hanoman 0.4.0 → 0.5.0

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.0",
-  "sha": "67478d09",
-  "builtAt": "2026-09-14T09:24:41.787Z"
+  "version": "0.5.0",
+  "sha": "c507df84",
+  "builtAt": "2026-09-14T23:17:43.632Z"
 }

package/dist/cli.js

@@ -4412,6 +4412,128 @@ var init_auto_merge = __esm({
   }
 });
 
+// ../shared/src/relay.ts
+function utf8Bytes(s2) {
+  let n2 = 0;
+  for (let i = 0; i < s2.length; i++) {
+    const cp = s2.codePointAt(i);
+    n2 += cpBytes(cp);
+    if (cp > 65535) i++;
+  }
+  return n2;
+}
+var RELAY_PART_MAX_BYTES, RELAY_RESPONSE_MAX_BYTES, RELAY_REASSEMBLY_MAX_BYTES, RELAY_REQUEST_BODY_MAX_BYTES, RELAY_CREDIT_INITIAL, RELAY_CREDIT_REFILL_BELOW, RELAY_SOCKET_MAX_BUFFERED, RELAY_UNSUPPORTED_RETRY_MS, REMOTE_CAPABILITIES, zRemoteCapability, zRemoteControl, REMOTE_CONTROL_DEFAULTS, cpBytes, zRelayActor, zId, UNSAFE_PATH, zRelayPath, zPart, RELAY_METHODS, zWelcome, zReq, zCancel, zOpen, zHubData, zCredit, zClose, zHubToClientFrame, zHello, zRes, zGeometryFields, zOpened, zGeometry, zClientData, zClientToHubFrame, zRemoteControlPut;
+var init_relay = __esm({
+  "../shared/src/relay.ts"() {
+    "use strict";
+    init_zod();
+    RELAY_PART_MAX_BYTES = 32 * 1024;
+    RELAY_RESPONSE_MAX_BYTES = 1024 * 1024;
+    RELAY_REASSEMBLY_MAX_BYTES = 1024 * 1024;
+    RELAY_REQUEST_BODY_MAX_BYTES = 32 * 1024;
+    RELAY_CREDIT_INITIAL = 256 * 1024;
+    RELAY_CREDIT_REFILL_BELOW = 64 * 1024;
+    RELAY_SOCKET_MAX_BUFFERED = 1024 * 1024;
+    RELAY_UNSUPPORTED_RETRY_MS = 30 * 6e4;
+    REMOTE_CAPABILITIES = [
+      "sessions:read",
+      "sessions:write",
+      "sessions:spawn",
+      "backlog:read",
+      "backlog:write",
+      "ide:read"
+    ];
+    zRemoteCapability = external_exports.enum(REMOTE_CAPABILITIES);
+    zRemoteControl = external_exports.object({
+      enabled: external_exports.boolean().default(false),
+      capabilities: external_exports.array(zRemoteCapability).default([])
+    });
+    REMOTE_CONTROL_DEFAULTS = { enabled: false, capabilities: [] };
+    cpBytes = (cp) => cp < 128 ? 1 : cp < 2048 ? 2 : cp < 65536 ? 3 : 4;
+    zRelayActor = external_exports.object({
+      hubOrigin: external_exports.string().min(1).max(200),
+      userId: external_exports.string().min(1).max(200),
+      email: external_exports.string().min(1).max(320)
+    }).strict();
+    zId = external_exports.string().min(1).max(64);
+    UNSAFE_PATH = /(^|\/)\.\.?(\/|$)|%2e|%2f|%5c|\\|[?#]/i;
+    zRelayPath = external_exports.string().max(2048).regex(/^\/api\//).refine((p3) => !UNSAFE_PATH.test(p3), "path relay tak sah");
+    zPart = external_exports.string().refine((s2) => utf8Bytes(s2) <= RELAY_PART_MAX_BYTES, "part relay > 32 KiB");
+    RELAY_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+    zWelcome = external_exports.object({ t: external_exports.literal("welcome"), v: external_exports.literal(1), protocol: external_exports.number().int(), version: external_exports.string().max(40) }).strict();
+    zReq = external_exports.object({
+      t: external_exports.literal("req"),
+      id: zId,
+      method: external_exports.enum(RELAY_METHODS),
+      path: zRelayPath,
+      query: external_exports.string().max(2048).optional(),
+      body: external_exports.unknown().optional(),
+      actor: zRelayActor
+    }).strict();
+    zCancel = external_exports.object({ t: external_exports.literal("cancel"), id: zId }).strict();
+    zOpen = external_exports.object({ t: external_exports.literal("open"), sid: zId, path: zRelayPath, mode: external_exports.enum(["read", "write"]), actor: zRelayActor }).strict();
+    zHubData = external_exports.object({ t: external_exports.literal("data"), sid: zId, d: zPart }).strict();
+    zCredit = external_exports.object({ t: external_exports.literal("credit"), sid: zId, n: external_exports.number().int().min(1).max(4 * 1024 * 1024) }).strict();
+    zClose = external_exports.object({ t: external_exports.literal("close"), sid: zId, code: external_exports.number().int().min(1e3).max(4999), reason: external_exports.string().max(120).optional() }).strict();
+    zHubToClientFrame = external_exports.discriminatedUnion("t", [zWelcome, zReq, zCancel, zOpen, zHubData, zCredit, zClose]);
+    zHello = external_exports.object({
+      t: external_exports.literal("hello"),
+      v: external_exports.literal(1),
+      // Sengaja number, bukan literal: hub harus bisa MELIHAT protokol yang beda untuk menutup 4001
+      // dan menampilkan "protocol-mismatch", bukan membuang frame-nya senyap.
+      protocol: external_exports.number().int(),
+      version: external_exports.string().max(40),
+      capabilities: external_exports.array(zRemoteCapability).max(REMOTE_CAPABILITIES.length)
+    }).strict();
+    zRes = external_exports.object({
+      t: external_exports.literal("res"),
+      id: zId,
