hanoman 0.1.52 → 0.1.53

package/dist/server.js

@@ -4189,10 +4189,10 @@ function convertPayload(to, payload) {
   const fromShape = shapeOfPayload(payload);
   const toShape = payloadShapeFor(to);
   const fromAudit = str3("fromAudit");
-  const done = (out3, dropped) => ({
-    payload: out3,
+  const done = (out4, dropped) => ({
+    payload: out4,
     dropped,
-    missing: SHAPE_REQUIRED[toShape].filter((f) => typeof out3[f] !== "string" || out3[f] === "")
+    missing: SHAPE_REQUIRED[toShape].filter((f) => typeof out4[f] !== "string" || out4[f] === "")
   });
   if (fromShape === toShape) return { payload: { ...p }, dropped: [], missing: [] };
   if (toShape === "qa") {
@@ -4967,25 +4967,25 @@ var init_agent = __esm({
 // ../shared/src/custom-agent.ts
 function mentionsOf(v) {
   if (!Array.isArray(v)) return [];
-  const out3 = [];
-  for (const x of v) if (typeof x === "string" && x && !out3.includes(x)) out3.push(x);
-  return out3;
+  const out4 = [];
+  for (const x of v) if (typeof x === "string" && x && !out4.includes(x)) out4.push(x);
+  return out4;
 }
 function runtimeOf(v) {
   return typeof v === "string" && AGENT_RUNTIMES.includes(v) ? v : null;
 }
 function toolsOf(v) {
   if (!Array.isArray(v)) return null;
-  const out3 = [];
-  for (const x of v) if (typeof x === "string" && x && !out3.includes(x)) out3.push(x);
-  return out3;
+  const out4 = [];
+  for (const x of v) if (typeof x === "string" && x && !out4.includes(x)) out4.push(x);
+  return out4;
 }
 function resolveTools(a) {
   const base2 = a.tools ?? [...DEFAULT_AGENT_TOOLS];
   const canMention = (a.mentions ?? []).length > 0;
-  const out3 = base2.filter((t) => t !== MENTION_TOOL);
-  if (canMention) out3.push(MENTION_TOOL);
-  return out3;
+  const out4 = base2.filter((t) => t !== MENTION_TOOL);
+  if (canMention) out4.push(MENTION_TOOL);
+  return out4;
 }
 function detectCycle(nodes) {
   const edges = new Map(nodes.map((n2) => [n2.name, n2.mentions]));
@@ -5392,7 +5392,7 @@ var init_prd_status = __esm({
 
 // ../shared/src/cron-expr.ts
 function parseField(raw2, lo, hi) {
-  const out3 = /* @__PURE__ */ new Set();
+  const out4 = /* @__PURE__ */ new Set();
   for (const part of raw2.split(",")) {
     const slash = part.indexOf("/");
     const rangePart = slash === -1 ? part : part.slice(0, slash);
@@ -5418,9 +5418,9 @@ function parseField(raw2, lo, hi) {
       to = Number(m[2]);
     }
     if (from < lo || to > hi || from > to) return null;
-    for (let v = from; v <= to; v += step) out3.add(v);
+    for (let v = from; v <= to; v += step) out4.add(v);
   }
-  return out3.size ? out3 : null;
+  return out4.size ? out4 : null;
 }
 function parseCron(expr) {
   const parts = expr.trim().split(/\s+/);
@@ -6055,9 +6055,20 @@ var init_api = __esm({
       // SPEC-255 · ADR-0064 · rename slug project (efek: DSN, Help Center, sync).
       projectRename: (id) => `${API}/projects/${encodeURIComponent(id)}/rename`,
       branches: (id) => `${API}/projects/${id}/branches`,
-      // SPEC-360 · ADR-0077 · branch ter-merge (nilai turunan git) + hapus batch local/origin.
-      branchesUnused: (id, base2) => `${API}/projects/${id}/branches/unused${base2 ? `?base=${encodeURIComponent(base2)}` : ""}`,
+      // SPEC-360 · ADR-0077 · daftar branch (nilai turunan git) + hapus batch local/origin.
+      // SPEC-859 · `include=all` memuat branch yang belum ter-merge; tanpa itu hanya yang ter-merge.
+      branchesUnused: (id, base2, include) => {
+        const q = new URLSearchParams();
+        if (base2) q.set("base", base2);
+        if (include) q.set("include", include);
+        const s2 = q.toString();
+        return `${API}/projects/${id}/branches/unused${s2 ? `?${s2}` : ""}`;
+      },
       branchesDelete: (id) => `${API}/projects/${id}/branches/delete`,
+      // SPEC-861 · ADR-0132 · worktree HIDUP (nilai turunan git) + sinyal mahal per baris + hapus batch.
+      worktrees: (id) => `${API}/projects/${id}/worktrees`,
+      worktreeStats: (id, name2) => `${API}/projects/${id}/worktrees/stats?name=${encodeURIComponent(name2)}`,
+      worktreesDelete: (id) => `${API}/projects/${id}/worktrees/delete`,
       // SPEC-217 · path per-mesin (LocalBinding, tak disync) + clone dari gitRemote
       binding: (id) => `${API}/projects/${id}/binding`,
       clone: (id) => `${API}/projects/${id}/clone`,
@@ -6307,13 +6318,13 @@ function resolveLink(fromRel, target2) {
   if (clean2.startsWith("/")) return clean2.slice(1).split("/").filter((p) => p && p !== ".").join("/");
   const dir2 = fromRel.includes("/") ? fromRel.slice(0, fromRel.lastIndexOf("/")) : "";
   const parts = (dir2 ? dir2.split("/") : []).concat(clean2.replace(/^\.\//, "").split("/"));
-  const out3 = [];
+  const out4 = [];
   for (const p of parts) {
     if (p === "" || p === ".") continue;
-    if (p === "..") out3.pop();
-    else out3.push(p);
+    if (p === "..") out4.pop();
+    else out4.push(p);
   }
-  return out3.join("/");
+  return out4.join("/");
 }
 function linkedSetFrom(indexRel, docs, read2) {
   const inCorpus = new Set(docs);
@@ -6755,17 +6766,17 @@ function matchesEvent(subscribed, type) {
   return false;
 }
 function projectRow(def2, row) {
-  const out3 = {};
-  for (const f of def2.fields) if (f in row) out3[f] = iso2(row[f]);
-  return out3;
+  const out4 = {};
+  for (const f of def2.fields) if (f in row) out4[f] = iso2(row[f]);
+  return out4;
 }
 function diffFields(def2, before2, after) {
-  const out3 = [];
+  const out4 = [];
   for (const f of def2.fields) {
     if (IGNORED_FIELDS.has(f)) continue;
-    if (JSON.stringify(iso2(before2[f]) ?? null) !== JSON.stringify(iso2(after[f]) ?? null)) out3.push(f);
+    if (JSON.stringify(iso2(before2[f]) ?? null) !== JSON.stringify(iso2(after[f]) ?? null)) out4.push(f);
   }
-  return out3;
+  return out4;
 }
 function eventTypeFor(def2, action, changed) {
   if (action === "updated") {
@@ -7298,9 +7309,9 @@ var init_mcp_shape = __esm({
     OBJECTIVE_CLIP = 200;
     MARK = "\u2026 (dipotong)";
     pick = (row, keys) => {
-      const out3 = {};
-      for (const k of keys) if (row[k] !== void 0) out3[k] = row[k];
-      return out3;
+      const out4 = {};
+      for (const k of keys) if (row[k] !== void 0) out4[k] = row[k];
+      return out4;
     };
     shapeProject = (row) => pick(row, ["id", "name", "kind", "desc", "backlog", "topStage", "coverage", "schedulerOptIn", "leadOptIn"]);
     shapeProjectDetail = (row) => pick(row, [
@@ -7361,9 +7372,9 @@ var init_mcp_shape = __esm({
 
