hanoman 0.1.47 → 0.1.50

package/dist/server.js

@@ -5507,6 +5507,10 @@ var init_dto = __esm({
       cwd: external_exports.string(),
       startedAt: external_exports.string(),
       endedAt: external_exports.string().nullable(),
+      // SPEC-844 · ADR-0125 · `string` longgar, bukan enum: baris lama null dan nilai asing dari
+      // instance lebih baru tak boleh melempar di boundary — `sessionOutcome()` yang menafsirkannya.
+      endedReason: external_exports.string().nullable(),
+      reconciledAt: external_exports.string().nullable(),
       exitCode: external_exports.number().nullable(),
       transcriptBytes: external_exports.number().nullable()
     });
@@ -6402,6 +6406,13 @@ var init_session_kind = __esm({
   }
 });
 
+// ../shared/src/session-end.ts
+var init_session_end = __esm({
+  "../shared/src/session-end.ts"() {
+    "use strict";
+  }
+});
+
 // ../shared/src/config.ts
 var zHanomanConfig;
 var init_config = __esm({
@@ -6890,6 +6901,8 @@ var init_webhook = __esm({
           "branch",
           "startedAt",
           "endedAt",
+          "endedReason",
+          "reconciledAt",
           "exitCode"
         ],
         projectIdField: "projectId",
@@ -6898,9 +6911,9 @@ var init_webhook = __esm({
         },
         derived: [{
           type: "session.ended",
-          label: "Sesi selesai atau gagal",
+          label: "Sesi selesai, gagal, atau terputus",
           changed: ["endedAt"],
-          when: "Sesi ditutup dan endedAt terisi. exitCode bukan 0 berarti pane mati gagal; null berarti tak terbaca, misalnya tmux mati di luar hanoman."
+          when: 'Sesi berakhir dan endedAt terisi. endedReason memberi tahu CARANYA: "closed" = hanoman menutupnya, jadi exitCode berlaku (null = agen masih hidup saat ditutup, 0 = keluar bersih, selain itu gagal); "reconciled" = panenya sudah lenyap saat hanoman menyala lagi (reboot, kill-server, host mati) sehingga hasilnya TAK DIKETAHUI, exitCode selalu null, dan reconciledAt menyebut kapan hanoman menemukannya \u2014 endedAt di kasus itu batas BAWAH, bukan waktu berakhir sebenarnya. null = baris lahir sebelum SPEC-844.'
         }],
         sample: {
           id: "6f0c1c1e-1a2b-4c3d-8e9f-0a1b2c3d4e5f",
@@ -6916,6 +6929,8 @@ var init_webhook = __esm({
           branch: "hanoman/spec-481",
           startedAt: "2026-08-01T02:12:31.000Z",
           endedAt: "2026-08-01T09:44:02.000Z",
+          endedReason: "closed",
+          reconciledAt: null,
           exitCode: 0
         }
       },
@@ -7833,6 +7848,7 @@ var init_src = __esm({
     init_portal();
     init_prd_status();
     init_session_kind();
+    init_session_end();
     init_config();
     init_config_registry();
     init_semver();
@@ -8768,6 +8784,16 @@ function resolveHome(env = process.env, home3 = homedir()) {
   const v = env.HANOMAN_HOME?.trim();
   return v ? v : join(home3, ".hanoman");
 }
+function resolveDataDirs(env = process.env, home3 = homedir()) {
+  const root = resolveHome(env, home3);
+  const dir2 = (key, name2) => env[key]?.trim() || join(root, name2);
+  return {
+    home: root,
+    transcripts: dir2("HANOMAN_TRANSCRIPT_DIR", "transcripts"),
+    uploads: dir2("HANOMAN_UPLOAD_DIR", "uploads"),
+    sshKeys: env.HANOMAN_SSH_KEY_DIR?.trim() || root
+  };
+}
 function schemeOf(raw2) {
   return raw2.split("://")[0] ?? "?";
 }
@@ -9728,7 +9754,7 @@ function extFor(mimeType) {
   return EXT[mimeType] ?? ".bin";
 }
 function uploadDir() {
-  return resolve8(effectiveStr("HANOMAN_UPLOAD_DIR") ?? join5(resolveHome(), "uploads"));
+  return resolve8(effectiveStr("HANOMAN_UPLOAD_DIR")?.trim() || resolveDataDirs().uploads);
