@defend-tech/opencode-optima 0.1.15 → 0.1.17

package/dist/index.js

@@ -8017,6 +8017,9 @@ var REPO_LOCAL_POLICIES_README = [
 ].join("\n");
 var activeWorkflows = /* @__PURE__ */ new Map();
 var activeClickUpWebhookListeners = /* @__PURE__ */ new Map();
+var activeClickUpWebhookLifecycleRegistry = /* @__PURE__ */ new Map();
+var CLICKUP_WEBHOOK_CLEANUP_TIMEOUT_MS = 8e3;
+var CLICKUP_WEBHOOK_SIGNAL_STATE = Symbol.for("opencode-optima.clickup-webhook.signal-state");
 var activeClickUpTaskRoutes = /* @__PURE__ */ new Map();
 var objectIdentityMap = /* @__PURE__ */ new WeakMap();
 var objectIdentitySequence = 0;
@@ -9041,8 +9044,13 @@ async function ensureClickUpWebhookSubscription({ validation, worktree, clickupC
   const existingValidation = await validateClickUpWebhookState(existing, config, clickupClient);
   if (existingValidation.valid) {
     const state = writeClickUpWebhookState(worktree, { ...existingValidation.state, recentEventKeys: existing.recentEventKeys || [] }, config);
+    clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_reused", webhookId: state.webhookId, mode: existingValidation.mode });
     return { active: true, valid: true, mode: existingValidation.mode, limitation: existingValidation.limitation, state };
   }
+  if (existing.webhookId && clickupClient?.deleteWebhook) {
+    await deleteClickUpWebhookBestEffort({ webhookId: existing.webhookId, clickupClient, worktree, reason: existingValidation.reason || "startup_self_heal" });
+    markClickUpWebhookInactive(worktree, existing, config);
+  }
   if (!clickupClient?.createWebhook) {
     return { active: false, valid: false, reason: "clickup_client_unavailable", state: existing };
   }
@@ -9062,15 +9070,12 @@ async function ensureClickUpWebhookSubscription({ validation, worktree, clickupC
     }
   }
   if (!createdValidation.valid) {
-    if (stateForValidation.webhookId && clickupClient?.deleteWebhook) {
-      try {
-        await clickupClient.deleteWebhook(stateForValidation.webhookId);
-      } catch {
-      }
-    }
+    await deleteClickUpWebhookBestEffort({ webhookId: stateForValidation.webhookId, clickupClient, worktree, reason: "created_state_invalid" });
+    clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_create_invalid", webhookId: stateForValidation.webhookId, reason: createdValidation.reason });
     return { active: false, valid: false, reason: "created_state_invalid", validation: createdValidation, state: stateForValidation };
   }
   const next = writeClickUpWebhookState(worktree, createdValidation.state || stateForValidation, config);
+  clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_created", webhookId: next.webhookId, mode: createdValidation.mode || "created" });
   const mode = createdValidation.mode === "created_pending_remote_validation" ? "created_pending_remote_validation" : clickupClient?.listWebhooks ? "created_remote_validated" : "created";
   return { active: true, valid: true, mode, limitation: createdValidation.limitation, state: next };
 }
@@ -9253,6 +9258,93 @@ function appendClickUpWebhookLocalLog(worktree, entry) {
   fs2.appendFileSync(logPath, `${JSON.stringify(safeEntry)}
 `, "utf8");
 }
+function clickUpWebhookLifecycleLog(worktree, entry) {
+  try {
+    appendClickUpWebhookLocalLog(worktree, { scope: "lifecycle", ...entry });
+  } catch {
+  }
+}
+function promiseWithTimeout(promise, timeoutMs, timeoutValue) {
+  let timeout;
+  return Promise.race([
+    Promise.resolve(promise),
+    new Promise((resolve) => {
+      timeout = setTimeout(() => resolve(timeoutValue), Math.max(1, Number(timeoutMs) || CLICKUP_WEBHOOK_CLEANUP_TIMEOUT_MS));
+    })
+  ]).finally(() => clearTimeout(timeout));
+}
+function closeClickUpWebhookServer(server) {
+  if (!server || typeof server.close !== "function") return Promise.resolve({ ok: true, skipped: true });
+  return new Promise((resolve) => {
+    try {
+      server.close((error) => resolve(error ? { ok: false, error: error.message } : { ok: true }));
+    } catch (error) {
+      resolve({ ok: false, error: error.message });
+    }
+  });
+}
+function managedClickUpWebhookKey({ worktree, state, config } = {}) {
