hanoman 0.9.18 → 0.9.20

package/dist/server.js

@@ -4273,13 +4273,14 @@ function stampSpecMethod(payload, methodId) {
   if (typeof payload !== "object" || Array.isArray(payload)) return null;
   return { ...payload, method: methodId };
 }
-var DEFAULT_METHOD, VERIFICATION_GATE, MATT_CLAUSE, METHODS, METHOD_IDS, uniq, PLAN_DIRS, SPEC_DIRS;
+var DEFAULT_METHOD, VERIFICATION_GATE, MATT_CLAUSE, AGENT_SKILLS_CLAUSE, METHODS, METHOD_IDS, uniq, PLAN_DIRS, SPEC_DIRS;
 var init_method_catalog = __esm({
   "../shared/src/method-catalog.ts"() {
     "use strict";
     DEFAULT_METHOD = "superpowers";
     VERIFICATION_GATE = "superpowers:verification-before-completion";
     MATT_CLAUSE = "Skill mattpocock yang kontraknya mewawancarai manusia (`/grill-me`, `/to-spec`, `/triage`) JANGAN dipakai: pakai primitif model-invoked-nya untuk menguji rancanganmu sendiri, bukan untuk mewawancarai siapa pun. Hal yang masih ambigu dan akan mempengaruhi hasil tetap JANGAN diputuskan sendiri \u2014 bila kamu agen fase, daftarkan di `Keputusan terbuka:` laporanmu; bila tidak, ajukan lewat jalur tanya di klausa otonomi prompt ini. `to-tickets` di fase Plan dipakai HANYA sebagai penghasil berkas plan berkotak `- [ ]` di `docs/matt/plans/`, BUKAN penerbit tiket \u2014 hanoman sendiri adalah issue tracker-nya, jadi jangan menulis ke tracker eksternal mana pun.";
+    AGENT_SKILLS_CLAUSE = "Pakai skill Agent Skills langsung sesuai fase, bukan slash-command atau meta-router `using-agent-skills`. Kontrak fase, instruksi project/pengguna, dan jalur keputusan/review hanoman tetap berlaku: `spec-driven-development` hanya menyusun spec pada fase Spec, jangan menjalankan Plan atau Execute dari fase itu. Simpan spec di `docs/agent-skills/specs/` dan plan beserta SELURUH checklist task `- [ ]` di `docs/agent-skills/plans/`, dengan id backlog pada nama berkas; ini menggantikan default `SPEC.md`, `tasks/plan.md`, dan `tasks/todo.md` upstream. Jangan menimpa plan lain yang belum tuntas atau membuat tiket di tracker eksternal: hanoman adalah issue tracker-nya. Centang task di berkas plan yang sama setelah implementasi dan verifikasi. Hal ambigu yang mempengaruhi hasil mengikuti jalur tanya prompt ini; bila kamu agen fase, daftarkan di `Keputusan terbuka:` laporanmu.";
     METHODS = {
       // Isi `PHASE_SKILLS` (SPEC-166) dipindah APA ADANYA. Objective & Spec adalah keluaran skill
       // brainstorming yang di-invoke di fase Brainstorm — sengaja tak punya entri sendiri. Fase reverse
@@ -4360,6 +4361,44 @@ var init_method_catalog = __esm({
             "codex plugin add superpowers@openai-curated"
           ]
         }
+      },
+      "agent-skills": {
+        id: "agent-skills",
+        label: "Agent Skills (Addy Osmani)",
+        planDir: "docs/agent-skills/plans",
+        specDir: "docs/agent-skills/specs",
+        phaseSkills: {
+          Brainstorm: ["agent-skills:idea-refine"],
+          Spec: ["agent-skills:spec-driven-development"],
+          Audit: [
+            "agent-skills:debugging-and-error-recovery",
+            "agent-skills:code-review-and-quality"
+          ],
+          Plan: ["agent-skills:planning-and-task-breakdown"],
+          Execute: [
+            "agent-skills:incremental-implementation",
+            "agent-skills:test-driven-development",
+            "agent-skills:code-review-and-quality"
+          ],
+          Verifikasi: [VERIFICATION_GATE]
+        },
+        exitSkills: [VERIFICATION_GATE],
+        extraClause: AGENT_SKILLS_CLAUSE,
+        requires: ["agent-skills", "superpowers"],
+        // Manifest upstream: marketplace Claude = addy-agent-skills, Codex = agent-skills.
+        install: {
+          claude: [
+            "claude plugin marketplace add addyosmani/agent-skills",
+            "claude plugin install agent-skills@addy-agent-skills",
+            "claude plugin marketplace add obra/superpowers-marketplace",
+            "claude plugin install superpowers@superpowers-marketplace"
+          ],
+          codex: [
+            "codex plugin marketplace add addyosmani/agent-skills",
+            "codex plugin add agent-skills@agent-skills",
+            "codex plugin add superpowers@openai-curated"
+          ]
+        }
       }
     };
     METHOD_IDS = Object.keys(METHODS);
@@ -5055,7 +5094,7 @@ function cmpVersion(a, b) {
   }
   return 0;
 }
-var zProject, zBriefPayload, zQaPayload, zGoalPayload, zSpecBlocker, zSourceChange, zManualDone, zSpec, zSpecListItem, zSpecSlim, NOTIFY_SOUNDS, EFFORTS, MODELS, CLAUDE_DEFAULT_ALIAS, E_5_6, E_LUNA, E_BASE, CODEX_MODELS, RETIRED_CODEX_MODELS, zCodex, CODEX_DEFAULTS, zSourceCommon, zScheduler, SCHEDULER_DEFAULTS, zGoal, GOAL_DEFAULTS, zConflict, CONFLICT_DEFAULTS, CHANGELOG_ENGINE_DEFAULTS, zLeadEngine, zLead, LEAD_DEFAULTS, zPortalChat, PORTAL_CHAT_DEFAULTS, zPhaseCell, PHASE_OVERRIDE_LIMITS, zPhaseOverride, zPhaseOverrides, zFlowOrchestration, zOrchestration, ORCHESTRATION_DEFAULTS, zSetting, zNotification, zDocFile, zDeviceTokenView;
+var zProject, zBriefPayload, zQaPayload, zGoalPayload, zSpecBlocker, zSourceChange, zManualDone, zSpec, zSpecListItem, zSpecSlim, NOTIFY_SOUNDS, EFFORTS, MODELS, CLAUDE_DEFAULT_ALIAS, E_5_6, E_LUNA, E_BASE, CODEX_MODELS, RETIRED_CODEX_MODELS, zCodex, CODEX_DEFAULTS, zSourceCommon, zScheduler, SCHEDULER_DEFAULTS, zGoal, GOAL_DEFAULTS, zConflict, CONFLICT_DEFAULTS, zLeadEngine, zLead, LEAD_DEFAULTS, zPortalChat, PORTAL_CHAT_DEFAULTS, zPhaseCell, PHASE_OVERRIDE_LIMITS, zPhaseOverride, zPhaseOverrides, zFlowOrchestration, zOrchestration, ORCHESTRATION_DEFAULTS, zSetting, zNotification, zDocFile, zDeviceTokenView;
 var init_entities = __esm({
   "../shared/src/entities.ts"() {
     "use strict";
@@ -5247,7 +5286,6 @@ var init_entities = __esm({
       effort: external_exports.string().default("xhigh")
     });
     CONFLICT_DEFAULTS = zConflict.parse({});
-    CHANGELOG_ENGINE_DEFAULTS = zAgentEngine.parse({});
     zLeadEngine = zAgentEngine;
     zLead = external_exports.object({
       enabled: external_exports.boolean().default(false),
@@ -5368,8 +5406,6 @@ var init_entities = __esm({
       // SPEC-409 · ADR-0091 · hanoman-lead (default mati)
       telegram: zTelegramSettings.default(TELEGRAM_DEFAULTS),
       // SPEC-476 · ADR-0096 · gateway Telegram (default mati)
-      changelog: zAgentEngine.default(CHANGELOG_ENGINE_DEFAULTS),
-      // SPEC-518 · agen pembuat changelog (opt-in, mati)
       portalChat: zPortalChat.default(PORTAL_CHAT_DEFAULTS),
       // SPEC-854 · ADR-0130 · chat portal klien (opt-in, mati)
       orchestration: zOrchestration.default(ORCHESTRATION_DEFAULTS),
@@ -8191,6 +8227,7 @@ var init_api = __esm({
       qaAttachments: (pid, rid) => `${API}/projects/${encodeURIComponent(pid)}/qa/reports/${encodeURIComponent(rid)}/attachments`,
       qaAttachment: (pid, rid, aid) => `${API}/projects/${encodeURIComponent(pid)}/qa/reports/${encodeURIComponent(rid)}/attachments/${encodeURIComponent(aid)}`,
       qaFindingBacklog: (pid, rid, fid) => `${API}/projects/${encodeURIComponent(pid)}/qa/reports/${encodeURIComponent(rid)}/findings/${encodeURIComponent(fid)}/backlog`,
+      qaFindingSession: (pid, rid, fid) => `${API}/projects/${encodeURIComponent(pid)}/qa/reports/${encodeURIComponent(rid)}/findings/${encodeURIComponent(fid)}/session`,
       qaReportBacklog: (pid, rid) => `${API}/projects/${encodeURIComponent(pid)}/qa/reports/${encodeURIComponent(rid)}/backlog`,
       qaCasesImport: (pid, rid) => `${API}/projects/${encodeURIComponent(pid)}/qa/reports/${encodeURIComponent(rid)}/cases/import`,
       qaImport: (pid) => `${API}/projects/${encodeURIComponent(pid)}/qa/import`,
@@ -8241,10 +8278,6 @@ var init_api = __esm({
       // SPEC-471 · ADR-0095 · tarik & triase issue GitHub (di belakang gate cookie, capability `support`).
       // hanoman TIDAK PERNAH menulis ke GitHub — tak ada path komentar/close di sini, dan itu disengaja.
       githubPull: (id2) => `${API}/projects/${encodeURIComponent(id2)}/github/pull`,
-      // SPEC-516 · ADR-0105 · changelog per project
-      changelog: (id2) => `${API}/projects/${encodeURIComponent(id2)}/changelog`,
-      changelogSources: (id2) => `${API}/projects/${encodeURIComponent(id2)}/changelog/sources`,
-      changelogItem: (id2, cid) => `${API}/projects/${encodeURIComponent(id2)}/changelog/${encodeURIComponent(cid)}`,
       githubIssues: (id2) => `${API}/projects/${encodeURIComponent(id2)}/github/issues`,
       githubIssuesAccept: `${API}/github-issues/accept`,
       githubIssueAccept: (id2) => `${API}/github-issues/${encodeURIComponent(id2)}/accept`,
@@ -10819,7 +10852,7 @@ var init_docs = __esm({
           required: ["project", "prd"]
         }),
         // `breakdown` hidup di berkas route docs.ts, TAPI `capabilityForRoute` memetakan sub-path
-        // `projects/:id/*` yang tak terdaftar ke `projects:*` — hanya `docs`, `prds`, dan `changelog`
+        // `projects/:id/*` yang tak terdaftar ke `projects:*` — hanya `docs` dan `prds`
         // yang dipetakan ke `docs:*`. Menuliskannya `docs:read` membuat uji kontrak merah, dan itulah
         // yang terjadi saat tool ini pertama ditulis.
         mode: "read",
@@ -10832,116 +10865,6 @@ var init_docs = __esm({
           query: query({ prd: s(a.prd) })
         }),
         shape: (raw) => raw
-      },
-      {
-        name: "hanoman_changelog_sources",
-        title: "Sumber changelog yang tersedia",
-        description: "Bahan mentah yang bisa dipakai membuat changelog: daftar tag git, HEAD, dan rentang backlog yang sudah selesai. Panggil ini SEBELUM hanoman_changelog_create \u2014 ia memberitahu mode mana yang mungkin (`hasRepo: false` berarti mode commit & version tak akan jalan) dan `defaultRange` yang masuk akal.",
-        inputSchema: obj({ properties: { project: PROJECT }, required: ["project"] }),
-        mode: "read",
-        capability: "docs:read",
-        samplePath: "/projects/hanoman/changelog/sources",
-        sampleMethod: "GET",
-        build: (a) => ({ method: "GET", path: `/projects/${enc(String(a.project))}/changelog/sources` }),
-        shape: (raw) => raw
-      },
-      {
-        name: "hanoman_changelog_list",
-        title: "Daftar changelog project",
-        description: "Changelog yang sudah dibuat untuk sebuah project, terbaru dulu, berhalaman. `q` menyaring judul & isi.",
-        inputSchema: obj({
-          properties: {
-            project: PROJECT,
-            q: str("Kata kunci penyaring judul & isi changelog. Kosongkan untuk semua."),
-            page: int("Halaman, mulai 1.", { minimum: 1 }),
-            limit: int("Item per halaman.", { minimum: 1, maximum: 200 })
-          },
-          required: ["project"]
-        }),
-        mode: "read",
-        capability: "docs:read",
-        samplePath: "/projects/hanoman/changelog",
-        sampleMethod: "GET",
-        build: (a) => ({
-          method: "GET",
-          path: `/projects/${enc(String(a.project))}/changelog`,
-          query: query({ q: s(a.q), page: n(a.page)?.toString(), limit: n(a.limit)?.toString() })
-        }),
-        shape: (raw) => raw
-      },
-      {
-        name: "hanoman_changelog_get",
-        title: "Baca satu changelog",
-        description: "Satu entri changelog beserta isinya, dicari menurut id di dalam project tersebut.",
-        inputSchema: obj({
-          properties: { project: PROJECT, changelog: str("Id changelog, dari hanoman_changelog_list.") },
-          required: ["project", "changelog"]
-        }),
-        mode: "read",
-        capability: "docs:read",
-        samplePath: "/projects/hanoman/changelog/c1",
-        sampleMethod: "GET",
-        build: (a) => ({ method: "GET", path: `/projects/${enc(String(a.project))}/changelog/${enc(String(a.changelog))}` }),
-        shape: (raw) => raw
-      },
-      {
-        name: "hanoman_changelog_create",
-        title: "Buat changelog",
-        description: "Membuat changelog baru dari salah satu dari tiga sumber. `mode` menentukan field mana yang WAJIB menyertainya: `backlog` memakai rentang tanggal (`from`/`to`, boleh kosong = seluruhnya), `commit` memakai dua sha, `version` memakai tag. Server menjawab 422 bila sumbernya tak tersedia \u2014 panggil hanoman_changelog_sources lebih dulu.",
-        inputSchema: obj({
-          properties: {
-            project: PROJECT,
-            mode: enumStr(["backlog", "commit", "version"], "Sumber changelog. Field yang menyertainya ditentukan nilai ini."),
-            from: str("Mode `backlog`: tanggal awal `YYYY-MM-DD`. Kosongkan untuk tanpa batas awal."),
-            to: str("Mode `backlog`: tanggal akhir `YYYY-MM-DD`. Harus >= `from`."),
-            fromSha: str("Mode `commit`: sha awal, minimal 4 karakter."),
-            toSha: str("Mode `commit`: sha akhir, minimal 4 karakter."),
-            fromTag: str("Mode `version`: tag awal. Kosongkan untuk mulai dari tag terawal."),
-            toTag: str("Mode `version`: tag akhir. WAJIB.")
-          },
-          required: ["project", "mode"],
-          // Skema ketat DI KLIEN: validator SDK menolak pasangan yang salah sebelum permintaan lahir,
-          // jadi agen dibimbing ke panggilan yang sah alih-alih menemukannya lewat 400 (ADR-0099 #2).
-          allOf: [
-            {
-              if: { properties: { mode: { const: "backlog" } }, required: ["mode"] },
-              then: { properties: { from: { type: "string" }, to: { type: "string" } } }
-            },
-            {
-              if: { properties: { mode: { const: "commit" } }, required: ["mode"] },
-              then: { required: ["fromSha", "toSha"] }
-            },
-            {
-              if: { properties: { mode: { const: "version" } }, required: ["mode"] },
-              then: { required: ["toTag"] }
-            }
-          ]
-        }),
-        mode: "write",
-        capability: "docs:write",
-        samplePath: "/projects/hanoman/changelog",
-        sampleMethod: "POST",
-        build: (a) => {
-          const mode = String(a.mode);
-          const body = mode === "commit" ? { mode, fromSha: String(a.fromSha), toSha: String(a.toSha) } : mode === "version" ? { mode, ...s(a.fromTag) ? { fromTag: s(a.fromTag) } : {}, toTag: String(a.toTag) } : { mode, ...s(a.from) ? { from: s(a.from) } : {}, ...s(a.to) ? { to: s(a.to) } : {} };
-          return { method: "POST", path: `/projects/${enc(String(a.project))}/changelog`, body };
-        },
-        shape: (raw) => raw
-      },
-      {
-        name: "hanoman_changelog_delete",
-        title: "Hapus changelog (BERBAHAYA)",
-        description: "BERBAHAYA \u2014 menghapus satu entri changelog secara permanen. Isinya tak tersimpan di tempat lain: changelog lahir dari generator dan tak bisa dipulihkan tanpa membuatnya ulang. Hanya muncul saat tingkat `--danger` menyala.",
-        inputSchema: obj({
-          properties: { project: PROJECT, changelog: str("Id changelog yang akan dihapus.") },
-          required: ["project", "changelog"]
-        }),
-        mode: "danger",
-        capability: "docs:write",
-        samplePath: "/projects/hanoman/changelog/c1",
-        sampleMethod: "DELETE",
-        build: (a) => ({ method: "DELETE", path: `/projects/${enc(String(a.project))}/changelog/${enc(String(a.changelog))}` }),
-        shape: (raw) => raw
       }
     ];
   }
@@ -13679,6 +13602,18 @@ var init_qa2 = __esm({
         build: (a) => ({ method: "PATCH", path: `${one(a)}/findings/${enc(String(a.finding))}`, body: findingBody(a) }),
         shape: (raw) => raw
       },
+      {
+        name: "hanoman_qa_finding_start_session",
+        title: "Kerjakan temuan QA langsung",
+        description: "Membuka sesi agen terisolasi dari temuan QA tanpa membuat backlog, membawa langkah uji dan lampiran. Memerlukan qa:write DAN sessions:write. Klik ulang memakai sesi aktif yang sama. Temuan wontfix atau sudah terkait backlog ditolak; laporan closed boleh.",
+        inputSchema: obj({ properties: { project: PROJECT3, report: REPORT, finding: FINDING }, required: ["project", "report", "finding"] }),
+        mode: "write",
+        capability: "qa:write",
+        samplePath: "/projects/p1/qa/reports/r1/findings/f1/session",
+        sampleMethod: "POST",
+        build: (a) => ({ method: "POST", path: `${one(a)}/findings/${enc(String(a.finding))}/session`, body: {} }),
+        shape: (raw) => raw
+      },
       {
         name: "hanoman_qa_finding_to_backlog",
         title: "Kirim temuan QA ke backlog",
@@ -13839,7 +13774,7 @@ var init_mcp = __esm({
     init_mcp_shape();
     init_mcp_catalog();
     init_mcp_catalog();
-    MCP_TOOL_SCHEMA_VERSION = 1;
+    MCP_TOOL_SCHEMA_VERSION = 2;
     MCP_INSTRUCTIONS = [
       `hanoman \u2014 orchestrator backlog + dashboard. Skema tool versi ${MCP_TOOL_SCHEMA_VERSION}.`,
       "",
@@ -13852,56 +13787,6 @@ var init_mcp = __esm({
   }
 });
 
