hanoman 0.1.7 → 0.1.8

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.7",
-  "sha": "33ae716",
-  "builtAt": "2026-07-31T15:10:07.810Z"
+  "version": "0.1.8",
+  "sha": "a749553",
+  "builtAt": "2026-07-31T17:13:08.743Z"
 }

package/dist/cli.js

@@ -4357,7 +4357,7 @@ var init_enums = __esm({
 });
 
 // ../shared/src/entities.ts
-var zProject, zBriefPayload, zQaPayload, zGoalPayload, zSpec, NOTIFY_SOUNDS, zCodex, CODEX_DEFAULTS, zSourceCommon, zScheduler, SCHEDULER_DEFAULTS, zGoal, GOAL_DEFAULTS, zConflict, CONFLICT_DEFAULTS, zLeadEngine, zLead, LEAD_DEFAULTS, zSetting, zNotification, zDocFile, zDeviceTokenView;
+var zProject, zBriefPayload, zQaPayload, zGoalPayload, zSpecBlocker, zSpec, NOTIFY_SOUNDS, zCodex, CODEX_DEFAULTS, zSourceCommon, zScheduler, SCHEDULER_DEFAULTS, zGoal, GOAL_DEFAULTS, zConflict, CONFLICT_DEFAULTS, zLeadEngine, zLead, LEAD_DEFAULTS, zSetting, zNotification, zDocFile, zDeviceTokenView;
 var init_entities = __esm({
   "../shared/src/entities.ts"() {
     "use strict";
@@ -4400,6 +4400,10 @@ var init_entities = __esm({
       constraints: external_exports.string(),
       priority: zPriority
     });
+    zSpecBlocker = external_exports.object({
+      id: external_exports.string(),
+      reason: external_exports.enum(["missing", "unfinished", "unmerged"])
+    });
     zSpec = external_exports.object({
       id: external_exports.string(),
       projectId: external_exports.string(),
@@ -4418,7 +4422,13 @@ var init_entities = __esm({
       // SPEC-408 · ADR-0090 · stempel waktu backlog (ISO string di wire — kolom DateTime di DB).
       // `startedAt` null = belum pernah dikerjakan; ia tak pernah ditulis ulang saat sesi dilanjutkan.
       createdAt: external_exports.string(),
-      startedAt: external_exports.string().nullable()
+      startedAt: external_exports.string().nullable(),
+      // SPEC-447 · ADR-0093 · id backlog yang harus selesai & ter-merge lebih dulu. Server selalu
+      // menormalkannya ke array (kolom DB-nya `Json?`); `.default([])` menjaga respons lama.
+      dependsOn: external_exports.array(external_exports.string()).default([]),
+      // Turunan (bukan kolom): dihitung `liveSpecs` dari stage dependency + git. Klien tak pernah
+      // mengirimkannya — `.default([])` supaya bentuk lama tetap parse.
+      blockedBy: external_exports.array(zSpecBlocker).default([])
     });
     NOTIFY_SOUNDS = [
       "off",
@@ -4758,7 +4768,9 @@ var init_dto = __esm({
       title: external_exports.string().min(1),
       priority: zPriority,
       payload: external_exports.union([zBriefPayload, zQaPayload, zGoalPayload]),
-      branchFrom: external_exports.string().min(1).optional()
+      branchFrom: external_exports.string().min(1).optional(),
+      // SPEC-447 · ADR-0093 · divalidasi server (id ada / satu project / bukan diri sendiri / non-siklus).
+      dependsOn: external_exports.array(external_exports.string()).optional()
     }).superRefine((o, ctx) => {
       const shape = "severity" in o.payload ? "qa" : "goal" in o.payload ? "goal" : "brief";
       const want = o.source === "qa" ? "qa" : o.source === "goal" ? "goal" : "brief";
@@ -4772,8 +4784,12 @@ var init_dto = __esm({
       // SPEC-186 · edit konten selagi item belum dimulai. Ditolak server bila sudah mulai.
       title: external_exports.string().min(1).optional(),
       priority: zPriority.optional(),
-      payload: external_exports.union([zBriefPayload, zQaPayload, zGoalPayload]).optional()
+      payload: external_exports.union([zBriefPayload, zQaPayload, zGoalPayload]).optional(),
       // SPEC-407 · +goal
+      // SPEC-447 · ADR-0093 · SENGAJA di luar gerbang `editingContent` (SPEC-186): gerbang itu
+      // melindungi konten yang sudah jadi dasar kerja sesi berjalan, sedangkan dependsOn hanya
+      // menggerbangi peluncuran BERIKUTNYA. `[]` = kosongkan.
+      dependsOn: external_exports.array(external_exports.string()).optional()
     });
     zIntegrate = external_exports.object({
       op: external_exports.enum(["merge", "rebase"]),
@@ -4969,7 +4985,10 @@ var init_dto = __esm({
         goal: external_exports.boolean().optional(),
         goalCondition: external_exports.string().max(4e3).optional(),
         agent: zAgent.optional(),
-        verifyScope: zVerifyScope.optional()
+        verifyScope: zVerifyScope.optional(),
+        // SPEC-447 · ADR-0093 — lewati gerbang dependency. Hanya jalur manusia; UI hanya
+        // mengirimkannya sesudah operator melihat daftar pemblokirnya.
+        force: external_exports.boolean().optional()
       })
     ]);
     zDocFileContent = external_exports.object({ content: external_exports.string() });

