const updatedAt = /* @__PURE__ */ new Date();
+  const changed = await prisma.user.updateMany({
+    where: { id: userId, terminalWorkspaceRevision: input.baseRevision },
+    data: {
+      terminalWorkspace: input.workspace,
+      terminalWorkspaceRevision: { increment: 1 },
+      terminalWorkspaceUpdatedAt: updatedAt
+    }
+  });
+  if (changed.count === 1) {
+    return {
+      ok: true,
+      current: {
+        workspace: input.workspace,
+        revision: input.baseRevision + 1,
+        updatedAt: updatedAt.toISOString()
+      }
+    };
+  }
+  return { ok: false, current: await readTerminalWorkspace(userId) };
+}
+
+// src/routes/terminal-workspace.ts
+var storedInvalid = (reply) => reply.code(422).send({ error: "stored terminal workspace is invalid" });
+async function terminalWorkspaceRoutes(app2) {
+  app2.get("/terminal/workspace", async (request, reply) => {
+    try {
+      return await readTerminalWorkspace(request.user.id);
+    } catch (error) {
+      if (error instanceof InvalidStoredTerminalWorkspaceError) return storedInvalid(reply);
+      throw error;
+    }
+  });
+  app2.put("/terminal/workspace", async (request, reply) => {
+    const parsed = zTerminalWorkspaceWrite.safeParse(request.body);
+    if (!parsed.success) return reply.code(400).send({ error: parsed.error.flatten() });
+    try {
+      const result = await writeTerminalWorkspace(request.user.id, parsed.data);
+      if (!result.ok) {
+        return reply.code(409).send({ code: "revision-conflict", current: result.current });
+      }
+      return result.current;
+    } catch (error) {
+      if (error instanceof InvalidStoredTerminalWorkspaceError) return storedInvalid(reply);
+      throw error;
+    }
+  });
+}
+
 // src/routes/vps.ts
 init_db();
 init_src();
@@ -30858,6 +31258,7 @@ function computeDrift(prev, curr) {
 }
 
 // src/services/vps-audit.ts
+init_notifications();
 var CRITICAL = [
   "sudo_ok",
   "os_supported",
@@ -31121,12 +31522,9 @@ async function vps_default(app2) {
     return updated;
   });
   app2.delete("/vps/:id", async (req, reply) => {
-    try {
-      await prisma.vps.delete({ where: { id: req.params.id } });
-      return reply.code(204).send();
-    } catch {
-      return reply.code(404).send({ error: "not found" });
-    }
+    const { id } = req.params;
+    if (!await deleteSynced("vps", id)) return reply.code(404).send({ error: "not found" });
+    return reply.code(204).send();
   });
   app2.post("/vps/:id/audit", async (req, reply) => {
     const v = await prisma.vps.findUnique({ where: { id: req.params.id } });
@@ -31654,6 +32052,7 @@ async function update(app2) {
 
 // src/services/events.ts
 init_pty();
+init_notifications();
 
