hanoman 0.1.55 → 0.1.56

package/dist/cli.js

@@ -4657,8 +4657,16 @@ var init_entities = __esm({
       // SPEC-476 · ADR-0096 · gateway Telegram (default mati)
       changelog: zAgentEngine.default(CHANGELOG_ENGINE_DEFAULTS),
       // SPEC-518 · agen pembuat changelog (opt-in, mati)
-      portalChat: zPortalChat.default(PORTAL_CHAT_DEFAULTS)
+      portalChat: zPortalChat.default(PORTAL_CHAT_DEFAULTS),
       // SPEC-854 · ADR-0130 · chat portal klien (opt-in, mati)
+      // SPEC-881 · ADR-0136 · sidik jari isi bawaan yang TERAKHIR ditulis seed di mesin ini, per nama
+      // agen. Dipakai seed untuk membedakan "belum pernah disunting operator" dari "sudah". WAJIB
+      // dideklarasikan di sini: zod membuang kunci tak dikenal dan `PUT /settings` menulis balik hasil
+      // parse — kunci asing akan lenyap tanpa satu pun error, lalu seed menimpa kerja operator.
+      //
+      // LOKAL per mesin: `setting` TIDAK ada di FIELDS sync (server/src/services/sync.ts), jadi dua
+      // mesin dengan versi hanoman berbeda tak bisa saling menimpa definisi bolak-balik.
+      builtinAgents: external_exports.record(external_exports.string(), external_exports.string()).default({})
     });
     zNotification = external_exports.object({
       id: external_exports.string(),
@@ -4814,6 +4822,266 @@ var init_custom_agent = __esm({
   }
 });
 
