hanoman 0.1.43 → 0.1.45

package/dist/server.js

@@ -4151,7 +4151,7 @@ var init_enums = __esm({
     "use strict";
     init_zod();
     zStage = external_exports.enum(["brainstorming", "objective", "spec-ready", "planned", "executing", "done"]);
-    zSpecSource = external_exports.enum(["brief", "qa", "audit", "help", "goal"]);
+    zSpecSource = external_exports.enum(["brief", "qa", "audit", "help", "goal", "no_effort"]);
     zDocStatus = external_exports.enum(["ok", "drift", "broken"]);
     zPriority = external_exports.enum(["tinggi", "sedang", "rendah"]);
     zProjectKind = external_exports.enum(["from-scratch", "existing"]);
@@ -4166,7 +4166,7 @@ var init_enums = __esm({
 
 // ../shared/src/spec-source.ts
 function payloadShapeFor(source) {
-  return source === "qa" ? "qa" : source === "goal" ? "goal" : "brief";
+  return source === "qa" ? "qa" : GOAL_SHAPED_SOURCES.has(source) ? "goal" : "brief";
 }
 function shapeOfPayload(payload) {
   const p = payload ?? {};
@@ -4203,15 +4203,17 @@ function convertPayload(to, payload) {
         expected: str3("outcome"),
         actual: str3("context"),
         env: "",
+        constraints: str3("constraints"),
         ...fromAudit ? { fromAudit } : {}
-      }, nonEmpty(["constraints"]));
+      }, []);
     return done({
       severity: severityFromPriority(prio()),
       steps: "",
       expected: str3("goal"),
       actual: "",
-      env: ""
-    }, nonEmpty(["done", "constraints"]));
+      env: "",
+      constraints: str3("constraints")
+    }, nonEmpty(["done"]));
   }
   if (toShape === "goal") {
     if (fromShape === "brief") {
@@ -4224,7 +4226,7 @@ function convertPayload(to, payload) {
     return done({
       goal: str3("expected"),
       done: "",
-      constraints: "",
+      constraints: str3("constraints"),
       priority: priorityFromSeverity(p.severity)
     }, nonEmpty(["steps", "actual", "env", "fromAudit"]));
   }
@@ -4232,7 +4234,7 @@ function convertPayload(to, payload) {
     return done({
       context: str3("actual"),
       outcome: str3("expected"),
-      constraints: "",
+      constraints: str3("constraints"),
       priority: priorityFromSeverity(p.severity),
       ...fromAudit ? { fromAudit } : {}
     }, nonEmpty(["steps", "env"]));
@@ -4243,11 +4245,12 @@ function convertPayload(to, payload) {
     priority: prio()
   }, nonEmpty(["done"]));
 }
-var SHAPE_REQUIRED;
+var GOAL_SHAPED_SOURCES, SHAPE_REQUIRED;
 var init_spec_source = __esm({
   "../shared/src/spec-source.ts"() {
     "use strict";
     init_enums();
+    GOAL_SHAPED_SOURCES = /* @__PURE__ */ new Set(["goal", "no_effort"]);
     SHAPE_REQUIRED = {
       brief: ["context", "outcome"],
       qa: ["steps", "expected", "actual", "env"],
@@ -4596,6 +4599,10 @@ var init_entities = __esm({
       expected: external_exports.string(),
       actual: external_exports.string(),
       env: external_exports.string(),
+      // SPEC-826 · bentuk ketiga yang ikut punya batasan pengerjaan. `.default("")` bukan gaya:
+      // payload qa yang SUDAH tersimpan tak punya field ini, dan `z.string()` polos membuat setiap
+      // baris lama gagal validasi begitu ia lewat zSpec/zCreateSpec/zPatchSpec/zChangeSpecSource.
+      constraints: external_exports.string().default(""),
       fromAudit: external_exports.string().optional()
     });
     zGoalPayload = external_exports.object({
@@ -5456,9 +5463,9 @@ var init_cron_expr = __esm({
 
 // ../shared/src/dto.ts
 function flowForSource(source) {
-  return source === "qa" ? "qa" : source === "audit" ? "audit" : source === "goal" ? "goal" : "feature";
+  return source === "qa" ? "qa" : source === "audit" ? "audit" : source === "goal" ? "goal" : source === "no_effort" ? "no_effort" : "feature";
 }
-var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zMarkSpecDone, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zSetup, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus, zCronExpr, zCreateCron, zPatchCron, zSchedulerCron, zSchedulerCronRun;
+var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zMarkSpecDone, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, isGoalShapedFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zSetup, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus, zCronExpr, zCreateCron, zPatchCron, zSchedulerCron, zSchedulerCronRun;
 var init_dto = __esm({
   "../shared/src/dto.ts"() {
     "use strict";
@@ -5730,7 +5737,8 @@ var init_dto = __esm({
         capacity: external_exports.number()
       }).default({ inFlight: 0, queued: 0, capacity: 1 })
     });
-    zFlow = external_exports.enum(["feature", "qa", "scaffold", "reverse", "prd", "audit", "breakdown", "goal"]);
+    zFlow = external_exports.enum(["feature", "qa", "scaffold", "reverse", "prd", "audit", "breakdown", "goal", "no_effort"]);
+    isGoalShapedFlow = (flow) => flow === "goal" || flow === "no_effort";
     zPrdBrief = external_exports.object({
       title: external_exports.string().min(1),
       context: external_exports.string(),
@@ -6092,6 +6100,9 @@ var init_api = __esm({
       ideCompare: (id, from, to) => `${API}/projects/${id}/compare?from=${encodeURIComponent(from)}&to=${encodeURIComponent(to)}`,
       ideCompareFile: (id, from, to, path2) => `${API}/projects/${id}/compare/file?from=${encodeURIComponent(from)}&to=${encodeURIComponent(to)}&path=${encodeURIComponent(path2)}`,
       ideGit: (id) => `${API}/projects/${id}/git`,
+      // ADR-0121 · operasi berkas Explorer: satu path untuk buat/rename/hapus, satu untuk unggah.
+      ideEntry: (id, path2) => `${API}/projects/${id}/entry${path2 ? `?path=${encodeURIComponent(path2)}` : ""}`,
+      ideUpload: (id) => `${API}/projects/${id}/upload`,
       ideGitMerge: (id) => `${API}/projects/${id}/git/merge`,
       // SPEC-229 · merge git graph isolasi
       // SPEC-234 · status working tree (staged/unstaged) + diff satu file working tree
@@ -6266,11 +6277,11 @@ function isExternalLink(target2) {
   return !target2 || /^(https?:|#|mailto:)/.test(target2);
 }
 function resolveLink(fromRel, target2) {
-  const clean = target2.trim().split(/\s+/)[0].split("#")[0].split("\\").join("/");
-  if (!clean) return "";
-  if (clean.startsWith("/")) return clean.slice(1).split("/").filter((p) => p && p !== ".").join("/");
+  const clean2 = target2.trim().split(/\s+/)[0].split("#")[0].split("\\").join("/");
+  if (!clean2) return "";
+  if (clean2.startsWith("/")) return clean2.slice(1).split("/").filter((p) => p && p !== ".").join("/");
   const dir2 = fromRel.includes("/") ? fromRel.slice(0, fromRel.lastIndexOf("/")) : "";
-  const parts = (dir2 ? dir2.split("/") : []).concat(clean.replace(/^\.\//, "").split("/"));
+  const parts = (dir2 ? dir2.split("/") : []).concat(clean2.replace(/^\.\//, "").split("/"));
   const out3 = [];
   for (const p of parts) {
     if (p === "" || p === ".") continue;
@@ -7144,12 +7155,13 @@ var init_mcp_schema = __esm({
         expected: str("Yang seharusnya terjadi."),
         actual: str("Yang sebenarnya terjadi. Dari sinilah `objective` backlog diturunkan server."),
         env: str("Lingkungan tempat temuan muncul: versi, browser, OS, instance."),
+        constraints: str("Batasan yang mengikat pengerjaan: yang tak boleh berubah, yang wajib dipertahankan. Boleh string kosong \u2014 SENGAJA tak wajib (SPEC-826)."),
         fromAudit: str("Opsional. Id backlog audit asal (mis. `SPEC-371`).")