 // src/services/lead/deciding.ts
 var deciding = /* @__PURE__ */ new Set();
@@ -31822,7 +32221,7 @@ async function events_default(app2, opts) {
 // src/routes/device-tokens.ts
 init_src();
 init_db();
-var view = (t) => ({
+var view2 = (t) => ({
   id: t.id,
   name: t.name,
   createdAt: t.createdAt.toISOString(),
@@ -31830,7 +32229,7 @@ var view = (t) => ({
   revokedAt: t.revokedAt?.toISOString() ?? null
 });
 async function device_tokens_default(app2) {
-  app2.get("/device-tokens", async (req) => (await prisma.deviceToken.findMany({ where: { userId: req.user.id }, orderBy: { createdAt: "desc" } })).map(view));
+  app2.get("/device-tokens", async (req) => (await prisma.deviceToken.findMany({ where: { userId: req.user.id }, orderBy: { createdAt: "desc" } })).map(view2));
   app2.post("/device-tokens", async (req, reply) => {
     const p = zIssueDeviceToken.safeParse(req.body);
     if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
@@ -31980,7 +32379,10 @@ var zPush = external_exports.object({
     entity: external_exports.string(),
     id: external_exports.string(),
     baseVersion: external_exports.number().int().nonnegative(),
-    data: external_exports.record(external_exports.unknown())
+    data: external_exports.record(external_exports.unknown()),
+    // SPEC-799 · ADR-0119 · absen = "upsert" (client versi lama). Hub versi lama membuang field ini
+    // dan sekadar memperlakukan push delete sebagai update — status quo, bukan galat.
+    op: external_exports.enum(["upsert", "delete"]).optional()
   }))
 });
 var AUTHORED = ["spec", "sessionResult"];
@@ -32010,7 +32412,7 @@ async function sync_default(app2) {
       }
       const data = { ...rec.data };
       if (AUTHORED.includes(rec.entity) && !data.author && user) data.author = user.email;
-      const r = await applyPush(rec.entity, rec.id, rec.baseVersion, data, req.device.id);
+      const r = await applyPush(rec.entity, rec.id, rec.baseVersion, data, req.device.id, rec.op ?? "upsert");
       results.push({ id: rec.id, ...r });
     }
     return { results };
@@ -32022,6 +32424,10 @@ async function sync_default(app2) {
     return { ok: true, full, ...stats2 };
   });
   app2.get("/sync/conflicts", async () => ({ conflicts: await listConflicts() }));
+  app2.get("/sync/pending", async () => {
+    const deletes = await listPendingDeletes();
+    return { deletes, total: deletes.length };
+  });
   const zResolve = external_exports.object({ choice: external_exports.enum(["local", "server"]) });
   app2.post("/sync/conflicts/:entity/:recordId/resolve", async (req, reply) => {
     const { entity, recordId } = req.params;
@@ -32072,7 +32478,7 @@ async function sync_default(app2) {
 
 // src/routes/session-results.ts
 init_db();
-var view2 = (r) => ({
+var view3 = (r) => ({
   id: r.id,
   projectId: r.projectId,
   specId: r.specId,
@@ -32095,7 +32501,7 @@ async function session_results_default(app2) {
       orderBy: { createdAt: "desc" },
       take: take2
     });
-    return rows.map(view2);
+    return rows.map(view3);
   });
   app2.delete("/session-results", async (req, reply) => {
     const { projectId, before: before2 } = req.query;
@@ -32107,8 +32513,10 @@ async function session_results_default(app2) {
       if (Number.isNaN(d.getTime())) return reply.code(400).send({ error: "before bukan tanggal valid" });
       where.createdAt = { lt: d };
     }
-    const { count } = await prisma.sessionResult.deleteMany({ where });
-    return { purged: count };
+    const rows = await prisma.sessionResult.findMany({ where, select: { id: true } });
+    let purged = 0;
+    for (const r of rows) if (await deleteSynced("sessionResult", r.id)) purged++;
+    return { purged };
   });
 }
 