+// ../shared/src/builtin-agents.ts
+var BUILTIN_AGENTS, BUILTIN_AGENT_NAMES;
+var init_builtin_agents = __esm({
+  "../shared/src/builtin-agents.ts"() {
+    "use strict";
+    BUILTIN_AGENTS = [
+      {
+        name: "scout",
+        description: "Gunakan saat perlu tahu DI MANA sesuatu dikerjakan di basis kode, atau bagaimana sebuah alur data mengalir, sebelum menyentuh kode. Ia menyapu banyak berkas dan mengembalikan peta ringkas berisi jangkar path:baris \u2014 bukan isi berkas. Panggil dia alih-alih membaca belasan berkas sendiri.",
+        tools: ["Read", "Glob", "Grep"],
+        enabledByDefault: true,
+        instructions: [
+          "Kamu navigator basis kode. Tugasmu MENJAWAB, bukan menyalin.",
+          "",
+          "Prosedur:",
+          "1. Sapu dari beberapa sudut sekaligus, jangan satu grep: nama simbol \xB7 nama konsep dalam",
+          "   bahasa manusia \xB7 jejak string yang muncul di UI/log/pesan galat \xB7 nama berkas & folder.",
+          "2. Cari juga CERMIN konsep yang sama: tipe yang disalin antar-paket, enum kembar, konstanta",
+          "   yang diduplikasi, daftar literal string yang tak punya rujukan tipe. Cermin adalah tempat",
+          "   bug paling senyap hidup, dan ia tak akan muncul dari satu pencarian nama.",
+          "3. Berhenti begitu pertanyaannya terjawab. Kamu bukan pembuat dokumentasi.",
+          "",
+          "Aturan keluaran:",
+          "- JANGAN mengembalikan isi berkas. Kembalikan kesimpulan + jangkar.",
+          "- Setiap klaim berpasangan `path:baris`.",
+          "- Bila kamu TAK menemukan sesuatu, katakan itu dan sebutkan pola apa saja yang sudah kamu",
+          "  coba. 'Tidak ada' yang tak menyebut cara mencarinya tak bisa dipercaya siapa pun.",
+          "",
+          "Bentuk laporan: (a) titik masuk \xB7 (b) alur data ringkas \xB7 (c) tempat perubahan harus",
+          "mendarat \xB7 (d) cermin yang ditemukan \xB7 (e) yang sudah dicari tapi tak ada."
+        ].join("\n")
+      },
+      {
+        name: "root-causer",
+        description: "Gunakan saat ada bug, test merah, atau perilaku tak terduga yang belum jelas sebabnya. Ia membuktikan akar lewat eksperimen sebelum ada perbaikan yang diusulkan. Jangan panggil dia untuk memperbaiki \u2014 dia mendiagnosis.",
+        tools: ["Read", "Glob", "Grep", "Bash"],
+        enabledByDefault: false,
+        instructions: [
+          "Kamu diagnostikus. Kamu TIDAK memperbaiki kode \u2014 kamu membuktikan sebabnya.",
+          "",
+          "Prosedur:",
+          "1. REPRODUKSI dulu. Tulis satu perintah yang bisa dijalankan ulang siapa pun dan yang",
+          "   memperlihatkan gejalanya. Bila kamu tak bisa mereproduksi, ITU temuanmu \u2014 laporkan,",
+          "   jangan lanjut menebak di atas gejala yang tak pernah kamu lihat sendiri.",
+          "2. Daftar hipotesis yang BERSAING, minimal dua. Satu hipotesis tunggal adalah tebakan yang",
+          "   sedang mencari pembenaran.",
+          "3. Rancang satu eksperimen yang MEMBEDAKAN hipotesis \u2014 yang hasilnya berbeda tergantung mana",
+          "   yang benar. Eksperimen yang hanya mengonfirmasi favoritmu tak menambah apa pun.",
+          "4. Jalankan. Buang yang terbantah. Ulangi sampai akar terbukti.",
+          "",
+          "Gerbang bukti \u2014 ini yang membedakanmu dari tebakan yang rapi:",
+          "- DILARANG mengusulkan perbaikan sebelum akar terbukti.",
+          "- Setiap hipotesis yang kamu terima wajib disertai eksperimen yang akan GAGAL bila hipotesis",
+          "  itu salah. Bila kamu tak bisa menyebut eksperimen itu, kamu belum membuktikan apa pun.",
+          "- 'Kemungkinan besar karena\u2026' bukan keluaran yang sah. Tulis 'belum terbukti' dan sebutkan",
+          "  apa yang masih kurang.",
+          "",
+          "Bentuk laporan: (a) reproduksi \xB7 (b) hipotesis yang diuji & yang terbantah + buktinya \xB7",
+          "(c) akar + bukti \xB7 (d) perbaikan TERKECIL yang menyentuh akar, bukan gejala \xB7 (e) cara",
+          "memverifikasi perbaikannya."
+        ].join("\n")
+      },
+      {
+        name: "qa-verifier",
+        description: "Gunakan SEBELUM menyatakan pekerjaan selesai atau test hijau. Ia menjalankan test yang tersentuh perubahan, memisahkan gagal palsu dari regresi, dan membuktikan bahwa test yang lulus itu benar-benar menguji perubahannya.",
+        tools: ["Read", "Glob", "Grep", "Bash"],
+        enabledByDefault: true,
+        instructions: [
+          "Kamu gerbang terakhir sebelum sesuatu diumumkan hijau. Tugasmu MERAGUKAN kehijauan itu.",
+          "",
+          "Prosedur:",
+          "1. Tentukan test yang TERSENTUH perubahan (dari diff terhadap base), bukan suite penuh.",
+          "2. Jalankan. Catat perintah persisnya.",
+          "3. Untuk setiap kegagalan, putuskan PALSU vs REGRESI dengan bukti, bukan firasat. Kandidat",
+          "   gagal palsu yang wajib kamu periksa dulu: berkas DB/state yang dibagi antar run,",
+          "   paralelisme antar-berkas test, sisa proses/soket/port dari run sebelumnya, variabel",
+          "   lingkungan yang bocor dari shell, dan test yang memang sudah merah SEBELUM perubahan.",
+          "   Cara memutuskannya: jalankan ulang test itu SENDIRIAN, dengan state yang bersih.",
+          "4. UJI RELEVANSI \u2014 langkah yang hampir tak pernah dilakukan siapa pun, dan tanpa ini 'hijau'",
+          "   tak berarti apa-apa: siapkan pohon kerja terpisah di commit SEBELUM perubahan",
+          "   (`git worktree add --detach <dir> <base-sha>`), pasang test barunya di sana, jalankan,",
+          "   dan tuntut test itu MERAH. Test yang tetap hijau tanpa perubahan tidak membuktikan apa",
+          "   pun tentang perubahan itu.",
+          "5. Bersihkan pohon kerja sementara (`git worktree remove`).",
+          "",
+          "Larangan keras:",
+          "- JANGAN `git stash` untuk apa pun. Tumpukan stash milik REPO, bukan pohon kerja \u2014 sesi lain",
+          "  bisa mem-pop stash milikmu, dan kamu bisa mem-pop milik mereka. Isolasi memakai",
+          "  `git worktree add`, titik.",
+          "- JANGAN mengubah test agar lulus. Bila test-nya yang salah, itu temuan, bukan pekerjaan.",
+          "",
+          "Gerbang bukti: setiap klaim membawa perintah DAN potongan keluarannya. Tanpa keluaran, tanpa",
+          "klaim. 'Semua test lulus' tanpa keluaran adalah kegagalanmu, bukan laporan.",
+          "",
+          "Bentuk laporan: satu baris per test \u2014 lulus-dan-relevan \xB7 lulus-tapi-tak-membuktikan-apa-pun",
+          "\xB7 regresi \xB7 gagal-palsu (+ sebabnya) \u2014 lalu satu putusan akhir: layak diumumkan selesai atau",
+          "belum, dan apa yang kurang."
+        ].join("\n")
+      },
+      {
+        name: "edge-case-hunter",
+        description: "Gunakan saat test yang ada hanya menguji jalur mulus dan kamu ingin batas-batas kontrak benar-benar tertutup. Ia menulis test yang hilang dan membuktikan tiap test baru merah dulu sebelum menyimpannya.",
+        tools: ["Read", "Glob", "Grep", "Bash", "Write", "Edit"],
+        enabledByDefault: false,
+        instructions: [
+          "Kamu penambal jalur bahagia. Cakupan yang terlihat baik bukan urusanmu \u2014 kontrak yang tak",
+          "pernah diuji itu urusanmu.",
+          "",
+          "Prosedur:",
+          "1. Baca kontrak unit yang berubah: apa yang ia janjikan, apa yang ia terima, apa yang ia",
+          "   lakukan saat janji itu tak bisa dipenuhi.",
+          "2. Enumerasi batas SECARA SISTEMATIS, jangan mengandalkan ingatan: kosong \xB7 null/undefined \xB7",
+          "   nol & negatif \xB7 unicode & string sangat panjang \xB7 urutan terbalik \xB7 kedatangan ganda",
+          "   (idempotensi) \xB7 kegagalan separuh jalan \xB7 timeout & retry \xB7 nilai asing dari luar batas",
+          "   kepercayaan (input pengguna, berkas konfigurasi, data dari mesin lain).",
+          "3. Adu daftar itu dengan test yang sudah ada. Tandai yang belum tertutup.",
+          "4. Tulis test yang hilang. Ikuti gaya berkas test tetangga \u2014 nama, struktur, helper.",
+          "5. Jalankan.",
+          "",
+          "Gerbang bukti: setiap test baru WAJIB kamu tunjukkan MERAH dulu terhadap kode yang belum",
+          "diperbaiki. Test yang lahir langsung hijau kamu laporkan sebagai 'tak membuktikan apa-apa' \u2014",
+          "jangan disimpan diam-diam, karena ia akan tetap hijau saat kodenya kelak rusak.",
+          "",
+          "Batas: kamu menulis TEST. Jangan mengubah kode produksi agar test lulus \u2014 bila test barumu",
+          "menemukan bug sungguhan, laporkan bugnya, biarkan test itu merah, dan katakan dengan jelas",
+          "bahwa ia merah karena bug, bukan karena test-nya salah.",
+          "",
+          "Bentuk laporan: (a) batas yang kini tertutup \xB7 (b) batas yang sengaja dilewati + alasannya \xB7",
+          "(c) bug yang ditemukan test baru."
+        ].join("\n")
+      },
+      {
+        name: "blast-radius",
+        description: "Gunakan sesudah perubahan selesai untuk menemukan tempat LAIN yang seharusnya ikut berubah tapi tidak: daftar kolom, cermin tipe antar-paket, enum kembar, dokumen kontrak, tabel konstanta. Ia mencari kegagalan senyap \u2014 yang tak memunculkan satu pun error.",
+        tools: ["Read", "Glob", "Grep", "Bash"],
+        enabledByDefault: true,
+        instructions: [
+          "Kamu pencari cermin yang hanyut. Kelas bug yang kamu buru punya satu ciri: TIDAK ADA yang",
+          "error. Satu kontrak hidup di beberapa tempat, satu tempat diperbarui, sisanya diam.",
+          "",
+          "Prosedur:",
+          "1. Baca diff terhadap base. Tarik daftar yang berubah: simbol, kolom, nilai enum, kunci",
+          "   konfigurasi, nama berkas, bentuk payload.",
+          "2. Untuk TIAP satu, sapu seluruh repo untuk semua tempat lain yang menyebutnya \u2014 ATAU yang",
+          "   seharusnya menyebutnya. Yang kedua ini yang penting, dan ia tak akan muncul dari pencarian",
+          "   nama saja. Tempat yang wajib kamu periksa:",
+          "   - daftar/array literal yang mencacah field atau kolom secara manual;",
+          "   - tabel konstanta & peta yang kuncinya harus lengkap tapi tak punya rujukan tipe;",
+          "   - tipe yang disalin (bukan diimpor) antar-paket, dan enum kembar;",
+          "   - skema validasi di batas HTTP vs bentuk yang benar-benar disimpan;",
+          "   - dokumen kontrak (API, data model) dan berkas contoh/konfigurasi;",
+          "   - berkas test yang mengunci bentuk lama.",
+          "3. Laporkan yang belum ikut berubah.",
+          "",
+          "Gerbang bukti: tiap temuan menyebut `path:baris` DAN apa yang terjadi bila dibiarkan. Bila",
+          "konsekuensinya 'gagal senyap' \u2014 nilai default palsu, kolom yang hilang tanpa error, cabang",
+          "yang tak pernah dijalankan \u2014 NAIKKAN prioritasnya, jangan turunkan. Yang berteriak akan",
+          "ketahuan sendiri; yang diam tidak.",
+          "",
+          "Bentuk laporan: daftar cermin yang hanyut, diurut dari yang paling senyap, tiap baris:",
+          "jangkar \xB7 apa yang hanyut \xB7 akibat bila dibiarkan."
+        ].join("\n")
+      },
+      {
+        name: "spec-auditor",
+        description: "Gunakan sebelum menutup pekerjaan untuk mengadu apa yang DIMINTA dengan apa yang benar-benar ada di diff. Ia menolak 'sepertinya sudah' dan memperlakukan kriteria tanpa jejak sebagai tak terpenuhi, walau kotaknya sudah tercentang.",
+        tools: ["Read", "Glob", "Grep", "Bash"],
+        enabledByDefault: false,
+        instructions: [
+          "Kamu pengadu janji. Kamu tak menilai bagus atau tidaknya kode \u2014 kamu menilai apakah yang",
+          "diminta benar-benar ada.",
+          "",
+          "Prosedur:",
+          "1. Baca sumber permintaannya: spec, plan, issue, atau deskripsi tugas. Bila ada beberapa,",
+          "   baca semuanya \u2014 plan bisa menyimpang dari spec, dan penyimpangan itu sendiri temuan.",
+          "2. Ubah jadi daftar kriteria yang bisa diperiksa SATU PER SATU. Kalimat yang tak bisa",
+          "   diperiksa ('lebih baik', 'rapi') kamu tandai sebagai tak terukur, bukan kamu tafsirkan.",
+          "3. Untuk tiap kriteria, cari JEJAKNYA di diff. Bukan di niat, bukan di komentar kode.",
+          "4. Putuskan: terpenuhi (+jangkar) \xB7 tak terpenuhi \xB7 terpenuhi BERBEDA dari yang diminta \xB7",
+          "   dikerjakan TANPA diminta.",
+          "",
+          "Gerbang bukti:",
+          "- Kriteria tanpa jangkar di diff = TAK TERPENUHI. Kotak yang sudah tercentang di berkas plan",
+          "  bukan bukti \u2014 ia klaim, dan klaim itu justru yang sedang kamu periksa.",
+          "- Pekerjaan yang dikerjakan tanpa diminta dilaporkan TERPISAH, bukan dipuji. Ia menambah",
+          "  permukaan yang tak pernah diminta siapa pun untuk dipelihara.",
+          "",
+          "Bentuk laporan: tabel \u2014 kriteria \xB7 putusan \xB7 jangkar; lalu daftar pekerjaan di luar minta;",
+          "lalu satu putusan akhir: boleh ditutup atau belum, dan apa yang kurang."
+        ].join("\n")
+      },
+      {
+        name: "security-reviewer",
+        description: "Gunakan sebelum menggabungkan perubahan yang menyentuh route, handler, job, CLI, atau apa pun yang menerima input dari luar. Ia menelusuri jalur konkret dari input tak terpercaya sampai ke tempat ia melukai, dan menolak melaporkan kekhawatiran yang tak bisa ia buktikan jalurnya.",
+        tools: ["Read", "Glob", "Grep", "Bash"],
+        enabledByDefault: true,
+        instructions: [
+          "Kamu penelusur sumber-ke-sink. Daftar kekhawatiran umum tak mengubah apa pun; yang mengubah",
+          "adalah satu jalur konkret dari input yang tak dipercaya sampai ke tempat ia melukai.",
+          "",
+          "Prosedur:",
+          "1. Enumerasi TITIK MASUK yang tersentuh diff: route HTTP, handler pesan/webhook, job",
+          "   terjadwal, perintah CLI, pembaca berkas konfigurasi, dan apa pun yang membaca input",
+          "   pengguna atau data dari mesin lain.",
+          "2. Untuk tiap titik masuk, telusuri input tak terpercaya sampai SINK: query basis data,",
+          "   `exec`/shell, path berkas, template/render, deserialisasi, permintaan keluar, redirect,",
+          "   dan apa pun yang ditulis ke log atau dikembalikan ke pemanggil.",
+          "3. Di sepanjang jalur itu, periksa gerbang yang seharusnya ada:",
+          "   - autentikasi \u2014 siapa dia;",
+          "   - OTORISASI KEPEMILIKAN OBJEK \u2014 apakah dia berhak atas objek INI. Ini yang paling sering",
+          "     hilang, dan justru hilangnya di endpoint yang autentikasinya sudah benar;",
+          "   - validasi bentuk di batas, bukan di dalam;",
+          "   - batas ukuran & jumlah (payload, unggahan, paginasi, perulangan);",
+          "   - kredensial: bocor ke log, ke response, ke pesan galat, atau ikut ter-commit.",
+          "",
+          "Gerbang bukti \u2014 ini yang membedakanmu dari daftar kekhawatiran:",
+          "- Temuan TANPA jalur konkret input \u2192 dampak TIDAK kamu laporkan. Tahan.",
+          "- Sebutkan juga jalur mana saja yang sudah kamu telusuri dan BERSIH. Tanpa itu, diammu tak",
+          "  bisa dibedakan dari tidak memeriksa.",
+          "- Jangan menilai dari nama fungsi atau kecocokan pola. Baca jalurnya.",
+          "",
+          "Bentuk laporan: per temuan \u2014 jalur (dengan jangkar) \xB7 dampak \xB7 perbaikan TERKECIL; lalu",
+          "daftar titik masuk yang dinyatakan bersih."
+        ].join("\n")
+      },
+      {
+        name: "dep-auditor",
+        description: "Gunakan saat diff menambah atau menaikkan versi dependensi. Ia memeriksa advisory, lisensi, tanda pemeliharaan, dan \u2014 yang paling sering terlewat \u2014 apakah fungsinya sudah tersedia tanpa dependensi baru itu.",
+        tools: ["Read", "Glob", "Grep", "Bash", "WebSearch", "WebFetch"],
+        enabledByDefault: false,
+        instructions: [
+          "Kamu gerbang rantai pasok. Satu dependensi masuk lewat satu baris diff dan tak pernah",
+          "diperiksa lagi seumur hidup proyek \u2014 pemeriksaan itu terjadi sekarang atau tidak sama sekali.",
+          "",
+          "Prosedur:",
+          "1. Dari diff, ambil dependensi yang BERTAMBAH atau NAIK VERSI (termasuk devDependencies).",
+          "   Lockfile ikut dibaca: dependensi transitif baru yang besar juga temuan.",
+          "2. Untuk tiap satu, periksa dan sebutkan sumbernya:",
+          "   - advisory/CVE yang diketahui untuk rentang versi itu;",
+          "   - tanggal rilis terakhir & tanda pemeliharaan (isu terbuka menumpuk, maintainer tunggal);",
+          "   - lisensi, dan apakah ia cocok dengan lisensi proyek ini;",
+          "   - ukuran pohon transitifnya;",
+          "   - apakah paket menjalankan skrip saat instalasi.",
+          "3. Pertanyaan yang paling sering dilewati, dan tanyakan SELALU: apakah fungsi yang dipakai",
+          "   sudah tersedia di dependensi yang SUDAH ada di proyek ini, atau di runtime-nya? Cek dulu",
+          "   sebelum menerima. Satu dependensi yang tak jadi masuk lebih berharga daripada sepuluh",
+          "   yang diaudit.",
+          "",
+          "Gerbang bukti: klaim CVE atau lisensi WAJIB membawa URL sumbernya. Tanpa sumber, tulis 'tak",
+          "terverifikasi' \u2014 jangan hilangkan, dan jangan naikkan jadi fakta.",
+          "",
+          "Bentuk laporan: per dependensi \u2014 aman \xB7 aman dengan catatan \xB7 tolak (+ penggantinya, atau",
+          "cara mengerjakannya tanpa dependensi itu)."
+        ].join("\n")
+      }
+    ];
+    BUILTIN_AGENT_NAMES = BUILTIN_AGENTS.map((a) => a.name);
+  }
+});
+
 // ../shared/src/agent-catalog.ts
 var BUILTIN_AGENT_TOOLS;
 var init_agent_catalog = __esm({
@@ -4961,6 +5229,31 @@ var init_lead = __esm({
   }
 });
 
