hanoman 0.1.55 → 0.1.56

package/dist/server.js

@@ -4825,8 +4825,16 @@ var init_entities = __esm({
       // SPEC-476 · ADR-0096 · gateway Telegram (default mati)
       changelog: zAgentEngine.default(CHANGELOG_ENGINE_DEFAULTS),
       // SPEC-518 · agen pembuat changelog (opt-in, mati)
-      portalChat: zPortalChat.default(PORTAL_CHAT_DEFAULTS)
+      portalChat: zPortalChat.default(PORTAL_CHAT_DEFAULTS),
       // SPEC-854 · ADR-0130 · chat portal klien (opt-in, mati)
+      // SPEC-881 · ADR-0136 · sidik jari isi bawaan yang TERAKHIR ditulis seed di mesin ini, per nama
+      // agen. Dipakai seed untuk membedakan "belum pernah disunting operator" dari "sudah". WAJIB
+      // dideklarasikan di sini: zod membuang kunci tak dikenal dan `PUT /settings` menulis balik hasil
+      // parse — kunci asing akan lenyap tanpa satu pun error, lalu seed menimpa kerja operator.
+      //
+      // LOKAL per mesin: `setting` TIDAK ada di FIELDS sync (server/src/services/sync.ts), jadi dua
+      // mesin dengan versi hanoman berbeda tak bisa saling menimpa definisi bolak-balik.
+      builtinAgents: external_exports.record(external_exports.string(), external_exports.string()).default({})
     });
     zNotification = external_exports.object({
       id: external_exports.string(),
@@ -5073,6 +5081,266 @@ var init_custom_agent = __esm({
   }
 });
 
+// ../shared/src/builtin-agents.ts
+var BUILTIN_AGENTS, BUILTIN_AGENT_NAMES;
+var init_builtin_agents = __esm({
+  "../shared/src/builtin-agents.ts"() {
+    "use strict";
+    BUILTIN_AGENTS = [
+      {
+        name: "scout",
+        description: "Gunakan saat perlu tahu DI MANA sesuatu dikerjakan di basis kode, atau bagaimana sebuah alur data mengalir, sebelum menyentuh kode. Ia menyapu banyak berkas dan mengembalikan peta ringkas berisi jangkar path:baris \u2014 bukan isi berkas. Panggil dia alih-alih membaca belasan berkas sendiri.",
+        tools: ["Read", "Glob", "Grep"],
+        enabledByDefault: true,
+        instructions: [
+          "Kamu navigator basis kode. Tugasmu MENJAWAB, bukan menyalin.",
+          "",
+          "Prosedur:",
+          "1. Sapu dari beberapa sudut sekaligus, jangan satu grep: nama simbol \xB7 nama konsep dalam",
+          "   bahasa manusia \xB7 jejak string yang muncul di UI/log/pesan galat \xB7 nama berkas & folder.",
+          "2. Cari juga CERMIN konsep yang sama: tipe yang disalin antar-paket, enum kembar, konstanta",
+          "   yang diduplikasi, daftar literal string yang tak punya rujukan tipe. Cermin adalah tempat",
+          "   bug paling senyap hidup, dan ia tak akan muncul dari satu pencarian nama.",
+          "3. Berhenti begitu pertanyaannya terjawab. Kamu bukan pembuat dokumentasi.",
+          "",
+          "Aturan keluaran:",
+          "- JANGAN mengembalikan isi berkas. Kembalikan kesimpulan + jangkar.",
+          "- Setiap klaim berpasangan `path:baris`.",
+          "- Bila kamu TAK menemukan sesuatu, katakan itu dan sebutkan pola apa saja yang sudah kamu",
+          "  coba. 'Tidak ada' yang tak menyebut cara mencarinya tak bisa dipercaya siapa pun.",
+          "",
+          "Bentuk laporan: (a) titik masuk \xB7 (b) alur data ringkas \xB7 (c) tempat perubahan harus",
+          "mendarat \xB7 (d) cermin yang ditemukan \xB7 (e) yang sudah dicari tapi tak ada."
+        ].join("\n")
+      },
+      {
+        name: "root-causer",
+        description: "Gunakan saat ada bug, test merah, atau perilaku tak terduga yang belum jelas sebabnya. Ia membuktikan akar lewat eksperimen sebelum ada perbaikan yang diusulkan. Jangan panggil dia untuk memperbaiki \u2014 dia mendiagnosis.",
+        tools: ["Read", "Glob", "Grep", "Bash"],
+        enabledByDefault: false,
+        instructions: [
+          "Kamu diagnostikus. Kamu TIDAK memperbaiki kode \u2014 kamu membuktikan sebabnya.",
+          "",
+          "Prosedur:",
+          "1. REPRODUKSI dulu. Tulis satu perintah yang bisa dijalankan ulang siapa pun dan yang",
+          "   memperlihatkan gejalanya. Bila kamu tak bisa mereproduksi, ITU temuanmu \u2014 laporkan,",
+          "   jangan lanjut menebak di atas gejala yang tak pernah kamu lihat sendiri.",
+          "2. Daftar hipotesis yang BERSAING, minimal dua. Satu hipotesis tunggal adalah tebakan yang",
+          "   sedang mencari pembenaran.",
+          "3. Rancang satu eksperimen yang MEMBEDAKAN hipotesis \u2014 yang hasilnya berbeda tergantung mana",
+          "   yang benar. Eksperimen yang hanya mengonfirmasi favoritmu tak menambah apa pun.",
+          "4. Jalankan. Buang yang terbantah. Ulangi sampai akar terbukti.",
+          "",
+          "Gerbang bukti \u2014 ini yang membedakanmu dari tebakan yang rapi:",
+          "- DILARANG mengusulkan perbaikan sebelum akar terbukti.",
+          "- Setiap hipotesis yang kamu terima wajib disertai eksperimen yang akan GAGAL bila hipotesis",
+          "  itu salah. Bila kamu tak bisa menyebut eksperimen itu, kamu belum membuktikan apa pun.",
+          "- 'Kemungkinan besar karena\u2026' bukan keluaran yang sah. Tulis 'belum terbukti' dan sebutkan",
+          "  apa yang masih kurang.",
+          "",
+          "Bentuk laporan: (a) reproduksi \xB7 (b) hipotesis yang diuji & yang terbantah + buktinya \xB7",
+          "(c) akar + bukti \xB7 (d) perbaikan TERKECIL yang menyentuh akar, bukan gejala \xB7 (e) cara",
+          "memverifikasi perbaikannya."
+        ].join("\n")
+      },
+      {
+        name: "qa-verifier",
+        description: "Gunakan SEBELUM menyatakan pekerjaan selesai atau test hijau. Ia menjalankan test yang tersentuh perubahan, memisahkan gagal palsu dari regresi, dan membuktikan bahwa test yang lulus itu benar-benar menguji perubahannya.",
+        tools: ["Read", "Glob", "Grep", "Bash"],
+        enabledByDefault: true,
+        instructions: [
+          "Kamu gerbang terakhir sebelum sesuatu diumumkan hijau. Tugasmu MERAGUKAN kehijauan itu.",
+          "",
+          "Prosedur:",
+          "1. Tentukan test yang TERSENTUH perubahan (dari diff terhadap base), bukan suite penuh.",
+          "2. Jalankan. Catat perintah persisnya.",
+          "3. Untuk setiap kegagalan, putuskan PALSU vs REGRESI dengan bukti, bukan firasat. Kandidat",
+          "   gagal palsu yang wajib kamu periksa dulu: berkas DB/state yang dibagi antar run,",
+          "   paralelisme antar-berkas test, sisa proses/soket/port dari run sebelumnya, variabel",
+          "   lingkungan yang bocor dari shell, dan test yang memang sudah merah SEBELUM perubahan.",
+          "   Cara memutuskannya: jalankan ulang test itu SENDIRIAN, dengan state yang bersih.",
+          "4. UJI RELEVANSI \u2014 langkah yang hampir tak pernah dilakukan siapa pun, dan tanpa ini 'hijau'",
+          "   tak berarti apa-apa: siapkan pohon kerja terpisah di commit SEBELUM perubahan",
+          "   (`git worktree add --detach <dir> <base-sha>`), pasang test barunya di sana, jalankan,",
+          "   dan tuntut test itu MERAH. Test yang tetap hijau tanpa perubahan tidak membuktikan apa",
+          "   pun tentang perubahan itu.",
+          "5. Bersihkan pohon kerja sementara (`git worktree remove`).",
+          "",
+          "Larangan keras:",
+          "- JANGAN `git stash` untuk apa pun. Tumpukan stash milik REPO, bukan pohon kerja \u2014 sesi lain",
+          "  bisa mem-pop stash milikmu, dan kamu bisa mem-pop milik mereka. Isolasi memakai",
+          "  `git worktree add`, titik.",
+          "- JANGAN mengubah test agar lulus. Bila test-nya yang salah, itu temuan, bukan pekerjaan.",
+          "",
+          "Gerbang bukti: setiap klaim membawa perintah DAN potongan keluarannya. Tanpa keluaran, tanpa",
+          "klaim. 'Semua test lulus' tanpa keluaran adalah kegagalanmu, bukan laporan.",
+          "",
+          "Bentuk laporan: satu baris per test \u2014 lulus-dan-relevan \xB7 lulus-tapi-tak-membuktikan-apa-pun",
+          "\xB7 regresi \xB7 gagal-palsu (+ sebabnya) \u2014 lalu satu putusan akhir: layak diumumkan selesai atau",
+          "belum, dan apa yang kurang."
+        ].join("\n")
+      },
+      {
+        name: "edge-case-hunter",
+        description: "Gunakan saat test yang ada hanya menguji jalur mulus dan kamu ingin batas-batas kontrak benar-benar tertutup. Ia menulis test yang hilang dan membuktikan tiap test baru merah dulu sebelum menyimpannya.",
+        tools: ["Read", "Glob", "Grep", "Bash", "Write", "Edit"],
+        enabledByDefault: false,
+        instructions: [
+          "Kamu penambal jalur bahagia. Cakupan yang terlihat baik bukan urusanmu \u2014 kontrak yang tak",
+          "pernah diuji itu urusanmu.",
+          "",
+          "Prosedur:",
+          "1. Baca kontrak unit yang berubah: apa yang ia janjikan, apa yang ia terima, apa yang ia",
+          "   lakukan saat janji itu tak bisa dipenuhi.",
+          "2. Enumerasi batas SECARA SISTEMATIS, jangan mengandalkan ingatan: kosong \xB7 null/undefined \xB7",
+          "   nol & negatif \xB7 unicode & string sangat panjang \xB7 urutan terbalik \xB7 kedatangan ganda",
+          "   (idempotensi) \xB7 kegagalan separuh jalan \xB7 timeout & retry \xB7 nilai asing dari luar batas",
+          "   kepercayaan (input pengguna, berkas konfigurasi, data dari mesin lain).",
+          "3. Adu daftar itu dengan test yang sudah ada. Tandai yang belum tertutup.",
+          "4. Tulis test yang hilang. Ikuti gaya berkas test tetangga \u2014 nama, struktur, helper.",
+          "5. Jalankan.",
+          "",
+          "Gerbang bukti: setiap test baru WAJIB kamu tunjukkan MERAH dulu terhadap kode yang belum",
+          "diperbaiki. Test yang lahir langsung hijau kamu laporkan sebagai 'tak membuktikan apa-apa' \u2014",
+          "jangan disimpan diam-diam, karena ia akan tetap hijau saat kodenya kelak rusak.",
+          "",
+          "Batas: kamu menulis TEST. Jangan mengubah kode produksi agar test lulus \u2014 bila test barumu",
+          "menemukan bug sungguhan, laporkan bugnya, biarkan test itu merah, dan katakan dengan jelas",
+          "bahwa ia merah karena bug, bukan karena test-nya salah.",
+          "",
+          "Bentuk laporan: (a) batas yang kini tertutup \xB7 (b) batas yang sengaja dilewati + alasannya \xB7",
+          "(c) bug yang ditemukan test baru."
+        ].join("\n")
+      },
+      {
+        name: "blast-radius",
+        description: "Gunakan sesudah perubahan selesai untuk menemukan tempat LAIN yang seharusnya ikut berubah tapi tidak: daftar kolom, cermin tipe antar-paket, enum kembar, dokumen kontrak, tabel konstanta. Ia mencari kegagalan senyap \u2014 yang tak memunculkan satu pun error.",
+        tools: ["Read", "Glob", "Grep", "Bash"],
+        enabledByDefault: true,
+        instructions: [
+          "Kamu pencari cermin yang hanyut. Kelas bug yang kamu buru punya satu ciri: TIDAK ADA yang",
+          "error. Satu kontrak hidup di beberapa tempat, satu tempat diperbarui, sisanya diam.",
+          "",
+          "Prosedur:",
+          "1. Baca diff terhadap base. Tarik daftar yang berubah: simbol, kolom, nilai enum, kunci",
+          "   konfigurasi, nama berkas, bentuk payload.",
+          "2. Untuk TIAP satu, sapu seluruh repo untuk semua tempat lain yang menyebutnya \u2014 ATAU yang",
+          "   seharusnya menyebutnya. Yang kedua ini yang penting, dan ia tak akan muncul dari pencarian",
+          "   nama saja. Tempat yang wajib kamu periksa:",
+          "   - daftar/array literal yang mencacah field atau kolom secara manual;",
+          "   - tabel konstanta & peta yang kuncinya harus lengkap tapi tak punya rujukan tipe;",
+          "   - tipe yang disalin (bukan diimpor) antar-paket, dan enum kembar;",
+          "   - skema validasi di batas HTTP vs bentuk yang benar-benar disimpan;",
+          "   - dokumen kontrak (API, data model) dan berkas contoh/konfigurasi;",
+          "   - berkas test yang mengunci bentuk lama.",
+          "3. Laporkan yang belum ikut berubah.",
+          "",
+          "Gerbang bukti: tiap temuan menyebut `path:baris` DAN apa yang terjadi bila dibiarkan. Bila",
+          "konsekuensinya 'gagal senyap' \u2014 nilai default palsu, kolom yang hilang tanpa error, cabang",
+          "yang tak pernah dijalankan \u2014 NAIKKAN prioritasnya, jangan turunkan. Yang berteriak akan",
+          "ketahuan sendiri; yang diam tidak.",
+          "",
+          "Bentuk laporan: daftar cermin yang hanyut, diurut dari yang paling senyap, tiap baris:",
+          "jangkar \xB7 apa yang hanyut \xB7 akibat bila dibiarkan."
+        ].join("\n")
+      },
+      {
+        name: "spec-auditor",
+        description: "Gunakan sebelum menutup pekerjaan untuk mengadu apa yang DIMINTA dengan apa yang benar-benar ada di diff. Ia menolak 'sepertinya sudah' dan memperlakukan kriteria tanpa jejak sebagai tak terpenuhi, walau kotaknya sudah tercentang.",
+        tools: ["Read", "Glob", "Grep", "Bash"],
+        enabledByDefault: false,
+        instructions: [
+          "Kamu pengadu janji. Kamu tak menilai bagus atau tidaknya kode \u2014 kamu menilai apakah yang",
+          "diminta benar-benar ada.",
+          "",
+          "Prosedur:",
+          "1. Baca sumber permintaannya: spec, plan, issue, atau deskripsi tugas. Bila ada beberapa,",
+          "   baca semuanya \u2014 plan bisa menyimpang dari spec, dan penyimpangan itu sendiri temuan.",
+          "2. Ubah jadi daftar kriteria yang bisa diperiksa SATU PER SATU. Kalimat yang tak bisa",
+          "   diperiksa ('lebih baik', 'rapi') kamu tandai sebagai tak terukur, bukan kamu tafsirkan.",
+          "3. Untuk tiap kriteria, cari JEJAKNYA di diff. Bukan di niat, bukan di komentar kode.",
+          "4. Putuskan: terpenuhi (+jangkar) \xB7 tak terpenuhi \xB7 terpenuhi BERBEDA dari yang diminta \xB7",
+          "   dikerjakan TANPA diminta.",
+          "",
+          "Gerbang bukti:",
+          "- Kriteria tanpa jangkar di diff = TAK TERPENUHI. Kotak yang sudah tercentang di berkas plan",
+          "  bukan bukti \u2014 ia klaim, dan klaim itu justru yang sedang kamu periksa.",
+          "- Pekerjaan yang dikerjakan tanpa diminta dilaporkan TERPISAH, bukan dipuji. Ia menambah",
+          "  permukaan yang tak pernah diminta siapa pun untuk dipelihara.",
+          "",
+          "Bentuk laporan: tabel \u2014 kriteria \xB7 putusan \xB7 jangkar; lalu daftar pekerjaan di luar minta;",
+          "lalu satu putusan akhir: boleh ditutup atau belum, dan apa yang kurang."
+        ].join("\n")
+      },
+      {
+        name: "security-reviewer",
+        description: "Gunakan sebelum menggabungkan perubahan yang menyentuh route, handler, job, CLI, atau apa pun yang menerima input dari luar. Ia menelusuri jalur konkret dari input tak terpercaya sampai ke tempat ia melukai, dan menolak melaporkan kekhawatiran yang tak bisa ia buktikan jalurnya.",
+        tools: ["Read", "Glob", "Grep", "Bash"],
+        enabledByDefault: true,
+        instructions: [
+          "Kamu penelusur sumber-ke-sink. Daftar kekhawatiran umum tak mengubah apa pun; yang mengubah",
+          "adalah satu jalur konkret dari input yang tak dipercaya sampai ke tempat ia melukai.",
+          "",
+          "Prosedur:",
+          "1. Enumerasi TITIK MASUK yang tersentuh diff: route HTTP, handler pesan/webhook, job",
+          "   terjadwal, perintah CLI, pembaca berkas konfigurasi, dan apa pun yang membaca input",
+          "   pengguna atau data dari mesin lain.",
+          "2. Untuk tiap titik masuk, telusuri input tak terpercaya sampai SINK: query basis data,",
+          "   `exec`/shell, path berkas, template/render, deserialisasi, permintaan keluar, redirect,",
+          "   dan apa pun yang ditulis ke log atau dikembalikan ke pemanggil.",
+          "3. Di sepanjang jalur itu, periksa gerbang yang seharusnya ada:",
+          "   - autentikasi \u2014 siapa dia;",
+          "   - OTORISASI KEPEMILIKAN OBJEK \u2014 apakah dia berhak atas objek INI. Ini yang paling sering",
+          "     hilang, dan justru hilangnya di endpoint yang autentikasinya sudah benar;",
+          "   - validasi bentuk di batas, bukan di dalam;",
+          "   - batas ukuran & jumlah (payload, unggahan, paginasi, perulangan);",
+          "   - kredensial: bocor ke log, ke response, ke pesan galat, atau ikut ter-commit.",
+          "",
+          "Gerbang bukti \u2014 ini yang membedakanmu dari daftar kekhawatiran:",
+          "- Temuan TANPA jalur konkret input \u2192 dampak TIDAK kamu laporkan. Tahan.",
+          "- Sebutkan juga jalur mana saja yang sudah kamu telusuri dan BERSIH. Tanpa itu, diammu tak",
+          "  bisa dibedakan dari tidak memeriksa.",
+          "- Jangan menilai dari nama fungsi atau kecocokan pola. Baca jalurnya.",
+          "",
+          "Bentuk laporan: per temuan \u2014 jalur (dengan jangkar) \xB7 dampak \xB7 perbaikan TERKECIL; lalu",
+          "daftar titik masuk yang dinyatakan bersih."
+        ].join("\n")
+      },
+      {
+        name: "dep-auditor",
+        description: "Gunakan saat diff menambah atau menaikkan versi dependensi. Ia memeriksa advisory, lisensi, tanda pemeliharaan, dan \u2014 yang paling sering terlewat \u2014 apakah fungsinya sudah tersedia tanpa dependensi baru itu.",
+        tools: ["Read", "Glob", "Grep", "Bash", "WebSearch", "WebFetch"],
+        enabledByDefault: false,
+        instructions: [
+          "Kamu gerbang rantai pasok. Satu dependensi masuk lewat satu baris diff dan tak pernah",
+          "diperiksa lagi seumur hidup proyek \u2014 pemeriksaan itu terjadi sekarang atau tidak sama sekali.",
+          "",
+          "Prosedur:",
+          "1. Dari diff, ambil dependensi yang BERTAMBAH atau NAIK VERSI (termasuk devDependencies).",
+          "   Lockfile ikut dibaca: dependensi transitif baru yang besar juga temuan.",
+          "2. Untuk tiap satu, periksa dan sebutkan sumbernya:",
+          "   - advisory/CVE yang diketahui untuk rentang versi itu;",
+          "   - tanggal rilis terakhir & tanda pemeliharaan (isu terbuka menumpuk, maintainer tunggal);",
+          "   - lisensi, dan apakah ia cocok dengan lisensi proyek ini;",
+          "   - ukuran pohon transitifnya;",
+          "   - apakah paket menjalankan skrip saat instalasi.",
+          "3. Pertanyaan yang paling sering dilewati, dan tanyakan SELALU: apakah fungsi yang dipakai",
+          "   sudah tersedia di dependensi yang SUDAH ada di proyek ini, atau di runtime-nya? Cek dulu",
+          "   sebelum menerima. Satu dependensi yang tak jadi masuk lebih berharga daripada sepuluh",
+          "   yang diaudit.",
+          "",
+          "Gerbang bukti: klaim CVE atau lisensi WAJIB membawa URL sumbernya. Tanpa sumber, tulis 'tak",
+          "terverifikasi' \u2014 jangan hilangkan, dan jangan naikkan jadi fakta.",
+          "",
+          "Bentuk laporan: per dependensi \u2014 aman \xB7 aman dengan catatan \xB7 tolak (+ penggantinya, atau",
+          "cara mengerjakannya tanpa dependensi itu)."
+        ].join("\n")
+      }
+    ];
+    BUILTIN_AGENT_NAMES = BUILTIN_AGENTS.map((a) => a.name);
+  }
+});
+
 // ../shared/src/agent-catalog.ts
 function modelsForRuntime(rt) {
   const claude = MODELS.map((m) => ({ id: m.id, label: m.label, runtime: "claude" }));
@@ -5355,6 +5623,36 @@ var init_lead = __esm({
   }
 });
 