 // ../shared/src/mcp-catalog.ts
 function query(pairs) {
-  const out3 = {};
-  for (const [k, v] of Object.entries(pairs)) if (v !== void 0) out3[k] = v;
-  return out3;
+  const out4 = {};
+  for (const [k, v] of Object.entries(pairs)) if (v !== void 0) out4[k] = v;
+  return out4;
 }
 function reshapePage(raw2, fn2) {
   const p = raw2;
@@ -8634,9 +8645,9 @@ function resolveGoalCondition(a, override, template) {
   return (picked ? picked.trim() : defaultGoalCondition(a)).slice(0, GOAL_MAX);
 }
 function goalChunks(line, size = GOAL_CHUNK) {
-  const out3 = [];
-  for (let i = 0; i < line.length; i += size) out3.push(line.slice(i, i + size));
-  return out3;
+  const out4 = [];
+  for (let i = 0; i < line.length; i += size) out4.push(line.slice(i, i + size));
+  return out4;
 }
 var GOAL_MAX, goalOneLine, GOAL_CHUNK;
 var init_goal = __esm({
@@ -8782,16 +8793,16 @@ function agentPromptOf(def2, roster) {
 }
 function renderAgentsJson(defs) {
   if (defs.length === 0) return "";
-  const out3 = {};
+  const out4 = {};
   for (const d of defs) {
-    out3[d.name] = {
+    out4[d.name] = {
       description: d.description,
       prompt: agentPromptOf(d, defs),
       tools: resolveTools({ tools: d.tools, mentions: d.mentions }),
       ...d.model ? { model: d.model } : {}
     };
   }
-  return JSON.stringify(out3);
+  return JSON.stringify(out4);
 }
 function agentRosterBlock(defs) {
   if (defs.length === 0) return "";
@@ -8924,27 +8935,27 @@ function asSkill(dir2, pkg, name2 = basename2(dir2)) {
   return { id: pkg ? `${pkg}:${name2}` : name2, name: name2, pkg, dir: dir2 };
 }
 function skillsUnder(dir2, pkg, depth = 2) {
-  const out3 = [];
+  const out4 = [];
   for (const name2 of dirsIn(dir2)) {
     const sub = join2(dir2, name2);
-    if (isSkillDir(sub)) out3.push(asSkill(sub, pkg, name2));
-    else if (depth > 1) out3.push(...skillsUnder(sub, pkg, depth - 1));
+    if (isSkillDir(sub)) out4.push(asSkill(sub, pkg, name2));
+    else if (depth > 1) out4.push(...skillsUnder(sub, pkg, depth - 1));
   }
-  return out3;
+  return out4;
 }
 function manifestSkills(installPath, pkg) {
   for (const marker of [".claude-plugin", ".codex-plugin"]) {
     const j = readJson(join2(installPath, marker, "plugin.json"));
     const declared = j?.skills;
     if (!Array.isArray(declared)) continue;
-    const out3 = [];
+    const out4 = [];
     for (const rel of declared) {
       if (typeof rel !== "string" || !rel) continue;
       const p = resolve6(installPath, rel);
       const dir2 = basename2(p) === "SKILL.md" ? dirname3(p) : p;
-      if (isSkillDir(dir2)) out3.push(asSkill(dir2, pkg));
+      if (isSkillDir(dir2)) out4.push(asSkill(dir2, pkg));
     }
-    if (out3.length) return out3;
+    if (out4.length) return out4;
   }
   return [];
 }
@@ -8953,15 +8964,15 @@ function pluginSkills(installPath, pkg) {
   return declared.length ? declared : skillsUnder(join2(installPath, "skills"), pkg);
 }
 function lockPluginNames(agentsHome) {
-  const out3 = /* @__PURE__ */ new Map();
+  const out4 = /* @__PURE__ */ new Map();
   const j = readJson(join2(agentsHome, ".skill-lock.json"));
   const skills = j?.skills;
-  if (!skills || typeof skills !== "object") return out3;
+  if (!skills || typeof skills !== "object") return out4;
   for (const [name2, entry] of Object.entries(skills)) {
     const pkg = entry?.pluginName;
-    if (typeof pkg === "string" && pkg.trim()) out3.set(name2, pkg.trim());
+    if (typeof pkg === "string" && pkg.trim()) out4.set(name2, pkg.trim());
   }
-  return out3;
+  return out4;
 }
 function splitPluginKey(key) {
   const at = key.lastIndexOf("@");
@@ -8971,39 +8982,39 @@ function manifestRoots(home3) {
   const j = readJson(join2(home3, "plugins", "installed_plugins.json"));
   const plugins = j?.plugins;
   if (!plugins || typeof plugins !== "object") return [];
-  const out3 = [];
+  const out4 = [];
   for (const [key, entries] of Object.entries(plugins)) {
     const { pkg, marketplace } = splitPluginKey(key);
     for (const e of Array.isArray(entries) ? entries : []) {
       const p = e?.installPath;
-      if (typeof p === "string" && p) out3.push({ pkg, marketplace, dir: p });
+      if (typeof p === "string" && p) out4.push({ pkg, marketplace, dir: p });
     }
   }
-  return out3;
+  return out4;
 }
 function cacheRoots(home3) {
   const cache7 = join2(home3, "plugins", "cache");
-  const out3 = [];
+  const out4 = [];
   for (const marketplace of dirsIn(cache7))
     for (const pkg of dirsIn(join2(cache7, marketplace)))
       for (const version2 of dirsIn(join2(cache7, marketplace, pkg)))
-        out3.push({ pkg, marketplace, dir: join2(cache7, marketplace, pkg, version2) });
-  return out3;
+        out4.push({ pkg, marketplace, dir: join2(cache7, marketplace, pkg, version2) });
+  return out4;
 }
 function disabledPlugins(agent, home3) {
-  const out3 = /* @__PURE__ */ new Set();
+  const out4 = /* @__PURE__ */ new Set();
   if (agent === "claude") {
     const en = readJson(join2(home3, "settings.json"))?.enabledPlugins;
     if (en && typeof en === "object") {
-      for (const [k, v] of Object.entries(en)) if (v === false) out3.add(k);
+      for (const [k, v] of Object.entries(en)) if (v === false) out4.add(k);
     }
-    return out3;
+    return out4;
   }
   let toml;
   try {
     toml = readFileSync2(join2(home3, "config.toml"), "utf8");
   } catch {
-    return out3;
+    return out4;
   }
   let current = null;
   for (const raw2 of toml.split("\n")) {
@@ -9014,9 +9025,9 @@ function disabledPlugins(agent, home3) {
       current = m ? m[1] : null;
       continue;
     }
-    if (current && /^enabled\s*=\s*false\b/.test(line)) out3.add(current);
+    if (current && /^enabled\s*=\s*false\b/.test(line)) out4.add(current);
   }
-  return out3;
+  return out4;
 }
 function scanAgentSkills(agent, env = process.env, osHome = homedir2()) {
   const home3 = agentSkillHome(agent, env, osHome);
@@ -9159,10 +9170,10 @@ function ensureSpawnHelpersExecutable(paths2, ops) {
   }
   return fixed;
 }
-function repairSpawnHelper(resolve19, notify) {
+function repairSpawnHelper(resolve21, notify) {
   let ptyDir;
   try {
-    ptyDir = dirname4(resolve19("node-pty/package.json"));
+    ptyDir = dirname4(resolve21("node-pty/package.json"));
   } catch {
     return [];
   }
@@ -9180,10 +9191,10 @@ function repairSpawnHelper(resolve19, notify) {
   if (fixed.length) notify?.("hanoman \xB7 memperbaiki izin `spawn-helper` node-pty (sekali per instalasi)\n");
   return fixed;
 }
-function ensureSpawnHelperOnce(resolve19, notify) {
+function ensureSpawnHelperOnce(resolve21, notify) {
   if (repaired) return [];
   repaired = true;
-  return repairSpawnHelper(resolve19, notify);
+  return repairSpawnHelper(resolve21, notify);
 }
 var repaired;
 var init_spawn_helper = __esm({
@@ -9222,14 +9233,14 @@ function registerWebhookTap(s2) {
 }
 async function cascadeCounts(base2, def2, id) {
   if (!def2.cascade?.length) return void 0;
-  const out3 = {};
+  const out4 = {};
   for (const child of def2.cascade) {
     try {
-      out3[child] = await base2[child].count({ where: { projectId: id } });
+      out4[child] = await base2[child].count({ where: { projectId: id } });
     } catch {
     }
   }
-  return out3;
+  return out4;
 }
 function webhookTap(base2) {
   const pre = async (model, where) => {
@@ -9276,9 +9287,9 @@ function webhookTap(base2) {
           const def2 = on(model);
           const before2 = def2 ? await pre(model, args.where) : null;
           const cascade = def2 && before2 ? await cascadeCounts(base2, def2, String(before2.id)) : void 0;
-          const out3 = await query2(args);
+          const out4 = await query2(args);
           if (def2 && before2) fire({ def: def2, action: "deleted", before: before2, after: null, changed: [], cascade });
-          return out3;
+          return out4;
         },
         // `liveSpecs` memajukan stage lewat CAS `updateMany` — jalur perubahan stage yang PALING
         // sering dipakai. Melewatkannya berarti melewatkan peristiwa yang paling diminta.
@@ -9290,7 +9301,7 @@ function webhookTap(base2) {
             before2 = await del(base2, model).findMany({ where: args.where });
           } catch {
           }
-          const out3 = await query2(args);
+          const out4 = await query2(args);
           if (before2.length) {
             const ids = before2.map((r) => r.id);
             let after = [];
@@ -9306,7 +9317,7 @@ function webhookTap(base2) {
               if (changed.length) fire({ def: def2, action: "updated", before: b, after: aft, changed });
             }
           }
-          return out3;
+          return out4;
         },
         async deleteMany({ model, args, query: query2 }) {
           const def2 = on(model);
@@ -9316,10 +9327,10 @@ function webhookTap(base2) {
             before2 = await del(base2, model).findMany({ where: args.where });
           } catch {
           }
-          const out3 = await query2(args);
+          const out4 = await query2(args);
           for (const b of before2)
             fire({ def: def2, action: "deleted", before: b, after: null, changed: [] });
-          return out3;
+          return out4;
         }
       }
     }
@@ -9366,6 +9377,7 @@ var init_db = __esm({
     process.env.DATABASE_URL = url;
     mkdirSync2(dirname5(dbFilePath(url)), { recursive: true, mode: 448 });
     base = new PrismaClient();
+    void base.$queryRawUnsafe("PRAGMA journal_mode=WAL").catch((e) => console.warn("tak bisa menyetel journal_mode=WAL:", e));
     prisma = base.$extends(webhookTap(base));
   }
 });
@@ -9382,12 +9394,12 @@ var init_stage_machine = __esm({
 // src/services/session-phases.ts
 import { readFileSync as readFileSync3, readdirSync as readdirSync3 } from "node:fs";
 function recorded(file) {
-  const out3 = /* @__PURE__ */ new Map();
+  const out4 = /* @__PURE__ */ new Map();
   let raw2;
   try {
     raw2 = readFileSync3(file, "utf8");
   } catch {
-    return out3;
+    return out4;
   }
   for (const line of raw2.split("\n")) {
     const trimmed = line.trimEnd();
@@ -9395,9 +9407,9 @@ function recorded(file) {
     if (i < 1) continue;
     const state = trimmed.slice(i + 1);
     if (state !== "done" && state !== "skipped") continue;
-    out3.set(trimmed.slice(0, i).trim(), state);
+    out4.set(trimmed.slice(0, i).trim(), state);
   }
-  return out3;
+  return out4;
 }
 function readPhases(file, flow) {
   const seen = recorded(file);
@@ -9736,7 +9748,7 @@ import { lookup as dnsLookup2 } from "node:dns/promises";
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 async function pinnedRequest(input) {
-  return new Promise((resolve19, reject2) => {
+  return new Promise((resolve21, reject2) => {
     const transport = input.url.protocol === "https:" ? httpsRequest : httpRequest;
     const req = transport({
       protocol: input.url.protocol,
@@ -9764,7 +9776,7 @@ async function pinnedRequest(input) {
         }
         chunks.push(chunk);
       });
-      response.on("end", () => resolve19({
+      response.on("end", () => resolve21({
         status: response.statusCode ?? 0,
         headers: response.headers,
         body: Buffer.concat(chunks)
@@ -10206,6 +10218,12 @@ import { randomUUID as randomUUID2 } from "node:crypto";
 import { mkdirSync as mkdirSync4, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname7 } from "node:path";
 import { tmpdir } from "node:os";
+function noTtyPromptEnv() {
+  const path2 = askpassDenyPath();
+  mkdirSync4(dirname7(path2), { recursive: true, mode: 448 });
+  writeFileSync2(path2, ASKPASS_DENY, { mode: 448 });
+  return { SSH_ASKPASS: path2, SSH_ASKPASS_REQUIRE: "force", GIT_TERMINAL_PROMPT: "0" };
+}
 function tmux(...args) {
   try {
     return execFileSync("tmux", ["-L", socket(), "-f", "/dev/null", ...args], {
@@ -10222,15 +10240,28 @@ function tmux(...args) {
   }
 }
 function listPanes() {
-  let out3;
+  let out4;
   try {
-    out3 = tmux("list-panes", "-a", "-F", FMT);
+    out4 = tmux("list-panes", "-a", "-F", FMT);
   } catch (e) {
     if (e instanceof TmuxError && e.noServer) return [];
     throw e;
   }
-  return out3.split("\n").filter(Boolean).flatMap((line) => {
-    const [n2, projectId, specId, flow, phaseFile, cwd, dead, code, decisionFile, branch, agent] = line.split("	");
+  return out4.split("\n").filter(Boolean).flatMap((line) => {
+    const [
+      n2,
+      projectId,
+      specId,
+      flow,
+      phaseFile,
+      cwd,
+      dead,
+      code,
+      decisionFile,
+      branch,
+      agent,
+      alternate
+    ] = line.split("	");
     if (!n2?.startsWith(PREFIX)) return [];
     const exited = dead === "1";
     return [{
@@ -10248,7 +10279,8 @@ function listPanes() {
       // SPEC-196 · sesi hidup dengan marker keputusan terisi = menunggu manusia.
       decision: !exited && !!decisionFile && markerFilled(decisionFile),
       // SPEC-338 · sesi yang lahir sebelum ADR-0074 tak punya opsi ini → claude.
-      agent: agent === "codex" ? "codex" : "claude"
+      agent: agent === "codex" ? "codex" : "claude",
+      altScreen: alternate === "1"
     }];
   });
 }
@@ -10269,8 +10301,8 @@ function sessionKind(o, projectId, cwd) {
 }
 function captureTranscript(id) {
   try {
-    const out3 = tmux("capture-pane", "-p", "-J", "-S", "-50000", "-t", name(id));
-    return out3.trim() ? out3 : null;
+    const out4 = tmux("capture-pane", "-p", "-J", "-S", "-50000", "-t", name(id));
+    return out4.trim() ? out4 : null;
   } catch {
     return null;
   }
@@ -10334,6 +10366,9 @@ function createSession(projectId, cwd, opts = {}) {
   if (!opts.command && agent === "claude") {
     for (const [k, v] of Object.entries(rootBypassEnv())) envPairs.push(`${k}=${sq(v)}`);
   }
+  if (!opts.command) {
+    for (const [k, v] of Object.entries(noTtyPromptEnv())) envPairs.push(`${k}=${sq(v)}`);
+  }
   if (opts.phaseFile) {
     mkdirSync4(dirname7(opts.phaseFile), { recursive: true });
     envPairs.push(`HANOMAN_PHASE_FILE=${sq(opts.phaseFile)}`);
@@ -10534,18 +10569,18 @@ function sessionPhases(id) {
   return readPhases(p.phaseFile, p.flow);
 }
 function sessionPhasesBySpec() {
-  const out3 = /* @__PURE__ */ new Map();
+  const out4 = /* @__PURE__ */ new Map();
   let panes;
   try {
     panes = listPanes();
   } catch {
-    return out3;
+    return out4;
   }
   for (const p of panes) {
     if (!p.specId || !p.flow || !p.phaseFile) continue;
-    out3.set(p.specId, { phases: readPhases(p.phaseFile, p.flow), cwd: p.cwd });
+    out4.set(p.specId, { phases: readPhases(p.phaseFile, p.flow), cwd: p.cwd });
   }
-  return out3;
+  return out4;
 }
 function broadcast(a, f) {
   const msg = frame(f);
@@ -10602,6 +10637,11 @@ function pollPhases(p, a) {
   a.lastPhases = json;
   broadcast(a, { t: "phase", phases, complete });
 }
+function pollAlt(p, a) {
+  if (p.altScreen === a.lastAlt) return;
+  a.lastAlt = p.altScreen;
+  broadcast(a, { t: "alt", on: p.altScreen });
+}
 function startPoll() {
   if (poll) return;
   poll = setInterval(() => {
@@ -10616,7 +10656,11 @@ function startPoll() {
       const p = live.get(id);
       if (!p) end(id, 0);
       else if (p.exited) end(id, p.code);
-      else pollPhases(p, attached.get(id));
+      else {
+        const a = attached.get(id);
+        pollPhases(p, a);
+        pollAlt(p, a);
+      }
     }
     if (attached.size === 0 && poll) {
       clearInterval(poll);
@@ -10633,14 +10677,18 @@ function attach(id, c) {
   }
   if (p.exited) {
     const screen = tmux("capture-pane", "-p", "-e", "-J", "-S", "-2000", "-t", name(id));
-    if (screen.trim()) c.send(frame({ t: "data", d: screen.replace(/\n/g, "\r\n") }));
+    if (screen.trim()) {
+      c.send(frame({ t: "data", d: stripTerminalQueries(screen.replace(/\n/g, "\r\n")) }));
+    }
     c.send(frame({ t: "exit", code: p.code }));
     c.close();
     return;
   }
   const a = attached.get(id) ?? open(id);
   a.clients.add(c);
-  if (a.scrollback) c.send(frame({ t: "data", d: a.scrollback }));
+  if (a.scrollback) c.send(frame({ t: "data", d: stripTerminalQueries(a.scrollback) }));
+  a.lastAlt = p.altScreen;
+  c.send(frame({ t: "alt", on: p.altScreen }));
   if (p.flow && p.phaseFile) {
     const phases = readPhases(p.phaseFile, p.flow);
     const complete = paneComplete(p);
@@ -10648,8 +10696,11 @@ function attach(id, c) {
     c.send(frame({ t: "phase", phases, complete }));
   }
 }
-function writeTo(id, d) {
-  attached.get(id)?.pty.write(d);
+function writeTo(id, d, from) {
+  const a = attached.get(id);
+  if (!a) return;
+  if (from && isTerminalResponse(d) && a.clients.values().next().value !== from) return;
+  a.pty.write(d);
 }
 function resize(id, cols, rows) {
   attached.get(id)?.pty.resize(cols, rows);
@@ -10685,7 +10736,7 @@ function spawnPty(...args) {
     );
   }
 }
-var socket, PREFIX, MAX_SCROLLBACK, SCROLLBACK_SLACK, POLL_MS, markerFilled, attached, claudeBin, shellBin, codexBin, agentBin, rootBypassEnv, frame, name, promptFilePath, goalGatePath, goalStatePath, agentsFilePath, NO_SERVER, TmuxError, sq, idFor, FMT, listSessions, liveDecisions, getSession, hooks, emitBirth, emitDeath, customAgentSource, customAgentsFor, sleep, paneText, dialogIO, DIALOG_CAPTURE_LINES, GOAL_ARMED_MARKERS, goalArmed, COALESCE_MS, COALESCE_MAX_BYTES, trimScrollback, phaseKey, paneComplete, sessionFinished, poll, detach;
+var socket, PREFIX, MAX_SCROLLBACK, SCROLLBACK_SLACK, POLL_MS, markerFilled, attached, claudeBin, shellBin, codexBin, agentBin, rootBypassEnv, frame, name, promptFilePath, goalGatePath, goalStatePath, agentsFilePath, askpassDenyPath, ASKPASS_DENY, NO_SERVER, TmuxError, sq, idFor, FMT, listSessions, liveDecisions, getSession, hooks, emitBirth, emitDeath, customAgentSource, customAgentsFor, sleep, paneText, dialogIO, DIALOG_CAPTURE_LINES, GOAL_ARMED_MARKERS, goalArmed, COALESCE_MS, COALESCE_MAX_BYTES, trimScrollback, phaseKey, paneComplete, sessionFinished, poll, TERMINAL_QUERY, stripTerminalQueries, TERMINAL_RESPONSE, isTerminalResponse, detach;
 var init_pty = __esm({
   "src/services/pty.ts"() {
     "use strict";
@@ -10721,6 +10772,12 @@ var init_pty = __esm({
     goalGatePath = (id) => `${tmpdir()}/hanoman-goal-gates/${id}.sh`;
     goalStatePath = (id) => `${tmpdir()}/hanoman-goal-gates/${id}.count`;
     agentsFilePath = (id) => `${tmpdir()}/hanoman-agents/${id}.json`;
+    askpassDenyPath = () => `${tmpdir()}/hanoman-askpass/deny.sh`;
+    ASKPASS_DENY = `#!/bin/sh
+echo "hanoman: tak ada manusia di pane ini \u2014 permintaan ketikan ditolak: $1" >&2
+echo "hanoman: buka kuncinya di luar sesi (mis. ssh-add ~/.ssh/id_rsa), lalu ulangi." >&2
+exit 1
+`;
     NO_SERVER = /no server running|error connecting to/i;
     TmuxError = class extends Error {
       constructor(message, noServer) {
@@ -10741,7 +10798,8 @@ var init_pty = __esm({
       "#{pane_dead_status}",
       "#{@hanoman_decision_file}",
       "#{@hanoman_branch}",
-      "#{@hanoman_agent}"
+      "#{@hanoman_agent}",
+      "#{alternate_on}"
     ].join("	");
     listSessions = () => listPanes().map(({ id, projectId, specId, flow, cwd, exited, code, branch, decision, agent }) => ({
       id,
@@ -10823,6 +10881,38 @@ var init_pty = __esm({
       const p = getSession(id);
       return !!p && paneComplete(p);
     };
+    TERMINAL_QUERY = new RegExp([
+      "\\x1b\\[[?>=]?[0-9;]*c",
+      // Device Attributes 1/2/3
+      "\\x1b\\[>[0-9;]*q",
+      // XTVERSION — `>` wajib, DECSCUSR `\\x1b[2 q` bukan ini
+      "\\x1b\\[\\??[0-9;]*n",
+      // DSR/DECDSR, termasuk `?996n` (skema warna)
+      "\\x1b\\[\\??[0-9;]*\\$[py]",
+      // DECRQM & balasannya
+      "\\x1b\\][0-9][0-9;]*\\?(?:\\x07|\\x1b\\\\)",
+      // OSC 4/10/11/12 `…;?`
+      "\\x1bP[0-9]*[$+][a-z][^\\x1b]*\\x1b\\\\",
+      // DECRQSS & XTGETTCAP
+      "\\x1b\\[(?:11|13|14|15|16|18|19|20|21)t"
+      // XTWINOPS laporan — berparameter TUNGGAL
+    ].join("|"), "g");
+    stripTerminalQueries = (s2) => s2.replace(TERMINAL_QUERY, "");
+    TERMINAL_RESPONSE = new RegExp([
+      "\\x1b\\[[?>][0-9;]*c",
+      // balasan DA
+      "\\x1b\\[\\??[0-9]+;[0-9]+R",
+      // CPR / DECXCPR
+      "\\x1b\\[\\??[0-9;]*n",
+      // balasan DSR
+      "\\x1b\\[\\??[0-9;]*\\$y",
+      // DECRPM
+      "\\x1b\\][0-9][0-9;]*;[^\\x07\\x1b]*(?:\\x07|\\x1b\\\\)",
+      // balasan warna OSC
+      "\\x1bP[0-9]*[$+>][a-z|][^\\x1b]*\\x1b\\\\"
+      // DECRPSS / XTGETTCAP / XTVERSION
+    ].join("|"), "g");
+    isTerminalResponse = (d) => d.length > 0 && d.replace(TERMINAL_RESPONSE, "") === "";
     detach = (id, c) => {
       attached.get(id)?.clients.delete(c);
     };
@@ -11003,14 +11093,14 @@ function jsonSafe(v) {
   return v === void 0 ? null : JSON.parse(JSON.stringify(v));
 }
 function coerce2(entity, data) {
-  const out3 = {};
+  const out4 = {};
   for (const f of FIELDS[entity]) {
     if (!(f in data)) continue;
     let v = data[f];
     if (DATE_FIELDS[entity].includes(f) && typeof v === "string") v = new Date(v);
-    out3[f] = v;
+    out4[f] = v;
   }
-  return out3;
+  return out4;
 }
 async function snapshot(entity, id) {
   const row = await DELEGATE[entity].findUnique({ where: { id } });
@@ -12326,14 +12416,14 @@ var require_filesystem = __commonJS({
       });
       return buffer2.subarray(0, bytesRead);
     };
-    var readFile6 = (path2) => new Promise((resolve19, reject2) => {
+    var readFile6 = (path2) => new Promise((resolve21, reject2) => {
       fs.open(path2, "r", (err, fd) => {
         if (err) {
           reject2(err);
         } else {
           const buffer2 = Buffer.alloc(MAX_LENGTH);
           fs.read(fd, buffer2, 0, MAX_LENGTH, 0, (_, bytesRead) => {
-            resolve19(buffer2.subarray(0, bytesRead));
+            resolve21(buffer2.subarray(0, bytesRead));
             fs.close(fd, () => {
             });
           });
@@ -12401,10 +12491,10 @@ var require_detect_libc = __commonJS({
     var commandOut = "";
     var safeCommand = () => {
       if (!commandOut) {
-        return new Promise((resolve19) => {
-          childProcess.exec(command, (err, out3) => {
-            commandOut = err ? " " : out3;
-            resolve19(commandOut);
+        return new Promise((resolve21) => {
+          childProcess.exec(command, (err, out4) => {
+            commandOut = err ? " " : out4;
+            resolve21(commandOut);
           });
         });
       }
@@ -12436,8 +12526,8 @@ var require_detect_libc = __commonJS({
       }
       return null;
     };
-    var familyFromCommand = (out3) => {
-      const [getconf, ldd1] = out3.split(/[\r\n]+/);
+    var familyFromCommand = (out4) => {
+      const [getconf, ldd1] = out4.split(/[\r\n]+/);
       if (getconf && getconf.includes(GLIBC)) {
         return GLIBC;
       }
@@ -12526,8 +12616,8 @@ var require_detect_libc = __commonJS({
             family2 = familyFromReport();
           }
           if (!family2) {
-            const out3 = await safeCommand();
-            family2 = familyFromCommand(out3);
+            const out4 = await safeCommand();
+            family2 = familyFromCommand(out4);
           }
         }
       }
@@ -12543,8 +12633,8 @@ var require_detect_libc = __commonJS({
             family2 = familyFromReport();
           }
           if (!family2) {
-            const out3 = safeCommandSync();
-            family2 = familyFromCommand(out3);
+            const out4 = safeCommandSync();
+            family2 = familyFromCommand(out4);
           }
         }
       }
@@ -12590,8 +12680,8 @@ var require_detect_libc = __commonJS({
       return null;
     };
     var versionSuffix = (s2) => s2.trim().split(/\s+/)[1];
-    var versionFromCommand = (out3) => {
-      const [getconf, ldd1, ldd2] = out3.split(/[\r\n]+/);
+    var versionFromCommand = (out4) => {
+      const [getconf, ldd1, ldd2] = out4.split(/[\r\n]+/);
       if (getconf && getconf.includes(GLIBC)) {
         return versionSuffix(getconf);
       }
@@ -12608,8 +12698,8 @@ var require_detect_libc = __commonJS({
           version3 = versionFromReport();
         }
         if (!version3) {
-          const out3 = await safeCommand();
-          version3 = versionFromCommand(out3);
+          const out4 = await safeCommand();
+          version3 = versionFromCommand(out4);
         }
       }
       return version3;
@@ -12622,8 +12712,8 @@ var require_detect_libc = __commonJS({
           version3 = versionFromReport();
         }
         if (!version3) {
-          const out3 = safeCommandSync();
-          version3 = versionFromCommand(out3);
+          const out4 = safeCommandSync();
+          version3 = versionFromCommand(out4);
         }
       }
       return version3;
@@ -16868,7 +16958,7 @@ var init_gateway = __esm({
             const message = sanitizeTelegramOutput(error.message, this.deps.exactSecrets).slice(0, 500);
             updateTelegramRuntimeStatus({ running: false, readiness: "error", lastError: message });
             if (error instanceof TelegramApiError && error.code === 409) return;
-            await new Promise((resolve19) => setTimeout(resolve19, 1e3));
+            await new Promise((resolve21) => setTimeout(resolve21, 1e3));
           }
         }
       }
@@ -22999,7 +23089,7 @@ var require_parseParams = __commonJS({
 var require_basename = __commonJS({
   "../node_modules/.pnpm/@fastify+busboy@3.2.0/node_modules/@fastify/busboy/lib/utils/basename.js"(exports, module) {
     "use strict";
-    module.exports = function basename6(path2) {
+    module.exports = function basename7(path2) {
       if (typeof path2 !== "string") {
         return "";
       }
@@ -23026,7 +23116,7 @@ var require_multipart = __commonJS({
     var Dicer = require_Dicer();
     var parseParams = require_parseParams();
     var decodeText = require_decodeText();
-    var basename6 = require_basename();
+    var basename7 = require_basename();
     var getLimit = require_getLimit();
     var RE_BOUNDARY = /^boundary$/i;
     var RE_FIELD = /^form-data$/i;
@@ -23143,7 +23233,7 @@ var require_multipart = __commonJS({
               } else if (RE_FILENAME.test(parsed[i][0])) {
                 filename = parsed[i][1];
                 if (!preservePath) {
-                  filename = basename6(filename);
+                  filename = basename7(filename);
                 }
               }
             }
@@ -24226,14 +24316,14 @@ var require_stream_consumer = __commonJS({
   "../node_modules/.pnpm/@fastify+multipart@10.1.0/node_modules/@fastify/multipart/lib/stream-consumer.js"(exports, module) {
     "use strict";
     module.exports = function streamToNull(stream2) {
-      return new Promise((resolve19, reject2) => {
+      return new Promise((resolve21, reject2) => {
         stream2.on("data", () => {
         });
         stream2.on("close", () => {
-          resolve19();
+          resolve21();
         });
         stream2.on("end", () => {
-          resolve19();
+          resolve21();
         });
         stream2.on("error", (error) => {
           reject2(error);
@@ -24682,10 +24772,10 @@ var require_multipart2 = __commonJS({
           }
         };
         const parts = () => {
-          return new Promise((resolve19, reject2) => {
+          return new Promise((resolve21, reject2) => {
             handle((val) => {
               if (val instanceof Error) return reject2(val);
-              resolve19(val);
+              resolve21(val);
             });
           });
         };
@@ -25073,10 +25163,10 @@ function components(rel) {
   return parts;
 }
 async function canonicalRoot(root) {
-  const out3 = await realpath(root).catch(() => denied("root tidak ada"));
-  const stat3 = await lstat(out3);
-  if (!stat3.isDirectory() || stat3.isSymbolicLink()) denied("root bukan direktori regular");
-  return out3;
+  const out4 = await realpath(root).catch(() => denied("root tidak ada"));
+  const stat4 = await lstat(out4);
+  if (!stat4.isDirectory() || stat4.isSymbolicLink()) denied("root bukan direktori regular");
+  return out4;
 }
 function beneath(root, candidate) {
   const rel = relative(root, candidate);
@@ -25093,8 +25183,8 @@ async function ensureRepoParents(root, rel) {
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
     }
-    const stat3 = await lstat(current);
-    if (stat3.isSymbolicLink() || !stat3.isDirectory()) denied("parent tidak aman");
+    const stat4 = await lstat(current);
+    if (stat4.isSymbolicLink() || !stat4.isDirectory()) denied("parent tidak aman");
     const canonical = await realpath(current);
     if (!beneath(base2, canonical) || canonical !== current) denied("parent keluar root");
   }
@@ -25110,8 +25200,8 @@ function ensureRepoParentsSync(root, rel) {
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
     }
-    const stat3 = lstatSync(current);
-    if (stat3.isSymbolicLink() || !stat3.isDirectory()) denied("parent tidak aman");
+    const stat4 = lstatSync(current);
+    if (stat4.isSymbolicLink() || !stat4.isDirectory()) denied("parent tidak aman");
     if (realpathSync2(current) !== current || !beneath(base2, current)) denied("parent keluar root");
   }
 }
@@ -25121,14 +25211,14 @@ async function resolveRepoEntry(root, rel, opts = {}) {
   let current = base2;
   for (let i = 0; i < parts.length; i++) {
     current = join6(current, parts[i]);
-    const stat3 = await lstat(current).catch((error) => {
+    const stat4 = await lstat(current).catch((error) => {
       if (error.code === "ENOENT" && opts.allowMissingTail) return null;
       if (error.code === "ENOENT" && opts.allowMissingFinal && i === parts.length - 1) return null;
       return denied("komponen tidak ada");
     });
-    if (!stat3) break;
-    if (stat3.isSymbolicLink()) denied("symlink");
-    if (i < parts.length - 1 && !stat3.isDirectory()) denied("parent bukan direktori");
+    if (!stat4) break;
+    if (stat4.isSymbolicLink()) denied("symlink");
+    if (i < parts.length - 1 && !stat4.isDirectory()) denied("parent bukan direktori");
   }
   if (!beneath(base2, resolve9(current))) denied("keluar root");
   const parent = resolve9(current, "..");
@@ -25143,9 +25233,9 @@ function assertSafeRepoPathSync(root, rel, allowMissingFinal = false, allowMissi
   for (let i = 0; i < parts.length; i++) {
     current = join6(current, parts[i]);
     try {
-      const stat3 = lstatSync(current);
-      if (stat3.isSymbolicLink()) denied("symlink");
-      if (i < parts.length - 1 && !stat3.isDirectory()) denied("parent bukan direktori");
+      const stat4 = lstatSync(current);
+      if (stat4.isSymbolicLink()) denied("symlink");
+      if (i < parts.length - 1 && !stat4.isDirectory()) denied("parent bukan direktori");
     } catch (error) {
       if (allowMissingTail && error.code === "ENOENT") break;
       if (allowMissingFinal && error.code === "ENOENT" && i === parts.length - 1) break;
@@ -25200,8 +25290,8 @@ async function readRepoFile(root, rel) {
   const entry = await resolveRepoEntry(root, rel);
   const handle = await open2(entry.path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0)).catch(() => denied("final component tidak aman"));
   try {
-    const stat3 = await handle.stat();
-    if (!stat3.isFile()) denied("bukan file regular");
+    const stat4 = await handle.stat();
+    if (!stat4.isFile()) denied("bukan file regular");
     return await handle.readFile();
   } finally {
     await handle.close();
@@ -25430,13 +25520,13 @@ async function deleteSynced(entity, id, deviceId) {
   return true;
 }
 async function listPendingDeletes() {
-  const out3 = [];
+  const out4 = [];
   for (const item of await listOutbox()) {
     const tomb = await findTombstone(item.entity, item.recordId);
     if (!tomb) continue;
-    out3.push({ entity: item.entity, recordId: item.recordId, deletedAt: tomb.deletedAt.toISOString() });
+    out4.push({ entity: item.entity, recordId: item.recordId, deletedAt: tomb.deletedAt.toISOString() });
   }
-  return out3;
+  return out4;
 }
 