 }
 function sessionUploadDir(sessionId2) {
   if (!SESSION_ID.test(sessionId2)) throw new Error(`sessionId tak sah: ${sessionId2}`);
@@ -10271,6 +10297,16 @@ function createSession(projectId, cwd, opts = {}) {
   });
   if (opts.decisionFile) mkdirSync4(dirname7(opts.decisionFile), { recursive: true });
   tmux(
+    // tmux menyerahkan argumen perintah `new-session` ke `default-shell`, dan defaultnya adalah
+    // shell login pemanggil di /etc/passwd. Saat hanoman jalan sebagai user service ber-shell
+    // `/usr/sbin/nologin`, SETIAP pane lahir langsung mati ("Attempted login by UNKNOWN") dan tak
+    // satu pun sesi terminal bisa hidup. Dipatok eksplisit — dan wajib mendahului `new-session`,
+    // sama seperti remain-on-exit di bawah.
+    "set-option",
+    "-g",
+    "default-shell",
+    shellBin(),
+    ";",
     "set-option",
     "-g",
     "remain-on-exit",
@@ -20844,7 +20880,7 @@ var require_websocket_server = __commonJS({
     var keyRegex = /^[+/0-9A-Za-z]{22}==$/;
     var RUNNING = 0;
     var CLOSING = 1;
-    var CLOSED = 2;
+    var CLOSED2 = 2;
     var WebSocketServer2 = class extends EventEmitter {
       /**
        * Create a `WebSocketServer` instance.
@@ -20973,7 +21009,7 @@ var require_websocket_server = __commonJS({
        * @public
        */
       close(cb) {
-        if (this._state === CLOSED) {
+        if (this._state === CLOSED2) {
           if (cb) {
             this.once("close", () => {
               cb(new Error("The server is not running"));
@@ -21197,7 +21233,7 @@ var require_websocket_server = __commonJS({
       };
     }
     function emitClose(server) {
-      server._state = CLOSED;
+      server._state = CLOSED2;
       server.emit("close");
     }
     function socketOnError() {
@@ -24983,8 +25019,8 @@ function components(rel) {
 }
 async function canonicalRoot(root) {
   const out3 = await realpath(root).catch(() => denied("root tidak ada"));
-  const stat2 = await lstat(out3);
-  if (!stat2.isDirectory() || stat2.isSymbolicLink()) denied("root bukan direktori regular");
+  const stat3 = await lstat(out3);
+  if (!stat3.isDirectory() || stat3.isSymbolicLink()) denied("root bukan direktori regular");
   return out3;
 }
 function beneath(root, candidate) {
@@ -25002,8 +25038,8 @@ async function ensureRepoParents(root, rel) {
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
     }
-    const stat2 = await lstat(current);
-    if (stat2.isSymbolicLink() || !stat2.isDirectory()) denied("parent tidak aman");
+    const stat3 = await lstat(current);
+    if (stat3.isSymbolicLink() || !stat3.isDirectory()) denied("parent tidak aman");
     const canonical = await realpath(current);
     if (!beneath(base2, canonical) || canonical !== current) denied("parent keluar root");
   }
@@ -25019,8 +25055,8 @@ function ensureRepoParentsSync(root, rel) {
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
     }
-    const stat2 = lstatSync(current);
-    if (stat2.isSymbolicLink() || !stat2.isDirectory()) denied("parent tidak aman");
+    const stat3 = lstatSync(current);
+    if (stat3.isSymbolicLink() || !stat3.isDirectory()) denied("parent tidak aman");
     if (realpathSync2(current) !== current || !beneath(base2, current)) denied("parent keluar root");
   }
 }
@@ -25030,14 +25066,14 @@ async function resolveRepoEntry(root, rel, opts = {}) {
   let current = base2;
   for (let i = 0; i < parts.length; i++) {
     current = join6(current, parts[i]);
-    const stat2 = await lstat(current).catch((error) => {
+    const stat3 = await lstat(current).catch((error) => {