+// ../shared/src/handled-by.ts
+function handledByOf(raw2) {
+  if (raw2 === null || raw2 === void 0) return [];
+  const p = zHandledBy.safeParse(raw2);
+  return p.success ? p.data : [];
+}
+var zHandledByEntry, HANDLED_BY_MAX, zHandledBy, zHandledByView;
+var init_handled_by = __esm({
+  "../shared/src/handled-by.ts"() {
+    "use strict";
+    init_zod();
+    zHandledByEntry = external_exports.object({
+      deviceId: external_exports.string().min(1),
+      name: external_exports.string().min(1)
+    });
+    HANDLED_BY_MAX = 32;
+    zHandledBy = external_exports.array(zHandledByEntry).max(HANDLED_BY_MAX).superRefine((list2, ctx) => {
+      const seen = /* @__PURE__ */ new Set();
+      for (const e of list2) {
+        if (seen.has(e.deviceId)) {
+          ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: `deviceId duplikat: ${e.deviceId}` });
+          return;
+        }
+        seen.add(e.deviceId);
+      }
+    });
+    zHandledByView = zHandledByEntry.extend({ revoked: external_exports.boolean().default(false) });
+  }
+});
+
 // ../shared/src/prd-status.ts
 function prdBranchFor(prdPath) {
   if (!prdPath.startsWith(PRD_DIR) || !prdPath.endsWith(".md")) return null;
@@ -5476,7 +5774,7 @@ var init_cron_expr = __esm({
 function flowForSource(source) {
   return source === "qa" ? "qa" : source === "audit" ? "audit" : source === "goal" ? "goal" : source === "no_effort" ? "no_effort" : "feature";
 }
-var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zMarkSpecDone, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, isGoalShapedFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zSetup, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zSpecAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus, zCronExpr, zCreateCron, zPatchCron, zSchedulerCron, zSchedulerCronRun;
+var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zMarkSpecDone, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, isGoalShapedFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zSetup, zSetupApply, zChangePassword, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, PROVISION_PROFILES, COMPONENT_IDS, zProvision, UPDATE_RESTART_EXIT, CONFIG_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zSpecAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus, zCronExpr, zCreateCron, zPatchCron, zSchedulerCron, zSchedulerCronRun;
 var init_dto = __esm({
   "../shared/src/dto.ts"() {
     "use strict";
@@ -5484,6 +5782,7 @@ var init_dto = __esm({
     init_entities();
     init_lead();
     init_auto_merge();
+    init_handled_by();
     init_prd_status();
     init_enums();
     init_spec_source();
@@ -5530,6 +5829,8 @@ var init_dto = __esm({
       kind: zProjectKind,
       repoDir: external_exports.string().optional(),
       gitRemote: external_exports.string().optional(),
+      // SPEC-880 · ADR-0135 · penanda "ditangani oleh" boleh di-set sejak awal (disync).
+      handledBy: zHandledBy.optional(),
       desc: external_exports.string().default("")
     });
     zProjectId = external_exports.string().regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "slug tak sah");
@@ -5539,6 +5840,10 @@ var init_dto = __esm({
       desc: external_exports.string().optional(),
       gitRemote: external_exports.string().optional(),
       // SPEC-213 · set git remote resmi project
+      // SPEC-880 · ADR-0135 · daftar hanoman client pemegang project (DISYNC — beda dari repoDir &
+      // opt-in di bawah yang lokal per-instance). `null` maupun `[]` = kosongkan. Digerbangi
+      // `checkHandledBy`: deviceId wajib dikenal HANYA bila instance ini punya katalog device.
+      handledBy: zHandledBy.nullable().optional(),
       repoDir: external_exports.string().nullable().optional(),
       // SPEC-217 · path default/server editable (null = kosongkan)
       schedulerOptIn: external_exports.boolean().optional(),
@@ -5614,6 +5919,10 @@ var init_dto = __esm({
       // SPEC-294 · opt-in scheduler otonom
       leadOptIn: external_exports.boolean().default(false),
       // SPEC-409 · ADR-0091 · opt-in hanoman-lead
+      // SPEC-880 · ADR-0135 · penanda "ditangani oleh" yang SUDAH diperkaya: `name` = nama hidup bila
+      // baris DeviceToken-nya ada di instance ini, else snapshot tersimpan; `revoked` diturunkan.
+      // `[]` = belum ditetapkan — kolom NULL tak pernah bocor ke UI sebagai bentuk kedua "kosong".
+      handledBy: zHandledByView.array().default([]),
       autoMerge: zAutoMerge.nullable().default(null)
     });
     zSchedulerQueueItem = external_exports.object({
@@ -5917,6 +6226,11 @@ var init_dto = __esm({
     zLogin = external_exports.object({ email: external_exports.string().email(), password: external_exports.string().min(1) });
     zSignup = external_exports.object({ email: external_exports.string().email(), password: external_exports.string().min(8) });
     zSetup = zSignup.extend({ setupToken: external_exports.string().min(1) });
+    zSetupApply = external_exports.object({
+      deployment: external_exports.enum(["local", "public"]),
+      hardening: external_exports.boolean(),
+      acknowledgedUnhardened: external_exports.boolean().optional()
+    });
     zChangePassword = external_exports.object({
       currentPassword: external_exports.string().min(1),
       newPassword: external_exports.string().min(8)
@@ -5944,7 +6258,27 @@ var init_dto = __esm({
     });
     zAttest = external_exports.object({ note: external_exports.string().max(500).optional() });
     zRemediate = external_exports.object({ items: external_exports.array(external_exports.string()).min(1).max(64) });
+    PROVISION_PROFILES = ["lab", "production"];
+    COMPONENT_IDS = [
+      "base",
+      "node",
+      "hanoman",
+      "caddy",
+      "podman",
+      "agent-image",
+      "claude",
+      "codex",
+      "gh"
+    ];
+    zProvision = external_exports.object({
+      items: external_exports.array(external_exports.enum(COMPONENT_IDS)).min(1).max(16),
+      profile: external_exports.enum(PROVISION_PROFILES),
+      domain: external_exports.string().min(1).regex(HOST_RE).optional(),
+      confirm: external_exports.boolean().optional(),
+      force: external_exports.boolean().optional()
+    });
     UPDATE_RESTART_EXIT = 75;
+    CONFIG_RESTART_EXIT = 76;
     zUpdateApplyBody = external_exports.object({ confirm: external_exports.boolean().optional() });
     zTicketView = external_exports.object({
       id: external_exports.string(),
@@ -6160,6 +6494,11 @@ var init_api = __esm({
       terminalSession: (id) => `${API}/terminal/sessions/${id}`,
       terminalSteer: (id) => `${API}/terminal/sessions/${id}/steer`,
       terminalInterrupt: (id) => `${API}/terminal/sessions/${id}/interrupt`,
+      // SPEC-899 · ADR-0142 · inbox keputusan. Di bawah prefix /terminal supaya ikut capability
+      // `sessions` yang sudah ada — GET menurunkan cabang bacanya, POST cabang tulisnya, tanpa satu
+      // baris pun perubahan di services/agent-capabilities.ts.
+      terminalDialog: (id) => `${API}/terminal/sessions/${id}/dialog`,
+      terminalDialogAnswer: (id) => `${API}/terminal/sessions/${id}/dialog/answer`,
       terminalPhases: (id) => `${API}/terminal/sessions/${id}/phases`,
       // SPEC-230 · review + integrate ber-skop sesi (sesi project-level PRD, tanpa Spec).
       sessionReview: (id) => `${API}/terminal/sessions/${id}/review`,
@@ -6191,6 +6530,11 @@ var init_api = __esm({
       vpsItemAttest: (id, itemId) => `${API}/vps/${id}/items/${itemId}/attest`,
       vpsRemediatePreview: (id) => `${API}/vps/${id}/remediate/preview`,
       vpsRemediate: (id) => `${API}/vps/${id}/remediate`,
+      // SPEC-883 · provisioning berbasis katalog
+      vpsComponents: () => `${API}/vps/components`,
+      vpsProbe: (id) => `${API}/vps/${id}/probe`,
+      vpsProvisionPreview: (id) => `${API}/vps/${id}/provision/preview`,
+      vpsProvision: (id) => `${API}/vps/${id}/provision`,
       // SPEC-169 · auth
       authStatus: `${API}/auth/status`,
       authSetup: `${API}/auth/setup`,
@@ -6199,6 +6543,9 @@ var init_api = __esm({
       authUsers: `${API}/auth/users`,
       authUser: (id) => `${API}/auth/users/${id}`,
       authChangePassword: `${API}/auth/change-password`,
+      // SPEC-884 · ADR-0139 · wizard setup awal
+      setupStatus: `${API}/setup/status`,
+      setupApply: `${API}/setup`,
       // SPEC-213 · device token + activity log
       deviceTokens: `${API}/device-tokens`,
       deviceToken: (id) => `${API}/device-tokens/${id}`,
@@ -6918,6 +7265,9 @@ var init_webhook = __esm({
           "gitRemote",
           "stack",
           "helpEnabled",
+          // SPEC-880 · ADR-0135 · penerima harus bisa tahu mesin mana yang memegang project ini
+          // tanpa mendiff dua amplop. Entrinya snapshot: [{deviceId,name}].
+          "handledBy",
           "schedulerOptIn",
           "leadOptIn",
           "autoMerge",
@@ -6928,7 +7278,7 @@ var init_webhook = __esm({
         cascade: ["spec", "ticket", "customAgent", "githubIssue"],
         events: {
           created: { type: "project.created", label: "Project ditambah", when: "Project baru terdaftar di workspace." },
-          updated: { type: "project.updated", label: "Project diubah", when: "Nama, deskripsi, stack, remote, atau opt-in scheduler/lead/Help Center berubah." },
+          updated: { type: "project.updated", label: "Project diubah", when: 'Nama, deskripsi, stack, remote, penanda "ditangani oleh", atau opt-in scheduler/lead/Help Center berubah.' },
           deleted: { type: "project.deleted", label: "Project dihapus", when: "Project dihapus. data.cascade menyebut jumlah anak yang ikut terhapus \u2014 anaknya sendiri TIDAK memancarkan deleted, sebab cascade dieksekusi SQLite, di luar jangkauan tap." }
         },
         sample: {
@@ -6939,6 +7289,7 @@ var init_webhook = __esm({
           gitRemote: "git@github.com:nafanesia/hanoman.git",
           stack: "ts",
           helpEnabled: false,
+          handledBy: [{ deviceId: "clq0device1", name: "hm-dena" }],
           schedulerOptIn: true,
           leadOptIn: false,
           autoMerge: null,
@@ -7912,6 +8263,27 @@ var init_terminal_io = __esm({
   }
 });
 
+// ../shared/src/session-dialog.ts
+var zSessionDialogAnswer;
+var init_session_dialog = __esm({
+  "../shared/src/session-dialog.ts"() {
+    "use strict";
+    init_zod();
+    zSessionDialogAnswer = external_exports.object({
+      screenHash: external_exports.string().min(1),
+      choice: external_exports.number().int().positive().optional(),
+      choices: external_exports.array(external_exports.number().int().positive()).max(32).optional(),
+      text: external_exports.string().trim().min(1).max(16e3).optional()
+    }).refine(
+      (v) => !(v.choice !== void 0 && v.choices !== void 0),
+      { message: "choice dan choices tak boleh dikirim bersamaan" }
+    ).refine(
+      (v) => v.choice !== void 0 || v.choices !== void 0 || v.text !== void 0,
+      { message: "jawaban kosong" }
+    );
+  }
+});
+
 // ../shared/src/index.ts
 var init_src = __esm({
   "../shared/src/index.ts"() {
@@ -7924,6 +8296,7 @@ var init_src = __esm({
     init_entities();
     init_agent();
     init_custom_agent();
+    init_builtin_agents();
     init_agent_catalog();
     init_github();
     init_lead();
@@ -7943,10 +8316,12 @@ var init_src = __esm({
     init_webhook();
     init_mcp();
     init_auto_merge();
+    init_handled_by();
     init_changelog();
     init_cron_expr();
     init_terminal_workspace();
     init_terminal_io();
+    init_session_dialog();
   }
 });
 
@@ -8618,7 +8993,7 @@ var init_settings = __esm({
         const f = `'${decisionFile.split("'").join("'\\''")}'`;
         hooks2.Notification = [{ hooks: [{
           type: "command",
-          command: `grep -qiE 'idle|permission|waiting for|needs.?input' && echo waiting >> ${f} || true`
+          command: `grep -qiE 'idle|permission|waiting for|needs.?input' && { [ -s ${f} ] || date +%s > ${f}; } || true`
         }] }];
         hooks2.UserPromptSubmit = [{ hooks: [{ type: "command", command: `: > ${f}` }] }];
       }
@@ -8691,7 +9066,7 @@ function codexHookArgs(o) {
   const stop = [];
   const submit = [];
   if (o.decisionFile) {
-    stop.push(`echo waiting >> ${shq(o.decisionFile)}`);
+    stop.push(`[ -s ${shq(o.decisionFile)} ] || date +%s > ${shq(o.decisionFile)}`);
     submit.push(`: > ${shq(o.decisionFile)}`);
   }
   if (o.goalGate) stop.push(`sh ${shq(o.goalGate)}`);
@@ -8852,6 +9227,24 @@ function agentRosterBlock(defs) {
   }
   return lines2.join("\n");
 }
+function agentDelegationClause(defs) {
+  if (defs.length === 0) return "";
+  return [
+    "",
+    "## Subagent yang tersedia",
+    "",
+    "Sesi ini punya subagent berikut. Delegasikan saat tugasnya cocok \u2014 konteks mereka TERPISAH",
+    "dari milikmu, jadi menyerahkan penyapuan & verifikasi ke mereka MENGHEMAT konteksmu sendiri,",
+    "bukan memboroskannya.",
+    "",
+    ...defs.map((d) => `- **${d.name}** \u2014 ${d.description}`),
+    "",
+    `Panggil lewat tool ${MENTION_TOOL} dengan nama agennya. Mereka tak bisa mendelegasikan lagi,`,
+    "jadi tak ada rantai panggilan yang perlu kamu jaga. Laporan mereka adalah MASUKAN \u2014 kamu yang",
+    "memutuskan, dan kamu yang bertanggung jawab atas hasilnya.",
+    ""
+  ].join("\n");
+}
 var liveMentions;
 var init_custom_agents = __esm({
   "../runner/src/custom-agents.ts"() {
@@ -9228,6 +9621,164 @@ var init_spawn_helper = __esm({
   }
 });
 
+// ../runner/src/config-env.ts
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { join as join4 } from "node:path";
+function configEnvPath(home3) {
+  return join4(home3, CONFIG_ENV_FILE);
+}
+function parseConfigEnv(text) {
+  const out4 = {};
+  for (const raw2 of text.split("\n")) {
+    const line = raw2.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    out4[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();
+  }
+  return out4;
+}
+function formatConfigEnv(values) {
+  const lines2 = Object.entries(values).filter(([, v]) => v.trim() !== "").map(([k, v]) => `${k}=${v.trim()}`);
+  return lines2.length ? `${lines2.join("\n")}
+` : "";
+}
+function readConfigEnv(home3) {
+  try {
+    return parseConfigEnv(readFileSync3(configEnvPath(home3), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeConfigEnv(home3, values) {
+  mkdirSync2(home3, { recursive: true, mode: 448 });
+  const path2 = configEnvPath(home3);
+  writeFileSync(path2, formatConfigEnv(values), { mode: 384 });
+  chmodSync2(path2, 384);
+}
+var CONFIG_ENV_FILE;
+var init_config_env = __esm({
+  "../runner/src/config-env.ts"() {
+    "use strict";
+    CONFIG_ENV_FILE = "config.env";
+  }
+});
+
+// ../runner/src/runtime-profile.ts
+function resolveHardening(env) {
+  if (env.HANOMAN_HARDENING === "1") return true;
+  return env.HANOMAN_SESSION_SANDBOX === "podman" || filled(env.HANOMAN_PUBLIC_ORIGINS) || filled(env.HANOMAN_TRUST_PROXY);
+}
+function resolveDeployment(env) {
+  if (resolveHardening(env)) return "public";
+  return env.HANOMAN_DEPLOYMENT === "public" ? "public" : "local";
+}
+var filled;
+var init_runtime_profile = __esm({
+  "../runner/src/runtime-profile.ts"() {
+    "use strict";
+    filled = (v) => !!v && v.trim() !== "";
+  }
+});
+
+// ../runner/src/sandbox-probe.ts
+import { execFileSync } from "node:child_process";
+import { accessSync, constants } from "node:fs";
+import { isAbsolute as isAbsolute3 } from "node:path";
+function trustProxyOk(raw2) {
+  const v = raw2?.trim();
+  if (!v) return false;
+  if (/^[1-9]\d*$/.test(v)) return true;
+  const values = v.split(",").map((s2) => s2.trim()).filter(Boolean);
+  if (!values.length) return false;
+  return !values.some((s2) => s2 === "true" || !s2.includes("/") && s2 !== "loopback");
+}
+function prerequisites(env, facts) {
+  const network = env.HANOMAN_SESSION_NETWORK ?? "hanoman-egress";
+  const credentialDir = env.HANOMAN_AGENT_CREDENTIAL_DIR;
+  const scanner = env.HANOMAN_UPLOAD_SCANNER?.trim();
+  return [
+    {
+      id: "podman",
+      label: "Podman rootless",
+      ok: !!facts.podman && facts.rootless,
+      detail: facts.podman ? facts.rootless ? facts.podman : `${facts.podman} \u2014 berjalan rootful, butuh rootless` : "podman tak ada"
+    },
+    {
+      id: "network",
+      label: `Network "${network}"`,
+      ok: facts.networkExists,
+      detail: facts.networkExists ? network : `network ${network} belum dibuat`
+    },
+    {
+      id: "egress-proxy",
+      label: "Egress proxy",
+      ok: filled2(env.HANOMAN_EGRESS_PROXY),
+      detail: env.HANOMAN_EGRESS_PROXY ?? "HANOMAN_EGRESS_PROXY belum disetel"
+    },
+    {
+      id: "credential-dir",
+      label: "Dir credential agen",
+      ok: filled2(credentialDir) && facts.credentialDirReadable,
+      detail: !filled2(credentialDir) ? "HANOMAN_AGENT_CREDENTIAL_DIR belum disetel" : facts.credentialDirReadable ? credentialDir : `${credentialDir} \u2014 tak terbaca`
+    },
+    {
+      id: "control-origin",
+      label: "Control origin",
+      ok: filled2(env.HANOMAN_CONTROL_ORIGINS),
+      detail: env.HANOMAN_CONTROL_ORIGINS ?? "HANOMAN_CONTROL_ORIGINS belum disetel"
+    },
+    {
+      id: "trust-proxy",
+      label: "Trusted proxy hop/CIDR",
+      ok: trustProxyOk(env.HANOMAN_TRUST_PROXY),
+      detail: filled2(env.HANOMAN_TRUST_PROXY) ? trustProxyOk(env.HANOMAN_TRUST_PROXY) ? env.HANOMAN_TRUST_PROXY : "harus hop atau CIDR eksplisit" : "HANOMAN_TRUST_PROXY belum disetel"
+    },
+    {
+      id: "upload-scanner",
+      label: "Scanner upload",
+      ok: !!scanner && isAbsolute3(scanner),
+      detail: !scanner ? "HANOMAN_UPLOAD_SCANNER belum disetel" : isAbsolute3(scanner) ? scanner : `${scanner} \u2014 path harus absolut`
+    }
+  ];
+}
+function allReady(rows) {
+  return rows.every((r) => r.ok);
+}
+function run(file, args) {
+  try {
+    return execFileSync(file, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return null;
+  }
+}
+function collectProbeFacts(env) {
+  const podman = run("podman", ["--version"]);
+  const network = env.HANOMAN_SESSION_NETWORK ?? "hanoman-egress";
+  const dir2 = env.HANOMAN_AGENT_CREDENTIAL_DIR;
+  let credentialDirReadable = false;
+  if (dir2) {
+    try {
+      accessSync(dir2, constants.R_OK);
+      credentialDirReadable = true;
+    } catch {
+    }
+  }
+  return {
+    podman,
+    rootless: podman ? run("podman", ["info", "--format", "{{.Host.Security.Rootless}}"]) === "true" : false,
+    networkExists: podman ? run("podman", ["network", "exists", network]) !== null : false,
+    credentialDirReadable
+  };
+}
+var filled2;
+var init_sandbox_probe = __esm({
+  "../runner/src/sandbox-probe.ts"() {
+    "use strict";
+    filled2 = (v) => !!v && v.trim() !== "";
+  }
+});
+
 // ../runner/src/index.ts
 var init_src2 = __esm({
   "../runner/src/index.ts"() {
@@ -9248,6 +9799,9 @@ var init_src2 = __esm({
     init_skills();
     init_telegram_operator();
     init_spawn_helper();
+    init_config_env();
+    init_runtime_profile();
+    init_sandbox_probe();
   }
 });
 
@@ -9382,7 +9936,7 @@ var init_tap = __esm({
 });
 
 // src/db.ts
-import { mkdirSync as mkdirSync2 } from "node:fs";
+import { mkdirSync as mkdirSync3 } from "node:fs";
 import { dirname as dirname5, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { PrismaClient } from "@prisma/client";
@@ -9399,7 +9953,7 @@ var init_db = __esm({
     if (notice) console.warn(notice);
     url = resolveDbUrl(process.env, schemaDir);
     process.env.DATABASE_URL = url;
-    mkdirSync2(dirname5(dbFilePath(url)), { recursive: true, mode: 448 });
+    mkdirSync3(dirname5(dbFilePath(url)), { recursive: true, mode: 448 });
     base = new PrismaClient();
     void base.$queryRawUnsafe("PRAGMA journal_mode=WAL").catch((e) => console.warn("tak bisa menyetel journal_mode=WAL:", e));
     prisma = base.$extends(webhookTap(base));
@@ -9416,12 +9970,12 @@ var init_stage_machine = __esm({
 });
 
 // src/services/session-phases.ts
-import { readFileSync as readFileSync3, readdirSync as readdirSync3 } from "node:fs";
+import { readFileSync as readFileSync4, readdirSync as readdirSync3 } from "node:fs";
 function recorded(file) {
   const out4 = /* @__PURE__ */ new Map();
   let raw2;
   try {
-    raw2 = readFileSync3(file, "utf8");
+    raw2 = readFileSync4(file, "utf8");
   } catch {
     return out4;
   }
@@ -9471,7 +10025,7 @@ function planComplete(worktree, specId) {
     for (const n2 of names) {
       if (!re.test(n2.toLowerCase())) continue;
       try {
-        if (/^[ \t]*- \[ \]/m.test(readFileSync3(`${dir2}/${n2}`, "utf8"))) return false;
+        if (/^[ \t]*- \[ \]/m.test(readFileSync4(`${dir2}/${n2}`, "utf8"))) return false;
       } catch {
       }
     }
@@ -9525,9 +10079,9 @@ var init_session_id = __esm({
 });
 
 // src/services/secret-box.ts
-import { chmodSync as chmodSync2, existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-import { dirname as dirname6, join as join4 } from "node:path";
+import { dirname as dirname6, join as join5 } from "node:path";
 function isEncrypted(value) {
   return value.startsWith(ENC_PREFIX);
 }
@@ -9559,7 +10113,7 @@ function fromEnv(raw2) {
   return null;
 }
 function secretKeyPath() {
-  return join4(resolveHome(), "secret.key");
+  return join5(resolveHome(), "secret.key");
 }
 function secretKey() {
   if (cached) return cached;
@@ -9572,15 +10126,15 @@ function secretKey() {
   }
   const path2 = secretKeyPath();
   if (existsSync5(path2)) {
-    const key2 = Buffer.from(readFileSync4(path2, "utf8").trim(), "base64url");
+    const key2 = Buffer.from(readFileSync5(path2, "utf8").trim(), "base64url");
     if (key2.length !== KEY_BYTES) throw new Error(`kunci di ${path2} rusak \u2014 panjangnya bukan 32 byte`);
     cached = key2;
     return key2;
   }
   const key = randomBytes(KEY_BYTES);
-  mkdirSync3(dirname6(path2), { recursive: true });
-  writeFileSync(path2, key.toString("base64url"), { mode: 384 });
-  chmodSync2(path2, 384);
+  mkdirSync4(dirname6(path2), { recursive: true });
+  writeFileSync2(path2, key.toString("base64url"), { mode: 384 });
+  chmodSync3(path2, 384);
   cached = key;
   return key;
 }
@@ -9771,6 +10325,7 @@ var init_ssrf = __esm({
 import { lookup as dnsLookup2 } from "node:dns/promises";
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
+import { createGunzip } from "node:zlib";
 async function pinnedRequest(input) {
   return new Promise((resolve21, reject2) => {
     const transport = input.url.protocol === "https:" ? httpsRequest : httpRequest;
@@ -9790,21 +10345,43 @@ async function pinnedRequest(input) {
       lookup: (_host, opts, callback) => opts.all ? callback(null, [{ address: input.address, family: input.family }]) : callback(null, input.address, input.family),
       timeout: input.connectMs
     }, (response) => {
+      const dimampat = input.acceptEncoding === "gzip" && String(response.headers["content-encoding"] ?? "").toLowerCase() === "gzip";
+      const capTerurai = input.maxDecodedBytes ?? input.maxResponseBytes;
       const chunks = [];
-      let bytes = 0;
+      let kabel = 0, terurai = 0;
+      const selesai = () => resolve21({
+        status: response.statusCode ?? 0,
+        headers: response.headers,
+        body: Buffer.concat(chunks)
+      });
+      const sink2 = dimampat ? createGunzip() : null;
+      if (sink2) {
+        sink2.on("data", (chunk) => {
+          terurai += chunk.length;
+          if (terurai > capTerurai) {
+            sink2.destroy(new Error("outbound response terurai terlalu besar"));
+            response.destroy();
+            return;
+          }
+          chunks.push(chunk);
+        });
+        sink2.on("end", selesai);
+        sink2.on("error", reject2);
+      }
       response.on("data", (chunk) => {
-        bytes += chunk.length;
-        if (bytes > input.maxResponseBytes) {
+        kabel += chunk.length;
+        if (kabel > input.maxResponseBytes) {
           response.destroy(new Error("outbound response terlalu besar"));
           return;
         }
-        chunks.push(chunk);
+        if (sink2) sink2.write(chunk);
+        else chunks.push(chunk);
       });
-      response.on("end", () => resolve21({
-        status: response.statusCode ?? 0,
-        headers: response.headers,
-        body: Buffer.concat(chunks)
-      }));
+      response.on("end", () => {
+        if (sink2) sink2.end();
+        else selesai();
+      });
+      response.on("error", reject2);
     });
     const timer9 = setTimeout(() => req.destroy(Object.assign(new Error("outbound timeout"), { name: "AbortError" })), input.totalMs);
     timer9.unref?.();
@@ -9838,7 +10415,7 @@ var init_safe_outbound_request = __esm({
 // src/services/uploads.ts
 import { randomUUID } from "node:crypto";
 import { mkdir, writeFile, readFile as readFile2, unlink, rm } from "node:fs/promises";
-import { join as join5, resolve as resolve8 } from "node:path";
+import { join as join6, resolve as resolve8 } from "node:path";
 function extFor(mimeType) {
   return EXT[mimeType] ?? ".bin";
 }
@@ -9847,12 +10424,12 @@ function uploadDir() {
 }
 function sessionUploadDir(sessionId2) {
   if (!SESSION_ID.test(sessionId2)) throw new Error(`sessionId tak sah: ${sessionId2}`);
-  return join5(uploadDir(), "terminal", sessionId2);
+  return join6(uploadDir(), "terminal", sessionId2);
 }
 async function saveSessionUpload(sessionId2, buf, mimeType) {
   const dir2 = sessionUploadDir(sessionId2);
   await mkdir(dir2, { recursive: true, mode: 448 });
-  const path2 = join5(dir2, `${randomUUID()}${extFor(mimeType)}`);
+  const path2 = join6(dir2, `${randomUUID()}${extFor(mimeType)}`);
   await writeFile(path2, buf, { mode: 384 });
   return { path: path2, size: buf.length };
 }
@@ -9868,11 +10445,11 @@ async function dropSessionUploads(sessionId2) {
 }
 async function readUpload(storageKey) {
   const safe = storageKey.replace(/[/\\]/g, "");
-  return readFile2(join5(uploadDir(), safe));
+  return readFile2(join6(uploadDir(), safe));
 }
 async function readUploadOrFetch(storageKey) {
   const safe = storageKey.replace(/[/\\]/g, "");
-  const target2 = join5(uploadDir(), safe);
+  const target2 = join6(uploadDir(), safe);
   try {
     return await readFile2(target2);
   } catch {
@@ -9899,7 +10476,7 @@ async function readUploadOrFetch(storageKey) {
 }
 async function deleteUpload(storageKey) {
   const safe = storageKey.replace(/[/\\]/g, "");
-  await unlink(join5(uploadDir(), safe)).catch(() => {
+  await unlink(join6(uploadDir(), safe)).catch(() => {
   });
 }
 var EXT, SESSION_ID;
@@ -9935,16 +10512,16 @@ function readChoiceDialog(paneText2) {
     if (m) found.push({ n: Number(m[1]), label: cleanLabel(m[2] ?? "") });
   }
   if (found.length < 2) return null;
-  const run2 = [];
+  const run3 = [];
   let expected = found[found.length - 1].n;
   for (let i = found.length - 1; i >= 0 && expected >= 1; i--) {
     const row = found[i];
     if (row.n !== expected) break;
-    run2.unshift(row);
+    run3.unshift(row);
     expected -= 1;
   }
-  if (run2.length < 2 || run2[0].n !== 1) return null;
-  const rows = run2.map((r) => {
+  if (run3.length < 2 || run3[0].n !== 1) return null;
+  const rows = run3.map((r) => {
     const m = CHECK.exec(r.label);
     const label = m ? (m[2] ?? "").trim() : r.label;
     return {
@@ -10152,7 +10729,7 @@ var init_tui_dialog = __esm({
 
 // src/services/session-sandbox.ts
 function assertRuntimeBoundary(env, runtime) {
-  if (env.NODE_ENV !== "production") return;
+  if (!resolveHardening(env)) return;
   if (runtime.uid === 0) throw new Error("production Hanoman harus berjalan sebagai user non-root");
   if (env.HANOMAN_SESSION_SANDBOX !== "podman")
     throw new Error("HANOMAN_SESSION_SANDBOX=podman wajib di production");
@@ -10207,7 +10784,7 @@ function sandboxArgv(input) {
 }
 function sandboxArgvFromEnv(input) {
   const env = input.env ?? process.env;
-  const mode = env.HANOMAN_SESSION_SANDBOX ?? (env.NODE_ENV === "production" ? "required" : "off");
+  const mode = env.HANOMAN_SESSION_SANDBOX ?? (resolveHardening(env) ? "required" : "off");
   if (mode === "off") return null;
   if (mode !== "podman") throw new Error("session sandbox production tidak dikonfigurasi");
   const credentialDir = env.HANOMAN_AGENT_CREDENTIAL_DIR;
@@ -10230,27 +10807,28 @@ var quote;
 var init_session_sandbox = __esm({
   "src/services/session-sandbox.ts"() {
     "use strict";
+    init_src2();
     quote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
   }
 });
 