 // src/services/branches.ts
@@ -26651,8 +26741,8 @@ var FileTokenizer = class _FileTokenizer extends AbstractTokenizer {
    */
   static async fromFile(sourceFilePath) {
     const fileHandle = await fsOpen(sourceFilePath, "r");
-    const stat3 = await fileHandle.stat();
-    return new _FileTokenizer(fileHandle, { fileInfo: { path: sourceFilePath, size: stat3.size } });
+    const stat4 = await fileHandle.stat();
+    return new _FileTokenizer(fileHandle, { fileInfo: { path: sourceFilePath, size: stat4.size } });
   }
   constructor(fileHandle, options2) {
     super(options2);
@@ -26931,18 +27021,18 @@ function decodeLatin1(bytes) {
 }
 function decodeWindows1252(bytes) {
   const parts = [];
-  let out3 = "";
+  let out4 = "";
   for (let i = 0; i < bytes.length; i++) {
     const b = bytes[i];
     const extra = b >= 128 && b <= 159 ? WINDOWS_1252_EXTRA[b] : void 0;
-    out3 += extra !== null && extra !== void 0 ? extra : String.fromCharCode(b);
-    if (out3.length >= CHUNK) {
-      parts.push(out3);
-      out3 = "";
+    out4 += extra !== null && extra !== void 0 ? extra : String.fromCharCode(b);
+    if (out4.length >= CHUNK) {
+      parts.push(out4);
+      out4 = "";
     }
   }
-  if (out3)
-    parts.push(out3);
+  if (out4)
+    parts.push(out4);
   return parts.join("");
 }
 
@@ -28224,7 +28314,7 @@ function readByobReaderWithSignal(reader, buffer2, signal) {
     return reader.read(buffer2);
   }
   signal.throwIfAborted();
-  return new Promise((resolve19, reject2) => {
+  return new Promise((resolve21, reject2) => {
     const cleanup = () => {
       signal.removeEventListener("abort", onAbort);
     };
@@ -28244,7 +28334,7 @@ function readByobReaderWithSignal(reader, buffer2, signal) {
       try {
         const result = await reader.read(buffer2);
         cleanup();
-        resolve19(result);
+        resolve21(result);
       } catch (error) {
         cleanup();
         reject2(error);
@@ -31364,14 +31454,14 @@ function metadata(callback) {
     return this;
   } else {
     if (this._isStreamInput()) {
-      return new Promise((resolve19, reject2) => {
+      return new Promise((resolve21, reject2) => {
         const finished = () => {
           this._flattenBufferIn();
           sharp_default.metadata(this.options, (err, metadata2) => {
             if (err) {
               reject2(is_default.nativeError(err, stack));
             } else {
-              resolve19(metadata2);
+              resolve21(metadata2);
             }
           });
         };
@@ -31382,12 +31472,12 @@ function metadata(callback) {
         }
       });
     } else {
-      return new Promise((resolve19, reject2) => {
+      return new Promise((resolve21, reject2) => {
         sharp_default.metadata(this.options, (err, metadata2) => {
           if (err) {
             reject2(is_default.nativeError(err, stack));
           } else {
-            resolve19(metadata2);
+            resolve21(metadata2);
           }
         });
       });
@@ -31420,25 +31510,25 @@ function stats(callback) {
     return this;
   } else {
     if (this._isStreamInput()) {
-      return new Promise((resolve19, reject2) => {
+      return new Promise((resolve21, reject2) => {
         this.on("finish", function() {
           this._flattenBufferIn();
           sharp_default.stats(this.options, (err, stats2) => {
             if (err) {
               reject2(is_default.nativeError(err, stack));
             } else {
-              resolve19(stats2);
+              resolve21(stats2);
             }
           });
         });
       });
     } else {
-      return new Promise((resolve19, reject2) => {
+      return new Promise((resolve21, reject2) => {
         sharp_default.stats(this.options, (err, stats2) => {
           if (err) {
             reject2(is_default.nativeError(err, stack));
           } else {
-            resolve19(stats2);
+            resolve21(stats2);
           }
         });
       });
@@ -33267,7 +33357,7 @@ function _pipeline(callback, stack) {
     return this;
   } else {
     if (this._isStreamInput()) {
-      return new Promise((resolve19, reject2) => {
+      return new Promise((resolve21, reject2) => {
         this.once("finish", () => {
           this._flattenBufferIn();
           sharp_default.pipeline(this.options, (err, data, info) => {
@@ -33275,24 +33365,24 @@ function _pipeline(callback, stack) {
               reject2(is_default.nativeError(err, stack));
             } else {
               if (this.options.resolveWithObject) {
-                resolve19({ data, info });
+                resolve21({ data, info });
               } else {
-                resolve19(data);
+                resolve21(data);
               }
             }
           });
         });
       });
     } else {
-      return new Promise((resolve19, reject2) => {
+      return new Promise((resolve21, reject2) => {
         sharp_default.pipeline(this.options, (err, data, info) => {
           if (err) {
             reject2(is_default.nativeError(err, stack));
           } else {
             if (this.options.resolveWithObject) {
-              resolve19({ data, info });
+              resolve21({ data, info });
             } else {
-              resolve19(data);
+              resolve21(data);
             }
           }
         });
@@ -33497,11 +33587,11 @@ var UploadError = class extends Error {
   }
 };
 function timeout2(promise, ms, code) {
-  return new Promise((resolve19, reject2) => {
+  return new Promise((resolve21, reject2) => {
     const timer9 = setTimeout(() => reject2(new UploadError(code, "upload operation timed out")), ms);
     promise.then((value) => {
       clearTimeout(timer9);
-      resolve19(value);
+      resolve21(value);
     }, (error) => {
       clearTimeout(timer9);
       reject2(error);
@@ -33522,7 +33612,7 @@ function scannerFromEnv(path2) {
     return Promise.resolve();
   }
   if (!isAbsolute4(command)) return Promise.reject(new UploadError("UPLOAD_SCAN", "scanner path must be absolute"));
-  return new Promise((resolve19, reject2) => {
+  return new Promise((resolve21, reject2) => {
     const child = spawn2(command, [path2], { shell: false, stdio: "ignore" });
     const timer9 = setTimeout(() => {
       child.kill("SIGKILL");
@@ -33534,7 +33624,7 @@ function scannerFromEnv(path2) {
     });
     child.once("exit", (code) => {
       clearTimeout(timer9);
-      if (code === 0) resolve19();
+      if (code === 0) resolve21();
       else reject2(new UploadError("UPLOAD_SCAN", `scanner exit ${code}`));
     });
   });
@@ -33961,29 +34051,29 @@ var REASON_LABEL = {
 function dependsOnOf(spec) {
   const v = spec.dependsOn;
   if (!Array.isArray(v)) return [];
-  const out3 = [];
-  for (const x of v) if (typeof x === "string" && x !== "" && !out3.includes(x)) out3.push(x);
-  return out3;
+  const out4 = [];
+  for (const x of v) if (typeof x === "string" && x !== "" && !out4.includes(x)) out4.push(x);
+  return out4;
 }
 function blockersFor(spec, deps, tipOf, isMerged) {
   const ids = dependsOnOf(spec);
   if (ids.length === 0) return [];
   const base2 = spec.branchFrom ?? "HEAD";
-  const out3 = [];
+  const out4 = [];
   for (const id of ids) {
     const d = deps.get(id);
     if (!d) {
-      out3.push({ id, reason: "missing" });
+      out4.push({ id, reason: "missing" });
       continue;
     }
     if (d.stage !== "done") {
-      out3.push({ id, reason: "unfinished" });
+      out4.push({ id, reason: "unfinished" });
       continue;
     }
     const tip = tipOf(d);
-    if (tip && !isMerged(tip, base2)) out3.push({ id, reason: "unmerged" });
+    if (tip && !isMerged(tip, base2)) out4.push({ id, reason: "unmerged" });
   }
-  return out3;
+  return out4;
 }
 function blockedNote(bl) {
   return `menunggu ${bl.map((b) => `${b.id} (${REASON_LABEL[b.reason]})`).join(", ")}`;
@@ -34051,18 +34141,18 @@ async function decorateBlocked(specs) {
   const rows = await depRows(ids);
   const deps = new Map(rows.map((r) => [r.id, r]));
   const repos = /* @__PURE__ */ new Map();
-  const out3 = [];
+  const out4 = [];
   for (const s2 of specs) {
     const own = dependsOnOf(s2);
     if (own.length === 0) {
-      out3.push({ ...s2, dependsOn: [], blockedBy: [] });
+      out4.push({ ...s2, dependsOn: [], blockedBy: [] });
       continue;
     }
     if (!repos.has(s2.projectId)) repos.set(s2.projectId, await resolveRepoDir(s2.projectId));
     const repo = repos.get(s2.projectId);
-    out3.push({ ...s2, dependsOn: own, blockedBy: blockersFor(s2, deps, tipper(repo), merger(repo)) });
+    out4.push({ ...s2, dependsOn: own, blockedBy: blockersFor(s2, deps, tipper(repo), merger(repo)) });
   }
-  return out3;
+  return out4;
 }
 async function validateDependsOn(specId, projectId, raw2) {
   const ids = dependsOnOf({ dependsOn: raw2 });
@@ -35479,12 +35569,12 @@ ${content}</tr>
       return text;
     }
     href = cleanHref;
-    let out3 = '<a href="' + href + '"';
+    let out4 = '<a href="' + href + '"';
     if (title) {
-      out3 += ' title="' + title + '"';
+      out4 += ' title="' + title + '"';
     }
-    out3 += ">" + text + "</a>";
-    return out3;
+    out4 += ">" + text + "</a>";
+    return out4;
   }
   image(href, title, text) {
     const cleanHref = cleanUrl(href);
@@ -35492,12 +35582,12 @@ ${content}</tr>
       return text;
     }
     href = cleanHref;
-    let out3 = `<img src="${href}" alt="${text}"`;
+    let out4 = `<img src="${href}" alt="${text}"`;
     if (title) {
-      out3 += ` title="${title}"`;
+      out4 += ` title="${title}"`;
     }
-    out3 += ">";
-    return out3;
+    out4 += ">";
+    return out4;
   }
   text(text) {
     return text;
@@ -35562,14 +35652,14 @@ var _Parser = class __Parser {
    * Parse Loop
    */
   parse(tokens, top = true) {
-    let out3 = "";
+    let out4 = "";
     for (let i = 0; i < tokens.length; i++) {
       const token = tokens[i];
       if (this.options.extensions && this.options.extensions.renderers && this.options.extensions.renderers[token.type]) {
         const genericToken = token;
         const ret = this.options.extensions.renderers[genericToken.type].call({ parser: this }, genericToken);
         if (ret !== false || !["space", "hr", "heading", "code", "table", "blockquote", "list", "html", "paragraph", "text"].includes(genericToken.type)) {
-          out3 += ret || "";
+          out4 += ret || "";
           continue;
         }
       }
@@ -35578,17 +35668,17 @@ var _Parser = class __Parser {
           continue;
         }
         case "hr": {
-          out3 += this.renderer.hr();
+          out4 += this.renderer.hr();
           continue;
         }
         case "heading": {
           const headingToken = token;
-          out3 += this.renderer.heading(this.parseInline(headingToken.tokens), headingToken.depth, unescape(this.parseInline(headingToken.tokens, this.textRenderer)));
+          out4 += this.renderer.heading(this.parseInline(headingToken.tokens), headingToken.depth, unescape(this.parseInline(headingToken.tokens, this.textRenderer)));
           continue;
         }
         case "code": {
           const codeToken = token;
-          out3 += this.renderer.code(codeToken.text, codeToken.lang, !!codeToken.escaped);
+          out4 += this.renderer.code(codeToken.text, codeToken.lang, !!codeToken.escaped);
           continue;
         }
         case "table": {
@@ -35608,13 +35698,13 @@ var _Parser = class __Parser {
             }
             body += this.renderer.tablerow(cell);
           }
-          out3 += this.renderer.table(header2, body);
+          out4 += this.renderer.table(header2, body);
           continue;
         }
         case "blockquote": {
           const blockquoteToken = token;
           const body = this.parse(blockquoteToken.tokens);
-          out3 += this.renderer.blockquote(body);
+          out4 += this.renderer.blockquote(body);
           continue;
         }
         case "list": {
@@ -35649,17 +35739,17 @@ var _Parser = class __Parser {
             itemBody += this.parse(item.tokens, loose);
             body += this.renderer.listitem(itemBody, task, !!checked);
           }
-          out3 += this.renderer.list(body, ordered, start);
+          out4 += this.renderer.list(body, ordered, start);
           continue;
         }
         case "html": {
           const htmlToken = token;
-          out3 += this.renderer.html(htmlToken.text, htmlToken.block);
+          out4 += this.renderer.html(htmlToken.text, htmlToken.block);
           continue;
         }
         case "paragraph": {
           const paragraphToken = token;
-          out3 += this.renderer.paragraph(this.parseInline(paragraphToken.tokens));
+          out4 += this.renderer.paragraph(this.parseInline(paragraphToken.tokens));
           continue;
         }
         case "text": {
@@ -35669,7 +35759,7 @@ var _Parser = class __Parser {
             textToken = tokens[++i];
             body += "\n" + (textToken.tokens ? this.parseInline(textToken.tokens) : textToken.text);
           }
-          out3 += top ? this.renderer.paragraph(body) : body;
+          out4 += top ? this.renderer.paragraph(body) : body;
           continue;
         }
         default: {
@@ -35683,71 +35773,71 @@ var _Parser = class __Parser {
         }
       }
     }
-    return out3;
+    return out4;
   }
   /**
    * Parse Inline Tokens
    */
   parseInline(tokens, renderer) {
     renderer = renderer || this.renderer;
-    let out3 = "";
+    let out4 = "";
     for (let i = 0; i < tokens.length; i++) {
       const token = tokens[i];
       if (this.options.extensions && this.options.extensions.renderers && this.options.extensions.renderers[token.type]) {
         const ret = this.options.extensions.renderers[token.type].call({ parser: this }, token);
         if (ret !== false || !["escape", "html", "link", "image", "strong", "em", "codespan", "br", "del", "text"].includes(token.type)) {
-          out3 += ret || "";
+          out4 += ret || "";
           continue;
         }
       }
       switch (token.type) {
         case "escape": {
           const escapeToken = token;
-          out3 += renderer.text(escapeToken.text);
+          out4 += renderer.text(escapeToken.text);
           break;
         }
         case "html": {
           const tagToken = token;
-          out3 += renderer.html(tagToken.text);
+          out4 += renderer.html(tagToken.text);
           break;
         }
         case "link": {
           const linkToken = token;
-          out3 += renderer.link(linkToken.href, linkToken.title, this.parseInline(linkToken.tokens, renderer));
+          out4 += renderer.link(linkToken.href, linkToken.title, this.parseInline(linkToken.tokens, renderer));
           break;
         }
         case "image": {
           const imageToken = token;
-          out3 += renderer.image(imageToken.href, imageToken.title, imageToken.text);
+          out4 += renderer.image(imageToken.href, imageToken.title, imageToken.text);
           break;
         }
         case "strong": {
           const strongToken = token;
-          out3 += renderer.strong(this.parseInline(strongToken.tokens, renderer));
+          out4 += renderer.strong(this.parseInline(strongToken.tokens, renderer));
           break;
         }
         case "em": {
           const emToken = token;
-          out3 += renderer.em(this.parseInline(emToken.tokens, renderer));
+          out4 += renderer.em(this.parseInline(emToken.tokens, renderer));
           break;
         }
         case "codespan": {
           const codespanToken = token;
-          out3 += renderer.codespan(codespanToken.text);
+          out4 += renderer.codespan(codespanToken.text);
           break;
         }
         case "br": {
-          out3 += renderer.br();
+          out4 += renderer.br();
           break;
         }
         case "del": {
           const delToken = token;
-          out3 += renderer.del(this.parseInline(delToken.tokens, renderer));
+          out4 += renderer.del(this.parseInline(delToken.tokens, renderer));
           break;
         }
         case "text": {
           const textToken = token;
-          out3 += renderer.text(textToken.text);
+          out4 += renderer.text(textToken.text);
           break;
         }
         default: {
@@ -35761,7 +35851,7 @@ var _Parser = class __Parser {
         }
       }
     }
-    return out3;
+    return out4;
   }
 };
 var _Hooks = class {
@@ -36155,26 +36245,26 @@ function isDropped(cp) {
   return cp >= 126976 && cp <= 131071 || cp >= 9728 && cp <= 10175 || cp >= 65024 && cp <= 65039 || cp === 8205;
 }
 function toWinAnsi(s2) {
-  let out3 = "";
+  let out4 = "";
   for (const ch of s2 || "") {
     const t = TRANSLIT[ch];
     if (t !== void 0) {
-      out3 += t;
+      out4 += t;
       continue;
     }
     const cp = ch.codePointAt(0);
     if (cp <= 255) {
-      out3 += ch;
+      out4 += ch;
       continue;
     }
     if (WINANSI_EXTRA.has(ch)) {
-      out3 += ch;
+      out4 += ch;
       continue;
     }
     if (isDropped(cp)) continue;
-    out3 += "?";
+    out4 += "?";
   }
-  return out3;
+  return out4;
 }
 function downloadFilename(prefix, path2, ext) {
   const base2 = (path2.split("/").pop() ?? "").replace(/\.[^.]+$/, "");
@@ -36214,40 +36304,40 @@ function decodeEntities(s2) {
 }
 var inlineText2 = (s2) => decodeEntities(s2).replace(/\s*\n\s*/g, " ");
 function flatten2(tokens, base2 = { text: "" }) {
-  const out3 = [];
+  const out4 = [];
   for (const t of tokens ?? []) {
     switch (t.type) {
       case "strong":
-        out3.push(...flatten2(t.tokens, { ...base2, bold: true }));
+        out4.push(...flatten2(t.tokens, { ...base2, bold: true }));
         break;
       case "em":
-        out3.push(...flatten2(t.tokens, { ...base2, italic: true }));
+        out4.push(...flatten2(t.tokens, { ...base2, italic: true }));
         break;
       case "del":
-        out3.push(...flatten2(t.tokens, { ...base2, strike: true }));
+        out4.push(...flatten2(t.tokens, { ...base2, strike: true }));
         break;
       case "codespan":
-        out3.push({ ...base2, text: inlineText2(t.text ?? ""), mono: true });
+        out4.push({ ...base2, text: inlineText2(t.text ?? ""), mono: true });
         break;
       case "link":
-        out3.push(...flatten2(t.tokens, { ...base2, link: t.href }));
+        out4.push(...flatten2(t.tokens, { ...base2, link: t.href }));
         break;
       case "br":
-        out3.push({ ...base2, text: "\n" });
+        out4.push({ ...base2, text: "\n" });
         break;
       case "image":
-        out3.push({ ...base2, text: `[gambar: ${t.href ?? ""}]`, italic: true });
+        out4.push({ ...base2, text: `[gambar: ${t.href ?? ""}]`, italic: true });
         break;
       case "escape":
       case "text":
-        if (t.tokens?.length) out3.push(...flatten2(t.tokens, base2));
-        else out3.push({ ...base2, text: inlineText2(t.text ?? "") });
+        if (t.tokens?.length) out4.push(...flatten2(t.tokens, base2));
+        else out4.push({ ...base2, text: inlineText2(t.text ?? "") });
         break;
       default:
-        out3.push({ ...base2, text: inlineText2(t.text ?? "") });
+        out4.push({ ...base2, text: inlineText2(t.text ?? "") });
     }
   }
-  return out3;
+  return out4;
 }
 function drawRuns(doc, runs, size, color2, opts = {}) {
   const items = runs.filter((r) => r.text !== "");
@@ -36417,7 +36507,7 @@ function renderDocPdf(text, name2, meta) {
   });
   const chunks = [];
   doc.on("data", (c) => chunks.push(c));
-  const done = new Promise((resolve19) => doc.on("end", () => resolve19(Buffer.concat(chunks))));
+  const done = new Promise((resolve21) => doc.on("end", () => resolve21(Buffer.concat(chunks))));
   doc.font("Helvetica-Bold").fontSize(8).fillColor(BRASS).text(toWinAnsi(meta.eyebrow.toUpperCase()), { characterSpacing: 0.8 });
   doc.moveDown(0.25);
   doc.font("Helvetica-Bold").fontSize(17).fillColor(STRONG).text(toWinAnsi(name2.split("/").pop() ?? name2));
@@ -36521,7 +36611,7 @@ async function liveSpecs(filter = {}) {
   if (live.size === 0) return decorateBlocked(specs);
   const advanced = [];
   const doneNow = [];
-  const out3 = specs.map((s2) => {
+  const out4 = specs.map((s2) => {
     const entry = live.get(s2.id);
     if (!entry) return s2;
     const next = stageForRun(entry.phases, entry.cwd, s2.id);
@@ -36538,7 +36628,7 @@ async function liveSpecs(filter = {}) {
       await notifySynced("spec", a.id);
     }));
   await Promise.all(doneNow.map((d) => recordCompletion(d.specId, d.title, d.projectId)));
-  return decorateBlocked(out3);
+  return decorateBlocked(out4);
 }
 
