@defend-tech/opencode-optima 0.1.19 → 0.1.21

package/dist/index.js

@@ -8831,10 +8831,21 @@ function resolveOptimaPluginOptions(rawInput = {}, pluginOptions = {}) {
 function pickConfiguredClickUp(rawInput = {}, repoCfg = {}, pluginOptions = {}) {
   return pluginOptions?.clickup || pluginOptions?.experimental?.optima?.clickup || rawInput?.options?.clickup || rawInput?.options?.experimental?.optima?.clickup || rawInput?.experimental?.optima?.clickup || rawInput?.config?.experimental?.optima?.clickup || rawInput?.opencode?.experimental?.optima?.clickup || repoCfg?.experimental?.optima?.clickup || repoCfg?.clickup || null;
 }
+function normalizeOpenCodeBaseUrl(value, defaultValue = "http://127.0.0.1:3001") {
+  const candidate = String(value || defaultValue || "").trim();
+  if (!candidate) return "";
+  try {
+    const url = new URL(candidate);
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return candidate.replace(/\/+$/, "");
+  }
+}
 function normalizeClickUpWebhookConfig(rawClickUp = null, worktree = process.cwd()) {
   const raw = isPlainObject(rawClickUp) ? rawClickUp : {};
   const webhook = isPlainObject(raw.webhook) ? raw.webhook : {};
   const routing = isPlainObject(raw.routing) ? raw.routing : {};
+  const opencode = isPlainObject(raw.opencode) ? raw.opencode : {};
   const location = isPlainObject(webhook.location) ? webhook.location : {};
   const events = Array.isArray(webhook.events) && webhook.events.length > 0 ? [...new Set(webhook.events.map((event) => String(event || "").trim()).filter(Boolean))] : [...CLICKUP_WEBHOOK_EVENTS];
   const ignoredStatuses = Array.isArray(routing.ignored_statuses) && routing.ignored_statuses.length > 0 ? routing.ignored_statuses : CLICKUP_WEBHOOK_TERMINAL_STATUSES;
@@ -8844,6 +8855,9 @@ function normalizeClickUpWebhookConfig(rawClickUp = null, worktree = process.cwd
     teamId: String(raw.team_id || raw.teamId || "").trim(),
     apiToken: String(raw.api_token || raw.apiToken || "").trim(),
     log: normalizeClickUpWebhookLogLevel(raw.log),
+    opencode: {
+      baseUrl: normalizeOpenCodeBaseUrl(opencode.base_url || opencode.baseUrl || raw.opencode_base_url || raw.opencodeBaseUrl)
+    },
     webhook: {
       publicUrl: String(webhook.public_url || webhook.publicUrl || "").trim(),
       bindHost: String(webhook.bind_host || webhook.bindHost || "127.0.0.1").trim(),
@@ -8877,6 +8891,13 @@ function normalizeClickUpWebhookConfig(rawClickUp = null, worktree = process.cwd
   if (!config.webhook.bindHost) errors.push("clickup.webhook.bind_host is required");
   if (!Number.isInteger(config.webhook.bindPort) || config.webhook.bindPort <= 0) errors.push("clickup.webhook.bind_port must be a positive integer");
   if (!config.webhook.location.list_id && !config.webhook.location.folder_id && !config.webhook.location.space_id) errors.push("one clickup.webhook.location id is required");
+  if (config.opencode.baseUrl) {
+    try {
+      new URL(config.opencode.baseUrl);
+    } catch {
+      errors.push("clickup.opencode.base_url must be a valid URL");
+    }
+  }
   const missingEvents = CLICKUP_WEBHOOK_EVENTS.filter((event) => !config.webhook.events.includes(event));
   if (missingEvents.length > 0) errors.push(`clickup.webhook.events missing: ${missingEvents.join(", ")}`);
   if (config.routing.targetAgent !== "workflow_product_manager") errors.push("clickup.routing.target_agent must be workflow_product_manager");
@@ -9234,8 +9255,10 @@ async function openCodeSessionExists(client, sessionId) {
   }
   return false;
 }
-async function createOpenCodeSession(client, { title, directory } = {}) {
-  const result = await client.session.create({ query: { directory }, body: { title } });
+async function createOpenCodeSession(client, { title, directory, agent } = {}) {
+  const body = { title };
+  if (agent) body.agent = agent;
+  const result = await client.session.create({ query: { directory }, body });
   return result?.data?.id || result?.id;
 }
 function assertOpenCodePromptAccepted(result) {
@@ -9246,33 +9269,47 @@ function assertOpenCodePromptAccepted(result) {
   }
   return result;
 }
-async function callOpenCodePromptWithFallbacks(method, sessionId, flatPayload, structuredPayload) {
-  const attempts = [