       if (error.code === "ENOENT" && opts.allowMissingTail) return null;
       if (error.code === "ENOENT" && opts.allowMissingFinal && i === parts.length - 1) return null;
       return denied("komponen tidak ada");
     });
-    if (!stat2) break;
-    if (stat2.isSymbolicLink()) denied("symlink");
-    if (i < parts.length - 1 && !stat2.isDirectory()) denied("parent bukan direktori");
+    if (!stat3) break;
+    if (stat3.isSymbolicLink()) denied("symlink");
+    if (i < parts.length - 1 && !stat3.isDirectory()) denied("parent bukan direktori");
   }
   if (!beneath(base2, resolve9(current))) denied("keluar root");
   const parent = resolve9(current, "..");
@@ -25052,9 +25088,9 @@ function assertSafeRepoPathSync(root, rel, allowMissingFinal = false, allowMissi
   for (let i = 0; i < parts.length; i++) {
     current = join6(current, parts[i]);
     try {
-      const stat2 = lstatSync(current);
-      if (stat2.isSymbolicLink()) denied("symlink");
-      if (i < parts.length - 1 && !stat2.isDirectory()) denied("parent bukan direktori");
+      const stat3 = lstatSync(current);
+      if (stat3.isSymbolicLink()) denied("symlink");
+      if (i < parts.length - 1 && !stat3.isDirectory()) denied("parent bukan direktori");
     } catch (error) {
       if (allowMissingTail && error.code === "ENOENT") break;
       if (allowMissingFinal && error.code === "ENOENT" && i === parts.length - 1) break;
@@ -25109,8 +25145,8 @@ async function readRepoFile(root, rel) {
   const entry = await resolveRepoEntry(root, rel);
   const handle = await open2(entry.path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0)).catch(() => denied("final component tidak aman"));
   try {
-    const stat2 = await handle.stat();
-    if (!stat2.isFile()) denied("bukan file regular");
+    const stat3 = await handle.stat();
+    if (!stat3.isFile()) denied("bukan file regular");
     return await handle.readFile();
   } finally {
     await handle.close();
@@ -26560,8 +26596,8 @@ var FileTokenizer = class _FileTokenizer extends AbstractTokenizer {
    */
   static async fromFile(sourceFilePath) {
     const fileHandle = await fsOpen(sourceFilePath, "r");
-    const stat2 = await fileHandle.stat();
-    return new _FileTokenizer(fileHandle, { fileInfo: { path: sourceFilePath, size: stat2.size } });
+    const stat3 = await fileHandle.stat();
+    return new _FileTokenizer(fileHandle, { fileInfo: { path: sourceFilePath, size: stat3.size } });
   }
   constructor(fileHandle, options2) {
     super(options2);
@@ -39673,16 +39709,32 @@ async function buildChecklist(vpsId) {
 }
 
 // src/services/vps-key.ts
+init_src2();
 init_config2();
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync9 } from "node:fs";
+import { chmodSync as chmodSync3, copyFileSync, existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync9, unlinkSync as unlinkSync2 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
 import { join as join17 } from "node:path";
-var keyDir = () => effectiveStr("HANOMAN_SSH_KEY_DIR") ?? join17(homedir5(), ".hanoman");
+var keyDir = () => effectiveStr("HANOMAN_SSH_KEY_DIR") ?? resolveDataDirs().sshKeys;
+var KEY_FILES = ["id_ed25519", "id_ed25519.pub"];
+function adoptLegacyKey(dir2) {
+  if (effectiveStr("HANOMAN_SSH_KEY_DIR")) return;
+  const legacy = join17(homedir5(), ".hanoman");
+  if (legacy === dir2) return;
+  if (!KEY_FILES.every((f) => existsSync12(join17(legacy, f)))) return;
+  mkdirSync8(dir2, { recursive: true, mode: 448 });
+  for (const f of KEY_FILES) {
+    copyFileSync(join17(legacy, f), join17(dir2, f));