 // src/services/pty.ts
 import { spawn } from "node-pty";
-import { execFileSync } from "node:child_process";
+import { execFile, execFileSync as execFileSync2 } from "node:child_process";
 import { createRequire } from "node:module";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { mkdirSync as mkdirSync4, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, statSync as statSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname7 } from "node:path";
 import { tmpdir } from "node:os";
 function noTtyPromptEnv() {
   const path2 = askpassDenyPath();
-  mkdirSync4(dirname7(path2), { recursive: true, mode: 448 });
-  writeFileSync2(path2, ASKPASS_DENY, { mode: 448 });
+  mkdirSync5(dirname7(path2), { recursive: true, mode: 448 });
+  writeFileSync3(path2, ASKPASS_DENY, { mode: 448 });
   return { SSH_ASKPASS: path2, SSH_ASKPASS_REQUIRE: "force", GIT_TERMINAL_PROMPT: "0" };
 }
 function tmux(...args) {
   try {
-    return execFileSync("tmux", ["-L", socket(), "-f", "/dev/null", ...args], {
+    return execFileSync2("tmux", ["-L", socket(), "-f", "/dev/null", ...args], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -10263,6 +10841,28 @@ function tmux(...args) {
     throw new TmuxError(`tmux ${args[0]} gagal: ${detail}`, NO_SERVER.test(detail));
   }
 }
+function tmuxAsync(...args) {
+  return new Promise((resolve21, reject2) => {
+    execFile(
+      "tmux",
+      ["-L", socket(), "-f", "/dev/null", ...args],
+      { encoding: "utf8" },
+      (e, stdout, stderr) => {
+        if (!e) {
+          resolve21(stdout);
+          return;
+        }
+        const err = e;
+        if (err.code === "ENOENT") {
+          reject2(new TmuxError("tmux tidak ada di PATH \u2014 sesi terminal hanoman hidup di dalam tmux (ADR-0016). Pasang: brew install tmux", false));
+          return;
+        }
+        const detail = (stderr || err.message).trim();
+        reject2(new TmuxError(`tmux ${args[0]} gagal: ${detail}`, NO_SERVER.test(detail)));
+      }
+    );
+  });
+}
 function listPanes() {
   let out4;
   try {
@@ -10271,6 +10871,19 @@ function listPanes() {
     if (e instanceof TmuxError && e.noServer) return [];
     throw e;
   }
+  return parsePanes(out4);
+}
+async function listPanesAsync() {
+  let out4;
+  try {
+    out4 = await tmuxAsync("list-panes", "-a", "-F", FMT);
+  } catch (e) {
+    if (e instanceof TmuxError && e.noServer) return [];
+    throw e;
+  }
+  return parsePanes(out4);
+}
+function parsePanes(out4) {
   return out4.split("\n").filter(Boolean).flatMap((line) => {
     const [
       n2,
@@ -10338,13 +10951,13 @@ function createSession(projectId, cwd, opts = {}) {
   if (existing) killSession(id);
   const agentForDefs = opts.agent ?? "claude";
   const customDefs = opts.command ? [] : customAgentsFor(projectId, agentForDefs);
-  const rosterBlock = agentForDefs === "codex" ? agentRosterBlock(customDefs) : "";
+  const rosterBlock = agentForDefs === "codex" ? agentRosterBlock(customDefs) : agentDelegationClause(customDefs);
   let promptArg = "";
   let promptFile;
   if (!opts.command && opts.prompt) {
     promptFile = promptFilePath(id);
-    mkdirSync4(dirname7(promptFile), { recursive: true, mode: 448 });
-    writeFileSync2(promptFile, opts.prompt + rosterBlock, { mode: 384 });
+    mkdirSync5(dirname7(promptFile), { recursive: true, mode: 448 });
+    writeFileSync3(promptFile, opts.prompt + rosterBlock, { mode: 384 });
     promptArg = `"$(cat ${sq(promptFile)})"`;
   }
   const agent = opts.agent ?? "claude";
@@ -10355,8 +10968,8 @@ function createSession(projectId, cwd, opts = {}) {
     let goalGate;
     if (agent === "codex" && opts.goal && opts.flow && opts.specId) {
       goalGate = goalGatePath(id);
-      mkdirSync4(dirname7(goalGate), { recursive: true, mode: 448 });
-      writeFileSync2(goalGate, codexGoalScript({
+      mkdirSync5(dirname7(goalGate), { recursive: true, mode: 448 });
+      writeFileSync3(goalGate, codexGoalScript({
         flow: opts.flow,
         specId: opts.specId,
         condition: opts.goal,
@@ -10371,8 +10984,8 @@ function createSession(projectId, cwd, opts = {}) {
       const json = renderAgentsJson(customDefs);
       if (json) {
         agentsFile = agentsFilePath(id);
-        mkdirSync4(dirname7(agentsFile), { recursive: true, mode: 448 });
-        writeFileSync2(agentsFile, json, { mode: 384 });
+        mkdirSync5(dirname7(agentsFile), { recursive: true, mode: 448 });
+        writeFileSync3(agentsFile, json, { mode: 384 });
       }
     }
     const flags = agentFlags({
@@ -10394,7 +11007,7 @@ function createSession(projectId, cwd, opts = {}) {
     for (const [k, v] of Object.entries(noTtyPromptEnv())) envPairs.push(`${k}=${sq(v)}`);
   }
   if (opts.phaseFile) {
-    mkdirSync4(dirname7(opts.phaseFile), { recursive: true });
+    mkdirSync5(dirname7(opts.phaseFile), { recursive: true });
     envPairs.push(`HANOMAN_PHASE_FILE=${sq(opts.phaseFile)}`);
   }
   if (opts.attachmentsDir) envPairs.push(`HANOMAN_ATTACHMENTS_DIR=${sq(opts.attachmentsDir)}`);
@@ -10407,7 +11020,7 @@ function createSession(projectId, cwd, opts = {}) {
     promptFile,
     attachmentsDir: opts.attachmentsDir
   });
-  if (opts.decisionFile) mkdirSync4(dirname7(opts.decisionFile), { recursive: true });
+  if (opts.decisionFile) mkdirSync5(dirname7(opts.decisionFile), { recursive: true });
   tmux(
     // tmux menyerahkan argumen perintah `new-session` ke `default-shell`, dan defaultnya adalah
     // shell login pemanggil di /etc/passwd. Saat hanoman jalan sebagai user service ber-shell
@@ -10510,7 +11123,7 @@ async function sendToPane(id, text, chunkMs = 50, choices = []) {
   const line = text.replace(/\s*\r?\n\s*/g, " ").trim();
   if (!line) return false;
   try {
-    const io = dialogIO(id);
+    const io = paneIO(id);
     const screen = readDialogScreen(io.capture());
     if (screen?.kind === "review") return await submitReview(io, screen.submitRow);
     if (screen?.kind === "question") {
@@ -10545,7 +11158,7 @@ async function submitPaneDialog(id) {
   const p = getSession(id);
   if (!p || p.exited) return false;
   try {
-    const io = dialogIO(id);
+    const io = paneIO(id);
     const screen = readDialogScreen(io.capture());
     if (screen?.kind !== "review") return false;
     return await submitReview(io, screen.submitRow);
@@ -10669,27 +11282,29 @@ function pollAlt(p, a) {
 function startPoll() {
   if (poll) return;
   poll = setInterval(() => {
-    let panes;
-    try {
-      panes = listPanes();
-    } catch {
-      return;
-    }
-    const live = new Map(panes.map((p) => [p.id, p]));
-    for (const id of [...attached.keys()]) {
-      const p = live.get(id);
-      if (!p) end(id, 0);
-      else if (p.exited) end(id, p.code);
-      else {
-        const a = attached.get(id);
-        pollPhases(p, a);
-        pollAlt(p, a);
+    if (polling) return;
+    polling = true;
+    const snapshot2 = [...attached.entries()];
+    listPanesAsync().then((panes) => {
+      const live = new Map(panes.map((p) => [p.id, p]));
+      for (const [id, a] of snapshot2) {
+        if (attached.get(id) !== a) continue;
+        const p = live.get(id);
+        if (!p) end(id, 0);
+        else if (p.exited) end(id, p.code);
+        else {
+          pollPhases(p, a);
+          pollAlt(p, a);
+        }
+      }
+    }, () => {
+    }).finally(() => {
+      polling = false;
+      if (attached.size === 0 && poll) {
+        clearInterval(poll);
+        poll = void 0;
       }
-    }
-    if (attached.size === 0 && poll) {
-      clearInterval(poll);
-      poll = void 0;
-    }
+    });
   }, POLL_MS);
   poll.unref();
 }
@@ -10760,7 +11375,7 @@ function spawnPty(...args) {
     );
   }
 }
-var socket, PREFIX, MAX_SCROLLBACK, SCROLLBACK_SLACK, POLL_MS, markerFilled, attached, claudeBin, shellBin, codexBin, agentBin, rootBypassEnv, frame, name, promptFilePath, goalGatePath, goalStatePath, agentsFilePath, askpassDenyPath, ASKPASS_DENY, NO_SERVER, TmuxError, sq, idFor, FMT, listSessions, liveDecisions, getSession, hooks, emitBirth, emitDeath, customAgentSource, customAgentsFor, sleep, paneText, dialogIO, DIALOG_CAPTURE_LINES, GOAL_ARMED_MARKERS, goalArmed, COALESCE_MS, COALESCE_MAX_BYTES, trimScrollback, phaseKey, paneComplete, sessionFinished, poll, TERMINAL_QUERY, stripTerminalQueries, detach;
+var socket, PREFIX, MAX_SCROLLBACK, SCROLLBACK_SLACK, POLL_MS, markerFilled, markerOnset, attached, claudeBin, shellBin, codexBin, agentBin, rootBypassEnv, frame, name, promptFilePath, goalGatePath, goalStatePath, agentsFilePath, askpassDenyPath, ASKPASS_DENY, NO_SERVER, TmuxError, sq, idFor, FMT, toSessionInfo, listSessions, listSessionsAsync, liveDecisions, getSession, hooks, emitBirth, emitDeath, customAgentSource, customAgentsFor, sleep, paneText, paneIO, DIALOG_CAPTURE_LINES, GOAL_ARMED_MARKERS, goalArmed, COALESCE_MS, COALESCE_MAX_BYTES, trimScrollback, phaseKey, paneComplete, sessionFinished, poll, polling, TERMINAL_QUERY, stripTerminalQueries, detach;
 var init_pty = __esm({
   "src/services/pty.ts"() {
     "use strict";
@@ -10784,6 +11399,17 @@ var init_pty = __esm({
         return false;
       }
     };
+    markerOnset = (f) => {
+      let raw2;
+      try {
+        raw2 = readFileSync6(f, "utf8");
+      } catch {
+        return void 0;
+      }
+      const secs = Number(raw2.trim());
+      if (!Number.isInteger(secs) || secs <= 0) return void 0;
+      return new Date(secs * 1e3).toISOString();
+    };
     attached = /* @__PURE__ */ new Map();
     claudeBin = () => effectiveStr("HANOMAN_CLAUDE_BIN") ?? "claude";
     shellBin = () => effectiveStr("HANOMAN_SHELL") ?? process.env.SHELL ?? "/bin/bash";
@@ -10825,7 +11451,19 @@ exit 1
       "#{@hanoman_agent}",
       "#{alternate_on}"
     ].join("	");
-    listSessions = () => listPanes().map(({ id, projectId, specId, flow, cwd, exited, code, branch, decision, agent }) => ({
+    toSessionInfo = ({
+      id,
+      projectId,
+      specId,
+      flow,
+      cwd,
+      exited,
+      code,
+      branch,
+      decision,
+      agent,
+      decisionFile
+    }) => ({
       id,
       projectId,
       specId,
@@ -10837,8 +11475,11 @@ exit 1
       agent,
       // Hanya untuk pane mati: `pane_dead_status` kosong pada pane hidup, dan `exitCode: 0` di sana
       // akan terbaca sebagai "sudah berakhir sukses".
-      ...exited ? { exitCode: code } : {}
-    }));
+      ...exited ? { exitCode: code } : {},
+      ...decision && decisionFile ? { decisionAt: markerOnset(decisionFile) } : {}
+    });
+    listSessions = () => listPanes().map(toSessionInfo);
+    listSessionsAsync = async () => (await listPanesAsync()).map(toSessionInfo);
     liveDecisions = () => listPanes().filter((p) => !p.exited && p.decisionFile).map((p) => ({ id: p.id, specId: p.specId, projectId: p.projectId, decisionFile: p.decisionFile }));
     getSession = (id) => listPanes().find((p) => p.id === id);
     hooks = {};
@@ -10872,7 +11513,7 @@ exit 1
         return "";
       }
     };
-    dialogIO = (id) => ({
+    paneIO = (id) => ({
       capture: () => capturePane(id, DIALOG_CAPTURE_LINES),
       literal: (s2) => {
         tmux("send-keys", "-t", name(id), "-l", s2);
@@ -10905,6 +11546,7 @@ exit 1
       const p = getSession(id);
       return !!p && paneComplete(p);
     };
+    polling = false;
     TERMINAL_QUERY = new RegExp([
       "\\x1b\\[[?>=]?[0-9;]*c",
       // Device Attributes 1/2/3
@@ -11042,7 +11684,9 @@ var init_tombstone = __esm({
 // src/services/sync.ts
 var sync_exports = {};
 __export(sync_exports, {
+  BOOTSTRAP_ORDER: () => BOOTSTRAP_ORDER,
   PARENTS: () => PARENTS,
+  PULL_MAX_BYTES: () => PULL_MAX_BYTES,
   SYNCED: () => SYNCED,
   __DATE_FIELDS: () => __DATE_FIELDS,
   __FIELDS: () => __FIELDS,
@@ -11050,12 +11694,14 @@ __export(sync_exports, {
   __JSON_FIELDS: () => __JSON_FIELDS,
   applyPush: () => applyPush,
   backfillFeed: () => backfillFeed,
+  bootstrapSnapshot: () => bootstrapSnapshot,
   consumeTombstoneOnRecreate: () => consumeTombstoneOnRecreate,
   deleteRow: () => deleteRow,
   isEntity: () => isEntity,
   publishDelete: () => publishDelete,
   publishLocal: () => publishLocal,
   pull: () => pull,
+  recordBytes: () => recordBytes,
   setAcceptedHook: () => setAcceptedHook,
   snapshot: () => snapshot,
   upsertLocal: () => upsertLocal,
@@ -11182,24 +11828,77 @@ async function applyPush(entity, id, baseVersion, data, deviceId, op = "upsert")
   onAccepted?.({ entity, recordId: id, version: newVersion, op: "upsert", data: snap?.data ?? {}, seq: String(log2.seq) });
   return { ok: true, version: newVersion };
 }
-async function pull(sinceCursor, limit = 500) {
+function recordBytes(rec) {
+  return Buffer.byteLength(JSON.stringify(rec));
+}
+async function pull(sinceCursor, limit = 500, maxBytes = PULL_MAX_BYTES) {
   const since = Number(sinceCursor || "0");
   const rows = await prisma.syncLog.findMany({
     where: { seq: { gt: since } },
     orderBy: { seq: "asc" },
     take: limit
   });
-  const cursor = rows.length ? String(rows[rows.length - 1].seq) : sinceCursor || "0";
-  return {
-    cursor,
-    records: rows.map((r) => ({
+  const records = [];
+  let bytes = 0;
+  let trimmed = false;
+  for (const r of rows) {
+    const rec = {
       entity: r.entity,
       recordId: r.recordId,
       version: r.version,
       op: r.op === "delete" ? "delete" : "upsert",
       data: r.data
-    }))
-  };
+    };
+    const size = recordBytes(rec);
+    if (records.length && bytes + size > maxBytes) {
+      trimmed = true;
+      break;
+    }
+    bytes += size;
+    records.push(rec);
+  }
+  const cursor = records.length ? String(rows[records.length - 1].seq) : sinceCursor || "0";
+  return { cursor, records, hasMore: trimmed || rows.length === limit };
+}
+async function bootstrapSnapshot(after, maxBytes = PULL_MAX_BYTES) {
+  const tip = await prisma.syncLog.findFirst({ orderBy: { seq: "desc" }, select: { seq: true } });
+  const cursor = tip ? String(tip.seq) : "0";
+  const sep5 = after ? after.indexOf(":") : -1;
+  const afterEntity = sep5 > 0 ? after.slice(0, sep5) : null;
+  const afterId = sep5 > 0 ? after.slice(sep5 + 1) : null;
+  const startAt = afterEntity ? BOOTSTRAP_ORDER.indexOf(afterEntity) : 0;
+  if (startAt < 0) throw new Error("bootstrap cursor tak dikenal");
+  const records = [];
+  let bytes = 0;
+  let last = null;
+  for (let i = startAt; i < BOOTSTRAP_ORDER.length; i++) {
+    const entity = BOOTSTRAP_ORDER[i];
+    const gt = i === startAt && afterId ? afterId : null;
+    const rows = await DELEGATE[entity].findMany({
+      ...gt ? { where: { id: { gt } } } : {},
+      orderBy: { id: "asc" },
+      select: { id: true }
+    });
+    for (const row of rows) {
+      const snap = await snapshot(entity, row.id);
+      if (!snap) continue;
+      const rec = {
+        entity,
+        recordId: row.id,
+        version: snap.version,
+        op: "upsert",
+        data: snap.data
+      };
+      const size = recordBytes(rec);
+      if (records.length && bytes + size > maxBytes) {
+        return { cursor, records, hasMore: true, next: last };
+      }
+      bytes += size;
+      records.push(rec);
+      last = `${entity}:${row.id}`;
+    }
+  }
+  return { cursor, records, hasMore: false, next: null };
 }
 async function publishLocal(entity, id) {
   const snap = await snapshot(entity, id);
@@ -11291,7 +11990,7 @@ async function upsertLocal(entity, id, version2, data) {
 function setAcceptedHook(hook) {
   onAccepted = hook;
 }
-var SYNCED, DELEGATE, FIELDS, DATE_FIELDS, PARENTS, __FIELDS, __DATE_FIELDS, NUMBER_FIELDS, BOOLEAN_FIELDS, JSON_FIELDS, __JSON_FIELDS, onAccepted, __FIELDS_FOR_TEST;
+var SYNCED, DELEGATE, FIELDS, DATE_FIELDS, PARENTS, __FIELDS, __DATE_FIELDS, NUMBER_FIELDS, BOOLEAN_FIELDS, JSON_FIELDS, __JSON_FIELDS, PULL_MAX_BYTES, BOOTSTRAP_ORDER, onAccepted, __FIELDS_FOR_TEST;
 var init_sync = __esm({
   "src/services/sync.ts"() {
     "use strict";
@@ -11310,7 +12009,12 @@ var init_sync = __esm({
       githubIssue: prisma.githubIssue
     };
     FIELDS = {
-      project: ["name", "desc", "kind", "stack", "gitRemote", "updatedAt"],
+      // SPEC-880 · ADR-0135 · `handledBy` ikut menyeberang: "project ini dipegang mesin yang mana"
+      // adalah pernyataan bersama, bukan setelan mesin — dan justru menyeberangnya nilai itu yang
+      // jadi inti spec-nya. SENGAJA bukan cermin `repoDir`/`schedulerOptIn`/`autoMerge` yang LOCAL-only
+      // (mereka properti checkout mesin ini). Tiap entri membawa `name` karena `DeviceToken` TIDAK
+      // ikut SYNCED: penerima tak punya baris device untuk di-join. BUKAN DATE_FIELDS.
+      project: ["name", "desc", "kind", "stack", "gitRemote", "handledBy", "updatedAt"],
       // SPEC-408 · ADR-0090 · createdAt/startedAt ikut menyeberang — sejajar baseSha/headSha. Tanpa
       // ini spec asal-hub mendapat createdAt lokal palsu di tiap client (kolom NOT NULL ber-default).
       // SPEC-447 · ADR-0093 · dependsOn ikut juga: tanpa itu client tak tahu urutannya dan akan
@@ -11391,6 +12095,7 @@ var init_sync = __esm({
     ]);
     BOOLEAN_FIELDS = /* @__PURE__ */ new Set(["vps:hardened", "customAgent:enabled"]);
     JSON_FIELDS = /* @__PURE__ */ new Set([
+      "project:handledBy",
       "spec:payload",
       "spec:dependsOn",
       "spec:sourceHistory",
@@ -11402,6 +12107,17 @@ var init_sync = __esm({
       "githubIssue:labels"
     ]);
     __JSON_FIELDS = JSON_FIELDS;
+    PULL_MAX_BYTES = 1024 * 1024;
+    BOOTSTRAP_ORDER = [
+      "project",
+      "spec",
+      "ticket",
+      "customAgent",
+      "githubIssue",
+      "ticketAttachment",
+      "vps",
+      "sessionResult"
+    ];
     __FIELDS_FOR_TEST = FIELDS;
   }
 });
@@ -11484,15 +12200,17 @@ var init_settings2 = __esm({
       // SPEC-476 · ADR-0096 · gateway Telegram opt-in
       changelog: CHANGELOG_ENGINE_DEFAULTS,
       // SPEC-518 · agen pembuat changelog (opt-in, mati)
-      portalChat: PORTAL_CHAT_DEFAULTS
+      portalChat: PORTAL_CHAT_DEFAULTS,
       // SPEC-854 · ADR-0130 · chat portal klien (opt-in, mati)
+      builtinAgents: {}
+      // SPEC-881 · ADR-0136 · sidik jari seed (lokal, tak disync)
     };
     RETIRED_MODELS = { "claude-opus-4-8": "claude-opus-5" };
   }
 });
 