-// ../shared/src/changelog.ts
-function dayString(d) {
-  const p3 = (n2) => String(n2).padStart(2, "0");
-  return `${d.getFullYear()}-${p3(d.getMonth() + 1)}-${p3(d.getDate())}`;
-}
-function defaultRange(today) {
-  const from = new Date(today.getFullYear(), today.getMonth(), today.getDate() - (DEFAULT_RANGE_DAYS - 1));
-  return { from: dayString(from), to: dayString(today) };
-}
-function changelogMatches(row, q2) {
-  const needle = (q2 ?? "").trim().toLowerCase();
-  if (!needle) return true;
-  return row.title.toLowerCase().includes(needle) || row.body.toLowerCase().includes(needle) || row.mode.toLowerCase().includes(needle);
-}
-var CHANGELOG_MODES, zChangelogMode, zDay, zChangelogRequest, zChangelogView, DEFAULT_RANGE_DAYS;
-var init_changelog = __esm({
-  "../shared/src/changelog.ts"() {
-    "use strict";
-    init_zod();
-    CHANGELOG_MODES = ["backlog", "commit", "version"];
-    zChangelogMode = external_exports.enum(CHANGELOG_MODES);
-    zDay = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/, "format tanggal harus YYYY-MM-DD");
-    zChangelogRequest = external_exports.discriminatedUnion("mode", [
-      external_exports.object({ mode: external_exports.literal("backlog"), from: zDay.optional(), to: zDay.optional() }),
-      external_exports.object({ mode: external_exports.literal("commit"), fromSha: external_exports.string().trim().min(4), toSha: external_exports.string().trim().min(4) }),
-      external_exports.object({ mode: external_exports.literal("version"), fromTag: external_exports.string().trim().min(1).optional(), toTag: external_exports.string().trim().min(1) })
-    ]).superRefine((v, ctx) => {
-      if (v.mode === "backlog" && v.from && v.to && v.from > v.to)
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["from"],
-          message: "rentang tanggal terbalik \u2014 `from` harus lebih awal atau sama dengan `to`"
-        });
-    });
-    zChangelogView = external_exports.object({
-      id: external_exports.string(),
-      projectId: external_exports.string(),
-      mode: zChangelogMode,
-      title: external_exports.string(),
-      params: external_exports.unknown(),
-      body: external_exports.string(),
-      generator: external_exports.enum(["agent", "fallback"]),
-      warning: external_exports.string().nullable(),
-      itemCount: external_exports.number().int(),
-      createdAt: external_exports.string()
-    });
-    DEFAULT_RANGE_DAYS = 30;
-  }
-});
-
 // ../shared/src/terminal-workspace.ts
 var zSessionId, zTrackSizes, zTerminalGroup, zTerminalWorkspaceV1, zTerminalWorkspaceWrite, zTerminalWorkspaceSnapshot;
 var init_terminal_workspace = __esm({
@@ -14350,7 +14235,6 @@ var init_src = __esm({
     init_mcp();
     init_auto_merge();
     init_handled_by();
-    init_changelog();
     init_cron_expr();
     init_terminal_workspace();
     init_terminal_io();
@@ -23445,8 +23329,8 @@ var require_webidl = __commonJS({
         return new Uint8Array(0);
       }
       const bytes = new Uint8Array(length);
-      const view13 = new Uint8Array(jsArrayBuffer, offset, length);
-      bytes.set(view13);
+      const view12 = new Uint8Array(jsArrayBuffer, offset, length);
+      bytes.set(view12);
       return bytes;
     };
     webidl.converters.DOMString = function(V, prefix, argument, flags) {
@@ -31855,7 +31739,7 @@ var require_mock_interceptor = __commonJS({
 var require_mock_client = __commonJS({
   "../node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/mock/mock-client.js"(exports, module) {
     "use strict";
-    var { promisify: promisify18 } = __require("node:util");
+    var { promisify: promisify17 } = __require("node:util");
     var Client = require_client();
     var { buildMockDispatch } = require_mock_utils();
     var {
@@ -31903,7 +31787,7 @@ var require_mock_client = __commonJS({
         this[kDispatches] = [];
       }
       async [kClose]() {
-        await promisify18(this[kOriginalClose])();
+        await promisify17(this[kOriginalClose])();
         this[kConnected] = 0;
         this[kMockAgent][Symbols.kClients].delete(this[kOrigin]);
       }
@@ -32116,7 +32000,7 @@ var require_mock_call_history = __commonJS({
 var require_mock_pool = __commonJS({
   "../node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/mock/mock-pool.js"(exports, module) {
     "use strict";
-    var { promisify: promisify18 } = __require("node:util");
+    var { promisify: promisify17 } = __require("node:util");
     var Pool = require_pool();
     var { buildMockDispatch } = require_mock_utils();
     var {
@@ -32164,7 +32048,7 @@ var require_mock_pool = __commonJS({
         this[kDispatches] = [];
       }
       async [kClose]() {
-        await promisify18(this[kOriginalClose])();
+        await promisify17(this[kOriginalClose])();
         this[kConnected] = 0;
         this[kMockAgent][Symbols.kClients].delete(this[kOrigin]);
       }
@@ -48932,25 +48816,25 @@ var init_lib4 = __esm({
 });
 