 // src/services/launch-authority.ts
@@ -37060,12 +37150,12 @@ function parseBreakdown(md) {
     return [];
   }
   const arr = data && typeof data === "object" && Array.isArray(data.items) ? data.items : [];
-  const out3 = [];
+  const out4 = [];
   for (const it of arr) {
     const p = zBreakdownItem.safeParse(it);
-    if (p.success) out3.push(p.data);
+    if (p.success) out4.push(p.data);
   }
-  return out3;
+  return out4;
 }
 async function resolveDir3(projectId, sessions) {
   const live = sessions.find((s2) => s2.projectId === projectId && s2.flow === "breakdown" && !s2.exited && s2.cwd);
@@ -37135,8 +37225,9 @@ async function docs_default(app2) {
 
 // src/routes/ide.ts
 init_src2();
-import { basename as basename4 } from "node:path";
-import { spawn as spawn3 } from "node:child_process";
+import { basename as basename5, resolve as resolve16 } from "node:path";
+import { execFile as execFile10, spawn as spawn3 } from "node:child_process";
+import { promisify as promisify10 } from "node:util";
 
 // src/services/git-remotes.ts
 import { execFile as execFile5 } from "node:child_process";
@@ -37550,53 +37641,53 @@ function gitArgs(op) {
   }
 }
 async function afterMergeDelete(repoDir, branch, mergeOut, mergeErr) {
-  const out3 = [mergeOut], err = [mergeErr];
+  const out4 = [mergeOut], err = [mergeErr];
   const step = async (args) => {
     const r = await exec6("git", args, { cwd: repoDir, ...GIT5 });
-    out3.push(r.stdout);
+    out4.push(r.stdout);
     err.push(r.stderr);
   };
   try {
     await step(["branch", "-D", branch]);
     const hasOrigin = await exec6("git", ["rev-parse", "--verify", "--quiet", `refs/remotes/origin/${branch}`], { cwd: repoDir, ...GIT5 }).then(() => true).catch(() => false);
     if (hasOrigin) await step(["push", "origin", "--delete", branch]);
-    return { ok: true, stdout: out3.join("\n").trim(), stderr: err.join("\n").trim(), current: await currentBranch(repoDir) };
+    return { ok: true, stdout: out4.join("\n").trim(), stderr: err.join("\n").trim(), current: await currentBranch(repoDir) };
   } catch (e) {
     const ee = e;
-    return { ok: false, stdout: [...out3, ee.stdout ?? ""].join("\n").trim(), stderr: [...err, ee.stderr ?? String(e)].join("\n").trim(), current: await currentBranch(repoDir) };
+    return { ok: false, stdout: [...out4, ee.stdout ?? ""].join("\n").trim(), stderr: [...err, ee.stderr ?? String(e)].join("\n").trim(), current: await currentBranch(repoDir) };
   }
 }
 async function runDeleteBranch(repoDir, op) {
-  const out3 = [], err = [];
+  const out4 = [], err = [];
   const step = async (args) => {
     const r = await exec6("git", args, { cwd: repoDir, ...GIT5 });
-    out3.push(r.stdout);
+    out4.push(r.stdout);
     err.push(r.stderr);
   };
   try {
     if (op.local !== false) await step(gitArgs({ op: "delete-branch", name: op.name, force: op.force }));
     if (op.remote) await step(["push", "origin", "--delete", "--end-of-options", op.name]);
-    return { ok: true, stdout: out3.join("\n").trim(), stderr: err.join("\n").trim(), current: await currentBranch(repoDir) };
+    return { ok: true, stdout: out4.join("\n").trim(), stderr: err.join("\n").trim(), current: await currentBranch(repoDir) };
   } catch (e) {
     const ee = e;
-    return { ok: false, stdout: [...out3, ee.stdout ?? ""].join("\n").trim(), stderr: [...err, ee.stderr ?? String(e)].join("\n").trim(), current: await currentBranch(repoDir) };
+    return { ok: false, stdout: [...out4, ee.stdout ?? ""].join("\n").trim(), stderr: [...err, ee.stderr ?? String(e)].join("\n").trim(), current: await currentBranch(repoDir) };
   }
 }
 async function runTagOp(repoDir, op) {
-  const out3 = [], err = [];
+  const out4 = [], err = [];
   const step = async (args) => {
     const r = await exec6("git", args, { cwd: repoDir, ...GIT5 });
-    out3.push(r.stdout);
+    out4.push(r.stdout);
     err.push(r.stderr);
   };
   try {
     await step(gitArgs(op));
     if (op.op === "tag" && op.push) await step(["push", "origin", "--end-of-options", op.name]);
     if (op.op === "delete-tag" && op.remote) await step(["push", "origin", "--delete", "--end-of-options", op.name]);
-    return { ok: true, stdout: out3.join("\n").trim(), stderr: err.join("\n").trim(), current: await currentBranch(repoDir) };
+    return { ok: true, stdout: out4.join("\n").trim(), stderr: err.join("\n").trim(), current: await currentBranch(repoDir) };
   } catch (e) {
     const ee = e;
-    return { ok: false, stdout: [...out3, ee.stdout ?? ""].join("\n").trim(), stderr: [...err, ee.stderr ?? String(e)].join("\n").trim(), current: await currentBranch(repoDir) };
+    return { ok: false, stdout: [...out4, ee.stdout ?? ""].join("\n").trim(), stderr: [...err, ee.stderr ?? String(e)].join("\n").trim(), current: await currentBranch(repoDir) };
   }
 }
 async function runGitOp(repoDir, op) {
@@ -37679,22 +37770,32 @@ async function resolveBase(repoDir, want, current) {
   return current && current !== "HEAD" ? current : "HEAD";
 }
 async function worktreeBranches(repoDir) {
-  const s2 = /* @__PURE__ */ new Set();
-  for (const l of lines(await out2(repoDir, ["worktree", "list", "--porcelain"])))
-    if (l.startsWith("branch refs/heads/")) s2.add(l.slice("branch refs/heads/".length));
-  return s2;
+  const m = /* @__PURE__ */ new Map();
+  let path2 = "";
+  for (const l of lines(await out2(repoDir, ["worktree", "list", "--porcelain"]))) {
+    if (l.startsWith("worktree ")) path2 = l.slice("worktree ".length);
+    else if (l.startsWith("branch refs/heads/")) m.set(l.slice("branch refs/heads/".length), path2);
+  }
+  return m;
 }
 var SEP = "";
-async function lastCommits(repoDir) {
-  const fmt = ["%(refname:short)", "%(objectname)", "%(committerdate:iso-strict)", "%(contents:subject)"].join(SEP);
-  const m = /* @__PURE__ */ new Map();
+async function refIndex(repoDir) {
+  const fmt = [
+    "%(refname)",
+    "%(refname:short)",
+    "%(objectname)",
+    "%(committerdate:iso-strict)",
+    "%(contents:subject)"
+  ].join(SEP);
+  const idx = { locals: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Set(), meta: /* @__PURE__ */ new Map() };
   for (const l of lines(await out2(repoDir, ["for-each-ref", `--format=${fmt}`, "refs/heads", "refs/remotes/origin"]))) {
-    const [ref, sha, at, ...rest] = l.split(SEP);
+    const [full, ref, sha, at, ...rest] = l.split(SEP);
     const name2 = shortName(ref ?? "");
     if (!name2 || !sha) continue;
-    if (!m.has(name2)) m.set(name2, { sha, at: at ?? "", subject: rest.join(SEP) });
+    (full?.startsWith("refs/heads/") ? idx.locals : idx.remotes).add(name2);
+    if (!idx.meta.has(name2)) idx.meta.set(name2, { sha, at: at ?? "", subject: rest.join(SEP) });
   }
-  return m;
+  return idx;
 }
 async function listUnusedBranches(repoDir, opts) {
   if (!repoDir) return EMPTY;
@@ -37705,26 +37806,45 @@ async function listUnusedBranches(repoDir, opts) {
   if (!baseSha) return { ...EMPTY, current };
   const baseRemote = await revSha(repoDir, `origin/${base2}`) ? `origin/${base2}` : null;
   const baseRemoteSha = baseRemote ? await revSha(repoDir, baseRemote) : baseSha;
-  const [localMerged, remoteMerged, wt, meta] = await Promise.all([
+  const [localMerged, remoteMerged, wt, refs2] = await Promise.all([
     out2(repoDir, ["branch", "--merged", baseSha, "--format=%(refname:short)"]),
     out2(repoDir, ["branch", "-r", "--merged", baseRemoteSha, "--format=%(refname:short)"]),
     worktreeBranches(repoDir),
-    lastCommits(repoDir)
+    refIndex(repoDir)
   ]);
-  const locals = new Set(lines(localMerged).map(shortName).filter(Boolean));
-  const remotes = new Set(
+  const mergedLocals = new Set(lines(localMerged).map(shortName).filter(Boolean));
+  const mergedRemotes = new Set(
     lines(remoteMerged).filter((r) => r.startsWith("origin/")).map(shortName).filter(Boolean)
   );
-  const names = [.../* @__PURE__ */ new Set([...locals, ...remotes])].sort();
-  const branches = names.map((name2) => {
+  const all = opts.include === "all";
+  const names = [...new Set(all ? [...refs2.locals, ...refs2.remotes] : [...mergedLocals, ...mergedRemotes])].sort();
+  const branches = [];
+  for (const name2 of names) {
+    const local = refs2.locals.has(name2);
+    const remote = refs2.remotes.has(name2);
+    const mergedLocal = local && mergedLocals.has(name2);
+    const mergedRemote = remote && mergedRemotes.has(name2);
+    const merged = (!local || mergedLocal) && (!remote || mergedRemote);
+    if (!all && !merged) continue;
     const locks = [];
     if (name2 === current) locks.push("current");
     if (name2 === base2) locks.push("base");
     if (wt.has(name2)) locks.push("worktree");
     if (opts.openSpecBranches.has(name2)) locks.push("spec-open");
     if (opts.sessionBranches.has(name2)) locks.push("session");
-    return { name: name2, local: locals.has(name2), remote: remotes.has(name2), lastCommit: meta.get(name2) ?? null, locks };
-  });
+    const wtPath = wt.get(name2);
+    branches.push({
+      name: name2,
+      local,
+      remote,
+      mergedLocal,
+      mergedRemote,
+      merged,
+      lastCommit: refs2.meta.get(name2) ?? null,
+      locks,
+      ...wtPath ? { worktree: wtPath } : {}
+    });
+  }
   return { base: base2, baseRemote, current, branches };
 }
 function effectiveScope(want, b) {
@@ -37736,26 +37856,30 @@ function effectiveScope(want, b) {
   return "none";
 }
 async function deleteBranches(repoDir, names, opts) {
-  const report = await listUnusedBranches(repoDir, opts);
+  const report = await listUnusedBranches(repoDir, { ...opts, include: "all" });
   const byName = new Map(report.branches.map((b) => [b.name, b]));
   const results = [];
   for (const name2 of names) {
     const b = byName.get(name2);
     if (!b) {
+      results.push({ name: name2, ok: false, scope: "none", error: "branch tak ditemukan di repo" });
+      continue;
+    }
+    if (b.locks.length) {
       results.push({
         name: name2,
         ok: false,
         scope: "none",
-        error: `branch tak ditemukan di daftar ter-merge ke ${report.base}`
+        error: `terkunci: ${b.locks.map((l) => LOCK_REASON[l]).join(", ")}`
       });
       continue;
     }
-    if (b.locks.length) {
+    if (!b.merged && !opts.allowUnmerged) {
       results.push({
         name: name2,
         ok: false,
         scope: "none",
-        error: `terkunci: ${b.locks.map((l) => LOCK_REASON[l]).join(", ")}`
+        error: `belum ter-merge ke ${report.base} \u2014 commit-nya bisa hilang; butuh konfirmasi terpisah`
       });
       continue;
     }
@@ -37769,21 +37893,353 @@ async function deleteBranches(repoDir, names, opts) {
       });
       continue;
     }
+    const forced = scope !== "remote" && !b.mergedLocal;
     const r = await runGitOp(repoDir, {
       op: "delete-branch",
       name: name2,
       local: scope !== "remote",
-      remote: scope !== "local"
+      remote: scope !== "local",
+      force: forced
     });
-    results.push(r.ok ? { name: name2, ok: true, scope } : { name: name2, ok: false, scope, error: r.stderr || "hapus branch gagal" });
+    results.push(r.ok ? { name: name2, ok: true, scope, ...forced ? { forced: true } : {} } : { name: name2, ok: false, scope, error: r.stderr || "hapus branch gagal" });
   }
   return { base: report.base, results };
 }
 