+  return [path2.resolve(worktree || process.cwd()), state?.webhookId || "", config?.webhook?.publicUrl || ""].join("|");
+}
+async function deleteClickUpWebhookBestEffort({ webhookId, clickupClient, worktree, reason = "cleanup" } = {}) {
+  const id = String(webhookId || "").trim();
+  if (!id || !clickupClient?.deleteWebhook) return { ok: false, skipped: true, reason: "delete_unavailable" };
+  try {
+    await clickupClient.deleteWebhook(id);
+    clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_deleted", reason, webhookId: id });
+    return { ok: true };
+  } catch (error) {
+    clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_delete_failed", reason, webhookId: id, message: error.message });
+    return { ok: false, error: error.message };
+  }
+}
+function markClickUpWebhookInactive(worktree, state = {}, config = null) {
+  if (!worktree || !state?.webhookId) return null;
+  return writeClickUpWebhookState(worktree, { ...state, active: false, listener: {}, lastValidatedAt: (/* @__PURE__ */ new Date()).toISOString() }, config);
+}
+async function cleanupManagedClickUpWebhook(entry = {}, { timeoutMs = CLICKUP_WEBHOOK_CLEANUP_TIMEOUT_MS, reason = "shutdown" } = {}) {
+  if (!entry || entry.cleaning) return { ok: true, skipped: true, reason: "already_cleaning" };
+  entry.cleaning = true;
+  const cleanup = (async () => {
+    clickUpWebhookLifecycleLog(entry.worktree, { type: "cleanup_started", reason, key: entry.key, webhookId: entry.state?.webhookId });
+    const closeResult = await closeClickUpWebhookServer(entry.listener?.server);
+    if (entry.listenerRegistry && entry.listener?.key) entry.listenerRegistry.delete(entry.listener.key);
+    const deleteResult = await deleteClickUpWebhookBestEffort({ webhookId: entry.state?.webhookId, clickupClient: entry.clickupClient, worktree: entry.worktree, reason });
+    if (deleteResult.ok) markClickUpWebhookInactive(entry.worktree, entry.state, entry.config);
+    activeClickUpWebhookLifecycleRegistry.delete(entry.key);
+    clickUpWebhookLifecycleLog(entry.worktree, { type: "cleanup_finished", reason, close_ok: closeResult.ok, delete_ok: deleteResult.ok, delete_reason: deleteResult.reason });
+    return { ok: closeResult.ok !== false && deleteResult.ok !== false, closeResult, deleteResult };
+  })();
+  const result = await promiseWithTimeout(cleanup, timeoutMs, { ok: false, timeout: true, reason: "cleanup_timeout" });
+  if (result?.timeout) clickUpWebhookLifecycleLog(entry.worktree, { type: "cleanup_timeout", reason, webhookId: entry.state?.webhookId });
+  return result;
+}
+function registerClickUpWebhookLifecycle({ config, state, worktree, clickupClient, listener, listenerRegistry = activeClickUpWebhookListeners } = {}) {
+  if (!isClickUpWebhookStateActive(state, config)) return null;
+  const key = managedClickUpWebhookKey({ worktree, state, config });
+  const entry = { key, config, state, worktree, clickupClient, listener, listenerRegistry, registeredAt: (/* @__PURE__ */ new Date()).toISOString() };
+  activeClickUpWebhookLifecycleRegistry.set(key, entry);
+  installClickUpWebhookSignalHandlers();
+  clickUpWebhookLifecycleLog(worktree, { type: "lifecycle_registered", key, webhookId: state.webhookId });
+  return entry;
+}
+function installClickUpWebhookSignalHandlers() {
+  const globalState = globalThis[CLICKUP_WEBHOOK_SIGNAL_STATE] || { installed: false, running: false };
+  if (globalState.installed) return;
+  const handler = (signal) => {
+    if (globalState.running) return;
+    globalState.running = true;
+    const timeoutMs = CLICKUP_WEBHOOK_CLEANUP_TIMEOUT_MS;
+    const cleanup = Promise.allSettled([...activeClickUpWebhookLifecycleRegistry.values()].map((entry) => cleanupManagedClickUpWebhook(entry, { timeoutMs, reason: signal })));
+    promiseWithTimeout(cleanup, timeoutMs + 500, { timeout: true }).finally(() => {
+      process.exit(signal === "SIGINT" ? 130 : 143);
+    });
+  };
+  process.once("SIGTERM", handler);
+  process.once("SIGINT", handler);
+  globalState.installed = true;
+  globalThis[CLICKUP_WEBHOOK_SIGNAL_STATE] = globalState;
+}
 function redactClickUpWebhookAuditValue(value, secretValues = []) {