@@ -32161,7 +32569,7 @@ async function deleteTranscript(key) {
 }
 
 // src/services/session-history.ts
-var view3 = (r) => ({
+var view4 = (r) => ({
   id: r.id,
   sessionId: r.sessionId,
   projectId: r.projectId,
@@ -32245,11 +32653,11 @@ async function listHistory(q) {
     skip: (page - 1) * pageSize,
     take: pageSize
   });
-  return { items: rows.map(view3), total, page, pageSize };
+  return { items: rows.map(view4), total, page, pageSize };
 }
 async function getHistory(id) {
   const r = await prisma.sessionHistory.findUnique({ where: { id } });
-  return r ? { ...view3(r), hasTranscript: !!r.transcriptKey } : null;
+  return r ? { ...view4(r), hasTranscript: !!r.transcriptKey } : null;
 }
 async function transcriptOf(id) {
   const r = await prisma.sessionHistory.findUnique({ where: { id }, select: { transcriptKey: true } });
@@ -32325,7 +32733,7 @@ init_config_apply();
 init_sync_client();
 var isSecret2 = (e) => e.kind === "secret";
 var agentBlocked = (req, e) => Boolean(req.agent) && e.category === "credential";
-function view4(e) {
+function view5(e) {
   const eff = effectiveStr(e.key);
   const base2 = {
     key: e.key,
@@ -32345,7 +32753,7 @@ function view4(e) {
 }
 async function config_default(app2) {
   app2.get("/config", async () => ({
-    entries: CONFIG_REGISTRY.map(view4),
+    entries: CONFIG_REGISTRY.map(view5),
     sync: syncStatus()
   }));
   app2.put("/config", async (req, reply) => {
@@ -32357,7 +32765,7 @@ async function config_default(app2) {
     const raw2 = b.value ?? "";
     if (isSecret2(entry) && raw2.trim() === "") {
       if (rawDbValue(entry.key) === void 0) return reply.code(400).send({ error: "tak boleh kosong" });
-      return view4(entry);
+      return view5(entry);
     }
     const parsed = parseConfigValue(entry, raw2);
     if (!parsed.ok) return reply.code(400).send({ error: parsed.error });
@@ -32367,11 +32775,11 @@ async function config_default(app2) {
       } catch (error) {
         return reply.code(400).send({ error: error.message });
       }
-      return view4(entry);
+      return view5(entry);
     }
     await setConfig(entry.key, parsed.value);
     await applyConfigSideEffect(entry.key);
-    return view4(entry);
+    return view5(entry);
   });
   app2.delete("/config/:key", async (req, reply) => {
     const { key } = req.params;
@@ -32437,6 +32845,7 @@ async function pruneOldTickets(now = Date.now()) {
 
 // src/services/ticket-intake.ts
 init_db();
+init_notifications();
 
 // src/services/upload-pipeline.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
@@ -33670,25 +34079,25 @@ var cachedDecoders = {
 };
 var cachedEncoder = new globalThis.TextEncoder();
 var byteToHexLookupTable = Array.from({ length: 256 }, (_, index) => index.toString(16).padStart(2, "0"));
-function getUintBE(view11) {
-  const { byteLength } = view11;
+function getUintBE(view12) {
+  const { byteLength } = view12;
   if (byteLength === 6) {
-    return view11.getUint16(0) * 2 ** 32 + view11.getUint32(2);
+    return view12.getUint16(0) * 2 ** 32 + view12.getUint32(2);
   }
   if (byteLength === 5) {
-    return view11.getUint8(0) * 2 ** 32 + view11.getUint32(1);
+    return view12.getUint8(0) * 2 ** 32 + view12.getUint32(1);
   }
   if (byteLength === 4) {
-    return view11.getUint32(0);
+    return view12.getUint32(0);
   }
   if (byteLength === 3) {
-    return view11.getUint8(0) * 2 ** 16 + view11.getUint16(1);
+    return view12.getUint8(0) * 2 ** 16 + view12.getUint16(1);
   }
   if (byteLength === 2) {
-    return view11.getUint16(0);
+    return view12.getUint16(0);
   }
   if (byteLength === 1) {
-    return view11.getUint8(0);
+    return view12.getUint8(0);
   }
 }
 
