@defend-tech/opencode-optima 0.1.40 → 0.1.43

package/dist/index.js

@@ -9248,12 +9248,16 @@ async function validateClickUpWebhookState(state, config, clickupClient = null,
   }
   return { valid: true, mode: "local_state", state: { ...state, lastValidatedAt: (/* @__PURE__ */ new Date()).toISOString() }, limitation: "ClickUp API validation unavailable; Optima trusts ignored local runtime state only after id/secret/config checks." };
 }
-async function ensureClickUpWebhookSubscription({ validation, worktree, clickupClient = null } = {}) {
+function clickUpWebhookValidationFromConfig(config = null) {
+  if (!config) return { complete: false, ok: false, errors: ["clickup_config_unavailable"] };
+  return { complete: true, ok: true, enabled: true, config, errors: [] };
+}
+async function ensureClickUpWebhookSubscription({ validation, worktree, clickupClient = null, existingState = null } = {}) {
   if (!validation?.complete) {
     return { active: false, valid: false, reason: "config_incomplete", errors: validation?.errors || [] };
   }
   const { config } = validation;
-  const existing = readClickUpWebhookState(worktree, config);
+  const existing = existingState ? sanitizeClickUpWebhookState(existingState, config) : readClickUpWebhookState(worktree, config);
   const existingValidation = await validateClickUpWebhookState(existing, config, clickupClient, { allowRemoteUnhealthyLocalRecovery: true });
   if (existingValidation.valid) {
     const state = writeClickUpWebhookState(worktree, { ...existingValidation.state, recentEventKeys: existing.recentEventKeys || [] }, config);
@@ -9306,6 +9310,30 @@ function verifyClickUpSignature(rawBody, signatureHeader, secret) {
   const wanted = Buffer.from(expected, "hex");
   return given.length === wanted.length && crypto.timingSafeEqual(given, wanted);
 }
+async function resyncClickUpWebhookForSignatureDrift({ rawBody, signature, config, state = {}, worktree = process.cwd(), clickupClient, saveState } = {}) {
+  const validation = clickUpWebhookValidationFromConfig(config);
+  if (!clickupClient?.listWebhooks && !clickupClient?.createWebhook) {
+    appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_skipped", reason: "clickup_client_unavailable", webhookId: state?.webhookId || null });
+    return { ok: false, reason: "clickup_client_unavailable", state };
+  }
+  try {
+    const resync = await ensureClickUpWebhookSubscription({ validation, worktree, clickupClient, existingState: state });
+    if (!resync?.valid || !resync?.state?.secret) {
+      appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_failed", reason: resync?.reason || "resync_failed", webhookId: state?.webhookId || null });
+      return { ok: false, reason: resync?.reason || "resync_failed", resync, state };
+    }
+    if (!verifyClickUpSignature(rawBody, signature, resync.state.secret)) {
+      appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_unverified", reason: "invalid_signature_after_resync", oldWebhookId: state?.webhookId || null, webhookId: resync.state.webhookId || null, mode: resync.mode || null });
+      return { ok: false, reason: "invalid_signature_after_resync", resync, state: resync.state };
+    }
+    if (saveState) saveState(resync.state);
+    appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_verified", oldWebhookId: state?.webhookId || null, webhookId: resync.state.webhookId || null, mode: resync.mode || null });
+    return { ok: true, state: resync.state, resync };
+  } catch (error) {
+    appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_error", webhookId: state?.webhookId || null, message: error.message });
+    return { ok: false, reason: "resync_error", error: error.message, state };
+  }
+}
 function clickUpWebhookEventKey(payload = {}) {
   const history = Array.isArray(payload.history_items) ? payload.history_items[0] : payload.history_item;
   const comment = payload.comment || history?.comment || {};
@@ -9564,31 +9592,64 @@ function assertOpenCodePromptAccepted(result) {
   }
   return result;
 }
-async function sendOpenCodeSessionEventDirect({ baseUrl, sessionId, text, fetchImpl = globalThis.fetch } = {}) {
+function responseLooksLikeHtml(contentType = "", raw = "") {
+  return String(contentType || "").toLowerCase().includes("text/html") || /^\s*<!doctype\s+html\b/i.test(raw) || /^\s*<html\b/i.test(raw);