-    { id: sessionId, ...flatPayload },
-    { sessionID: sessionId, ...flatPayload },
-    { ...structuredPayload, path: { sessionID: sessionId } },
-    { ...structuredPayload, path: { id: sessionId } }
-  ];
-  let firstError = null;
-  for (const attempt of attempts) {
+async function sendOpenCodeSessionEventDirect({ baseUrl, sessionId, text, fetchImpl = globalThis.fetch } = {}) {
+  if (typeof fetchImpl !== "function") throw new Error("OpenCode direct prompt delivery requires fetch.");
+  const root = normalizeOpenCodeBaseUrl(baseUrl, "");
+  if (!root) throw new Error("OpenCode direct prompt delivery requires a base URL.");
+  const url = `${root}/api/session/${encodeURIComponent(sessionId)}/prompt`;
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ prompt: { text }, delivery: "queue", resume: true })
+  });
+  const raw = await response.text();
+  let data = null;
+  if (raw) {
     try {
-      return assertOpenCodePromptAccepted(await method(attempt));
+      data = JSON.parse(raw);
     } catch (error) {
-      firstError ??= error;
+      if (response.ok) throw new Error(`OpenCode prompt response was not JSON: ${error.message}`);
     }
   }
-  throw firstError;
+  if (!response.ok) {
+    const message = data?.error?.message || data?.message || raw || `OpenCode prompt request failed with status ${response.status}.`;
+    throw new Error(message);
+  }
+  if (!data?.data?.id) throw new Error("OpenCode prompt response did not include data.id.");
+  return { ok: true, method: "http", status: response.status, data: data.data, response: data };
 }
-async function sendOpenCodeSessionEvent(client, { sessionId, agent, text, directory } = {}) {
+async function sendOpenCodeSessionEvent(client, { sessionId, agent, text, directory, opencodeBaseUrl, baseUrl, fetchImpl, direct = false } = {}) {
+  const directBaseUrl = opencodeBaseUrl || baseUrl;
   const parts = [{ type: "text", text }];
-  const flatPayload = { directory, agent, parts };
-  const structuredPayload = { query: { directory }, body: { agent, parts } };
-  if (typeof client?.session?.prompt === "function") {
-    return callOpenCodePromptWithFallbacks(client.session.prompt.bind(client.session), sessionId, flatPayload, structuredPayload);
+  const structuredPayload = {
+    path: { id: sessionId },
+    query: { directory },
+    body: { agent, parts }
+  };
+  if (!direct && typeof client?.session?.promptAsync === "function") {
+    return assertOpenCodePromptAccepted(await client.session.promptAsync(structuredPayload));
   }
-  if (typeof client?.session?.promptAsync === "function") {
-    return callOpenCodePromptWithFallbacks(client.session.promptAsync.bind(client.session), sessionId, flatPayload, structuredPayload);
+  if (!direct && typeof client?.session?.prompt === "function") {
+    return assertOpenCodePromptAccepted(await client.session.prompt(structuredPayload));
   }
+  if (directBaseUrl) return sendOpenCodeSessionEventDirect({ baseUrl: directBaseUrl, sessionId, text, fetchImpl });
   throw new Error("OpenCode client does not expose session.prompt or session.promptAsync.");
 }
 function formatClickUpWebhookPrompt({ eventType, taskId, payload }) {
@@ -9501,7 +9538,7 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
   if (!existingSessionId) {
     let pendingSessionId = getNestedMetadataValue(metadata, clickUpPendingSessionKey(config.routing.metadataKey)) || state.pendingSessions?.[taskId];
     if (!pendingSessionId) {
-      pendingSessionId = await createSession(openCodeClient, { title: `ClickUp PM: ${taskId}`, directory: config.basePath });
+      pendingSessionId = await createSession(openCodeClient, { title: `ClickUp PM: ${taskId}`, directory: config.basePath, agent: config.routing.targetAgent });
       if (!String(pendingSessionId || "").startsWith("ses_")) return { ok: false, action: "error", reason: "session_create_failed", taskId };
       if (saveState) {
         saveState({
@@ -9517,7 +9554,7 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
       appendClickUpWebhookLocalLog(worktree, { type: "pending_session_metadata_failed", taskId, sessionId: pendingSessionId, message: error.message });
       throw error;
     }
