@defend-tech/opencode-optima 0.1.40 → 0.1.42

package/dist/index.js

@@ -9248,12 +9248,16 @@ async function validateClickUpWebhookState(state, config, clickupClient = null,
   }
   return { valid: true, mode: "local_state", state: { ...state, lastValidatedAt: (/* @__PURE__ */ new Date()).toISOString() }, limitation: "ClickUp API validation unavailable; Optima trusts ignored local runtime state only after id/secret/config checks." };
 }
-async function ensureClickUpWebhookSubscription({ validation, worktree, clickupClient = null } = {}) {
+function clickUpWebhookValidationFromConfig(config = null) {
+  if (!config) return { complete: false, ok: false, errors: ["clickup_config_unavailable"] };
+  return { complete: true, ok: true, enabled: true, config, errors: [] };
+}
+async function ensureClickUpWebhookSubscription({ validation, worktree, clickupClient = null, existingState = null } = {}) {
   if (!validation?.complete) {
     return { active: false, valid: false, reason: "config_incomplete", errors: validation?.errors || [] };
   }
   const { config } = validation;
-  const existing = readClickUpWebhookState(worktree, config);
+  const existing = existingState ? sanitizeClickUpWebhookState(existingState, config) : readClickUpWebhookState(worktree, config);
   const existingValidation = await validateClickUpWebhookState(existing, config, clickupClient, { allowRemoteUnhealthyLocalRecovery: true });
   if (existingValidation.valid) {
     const state = writeClickUpWebhookState(worktree, { ...existingValidation.state, recentEventKeys: existing.recentEventKeys || [] }, config);
@@ -9306,6 +9310,30 @@ function verifyClickUpSignature(rawBody, signatureHeader, secret) {
   const wanted = Buffer.from(expected, "hex");
   return given.length === wanted.length && crypto.timingSafeEqual(given, wanted);
 }
+async function resyncClickUpWebhookForSignatureDrift({ rawBody, signature, config, state = {}, worktree = process.cwd(), clickupClient, saveState } = {}) {
+  const validation = clickUpWebhookValidationFromConfig(config);
+  if (!clickupClient?.listWebhooks && !clickupClient?.createWebhook) {
+    appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_skipped", reason: "clickup_client_unavailable", webhookId: state?.webhookId || null });
+    return { ok: false, reason: "clickup_client_unavailable", state };
+  }
+  try {
+    const resync = await ensureClickUpWebhookSubscription({ validation, worktree, clickupClient, existingState: state });
+    if (!resync?.valid || !resync?.state?.secret) {
+      appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_failed", reason: resync?.reason || "resync_failed", webhookId: state?.webhookId || null });
+      return { ok: false, reason: resync?.reason || "resync_failed", resync, state };
+    }
+    if (!verifyClickUpSignature(rawBody, signature, resync.state.secret)) {
+      appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_unverified", reason: "invalid_signature_after_resync", oldWebhookId: state?.webhookId || null, webhookId: resync.state.webhookId || null, mode: resync.mode || null });
+      return { ok: false, reason: "invalid_signature_after_resync", resync, state: resync.state };
+    }
+    if (saveState) saveState(resync.state);
+    appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_verified", oldWebhookId: state?.webhookId || null, webhookId: resync.state.webhookId || null, mode: resync.mode || null });
+    return { ok: true, state: resync.state, resync };
+  } catch (error) {
+    appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_error", webhookId: state?.webhookId || null, message: error.message });
+    return { ok: false, reason: "resync_error", error: error.message, state };
+  }
+}
 function clickUpWebhookEventKey(payload = {}) {
   const history = Array.isArray(payload.history_items) ? payload.history_items[0] : payload.history_item;
   const comment = payload.comment || history?.comment || {};
@@ -9672,7 +9700,7 @@ async function applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason,
     return { ok: false, error: error.message, tagName };
   }
 }
-async function deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent, text, directory, opencodeBaseUrl, eventMarkers = [], verifySessionEventDelivery = verifyOpenCodeSessionEventDelivery } = {}) {
+async function deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent, text, directory, opencodeBaseUrl, eventMarkers = [], verifySessionEventDelivery = verifyOpenCodeSessionEventDelivery, applyBlockerOnFailure = true } = {}) {