+}
+async function readOpenCodeJsonResponse(response, endpointName) {
+  const contentType = response.headers?.get?.("content-type") || "";
+  const raw = await response.text();
+  if (responseLooksLikeHtml(contentType, raw)) {
+    throw new Error(`OpenCode ${endpointName} returned the HTML app shell instead of an API response.`);
+  }
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw);
+  } catch (error) {
+    if (response.ok) throw new Error(`OpenCode ${endpointName} response was not JSON: ${error.message}`);
+    return { raw };
+  }
+}
+async function sendOpenCodeSessionEventDirect({ baseUrl, sessionId, text, agent, fetchImpl = globalThis.fetch } = {}) {
   if (typeof fetchImpl !== "function") throw new Error("OpenCode direct prompt delivery requires fetch.");
   const root = normalizeOpenCodeBaseUrl(baseUrl, "");
   if (!root) throw new Error("OpenCode direct prompt delivery requires a base URL.");
-  const url = `${root}/api/session/${encodeURIComponent(sessionId)}/prompt`;
-  const response = await fetchImpl(url, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ prompt: { text }, delivery: "queue", resume: true })
-  });
-  const raw = await response.text();
-  let data = null;
-  if (raw) {
-    try {
-      data = JSON.parse(raw);
-    } catch (error) {
-      if (response.ok) throw new Error(`OpenCode prompt response was not JSON: ${error.message}`);
+  const encodedSession = encodeURIComponent(sessionId);
+  const attempts = [
+    {
+      name: "v2 prompt",
+      url: `${root}/api/session/${encodedSession}/prompt`,
+      body: { prompt: { text }, delivery: "queue", resume: true },
+      accept: (response, data) => {
+        if (!response.ok) return null;
+        if (!data?.data?.id) throw new Error("OpenCode v2 prompt response did not include data.id.");
+        return { ok: true, method: "http", endpoint: "/api/session/{sessionID}/prompt", status: response.status, data: data.data, response: data };
+      }
+    },
+    {
+      name: "legacy async prompt",
+      url: `${root}/session/${encodedSession}/prompt_async`,
+      body: { agent, parts: [{ type: "text", text }] },
+      accept: (response, data) => {
+        if (response.status !== 204 && !response.ok) return null;
+        return { ok: true, method: "http", endpoint: "/session/{sessionID}/prompt_async", status: response.status, data: data?.data || null, response: data };
+      }
     }
+  ];
+  let firstError = null;
+  for (const attempt of attempts) {
+    const response = await fetchImpl(attempt.url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(attempt.body)
+    });
+    const data = await readOpenCodeJsonResponse(response, attempt.name);
+    const accepted = attempt.accept(response, data);
+    if (accepted) return accepted;
+    const message = data?.error?.message || data?.message || data?.raw || `OpenCode ${attempt.name} request failed with status ${response.status}.`;
+    firstError ??= new Error(message);
+    if (![404, 405].includes(Number(response.status))) break;
   }
-  if (!response.ok) {
-    const message = data?.error?.message || data?.message || raw || `OpenCode prompt request failed with status ${response.status}.`;
-    throw new Error(message);
-  }
-  if (!data?.data?.id) throw new Error("OpenCode prompt response did not include data.id.");
-  return { ok: true, method: "http", status: response.status, data: data.data, response: data };
+  throw firstError || new Error("OpenCode direct prompt delivery failed.");
 }
 async function sendOpenCodeSessionEvent(client, { sessionId, agent, text, directory, opencodeBaseUrl, baseUrl, fetchImpl, direct = false } = {}) {
   const directBaseUrl = opencodeBaseUrl || baseUrl;
@@ -9604,7 +9665,7 @@ async function sendOpenCodeSessionEvent(client, { sessionId, agent, text, direct
   if (!direct && typeof client?.session?.prompt === "function") {
     return assertOpenCodePromptAccepted(await client.session.prompt(structuredPayload));
   }
-  if (directBaseUrl) return sendOpenCodeSessionEventDirect({ baseUrl: directBaseUrl, sessionId, text, fetchImpl });
+  if (directBaseUrl) return sendOpenCodeSessionEventDirect({ baseUrl: directBaseUrl, sessionId, text, agent, fetchImpl });
   throw new Error("OpenCode client does not expose session.prompt or session.promptAsync.");
 }
 function normalizeOpenCodeSessionMessages(result) {