-    await sendSessionEvent(openCodeClient, { sessionId: pendingSessionId, agent: config.routing.targetAgent, text: prompt, directory: config.basePath });
+    await sendSessionEvent(openCodeClient, { sessionId: pendingSessionId, agent: config.routing.targetAgent, text: prompt, directory: config.basePath, opencodeBaseUrl: config.opencode?.baseUrl });
     const nextMetadata = clearClickUpPendingSessionMetadata(setClickUpSessionMetadata(pendingMetadata, config.routing.metadataKey, pendingSessionId), config.routing.metadataKey);
     await clickupClient.updateTaskMetadata({ taskId, fieldId: config.routing.metadataFieldId, value: nextMetadata });
     const { [taskId]: _completedPending, ...remainingPending } = stateToPersist.pendingSessions || {};
@@ -9526,7 +9563,7 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
   }
   const sessionId = String(existingSessionId);
   if (await sessionExists(openCodeClient, sessionId)) {
-    await sendSessionEvent(openCodeClient, { sessionId, agent: config.routing.targetAgent, text: prompt, directory: config.basePath });
+    await sendSessionEvent(openCodeClient, { sessionId, agent: config.routing.targetAgent, text: prompt, directory: config.basePath, opencodeBaseUrl: config.opencode?.baseUrl });
     return finish({ ok: true, action: "sent_to_existing_session", taskId, sessionId, eventKey });
   }
   const at = now().toISOString();
@@ -10555,9 +10592,21 @@ function getModePromptFragment(agentId, operatingTeamMode, worktree) {
   if (!fragmentPath) return "";
   return readResolvedFile(fragmentPath, worktree, { preferCompactPromptDocs: true });
 }
+function isSameOrNestedPath(candidate, root) {
+  if (typeof candidate !== "string" || typeof root !== "string" || !candidate.trim() || !root.trim()) return false;
+  const resolvedCandidate = path2.resolve(candidate);
+  const resolvedRoot = path2.resolve(root);
+  const relative = path2.relative(resolvedRoot, resolvedCandidate);
+  return relative === "" || !!relative && !relative.startsWith("..") && !path2.isAbsolute(relative);
+}
+function shouldRegisterWorkflowProductManager(options = {}, worktree = process.cwd()) {
+  if (options.clickUpWebhookActive === true) return true;
+  const validation = options.clickUpWebhookValidation;
+  return validation?.complete === true && isSameOrNestedPath(worktree, validation.config?.basePath);
+}
 function buildOptimaAgents(repoCfg, operatingTeamMode, worktree, debugDir, options = {}) {
   const optimaActive = repoCfg && repoCfg.enabled === true;
-  const clickUpWebhookActive = options.clickUpWebhookActive === true;
+  const clickUpWebhookActive = shouldRegisterWorkflowProductManager(options, worktree);
   const repoAgentDefinitions = repoAgentsDir(worktree);
   const repoAgentAdditions = repoAgentAdditionsDir(worktree);
   const legacyAgentsDir = legacyRepoAgentsDir(worktree);
@@ -11259,7 +11308,7 @@ Follow-up: use optima_prompt_workflow with session_id '${sessionId}' to check in
     },
     async config(cfg) {
       cfg.agent ??= {};
-      const ourAgents = buildOptimaAgents(repoCfg, operatingTeamMode, worktree, debugDir, { clickUpWebhookActive });
+      const ourAgents = buildOptimaAgents(repoCfg, operatingTeamMode, worktree, debugDir, { clickUpWebhookActive, clickUpWebhookValidation });
       const builtInAgents = ["build", "plan", "general", "explore"];
       const preserveExistingAgents = repoCfg.features?.preserve_existing_agents ?? DEFAULT_PRESERVE_EXISTING_AGENTS;
       const allToDisable = preserveExistingAgents ? /* @__PURE__ */ new Set() : /* @__PURE__ */ new Set([...builtInAgents, ...Object.keys(cfg.agent)]);
@@ -11277,7 +11326,7 @@ Follow-up: use optima_prompt_workflow with session_id '${sessionId}' to check in
     }
   };
 }
-OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, readClickUpWebhookState, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
+OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, normalizeOpenCodeBaseUrl, readClickUpWebhookState, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, sendOpenCodeSessionEventDirect, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
 export {
   OptimaPlugin as default
 };

package/dist/sanitize_cli.js

@@ -8838,10 +8838,21 @@ function resolveOptimaPluginOptions(rawInput = {}, pluginOptions = {}) {