package/dist/server.js

@@ -4182,7 +4182,7 @@ function cmpVersion(a, b) {
   }
   return 0;
 }
-var zProject, zBriefPayload, zQaPayload, zGoalPayload, zSpec, NOTIFY_SOUNDS, E_5_6, E_LUNA, E_BASE, CODEX_MODELS, RETIRED_CODEX_MODELS, zCodex, CODEX_DEFAULTS, zSourceCommon, zScheduler, SCHEDULER_DEFAULTS, zGoal, GOAL_DEFAULTS, zConflict, CONFLICT_DEFAULTS, zLeadEngine, zLead, LEAD_DEFAULTS, zSetting, zNotification, zDocFile, zDeviceTokenView;
+var zProject, zBriefPayload, zQaPayload, zGoalPayload, zSpecBlocker, zSpec, NOTIFY_SOUNDS, E_5_6, E_LUNA, E_BASE, CODEX_MODELS, RETIRED_CODEX_MODELS, zCodex, CODEX_DEFAULTS, zSourceCommon, zScheduler, SCHEDULER_DEFAULTS, zGoal, GOAL_DEFAULTS, zConflict, CONFLICT_DEFAULTS, zLeadEngine, zLead, LEAD_DEFAULTS, zSetting, zNotification, zDocFile, zDeviceTokenView;
 var init_entities = __esm({
   "../shared/src/entities.ts"() {
     "use strict";
@@ -4225,6 +4225,10 @@ var init_entities = __esm({
       constraints: external_exports.string(),
       priority: zPriority
     });
+    zSpecBlocker = external_exports.object({
+      id: external_exports.string(),
+      reason: external_exports.enum(["missing", "unfinished", "unmerged"])
+    });
     zSpec = external_exports.object({
       id: external_exports.string(),
       projectId: external_exports.string(),
@@ -4243,7 +4247,13 @@ var init_entities = __esm({
       // SPEC-408 · ADR-0090 · stempel waktu backlog (ISO string di wire — kolom DateTime di DB).
       // `startedAt` null = belum pernah dikerjakan; ia tak pernah ditulis ulang saat sesi dilanjutkan.
       createdAt: external_exports.string(),
-      startedAt: external_exports.string().nullable()
+      startedAt: external_exports.string().nullable(),
+      // SPEC-447 · ADR-0093 · id backlog yang harus selesai & ter-merge lebih dulu. Server selalu
+      // menormalkannya ke array (kolom DB-nya `Json?`); `.default([])` menjaga respons lama.
+      dependsOn: external_exports.array(external_exports.string()).default([]),
+      // Turunan (bukan kolom): dihitung `liveSpecs` dari stage dependency + git. Klien tak pernah
+      // mengirimkannya — `.default([])` supaya bentuk lama tetap parse.
+      blockedBy: external_exports.array(zSpecBlocker).default([])
     });
     NOTIFY_SOUNDS = [
       "off",
@@ -4650,7 +4660,9 @@ var init_dto = __esm({
       title: external_exports.string().min(1),
       priority: zPriority,
       payload: external_exports.union([zBriefPayload, zQaPayload, zGoalPayload]),
-      branchFrom: external_exports.string().min(1).optional()
+      branchFrom: external_exports.string().min(1).optional(),
+      // SPEC-447 · ADR-0093 · divalidasi server (id ada / satu project / bukan diri sendiri / non-siklus).
+      dependsOn: external_exports.array(external_exports.string()).optional()
     }).superRefine((o, ctx) => {
       const shape = "severity" in o.payload ? "qa" : "goal" in o.payload ? "goal" : "brief";
       const want = o.source === "qa" ? "qa" : o.source === "goal" ? "goal" : "brief";
@@ -4664,8 +4676,12 @@ var init_dto = __esm({
       // SPEC-186 · edit konten selagi item belum dimulai. Ditolak server bila sudah mulai.
       title: external_exports.string().min(1).optional(),
       priority: zPriority.optional(),
-      payload: external_exports.union([zBriefPayload, zQaPayload, zGoalPayload]).optional()
+      payload: external_exports.union([zBriefPayload, zQaPayload, zGoalPayload]).optional(),
       // SPEC-407 · +goal
+      // SPEC-447 · ADR-0093 · SENGAJA di luar gerbang `editingContent` (SPEC-186): gerbang itu
+      // melindungi konten yang sudah jadi dasar kerja sesi berjalan, sedangkan dependsOn hanya