   if (typeof value === "string") {
     return secretValues.reduce((next, secret) => secret ? next.split(secret).join(CLICKUP_WEBHOOK_REDACTED) : next, value);
@@ -10566,25 +10658,35 @@ async function OptimaPlugin(input = {}, pluginOptions = {}) {
   let clickUpWebhookActive = clickUpWebhookRuntime.active === true && clickUpWebhookRuntime.valid === true;
   if (clickUpWebhookActive && input.startClickUpWebhookListener !== false) {
     try {
+      const lifecycleClickUpClient = input.clickupClient || createClickUpApiClient(clickUpWebhookValidation.config, input.fetch);
+      const listenerRegistry = input.clickUpWebhookListenerRegistry || activeClickUpWebhookListeners;
+      const listenerState = clickUpWebhookRuntime.state || readClickUpWebhookState(worktree, clickUpWebhookValidation.config);
       const listener = startClickUpWebhookListener({
         config: clickUpWebhookValidation.config,
-        state: clickUpWebhookRuntime.state || readClickUpWebhookState(worktree, clickUpWebhookValidation.config),
+        state: listenerState,
         worktree,
-        clickupClient: input.clickupClient || createClickUpApiClient(clickUpWebhookValidation.config, input.fetch),
+        clickupClient: lifecycleClickUpClient,
         openCodeClient: input.client,
-        listenerRegistry: input.clickUpWebhookListenerRegistry || activeClickUpWebhookListeners
+        listenerRegistry
       });
       const readyListener = listener.readyPromise ? await listener.readyPromise : listener;
       if (readyListener.active && readyListener.ready !== false) {
-        writeClickUpWebhookState(worktree, {
-          ...clickUpWebhookRuntime.state || readClickUpWebhookState(worktree, clickUpWebhookValidation.config),
+        const activeState = writeClickUpWebhookState(worktree, {
+          ...listenerState,
           listener: { bindHost: clickUpWebhookValidation.config.webhook.bindHost, bindPort: clickUpWebhookValidation.config.webhook.bindPort, startedAt: (/* @__PURE__ */ new Date()).toISOString() }
         }, clickUpWebhookValidation.config);
+        registerClickUpWebhookLifecycle({ config: clickUpWebhookValidation.config, state: activeState, worktree, clickupClient: lifecycleClickUpClient, listener: readyListener, listenerRegistry });
       } else {
+        await deleteClickUpWebhookBestEffort({ webhookId: listenerState.webhookId, clickupClient: lifecycleClickUpClient, worktree, reason: readyListener.reason || "listener_unavailable" });
+        markClickUpWebhookInactive(worktree, listenerState, clickUpWebhookValidation.config);
         clickUpWebhookActive = false;
         clickUpWebhookRuntime = { ...clickUpWebhookRuntime, active: false, valid: false, reason: readyListener.reason || "listener_unavailable" };
       }
     } catch (error) {
+      const failureState = clickUpWebhookRuntime.state || readClickUpWebhookState(worktree, clickUpWebhookValidation.config);
+      const failureClient = input.clickupClient || createClickUpApiClient(clickUpWebhookValidation.config, input.fetch);
+      await deleteClickUpWebhookBestEffort({ webhookId: failureState.webhookId, clickupClient: failureClient, worktree, reason: "listener_failed" });
+      markClickUpWebhookInactive(worktree, failureState, clickUpWebhookValidation.config);
       clickUpWebhookActive = false;
       clickUpWebhookRuntime = { ...clickUpWebhookRuntime, active: false, valid: false, reason: "listener_failed", error: error.message };
       appendClickUpWebhookLocalLog(worktree, { type: "listener_failed", message: error.message });
@@ -11139,7 +11241,7 @@ Follow-up: use optima_prompt_workflow with session_id '${sessionId}' to check in
     }
   };
 }
-OptimaPlugin.__internals = { buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, readClickUpWebhookState, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
+OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, readClickUpWebhookState, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
 export {
   OptimaPlugin as default
 };

package/dist/sanitize_cli.js

@@ -8024,6 +8024,9 @@ var REPO_LOCAL_POLICIES_README = [
 ].join("\n");
 var activeWorkflows = /* @__PURE__ */ new Map();