+    chmodSync3(join17(dir2, f), 384);
+  }
+  for (const f of KEY_FILES) unlinkSync2(join17(legacy, f));
+  console.log(`vps: key SSH dipindah dari ${legacy} ke ${dir2} (SPEC-846 \u2014 satu batas backup)`);
+}
 function ensureHanomanKey() {
   const dir2 = keyDir();
-  const privPath = join17(dir2, "id_ed25519");
+  const privPath = join17(dir2, KEY_FILES[0]);
   const pubPath = `${privPath}.pub`;
+  if (!existsSync12(privPath)) adoptLegacyKey(dir2);
   if (!existsSync12(privPath)) {
     mkdirSync8(dir2, { recursive: true, mode: 448 });
     execFileSync2(
@@ -40708,11 +40760,11 @@ import { randomUUID as randomUUID8 } from "node:crypto";
 init_config2();
 init_src2();
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { mkdir as mkdir5, writeFile as writeFile4, readFile as readFile4, unlink as unlink4 } from "node:fs/promises";
+import { mkdir as mkdir5, writeFile as writeFile4, readFile as readFile4, unlink as unlink4, readdir as readdir5, stat as stat2 } from "node:fs/promises";
 import { join as join20, resolve as resolve17, basename as basename5 } from "node:path";
 var MAX_TRANSCRIPT_BYTES = 1024 * 1024;
 function transcriptDir() {
-  return resolve17(effectiveStr("HANOMAN_TRANSCRIPT_DIR") ?? join20(resolveHome(), "transcripts"));
+  return resolve17(effectiveStr("HANOMAN_TRANSCRIPT_DIR")?.trim() || resolveDataDirs().transcripts);
 }
 function clamp(text) {
   const buf = Buffer.from(text, "utf8");
@@ -40743,11 +40795,35 @@ async function readTranscript(key) {
 }
 async function deleteTranscript(key) {
   if (!key) return;
-  await unlink4(join20(transcriptDir(), basename5(key))).catch(() => {
-  });
+  try {
+    await unlink4(join20(transcriptDir(), basename5(key)));
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+  }
+}
+async function listTranscripts() {
+  const dir2 = transcriptDir();
+  let names;
+  try {
+    names = await readdir5(dir2);
+  } catch (e) {
+    if (e.code === "ENOENT") return [];
+    throw e;
+  }
+  const rows = [];
+  for (const name2 of names) {
+    if (!name2.endsWith(".log")) continue;
+    try {
+      rows.push({ key: name2, mtimeMs: (await stat2(join20(dir2, name2))).mtimeMs });
+    } catch {
+    }
+  }
+  return rows;
 }
 
 // src/services/session-history.ts
+var CLOSED = "closed";
+var RECONCILED = "reconciled";
 var view5 = (r) => ({
   id: r.id,
   sessionId: r.sessionId,
@@ -40763,6 +40839,8 @@ var view5 = (r) => ({
   cwd: r.cwd,
   startedAt: r.startedAt.toISOString(),
   endedAt: r.endedAt?.toISOString() ?? null,
+  endedReason: r.endedReason,
+  reconciledAt: r.reconciledAt?.toISOString() ?? null,
   exitCode: r.exitCode,
   transcriptBytes: r.transcriptBytes
 });
@@ -40795,11 +40873,19 @@ async function finishSession(d) {
     orderBy: { startedAt: "desc" }
   });
   if (!open4) return;
-  const t = d.transcript ? await saveTranscript(d.transcript) : { key: "", bytes: 0 };
+  let t = { key: "", bytes: 0 };
+  if (d.transcript) {
+    try {
+      t = await saveTranscript(d.transcript);
+    } catch (e) {
+      console.error("riwayat sesi (transkrip tak tersimpan):", e);
+    }
+  }
   await prisma.sessionHistory.update({
     where: { id: open4.id },
     data: {
       endedAt: /* @__PURE__ */ new Date(),
+      endedReason: CLOSED,
       exitCode: d.exitCode,
       transcriptKey: t.key || null,
       transcriptBytes: t.key ? t.bytes : null
@@ -40844,15 +40930,71 @@ async function transcriptOf(id) {
   const text = await readTranscript(r.transcriptKey);
   return text === null ? null : { text, bytes: Buffer.byteLength(text, "utf8") };
 }
+var PURGE_BATCH = 200;
 async function purgeHistory(q) {