+      // menggerbangi peluncuran BERIKUTNYA. `[]` = kosongkan.
+      dependsOn: external_exports.array(external_exports.string()).optional()
     });
     zIntegrate = external_exports.object({
       op: external_exports.enum(["merge", "rebase"]),
@@ -4861,7 +4877,10 @@ var init_dto = __esm({
         goal: external_exports.boolean().optional(),
         goalCondition: external_exports.string().max(4e3).optional(),
         agent: zAgent.optional(),
-        verifyScope: zVerifyScope.optional()
+        verifyScope: zVerifyScope.optional(),
+        // SPEC-447 · ADR-0093 — lewati gerbang dependency. Hanya jalur manusia; UI hanya
+        // mengirimkannya sesudah operator melihat daftar pemblokirnya.
+        force: external_exports.boolean().optional()
       })
     ]);
     zDocFileContent = external_exports.object({ content: external_exports.string() });
@@ -5989,6 +6008,17 @@ var init_git = __esm({
           { cwd: repo, encoding: "utf8" }
         );
         return r.status === 0 ? r.stdout.trim() : null;
+      },
+      // SPEC-447 · `git merge-base --is-ancestor A B` = exit 0 (ya) / 1 (tidak) / lainnya (error).
+      // `--end-of-options` menjaga ADR-0032: sha & ref datang dari DB/kolom, jangan sampai terbaca
+      // sebagai flag. Ref yang tak resolve membuat git exit 128 → dibaca sebagai "belum" (fail-closed).
+      isAncestor: (repo, sha, ref) => {
+        const r = spawnSync(
+          "git",
+          ["merge-base", "--is-ancestor", "--end-of-options", sha, ref],
+          { cwd: repo, encoding: "utf8" }
+        );
+        return r.status === 0;
       }
     };
   }
@@ -7000,6 +7030,7 @@ var init_rename_project = __esm({
 var sync_exports = {};
 __export(sync_exports, {
   SYNCED: () => SYNCED,
+  __FIELDS_FOR_TEST: () => __FIELDS_FOR_TEST,
   applyPush: () => applyPush,
   backfillFeed: () => backfillFeed,
   isEntity: () => isEntity,
@@ -7137,7 +7168,7 @@ async function upsertLocal(entity, id, version, data) {
 function setAcceptedHook(hook) {
   onAccepted = hook;
 }
-var SYNCED, DELEGATE, FIELDS, DATE_FIELDS, onAccepted;
+var SYNCED, DELEGATE, FIELDS, DATE_FIELDS, onAccepted, __FIELDS_FOR_TEST;
 var init_sync = __esm({
   "src/services/sync.ts"() {
     "use strict";
@@ -7156,7 +7187,9 @@ var init_sync = __esm({
       project: ["name", "desc", "kind", "stack", "gitRemote", "updatedAt"],
       // SPEC-408 · ADR-0090 · createdAt/startedAt ikut menyeberang — sejajar baseSha/headSha. Tanpa
       // ini spec asal-hub mendapat createdAt lokal palsu di tiap client (kolom NOT NULL ber-default).
-      spec: ["projectId", "title", "source", "stage", "priority", "author", "objective", "payload", "branchFrom", "baseSha", "headSha", "createdAt", "startedAt", "updatedAt"],
+      // SPEC-447 · ADR-0093 · dependsOn ikut juga: tanpa itu client tak tahu urutannya dan akan
+      // meluncurkan pekerjaan yang di hub terblokir. Bukan DATE_FIELDS — nilainya array string.
+      spec: ["projectId", "title", "source", "stage", "priority", "author", "objective", "payload", "branchFrom", "baseSha", "headSha", "dependsOn", "createdAt", "startedAt", "updatedAt"],
       vps: ["name", "host", "port", "user", "health", "audit", "hardened", "lastSeenAt", "lastAuditAt", "updatedAt"],
       sessionResult: ["projectId", "specId", "oldStage", "newStage", "commitSha", "branch", "prUrl", "status", "deviceId", "author", "createdAt", "updatedAt"],
       // SPEC-268 · ADR-0066 · metadata tiket (lampiran biner tak disync). accessKeyHash wajib
@@ -7173,6 +7206,7 @@ var init_sync = __esm({
       ticket: ["createdAt", "updatedAt"],
       ticketAttachment: ["createdAt", "updatedAt"]
     };
+    __FIELDS_FOR_TEST = FIELDS;
   }
 });
 
