@defend-tech/opencode-optima 0.1.12 → 0.1.13

package/dist/index.js

@@ -7929,6 +7929,8 @@ var CLICKUP_PM_MENTION_NAME = "Defend Tech Product Manager";
 var CLICKUP_WEBHOOK_RUNTIME_VERSION = 1;
 var CLICKUP_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
 var CLICKUP_WEBHOOK_REQUEST_TIMEOUT_MS = 1e4;
+var CLICKUP_WEBHOOK_LOG_LEVELS = /* @__PURE__ */ new Set(["error", "info", "verbose"]);
+var CLICKUP_WEBHOOK_REDACTED = "[REDACTED]";
 var DISCUSSION_BACKFILL_FETCH_LIMIT = 100;
 var DEFAULT_PRESERVE_EXISTING_AGENTS = true;
 var SAFE_WORKTREE_FAILURE = "FAIL: Optima needs a writable project directory. Open/add a project in OpenChamber first. Refusing to use '/'.";
@@ -8793,6 +8795,22 @@ function clickUpWebhookStatePath(worktree) {
 function clickUpWebhookLogPath(worktree) {
   return path2.join(optimaRuntimeDir(worktree), "clickup-webhook.log.jsonl");
 }
+function normalizeClickUpWebhookLogLevel(value) {
+  const level = String(value || "info").trim().toLowerCase();
+  return CLICKUP_WEBHOOK_LOG_LEVELS.has(level) ? level : "info";
+}
+function clickUpWebhookAuditLogDir() {
+  const dataHome = process.env.XDG_DATA_HOME && path2.isAbsolute(process.env.XDG_DATA_HOME) ? process.env.XDG_DATA_HOME : path2.join(os.homedir(), ".local", "share", "opencode");
+  return path2.join(dataHome, "opencode-optima");
+}
+function clickUpWebhookAuditLogPath(at = /* @__PURE__ */ new Date(), logDir = clickUpWebhookAuditLogDir()) {
+  return path2.join(logDir, `clickup-webhook-${at.toISOString().slice(0, 10)}.jsonl`);
+}
+function clickUpWebhookRequestFilePath(at = /* @__PURE__ */ new Date(), logDir = clickUpWebhookAuditLogDir()) {
+  const stamp = at.toISOString().replace(/:/g, "-").replace(/\./g, "-");
+  const shortId = crypto.randomBytes(4).toString("hex");
+  return path2.join(logDir, "requests", `clickup-webhook-${stamp}-${shortId}.json`);
+}
 function findOptimaPluginTupleOptions(pluginEntries = []) {
   if (!Array.isArray(pluginEntries)) return null;
   for (const entry of pluginEntries) {
@@ -8822,6 +8840,7 @@ function normalizeClickUpWebhookConfig(rawClickUp = null, worktree = process.cwd
     basePath: String(raw.base_path || raw.basePath || worktree || "").trim(),
     teamId: String(raw.team_id || raw.teamId || "").trim(),
     apiToken: String(raw.api_token || raw.apiToken || "").trim(),
+    log: normalizeClickUpWebhookLogLevel(raw.log),
     webhook: {
       publicUrl: String(webhook.public_url || webhook.publicUrl || "").trim(),
       bindHost: String(webhook.bind_host || webhook.bindHost || "127.0.0.1").trim(),
@@ -9212,6 +9231,74 @@ function appendClickUpWebhookLocalLog(worktree, entry) {
   fs2.appendFileSync(logPath, `${JSON.stringify(safeEntry)}
 `, "utf8");
 }
+function redactClickUpWebhookAuditValue(value, secretValues = []) {
+  if (typeof value === "string") {
+    return secretValues.reduce((next, secret) => secret ? next.split(secret).join(CLICKUP_WEBHOOK_REDACTED) : next, value);
+  }
+  if (Array.isArray(value)) return value.map((item) => redactClickUpWebhookAuditValue(item, secretValues));
+  if (!isPlainObject(value)) return value;
+  return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => {
+    const normalizedKey = normalizeLooseToken(key);
+    const secretKey = normalizedKey.includes("signature") || normalizedKey.includes("authorization") || normalizedKey.includes("cookie") || normalizedKey.includes("token") || normalizedKey.includes("secret") || normalizedKey.includes("api-key") || normalizedKey.includes("apikey");
+    return [key, secretKey ? CLICKUP_WEBHOOK_REDACTED : redactClickUpWebhookAuditValue(entryValue, secretValues)];
+  }));
+}