+// ../shared/src/handled-by.ts
+var zHandledByEntry, HANDLED_BY_MAX, zHandledBy, zHandledByView;
+var init_handled_by = __esm({
+  "../shared/src/handled-by.ts"() {
+    "use strict";
+    init_zod();
+    zHandledByEntry = external_exports.object({
+      deviceId: external_exports.string().min(1),
+      name: external_exports.string().min(1)
+    });
+    HANDLED_BY_MAX = 32;
+    zHandledBy = external_exports.array(zHandledByEntry).max(HANDLED_BY_MAX).superRefine((list, ctx) => {
+      const seen = /* @__PURE__ */ new Set();
+      for (const e of list) {
+        if (seen.has(e.deviceId)) {
+          ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: `deviceId duplikat: ${e.deviceId}` });
+          return;
+        }
+        seen.add(e.deviceId);
+      }
+    });
+    zHandledByView = zHandledByEntry.extend({ revoked: external_exports.boolean().default(false) });
+  }
+});
+
 // ../shared/src/prd-status.ts
 var PRD_STATUSES, zPrdStatus;
 var init_prd_status = __esm({
@@ -5033,7 +5326,7 @@ var init_cron_expr = __esm({
 });
 
 // ../shared/src/dto.ts
-var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zMarkSpecDone, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zSetup, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zSpecAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus, zCronExpr, zCreateCron, zPatchCron, zSchedulerCron, zSchedulerCronRun;
+var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zMarkSpecDone, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zSetup, zSetupApply, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, PROVISION_PROFILES, COMPONENT_IDS, zProvision, UPDATE_RESTART_EXIT, CONFIG_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zSpecAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus, zCronExpr, zCreateCron, zPatchCron, zSchedulerCron, zSchedulerCronRun;
 var init_dto = __esm({
   "../shared/src/dto.ts"() {
     "use strict";
@@ -5041,6 +5334,7 @@ var init_dto = __esm({
     init_entities();
     init_lead();
     init_auto_merge();
+    init_handled_by();
     init_prd_status();
     init_enums();
     init_spec_source();
@@ -5087,6 +5381,8 @@ var init_dto = __esm({
       kind: zProjectKind,
       repoDir: external_exports.string().optional(),
       gitRemote: external_exports.string().optional(),
+      // SPEC-880 · ADR-0135 · penanda "ditangani oleh" boleh di-set sejak awal (disync).
+      handledBy: zHandledBy.optional(),
       desc: external_exports.string().default("")
     });
     zProjectId = external_exports.string().regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "slug tak sah");
@@ -5096,6 +5392,10 @@ var init_dto = __esm({
       desc: external_exports.string().optional(),
       gitRemote: external_exports.string().optional(),
       // SPEC-213 · set git remote resmi project
+      // SPEC-880 · ADR-0135 · daftar hanoman client pemegang project (DISYNC — beda dari repoDir &
+      // opt-in di bawah yang lokal per-instance). `null` maupun `[]` = kosongkan. Digerbangi
+      // `checkHandledBy`: deviceId wajib dikenal HANYA bila instance ini punya katalog device.
+      handledBy: zHandledBy.nullable().optional(),
       repoDir: external_exports.string().nullable().optional(),
       // SPEC-217 · path default/server editable (null = kosongkan)
       schedulerOptIn: external_exports.boolean().optional(),
@@ -5171,6 +5471,10 @@ var init_dto = __esm({
       // SPEC-294 · opt-in scheduler otonom
       leadOptIn: external_exports.boolean().default(false),
       // SPEC-409 · ADR-0091 · opt-in hanoman-lead
+      // SPEC-880 · ADR-0135 · penanda "ditangani oleh" yang SUDAH diperkaya: `name` = nama hidup bila
+      // baris DeviceToken-nya ada di instance ini, else snapshot tersimpan; `revoked` diturunkan.
+      // `[]` = belum ditetapkan — kolom NULL tak pernah bocor ke UI sebagai bentuk kedua "kosong".
+      handledBy: zHandledByView.array().default([]),
       autoMerge: zAutoMerge.nullable().default(null)
     });
     zSchedulerQueueItem = external_exports.object({
@@ -5473,6 +5777,11 @@ var init_dto = __esm({
     zLogin = external_exports.object({ email: external_exports.string().email(), password: external_exports.string().min(1) });
     zSignup = external_exports.object({ email: external_exports.string().email(), password: external_exports.string().min(8) });
     zSetup = zSignup.extend({ setupToken: external_exports.string().min(1) });
+    zSetupApply = external_exports.object({
+      deployment: external_exports.enum(["local", "public"]),
+      hardening: external_exports.boolean(),
+      acknowledgedUnhardened: external_exports.boolean().optional()
+    });
     zChangePassword = external_exports.object({
       currentPassword: external_exports.string().min(1),
       newPassword: external_exports.string().min(8)
@@ -5500,7 +5809,27 @@ var init_dto = __esm({
     });
     zAttest = external_exports.object({ note: external_exports.string().max(500).optional() });
     zRemediate = external_exports.object({ items: external_exports.array(external_exports.string()).min(1).max(64) });
+    PROVISION_PROFILES = ["lab", "production"];
+    COMPONENT_IDS = [
+      "base",
+      "node",
+      "hanoman",
+      "caddy",
+      "podman",
+      "agent-image",
+      "claude",
+      "codex",
+      "gh"
+    ];
+    zProvision = external_exports.object({
+      items: external_exports.array(external_exports.enum(COMPONENT_IDS)).min(1).max(16),
+      profile: external_exports.enum(PROVISION_PROFILES),
+      domain: external_exports.string().min(1).regex(HOST_RE).optional(),
+      confirm: external_exports.boolean().optional(),
+      force: external_exports.boolean().optional()
+    });
     UPDATE_RESTART_EXIT = 75;
+    CONFIG_RESTART_EXIT = 76;
     zUpdateApplyBody = external_exports.object({ confirm: external_exports.boolean().optional() });
     zTicketView = external_exports.object({
       id: external_exports.string(),
@@ -5716,6 +6045,11 @@ var init_api = __esm({
       terminalSession: (id) => `${API}/terminal/sessions/${id}`,
       terminalSteer: (id) => `${API}/terminal/sessions/${id}/steer`,
       terminalInterrupt: (id) => `${API}/terminal/sessions/${id}/interrupt`,
+      // SPEC-899 · ADR-0142 · inbox keputusan. Di bawah prefix /terminal supaya ikut capability
+      // `sessions` yang sudah ada — GET menurunkan cabang bacanya, POST cabang tulisnya, tanpa satu
+      // baris pun perubahan di services/agent-capabilities.ts.
+      terminalDialog: (id) => `${API}/terminal/sessions/${id}/dialog`,
+      terminalDialogAnswer: (id) => `${API}/terminal/sessions/${id}/dialog/answer`,
       terminalPhases: (id) => `${API}/terminal/sessions/${id}/phases`,
       // SPEC-230 · review + integrate ber-skop sesi (sesi project-level PRD, tanpa Spec).
       sessionReview: (id) => `${API}/terminal/sessions/${id}/review`,
@@ -5747,6 +6081,11 @@ var init_api = __esm({
       vpsItemAttest: (id, itemId) => `${API}/vps/${id}/items/${itemId}/attest`,
       vpsRemediatePreview: (id) => `${API}/vps/${id}/remediate/preview`,
       vpsRemediate: (id) => `${API}/vps/${id}/remediate`,
+      // SPEC-883 · provisioning berbasis katalog
+      vpsComponents: () => `${API}/vps/components`,
+      vpsProbe: (id) => `${API}/vps/${id}/probe`,
+      vpsProvisionPreview: (id) => `${API}/vps/${id}/provision/preview`,
+      vpsProvision: (id) => `${API}/vps/${id}/provision`,
       // SPEC-169 · auth
       authStatus: `${API}/auth/status`,
       authSetup: `${API}/auth/setup`,
@@ -5755,6 +6094,9 @@ var init_api = __esm({
       authUsers: `${API}/auth/users`,
       authUser: (id) => `${API}/auth/users/${id}`,
       authChangePassword: `${API}/auth/change-password`,
+      // SPEC-884 · ADR-0139 · wizard setup awal
+      setupStatus: `${API}/setup/status`,
+      setupApply: `${API}/setup`,
       // SPEC-213 · device token + activity log
       deviceTokens: `${API}/device-tokens`,
       deviceToken: (id) => `${API}/device-tokens/${id}`,
@@ -6296,6 +6638,9 @@ var init_webhook = __esm({
           "gitRemote",
           "stack",
           "helpEnabled",
+          // SPEC-880 · ADR-0135 · penerima harus bisa tahu mesin mana yang memegang project ini
+          // tanpa mendiff dua amplop. Entrinya snapshot: [{deviceId,name}].
+          "handledBy",
           "schedulerOptIn",
           "leadOptIn",
           "autoMerge",
@@ -6306,7 +6651,7 @@ var init_webhook = __esm({
         cascade: ["spec", "ticket", "customAgent", "githubIssue"],
         events: {
           created: { type: "project.created", label: "Project ditambah", when: "Project baru terdaftar di workspace." },
-          updated: { type: "project.updated", label: "Project diubah", when: "Nama, deskripsi, stack, remote, atau opt-in scheduler/lead/Help Center berubah." },
+          updated: { type: "project.updated", label: "Project diubah", when: 'Nama, deskripsi, stack, remote, penanda "ditangani oleh", atau opt-in scheduler/lead/Help Center berubah.' },
           deleted: { type: "project.deleted", label: "Project dihapus", when: "Project dihapus. data.cascade menyebut jumlah anak yang ikut terhapus \u2014 anaknya sendiri TIDAK memancarkan deleted, sebab cascade dieksekusi SQLite, di luar jangkauan tap." }
         },
         sample: {
@@ -6317,6 +6662,7 @@ var init_webhook = __esm({
           gitRemote: "git@github.com:nafanesia/hanoman.git",
           stack: "ts",
           helpEnabled: false,
+          handledBy: [{ deviceId: "clq0device1", name: "hm-dena" }],
           schedulerOptIn: true,
           leadOptIn: false,
           autoMerge: null,
@@ -7306,6 +7652,27 @@ var init_terminal_io = __esm({
   }
 });
 