@@ -40173,7 +40582,7 @@ async function acceptTicket(t, opts) {
 
 // src/routes/tickets.ts
 init_src();
-var view5 = (t) => ({
+var view6 = (t) => ({
   id: t.id,
   projectId: t.projectId,
   number: t.number,
@@ -40201,7 +40610,7 @@ async function tickets_default(app2) {
       rows = rows.filter((t) => `${t.title} ${t.reporterEmail}`.toLowerCase().includes(n2));
     }
     const unreviewed = rows.filter((t) => t.status === "new").length;
-    return { ...paginate(rows.map(view5), page, limit), unreviewed };
+    return { ...paginate(rows.map(view6), page, limit), unreviewed };
   });
   app2.get("/tickets/:id", async (req, reply) => {
     const { id } = req.params;
@@ -40219,7 +40628,7 @@ async function tickets_default(app2) {
     const base2 = `${req.protocol}://${req.headers.host ?? "localhost"}`;
     const publicStatusUrl = `${base2}/help/${encodeURIComponent(t.projectId)}/status/${shareToken}`;
     return {
-      ...view5(t),
+      ...view6(t),
       detail: t.detail,
       attachments: t.attachments.map((a) => ({ id: a.id, filename: a.filename, mimeType: a.mimeType, size: a.size })),
       spec,
@@ -40279,7 +40688,7 @@ async function tickets_default(app2) {
     });
     const spec = updated.specId ? await prisma.spec.findUnique({ where: { id: updated.specId } }) : null;
     return {
-      ...view5(updated),
+      ...view6(updated),
       detail: updated.detail,
       attachments: updated.attachments.map((a) => ({ id: a.id, filename: a.filename, mimeType: a.mimeType, size: a.size })),
       spec
@@ -40290,7 +40699,7 @@ async function tickets_default(app2) {
     const t = await prisma.ticket.findUnique({ where: { id }, include: { attachments: true } });
     if (!t) return reply.code(404).send({ error: "not found" });
     for (const a of t.attachments) await deleteUpload(a.storageKey);
-    await prisma.ticket.delete({ where: { id } });
+    await deleteSynced("ticket", id);
     return { ok: true };
   });
 }
@@ -40397,6 +40806,7 @@ async function isQueued(id) {
 // src/services/scheduler/cron.ts
 init_db();
 init_src();
+init_notifications();
 var GRACE_MS = 30 * 6e4;
 function computeNextRun(expr, after) {
   const spec = parseCron(expr);
@@ -40747,6 +41157,7 @@ async function leadProjects() {
 init_src();
 init_db();
 init_pty();
+init_notifications();
 
 // src/services/lead/prompt.ts
 init_src();
@@ -41518,6 +41929,7 @@ init_src();
 init_db();
 init_pty();
 init_session_phases();
+init_notifications();
 
 // src/services/webhooks/actor.ts
 init_src();
@@ -41670,6 +42082,7 @@ Bukti integrasi: ${evidence.join("; ")} \u2192 ${verdict}.` }
 init_src();
 init_pty();
 init_tui_dialog();
+init_notifications();
 import { writeFileSync as writeFileSync6 } from "node:fs";
 
 // src/services/lead/pane.ts
@@ -41990,6 +42403,7 @@ function sweep(liveIds) {
 init_db();
 init_pty();
 init_session_phases();
+init_notifications();
 var moduleOf = (p) => p.split("/").slice(0, 2).join("/");
 function findCollisions(areas) {
   const out3 = [];
@@ -42257,6 +42671,7 @@ async function orderProject(projectId, deps) {
 }
 
 // src/services/lead/engine.ts
+init_notifications();
 var TICK_MS2 = 5e3;
 var busyDetect = false;
 var busyPulse = false;
@@ -42771,7 +43186,7 @@ async function generateChangelog(projectId, req, deps = {}) {
 }
 
 // src/routes/changelog.ts
-var view6 = (c) => ({
+var view7 = (c) => ({
   id: c.id,
   projectId: c.projectId,
   mode: c.mode,
@@ -42811,7 +43226,7 @@ async function changelog_default(app2) {
     if (!await prisma.project.findUnique({ where: { id } })) return reply.code(404).send({ error: "not found" });
     const { page, limit, q } = req.query;
     const rows = await prisma.changelog.findMany({ where: { projectId: id }, orderBy: { createdAt: "desc" } });
-    return paginate(rows.filter((r) => changelogMatches(r, q ?? "")).map(view6), page, limit);
+    return paginate(rows.filter((r) => changelogMatches(r, q ?? "")).map(view7), page, limit);
   });
   app2.get("/projects/:id/changelog/:cid", async (req, reply) => {
     const { id, cid } = req.params;
@@ -42825,7 +43240,7 @@ async function changelog_default(app2) {
       eyebrow: `hanoman \xB7 ${id} \xB7 changelog`,
       path: row.title
     });
-    return view6(row);
+    return view7(row);
   });
   app2.post("/projects/:id/changelog", async (req, reply) => {
     const { id } = req.params;
@@ -42834,7 +43249,7 @@ async function changelog_default(app2) {
     if (!parsed.success) return reply.code(400).send({ error: parsed.error.flatten() });
     const r = await generateChangelog(id, parsed.data);
     if (!r.ok) return reply.code(422).send({ error: r.reason });
-    return reply.code(201).send(view6(r.row));
+    return reply.code(201).send(view7(r.row));
   });
   app2.delete("/projects/:id/changelog/:cid", async (req, reply) => {
     const { id, cid } = req.params;
@@ -42973,7 +43388,7 @@ async function installCustomAgents() {
 