 var activeClickUpWebhookListeners = /* @__PURE__ */ new Map();
+var activeClickUpWebhookLifecycleRegistry = /* @__PURE__ */ new Map();
+var CLICKUP_WEBHOOK_CLEANUP_TIMEOUT_MS = 8e3;
+var CLICKUP_WEBHOOK_SIGNAL_STATE = Symbol.for("opencode-optima.clickup-webhook.signal-state");
 var activeClickUpTaskRoutes = /* @__PURE__ */ new Map();
 var objectIdentityMap = /* @__PURE__ */ new WeakMap();
 var objectIdentitySequence = 0;
@@ -9048,8 +9051,13 @@ async function ensureClickUpWebhookSubscription({ validation, worktree, clickupC
   const existingValidation = await validateClickUpWebhookState(existing, config, clickupClient);
   if (existingValidation.valid) {
     const state = writeClickUpWebhookState(worktree, { ...existingValidation.state, recentEventKeys: existing.recentEventKeys || [] }, config);
+    clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_reused", webhookId: state.webhookId, mode: existingValidation.mode });
     return { active: true, valid: true, mode: existingValidation.mode, limitation: existingValidation.limitation, state };
   }
+  if (existing.webhookId && clickupClient?.deleteWebhook) {
+    await deleteClickUpWebhookBestEffort({ webhookId: existing.webhookId, clickupClient, worktree, reason: existingValidation.reason || "startup_self_heal" });
+    markClickUpWebhookInactive(worktree, existing, config);
+  }
   if (!clickupClient?.createWebhook) {
     return { active: false, valid: false, reason: "clickup_client_unavailable", state: existing };
   }
@@ -9069,15 +9077,12 @@ async function ensureClickUpWebhookSubscription({ validation, worktree, clickupC
     }
   }
   if (!createdValidation.valid) {
-    if (stateForValidation.webhookId && clickupClient?.deleteWebhook) {
-      try {
-        await clickupClient.deleteWebhook(stateForValidation.webhookId);
-      } catch {
-      }
-    }
+    await deleteClickUpWebhookBestEffort({ webhookId: stateForValidation.webhookId, clickupClient, worktree, reason: "created_state_invalid" });
+    clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_create_invalid", webhookId: stateForValidation.webhookId, reason: createdValidation.reason });
     return { active: false, valid: false, reason: "created_state_invalid", validation: createdValidation, state: stateForValidation };
   }
   const next = writeClickUpWebhookState(worktree, createdValidation.state || stateForValidation, config);
+  clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_created", webhookId: next.webhookId, mode: createdValidation.mode || "created" });
   const mode = createdValidation.mode === "created_pending_remote_validation" ? "created_pending_remote_validation" : clickupClient?.listWebhooks ? "created_remote_validated" : "created";
   return { active: true, valid: true, mode, limitation: createdValidation.limitation, state: next };
 }
@@ -9260,6 +9265,93 @@ function appendClickUpWebhookLocalLog(worktree, entry) {
   fs2.appendFileSync(logPath, `${JSON.stringify(safeEntry)}
 `, "utf8");
 }
+function clickUpWebhookLifecycleLog(worktree, entry) {
+  try {
+    appendClickUpWebhookLocalLog(worktree, { scope: "lifecycle", ...entry });
+  } catch {
+  }
+}
+function promiseWithTimeout(promise, timeoutMs, timeoutValue) {
+  let timeout;
+  return Promise.race([
+    Promise.resolve(promise),
+    new Promise((resolve) => {
+      timeout = setTimeout(() => resolve(timeoutValue), Math.max(1, Number(timeoutMs) || CLICKUP_WEBHOOK_CLEANUP_TIMEOUT_MS));
+    })
+  ]).finally(() => clearTimeout(timeout));
+}
+function closeClickUpWebhookServer(server) {
+  if (!server || typeof server.close !== "function") return Promise.resolve({ ok: true, skipped: true });
+  return new Promise((resolve) => {
+    try {
+      server.close((error) => resolve(error ? { ok: false, error: error.message } : { ok: true }));
+    } catch (error) {
+      resolve({ ok: false, error: error.message });
+    }
+  });
+}
+function managedClickUpWebhookKey({ worktree, state, config } = {}) {
+  return [path2.resolve(worktree || process.cwd()), state?.webhookId || "", config?.webhook?.publicUrl || ""].join("|");
+}
+async function deleteClickUpWebhookBestEffort({ webhookId, clickupClient, worktree, reason = "cleanup" } = {}) {