+function buildClickUpWebhookAuditSummary({ method, url, config, handled, error, payload, requestFile, at = /* @__PURE__ */ new Date() } = {}) {
+  const result = handled?.result || {};
+  const summary = {
+    at: at.toISOString(),
+    method,
+    path: url === null ? null : new URL(String(url || "/"), config?.webhook?.publicUrl || "http://localhost").pathname,
+    status: handled?.status || 500,
+    ok: Boolean(handled?.ok),
+    reason: handled?.reason || result.reason || (error ? "handler_error" : void 0),
+    action: result.action,
+    event: payload ? clickUpEventType(payload) : void 0,
+    task: result.taskId || clickUpTaskIdFromPayload(payload || {}),
+    comment: clickUpCommentFromPayload(payload || {})?.id || payload?.comment_id || payload?.commentId,
+    session: result.sessionId,
+    base_path: config?.basePath || "",
+    request_file: requestFile || void 0
+  };
+  return Object.fromEntries(Object.entries(summary).filter(([, value]) => value !== void 0 && value !== ""));
+}
+function writeClickUpWebhookAuditLog({ method, url, headers = {}, rawBody = "", config, state = {}, handled = null, error = null, payload = null, at = /* @__PURE__ */ new Date() } = {}) {
+  try {
+    const level = normalizeClickUpWebhookLogLevel(config?.log);
+    const failed = Boolean(error || !handled?.ok || (handled?.status || 500) >= 400);
+    if (level === "error" && !failed) return;
+    const logDir = clickUpWebhookAuditLogDir();
+    fs2.mkdirSync(logDir, { recursive: true });
+    const secretValues = [resolveSecretReference(config?.apiToken), state?.secret, config?.webhook?.secret].filter(Boolean);
+    let requestFile;
+    if (level === "verbose") {
+      const absoluteRequestFile = clickUpWebhookRequestFilePath(at, logDir);
+      fs2.mkdirSync(path2.dirname(absoluteRequestFile), { recursive: true });
+      requestFile = path2.relative(logDir, absoluteRequestFile).split(path2.sep).join("/");
+      const parsedBody = payload || (() => {
+        try {
+          return JSON.parse(Buffer.isBuffer(rawBody) ? rawBody.toString("utf8") : String(rawBody || ""));
+        } catch {
+          return void 0;
+        }
+      })();
+      const requestArtifact = redactClickUpWebhookAuditValue({
+        at: at.toISOString(),
+        method,
+        url,
+        path: url === null ? null : new URL(String(url || "/"), config?.webhook?.publicUrl || "http://localhost").pathname,
+        headers,
+        body: parsedBody === void 0 ? Buffer.isBuffer(rawBody) ? rawBody.toString("utf8") : String(rawBody || "") : parsedBody
+      }, secretValues);
+      fs2.writeFileSync(absoluteRequestFile, `${JSON.stringify(requestArtifact, null, 2)}
+`, "utf8");
+    }
+    const summary = redactClickUpWebhookAuditValue(buildClickUpWebhookAuditSummary({ method, url, config, handled, error, payload, requestFile, at }), secretValues);
+    fs2.appendFileSync(clickUpWebhookAuditLogPath(at, logDir), `${JSON.stringify(summary)}
+`, "utf8");
+  } catch {
+  }
+}
 async function withClickUpTaskRouteLock(taskId, operation) {
   const key = String(taskId || "");
   if (!key) return operation();
@@ -9309,25 +9396,36 @@ function clickUpWebhookExpectedPath(config) {
     return "/";
   }
 }
-async function handleClickUpWebhookRequest({ method = "POST", url = null, headers = {}, rawBody = "", config, state, worktree, clickupClient, openCodeClient, saveState } = {}) {
-  if (method !== "POST") return { ok: false, status: 405, reason: "method_not_allowed" };
-  if (url !== null) {
-    const requestPath = new URL(String(url), config?.webhook?.publicUrl || "http://localhost").pathname;
-    if (requestPath !== clickUpWebhookExpectedPath(config)) return { ok: false, status: 404, reason: "wrong_path" };
-  }