 function pickConfiguredClickUp(rawInput = {}, repoCfg = {}, pluginOptions = {}) {
   return pluginOptions?.clickup || pluginOptions?.experimental?.optima?.clickup || rawInput?.options?.clickup || rawInput?.options?.experimental?.optima?.clickup || rawInput?.experimental?.optima?.clickup || rawInput?.config?.experimental?.optima?.clickup || rawInput?.opencode?.experimental?.optima?.clickup || repoCfg?.experimental?.optima?.clickup || repoCfg?.clickup || null;
 }
+function normalizeOpenCodeBaseUrl(value, defaultValue = "http://127.0.0.1:3001") {
+  const candidate = String(value || defaultValue || "").trim();
+  if (!candidate) return "";
+  try {
+    const url = new URL(candidate);
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return candidate.replace(/\/+$/, "");
+  }
+}
 function normalizeClickUpWebhookConfig(rawClickUp = null, worktree = process.cwd()) {
   const raw = isPlainObject(rawClickUp) ? rawClickUp : {};
   const webhook = isPlainObject(raw.webhook) ? raw.webhook : {};
   const routing = isPlainObject(raw.routing) ? raw.routing : {};
+  const opencode = isPlainObject(raw.opencode) ? raw.opencode : {};
   const location = isPlainObject(webhook.location) ? webhook.location : {};
   const events = Array.isArray(webhook.events) && webhook.events.length > 0 ? [...new Set(webhook.events.map((event) => String(event || "").trim()).filter(Boolean))] : [...CLICKUP_WEBHOOK_EVENTS];
   const ignoredStatuses = Array.isArray(routing.ignored_statuses) && routing.ignored_statuses.length > 0 ? routing.ignored_statuses : CLICKUP_WEBHOOK_TERMINAL_STATUSES;
@@ -8851,6 +8862,9 @@ function normalizeClickUpWebhookConfig(rawClickUp = null, worktree = process.cwd
     teamId: String(raw.team_id || raw.teamId || "").trim(),
     apiToken: String(raw.api_token || raw.apiToken || "").trim(),
     log: normalizeClickUpWebhookLogLevel(raw.log),
+    opencode: {
+      baseUrl: normalizeOpenCodeBaseUrl(opencode.base_url || opencode.baseUrl || raw.opencode_base_url || raw.opencodeBaseUrl)
+    },
     webhook: {
       publicUrl: String(webhook.public_url || webhook.publicUrl || "").trim(),
       bindHost: String(webhook.bind_host || webhook.bindHost || "127.0.0.1").trim(),
@@ -8884,6 +8898,13 @@ function normalizeClickUpWebhookConfig(rawClickUp = null, worktree = process.cwd
   if (!config.webhook.bindHost) errors.push("clickup.webhook.bind_host is required");
   if (!Number.isInteger(config.webhook.bindPort) || config.webhook.bindPort <= 0) errors.push("clickup.webhook.bind_port must be a positive integer");
   if (!config.webhook.location.list_id && !config.webhook.location.folder_id && !config.webhook.location.space_id) errors.push("one clickup.webhook.location id is required");
+  if (config.opencode.baseUrl) {
+    try {
+      new URL(config.opencode.baseUrl);
+    } catch {
+      errors.push("clickup.opencode.base_url must be a valid URL");
+    }
+  }
   const missingEvents = CLICKUP_WEBHOOK_EVENTS.filter((event) => !config.webhook.events.includes(event));
   if (missingEvents.length > 0) errors.push(`clickup.webhook.events missing: ${missingEvents.join(", ")}`);
   if (config.routing.targetAgent !== "workflow_product_manager") errors.push("clickup.routing.target_agent must be workflow_product_manager");
@@ -9241,8 +9262,10 @@ async function openCodeSessionExists(client, sessionId) {
   }
   return false;
 }
-async function createOpenCodeSession(client, { title, directory } = {}) {
-  const result = await client.session.create({ query: { directory }, body: { title } });
+async function createOpenCodeSession(client, { title, directory, agent } = {}) {
+  const body = { title };
+  if (agent) body.agent = agent;
+  const result = await client.session.create({ query: { directory }, body });
   return result?.data?.id || result?.id;
 }
 function assertOpenCodePromptAccepted(result) {
@@ -9253,33 +9276,47 @@ function assertOpenCodePromptAccepted(result) {
   }
   return result;
 }
-async function callOpenCodePromptWithFallbacks(method, sessionId, flatPayload, structuredPayload) {
-  const attempts = [
-    { id: sessionId, ...flatPayload },
-    { sessionID: sessionId, ...flatPayload },
-    { ...structuredPayload, path: { sessionID: sessionId } },
-    { ...structuredPayload, path: { id: sessionId } }