 // src/routes/custom-agents.ts
 var rowsOf = async () => await prisma.customAgent.findMany();
-var view7 = (r, projectId) => ({
+var view8 = (r, projectId) => ({
   id: r.id,
   projectId: r.projectId,
   name: r.name,
@@ -43018,7 +43433,7 @@ async function custom_agents_default(app2) {
     const byName = /* @__PURE__ */ new Map();
     for (const r of rows) if (r.projectId === null) byName.set(r.name, r);
     for (const r of rows) if (r.projectId !== null) byName.set(r.name, r);
-    return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name)).map((r) => view7(r, projectId));
+    return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name)).map((r) => view8(r, projectId));
   });
   app2.post("/custom-agents", async (req, reply) => {
     const parsed = zCreateCustomAgent.safeParse(req.body);
@@ -43065,7 +43480,7 @@ async function custom_agents_default(app2) {
     } });
     await loadCustomAgents();
     await notifySynced("customAgent", id);
-    return reply.code(201).send(view7(row));
+    return reply.code(201).send(view8(row));
   });
   app2.patch("/custom-agents/:id", async (req, reply) => {
     const { id } = req.params;
@@ -43112,13 +43527,13 @@ async function custom_agents_default(app2) {
     } });
     await loadCustomAgents();
     await notifySynced("customAgent", id);
-    return view7(row);
+    return view8(row);
   });
   app2.delete("/custom-agents/:id", async (req, reply) => {
     const { id } = req.params;
     const existing = await prisma.customAgent.findUnique({ where: { id } });
     if (!existing) return reply.code(404).send({ error: "not found" });
-    await prisma.customAgent.delete({ where: { id } });
+    await deleteSynced("customAgent", id);
     const name2 = existing.name;
     for (const r of await rowsOf()) {
       const m = mentionsOf(r.mentions);
@@ -43453,7 +43868,7 @@ var STATUS = {
   unauthorized: 401,
   other: 502
 };
-var view8 = (i) => ({
+var view9 = (i) => ({
   id: i.id,
   projectId: i.projectId,
   repoSlug: i.repoSlug,
@@ -43488,7 +43903,7 @@ async function githubIssues(app2) {
       where: { projectId: id, ...status ? { status } : {} },
       orderBy: [{ number: "desc" }]
     });
-    return reply.send(paginate(items.map(view8), page, limit));
+    return reply.send(paginate(items.map(view9), page, limit));
   });
   app2.post("/github-issues/accept", async (req, reply) => {
     const parsed = zAcceptMany.safeParse(req.body ?? {});
@@ -44248,7 +44663,7 @@ async function portal_default(app2) {
 // src/routes/client-accounts.ts
 init_src();
 init_db();
-var view9 = (u) => ({
+var view10 = (u) => ({
   id: u.id,
   email: u.email,
   disabled: u.disabled,
@@ -44279,7 +44694,7 @@ async function client_accounts_default(app2) {
       orderBy: { createdAt: "asc" },
       include: { projectAccess: { select: { projectId: true } } }
     });
-    return { items: rows.map(view9) };
+    return { items: rows.map(view10) };
   });
   app2.post("/client-accounts", async (req, reply) => {
     const p = zCreateClientAccount.safeParse(req.body);
@@ -44293,7 +44708,7 @@ async function client_accounts_default(app2) {
       await prisma.user.delete({ where: { id: user.id } });
       return reply.code(400).send({ error: "ada project yang tidak dikenal" });
     }
-    return reply.code(201).send(view9(await load(user.id)));
+    return reply.code(201).send(view10(await load(user.id)));
   });
   app2.patch("/client-accounts/:id", async (req, reply) => {
     const { id } = req.params;
@@ -44307,7 +44722,7 @@ async function client_accounts_default(app2) {
     if (p.data.password)
       await prisma.user.update({ where: { id }, data: { passwordHash: await hashPassword(p.data.password) } });
     if (p.data.disabled || p.data.password) await deleteUserSessions(id);
-    return view9(await load(id));
+    return view10(await load(id));
   });
   app2.delete("/client-accounts/:id", async (req, reply) => {
     const { id } = req.params;
@@ -44403,7 +44818,7 @@ async function consumeSetupToken(home3) {
 