+      status: external_exports.number().int().min(100).max(599).optional(),
+      contentType: external_exports.string().max(200).optional(),
+      part: zPart,
+      end: external_exports.boolean()
+    }).strict();
+    zGeometryFields = { cols: external_exports.number().int().min(1).max(1e3), rows: external_exports.number().int().min(1).max(1e3) };
+    zOpened = external_exports.object({ t: external_exports.literal("opened"), sid: zId, geometry: external_exports.object(zGeometryFields).strict().optional() }).strict();
+    zGeometry = external_exports.object({ t: external_exports.literal("geometry"), sid: zId, ...zGeometryFields }).strict();
+    zClientData = external_exports.object({ t: external_exports.literal("data"), sid: zId, d: zPart, more: external_exports.literal(true).optional() }).strict();
+    zClientToHubFrame = external_exports.discriminatedUnion("t", [zHello, zRes, zOpened, zGeometry, zClientData, zClose]);
+    zRemoteControlPut = external_exports.object({
+      control: external_exports.object({ enabled: external_exports.boolean(), capabilities: external_exports.array(external_exports.string().max(40)).max(20) }).strict().optional(),
+      logs: external_exports.object({ event: external_exports.boolean(), server: external_exports.boolean(), transcript: external_exports.boolean() }).strict().optional()
+    }).strict();
+  }
+});
+
+// ../shared/src/logs.ts
+var LOG_LANES, zLogLane, LOG_LEVELS, zLogLevel, LOG_MSG_MAX_BYTES, LOG_DATA_MAX_BYTES, LOG_SHIPPING_DEFAULTS, zLogShipping, LOG_RETENTION_DEFAULTS, days, zLogRetention;
+var init_logs = __esm({
+  "../shared/src/logs.ts"() {
+    "use strict";
+    init_zod();
+    LOG_LANES = ["event", "server", "transcript"];
+    zLogLane = external_exports.enum(LOG_LANES);
+    LOG_LEVELS = ["debug", "info", "warn", "error"];
+    zLogLevel = external_exports.enum(LOG_LEVELS);
+    LOG_MSG_MAX_BYTES = 4 * 1024;
+    LOG_DATA_MAX_BYTES = 8 * 1024;
+    LOG_SHIPPING_DEFAULTS = { event: true, server: false, transcript: false };
+    zLogShipping = external_exports.object({
+      event: external_exports.boolean().default(true),
+      server: external_exports.boolean().default(false),
+      transcript: external_exports.boolean().default(false)
+    });
+    LOG_RETENTION_DEFAULTS = { eventDays: 90, serverDays: 7, transcriptDays: 30, maxBytes: 256 * 1024 ** 2 };
+    days = (d) => external_exports.number().int().min(1).max(365).default(d);
+    zLogRetention = external_exports.object({
+      eventDays: days(90),
+      serverDays: days(7),
+      transcriptDays: days(30),
+      maxBytes: external_exports.number().int().min(16 * 1024 ** 2).max(4 * 1024 ** 3).default(256 * 1024 ** 2)
+    });
+  }
+});
+
 // ../shared/src/entities.ts
 function cmpVersion(a, b) {
   const pa = a.split(".").map(Number);
@@ -4432,6 +4554,8 @@ var init_entities = __esm({
     init_agent_engine();
     init_auto_merge();
     init_method_catalog();
+    init_relay();
+    init_logs();
     zProject = external_exports.object({
       id: external_exports.string(),
       name: external_exports.string(),
@@ -4695,6 +4819,15 @@ var init_entities = __esm({
       // SPEC-854 · ADR-0130 · chat portal klien (opt-in, mati)
       orchestration: zOrchestration.default(ORCHESTRATION_DEFAULTS),
       // ADR-0164 · orkestrasi subagent per fase (default aktif)
+      // SPEC-1215 · ADR-0165/0166 · LOCAL-only (setting tak ada di SYNCED) dan TAK ditulis `PUT /settings`
+      // (routes/settings.ts mempertahankan nilai tersimpan). Pengelolanya `PUT /api/remote-control` dan,
+      // kelak, `PUT /api/logs/retention` — keduanya COOKIE_ONLY.
+      remoteControl: zRemoteControl.default(REMOTE_CONTROL_DEFAULTS),
+      // grant kendali jarak jauh (default mati)
+      logShipping: zLogShipping.default(LOG_SHIPPING_DEFAULTS),
+      // lajur log ke hub (SPEC-1217)
+      logRetention: zLogRetention.default(LOG_RETENTION_DEFAULTS),
+      // retensi log di hub (SPEC-1217)
       // SPEC-881 · ADR-0136 · sidik jari isi bawaan yang TERAKHIR ditulis seed di mesin ini, per nama
       // agen. Dipakai seed untuk membedakan "belum pernah disunting operator" dari "sudah". WAJIB
       // dideklarasikan di sini: zod membuang kunci tak dikenal dan `PUT /settings` menulis balik hasil
@@ -6647,6 +6780,8 @@ var init_api = __esm({
       // SPEC-213 · device token + activity log
       deviceTokens: `${API}/device-tokens`,
       deviceToken: (id) => `${API}/device-tokens/${id}`,
+      // SPEC-1215 · ADR-0165 · grant kendali jarak jauh mesin ini (cookie-only)
+      remoteControl: `${API}/remote-control`,
       sessionResults: (projectId) => `${API}/session-results${projectId ? `?projectId=${encodeURIComponent(projectId)}` : ""}`,
       // SPEC-215 · config runtime
       config: `${API}/config`,
@@ -11407,11 +11542,12 @@ var init_session_ask = __esm({
 });
 