 // src/services/codex-trust.ts
-import { appendFileSync, mkdirSync as mkdirSync6, readFileSync as readFileSync6, realpathSync as realpathSync3 } from "node:fs";
+import { appendFileSync, mkdirSync as mkdirSync7, readFileSync as readFileSync8, realpathSync as realpathSync3 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 function ensureCodexTrust(repoDir, home3) {
   const path2 = codexConfigPath(home3);
@@ -11505,11 +12223,11 @@ function ensureCodexTrust(repoDir, home3) {
   try {
     let existing = "";
     try {
-      existing = readFileSync6(path2, "utf8");
+      existing = readFileSync8(path2, "utf8");
     } catch {
     }
     if (existing.includes(header2)) return;
-    mkdirSync6(codexHome(home3), { recursive: true });
+    mkdirSync7(codexHome(home3), { recursive: true });
     const lead = existing === "" || existing.endsWith("\n") ? "" : "\n";
     appendFileSync(path2, `${lead}
 ${header2}
@@ -12417,7 +13135,7 @@ var require_filesystem = __commonJS({
     var LDD_PATH = "/usr/bin/ldd";
     var SELF_PATH = "/proc/self/exe";
     var MAX_LENGTH = 2048;
-    var readFileSync14 = (path2) => {
+    var readFileSync17 = (path2) => {
       const fd = fs.openSync(path2, "r");
       const buffer2 = Buffer.alloc(MAX_LENGTH);
       const bytesRead = fs.readSync(fd, buffer2, 0, MAX_LENGTH, 0);
@@ -12442,7 +13160,7 @@ var require_filesystem = __commonJS({
     module.exports = {
       LDD_PATH,
       SELF_PATH,
-      readFileSync: readFileSync14,
+      readFileSync: readFileSync17,
       readFile: readFile6
     };
   }
@@ -12491,7 +13209,7 @@ var require_detect_libc = __commonJS({
     "use strict";
     var childProcess = __require("child_process");
     var { isLinux, getReport } = require_process();
-    var { LDD_PATH, SELF_PATH, readFile: readFile6, readFileSync: readFileSync14 } = require_filesystem();
+    var { LDD_PATH, SELF_PATH, readFile: readFile6, readFileSync: readFileSync17 } = require_filesystem();
     var { interpreterPath } = require_elf();
     var cachedFamilyInterpreter;
     var cachedFamilyFilesystem;
@@ -12583,7 +13301,7 @@ var require_detect_libc = __commonJS({
       }
       cachedFamilyFilesystem = null;
       try {
-        const lddContent = readFileSync14(LDD_PATH);
+        const lddContent = readFileSync17(LDD_PATH);
         cachedFamilyFilesystem = getFamilyFromLddContent(lddContent);
       } catch (e) {
       }
@@ -12608,7 +13326,7 @@ var require_detect_libc = __commonJS({
       }
       cachedFamilyInterpreter = null;
       try {
-        const selfContent = readFileSync14(SELF_PATH);
+        const selfContent = readFileSync17(SELF_PATH);
         const path2 = interpreterPath(selfContent);
         cachedFamilyInterpreter = familyFromInterpreterPath(path2);
       } catch (e) {
@@ -12672,7 +13390,7 @@ var require_detect_libc = __commonJS({
       }
       cachedVersionFilesystem = null;
       try {
-        const lddContent = readFileSync14(LDD_PATH);
+        const lddContent = readFileSync17(LDD_PATH);
         const versionMatch = lddContent.match(RE_GLIBC_VERSION);
         if (versionMatch) {
           cachedVersionFilesystem = versionMatch[1];
@@ -13590,10 +14308,10 @@ var require_truncate = __commonJS({
   "../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/truncate.js"(exports, module) {
     "use strict";
     var parse3 = require_parse();
-    var constants2 = require_constants();
+    var constants3 = require_constants();
     var SemVer = require_semver();
     var truncate = (version2, truncation, options2) => {
-      if (!constants2.RELEASE_TYPES.includes(truncation)) {
+      if (!constants3.RELEASE_TYPES.includes(truncation)) {
         return null;
       }
       const clonedVersion = cloneInputVersion(version2, options2);
@@ -14642,7 +15360,7 @@ var require_semver2 = __commonJS({
   "../node_modules/.pnpm/semver@7.8.5/node_modules/semver/index.js"(exports, module) {
     "use strict";
     var internalRe = require_re();
-    var constants2 = require_constants();
+    var constants3 = require_constants();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
     var parse3 = require_parse();
@@ -14726,8 +15444,8 @@ var require_semver2 = __commonJS({
       re: internalRe.re,
       src: internalRe.src,
       tokens: internalRe.t,
-      SEMVER_SPEC_VERSION: constants2.SEMVER_SPEC_VERSION,
-      RELEASE_TYPES: constants2.RELEASE_TYPES,
+      SEMVER_SPEC_VERSION: constants3.SEMVER_SPEC_VERSION,
+      RELEASE_TYPES: constants3.RELEASE_TYPES,
       compareIdentifiers: identifiers.compareIdentifiers,
       rcompareIdentifiers: identifiers.rcompareIdentifiers
     };
@@ -17487,7 +18205,7 @@ __export(bootstrap_exports, {
   reloadTelegramGateway: () => reloadTelegramGateway,
   telegramSessionDeps: () => telegramSessionDeps
 });
-import { mkdirSync as mkdirSync7 } from "node:fs";
+import { mkdirSync as mkdirSync8 } from "node:fs";
 function parseTelegramAllowedUserIds(raw2) {
   const ids = raw2.split(/[\s,]+/).filter(Boolean);
   if (!ids.length) throw new Error("Telegram allowlist wajib berisi numeric user id");
@@ -17512,7 +18230,7 @@ function telegramSessionDeps(input) {
     home: resolveHome(),
     apiBase: input.apiBase,
     agentToken: input.agentToken,
-    ensureDir: (path2) => mkdirSync7(path2, { recursive: true })
+    ensureDir: (path2) => mkdirSync8(path2, { recursive: true })
   };
 }
 async function productionFactory(input) {
@@ -19988,7 +20706,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes11, createHash: createHash10 } = __require("crypto");
+    var { randomBytes: randomBytes11, createHash: createHash12 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -20656,7 +21374,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket2, socket2, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash10("sha1").update(key + GUID).digest("base64");
+        const digest = createHash12("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket2, socket2, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -21025,7 +21743,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash10 } = __require("crypto");
+    var { createHash: createHash12 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -21332,7 +22050,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket2, 503);
-        const digest = createHash10("sha1").update(key + GUID).digest("base64");
+        const digest = createHash12("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -21524,9 +22242,50 @@ async function applyFeedFrame(msg) {
   if (msg.seq && !feedHole) await setCursor(String(msg.seq));
   return true;
 }
+async function retryDeferred(rest, stats2) {
+  while (rest.length) {
+    const still = [];
+    for (const rec of rest) {
+      try {
+        const r = await applyRemote(rec.entity, rec.recordId, rec.version, rec.data, rec.op ?? "upsert");
+        if (r === "dropped") stats2.dropped++;
+        else if (rec.op === "delete") stats2.deleted++;
+        else stats2.pulled++;
+      } catch {
+        still.push(rec);
+      }
+    }
+    if (still.length === rest.length) return still;
+    rest = still;
+  }
+  return [];
+}
+async function bootstrapOnce(transport) {
+  if (await getCursor() !== "0") return null;
+  if ((await listOutbox()).length) return null;
+  let after = null;
+  let cursor = "0";
+  let applied = 0;
+  for (let page = 0; page < MAX_DRAIN_PAGES; page++) {
+    const q = after ? `?after=${encodeURIComponent(after)}` : "";
+    const res = await transport("GET", `/api/sync/bootstrap${q}`);
+    if (res.status !== 200 || !Array.isArray(res.body?.records)) return null;
+    for (const raw2 of res.body.records) {
+      const rec = validateIncomingRecord(raw2);
+      if (!rec.op) continue;
+      await applyRemote(rec.entity, rec.recordId, rec.version, rec.data, rec.op);
+      applied++;
+    }
+    cursor = String(res.body.cursor ?? "0");
+    const next = res.body.next ? String(res.body.next) : null;
+    if (!res.body.hasMore || !next) break;
+    after = next;
+  }
+  await setCursor(cursor);
+  return applied;
+}
 async function syncOnce(transport) {
-  let pulled = 0, pushed = 0, conflicts = 0, deleted = 0, dropped = 0;
-  const cursor = await getCursor();
+  const stats2 = { pulled: 0, pushed: 0, conflicts: 0, deleted: 0, dropped: 0 };
   const outbox = await listOutbox();
   const pending2 = new Set(outbox.map((o) => `${o.entity}:${o.recordId}`));
   const conflicted = /* @__PURE__ */ new Set();
@@ -21535,64 +22294,53 @@ async function syncOnce(transport) {
     const key = `${entity}:${recordId}`;
     if (!conflicted.has(key)) {
       conflicted.add(key);
-      conflicts++;
+      stats2.conflicts++;
     }
   };
-  const pullRes = await transport("GET", `/api/sync/pull?since=${cursor}`);
-  const rawRecords = Array.isArray(pullRes.body?.records) ? pullRes.body.records : [];
-  const records = rawRecords.map(validateIncomingRecord);
-  const deferred = [];
-  for (const rec of records) {
-    if (!isEntity(rec.entity)) continue;
-    if (!rec.op) {
-      dropped++;
-      continue;
-    }
-    if (rec.op === "upsert" && pending2.has(`${rec.entity}:${rec.recordId}`)) {
-      const local = await snapshot(rec.entity, rec.recordId);
-      if (local && JSON.stringify(local.data) !== JSON.stringify(rec.data)) {
-        await markConflict(
-          rec.entity,
-          rec.recordId,
-          { version: local.version, data: local.data },
-          { version: rec.version, data: rec.data }
-        );
+  let deferred = [];
+  for (let page = 0; page < MAX_DRAIN_PAGES; page++) {
+    const cursor = await getCursor();
+    const pullRes = await transport("GET", `/api/sync/pull?since=${cursor}`);
+    const rawRecords = Array.isArray(pullRes.body?.records) ? pullRes.body.records : [];
+    const records = rawRecords.map(validateIncomingRecord);
+    for (const rec of records) {
+      if (!isEntity(rec.entity)) continue;
+      if (!rec.op) {
+        stats2.dropped++;
+        continue;
+      }
+      if (rec.op === "upsert" && pending2.has(`${rec.entity}:${rec.recordId}`)) {
+        const local = await snapshot(rec.entity, rec.recordId);
+        if (local && JSON.stringify(local.data) !== JSON.stringify(rec.data)) {
+          await markConflict(
+            rec.entity,
+            rec.recordId,
+            { version: local.version, data: local.data },
+            { version: rec.version, data: rec.data }
+          );
+        }
+        continue;
       }
-      continue;
-    }
-    try {
-      const r = await applyRemote(rec.entity, rec.recordId, rec.version, rec.data, rec.op);
-      if (r === "dropped") dropped++;
-      else if (rec.op === "delete") deleted++;
-      else pulled++;
-    } catch {
-      deferred.push(rec);
-    }
-  }
-  let rest = deferred;
-  while (rest.length) {
-    const still = [];
-    for (const rec of rest) {
       try {
-        const r = await applyRemote(rec.entity, rec.recordId, rec.version, rec.data, rec.op ?? "upsert");
-        if (r === "dropped") dropped++;
-        else if (rec.op === "delete") deleted++;
-        else pulled++;
+        const r = await applyRemote(rec.entity, rec.recordId, rec.version, rec.data, rec.op);
+        if (r === "dropped") stats2.dropped++;
+        else if (rec.op === "delete") stats2.deleted++;
+        else stats2.pulled++;
       } catch {
-        still.push(rec);
+        deferred.push(rec);
       }
     }
-    if (still.length === rest.length) {
-      for (const rec of still) {
-        console.warn(`sync: record ${rec.entity}:${rec.recordId} tak bisa diterapkan \u2014 dilewati`);
-        dropped++;
-      }
-      break;
-    }
-    rest = still;
+    deferred = await retryDeferred(deferred, stats2);
+    const next = pullRes.body?.cursor ? String(pullRes.body.cursor) : cursor;
+    if (next !== cursor) await setCursor(next);
+    feedHole = false;
+    const more = pullRes.body?.hasMore ?? records.length > 0;
+    if (!more || next === cursor) break;
+  }
+  for (const rec of deferred) {
+    console.warn(`sync: record ${rec.entity}:${rec.recordId} tak bisa diterapkan \u2014 dilewati`);
+    stats2.dropped++;
   }
-  if (pullRes.body?.cursor) await setCursor(String(pullRes.body.cursor));
-  feedHole = false;
   for (const item of outbox) {
     if (item.entity === "projectRename") {
       const [oldId, newId] = item.recordId.split(RENAME_SEP);
@@ -21607,9 +22355,9 @@ async function syncOnce(transport) {
       const r2 = res2.body?.results?.[0];
       if (r2?.ok) {
         await clearOutbox(item.entity, item.recordId);
-        pushed++;
+        stats2.pushed++;
       } else if (r2?.conflict) {
-        conflicts++;
+        stats2.conflicts++;
       }
       continue;
     }
@@ -21635,7 +22383,7 @@ async function syncOnce(transport) {
       });
       if (res2.body?.results?.[0]?.ok) {
         await clearOutbox(item.entity, item.recordId);
-        pushed++;
+        stats2.pushed++;
       }
       continue;
     }
@@ -21643,6 +22391,9 @@ async function syncOnce(transport) {
       records: [{ entity: item.entity, id: item.recordId, baseVersion: snap.version, data: snap.data }]
     });
     const r = res.body?.results?.[0];
+    if (!r) {
+      console.warn(`sync: push ${item.entity}:${item.recordId} tak dijawab hub (status ${res.status}) \u2014 tetap di outbox; periksa apakah hub lebih tua dari client ini`);
+    }
     if (r?.ok) {
       if (typeof r.version === "number") {
         const delegate = prisma[item.entity];
@@ -21650,7 +22401,7 @@ async function syncOnce(transport) {
         });
       }
       await clearOutbox(item.entity, item.recordId);
-      pushed++;
+      stats2.pushed++;
     } else if (r?.conflict) {
       if (r.deleted) {
         await applyRemote(
@@ -21661,7 +22412,7 @@ async function syncOnce(transport) {
           "delete"
         );
         await clearOutbox(item.entity, item.recordId);
-        deleted++;
+        stats2.deleted++;
         continue;
       }
       const server = r.server;
@@ -21678,7 +22429,7 @@ async function syncOnce(transport) {
       }
     }
   }
-  return { pulled, pushed, conflicts, deleted, dropped };
+  return stats2;
 }
 function fetchTransport(base2, token) {
   return async (method, path2, body) => {
@@ -21687,12 +22438,26 @@ function fetchTransport(base2, token) {
     const res = await safeRequest({
       url: url2,
       method,
-      headers: { authorization: `Bearer ${token}`, ...body ? { "content-type": "application/json" } : {} },
+      headers: {
+        authorization: `Bearer ${token}`,
+        // SPEC-885 · ADR-0138 · hub lama mengabaikan header ini dan membalas polos; `safeRequest`
+        // hanya men-decompress bila balasannya benar-benar ber-`content-encoding: gzip`.
+        "accept-encoding": "gzip",
+        ...body ? { "content-type": "application/json" } : {}
+      },
       ...body ? { body: Buffer.from(JSON.stringify(body)) } : {},
       allowPrivate: process.env.NODE_ENV !== "production" && loopback,
       connectMs: 5e3,
       totalMs: 15e3,
-      maxResponseBytes: 2 * 1024 * 1024
+      // SPEC-885 · ADR-0138 · cap ini dulu 2 MB, dan halaman feed 2,51 MB di hub produksi
+      // membuat setiap client baru MANDEK di situ selamanya — bukan lambat, mandek, dan tanpa
+      // satu baris log. Hub yang sudah membawa anggaran byte memotong halamannya di 1 MB, jadi
+      // cap ini tak akan tersentuh olehnya. Ia dinaikkan justru untuk hub yang BELUM naik versi,
+      // yang tetap mengirim 500 baris apa adanya — kombinasi yang dialami tiap
+      // `npm i -g hanoman` sebelum hub-nya diperbarui (urutan rilis hub-duluan, ADR-0135).
+      maxResponseBytes: 8 * 1024 * 1024,
+      acceptEncoding: "gzip",
+      maxDecodedBytes: 16 * 1024 * 1024
     });
     let parsed = null;
     try {
@@ -21707,22 +22472,11 @@ async function syncNow(opts) {
   const token = effectiveStr("SYNC_DEVICE_TOKEN");
   if (!base2 || !token) return null;
   const transport = fetchTransport(base2, token);
-  if (!opts?.full) return syncOnce(transport);
-  await setCursor("0");
-  const total = { pulled: 0, pushed: 0, conflicts: 0, deleted: 0, dropped: 0 };
-  let seen = "0";
-  for (let page = 0; page < FULL_PULL_MAX_PAGES; page++) {
-    const s2 = await syncOnce(transport);
-    total.pulled += s2.pulled;
-    total.pushed += s2.pushed;
-    total.conflicts += s2.conflicts;
-    total.deleted += s2.deleted;
-    total.dropped += s2.dropped;
-    const now = await getCursor();
-    if (now === seen) break;
-    seen = now;
-  }
-  return total;
+  if (opts?.full) await setCursor("0");
+  const booted = await bootstrapOnce(transport).catch(() => null);
+  const stats2 = await syncOnce(transport);
+  if (booted) stats2.pulled += booted;
+  return stats2;
 }
 function syncStatus() {
   return {
@@ -21731,15 +22485,24 @@ function syncStatus() {
     /* OPEN */
   };
 }
+async function syncTick(transport) {
+  try {
+    await syncOnce(transport);
+    if (!pullSehat) {
+      console.info("sync: pull pulih");
+      pullSehat = true;
+    }
+  } catch (e) {
+    if (pullSehat) {
+      console.warn(`sync: pull gagal \u2014 ${e.message}`);
+      pullSehat = false;
+    }
+  }
+}
 async function startSyncClient(base2, token, tickMs2) {
   started = true;
   const transport = fetchTransport(base2, token);
-  const tick6 = async () => {
-    try {
-      await syncOnce(transport);
-    } catch {
-    }
-  };
+  const tick6 = () => syncTick(transport);
   const connectWs = async () => {
     const { WebSocket: WebSocket2 } = await Promise.resolve().then(() => (init_wrapper(), wrapper_exports));
     const wsUrl = base2.replace(/^http/, "ws").replace(/\/$/, "") + "/api/sync/ws";
@@ -21768,6 +22531,7 @@ async function startSyncClient(base2, token, tickMs2) {
       }
     });
   };
+  await bootstrapOnce(transport).catch(() => null);
   await tick6();
   void connectWs();
   const ms = tickMs2 && tickMs2 > 0 ? tickMs2 : 15e3;
@@ -21794,7 +22558,7 @@ async function applySyncConfig() {
   const token = effectiveStr("SYNC_DEVICE_TOKEN");
   if (base2 && token) await startSyncClient(base2, token, effectiveInt("SYNC_TICK_MS"));
 }
-var MAX_SYNC_RECORD_BYTES, feedHole, FULL_PULL_MAX_PAGES, timer3, ws, started;
+var MAX_SYNC_RECORD_BYTES, feedHole, MAX_DRAIN_PAGES, timer3, ws, started, pullSehat;
 var init_sync_client = __esm({
   "src/services/sync-client.ts"() {
     "use strict";
@@ -21809,8 +22573,9 @@ var init_sync_client = __esm({
     init_safe_outbound_request();
     MAX_SYNC_RECORD_BYTES = 1024 * 1024;
     feedHole = false;
-    FULL_PULL_MAX_PAGES = 200;
+    MAX_DRAIN_PAGES = 500;
     started = false;
+    pullSehat = true;
   }
 });
 
@@ -25085,9 +25850,9 @@ import Fastify from "fastify";
 import fastifyStatic from "@fastify/static";
 import websocket from "@fastify/websocket";
 import cookie from "@fastify/cookie";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { dirname as dirname13 } from "node:path";
-import { existsSync as existsSync16 } from "node:fs";
+import { existsSync as existsSync17 } from "node:fs";
 
 // src/web-dir.ts
 import { resolve } from "node:path";
@@ -25148,17 +25913,17 @@ init_stage_machine();
 
 // src/services/scan.ts
 init_src();
-import { execFile } from "node:child_process";
+import { execFile as execFile2 } from "node:child_process";
 import { promisify } from "node:util";
 import { existsSync as existsSync6, rmSync as rmSync2 } from "node:fs";
 import { resolve as resolve10 } from "node:path";
 
 // src/services/safe-repo-path.ts
-import { constants } from "node:fs";
+import { constants as constants2 } from "node:fs";
 import { lstat, mkdir as mkdir2, open as open2, realpath, rename, unlink as unlink2 } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, join as join6, relative, resolve as resolve9, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join7, relative, resolve as resolve9, sep as sep2 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { closeSync, fstatSync, lstatSync, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync5, realpathSync as realpathSync2, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { closeSync, fstatSync, lstatSync, mkdirSync as mkdirSync6, openSync, readFileSync as readFileSync7, realpathSync as realpathSync2, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync4 } from "node:fs";
 var PathContainmentError = class extends Error {
   code = "PATH_CONTAINMENT";
 };
@@ -25166,7 +25931,7 @@ var denied = (detail) => {
   throw new PathContainmentError(`repository path ditolak: ${detail}`);
 };
 function components(rel) {
-  if (!rel || isAbsolute3(rel) || rel.includes("\0")) denied("path invalid");
+  if (!rel || isAbsolute4(rel) || rel.includes("\0")) denied("path invalid");
   const parts = rel.replace(/\\/g, "/").split("/");
   if (parts.some((part) => !part || part === "." || part === "..")) denied("parent/empty component");
   return parts;
@@ -25179,14 +25944,14 @@ async function canonicalRoot(root) {
 }
 function beneath(root, candidate) {
   const rel = relative(root, candidate);
-  return rel === "" || !rel.startsWith(`..${sep2}`) && rel !== ".." && !isAbsolute3(rel);
+  return rel === "" || !rel.startsWith(`..${sep2}`) && rel !== ".." && !isAbsolute4(rel);
 }
 async function ensureRepoParents(root, rel) {
   const base2 = await canonicalRoot(root);
   const parts = components(rel).slice(0, -1);
   let current = base2;
   for (const part of parts) {
-    current = join6(current, part);
+    current = join7(current, part);
     try {
       await mkdir2(current, { mode: 448 });
     } catch (error) {
@@ -25203,9 +25968,9 @@ function ensureRepoParentsSync(root, rel) {
   const parts = components(rel).slice(0, -1);
   let current = base2;
   for (const part of parts) {
-    current = join6(current, part);
+    current = join7(current, part);
     try {
-      mkdirSync5(current, { mode: 448 });
+      mkdirSync6(current, { mode: 448 });
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
     }
@@ -25219,7 +25984,7 @@ async function resolveRepoEntry(root, rel, opts = {}) {
   const parts = components(rel);
   let current = base2;
   for (let i = 0; i < parts.length; i++) {
-    current = join6(current, parts[i]);
+    current = join7(current, parts[i]);
     const stat4 = await lstat(current).catch((error) => {
       if (error.code === "ENOENT" && opts.allowMissingTail) return null;
       if (error.code === "ENOENT" && opts.allowMissingFinal && i === parts.length - 1) return null;
@@ -25240,7 +26005,7 @@ function assertSafeRepoPathSync(root, rel, allowMissingFinal = false, allowMissi
   const parts = components(rel);
   let current = base2;
   for (let i = 0; i < parts.length; i++) {
-    current = join6(current, parts[i]);
+    current = join7(current, parts[i]);
     try {
       const stat4 = lstatSync(current);
       if (stat4.isSymbolicLink()) denied("symlink");
@@ -25256,10 +26021,10 @@ function assertSafeRepoPathSync(root, rel, allowMissingFinal = false, allowMissi
 }
 function readRepoFileSync(root, rel) {
   const path2 = assertSafeRepoPathSync(root, rel);
-  const fd = openSync(path2, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  const fd = openSync(path2, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
   try {
     if (!fstatSync(fd).isFile()) denied("bukan file regular");
-    return readFileSync5(fd);
+    return readFileSync7(fd);
   } finally {
     closeSync(fd);
   }
@@ -25270,10 +26035,10 @@ function writeRepoFileAtomicSync(root, rel, data) {
   const parent = resolve9(path2, "..");
   const parentRel = relative(realpathSync2(root), parent);
   if (parentRel) assertSafeRepoPathSync(root, parentRel);
-  const temp = join6(parent, `.hanoman-${randomUUID3()}.tmp`);
-  const fd = openSync(temp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 384);
+  const temp = join7(parent, `.hanoman-${randomUUID3()}.tmp`);
+  const fd = openSync(temp, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | (constants2.O_NOFOLLOW ?? 0), 384);
   try {
-    writeFileSync3(fd, data);
+    writeFileSync4(fd, data);
   } finally {
     closeSync(fd);
   }
@@ -25297,7 +26062,7 @@ function writeRepoFileAtomicSync(root, rel, data) {
 }
 async function readRepoFile(root, rel) {
   const entry = await resolveRepoEntry(root, rel);
-  const handle = await open2(entry.path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0)).catch(() => denied("final component tidak aman"));
+  const handle = await open2(entry.path, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0)).catch(() => denied("final component tidak aman"));
   try {
     const stat4 = await handle.stat();
     if (!stat4.isFile()) denied("bukan file regular");
@@ -25317,8 +26082,8 @@ async function writeRepoFileAtomic(root, rel, data) {
   await mkdir2(entry.parent, { recursive: false, mode: 448 }).catch((error) => {
     if (error.code !== "EEXIST") throw error;
   });
-  const temp = join6(entry.parent, `.hanoman-${randomUUID3()}.tmp`);
-  const handle = await open2(temp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 384);
+  const temp = join7(entry.parent, `.hanoman-${randomUUID3()}.tmp`);
+  const handle = await open2(temp, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | (constants2.O_NOFOLLOW ?? 0), 384);
   try {
     await handle.writeFile(data);
     await handle.sync();
@@ -25339,7 +26104,7 @@ async function writeRepoFileAtomic(root, rel, data) {
 }
 
 // src/services/scan.ts
-var exec = promisify(execFile);
+var exec = promisify(execFile2);
 async function listRepoDocs(repoDir) {
   try {
     const { stdout } = await exec(
@@ -25459,7 +26224,18 @@ function sessionOf(projectId, sessions) {
     commit: `\u2192 hanoman/${s2.id}`
   };
 }
-async function toProjectView(p, sessions) {
+async function loadDeviceIndex() {
+  const rows = await prisma.deviceToken.findMany({ select: { id: true, name: true, revokedAt: true } });
+  return new Map(rows.map((d) => [d.id, { name: d.name, revoked: d.revokedAt !== null }]));
+}
+function handledByView(raw2, devices) {
+  return handledByOf(raw2).map((e) => {
+    const d = devices.get(e.deviceId);
+    return { deviceId: e.deviceId, name: d?.name ?? e.name, revoked: d?.revoked ?? false };
+  });
+}
+async function toProjectView(p, sessions, devices) {
+  const deviceIndex = devices ?? await loadDeviceIndex();
   const specs = await prisma.spec.findMany({ where: { projectId: p.id } });
   const { coverage } = await scanRepoDocs(await resolveRepoDir(p.id));
   const binding = await getBinding(p.id);
@@ -25489,6 +26265,9 @@ async function toProjectView(p, sessions) {
     schedulerOptIn: p.schedulerOptIn,
     // SPEC-409 · ADR-0091 · opt-in hanoman-lead (lokal per-instance, cermin schedulerOptIn).
     leadOptIn: p.leadOptIn,
+    // SPEC-880 · ADR-0135 · penanda "ditangani oleh" (DISYNC — beda dari repoDir/binding di atas
+    // yang fakta mesin ini saja).
+    handledBy: handledByView(p.handledBy, deviceIndex),
     // SPEC-486 · ADR-0103 · kebijakan auto-merge (lokal per-instance, cermin schedulerOptIn).
     autoMerge: autoMergeOf(p.autoMerge)
   };
@@ -25539,9 +26318,9 @@ async function listPendingDeletes() {
 }
 
 // src/services/branches.ts
-import { execFile as execFile2 } from "node:child_process";
+import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
-var exec2 = promisify2(execFile2);
+var exec2 = promisify2(execFile3);
 var GIT = { maxBuffer: 1 << 24, encoding: "utf8" };
 async function refs(repoDir, glob) {
   if (!repoDir) return [];
@@ -25596,6 +26375,17 @@ async function checkAutoMerge(repoDir, raw2) {
   return known.includes(p.branch) ? { ok: true } : { ok: false, code: 400, error: `branch "${p.branch}" tidak ada di ${p.dest === "origin" ? "origin" : "repo lokal"} project` };
 }
 
+// src/services/handled-by.ts
+init_db();
+async function checkHandledBy(list2) {
+  const known = await prisma.deviceToken.findMany({ select: { id: true } });
+  if (!known.length) return { ok: true };
+  const ids = new Set(known.map((d) => d.id));
+  const asing = list2.filter((e) => !ids.has(e.deviceId)).map((e) => e.deviceId);
+  if (asing.length) return { ok: false, code: 400, error: `device tak dikenal: ${asing.join(", ")}` };
+  return { ok: true };
+}
+
 // src/routes/projects.ts
 import { Prisma } from "@prisma/client";
 init_pty();
@@ -25613,13 +26403,16 @@ function paginate(items, page, limit) {
 init_src2();
 async function projects_default(app2) {
   app2.get("/projects", async (req) => {
-    const { q, page, limit } = req.query;
+    const { q, handledBy, page, limit } = req.query;
     const ps = await prisma.project.findMany({ orderBy: { createdAt: "desc" } });
     const sessions = listSessions();
-    const views = await Promise.all(ps.map((p) => toProjectView(p, sessions)));
+    const devices = await loadDeviceIndex();
+    const views = await Promise.all(ps.map((p) => toProjectView(p, sessions, devices)));
     const needle = (q ?? "").trim().toLowerCase();
     const filtered = needle ? views.filter((v) => `${v.name} ${v.desc} ${v.stack}`.toLowerCase().includes(needle)) : views;
-    return paginate(filtered, page, limit);
+    const device = (handledBy ?? "").trim();
+    const scoped = device ? filtered.filter((v) => v.handledBy.some((h) => h.deviceId === device)) : filtered;
+    return paginate(scoped, page, limit);
   });
   app2.get("/projects/:id", async (req, reply) => {
     const { id } = req.params;
@@ -25634,6 +26427,10 @@ async function projects_default(app2) {
     const id = (b.name || b.repoDir?.split("/").pop() || "repo").trim().toLowerCase().replace(/\s+/g, "-");
     if (await prisma.project.findUnique({ where: { id } }))
       return reply.code(409).send({ error: `project "${id}" sudah ada` });
+    if (b.handledBy?.length) {
+      const gate = await checkHandledBy(b.handledBy);
+      if (!gate.ok) return reply.code(gate.code).send({ error: gate.error });
+    }
     if (b.kind === "from-scratch" && b.repoDir) {
       try {
         realGit.initRepo(b.repoDir);
@@ -25649,7 +26446,8 @@ async function projects_default(app2) {
         kind: b.kind,
         repoDir: b.repoDir ?? null,
         gitRemote: b.gitRemote ?? null,
-        stack: ""
+        stack: "",
+        ...b.handledBy?.length ? { handledBy: b.handledBy } : {}
       }
     });
     await notifySynced("project", created.id);
@@ -25664,8 +26462,13 @@ async function projects_default(app2) {
       const gate = await checkAutoMerge(await resolveRepoDir(id), parsed.data.autoMerge);
       if (!gate.ok) return reply.code(gate.code).send({ error: gate.error });
     }
+    if (parsed.data.handledBy?.length) {
+      const gate = await checkHandledBy(parsed.data.handledBy);
+      if (!gate.ok) return reply.code(gate.code).send({ error: gate.error });
+    }
     const data = { ...parsed.data };
     if ("autoMerge" in data && data.autoMerge === null) data.autoMerge = Prisma.DbNull;
+    if ("handledBy" in data && !data.handledBy?.length) data.handledBy = Prisma.DbNull;
     const updated = await prisma.project.update({ where: { id }, data });
     await notifySynced("project", id);
     return toProjectView(updated, listSessions());
@@ -25736,13 +26539,13 @@ init_src2();
 import { existsSync as existsSync7 } from "node:fs";
 