-  const maxBodyBytes = Number(config?.webhook?.maxBodyBytes || CLICKUP_WEBHOOK_MAX_BODY_BYTES);
-  const bodyBytes = Buffer.isBuffer(rawBody) ? rawBody.length : Buffer.byteLength(String(rawBody || ""));
-  if (bodyBytes > maxBodyBytes) return { ok: false, status: 413, reason: "body_too_large" };
-  const signature = headers["x-signature"] || headers["X-Signature"];
-  if (!verifyClickUpSignature(rawBody, signature, state?.secret)) return { ok: false, status: 401, reason: "invalid_signature" };
-  let payload;
+async function handleClickUpWebhookRequest({ method = "POST", url = null, headers = {}, rawBody = "", config, state, worktree, clickupClient, openCodeClient, saveState, now = () => /* @__PURE__ */ new Date() } = {}) {
+  let payload = null;
+  let handled = null;
+  const finish = (result) => {
+    handled = result;
+    writeClickUpWebhookAuditLog({ method, url, headers, rawBody, config, state, handled, payload, at: now() });
+    return result;
+  };
   try {
-    payload = JSON.parse(Buffer.isBuffer(rawBody) ? rawBody.toString("utf8") : String(rawBody));
-  } catch {
-    return { ok: false, status: 400, reason: "invalid_json" };
+    if (method !== "POST") return finish({ ok: false, status: 405, reason: "method_not_allowed" });
+    if (url !== null) {
+      const requestPath = new URL(String(url), config?.webhook?.publicUrl || "http://localhost").pathname;
+      if (requestPath !== clickUpWebhookExpectedPath(config)) return finish({ ok: false, status: 404, reason: "wrong_path" });
+    }
+    const maxBodyBytes = Number(config?.webhook?.maxBodyBytes || CLICKUP_WEBHOOK_MAX_BODY_BYTES);
+    const bodyBytes = Buffer.isBuffer(rawBody) ? rawBody.length : Buffer.byteLength(String(rawBody || ""));
+    if (bodyBytes > maxBodyBytes) return finish({ ok: false, status: 413, reason: "body_too_large" });
+    const signature = headers["x-signature"] || headers["X-Signature"];
+    if (!verifyClickUpSignature(rawBody, signature, state?.secret)) return finish({ ok: false, status: 401, reason: "invalid_signature" });
+    try {
+      payload = JSON.parse(Buffer.isBuffer(rawBody) ? rawBody.toString("utf8") : String(rawBody));
+    } catch {
+      return finish({ ok: false, status: 400, reason: "invalid_json" });
+    }
+    const result = await routeClickUpWebhookEvent({ payload, config, state, worktree, clickupClient, openCodeClient, saveState });
+    return finish({ ok: result.ok, status: result.ok ? 200 : 422, result });
+  } catch (error) {
+    writeClickUpWebhookAuditLog({ method, url, headers, rawBody, config, state, handled, error, payload, at: now() });
+    throw error;
   }
-  const result = await routeClickUpWebhookEvent({ payload, config, state, worktree, clickupClient, openCodeClient, saveState });
-  return { ok: result.ok, status: result.ok ? 200 : 422, result };
 }
 function clickUpListenerKey(config) {
   return `${config?.webhook?.bindHost || "127.0.0.1"}:${config?.webhook?.bindPort || 0}`;
@@ -11019,7 +11117,7 @@ Follow-up: use optima_prompt_workflow with session_id '${sessionId}' to check in
     }
   };
 }
-OptimaPlugin.__internals = { buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentMentionsProductManager, createClickUpApiClient, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, readClickUpWebhookState, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
+OptimaPlugin.__internals = { buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, readClickUpWebhookState, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
 export {
   OptimaPlugin as default
 };

package/dist/sanitize_cli.js

@@ -7936,6 +7936,8 @@ var CLICKUP_PM_MENTION_NAME = "Defend Tech Product Manager";
 var CLICKUP_WEBHOOK_RUNTIME_VERSION = 1;