 // ../shared/src/presence.ts
-var PRESENCE_PROTOCOL, MAX_PRESENCE_SESSIONS, PRESENCE_MAX_FRAME_BYTES, zPresenceSession, zPresenceFrame;
+var PRESENCE_PROTOCOL, MAX_PRESENCE_SESSIONS, PRESENCE_MAX_FRAME_BYTES, zPresenceSession, zPresenceFrame, zCapacityFrame;
 var init_presence = __esm({
   "../shared/src/presence.ts"() {
     "use strict";
     init_zod();
+    init_session_admission();
     PRESENCE_PROTOCOL = 1;
     MAX_PRESENCE_SESSIONS = 100;
     PRESENCE_MAX_FRAME_BYTES = 32 * 1024;
@@ -11431,6 +11567,11 @@ var init_presence = __esm({
       v: external_exports.literal(PRESENCE_PROTOCOL),
       sessions: external_exports.array(zPresenceSession).max(MAX_PRESENCE_SESSIONS)
     }).strict();
+    zCapacityFrame = external_exports.object({
+      t: external_exports.literal("capacity"),
+      v: external_exports.literal(PRESENCE_PROTOCOL),
+      admission: zLaunchStatus
+    }).strict();
   }
 });
 
@@ -11492,6 +11633,8 @@ var init_src = __esm({
     init_session_dialog();
     init_session_ask();
     init_presence();
+    init_relay();
+    init_logs();
     init_pending();
     init_team();
     init_model_catalog();
@@ -33955,6 +34098,11 @@ var init_migrate_pg = __esm({
       "SyncState",
       "SyncConflict",
       "SyncTombstone",
+      // SPEC-1215 · ADR-0166 · LOCAL-only, tanpa FK. Tabel ini tak ada di sumber Postgres lama — jalur
+      // 42P01 memperlakukannya sebagai nol baris (cermin AgentInvocation/Changelog). Tetap WAJIB
+      // terdaftar: test migrate-pg menuntut PG_ORDER = seluruh model DMMF.
+      "LogEntry",
+      "LogCursor",
       // SPEC-485 · ADR-0102 · LeadFlow SEBELUM LeadDecision: `flowId` menunjuk ke sana. Tanpa FK, tapi
       // urutan tabel harus tetap mencerminkan arah tautannya bagi pembaca berikutnya.
       // SPEC-646 · ADR-0112 · SchedulerCron SEBELUM SchedulerCronRun: `cronId` menunjuk ke sana. Tanpa