 // src/services/integrate.ts
-import { execFile as execFile3 } from "node:child_process";
+import { execFile as execFile4 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
 import { rmSync as rmSync3 } from "node:fs";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 var sanitize = (id) => id.toLowerCase().replace(/[^a-z0-9_-]/g, "_");
 var sourceBranch = (specId) => `hanoman/${sanitize(specId)}`;
-var exec3 = promisify3(execFile3);
+var exec3 = promisify3(execFile4);
 var GIT2 = { timeout: 6e4, maxBuffer: 1 << 24, encoding: "utf8" };
 var sh = (cwd, args) => exec3("git", args, { cwd, ...GIT2 }).then(
   (r) => ({ status: 0, stdout: r.stdout, stderr: r.stderr }),
@@ -25783,7 +26586,7 @@ async function integrateBranch(repoDir, src, op, target2) {
   const tgt = await resolveTarget(repoDir, target2);
   if (!tgt) return { status: "error", code: 400, error: `target "${target2}" tidak dikenal` };
   await sh(repoDir, ["fetch", "origin"]);
-  const wt = join7(repoDir, ".worktrees", `merge-${sanitize(src.mergeId)}`);
+  const wt = join8(repoDir, ".worktrees", `merge-${sanitize(src.mergeId)}`);
   await reclaim(repoDir, wt);
   const baseRef = op === "merge" ? tgt.ref : source;
   const baseSha = await out(repoDir, ["rev-parse", "--verify", "--end-of-options", `${baseRef}^{commit}`]);
@@ -25791,9 +26594,9 @@ async function integrateBranch(repoDir, src, op, target2) {
     return { status: "error", code: 500, error: "gagal membuat worktree integrasi" };
   const applyRef = op === "merge" ? source : tgt.ref;
   const cmd = op === "merge" ? ["merge", "--no-edit", applyRef] : ["rebase", applyRef];
-  const run2 = await sh(wt, cmd);
+  const run3 = await sh(wt, cmd);
   const finalize = op === "rebase" ? { kind: "force-push", branch: src.branch } : tgt.dest === "local" ? { kind: "branch-f", branch: tgt.name, checkout: await worktreeForBranch(repoDir, tgt.name) } : { kind: "push", branch: tgt.name };
-  if (run2.status === 0) {
+  if (run3.status === 0) {
     const fin = await runFinalize(wt, repoDir, finalize);
     await sh(repoDir, ["worktree", "remove", "--force", wt]);
     return fin.ok ? { status: "clean", detail: fin.detail } : { status: "error", code: 409, error: fin.error };
@@ -25844,16 +26647,16 @@ async function mergeIntoCurrent(repoDir, source, opts = {}) {
   const src = await resolveGraphSource(repoDir, source);
   if (!src) return { status: "error", code: 400, error: `source "${source}" tak dikenal` };
   await sh(repoDir, ["fetch", "origin"]);
-  const wt = join7(repoDir, ".worktrees", `merge-${sanitize(current)}`);
+  const wt = join8(repoDir, ".worktrees", `merge-${sanitize(current)}`);
   await reclaim(repoDir, wt);
   const baseSha = await out(repoDir, ["rev-parse", "--verify", "--end-of-options", `refs/heads/${current}^{commit}`]);
   if (!await ok(repoDir, ["worktree", "add", "--detach", "-q", wt, baseSha]))
     return { status: "error", code: 500, error: "gagal membuat worktree merge" };
   const srcSha = await out(repoDir, ["rev-parse", "--verify", "--end-of-options", `${src}^{commit}`]);
   const cmd = ["merge", "--no-edit", ...opts.ff ? [`--${opts.ff}`] : [], "--end-of-options", srcSha];
-  const run2 = await sh(wt, cmd);
+  const run3 = await sh(wt, cmd);
   const finalize = { kind: "branch-f", branch: current, checkout: await worktreeForBranch(repoDir, current) };
-  if (run2.status === 0) {
+  if (run3.status === 0) {
     const fin = await runFinalize(wt, repoDir, finalize);
     if (fin.ok && opts.deleteBranch) await deleteMergedBranch(repoDir, opts.deleteBranch);
     await sh(repoDir, ["worktree", "remove", "--force", wt]);
@@ -25863,7 +26666,7 @@ async function mergeIntoCurrent(repoDir, source, opts = {}) {
   if (!conflicted) {
     await sh(wt, ["merge", "--abort"]);
     await sh(repoDir, ["worktree", "remove", "--force", wt]);
-    return { status: "error", code: 409, error: run2.stderr.trim() || "merge gagal \u2014 tak bisa fast-forward?" };
+    return { status: "error", code: 409, error: run3.stderr.trim() || "merge gagal \u2014 tak bisa fast-forward?" };
   }
   return { status: "conflict", worktree: wt, source: src, target: `local:${current}`, finalize: finalizeInstruction("merge", finalize) };
 }
@@ -25882,13 +26685,13 @@ async function replayCurrent(repoDir, source, cmd) {
   const current = await out(repoDir, ["rev-parse", "--abbrev-ref", "HEAD"]);
   if (!current || current === "HEAD")
     return { status: "error", code: 409, error: "HEAD detached \u2014 checkout sebuah branch dulu" };
-  const wt = join7(repoDir, ".worktrees", `merge-${sanitize(current)}`);
+  const wt = join8(repoDir, ".worktrees", `merge-${sanitize(current)}`);
   await reclaim(repoDir, wt);
   const baseSha = await out(repoDir, ["rev-parse", "--verify", "--end-of-options", `refs/heads/${current}^{commit}`]);
   if (!await ok(repoDir, ["worktree", "add", "--detach", "-q", wt, baseSha]))
     return { status: "error", code: 500, error: "gagal membuat worktree rebase" };
-  const run2 = await sh(wt, cmd);
-  if (run2.status === 0) {
+  const run3 = await sh(wt, cmd);
+  if (run3.status === 0) {
     const head = await out(wt, ["rev-parse", "HEAD"]);
     const fin = await landRewrite(repoDir, current, head);
     await sh(repoDir, ["worktree", "remove", "--force", wt]);
@@ -25898,7 +26701,7 @@ async function replayCurrent(repoDir, source, cmd) {
   if (!conflicted) {
     await sh(wt, ["rebase", "--abort"]);
     await sh(repoDir, ["worktree", "remove", "--force", wt]);
-    return { status: "error", code: 409, error: run2.stderr.trim() || "operasi rebase gagal" };
+    return { status: "error", code: 409, error: run3.stderr.trim() || "operasi rebase gagal" };
   }
   return { status: "conflict", worktree: wt, source, target: `local:${current}`, finalize: rewriteInstruction(repoDir, current) };
 }
@@ -25927,19 +26730,19 @@ init_codex_trust();
 init_db();
 
 // src/services/spec-review.ts
-import { execFile as execFile4 } from "node:child_process";
+import { execFile as execFile5 } from "node:child_process";
 import { promisify as promisify4 } from "node:util";
 import { mkdtemp, copyFile, rm as rm2 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join8, resolve as resolve11 } from "node:path";
-var exec4 = promisify4(execFile4);
+import { join as join9, resolve as resolve11 } from "node:path";
+var exec4 = promisify4(execFile5);
 var GIT3 = { maxBuffer: 1 << 24 };
 var MAX = 256 * 1024;
-var worktreeDir = (repoDir, specId) => join8(repoDir, ".worktrees", specId.toLowerCase().replace(/[^a-z0-9_-]/g, "_"));
+var worktreeDir = (repoDir, specId) => join9(repoDir, ".worktrees", specId.toLowerCase().replace(/[^a-z0-9_-]/g, "_"));
 async function withTempIndex(wt, fn2) {
   const idx = (await exec4("git", ["rev-parse", "--git-path", "index"], { cwd: wt, ...GIT3 })).stdout.trim();
-  const dir2 = await mkdtemp(join8(tmpdir2(), "hanoman-idx-"));
-  const tmp = join8(dir2, "index");
+  const dir2 = await mkdtemp(join9(tmpdir2(), "hanoman-idx-"));
+  const tmp = join9(dir2, "index");
   await copyFile(resolve11(wt, idx), tmp);
   const env = { ...process.env, GIT_INDEX_FILE: tmp };
   try {
@@ -26210,7 +27013,7 @@ import { extname } from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { spawn as spawn2 } from "node:child_process";
 import { mkdir as mkdir3, rename as rename2, unlink as unlink3, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename3, isAbsolute as isAbsolute4, join as join9 } from "node:path";
+import { basename as basename3, isAbsolute as isAbsolute5, join as join10 } from "node:path";
 
 // ../node_modules/.pnpm/strtok3@10.3.5/node_modules/strtok3/lib/stream/Errors.js
 var defaultMessages = "End-Of-Stream";
@@ -33572,6 +34375,7 @@ utility_default(constructor_default);
 var dist_default = constructor_default;
 
 // src/services/upload-pipeline.ts
+init_src2();
 init_db();
 init_uploads();
 var UPLOAD_LIMITS = {
@@ -33617,10 +34421,12 @@ async function defaultUsage(projectId) {
 function scannerFromEnv(path2) {
   const command = process.env.HANOMAN_UPLOAD_SCANNER?.trim();
   if (!command) {
-    if (process.env.NODE_ENV === "production") return Promise.reject(new UploadError("UPLOAD_SCAN", "scanner required"));
+    if (resolveHardening(process.env))
+      return Promise.reject(new UploadError("UPLOAD_SCAN", "scanner required"));
+    console.warn("upload: HANOMAN_UPLOAD_SCANNER tak disetel \u2014 lampiran diterima tanpa dipindai");
     return Promise.resolve();
   }
-  if (!isAbsolute4(command)) return Promise.reject(new UploadError("UPLOAD_SCAN", "scanner path must be absolute"));
+  if (!isAbsolute5(command)) return Promise.reject(new UploadError("UPLOAD_SCAN", "scanner path must be absolute"));
   return new Promise((resolve21, reject2) => {
     const child = spawn2(command, [path2], { shell: false, stdio: "ignore" });
     const timer9 = setTimeout(() => {
@@ -33644,16 +34450,16 @@ function safeFilename(input, extension2) {
 }
 async function commitToStorage(buffer2, extension2, deps, beforePromote) {
   const storageDir = deps.storageDir ?? uploadDir();
-  const quarantineDir = join9(storageDir, ".quarantine");
+  const quarantineDir = join10(storageDir, ".quarantine");
   await mkdir3(quarantineDir, { recursive: true, mode: 448 });
   await mkdir3(storageDir, { recursive: true, mode: 448 });
-  const quarantine = join9(quarantineDir, `${randomUUID5()}.upload`);
+  const quarantine = join10(quarantineDir, `${randomUUID5()}.upload`);
   const storageKey = `${randomUUID5()}${extension2}`;
   await writeFile2(quarantine, buffer2, { mode: 384, flag: "wx" });
   try {
     await timeout2((deps.scanner ?? scannerFromEnv)(quarantine), UPLOAD_LIMITS.scanMs, "UPLOAD_SCAN");
     await beforePromote?.();
-    await rename2(quarantine, join9(storageDir, storageKey));
+    await rename2(quarantine, join10(storageDir, storageKey));
   } catch (error) {
     await unlink3(quarantine).catch(() => {
     });
@@ -33854,10 +34660,10 @@ async function dropSpecAttachments(specId) {
 // src/services/spec-attachment-dir.ts
 init_db();
 import { mkdir as mkdir4, readdir, readFile as readFile3, rm as rm3, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 init_session_id();
 init_uploads();
-var specAttachmentsDir = (repoDir, sessionId2) => join10(repoDir, ".worktrees", ".attachments", sessionId2);
+var specAttachmentsDir = (repoDir, sessionId2) => join11(repoDir, ".worktrees", ".attachments", sessionId2);
 var INDEX = "INDEX.md";
 var humanSize = (n2) => n2 >= 1024 * 1024 ? `${(n2 / 1024 / 1024).toFixed(1)} MB` : n2 >= 1024 ? `${Math.round(n2 / 1024)} KB` : `${n2} B`;
 function uniqueName(taken, filename) {
@@ -33907,19 +34713,19 @@ async function syncSpecAttachmentsDir(specId, projectId) {
   for (const a of rows) {
     let bytes;
     try {
-      bytes = await readFile3(join10(uploadDir(), a.storageKey));
+      bytes = await readFile3(join11(uploadDir(), a.storageKey));
     } catch {
       continue;
     }
     const filename = uniqueName(taken, a.filename);
-    const path2 = join10(dir2, filename);
+    const path2 = join11(dir2, filename);
     await writeFile3(path2, bytes, { mode: 384 });
     items.push({ filename, mimeType: a.mimeType, size: a.size, path: path2 });
   }
-  await writeFile3(join10(dir2, INDEX), renderIndex(specId, items), { mode: 384 });
+  await writeFile3(join11(dir2, INDEX), renderIndex(specId, items), { mode: 384 });
   const keep = /* @__PURE__ */ new Set([INDEX, ...items.map((a) => a.filename)]);
   for (const name2 of await readdir(dir2)) {
-    if (!keep.has(name2)) await rm3(join10(dir2, name2), { recursive: true, force: true }).catch(() => {
+    if (!keep.has(name2)) await rm3(join11(dir2, name2), { recursive: true, force: true }).catch(() => {
     });
   }
   return items;
@@ -37235,14 +38041,14 @@ async function docs_default(app2) {
 // src/routes/ide.ts
 init_src2();
 import { basename as basename5, resolve as resolve16 } from "node:path";
-import { execFile as execFile10, spawn as spawn3 } from "node:child_process";
+import { execFile as execFile11, spawn as spawn3 } from "node:child_process";
 import { promisify as promisify10 } from "node:util";
 
 // src/services/git-remotes.ts
-import { execFile as execFile5 } from "node:child_process";
+import { execFile as execFile6 } from "node:child_process";
 import { promisify as promisify5 } from "node:util";
 import { existsSync as existsSync8 } from "node:fs";
-var exec5 = promisify5(execFile5);
+var exec5 = promisify5(execFile6);
 var GIT4 = { maxBuffer: 1 << 24, encoding: "utf8" };
 function parseRemote(url2) {
   let m = /^git@([^:]+):(.+?)(?:\.git)?$/.exec(url2);
@@ -37295,15 +38101,15 @@ init_settings2();
 init_codex_trust();
 
 // src/services/branch-cleanup.ts
-import { execFile as execFile7 } from "node:child_process";
+import { execFile as execFile8 } from "node:child_process";
 import { promisify as promisify7 } from "node:util";
 
 // src/services/git-ide.ts
-import { execFile as execFile6 } from "node:child_process";
+import { execFile as execFile7 } from "node:child_process";
 import { promisify as promisify6 } from "node:util";
 import { existsSync as existsSync9 } from "node:fs";
 import { resolve as resolve12 } from "node:path";
-var exec6 = promisify6(execFile6);
+var exec6 = promisify6(execFile7);
 var GIT5 = { maxBuffer: 1 << 24 };
 var MAX2 = 256 * 1024;
 var splitZ2 = (s2) => s2.split("\0").filter(Boolean);
@@ -37467,16 +38273,16 @@ async function compareCommits(repoDir, from, to) {
 }
 async function searchCommits(repoDir, q, by = "all") {
   if (!repoDir || !existsSync9(repoDir) || !q) return [];
-  const run2 = async (extra) => {
+  const run3 = async (extra) => {
     try {
       return (await exec6("git", ["log", "--all", "--format=%H", ...extra], { cwd: repoDir, ...GIT5 })).stdout.split("\n").filter(Boolean);
     } catch {
       return [];
     }
   };
-  const byMessage = () => run2(["-i", "-F", `--grep=${q}`]);
-  const byAuthor = () => run2(["-i", `--author=${q}`]);
-  const byHash = async () => (await run2([])).filter((h2) => h2.toLowerCase().startsWith(q.toLowerCase()));
+  const byMessage = () => run3(["-i", "-F", `--grep=${q}`]);
+  const byAuthor = () => run3(["-i", `--author=${q}`]);
+  const byHash = async () => (await run3([])).filter((h2) => h2.toLowerCase().startsWith(q.toLowerCase()));
   if (by === "message") return byMessage();
   if (by === "author") return byAuthor();
   if (by === "hash") return byHash();
@@ -37748,7 +38554,7 @@ async function workingFileDiff(repoDir, path2, staged) {
 }
 
 // src/services/branch-cleanup.ts
-var exec7 = promisify7(execFile7);
+var exec7 = promisify7(execFile8);
 var GIT6 = { timeout: 6e4, maxBuffer: 1 << 24, encoding: "utf8" };
 var LOCK_REASON = {
   current: "branch aktif (HEAD)",
@@ -37916,10 +38722,10 @@ async function deleteBranches(repoDir, names, opts) {
 }
 
 // src/services/worktree-list.ts
-import { execFile as execFile8 } from "node:child_process";
+import { execFile as execFile9 } from "node:child_process";
 import { realpathSync as realpathSync4 } from "node:fs";
 import { stat } from "node:fs/promises";
-import { basename as basename4, join as join11, resolve as resolve14, sep as sep4 } from "node:path";
+import { basename as basename4, join as join12, resolve as resolve14, sep as sep4 } from "node:path";
 import { promisify as promisify8 } from "node:util";
 
 // src/services/session-worktree.ts
@@ -37932,7 +38738,7 @@ function ownsWorktree(repoDir, cwd) {
 }
 
 // src/services/worktree-list.ts
-var exec8 = promisify8(execFile8);
+var exec8 = promisify8(execFile9);
 var GIT7 = { timeout: 6e4, maxBuffer: 1 << 24, encoding: "utf8" };
 async function out3(cwd, args) {
   try {
@@ -37975,7 +38781,7 @@ var real = (p) => {
 };
 async function bornAt(path2) {
   try {
-    const st = await stat(join11(path2, ".git"));
+    const st = await stat(join12(path2, ".git"));
     const ms = st.birthtimeMs > 0 ? st.birthtimeMs : st.mtimeMs;
     return new Date(ms).toISOString();
   } catch {
@@ -38095,14 +38901,14 @@ init_stage_machine();
 // src/services/worktree-reaper.ts
 init_src2();
 init_db();
-import { execFile as execFile9 } from "node:child_process";
+import { execFile as execFile10 } from "node:child_process";
 import { readdir as readdir2, rm as rm4 } from "node:fs/promises";
 import { promisify as promisify9 } from "node:util";
-import { join as join12, resolve as resolve15 } from "node:path";
+import { join as join13, resolve as resolve15 } from "node:path";
 init_notifications();
 var TICK_MS = 6e4;
 var trashDirOf = (repoDir) => resolve15(repoDir, ".worktrees", ".trash");
-var exec9 = promisify9(execFile9);
+var exec9 = promisify9(execFile10);
 var prodReaperDeps = {
   rm: (path2) => rm4(path2, { recursive: true, force: true }),
   prune: async (repoDir) => {
@@ -38158,7 +38964,7 @@ async function sweepRepo(repoDir, projectId, deps = prodReaperDeps) {
   }
   let removed = 0;
   for (const entry of entries) {
-    const path2 = join12(dir2, entry);
+    const path2 = join13(dir2, entry);
     const known = pending.get(path2);
     const row = known ?? { path: path2, repoDir, projectId, entry, sessionId: sessionIdOf(entry), since: Date.now() };
     pending.set(path2, row);
@@ -38248,7 +39054,7 @@ init_session_id();
 // src/services/repo-fs.ts
 import { lstat as lstat2, rename as rename3, rm as rm5 } from "node:fs/promises";
 import { createWriteStream } from "node:fs";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { pipeline } from "node:stream/promises";
 var EntryExistsError = class extends Error {
@@ -38309,7 +39115,7 @@ async function saveUpload(repoDir, rel, source, opts = {}) {
   if (current && !opts.overwrite) return { status: "exists" };
   if (current && !current.isFile())
     throw new PathContainmentError("repository path ditolak: target bukan file regular");
-  const temp = join13(entry.parent, `.hanoman-${randomUUID6()}.tmp`);
+  const temp = join14(entry.parent, `.hanoman-${randomUUID6()}.tmp`);
   try {
     await pipeline(source, createWriteStream(temp, { flags: "wx", mode: 384 }));
     if (opts.isTruncated?.()) {
@@ -38349,7 +39155,7 @@ async function worktreeInputs(id) {
     sessions: new Map(listSessions().filter((s2) => s2.projectId === id && !s2.exited).map((s2) => [resolve16(s2.cwd), { id: s2.id, specId: s2.specId ?? null }]))
   };
 }
-var execAsync = promisify10(execFile10);
+var execAsync = promisify10(execFile11);
 function entryError(reply, e) {
   if (e instanceof EntryMissingError) return reply.code(404).send({ error: "not found" });
   if (e instanceof EntryExistsError) return reply.code(409).send({ error: "sudah ada" });
@@ -38813,14 +39619,14 @@ async function finishGraphOp(reply, id, repoDir, r, verb) {
 // src/routes/fs.ts
 import { readdir as readdir3 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
-import { resolve as resolve17, dirname as dirname9, join as join14 } from "node:path";
+import { resolve as resolve17, dirname as dirname9, join as join15 } from "node:path";
 async function fs_default(app2) {
   app2.get("/fs/browse", async (req, reply) => {
     const q = req.query.path;
     const dir2 = q && q.trim() ? resolve17(q.trim()) : homedir4();
     try {
       const ents = await readdir3(dir2, { withFileTypes: true });
-      const entries = ents.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, path: join14(dir2, e.name) })).sort((a, b) => a.name.localeCompare(b.name));
+      const entries = ents.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, path: join15(dir2, e.name) })).sort((a, b) => a.name.localeCompare(b.name));
       const parent = dirname9(dir2);
       return { path: dir2, parent: parent === dir2 ? null : parent, entries };
     } catch {
@@ -39021,6 +39827,7 @@ function setBounded(map, key, value, maxKeys) {
 }
 
 // src/services/auth.ts
+init_src2();
 init_db();
 import { randomBytes as randomBytes3, scrypt as scryptCb, timingSafeEqual as timingSafeEqual2, createHash as createHash6 } from "node:crypto";
 import { promisify as promisify11 } from "node:util";
@@ -39087,11 +39894,13 @@ function clearLoginFails(ip) {
   fails.clear(ip);
   loginStates.delete(ip);
 }
-function cookieOpts() {
+function cookieOpts(req) {
+  const forwarded = String(req.headers["x-forwarded-proto"] ?? "").split(",")[0]?.trim();
+  const https = req.protocol === "https" || forwarded === "https";
   return {
     httpOnly: true,
     sameSite: "strict",
-    secure: process.env.NODE_ENV === "production",
+    secure: https || resolveHardening(process.env),
     path: "/",
     maxAge: SESSION_TTL_MS / 1e3
   };
@@ -39217,6 +40026,41 @@ async function revalidateWsPrincipal(req, principal) {
   }
   return req.agent?.id === principal.id;
 }
+var WS_REVALIDATE_EVERY_MS = 1e3;
+function createPrincipalWatch(opts) {
+  const now = opts.now ?? Date.now;
+  const everyMs = opts.everyMs ?? WS_REVALIDATE_EVERY_MS;
+  let revoked = false;
+  let disposed = false;
+  let inFlight3 = false;
+  let attemptedAt = null;
+  const run3 = () => {
+    if (revoked || disposed || inFlight3) return;
+    inFlight3 = true;
+    attemptedAt = now();
+    opts.check().then((ok2) => {
+      inFlight3 = false;
+      if (disposed || revoked || ok2) return;
+      revoked = true;
+      opts.onRevoked();
+    }, () => {
+      inFlight3 = false;
+    });
+  };
+  return {
+    admit() {
+      if (revoked) return false;
+      if (attemptedAt === null || now() - attemptedAt >= everyMs) run3();
+      return true;
+    },
+    refresh() {
+      run3();
+    },
+    dispose() {
+      disposed = true;
+    }
+  };
+}
 function bearerToken(req) {
   const value = req.headers.authorization;
   return typeof value === "string" && value.startsWith("Bearer ") ? value.slice(7) : null;
@@ -39260,14 +40104,14 @@ function installCommand(m, agent, shell = shellBin()) {
 }
 