-  ];
-  let firstError = null;
-  for (const attempt of attempts) {
+async function sendOpenCodeSessionEventDirect({ baseUrl, sessionId, text, fetchImpl = globalThis.fetch } = {}) {
+  if (typeof fetchImpl !== "function") throw new Error("OpenCode direct prompt delivery requires fetch.");
+  const root = normalizeOpenCodeBaseUrl(baseUrl, "");
+  if (!root) throw new Error("OpenCode direct prompt delivery requires a base URL.");
+  const url = `${root}/api/session/${encodeURIComponent(sessionId)}/prompt`;
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ prompt: { text }, delivery: "queue", resume: true })
+  });
+  const raw = await response.text();
+  let data = null;
+  if (raw) {
     try {
-      return assertOpenCodePromptAccepted(await method(attempt));
+      data = JSON.parse(raw);
     } catch (error) {
-      firstError ??= error;
+      if (response.ok) throw new Error(`OpenCode prompt response was not JSON: ${error.message}`);
     }
   }
-  throw firstError;
+  if (!response.ok) {
+    const message = data?.error?.message || data?.message || raw || `OpenCode prompt request failed with status ${response.status}.`;
+    throw new Error(message);
+  }
+  if (!data?.data?.id) throw new Error("OpenCode prompt response did not include data.id.");
+  return { ok: true, method: "http", status: response.status, data: data.data, response: data };
 }
-async function sendOpenCodeSessionEvent(client, { sessionId, agent, text, directory } = {}) {
+async function sendOpenCodeSessionEvent(client, { sessionId, agent, text, directory, opencodeBaseUrl, baseUrl, fetchImpl, direct = false } = {}) {
+  const directBaseUrl = opencodeBaseUrl || baseUrl;
   const parts = [{ type: "text", text }];
-  const flatPayload = { directory, agent, parts };
-  const structuredPayload = { query: { directory }, body: { agent, parts } };
-  if (typeof client?.session?.prompt === "function") {
-    return callOpenCodePromptWithFallbacks(client.session.prompt.bind(client.session), sessionId, flatPayload, structuredPayload);
+  const structuredPayload = {
+    path: { id: sessionId },
+    query: { directory },
+    body: { agent, parts }
+  };
+  if (!direct && typeof client?.session?.promptAsync === "function") {
+    return assertOpenCodePromptAccepted(await client.session.promptAsync(structuredPayload));
   }
-  if (typeof client?.session?.promptAsync === "function") {
-    return callOpenCodePromptWithFallbacks(client.session.promptAsync.bind(client.session), sessionId, flatPayload, structuredPayload);
+  if (!direct && typeof client?.session?.prompt === "function") {
+    return assertOpenCodePromptAccepted(await client.session.prompt(structuredPayload));
   }
+  if (directBaseUrl) return sendOpenCodeSessionEventDirect({ baseUrl: directBaseUrl, sessionId, text, fetchImpl });
   throw new Error("OpenCode client does not expose session.prompt or session.promptAsync.");
 }
 function formatClickUpWebhookPrompt({ eventType, taskId, payload }) {
@@ -9508,7 +9545,7 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
   if (!existingSessionId) {
     let pendingSessionId = getNestedMetadataValue(metadata, clickUpPendingSessionKey(config.routing.metadataKey)) || state.pendingSessions?.[taskId];
     if (!pendingSessionId) {
-      pendingSessionId = await createSession(openCodeClient, { title: `ClickUp PM: ${taskId}`, directory: config.basePath });
+      pendingSessionId = await createSession(openCodeClient, { title: `ClickUp PM: ${taskId}`, directory: config.basePath, agent: config.routing.targetAgent });
       if (!String(pendingSessionId || "").startsWith("ses_")) return { ok: false, action: "error", reason: "session_create_failed", taskId };
       if (saveState) {
         saveState({
@@ -9524,7 +9561,7 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
       appendClickUpWebhookLocalLog(worktree, { type: "pending_session_metadata_failed", taskId, sessionId: pendingSessionId, message: error.message });
       throw error;
     }
-    await sendSessionEvent(openCodeClient, { sessionId: pendingSessionId, agent: config.routing.targetAgent, text: prompt, directory: config.basePath });