 // src/routes/auth.ts
 var BOOTSTRAP_USER_ID = "bootstrap-admin";
-var view10 = (u) => ({ id: u.id, email: u.email, role: u.role, createdAt: u.createdAt.toISOString() });
+var view11 = (u) => ({ id: u.id, email: u.email, role: u.role, createdAt: u.createdAt.toISOString() });
 async function issue(reply, userId) {
   const token = await createSession2(userId);
   reply.setCookie(COOKIE_NAME, token, cookieOpts());
@@ -44443,7 +44858,7 @@ async function auth_default(app2, opts) {
     if (opts.bootstrapRequired) await consumeSetupToken(opts.home);
     setupAttempts.clear(req.ip);
     await issue(reply, user.id);
-    return { user: view10(user) };
+    return { user: view11(user) };
   });
   app2.post("/auth/login", async (req, reply) => {
     if (loginThrottle(req.ip).blocked) return reply.code(429).send({ error: "too many attempts" });
@@ -44456,7 +44871,7 @@ async function auth_default(app2, opts) {
     }
     clearLoginFails(req.ip);
     await issue(reply, user.id);
-    return { user: view10(user) };
+    return { user: view11(user) };
   });
   app2.post("/auth/logout", async (req, reply) => {
     const token = req.cookies?.[COOKIE_NAME];
@@ -44464,7 +44879,7 @@ async function auth_default(app2, opts) {
     reply.clearCookie(COOKIE_NAME, { path: "/" });
     return reply.code(204).send();
   });
-  app2.get("/auth/users", async () => (await prisma.user.findMany({ orderBy: { createdAt: "asc" } })).map(view10));
+  app2.get("/auth/users", async () => (await prisma.user.findMany({ orderBy: { createdAt: "asc" } })).map(view11));
   app2.post("/auth/users", async (req, reply) => {
     const p = zSignup.safeParse(req.body);
     if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
@@ -44475,7 +44890,7 @@ async function auth_default(app2, opts) {
       // (/api/client-accounts) supaya "undang rekan" dan "beri akses klien" tak pernah tertukar.
       data: { email: p.data.email, passwordHash: await hashPassword(p.data.password), role: "admin" }
     });
-    return view10(user);
+    return view11(user);
   });
   app2.delete("/auth/users/:id", async (req, reply) => {
     const target2 = await prisma.user.findUnique({ where: { id: req.params.id } });
@@ -44498,7 +44913,7 @@ async function auth_default(app2, opts) {
     });
     await deleteUserSessions(user.id);
     await issue(reply, user.id);
-    return { user: view10(user) };
+    return { user: view11(user) };
   });
 }
 