+// src/services/worktree-list.ts
+import { execFile as execFile8 } from "node:child_process";
+import { realpathSync as realpathSync4 } from "node:fs";
+import { stat } from "node:fs/promises";
+import { basename as basename4, join as join11, resolve as resolve14, sep as sep4 } from "node:path";
+import { promisify as promisify8 } from "node:util";
+
+// src/services/session-worktree.ts
+import { resolve as resolve13, sep as sep3 } from "node:path";
+function ownsWorktree(repoDir, cwd) {
+  const base2 = resolve13(repoDir);
+  const dir2 = resolve13(cwd);
+  const container = resolve13(base2, ".worktrees");
+  return dir2 !== base2 && dir2 !== container && dir2.startsWith(container + sep3);
+}
+
+// src/services/worktree-list.ts
+var exec8 = promisify8(execFile8);
+var GIT7 = { timeout: 6e4, maxBuffer: 1 << 24, encoding: "utf8" };
+async function out3(cwd, args) {
+  try {
+    return (await exec8("git", args, { cwd, ...GIT7 })).stdout;
+  } catch {
+    return "";
+  }
+}
+function parseWorktreePorcelain(text) {
+  const rows = [];
+  let cur = null;
+  for (const raw2 of text.split("\n")) {
+    const line = raw2.replace(/\r$/, "");
+    if (line.startsWith("worktree ")) {
+      cur = {
+        path: line.slice("worktree ".length),
+        head: "",
+        branch: null,
+        prunable: false,
+        locked: false,
+        bare: false
+      };
+      rows.push(cur);
+    } else if (!cur) continue;
+    else if (line.startsWith("HEAD ")) cur.head = line.slice("HEAD ".length);
+    else if (line.startsWith("branch refs/heads/")) cur.branch = line.slice("branch refs/heads/".length);
+    else if (line === "bare") cur.bare = true;
+    else if (line === "locked" || line.startsWith("locked ")) cur.locked = true;
+    else if (line === "prunable" || line.startsWith("prunable ")) cur.prunable = true;
+  }
+  return rows;
+}
+var EMPTY2 = { repoDir: "", worktrees: [] };
+var real = (p) => {
+  try {
+    return realpathSync4(p);
+  } catch {
+    return resolve14(p);
+  }
+};
+async function bornAt(path2) {
+  try {
+    const st = await stat(join11(path2, ".git"));
+    const ms = st.birthtimeMs > 0 ? st.birthtimeMs : st.mtimeMs;
+    return new Date(ms).toISOString();
+  } catch {
+    return null;
+  }
+}
+async function listWorktrees(repoDir, inputs) {
+  if (!repoDir) return EMPTY2;
+  const base2 = resolve14(repoDir);
+  const baseReal = real(base2);
+  const text = await out3(base2, ["worktree", "list", "--porcelain"]);
+  const trash = resolve14(baseReal, ".worktrees", ".trash");
+  const sessions = new Map([...inputs.sessions].map(([cwd, s2]) => [real(cwd), s2]));
+  const rows = [];
+  for (const w of parseWorktreePorcelain(text)) {
+    const path2 = resolve14(w.path);
+    if (path2 === trash || path2.startsWith(trash + sep4)) continue;
+    const name2 = basename4(path2);
+    const deletable = ownsWorktree(baseReal, path2);
+    const spec = inputs.specs.get(name2);
+    rows.push({
+      path: path2,
+      name: name2,
+      head: w.head,
+      branch: w.branch,
+      prunable: w.prunable,
+      locked: w.locked,
+      deletable,
+      blocked: deletable ? null : path2 === baseReal ? "checkout project" : "di luar .worktrees project ini",
+      spec: spec ? { id: spec.id, stage: spec.stage } : null,
+      session: sessions.get(path2) ?? null,
+      createdAt: await bornAt(path2)
+    });
+  }
+  rows.sort((a, b) => Number(a.deletable) - Number(b.deletable) || a.name.localeCompare(b.name));
+  return { repoDir: base2, worktrees: rows };
+}
+async function worktreeStats(repoDir, w) {
+  const [sizeBytes, dirtyFiles, orphanCommits] = await Promise.all([
+    diskBytes(w),
+    dirtyCount(w),
+    orphanCount(resolve14(repoDir), w)
+  ]);
+  return { name: w.name, sizeBytes, dirtyFiles, orphanCommits };
+}
+async function diskBytes(w) {
+  if (w.prunable) return null;
+  try {
+    const { stdout } = await exec8(
+      "du",
+      ["-sk", w.path],
+      { timeout: 3e4, maxBuffer: 1 << 20, encoding: "utf8" }
+    );
+    const kb = Number.parseInt(stdout.trim().split(/\s+/)[0] ?? "", 10);
+    return Number.isFinite(kb) ? kb * 1024 : null;
+  } catch {
+    return null;
+  }
+}
+async function dirtyCount(w) {
+  if (w.prunable) return 0;
+  const s2 = await out3(w.path, ["status", "--porcelain"]);
+  return s2.split("\n").filter((l) => l.trim()).length;
+}
+async function orphanCount(repoDir, w) {
+  if (!w.head) return 0;
+  const args = ["rev-list", "--count", w.head, "--not"];
+  if (w.branch) args.push(`--exclude=${w.branch}`, "--branches", `--exclude=*/${w.branch}`, "--remotes", "--tags");
+  else args.push("--branches", "--remotes", "--tags");
+  const n2 = Number.parseInt((await out3(repoDir, args)).trim(), 10);
+  return Number.isFinite(n2) ? n2 : 0;
+}
+async function deleteWorktrees(repoDir, names, opts) {
+  const report = await listWorktrees(repoDir, opts);
+  const byName = new Map(report.worktrees.map((w) => [w.name, w]));
+  const results = [];
+  for (const name2 of names) {
+    const w = byName.get(name2);
+    if (!w) {
+      results.push({ name: name2, ok: false, cleanup: null, error: "worktree tak ditemukan" });
+      continue;
+    }
+    if (!w.deletable) {
+      results.push({ name: name2, ok: false, cleanup: null, error: `tak bisa dihapus: ${w.blocked}` });
+      continue;
+    }
+    const row = { name: name2, ok: true, cleanup: null };
+    try {
+      if (w.session) {
+        const closed = await opts.closeSession(w.session.id);
+        row.closedSession = w.session.id;
+        row.cleanup = closed?.cleanup ?? null;
+      }
+      if (!row.cleanup) row.cleanup = opts.release(report.repoDir, w.path);
+      await opts.prune(report.repoDir);
+      if (opts.withBranch && w.branch) {
+        const b = await opts.deleteBranch(report.repoDir, w.branch);
+        row.branch = { name: w.branch, ok: b.ok, ...b.error ? { error: b.error } : {} };
+      }
+    } catch (e) {
+      row.ok = false;
+      row.error = e.message;
+    }
+    results.push(row);
+  }
+  return { results };
+}
+
+// src/services/session-close.ts
+init_src2();
+init_db();
+init_pty();
+init_session_phases();
+init_notifications();
+init_stage_machine();
+
+// src/services/worktree-reaper.ts
+init_src2();
+init_db();
+import { execFile as execFile9 } from "node:child_process";
+import { readdir as readdir2, rm as rm4 } from "node:fs/promises";
+import { promisify as promisify9 } from "node:util";
+import { join as join12, resolve as resolve15 } from "node:path";
+init_notifications();
+var TICK_MS = 6e4;
+var trashDirOf = (repoDir) => resolve15(repoDir, ".worktrees", ".trash");
+var exec9 = promisify9(execFile9);
+var prodReaperDeps = {
+  rm: (path2) => rm4(path2, { recursive: true, force: true }),
+  prune: async (repoDir) => {
+    try {
+      await exec9("git", ["worktree", "prune"], { cwd: repoDir, timeout: 3e4 });
+    } catch {
+    }
+  },
+  repos: async () => {
+    const projects = await prisma.project.findMany({ select: { id: true } });
+    const seen = /* @__PURE__ */ new Set();
+    const out4 = [];
+    for (const p of projects) {
+      const repoDir = await resolveRepoDir(p.id);
+      if (!repoDir || seen.has(repoDir)) continue;
+      seen.add(repoDir);
+      out4.push({ projectId: p.id, repoDir });
+    }
+    return out4;
+  }
+};
+var pending = /* @__PURE__ */ new Map();
+var sessionIdOf = (entry) => entry.split(".")[0] ?? entry;
+function releaseWorktree(repoDir, cwd, projectId, deps = prodReaperDeps) {
+  let path2;
+  try {
+    path2 = realGit.trashWorktree(repoDir, cwd);
+  } catch {
+    realGit.removeWorktree(repoDir, cwd);
+    return null;
+  }
+  if (!path2) return null;
+  const entry = path2.slice(trashDirOf(repoDir).length + 1);
+  pending.set(path2, { path: path2, repoDir, projectId, entry, sessionId: sessionIdOf(entry), since: Date.now() });
+  reapSoon(repoDir, projectId, deps);
+  return entry;
+}
+var listCleanups = () => [...pending.values()].sort((a, b) => a.since - b.since).map((p) => ({
+  sessionId: p.sessionId,
+  projectId: p.projectId,
+  entry: p.entry,
+  since: new Date(p.since).toISOString(),
+  state: p.error ? "failed" : "closing",
+  ...p.error ? { error: p.error } : {}
+}));
+async function sweepRepo(repoDir, projectId, deps = prodReaperDeps) {
+  const dir2 = trashDirOf(repoDir);
+  let entries;
+  try {
+    entries = await readdir2(dir2);
+  } catch {
+    return 0;
+  }
+  let removed = 0;
+  for (const entry of entries) {
+    const path2 = join12(dir2, entry);
+    const known = pending.get(path2);
+    const row = known ?? { path: path2, repoDir, projectId, entry, sessionId: sessionIdOf(entry), since: Date.now() };
+    pending.set(path2, row);
+    try {
+      await deps.rm(path2);
+      pending.delete(path2);
+      removed++;
+    } catch (e) {
+      row.error = e.message;
+      await recordCleanupFailure(row.sessionId, row.projectId, entry, row.error);
+    }
+  }
+  if (removed) await deps.prune(repoDir);
+  return removed;
+}
+async function sweepAll(deps = prodReaperDeps) {
+  let removed = 0;
+  for (const { projectId, repoDir } of await deps.repos()) {
+    removed += await sweepRepo(repoDir, projectId, deps).catch(() => 0);
+  }
+  return removed;
+}
+var inFlight = /* @__PURE__ */ new Set();
+function reapSoon(repoDir, projectId, deps = prodReaperDeps) {
+  if (inFlight.has(repoDir)) return;
+  inFlight.add(repoDir);
+  void sweepRepo(repoDir, projectId, deps).catch((e) => console.error("sapuan worktree:", e)).finally(() => inFlight.delete(repoDir));
+}
+var timer;
+function startWorktreeReaper(deps = prodReaperDeps) {
+  if (timer) return;
+  void sweepAll(deps).catch((e) => console.error("sapuan worktree saat boot:", e));
+  timer = setInterval(() => {
+    void sweepAll(deps).catch(() => {
+    });
+  }, TICK_MS);
+  timer.unref();
+}
+
+// src/services/session-close.ts
+async function advanceStage(specId, repoDir, sessionId2, flow, worktree) {
+  const next = stageForRun(readPhases(phaseFilePath(repoDir, sessionId2), flow), worktree, specId);
+  if (!next) return;
+  const spec = await prisma.spec.findUnique({ where: { id: specId }, select: { stage: true, title: true, projectId: true } });
+  if (!spec || STAGES.indexOf(next) <= STAGES.indexOf(spec.stage)) return;
+  const { count } = await prisma.spec.updateMany({ where: { id: specId, stage: spec.stage }, data: { stage: next } });
+  if (count === 0) return;
+  let commitSha = null;
+  try {
+    commitSha = realGit.headSha(worktree);
+  } catch {
+  }
+  await recordSessionResult({
+    projectId: spec.projectId,
+    specId,
+    oldStage: spec.stage,
+    newStage: next,
+    commitSha,
+    branch: `hanoman/${sessionId2}`,
+    status: next === "done" ? "done" : "progress"
+  }).catch(() => {
+  });
+  if (next === "done") await recordCompletion(specId, spec.title, spec.projectId);
+}
+async function closeSession(id) {
+  const s2 = getSession(id);
+  if (!s2) return null;
+  if (s2.flow || s2.cwd.includes("/.worktrees/")) {
+    const repoDir = await resolveRepoDir(s2.projectId);
+    if (repoDir) {
+      if (s2.specId) {
+        if (s2.flow) await advanceStage(s2.specId, repoDir, id, s2.flow, s2.cwd);
+        await recordHeadSha(s2.specId, s2.cwd);
+      }
+      killSession(id);
+      const cleanup = ownsWorktree(repoDir, s2.cwd) ? releaseWorktree(repoDir, s2.cwd, s2.projectId) : null;
+      return { cleanup };
+    }
+  }
+  killSession(id);
+  return { cleanup: null };
+}
+
+// src/routes/ide.ts
+init_session_id();
+
 // src/services/repo-fs.ts
-import { lstat as lstat2, rename as rename3, rm as rm4 } from "node:fs/promises";
+import { lstat as lstat2, rename as rename3, rm as rm5 } from "node:fs/promises";
 import { createWriteStream } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join13 } from "node:path";
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { pipeline } from "node:stream/promises";
 var EntryExistsError = class extends Error {
@@ -37833,7 +38289,7 @@ async function deleteEntry(repoDir, rel) {
   const kind = await entryKind(repoDir, rel);
   if (!kind) throw new EntryMissingError(`tidak ada: ${rel}`);
   const { path: path2 } = await resolveRepoEntry(repoDir, rel);
-  await rm4(path2, { recursive: kind === "dir", force: false });
+  await rm5(path2, { recursive: kind === "dir", force: false });
   return { path: rel, kind };
 }
 async function saveUpload(repoDir, rel, source, opts = {}) {
@@ -37844,17 +38300,17 @@ async function saveUpload(repoDir, rel, source, opts = {}) {
   if (current && !opts.overwrite) return { status: "exists" };
   if (current && !current.isFile())
     throw new PathContainmentError("repository path ditolak: target bukan file regular");
-  const temp = join11(entry.parent, `.hanoman-${randomUUID6()}.tmp`);
+  const temp = join13(entry.parent, `.hanoman-${randomUUID6()}.tmp`);
   try {
     await pipeline(source, createWriteStream(temp, { flags: "wx", mode: 384 }));
     if (opts.isTruncated?.()) {
-      await rm4(temp, { force: true });
+      await rm5(temp, { force: true });
       return { status: "too-large" };
     }
     await rename3(temp, entry.path);
     return { status: "written" };
   } catch (error) {
-    await rm4(temp, { force: true });
+    await rm5(temp, { force: true });
     throw error;
   }
 }
@@ -37877,6 +38333,14 @@ async function lockInputs(id) {
     sessionBranches: new Set(sessions)
   };
 }
+async function worktreeInputs(id) {
+  const specs = await prisma.spec.findMany({ where: { projectId: id }, select: { id: true, stage: true } });
+  return {
+    specs: new Map(specs.map((s2) => [sessionIdForSpec(s2.id), { id: s2.id, stage: s2.stage }])),
+    sessions: new Map(listSessions().filter((s2) => s2.projectId === id && !s2.exited).map((s2) => [resolve16(s2.cwd), { id: s2.id, specId: s2.specId ?? null }]))
+  };
+}
+var execAsync = promisify10(execFile10);
 function entryError(reply, e) {
   if (e instanceof EntryMissingError) return reply.code(404).send({ error: "not found" });
   if (e instanceof EntryExistsError) return reply.code(409).send({ error: "sudah ada" });
@@ -38129,7 +38593,7 @@ async function ide_default(app2) {
     const fmt = q.format === "tar" ? "tar" : "zip";
     const child = spawn3("git", ["archive", `--format=${fmt}`, "--end-of-options", ref], { cwd: repoDir });
     reply.header("content-type", fmt === "zip" ? "application/zip" : "application/x-tar");
-    reply.header("content-disposition", `attachment; filename="${basename4(repoDir)}-${ref.replace(/[^\w.-]/g, "_")}.${fmt}"`);
+    reply.header("content-disposition", `attachment; filename="${basename5(repoDir)}-${ref.replace(/[^\w.-]/g, "_")}.${fmt}"`);
     return reply.send(child.stdout);
   });
   app2.get("/projects/:id/commit/:sha", async (req, reply) => {
@@ -38248,8 +38712,12 @@ async function ide_default(app2) {
     const { id } = req.params;
     const repoDir = await repoOf(id);
     if (repoDir === void 0) return reply.code(404).send({ error: "not found" });
-    const { base: base2 } = req.query;
-    return listUnusedBranches(repoDir, { base: base2, ...await lockInputs(id) });
+    const { base: base2, include } = req.query;
+    return listUnusedBranches(repoDir, {
+      base: base2,
+      include: include === "all" ? "all" : "merged",
+      ...await lockInputs(id)
+    });
   });
   app2.post("/projects/:id/branches/delete", async (req, reply) => {
     const { id } = req.params;
@@ -38261,12 +38729,60 @@ async function ide_default(app2) {
       return reply.code(400).send({ error: "names wajib berisi nama branch" });
     if (b.scope !== void 0 && b.scope !== "local" && b.scope !== "remote" && b.scope !== "both")
       return reply.code(400).send({ error: "scope harus local, remote, atau both" });
+    if (b.allowUnmerged !== void 0 && typeof b.allowUnmerged !== "boolean")
+      return reply.code(400).send({ error: "allowUnmerged harus boolean" });
     return deleteBranches(repoDir, b.names, {
       scope: b.scope ?? "both",
       base: typeof b.base === "string" && b.base ? b.base : void 0,
+      allowUnmerged: b.allowUnmerged === true,
       ...await lockInputs(id)
     });
   });
+  app2.get("/projects/:id/worktrees", async (req, reply) => {
+    const { id } = req.params;
+    const repoDir = await repoOf(id);
+    if (repoDir === void 0) return reply.code(404).send({ error: "not found" });
+    return listWorktrees(repoDir, await worktreeInputs(id));
+  });
+  app2.get("/projects/:id/worktrees/stats", async (req, reply) => {
+    const { id } = req.params;
+    const repoDir = await repoOf(id);
+    if (repoDir === void 0) return reply.code(404).send({ error: "not found" });
+    if (!repoDir) return reply.code(400).send({ error: "project tidak punya repoDir" });
+    const { name: name2 } = req.query;
+    const report = await listWorktrees(repoDir, await worktreeInputs(id));
+    const w = report.worktrees.find((x) => x.name === name2);
+    if (!w) return reply.code(404).send({ error: "not found" });
+    return worktreeStats(report.repoDir, w);
+  });
+  app2.post("/projects/:id/worktrees/delete", async (req, reply) => {
+    const { id } = req.params;
+    const repoDir = await repoOf(id);
+    if (repoDir === void 0) return reply.code(404).send({ error: "not found" });
+    if (!repoDir) return reply.code(400).send({ error: "project tidak punya repoDir" });
+    const b = req.body;
+    if (!Array.isArray(b?.names) || b.names.some((n2) => typeof n2 !== "string" || !n2))
+      return reply.code(400).send({ error: "names wajib berisi nama worktree" });
+    const locks = await lockInputs(id);
+    return deleteWorktrees(repoDir, b.names, {
+      withBranch: b.deleteBranch === true,
+      ...await worktreeInputs(id),
+      closeSession,
+      release: (repo, path2) => releaseWorktree(repo, path2, id),
+      prune: async (repo) => {
+        try {
+          await execAsync("git", ["worktree", "prune"], { cwd: repo, timeout: 3e4 });
+        } catch {
+        }
+      },
+      // Pagar kunci ADR-0077 ikut apa adanya — satu-satunya jalur hapus branch di codebase.
+      deleteBranch: async (repo, name2) => {
+        const r = await deleteBranches(repo, [name2], { scope: "both", ...locks });
+        const first = r.results[0];
+        return { ok: !!first?.ok, ...first?.error ? { error: first.error } : {} };
+      }
+    });
+  });
 }
 async function finishGraphOp(reply, id, repoDir, r, verb) {
   if (r.status === "error") return reply.code(r.code).send({ error: r.error });
@@ -38281,21 +38797,21 @@ async function finishGraphOp(reply, id, repoDir, r, verb) {
     CODE_STYLE_CLAUSE,
     `${verb} via git graph project ${id}.`
   ].join("\n\n");
-  const s2 = createSession(id, r.worktree, { id: basename4(r.worktree), model, effort, agent, prompt });
+  const s2 = createSession(id, r.worktree, { id: basename5(r.worktree), model, effort, agent, prompt });
   return { status: "conflict", sessionId: s2.id };
 }
 