 // src/services/terminal-diag.ts
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync8, statSync as statSync3, rmSync as rmSync4 } from "node:fs";
-import { join as join15 } from "node:path";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync9, statSync as statSync3, rmSync as rmSync4 } from "node:fs";
+import { join as join16 } from "node:path";
 var DIAG_MAX_BYTES = 2 * 1024 * 1024;
 var KINDS = /* @__PURE__ */ new Set(["key", "comp", "data", "ack", "pred"]);
 var ID = /^[A-Za-z0-9_-]{1,64}$/;
 function diagFile(home3, sessionId2) {
   if (!ID.test(sessionId2)) throw new Error(`id sesi tak sah untuk diag: ${sessionId2}`);
-  return join15(home3, "diag", `${sessionId2}.jsonl`);
+  return join16(home3, "diag", `${sessionId2}.jsonl`);
 }
 function usable(ev) {
   if (!ev || typeof ev !== "object") return false;
@@ -39278,7 +40122,7 @@ function appendDiag(home3, sessionId2, events2) {
   const file = diagFile(home3, sessionId2);
   const rows = events2.filter(usable);
   if (!rows.length) return;
-  mkdirSync8(join15(home3, "diag"), { recursive: true });
+  mkdirSync9(join16(home3, "diag"), { recursive: true });
   try {
     if (statSync3(file).size > DIAG_MAX_BYTES) rmSync4(file);
   } catch {
@@ -39291,7 +40135,103 @@ init_notifications();
 init_stage_machine();
 init_pty();
 init_uploads();
+
+// src/services/session-dialog.ts
+init_tui_dialog();
+init_pty();
+import { createHash as createHash8 } from "node:crypto";
+var DIALOG_CHUNK_MS = 50;
+var screenHashOf = (paneText2) => createHash8("sha256").update(dialogKey(paneText2)).digest("hex").slice(0, 16);
+var answerable = (paneText2) => {
+  const s2 = readDialogScreen(paneText2);
+  if (s2?.kind !== "question") return null;
+  if (!(s2.multi && s2.submit.present) && s2.freeIndex === null && !s2.notes) return null;
+  return s2;
+};
+function readSessionDialog(io) {
+  const text = io.capture();
+  const s2 = answerable(text);
+  if (!s2) return null;
+  return {
+    dialog: {
+      title: s2.title,
+      multi: s2.multi,
+      freeIndex: s2.freeIndex,
+      notes: s2.notes,
+      options: s2.rows.filter((r) => !r.free && !r.chat).map((r) => ({ n: r.n, label: r.label, checked: r.checked })),
+      tabs: s2.tabs
+    },
+    screenHash: screenHashOf(text)
+  };
+}
+async function answerSessionDialog(io, input, chunkMs = DIALOG_CHUNK_MS) {
+  const text = io.capture();
+  const s2 = answerable(text);
+  if (!s2) return { ok: false, reason: "stale" };
+  if (screenHashOf(text) !== input.screenHash) return { ok: false, reason: "stale" };
+  const optionLabel = (n2) => s2.rows.find((r) => r.n === n2 && !r.free && !r.chat)?.label ?? null;
+  if (s2.multi && s2.submit.present) {
+    if (input.choice !== void 0) return { ok: false, reason: "shape" };
+    const pick2 = input.choices ?? [];
+    if (pick2.some((n2) => optionLabel(n2) === null)) return { ok: false, reason: "shape" };
+    if (input.text && s2.freeIndex === null) return { ok: false, reason: "shape" };
+    const ok3 = await answerMultiSelectDialog(
+      io,
+      { pick: pick2, line: input.text ?? "", freeIndex: s2.freeIndex },
+      chunkMs
+    );
+    return ok3 ? { ok: true } : { ok: false, reason: "not-landed" };
+  }
+  if (input.choices !== void 0) return { ok: false, reason: "shape" };
+  const line = input.text ?? (input.choice !== void 0 ? optionLabel(input.choice) : null);
+  if (!line) return { ok: false, reason: "shape" };
+  const ok2 = s2.freeIndex !== null ? await answerChoiceDialog(io, s2.freeIndex, line, chunkMs) : await answerNotesDialog(io, line, chunkMs);
+  return ok2 ? { ok: true } : { ok: false, reason: "not-landed" };
+}
+var answering = /* @__PURE__ */ new Set();
+function beginAnswer(sessionId2) {
+  if (answering.has(sessionId2)) return false;
+  answering.add(sessionId2);
+  return true;
+}
+function endAnswer(sessionId2) {
+  answering.delete(sessionId2);
+}
+var paneIOFactory = paneIO;
+var sessionPaneIO = (id) => paneIOFactory(id);
+
+// src/services/lead/deciding.ts
+var deciding = /* @__PURE__ */ new Set();
+function markDeciding(sessionId2) {
+  deciding.add(sessionId2);
+}
+function clearDeciding(sessionId2) {
+  deciding.delete(sessionId2);
+}
+function isDeciding(sessionId2) {
+  return deciding.has(sessionId2);
+}
+function decidingIds() {
+  return [...deciding];
+}
+var queued = /* @__PURE__ */ new Set();
+function markQueued(sessionId2) {
+  queued.add(sessionId2);
+}
+function clearQueued(sessionId2) {
+  queued.delete(sessionId2);
+}
+function queuedIds() {
+  return [...queued];
+}
+
+// src/routes/terminal.ts
 var ATTACHMENT_MIME = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/webp"]);
+var DIALOG_ANSWER_ERROR = {
+  stale: "layar dialog sudah berubah \u2014 muat ulang pertanyaannya",
+  shape: "bentuk jawaban tak cocok dengan dialog di layar",
+  "not-landed": "jawaban tak mendarat di pane \u2014 sesi tidak digerakkan"
+};
 var TERMINAL_WS_MESSAGES_PER_MINUTE = 6e3;
 var ensureWorktree = (repoDir, wt, branchFrom) => {
   if (realGit.worktreeAlive(wt)) return true;
@@ -39515,6 +40455,33 @@ async function terminal_default(app2, opts) {
     if (!ok2) return reply.code(404).send({ error: "live session not found" });
     return reply.code(202).send({ accepted: true });
   });
+  app2.get("/terminal/sessions/:id/dialog", async (req, reply) => {
+    const { id } = req.params;
+    const s2 = getSession(id);
+    if (!s2) return reply.code(404).send({ error: "not found" });
+    if (s2.exited) return reply.code(204).send();
+    const found = readSessionDialog(sessionPaneIO(id));
+    if (!found) return reply.code(204).send();
+    return found;
+  });
+  app2.post("/terminal/sessions/:id/dialog/answer", async (req, reply) => {
+    const parsed = zSessionDialogAnswer.safeParse(req.body);
+    if (!parsed.success) return reply.code(400).send({ error: "invalid body" });
+    const { id } = req.params;
+    const s2 = getSession(id);
+    if (!s2 || s2.exited) return reply.code(404).send({ error: "live session not found" });
+    if (isDeciding(id))
+      return reply.code(409).send({ error: "hanoman-lead sedang menyusun keputusan untuk sesi ini", reason: "deciding" });
+    if (!beginAnswer(id))
+      return reply.code(409).send({ error: "jawaban lain sedang dikirim ke sesi ini", reason: "answering" });
+    try {
+      const r = await answerSessionDialog(sessionPaneIO(id), parsed.data);
+      if (!r.ok) return reply.code(409).send({ error: DIALOG_ANSWER_ERROR[r.reason], reason: r.reason });
+      return reply.code(202).send({ accepted: true });
+    } finally {
+      endAnswer(id);
+    }
+  });
   const sessionWorktree = async (id) => {
     const s2 = getSession(id);
     if (!s2) return { ok: false, code: 404, msg: "not found" };
@@ -39614,17 +40581,17 @@ async function terminal_default(app2, opts) {
     const guard = new WsMessageGuard({ perWindow: TERMINAL_WS_MESSAGES_PER_MINUTE });
     const client = { send: (m) => socket2.send(m), close: () => socket2.close() };
     attach(id, client);
-    socket2.on("message", async (raw2) => {
+    const watch = createPrincipalWatch({
+      check: () => revalidateWsPrincipal(req, principal),
+      onRevoked: () => socket2.close(1008, "session revoked")
+    });
+    socket2.on("message", (raw2) => {
       const verdict = guard.accept(raw2);
       if (!verdict.ok) {
         socket2.close(verdict.code, verdict.reason);
         return;
       }
-      const valid = await revalidateWsPrincipal(req, principal).catch(() => false);
-      if (!valid) {
-        socket2.close(1008, "session revoked");
-        return;
-      }
+      if (!watch.admit()) return;
       let m;
       try {
         m = JSON.parse(raw2.toString());
@@ -39642,14 +40609,11 @@ async function terminal_default(app2, opts) {
         }
       }
     });
-    const revalidate = setInterval(() => {
-      void revalidateWsPrincipal(req, principal).then((ok2) => {
-        if (!ok2) socket2.close(1008, "session revoked");
-      });
-    }, 6e4);
+    const revalidate = setInterval(() => watch.refresh(), 6e4);
     revalidate.unref?.();
     socket2.on("close", () => {
       clearInterval(revalidate);
+      watch.dispose();
       release();
       detach(id, client);
     });
@@ -39746,7 +40710,7 @@ async function terminalWorkspaceRoutes(app2) {
 // src/routes/vps.ts
 init_db();
 init_src();
-import { readFileSync as readFileSync10, existsSync as existsSync13 } from "node:fs";
+import { readFileSync as readFileSync13, existsSync as existsSync14 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 
 // src/vps/catalog/catalog.data.ts
@@ -39828,15 +40792,130 @@ var SECTIONS = RAW_SECTIONS.map((s2) => ({
 var _map = new Map(CATALOG.map((c) => [c.id, c]));
 var byId = (id) => _map.get(id);
 
-// src/services/vps-remediate.ts
-import { readFileSync as readFileSync8 } from "node:fs";
+// src/vps/catalog/components.ts
+var BOTH = ["lab", "production"];
+var COMPONENTS = [
+  {
+    id: "base",
+    label: "Paket dasar (curl, git, tmux, toolchain node-pty)",
+    section: "dasar",
+    requires: { lab: [], production: [] },
+    profiles: BOTH,
+    interactiveLogin: false,
+    needsDomain: false
+  },
+  {
+    id: "node",
+    label: "Node.js 22 LTS",
+    section: "dasar",
+    requires: { lab: ["base"], production: ["base"] },
+    profiles: BOTH,
+    interactiveLogin: false,
+    needsDomain: false
+  },
+  {
+    id: "hanoman",
+    label: "hanoman (npm global + user service + systemd)",
+    section: "hanoman",
+    requires: { lab: ["node"], production: ["node", "podman"] },
+    profiles: BOTH,
+    interactiveLogin: false,
+    needsDomain: false
+  },
+  {
+    id: "caddy",
+    label: "Caddy + TLS otomatis",
+    section: "ingress",
+    requires: { lab: [], production: [] },
+    profiles: BOTH,
+    interactiveLogin: false,
+    needsDomain: true
+  },
+  {
+    id: "podman",
+    label: "Podman rootless + network egress",
+    section: "sandbox",
+    requires: { lab: ["base"], production: ["base"] },
+    profiles: BOTH,
+    interactiveLogin: false,
+    needsDomain: false
+  },
+  {
+    id: "agent-image",
+    label: "Image agen hanoman-agent:latest",
+    section: "sandbox",
+    requires: { lab: [], production: ["podman"] },
+    profiles: ["production"],
+    interactiveLogin: false,
+    needsDomain: false
+  },
+  {
+    id: "claude",
+    label: "Claude Code CLI",
+    section: "agen",
+    requires: { lab: ["node"], production: ["agent-image"] },
+    profiles: BOTH,
+    interactiveLogin: true,
+    needsDomain: false
+  },
+  {
+    id: "codex",
+    label: "Codex CLI",
+    section: "agen",
+    requires: { lab: ["node"], production: ["agent-image"] },
+    profiles: BOTH,
+    interactiveLogin: true,
+    needsDomain: false
+  },
+  {
+    id: "gh",
+    label: "GitHub CLI",
+    section: "agen",
+    requires: { lab: ["base"], production: ["base"] },
+    profiles: BOTH,
+    interactiveLogin: true,
+    needsDomain: false
+  }
+];
+var BY_ID = new Map(COMPONENTS.map((c) => [c.id, c]));
+var componentById = (id) => BY_ID.get(id);
+function resolveComponents(ids, profile) {
+  if (ids.length === 0) return { ok: false, error: "tak ada komponen yang dipilih" };
+  const out4 = [];
+  const seen = /* @__PURE__ */ new Set();
+  const stack = /* @__PURE__ */ new Set();
+  const visit = (id) => {
+    const c = componentById(id);
+    if (!c) return `komponen tak dikenal: ${id}`;
+    if (!c.profiles.includes(profile)) return `komponen ${id} tak tersedia di profil ${profile}`;
+    if (seen.has(id)) return null;
+    if (stack.has(id)) return `siklus dependensi pada ${id}`;
+    stack.add(id);
+    for (const dep of c.requires[profile]) {
+      const err = visit(dep);
+      if (err) return err;
+    }
+    stack.delete(id);
+    seen.add(id);
+    out4.push(id);
+    return null;
+  };
+  for (const id of ids) {
+    const err = visit(id);
+    if (err) return { ok: false, error: err };
+  }
+  return { ok: true, items: out4 };
+}
+
+// src/services/vps-provision.ts
+import { readFileSync as readFileSync10 } from "node:fs";
 
 // src/services/vps-ssh.ts
 init_config2();
 import { spawn as spawn4 } from "node:child_process";
-import { mkdtempSync, rmSync as rmSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { mkdtempSync, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname10, join as join16 } from "node:path";
+import { dirname as dirname10, join as join17 } from "node:path";
 var sshBin = () => effectiveStr("HANOMAN_SSH_BIN") ?? "ssh";
 function consoleArgv(t) {
   return [
@@ -39851,9 +40930,9 @@ function consoleArgv(t) {
   ];
 }
 function askpassScript() {
-  const dir2 = mkdtempSync(join16(tmpdir3(), "hanoman-askpass-"));
-  const path2 = join16(dir2, "askpass.sh");
-  writeFileSync4(path2, `#!/bin/sh
+  const dir2 = mkdtempSync(join17(tmpdir3(), "hanoman-askpass-"));
+  const path2 = join17(dir2, "askpass.sh");
+  writeFileSync5(path2, `#!/bin/sh
 printf '%s' "$HANOMAN_SSH_PASSWORD"
 `, { mode: 448 });
   return path2;
@@ -39912,16 +40991,17 @@ function sshExec(t, remoteCmd, opts = {}) {
 
 // src/services/vps-audit.ts
 init_db();
-import { readFileSync as readFileSync7 } from "node:fs";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
+import { join as join19 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/runner/deps.ts
 import { existsSync as existsSync11 } from "node:fs";
-import { dirname as dirname11, join as join17 } from "node:path";
+import { dirname as dirname11, join as join18 } from "node:path";
 function repoRootFrom(startDir) {
   let dir2 = startDir;
   for (let i = 0; i < 8; i++) {
-    if (existsSync11(join17(dir2, "pnpm-workspace.yaml"))) return dir2;
+    if (existsSync11(join18(dir2, "pnpm-workspace.yaml"))) return dir2;
     const parent = dirname11(dir2);
     if (parent === dir2) break;
     dir2 = parent;
@@ -40027,7 +41107,12 @@ function parseHealth(out4) {
   return { uptime: h.uptime ?? "", disk: h.disk ?? "", mem: h.mem ?? "", load: h.load ?? "" };
 }
 var target = (v) => ({ host: v.host, port: v.port, user: v.user, keyPath: v.keyPath });
-var scriptPath = (f) => join18(repoRoot(), "server", "scripts", "vps", f);
+var packagedScript = (f) => fileURLToPath3(new URL(`../scripts/vps/${f}`, import.meta.url));
+var moduleDir = () => fileURLToPath3(new URL(".", import.meta.url));
+var scriptPath = (f) => {
+  const packed = packagedScript(f);
+  return existsSync12(packed) ? packed : join19(repoRoot(moduleDir()), "server", "scripts", "vps", f);
+};
 async function itemStatesOf(vpsId) {
   const rows = await prisma.vpsItemState.findMany({ where: { vpsId } });
   return Object.fromEntries(rows.map((s2) => [s2.itemId, { na: s2.na, attested: s2.attested }]));
@@ -40036,7 +41121,7 @@ async function runAudit(v) {
   const r = await sshExec(
     target(v),
     "sudo -n bash -s",
-    { stdin: readFileSync7(scriptPath("audit.sh"), "utf8"), timeoutMs: 6e4 }
+    { stdin: readFileSync9(scriptPath("audit.sh"), "utf8"), timeoutMs: 6e4 }
   );
   const audit = parseAudit(r.out);
   if (r.code !== 0 || audit.length === 0) return { ok: false, out: r.out };
@@ -40072,19 +41157,78 @@ async function runAudit(v) {
   await notifySynced("vps", v.id);
   return { ok: true, audit, hardened, scoreTotal: scored.total, scoreBySection: scored.bySection, drift };
 }
+var PUBLISH_HEARTBEAT_MS = 36e5;
+function shouldPublishHealth(prev, next, now = Date.now()) {
+  if (JSON.stringify(prev?.health ?? null) !== JSON.stringify(next ?? null)) return true;
+  if (!prev?.lastPublishedAt) return true;
+  return now - prev.lastPublishedAt.getTime() >= PUBLISH_HEARTBEAT_MS;
+}
 async function runHealth(v) {
   const r = await sshExec(target(v), HEALTH_CMD, { timeoutMs: 6e4 });
   const health = parseHealth(r.out);
   if (r.code !== 0 || !health) return false;
+  const prev = await prisma.vps.findUnique({
+    where: { id: v.id },
+    select: { health: true, lastPublishedAt: true }
+  });
+  const publish = shouldPublishHealth(prev, health);
   await prisma.vps.update({ where: { id: v.id }, data: {
     health,
-    lastSeenAt: /* @__PURE__ */ new Date()
+    lastSeenAt: /* @__PURE__ */ new Date(),
+    ...publish ? { lastPublishedAt: /* @__PURE__ */ new Date() } : {}
   } });
-  await notifySynced("vps", v.id);
+  if (publish) await notifySynced("vps", v.id);
   return true;
 }
 
+// src/services/vps-provision.ts
+var PROVISION_TIMEOUT_MS = 9e5;
+var PROBE_TIMEOUT_MS = 6e4;
+var STATUSES = ["ok", "partial", "absent"];
+function parseComponents(out4) {
+  return out4.split("\n").flatMap((line) => {
+    const m = line.match(/^COMP (\S+) (\S+)(?: (.*))?$/);
+    if (!m) return [];
+    const [, id, status] = m;
+    if (!componentById(id)) return [];
+    if (!STATUSES.includes(status)) return [];
+    return [{ id, status, detail: (m[3] ?? "").trim() }];
+  });
+}
+function parseProvisionSteps(out4) {
+  return out4.split("\n").flatMap((line) => {
+    const m = line.match(/^STEP (\S+) (would|ok|fail|skip)(?: (.*))?$/);
+    return m ? [{ item: m[1], status: m[2], detail: (m[3] ?? "").trim() }] : [];
+  });
+}
+var script = () => readFileSync10(scriptPath("provision.sh"), "utf8");
+async function probeComponents(v) {
+  const r = await sshExec(v, "env MODE=probe bash -s", { stdin: script(), timeoutMs: PROBE_TIMEOUT_MS });
+  const components2 = parseComponents(r.out);
+  if (r.code !== 0 || components2.length === 0) return { ok: false, out: r.out };
+  return { ok: true, components: components2 };
+}
+async function provision(v, items, opts) {
+  const env = [
+    "MODE=apply",
+    `ITEMS=${items.join(",")}`,
+    `PROFILE=${opts.profile}`,
+    ...opts.domain ? [`DOMAIN=${opts.domain}`] : [],
+    ...opts.dryRun ? ["DRY_RUN=1"] : []
+  ].join(" ");
+  const r = await sshExec(v, `sudo -n env ${env} bash -s`, { stdin: script(), timeoutMs: PROVISION_TIMEOUT_MS });
+  return { ok: r.code === 0, steps: parseProvisionSteps(r.out), out: r.out };
+}
+async function readSetupToken(v, home3 = "/var/lib/hanoman") {
+  const r = await sshExec(v, `sudo -n cat ${home3}/setup.token`, { timeoutMs: 15e3 });
+  if (r.code !== 0) return null;
+  const [token, expires] = r.out.trim().split("\n");
+  if (!token || !expires) return null;
+  return Date.parse(expires) > Date.now() ? token : null;
+}
+
 // src/services/vps-remediate.ts
+import { readFileSync as readFileSync11 } from "node:fs";
 function parseSteps(out4) {
   return out4.split("\n").flatMap((line) => {
     const m = line.match(/^STEP (\S+) (would|ok|fail)(?: (.*))?$/);
@@ -40095,7 +41239,7 @@ async function remediate(v, items, dryRun) {
   const r = await sshExec(
     v,
     `sudo -n env ITEMS=${items.join(",")} SSH_PORT=${v.port} DRY_RUN=${dryRun ? "1" : ""} bash -s`,
-    { stdin: readFileSync8(scriptPath("remediate.sh"), "utf8"), timeoutMs: 3e5 }
+    { stdin: readFileSync11(scriptPath("remediate.sh"), "utf8"), timeoutMs: 3e5 }
   );
   return { ok: r.code === 0, steps: parseSteps(r.out), out: r.out };
 }
@@ -40174,39 +41318,39 @@ async function buildChecklist(vpsId) {
 // src/services/vps-key.ts
 init_src2();
 init_config2();
-import { execFileSync as execFileSync2 } from "node:child_process";
-import { chmodSync as chmodSync3, copyFileSync, existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync9, unlinkSync as unlinkSync2 } from "node:fs";
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { chmodSync as chmodSync4, copyFileSync, existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync12, unlinkSync as unlinkSync2 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 var keyDir = () => effectiveStr("HANOMAN_SSH_KEY_DIR") ?? resolveDataDirs().sshKeys;
 var KEY_FILES = ["id_ed25519", "id_ed25519.pub"];
 function adoptLegacyKey(dir2) {
   if (effectiveStr("HANOMAN_SSH_KEY_DIR")) return;
-  const legacy = join19(homedir5(), ".hanoman");
+  const legacy = join20(homedir5(), ".hanoman");
   if (legacy === dir2) return;
-  if (!KEY_FILES.every((f) => existsSync12(join19(legacy, f)))) return;
-  mkdirSync9(dir2, { recursive: true, mode: 448 });
+  if (!KEY_FILES.every((f) => existsSync13(join20(legacy, f)))) return;
+  mkdirSync10(dir2, { recursive: true, mode: 448 });
   for (const f of KEY_FILES) {
-    copyFileSync(join19(legacy, f), join19(dir2, f));
-    chmodSync3(join19(dir2, f), 384);
+    copyFileSync(join20(legacy, f), join20(dir2, f));
+    chmodSync4(join20(dir2, f), 384);
   }
-  for (const f of KEY_FILES) unlinkSync2(join19(legacy, f));
+  for (const f of KEY_FILES) unlinkSync2(join20(legacy, f));
   console.log(`vps: key SSH dipindah dari ${legacy} ke ${dir2} (SPEC-846 \u2014 satu batas backup)`);
 }
 function ensureHanomanKey() {
   const dir2 = keyDir();
-  const privPath = join19(dir2, KEY_FILES[0]);
+  const privPath = join20(dir2, KEY_FILES[0]);
   const pubPath = `${privPath}.pub`;
-  if (!existsSync12(privPath)) adoptLegacyKey(dir2);
-  if (!existsSync12(privPath)) {
-    mkdirSync9(dir2, { recursive: true, mode: 448 });
-    execFileSync2(
+  if (!existsSync13(privPath)) adoptLegacyKey(dir2);
+  if (!existsSync13(privPath)) {
+    mkdirSync10(dir2, { recursive: true, mode: 448 });
+    execFileSync3(
       "ssh-keygen",
       ["-t", "ed25519", "-N", "", "-C", "hanoman", "-f", privPath],
       { stdio: ["ignore", "ignore", "pipe"] }
     );
   }
-  return { privPath, pubPath, pub: readFileSync9(pubPath, "utf8").trim() };
+  return { privPath, pubPath, pub: readFileSync12(pubPath, "utf8").trim() };
 }
 
 // src/services/vps-bootstrap.ts
@@ -40225,7 +41369,7 @@ async function bootstrapKey(t, password) {
 init_pty();
 init_settings2();
 function keyMissing(v) {
-  return !!v.keyPath && !existsSync13(v.keyPath);
+  return !!v.keyPath && !existsSync14(v.keyPath);
 }
 async function vps_default(app2) {
   app2.get("/vps", async () => prisma.vps.findMany({ orderBy: { createdAt: "asc" } }));
@@ -40373,6 +41517,79 @@ async function vps_default(app2) {
       scoreBySection: audit.ok ? audit.scoreBySection : null
     };
   });
+  app2.get("/vps/components", async () => ({ components: COMPONENTS }));
+  function planItems(items, profile, domain) {
+    const r = resolveComponents(items, profile);
+    if (!r.ok) return r;
+    const needsDomain = r.items.some((id) => componentById(id)?.needsDomain);
+    if (needsDomain && !domain) return { ok: false, error: "domain wajib untuk komponen ingress" };
+    return r;
+  }
+  async function runProbe(v) {
+    const r = await probeComponents(v);
+    if (!r.ok) return r;
+    const map = {};
+    for (const c of r.components) map[c.id] = { status: c.status, detail: c.detail };
+    const checkedAt = /* @__PURE__ */ new Date();
+    await prisma.vps.update({ where: { id: v.id }, data: { components: map, componentsCheckedAt: checkedAt } });
+    return { ok: true, components: r.components, checkedAt };
+  }
+  app2.post("/vps/:id/probe", async (req, reply) => {
+    const v = await prisma.vps.findUnique({ where: { id: req.params.id } });
+    if (!v) return reply.code(404).send({ error: "not found" });
+    if (keyMissing(v)) return reply.code(409).send({ error: "key VPS tidak ada di mesin ini", keyMissing: true });
+    const r = await runProbe(v);
+    if (!r.ok) return reply.code(502).send({ error: "probe gagal lewat ssh", out: r.out });
+    return { components: r.components, checkedAt: r.checkedAt.toISOString() };
+  });
+  app2.post("/vps/:id/provision/preview", async (req, reply) => {
+    const v = await prisma.vps.findUnique({ where: { id: req.params.id } });
+    if (!v) return reply.code(404).send({ error: "not found" });
+    if (keyMissing(v)) return reply.code(409).send({ error: "key VPS tidak ada di mesin ini", keyMissing: true });
+    const p = zProvision.safeParse(req.body);
+    if (!p.success) return reply.code(400).send({ error: "invalid body" });
+    const plan = planItems(p.data.items, p.data.profile, p.data.domain);
+    if (!plan.ok) return reply.code(400).send({ error: plan.error });
+    const r = await provision(v, plan.items, { profile: p.data.profile, domain: p.data.domain, dryRun: true });
+    if (!r.ok) return reply.code(502).send({ error: "preview gagal lewat ssh", out: r.out });
+    return { steps: r.steps };
+  });
+  app2.post("/vps/:id/provision", async (req, reply) => {
+    const v = await prisma.vps.findUnique({ where: { id: req.params.id } });
+    if (!v) return reply.code(404).send({ error: "not found" });
+    if (keyMissing(v)) return reply.code(409).send({ error: "key VPS tidak ada di mesin ini", keyMissing: true });
+    const p = zProvision.safeParse(req.body);
+    if (!p.success) return reply.code(400).send({ error: "invalid body" });
+    const plan = planItems(p.data.items, p.data.profile, p.data.domain);
+    if (!plan.ok) return reply.code(400).send({ error: plan.error });
+    if (!p.data.confirm) {
+      const dry = await provision(v, plan.items, { profile: p.data.profile, domain: p.data.domain, dryRun: true });
+      if (!dry.ok) return reply.code(502).send({ error: "dry-run gagal lewat ssh", out: dry.out });
+      return reply.code(409).send({ error: "confirm-required", steps: dry.steps });
+    }
+    const installed = v.components?.hanoman?.status === "ok";
+    if (installed && v.provisionProfile && v.provisionProfile !== p.data.profile && !p.data.force) {
+      return reply.code(409).send({ error: "profile-mismatch", current: v.provisionProfile });
+    }
+    const r = await provision(v, plan.items, { profile: p.data.profile, domain: p.data.domain, dryRun: false });
+    if (!r.ok) return reply.code(502).send({ error: "provision gagal lewat ssh", transcript: r.out, steps: r.steps });
+    const probe = await runProbe(v);
+    if (!probe.ok) return reply.code(502).send({ error: "probe pasca-provision gagal", transcript: r.out, steps: r.steps });
+    await prisma.vps.update({ where: { id: v.id }, data: { provisionProfile: p.data.profile } });
+    let setup = null;
+    const hanomanOk = probe.components.some((c) => c.id === "hanoman" && c.status === "ok");
+    if (hanomanOk) {
+      const token = await readSetupToken(v);
+      if (token) {
+        const base2 = p.data.domain ? `https://${p.data.domain}` : `http://${v.host}:8787`;
+        setup = {
+          url: `${base2}/setup?token=${encodeURIComponent(token)}`,
+          expiresAt: new Date(Date.now() + 15 * 6e4).toISOString()
+        };
+      }
+    }
+    return { steps: r.steps, components: probe.components, checkedAt: probe.checkedAt.toISOString(), setup };
+  });
   app2.post("/vps/:id/harden", async (req, reply) => {
     const v = await prisma.vps.findUnique({ where: { id: req.params.id } });
     if (!v) return reply.code(404).send({ error: "not found" });
@@ -40380,7 +41597,7 @@ async function vps_default(app2) {
     const r = await sshExec(
       v,
       `sudo -n env SSH_PORT=${v.port} SSH_USER=${v.user} bash -s`,
-      { stdin: readFileSync10(scriptPath("harden.sh"), "utf8"), timeoutMs: 3e5 }
+      { stdin: readFileSync13(scriptPath("harden.sh"), "utf8"), timeoutMs: 3e5 }
     );
     if (r.code !== 0) return reply.code(502).send({ error: "harden gagal lewat ssh", transcript: r.out });
     const verify = await sshExec(v, "true", { timeoutMs: 3e4 });
@@ -40431,10 +41648,10 @@ async function vps_default(app2) {
 