       },
       required: ["severity", "steps", "expected", "actual", "env"]
     });
     GOAL_PAYLOAD = obj({
-      description: "Bentuk payload untuk source `goal`. Sesi goal mengejar satu tujuan tanpa fase perencanaan (ADR-0089).",
+      description: "Bentuk payload untuk source `goal` dan `no_effort`. Sesi goal mengejar satu tujuan tanpa fase perencanaan (ADR-0089); sesi no_effort mengerjakan satu task remeh dalam SATU fase lalu berhenti (ADR-0123).",
       properties: {
         goal: str("Satu tujuan yang dikejar sesi. Dari sinilah `objective` backlog diturunkan server."),
         done: str("Bukti berhenti yang dituntut. Kosong berarti goal itu sendiri buktinya."),
@@ -7159,12 +7171,12 @@ var init_mcp_schema = __esm({
       required: ["goal", "done", "constraints", "priority"]
     });
     SPEC_PAYLOAD_ONEOF = {
-      description: "Isi backlog. BENTUKNYA DITENTUKAN `source`: `qa` \u2192 {severity, steps, expected, actual, env}; `goal` \u2192 {goal, done, constraints, priority}; `brief`/`audit`/`help` \u2192 {context, outcome, constraints, priority}. Bentuk yang tak cocok ditolak sebelum dikirim.",
+      description: "Isi backlog. BENTUKNYA DITENTUKAN `source`: `qa` \u2192 {severity, steps, expected, actual, env, constraints}; `goal`/`no_effort` \u2192 {goal, done, constraints, priority}; `brief`/`audit`/`help` \u2192 {context, outcome, constraints, priority}. `constraints` qa opsional (default string kosong); bentuk yang tak cocok ditolak sebelum dikirim.",
       oneOf: [BRIEF_PAYLOAD, QA_PAYLOAD, GOAL_PAYLOAD]
     };
     SOURCE_PAYLOAD_ALLOF = [
       { if: { properties: { source: { const: "qa" } }, required: ["source"] }, then: { properties: { payload: QA_PAYLOAD } } },
-      { if: { properties: { source: { const: "goal" } }, required: ["source"] }, then: { properties: { payload: GOAL_PAYLOAD } } },
+      { if: { properties: { source: { enum: ["goal", "no_effort"] } }, required: ["source"] }, then: { properties: { payload: GOAL_PAYLOAD } } },
       { if: { properties: { source: { enum: ["brief", "audit", "help"] } }, required: ["source"] }, then: { properties: { payload: BRIEF_PAYLOAD } } }
     ];
     PAGE_PARAMS = {
@@ -8112,25 +8124,26 @@ Judul: ${spec.title}
 Objective: ${spec.objective}${detail}`
   ].filter(Boolean).join("\n\n");
 }
-function startGoalPrompt(spec, branchTo, opts = {}) {
+function startGoalPrompt(flow, spec, branchTo, opts = {}) {
   const m = resolveMethod(opts.method);
   const g = readGoalPayload(spec.payload);
+  const noEffort = flow === "no_effort";
   const detail = [
     `Goal: ${g?.goal ?? spec.objective}`,
     g?.done ? `Selesai bila: ${g.done}` : "",
     g?.constraints ? `Batasan: ${g.constraints}` : ""
   ].filter(Boolean).join("\n");
   return [
-    "hanoman goal \u2014 sesi ini mengejar SATU goal sampai tercapai. TIDAK ada fase Brainstorm, Objective, Spec, maupun Plan: jangan menulis design doc, jangan menulis plan berkotak, jangan memecah pekerjaan ini jadi backlog baru. Langsung kerjakan goal-nya. Tetap ikuti internal/docs sebagai Source of Truth; perbarui docs yang tersentuh dan link-nya di index, dalam commit yang sama.",
+    noEffort ? "hanoman no-effort \u2014 sesi ini mengerjakan SATU pekerjaan remeh lalu berhenti. TIDAK ada fase Brainstorm, Objective, Spec, Plan, maupun fase pembuktian terpisah: jangan menulis design doc, jangan menulis plan berkotak, jangan memecah pekerjaan ini jadi backlog baru, dan jangan menambah fase sendiri. Langsung kerjakan, buktikan seperlunya di fase yang sama, lalu berhenti. Tetap ikuti internal/docs sebagai Source of Truth; perbarui docs yang tersentuh dan link-nya di index, dalam commit yang sama." : "hanoman goal \u2014 sesi ini mengejar SATU goal sampai tercapai. TIDAK ada fase Brainstorm, Objective, Spec, maupun Plan: jangan menulis design doc, jangan menulis plan berkotak, jangan memecah pekerjaan ini jadi backlog baru. Langsung kerjakan goal-nya. Tetap ikuti internal/docs sebagai Source of Truth; perbarui docs yang tersentuh dan link-nya di index, dalam commit yang sama.",
     opts.resume ? resumeClause(opts.resume, branchTo, m.planDir, false) : "",
     detail,
-    phaseInstruction(PIPELINES.goal, m),
-    "Fase Verifikasi bukan formalitas: jalankan perintah yang membuktikan goal-nya tercapai (test/typecheck/benchmark/perintah yang relevan) dan baca outputnya. Klaim tanpa output bukan bukti.",
+    phaseInstruction(PIPELINES[flow], m),
+    noEffort ? "" : "Fase Verifikasi bukan formalitas: jalankan perintah yang membuktikan goal-nya tercapai (test/typecheck/benchmark/perintah yang relevan) dan baca outputnya. Klaim tanpa output bukan bukti.",
     autonomyClause(opts.autonomy),
-    scopeClause("goal", opts.verifyScope),
-    codeStyleClause("goal"),
+    scopeClause(flow, opts.verifyScope),
+    codeStyleClause(flow),
     methodClause(m),
-    skillInstruction(PIPELINES.goal, m, writesCode("goal")),
+    skillInstruction(PIPELINES[flow], m, writesCode(flow)),
     `Setelah fase terakhir: commit, lalu \`git push origin HEAD:refs/heads/${branchTo}\`. Worktree ini detached HEAD \u2014 itu memang disengaja.`,
     `Backlog item ${spec.id} \xB7 sumber ${spec.source} \xB7 prioritas ${spec.priority}
 Judul: ${spec.title}`
@@ -8216,7 +8229,7 @@ Stack: ${project.stack || "\u2014"}`,
 ${cron.prompt}`
   ].join("\n\n");
 }
-var PIPELINES, AUTONOMY_CLAUSE, AUTONOMY_CLAUSE_FULL, autonomyClause, phaseInstruction, skillInstruction, auditDecisionInstruction, ESCALATION_CONTRACT, auditOnlyInstruction, auditContinuationInstruction, writesCode, scopeClause, codeStyleClause, methodClause, PROJECT_METHOD, resumeClause, RESUMED_WORKTREE_NOTE, REVERSE_PHASE_GUIDE, SCAFFOLD_PHASE_GUIDE;
+var PIPELINES, WORK_PHASES, AUTONOMY_CLAUSE, AUTONOMY_CLAUSE_FULL, autonomyClause, phaseInstruction, skillInstruction, auditDecisionInstruction, ESCALATION_CONTRACT, auditOnlyInstruction, auditContinuationInstruction, writesCode, scopeClause, codeStyleClause, methodClause, PROJECT_METHOD, resumeClause, RESUMED_WORKTREE_NOTE, REVERSE_PHASE_GUIDE, SCAFFOLD_PHASE_GUIDE;
 var init_prompt = __esm({
   "../runner/src/prompt.ts"() {
     "use strict";
@@ -8238,8 +8251,14 @@ var init_prompt = __esm({
       // SPEC-407 · ADR-0089 · backlog goal: tak ada fase perencanaan sama sekali. `Goal` = kerjakan,
       // `Verifikasi` = buktikan. Kedua nama unik lintas PIPELINES — syarat peta REACHED di server,
       // yang berkunci nama fase saja.
-      goal: ["Goal", "Verifikasi"]
-    };
+      goal: ["Goal", "Verifikasi"],
+      // SPEC-825 · ADR-0123 · task remeh: SATU fase. Fase `Verifikasi` milik flow goal menghabiskan
+      // satu giliran agen untuk membuktikan sesuatu yang diff-nya sendiri sudah membuktikan; untuk
+      // ganti copy / bump konstanta / typo docs itu murni biaya. Nama `Kerjakan` unik lintas
+      // PIPELINES — syarat peta REACHED server, yang berkunci nama fase saja.