+// ../shared/src/session-dialog.ts
+var zSessionDialogAnswer;
+var init_session_dialog = __esm({
+  "../shared/src/session-dialog.ts"() {
+    "use strict";
+    init_zod();
+    zSessionDialogAnswer = external_exports.object({
+      screenHash: external_exports.string().min(1),
+      choice: external_exports.number().int().positive().optional(),
+      choices: external_exports.array(external_exports.number().int().positive()).max(32).optional(),
+      text: external_exports.string().trim().min(1).max(16e3).optional()
+    }).refine(
+      (v) => !(v.choice !== void 0 && v.choices !== void 0),
+      { message: "choice dan choices tak boleh dikirim bersamaan" }
+    ).refine(
+      (v) => v.choice !== void 0 || v.choices !== void 0 || v.text !== void 0,
+      { message: "jawaban kosong" }
+    );
+  }
+});
+
 // ../shared/src/index.ts
 var init_src = __esm({
   "../shared/src/index.ts"() {
@@ -7318,6 +7685,7 @@ var init_src = __esm({
     init_entities();
     init_agent();
     init_custom_agent();
+    init_builtin_agents();
     init_agent_catalog();
     init_github();
     init_lead();
@@ -7337,10 +7705,12 @@ var init_src = __esm({
     init_webhook();
     init_mcp();
     init_auto_merge();
+    init_handled_by();
     init_changelog();
     init_cron_expr();
     init_terminal_workspace();
     init_terminal_io();
+    init_session_dialog();
   }
 });
 
@@ -7818,6 +8188,149 @@ var init_spawn_helper = __esm({
   }
 });
 
+// ../runner/src/config-env.ts
+import { chmodSync as chmodSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { join as join4 } from "node:path";
+function configEnvPath(home) {
+  return join4(home, CONFIG_ENV_FILE);
+}
+function parseConfigEnv(text) {
+  const out = {};
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    out[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();
+  }
+  return out;
+}
+function readConfigEnv(home) {
+  try {
+    return parseConfigEnv(readFileSync2(configEnvPath(home), "utf8"));
+  } catch {
+    return {};
+  }
+}
+var CONFIG_ENV_FILE;
+var init_config_env = __esm({
+  "../runner/src/config-env.ts"() {
+    "use strict";
+    CONFIG_ENV_FILE = "config.env";
+  }
+});
+
+// ../runner/src/runtime-profile.ts
+function resolveHardening(env) {
+  if (env.HANOMAN_HARDENING === "1") return true;
+  return env.HANOMAN_SESSION_SANDBOX === "podman" || filled(env.HANOMAN_PUBLIC_ORIGINS) || filled(env.HANOMAN_TRUST_PROXY);
+}
+var filled;
+var init_runtime_profile = __esm({
+  "../runner/src/runtime-profile.ts"() {
+    "use strict";
+    filled = (v) => !!v && v.trim() !== "";
+  }
+});
+
+// ../runner/src/sandbox-probe.ts
+import { execFileSync } from "node:child_process";
+import { accessSync, constants } from "node:fs";
+import { isAbsolute as isAbsolute2 } from "node:path";
+function trustProxyOk(raw) {
+  const v = raw?.trim();
+  if (!v) return false;
+  if (/^[1-9]\d*$/.test(v)) return true;
+  const values = v.split(",").map((s2) => s2.trim()).filter(Boolean);
+  if (!values.length) return false;
+  return !values.some((s2) => s2 === "true" || !s2.includes("/") && s2 !== "loopback");
+}
+function prerequisites(env, facts) {
+  const network = env.HANOMAN_SESSION_NETWORK ?? "hanoman-egress";
+  const credentialDir = env.HANOMAN_AGENT_CREDENTIAL_DIR;
+  const scanner = env.HANOMAN_UPLOAD_SCANNER?.trim();
+  return [
+    {
+      id: "podman",
+      label: "Podman rootless",
+      ok: !!facts.podman && facts.rootless,
+      detail: facts.podman ? facts.rootless ? facts.podman : `${facts.podman} \u2014 berjalan rootful, butuh rootless` : "podman tak ada"
+    },
+    {
+      id: "network",
+      label: `Network "${network}"`,
+      ok: facts.networkExists,
+      detail: facts.networkExists ? network : `network ${network} belum dibuat`
+    },
+    {
+      id: "egress-proxy",
+      label: "Egress proxy",
+      ok: filled2(env.HANOMAN_EGRESS_PROXY),
+      detail: env.HANOMAN_EGRESS_PROXY ?? "HANOMAN_EGRESS_PROXY belum disetel"
+    },
+    {
+      id: "credential-dir",
+      label: "Dir credential agen",
+      ok: filled2(credentialDir) && facts.credentialDirReadable,
+      detail: !filled2(credentialDir) ? "HANOMAN_AGENT_CREDENTIAL_DIR belum disetel" : facts.credentialDirReadable ? credentialDir : `${credentialDir} \u2014 tak terbaca`
+    },
+    {
+      id: "control-origin",
+      label: "Control origin",
+      ok: filled2(env.HANOMAN_CONTROL_ORIGINS),
+      detail: env.HANOMAN_CONTROL_ORIGINS ?? "HANOMAN_CONTROL_ORIGINS belum disetel"
+    },
+    {
+      id: "trust-proxy",
+      label: "Trusted proxy hop/CIDR",
+      ok: trustProxyOk(env.HANOMAN_TRUST_PROXY),
+      detail: filled2(env.HANOMAN_TRUST_PROXY) ? trustProxyOk(env.HANOMAN_TRUST_PROXY) ? env.HANOMAN_TRUST_PROXY : "harus hop atau CIDR eksplisit" : "HANOMAN_TRUST_PROXY belum disetel"
+    },
+    {
+      id: "upload-scanner",
+      label: "Scanner upload",
+      ok: !!scanner && isAbsolute2(scanner),
+      detail: !scanner ? "HANOMAN_UPLOAD_SCANNER belum disetel" : isAbsolute2(scanner) ? scanner : `${scanner} \u2014 path harus absolut`
+    }
+  ];
+}
+function allReady(rows) {
+  return rows.every((r) => r.ok);
+}
+function run(file, args) {
+  try {
+    return execFileSync(file, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return null;
+  }
+}
+function collectProbeFacts(env) {
+  const podman = run("podman", ["--version"]);
+  const network = env.HANOMAN_SESSION_NETWORK ?? "hanoman-egress";
+  const dir = env.HANOMAN_AGENT_CREDENTIAL_DIR;
+  let credentialDirReadable = false;
+  if (dir) {
+    try {
+      accessSync(dir, constants.R_OK);
+      credentialDirReadable = true;
+    } catch {
+    }
+  }
+  return {
+    podman,
+    rootless: podman ? run("podman", ["info", "--format", "{{.Host.Security.Rootless}}"]) === "true" : false,
+    networkExists: podman ? run("podman", ["network", "exists", network]) !== null : false,
+    credentialDirReadable
+  };
+}
+var filled2;
+var init_sandbox_probe = __esm({
+  "../runner/src/sandbox-probe.ts"() {
+    "use strict";
+    filled2 = (v) => !!v && v.trim() !== "";
+  }
+});
+
 // ../runner/src/index.ts
 var init_src2 = __esm({
   "../runner/src/index.ts"() {
@@ -7838,28 +8351,31 @@ var init_src2 = __esm({
     init_skills();
     init_telegram_operator();
     init_spawn_helper();
+    init_config_env();
+    init_runtime_profile();
+    init_sandbox_probe();
   }
 });
 