@@ -44511,15 +44926,15 @@ async function agent_tokens_default(app2) {
   app2.post("/agent-tokens", async (req, reply) => {
     const p = zAgentTokenCreate.safeParse(req.body);
     if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
-    const { view: view11, token } = await issueAgentToken({ ...p.data, createdBy: req.user?.id });
-    return reply.code(201).send({ ...view11, token });
+    const { view: view12, token } = await issueAgentToken({ ...p.data, createdBy: req.user?.id });
+    return reply.code(201).send({ ...view12, token });
   });
   app2.patch("/agent-tokens/:id", async (req, reply) => {
     const p = zAgentTokenPatch.safeParse(req.body);
     if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
     const { id } = req.params;
-    const view11 = await patchAgentToken(id, p.data);
-    return view11 ? reply.send(view11) : reply.code(404).send({ error: "not found" });
+    const view12 = await patchAgentToken(id, p.data);
+    return view12 ? reply.send(view12) : reply.code(404).send({ error: "not found" });
   });
   app2.delete("/agent-tokens/:id", async (req, reply) => {
     const { id } = req.params;
@@ -44586,6 +45001,7 @@ function capabilityForRoute(method, path2) {
   if (top === "vps") return rw("vps");
   if (top === "prds") return rw("docs");
   if (top === "terminal") {
+    if (seg[1] === "workspace") return "COOKIE_ONLY";
     if (seg[seg.length - 1] === "ws") return "sessions:write";
     return rw("sessions");
   }
@@ -44817,7 +45233,7 @@ function buildApp({ requireAuth = true, agentDocFile, env = process.env } = {})
         if (PUBLIC.has(`${req.method} ${path2}`)) return;
         if (user?.role === "client" && !clientRouteAllowed(req.method, path2))
           return reply.code(403).send({ error: "portal klien: baca-saja" });
-        if (path2.startsWith("/api/sync") && path2 !== "/api/sync/now" && !path2.startsWith("/api/sync/conflicts")) return;
+        if (path2.startsWith("/api/sync") && path2 !== "/api/sync/now" && path2 !== "/api/sync/pending" && !path2.startsWith("/api/sync/conflicts")) return;
         if (path2.startsWith("/api/help")) return;
         if (user) return;
         const agentTok = agentTokenFromReq(req);
@@ -44852,6 +45268,7 @@ function buildApp({ requireAuth = true, agentDocFile, env = process.env } = {})
     await api.register(fs_default);
     const wsOptions = { allowedOrigins: wsControlOrigins(env) };
     await api.register(terminal_default, wsOptions);
+    await api.register(terminalWorkspaceRoutes);
     await api.register(vps_default);
     await api.register(limits);
     await api.register(update);
@@ -44930,6 +45347,7 @@ init_src();
 
 // src/services/scheduler/governor.ts
 init_db();
+init_notifications();
 var ALREADY_DONE_NOTE = "spec sudah selesai \u2014 tak diluncurkan";
 var canceledRaceNote = (sessionId2) => `dibatalkan saat sesi ${sessionId2} sudah terlanjur lahir \u2014 sesi dibiarkan hidup, tutup dari Terminal bila tak diperlukan`;
 var CAP_FULL_NOTE = "cap penuh \u2014 tak ada slot sesi";
@@ -45064,6 +45482,7 @@ async function startCronSession(cron) {
 // src/services/scheduler/reconcile.ts
 init_db();
 init_src2();
+init_notifications();
 init_stage_machine();
 init_pty();
 init_session_phases();
@@ -45127,6 +45546,7 @@ var reconcileProdDeps = {
 };
 
 // src/services/scheduler/engine.ts
+init_notifications();
 init_pty();
 var prodEnd = {
   reconcile: () => reconcile(reconcileProdDeps),
@@ -45501,6 +45921,7 @@ init_src();
 init_db();
 import { execFile as execFile13 } from "node:child_process";
 import { promisify as promisify12 } from "node:util";
+init_notifications();
 var AUTO_MERGE_WINDOW_MS = 24 * 60 * 60 * 1e3;
 var AUTO_MERGE_GRACE_MS = 15 * 60 * 1e3;
 var TICK_MS5 = 6e4;