   const beforeMessages = await readOpenCodeSessionMessages(openCodeClient, { sessionId, limit: 50 }).catch(() => null);
   await sendSessionEvent(openCodeClient, { sessionId, agent, text, directory, opencodeBaseUrl });
   let verification = await verifySessionEventDelivery(openCodeClient, { sessionId, beforeMessages, expectedText: text, markers: eventMarkers });
@@ -9686,9 +9714,50 @@ async function deliverClickUpSessionEventWithVerification({ openCodeClient, send
   }
   const reason = verification?.reason || "message_delivery_failed";
   appendClickUpWebhookLocalLog(worktree, { type: "message_delivery_failed", taskId, sessionId, reason, fallbackAttempted: canFallbackDirect });
+  if (!applyBlockerOnFailure) return { ok: false, action: "message_delivery_failed", reason, taskId, sessionId, fallbackAttempted: canFallbackDirect };
   const blocker = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason, source: canFallbackDirect ? "delivery_fallback_failed" : "delivery_verification_failed" });
   return { ok: false, action: "message_delivery_failed", reason, taskId, sessionId, fallbackAttempted: canFallbackDirect, blockerTag: blocker };
 }
+async function recoverClickUpPmSession({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, staleSessionId, sessionTitle, taskRoute, metadataWithRouting, config, prompt, eventMarkers = [], deliveryEvidencePath, evidencePath, eventKey, createSession, verifySessionEventDelivery } = {}) {
+  appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_started", taskId, staleSessionId, worktree: taskRoute?.worktree });
+  let replacementSessionId = "";
+  try {
+    replacementSessionId = await createSession(openCodeClient, { title: `${sessionTitle} (recovery)`, directory: taskRoute.worktree, agent: config.routing.targetAgent });
+  } catch (error) {
+    appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_create_failed", taskId, staleSessionId, message: error.message });
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "replacement_session_create_failed", source: "pm_session_recovery" });
+    return { ok: false, action: "message_delivery_failed", reason: "replacement_session_create_failed", taskId, sessionId: staleSessionId, replacementAttempted: true, blockerTag, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath };
+  }
+  if (!String(replacementSessionId || "").startsWith("ses_")) {
+    appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_create_invalid", taskId, staleSessionId, replacementSessionId });
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "replacement_session_create_failed", source: "pm_session_recovery" });
+    return { ok: false, action: "message_delivery_failed", reason: "replacement_session_create_failed", taskId, sessionId: staleSessionId, replacementAttempted: true, blockerTag, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath };
+  }
+  const replacementDelivery = await deliverClickUpSessionEventWithVerification({
+    openCodeClient,
+    sendSessionEvent,
+    clickupClient,
+    worktree,
+    taskId,
+    sessionId: replacementSessionId,
+    agent: config.routing.targetAgent,
+    text: prompt,
+    directory: taskRoute.worktree,
+    opencodeBaseUrl: config.opencode?.baseUrl,
+    eventMarkers,
+    verifySessionEventDelivery,
+    applyBlockerOnFailure: false
+  });
+  if (!replacementDelivery.ok) {
+    appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_delivery_failed", taskId, staleSessionId, replacementSessionId, reason: replacementDelivery.reason });
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: replacementDelivery.reason || "replacement_delivery_failed", source: "pm_session_recovery" });
+    return { ...replacementDelivery, sessionId: staleSessionId, replacementSessionId, replacementAttempted: true, blockerTag, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath };
+  }
+  const replacementMetadata = clearClickUpPendingSessionMetadata(setClickUpSessionMetadata(metadataWithRouting, config.routing.metadataKey, replacementSessionId), config.routing.metadataKey);
+  await clickupClient.updateTaskMetadata({ taskId, fieldId: config.routing.metadataFieldId, value: replacementMetadata });
+  appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_succeeded", taskId, staleSessionId, replacementSessionId });