 var CLICKUP_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
 var CLICKUP_WEBHOOK_REQUEST_TIMEOUT_MS = 1e4;
+var CLICKUP_WEBHOOK_LOG_LEVELS = /* @__PURE__ */ new Set(["error", "info", "verbose"]);
+var CLICKUP_WEBHOOK_REDACTED = "[REDACTED]";
 var DISCUSSION_BACKFILL_FETCH_LIMIT = 100;
 var DEFAULT_PRESERVE_EXISTING_AGENTS = true;
 var SAFE_WORKTREE_FAILURE = "FAIL: Optima needs a writable project directory. Open/add a project in OpenChamber first. Refusing to use '/'.";
@@ -8800,6 +8802,22 @@ function clickUpWebhookStatePath(worktree) {
 function clickUpWebhookLogPath(worktree) {
   return path2.join(optimaRuntimeDir(worktree), "clickup-webhook.log.jsonl");
 }
+function normalizeClickUpWebhookLogLevel(value) {
+  const level = String(value || "info").trim().toLowerCase();
+  return CLICKUP_WEBHOOK_LOG_LEVELS.has(level) ? level : "info";
+}
+function clickUpWebhookAuditLogDir() {
+  const dataHome = process.env.XDG_DATA_HOME && path2.isAbsolute(process.env.XDG_DATA_HOME) ? process.env.XDG_DATA_HOME : path2.join(os.homedir(), ".local", "share", "opencode");
+  return path2.join(dataHome, "opencode-optima");
+}
+function clickUpWebhookAuditLogPath(at = /* @__PURE__ */ new Date(), logDir = clickUpWebhookAuditLogDir()) {
+  return path2.join(logDir, `clickup-webhook-${at.toISOString().slice(0, 10)}.jsonl`);
+}
+function clickUpWebhookRequestFilePath(at = /* @__PURE__ */ new Date(), logDir = clickUpWebhookAuditLogDir()) {
+  const stamp = at.toISOString().replace(/:/g, "-").replace(/\./g, "-");
+  const shortId = crypto.randomBytes(4).toString("hex");
+  return path2.join(logDir, "requests", `clickup-webhook-${stamp}-${shortId}.json`);
+}
 function findOptimaPluginTupleOptions(pluginEntries = []) {
   if (!Array.isArray(pluginEntries)) return null;
   for (const entry of pluginEntries) {
@@ -8829,6 +8847,7 @@ function normalizeClickUpWebhookConfig(rawClickUp = null, worktree = process.cwd
     basePath: String(raw.base_path || raw.basePath || worktree || "").trim(),
     teamId: String(raw.team_id || raw.teamId || "").trim(),
     apiToken: String(raw.api_token || raw.apiToken || "").trim(),
+    log: normalizeClickUpWebhookLogLevel(raw.log),
     webhook: {
       publicUrl: String(webhook.public_url || webhook.publicUrl || "").trim(),
       bindHost: String(webhook.bind_host || webhook.bindHost || "127.0.0.1").trim(),
@@ -9219,6 +9238,74 @@ function appendClickUpWebhookLocalLog(worktree, entry) {
   fs2.appendFileSync(logPath, `${JSON.stringify(safeEntry)}
 `, "utf8");
 }
+function redactClickUpWebhookAuditValue(value, secretValues = []) {
+  if (typeof value === "string") {
+    return secretValues.reduce((next, secret) => secret ? next.split(secret).join(CLICKUP_WEBHOOK_REDACTED) : next, value);
+  }
+  if (Array.isArray(value)) return value.map((item) => redactClickUpWebhookAuditValue(item, secretValues));
+  if (!isPlainObject(value)) return value;
+  return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => {
+    const normalizedKey = normalizeLooseToken(key);
+    const secretKey = normalizedKey.includes("signature") || normalizedKey.includes("authorization") || normalizedKey.includes("cookie") || normalizedKey.includes("token") || normalizedKey.includes("secret") || normalizedKey.includes("api-key") || normalizedKey.includes("apikey");
+    return [key, secretKey ? CLICKUP_WEBHOOK_REDACTED : redactClickUpWebhookAuditValue(entryValue, secretValues)];
+  }));
+}
+function buildClickUpWebhookAuditSummary({ method, url, config, handled, error, payload, requestFile, at = /* @__PURE__ */ new Date() } = {}) {
+  const result = handled?.result || {};
+  const summary = {
+    at: at.toISOString(),