@@ -15360,6 +15394,128 @@ async function readEscalation(specId, sessions = listSessions()) {
   };
 }
 
+// src/services/spec-deps.ts
+init_db();
+init_src2();
+var REASON_LABEL = {
+  missing: "tak ditemukan",
+  unfinished: "belum selesai",
+  unmerged: "belum ter-merge"
+};
+function dependsOnOf(spec) {
+  const v = spec.dependsOn;
+  if (!Array.isArray(v)) return [];
+  const out3 = [];
+  for (const x of v) if (typeof x === "string" && x !== "" && !out3.includes(x)) out3.push(x);
+  return out3;
+}
+function blockersFor(spec, deps, isMerged) {
+  const ids = dependsOnOf(spec);
+  if (ids.length === 0) return [];
+  const base = spec.branchFrom ?? "HEAD";
+  const out3 = [];
+  for (const id of ids) {
+    const d = deps.get(id);
+    if (!d) {
+      out3.push({ id, reason: "missing" });
+      continue;
+    }
+    if (d.stage !== "done") {
+      out3.push({ id, reason: "unfinished" });
+      continue;
+    }
+    if (d.headSha && !isMerged(d.headSha, base)) out3.push({ id, reason: "unmerged" });
+  }
+  return out3;
+}
+function blockedNote(bl) {
+  return `menunggu ${bl.map((b) => `${b.id} (${REASON_LABEL[b.reason]})`).join(", ")}`;
+}
+function reaches(edges, from, target2) {
+  const seen = /* @__PURE__ */ new Set();
+  const stack = [...from];
+  while (stack.length) {
+    const cur = stack.pop();
+    if (cur === target2) return true;
+    if (seen.has(cur)) continue;
+    seen.add(cur);
+    for (const n of edges.get(cur) ?? []) stack.push(n);
+  }
+  return false;
+}
+var TTL_MS = 15e3;
+var mergeCache = /* @__PURE__ */ new Map();
+function mergedInto(repoDir, sha, baseRef) {
+  const key = `${repoDir} ${sha} ${baseRef}`;
+  const hit = mergeCache.get(key);
+  const now = Date.now();
+  if (hit && now - hit.at < TTL_MS) return hit.v;
+  let v = false;
+  try {
+    v = realGit.isAncestor(repoDir, sha, baseRef);
+  } catch {
+    v = false;
+  }
+  mergeCache.set(key, { at: now, v });
+  return v;
+}
+var merger = (repoDir) => (sha, base) => repoDir ? mergedInto(repoDir, sha, base) : false;
+var depRows = (ids) => prisma.spec.findMany({
+  where: { id: { in: ids } },
+  select: { id: true, stage: true, headSha: true }
+});
+async function blockersForSpec(spec, repoDir) {
+  const ids = dependsOnOf(spec);
+  if (ids.length === 0) return [];
+  const rows = await depRows(ids);
+  return blockersFor(spec, new Map(rows.map((r) => [r.id, r])), merger(repoDir));
+}
+async function decorateBlocked(specs) {
+  const ids = [...new Set(specs.flatMap(dependsOnOf))];
+  if (ids.length === 0) return specs.map((s) => ({ ...s, dependsOn: [], blockedBy: [] }));
+  const rows = await depRows(ids);
+  const deps = new Map(rows.map((r) => [r.id, r]));
+  const repos = /* @__PURE__ */ new Map();
+  const out3 = [];
+  for (const s of specs) {
+    const own = dependsOnOf(s);
+    if (own.length === 0) {
+      out3.push({ ...s, dependsOn: [], blockedBy: [] });
+      continue;
+    }
+    if (!repos.has(s.projectId)) repos.set(s.projectId, await resolveRepoDir(s.projectId));
+    out3.push({ ...s, dependsOn: own, blockedBy: blockersFor(s, deps, merger(repos.get(s.projectId))) });
+  }
+  return out3;
+}
+async function validateDependsOn(specId, projectId, raw) {
+  const ids = dependsOnOf({ dependsOn: raw });
+  if (ids.length === 0) return { ok: true, ids: [] };
+  if (specId && ids.includes(specId))
+    return { ok: false, error: "backlog tak bisa bergantung pada dirinya sendiri" };
+  const rows = await prisma.spec.findMany({
+    where: { id: { in: ids } },
+    select: { id: true, projectId: true }
+  });
+  const found = new Map(rows.map((r) => [r.id, r.projectId]));
+  const missing = ids.filter((i) => !found.has(i));
+  if (missing.length) return { ok: false, error: `backlog tak ditemukan: ${missing.join(", ")}` };
+  const foreign = ids.filter((i) => found.get(i) !== projectId);
+  if (foreign.length)
+    return { ok: false, error: `dependency harus di project yang sama: ${foreign.join(", ")}` };
+  if (specId) {
+    const all = await prisma.spec.findMany({
+      where: { projectId },
+      select: { id: true, dependsOn: true }
+    });
+    const edges = new Map(all.map((r) => [r.id, dependsOnOf(r)]));
+    edges.set(specId, ids);
+    if (reaches(edges, ids, specId))
+      return { ok: false, error: "dependency membentuk siklus" };
+  }
+  return { ok: true, ids };
+}
+
 // src/services/doc-export.ts
 import PDFDocument from "pdfkit";
 