 // src/layout.ts
-import { join as join4, resolve as resolve3 } from "node:path";
+import { join as join5, resolve as resolve3 } from "node:path";
 function resolveLayout(distDir2, exists) {
   const pkg = resolve3(distDir2, "..");
-  if (exists(join4(pkg, "prisma", "schema.prisma"))) {
+  if (exists(join5(pkg, "prisma", "schema.prisma"))) {
     return {
       root: pkg,
-      schema: join4(pkg, "prisma", "schema.prisma"),
-      server: join4(pkg, "dist", "server.js"),
-      web: exists(join4(pkg, "web")) ? join4(pkg, "web") : null
+      schema: join5(pkg, "prisma", "schema.prisma"),
+      server: join5(pkg, "dist", "server.js"),
+      web: exists(join5(pkg, "web")) ? join5(pkg, "web") : null
     };
   }
   const repo = resolve3(distDir2, "../..");
-  if (exists(join4(repo, "server", "prisma", "schema.prisma"))) {
+  if (exists(join5(repo, "server", "prisma", "schema.prisma"))) {
     return {
       root: repo,
-      schema: join4(repo, "server", "prisma", "schema.prisma"),
-      server: join4(repo, "server", "dist", "server.js"),
-      web: exists(join4(repo, "src", "dist")) ? join4(repo, "src", "dist") : null
+      schema: join5(repo, "server", "prisma", "schema.prisma"),
+      server: join5(repo, "server", "dist", "server.js"),
+      web: exists(join5(repo, "src", "dist")) ? join5(repo, "src", "dist") : null
     };
   }
   throw new Error(`hanoman: prisma/schema.prisma tak ditemukan dari ${distDir2} \u2014 instalasi rusak?`);
@@ -7878,7 +8394,7 @@ __export(update_exports, {
   default: () => update,
   planUpdate: () => planUpdate
 });
-import { execFileSync } from "node:child_process";
+import { execFileSync as execFileSync2 } from "node:child_process";
 function planUpdate(current, latest) {
   if (!latest) return { action: "unknown", current, latest: null };
   return compareSemver(latest, current) > 0 ? { action: "install", current, latest } : { action: "up-to-date", current, latest };
@@ -7916,7 +8432,7 @@ async function update(argv, ctx) {
     return 0;
   }
   try {
-    execFileSync("npm", [...INSTALL_ARGS], { stdio: "inherit" });
+    execFileSync2("npm", [...INSTALL_ARGS], { stdio: "inherit" });
   } catch {
     ctx.stderr("npm i -g gagal \u2014 jalankan manual (mungkin butuh sudo)\n");
     return 1;
@@ -7940,6 +8456,7 @@ var init_update = __esm({
 // src/commands/start.ts
 var start_exports = {};
 __export(start_exports, {
+  MAX_CONFIG_RESTARTS: () => MAX_CONFIG_RESTARTS,
   MAX_UPDATE_RESTARTS: () => MAX_UPDATE_RESTARTS,
   applyMigrations: () => applyMigrations,
   default: () => start,
@@ -7950,30 +8467,31 @@ __export(start_exports, {
   parseStartArgs: () => parseStartArgs,
   planSupervisorStep: () => planSupervisorStep,
   prismaClientUsable: () => prismaClientUsable,
-  serverEnv: () => serverEnv
+  serverEnv: () => serverEnv,
+  spawnEnv: () => spawnEnv
 });
-import { spawn, execFileSync as execFileSync2 } from "node:child_process";
+import { spawn, execFileSync as execFileSync3 } from "node:child_process";
 import { createRequire } from "node:module";
-import { existsSync as existsSync3, mkdirSync, chmodSync as chmodSync2 } from "node:fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, chmodSync as chmodSync3 } from "node:fs";
 import { dirname as dirname4, resolve as resolvePath } from "node:path";
 import { fileURLToPath } from "node:url";
 function parseStartArgs(argv) {
   const out = { port: null, host: null, db: null, migrate: true };
-  const value = (i, flag, inline) => {
+  const value = (i, flag2, inline) => {
     const v = inline ?? argv[i + 1];
-    if (v === void 0 || v.startsWith("--")) throw new Error(`${flag} butuh nilai`);
+    if (v === void 0 || v.startsWith("--")) throw new Error(`${flag2} butuh nilai`);
     return v;
   };
   for (let i = 0; i < argv.length; i++) {
     const raw = argv[i];
     const eq = raw.indexOf("=");
-    const flag = eq === -1 ? raw : raw.slice(0, eq);
+    const flag2 = eq === -1 ? raw : raw.slice(0, eq);
     const inline = eq === -1 ? void 0 : raw.slice(eq + 1);
-    if (flag === "--no-migrate") {
+    if (flag2 === "--no-migrate") {
       out.migrate = false;
       continue;
     }
-    if (flag === "--port") {
+    if (flag2 === "--port") {
       const v = value(i, "--port", inline);
       const n2 = Number(v);
       if (!Number.isInteger(n2) || n2 <= 0) throw new Error(`--port harus angka, dapat "${v}"`);
@@ -7981,12 +8499,12 @@ function parseStartArgs(argv) {
       if (inline === void 0) i++;
       continue;
     }
-    if (flag === "--host") {
+    if (flag2 === "--host") {
       out.host = value(i, "--host", inline);
       if (inline === void 0) i++;
       continue;
     }
-    if (flag === "--db") {
+    if (flag2 === "--db") {
       out.db = value(i, "--db", inline);
       if (inline === void 0) i++;
       continue;
@@ -8001,7 +8519,7 @@ function distDir() {
 function runPrisma(args, dbUrl) {
   const prismaCli = prismaCliPath(createRequire(import.meta.url).resolve);
   try {
-    const out = execFileSync2(process.execPath, [prismaCli, ...args], {
+    const out = execFileSync3(process.execPath, [prismaCli, ...args], {
       env: { ...process.env, DATABASE_URL: dbUrl },
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -8050,7 +8568,9 @@ async function ensurePrismaClient(schema, dbUrl, ctx) {
 function repairSpawnHelperEarly(ctx) {
   repairSpawnHelper(createRequire(import.meta.url).resolve, ctx.stdout);
 }
-function planSupervisorStep(code, restartsUsed) {
+function planSupervisorStep(code, restartsUsed, configRestartsUsed = 0) {
+  if (code === CONFIG_RESTART_EXIT)
+    return configRestartsUsed >= MAX_CONFIG_RESTARTS ? { action: "exit", code } : { action: "restart" };
   if (code !== UPDATE_RESTART_EXIT) return { action: "exit", code };
   if (restartsUsed >= MAX_UPDATE_RESTARTS) return { action: "exit", code };
   return { action: "update" };
@@ -8068,14 +8588,20 @@ function serverEnv(o) {
 }
 function installLatest() {
   try {
-    execFileSync2("npm", [...INSTALL_ARGS], { stdio: "inherit" });
+    execFileSync3("npm", [...INSTALL_ARGS], { stdio: "inherit" });
     return { ok: true };
   } catch (e) {
     return { ok: false, reason: e.message || "npm i -g gagal" };
   }
 }
-function runServer(serverJs, env) {
-  const child = spawn(process.execPath, [serverJs], { stdio: "inherit", env: { ...process.env, ...env } });
+function spawnEnv(fileEnv, processEnv, server) {
+  return { ...fileEnv, ...processEnv, ...server };
+}
+function runServer(serverJs, env, fileEnv) {
+  const child = spawn(process.execPath, [serverJs], {
+    stdio: "inherit",
+    env: spawnEnv(fileEnv, process.env, env)
+  });
   const handlers = ["SIGINT", "SIGTERM"].map((sig) => [sig, () => child.kill(sig)]);
   for (const [sig, h] of handlers) process.on(sig, h);
   return new Promise((res) => child.on("exit", (code) => {
@@ -8107,9 +8633,9 @@ async function start(argv, ctx) {
   if (notice) ctx.stderr(`${notice}
 `);
   const home = resolveHome(ctx.env);
-  mkdirSync(home, { recursive: true, mode: 448 });
-  chmodSync2(home, 448);
-  mkdirSync(dirname4(dbFilePath(dbUrl)), { recursive: true, mode: 448 });
+  mkdirSync2(home, { recursive: true, mode: 448 });
+  chmodSync3(home, 448);
+  mkdirSync2(dirname4(dbFilePath(dbUrl)), { recursive: true, mode: 448 });
   if (!existsSync3(layout.server)) {
     ctx.stderr(`hanoman: bundle server tak ada di ${layout.server} \u2014 jalankan \`pnpm build\` dulu
 `);
@@ -8130,23 +8656,34 @@ ${hint}
       return 1;
     }
   }
-  if (existsSync3(dbFilePath(dbUrl))) chmodSync2(dbFilePath(dbUrl), 384);
+  if (existsSync3(dbFilePath(dbUrl))) chmodSync3(dbFilePath(dbUrl), 384);
   const port = opts.port ?? Number(ctx.env.PORT ?? 8787);
   const host = opts.host ?? ctx.env.HOST ?? "127.0.0.1";
   ctx.stdout(`hanoman \xB7 http://${host === "0.0.0.0" ? "127.0.0.1" : host}:${port}
 `);
   const env = serverEnv({ dbUrl, port, host, home, web: layout.web ?? null });
   let restartsUsed = 0;
+  let configRestartsUsed = 0;
   for (; ; ) {
-    const code = await runServer(layout.server, env);
-    const step = planSupervisorStep(code, restartsUsed);
+    const code = await runServer(layout.server, env, readConfigEnv(home));
+    const step = planSupervisorStep(code, restartsUsed, configRestartsUsed);
     if (step.action === "exit") {
       if (code === UPDATE_RESTART_EXIT) {
         ctx.stderr(`hanoman: jatah update-restart (${MAX_UPDATE_RESTARTS}) habis \u2014 keluar tanpa memasang
+`);
+      }
+      if (code === CONFIG_RESTART_EXIT) {
+        ctx.stderr(`hanoman: jatah restart-konfigurasi (${MAX_CONFIG_RESTARTS}) habis \u2014 keluar
 `);
       }
       return step.code;
     }
+    if (step.action === "restart") {
+      configRestartsUsed++;
+      ctx.stdout(`hanoman \xB7 konfigurasi berubah; menjalankan ulang (${configRestartsUsed}/${MAX_CONFIG_RESTARTS})
+`);
+      continue;
+    }
     restartsUsed++;
     ctx.stdout(`hanoman \xB7 memasang versi terbaru dari npm (${restartsUsed}/${MAX_UPDATE_RESTARTS})
 `);
@@ -8176,7 +8713,7 @@ ${hint}
     ctx.stdout("hanoman \xB7 terpasang; menjalankan ulang\n");
   }
 }
-var MAX_UPDATE_RESTARTS;
+var MAX_UPDATE_RESTARTS, MAX_CONFIG_RESTARTS;
 var init_start = __esm({
   "src/commands/start.ts"() {
     "use strict";
@@ -8185,6 +8722,7 @@ var init_start = __esm({
     init_layout();
     init_update();
     MAX_UPDATE_RESTARTS = 5;
+    MAX_CONFIG_RESTARTS = 5;
   }
 });
 