+    await sendSessionEvent(openCodeClient, { sessionId: pendingSessionId, agent: config.routing.targetAgent, text: prompt, directory: config.basePath, opencodeBaseUrl: config.opencode?.baseUrl });
     const nextMetadata = clearClickUpPendingSessionMetadata(setClickUpSessionMetadata(pendingMetadata, config.routing.metadataKey, pendingSessionId), config.routing.metadataKey);
     await clickupClient.updateTaskMetadata({ taskId, fieldId: config.routing.metadataFieldId, value: nextMetadata });
     const { [taskId]: _completedPending, ...remainingPending } = stateToPersist.pendingSessions || {};
@@ -9533,7 +9570,7 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
   }
   const sessionId = String(existingSessionId);
   if (await sessionExists(openCodeClient, sessionId)) {
-    await sendSessionEvent(openCodeClient, { sessionId, agent: config.routing.targetAgent, text: prompt, directory: config.basePath });
+    await sendSessionEvent(openCodeClient, { sessionId, agent: config.routing.targetAgent, text: prompt, directory: config.basePath, opencodeBaseUrl: config.opencode?.baseUrl });
     return finish({ ok: true, action: "sent_to_existing_session", taskId, sessionId, eventKey });
   }
   const at = now().toISOString();
@@ -10562,9 +10599,21 @@ function getModePromptFragment(agentId, operatingTeamMode, worktree) {
   if (!fragmentPath) return "";
   return readResolvedFile(fragmentPath, worktree, { preferCompactPromptDocs: true });
 }
+function isSameOrNestedPath(candidate, root) {
+  if (typeof candidate !== "string" || typeof root !== "string" || !candidate.trim() || !root.trim()) return false;
+  const resolvedCandidate = path2.resolve(candidate);
+  const resolvedRoot = path2.resolve(root);
+  const relative = path2.relative(resolvedRoot, resolvedCandidate);
+  return relative === "" || !!relative && !relative.startsWith("..") && !path2.isAbsolute(relative);
+}
+function shouldRegisterWorkflowProductManager(options = {}, worktree = process.cwd()) {
+  if (options.clickUpWebhookActive === true) return true;
+  const validation = options.clickUpWebhookValidation;
+  return validation?.complete === true && isSameOrNestedPath(worktree, validation.config?.basePath);
+}
 function buildOptimaAgents(repoCfg, operatingTeamMode, worktree, debugDir, options = {}) {
   const optimaActive = repoCfg && repoCfg.enabled === true;
-  const clickUpWebhookActive = options.clickUpWebhookActive === true;
+  const clickUpWebhookActive = shouldRegisterWorkflowProductManager(options, worktree);
   const repoAgentDefinitions = repoAgentsDir(worktree);
   const repoAgentAdditions = repoAgentAdditionsDir(worktree);
   const legacyAgentsDir = legacyRepoAgentsDir(worktree);
@@ -11266,7 +11315,7 @@ Follow-up: use optima_prompt_workflow with session_id '${sessionId}' to check in
     },
     async config(cfg) {
       cfg.agent ??= {};
-      const ourAgents = buildOptimaAgents(repoCfg, operatingTeamMode, worktree, debugDir, { clickUpWebhookActive });
+      const ourAgents = buildOptimaAgents(repoCfg, operatingTeamMode, worktree, debugDir, { clickUpWebhookActive, clickUpWebhookValidation });
       const builtInAgents = ["build", "plan", "general", "explore"];
       const preserveExistingAgents = repoCfg.features?.preserve_existing_agents ?? DEFAULT_PRESERVE_EXISTING_AGENTS;
       const allToDisable = preserveExistingAgents ? /* @__PURE__ */ new Set() : /* @__PURE__ */ new Set([...builtInAgents, ...Object.keys(cfg.agent)]);
@@ -11284,7 +11333,7 @@ Follow-up: use optima_prompt_workflow with session_id '${sessionId}' to check in
     }
   };
 }
-OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, readClickUpWebhookState, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
+OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, normalizeOpenCodeBaseUrl, readClickUpWebhookState, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, sendOpenCodeSessionEventDirect, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
 
 // src/sanitize_cli.js
 var { migrateLegacyOptimaLayout: migrateLegacyOptimaLayout2 } = OptimaPlugin.__internals;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defend-tech/opencode-optima",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "repository": {
     "type": "git",
     "url": "git+ssh://git@github.com/defend-tech/opencode-optima.git"