@@ -17829,7 +17985,7 @@ async function liveSpecs(filter = {}) {
     orderBy: { id: "desc" }
   });
   const live = sessionPhasesBySpec();
-  if (live.size === 0) return specs;
+  if (live.size === 0) return decorateBlocked(specs);
   const advanced = [];
   const doneNow = [];
   const out3 = specs.map((s) => {
@@ -17847,7 +18003,7 @@ async function liveSpecs(filter = {}) {
       if (res.count > 0) await notifySynced("spec", a.id);
     }));
   await Promise.all(doneNow.map((d) => recordCompletion(d.specId, d.title, d.projectId)));
-  return out3;
+  return decorateBlocked(out3);
 }
 
 // src/routes/specs.ts
@@ -17887,6 +18043,8 @@ async function specs_default(app2) {
     const repoDir = await resolveRepoDir(b.project);
     if (b.branchFrom && await branchUnknown(repoDir, b.branchFrom))
       return reply.code(400).send({ error: `branch "${b.branchFrom}" tidak ada di repo project` });
+    const dep = await validateDependsOn(null, b.project, b.dependsOn ?? []);
+    if (!dep.ok) return reply.code(400).send({ error: dep.error });
     const isQa = b.source === "qa";
     const { priority, objective } = deriveSpecFields(b.source, b.payload, b.priority);
     const author = req.user?.email ?? "system";
@@ -17905,7 +18063,9 @@ async function specs_default(app2) {
             author: isQa ? `QA \xB7 ${author}` : b.source === "audit" ? `Audit \xB7 ${author}` : b.source === "goal" ? `Goal \xB7 ${author}` : author,
             objective,
             payload: b.payload,
-            branchFrom: b.branchFrom ?? null
+            branchFrom: b.branchFrom ?? null,
+            dependsOn: dep.ids
+            // SPEC-447 · ADR-0093
           }
         });
       } catch (e) {
@@ -17969,7 +18129,7 @@ ${item.context}` : item.context;
     if (!parsed.success) return reply.code(400).send({ error: parsed.error.flatten() });
     const spec = await prisma.spec.findUnique({ where: { id } });
     if (!spec) return reply.code(404).send({ error: "not found" });
-    const { branchFrom, stage, confirmDelete, title, priority: newPriority, payload } = parsed.data;
+    const { branchFrom, stage, confirmDelete, title, priority: newPriority, payload, dependsOn } = parsed.data;
     const editingContent = title !== void 0 || newPriority !== void 0 || payload !== void 0;
     if (editingContent && (spec.stage !== "brainstorming" || spec.baseSha !== null))
       return reply.code(409).send({ error: "backlog item sudah dimulai \u2014 tak bisa diedit" });
@@ -17977,6 +18137,12 @@ ${item.context}` : item.context;
       if (await branchUnknown(await resolveRepoDir(spec.projectId), branchFrom))
         return reply.code(400).send({ error: `branch "${branchFrom}" tidak ada di repo project` });
     }
+    let depIds;
+    if (dependsOn !== void 0) {
+      const d = await validateDependsOn(spec.id, spec.projectId, dependsOn);
+      if (!d.ok) return reply.code(400).send({ error: d.error });
+      depIds = d.ids;
+    }
     if (stage !== void 0) {
       if (STAGES.indexOf(stage) >= STAGES.indexOf(spec.stage))
         return reply.code(422).send({ error: "stage hanya boleh dikembalikan mundur" });
@@ -17988,6 +18154,7 @@ ${item.context}` : item.context;
     }
     const data = {};
     if (branchFrom !== void 0) data.branchFrom = branchFrom;
+    if (depIds !== void 0) data.dependsOn = depIds;
     if (stage !== void 0) data.stage = stage;