 // src/services/limits.ts
 init_config2();
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { readFileSync as readFileSync11 } from "node:fs";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { readFileSync as readFileSync14 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 var USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 var TTL_MS2 = 3e4;
 var lastOk = null;
@@ -40447,12 +41664,12 @@ var LABELS = {
 var humanize = (k) => k.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
 var nowIso = () => (/* @__PURE__ */ new Date()).toISOString();
 function credsFile() {
-  return join20(effectiveStr("CLAUDE_CONFIG_DIR") ?? join20(homedir7(), ".claude"), ".credentials.json");
+  return join21(effectiveStr("CLAUDE_CONFIG_DIR") ?? join21(homedir7(), ".claude"), ".credentials.json");
 }
 function readAccessToken() {
   if (process.platform === "darwin" && !effectiveStr("CLAUDE_CONFIG_DIR")) {
     try {
-      const blob = execFileSync3(
+      const blob = execFileSync4(
         "security",
         ["find-generic-password", "-s", "Claude Code-credentials", "-w"],
         { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
@@ -40463,7 +41680,7 @@ function readAccessToken() {
     }
   }
   try {
-    return JSON.parse(readFileSync11(credsFile(), "utf8"))?.claudeAiOauth?.accessToken ?? null;
+    return JSON.parse(readFileSync14(credsFile(), "utf8"))?.claudeAiOauth?.accessToken ?? null;
   } catch {
     return null;
   }
@@ -40521,14 +41738,14 @@ async function getLimits() {
 // src/services/codex-limits.ts
 import { open as open3, readdir as readdir4, stat as stat2 } from "node:fs/promises";
 import { homedir as homedir8 } from "node:os";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 var TTL_MS3 = 3e4;
 var STALE_AFTER_MS = 12 * 36e5;
 var TAIL_BYTES = 512 * 1024;
 var MAX_FILES = 8;
 var cache3 = null;
 var freshUntil2 = 0;
-var codexSessionsDir = () => join21(process.env.CODEX_HOME ?? join21(homedir8(), ".codex"), "sessions");
+var codexSessionsDir = () => join22(process.env.CODEX_HOME ?? join22(homedir8(), ".codex"), "sessions");
 var UNAVAILABLE = { status: "unavailable", windows: [], fetchedAt: null, plan: null };
 function windowLabel(minutes) {
   if (minutes === 300) return "Sesi 5 jam";
@@ -40561,7 +41778,7 @@ async function recentRollouts(dir2) {
     return [];
   }
   const stamped = await Promise.all(entries.map(async (rel) => {
-    const full = join21(dir2, rel);
+    const full = join22(dir2, rel);
     try {
       return { full, mtime: (await stat2(full)).mtimeMs };
     } catch {
@@ -40641,9 +41858,9 @@ async function limits(app2) {
 // src/services/codex-version.ts
 init_src();
 init_config2();
-import { execFile as execFile11 } from "node:child_process";
+import { execFile as execFile12 } from "node:child_process";
 import { promisify as promisify12 } from "node:util";
-var run = promisify12(execFile11);
+var run2 = promisify12(execFile12);
 var CODEX_MIN_CLIENT = "0.144.0";
 var TTL_MS4 = 5 * 6e4;
 var cache4 = null;
@@ -40656,7 +41873,7 @@ async function getCodexVersion(now = Date.now()) {
   if (cache4 && now - cache4.at < TTL_MS4) return cache4.version;
   let version2 = null;
   try {
-    const { stdout } = await run(codexBin2(), ["--version"], { timeout: 5e3 });
+    const { stdout } = await run2(codexBin2(), ["--version"], { timeout: 5e3 });
     version2 = parseCodexVersion(stdout);
   } catch {
   }
@@ -40688,9 +41905,9 @@ init_src();
 // src/services/update.ts
 init_src();
 init_config2();
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync15 } from "node:fs";
 import { resolve as resolve18, dirname as dirname12 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 var UPDATE_COMMAND = "npm i -g hanoman@latest --prefer-online";
 function composeUpdate(x) {
   const available = x.registryStatus === "ok" && x.latestVersion != null && compareSemver(x.latestVersion, x.currentVersion) > 0;
@@ -40714,10 +41931,10 @@ var lastFetchAt = 0;
 var lastLatest = null;
 var lastStatus = "unavailable";
 function runningVersion() {
-  const here = dirname12(fileURLToPath3(import.meta.url));
+  const here = dirname12(fileURLToPath4(import.meta.url));
   for (const p of [resolve18(here, "build-info.json"), resolve18(here, "../package.json")]) {
     try {
-      const v = JSON.parse(readFileSync12(p, "utf8")).version;
+      const v = JSON.parse(readFileSync15(p, "utf8")).version;
       if (typeof v === "string" && v) return v;
     } catch {
     }
@@ -40794,33 +42011,6 @@ async function update(app2) {
 // src/services/events.ts
 init_pty();
 init_notifications();
-
-// src/services/lead/deciding.ts
-var deciding = /* @__PURE__ */ new Set();
-function markDeciding(sessionId2) {
-  deciding.add(sessionId2);
-}
-function clearDeciding(sessionId2) {
-  deciding.delete(sessionId2);
-}
-function isDeciding(sessionId2) {
-  return deciding.has(sessionId2);
-}
-function decidingIds() {
-  return [...deciding];
-}
-var queued = /* @__PURE__ */ new Set();
-function markQueued(sessionId2) {
-  queued.add(sessionId2);
-}
-function clearQueued(sessionId2) {
-  queued.delete(sessionId2);
-}
-function queuedIds() {
-  return [...queued];
-}
-
-// src/services/events.ts
 init_db();
 init_config2();
 var clients = /* @__PURE__ */ new Set();
@@ -40832,7 +42022,9 @@ var GROUPS = [
   // service itu sengaja tak tahu apa-apa soal lead maupun DB.
   { everyTicks: 1, last: "", build: async () => ({
     t: "sessions",
-    sessions: listSessions().map((s2) => isDeciding(s2.id) ? { ...s2, deciding: true } : s2)
+    // Asinkron: grup ini di-recompute tiap detik, dan `execFileSync` tmux memblokir seluruh event
+    // loop — termasuk frame ketikan terminal — selama spawn (terukur sampai 916 ms saat mesin sibuk).
+    sessions: (await listSessionsAsync()).map((s2) => isDeciding(s2.id) ? { ...s2, deciding: true } : s2)
   }) },
   { everyTicks: 1, last: "", build: async () => ({ t: "specs", specs: await liveSpecs() }) },
   { everyTicks: 3, last: "", build: async () => ({ t: "notifications", ...await notificationsFeed() }) },
@@ -41033,6 +42225,7 @@ async function bindings_default(app2) {
 // src/routes/sync.ts
 init_zod();
 init_db();
+import { gzipSync } from "node:zlib";
 
 // src/services/device-auth.ts
 function bearerToken2(req) {
@@ -41088,10 +42281,21 @@ var zPush = external_exports.object({
   }))
 });
 var AUTHORED = ["spec", "sessionResult"];
+function maybeGzip(req, reply, payload) {
+  reply.header("vary", "accept-encoding");
+  if (!/\bgzip\b/.test(String(req.headers["accept-encoding"] ?? ""))) return payload;
+  reply.header("content-type", "application/json; charset=utf-8");
+  reply.header("content-encoding", "gzip");
+  return gzipSync(Buffer.from(JSON.stringify(payload)));
+}
 async function sync_default(app2) {
-  app2.get("/sync/pull", { preHandler: requireDeviceToken }, async (req) => {
+  app2.get("/sync/pull", { preHandler: requireDeviceToken }, async (req, reply) => {
     const since = req.query.since ?? "0";
-    return pull(since);
+    return maybeGzip(req, reply, await pull(since));
+  });
+  app2.get("/sync/bootstrap", { preHandler: requireDeviceToken }, async (req, reply) => {
+    const after = req.query.after ?? null;
+    return maybeGzip(req, reply, await bootstrapSnapshot(after));
   });
   app2.get("/sync/attachments/:storageKey", { preHandler: requireDeviceToken }, async (req, reply) => {
     const { storageKey } = req.params;
@@ -41114,8 +42318,13 @@ async function sync_default(app2) {
       }
       const data = { ...rec.data };
       if (AUTHORED.includes(rec.entity) && !data.author && user) data.author = user.email;
-      const r = await applyPush(rec.entity, rec.id, rec.baseVersion, data, req.device.id, rec.op ?? "upsert");
-      results.push({ id: rec.id, ...r });
+      try {
+        const r = await applyPush(rec.entity, rec.id, rec.baseVersion, data, req.device.id, rec.op ?? "upsert");
+        results.push({ id: rec.id, ...r });
+      } catch (e) {
+        req.log.warn({ entity: rec.entity, recordId: rec.id, err: e }, "sync push record ditolak");
+        results.push({ id: rec.id, ok: false, error: e.message });
+      }
     }
     return { results };
   });
@@ -41232,7 +42441,7 @@ init_config2();
 init_src2();
 import { randomUUID as randomUUID7 } from "node:crypto";
 import { mkdir as mkdir5, writeFile as writeFile4, readFile as readFile4, unlink as unlink4, readdir as readdir5, stat as stat3 } from "node:fs/promises";
-import { join as join22, resolve as resolve19, basename as basename6 } from "node:path";
+import { join as join23, resolve as resolve19, basename as basename6 } from "node:path";
 var MAX_TRANSCRIPT_BYTES = 1024 * 1024;
 function transcriptDir() {
   return resolve19(effectiveStr("HANOMAN_TRANSCRIPT_DIR")?.trim() || resolveDataDirs().transcripts);
@@ -41253,13 +42462,13 @@ async function saveTranscript(text) {
   const dir2 = transcriptDir();
   await mkdir5(dir2, { recursive: true, mode: 448 });
   const key = `${randomUUID7()}.log`;
-  await writeFile4(join22(dir2, key), body, { encoding: "utf8", mode: 384 });
+  await writeFile4(join23(dir2, key), body, { encoding: "utf8", mode: 384 });
   return { key, bytes: Buffer.byteLength(body, "utf8"), truncated };
 }
 async function readTranscript(key) {
   if (!key) return null;
   try {
-    return await readFile4(join22(transcriptDir(), basename6(key)), "utf8");
+    return await readFile4(join23(transcriptDir(), basename6(key)), "utf8");
   } catch {
     return null;
   }
@@ -41267,7 +42476,7 @@ async function readTranscript(key) {
 async function deleteTranscript(key) {
   if (!key) return;
   try {
-    await unlink4(join22(transcriptDir(), basename6(key)));
+    await unlink4(join23(transcriptDir(), basename6(key)));
   } catch (e) {
     if (e.code !== "ENOENT") throw e;
   }
@@ -41285,7 +42494,7 @@ async function listTranscripts() {
   for (const name2 of names) {
     if (!name2.endsWith(".log")) continue;
     try {
-      rows.push({ key: name2, mtimeMs: (await stat3(join22(dir2, name2))).mtimeMs });
+      rows.push({ key: name2, mtimeMs: (await stat3(join23(dir2, name2))).mtimeMs });
     } catch {
     }
   }
@@ -41598,9 +42807,9 @@ init_db();
 init_db();
 init_uploads();
 init_src();
-import { createHash as createHash8, randomBytes as randomBytes6 } from "node:crypto";
+import { createHash as createHash9, randomBytes as randomBytes6 } from "node:crypto";
 function hashAccessKey(key) {
-  return createHash8("sha256").update(key).digest("hex");
+  return createHash9("sha256").update(key).digest("hex");
 }
 function generateAccessKey() {
   const key = "hnm_tkt_" + randomBytes6(24).toString("hex");
@@ -42162,11 +43371,11 @@ async function expireStale(now) {
   const stale = await prisma.schedulerCronRun.findMany({
     where: { status: "queued", dueAt: { lt: new Date(now - GRACE_MS) } }
   });
-  for (const run2 of stale) {
-    const note = run2.note ?? "tak terluncurkan sampai batas keterlambatan";
-    await prisma.schedulerCronRun.update({ where: { id: run2.id }, data: { status: "skipped", note } });
-    const cron = await prisma.schedulerCron.findUnique({ where: { id: run2.cronId } });
-    await recordCronRun(run2.cronId, cron?.name ?? run2.cronId, run2.projectId, run2.dueAt, "skipped", note);
+  for (const run3 of stale) {
+    const note = run3.note ?? "tak terluncurkan sampai batas keterlambatan";
+    await prisma.schedulerCronRun.update({ where: { id: run3.id }, data: { status: "skipped", note } });
+    const cron = await prisma.schedulerCron.findUnique({ where: { id: run3.cronId } });
+    await recordCronRun(run3.cronId, cron?.name ?? run3.cronId, run3.projectId, run3.dueAt, "skipped", note);
   }
 }
 function queuedCronRuns() {
@@ -42403,10 +43612,10 @@ async function scheduler_default(app2) {
     const pending2 = await prisma.schedulerCronRun.findFirst({ where: { cronId: id, status: "queued" } });
     if (pending2) return reply.code(409).send({ error: "masih ada run yang menunggu dijalankan", runId: pending2.id });
     try {
-      const run2 = await prisma.schedulerCronRun.create({
+      const run3 = await prisma.schedulerCronRun.create({
         data: { cronId: id, projectId: cron.projectId, dueAt: /* @__PURE__ */ new Date(), manual: true }
       });
-      return reply.code(201).send(runView(run2));
+      return reply.code(201).send(runView(run3));
     } catch {
       return reply.code(409).send({ error: "run untuk jatuh tempo ini sudah ada" });
     }
@@ -42554,8 +43763,8 @@ function leadPrompt(q, c) {
 
 // src/services/lead/verdict.ts
 init_src();
-import { existsSync as existsSync14 } from "node:fs";
-import { isAbsolute as isAbsolute5, resolve as resolvePath, relative as relative2 } from "node:path";
+import { existsSync as existsSync15 } from "node:fs";
+import { isAbsolute as isAbsolute6, resolve as resolvePath, relative as relative2 } from "node:path";
 function extractJsonBlock(raw2) {
   const re = /```json\s*\n([\s\S]*?)```/g;
   let last = null;
@@ -42588,11 +43797,11 @@ function keepExistingRefs(refs2, repoDir) {
       continue;
     }
     if (!repoDir) continue;
-    if (isAbsolute5(ref)) continue;
+    if (isAbsolute6(ref)) continue;
     const full = resolvePath(repoDir, ref);
     const rel = relative2(repoDir, full);
     if (rel.startsWith("..")) continue;
-    if (existsSync14(full)) out4.push(ref);
+    if (existsSync15(full)) out4.push(ref);
   }
   return [...new Set(out4)];
 }
@@ -42740,14 +43949,15 @@ function toDecisionView(r) {
 }
 
 // src/services/lead/brain.ts
+init_src2();
 init_config2();
 init_pty();
 init_session_sandbox();
-import { execFile as execFile12 } from "node:child_process";
+import { execFile as execFile13 } from "node:child_process";
 import { randomUUID as randomUUID9 } from "node:crypto";
-import { mkdirSync as mkdirSync10, rmSync as rmSync6, writeFileSync as writeFileSync5 } from "node:fs";
+import { mkdirSync as mkdirSync11, rmSync as rmSync6, writeFileSync as writeFileSync6 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 var binFor = (agent) => agent === "codex" ? effectiveStr("HANOMAN_CODEX_BIN") ?? "codex" : effectiveStr("HANOMAN_CLAUDE_BIN") ?? "claude";
 function leadArgv(o) {
   if (o.agent === "codex") {
@@ -42772,15 +43982,15 @@ var shellQuote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
 function leadProcess(prompt, o, env = process.env) {
   const file = binFor(o.agent);
   const directArgs = leadArgv({ agent: o.agent, model: o.model, effort: o.effort, prompt });
-  const mode = env.HANOMAN_SESSION_SANDBOX ?? (env.NODE_ENV === "production" ? "required" : "off");
+  const mode = env.HANOMAN_SESSION_SANDBOX ?? (resolveHardening(env) ? "required" : "off");
   if (mode === "off") return { file, args: directArgs, cwd: o.cwd, cleanup: () => {
   } };
-  const promptDir = join23(tmpdir4(), "hanoman-prompts");
-  mkdirSync10(promptDir, { recursive: true, mode: 448 });
-  const promptFile = join23(promptDir, `oneshot-${randomUUID9()}`);
-  writeFileSync5(promptFile, prompt, { flag: "wx", mode: 384 });
-  const workspace = o.cwd ?? join23(tmpdir4(), `hanoman-oneshot-${randomUUID9()}`);
-  if (!o.cwd) mkdirSync10(workspace, { recursive: false, mode: 448 });
+  const promptDir = join24(tmpdir4(), "hanoman-prompts");
+  mkdirSync11(promptDir, { recursive: true, mode: 448 });
+  const promptFile = join24(promptDir, `oneshot-${randomUUID9()}`);
+  writeFileSync6(promptFile, prompt, { flag: "wx", mode: 384 });
+  const workspace = o.cwd ?? join24(tmpdir4(), `hanoman-oneshot-${randomUUID9()}`);
+  if (!o.cwd) mkdirSync11(workspace, { recursive: false, mode: 448 });
   try {
     const argsWithoutPrompt = directArgs.slice(0, -1);
     const command = [file, ...argsWithoutPrompt].map(shellQuote).join(" ") + ` "$(cat ${shellQuote(promptFile)})"`;
@@ -42822,7 +44032,7 @@ function leadFailureReason(agent, timeoutMs, err, stdout, stderr) {
 function think(prompt, o) {
   const process2 = leadProcess(prompt, o);
   return new Promise((resolve21, reject2) => {
-    const child = execFile12(process2.file, process2.args, {
+    const child = execFile13(process2.file, process2.args, {
       cwd: process2.cwd,
       timeout: o.timeoutMs,
       maxBuffer: 16 * 1024 * 1024,
@@ -43385,7 +44595,7 @@ init_src();
 init_pty();
 init_tui_dialog();
 init_notifications();
-import { writeFileSync as writeFileSync6 } from "node:fs";
+import { writeFileSync as writeFileSync7 } from "node:fs";
 
 // src/services/lead/pane.ts
 init_tui_dialog();
@@ -43471,7 +44681,7 @@ var prodDetectDeps = {
   send: (id, text, choices) => sendToPane(id, text, 50, choices),
   clearMarker: (file) => {
     try {
-      writeFileSync6(file, "");
+      writeFileSync7(file, "");
     } catch {
     }
   },
@@ -44236,9 +45446,9 @@ init_db();
 
 // src/services/changelog/collect.ts
 init_db();
-import { execFile as execFile13 } from "node:child_process";
+import { execFile as execFile14 } from "node:child_process";
 import { promisify as promisify13 } from "node:util";
-import { existsSync as existsSync15 } from "node:fs";
+import { existsSync as existsSync16 } from "node:fs";
 
 // src/services/changelog/scrub.ts
 var MERGE = /^merge\s+(branch|pull request|remote-tracking branch|tag)\b/i;
@@ -44299,13 +45509,13 @@ async function collectBacklog(projectId, from, to) {
     notes.push(`${stampless} item selesai tanpa stempel waktu (selesai sebelum stempel ini ada) dan tak ikut dihitung.`);
   return { ok: true, input: { mode: "backlog", title: `${from} \u2013 ${to}`, items, notes } };
 }
-var exec10 = promisify13(execFile13);
+var exec10 = promisify13(execFile14);
 var GIT8 = { maxBuffer: 1 << 24, encoding: "utf8" };
 var US2 = "";
 var RS = "";
 var NO_REPO = "project ini belum ditautkan ke repo di mesin ini";
 var NO_TAG = "repo project ini belum punya tag rilis";
-var usable2 = (repoDir) => !!repoDir && existsSync15(repoDir);
+var usable2 = (repoDir) => !!repoDir && existsSync16(repoDir);
 async function listTags(repoDir) {
   if (!usable2(repoDir)) return { tags: [], head: null, reason: NO_REPO };
   try {
@@ -44459,12 +45669,12 @@ async function generateChangelog(projectId, req, deps = {}) {
   const input = got.input;
   const prompt = changelogPrompt(input, CHANGELOG_TIMEOUT_MS);
   const { agent, model, effort } = await changelogAgentDefaults();
-  const run2 = deps.think ?? think;
+  const run3 = deps.think ?? think;
   let body = "";
   let generator = "agent";
   const warnings = [...input.notes];
   try {
-    const raw2 = await run2(prompt, { agent, model, effort, timeoutMs: CHANGELOG_TIMEOUT_MS });
+    const raw2 = await run3(prompt, { agent, model, effort, timeoutMs: CHANGELOG_TIMEOUT_MS });
     body = scrubOutput(raw2 ?? "");
     if (!body.trim()) throw new Error("agen tak memulangkan teks apa pun");
   } catch (e) {
@@ -44566,13 +45776,13 @@ init_db();
 
 // src/services/agent-tool-catalog.ts
 init_src();
-import { readFileSync as readFileSync13 } from "node:fs";
+import { readFileSync as readFileSync16 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 var home = () => process.env.HOME || homedir9();
 var readJson2 = (path2) => {
   try {
-    return JSON.parse(readFileSync13(path2, "utf8"));
+    return JSON.parse(readFileSync16(path2, "utf8"));
   } catch {
     return null;
   }
@@ -44585,7 +45795,7 @@ var serversOf = (node) => {
 var codexServers = () => {
   let text;
   try {
-    text = readFileSync13(join24(home(), ".codex", "config.toml"), "utf8");
+    text = readFileSync16(join25(home(), ".codex", "config.toml"), "utf8");
   } catch {
     return [];
   }
@@ -44598,12 +45808,12 @@ var codexServers = () => {
 };
 function mcpServerNames(repoDir) {
   const names = [];
-  const claudeJson = readJson2(join24(home(), ".claude.json"));
+  const claudeJson = readJson2(join25(home(), ".claude.json"));
   names.push(...serversOf(claudeJson));
   if (repoDir) {
     const projects = claudeJson?.projects;
     if (projects && typeof projects === "object") names.push(...serversOf(projects[repoDir]));
-    names.push(...serversOf(readJson2(join24(repoDir, ".mcp.json"))));
+    names.push(...serversOf(readJson2(join25(repoDir, ".mcp.json"))));
   }
   names.push(...codexServers());
   return [...new Set(names.filter(Boolean))].sort((a, b) => a.localeCompare(b));
@@ -44613,6 +45823,71 @@ function agentToolCatalog(repoDir) {
 }
 var agentToolIds = (repoDir) => agentToolCatalog(repoDir).map((t) => t.id);
 
+// src/routes/custom-agents.ts
+init_settings2();
+
+// src/services/builtin-agents.ts
+init_src();
+init_db();
+init_settings2();
+init_tombstone();
+import { createHash as createHash10 } from "node:crypto";
+var fingerprint = (name2, description, instructions, tools) => createHash10("sha256").update([name2, description, instructions, [...tools].join(",")].join(" ")).digest("hex").slice(0, 16);
+var builtinFingerprint = (a) => fingerprint(a.name, a.description, a.instructions, a.tools);
+var rowFingerprint = (r) => fingerprint(r.name, r.description, r.instructions, toolsOf(r.tools) ?? []);
+async function seedBuiltinAgents() {
+  try {
+    const setting = await getSetting();
+    const stamps = { ...setting.builtinAgents };
+    let changed = false;
+    for (const a of BUILTIN_AGENTS) {
+      const id = customAgentId(null, a.name);
+      const fp = builtinFingerprint(a);
+      const row = await prisma.customAgent.findUnique({ where: { id } });
+      if (!row) {
+        if (await findTombstone("customAgent", id)) continue;
+        await prisma.customAgent.create({ data: {
+          id,
+          projectId: null,
+          name: a.name,
+          description: a.description,
+          instructions: a.instructions,
+          tools: [...a.tools],
+          model: null,
+          mentions: [],
+          runtime: null,
+          enabled: a.enabledByDefault
+        } });
+        await notifySynced("customAgent", id);
+        stamps[a.name] = fp;
+        changed = true;
+        continue;
+      }
+      const stamped = stamps[a.name];
+      if (!stamped || stamped === fp) continue;
+      if (stamped !== rowFingerprint(row)) continue;
+      await prisma.customAgent.update({ where: { id }, data: {
+        description: a.description,
+        instructions: a.instructions,
+        tools: [...a.tools]
+        // `enabled` TIDAK di sini. Sengaja.
+      } });
+      await notifySynced("customAgent", id);
+      stamps[a.name] = fp;
+      changed = true;
+    }
+    if (changed) {
+      const data = { ...setting, builtinAgents: stamps };
+      await prisma.setting.upsert({
+        where: { id: 1 },
+        update: { data },
+        create: { id: 1, data }
+      });
+    }
+  } catch {
+  }
+}
+
 // src/services/custom-agents.ts
 init_db();
 init_src();
@@ -44684,25 +45959,35 @@ function unknownMentions(row, all) {
   return mentionsOf(row.mentions).filter((m) => !visible.has(m));
 }
 async function installCustomAgents() {
+  await seedBuiltinAgents();
   await loadCustomAgents();
   registerCustomAgentSource((projectId, agent) => agentDefsFor(projectId, agent));
 }
 