@@ -8194,8 +8732,8 @@ __export(doctor_exports, {
   default: () => doctor,
   doctorReport: () => doctorReport
 });
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { accessSync, constants, existsSync as existsSync4 } from "node:fs";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync4 } from "node:fs";
 import { dirname as dirname5, resolve as resolve4 } from "node:path";
 function doctorReport(p) {
   const major = Number(/^v?(\d+)/.exec(p.node)?.[1] ?? 0);
@@ -8244,7 +8782,7 @@ function writable(path) {
   for (let p = resolve4(path); ; ) {
     if (existsSync4(p)) {
       try {
-        accessSync(p, constants.W_OK);
+        accessSync2(p, constants2.W_OK);
         return true;
       } catch {
         return false;
@@ -8257,7 +8795,7 @@ function writable(path) {
 }
 function version(bin, args) {
   try {
-    return execFileSync3(bin, args, { encoding: "utf8", timeout: 1e4, stdio: ["ignore", "pipe", "ignore"] }).trim().split("\n")[0] ?? null;
+    return execFileSync4(bin, args, { encoding: "utf8", timeout: 1e4, stdio: ["ignore", "pipe", "ignore"] }).trim().split("\n")[0] ?? null;
   } catch {
     return null;
   }
@@ -8287,21 +8825,10 @@ async function doctor(_argv, ctx) {
     const s2 = scanAgentSkills(a, ctx.env);
     return methodStatus(method, a, { skills: s2.skills.map((k) => k.id), packages: s2.packages });
   });
-  const podman = version("podman", ["--version"]);
-  const sandboxRequired = ctx.env.NODE_ENV === "production" || !!ctx.env.HANOMAN_PUBLIC_ORIGINS;
-  const rootless = podman ? version("podman", ["info", "--format", "{{.Host.Security.Rootless}}"]) === "true" : false;
-  const credentialDir = ctx.env.HANOMAN_AGENT_CREDENTIAL_DIR;
-  let credentialsReadable = false;
-  if (credentialDir) {
-    try {
-      accessSync(credentialDir, constants.R_OK);
-      credentialsReadable = true;
-    } catch {
-    }
-  }
-  const network = ctx.env.HANOMAN_SESSION_NETWORK ?? "hanoman-egress";
-  const networkReady = podman ? version("podman", ["network", "exists", network]) !== null : false;
-  const sandboxReady = ctx.env.HANOMAN_SESSION_SANDBOX === "podman" && rootless && credentialsReadable && !!ctx.env.HANOMAN_EGRESS_PROXY && networkReady;
+  const podmanFacts = collectProbeFacts(ctx.env);
+  const podman = podmanFacts.podman;
+  const sandboxRequired = resolveHardening(ctx.env);
+  const sandboxReady = allReady(prerequisites(ctx.env, podmanFacts));
   const r = doctorReport({
     node: process.version,
     git: version("git", ["--version"]),
@@ -17217,13 +17744,13 @@ function fillCacheFields(method, result) {
   const provided = result;
   const ttlMs = isValidCacheTtlMs(provided["ttlMs"]) ? provided["ttlMs"] : resolveTtlMs(fallback);
   const cacheScope = isValidCacheScope(provided["cacheScope"]) ? provided["cacheScope"] : resolveCacheScope(fallback);
-  const filled = {
+  const filled3 = {
     ...provided,
     ttlMs,
     cacheScope
   };
-  delete filled[RESULT_CACHE_HINT_FALLBACK];
-  return filled;
+  delete filled3[RESULT_CACHE_HINT_FALLBACK];
+  return filled3;
 }
 function isPlainObject$5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -20225,9 +20752,9 @@ var init_ajvProvider_CEoC_sr = __esm({
           const rhs = this.rhs === void 0 ? "" : ` = ${this.rhs}`;
           return `${varKind} ${this.name}${rhs};` + _n;
         }
-        optimizeNames(names, constants2) {
+        optimizeNames(names, constants3) {
           if (!names[this.name.str]) return;
-          if (this.rhs) this.rhs = optimizeExpr(this.rhs, names, constants2);
+          if (this.rhs) this.rhs = optimizeExpr(this.rhs, names, constants3);
           return this;
         }
         get names() {
@@ -20244,9 +20771,9 @@ var init_ajvProvider_CEoC_sr = __esm({
         render({ _n }) {
           return `${this.lhs} = ${this.rhs};` + _n;
         }
-        optimizeNames(names, constants2) {
+        optimizeNames(names, constants3) {
           if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects) return;
-          this.rhs = optimizeExpr(this.rhs, names, constants2);
+          this.rhs = optimizeExpr(this.rhs, names, constants3);
           return this;
         }
         get names() {
@@ -20305,8 +20832,8 @@ var init_ajvProvider_CEoC_sr = __esm({
         optimizeNodes() {
           return `${this.code}` ? this : void 0;
         }
-        optimizeNames(names, constants2) {
-          this.code = optimizeExpr(this.code, names, constants2);
+        optimizeNames(names, constants3) {
+          this.code = optimizeExpr(this.code, names, constants3);
           return this;
         }
         get names() {
@@ -20332,12 +20859,12 @@ var init_ajvProvider_CEoC_sr = __esm({
           }
           return nodes.length > 0 ? this : void 0;
         }
-        optimizeNames(names, constants2) {
+        optimizeNames(names, constants3) {
           const { nodes } = this;
           let i = nodes.length;
           while (i--) {
             const n2 = nodes[i];
-            if (n2.optimizeNames(names, constants2)) continue;
+            if (n2.optimizeNames(names, constants3)) continue;
             subtractNames(names, n2.names);
             nodes.splice(i, 1);
           }
@@ -20384,11 +20911,11 @@ var init_ajvProvider_CEoC_sr = __esm({
           if (cond === false || !this.nodes.length) return void 0;
           return this;
         }
-        optimizeNames(names, constants2) {
+        optimizeNames(names, constants3) {
           var _a3;
-          this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants2);
-          if (!(super.optimizeNames(names, constants2) || this.else)) return;
-          this.condition = optimizeExpr(this.condition, names, constants2);
+          this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants3);
+          if (!(super.optimizeNames(names, constants3) || this.else)) return;
+          this.condition = optimizeExpr(this.condition, names, constants3);
           return this;
         }
         get names() {
@@ -20410,9 +20937,9 @@ var init_ajvProvider_CEoC_sr = __esm({
         render(opts) {
           return `for(${this.iteration})` + super.render(opts);
         }
-        optimizeNames(names, constants2) {
-          if (!super.optimizeNames(names, constants2)) return;
-          this.iteration = optimizeExpr(this.iteration, names, constants2);
+        optimizeNames(names, constants3) {
+          if (!super.optimizeNames(names, constants3)) return;
+          this.iteration = optimizeExpr(this.iteration, names, constants3);
           return this;
         }
         get names() {
@@ -20447,9 +20974,9 @@ var init_ajvProvider_CEoC_sr = __esm({
         render(opts) {
           return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
         }
-        optimizeNames(names, constants2) {
-          if (!super.optimizeNames(names, constants2)) return;
-          this.iterable = optimizeExpr(this.iterable, names, constants2);
+        optimizeNames(names, constants3) {
+          if (!super.optimizeNames(names, constants3)) return;
+          this.iterable = optimizeExpr(this.iterable, names, constants3);
           return this;
         }
         get names() {
@@ -20488,11 +21015,11 @@ var init_ajvProvider_CEoC_sr = __esm({
           (_b = this.finally) === null || _b === void 0 || _b.optimizeNodes();
           return this;
         }
-        optimizeNames(names, constants2) {
+        optimizeNames(names, constants3) {
           var _a3, _b;
-          super.optimizeNames(names, constants2);
-          (_a3 = this.catch) === null || _a3 === void 0 || _a3.optimizeNames(names, constants2);
-          (_b = this.finally) === null || _b === void 0 || _b.optimizeNames(names, constants2);
+          super.optimizeNames(names, constants3);
+          (_a3 = this.catch) === null || _a3 === void 0 || _a3.optimizeNames(names, constants3);
+          (_b = this.finally) === null || _b === void 0 || _b.optimizeNames(names, constants3);
           return this;
         }
         get names() {
@@ -20741,7 +21268,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       function addExprNames(names, from) {
         return from instanceof code_1._CodeOrName ? addNames(names, from.names) : names;
       }
-      function optimizeExpr(expr, names, constants2) {
+      function optimizeExpr(expr, names, constants3) {
         if (expr instanceof code_1.Name) return replaceName(expr);
         if (!canOptimize(expr)) return expr;
         return new code_1._Code(expr._items.reduce((items, c) => {
@@ -20751,13 +21278,13 @@ var init_ajvProvider_CEoC_sr = __esm({
           return items;
         }, []));
         function replaceName(n2) {
-          const c = constants2[n2.str];
+          const c = constants3[n2.str];
           if (c === void 0 || names[n2.str] !== 1) return n2;
           delete names[n2.str];
           return c;
         }
         function canOptimize(e) {
-          return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants2[c.str] !== void 0);
+          return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants3[c.str] !== void 0);
         }
       }
       function subtractNames(names, from) {
@@ -29122,8 +29649,8 @@ __export(mcp_exports, {
   agentTokenPath: () => agentTokenPath,
   default: () => mcp
 });
-import { readFileSync as readFileSync2 } from "node:fs";
-import { join as join6 } from "node:path";
+import { readFileSync as readFileSync3 } from "node:fs";
+import { join as join7 } from "node:path";
 async function mcp(argv, ctx) {
   const cfg = resolveMcpConfig(argv, ctx.env, () => tokenFile(ctx.env));
   const say = (s2) => ctx.stderr(redactToken(s2, cfg.token) + "\n");
@@ -29154,10 +29681,10 @@ var init_mcp2 = __esm({
     init_client();
     init_server();
     init_redact();
-    agentTokenPath = (env) => join6(resolveHome(env), "agent-token");
+    agentTokenPath = (env) => join7(resolveHome(env), "agent-token");
     tokenFile = (env) => {
       try {
-        return readFileSync2(agentTokenPath(env), "utf8");
+        return readFileSync3(agentTokenPath(env), "utf8");
       } catch {
         return null;
       }
@@ -29165,6 +29692,89 @@ var init_mcp2 = __esm({
   }
 });
 