+  return { ok: true, action: "sent_to_replacement_session", taskId, sessionId: replacementSessionId, staleSessionId, replacementAttempted: true, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath, deliveryVerification: replacementDelivery.verification, deliveryFallback: replacementDelivery.fallback };
+}
 function formatClickUpWebhookPrompt({ eventType, taskId, payload, branch = "", worktree = "", deliveryEvidencePath = "" }) {
   const comment = clickUpCommentFromPayload(payload);
   const commentText = clickUpCommentText(comment).trim();
@@ -9940,8 +10009,8 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
   } catch (error) {
     const message = `Optima webhook could not create or reuse a task worktree for ${taskId}: ${error.message}`;
     appendClickUpWebhookLocalLog(worktree, { type: "task_worktree_failed", taskId, message });
-    const blockerTag2 = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "task_worktree_failed", source: "route_worktree" });
-    return { ok: false, action: "error", reason: "task_worktree_failed", taskId, message, blockerTag: blockerTag2 };
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "task_worktree_failed", source: "route_worktree" });
+    return { ok: false, action: "error", reason: "task_worktree_failed", taskId, message, blockerTag };
   }
   const deliveryEvidencePath = deliveryEvidencePathForClickUpTask(taskId);
   const routingMetadata = {
@@ -9982,14 +10051,17 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
   const sessionId = String(existingSessionId);
   if (await sessionExists(openCodeClient, sessionId)) {
     if (typeof clickupClient?.updateTaskMetadata === "function") await clickupClient.updateTaskMetadata({ taskId, fieldId: config.routing.metadataFieldId, value: metadataWithRouting });
-    const delivery = await deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent: config.routing.targetAgent, text: prompt, directory: taskRoute.worktree, opencodeBaseUrl: config.opencode?.baseUrl, eventMarkers: [taskId, eventType], verifySessionEventDelivery });
-    if (!delivery.ok) return finish({ ...delivery, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath: routingMetadata.evidence_path });
+    const delivery = await deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent: config.routing.targetAgent, text: prompt, directory: taskRoute.worktree, opencodeBaseUrl: config.opencode?.baseUrl, eventMarkers: [taskId, eventType], verifySessionEventDelivery, applyBlockerOnFailure: false });
+    if (!delivery.ok) {
+      const recovery2 = await recoverClickUpPmSession({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, staleSessionId: sessionId, sessionTitle, taskRoute, metadataWithRouting, config, prompt, eventMarkers: [taskId, eventType], deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, eventKey, createSession, verifySessionEventDelivery });
+      return finish(recovery2);
+    }
     return finish({ ok: true, action: "sent_to_existing_session", taskId, sessionId, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, deliveryVerification: delivery.verification, deliveryFallback: delivery.fallback });
   }
   const at = now().toISOString();
   appendClickUpWebhookLocalLog(worktree, { type: "missing_session", taskId, sessionId, host, at });
-  const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "missing_session", source: "route_existing_session" });
-  return finish({ ok: true, action: "missing_session_reported", taskId, sessionId, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, blockerTag });
+  const recovery = await recoverClickUpPmSession({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, staleSessionId: sessionId, sessionTitle, taskRoute, metadataWithRouting, config, prompt, eventMarkers: [taskId, eventType], deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, eventKey, createSession, verifySessionEventDelivery });
+  return finish(recovery);
 }
 async function routeClickUpWebhookEvent(options = {}) {
   const taskId = clickUpTaskIdFromPayload(options.payload || {});
@@ -10097,15 +10169,16 @@ function clickUpWebhookExpectedPath(config) {
     return "/";
   }
 }
-async function handleClickUpWebhookRequest({ method = "POST", url = null, headers = {}, rawBody = "", config, state, worktree, clickupClient, openCodeClient, saveState, now = () => /* @__PURE__ */ new Date() } = {}) {
+async function handleClickUpWebhookRequest({ method = "POST", url = null, headers = {}, rawBody = "", config, state, worktree, clickupClient, openCodeClient, saveState, now = () => /* @__PURE__ */ new Date(), sessionExists, createSession, sendSessionEvent, ensureTaskWorktree, verifySessionEventDelivery } = {}) {