 // src/routes/fs.ts
-import { readdir as readdir2 } from "node:fs/promises";
+import { readdir as readdir3 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
-import { resolve as resolve13, dirname as dirname9, join as join12 } from "node:path";
+import { resolve as resolve17, dirname as dirname9, join as join14 } from "node:path";
 async function fs_default(app2) {
   app2.get("/fs/browse", async (req, reply) => {
     const q = req.query.path;
-    const dir2 = q && q.trim() ? resolve13(q.trim()) : homedir4();
+    const dir2 = q && q.trim() ? resolve17(q.trim()) : homedir4();
     try {
-      const ents = await readdir2(dir2, { withFileTypes: true });
-      const entries = ents.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, path: join12(dir2, e.name) })).sort((a, b) => a.name.localeCompare(b.name));
+      const ents = await readdir3(dir2, { withFileTypes: true });
+      const entries = ents.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, path: join14(dir2, e.name) })).sort((a, b) => a.name.localeCompare(b.name));
       const parent = dirname9(dir2);
       return { path: dir2, parent: parent === dir2 ? null : parent, entries };
     } catch {
@@ -38498,8 +39014,8 @@ function setBounded(map, key, value, maxKeys) {
 // src/services/auth.ts
 init_db();
 import { randomBytes as randomBytes3, scrypt as scryptCb, timingSafeEqual as timingSafeEqual2, createHash as createHash6 } from "node:crypto";
-import { promisify as promisify8 } from "node:util";
-var scrypt = promisify8(scryptCb);
+import { promisify as promisify11 } from "node:util";
+var scrypt = promisify11(scryptCb);
 var COOKIE_NAME = "hn_session";
 var SESSION_TTL_MS = 7 * 24 * 3600 * 1e3;
 async function hashPassword(pw) {
@@ -38734,121 +39250,6 @@ function installCommand(m, agent, shell = shellBin()) {
   return [shell, "-lc", `${m.install[agent].join(" && ")}; exec '${shell}' -l`];
 }
 
-// src/services/session-worktree.ts
-import { resolve as resolve14, sep as sep3 } from "node:path";
-function ownsWorktree(repoDir, cwd) {
-  const base2 = resolve14(repoDir);
-  const dir2 = resolve14(cwd);
-  const container = resolve14(base2, ".worktrees");
-  return dir2 !== base2 && dir2 !== container && dir2.startsWith(container + sep3);
-}
-
-// src/services/worktree-reaper.ts
-init_src2();
-init_db();
-import { execFile as execFile8 } from "node:child_process";
-import { readdir as readdir3, rm as rm5 } from "node:fs/promises";
-import { promisify as promisify9 } from "node:util";
-import { join as join13, resolve as resolve15 } from "node:path";
-init_notifications();
-var TICK_MS = 6e4;
-var trashDirOf = (repoDir) => resolve15(repoDir, ".worktrees", ".trash");
-var exec8 = promisify9(execFile8);
-var prodReaperDeps = {
-  rm: (path2) => rm5(path2, { recursive: true, force: true }),
-  prune: async (repoDir) => {
-    try {
-      await exec8("git", ["worktree", "prune"], { cwd: repoDir, timeout: 3e4 });
-    } catch {
-    }
-  },
-  repos: async () => {
-    const projects = await prisma.project.findMany({ select: { id: true } });
-    const seen = /* @__PURE__ */ new Set();
-    const out3 = [];
-    for (const p of projects) {
-      const repoDir = await resolveRepoDir(p.id);
-      if (!repoDir || seen.has(repoDir)) continue;
-      seen.add(repoDir);
-      out3.push({ projectId: p.id, repoDir });
-    }
-    return out3;
-  }
-};
-var pending = /* @__PURE__ */ new Map();
-var sessionIdOf = (entry) => entry.split(".")[0] ?? entry;
-function releaseWorktree(repoDir, cwd, projectId, deps = prodReaperDeps) {
-  let path2;
-  try {
-    path2 = realGit.trashWorktree(repoDir, cwd);
-  } catch {
-    realGit.removeWorktree(repoDir, cwd);
-    return null;
-  }
-  if (!path2) return null;
-  const entry = path2.slice(trashDirOf(repoDir).length + 1);
-  pending.set(path2, { path: path2, repoDir, projectId, entry, sessionId: sessionIdOf(entry), since: Date.now() });
-  reapSoon(repoDir, projectId, deps);
-  return entry;
-}
-var listCleanups = () => [...pending.values()].sort((a, b) => a.since - b.since).map((p) => ({
-  sessionId: p.sessionId,
-  projectId: p.projectId,
-  entry: p.entry,
-  since: new Date(p.since).toISOString(),
-  state: p.error ? "failed" : "closing",
-  ...p.error ? { error: p.error } : {}
-}));
-async function sweepRepo(repoDir, projectId, deps = prodReaperDeps) {
-  const dir2 = trashDirOf(repoDir);
-  let entries;
-  try {
-    entries = await readdir3(dir2);
-  } catch {
-    return 0;
-  }
-  let removed = 0;
-  for (const entry of entries) {
-    const path2 = join13(dir2, entry);
-    const known = pending.get(path2);
-    const row = known ?? { path: path2, repoDir, projectId, entry, sessionId: sessionIdOf(entry), since: Date.now() };
-    pending.set(path2, row);
-    try {
-      await deps.rm(path2);
-      pending.delete(path2);
-      removed++;
-    } catch (e) {
-      row.error = e.message;
-      await recordCleanupFailure(row.sessionId, row.projectId, entry, row.error);
-    }
-  }
-  if (removed) await deps.prune(repoDir);
-  return removed;
-}
-async function sweepAll(deps = prodReaperDeps) {
-  let removed = 0;
-  for (const { projectId, repoDir } of await deps.repos()) {
-    removed += await sweepRepo(repoDir, projectId, deps).catch(() => 0);
-  }
-  return removed;
-}
-var inFlight = /* @__PURE__ */ new Set();
-function reapSoon(repoDir, projectId, deps = prodReaperDeps) {
-  if (inFlight.has(repoDir)) return;
-  inFlight.add(repoDir);
-  void sweepRepo(repoDir, projectId, deps).catch((e) => console.error("sapuan worktree:", e)).finally(() => inFlight.delete(repoDir));
-}
-var timer;
-function startWorktreeReaper(deps = prodReaperDeps) {
-  if (timer) return;
-  void sweepAll(deps).catch((e) => console.error("sapuan worktree saat boot:", e));
-  timer = setInterval(() => {
-    void sweepAll(deps).catch(() => {
-    });
-  }, TICK_MS);
-  timer.unref();
-}
-
 // src/routes/terminal.ts
 init_notifications();
 init_stage_machine();
@@ -38856,30 +39257,6 @@ init_pty();
 init_uploads();
 var ATTACHMENT_MIME = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/webp"]);
 var TERMINAL_WS_MESSAGES_PER_MINUTE = 6e3;
-async function advanceStage(specId, repoDir, sessionId2, flow, worktree) {
-  const next = stageForRun(readPhases(phaseFilePath(repoDir, sessionId2), flow), worktree, specId);
-  if (!next) return;
-  const spec = await prisma.spec.findUnique({ where: { id: specId }, select: { stage: true, title: true, projectId: true } });
-  if (!spec || STAGES.indexOf(next) <= STAGES.indexOf(spec.stage)) return;
-  const { count } = await prisma.spec.updateMany({ where: { id: specId, stage: spec.stage }, data: { stage: next } });
-  if (count === 0) return;
-  let commitSha = null;
-  try {
-    commitSha = realGit.headSha(worktree);
-  } catch {
-  }
-  await recordSessionResult({
-    projectId: spec.projectId,
-    specId,
-    oldStage: spec.stage,
-    newStage: next,
-    commitSha,
-    branch: `hanoman/${sessionId2}`,
-    status: next === "done" ? "done" : "progress"
-  }).catch(() => {
-  });
-  if (next === "done") await recordCompletion(specId, spec.title, spec.projectId);
-}
 var ensureWorktree = (repoDir, wt, branchFrom) => {
   if (realGit.worktreeAlive(wt)) return true;
   realGit.addWorktree(repoDir, wt, branchFrom);
@@ -39161,22 +39538,9 @@ async function terminal_default(app2, opts) {
   app2.get("/terminal/cleanups", async () => ({ items: listCleanups() }));
   app2.delete("/terminal/sessions/:id", async (req, reply) => {
     const { id } = req.params;
-    const s2 = getSession(id);
-    if (!s2) return reply.code(404).send({ error: "not found" });
-    if (s2.flow || s2.cwd.includes("/.worktrees/")) {
-      const repoDir = await resolveRepoDir(s2.projectId);
-      if (repoDir) {
-        if (s2.specId) {
-          if (s2.flow) await advanceStage(s2.specId, repoDir, id, s2.flow, s2.cwd);
-          await recordHeadSha(s2.specId, s2.cwd);
-        }
-        killSession(id);
-        const cleanup = ownsWorktree(repoDir, s2.cwd) ? releaseWorktree(repoDir, s2.cwd, s2.projectId) : null;
-        return reply.code(202).send({ cleanup });
-      }
-    }
-    killSession(id);
-    return reply.code(202).send({ cleanup: null });
+    const r = await closeSession(id);
+    if (!r) return reply.code(404).send({ error: "not found" });
+    return reply.code(202).send(r);
   });
   app2.post("/terminal/sessions/:id/attachments", async (req, reply) => {
     const { id } = req.params;
@@ -39231,7 +39595,7 @@ async function terminal_default(app2, opts) {
       } catch {
         return;
       }
-      if (m.t === "in" && typeof m.d === "string") writeTo(id, m.d);
+      if (m.t === "in" && typeof m.d === "string") writeTo(id, m.d, client);
       else if (m.t === "resize" && m.cols && m.rows) resize(id, m.cols, m.rows);
     });
     const revalidate = setInterval(() => {
@@ -39428,7 +39792,7 @@ init_config2();
 import { spawn as spawn4 } from "node:child_process";
 import { mkdtempSync, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname10, join as join14 } from "node:path";
+import { dirname as dirname10, join as join15 } from "node:path";
 var sshBin = () => effectiveStr("HANOMAN_SSH_BIN") ?? "ssh";
 function consoleArgv(t) {
   return [
@@ -39443,8 +39807,8 @@ function consoleArgv(t) {
   ];
 }
 function askpassScript() {
-  const dir2 = mkdtempSync(join14(tmpdir3(), "hanoman-askpass-"));
-  const path2 = join14(dir2, "askpass.sh");
+  const dir2 = mkdtempSync(join15(tmpdir3(), "hanoman-askpass-"));
+  const path2 = join15(dir2, "askpass.sh");
   writeFileSync4(path2, `#!/bin/sh
 printf '%s' "$HANOMAN_SSH_PASSWORD"
 `, { mode: 448 });
@@ -39478,24 +39842,24 @@ function sshExec(t, remoteCmd, opts = {}) {
     SSH_ASKPASS_REQUIRE: "force",
     HANOMAN_SSH_PASSWORD: opts.password
   } : process.env;
-  return new Promise((resolve19) => {
+  return new Promise((resolve21) => {
     const p = spawn4(sshBin(), args, { stdio: ["pipe", "pipe", "pipe"], env });
-    let out3 = "";
+    let out4 = "";
     const timer9 = setTimeout(() => p.kill("SIGKILL"), opts.timeoutMs ?? 6e4);
     const done = (r) => {
       clearTimeout(timer9);
       if (askpass) rmSync4(dirname10(askpass), { recursive: true, force: true });
-      resolve19(r);
+      resolve21(r);
     };
     p.stdout.on("data", (d) => {
-      out3 += d;
+      out4 += d;
     });
     p.stderr.on("data", (d) => {
-      out3 += d;
+      out4 += d;
     });
     p.stdin.on("error", () => {
     });
-    p.on("close", (code) => done({ code: code ?? 1, out: out3 }));
+    p.on("close", (code) => done({ code: code ?? 1, out: out4 }));
     p.on("error", (e) => done({ code: 127, out: String(e) }));
     if (opts.stdin) p.stdin.write(opts.stdin);
     p.stdin.end();
@@ -39505,15 +39869,15 @@ function sshExec(t, remoteCmd, opts = {}) {
 // src/services/vps-audit.ts
 init_db();
 import { readFileSync as readFileSync7 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 
 // src/runner/deps.ts
 import { existsSync as existsSync11 } from "node:fs";
-import { dirname as dirname11, join as join15 } from "node:path";
+import { dirname as dirname11, join as join16 } from "node:path";
 function repoRootFrom(startDir) {
   let dir2 = startDir;
   for (let i = 0; i < 8; i++) {
-    if (existsSync11(join15(dir2, "pnpm-workspace.yaml"))) return dir2;
+    if (existsSync11(join16(dir2, "pnpm-workspace.yaml"))) return dir2;
     const parent = dirname11(dir2);
     if (parent === dir2) break;
     dir2 = parent;
@@ -39564,14 +39928,14 @@ function scoreCompliance(probeStatus, states, items = CATALOG) {
 // src/vps/drift.ts
 var REGRESS = /* @__PURE__ */ new Set(["fail", "warn"]);
 function computeDrift(prev, curr) {
-  const out3 = [];
+  const out4 = [];
   for (const [id, c] of Object.entries(curr)) {
     const p = prev[id];
     if (p && p.status === "pass" && REGRESS.has(c.status)) {
-      out3.push({ itemId: id, from: p.status, to: c.status });
+      out4.push({ itemId: id, from: p.status, to: c.status });
     }
   }
-  return out3;
+  return out4;
 }
 