   const where = {
     ...q.projectId ? { projectId: q.projectId } : {},
     ...q.before ? { startedAt: { lt: q.before } } : {}
   };
-  const doomed = await prisma.sessionHistory.findMany({ where, select: { transcriptKey: true } });
-  for (const d of doomed) if (d.transcriptKey) await deleteTranscript(d.transcriptKey);
-  const { count } = await prisma.sessionHistory.deleteMany({ where });
-  return count;
+  const doomed = await prisma.sessionHistory.findMany({ where, select: { id: true, transcriptKey: true } });
+  const report = { purged: 0, transcriptsDeleted: 0, transcriptsFailed: 0 };
+  for (let i = 0; i < doomed.length; i += PURGE_BATCH) {
+    const batch = doomed.slice(i, i + PURGE_BATCH);
+    const { count } = await prisma.sessionHistory.deleteMany({ where: { id: { in: batch.map((d) => d.id) } } });
+    report.purged += count;
+    for (const d of batch) {
+      if (!d.transcriptKey) continue;
+      try {
+        await deleteTranscript(d.transcriptKey);
+        report.transcriptsDeleted++;
+      } catch {
+        report.transcriptsFailed++;
+      }
+    }
+  }
+  return report;
+}
+var TRANSCRIPT_GC_GRACE_MS = 60 * 6e4;
+async function reconcileTranscripts(opts = {}) {
+  const rows = await prisma.sessionHistory.findMany({
+    where: { transcriptKey: { not: null } },
+    select: { id: true, transcriptKey: true }
+  });
+  const referenced = new Set(rows.map((r) => r.transcriptKey));
+  const onDisk = await listTranscripts();
+  const present = new Set(onDisk.map((f) => f.key));
+  const cutoff = Date.now() - (opts.graceMs ?? TRANSCRIPT_GC_GRACE_MS);
+  const report = { orphans: 0, dangling: 0, failed: 0 };
+  for (const f of onDisk) {
+    if (referenced.has(f.key) || f.mtimeMs > cutoff) continue;
+    if (opts.dryRun) {
+      report.orphans++;
+      continue;
+    }
+    try {
+      await deleteTranscript(f.key);
+      report.orphans++;
+    } catch {
+      report.failed++;
+    }
+  }
+  for (const r of rows) {
+    if (present.has(r.transcriptKey)) continue;
+    if (opts.dryRun) {
+      report.dangling++;
+      continue;
+    }
+    try {
+      await prisma.sessionHistory.update({
+        where: { id: r.id },
+        data: { transcriptKey: null, transcriptBytes: null }
+      });
+      report.dangling++;
+    } catch {
+      report.failed++;
+    }
+  }
+  return report;
 }
 async function reconcileHistory(liveSessionIds) {
   const open4 = await prisma.sessionHistory.findMany({
@@ -40860,10 +41002,14 @@ async function reconcileHistory(liveSessionIds) {
     select: { id: true, sessionId: true, updatedAt: true }
   });
   const live = new Set(liveSessionIds);
+  const at = /* @__PURE__ */ new Date();
   let closed = 0;
   for (const r of open4) {
     if (live.has(r.sessionId)) continue;
-    await prisma.sessionHistory.update({ where: { id: r.id }, data: { endedAt: r.updatedAt } });
+    await prisma.sessionHistory.update({
+      where: { id: r.id },
+      data: { endedAt: r.updatedAt, endedReason: RECONCILED, reconciledAt: at }
+    });
     closed++;
   }
   return closed;
@@ -40901,7 +41047,7 @@ async function session_history_default(app2) {
       cut = new Date(before2);
       if (Number.isNaN(cut.getTime())) return reply.code(400).send({ error: "before bukan tanggal valid" });
     }
-    return { purged: await purgeHistory({ projectId, before: cut }) };
+    return purgeHistory({ projectId, before: cut });
   });
 }
 
@@ -46793,10 +46939,25 @@ var RETENTION_DAYS = {
 };
 var before = (now, days) => new Date(now.getTime() - days * 864e5);
 async function runRetention(opts = {}, deps = {}) {