 // ../node_modules/.pnpm/uint8array-extras@1.5.0/node_modules/uint8array-extras/index.js
-function getUintBE(view13) {
-  const { byteLength } = view13;
+function getUintBE(view12) {
+  const { byteLength } = view12;
   if (byteLength === 6) {
-    return view13.getUint16(0) * 2 ** 32 + view13.getUint32(2);
+    return view12.getUint16(0) * 2 ** 32 + view12.getUint32(2);
   }
   if (byteLength === 5) {
-    return view13.getUint8(0) * 2 ** 32 + view13.getUint32(1);
+    return view12.getUint8(0) * 2 ** 32 + view12.getUint32(1);
   }
   if (byteLength === 4) {
-    return view13.getUint32(0);
+    return view12.getUint32(0);
   }
   if (byteLength === 3) {
-    return view13.getUint8(0) * 2 ** 16 + view13.getUint16(1);
+    return view12.getUint8(0) * 2 ** 16 + view12.getUint16(1);
   }
   if (byteLength === 2) {
-    return view13.getUint16(0);
+    return view12.getUint16(0);
   }
   if (byteLength === 1) {
-    return view13.getUint8(0);
+    return view12.getUint8(0);
   }
 }
 var cachedDecoders, cachedEncoder, byteToHexLookupTable;
@@ -51784,6 +51668,7 @@ var init_qa_attachment_sync = __esm({
 var sync_exports = {};
 __export(sync_exports, {
   BOOTSTRAP_ORDER: () => BOOTSTRAP_ORDER,
+  OPTIONAL_ENTITIES: () => OPTIONAL_ENTITIES,
   PARENTS: () => PARENTS,
   PULL_MAX_BYTES: () => PULL_MAX_BYTES,
   QA_SYNC_MIMES: () => QA_SYNC_MIMES,
@@ -51792,12 +51677,14 @@ __export(sync_exports, {
   __FIELDS: () => __FIELDS,
   __FIELDS_FOR_TEST: () => __FIELDS_FOR_TEST,
   __JSON_FIELDS: () => __JSON_FIELDS,
+  acceptedOptional: () => acceptedOptional,
   applyPush: () => applyPush,
   backfillFeed: () => backfillFeed,
   bootstrapSnapshot: () => bootstrapSnapshot,
   consumeTombstoneOnRecreate: () => consumeTombstoneOnRecreate,
   deleteRow: () => deleteRow,
   isEntity: () => isEntity,
+  isOptionalEntity: () => isOptionalEntity,
   publishDelete: () => publishDelete,
   publishLocal: () => publishLocal,
   pull: () => pull,
@@ -51807,6 +51694,10 @@ __export(sync_exports, {
   upsertLocal: () => upsertLocal,
   validateSyncData: () => validateSyncData
 });
+function acceptedOptional(raw) {
+  const want = typeof raw === "string" ? raw.split(",").map((x) => x.trim()) : [];
+  return new Set(OPTIONAL_ENTITIES.filter((e) => want.includes(e)));
+}
 function validateSyncData(entity, data, options2 = {}) {
   const allowed = new Set(FIELDS[entity]);
   if (entity === "project" && options2.allowProjectRename) allowed.add("renamedFrom");
@@ -51953,17 +51844,23 @@ async function applyPush(entity, id2, baseVersion, data, deviceId, op = "upsert"
 function recordBytes(rec) {
   return Buffer.byteLength(JSON.stringify(rec));
 }
-async function pull(sinceCursor, limit = 500, maxBytes = PULL_MAX_BYTES) {
+async function pull(sinceCursor, limit = 500, maxBytes = PULL_MAX_BYTES, opts2 = {}) {
   const since = Number(sinceCursor || "0");
   const rows = await prisma.syncLog.findMany({
     where: { seq: { gt: since } },
     orderBy: { seq: "asc" },
     take: limit
   });
+  const accept = opts2.accept ?? /* @__PURE__ */ new Set();
   const records = [];
   let bytes = 0;
   let trimmed = false;
+  let consumed = null;
   for (const r of rows) {
+    if (isOptionalEntity(r.entity) && !accept.has(r.entity)) {
+      consumed = r.seq;
+      continue;
+    }
     const rec = {
       entity: r.entity,
       recordId: r.recordId,
@@ -51978,11 +51875,12 @@ async function pull(sinceCursor, limit = 500, maxBytes = PULL_MAX_BYTES) {
     }
     bytes += size;
     records.push(rec);
+    consumed = r.seq;
   }
-  const cursor = records.length ? String(rows[records.length - 1].seq) : sinceCursor || "0";
-  return { cursor, records, hasMore: trimmed || rows.length === limit };
+  const cursor = consumed !== null ? String(consumed) : sinceCursor || "0";
+  return { cursor, records, hasMore: trimmed || rows.length === limit, entities: [...OPTIONAL_ENTITIES] };
 }
-async function bootstrapSnapshot(after, maxBytes = PULL_MAX_BYTES) {
+async function bootstrapSnapshot(after, maxBytes = PULL_MAX_BYTES, opts2 = {}) {
   const tip = await prisma.syncLog.findFirst({ orderBy: { seq: "desc" }, select: { seq: true } });
   const cursor = tip ? String(tip.seq) : "0";
   const sep9 = after ? after.indexOf(":") : -1;
@@ -51995,6 +51893,8 @@ async function bootstrapSnapshot(after, maxBytes = PULL_MAX_BYTES) {
   let last2 = null;
   for (let i = startAt; i < BOOTSTRAP_ORDER.length; i++) {
     const entity = BOOTSTRAP_ORDER[i];
+    if (isOptionalEntity(entity) && !(opts2.accept ?? /* @__PURE__ */ new Set()).has(entity)) continue;
+    if (opts2.only && !opts2.only.has(entity)) continue;
     const gt = i === startAt && afterId ? afterId : null;
     const rows = await DELEGATE[entity].findMany({
       ...gt ? { where: { id: { gt } } } : {},
@@ -52013,14 +51913,14 @@ async function bootstrapSnapshot(after, maxBytes = PULL_MAX_BYTES) {
       };
       const size = recordBytes(rec);
       if (records.length && bytes + size > maxBytes) {
-        return { cursor, records, hasMore: true, next: last2 };
+        return { cursor, records, hasMore: true, next: last2, entities: [...OPTIONAL_ENTITIES] };
       }
       bytes += size;
       records.push(rec);
       last2 = `${entity}:${row.id}`;
     }
   }
-  return { cursor, records, hasMore: false, next: null };
+  return { cursor, records, hasMore: false, next: null, entities: [...OPTIONAL_ENTITIES] };
 }
 async function publishLocal(entity, id2) {
   const snap = await snapshot(entity, id2);
@@ -52114,7 +52014,7 @@ async function upsertLocal(entity, id2, version, data) {
 function setAcceptedHook(hook) {
   onAccepted = hook;
 }
-var SYNCED, DELEGATE, FIELDS, DATE_FIELDS, PARENTS, __FIELDS, __DATE_FIELDS, NUMBER_FIELDS, NULLABLE_NUMBER_FIELDS, FLOAT_FIELDS, BOOLEAN_FIELDS, JSON_FIELDS, __JSON_FIELDS, QA_SYNC_MIMES, PULL_MAX_BYTES, BOOTSTRAP_ORDER, onAccepted, __FIELDS_FOR_TEST;
+var SYNCED, OPTIONAL_ENTITIES, isOptionalEntity, DELEGATE, FIELDS, DATE_FIELDS, PARENTS, __FIELDS, __DATE_FIELDS, NUMBER_FIELDS, NULLABLE_NUMBER_FIELDS, FLOAT_FIELDS, BOOLEAN_FIELDS, JSON_FIELDS, __JSON_FIELDS, QA_SYNC_MIMES, PULL_MAX_BYTES, BOOTSTRAP_ORDER, onAccepted, __FIELDS_FOR_TEST;
 var init_sync = __esm({
   "src/services/sync.ts"() {
     "use strict";
@@ -52123,6 +52023,8 @@ var init_sync = __esm({
     init_tombstone();
     init_qa_attachment_sync();
     SYNCED = ["project", "spec", "vps", "sessionResult", "ticket", "ticketAttachment", "customAgent", "githubIssue", "member", "task", "qaReport", "qaCase", "qaFinding", "qaAttachment"];
+    OPTIONAL_ENTITIES = [];
+    isOptionalEntity = (e) => OPTIONAL_ENTITIES.includes(e);
     DELEGATE = {
       project: prisma.project,
       spec: prisma.spec,
@@ -52151,7 +52053,7 @@ var init_sync = __esm({
       // SPEC-447 · ADR-0093 · dependsOn ikut juga: tanpa itu client tak tahu urutannya dan akan
       // meluncurkan pekerjaan yang di hub terblokir. Bukan DATE_FIELDS — nilainya array string.
       // SPEC-516 · ADR-0105 · doneAt ikut menyeberang — cermin createdAt/startedAt. Tanpa ini spec
-      // asal-hub mendarat di tiap client dengan doneAt null tanpa satu pun error, dan changelog
+      // asal-hub mendarat di tiap client dengan doneAt null tanpa satu pun error, dan riwayat selesai
       // mode backlog di client itu selamanya kosong.
       // SPEC-546 · ADR-0109 · sourceHistory ikut menyeberang: jejak konversi type adalah bagian
       // keadaan yang harus dilihat sama oleh semua mesin. `upsert` yang tak menyebut sebuah kolom
@@ -52467,8 +52369,6 @@ var init_settings3 = __esm({
       // SPEC-409 · ADR-0091 · hanoman-lead (master switch mati)
       telegram: TELEGRAM_DEFAULTS,
       // SPEC-476 · ADR-0096 · gateway Telegram opt-in
-      changelog: CHANGELOG_ENGINE_DEFAULTS,
-      // SPEC-518 · agen pembuat changelog (opt-in, mati)
       portalChat: PORTAL_CHAT_DEFAULTS,
       // SPEC-854 · ADR-0130 · chat portal klien (opt-in, mati)
       orchestration: ORCHESTRATION_DEFAULTS,
@@ -53494,7 +53394,10 @@ async function verifyAgentToken(token) {
   if (a.length !== b.length || !timingSafeEqual2(a, b)) return null;
   await prisma.agentToken.update({ where: { id: row.id }, data: { lastUsedAt: /* @__PURE__ */ new Date() } }).catch(() => {
   });
-  return { id: row.id, capabilities: Array.isArray(row.capabilities) ? row.capabilities : [] };
+  return {
+    id: row.id,
+    capabilities: Array.isArray(row.capabilities) ? row.capabilities : []
+  };
 }
 async function listAgentTokens() {
   const rows = await prisma.agentToken.findMany({ orderBy: { createdAt: "desc" } });
@@ -53651,8 +53554,8 @@ async function telegramEngineContext() {
   };
 }
 function telegramReloadNeeded(before2, after) {
-  const strip2 = ({ engine: _engine, ...rest }) => rest;
-  return JSON.stringify(strip2(before2)) !== JSON.stringify(strip2(after));
+  const strip = ({ engine: _engine, ...rest }) => rest;
+  return JSON.stringify(strip(before2)) !== JSON.stringify(strip(after));
 }
 var init_config4 = __esm({
   "src/services/telegram/config.ts"() {
@@ -54907,8 +54810,18 @@ async function uploadPendingQaBytes() {
   const hub = hubOf();
   if (!hub) return out4;
   const queued3 = new Set((await listOutbox()).filter((o) => o.entity === "qaAttachment").map((o) => o.recordId));
-  const rows = await prisma.qaAttachment.findMany({ where: { syncState: "local-only" }, orderBy: [{ createdAt: "asc" }, { id: "asc" }], take: UPLOAD_BATCH + queued3.size });
+  const pendingRows = (after) => prisma.qaAttachment.findMany({
+    where: { syncState: "local-only", id: { gt: after } },
+    orderBy: { id: "asc" },
+    take: UPLOAD_BATCH + queued3.size
+  });
+  let rows = await pendingRows(uploadCursor);
+  if (!rows.length && uploadCursor) {
+    uploadCursor = "";
+    rows = await pendingRows("");
+  }
   for (const a of rows.filter((r) => !queued3.has(r.id)).slice(0, UPLOAD_BATCH)) {
+    uploadCursor = a.id;
     const bytes = QA_STORAGE_KEY.test(a.storageKey) ? await readUpload(a.storageKey).catch(() => null) : null;
     if (!bytes) {
       await prisma.qaAttachment.update({ where: { id: a.id }, data: { syncState: "failed" } });
@@ -54939,7 +54852,28 @@ async function uploadPendingQaBytes() {
   }
   return out4;
 }
-var hubOf, endpoint, isLoopback, inflight2, UPLOAD_BATCH;
+async function downloadPendingQaBytes() {
+  if (!hubOf()) return { downloaded: 0, pending: 0 };
+  let rows = await prisma.qaAttachment.findMany({
+    where: { syncState: "remote", id: { gt: downloadCursor } },
+    orderBy: { id: "asc" },
+    take: 5
+  });
+  if (!rows.length && downloadCursor) {
+    downloadCursor = "";
+    rows = await prisma.qaAttachment.findMany({ where: { syncState: "remote" }, orderBy: { id: "asc" }, take: 5 });
+  }
+  let downloaded = 0;
+  for (const row of rows) {
+    downloadCursor = row.id;
+    if (await readQaAttachmentBytes(row.id)) {
+      await prisma.qaAttachment.updateMany({ where: { id: row.id, syncState: "remote" }, data: { syncState: "available" } });
+      downloaded++;
+    }
+  }
+  return { downloaded, pending: await prisma.qaAttachment.count({ where: { syncState: "remote" } }) };
+}
+var hubOf, endpoint, isLoopback, inflight2, UPLOAD_BATCH, uploadCursor, downloadCursor;
 var init_qa_attachment_transfer = __esm({
   "src/services/qa-attachment-transfer.ts"() {
     "use strict";
@@ -54958,6 +54892,8 @@ var init_qa_attachment_transfer = __esm({
     isLoopback = (u) => ["localhost", "127.0.0.1", "::1"].includes(u.hostname);
     inflight2 = /* @__PURE__ */ new Map();
     UPLOAD_BATCH = 5;
+    uploadCursor = "";
+    downloadCursor = "";
   }
 });
 