+    method,
+    path: url === null ? null : new URL(String(url || "/"), config?.webhook?.publicUrl || "http://localhost").pathname,
+    status: handled?.status || 500,
+    ok: Boolean(handled?.ok),
+    reason: handled?.reason || result.reason || (error ? "handler_error" : void 0),
+    action: result.action,
+    event: payload ? clickUpEventType(payload) : void 0,
+    task: result.taskId || clickUpTaskIdFromPayload(payload || {}),
+    comment: clickUpCommentFromPayload(payload || {})?.id || payload?.comment_id || payload?.commentId,
+    session: result.sessionId,
+    base_path: config?.basePath || "",
+    request_file: requestFile || void 0
+  };
+  return Object.fromEntries(Object.entries(summary).filter(([, value]) => value !== void 0 && value !== ""));
+}
+function writeClickUpWebhookAuditLog({ method, url, headers = {}, rawBody = "", config, state = {}, handled = null, error = null, payload = null, at = /* @__PURE__ */ new Date() } = {}) {
+  try {
+    const level = normalizeClickUpWebhookLogLevel(config?.log);
+    const failed = Boolean(error || !handled?.ok || (handled?.status || 500) >= 400);
+    if (level === "error" && !failed) return;
+    const logDir = clickUpWebhookAuditLogDir();
+    fs2.mkdirSync(logDir, { recursive: true });
+    const secretValues = [resolveSecretReference(config?.apiToken), state?.secret, config?.webhook?.secret].filter(Boolean);
+    let requestFile;
+    if (level === "verbose") {
+      const absoluteRequestFile = clickUpWebhookRequestFilePath(at, logDir);
+      fs2.mkdirSync(path2.dirname(absoluteRequestFile), { recursive: true });
+      requestFile = path2.relative(logDir, absoluteRequestFile).split(path2.sep).join("/");
+      const parsedBody = payload || (() => {
+        try {
+          return JSON.parse(Buffer.isBuffer(rawBody) ? rawBody.toString("utf8") : String(rawBody || ""));
+        } catch {
+          return void 0;
+        }
+      })();
+      const requestArtifact = redactClickUpWebhookAuditValue({
+        at: at.toISOString(),
+        method,
+        url,
+        path: url === null ? null : new URL(String(url || "/"), config?.webhook?.publicUrl || "http://localhost").pathname,
+        headers,
+        body: parsedBody === void 0 ? Buffer.isBuffer(rawBody) ? rawBody.toString("utf8") : String(rawBody || "") : parsedBody
+      }, secretValues);
+      fs2.writeFileSync(absoluteRequestFile, `${JSON.stringify(requestArtifact, null, 2)}
+`, "utf8");
+    }
+    const summary = redactClickUpWebhookAuditValue(buildClickUpWebhookAuditSummary({ method, url, config, handled, error, payload, requestFile, at }), secretValues);
+    fs2.appendFileSync(clickUpWebhookAuditLogPath(at, logDir), `${JSON.stringify(summary)}
+`, "utf8");
+  } catch {
+  }
+}
 async function withClickUpTaskRouteLock(taskId, operation) {
   const key = String(taskId || "");
   if (!key) return operation();
@@ -9316,25 +9403,36 @@ function clickUpWebhookExpectedPath(config) {
     return "/";
   }
 }
-async function handleClickUpWebhookRequest({ method = "POST", url = null, headers = {}, rawBody = "", config, state, worktree, clickupClient, openCodeClient, saveState } = {}) {
-  if (method !== "POST") return { ok: false, status: 405, reason: "method_not_allowed" };
-  if (url !== null) {
-    const requestPath = new URL(String(url), config?.webhook?.publicUrl || "http://localhost").pathname;
-    if (requestPath !== clickUpWebhookExpectedPath(config)) return { ok: false, status: 404, reason: "wrong_path" };
-  }
-  const maxBodyBytes = Number(config?.webhook?.maxBodyBytes || CLICKUP_WEBHOOK_MAX_BODY_BYTES);
-  const bodyBytes = Buffer.isBuffer(rawBody) ? rawBody.length : Buffer.byteLength(String(rawBody || ""));