+  const id = String(webhookId || "").trim();
+  if (!id || !clickupClient?.deleteWebhook) return { ok: false, skipped: true, reason: "delete_unavailable" };
+  try {
+    await clickupClient.deleteWebhook(id);
+    clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_deleted", reason, webhookId: id });
+    return { ok: true };
+  } catch (error) {
+    clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_delete_failed", reason, webhookId: id, message: error.message });
+    return { ok: false, error: error.message };
+  }
+}
+function markClickUpWebhookInactive(worktree, state = {}, config = null) {
+  if (!worktree || !state?.webhookId) return null;
+  return writeClickUpWebhookState(worktree, { ...state, active: false, listener: {}, lastValidatedAt: (/* @__PURE__ */ new Date()).toISOString() }, config);
+}
+async function cleanupManagedClickUpWebhook(entry = {}, { timeoutMs = CLICKUP_WEBHOOK_CLEANUP_TIMEOUT_MS, reason = "shutdown" } = {}) {
+  if (!entry || entry.cleaning) return { ok: true, skipped: true, reason: "already_cleaning" };
+  entry.cleaning = true;
+  const cleanup = (async () => {
+    clickUpWebhookLifecycleLog(entry.worktree, { type: "cleanup_started", reason, key: entry.key, webhookId: entry.state?.webhookId });
+    const closeResult = await closeClickUpWebhookServer(entry.listener?.server);
+    if (entry.listenerRegistry && entry.listener?.key) entry.listenerRegistry.delete(entry.listener.key);
+    const deleteResult = await deleteClickUpWebhookBestEffort({ webhookId: entry.state?.webhookId, clickupClient: entry.clickupClient, worktree: entry.worktree, reason });
+    if (deleteResult.ok) markClickUpWebhookInactive(entry.worktree, entry.state, entry.config);
+    activeClickUpWebhookLifecycleRegistry.delete(entry.key);
+    clickUpWebhookLifecycleLog(entry.worktree, { type: "cleanup_finished", reason, close_ok: closeResult.ok, delete_ok: deleteResult.ok, delete_reason: deleteResult.reason });
+    return { ok: closeResult.ok !== false && deleteResult.ok !== false, closeResult, deleteResult };
+  })();
+  const result = await promiseWithTimeout(cleanup, timeoutMs, { ok: false, timeout: true, reason: "cleanup_timeout" });
+  if (result?.timeout) clickUpWebhookLifecycleLog(entry.worktree, { type: "cleanup_timeout", reason, webhookId: entry.state?.webhookId });
+  return result;
+}
+function registerClickUpWebhookLifecycle({ config, state, worktree, clickupClient, listener, listenerRegistry = activeClickUpWebhookListeners } = {}) {
+  if (!isClickUpWebhookStateActive(state, config)) return null;
+  const key = managedClickUpWebhookKey({ worktree, state, config });
+  const entry = { key, config, state, worktree, clickupClient, listener, listenerRegistry, registeredAt: (/* @__PURE__ */ new Date()).toISOString() };
+  activeClickUpWebhookLifecycleRegistry.set(key, entry);
+  installClickUpWebhookSignalHandlers();
+  clickUpWebhookLifecycleLog(worktree, { type: "lifecycle_registered", key, webhookId: state.webhookId });
+  return entry;
+}
+function installClickUpWebhookSignalHandlers() {
+  const globalState = globalThis[CLICKUP_WEBHOOK_SIGNAL_STATE] || { installed: false, running: false };
+  if (globalState.installed) return;
+  const handler = (signal) => {
+    if (globalState.running) return;
+    globalState.running = true;
+    const timeoutMs = CLICKUP_WEBHOOK_CLEANUP_TIMEOUT_MS;
+    const cleanup = Promise.allSettled([...activeClickUpWebhookLifecycleRegistry.values()].map((entry) => cleanupManagedClickUpWebhook(entry, { timeoutMs, reason: signal })));
+    promiseWithTimeout(cleanup, timeoutMs + 500, { timeout: true }).finally(() => {
+      process.exit(signal === "SIGINT" ? 130 : 143);
+    });
+  };
+  process.once("SIGTERM", handler);
+  process.once("SIGINT", handler);
+  globalState.installed = true;
+  globalThis[CLICKUP_WEBHOOK_SIGNAL_STATE] = globalState;
+}
 function redactClickUpWebhookAuditValue(value, secretValues = []) {
   if (typeof value === "string") {
     return secretValues.reduce((next, secret) => secret ? next.split(secret).join(CLICKUP_WEBHOOK_REDACTED) : next, value);