@@ -55165,7 +55101,7 @@ function capabilityForRoute(method, path) {
   if (top === "projects") {
     const sub = seg[2];
     if (sub === "qa") return rw("qa");
-    if (sub === "docs" || sub === "prds" || sub === "changelog") return rw("docs");
+    if (sub === "docs" || sub === "prds") return rw("docs");
     if (sub === "github") return rw("support");
     if (!read2 && sub === "git") return "ide:git";
     if (!read2 && (sub === "branches" || sub === "worktrees") && seg[3] === "delete") return "ide:git";
@@ -55690,7 +55626,7 @@ var require_permessage_deflate2 = __commonJS({
     var Limiter = require_limiter();
     var { kStatusCode } = require_constants6();
     var FastBuffer = Buffer[Symbol.species];
-    var TRAILER2 = Buffer.from([0, 0, 255, 255]);
+    var TRAILER = Buffer.from([0, 0, 255, 255]);
     var kPerMessageDeflate = Symbol("permessage-deflate");
     var kTotalLength = Symbol("total-length");
     var kCallback = Symbol("callback");
@@ -55965,7 +55901,7 @@ var require_permessage_deflate2 = __commonJS({
         }
         this._inflate[kCallback] = callback;
         this._inflate.write(data);
-        if (fin) this._inflate.write(TRAILER2);
+        if (fin) this._inflate.write(TRAILER);
         this._inflate.flush(() => {
           const err = this._inflate[kError];
           if (err) {
@@ -57781,7 +57717,7 @@ var require_websocket2 = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes12, createHash: createHash19 } = __require("crypto");
+    var { randomBytes: randomBytes12, createHash: createHash20 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate2();
@@ -58449,7 +58385,7 @@ var require_websocket2 = __commonJS({
           abortHandshake(websocket2, socket2, "Invalid Upgrade header");
           return;
         }
-        const digest2 = createHash19("sha1").update(key + GUID).digest("base64");
+        const digest2 = createHash20("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest2) {
           abortHandshake(websocket2, socket2, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -58818,7 +58754,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash19 } = __require("crypto");
+    var { createHash: createHash20 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate2();
     var subprotocol2 = require_subprotocol();
@@ -59125,7 +59061,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket2, 503);
-        const digest2 = createHash19("sha1").update(key + GUID).digest("base64");
+        const digest2 = createHash20("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -59571,7 +59507,7 @@ var init_shipper = __esm({
 function validateIncomingRecord(input) {
   if (!input || typeof input !== "object") throw new Error("sync record harus object");
   const row = input;
-  if (typeof row.entity !== "string" || !isEntity(row.entity)) throw new Error("sync entity tak dikenal");
+  if (typeof row.entity !== "string" || !isEntity(row.entity)) throw new UnknownEntityError(row.entity);
   if (typeof row.recordId !== "string" || !row.recordId || row.recordId.length > 256) throw new Error("sync recordId invalid");
   if (!Number.isSafeInteger(row.version) || Number(row.version) < 0) throw new Error("sync version invalid");
   if (!row.data || typeof row.data !== "object" || Array.isArray(row.data)) throw new Error("sync data invalid");
@@ -59639,7 +59575,11 @@ async function applyFeedFrame(msg) {
   try {
     const record2 = validateIncomingRecord({ ...msg, version: Number(msg.version ?? 0), data: msg.data ?? {} });
     if (record2.op) await applyRemote(record2.entity, record2.recordId, record2.version, record2.data, record2.op);
-  } catch {
+  } catch (e) {
+    if (e instanceof UnknownEntityError) {
+      if (msg.seq && !feedHole) await setCursor(String(msg.seq));
+      return true;
+    }
     feedHole = true;
     return false;
   }
@@ -59671,11 +59611,18 @@ async function bootstrapOnce(transport) {
   let cursor = "0";
   let applied = 0;
   for (let page = 0; page < MAX_DRAIN_PAGES; page++) {
-    const q2 = after ? `?after=${encodeURIComponent(after)}` : "";
+    const q2 = `?${OPTIONAL_QUERY}${after ? `&after=${encodeURIComponent(after)}` : ""}`;
     const res = await transport("GET", `/api/sync/bootstrap${q2}`);
     if (res.status !== 200 || !Array.isArray(res.body?.records)) return null;
+    if (page === 0) hubOptional = Array.isArray(res.body.entities) ? new Set(res.body.entities) : null;
     for (const raw of res.body.records) {
-      const rec = validateIncomingRecord(raw);
+      let rec;
+      try {
+        rec = validateIncomingRecord(raw);
+      } catch (e) {
+        if (e instanceof UnknownEntityError) continue;
+        throw e;
+      }
       if (!rec.op) continue;
       await applyRemote(rec.entity, rec.recordId, rec.version, rec.data, rec.op);
       applied++;
@@ -59686,6 +59633,46 @@ async function bootstrapOnce(transport) {
     after = next;
   }
   await setCursor(cursor);
+  if (hubOptional) await setOptionalMarker([...hubOptional]);
+  return applied;
+}
+async function getOptionalMarker() {
+  const st = await prisma.syncState.findUnique({ where: { id: 1 } });
+  return new Set((st?.entities ?? "").split(",").filter(Boolean));
+}
+async function setOptionalMarker(entities) {
+  const have = await getOptionalMarker();
+  for (const e of entities) if (isOptionalEntity(String(e))) have.add(String(e));
+  const value = OPTIONAL_ENTITIES.filter((e) => have.has(e)).join(",");
+  await prisma.syncState.upsert({ where: { id: 1 }, create: { id: 1, entities: value }, update: { entities: value } });
+}
+async function catchUpOptional(transport) {
+  const have = await getOptionalMarker();
+  const missing = OPTIONAL_ENTITIES.filter((e) => !have.has(e) && hubOptional?.has(e));
+  if (!missing.length) return 0;
+  if (await getCursor() === "0") {
+    await setOptionalMarker(missing);
+    return 0;
+  }
+  const only = missing.join(",");
+  let after = null;
+  let applied = 0;
+  for (let page = 0; page < MAX_DRAIN_PAGES; page++) {
+    const q2 = `${OPTIONAL_QUERY}&only=${only}${after ? `&after=${encodeURIComponent(after)}` : ""}`;
+    const res = await transport("GET", `/api/sync/bootstrap?${q2}`);
+    if (res.status !== 200 || !Array.isArray(res.body?.records)) return applied;
+    for (const raw of res.body.records) {
+      const rec = validateIncomingRecord(raw);
+      if (rec.op) {
+        await applyRemote(rec.entity, rec.recordId, rec.version, rec.data, rec.op);
+        applied++;
+      }
+    }
+    const next = res.body.next ? String(res.body.next) : null;
+    if (!res.body.hasMore || !next) break;
+    after = next;
+  }
+  await setOptionalMarker(missing);
   return applied;
 }
 async function syncOnce(transport) {
@@ -59704,9 +59691,18 @@ async function syncOnce(transport) {
   let deferred = [];
   for (let page = 0; page < MAX_DRAIN_PAGES; page++) {
     const cursor = await getCursor();
-    const pullRes = await transport("GET", `/api/sync/pull?since=${cursor}`);
+    const pullRes = await transport("GET", `/api/sync/pull?since=${cursor}&${OPTIONAL_QUERY}`);
     const rawRecords = Array.isArray(pullRes.body?.records) ? pullRes.body.records : [];
-    const records = rawRecords.map(validateIncomingRecord);
+    hubOptional = Array.isArray(pullRes.body?.entities) ? new Set(pullRes.body.entities) : null;
+    const records = [];
+    for (const raw of rawRecords) {
+      try {
+        records.push(validateIncomingRecord(raw));
+      } catch (e) {
+        if (!(e instanceof UnknownEntityError)) throw e;
+        stats.dropped++;
+      }
+    }
     for (const rec of records) {
       if (!isEntity(rec.entity)) continue;
       if (!rec.op) {
@@ -59745,6 +59741,7 @@ async function syncOnce(transport) {
     console.warn(`sync: record ${rec.entity}:${rec.recordId} tak bisa diterapkan \u2014 dilewati`);
     stats.dropped++;
   }
+  await catchUpOptional(transport).catch((e) => console.warn("sync: catch-up entitas opsional gagal \u2014", e.message));
   for (const item of outbox) {
     if (item.entity === "projectRename") {
       const [oldId, newId] = item.recordId.split(RENAME_SEP);
@@ -59769,6 +59766,7 @@ async function syncOnce(transport) {
       await clearOutbox(item.entity, item.recordId);
       continue;
     }
+    if (isOptionalEntity(item.entity) && !hubOptional?.has(item.entity)) continue;
     const snap = await snapshot(item.entity, item.recordId);
     if (!snap) {
       const tomb = await findTombstone(item.entity, item.recordId);
@@ -59838,6 +59836,11 @@ async function syncOnce(transport) {
   } catch (e) {
     console.warn("sync: unggah byte lampiran QA gagal \u2014", e.message);
   }
+  try {
+    await downloadPendingQaBytes();
+  } catch (e) {
+    console.warn("sync: unduh byte lampiran QA gagal \u2014", e.message);
+  }
   return stats;
 }
 function fetchTransport(base3, token) {
@@ -59916,7 +59919,7 @@ async function startSyncClient(base3, token, tickMs2) {
   const tick6 = () => syncTick(transport);
   const connectWs = async () => {
     const { WebSocket: WebSocket2 } = await Promise.resolve().then(() => (init_wrapper(), wrapper_exports));
-    const wsUrl = base3.replace(/^http/, "ws").replace(/\/$/, "") + "/api/sync/ws";
+    const wsUrl = base3.replace(/^http/, "ws").replace(/\/$/, "") + "/api/sync/ws?" + OPTIONAL_QUERY;
     const sock2 = new WebSocket2(wsUrl, { headers: { authorization: `Bearer ${token}` } });
     ws = sock2;
     sock2.on("open", () => {
@@ -59984,7 +59987,7 @@ async function applySyncConfig() {
   const token = effectiveStr("SYNC_DEVICE_TOKEN");
   if (base3 && token) await startSyncClient(base3, token, effectiveInt("SYNC_TICK_MS"));
 }
-var MAX_SYNC_RECORD_BYTES, feedHole, MAX_DRAIN_PAGES, timer5, ws, started, reconnectTimer, reconnectDelay, presence, pullSehat;
+var MAX_SYNC_RECORD_BYTES, OPTIONAL_QUERY, hubOptional, UnknownEntityError, feedHole, MAX_DRAIN_PAGES, timer5, ws, started, reconnectTimer, reconnectDelay, presence, pullSehat;
 var init_sync_client = __esm({
   "src/services/sync-client.ts"() {
     "use strict";
@@ -60003,6 +60006,13 @@ var init_sync_client = __esm({
     init_client2();
     init_shipper();
     MAX_SYNC_RECORD_BYTES = 1024 * 1024;
+    OPTIONAL_QUERY = `entities=${OPTIONAL_ENTITIES.join(",")}`;
+    hubOptional = null;
+    UnknownEntityError = class extends Error {
+      constructor(entity) {
+        super(`sync entity tak dikenal: ${String(entity)}`);
+      }
+    };
     feedHole = false;
     MAX_DRAIN_PAGES = 500;
     started = false;
@@ -61980,7 +61990,7 @@ var require_Decoder = __commonJS({
   "../node_modules/.pnpm/@fastify+busboy@3.2.0/node_modules/@fastify/busboy/lib/utils/Decoder.js"(exports, module) {
     "use strict";
     var RE_PLUS = /\+/g;
-    var HEX2 = [
+    var HEX = [
       0,
       0,
       0,
@@ -62121,7 +62131,7 @@ var require_Decoder = __commonJS({
       const len = str5.length;
       for (; i < len; ++i) {
         if (this.buffer !== void 0) {
-          if (!HEX2[str5.charCodeAt(i)]) {
+          if (!HEX[str5.charCodeAt(i)]) {
             res += "%" + this.buffer;
             this.buffer = void 0;
             --i;
@@ -62542,7 +62552,7 @@ var require_fastify_plugin = __commonJS({
 var require_generateId = __commonJS({
   "../node_modules/.pnpm/@fastify+multipart@10.1.0/node_modules/@fastify/multipart/lib/generateId.js"(exports, module) {
     "use strict";
-    var HEX2 = [
+    var HEX = [
       "00",
       "01",
       "02",
@@ -62802,13 +62812,13 @@ var require_generateId = __commonJS({
     ];
     var random = Math.random;
     function seed() {
-      return HEX2[255 * random() | 0] + HEX2[255 * random() | 0] + HEX2[255 * random() | 0] + HEX2[255 * random() | 0] + HEX2[255 * random() | 0] + HEX2[255 * random() | 0] + HEX2[255 * random() | 0];
+      return HEX[255 * random() | 0] + HEX[255 * random() | 0] + HEX[255 * random() | 0] + HEX[255 * random() | 0] + HEX[255 * random() | 0] + HEX[255 * random() | 0] + HEX[255 * random() | 0];
     }
     module.exports.generateId = function generateIdFn() {
       let num = 0;
       let str5 = seed();
       return function generateId() {
-        return num === 255 ? (str5 = seed()) + HEX2[num = 0] : str5 + HEX2[++num];
+        return num === 255 ? (str5 = seed()) + HEX[num = 0] : str5 + HEX[++num];
       };
     }();
   }
@@ -63667,7 +63677,7 @@ import websocket from "@fastify/websocket";
 import cookie from "@fastify/cookie";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { dirname as dirname17 } from "node:path";
-import { existsSync as existsSync23 } from "node:fs";
+import { existsSync as existsSync22 } from "node:fs";
 