 // src/routes/custom-agents.ts
 var rowsOf = async () => await prisma.customAgent.findMany();
-var view9 = (r, projectId) => ({
-  id: r.id,
-  projectId: r.projectId,
-  name: r.name,
-  description: r.description,
-  instructions: r.instructions,
-  tools: toolsOf(r.tools),
-  model: r.model,
-  mentions: mentionsOf(r.mentions),
-  runtime: runtimeOf(r.runtime),
-  enabled: r.enabled,
-  ...projectId ? { inherited: r.projectId === null } : {}
-});
+var stampsOf = async () => (await getSetting()).builtinAgents;
+var view9 = (r, projectId, stamps = {}) => {
+  const builtin = r.projectId === null && BUILTIN_AGENT_NAMES.includes(r.name);
+  return {
+    id: r.id,
+    projectId: r.projectId,
+    name: r.name,
+    description: r.description,
+    instructions: r.instructions,
+    tools: toolsOf(r.tools),
+    model: r.model,
+    mentions: mentionsOf(r.mentions),
+    runtime: runtimeOf(r.runtime),
+    enabled: r.enabled,
+    builtin,
+    // Sidik jari yang tak tercatat (baris menyeberang sync dari mesin lain, seed di sini belum
+    // pernah menyentuhnya) dibaca sebagai "disunting" — lebih baik menandai berlebih daripada
+    // menjanjikan "asli bawaan" untuk isi yang tak bisa kita buktikan.
+    builtinEdited: builtin ? stamps[r.name] !== rowFingerprint(r) : false,
+    ...projectId ? { inherited: r.projectId === null } : {}
+  };
+};
 var repoDirOf2 = async (projectId) => projectId ? await resolveRepoDir(projectId) : null;
 function toolsProblem(tools, catalogIds) {
   if (!tools || tools.length === 0) return null;
@@ -44735,7 +46020,8 @@ async function custom_agents_default(app2) {
     const byName = /* @__PURE__ */ new Map();
     for (const r of rows) if (r.projectId === null) byName.set(r.name, r);
     for (const r of rows) if (r.projectId !== null) byName.set(r.name, r);
-    return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name)).map((r) => view9(r, projectId));
+    const stamps = await stampsOf();
+    return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name)).map((r) => view9(r, projectId, stamps));
   });
   app2.post("/custom-agents", async (req, reply) => {
     const parsed = zCreateCustomAgent.safeParse(req.body);
@@ -44782,7 +46068,7 @@ async function custom_agents_default(app2) {
     } });
     await loadCustomAgents();
     await notifySynced("customAgent", id);
-    return reply.code(201).send(view9(row));
+    return reply.code(201).send(view9(row, void 0, await stampsOf()));
   });
   app2.patch("/custom-agents/:id", async (req, reply) => {
     const { id } = req.params;
@@ -44829,7 +46115,7 @@ async function custom_agents_default(app2) {
     } });
     await loadCustomAgents();
     await notifySynced("customAgent", id);
-    return view9(row);
+    return view9(row, void 0, await stampsOf());
   });
   app2.delete("/custom-agents/:id", async (req, reply) => {
     const { id } = req.params;
@@ -44902,7 +46188,7 @@ async function resolveGithubRepo(projectId) {
 
 // src/services/github-fetch.ts
 init_config2();
-import { execFile as execFile14 } from "node:child_process";
+import { execFile as execFile15 } from "node:child_process";
 var labelNames = (l) => (l ?? []).map((x) => typeof x === "string" ? x : x.name ?? "").filter(Boolean);
 var norm2 = (s2) => s2.toLowerCase() === "closed" ? "closed" : "open";
 function issueFromGh(raw2) {
@@ -44943,7 +46229,7 @@ function issuesFromRest(raw2) {
 var GH_FIELDS = "number,title,body,author,labels,url,state,createdAt,updatedAt";
 var API2 = "https://api.github.com";
 var defaultRunGh = (args, env) => new Promise((resolve21, reject2) => {
-  execFile14(
+  execFile15(
     args[0],
     args.slice(1),
     { env, maxBuffer: 1 << 26, encoding: "utf8", timeout: 6e4 },
@@ -45289,22 +46575,22 @@ async function verifyTelegramAgentToken(token, deps = {}) {
   return missing.length ? { ok: false, missing, reason: `AgentToken kurang ${missing.length} capability.` } : { ok: true };
 }
 async function telegramInboundReadiness(deps = {}) {
-  const polling = deps.polling ?? telegramRuntimeStatus().running;
+  const polling2 = deps.polling ?? telegramRuntimeStatus().running;
   const empty = [];
   const token = deps.agentToken ?? effectiveStr("HANOMAN_TELEGRAM_AGENT_TOKEN")?.trim();
   if (!token) {
-    return { ok: false, reason: "AgentToken gateway belum diisi.", missingCapabilities: [...TELEGRAM_REQUIRED_CAPABILITIES], polling };
+    return { ok: false, reason: "AgentToken gateway belum diisi.", missingCapabilities: [...TELEGRAM_REQUIRED_CAPABILITIES], polling: polling2 };
   }
   const setting = await (deps.getSetting ?? getSetting)();
   if (!setting.agentAccessEnabled) {
-    return { ok: false, reason: "Akses agent mati \u2014 nyalakan master switch di Akses AI Agent.", missingCapabilities: empty, polling };
+    return { ok: false, reason: "Akses agent mati \u2014 nyalakan master switch di Akses AI Agent.", missingCapabilities: empty, polling: polling2 };
   }
   const gate = await verifyTelegramAgentToken(token, deps);
-  if (!gate.ok) return { ok: false, reason: gate.reason, missingCapabilities: gate.missing, polling };
-  if (!polling) {
-    return { ok: false, reason: "Kredensial sudah sah tapi gateway belum polling \u2014 nyalakan \u201CGateway aktif\u201D.", missingCapabilities: empty, polling };
+  if (!gate.ok) return { ok: false, reason: gate.reason, missingCapabilities: gate.missing, polling: polling2 };
+  if (!polling2) {
+    return { ok: false, reason: "Kredensial sudah sah tapi gateway belum polling \u2014 nyalakan \u201CGateway aktif\u201D.", missingCapabilities: empty, polling: polling2 };
   }
-  return { ok: true, reason: null, missingCapabilities: empty, polling };
+  return { ok: true, reason: null, missingCapabilities: empty, polling: polling2 };
 }
 var KEYS = TELEGRAM_CONFIG_KEYS;
 function telegramCredentialView() {
@@ -45975,7 +47261,7 @@ init_settings2();
 // src/services/portal-chat/turn.ts
 init_src();
 init_db();
-import { execFile as execFile15 } from "node:child_process";
+import { execFile as execFile16 } from "node:child_process";
 
 // src/services/portal-chat/guard-input.ts
 import { randomBytes as randomBytes9 } from "node:crypto";
@@ -46087,9 +47373,9 @@ ${baru}`;
 // src/services/portal-chat/workspace.ts
 init_src();
 init_db();
-import { mkdirSync as mkdirSync11, mkdtempSync as mkdtempSync2, rmSync as rmSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync2, rmSync as rmSync7, writeFileSync as writeFileSync8 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 var STAGE_LABEL = {
   brainstorming: "Dirumuskan",
   objective: "Dirumuskan",
@@ -46144,7 +47430,7 @@ ${c.body}
 ${baris.join("\n")}`;
 }
 async function buildChatWorkspace(projectId) {
-  const dir2 = mkdtempSync2(join25(tmpdir5(), "hanoman-portal-chat-"));
+  const dir2 = mkdtempSync2(join26(tmpdir5(), "hanoman-portal-chat-"));
   try {
     const project = await prisma.project.findUnique({
       where: { id: projectId },
@@ -46165,7 +47451,7 @@ async function buildChatWorkspace(projectId) {
     });
     const files = [];
     const tulis = (rel, isi) => {
-      writeFileSync7(join25(dir2, rel), isi, { mode: 384 });
+      writeFileSync8(join26(dir2, rel), isi, { mode: 384 });
       files.push(rel);
     };
     tulis("project.md", renderProjectDoc(project));
@@ -46174,11 +47460,11 @@ async function buildChatWorkspace(projectId) {
     tulis("catatan-rilis.md", renderChangelogDoc(changelogs));
     const prds = await listPrds(projectId);
     if (prds.length) {
-      mkdirSync11(join25(dir2, "dokumen"), { mode: 448 });
+      mkdirSync12(join26(dir2, "dokumen"), { mode: 448 });
       for (const prd of prds) {
         const isi = await readPrd(projectId, prd.path);
         if (!isi) continue;
-        tulis(join25("dokumen", `${prd.slug.replaceAll("/", "-")}.md`), isi);
+        tulis(join26("dokumen", `${prd.slug.replaceAll("/", "-")}.md`), isi);
       }
     }
     return { dir: dir2, files, cleanup: () => rmSync7(dir2, { recursive: true, force: true }) };
@@ -46190,6 +47476,7 @@ async function buildChatWorkspace(projectId) {
 
 // src/services/portal-chat/argv.ts
 init_src();
+init_src2();
 init_config2();
 init_session_sandbox();
 var PORTAL_CHAT_TOOLS = "Read,Glob,Grep";
@@ -46220,10 +47507,10 @@ var shellQuote2 = (v) => `'${v.replace(/'/g, `'"'"'`)}'`;
 function portalChatProcess(o, env = process.env) {
   const file = effectiveStr("HANOMAN_CLAUDE_BIN") ?? "claude";
   const args = portalChatArgv(o);
-  const mode = env.HANOMAN_SESSION_SANDBOX ?? (env.NODE_ENV === "production" ? "required" : "off");
+  const mode = env.HANOMAN_SESSION_SANDBOX ?? (resolveHardening(env) ? "required" : "off");
   if (mode === "off") {
-    if (env.NODE_ENV === "production")
-      throw new Error("chat portal menolak jalan: sandbox sesi wajib di production");
+    if (resolveHardening(env))
+      throw new Error("chat portal menolak jalan: sandbox sesi wajib saat hardening menyala");
     return { file, args, cwd: o.workspace };
   }
   const command = [file, ...args].map(shellQuote2).join(" ");
@@ -46261,7 +47548,7 @@ function chatFailureReason(err, stdout, stderr, timeoutMs) {
 }
 function runProcess(p, timeoutMs) {
   return new Promise((resolve21, reject2) => {
-    const child = execFile15(p.file, p.args, {
+    const child = execFile16(p.file, p.args, {
       cwd: p.cwd,
       timeout: timeoutMs,
       maxBuffer: 16 * 1024 * 1024,
@@ -46688,15 +47975,15 @@ init_src();
 init_db();
 
 // src/services/bootstrap.ts
-import { createHash as createHash9, randomBytes as randomBytes10, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+import { createHash as createHash11, randomBytes as randomBytes10, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
 import { chmod, lstat as lstat3, mkdir as mkdir6, readFile as readFile5, unlink as unlink5, writeFile as writeFile5 } from "node:fs/promises";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 var TTL_MS5 = 15 * 6e4;
 var SETUP_TOKEN_FILE = "setup.token";
 var BootstrapError = class extends Error {
   code = "BOOTSTRAP_PROOF";
 };
-var tokenPath = (home3) => join26(home3, SETUP_TOKEN_FILE);
+var tokenPath = (home3) => join27(home3, SETUP_TOKEN_FILE);
 async function readStored(home3) {
   try {
     const info = await lstat3(tokenPath(home3));
@@ -46741,8 +48028,8 @@ ${new Date(expiresAt).toISOString()}
 }
 async function verifySetupToken(candidate, home3, now = Date.now()) {
   const stored = await readStored(home3);
-  const got = createHash9("sha256").update(candidate).digest();
-  const want = createHash9("sha256").update(stored.token).digest();
+  const got = createHash11("sha256").update(candidate).digest();
+  const want = createHash11("sha256").update(stored.token).digest();
   if (stored.expiresAt <= now || !timingSafeEqual3(got, want)) throw new BootstrapError("invalid setup proof");
 }
 async function consumeSetupToken(home3) {
@@ -46754,9 +48041,9 @@ async function consumeSetupToken(home3) {
 // src/routes/auth.ts
 var BOOTSTRAP_USER_ID = "bootstrap-admin";
 var view12 = (u) => ({ id: u.id, email: u.email, role: u.role, createdAt: u.createdAt.toISOString() });
-async function issue(reply, userId) {
+async function issue(req, reply, userId) {
   const token = await createSession2(userId);
-  reply.setCookie(COOKIE_NAME, token, cookieOpts());
+  reply.setCookie(COOKIE_NAME, token, cookieOpts(req));
 }
 async function auth_default(app2, opts) {
   const setupAttempts = new BoundedRateLimiter({ windowMs: 6e4, limit: 10, maxKeys: 4096 });
@@ -46792,7 +48079,7 @@ async function auth_default(app2, opts) {
     }
     if (opts.bootstrapRequired) await consumeSetupToken(opts.home);
     setupAttempts.clear(req.ip);
-    await issue(reply, user.id);
+    await issue(req, reply, user.id);
     return { user: view12(user) };
   });
   app2.post("/auth/login", async (req, reply) => {
@@ -46805,7 +48092,7 @@ async function auth_default(app2, opts) {
       return reply.code(401).send({ error: "email atau password salah" });
     }
     clearLoginFails(req.ip);
-    await issue(reply, user.id);
+    await issue(req, reply, user.id);
     return { user: view12(user) };
   });
   app2.post("/auth/logout", async (req, reply) => {
@@ -46847,11 +48134,93 @@ async function auth_default(app2, opts) {
       data: { passwordHash: await hashPassword(p.data.newPassword) }
     });
     await deleteUserSessions(user.id);
-    await issue(reply, user.id);
+    await issue(req, reply, user.id);
     return { user: view12(user) };
   });
 }
 
+// src/routes/setup.ts
+init_src2();
+init_src();
+init_db();
+
+// src/services/setup-config.ts
+init_src2();
+var SETUP_ALLOWED_KEYS = [
+  "HANOMAN_DEPLOYMENT",
+  "HANOMAN_HARDENING",
+  "HANOMAN_SETUP_DONE",
+  "HANOMAN_SESSION_SANDBOX",
+  "HANOMAN_SESSION_NETWORK",
+  "HANOMAN_EGRESS_PROXY",
+  "HANOMAN_AGENT_CREDENTIAL_DIR",
+  "HANOMAN_CONTROL_ORIGINS",
+  "HANOMAN_PUBLIC_ORIGINS",
+  "HANOMAN_SINGLE_ORIGIN",
+  "HANOMAN_TRUST_PROXY",
+  "HANOMAN_UPLOAD_SCANNER"
+];
+function setupDone(home3) {
+  return readConfigEnv(home3).HANOMAN_SETUP_DONE === "1";
+}
+function hardeningLocked(home3, env) {
+  return resolveHardening(env) && !resolveHardening(readConfigEnv(home3));
+}
+function applySetup(home3, input) {
+  const existing = readConfigEnv(home3);
+  const next = {};
+  for (const key of SETUP_ALLOWED_KEYS) if (existing[key]) next[key] = existing[key];
+  next.HANOMAN_DEPLOYMENT = input.deployment;
+  next.HANOMAN_SETUP_DONE = "1";
+  if (input.hardening) next.HANOMAN_HARDENING = "1";
+  else delete next.HANOMAN_HARDENING;
+  writeConfigEnv(home3, next);
+  return next;
+}
+
+// src/services/restart.ts
+init_src();
+function requestConfigRestart(delayMs = 50) {
+  setTimeout(() => process.exit(CONFIG_RESTART_EXIT), delayMs);
+}
+
+// src/routes/setup.ts
+async function setup_default(app2, opts) {
+  const attempts = new BoundedRateLimiter({ windowMs: 6e4, limit: 10, maxKeys: 4096 });
+  const env = opts.env;
+  const status = async () => ({
+    // Dua syarat, bukan satu: belum ada user DAN wizard belum pernah dijawab.
+    needed: await prisma.user.count() === 0 && !setupDone(opts.home),
+    deployment: resolveDeployment(env),
+    hardening: resolveHardening(env),
+    hardeningLocked: hardeningLocked(opts.home, env),
+    supervised: env.HANOMAN_SUPERVISOR === "1",
+    setupTokenRequired: resolveHardening(env),
+    prerequisites: prerequisites(env, collectProbeFacts(env))
+  });
+  app2.get("/setup/status", async () => status());
+  app2.post("/setup", async (req, reply) => {
+    if (attempts.hit(req.ip).blocked) return reply.code(429).send({ error: "too many attempts" });
+    const p = zSetupApply.safeParse(req.body);
+    if (!p.success) return reply.code(400).send({ error: p.error.flatten() });
+    if (hardeningLocked(opts.home, env) && !p.data.hardening)
+      return reply.code(409).send({ error: "hardening-locked" });
+    if (p.data.hardening) {
+      const rows = prerequisites(env, collectProbeFacts(env));
+      if (!allReady(rows))
+        return reply.code(400).send({
+          error: "prerequisites-missing",
+          missing: rows.filter((r) => !r.ok).map((r) => r.id)
+        });
+    }
+    applySetup(opts.home, { deployment: p.data.deployment, hardening: p.data.hardening });
+    attempts.clear(req.ip);
+    if (env.HANOMAN_SUPERVISOR !== "1") return { restart: "manual" };
+    reply.raw.on("finish", () => requestConfigRestart());
+    return { restart: "self" };
+  });
+}
+
 // src/routes/agent-tokens.ts
 init_src();
 init_agent_token();
@@ -47138,6 +48507,7 @@ function trustProxyFromEnv(env) {
 
 // src/app.ts
 init_src2();
+init_db();
 var PUBLIC = /* @__PURE__ */ new Set([
   "GET /api/health",
   "GET /api/auth/status",
@@ -47149,8 +48519,12 @@ var PUBLIC = /* @__PURE__ */ new Set([
   // justru menjelaskan arti 403 itu.
   "GET /api/agent-integration.md"
 ]);
+var SETUP_PUBLIC = /* @__PURE__ */ new Set([
+  "GET /api/setup/status",
+  "POST /api/setup"
+]);
 function buildApp({ requireAuth = true, agentDocFile, env = process.env } = {}) {
-  const docFile = agentDocFile !== void 0 ? agentDocFile : pickGuideFile(dirname13(fileURLToPath4(import.meta.url)), env, existsSync16);
+  const docFile = agentDocFile !== void 0 ? agentDocFile : pickGuideFile(dirname13(fileURLToPath5(import.meta.url)), env, existsSync17);
   const ingress = loadIngressPolicy(env);
   const app2 = Fastify({ logger: false, trustProxy: trustProxyFromEnv(env) });
   app2.addHook("onRequest", async (req, reply) => {
@@ -47191,6 +48565,7 @@ function buildApp({ requireAuth = true, agentDocFile, env = process.env } = {})
         if (user) req.user = user;
         const path2 = req.url.split("?")[0] ?? req.url;
         if (PUBLIC.has(`${req.method} ${path2}`)) return;
+        if (SETUP_PUBLIC.has(`${req.method} ${path2}`) && await prisma.user.count() === 0) return;
         if (user?.role === "client" && !clientRouteAllowed(req.method, path2))
           return reply.code(403).send({ error: "portal klien: baca-saja" });
         if (path2.startsWith("/api/sync") && path2 !== "/api/sync/now" && path2 !== "/api/sync/pending" && !path2.startsWith("/api/sync/conflicts")) return;
@@ -47216,7 +48591,8 @@ function buildApp({ requireAuth = true, agentDocFile, env = process.env } = {})
       setActor(actorFromRequest({ user: req.user ?? null, agent: req.agent ?? null }));
     });
     api.addHook("onResponse", auditTelegramGatewayResponse);
-    await api.register(auth_default, { bootstrapRequired: env.NODE_ENV === "production", home: resolveHome(env) });
+    await api.register(auth_default, { bootstrapRequired: resolveHardening(env), home: resolveHome(env) });
+    await api.register(setup_default, { home: resolveHome(env), env });
     await api.register(health_default);
     await api.register(agent_doc_default, { file: docFile });
     await api.register(projects_default);
@@ -47258,7 +48634,7 @@ function buildApp({ requireAuth = true, agentDocFile, env = process.env } = {})
     await api.register(client_accounts_default);
   }, { prefix: "/api" });
   if (shouldServeWeb(env)) {
-    const dist = pickWebDir(dirname13(fileURLToPath4(import.meta.url)), env, existsSync16);
+    const dist = pickWebDir(dirname13(fileURLToPath5(import.meta.url)), env, existsSync17);
     if (dist) {
       app2.register(fastifyStatic, { root: dist });
       app2.setNotFoundHandler((req, reply) => req.url.startsWith("/api") ? reply.code(404).send({ error: "not found" }) : reply.sendFile("index.html"));
@@ -47317,12 +48693,12 @@ var cronLiveNote = (sessionId2) => `sesi cron sebelumnya masih berjalan (${sessi
 var CRON_GONE_NOTE = "cron sudah dihapus atau dinonaktifkan";
 var CRON_OPTOUT_NOTE = "project belum di-opt-in scheduler";
 async function drainCronRuns(slots, deps) {
-  for (const run2 of await queuedCronRuns()) {
-    const cron = await prisma.schedulerCron.findUnique({ where: { id: run2.cronId } });
+  for (const run3 of await queuedCronRuns()) {
+    const cron = await prisma.schedulerCron.findUnique({ where: { id: run3.cronId } });
     const close = async (status, note) => {
-      if (status === "skipped") await markCronSkipped(run2.id, note);
-      else await markCronFailed(run2.id, note);
-      await recordCronRun(run2.cronId, cron?.name ?? run2.cronId, run2.projectId, run2.dueAt, status, note);
+      if (status === "skipped") await markCronSkipped(run3.id, note);
+      else await markCronFailed(run3.id, note);
+      await recordCronRun(run3.cronId, cron?.name ?? run3.cronId, run3.projectId, run3.dueAt, status, note);
     };
     if (!cron || !cron.enabled) {
       await close("skipped", CRON_GONE_NOTE);
@@ -47342,7 +48718,7 @@ async function drainCronRuns(slots, deps) {
       continue;
     }
     if (slots <= 0) {
-      await noteCronRun(run2.id, CAP_FULL_NOTE);
+      await noteCronRun(run3.id, CAP_FULL_NOTE);
       continue;
     }
     try {
@@ -47355,8 +48731,8 @@ async function drainCronRuns(slots, deps) {
         model: cron.model,
         effort: cron.effort
       });
-      if (await markCronLaunched(run2.id, sessionId2))
-        await recordCronRun(cron.id, cron.name, cron.projectId, run2.dueAt, "launched", null);
+      if (await markCronLaunched(run3.id, sessionId2))
+        await recordCronRun(cron.id, cron.name, cron.projectId, run3.dueAt, "launched", null);
       await prisma.schedulerCron.update({ where: { id: cron.id }, data: { lastRunAt: /* @__PURE__ */ new Date() } });
       slots--;
     } catch (e) {
@@ -47881,13 +49257,13 @@ function startWebhookEngine() {
 // src/services/auto-merge.ts
 init_src();
 init_db();
-import { execFile as execFile16 } from "node:child_process";
+import { execFile as execFile17 } from "node:child_process";
 import { promisify as promisify14 } from "node:util";
 init_notifications();
 var AUTO_MERGE_WINDOW_MS = 24 * 60 * 60 * 1e3;
 var AUTO_MERGE_GRACE_MS = 15 * 60 * 1e3;
 var TICK_MS5 = 6e4;
-var exec11 = promisify14(execFile16);
+var exec11 = promisify14(execFile17);
 var GIT9 = { timeout: 3e4, maxBuffer: 1 << 24, encoding: "utf8" };
 var gitOut = async (cwd, args) => {
   try {
@@ -48000,7 +49376,7 @@ init_src2();
 
 // src/services/secure-home.ts
 import { chmod as chmod2, lstat as lstat4, mkdir as mkdir7 } from "node:fs/promises";
-import { isAbsolute as isAbsolute6, resolve as resolve20 } from "node:path";
+import { isAbsolute as isAbsolute7, resolve as resolve20 } from "node:path";
 var HomePermissionError = class extends Error {
   code = "HOME_SYMLINK";
 };
@@ -48014,7 +49390,7 @@ async function assertNoSymlink(path2, allowMissing) {
   }
 }
 async function secureHanomanHome(opts) {
-  if (!isAbsolute6(opts.home)) throw new HomePermissionError("HANOMAN_HOME harus absolut");
+  if (!isAbsolute7(opts.home)) throw new HomePermissionError("HANOMAN_HOME harus absolut");
   await assertNoSymlink(opts.home, true);
   await mkdir7(opts.home, { recursive: true, mode: 448 });
   await assertNoSymlink(opts.home, false);
@@ -48229,6 +49605,10 @@ var bootstrapReady = secureHanomanHome({
 }).then(() => prisma.user.count()).then(async (count) => {
   await secureHanomanHome({ home: home2, files: [dbFilePath(process.env.DATABASE_URL)] });
   if (count > 0) return;
+  if (!resolveHardening(process.env)) {
+    console.log("setup awal: buka dashboard dan ikuti wizard \u2014 tanpa hardening, akun pertama tak butuh token");
+    return;
+  }
   const proof = await ensureSetupToken(resolveHome());
   console.log(`setup admin memerlukan token di ${proof.path}; kedaluwarsa ${new Date(proof.expiresAt).toISOString()}`);
 });