-  if (bodyBytes > maxBodyBytes) return { ok: false, status: 413, reason: "body_too_large" };
-  const signature = headers["x-signature"] || headers["X-Signature"];
-  if (!verifyClickUpSignature(rawBody, signature, state?.secret)) return { ok: false, status: 401, reason: "invalid_signature" };
-  let payload;
+async function handleClickUpWebhookRequest({ method = "POST", url = null, headers = {}, rawBody = "", config, state, worktree, clickupClient, openCodeClient, saveState, now = () => /* @__PURE__ */ new Date() } = {}) {
+  let payload = null;
+  let handled = null;
+  const finish = (result) => {
+    handled = result;
+    writeClickUpWebhookAuditLog({ method, url, headers, rawBody, config, state, handled, payload, at: now() });
+    return result;
+  };
   try {
-    payload = JSON.parse(Buffer.isBuffer(rawBody) ? rawBody.toString("utf8") : String(rawBody));
-  } catch {
-    return { ok: false, status: 400, reason: "invalid_json" };
+    if (method !== "POST") return finish({ ok: false, status: 405, reason: "method_not_allowed" });
+    if (url !== null) {
+      const requestPath = new URL(String(url), config?.webhook?.publicUrl || "http://localhost").pathname;
+      if (requestPath !== clickUpWebhookExpectedPath(config)) return finish({ ok: false, status: 404, reason: "wrong_path" });
+    }
+    const maxBodyBytes = Number(config?.webhook?.maxBodyBytes || CLICKUP_WEBHOOK_MAX_BODY_BYTES);
+    const bodyBytes = Buffer.isBuffer(rawBody) ? rawBody.length : Buffer.byteLength(String(rawBody || ""));
+    if (bodyBytes > maxBodyBytes) return finish({ ok: false, status: 413, reason: "body_too_large" });
+    const signature = headers["x-signature"] || headers["X-Signature"];
+    if (!verifyClickUpSignature(rawBody, signature, state?.secret)) return finish({ ok: false, status: 401, reason: "invalid_signature" });
+    try {
+      payload = JSON.parse(Buffer.isBuffer(rawBody) ? rawBody.toString("utf8") : String(rawBody));
+    } catch {
+      return finish({ ok: false, status: 400, reason: "invalid_json" });
+    }
+    const result = await routeClickUpWebhookEvent({ payload, config, state, worktree, clickupClient, openCodeClient, saveState });
+    return finish({ ok: result.ok, status: result.ok ? 200 : 422, result });
+  } catch (error) {
+    writeClickUpWebhookAuditLog({ method, url, headers, rawBody, config, state, handled, error, payload, at: now() });
+    throw error;
   }
-  const result = await routeClickUpWebhookEvent({ payload, config, state, worktree, clickupClient, openCodeClient, saveState });
-  return { ok: result.ok, status: result.ok ? 200 : 422, result };
 }
 function clickUpListenerKey(config) {
   return `${config?.webhook?.bindHost || "127.0.0.1"}:${config?.webhook?.bindPort || 0}`;
@@ -11026,7 +11124,7 @@ Follow-up: use optima_prompt_workflow with session_id '${sessionId}' to check in
     }
   };
 }
-OptimaPlugin.__internals = { buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentMentionsProductManager, createClickUpApiClient, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, readClickUpWebhookState, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
+OptimaPlugin.__internals = { buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, readClickUpWebhookState, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
 
 // src/sanitize_cli.js
 var { migrateLegacyOptimaLayout: migrateLegacyOptimaLayout2 } = OptimaPlugin.__internals;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defend-tech/opencode-optima",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "repository": {
     "type": "git",
     "url": "git+ssh://git@github.com/defend-tech/opencode-optima.git"