 // src/web-dir.ts
 import { resolve as resolve10 } from "node:path";
@@ -69235,11 +69245,11 @@ ${item.context}` : item.context;
     if (live && parsed.data.confirm !== true)
       return reply.code(409).send({ error: "confirm-required", session: { id: live.id, agent: live.agent } });
     if (!live) {
-      const view13 = await presenceView();
+      const view12 = await presenceView();
       const verdict = remoteSessionVerdict({
         specId: id2,
         now: Date.now(),
-        devices: view13.devices,
+        devices: view12.devices,
         recentlyOffline: recentlyOffline(id2),
         lastResultDeviceId: null
       });
@@ -71083,7 +71093,7 @@ async function startSpecSession(spec, opts2) {
   return withSessionAdmission({ id: id2, force: opts2.force }, async () => {
     const pane = await getSessionAsync(id2);
     if (!pane) {
-      const view13 = await presenceView();
+      const view12 = await presenceView();
       const lastResult = await prisma.sessionResult.findFirst({
         where: { specId: spec.id },
         orderBy: { createdAt: "desc" },
@@ -71093,7 +71103,7 @@ async function startSpecSession(spec, opts2) {
       const verdict = remoteSessionVerdict({
         specId: spec.id,
         now: Date.now(),
-        devices: view13.devices,
+        devices: view12.devices,
         recentlyOffline: recentlyOffline(spec.id),
         lastResultDeviceId
       });
@@ -77016,6 +77026,7 @@ function detachSync(c) {
 function broadcastSyncLog(row) {
   const s2 = JSON.stringify({ t: "sync", ...row });
   for (const c of clients2) {
+    if (isOptionalEntity(row.entity) && !c.accept?.has(row.entity)) continue;
     try {
       c.send(s2);
     } catch {
@@ -77156,12 +77167,16 @@ async function requireDeviceWs(req, reply) {
 }
 async function sync_default(app3) {
   app3.get("/sync/pull", { preHandler: requireDeviceToken }, async (req, reply) => {
-    const since = req.query.since ?? "0";
-    return maybeGzip(req, reply, await pull(since));
+    const q2 = req.query;
+    return maybeGzip(req, reply, await pull(q2.since ?? "0", void 0, void 0, { accept: acceptedOptional(q2.entities) }));
   });
   app3.get("/sync/bootstrap", { preHandler: requireDeviceToken }, async (req, reply) => {
-    const after = req.query.after ?? null;
-    return maybeGzip(req, reply, await bootstrapSnapshot(after));
+    const q2 = req.query;
+    return maybeGzip(req, reply, await bootstrapSnapshot(q2.after ?? null, void 0, {
+      accept: acceptedOptional(q2.entities),
+      // ADR-0180 · catch-up: hanya entitas opsional yang diminta, tanpa memindahkan kursor client.
+      ...q2.only ? { only: acceptedOptional(q2.only) } : {}
+    }));
   });
   app3.get("/sync/attachments/:storageKey", { preHandler: requireDeviceToken }, async (req, reply) => {
     const { storageKey } = req.params;
@@ -77314,7 +77329,11 @@ async function sync_default(app3) {
       socket2.close(1008, "connection limit");
       return;
     }
-    const client = { send: (m) => socket2.send(m), close: () => socket2.close() };
+    const client = {
+      send: (m) => socket2.send(m),
+      close: () => socket2.close(),
+      accept: acceptedOptional(req.query.entities)
+    };
     attachSync(client);
     const unregisterSocket = registerDeviceSocket(principal.id, "sync", socket2);
     const guard = new WsMessageGuard({ perWindow: PRESENCE_MAX_FRAMES_PER_MIN });
@@ -78414,338 +78433,6 @@ async function lead_default(app3) {
   });
 }
 