+  const report = {
+    candidates: 0,
+    deleted: 0,
+    bytes: 0,
+    failed: 0,
+    orphans: 0,
+    dangling: 0
+  };
+  await deleteExpired(report, opts, deps);
+  const gc = await reconcileTranscripts({ dryRun: opts.dryRun });
+  report.orphans = gc.orphans;
+  report.dangling = gc.dangling;
+  report.failed += gc.failed;
+  return report;
+}
+async function deleteExpired(report, opts, deps) {
   const now = opts.now ?? /* @__PURE__ */ new Date();
   const holds = opts.holds ?? /* @__PURE__ */ new Set();
   let remaining = Math.min(Math.max(opts.batchSize ?? 100, 1), 1e3);
-  const report = { candidates: 0, deleted: 0, bytes: 0, failed: 0 };
   const removeTranscript = deps.deleteTranscript ?? deleteTranscript;
   const removeUpload = deps.deleteUpload ?? deleteUpload;
   const sessions = await prisma.sessionHistory.findMany({
@@ -46810,14 +46971,16 @@ async function runRetention(opts = {}, deps = {}) {
     report.bytes += row.transcriptBytes ?? 0;
     if (opts.dryRun) continue;
     try {
-      if (row.transcriptKey) await removeTranscript(row.transcriptKey);
       await prisma.sessionHistory.delete({ where: { id: row.id } });
       report.deleted++;
       remaining--;
     } catch {
       report.failed++;
+      continue;
     }
-    if (remaining <= 0) return report;
+    if (row.transcriptKey) await removeTranscript(row.transcriptKey).catch(() => {
+    });
+    if (remaining <= 0) return;
   }
   const tickets2 = await prisma.ticket.findMany({
     where: { OR: [
@@ -46841,7 +47004,7 @@ async function runRetention(opts = {}, deps = {}) {
     } catch {
       report.failed++;
     }
-    if (remaining <= 0) return report;
+    if (remaining <= 0) return;
   }
   const deliveries = await prisma.webhookDelivery.findMany({
     where: { status: { in: ["sent", "failed", "dropped"] }, createdAt: { lt: before(now, RETENTION_DAYS.deliveries) } },
@@ -46860,7 +47023,7 @@ async function runRetention(opts = {}, deps = {}) {
         report.failed++;
       }
     }
-    if (remaining <= 0) return report;
+    if (remaining <= 0) return;
   }
   const results = await prisma.sessionResult.findMany({
     where: { createdAt: { lt: before(now, RETENTION_DAYS.sessionResults) } },
@@ -46881,7 +47044,6 @@ async function runRetention(opts = {}, deps = {}) {
     }
     if (remaining <= 0) break;
   }
-  return report;
 }
 var timer8;
 function startRetentionSweep() {
@@ -46889,7 +47051,9 @@ function startRetentionSweep() {
   const sweep2 = () => {
     const holds = new Set((process.env.HANOMAN_RETENTION_HOLDS ?? "").split(",").map((v) => v.trim()).filter(Boolean));
     void runRetention({ holds }).then((report) => {
-      if (report.deleted || report.failed) console.log(`retention: ${report.deleted} dihapus, ${report.failed} gagal`);
+      if (report.deleted || report.failed || report.orphans || report.dangling) {
+        console.log(`retention: ${report.deleted} dihapus, ${report.failed} gagal, ${report.orphans} transkrip yatim disapu, ${report.dangling} metadata menggantung dibersihkan`);
+      }
     }).catch((error) => console.error("retention sweep:", error));
   };
   sweep2();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hanoman",
-  "version": "0.1.47",
+  "version": "0.1.50",
   "description": "Orchestrator + dashboard workflow docs-driven untuk sesi Claude Code / Codex",
   "type": "module",
   "repository": {

package/prisma/migrations/20260819130000_session_history_ended_reason/migration.sql

@@ -0,0 +1,27 @@
+-- SPEC-844 · ADR-0125 · riwayat sesi mencatat BAGAIMANA sebuah baris ditutup.