+      no_effort: ["Kerjakan"]
+    };
+    WORK_PHASES = ["Execute", "Goal", "Kerjakan"];
     AUTONOMY_CLAUSE = 'Jalankan seluruh pipeline sampai tuntas tanpa berhenti di batas antar-fase. Checkpoint "review"/"approval"/"need review" milik skill superpowers BUKAN titik berhenti di sini \u2014 lanjut saja ke fase berikutnya. Berhenti HANYA saat butuh keputusan manusia sejati (percabangan yang mengubah bentuk kerja: data model, kontrak API, scope); saat itu tanyakan di terminal ini dan tunggu jawabannya. Selain itu, terus lanjut.';
     AUTONOMY_CLAUSE_FULL = "Kamu berjalan TANPA pengawas \u2014 tak ada manusia yang menonton terminal ini untuk menjawab. Putuskan sendiri di SETIAP percabangan (termasuk yang mengubah bentuk kerja: data model, kontrak API, scope) berdasarkan Source of Truth dan penilaian terbaikmu; JANGAN berhenti bertanya. Tembus seluruh pipeline sampai stage `done`, lalu commit & push. Jangan menunggu review/persetujuan siapa pun \u2014 catat asumsi & keputusan penting di pesan commit agar bisa di-review pasca-fakta. Merge ke branch utama tetap dilakukan manusia, bukan kamu.";
     autonomyClause = (mode) => mode === "full-control" ? AUTONOMY_CLAUSE_FULL : AUTONOMY_CLAUSE;
@@ -8293,7 +8312,7 @@ ${lines2.join("\n")}` : "";
         return `Backlog brief ini LANJUTAN dari audit ${fromAudit}. Worktree ini lahir dari branch audit itu, jadi dokumen audit sudah ada di ${doc}. BACA dokumen itu lebih dulu dan pakai sebagai bahan fase Brainstorm & Objective \u2014 temuannya sudah terbukti, jangan menginvestigasi ulang dari nol. Semua fase tetap dijalankan: dokumen audit memuat TEMUAN, bukan bentuk solusi, jadi perancangan fitur tetap pekerjaanmu.`;
       return `Backlog qa ini LANJUTAN dari audit ${fromAudit}. Worktree ini lahir dari branch audit itu, jadi dokumen audit sudah ada di ${doc}. JANGAN mengulang investigasi fase Audit dari nol \u2014 baca dokumen audit itu sebagai temuan, tandai fase Audit dilewati (\`echo "Audit skipped" >> "$HANOMAN_PHASE_FILE"\`), lalu ambil keputusan pasca-Audit: perbaikan jelas & kecil \u2192 langsung Execute (tandai \`Spec skipped\` dan \`Plan skipped\` bila sesuai); selain itu Spec \u2192 Plan \u2192 Execute penuh.`;
     };
-    writesCode = (flow) => PIPELINES[flow].includes("Execute") || PIPELINES[flow].includes("Goal");
+    writesCode = (flow) => PIPELINES[flow].some((p) => WORK_PHASES.includes(p));
     scopeClause = (flow, scope) => scope && writesCode(flow) ? verifyScopeClause(scope) : "";
     codeStyleClause = (flow) => writesCode(flow) ? CODE_STYLE_CLAUSE : "";
     methodClause = (method) => method.extraClause ?? "";
@@ -8484,7 +8503,7 @@ var init_settings = __esm({
 });
 
 // ../runner/src/goal.ts
-function goalFlowCondition(specId, branchTo, spec) {
+function goalFlowCondition(flow, specId, branchTo, spec) {
   const g = readGoalPayload(spec?.payload);
   const goal = g?.goal || (spec?.objective ?? "").trim() || "(goal tak tercatat di backlog item)";
   const bukti = g?.done || goal;
@@ -8492,13 +8511,13 @@ function goalFlowCondition(specId, branchTo, spec) {
     `Sesi goal hanoman ${specId}. GOAL: ${goal}`,
     "Sesi ini hanya boleh berhenti bila transkrip TERBARU memuat bukti langsung semua hal berikut:",
     `1. goal tercapai \u2014 ${bukti};`,
-    `2. output \`cat "$HANOMAN_PHASE_FILE"\` yang memuat satu baris untuk SETIAP fase ${PIPELINES.goal.join(" \u2192 ")}, masing-masing berakhiran \`done\` atau \`skipped\`;`,
+    `2. output \`cat "$HANOMAN_PHASE_FILE"\` yang memuat satu baris untuk SETIAP fase ${PIPELINES[flow].join(" \u2192 ")}, masing-masing berakhiran \`done\` atau \`skipped\`;`,
     `3. output \`git push origin HEAD:refs/heads/${branchTo}\` yang SUKSES sesudah commit terakhir.`,
     "Bila salah satu bukti tak ada di transkrip terbaru, kondisi BELUM terpenuhi: jalankan perintah verifikasinya, tuntaskan yang masih kurang, lalu lanjutkan \u2014 jangan berhenti."
   ].join("\n");
 }
 function defaultGoalCondition({ flow, specId, branchTo, spec }) {
-  if (flow === "goal") return goalFlowCondition(specId, branchTo, spec);
+  if (isGoalShapedFlow(flow)) return goalFlowCondition(flow, specId, branchTo, spec);
   const phases = PIPELINES[flow];
   const planGate = phases.includes("Plan") && phases.includes("Execute");
   const clauses = [
@@ -9293,7 +9312,7 @@ function readPhases(file, flow) {
 function stageFor(phases) {
   let best = -1;
   for (const p of phases) {
-    if ((p.name === "Execute" || p.name === "Goal") && p.state === "active")
+    if (WORK_PHASES.includes(p.name) && p.state === "active")
       best = Math.max(best, STAGES.indexOf("executing"));
     if (p.state !== "done" && p.state !== "skipped") continue;
     const s2 = REACHED[p.name];
@@ -9350,7 +9369,10 @@ var init_session_phases = __esm({
       // SPEC-407 · ADR-0089 · flow goal (Goal → Verifikasi): fase kerja mencapai `executing`, fase
       // verifikasi yang mencapai `done`. Kedua nama unik lintas PIPELINES — peta ini berkunci nama.
       Goal: "executing",
-      Verifikasi: "done"
+      Verifikasi: "done",
+      // SPEC-825 · ADR-0123 · flow no_effort (Kerjakan): satu fase, jadi fase kerjanya sendiri yang
+      // mencapai `done` — tak ada fase verifikasi untuk menutupnya.