+// src/commands/provision.ts
+var provision_exports = {};
+__export(provision_exports, {
+  default: () => provisionCmd,
+  localScriptPath: () => localScriptPath,
+  parseProvisionArgs: () => parseProvisionArgs,
+  scriptEnv: () => scriptEnv
+});
+import { spawn as spawn2 } from "node:child_process";
+import { existsSync as existsSync5 } from "node:fs";
+import { join as join8 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+function parseProvisionArgs(args) {
+  const probe = args.includes("--probe");
+  const items = (flag(args, "with") ?? "").split(",").map((s2) => s2.trim()).filter(Boolean);
+  const profile = flag(args, "profile") ?? "lab";
+  const domain = flag(args, "domain");
+  if (!PROFILES.includes(profile)) return { error: `profil tak dikenal: ${profile}` };
+  if (!probe && items.length === 0) return { error: "sebutkan komponen dengan --with=a,b" };
+  return {
+    mode: probe ? "probe" : "apply",
+    items,
+    profile,
+    domain,
+    dryRun: args.includes("--dry-run"),
+    yes: args.includes("--yes")
+  };
+}
+function scriptEnv(a) {
+  return {
+    MODE: a.mode,
+    ...a.mode === "apply" ? { ITEMS: a.items.join(","), PROFILE: a.profile } : {},
+    ...a.mode === "apply" && a.domain ? { DOMAIN: a.domain } : {},
+    ...a.mode === "apply" && a.dryRun ? { DRY_RUN: "1" } : {}
+  };
+}
+function localScriptPath(cwd = process.cwd()) {
+  const packed = fileURLToPath2(new URL("../scripts/vps/provision.sh", import.meta.url));
+  if (existsSync5(packed)) return packed;
+  return join8(cwd, "server", "scripts", "vps", "provision.sh");
+}
+function runScript(env, ctx) {
+  return new Promise((resolve5) => {
+    const p = spawn2("bash", [localScriptPath(ctx.cwd)], { env: { ...process.env, ...env } });
+    p.stdout.on("data", (d) => ctx.stdout(String(d)));
+    p.stderr.on("data", (d) => ctx.stderr(String(d)));
+    p.on("close", (code) => resolve5(code ?? 1));
+    p.on("error", (e) => {
+      ctx.stderr(`${e}
+`);
+      resolve5(127);
+    });
+  });
+}
+async function provisionCmd(args, ctx) {
+  const parsed = parseProvisionArgs(args);
+  if ("error" in parsed) {
+    ctx.stderr(`${parsed.error}
+`);
+    return 1;
+  }
+  if (parsed.mode === "probe" || parsed.dryRun) return runScript(scriptEnv(parsed), ctx);
+  if (!parsed.yes) {
+    ctx.stdout("Rencana (dry-run):\n");
+    await runScript({ ...scriptEnv(parsed), DRY_RUN: "1" }, ctx);
+    ctx.stdout("Lanjutkan? [y/N] ");
+    const answer = (await ctx.readStdin?.() ?? "").trim().toLowerCase();
+    if (answer !== "y" && answer !== "ya") {
+      ctx.stderr("dibatalkan\n");
+      return 1;
+    }
+  }
+  return runScript(scriptEnv(parsed), ctx);
+}
+var PROFILES, flag;
+var init_provision = __esm({
+  "src/commands/provision.ts"() {
+    "use strict";
+    PROFILES = ["lab", "production"];
+    flag = (args, name) => args.find((a) => a.startsWith(`--${name}=`))?.split("=").slice(1).join("=");
+  }
+});
+
 // src/commands/migrate-pg.ts
 var migrate_pg_exports = {};
 __export(migrate_pg_exports, {
@@ -29177,7 +29787,7 @@ __export(migrate_pg_exports, {
   migrationSteps: () => migrationSteps,
   parseMigrateArgs: () => parseMigrateArgs
 });
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { dirname as dirname6, resolve as resolvePath2 } from "node:path";
 function coerceInt8(rows, fields, model) {
   const cols = fields.filter((f) => f.dataTypeID === INT8_OID).map((f) => f.name);
@@ -29245,7 +29855,7 @@ async function migratePg(argv, ctx) {
   let layout;
   let dbUrl;
   try {
-    layout = resolveLayout(distDir(), existsSync5);
+    layout = resolveLayout(distDir(), existsSync6);
     dbUrl = opts.to ? `file:${resolvePath2(opts.to)}` : resolveDbUrl(ctx.env, dirname6(layout.schema));
   } catch (e) {
     ctx.stderr(`${e.message}
@@ -29395,11 +30005,11 @@ var init_migrate_pg = __esm({
 });
 
 // src/config.ts
-import { readFileSync as readFileSync3, existsSync as existsSync6 } from "node:fs";
-import { join as join7 } from "node:path";
+import { readFileSync as readFileSync4, existsSync as existsSync7 } from "node:fs";
+import { join as join9 } from "node:path";
 function loadConfig(repoRoot) {
-  const p = join7(repoRoot, "hanoman.config.json");
-  const raw = existsSync6(p) ? JSON.parse(readFileSync3(p, "utf8")) : {};
+  const p = join9(repoRoot, "hanoman.config.json");
+  const raw = existsSync7(p) ? JSON.parse(readFileSync4(p, "utf8")) : {};
   return zHanomanConfig.parse(raw);
 }
 var init_config3 = __esm({
@@ -29411,12 +30021,12 @@ var init_config3 = __esm({
 
 // src/repo.ts
 import { spawnSync } from "node:child_process";
-import { join as join8 } from "node:path";
+import { join as join10 } from "node:path";
 function resolveRepo(cwd) {
   const r = spawnSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8" });
   const root = r.status === 0 ? r.stdout.trim() : cwd;
   const { docsDir } = loadConfig(root);
-  return { root, docsDir, indexPath: join8(root, docsDir, "README.md") };
+  return { root, docsDir, indexPath: join10(root, docsDir, "README.md") };
 }
 var init_repo = __esm({
   "src/repo.ts"() {
@@ -29426,10 +30036,10 @@ var init_repo = __esm({
 });
 
 // src/docs-model.ts
-import { readFileSync as readFileSync4, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { join as join9, relative } from "node:path";
+import { readFileSync as readFileSync5, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { join as join11, relative } from "node:path";
 function parseIndex(indexPath) {
-  const md = readFileSync4(indexPath, "utf8");
+  const md = readFileSync5(indexPath, "utf8");
   const out = /* @__PURE__ */ new Set();
   for (const m of md.matchAll(LINK_RE2)) {
     let t = m[1].trim();
@@ -29444,7 +30054,7 @@ function walkDocs(docsRoot) {
   const walk = (dir) => {
     for (const name of readdirSync3(dir)) {
       if (name.startsWith(".")) continue;
-      const abs = join9(dir, name);
+      const abs = join11(dir, name);
       if (statSync2(abs).isDirectory()) walk(abs);
       else out.push(relative(docsRoot, abs).split("\\").join("/"));
     }
@@ -29476,17 +30086,17 @@ var init_docs_model = __esm({
 });
 
 // src/verify.ts
-import { join as join10 } from "node:path";
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:fs";
+import { join as join12 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
 function scanCoverage(cwd) {
   const { root, docsDir, indexPath } = resolveRepo(cwd);
-  const docsRoot = join10(root, docsDir);
-  if (!existsSync7(docsRoot)) return { coverage: 100, cats: [] };
-  if (!existsSync7(indexPath)) throw new Error(`index Source of Truth tidak ada: ${indexPath}`);
+  const docsRoot = join12(root, docsDir);
+  if (!existsSync8(docsRoot)) return { coverage: 100, cats: [] };
+  if (!existsSync8(indexPath)) throw new Error(`index Source of Truth tidak ada: ${indexPath}`);
   const corpus = walkDocs(docsRoot);
   const read = (rel) => {
     try {
-      return readFileSync5(join10(docsRoot, rel), "utf8");
+      return readFileSync6(join12(docsRoot, rel), "utf8");
     } catch {
       return null;
     }
@@ -29529,9 +30139,9 @@ var init_docs_scan = __esm({
 });
 
 // src/index-edit.ts
-import { readFileSync as readFileSync6, writeFileSync } from "node:fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
 function addLink(indexPath, relPath, category) {
-  let md = readFileSync6(indexPath, "utf8");
+  let md = readFileSync7(indexPath, "utf8");
   if (md.includes(`(${relPath})`)) return;
   const base = relPath.split("/").pop().replace(/\.md$/, "");
   const line = `- [${base}](${relPath})`;
@@ -29546,7 +30156,7 @@ ${head}
 ${line}
 `;
   }
-  writeFileSync(indexPath, md);
+  writeFileSync2(indexPath, md);
 }
 var init_index_edit = __esm({
   "src/index-edit.ts"() {
@@ -29560,23 +30170,23 @@ __export(docs_index_exports, {
   default: () => docs_index_default
 });
 import { parseArgs as parseArgs2 } from "node:util";
-import { join as join11 } from "node:path";
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
+import { join as join13 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
 async function docs_index_default(args, ctx) {
   const { values } = parseArgs2({ args, options: { check: { type: "boolean" }, fix: { type: "boolean" } }, allowPositionals: true });
   const { root, docsDir, indexPath } = resolveRepo(ctx.cwd);
-  const docsRoot = join11(root, docsDir);
+  const docsRoot = join13(root, docsDir);
   const corpus = walkDocs(docsRoot);
   const read = (rel) => {
     try {
-      return readFileSync7(join11(docsRoot, rel), "utf8");
+      return readFileSync8(join13(docsRoot, rel), "utf8");
     } catch {
       return null;
     }
   };
   const linked = linkedSetFrom(INDEX_NAME, corpus, read);
   const unlinked = corpus.filter((f) => f !== INDEX_NAME && !linked.has(f));
-  const dangling = [...parseIndex(indexPath)].filter((p) => !existsSync8(join11(docsRoot, p)));
+  const dangling = [...parseIndex(indexPath)].filter((p) => !existsSync9(join13(docsRoot, p)));
   if (values.fix) {
     for (const f of unlinked) addLink(indexPath, f, f.split("/")[0]);
     ctx.stdout(`linked ${unlinked.length} doc(s)
@@ -29629,7 +30239,7 @@ var init_docs_link = __esm({
 });
 