     if (editingContent) {
       const effPayload = payload ?? spec.payload;
@@ -18020,8 +18187,21 @@ ${item.context}` : item.context;
   });
   app2.delete("/specs/:id", async (req, reply) => {
     const { id } = req.params;
+    const gone = await prisma.spec.findUnique({ where: { id }, select: { projectId: true } });
     await prisma.spec.delete({ where: { id } }).catch(() => {
     });
+    if (gone) {
+      const rows = await prisma.spec.findMany({
+        where: { projectId: gone.projectId },
+        select: { id: true, dependsOn: true }
+      });
+      for (const r of rows) {
+        const ids = dependsOnOf(r);
+        if (!ids.includes(id)) continue;
+        await prisma.spec.update({ where: { id: r.id }, data: { dependsOn: ids.filter((x) => x !== id) } });
+        await notifySynced("spec", r.id);
+      }
+    }
     return reply.code(204).send();
   });
   app2.post("/specs/:id/integrate", async (req, reply) => {
@@ -19251,9 +19431,11 @@ init_pty();
 init_session_phases();
 init_pty();
 var LaunchError = class extends Error {
-  constructor(message, kind) {
+  // SPEC-447 · `blockers` hanya terisi untuk kind "blocked"; route memetakannya ke body 409.
+  constructor(message, kind, blockers = []) {
     super(message);
     this.kind = kind;
+    this.blockers = blockers;
   }
 };
 function resumeState(repoDir, worktree, branchTo, headSha) {
@@ -19275,6 +19457,11 @@ async function startSpecSession(spec, opts) {
   const id = sessionIdForSpec(spec.id);
   const pane = getSession(id);
   if (pane && !pane.exited) return { id: pane.id, reused: true };
+  if (!opts.force) {
+    const blockers = await blockersForSpec(spec, repoDir);
+    if (blockers.length)
+      throw new LaunchError(`${spec.id} ${blockedNote(blockers)}`, "blocked", blockers);
+  }
   if (pane) killSession(id);
   const setting = await getSetting();
   const agent = opts.agent ?? setting.agent;
@@ -19437,12 +19624,16 @@ async function terminal_default(app2) {
           // SPEC-332 · ADR-0073
           agent: parsed.data.agent,
           // SPEC-338 · ADR-0074
-          verifyScope: parsed.data.verifyScope
+          verifyScope: parsed.data.verifyScope,
           // SPEC-376 · ADR-0080
+          force: parsed.data.force
+          // SPEC-447 · ADR-0093
         });
         return reply.code(201).send(r.resumed ? { id: r.id, resumed: true } : { id: r.id });
       } catch (e) {
         if (e instanceof LaunchError) {
+          if (e.kind === "blocked")
+            return reply.code(409).send({ error: e.message, blocked: true, blockers: e.blockers });
           return e.kind === "needs-bind" ? reply.code(400).send({ error: e.message, needsBind: true }) : reply.code(422).send({ error: e.message });
         }
         throw e;
@@ -20378,7 +20569,7 @@ import { readFileSync as readFileSync9 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { join as join9 } from "node:path";
 var USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
-var TTL_MS = 3e4;
+var TTL_MS2 = 3e4;
 var lastOk = null;
 var freshUntil = 0;
 var LABELS = {
@@ -20456,7 +20647,7 @@ async function fetchUsage() {
 async function getLimits() {
   if (lastOk && Date.now() < freshUntil) return lastOk;
   const dto = await fetchUsage();
-  if (dto.status === "ok") freshUntil = Date.now() + TTL_MS;
+  if (dto.status === "ok") freshUntil = Date.now() + TTL_MS2;
   return dto;
 }
 