+      Kerjakan: "done"
     };
     phasesComplete = (phases) => phases.length > 0 && phases.every((p) => p.state === "done" || p.state === "skipped");
   }
@@ -11626,9 +11648,9 @@ var init_config3 = __esm({
 // src/services/telegram/protocol.ts
 import { createHash as createHash2 } from "node:crypto";
 function normalizeTelegramCommand(text) {
-  const clean = text.trim();
-  const match = clean.match(/^\/([a-z0-9_]+)(?:@[a-z0-9_]+)?(?:\s+([\s\S]*))?$/i);
-  if (!match) return clean;
+  const clean2 = text.trim();
+  const match = clean2.match(/^\/([a-z0-9_]+)(?:@[a-z0-9_]+)?(?:\s+([\s\S]*))?$/i);
+  if (!match) return clean2;
   const args = match[2]?.trim().replace(/\s+/g, " ");
   return `/${match[1].toLowerCase()}${args ? ` ${args}` : ""}`;
 }
@@ -11694,19 +11716,19 @@ function inboundDigest(input) {
   return createHash2("sha256").update(`${input.updateId}\0${input.chatId}\0${input.userId}\0${input.kind}\0${input.text}`, "utf8").digest("hex");
 }
 function sanitizeTelegramOutput(text, exactSecrets = []) {
-  let clean = text.replace(ANSI, "").replace(CONTROLS, "");
+  let clean2 = text.replace(ANSI, "").replace(CONTROLS, "");
   for (const secret of [...exactSecrets].filter(Boolean).sort((a, b) => b.length - a.length)) {
-    clean = clean.split(secret).join("[REDACTED]");
+    clean2 = clean2.split(secret).join("[REDACTED]");
   }
-  for (const pattern of CREDENTIAL_PATTERNS) clean = clean.replace(pattern, "[REDACTED]");
-  return clean.trim();
+  for (const pattern of CREDENTIAL_PATTERNS) clean2 = clean2.replace(pattern, "[REDACTED]");
+  return clean2.trim();
 }
 function splitTelegramText(text, max = 4096, exactSecrets = []) {
   if (!Number.isInteger(max) || max < 1) throw new Error("max harus integer positif");
-  const clean = sanitizeTelegramOutput(text, exactSecrets);
-  if (!clean) return [];
+  const clean2 = sanitizeTelegramOutput(text, exactSecrets);
+  if (!clean2) return [];
   const chunks = [];
-  let rest = clean;
+  let rest = clean2;
   while (rest.length > max) {
     let cut = max;
     const before2 = rest.charCodeAt(cut - 1);
@@ -18558,11 +18580,11 @@ var require_clean = __commonJS({
   "../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/clean.js"(exports, module) {
     "use strict";
     var parse3 = require_parse();
-    var clean = (version2, options2) => {
+    var clean2 = (version2, options2) => {
       const s2 = parse3(version2.trim().replace(/^[=v]+/, ""), options2);
       return s2 ? s2.version : null;
     };
-    module.exports = clean;
+    module.exports = clean2;
   }
 });
 
@@ -19959,7 +19981,7 @@ var require_semver2 = __commonJS({
     var identifiers = require_identifiers();
     var parse3 = require_parse();
     var valid = require_valid();
-    var clean = require_clean();
+    var clean2 = require_clean();
     var inc = require_inc();
     var diff = require_diff();
     var major = require_major();
@@ -19998,7 +20020,7 @@ var require_semver2 = __commonJS({
     module.exports = {
       parse: parse3,
       valid,
-      clean,
+      clean: clean2,
       inc,
       diff,
       major,
@@ -24356,7 +24378,7 @@ var require_multipart2 = __commonJS({
     var Busboy = require_main();
     var os = __require("node:os");
     var fp = require_fastify_plugin();
-    var { createWriteStream } = __require("node:fs");
+    var { createWriteStream: createWriteStream2 } = __require("node:fs");
     var { unlink: unlink6 } = __require("node:fs/promises");
     var path2 = __require("node:path");
     var { generateId } = require_generateId();
@@ -24736,7 +24758,7 @@ var require_multipart2 = __commonJS({
             continue;
           }
           const filepath = path2.join(tmpdir5, generateId() + path2.extname(part.filename || "file" + i++));
-          const target2 = createWriteStream(filepath);
+          const target2 = createWriteStream2(filepath);
           try {
             this.tmpUploads.push(filepath);
             await pump2(part.file, target2);
@@ -24983,6 +25005,7 @@ async function resolveRepoEntry(root, rel, opts = {}) {
   for (let i = 0; i < parts.length; i++) {
     current = join6(current, parts[i]);
     const stat2 = await lstat(current).catch((error) => {
+      if (error.code === "ENOENT" && opts.allowMissingTail) return null;
       if (error.code === "ENOENT" && opts.allowMissingFinal && i === parts.length - 1) return null;
       return denied("komponen tidak ada");
     });
@@ -25859,7 +25882,7 @@ async function nextSpecId(repoDir) {
 // src/services/spec-fields.ts
 init_src();
 function deriveSpecFields(source, payload, manualPriority) {
-  if (source === "goal") {
+  if (payloadShapeFor(source) === "goal") {
     const pick2 = (v) => typeof v === "string" ? v.trim() : "";
     return {
       priority: manualPriority,
@@ -28731,7 +28754,7 @@ async function specs_default(app2) {
             source: b.source,
             stage: "brainstorming",
             priority,
-            author: isQa ? `QA \xB7 ${author}` : b.source === "audit" ? `Audit \xB7 ${author}` : b.source === "goal" ? `Goal \xB7 ${author}` : author,
+            author: isQa ? `QA \xB7 ${author}` : b.source === "audit" ? `Audit \xB7 ${author}` : b.source === "goal" ? `Goal \xB7 ${author}` : b.source === "no_effort" ? `No effort \xB7 ${author}` : author,
             objective,
             payload: b.payload,
             branchFrom: b.branchFrom ?? null,
@@ -29373,10 +29396,10 @@ async function listGraph(repoDir, limit = 200, opts = {}) {
       const [sha, parents, author, at, subject, refs2] = line.split(US);
       const tags = [], branchRefs = [];
       for (const d of (refs2 ?? "").split(",").map((r) => r.trim()).filter(Boolean)) {
-        const clean = d.replace(/^HEAD -> /, "");
-        if (clean === "HEAD") continue;
-        if (clean.startsWith("tag: ")) tags.push(clean.slice(5));
-        else branchRefs.push(clean);
+        const clean2 = d.replace(/^HEAD -> /, "");
+        if (clean2 === "HEAD") continue;
+        if (clean2.startsWith("tag: ")) tags.push(clean2.slice(5));
+        else branchRefs.push(clean2);
       }
       return {
         sha,
@@ -29852,6 +29875,85 @@ async function deleteBranches(repoDir, names, opts) {
   return { base: report.base, results };
 }
 
+// src/services/repo-fs.ts
+import { lstat as lstat2, rename as rename2, rm as rm3 } from "node:fs/promises";
+import { createWriteStream } from "node:fs";
+import { join as join9 } from "node:path";
+import { randomUUID as randomUUID5 } from "node:crypto";
+import { pipeline } from "node:stream/promises";
+var EntryExistsError = class extends Error {
+  code = "ENTRY_EXISTS";
+};
+var EntryMissingError = class extends Error {
+  code = "ENTRY_MISSING";
+};
+var EntryTargetInsideError = class extends Error {
+  code = "ENTRY_TARGET_INSIDE";
+};
+function assertNotGit(rel) {
+  if (rel.split(/[\\/]/).includes(".git"))
+    throw new PathContainmentError("repository path ditolak: tidak boleh menyentuh .git");
+}
+var clean = (s2) => s2.trim().replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
+function joinRel(dir2, name2) {
+  const d = clean(dir2), n2 = clean(name2);
+  if (!n2) throw new PathContainmentError("repository path ditolak: nama berkas kosong");
+  return d ? `${d}/${n2}` : n2;
+}
+async function entryKind(repoDir, rel) {
+  assertNotGit(rel);
+  const { path: path2 } = await resolveRepoEntry(repoDir, rel, { allowMissingTail: true });
+  const st = await lstat2(path2).catch(() => null);
+  if (!st) return null;
+  return st.isDirectory() ? "dir" : "file";
+}
+async function createEntry(repoDir, rel, kind) {
+  if (await entryKind(repoDir, rel)) throw new EntryExistsError(`sudah ada: ${rel}`);