+--
+-- Ditulis tangan (bukan `migrate dev`): worktree tetangga membuat `migrate dev` me-reset DB saat
+-- ada drift. ADITIF murni — dua kolom NULLABLE tanpa default, tak ada tabel diredefinisi, jadi
+-- jebakan `ADD COLUMN … DEFAULT CURRENT_TIMESTAMP` (ADR-0090) tak berlaku di sini.
+ALTER TABLE "SessionHistory" ADD COLUMN "endedReason" TEXT;
+ALTER TABLE "SessionHistory" ADD COLUMN "reconciledAt" DATETIME;
+
+-- Backfill SEKALI JALAN. Baris lama tak bisa ditanyai, tapi jejaknya masih ada: `reconcileHistory`
+-- membaca `updatedAt` SEBELUM update-nya sendiri (jadi `updatedAt` melompat ke waktu boot dan
+-- meninggalkan `endedAt` di belakang), sementara `finishSession` menulis `endedAt = new Date()` DI
+-- DALAM update yang sama (jadi jaraknya nol). Terukur pada DB hidup 806 baris: tutup normal
+-- 0–39 ms (n=777) vs rekonsiliasi 275 966–82 224 277 ms (n=20) — empat orde besaran tanpa satu pun
+-- baris di antaranya; ambang 60 000 ms duduk di tengah celah itu.
+--
+-- Ini backfill, BUKAN aturan render: menjadikannya kontrak akan mengunci detail penyimpanan Prisma
+-- sebagai semantik produk. Prisma menyimpan DateTime SQLite sebagai INTEGER milidetik, jadi
+-- selisihnya aritmetika biasa; `CAST` dipasang supaya representasi lain (teks ISO) menghasilkan
+-- selisih 0 → nol baris cocok → seluruh tabel jatuh ke 'closed', yaitu perilaku sebelum spec ini.
+UPDATE "SessionHistory"
+   SET "endedReason" = 'reconciled', "reconciledAt" = "updatedAt"
+ WHERE "endedAt" IS NOT NULL
+   AND CAST("updatedAt" AS INTEGER) - CAST("endedAt" AS INTEGER) > 60000;
+
+UPDATE "SessionHistory"
+   SET "endedReason" = 'closed'
+ WHERE "endedAt" IS NOT NULL AND "endedReason" IS NULL;

package/prisma/schema.prisma

@@ -392,6 +392,13 @@ model SessionHistory {
   startedAt       DateTime  @default(now())
   endedAt         DateTime?
   exitCode        Int?
+  // SPEC-844 · ADR-0125 · CARA baris ini ditutup: "closed" (killSession) atau "reconciled" (pane
+  // sudah lenyap saat boot — hasilnya tak diketahui). null = baris lahir sebelum kolom ini ada.
+  // Kelas hasil (selesai/gagal) sengaja TIDAK disimpan: ia turunan exitCode (sessionOutcome).
+  endedReason     String?
+  // Kapan boot menemukan panenya lenyap. `endedAt` baris rekonsiliasi adalah batas BAWAH
+  // ("terakhir diketahui hidup"); kolom ini batas atasnya.
+  reconciledAt    DateTime?
   transcriptKey   String?
   transcriptBytes Int?
   createdAt       DateTime  @default(now())