   let payload = null;
   let handled = null;
   let authenticatedWebhook = false;
   let receivedAt = null;
+  let activeState = state;
   const finish = (result) => {
     handled = result;
     receivedAt ??= now();
-    const auditState = authenticatedWebhook ? { ...state, lastWebhookAt: receivedAt.toISOString() } : state;
+    const auditState = authenticatedWebhook ? { ...activeState, lastWebhookAt: receivedAt.toISOString() } : activeState;
     if (saveState && authenticatedWebhook) saveState(auditState);
     writeClickUpWebhookAuditLog({ method, url, headers, rawBody, config, state: auditState, handled, payload, at: receivedAt });
     return result;
@@ -10120,7 +10193,11 @@ async function handleClickUpWebhookRequest({ method = "POST", url = null, header
     const bodyBytes = Buffer.isBuffer(rawBody) ? rawBody.length : Buffer.byteLength(String(rawBody || ""));
     if (bodyBytes > maxBodyBytes) return finish({ ok: false, status: 413, reason: "body_too_large" });
     const signature = headers["x-signature"] || headers["X-Signature"];
-    if (!verifyClickUpSignature(rawBody, signature, state?.secret)) return finish({ ok: false, status: 401, reason: "invalid_signature" });
+    if (!verifyClickUpSignature(rawBody, signature, activeState?.secret)) {
+      const resync = await resyncClickUpWebhookForSignatureDrift({ rawBody, signature, config, state: activeState, worktree, clickupClient, saveState });
+      if (!resync.ok) return finish({ ok: false, status: 401, reason: "invalid_signature", resync: { attempted: true, reason: resync.reason } });
+      activeState = resync.state;
+    }
     authenticatedWebhook = true;
     receivedAt = now();
     try {
@@ -10128,8 +10205,8 @@ async function handleClickUpWebhookRequest({ method = "POST", url = null, header
     } catch {
       return finish({ ok: false, status: 400, reason: "invalid_json" });
     }
-    const receivedState = { ...state, lastWebhookAt: receivedAt.toISOString() };
-    const result = await routeClickUpWebhookEvent({ payload, config, state: receivedState, worktree, clickupClient, openCodeClient, saveState });
+    const receivedState = { ...activeState, lastWebhookAt: receivedAt.toISOString() };
+    const result = await routeClickUpWebhookEvent({ payload, config, state: receivedState, worktree, clickupClient, openCodeClient, saveState, sessionExists, createSession, sendSessionEvent, ensureTaskWorktree, verifySessionEventDelivery });
     return finish({ ok: result.ok, status: result.ok ? 200 : 422, result });
   } catch (error) {
     writeClickUpWebhookAuditLog({ method, url, headers, rawBody, config, state, handled, error, payload, at: now() });
@@ -11869,7 +11946,7 @@ Follow-up: use optima_prompt_workflow with session_id '${sessionId}' to check in
     }
   };
 }
-OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, BUNDLE_ASSETS_DIR, CLICKUP_DEFINITION_DOC_PARENT, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentLedgerKey, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, deliveryEvidencePathForClickUpTask, ensureClickUpTaskWorktree, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, normalizeOpenCodeBaseUrl, readClickUpCommentLedger, readClickUpWebhookState, reconcileClickUpStartup, recordClickUpCommentVersionProcessed, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, sendOpenCodeSessionEventDirect, verifyOpenCodeSessionEventDelivery, stableClickUpCommentVersionMarker, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
+OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, BUNDLE_ASSETS_DIR, CLICKUP_DEFINITION_DOC_PARENT, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentLedgerKey, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, deliveryEvidencePathForClickUpTask, ensureClickUpTaskWorktree, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, normalizeOpenCodeBaseUrl, readClickUpCommentLedger, readClickUpWebhookState, reconcileClickUpStartup, recordClickUpCommentVersionProcessed, resyncClickUpWebhookForSignatureDrift, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, sendOpenCodeSessionEventDirect, verifyOpenCodeSessionEventDelivery, stableClickUpCommentVersionMarker, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
 export {
   OptimaPlugin as default
 };

package/dist/sanitize_cli.js

@@ -9255,12 +9255,16 @@ async function validateClickUpWebhookState(state, config, clickupClient = null,
   }