+  await writeRepoFileAtomic(repoDir, kind === "dir" ? `${clean(rel)}/.gitkeep` : rel, "");
+  return { path: rel };
+}
+async function renameEntry(repoDir, from, to) {
+  const kind = await entryKind(repoDir, from);
+  if (!kind) throw new EntryMissingError(`tidak ada: ${from}`);
+  if (await entryKind(repoDir, to)) throw new EntryExistsError(`sudah ada: ${to}`);
+  if (kind === "dir" && `${clean(to)}/`.startsWith(`${clean(from)}/`))
+    throw new EntryTargetInsideError("tujuan di dalam sumber");
+  await ensureRepoParents(repoDir, to);
+  const src = await resolveRepoEntry(repoDir, from);
+  const dst = await resolveRepoEntry(repoDir, to, { allowMissingFinal: true });
+  await rename2(src.path, dst.path);
+  return { from, to };
+}
+async function deleteEntry(repoDir, rel) {
+  const kind = await entryKind(repoDir, rel);
+  if (!kind) throw new EntryMissingError(`tidak ada: ${rel}`);
+  const { path: path2 } = await resolveRepoEntry(repoDir, rel);
+  await rm3(path2, { recursive: kind === "dir", force: false });
+  return { path: rel, kind };
+}
+async function saveUpload(repoDir, rel, source, opts = {}) {
+  assertNotGit(rel);
+  await ensureRepoParents(repoDir, rel);
+  const entry = await resolveRepoEntry(repoDir, rel, { allowMissingFinal: true });
+  const current = await lstat2(entry.path).catch(() => null);
+  if (current && !opts.overwrite) return { status: "exists" };
+  if (current && !current.isFile())
+    throw new PathContainmentError("repository path ditolak: target bukan file regular");
+  const temp = join9(entry.parent, `.hanoman-${randomUUID5()}.tmp`);
+  try {
+    await pipeline(source, createWriteStream(temp, { flags: "wx", mode: 384 }));
+    if (opts.isTruncated?.()) {
+      await rm3(temp, { force: true });
+      return { status: "too-large" };
+    }
+    await rename2(temp, entry.path);
+    return { status: "written" };
+  } catch (error) {
+    await rm3(temp, { force: true });
+    throw error;
+  }
+}
+
 // src/routes/ide.ts
 async function repoOf(id) {
   const p = await prisma.project.findUnique({ where: { id } });
@@ -29870,6 +29972,19 @@ async function lockInputs(id) {
     sessionBranches: new Set(sessions)
   };
 }
+function entryError(reply, e) {
+  if (e instanceof EntryMissingError) return reply.code(404).send({ error: "not found" });
+  if (e instanceof EntryExistsError) return reply.code(409).send({ error: "sudah ada" });
+  if (e instanceof EntryTargetInsideError) return reply.code(400).send({ error: "tujuan di dalam sumber" });
+  return reply.code(400).send({ error: e.message });
+}
+var UPLOAD_LIMITS = {
+  fileSize: 100 * 1024 * 1024,
+  files: 1e3,
+  fields: 10,
+  fieldSize: 1024 * 1024
+};
+var UPLOAD_TOTAL_MAX = 2 * 1024 * 1024 * 1024;
 async function ide_default(app2) {
   app2.get("/projects/:id/tree", async (req, reply) => {
     const repoDir = await repoOf(req.params.id);
@@ -29934,6 +30049,102 @@ async function ide_default(app2) {
       return reply.code(400).send({ error: e.message });
     }
   });
+  app2.post("/projects/:id/entry", async (req, reply) => {
+    const repoDir = await repoOf(req.params.id);
+    if (repoDir === void 0) return reply.code(404).send({ error: "not found" });
+    if (!repoDir) return reply.code(400).send({ error: "project tidak punya repoDir" });
+    const b = req.body;
+    if (!b?.path || typeof b.path !== "string") return reply.code(400).send({ error: "path wajib" });
+    if (b.kind !== "file" && b.kind !== "dir") return reply.code(400).send({ error: "kind harus file atau dir" });
+    try {
+      return reply.code(201).send(await createEntry(repoDir, b.path, b.kind));
+    } catch (e) {
+      return entryError(reply, e);
+    }
+  });
+  app2.patch("/projects/:id/entry", async (req, reply) => {
+    const repoDir = await repoOf(req.params.id);
+    if (repoDir === void 0) return reply.code(404).send({ error: "not found" });
+    if (!repoDir) return reply.code(400).send({ error: "project tidak punya repoDir" });
+    const b = req.body;
+    if (!b?.from || !b?.to || typeof b.from !== "string" || typeof b.to !== "string")
+      return reply.code(400).send({ error: "from & to wajib" });
+    try {
+      return await renameEntry(repoDir, b.from, b.to);
+    } catch (e) {
+      return entryError(reply, e);
+    }
+  });
+  app2.delete("/projects/:id/entry", async (req, reply) => {
+    const repoDir = await repoOf(req.params.id);
+    if (repoDir === void 0) return reply.code(404).send({ error: "not found" });
+    if (!repoDir) return reply.code(400).send({ error: "project tidak punya repoDir" });
+    const { path: path2 } = req.query;
+    if (!path2) return reply.code(400).send({ error: "path wajib" });
+    try {
+      return await deleteEntry(repoDir, path2);
+    } catch (e) {
+      return entryError(reply, e);
+    }
+  });
+  app2.post("/projects/:id/upload", async (req, reply) => {
+    const repoDir = await repoOf(req.params.id);
+    if (repoDir === void 0) return reply.code(404).send({ error: "not found" });
+    if (!repoDir) return reply.code(400).send({ error: "project tidak punya repoDir" });
+    if (!req.isMultipart?.()) return reply.code(400).send({ error: "butuh multipart/form-data" });
+    const totalMax = Number(process.env.HANOMAN_IDE_UPLOAD_MAX_BYTES) || UPLOAD_TOTAL_MAX;
+    let dir2 = "", overwrite = false, manifest = null, seen = 0, total = 0;
+    const written = [];
+    const skipped2 = [];
+    for await (const part of req.parts({ limits: UPLOAD_LIMITS })) {
+      if (part.type === "field") {
+        if (part.fieldname === "dir") dir2 = String(part.value ?? "");
+        else if (part.fieldname === "overwrite") overwrite = part.value === "1" || part.value === "true";
+        else if (part.fieldname === "manifest") {
+          try {
+            const parsed = JSON.parse(String(part.value));
+            if (!Array.isArray(parsed) || parsed.some((p) => typeof p !== "string")) throw new Error("bentuk");
+            manifest = parsed;
+          } catch {
+            return reply.code(400).send({ error: "manifest tak sah" });
+          }
+        }
+        continue;
+      }
+      const name2 = manifest ? manifest[seen] : part.filename;
+      seen++;
+      if (name2 === void 0) {
+        part.file.resume();
+        return reply.code(400).send({ error: "manifest tak cocok dengan berkas" });
+      }
+      let rel = name2;
+      try {
+        rel = joinRel(dir2, name2);
+        if (total >= totalMax) {
+          part.file.resume();
+          skipped2.push({ path: rel, reason: "budget" });
+          continue;
+        }
+        const r = await saveUpload(repoDir, rel, part.file, {
+          overwrite,
+          isTruncated: () => part.file.truncated === true
+        });
+        if (r.status === "written") {
+          written.push(rel);
+          total += Number(part.file.bytesRead ?? 0);
+        } else {
+          part.file.resume();
+          skipped2.push({ path: rel, reason: r.status });
+        }
+      } catch {
+        part.file.resume();
+        skipped2.push({ path: name2, reason: "denied" });
+      }
+    }
+    if (manifest && seen !== manifest.length)
+      return reply.code(400).send({ error: "manifest tak cocok dengan berkas" });
+    return { written, skipped: skipped2 };
+  });
   app2.get("/projects/:id/graph", async (req, reply) => {
     const repoDir = await repoOf(req.params.id);
     if (repoDir === void 0) return reply.code(404).send({ error: "not found" });
@@ -30172,14 +30383,14 @@ async function finishGraphOp(reply, id, repoDir, r, verb) {
 // src/routes/fs.ts
 import { readdir } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