-// src/routes/changelog.ts
-init_src();
-init_db();
-init_local_binding();
-
-// src/services/changelog/collect.ts
-init_db();
-import { execFile as execFile17 } from "node:child_process";
-import { promisify as promisify16 } from "node:util";
-import { existsSync as existsSync22 } from "node:fs";
-
-// src/services/changelog/scrub.ts
-var MERGE = /^merge\s+(branch|pull request|remote-tracking branch|tag)\b/i;
-var CONVENTIONAL = /^(feat|fix|chore|docs|refactor|test|perf|build|ci|style|revert)(\([^)]*\))?!?:\s*/i;
-var PATH_LIKE = /(?:[\w.@-]+\/)+[\w.-]+\.\w{1,6}/g;
-var HEX = /\b(?=[0-9a-f]{7,40}\b)(?=[0-9a-f]*\d)(?=[0-9a-f]*[a-f])[0-9a-f]{7,40}\b/gi;
-var INTERNAL_REF = /\b(?:SPEC|ADR|PR|ISSUE)[-\s]?\d+\b/gi;
-var CAMEL = /\b[a-z]{2,}(?:[A-Z][a-z]{2,})+\b/g;
-var SNAKE = /\b[a-z][a-z0-9]*(?:_[a-z0-9]+)+\b/gi;
-var CALL = /\b[A-Za-z_][\w.]*\(\s*\)/g;
-var INLINE_CODE = /`[^`\n]*`/g;
-var FENCE = /^```[\s\S]*?^```$/gm;
-var TRAILER = /^[A-Za-z-]+:\s.*$/gm;
-var tidy = (s2) => s2.replace(/\(\s*\)/g, " ").replace(/[ \t]{2,}/g, " ").replace(/\s+([,.;:!?])/g, "$1").replace(/^[\s:;,·—–-]+/, "").replace(/[\s:;,·—–-]+$/, "").trim();
-function strip(s2) {
-  return s2.replace(INLINE_CODE, " ").replace(PATH_LIKE, " ").replace(CALL, " ").replace(HEX, " ").replace(INTERNAL_REF, " ").replace(CAMEL, " ").replace(SNAKE, " ");
-}
-function scrubSubject(s2) {
-  const one2 = (s2 ?? "").replace(/\s+/g, " ").trim();
-  if (!one2 || MERGE.test(one2)) return "";
-  return tidy(strip(one2.replace(CONVENTIONAL, "")));
-}
-function scrubBody(s2) {
-  const first = (s2 ?? "").replace(TRAILER, "").split(/\n\s*\n/)[0] ?? "";
-  return tidy(strip(first.replace(/\s+/g, " ").trim()));
-}
-function scrubOutput(md) {
-  const noFence = (md ?? "").replace(FENCE, "");
-  const lines2 = noFence.split("\n").map((line) => {
-    const m = /^(\s*(?:[-*+]|\d+\.)\s+|\s*#{1,6}\s+|\s*>\s*)?(.*)$/.exec(line);
-    const lead = m?.[1] ?? "";
-    const rest = m?.[2] ?? line;
-    const cleaned = tidy(strip(rest));
-    return cleaned ? `${lead}${cleaned}` : "";
-  });
-  return lines2.join("\n").replace(/\n{3,}/g, "\n\n").trim() + "\n";
-}
-
-// src/services/changelog/collect.ts
-var toItem = (label2, detail) => {
-  const l = scrubSubject(label2);
-  return l ? { label: l, detail: scrubBody(detail) } : null;
-};
-async function collectBacklog(projectId, from, to) {
-  const f = dayStart(from), t = dayEnd(to);
-  const rows = await prisma.spec.findMany({
-    where: { projectId, stage: "done" },
-    select: { title: true, objective: true, doneAt: true },
-    orderBy: [{ doneAt: "asc" }, { id: "asc" }]
-  });
-  const stampless = rows.filter((r) => r.doneAt === null).length;
-  const hit = rows.filter((r) => inDayRange(r.doneAt, f, t));
-  const items = hit.map((r) => toItem(r.title, r.objective ?? "")).filter((x) => x !== null);
-  if (items.length === 0)
-    return { ok: false, reason: `tak ada backlog yang selesai antara ${from} dan ${to}` };
-  const notes = [];
-  if (stampless > 0)
-    notes.push(`${stampless} item selesai tanpa stempel waktu (selesai sebelum stempel ini ada) dan tak ikut dihitung.`);
-  return { ok: true, input: { mode: "backlog", title: `${from} \u2013 ${to}`, items, notes } };
-}
-var exec11 = promisify16(execFile17);
-var GIT8 = { maxBuffer: 1 << 24, encoding: "utf8" };
-var US2 = "";
-var RS = "";
-var NO_REPO = "project ini belum ditautkan ke repo di mesin ini";
-var NO_TAG = "repo project ini belum punya tag rilis";
-var usable2 = (repoDir) => !!repoDir && existsSync22(repoDir);
-async function listTags(repoDir) {
-  if (!usable2(repoDir)) return { tags: [], head: null, reason: NO_REPO };
-  try {
-    const { stdout } = await exec11("git", ["tag", "--list", "--sort=-creatordate"], { cwd: repoDir, ...GIT8 });
-    const tags = stdout.split("\n").map((s2) => s2.trim()).filter(Boolean);
-    const head = await exec11("git", ["rev-parse", "--short", "HEAD"], { cwd: repoDir, ...GIT8 }).then((r) => r.stdout.trim()).catch(() => null);
-    return { tags, head, reason: tags.length ? null : NO_TAG };
-  } catch {
-    return { tags: [], head: null, reason: NO_TAG };
-  }
-}
-async function previousTag(repoDir, tag2) {
-  return exec11("git", ["describe", "--tags", "--abbrev=0", "--end-of-options", `${tag2}^`], { cwd: repoDir, ...GIT8 }).then((r) => r.stdout.trim() || null).catch(() => null);
-}
-async function revExists(repoDir, rev) {
-  return exec11("git", ["rev-parse", "--verify", "--quiet", "--end-of-options", `${rev}^{commit}`], { cwd: repoDir, ...GIT8 }).then(() => true).catch(() => false);
-}
-async function logRange(repoDir, range) {
-  const { stdout } = await exec11(
-    "git",
-    ["log", "--no-merges", `--pretty=format:%s${US2}%b${RS}`, ...range],
-    { cwd: repoDir, ...GIT8 }
-  );
-  return stdout.split(RS).map((rec) => rec.replace(/^\n+/, "")).filter((rec) => rec.trim()).map((rec) => {
-    const [subject, body] = rec.split(US2);
-    return toItem(subject ?? "", body ?? "");
-  }).filter((x) => x !== null);
-}
-async function collectCommits(repoDir, fromSha, toSha) {
-  if (!usable2(repoDir)) return { ok: false, reason: NO_REPO };
-  for (const rev of [fromSha, toSha])
-    if (!await revExists(repoDir, rev)) return { ok: false, reason: `revisi "${rev}" tak dikenal di repo project` };
-  try {
-    const items = await logRange(repoDir, ["--end-of-options", `${fromSha}..${toSha}`]);
-    if (!items.length) return { ok: false, reason: `tak ada perubahan antara "${fromSha}" dan "${toSha}"` };
-    const short = (s2) => s2.slice(0, 7);
-    return { ok: true, input: { mode: "commit", title: `${short(fromSha)} \u2192 ${short(toSha)}`, items, notes: [] } };
-  } catch (e) {
-    return { ok: false, reason: `git menolak rentang itu: ${e.message.split("\n")[0]}` };
-  }
-}
-async function collectVersions(repoDir, fromTag, toTag) {
-  const { tags, reason } = await listTags(repoDir);
-  if (reason) return { ok: false, reason };
-  if (!usable2(repoDir)) return { ok: false, reason: NO_REPO };
-  if (!tags.includes(toTag)) return { ok: false, reason: `tag "${toTag}" tak ada di repo project` };
-  if (fromTag && !tags.includes(fromTag)) return { ok: false, reason: `tag "${fromTag}" tak ada di repo project` };
-  const prev = fromTag ?? await previousTag(repoDir, toTag);
-  try {
-    const items = await logRange(repoDir, ["--end-of-options", prev ? `${prev}..${toTag}` : toTag]);
-    if (!items.length) return { ok: false, reason: `tak ada perubahan yang masuk ke "${toTag}"` };
-    const title = fromTag ? `${fromTag} \u2192 ${toTag}` : toTag;
-    return { ok: true, input: { mode: "version", title, items, notes: [] } };
-  } catch (e) {
-    return { ok: false, reason: `git menolak rentang itu: ${e.message.split("\n")[0]}` };
-  }
-}
-
-// src/services/changelog/generate.ts
-init_src();
-init_db();
-init_local_binding();
-
-// src/services/changelog/config.ts
-init_src();
-init_settings3();
-async function changelogAgentDefaults() {
-  const e = (await getSetting()).changelog;
-  if (!e.enabled) return sessionAgentDefaults();
-  return e.agent === "codex" ? { agent: "codex", model: e.model, effort: coerceCodexEffort(e.model, e.effort) } : { agent: "claude", model: e.model, effort: e.effort };
-}
-
-// src/services/changelog/render.ts
-init_src2();
-var MODE_LABEL = {
-  backlog: "backlog yang selesai dalam rentang tanggal",
-  commit: "riwayat perubahan repo dalam rentang yang dipilih",
-  version: "perubahan yang masuk ke versi/rilis itu"
-};
-var DETAIL_MAX = 240;
-var clip3 = (s2) => s2.length > DETAIL_MAX ? `${s2.slice(0, DETAIL_MAX - 1).trimEnd()}\u2026` : s2;
-function fallbackMarkdown(input) {
-  const lines2 = [`# Changelog \u2014 ${input.title}`, ""];
-  if (input.items.length === 0) {
-    lines2.push("_Tak ada perubahan yang bisa diringkas untuk rentang ini._", "");
-  } else {
-    lines2.push(`Ringkasan ${input.items.length} perubahan untuk pemakai.`, "");
-    for (const it of input.items) {
-      const d = clip3(it.detail.trim());
-      lines2.push(d ? `- **${it.label}** \u2014 ${d}` : `- **${it.label}**`);
-    }
-    lines2.push("");
-  }
-  if (input.notes.length) {
-    lines2.push("---", "");
-    for (const n2 of input.notes) lines2.push(`> ${n2}`);
-    lines2.push("");
-  }
-  return lines2.join("\n");
-}
-function changelogPrompt(input, budgetMs) {
-  const budget = Math.max(1, Math.round(budgetMs / 1e3));
-  const items = input.items.map((it, i) => `${i + 1}. ${it.label}${it.detail ? ` \u2014 ${it.detail}` : ""}`).join("\n");
-  return [
-    "Kamu menulis changelog untuk PEMAKAI sebuah produk, bukan untuk developer.",
-    "",
-    `Anggaran waktumu ${budget} detik. Jawab langsung \u2014 jangan membaca berkas, jangan memakai tool,`,
-    "jangan menyelidiki apa pun. Seluruh bahan sudah ada di bawah.",
-    "",
-    `Judul rentang: ${input.title}`,
-    `Bahan berasal dari ${MODE_LABEL[input.mode]}.`,
-    "",
-    "Bahan:",
-    items || "(tidak ada)",
-    "",
-    "Aturan:",
-    "- Bahasa Indonesia, gaya editorial: tenang, ringkas, kalimat penuh.",
-    "- Tulis apa yang berubah BAGI PEMAKAI, bukan apa yang disentuh di dalam kode.",
-    "- DILARANG menyebut nama berkas, nama fungsi, nama variabel, hash commit, nomor SPEC/ADR,",
-    "  nama branch, atau istilah internal apa pun.",
-    "- Gabungkan bahan yang bicara hal yang sama jadi satu butir. 3\u201310 butir; kurangi bila memang sedikit.",
-    "- Jangan mengarang perubahan yang tak ada di bahan.",
-    "",
-    // SPEC-543 · ADR-0108 · dipasang di SEMUA prompt agen, bukan hanya yang menulis kode; gerbang
-    // di baris pertama klausa yang membuatnya diam untuk narator ini.
-    CODE_STYLE_CLAUSE,
-    "",
-    "Bentuk keluaran \u2014 HANYA markdown ini, tanpa kalimat pembuka atau penutup di luarnya,",
-    "tanpa blok kode:",
-    "",
-    `# Changelog \u2014 ${input.title}`,
-    "",
-    "<satu paragraf pembuka, maksimal dua kalimat>",
-    "",
-    "- **<judul singkat perubahan>** \u2014 <satu kalimat manfaatnya bagi pemakai>"
-  ].join("\n");
-}
-
-// src/services/changelog/generate.ts
-var CHANGELOG_TIMEOUT_MS = 18e4;
-async function collect(projectId, req) {
-  if (req.mode === "backlog") {
-    const d = defaultRange(/* @__PURE__ */ new Date());
-    return collectBacklog(projectId, req.from ?? d.from, req.to ?? d.to);
-  }
-  const repoDir = await resolveRepoDir(projectId);
-  return req.mode === "commit" ? collectCommits(repoDir, req.fromSha, req.toSha) : collectVersions(repoDir, req.fromTag, req.toTag);
-}
-async function generateChangelog(projectId, req, deps = {}) {
-  const got = await collect(projectId, req);
-  if (!got.ok) return got;
-  const input = got.input;
-  const prompt = changelogPrompt(input, CHANGELOG_TIMEOUT_MS);
-  const { agent, model, effort: effort2 } = await changelogAgentDefaults();
-  const run5 = deps.think ?? think;
-  let body = "";
-  let generator = "agent";
-  const warnings = [...input.notes];
-  try {
-    const raw = await run5(prompt, { agent, model, effort: effort2, timeoutMs: CHANGELOG_TIMEOUT_MS });
-    body = scrubOutput(raw ?? "");
-    if (!body.trim()) throw new Error("agen tak memulangkan teks apa pun");
-  } catch (e) {
-    generator = "fallback";
-    body = fallbackMarkdown(input);
-    warnings.push(`Narasi otomatis tak tersedia \u2014 ${e.message}. Yang tampil adalah draf ringkas.`);
-  }
-  const row = await prisma.changelog.create({
-    data: {
-      projectId,
-      mode: input.mode,
-      title: input.title,
-      params: req,
-      body,
-      generator,
-      itemCount: input.items.length,
-      warning: warnings.length ? warnings.join(" ") : null
-    }
-  });
-  return { ok: true, row };
-}
-
-// src/routes/changelog.ts
-var view7 = (c) => ({
-  id: c.id,
-  projectId: c.projectId,
-  mode: c.mode,
-  title: c.title,
-  params: c.params,
-  body: c.body,
-  generator: c.generator,
-  warning: c.warning,
-  itemCount: c.itemCount,
-  createdAt: c.createdAt.toISOString()
-});
-async function changelog_default(app3) {
-  app3.get("/projects/:id/changelog/sources", async (req, reply) => {
-    const { id: id2 } = req.params;
-    if (!await prisma.project.findUnique({ where: { id: id2 } })) return reply.code(404).send({ error: "not found" });
-    const { tags, head, reason } = await listTags(await resolveRepoDir(id2));
-    const done = await prisma.spec.findMany({
-      where: { projectId: id2, stage: "done", doneAt: { not: null } },
-      select: { doneAt: true },
-      orderBy: { doneAt: "asc" }
-    });
-    return {
-      hasRepo: reason === null || tags.length > 0,
-      tags,
-      head,
-      reason,
-      backlog: {
-        doneCount: done.length,
-        earliest: done[0]?.doneAt?.toISOString() ?? null,
-        latest: done[done.length - 1]?.doneAt?.toISOString() ?? null
-      },
-      defaultRange: defaultRange(/* @__PURE__ */ new Date())
-    };
-  });
-  app3.get("/projects/:id/changelog", async (req, reply) => {
-    const { id: id2 } = req.params;
-    if (!await prisma.project.findUnique({ where: { id: id2 } })) return reply.code(404).send({ error: "not found" });
-    const { page, limit, q: q2 } = req.query;
-    const rows = await prisma.changelog.findMany({ where: { projectId: id2 }, orderBy: { createdAt: "desc" } });
-    return paginate(rows.filter((r) => changelogMatches(r, q2 ?? "")).map(view7), page, limit);
-  });
-  app3.get("/projects/:id/changelog/:cid", async (req, reply) => {
-    const { id: id2, cid } = req.params;
-    const row = await prisma.changelog.findFirst({ where: { id: cid, projectId: id2 } });
-    if (!row) return reply.code(404).send({ error: "not found" });
-    const fmt = downloadFormat(req.query);
-    if (fmt) return sendDocDownload(reply, fmt, {
-      content: row.body,
-      name: `${row.title}.md`,
-      prefix: `${id2}-changelog`,
-      eyebrow: `hanoman \xB7 ${id2} \xB7 changelog`,
-      path: row.title
-    });
-    return view7(row);
-  });
-  app3.post("/projects/:id/changelog", async (req, reply) => {
-    const { id: id2 } = req.params;
-    if (!await prisma.project.findUnique({ where: { id: id2 } })) return reply.code(404).send({ error: "not found" });
-    const parsed = zChangelogRequest.safeParse(req.body);
-    if (!parsed.success) return reply.code(400).send({ error: parsed.error.flatten() });
-    const r = await generateChangelog(id2, parsed.data);
-    if (!r.ok) return reply.code(422).send({ error: r.reason });
-    return reply.code(201).send(view7(r.row));
-  });
-  app3.delete("/projects/:id/changelog/:cid", async (req, reply) => {
-    const { id: id2, cid } = req.params;
-    const { count } = await prisma.changelog.deleteMany({ where: { id: cid, projectId: id2 } });
-    return count ? reply.code(204).send() : reply.code(404).send({ error: "not found" });
-  });
-}
-
 // src/routes/custom-agents.ts
 init_src2();
 init_src();
@@ -78789,7 +78476,7 @@ var selectionReasonOf = (r, availability) => {
   }
   return "selalu tersedia sepanjang sesi";
 };
-var view8 = (r, projectId, stamps = {}, requestedRuntime) => {
+var view7 = (r, projectId, stamps = {}, requestedRuntime) => {
   const builtin = r.projectId === null && BUILTIN_AGENT_NAMES.includes(r.name);
   const availability = availabilityOf(r, requestedRuntime);
   return {
@@ -78861,7 +78548,7 @@ async function custom_agents_default(app3) {
     for (const r of rows) if (r.projectId === null) byName.set(r.name, r);
     for (const r of rows) if (r.projectId !== null) byName.set(r.name, r);
     const stamps = await stampsOf();
-    return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name)).map((r) => view8(r, projectId, stamps, requestedRuntime));
+    return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name)).map((r) => view7(r, projectId, stamps, requestedRuntime));
   });
   app3.post("/custom-agents", async (req, reply) => {
     const parsed = zCreateCustomAgent.safeParse(req.body);
@@ -78920,7 +78607,7 @@ async function custom_agents_default(app3) {
     } });
     await loadCustomAgents();
     await notifySynced("customAgent", id2);
-    return reply.code(201).send(view8(row, void 0, await stampsOf()));
+    return reply.code(201).send(view7(row, void 0, await stampsOf()));
   });
   app3.patch("/custom-agents/:id", async (req, reply) => {
     const { id: id2 } = req.params;
@@ -78991,7 +78678,7 @@ async function custom_agents_default(app3) {
     } });
     await loadCustomAgents();
     await notifySynced("customAgent", id2);
-    return view8(row, void 0, await stampsOf());
+    return view7(row, void 0, await stampsOf());
   });
   app3.delete("/custom-agents/:id", async (req, reply) => {
     const { id: id2 } = req.params;
@@ -79147,13 +78834,13 @@ async function custom_agent_metrics_default(app3) {
     const body = zPatch.safeParse(req.body);
     if (!body.success) return reply.code(400).send({ error: body.error.issues[0]?.message });
     const id2 = String(req.params.id ?? "");
-    const view13 = await updateAgentInvocationDisposition(
+    const view12 = await updateAgentInvocationDisposition(
       id2,
       body.data.disposition,
       body.data.note,
       body.data.reworkRequired
     );
-    return view13 ?? reply.code(404).send({ error: "invocation tidak ditemukan" });
+    return view12 ?? reply.code(404).send({ error: "invocation tidak ditemukan" });
   });
 }
 