@@ -20464,7 +20655,7 @@ async function getLimits() {
 import { open as open2, readdir as readdir2, stat } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
 import { join as join10 } from "node:path";
-var TTL_MS2 = 3e4;
+var TTL_MS3 = 3e4;
 var STALE_AFTER_MS = 12 * 36e5;
 var TAIL_BYTES = 512 * 1024;
 var MAX_FILES = 8;
@@ -20569,7 +20760,7 @@ async function getCodexLimits(dir2) {
   const dto = await readLimits(codexSessionsDir());
   if (dto.status !== "unavailable") {
     cache2 = dto;
-    freshUntil2 = Date.now() + TTL_MS2;
+    freshUntil2 = Date.now() + TTL_MS3;
   }
   return dto;
 }
@@ -20587,7 +20778,7 @@ import { execFile as execFile8 } from "node:child_process";
 import { promisify as promisify8 } from "node:util";
 var run = promisify8(execFile8);
 var CODEX_MIN_CLIENT = "0.144.0";
-var TTL_MS3 = 5 * 6e4;
+var TTL_MS4 = 5 * 6e4;
 var cache3 = null;
 var codexBin2 = () => effectiveStr("HANOMAN_CODEX_BIN") ?? "codex";
 function parseCodexVersion(out3) {
@@ -20595,7 +20786,7 @@ function parseCodexVersion(out3) {
   return m ? `${m[1]}.${m[2]}.${m[3]}` : null;
 }
 async function getCodexVersion(now = Date.now()) {
-  if (cache3 && now - cache3.at < TTL_MS3) return cache3.version;
+  if (cache3 && now - cache3.at < TTL_MS4) return cache3.version;
   let version = null;
   try {
     const { stdout } = await run(codexBin2(), ["--version"], { timeout: 5e3 });
@@ -21825,6 +22016,11 @@ async function markDone(id, note) {
     data: { status: "done", ...note ? { note } : {} }
   });
 }
+async function noteQueued(id, note) {
+  const row = await prisma.schedulerQueueItem.findUnique({ where: { id }, select: { note: true } });
+  if (row?.note === note) return;
+  await prisma.schedulerQueueItem.update({ where: { id }, data: { note } });
+}
 
 // src/services/scheduler/registry.ts
 var sources = /* @__PURE__ */ new Map();
@@ -22113,6 +22309,7 @@ function toDecisionView(r) {
 
 // src/services/lead/brain.ts
 init_config2();
+init_pty();
 import { execFile as execFile9 } from "node:child_process";
 var binFor = (agent) => agent === "codex" ? effectiveStr("HANOMAN_CODEX_BIN") ?? "codex" : effectiveStr("HANOMAN_CLAUDE_BIN") ?? "claude";
 function leadArgv(o) {
@@ -22133,14 +22330,16 @@ function leadArgv(o) {
     o.prompt
   ];
 }
+var leadEnv = (agent, base = process.env, uid = process.getuid?.()) => agent === "claude" ? { ...rootBypassEnv(uid), ...base } : { ...base };
 function think(prompt, o) {
   const bin = binFor(o.agent);
   const args = leadArgv({ agent: o.agent, model: o.model, effort: o.effort, prompt });
   return new Promise((resolve14, reject) => {
-    execFile9(bin, args, {
+    const child = execFile9(bin, args, {
       cwd: o.cwd,
       timeout: o.timeoutMs,
       maxBuffer: 16 * 1024 * 1024,
+      env: leadEnv(o.agent),
       encoding: "utf8",
       killSignal: "SIGTERM"
     }, (err, stdout, stderr) => {
@@ -22151,6 +22350,7 @@ function think(prompt, o) {
       }
       resolve14(stdout);
     });
+    child.stdin?.end();
   });
 }
 