-import { resolve as resolve13, dirname as dirname9, join as join9 } from "node:path";
+import { resolve as resolve13, dirname as dirname9, join as join10 } from "node:path";
 async function fs_default(app2) {
   app2.get("/fs/browse", async (req, reply) => {
     const q = req.query.path;
     const dir2 = q && q.trim() ? resolve13(q.trim()) : homedir4();
     try {
       const ents = await readdir(dir2, { withFileTypes: true });
-      const entries = ents.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, path: join9(dir2, e.name) })).sort((a, b) => a.name.localeCompare(b.name));
+      const entries = ents.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, path: join10(dir2, e.name) })).sort((a, b) => a.name.localeCompare(b.name));
       const parent = dirname9(dir2);
       return { path: dir2, parent: parent === dir2 ? null : parent, entries };
     } catch {
@@ -30253,7 +30464,7 @@ async function startSpecSession(spec, opts) {
   const worktree = `${repoDir}/.worktrees/${id}`;
   const branchTo = `hanoman/${id}`;
   const resume = !isContinue && spec.baseSha ? resumeState(repoDir, worktree, branchTo, spec.headSha) : null;
-  const isGoalFlow = opts.flow === "goal";
+  const isGoalFlow = isGoalShapedFlow(opts.flow);
   const goalArgs = {
     flow: opts.flow,
     specId: spec.id,
@@ -30295,7 +30506,7 @@ async function startSpecSession(spec, opts) {
   const resumeCtx = resume ? buildResumeCtx(repoDir, id, opts.flow, resume.worktreeKept) : void 0;
   let prompt;
   if (isGoalFlow) {
-    prompt = startGoalPrompt(brief, branchTo, {
+    prompt = startGoalPrompt(opts.flow, brief, branchTo, {
       autonomy: opts.autonomy,
       verifyScope,
       resume: resumeCtx,
@@ -30625,15 +30836,15 @@ function ownsWorktree(repoDir, cwd) {
 init_src2();
 init_db();
 import { execFile as execFile8 } from "node:child_process";
-import { readdir as readdir2, rm as rm3 } from "node:fs/promises";
+import { readdir as readdir2, rm as rm4 } from "node:fs/promises";
 import { promisify as promisify9 } from "node:util";
-import { join as join10, resolve as resolve15 } from "node:path";
+import { join as join11, resolve as resolve15 } from "node:path";
 init_notifications();
 var TICK_MS = 6e4;
 var trashDirOf = (repoDir) => resolve15(repoDir, ".worktrees", ".trash");
 var exec8 = promisify9(execFile8);
 var prodReaperDeps = {
-  rm: (path2) => rm3(path2, { recursive: true, force: true }),
+  rm: (path2) => rm4(path2, { recursive: true, force: true }),
   prune: async (repoDir) => {
     try {
       await exec8("git", ["worktree", "prune"], { cwd: repoDir, timeout: 3e4 });
@@ -30687,7 +30898,7 @@ async function sweepRepo(repoDir, projectId, deps = prodReaperDeps) {
   }
   let removed = 0;
   for (const entry of entries) {
-    const path2 = join10(dir2, entry);
+    const path2 = join11(dir2, entry);
     const known = pending.get(path2);
     const row = known ?? { path: path2, repoDir, projectId, entry, sessionId: sessionIdOf(entry), since: Date.now() };
     pending.set(path2, row);
@@ -31306,7 +31517,7 @@ init_config2();
 import { spawn as spawn3 } from "node:child_process";
 import { mkdtempSync, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname10, join as join11 } from "node:path";
+import { dirname as dirname10, join as join12 } from "node:path";
 var sshBin = () => effectiveStr("HANOMAN_SSH_BIN") ?? "ssh";
 function consoleArgv(t) {
   return [
@@ -31321,8 +31532,8 @@ function consoleArgv(t) {
   ];
 }
 function askpassScript() {
-  const dir2 = mkdtempSync(join11(tmpdir3(), "hanoman-askpass-"));
-  const path2 = join11(dir2, "askpass.sh");
+  const dir2 = mkdtempSync(join12(tmpdir3(), "hanoman-askpass-"));
+  const path2 = join12(dir2, "askpass.sh");
   writeFileSync4(path2, `#!/bin/sh
 printf '%s' "$HANOMAN_SSH_PASSWORD"
 `, { mode: 448 });
@@ -31383,15 +31594,15 @@ function sshExec(t, remoteCmd, opts = {}) {
 // src/services/vps-audit.ts
 init_db();
 import { readFileSync as readFileSync7 } from "node:fs";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 
 // src/runner/deps.ts
 import { existsSync as existsSync11 } from "node:fs";
-import { dirname as dirname11, join as join12 } from "node:path";
+import { dirname as dirname11, join as join13 } from "node:path";
 function repoRootFrom(startDir) {
   let dir2 = startDir;
   for (let i = 0; i < 8; i++) {
-    if (existsSync11(join12(dir2, "pnpm-workspace.yaml"))) return dir2;
+    if (existsSync11(join13(dir2, "pnpm-workspace.yaml"))) return dir2;
     const parent = dirname11(dir2);
     if (parent === dir2) break;
     dir2 = parent;
@@ -31497,7 +31708,7 @@ function parseHealth(out3) {
   return { uptime: h.uptime ?? "", disk: h.disk ?? "", mem: h.mem ?? "", load: h.load ?? "" };
 }
 var target = (v) => ({ host: v.host, port: v.port, user: v.user, keyPath: v.keyPath });
-var scriptPath = (f) => join13(repoRoot(), "server", "scripts", "vps", f);
+var scriptPath = (f) => join14(repoRoot(), "server", "scripts", "vps", f);
 async function itemStatesOf(vpsId) {
   const rows = await prisma.vpsItemState.findMany({ where: { vpsId } });
   return Object.fromEntries(rows.map((s2) => [s2.itemId, { na: s2.na, attested: s2.attested }]));
@@ -31646,11 +31857,11 @@ init_config2();
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync9 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join14 } from "node:path";
-var keyDir = () => effectiveStr("HANOMAN_SSH_KEY_DIR") ?? join14(homedir5(), ".hanoman");
+import { join as join15 } from "node:path";
+var keyDir = () => effectiveStr("HANOMAN_SSH_KEY_DIR") ?? join15(homedir5(), ".hanoman");
 function ensureHanomanKey() {
   const dir2 = keyDir();
-  const privPath = join14(dir2, "id_ed25519");
+  const privPath = join15(dir2, "id_ed25519");
   const pubPath = `${privPath}.pub`;
   if (!existsSync12(privPath)) {
     mkdirSync8(dir2, { recursive: true, mode: 448 });
@@ -31888,7 +32099,7 @@ init_config2();
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { readFileSync as readFileSync11 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 var USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 var TTL_MS2 = 3e4;
 var lastOk = null;
@@ -31901,7 +32112,7 @@ var LABELS = {
 var humanize = (k) => k.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
 var nowIso = () => (/* @__PURE__ */ new Date()).toISOString();
 function credsFile() {
-  return join15(effectiveStr("CLAUDE_CONFIG_DIR") ?? join15(homedir7(), ".claude"), ".credentials.json");
+  return join16(effectiveStr("CLAUDE_CONFIG_DIR") ?? join16(homedir7(), ".claude"), ".credentials.json");
 }
 function readAccessToken() {
   if (process.platform === "darwin" && !effectiveStr("CLAUDE_CONFIG_DIR")) {
@@ -31975,14 +32186,14 @@ async function getLimits() {
 // src/services/codex-limits.ts
 import { open as open3, readdir as readdir3, stat } from "node:fs/promises";
 import { homedir as homedir8 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 var TTL_MS3 = 3e4;
 var STALE_AFTER_MS = 12 * 36e5;
 var TAIL_BYTES = 512 * 1024;
 var MAX_FILES = 8;
 var cache2 = null;
 var freshUntil2 = 0;
-var codexSessionsDir = () => join16(process.env.CODEX_HOME ?? join16(homedir8(), ".codex"), "sessions");
+var codexSessionsDir = () => join17(process.env.CODEX_HOME ?? join17(homedir8(), ".codex"), "sessions");
 var UNAVAILABLE = { status: "unavailable", windows: [], fetchedAt: null, plan: null };
 function windowLabel(minutes) {
   if (minutes === 300) return "Sesi 5 jam";
@@ -32015,7 +32226,7 @@ async function recentRollouts(dir2) {
     return [];
   }
   const stamped = await Promise.all(entries.map(async (rel) => {
-    const full = join16(dir2, rel);
+    const full = join17(dir2, rel);