   return { valid: true, mode: "local_state", state: { ...state, lastValidatedAt: (/* @__PURE__ */ new Date()).toISOString() }, limitation: "ClickUp API validation unavailable; Optima trusts ignored local runtime state only after id/secret/config checks." };
 }
-async function ensureClickUpWebhookSubscription({ validation, worktree, clickupClient = null } = {}) {
+function clickUpWebhookValidationFromConfig(config = null) {
+  if (!config) return { complete: false, ok: false, errors: ["clickup_config_unavailable"] };
+  return { complete: true, ok: true, enabled: true, config, errors: [] };
+}
+async function ensureClickUpWebhookSubscription({ validation, worktree, clickupClient = null, existingState = null } = {}) {
   if (!validation?.complete) {
     return { active: false, valid: false, reason: "config_incomplete", errors: validation?.errors || [] };
   }
   const { config } = validation;
-  const existing = readClickUpWebhookState(worktree, config);
+  const existing = existingState ? sanitizeClickUpWebhookState(existingState, config) : readClickUpWebhookState(worktree, config);
   const existingValidation = await validateClickUpWebhookState(existing, config, clickupClient, { allowRemoteUnhealthyLocalRecovery: true });
   if (existingValidation.valid) {
     const state = writeClickUpWebhookState(worktree, { ...existingValidation.state, recentEventKeys: existing.recentEventKeys || [] }, config);
@@ -9313,6 +9317,30 @@ function verifyClickUpSignature(rawBody, signatureHeader, secret) {
   const wanted = Buffer.from(expected, "hex");
   return given.length === wanted.length && crypto.timingSafeEqual(given, wanted);
 }
+async function resyncClickUpWebhookForSignatureDrift({ rawBody, signature, config, state = {}, worktree = process.cwd(), clickupClient, saveState } = {}) {
+  const validation = clickUpWebhookValidationFromConfig(config);
+  if (!clickupClient?.listWebhooks && !clickupClient?.createWebhook) {
+    appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_skipped", reason: "clickup_client_unavailable", webhookId: state?.webhookId || null });
+    return { ok: false, reason: "clickup_client_unavailable", state };
+  }
+  try {
+    const resync = await ensureClickUpWebhookSubscription({ validation, worktree, clickupClient, existingState: state });
+    if (!resync?.valid || !resync?.state?.secret) {
+      appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_failed", reason: resync?.reason || "resync_failed", webhookId: state?.webhookId || null });
+      return { ok: false, reason: resync?.reason || "resync_failed", resync, state };
+    }
+    if (!verifyClickUpSignature(rawBody, signature, resync.state.secret)) {
+      appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_unverified", reason: "invalid_signature_after_resync", oldWebhookId: state?.webhookId || null, webhookId: resync.state.webhookId || null, mode: resync.mode || null });
+      return { ok: false, reason: "invalid_signature_after_resync", resync, state: resync.state };
+    }
+    if (saveState) saveState(resync.state);
+    appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_verified", oldWebhookId: state?.webhookId || null, webhookId: resync.state.webhookId || null, mode: resync.mode || null });
+    return { ok: true, state: resync.state, resync };
+  } catch (error) {
+    appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_error", webhookId: state?.webhookId || null, message: error.message });
+    return { ok: false, reason: "resync_error", error: error.message, state };
+  }
+}
 function clickUpWebhookEventKey(payload = {}) {
   const history = Array.isArray(payload.history_items) ? payload.history_items[0] : payload.history_item;
   const comment = payload.comment || history?.comment || {};
@@ -9679,7 +9707,7 @@ async function applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason,
     return { ok: false, error: error.message, tagName };
   }
 }
-async function deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent, text, directory, opencodeBaseUrl, eventMarkers = [], verifySessionEventDelivery = verifyOpenCodeSessionEventDelivery } = {}) {
+async function deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent, text, directory, opencodeBaseUrl, eventMarkers = [], verifySessionEventDelivery = verifyOpenCodeSessionEventDelivery, applyBlockerOnFailure = true } = {}) {
   const beforeMessages = await readOpenCodeSessionMessages(openCodeClient, { sessionId, limit: 50 }).catch(() => null);