 // src/services/vps-audit.ts
@@ -39585,33 +39949,33 @@ var CRITICAL = [
   "fail2ban",
   "auto_updates"
 ];
-function parseAudit(out3) {
-  return out3.split("\n").flatMap((line) => {
+function parseAudit(out4) {
+  return out4.split("\n").flatMap((line) => {
     const m = line.match(/^CHECK (\S+) (pass|fail|warn|na)(?: (.*))?$/);
     return m ? [{ check: m[1], status: m[2], detail: (m[3] ?? "").trim() }] : [];
   });
 }
-function parseStack(out3) {
+function parseStack(out4) {
   const d = {};
-  for (const line of out3.split("\n")) {
+  for (const line of out4.split("\n")) {
     const m = line.match(/^STACK (\S+) (present|absent)(?: (.*))?$/);
     if (m) d[m[1]] = { present: m[2] === "present", detail: (m[3] ?? "").trim() };
   }
   return d;
 }
 function mapToCatalog(checks) {
-  const out3 = {};
+  const out4 = {};
   for (const c of checks) {
     if (!byId(c.check)) continue;
-    out3[c.check] = c.status === "na" ? "unknown" : c.status;
+    out4[c.check] = c.status === "na" ? "unknown" : c.status;
   }
-  return out3;
+  return out4;
 }
 var isHardened = (checks) => CRITICAL.every((c) => checks.find((x) => x.check === c)?.status === "pass");
 var HEALTH_CMD = `echo HEALTH uptime $(uptime -p 2>/dev/null || uptime); echo HEALTH disk $(df -P / | awk 'NR==2{print $5}'); echo HEALTH mem $(free -m 2>/dev/null | awk 'NR==2{printf "%d/%dMB", $3, $2}'); echo HEALTH load $(cut -d" " -f1-3 /proc/loadavg)`;
-function parseHealth(out3) {
+function parseHealth(out4) {
   const h = {};
-  for (const line of out3.split("\n")) {
+  for (const line of out4.split("\n")) {
     const m = line.match(/^HEALTH (\S+) ?(.*)$/);
     if (m) h[m[1]] = m[2].trim();
   }
@@ -39619,7 +39983,7 @@ function parseHealth(out3) {
   return { uptime: h.uptime ?? "", disk: h.disk ?? "", mem: h.mem ?? "", load: h.load ?? "" };
 }
 var target = (v) => ({ host: v.host, port: v.port, user: v.user, keyPath: v.keyPath });
-var scriptPath = (f) => join16(repoRoot(), "server", "scripts", "vps", f);
+var scriptPath = (f) => join17(repoRoot(), "server", "scripts", "vps", f);
 async function itemStatesOf(vpsId) {
   const rows = await prisma.vpsItemState.findMany({ where: { vpsId } });
   return Object.fromEntries(rows.map((s2) => [s2.itemId, { na: s2.na, attested: s2.attested }]));
@@ -39677,8 +40041,8 @@ async function runHealth(v) {
 }
 
 // src/services/vps-remediate.ts
-function parseSteps(out3) {
-  return out3.split("\n").flatMap((line) => {
+function parseSteps(out4) {
+  return out4.split("\n").flatMap((line) => {
     const m = line.match(/^STEP (\S+) (would|ok|fail)(?: (.*))?$/);
     return m ? [{ item: m[1], status: m[2], detail: (m[3] ?? "").trim() }] : [];
   });
@@ -39769,25 +40133,25 @@ init_config2();
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { chmodSync as chmodSync3, copyFileSync, existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync9, unlinkSync as unlinkSync2 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 var keyDir = () => effectiveStr("HANOMAN_SSH_KEY_DIR") ?? resolveDataDirs().sshKeys;
 var KEY_FILES = ["id_ed25519", "id_ed25519.pub"];
 function adoptLegacyKey(dir2) {
   if (effectiveStr("HANOMAN_SSH_KEY_DIR")) return;
-  const legacy = join17(homedir5(), ".hanoman");
+  const legacy = join18(homedir5(), ".hanoman");
   if (legacy === dir2) return;
-  if (!KEY_FILES.every((f) => existsSync12(join17(legacy, f)))) return;
+  if (!KEY_FILES.every((f) => existsSync12(join18(legacy, f)))) return;
   mkdirSync8(dir2, { recursive: true, mode: 448 });
   for (const f of KEY_FILES) {
-    copyFileSync(join17(legacy, f), join17(dir2, f));
-    chmodSync3(join17(dir2, f), 384);
+    copyFileSync(join18(legacy, f), join18(dir2, f));
+    chmodSync3(join18(dir2, f), 384);
   }
-  for (const f of KEY_FILES) unlinkSync2(join17(legacy, f));
+  for (const f of KEY_FILES) unlinkSync2(join18(legacy, f));
   console.log(`vps: key SSH dipindah dari ${legacy} ke ${dir2} (SPEC-846 \u2014 satu batas backup)`);
 }
 function ensureHanomanKey() {
   const dir2 = keyDir();
-  const privPath = join17(dir2, KEY_FILES[0]);
+  const privPath = join18(dir2, KEY_FILES[0]);
   const pubPath = `${privPath}.pub`;
   if (!existsSync12(privPath)) adoptLegacyKey(dir2);
   if (!existsSync12(privPath)) {
@@ -40026,7 +40390,7 @@ init_config2();
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { readFileSync as readFileSync11 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 var USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 var TTL_MS2 = 3e4;
 var lastOk = null;
@@ -40039,7 +40403,7 @@ var LABELS = {
 var humanize = (k) => k.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
 var nowIso = () => (/* @__PURE__ */ new Date()).toISOString();
 function credsFile() {
-  return join18(effectiveStr("CLAUDE_CONFIG_DIR") ?? join18(homedir7(), ".claude"), ".credentials.json");
+  return join19(effectiveStr("CLAUDE_CONFIG_DIR") ?? join19(homedir7(), ".claude"), ".credentials.json");
 }
 function readAccessToken() {
   if (process.platform === "darwin" && !effectiveStr("CLAUDE_CONFIG_DIR")) {
@@ -40111,16 +40475,16 @@ async function getLimits() {
 }
 
 // src/services/codex-limits.ts
-import { open as open3, readdir as readdir4, stat } from "node:fs/promises";
+import { open as open3, readdir as readdir4, stat as stat2 } from "node:fs/promises";
 import { homedir as homedir8 } from "node:os";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 var TTL_MS3 = 3e4;
 var STALE_AFTER_MS = 12 * 36e5;
 var TAIL_BYTES = 512 * 1024;
 var MAX_FILES = 8;
 var cache3 = null;
 var freshUntil2 = 0;
-var codexSessionsDir = () => join19(process.env.CODEX_HOME ?? join19(homedir8(), ".codex"), "sessions");
+var codexSessionsDir = () => join20(process.env.CODEX_HOME ?? join20(homedir8(), ".codex"), "sessions");
 var UNAVAILABLE = { status: "unavailable", windows: [], fetchedAt: null, plan: null };
 function windowLabel(minutes) {
   if (minutes === 300) return "Sesi 5 jam";
@@ -40153,9 +40517,9 @@ async function recentRollouts(dir2) {
     return [];
   }
   const stamped = await Promise.all(entries.map(async (rel) => {
-    const full = join19(dir2, rel);
+    const full = join20(dir2, rel);
     try {
-      return { full, mtime: (await stat(full)).mtimeMs };
+      return { full, mtime: (await stat2(full)).mtimeMs };
     } catch {
       return null;
     }
@@ -40233,15 +40597,15 @@ async function limits(app2) {
 // src/services/codex-version.ts
 init_src();
 init_config2();
-import { execFile as execFile9 } from "node:child_process";
-import { promisify as promisify10 } from "node:util";
-var run = promisify10(execFile9);
+import { execFile as execFile11 } from "node:child_process";
+import { promisify as promisify12 } from "node:util";
+var run = promisify12(execFile11);
 var CODEX_MIN_CLIENT = "0.144.0";
 var TTL_MS4 = 5 * 6e4;
 var cache4 = null;
 var codexBin2 = () => effectiveStr("HANOMAN_CODEX_BIN") ?? "codex";
-function parseCodexVersion(out3) {
-  const m = /(\d+)\.(\d+)\.(\d+)/.exec(out3);
+function parseCodexVersion(out4) {
+  const m = /(\d+)\.(\d+)\.(\d+)/.exec(out4);
   return m ? `${m[1]}.${m[2]}.${m[3]}` : null;
 }
 async function getCodexVersion(now = Date.now()) {
@@ -40281,7 +40645,7 @@ init_src();
 init_src();
 init_config2();
 import { readFileSync as readFileSync12 } from "node:fs";
-import { resolve as resolve16, dirname as dirname12 } from "node:path";
+import { resolve as resolve18, dirname as dirname12 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var UPDATE_COMMAND = "npm i -g hanoman@latest --prefer-online";
 function composeUpdate(x) {
@@ -40307,7 +40671,7 @@ var lastLatest = null;
 var lastStatus = "unavailable";
 function runningVersion() {
   const here = dirname12(fileURLToPath3(import.meta.url));
-  for (const p of [resolve16(here, "build-info.json"), resolve16(here, "../package.json")]) {
+  for (const p of [resolve18(here, "build-info.json"), resolve18(here, "../package.json")]) {
     try {
       const v = JSON.parse(readFileSync12(p, "utf8")).version;
       if (typeof v === "string" && v) return v;
@@ -40823,11 +41187,11 @@ import { randomUUID as randomUUID8 } from "node:crypto";
 init_config2();
 init_src2();
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { mkdir as mkdir5, writeFile as writeFile4, readFile as readFile4, unlink as unlink4, readdir as readdir5, stat as stat2 } from "node:fs/promises";
-import { join as join20, resolve as resolve17, basename as basename5 } from "node:path";
+import { mkdir as mkdir5, writeFile as writeFile4, readFile as readFile4, unlink as unlink4, readdir as readdir5, stat as stat3 } from "node:fs/promises";
+import { join as join21, resolve as resolve19, basename as basename6 } from "node:path";
 var MAX_TRANSCRIPT_BYTES = 1024 * 1024;
 function transcriptDir() {
-  return resolve17(effectiveStr("HANOMAN_TRANSCRIPT_DIR")?.trim() || resolveDataDirs().transcripts);
+  return resolve19(effectiveStr("HANOMAN_TRANSCRIPT_DIR")?.trim() || resolveDataDirs().transcripts);
 }
 function clamp(text) {
   const buf = Buffer.from(text, "utf8");
@@ -40845,13 +41209,13 @@ async function saveTranscript(text) {
   const dir2 = transcriptDir();
   await mkdir5(dir2, { recursive: true, mode: 448 });
   const key = `${randomUUID7()}.log`;
-  await writeFile4(join20(dir2, key), body, { encoding: "utf8", mode: 384 });
+  await writeFile4(join21(dir2, key), body, { encoding: "utf8", mode: 384 });
   return { key, bytes: Buffer.byteLength(body, "utf8"), truncated };
 }
 async function readTranscript(key) {
   if (!key) return null;
   try {
-    return await readFile4(join20(transcriptDir(), basename5(key)), "utf8");
+    return await readFile4(join21(transcriptDir(), basename6(key)), "utf8");
   } catch {
     return null;
   }
@@ -40859,7 +41223,7 @@ async function readTranscript(key) {
 async function deleteTranscript(key) {
   if (!key) return;
   try {
-    await unlink4(join20(transcriptDir(), basename5(key)));
+    await unlink4(join21(transcriptDir(), basename6(key)));
   } catch (e) {
     if (e.code !== "ENOENT") throw e;
   }
@@ -40877,7 +41241,7 @@ async function listTranscripts() {
   for (const name2 of names) {
     if (!name2.endsWith(".log")) continue;
     try {
-      rows.push({ key: name2, mtimeMs: (await stat2(join20(dir2, name2))).mtimeMs });
+      rows.push({ key: name2, mtimeMs: (await stat3(join21(dir2, name2))).mtimeMs });
     } catch {
     }
   }
@@ -42171,12 +42535,12 @@ function parseLeadVerdict(raw2) {
 var SHA = /^[0-9a-f]{7,40}$/i;
 var isNonFileRef = (ref) => SHA.test(ref) || /^ADR-\d{4}$/i.test(ref);
 function keepExistingRefs(refs2, repoDir) {
-  const out3 = [];
+  const out4 = [];
   for (const raw2 of refs2) {
     const ref = raw2.trim();
     if (!ref) continue;
     if (isNonFileRef(ref)) {
-      out3.push(ref);
+      out4.push(ref);
       continue;
     }
     if (!repoDir) continue;
@@ -42184,9 +42548,9 @@ function keepExistingRefs(refs2, repoDir) {
     const full = resolvePath(repoDir, ref);
     const rel = relative2(repoDir, full);
     if (rel.startsWith("..")) continue;
-    if (existsSync14(full)) out3.push(ref);
+    if (existsSync14(full)) out4.push(ref);
   }
-  return [...new Set(out3)];
+  return [...new Set(out4)];
 }
 
 // src/services/lead/trail.ts
@@ -42335,11 +42699,11 @@ function toDecisionView(r) {
 init_config2();
 init_pty();
 init_session_sandbox();
-import { execFile as execFile10 } from "node:child_process";
+import { execFile as execFile12 } from "node:child_process";
 import { randomUUID as randomUUID9 } from "node:crypto";
 import { mkdirSync as mkdirSync9, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 var binFor = (agent) => agent === "codex" ? effectiveStr("HANOMAN_CODEX_BIN") ?? "codex" : effectiveStr("HANOMAN_CLAUDE_BIN") ?? "claude";
 function leadArgv(o) {
   if (o.agent === "codex") {
@@ -42367,11 +42731,11 @@ function leadProcess(prompt, o, env = process.env) {
   const mode = env.HANOMAN_SESSION_SANDBOX ?? (env.NODE_ENV === "production" ? "required" : "off");
   if (mode === "off") return { file, args: directArgs, cwd: o.cwd, cleanup: () => {
   } };
-  const promptDir = join21(tmpdir4(), "hanoman-prompts");
+  const promptDir = join22(tmpdir4(), "hanoman-prompts");
   mkdirSync9(promptDir, { recursive: true, mode: 448 });
-  const promptFile = join21(promptDir, `oneshot-${randomUUID9()}`);
+  const promptFile = join22(promptDir, `oneshot-${randomUUID9()}`);
   writeFileSync5(promptFile, prompt, { flag: "wx", mode: 384 });
-  const workspace = o.cwd ?? join21(tmpdir4(), `hanoman-oneshot-${randomUUID9()}`);
+  const workspace = o.cwd ?? join22(tmpdir4(), `hanoman-oneshot-${randomUUID9()}`);
   if (!o.cwd) mkdirSync9(workspace, { recursive: false, mode: 448 });
   try {
     const argsWithoutPrompt = directArgs.slice(0, -1);
@@ -42413,8 +42777,8 @@ function leadFailureReason(agent, timeoutMs, err, stdout, stderr) {
 }
 function think(prompt, o) {
   const process2 = leadProcess(prompt, o);
-  return new Promise((resolve19, reject2) => {
-    const child = execFile10(process2.file, process2.args, {
+  return new Promise((resolve21, reject2) => {
+    const child = execFile12(process2.file, process2.args, {
       cwd: process2.cwd,
       timeout: o.timeoutMs,
       maxBuffer: 16 * 1024 * 1024,
@@ -42427,7 +42791,7 @@ function think(prompt, o) {
         reject2(new Error(leadFailureReason(o.agent, o.timeoutMs, err, stdout, stderr)));
         return;
       }
-      resolve19(stdout);
+      resolve21(stdout);
     });
     child.stdin?.end();
   });
@@ -42464,9 +42828,9 @@ function acquire(cap, waitMs) {
     return Promise.resolve();
   }
   const startedAt = Date.now();
-  return new Promise((resolve19, reject2) => {
+  return new Promise((resolve21, reject2) => {
     const w = {
-      grant: resolve19,
+      grant: resolve21,
       deny: reject2,
       timer: setTimeout(() => {
         const i = queue2.indexOf(w);
@@ -42567,12 +42931,12 @@ async function expireFlows(now) {
     orderBy: { createdAt: "asc" },
     take: 100
   });
-  const out3 = [];
+  const out4 = [];
   for (const f of due) {
     const closed = await closeFlow(f.id, "kedaluwarsa");
-    if (closed) out3.push(closed);
+    if (closed) out4.push(closed);
   }
-  return out3;
+  return out4;
 }
 function toFlowView(r) {
   return {
@@ -43083,15 +43447,15 @@ var prodDetectDeps = {
   cfg: getLead
 };
 async function scanAndAnswer(deps = prodDetectDeps) {
-  const out3 = { answered: [], skipped: [] };
+  const out4 = { answered: [], skipped: [] };
   const cfg = await deps.cfg();
-  if (!cfg.enabled || cfg.paused) return out3;
+  if (!cfg.enabled || cfg.paused) return out4;
   const optIn = new Set(await deps.optIn());
   const sessions = deps.live();
   sweep(sessions.map((s2) => s2.id));
   const ready = [];
   for (const s2 of sessions) {
-    const skip = (reason) => out3.skipped.push({ id: s2.id, reason });
+    const skip = (reason) => out4.skipped.push({ id: s2.id, reason });
     if (!optIn.has(s2.projectId)) {
       skip("project tak opt-in lead");
       continue;
@@ -43181,16 +43545,16 @@ async function scanAndAnswer(deps = prodDetectDeps) {
       deps.clearMarker(s2.decisionFile);
       answers.set(s2.id, (answers.get(s2.id) ?? 0) + 1);
       failures.delete(s2.id);
-      out3.answered.push(s2.id);
+      out4.answered.push(s2.id);
       return;
     }
     if (chain.failed) {
       failures.set(s2.id, (failures.get(s2.id) ?? 0) + 1);
       failedAt.set(s2.id, deps.now());
     }
-    out3.skipped.push({ id: s2.id, reason: chain.reason });
+    out4.skipped.push({ id: s2.id, reason: chain.reason });
   });
-  return out3;
+  return out4;
 }
 async function runChain(s2, agent, deps) {
   let acted = false;
@@ -43300,7 +43664,7 @@ init_session_phases();
 init_notifications();
 var moduleOf = (p) => p.split("/").slice(0, 2).join("/");
 function findCollisions(areas) {
-  const out3 = [];
+  const out4 = [];
   for (let i = 0; i < areas.length; i++) {
     for (let j = i + 1; j < areas.length; j++) {
       const a = areas[i], b = areas[j];
@@ -43309,10 +43673,10 @@ function findCollisions(areas) {
       const shared = a.paths.filter((p) => bp.has(p));
       const bm = new Set(b.paths.map(moduleOf));
       const nearby = [...new Set(a.paths.map(moduleOf))].filter((m) => bm.has(m) && !shared.some((s2) => moduleOf(s2) === m));
-      if (shared.length || nearby.length) out3.push({ a, b, shared, nearby });
+      if (shared.length || nearby.length) out4.push({ a, b, shared, nearby });
     }
   }
-  return out3;
+  return out4;
 }
 var prodPulseDeps = {
   sessions: () => {
@@ -43828,8 +44192,8 @@ init_db();
 