     try {
       return { full, mtime: (await stat(full)).mtimeMs };
     } catch {
@@ -32671,17 +32882,17 @@ async function session_results_default(app2) {
 // src/services/session-history.ts
 init_db();
 init_pty();
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 
 // src/services/transcript-store.ts
 init_config2();
 init_src2();
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 import { mkdir as mkdir3, writeFile as writeFile2, readFile as readFile3, unlink as unlink3 } from "node:fs/promises";
-import { join as join17, resolve as resolve17, basename as basename4 } from "node:path";
+import { join as join18, resolve as resolve17, basename as basename4 } from "node:path";
 var MAX_TRANSCRIPT_BYTES = 1024 * 1024;
 function transcriptDir() {
-  return resolve17(effectiveStr("HANOMAN_TRANSCRIPT_DIR") ?? join17(resolveHome(), "transcripts"));
+  return resolve17(effectiveStr("HANOMAN_TRANSCRIPT_DIR") ?? join18(resolveHome(), "transcripts"));
 }
 function clamp(text) {
   const buf = Buffer.from(text, "utf8");
@@ -32698,21 +32909,21 @@ async function saveTranscript(text) {
   const { body, truncated } = clamp(text);
   const dir2 = transcriptDir();
   await mkdir3(dir2, { recursive: true, mode: 448 });
-  const key = `${randomUUID5()}.log`;
-  await writeFile2(join17(dir2, key), body, { encoding: "utf8", mode: 384 });
+  const key = `${randomUUID6()}.log`;
+  await writeFile2(join18(dir2, key), body, { encoding: "utf8", mode: 384 });
   return { key, bytes: Buffer.byteLength(body, "utf8"), truncated };
 }
 async function readTranscript(key) {
   if (!key) return null;
   try {
-    return await readFile3(join17(transcriptDir(), basename4(key)), "utf8");
+    return await readFile3(join18(transcriptDir(), basename4(key)), "utf8");
   } catch {
     return null;
   }
 }
 async function deleteTranscript(key) {
   if (!key) return;
-  await unlink3(join17(transcriptDir(), basename4(key))).catch(() => {
+  await unlink3(join18(transcriptDir(), basename4(key))).catch(() => {
   });
 }
 
@@ -32743,7 +32954,7 @@ async function titleFor(specId) {
 async function beginSession(b) {
   await prisma.sessionHistory.create({
     data: {
-      id: randomUUID6(),
+      id: randomUUID7(),
       sessionId: b.sessionId,
       projectId: b.projectId,
       specId: b.specId ?? null,
@@ -32998,10 +33209,10 @@ init_notifications();
 init_uploads();
 
 // src/services/upload-pipeline.ts
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 import { spawn as spawn4 } from "node:child_process";
-import { mkdir as mkdir4, rename as rename2, unlink as unlink4, writeFile as writeFile3 } from "node:fs/promises";
-import { basename as basename5, isAbsolute as isAbsolute4, join as join18 } from "node:path";
+import { mkdir as mkdir4, rename as rename3, unlink as unlink4, writeFile as writeFile3 } from "node:fs/promises";
+import { basename as basename5, isAbsolute as isAbsolute4, join as join19 } from "node:path";
 
 // ../node_modules/.pnpm/strtok3@10.3.5/node_modules/strtok3/lib/stream/Errors.js
 var defaultMessages = "End-Of-Stream";
@@ -40365,7 +40576,7 @@ var dist_default = constructor_default;
 // src/services/upload-pipeline.ts
 init_db();
 init_uploads();
-var UPLOAD_LIMITS = {
+var UPLOAD_LIMITS2 = {
   fileBytes: 5 * 1024 * 1024,
   ticketBytes: 10 * 1024 * 1024,
   projectBytes: 250 * 1024 * 1024,
@@ -40417,7 +40628,7 @@ function scannerFromEnv(path2) {
     const timer9 = setTimeout(() => {
       child.kill("SIGKILL");
       reject2(new UploadError("UPLOAD_SCAN", "scanner timeout"));
-    }, UPLOAD_LIMITS.scanMs);
+    }, UPLOAD_LIMITS2.scanMs);
     child.once("error", (error) => {
       clearTimeout(timer9);
       reject2(error);
@@ -40434,9 +40645,9 @@ function safeFilename(input, extension2) {
   return `${stem || "upload"}${extension2}`;
 }
 async function processUpload(input, deps = {}) {
-  if (input.buffer.byteLength === 0 || input.buffer.byteLength > UPLOAD_LIMITS.fileBytes)
+  if (input.buffer.byteLength === 0 || input.buffer.byteLength > UPLOAD_LIMITS2.fileBytes)
     throw new UploadError("UPLOAD_QUOTA", "file quota exceeded");
-  if (input.ticketBytes + input.buffer.byteLength > UPLOAD_LIMITS.ticketBytes)
+  if (input.ticketBytes + input.buffer.byteLength > UPLOAD_LIMITS2.ticketBytes)
     throw new UploadError("UPLOAD_QUOTA", "ticket quota exceeded");
   const detected = await fileTypeFromBuffer(input.buffer);
   if (!detected || !(detected.mime in TYPES) || detected.mime !== input.clientMime)
@@ -40447,14 +40658,14 @@ async function processUpload(input, deps = {}) {
   let height;
   let normalized;
   try {
-    const source = dist_default(input.buffer, { failOn: "error", limitInputPixels: UPLOAD_LIMITS.pixels, sequentialRead: true });
-    const metadata2 = await timeout2(source.metadata(), UPLOAD_LIMITS.decodeMs, "UPLOAD_DECODE");
+    const source = dist_default(input.buffer, { failOn: "error", limitInputPixels: UPLOAD_LIMITS2.pixels, sequentialRead: true });
+    const metadata2 = await timeout2(source.metadata(), UPLOAD_LIMITS2.decodeMs, "UPLOAD_DECODE");
     width = metadata2.width ?? 0;
     height = metadata2.height ?? 0;
-    if (!width || !height || width > UPLOAD_LIMITS.dimension || height > UPLOAD_LIMITS.dimension || width * height > UPLOAD_LIMITS.pixels) throw new UploadError("UPLOAD_PIXELS", "image dimensions exceed policy");
+    if (!width || !height || width > UPLOAD_LIMITS2.dimension || height > UPLOAD_LIMITS2.dimension || width * height > UPLOAD_LIMITS2.pixels) throw new UploadError("UPLOAD_PIXELS", "image dimensions exceed policy");
     normalized = await timeout2(
-      dist_default(input.buffer, { failOn: "error", limitInputPixels: UPLOAD_LIMITS.pixels, sequentialRead: true }).rotate().toFormat(type.format).toBuffer(),
-      UPLOAD_LIMITS.decodeMs,
+      dist_default(input.buffer, { failOn: "error", limitInputPixels: UPLOAD_LIMITS2.pixels, sequentialRead: true }).rotate().toFormat(type.format).toBuffer(),
+      UPLOAD_LIMITS2.decodeMs,
       "UPLOAD_DECODE"
     );
   } catch (error) {
@@ -40462,21 +40673,21 @@ async function processUpload(input, deps = {}) {
     throw new UploadError("UPLOAD_DECODE", "image decode failed");
   }
   const usage2 = await (deps.usage ?? defaultUsage)(input.projectId);
-  if (usage2.project + normalized.byteLength > UPLOAD_LIMITS.projectBytes || usage2.global + normalized.byteLength > UPLOAD_LIMITS.globalBytes)
+  if (usage2.project + normalized.byteLength > UPLOAD_LIMITS2.projectBytes || usage2.global + normalized.byteLength > UPLOAD_LIMITS2.globalBytes)
     throw new UploadError("UPLOAD_QUOTA", "storage quota exceeded");
   const storageDir = deps.storageDir ?? uploadDir();
-  const quarantineDir = join18(storageDir, ".quarantine");
+  const quarantineDir = join19(storageDir, ".quarantine");
   await mkdir4(quarantineDir, { recursive: true, mode: 448 });
   await mkdir4(storageDir, { recursive: true, mode: 448 });
-  const quarantine = join18(quarantineDir, `${randomUUID7()}.upload`);
-  const storageKey = `${randomUUID7()}${type.extension}`;
+  const quarantine = join19(quarantineDir, `${randomUUID8()}.upload`);
+  const storageKey = `${randomUUID8()}${type.extension}`;
   await writeFile3(quarantine, normalized, { mode: 384, flag: "wx" });
   try {
-    await timeout2((deps.scanner ?? scannerFromEnv)(quarantine), UPLOAD_LIMITS.scanMs, "UPLOAD_SCAN");
+    await timeout2((deps.scanner ?? scannerFromEnv)(quarantine), UPLOAD_LIMITS2.scanMs, "UPLOAD_SCAN");
     const finalUsage = await (deps.usage ?? defaultUsage)(input.projectId);
-    if (finalUsage.project + normalized.byteLength > UPLOAD_LIMITS.projectBytes || finalUsage.global + normalized.byteLength > UPLOAD_LIMITS.globalBytes)