   await sendSessionEvent(openCodeClient, { sessionId, agent, text, directory, opencodeBaseUrl });
   let verification = await verifySessionEventDelivery(openCodeClient, { sessionId, beforeMessages, expectedText: text, markers: eventMarkers });
@@ -9693,9 +9721,50 @@ async function deliverClickUpSessionEventWithVerification({ openCodeClient, send
   }
   const reason = verification?.reason || "message_delivery_failed";
   appendClickUpWebhookLocalLog(worktree, { type: "message_delivery_failed", taskId, sessionId, reason, fallbackAttempted: canFallbackDirect });
+  if (!applyBlockerOnFailure) return { ok: false, action: "message_delivery_failed", reason, taskId, sessionId, fallbackAttempted: canFallbackDirect };
   const blocker = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason, source: canFallbackDirect ? "delivery_fallback_failed" : "delivery_verification_failed" });
   return { ok: false, action: "message_delivery_failed", reason, taskId, sessionId, fallbackAttempted: canFallbackDirect, blockerTag: blocker };
 }
+async function recoverClickUpPmSession({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, staleSessionId, sessionTitle, taskRoute, metadataWithRouting, config, prompt, eventMarkers = [], deliveryEvidencePath, evidencePath, eventKey, createSession, verifySessionEventDelivery } = {}) {
+  appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_started", taskId, staleSessionId, worktree: taskRoute?.worktree });
+  let replacementSessionId = "";
+  try {
+    replacementSessionId = await createSession(openCodeClient, { title: `${sessionTitle} (recovery)`, directory: taskRoute.worktree, agent: config.routing.targetAgent });
+  } catch (error) {
+    appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_create_failed", taskId, staleSessionId, message: error.message });
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "replacement_session_create_failed", source: "pm_session_recovery" });
+    return { ok: false, action: "message_delivery_failed", reason: "replacement_session_create_failed", taskId, sessionId: staleSessionId, replacementAttempted: true, blockerTag, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath };
+  }
+  if (!String(replacementSessionId || "").startsWith("ses_")) {
+    appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_create_invalid", taskId, staleSessionId, replacementSessionId });
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "replacement_session_create_failed", source: "pm_session_recovery" });
+    return { ok: false, action: "message_delivery_failed", reason: "replacement_session_create_failed", taskId, sessionId: staleSessionId, replacementAttempted: true, blockerTag, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath };
+  }
+  const replacementDelivery = await deliverClickUpSessionEventWithVerification({
+    openCodeClient,
+    sendSessionEvent,
+    clickupClient,
+    worktree,
+    taskId,
+    sessionId: replacementSessionId,
+    agent: config.routing.targetAgent,
+    text: prompt,
+    directory: taskRoute.worktree,
+    opencodeBaseUrl: config.opencode?.baseUrl,
+    eventMarkers,
+    verifySessionEventDelivery,
+    applyBlockerOnFailure: false
+  });
+  if (!replacementDelivery.ok) {
+    appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_delivery_failed", taskId, staleSessionId, replacementSessionId, reason: replacementDelivery.reason });
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: replacementDelivery.reason || "replacement_delivery_failed", source: "pm_session_recovery" });
+    return { ...replacementDelivery, sessionId: staleSessionId, replacementSessionId, replacementAttempted: true, blockerTag, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath };
+  }
+  const replacementMetadata = clearClickUpPendingSessionMetadata(setClickUpSessionMetadata(metadataWithRouting, config.routing.metadataKey, replacementSessionId), config.routing.metadataKey);
+  await clickupClient.updateTaskMetadata({ taskId, fieldId: config.routing.metadataFieldId, value: replacementMetadata });
+  appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_succeeded", taskId, staleSessionId, replacementSessionId });
+  return { ok: true, action: "sent_to_replacement_session", taskId, sessionId: replacementSessionId, staleSessionId, replacementAttempted: true, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath, deliveryVerification: replacementDelivery.verification, deliveryFallback: replacementDelivery.fallback };