@@ -22736,11 +22936,22 @@ async function orderReadyWork(optIn, deps) {
 async function orderProject(projectId, deps) {
   const project = await prisma.project.findUnique({ where: { id: projectId }, select: { schedulerOptIn: true } });
   if (!project?.schedulerOptIn) return 0;
-  const ready = await prisma.spec.findMany({
+  const readyRaw = await prisma.spec.findMany({
     where: { ...UNSTARTED_SPEC_WHERE, projectId },
-    select: { id: true, projectId: true, title: true, priority: true, objective: true },
+    select: {
+      id: true,
+      projectId: true,
+      title: true,
+      priority: true,
+      objective: true,
+      branchFrom: true,
+      dependsOn: true
+    },
     orderBy: { id: "asc" }
   });
+  const repoDir = await resolveRepoDir(projectId);
+  const ready = [];
+  for (const r of readyRaw) if ((await blockersForSpec(r, repoDir)).length === 0) ready.push(r);
   if (ready.length < 2) return 0;
   const already = new Set((await prisma.schedulerQueueItem.findMany({
     where: { specId: { in: ready.map((r) => r.id) } },
@@ -23407,6 +23618,11 @@ async function drain(cfg, deps) {
         await markDone(item.id, ALREADY_DONE_NOTE);
         continue;
       }
+      const blocked = await deps.blockers(item.specId);
+      if (blocked.length) {
+        await noteQueued(item.id, blockedNote(blocked));
+        continue;
+      }
       const liveId = deps.isLive(item.specId);
       if (liveId) {
         await markLaunched(item.id, liveId);
@@ -23536,6 +23752,13 @@ var prodDeps = {
     const s = await prisma.spec.findUnique({ where: { id: specId }, select: { stage: true } });
     return s?.stage === "done";
   },
+  // SPEC-447 · ADR-0093 · dibaca ULANG dari DB tepat sebelum launch, seperti `isDone`: `dependsOn`
+  // bisa ditulis operator selagi item mengantre, dan merged-ness bergerak sendiri saat ada integrate.
+  blockers: async (specId) => {
+    const spec = await prisma.spec.findUnique({ where: { id: specId } });
+    if (!spec) return [];
+    return blockersForSpec(spec, await resolveRepoDir(spec.projectId));
+  },
   launch: async (item, autonomy) => {
     const spec = await prisma.spec.findUnique({ where: { id: item.specId } });
     if (!spec) throw new Error(`spec ${item.specId} tak ada`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hanoman",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Orchestrator + dashboard workflow docs-driven untuk sesi Claude Code / Codex",
   "type": "module",
   "repository": {

package/prisma/migrations/20260731210000_spec_depends_on/migration.sql

@@ -0,0 +1,7 @@
+-- SPEC-447 · ADR-0093 · dependency antar-backlog.
+--
+-- ADITIF & nullable tanpa default → `ADD COLUMN` polos sudah cukup. Beda dari migration SPEC-408
+-- yang harus meredefinisi tabel: yang dilarang SQLite adalah `ADD COLUMN … DEFAULT <non-konstan>`,
+-- bukan `ADD COLUMN` itu sendiri. Baris lama tetap NULL, dan pembaca menerjemahkan NULL → []
+-- (`dependsOnOf` di services/spec-deps.ts) — jadi tak ada backfill yang perlu dilakukan.
+ALTER TABLE "Spec" ADD COLUMN "dependsOn" JSONB;

package/prisma/schema.prisma

@@ -46,6 +46,12 @@ model Spec {
   // sama dengan `baseSha` (services/session-launch.ts); jalur RESUME (ADR-0084) sengaja tidak
   // menimpanya — melanjutkan sesi bukan "mulai lagi". null = belum pernah dikerjakan.
   startedAt  DateTime?
+  // SPEC-447 · ADR-0093 · id spec lain yang harus SELESAI & commit-nya sudah ada di branch basis
+  // sebelum item ini boleh diluncurkan. Array JSON of string; null/[] = tak bergantung apa pun.
+  // Sengaja kolom, bukan tabel join: SQLite melarang scalar list, `Json` sudah dipakai `payload`,
+  // dan kolom ikut FIELDS.spec sync apa adanya. Integritas ditegakkan di boundary route +
+  // pembersihan saat spec dihapus, bukan FK.
+  dependsOn  Json?
   updatedAt  DateTime @updatedAt
   project   Project @relation(fields: [projectId], references: [id], onDelete: Cascade)
 }