 // src/release/pack.ts
-import { join as join12 } from "node:path";
+import { join as join14 } from "node:path";
 function packageJsonFor(version3, deps) {
   return {
     name: PKG_NAME,
@@ -29652,7 +30262,7 @@ function packageJsonFor(version3, deps) {
       prepublishOnly: "node dist/cli.js __verify"
     },
     engines: { node: ">=20" },
-    files: ["bin", "dist", "web", "prisma", "docs", "README.md", "LICENSE"],
+    files: ["bin", "dist", "web", "prisma", "docs", "scripts", "README.md", "LICENSE"],
     dependencies: deps,
     // MIT: paket ini didistribusikan publik supaya orang `npm i -g`. `UNLICENSED` berarti "tak ada
     // izin pakai" — 0.1.0 terbit dengan kontradiksi itu, dan versi terbit tak bisa diperbaiki.
@@ -29667,17 +30277,19 @@ function verifyPackedDeps(pkg) {
 }
 function copyPlan(repo) {
   return [
-    { from: join12(repo, "server/dist/server.js"), to: "dist/server.js" },
-    { from: join12(repo, "server/dist/build-info.json"), to: "dist/build-info.json" },
-    { from: join12(repo, "cli/dist/hanoman.js"), to: "dist/cli.js" },
-    { from: join12(repo, "src/dist"), to: "web", dir: true },
-    { from: join12(repo, "server/prisma/schema.prisma"), to: "prisma/schema.prisma" },
-    { from: join12(repo, "server/prisma/migrations"), to: "prisma/migrations", dir: true },
-    { from: join12(repo, "internal/docs/operations/npm-readme.md"), to: "README.md" },
+    { from: join14(repo, "server/dist/server.js"), to: "dist/server.js" },
+    { from: join14(repo, "server/dist/build-info.json"), to: "dist/build-info.json" },
+    { from: join14(repo, "cli/dist/hanoman.js"), to: "dist/cli.js" },
+    { from: join14(repo, "src/dist"), to: "web", dir: true },
+    { from: join14(repo, "server/prisma/schema.prisma"), to: "prisma/schema.prisma" },
+    { from: join14(repo, "server/prisma/migrations"), to: "prisma/migrations", dir: true },
+    { from: join14(repo, "internal/docs/operations/npm-readme.md"), to: "README.md" },
     // SPEC-489 · dibaca runtime oleh pickGuideFile (kandidat `<pkg>/docs/…`). Bukan README:
     // README paket adalah npm-readme.md (berhadapan-MANUSIA), ini naskah berhadapan-AGEN.
-    { from: join12(repo, "docs/agent-integration.md"), to: "docs/agent-integration.md" },
-    { from: join12(repo, "LICENSE"), to: "LICENSE" }
+    { from: join14(repo, "docs/agent-integration.md"), to: "docs/agent-integration.md" },
+    // SPEC-883 · skrip VPS (audit/harden/remediate/provision) dibaca runtime lewat scriptPath().
+    { from: join14(repo, "server/scripts/vps"), to: "scripts/vps", dir: true },
+    { from: join14(repo, "LICENSE"), to: "LICENSE" }
   ];
 }
 var PKG_NAME, REPO_URL, RUNTIME_DEPS, REQUIRED_ARTIFACTS, BIN_SHIM;
@@ -29710,7 +30322,15 @@ var init_pack = __esm({
       // SPEC-489 · naskah panduan AI agent — dibaca runtime & disajikan di GET /api/agent-integration.md.
       // Tanpa gerbang ini paket bisa terbit tanpa dokumen dan endpoint-nya 404 di SETIAP instalasi npm,
       // sementara checkout dev terlihat sehat.
-      "docs/agent-integration.md"
+      "docs/agent-integration.md",
+      // SPEC-883 · skrip VPS dibaca runtime oleh scriptPath(). Sebelum spec ini keempatnya TIDAK
+      // ikut terpaket sementara scriptPath menjangkar ke repoRoot() — di instalasi npm marker
+      // pnpm-workspace.yaml tak ada, repoRoot jatuh ke cwd, dan audit/harden/remediate melempar
+      // ENOENT. Gerbang ini yang membuat kegagalan itu tak bisa terbit lagi.
+      "scripts/vps/audit.sh",
+      "scripts/vps/harden.sh",
+      "scripts/vps/remediate.sh",
+      "scripts/vps/provision.sh"
     ];
     BIN_SHIM = `#!/usr/bin/env node
 // SPEC-398 \xB7 shim tipis: seluruh logika ada di dist/cli.js (bundle esbuild).
@@ -29724,10 +30344,10 @@ var pack_exports = {};
 __export(pack_exports, {
   default: () => pack
 });
-import { cpSync, existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync8, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname7, join as join13 } from "node:path";
+import { cpSync, existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync9, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname7, join as join15 } from "node:path";
 function depVersions(repo) {
-  const read = (p) => JSON.parse(readFileSync8(join13(repo, p), "utf8"));
+  const read = (p) => JSON.parse(readFileSync9(join15(repo, p), "utf8"));
   const server = read("server/package.json"), cli = read("cli/package.json");
   const pools = [server.dependencies, server.devDependencies, cli.dependencies, cli.devDependencies];
   const out = {};
@@ -29741,19 +30361,19 @@ function depVersions(repo) {
 async function pack(argv, ctx) {
   let repo;
   try {
-    repo = resolveLayout(distDir(), existsSync9).root;
+    repo = resolveLayout(distDir(), existsSync10).root;
   } catch (e) {
     ctx.stderr(`${e.message}
 `);
     return 1;
   }
-  if (!existsSync9(join13(repo, "server/prisma/schema.prisma"))) {
+  if (!existsSync10(join15(repo, "server/prisma/schema.prisma"))) {
     ctx.stderr("pack: hanya bisa dijalankan dari checkout repo hanoman\n");
     return 1;
   }
   const outIdx = argv.indexOf("--out");
-  const out = outIdx === -1 ? join13(repo, "dist-npm") : join13(repo, argv[outIdx + 1] ?? "dist-npm");
-  const version3 = JSON.parse(readFileSync8(join13(repo, "package.json"), "utf8")).version;
+  const out = outIdx === -1 ? join15(repo, "dist-npm") : join15(repo, argv[outIdx + 1] ?? "dist-npm");
+  const version3 = JSON.parse(readFileSync9(join15(repo, "package.json"), "utf8")).version;
   if (!version3) {
     ctx.stderr("pack: root package.json tanpa field version\n");
     return 1;
@@ -29767,20 +30387,20 @@ async function pack(argv, ctx) {
     return 1;
   }
   rmSync(out, { recursive: true, force: true });
-  mkdirSync2(join13(out, "bin"), { recursive: true });
+  mkdirSync3(join15(out, "bin"), { recursive: true });
   for (const item of copyPlan(repo)) {
-    if (!existsSync9(item.from)) {
+    if (!existsSync10(item.from)) {
       ctx.stderr(`pack: artefak hilang \u2014 ${item.from} (sudah \`pnpm build\`?)
 `);
       return 1;
     }
-    const dest = join13(out, item.to);
-    mkdirSync2(dirname7(dest), { recursive: true });
+    const dest = join15(out, item.to);
+    mkdirSync3(dirname7(dest), { recursive: true });
     cpSync(item.from, dest, item.dir ? { recursive: true } : {});
   }
-  writeFileSync2(join13(out, "bin/hanoman.mjs"), BIN_SHIM);
-  writeFileSync2(join13(out, "package.json"), JSON.stringify(packageJsonFor(version3, deps), null, 2) + "\n");
-  const missing = REQUIRED_ARTIFACTS.filter((a) => !existsSync9(join13(out, a)));
+  writeFileSync3(join15(out, "bin/hanoman.mjs"), BIN_SHIM);
+  writeFileSync3(join15(out, "package.json"), JSON.stringify(packageJsonFor(version3, deps), null, 2) + "\n");
+  const missing = REQUIRED_ARTIFACTS.filter((a) => !existsSync10(join15(out, a)));
   if (missing.length) {
     ctx.stderr(`pack: artefak wajib hilang: ${missing.join(", ")}
 `);
@@ -29805,13 +30425,13 @@ var verify_packed_exports = {};
 __export(verify_packed_exports, {
   default: () => verifyPacked
 });
-import { readFileSync as readFileSync9 } from "node:fs";
-import { join as join14 } from "node:path";
+import { readFileSync as readFileSync10 } from "node:fs";
+import { join as join16 } from "node:path";
 function verifyPacked(_argv, ctx) {
-  const path = join14(process.cwd(), "package.json");
+  const path = join16(process.cwd(), "package.json");
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync9(path, "utf8"));
+    pkg = JSON.parse(readFileSync10(path, "utf8"));
   } catch {
     ctx.stderr(`verify: tak bisa membaca ${path}
 `);
@@ -29847,7 +30467,7 @@ function route(argv) {
   if (argv.includes("--help")) return { cmd: "help", args: [] };
   const [group, sub, ...rest] = argv;
   if (group === void 0 || group.startsWith("--")) return { cmd: "start", args: argv };
-  if (group === "start" || group === "doctor" || group === "update" || group === "mcp")
+  if (group === "start" || group === "doctor" || group === "update" || group === "mcp" || group === "provision")
     return { cmd: group, args: argv.slice(1) };
   if (group === "migrate-from-postgres") return { cmd: "migrate-pg", args: argv.slice(1) };
   if (group === "docs" && (sub === "scan" || sub === "index" || sub === "link")) {
@@ -29857,7 +30477,7 @@ function route(argv) {
   if (group === "__verify") return { cmd: "__verify", args: argv.slice(1) };
   return { cmd: "unknown", args: argv };
 }
-async function run(argv, ctx) {
+async function run2(argv, ctx) {
   const { cmd, args } = route(argv);
   if (cmd === "version") {
     ctx.stdout(currentVersion() + "\n");
@@ -29871,6 +30491,7 @@ async function run(argv, ctx) {
   if (cmd === "doctor") return (await Promise.resolve().then(() => (init_doctor(), doctor_exports))).default(args, ctx);
   if (cmd === "update") return (await Promise.resolve().then(() => (init_update(), update_exports))).default(args, ctx);
   if (cmd === "mcp") return (await Promise.resolve().then(() => (init_mcp2(), mcp_exports))).default(args, ctx);
+  if (cmd === "provision") return (await Promise.resolve().then(() => (init_provision(), provision_exports))).default(args, ctx);
   if (cmd === "migrate-pg") return (await Promise.resolve().then(() => (init_migrate_pg(), migrate_pg_exports))).default(args, ctx);
   if (cmd === "docs:scan") return (await Promise.resolve().then(() => (init_docs_scan(), docs_scan_exports))).default(args, ctx);
   if (cmd === "docs:index") return (await Promise.resolve().then(() => (init_docs_index(), docs_index_exports))).default(args, ctx);
@@ -29893,6 +30514,9 @@ var init_router = __esm({
     --port <n> --host <h> --db <file> --no-migrate
   doctor                                    periksa prasyarat: node, git, tmux, CLI agen, data dir
   update [--check]                          bandingkan versi dengan registry npm; pasang yang terbaru
+  provision [--with=a,b] [--probe]          pasang komponen di MESIN INI (hanoman, caddy, claude,
+    [--profile=lab|production]              codex, gh, \u2026). --probe hanya melaporkan apa yang ada.
+    [--domain=<d>] [--dry-run] [--yes]
   mcp [--read-only] [--host <url>]          MCP server stdio untuk klien AI (Claude Code/Desktop,
     [--max-bytes <n>]                       Codex, Cursor, Copilot). Token dari HANOMAN_AGENT_TOKEN.
   migrate-from-postgres --from <url>        pindahkan data Postgres lama ke SQLite
@@ -29913,7 +30537,7 @@ var readStdin = () => new Promise((res) => {
   process.stdin.on("end", () => res(d));
   if (process.stdin.isTTY) res("");
 });
-run(process.argv.slice(2), {
+run2(process.argv.slice(2), {
   cwd: process.cwd(),
   env: process.env,
   stdout: (s2) => process.stdout.write(s2),