+}
 function formatClickUpWebhookPrompt({ eventType, taskId, payload, branch = "", worktree = "", deliveryEvidencePath = "" }) {
   const comment = clickUpCommentFromPayload(payload);
   const commentText = clickUpCommentText(comment).trim();
@@ -9947,8 +10016,8 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
   } catch (error) {
     const message = `Optima webhook could not create or reuse a task worktree for ${taskId}: ${error.message}`;
     appendClickUpWebhookLocalLog(worktree, { type: "task_worktree_failed", taskId, message });
-    const blockerTag2 = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "task_worktree_failed", source: "route_worktree" });
-    return { ok: false, action: "error", reason: "task_worktree_failed", taskId, message, blockerTag: blockerTag2 };
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "task_worktree_failed", source: "route_worktree" });
+    return { ok: false, action: "error", reason: "task_worktree_failed", taskId, message, blockerTag };
   }
   const deliveryEvidencePath = deliveryEvidencePathForClickUpTask(taskId);
   const routingMetadata = {
@@ -9989,14 +10058,17 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
   const sessionId = String(existingSessionId);
   if (await sessionExists(openCodeClient, sessionId)) {
     if (typeof clickupClient?.updateTaskMetadata === "function") await clickupClient.updateTaskMetadata({ taskId, fieldId: config.routing.metadataFieldId, value: metadataWithRouting });
-    const delivery = await deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent: config.routing.targetAgent, text: prompt, directory: taskRoute.worktree, opencodeBaseUrl: config.opencode?.baseUrl, eventMarkers: [taskId, eventType], verifySessionEventDelivery });
-    if (!delivery.ok) return finish({ ...delivery, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath: routingMetadata.evidence_path });
+    const delivery = await deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent: config.routing.targetAgent, text: prompt, directory: taskRoute.worktree, opencodeBaseUrl: config.opencode?.baseUrl, eventMarkers: [taskId, eventType], verifySessionEventDelivery, applyBlockerOnFailure: false });
+    if (!delivery.ok) {
+      const recovery2 = await recoverClickUpPmSession({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, staleSessionId: sessionId, sessionTitle, taskRoute, metadataWithRouting, config, prompt, eventMarkers: [taskId, eventType], deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, eventKey, createSession, verifySessionEventDelivery });
+      return finish(recovery2);
+    }
     return finish({ ok: true, action: "sent_to_existing_session", taskId, sessionId, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, deliveryVerification: delivery.verification, deliveryFallback: delivery.fallback });
   }
   const at = now().toISOString();
   appendClickUpWebhookLocalLog(worktree, { type: "missing_session", taskId, sessionId, host, at });
-  const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "missing_session", source: "route_existing_session" });
-  return finish({ ok: true, action: "missing_session_reported", taskId, sessionId, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, blockerTag });
+  const recovery = await recoverClickUpPmSession({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, staleSessionId: sessionId, sessionTitle, taskRoute, metadataWithRouting, config, prompt, eventMarkers: [taskId, eventType], deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, eventKey, createSession, verifySessionEventDelivery });
+  return finish(recovery);
 }
 async function routeClickUpWebhookEvent(options = {}) {
   const taskId = clickUpTaskIdFromPayload(options.payload || {});
@@ -10104,15 +10176,16 @@ function clickUpWebhookExpectedPath(config) {
     return "/";
   }
 }
-async function handleClickUpWebhookRequest({ method = "POST", url = null, headers = {}, rawBody = "", config, state, worktree, clickupClient, openCodeClient, saveState, now = () => /* @__PURE__ */ new Date() } = {}) {
+async function handleClickUpWebhookRequest({ method = "POST", url = null, headers = {}, rawBody = "", config, state, worktree, clickupClient, openCodeClient, saveState, now = () => /* @__PURE__ */ new Date(), sessionExists, createSession, sendSessionEvent, ensureTaskWorktree, verifySessionEventDelivery } = {}) {
   let payload = null;
   let handled = null;
   let authenticatedWebhook = false;