@@ -79161,7 +78848,7 @@ async function custom_agent_metrics_default(app3) {
 init_src();
 init_db();
 init_sync_notify();
-var view9 = (m) => ({
+var view8 = (m) => ({
   id: m.id,
   name: m.name,
   email: m.email,
@@ -79179,7 +78866,7 @@ async function members_default(app3) {
       // punya nama, dan menyembunyikannya membuat assignee-nya terbaca sebagai id mentah.
       orderBy: [{ active: "desc" }, { name: "asc" }]
     });
-    return paginate(rows.map(view9), page, limit);
+    return paginate(rows.map(view8), page, limit);
   });
   app3.post("/members", async (req, reply) => {
     const parsed = zCreateMember.safeParse(req.body);
@@ -79192,7 +78879,7 @@ async function members_default(app3) {
       data: { id: id2, name: p3.name, email: p3.email, role: p3.role ?? null }
     });
     await notifySynced("member", id2);
-    return reply.code(201).send(view9(row));
+    return reply.code(201).send(view8(row));
   });
   app3.patch("/members/:id", async (req, reply) => {
     const { id: id2 } = req.params;
@@ -79205,7 +78892,7 @@ async function members_default(app3) {
       return reply.code(404).send({ error: "not found" });
     const row = await prisma.member.update({ where: { id: id2 }, data: parsed.data });
     await notifySynced("member", id2);
-    return view9(row);
+    return view8(row);
   });
   app3.delete("/members/:id", async (req, reply) => {
     const { id: id2 } = req.params;
@@ -79394,8 +79081,8 @@ async function tasks_default(app3) {
       author: req.user?.email ?? (req.agent ? `agent:${req.agent.id}` : "system"),
       launchApprovedBy: launchPrincipal(req)
     });
-    const view13 = taskView(r.task, { id: r.spec.id, stage: r.spec.stage, priority: r.spec.priority });
-    return reply.code(r.created ? 201 : 200).send({ created: r.created, spec: r.spec, task: view13 });
+    const view12 = taskView(r.task, { id: r.spec.id, stage: r.spec.stage, priority: r.spec.priority });
+    return reply.code(r.created ? 201 : 200).send({ created: r.created, spec: r.spec, task: view12 });
   });
   app3.delete("/tasks/:id/escalate", async (req, reply) => {
     const { id: id2 } = req.params;
@@ -80795,6 +80482,103 @@ async function qaTransfer(app3) {
 // src/routes/qa-backlog.ts
 init_src();
 init_zod();
+
+// src/services/qa-session.ts
+init_src2();
+init_local_binding();
+init_session_launch_gate();
+init_pty();
+init_settings3();
+init_codex_trust();
+init_qa_attachment_transfer();
+init_uploads();
+import { createHash as createHash18 } from "node:crypto";
+import { execFileSync as execFileSync8 } from "node:child_process";
+import { join as join43 } from "node:path";
+var QaSessionError = class extends Error {
+  constructor(code, message, needsBind = false) {
+    super(message);
+    this.code = code;
+    this.needsBind = needsBind;
+  }
+};
+var qaSessionId = (findingId) => `qa-${createHash18("sha256").update(findingId).digest("hex").slice(0, 24)}`;
+async function startQaFindingSession(d, fid) {
+  const f = d.findings.find((x) => x.id === fid);
+  if (!f) throw new QaSessionError(404, "temuan tidak ditemukan");
+  if (f.status === "wontfix") throw new QaSessionError(409, "Temuan ditandai tidak akan diperbaiki. Buka kembali sebelum dikerjakan.");
+  if (f.spec) throw new QaSessionError(409, "Temuan sudah masuk backlog. Mulai sesi dari backlog tersebut.");
+  const repoDir = await resolveRepoDir(d.projectId);
+  if (!repoDir) throw new QaSessionError(400, "Project belum terikat ke repo lokal", true);
+  const id2 = qaSessionId(fid);
+  return withSessionAdmission({ id: id2 }, async () => {
+    const linkedCase = d.cases.find((c) => c.id === f.caseId);
+    const attachments = d.attachments.filter((a) => a.ownerType === "report" || a.ownerType === "finding" && a.ownerId === fid || a.ownerType === "case" && a.ownerId === linkedCase?.id);
+    const files = [];
+    for (const a of attachments) {
+      const bytes = await readQaAttachmentBytes(a.id);
+      if (!bytes) throw new QaSessionError(409, `Lampiran belum tersedia: ${a.filename}. Sinkronkan QA lalu coba lagi.`);
+      const saved = await saveSessionUpload(id2, bytes, a.mimeType);
+      files.push(`${JSON.stringify(a.filename)} (${a.mimeType}): ${saved.path}`);
+    }
+    const wt = join43(repoDir, ".worktrees", id2);
+    const branch = `qa/${id2.slice(3)}`;
+    const reused = realGit.worktreeAlive(wt);
+    try {
+      if (!reused) {
+        const base3 = realGit.revParse(repoDir, branch) ? branch : "HEAD";
+        realGit.addWorktree(repoDir, wt, base3);
+        execFileSync8("git", ["checkout", "-B", branch], { cwd: wt, encoding: "utf8" });
+      }
+    } catch (e) {
+      throw new QaSessionError(422, `Gagal membuat worktree QA: ${e.message}`);
+    }
+    const verifyScope = (await getSetting()).verifyScope;
+    const baseSha = realGit.headSha(wt);
+    const { agent, model, effort: effort2 } = await sessionAgentDefaults();
+    if (agent === "codex") ensureCodexTrust(repoDir);
+    const prompt = [
+      `hanoman \xB7 perbaiki temuan QA ${f.code}: ${f.title}`,
+      `Project ${d.projectId}; laporan ${d.code}: ${d.title}; reportId=${d.id}; findingId=${fid}.`,
+      "Baca instruksi project dan docs Source of Truth. Audit penyebab, pilih perbaikan yang sesuai, lakukan dan verifikasi. Untuk temuan kecil langsung execute; bila perlu desain/spec/plan tulis dokumennya di worktree ini. Jangan membuat backlog terlebih dahulu.",
+      `Build: ${d.buildVersion}
+Lingkungan: ${JSON.stringify(d.environment)}
+Cakupan: ${d.scope}
+Ringkasan laporan: ${d.summary}`,
+      `Dampak: ${f.severity}; prioritas: ${f.priority}; area: ${f.area}
+Repro:
+${f.steps.map((s3, i) => `${i + 1}. ${s3}`).join("\n")}
+Expected:
+${f.expected}
+Actual:
+${f.actual}`,
+      linkedCase ? `Langkah uji terkait ${linkedCase.code}: ${linkedCase.title}
+${linkedCase.steps}
+Expected: ${linkedCase.expected}
+Actual: ${linkedCase.actual}
+Status: ${linkedCase.status}` : "",
+      files.length ? `Lampiran konteks (baca berkas berikut):
+${files.join("\n")}` : "",
+      `Kerjakan pada branch ${branch}. Laporkan perubahan, bukti verifikasi dan langkah retest; integrasi diputuskan operator melalui Terminal. Jangan menandai temuan selesai sebelum retest operator.`,
+      verifyScopeClause(verifyScope),
+      CODE_STYLE_CLAUSE,
+      reused ? RESUMED_WORKTREE_NOTE : ""
+    ].filter(Boolean).join("\n\n");
+    const s2 = createSession(d.projectId, wt, {
+      id: id2,
+      branch,
+      agent,
+      model,
+      effort: effort2,
+      prompt,
+      env: { HANOMAN_BASE_SHA: baseSha, HANOMAN_VERIFY_SCOPE: verifyScope },
+      attachmentsDir: files.length ? sessionUploadDir(id2) : void 0
+    });
+    return { id: s2.id, reused: false };
+  }, (pane) => ({ id: pane.id, reused: true }));
+}
+
+// src/routes/qa-backlog.ts
 init_db();
 
 // src/services/qa-backlog.ts
@@ -80923,6 +80707,21 @@ async function qaBacklog(app3) {
     await prisma.qaReport.update({ where: { id: rid }, data: { updatedAt: /* @__PURE__ */ new Date() } });
     return reply.code(r.created ? 201 : 200).send({ ...r, report: await reportDetail(pid, rid) });
   });
+  app3.post("/projects/:pid/qa/reports/:rid/findings/:fid/session", async (req, reply) => {
+    if (!launchPrincipal(req)) return reply.code(403).send({ error: "Peluncuran sesi memerlukan sessions:write" });
+    const { pid, rid, fid } = req.params;
+    const parsed = external_exports.object({}).strict().safeParse(req.body ?? {});
+    if (!parsed.success) return reply.code(400).send({ error: parsed.error.flatten() });
+    const d = await reportDetail(pid, rid);
+    if (!d || !d.findings.some((f) => f.id === fid)) return reply.code(404).send({ error: "not found" });
+    try {
+      const result = await startQaFindingSession(d, fid);
+      return reply.code(result.reused ? 200 : 201).send(result);
+    } catch (e) {
+      if (e instanceof QaSessionError) return reply.code(e.code).send({ error: e.message, ...e.needsBind ? { needsBind: true } : {} });
+      throw e;
+    }
+  });
   app3.post("/projects/:pid/qa/reports/:rid/backlog", async (req, reply) => {
     const { pid, rid } = req.params;
     const parsed = zBody.safeParse(req.body ?? {});
@@ -80999,7 +80798,7 @@ async function resolveGithubRepo(projectId) {
 
 // src/services/github-fetch.ts
 init_config2();
-import { execFile as execFile18 } from "node:child_process";
+import { execFile as execFile17 } from "node:child_process";
 var labelNames = (l) => (l ?? []).map((x) => typeof x === "string" ? x : x.name ?? "").filter(Boolean);
 var norm4 = (s2) => s2.toLowerCase() === "closed" ? "closed" : "open";
 function issueFromGh(raw) {
@@ -81040,7 +80839,7 @@ function issuesFromRest(raw) {
 var GH_FIELDS = "number,title,body,author,labels,url,state,createdAt,updatedAt";
 var API2 = "https://api.github.com";
 var defaultRunGh = (args, env) => new Promise((resolve24, reject2) => {
-  execFile18(
+  execFile17(
     args[0],
     args.slice(1),
     { env, maxBuffer: 1 << 26, encoding: "utf8", timeout: 6e4 },
@@ -81272,7 +81071,7 @@ var STATUS = {
   unauthorized: 401,
   other: 502
 };
-var view10 = (i) => ({
+var view9 = (i) => ({
   id: i.id,
   projectId: i.projectId,
   repoSlug: i.repoSlug,
@@ -81307,7 +81106,7 @@ async function githubIssues(app3) {
       where: { projectId: id2, ...status2 ? { status: status2 } : {} },
       orderBy: [{ number: "desc" }]
     });
-    return reply.send(paginate(items.map(view10), page, limit));
+    return reply.send(paginate(items.map(view9), page, limit));
   });
   app3.post("/github-issues/accept", async (req, reply) => {
     const parsed = zAcceptMany.safeParse(req.body ?? {});
@@ -82076,7 +81875,7 @@ init_settings3();
 // src/services/portal-chat/turn.ts
 init_src();
 init_db();
-import { execFile as execFile19 } from "node:child_process";
+import { execFile as execFile18 } from "node:child_process";
 
 // src/services/portal-chat/guard-input.ts
 import { randomBytes as randomBytes10 } from "node:crypto";
@@ -82190,7 +81989,7 @@ init_src();
 init_db();
 import { mkdirSync as mkdirSync16, mkdtempSync as mkdtempSync4, rmSync as rmSync11, writeFileSync as writeFileSync14 } from "node:fs";
 import { tmpdir as tmpdir8 } from "node:os";
-import { join as join43 } from "node:path";
+import { join as join44 } from "node:path";
 var STAGE_LABEL = {
   brainstorming: "Dirumuskan",
   objective: "Dirumuskan",
@@ -82230,22 +82029,10 @@ function renderTicketDoc(tickets2) {
 `);
   return `# Laporan yang pernah dikirim
 
-${baris.join("\n")}`;
-}
-function renderChangelogDoc(rows) {
-  if (!rows.length) return "# Catatan rilis\n\nBelum ada catatan rilis.\n";
-  const baris = rows.map((c) => `## ${c.title}
-
-${tanggal(c.createdAt.toISOString())}
-
-${c.body}
-`);
-  return `# Catatan rilis
-
 ${baris.join("\n")}`;
 }
 async function buildChatWorkspace(projectId) {
-  const dir2 = mkdtempSync4(join43(tmpdir8(), "hanoman-portal-chat-"));
+  const dir2 = mkdtempSync4(join44(tmpdir8(), "hanoman-portal-chat-"));
   try {
     const project = await prisma.project.findUnique({
       where: { id: projectId },
@@ -82258,28 +82045,21 @@ async function buildChatWorkspace(projectId) {
       orderBy: { createdAt: "desc" },
       take: 100
     });
-    const changelogs = await prisma.changelog.findMany({
-      where: { projectId },
-      orderBy: { createdAt: "desc" },
-      take: 20,
-      select: { title: true, body: true, createdAt: true }
-    });
     const files = [];
     const tulis = (rel, isi) => {
-      writeFileSync14(join43(dir2, rel), isi, { mode: 384 });
+      writeFileSync14(join44(dir2, rel), isi, { mode: 384 });
       files.push(rel);
     };
     tulis("project.md", renderProjectDoc(project));
     tulis("pekerjaan.md", renderBacklogDoc(specs));
     tulis("laporan.md", renderTicketDoc(tickets2.map((t) => toPortalTicket(t, null))));
-    tulis("catatan-rilis.md", renderChangelogDoc(changelogs));
     const prds = await listPrds(projectId);
     if (prds.length) {
-      mkdirSync16(join43(dir2, "dokumen"), { mode: 448 });
+      mkdirSync16(join44(dir2, "dokumen"), { mode: 448 });
       for (const prd of prds) {
         const isi = await readPrd(projectId, prd.path);
         if (!isi) continue;
-        tulis(join43("dokumen", `${prd.slug.replaceAll("/", "-")}.md`), isi);
+        tulis(join44("dokumen", `${prd.slug.replaceAll("/", "-")}.md`), isi);
       }
     }
     return { dir: dir2, files, cleanup: () => rmSync11(dir2, { recursive: true, force: true }) };
@@ -82363,7 +82143,7 @@ function chatFailureReason(err, stdout, stderr, timeoutMs) {
 }
 function runProcess(p3, timeoutMs) {
   return new Promise((resolve24, reject2) => {
-    const child = execFile19(p3.file, p3.args, {
+    const child = execFile18(p3.file, p3.args, {
       cwd: p3.cwd,
       timeout: timeoutMs,
       maxBuffer: 16 * 1024 * 1024,
@@ -82701,7 +82481,7 @@ async function portal_chat_admin_default(app3) {
 // src/routes/client-accounts.ts
 init_src();
 init_db();
-var view11 = (u) => ({
+var view10 = (u) => ({
   id: u.id,
   email: u.email,
   disabled: u.disabled,
@@ -82732,7 +82512,7 @@ async function client_accounts_default(app3) {
       orderBy: { createdAt: "asc" },
       include: { projectAccess: { select: { projectId: true } } }
     });
-    return { items: rows.map(view11) };
+    return { items: rows.map(view10) };
   });
   app3.post("/client-accounts", async (req, reply) => {
     const p3 = zCreateClientAccount.safeParse(req.body);
@@ -82746,7 +82526,7 @@ async function client_accounts_default(app3) {
       await prisma.user.delete({ where: { id: user.id } });
       return reply.code(400).send({ error: "ada project yang tidak dikenal" });
     }
-    return reply.code(201).send(view11(await load(user.id)));
+    return reply.code(201).send(view10(await load(user.id)));
   });
   app3.patch("/client-accounts/:id", async (req, reply) => {
     const { id: id2 } = req.params;
@@ -82760,7 +82540,7 @@ async function client_accounts_default(app3) {
     if (p3.data.password)
       await prisma.user.update({ where: { id: id2 }, data: { passwordHash: await hashPassword(p3.data.password) } });
     if (p3.data.disabled || p3.data.password) await deleteUserSessions(id2);
-    return view11(await load(id2));
+    return view10(await load(id2));
   });
   app3.delete("/client-accounts/:id", async (req, reply) => {
     const { id: id2 } = req.params;
@@ -82792,15 +82572,15 @@ init_src();
 init_db();
 