 // src/services/changelog/collect.ts
 init_db();
-import { execFile as execFile11 } from "node:child_process";
-import { promisify as promisify11 } from "node:util";
+import { execFile as execFile13 } from "node:child_process";
+import { promisify as promisify13 } from "node:util";
 import { existsSync as existsSync15 } from "node:fs";
 
 // src/services/changelog/scrub.ts
@@ -43891,8 +44255,8 @@ async function collectBacklog(projectId, from, to) {
     notes.push(`${stampless} item selesai tanpa stempel waktu (selesai sebelum stempel ini ada) dan tak ikut dihitung.`);
   return { ok: true, input: { mode: "backlog", title: `${from} \u2013 ${to}`, items, notes } };
 }
-var exec9 = promisify11(execFile11);
-var GIT7 = { maxBuffer: 1 << 24, encoding: "utf8" };
+var exec10 = promisify13(execFile13);
+var GIT8 = { maxBuffer: 1 << 24, encoding: "utf8" };
 var US2 = "";
 var RS = "";
 var NO_REPO = "project ini belum ditautkan ke repo di mesin ini";
@@ -43901,25 +44265,25 @@ var usable = (repoDir) => !!repoDir && existsSync15(repoDir);
 async function listTags(repoDir) {
   if (!usable(repoDir)) return { tags: [], head: null, reason: NO_REPO };
   try {
-    const { stdout } = await exec9("git", ["tag", "--list", "--sort=-creatordate"], { cwd: repoDir, ...GIT7 });
+    const { stdout } = await exec10("git", ["tag", "--list", "--sort=-creatordate"], { cwd: repoDir, ...GIT8 });
     const tags = stdout.split("\n").map((s2) => s2.trim()).filter(Boolean);
-    const head = await exec9("git", ["rev-parse", "--short", "HEAD"], { cwd: repoDir, ...GIT7 }).then((r) => r.stdout.trim()).catch(() => null);
+    const head = await exec10("git", ["rev-parse", "--short", "HEAD"], { cwd: repoDir, ...GIT8 }).then((r) => r.stdout.trim()).catch(() => null);
     return { tags, head, reason: tags.length ? null : NO_TAG };
   } catch {
     return { tags: [], head: null, reason: NO_TAG };
   }
 }
 async function previousTag(repoDir, tag2) {
-  return exec9("git", ["describe", "--tags", "--abbrev=0", "--end-of-options", `${tag2}^`], { cwd: repoDir, ...GIT7 }).then((r) => r.stdout.trim() || null).catch(() => null);
+  return exec10("git", ["describe", "--tags", "--abbrev=0", "--end-of-options", `${tag2}^`], { cwd: repoDir, ...GIT8 }).then((r) => r.stdout.trim() || null).catch(() => null);
 }
 async function revExists(repoDir, rev) {
-  return exec9("git", ["rev-parse", "--verify", "--quiet", "--end-of-options", `${rev}^{commit}`], { cwd: repoDir, ...GIT7 }).then(() => true).catch(() => false);
+  return exec10("git", ["rev-parse", "--verify", "--quiet", "--end-of-options", `${rev}^{commit}`], { cwd: repoDir, ...GIT8 }).then(() => true).catch(() => false);
 }
 async function logRange(repoDir, range) {
-  const { stdout } = await exec9(
+  const { stdout } = await exec10(
     "git",
     ["log", "--no-merges", `--pretty=format:%s${US2}%b${RS}`, ...range],
-    { cwd: repoDir, ...GIT7 }
+    { cwd: repoDir, ...GIT8 }
   );
   return stdout.split(RS).map((rec) => rec.replace(/^\n+/, "")).filter((rec) => rec.trim()).map((rec) => {
     const [subject, body] = rec.split(US2);
@@ -44160,7 +44524,7 @@ init_db();
 init_src();
 import { readFileSync as readFileSync13 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 var home = () => process.env.HOME || homedir9();
 var readJson2 = (path2) => {
   try {
@@ -44177,25 +44541,25 @@ var serversOf = (node) => {
 var codexServers = () => {
   let text;
   try {
-    text = readFileSync13(join22(home(), ".codex", "config.toml"), "utf8");
+    text = readFileSync13(join23(home(), ".codex", "config.toml"), "utf8");
   } catch {
     return [];
   }
-  const out3 = [];
+  const out4 = [];
   for (const m of text.matchAll(/^\s*\[mcp_servers\.(?:"([^"]+)"|([A-Za-z0-9_-]+))(?:\.[^\]]*)?\]/gm)) {
     const name2 = m[1] ?? m[2];
-    if (name2) out3.push(name2);
+    if (name2) out4.push(name2);
   }
-  return out3;
+  return out4;
 };
 function mcpServerNames(repoDir) {
   const names = [];
-  const claudeJson = readJson2(join22(home(), ".claude.json"));
+  const claudeJson = readJson2(join23(home(), ".claude.json"));
   names.push(...serversOf(claudeJson));
   if (repoDir) {
     const projects = claudeJson?.projects;
     if (projects && typeof projects === "object") names.push(...serversOf(projects[repoDir]));
-    names.push(...serversOf(readJson2(join22(repoDir, ".mcp.json"))));
+    names.push(...serversOf(readJson2(join23(repoDir, ".mcp.json"))));
   }
   names.push(...codexServers());
   return [...new Set(names.filter(Boolean))].sort((a, b) => a.localeCompare(b));
@@ -44494,7 +44858,7 @@ async function resolveGithubRepo(projectId) {
 
 // src/services/github-fetch.ts
 init_config2();
-import { execFile as execFile12 } from "node:child_process";
+import { execFile as execFile14 } from "node:child_process";
 var labelNames = (l) => (l ?? []).map((x) => typeof x === "string" ? x : x.name ?? "").filter(Boolean);
 var norm2 = (s2) => s2.toLowerCase() === "closed" ? "closed" : "open";
 function issueFromGh(raw2) {
@@ -44534,15 +44898,15 @@ function issuesFromRest(raw2) {
 }
 var GH_FIELDS = "number,title,body,author,labels,url,state,createdAt,updatedAt";
 var API2 = "https://api.github.com";
-var defaultRunGh = (args, env) => new Promise((resolve19, reject2) => {
-  execFile12(
+var defaultRunGh = (args, env) => new Promise((resolve21, reject2) => {
+  execFile14(
     args[0],
     args.slice(1),
     { env, maxBuffer: 1 << 26, encoding: "utf8", timeout: 6e4 },
     (err, stdout, stderr) => {
       const e = err;
       if (e && (e.code === "ENOENT" || e.code === "EACCES")) return reject2(e);
-      resolve19({ code: err ? Number(err.code ?? 1) : 0, stdout, stderr });
+      resolve21({ code: err ? Number(err.code ?? 1) : 0, stdout, stderr });
     }
   );
 });
@@ -44577,20 +44941,20 @@ async function viaGh(repo, opts, deps) {
   ];
   const env = { ...process.env };
   if (deps.token) env.GH_TOKEN = deps.token;
-  let out3;
+  let out4;
   try {
-    out3 = await (deps.runGh ?? defaultRunGh)(args, env);
+    out4 = await (deps.runGh ?? defaultRunGh)(args, env);
   } catch {
     return { fallback: true, reason: "gh tak terpasang" };
   }
-  if (out3.code !== 0) {
-    const kind = classifyGhStderr(out3.stderr);
+  if (out4.code !== 0) {
+    const kind = classifyGhStderr(out4.stderr);
     if (kind === "unauth") return { fallback: true, reason: "gh tak terautentikasi" };
-    return { ok: false, kind, error: out3.stderr.trim() || `gh keluar dengan kode ${out3.code}` };
+    return { ok: false, kind, error: out4.stderr.trim() || `gh keluar dengan kode ${out4.code}` };
   }
   let raw2;
   try {
-    raw2 = JSON.parse(out3.stdout || "[]");
+    raw2 = JSON.parse(out4.stdout || "[]");
   } catch {
     return { ok: false, kind: "other", error: "keluaran gh bukan JSON" };
   }
@@ -45402,13 +45766,13 @@ async function webhooks_default(app2) {
         sentAt: res.ok ? /* @__PURE__ */ new Date() : null
       }
     });
-    const out3 = {
+    const out4 = {
       ok: res.ok,
       httpStatus: res.httpStatus,
       durationMs: res.durationMs,
       error: res.error
     };
-    return out3;
+    return out4;
   });
   app2.get("/webhooks/:id/deliveries", async (req, reply) => {
     const { id } = req.params;
@@ -45567,7 +45931,7 @@ init_settings2();
 // src/services/portal-chat/turn.ts
 init_src();
 init_db();
-import { execFile as execFile13 } from "node:child_process";
+import { execFile as execFile15 } from "node:child_process";
 
 // src/services/portal-chat/guard-input.ts
 import { randomBytes as randomBytes9 } from "node:crypto";
@@ -45681,7 +46045,7 @@ init_src();
 init_db();
 import { mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync2, rmSync as rmSync6, writeFileSync as writeFileSync7 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 var STAGE_LABEL = {
   brainstorming: "Dirumuskan",
   objective: "Dirumuskan",
@@ -45736,7 +46100,7 @@ ${c.body}
 ${baris.join("\n")}`;
 }
 async function buildChatWorkspace(projectId) {
-  const dir2 = mkdtempSync2(join23(tmpdir5(), "hanoman-portal-chat-"));
+  const dir2 = mkdtempSync2(join24(tmpdir5(), "hanoman-portal-chat-"));
   try {
     const project = await prisma.project.findUnique({
       where: { id: projectId },
@@ -45757,7 +46121,7 @@ async function buildChatWorkspace(projectId) {
     });
     const files = [];
     const tulis = (rel, isi) => {
-      writeFileSync7(join23(dir2, rel), isi, { mode: 384 });
+      writeFileSync7(join24(dir2, rel), isi, { mode: 384 });
       files.push(rel);
     };
     tulis("project.md", renderProjectDoc(project));
@@ -45766,11 +46130,11 @@ async function buildChatWorkspace(projectId) {
     tulis("catatan-rilis.md", renderChangelogDoc(changelogs));
     const prds = await listPrds(projectId);
     if (prds.length) {
-      mkdirSync10(join23(dir2, "dokumen"), { mode: 448 });
+      mkdirSync10(join24(dir2, "dokumen"), { mode: 448 });
       for (const prd of prds) {
         const isi = await readPrd(projectId, prd.path);
         if (!isi) continue;
-        tulis(join23("dokumen", `${prd.slug.replaceAll("/", "-")}.md`), isi);
+        tulis(join24("dokumen", `${prd.slug.replaceAll("/", "-")}.md`), isi);
       }
     }
     return { dir: dir2, files, cleanup: () => rmSync6(dir2, { recursive: true, force: true }) };
@@ -45852,8 +46216,8 @@ function chatFailureReason(err, stdout, stderr, timeoutMs) {
   return `chat portal gagal (${bagaimana}): ${detail}`;
 }
 function runProcess(p, timeoutMs) {
-  return new Promise((resolve19, reject2) => {
-    const child = execFile13(p.file, p.args, {
+  return new Promise((resolve21, reject2) => {
+    const child = execFile15(p.file, p.args, {
       cwd: p.cwd,
       timeout: timeoutMs,
       maxBuffer: 16 * 1024 * 1024,
@@ -45864,7 +46228,7 @@ function runProcess(p, timeoutMs) {
       stdout,
       stderr,
       timeoutMs
-    ))) : resolve19(stdout));
+    ))) : resolve21(stdout));
     child.stdin?.end();
   });
 }
@@ -46282,13 +46646,13 @@ init_db();
 // src/services/bootstrap.ts
 import { createHash as createHash9, randomBytes as randomBytes10, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
 import { chmod, lstat as lstat3, mkdir as mkdir6, readFile as readFile5, unlink as unlink5, writeFile as writeFile5 } from "node:fs/promises";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 var TTL_MS5 = 15 * 6e4;
 var SETUP_TOKEN_FILE = "setup.token";
 var BootstrapError = class extends Error {
   code = "BOOTSTRAP_PROOF";
 };
-var tokenPath = (home3) => join24(home3, SETUP_TOKEN_FILE);
+var tokenPath = (home3) => join25(home3, SETUP_TOKEN_FILE);
 async function readStored(home3) {
   try {
     const info = await lstat3(tokenPath(home3));
@@ -46503,7 +46867,10 @@ var IDE_SUBS = /* @__PURE__ */ new Set([
   // POST/PATCH/DELETE menuntut ide:write — capability yang sudah memberi hak menimpa isi
   // berkas apa pun lewat PUT /file (hindari kelas bug SPEC-405: prefix tanpa lihat method).
   "entry",
-  "upload"
+  "upload",
+  // SPEC-861 · ADR-0132 · daftar & hapus worktree hidup. `rw()` menurunkan read/write DARI METHOD,
+  // jadi POST /worktrees/delete menuntut ide:write (hindari kelas bug SPEC-405).
+  "worktrees"
 ]);
 function capabilityForRoute(method, path2) {
   const read2 = method === "GET" || method === "HEAD";
@@ -46675,16 +47042,16 @@ init_runtime();
 
 // src/services/ingress-policy.ts
 function origins(value, key) {
-  const out3 = [];
+  const out4 = [];
   for (const raw2 of value?.split(",") ?? []) {
     const input = raw2.trim();
     if (!input) continue;
     const parsed = new URL(input);
     if (!/^https?:$/.test(parsed.protocol) || parsed.username || parsed.password || parsed.pathname !== "/")
       throw new Error(`${key} harus berisi exact http(s) origin`);
-    out3.push({ host: parsed.host.toLowerCase(), base: `${parsed.protocol}//${parsed.host}` });
+    out4.push({ host: parsed.host.toLowerCase(), base: `${parsed.protocol}//${parsed.host}` });
   }
-  return out3;
+  return out4;
 }
 function loadIngressPolicy(env) {
   const pub = origins(env.HANOMAN_PUBLIC_ORIGINS, "HANOMAN_PUBLIC_ORIGINS");
@@ -47470,17 +47837,17 @@ function startWebhookEngine() {
 // src/services/auto-merge.ts
 init_src();
 init_db();
-import { execFile as execFile14 } from "node:child_process";
-import { promisify as promisify12 } from "node:util";
+import { execFile as execFile16 } from "node:child_process";
+import { promisify as promisify14 } from "node:util";
 init_notifications();
 var AUTO_MERGE_WINDOW_MS = 24 * 60 * 60 * 1e3;
 var AUTO_MERGE_GRACE_MS = 15 * 60 * 1e3;
 var TICK_MS5 = 6e4;
-var exec10 = promisify12(execFile14);
-var GIT8 = { timeout: 3e4, maxBuffer: 1 << 24, encoding: "utf8" };
+var exec11 = promisify14(execFile16);
+var GIT9 = { timeout: 3e4, maxBuffer: 1 << 24, encoding: "utf8" };
 var gitOut = async (cwd, args) => {
   try {
-    return (await exec10("git", args, { cwd, ...GIT8 })).stdout.trim();
+    return (await exec11("git", args, { cwd, ...GIT9 })).stdout.trim();
   } catch {
     return null;
   }
@@ -47589,13 +47956,13 @@ init_src2();
 
 // src/services/secure-home.ts
 import { chmod as chmod2, lstat as lstat4, mkdir as mkdir7 } from "node:fs/promises";
-import { isAbsolute as isAbsolute6, resolve as resolve18 } from "node:path";
+import { isAbsolute as isAbsolute6, resolve as resolve20 } from "node:path";
 var HomePermissionError = class extends Error {
   code = "HOME_SYMLINK";
 };
 async function assertNoSymlink(path2, allowMissing) {
   try {
-    const info = await lstat4(resolve18(path2));
+    const info = await lstat4(resolve20(path2));
     if (info.isSymbolicLink()) throw new HomePermissionError(`symlink ditolak: ${path2}`);
   } catch (error) {
     if (error.code === "ENOENT" && allowMissing) return;