   let receivedAt = null;
+  let activeState = state;
   const finish = (result) => {
     handled = result;
     receivedAt ??= now();
-    const auditState = authenticatedWebhook ? { ...state, lastWebhookAt: receivedAt.toISOString() } : state;
+    const auditState = authenticatedWebhook ? { ...activeState, lastWebhookAt: receivedAt.toISOString() } : activeState;
     if (saveState && authenticatedWebhook) saveState(auditState);
     writeClickUpWebhookAuditLog({ method, url, headers, rawBody, config, state: auditState, handled, payload, at: receivedAt });
     return result;
@@ -10127,7 +10200,11 @@ async function handleClickUpWebhookRequest({ method = "POST", url = null, header
     const bodyBytes = Buffer.isBuffer(rawBody) ? rawBody.length : Buffer.byteLength(String(rawBody || ""));
     if (bodyBytes > maxBodyBytes) return finish({ ok: false, status: 413, reason: "body_too_large" });
     const signature = headers["x-signature"] || headers["X-Signature"];
-    if (!verifyClickUpSignature(rawBody, signature, state?.secret)) return finish({ ok: false, status: 401, reason: "invalid_signature" });
+    if (!verifyClickUpSignature(rawBody, signature, activeState?.secret)) {
+      const resync = await resyncClickUpWebhookForSignatureDrift({ rawBody, signature, config, state: activeState, worktree, clickupClient, saveState });
+      if (!resync.ok) return finish({ ok: false, status: 401, reason: "invalid_signature", resync: { attempted: true, reason: resync.reason } });
+      activeState = resync.state;
+    }
     authenticatedWebhook = true;
     receivedAt = now();
     try {
@@ -10135,8 +10212,8 @@ async function handleClickUpWebhookRequest({ method = "POST", url = null, header
     } catch {
       return finish({ ok: false, status: 400, reason: "invalid_json" });
     }
-    const receivedState = { ...state, lastWebhookAt: receivedAt.toISOString() };
-    const result = await routeClickUpWebhookEvent({ payload, config, state: receivedState, worktree, clickupClient, openCodeClient, saveState });
+    const receivedState = { ...activeState, lastWebhookAt: receivedAt.toISOString() };
+    const result = await routeClickUpWebhookEvent({ payload, config, state: receivedState, worktree, clickupClient, openCodeClient, saveState, sessionExists, createSession, sendSessionEvent, ensureTaskWorktree, verifySessionEventDelivery });
     return finish({ ok: result.ok, status: result.ok ? 200 : 422, result });
   } catch (error) {
     writeClickUpWebhookAuditLog({ method, url, headers, rawBody, config, state, handled, error, payload, at: now() });
@@ -11876,7 +11953,7 @@ Follow-up: use optima_prompt_workflow with session_id '${sessionId}' to check in
     }
   };
 }
-OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, BUNDLE_ASSETS_DIR, CLICKUP_DEFINITION_DOC_PARENT, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentLedgerKey, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, deliveryEvidencePathForClickUpTask, ensureClickUpTaskWorktree, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, normalizeOpenCodeBaseUrl, readClickUpCommentLedger, readClickUpWebhookState, reconcileClickUpStartup, recordClickUpCommentVersionProcessed, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, sendOpenCodeSessionEventDirect, verifyOpenCodeSessionEventDelivery, stableClickUpCommentVersionMarker, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
+OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, BUNDLE_ASSETS_DIR, CLICKUP_DEFINITION_DOC_PARENT, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentLedgerKey, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, deliveryEvidencePathForClickUpTask, ensureClickUpTaskWorktree, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, normalizeOpenCodeBaseUrl, readClickUpCommentLedger, readClickUpWebhookState, reconcileClickUpStartup, recordClickUpCommentVersionProcessed, resyncClickUpWebhookForSignatureDrift, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, sendOpenCodeSessionEventDirect, verifyOpenCodeSessionEventDelivery, stableClickUpCommentVersionMarker, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
 
 // src/sanitize_cli.js
 var { migrateLegacyOptimaLayout: migrateLegacyOptimaLayout2 } = OptimaPlugin.__internals;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defend-tech/opencode-optima",
-  "version": "0.1.40",
+  "version": "0.1.42",
   "repository": {
     "type": "git",
     "url": "git+ssh://git@github.com/defend-tech/opencode-optima.git"