 // src/services/bootstrap.ts
-import { createHash as createHash18, randomBytes as randomBytes11, timingSafeEqual as timingSafeEqual5 } from "node:crypto";
+import { createHash as createHash19, randomBytes as randomBytes11, timingSafeEqual as timingSafeEqual5 } from "node:crypto";
 import { chmod as chmod2, lstat as lstat3, mkdir as mkdir11, readFile as readFile9, unlink as unlink5, writeFile as writeFile8 } from "node:fs/promises";
-import { join as join44 } from "node:path";
+import { join as join45 } from "node:path";
 var TTL_MS5 = 15 * 6e4;
 var SETUP_TOKEN_FILE = "setup.token";
 var BootstrapError = class extends Error {
   code = "BOOTSTRAP_PROOF";
 };
-var tokenPath = (home3) => join44(home3, SETUP_TOKEN_FILE);
+var tokenPath = (home3) => join45(home3, SETUP_TOKEN_FILE);
 async function readStored(home3) {
   try {
     const info = await lstat3(tokenPath(home3));
@@ -82845,8 +82625,8 @@ ${new Date(expiresAt).toISOString()}
 }
 async function verifySetupToken(candidate, home3, now = Date.now()) {
   const stored = await readStored(home3);
-  const got = createHash18("sha256").update(candidate).digest();
-  const want = createHash18("sha256").update(stored.token).digest();
+  const got = createHash19("sha256").update(candidate).digest();
+  const want = createHash19("sha256").update(stored.token).digest();
   if (stored.expiresAt <= now || !timingSafeEqual5(got, want)) throw new BootstrapError("invalid setup proof");
 }
 async function consumeSetupToken(home3) {
@@ -82857,7 +82637,7 @@ async function consumeSetupToken(home3) {
 
 // src/routes/auth.ts
 var BOOTSTRAP_USER_ID = "bootstrap-admin";
-var view12 = (u) => ({ id: u.id, email: u.email, role: u.role, createdAt: u.createdAt.toISOString() });
+var view11 = (u) => ({ id: u.id, email: u.email, role: u.role, createdAt: u.createdAt.toISOString() });
 async function issue(req, reply, userId) {
   const token = await createSession2(userId);
   reply.setCookie(COOKIE_NAME, token, cookieOpts(req));
@@ -82897,7 +82677,7 @@ async function auth_default(app3, opts2) {
     if (opts2.bootstrapRequired) await consumeSetupToken(opts2.home);
     setupAttempts.clear(req.ip);
     await issue(req, reply, user.id);
-    return { user: view12(user) };
+    return { user: view11(user) };
   });
   app3.post("/auth/login", async (req, reply) => {
     if (loginThrottle(req.ip).blocked) return reply.code(429).send({ error: "too many attempts" });
@@ -82910,7 +82690,7 @@ async function auth_default(app3, opts2) {
     }
     clearLoginFails(req.ip);
     await issue(req, reply, user.id);
-    return { user: view12(user) };
+    return { user: view11(user) };
   });
   app3.post("/auth/logout", async (req, reply) => {
     const token = req.cookies?.[COOKIE_NAME];
@@ -82918,7 +82698,7 @@ async function auth_default(app3, opts2) {
     reply.clearCookie(COOKIE_NAME, { path: "/" });
     return reply.code(204).send();
   });
-  app3.get("/auth/users", async () => (await prisma.user.findMany({ orderBy: { createdAt: "asc" } })).map(view12));
+  app3.get("/auth/users", async () => (await prisma.user.findMany({ orderBy: { createdAt: "asc" } })).map(view11));
   app3.post("/auth/users", async (req, reply) => {
     const p3 = zSignup.safeParse(req.body);
     if (!p3.success) return reply.code(400).send({ error: p3.error.flatten() });
@@ -82929,7 +82709,7 @@ async function auth_default(app3, opts2) {
       // (/api/client-accounts) supaya "undang rekan" dan "beri akses klien" tak pernah tertukar.
       data: { email: p3.data.email, passwordHash: await hashPassword(p3.data.password), role: "admin" }
     });
-    return view12(user);
+    return view11(user);
   });
   app3.delete("/auth/users/:id", async (req, reply) => {
     const target3 = await prisma.user.findUnique({ where: { id: req.params.id } });
@@ -82952,7 +82732,7 @@ async function auth_default(app3, opts2) {
     });
     await deleteUserSessions(user.id);
     await issue(req, reply, user.id);
-    return { user: view12(user) };
+    return { user: view11(user) };
   });
 }
 
@@ -83041,15 +82821,15 @@ async function agent_tokens_default(app3) {
   app3.post("/agent-tokens", async (req, reply) => {
     const p3 = zAgentTokenCreate.safeParse(req.body);
     if (!p3.success) return reply.code(400).send({ error: p3.error.flatten() });
-    const { view: view13, token } = await issueAgentToken({ ...p3.data, createdBy: req.user?.id });
-    return reply.code(201).send({ ...view13, token });
+    const { view: view12, token } = await issueAgentToken({ ...p3.data, createdBy: req.user?.id });
+    return reply.code(201).send({ ...view12, token });
   });
   app3.patch("/agent-tokens/:id", async (req, reply) => {
     const p3 = zAgentTokenPatch.safeParse(req.body);
     if (!p3.success) return reply.code(400).send({ error: p3.error.flatten() });
     const { id: id2 } = req.params;
-    const view13 = await patchAgentToken(id2, p3.data);
-    return view13 ? reply.send(view13) : reply.code(404).send({ error: "not found" });
+    const view12 = await patchAgentToken(id2, p3.data);
+    return view12 ? reply.send(view12) : reply.code(404).send({ error: "not found" });
   });
   app3.delete("/agent-tokens/:id", async (req, reply) => {
     const { id: id2 } = req.params;
@@ -83336,7 +83116,7 @@ init_event_log();
 init_transcript_store();
 init_src2();
 import { readFile as readFile10 } from "node:fs/promises";
-import { join as join45 } from "node:path";
+import { join as join46 } from "node:path";
 function decodeCursor(c) {
   if (!c) return null;
   try {
@@ -83374,7 +83154,7 @@ async function readRemoteTranscript(id2) {
   const row = await prisma.logEntry.findUnique({ where: { id: id2 } });
   if (!row || row.lane !== "transcript" || !row.transcriptKey) return null;
   if (row.deviceId === "local") return readTranscript(row.transcriptKey);
-  const path = join45(resolveDataDirs().home, "remote-transcripts", row.transcriptKey);
+  const path = join46(resolveDataDirs().home, "remote-transcripts", row.transcriptKey);
   try {
     return await readFile10(path, "utf8");
   } catch {
@@ -83566,7 +83346,7 @@ var SETUP_PUBLIC = /* @__PURE__ */ new Set([
   "POST /api/setup"
 ]);
 function buildApp({ requireAuth = true, agentDocFile, env = process.env } = {}) {
-  const docFile = agentDocFile !== void 0 ? agentDocFile : pickGuideFile(dirname17(fileURLToPath5(import.meta.url)), env, existsSync23);
+  const docFile = agentDocFile !== void 0 ? agentDocFile : pickGuideFile(dirname17(fileURLToPath5(import.meta.url)), env, existsSync22);
   const ingress = loadIngressPolicy(env);
   const app3 = Fastify({ logger: false, trustProxy: trustProxyFromEnv(env) });
   app3.setErrorHandler((error, _req, reply) => {
@@ -83694,7 +83474,6 @@ function buildApp({ requireAuth = true, agentDocFile, env = process.env } = {})
     await api.register(githubIssues);
     await api.register(telegramRoutes);
     await api.register(webhooks_default);
-    await api.register(changelog_default);
     await api.register(portal_default);
     await api.register(portal_chat_default);
     await api.register(portal_chat_admin_default);
@@ -83707,7 +83486,7 @@ function buildApp({ requireAuth = true, agentDocFile, env = process.env } = {})
     await api.register(qaBacklog);
   }, { prefix: "/api" });
   if (shouldServeWeb(env)) {
-    const dist = pickWebDir(dirname17(fileURLToPath5(import.meta.url)), env, existsSync23);
+    const dist = pickWebDir(dirname17(fileURLToPath5(import.meta.url)), env, existsSync22);
     if (dist) {
       app3.register(fastifyStatic, { root: dist });
       app3.setNotFoundHandler((req, reply) => req.url.startsWith("/api") ? reply.code(404).send({ error: "not found" }) : req.url.startsWith("/assets/") ? reply.code(404).type("text/plain").send("not found") : reply.sendFile("index.html"));
@@ -84411,18 +84190,18 @@ function startWebhookEngine() {
 // src/services/auto-merge.ts
 init_src();
 init_db();
-import { execFile as execFile20 } from "node:child_process";
-import { promisify as promisify17 } from "node:util";
+import { execFile as execFile19 } from "node:child_process";
+import { promisify as promisify16 } from "node:util";
 init_local_binding();
 init_notifications2();
 var AUTO_MERGE_WINDOW_MS = 24 * 60 * 60 * 1e3;
 var AUTO_MERGE_GRACE_MS = 15 * 60 * 1e3;
 var TICK_MS4 = 6e4;
-var exec12 = promisify17(execFile20);
-var GIT9 = { timeout: 3e4, maxBuffer: 1 << 24, encoding: "utf8" };
+var exec11 = promisify16(execFile19);
+var GIT8 = { timeout: 3e4, maxBuffer: 1 << 24, encoding: "utf8" };
 var gitOut = async (cwd, args) => {
   try {
-    return (await exec12("git", args, { cwd, ...GIT9 })).stdout.trim();
+    return (await exec11("git", args, { cwd, ...GIT8 })).stdout.trim();
   } catch {
     return null;
   }
@@ -84631,9 +84410,9 @@ async function pruneLogs(now, retention, opts2 = {}) {
 }
 async function reconcileRemoteTranscripts() {
   const { readdir: readdir10, unlink: unlink6, stat: stat8 } = await import("node:fs/promises");
-  const { join: join46 } = await import("node:path");
+  const { join: join47 } = await import("node:path");
   const { resolveDataDirs: resolveDataDirs2 } = await Promise.resolve().then(() => (init_src2(), src_exports));
-  const root = join46(resolveDataDirs2().home, "remote-transcripts");
+  const root = join47(resolveDataDirs2().home, "remote-transcripts");
   let deviceDirs;
   try {
     deviceDirs = await readdir10(root);
@@ -84647,16 +84426,16 @@ async function reconcileRemoteTranscripts() {
   for (const dev of deviceDirs) {
     let files;
     try {
-      files = await readdir10(join46(root, dev));
+      files = await readdir10(join47(root, dev));
     } catch {
       continue;
     }
     for (const f of files) {
       const key = `${dev}/${f}`;
       if (referenced.has(key)) continue;
-      const st = await stat8(join46(root, dev, f)).catch(() => null);
+      const st = await stat8(join47(root, dev, f)).catch(() => null);
       if (!st || Date.now() - st.mtimeMs < gracePeriodMs) continue;
-      await unlink6(join46(root, dev, f)).catch(() => {
+      await unlink6(join47(root, dev, f)).catch(() => {
       });
       orphans++;
     }