@@ -10573,25 +10665,35 @@ async function OptimaPlugin(input = {}, pluginOptions = {}) {
   let clickUpWebhookActive = clickUpWebhookRuntime.active === true && clickUpWebhookRuntime.valid === true;
   if (clickUpWebhookActive && input.startClickUpWebhookListener !== false) {
     try {
+      const lifecycleClickUpClient = input.clickupClient || createClickUpApiClient(clickUpWebhookValidation.config, input.fetch);
+      const listenerRegistry = input.clickUpWebhookListenerRegistry || activeClickUpWebhookListeners;
+      const listenerState = clickUpWebhookRuntime.state || readClickUpWebhookState(worktree, clickUpWebhookValidation.config);
       const listener = startClickUpWebhookListener({
         config: clickUpWebhookValidation.config,
-        state: clickUpWebhookRuntime.state || readClickUpWebhookState(worktree, clickUpWebhookValidation.config),
+        state: listenerState,
         worktree,
-        clickupClient: input.clickupClient || createClickUpApiClient(clickUpWebhookValidation.config, input.fetch),
+        clickupClient: lifecycleClickUpClient,
         openCodeClient: input.client,
-        listenerRegistry: input.clickUpWebhookListenerRegistry || activeClickUpWebhookListeners
+        listenerRegistry
       });
       const readyListener = listener.readyPromise ? await listener.readyPromise : listener;
       if (readyListener.active && readyListener.ready !== false) {
-        writeClickUpWebhookState(worktree, {
-          ...clickUpWebhookRuntime.state || readClickUpWebhookState(worktree, clickUpWebhookValidation.config),
+        const activeState = writeClickUpWebhookState(worktree, {
+          ...listenerState,
           listener: { bindHost: clickUpWebhookValidation.config.webhook.bindHost, bindPort: clickUpWebhookValidation.config.webhook.bindPort, startedAt: (/* @__PURE__ */ new Date()).toISOString() }
         }, clickUpWebhookValidation.config);
+        registerClickUpWebhookLifecycle({ config: clickUpWebhookValidation.config, state: activeState, worktree, clickupClient: lifecycleClickUpClient, listener: readyListener, listenerRegistry });
       } else {
+        await deleteClickUpWebhookBestEffort({ webhookId: listenerState.webhookId, clickupClient: lifecycleClickUpClient, worktree, reason: readyListener.reason || "listener_unavailable" });
+        markClickUpWebhookInactive(worktree, listenerState, clickUpWebhookValidation.config);
         clickUpWebhookActive = false;
         clickUpWebhookRuntime = { ...clickUpWebhookRuntime, active: false, valid: false, reason: readyListener.reason || "listener_unavailable" };
       }
     } catch (error) {
+      const failureState = clickUpWebhookRuntime.state || readClickUpWebhookState(worktree, clickUpWebhookValidation.config);
+      const failureClient = input.clickupClient || createClickUpApiClient(clickUpWebhookValidation.config, input.fetch);
+      await deleteClickUpWebhookBestEffort({ webhookId: failureState.webhookId, clickupClient: failureClient, worktree, reason: "listener_failed" });
+      markClickUpWebhookInactive(worktree, failureState, clickUpWebhookValidation.config);
       clickUpWebhookActive = false;
       clickUpWebhookRuntime = { ...clickUpWebhookRuntime, active: false, valid: false, reason: "listener_failed", error: error.message };
       appendClickUpWebhookLocalLog(worktree, { type: "listener_failed", message: error.message });
@@ -11146,7 +11248,7 @@ Follow-up: use optima_prompt_workflow with session_id '${sessionId}' to check in
     }
   };
 }
-OptimaPlugin.__internals = { buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, readClickUpWebhookState, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
+OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, readClickUpWebhookState, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
 
 // src/sanitize_cli.js
 var { migrateLegacyOptimaLayout: migrateLegacyOptimaLayout2 } = OptimaPlugin.__internals;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defend-tech/opencode-optima",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "repository": {
     "type": "git",
     "url": "git+ssh://git@github.com/defend-tech/opencode-optima.git"