+    if (finalUsage.project + normalized.byteLength > UPLOAD_LIMITS2.projectBytes || finalUsage.global + normalized.byteLength > UPLOAD_LIMITS2.globalBytes)
       throw new UploadError("UPLOAD_QUOTA", "storage quota exceeded");
-    await rename2(quarantine, join18(storageDir, storageKey));
+    await rename3(quarantine, join19(storageDir, storageKey));
   } catch (error) {
     await unlink4(quarantine).catch(() => {
     });
@@ -40699,7 +40910,8 @@ async function acceptTicket(t, opts) {
     steps: "Reproduksi dari keluhan pelapor & lampiran.",
     expected: "Perilaku yang diharapkan pelapor.",
     actual: detail,
-    env: ""
+    env: "",
+    constraints: ""
   } : { context: detail, outcome: "", constraints: "" };
   const repoDir = await resolveRepoDir(t.projectId);
   let spec = null;
@@ -41594,10 +41806,10 @@ init_config2();
 init_pty();
 init_session_sandbox();
 import { execFile as execFile10 } from "node:child_process";
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 import { mkdirSync as mkdirSync9, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 var binFor = (agent) => agent === "codex" ? effectiveStr("HANOMAN_CODEX_BIN") ?? "codex" : effectiveStr("HANOMAN_CLAUDE_BIN") ?? "claude";
 function leadArgv(o) {
   if (o.agent === "codex") {
@@ -41625,11 +41837,11 @@ function leadProcess(prompt, o, env = process.env) {
   const mode = env.HANOMAN_SESSION_SANDBOX ?? (env.NODE_ENV === "production" ? "required" : "off");
   if (mode === "off") return { file, args: directArgs, cwd: o.cwd, cleanup: () => {
   } };
-  const promptDir = join19(tmpdir4(), "hanoman-prompts");
+  const promptDir = join20(tmpdir4(), "hanoman-prompts");
   mkdirSync9(promptDir, { recursive: true, mode: 448 });
-  const promptFile = join19(promptDir, `oneshot-${randomUUID8()}`);
+  const promptFile = join20(promptDir, `oneshot-${randomUUID9()}`);
   writeFileSync5(promptFile, prompt, { flag: "wx", mode: 384 });
-  const workspace = o.cwd ?? join19(tmpdir4(), `hanoman-oneshot-${randomUUID8()}`);
+  const workspace = o.cwd ?? join20(tmpdir4(), `hanoman-oneshot-${randomUUID9()}`);
   if (!o.cwd) mkdirSync9(workspace, { recursive: false, mode: 448 });
   try {
     const argsWithoutPrompt = directArgs.slice(0, -1);
@@ -43418,7 +43630,7 @@ init_db();
 init_src();
 import { readFileSync as readFileSync13 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 var home = () => process.env.HOME || homedir9();
 var readJson2 = (path2) => {
   try {
@@ -43435,7 +43647,7 @@ var serversOf = (node) => {
 var codexServers = () => {
   let text;
   try {
-    text = readFileSync13(join20(home(), ".codex", "config.toml"), "utf8");
+    text = readFileSync13(join21(home(), ".codex", "config.toml"), "utf8");
   } catch {
     return [];
   }
@@ -43448,12 +43660,12 @@ var codexServers = () => {
 };
 function mcpServerNames(repoDir) {
   const names = [];
-  const claudeJson = readJson2(join20(home(), ".claude.json"));
+  const claudeJson = readJson2(join21(home(), ".claude.json"));
   names.push(...serversOf(claudeJson));
   if (repoDir) {
     const projects = claudeJson?.projects;
     if (projects && typeof projects === "object") names.push(...serversOf(projects[repoDir]));
-    names.push(...serversOf(readJson2(join20(repoDir, ".mcp.json"))));
+    names.push(...serversOf(readJson2(join21(repoDir, ".mcp.json"))));
   }
   names.push(...codexServers());
   return [...new Set(names.filter(Boolean))].sort((a, b) => a.localeCompare(b));
@@ -43963,7 +44175,8 @@ ${backlink}`;
     steps: "Reproduksi dari deskripsi issue.",
     expected: "Perilaku yang diharapkan pelapor issue.",
     actual: detail,
-    env: ""
+    env: "",
+    constraints: ""
   } : { context: detail, outcome: "", constraints: "", priority };
   const repoDir = await resolveRepoDir(issue2.projectId).catch(() => null);
   let spec = null;
@@ -44906,17 +45119,17 @@ init_db();
 
 // src/services/bootstrap.ts
 import { createHash as createHash9, randomBytes as randomBytes9, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
-import { chmod, lstat as lstat2, mkdir as mkdir5, readFile as readFile4, unlink as unlink5, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join21 } from "node:path";
+import { chmod, lstat as lstat3, mkdir as mkdir5, readFile as readFile4, unlink as unlink5, writeFile as writeFile4 } from "node:fs/promises";
+import { join as join22 } from "node:path";
 var TTL_MS5 = 15 * 6e4;
 var SETUP_TOKEN_FILE = "setup.token";
 var BootstrapError = class extends Error {
   code = "BOOTSTRAP_PROOF";
 };
-var tokenPath = (home3) => join21(home3, SETUP_TOKEN_FILE);
+var tokenPath = (home3) => join22(home3, SETUP_TOKEN_FILE);
 async function readStored(home3) {
   try {
-    const info = await lstat2(tokenPath(home3));
+    const info = await lstat3(tokenPath(home3));
     if (info.isSymbolicLink() || !info.isFile()) throw new BootstrapError("invalid setup proof");
     const [token, expires] = (await readFile4(tokenPath(home3), "utf8")).trim().split("\n");
     const expiresAt = Date.parse(expires ?? "");
@@ -44929,7 +45142,7 @@ async function readStored(home3) {
 }
 async function ensureSetupToken(home3, now = Date.now()) {
   await mkdir5(home3, { recursive: true, mode: 448 });
-  const homeInfo = await lstat2(home3);
+  const homeInfo = await lstat3(home3);
   if (homeInfo.isSymbolicLink() || !homeInfo.isDirectory()) throw new BootstrapError("invalid setup home");
   await chmod(home3, 448);
   try {
@@ -45123,7 +45336,12 @@ var IDE_SUBS = /* @__PURE__ */ new Set([
   "remotes",
   "compare",
   "archive",
-  "pr-url"
+  "pr-url",
+  // ADR-0121 · operasi berkas Explorer. `rw()` menurunkan read/write DARI METHOD, jadi
+  // POST/PATCH/DELETE menuntut ide:write — capability yang sudah memberi hak menimpa isi
+  // berkas apa pun lewat PUT /file (hindari kelas bug SPEC-405: prefix tanpa lihat method).
+  "entry",
+  "upload"
 ]);
 function capabilityForRoute(method, path2) {
   const read2 = method === "GET" || method === "HEAD";
@@ -45828,7 +46046,7 @@ init_tap();
 // src/services/webhooks/emit.ts
 init_src();
 init_db();
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 function skipped(def2, row) {
   if (!def2.skipWhen || !row) return false;
   return row[def2.skipWhen.field] === def2.skipWhen.equals;
@@ -45894,7 +46112,7 @@ async function emitWebhook(i) {
     const targets = matchingEndpoints(type, projectId);
     if (!targets.length) return;
     const name2 = projectId ? (await prisma.project.findUnique({ where: { id: projectId }, select: { name: true } }))?.name ?? null : null;
-    const env = buildEnvelope(i, name2, (/* @__PURE__ */ new Date()).toISOString(), `evt_${randomUUID9().replace(/-/g, "")}`);
+    const env = buildEnvelope(i, name2, (/* @__PURE__ */ new Date()).toISOString(), `evt_${randomUUID10().replace(/-/g, "")}`);
     if (!env) return;
     await enqueueEnvelope(env, targets);
   } catch (e) {
@@ -46206,14 +46424,14 @@ init_session_sandbox();
 init_src2();
 
 // src/services/secure-home.ts
-import { chmod as chmod2, lstat as lstat3, mkdir as mkdir6 } from "node:fs/promises";
+import { chmod as chmod2, lstat as lstat4, mkdir as mkdir6 } from "node:fs/promises";
 import { isAbsolute as isAbsolute6, resolve as resolve18 } from "node:path";
 var HomePermissionError = class extends Error {
   code = "HOME_SYMLINK";
 };
 async function assertNoSymlink(path2, allowMissing) {
   try {
-    const info = await lstat3(resolve18(path2));
+    const info = await lstat4(resolve18(path2));
     if (info.isSymbolicLink()) throw new HomePermissionError(`symlink ditolak: ${path2}`);
   } catch (error) {
     if (error.code === "ENOENT" && allowMissing) return;