@@ -9672,7 +9733,7 @@ async function applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason,
     return { ok: false, error: error.message, tagName };
   }
 }
-async function deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent, text, directory, opencodeBaseUrl, eventMarkers = [], verifySessionEventDelivery = verifyOpenCodeSessionEventDelivery } = {}) {
+async function deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent, text, directory, opencodeBaseUrl, eventMarkers = [], verifySessionEventDelivery = verifyOpenCodeSessionEventDelivery, applyBlockerOnFailure = true } = {}) {
   const beforeMessages = await readOpenCodeSessionMessages(openCodeClient, { sessionId, limit: 50 }).catch(() => null);
   await sendSessionEvent(openCodeClient, { sessionId, agent, text, directory, opencodeBaseUrl });
   let verification = await verifySessionEventDelivery(openCodeClient, { sessionId, beforeMessages, expectedText: text, markers: eventMarkers });
@@ -9686,9 +9747,50 @@ async function deliverClickUpSessionEventWithVerification({ openCodeClient, send
   }
   const reason = verification?.reason || "message_delivery_failed";
   appendClickUpWebhookLocalLog(worktree, { type: "message_delivery_failed", taskId, sessionId, reason, fallbackAttempted: canFallbackDirect });
+  if (!applyBlockerOnFailure) return { ok: false, action: "message_delivery_failed", reason, taskId, sessionId, fallbackAttempted: canFallbackDirect };
   const blocker = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason, source: canFallbackDirect ? "delivery_fallback_failed" : "delivery_verification_failed" });
   return { ok: false, action: "message_delivery_failed", reason, taskId, sessionId, fallbackAttempted: canFallbackDirect, blockerTag: blocker };
 }
+async function recoverClickUpPmSession({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, staleSessionId, sessionTitle, taskRoute, metadataWithRouting, config, prompt, eventMarkers = [], deliveryEvidencePath, evidencePath, eventKey, createSession, verifySessionEventDelivery } = {}) {
+  appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_started", taskId, staleSessionId, worktree: taskRoute?.worktree });
+  let replacementSessionId = "";
+  try {
+    replacementSessionId = await createSession(openCodeClient, { title: `${sessionTitle} (recovery)`, directory: taskRoute.worktree, agent: config.routing.targetAgent });
+  } catch (error) {
+    appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_create_failed", taskId, staleSessionId, message: error.message });
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "replacement_session_create_failed", source: "pm_session_recovery" });
+    return { ok: false, action: "message_delivery_failed", reason: "replacement_session_create_failed", taskId, sessionId: staleSessionId, replacementAttempted: true, blockerTag, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath };
+  }
+  if (!String(replacementSessionId || "").startsWith("ses_")) {
+    appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_create_invalid", taskId, staleSessionId, replacementSessionId });
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "replacement_session_create_failed", source: "pm_session_recovery" });
+    return { ok: false, action: "message_delivery_failed", reason: "replacement_session_create_failed", taskId, sessionId: staleSessionId, replacementAttempted: true, blockerTag, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath };
+  }
+  const replacementDelivery = await deliverClickUpSessionEventWithVerification({
+    openCodeClient,
+    sendSessionEvent,
+    clickupClient,
+    worktree,
+    taskId,
+    sessionId: replacementSessionId,
+    agent: config.routing.targetAgent,
+    text: prompt,
+    directory: taskRoute.worktree,
+    opencodeBaseUrl: config.opencode?.baseUrl,
+    eventMarkers,
+    verifySessionEventDelivery,
+    applyBlockerOnFailure: false
+  });
+  if (!replacementDelivery.ok) {
+    appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_delivery_failed", taskId, staleSessionId, replacementSessionId, reason: replacementDelivery.reason });
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: replacementDelivery.reason || "replacement_delivery_failed", source: "pm_session_recovery" });
+    return { ...replacementDelivery, sessionId: staleSessionId, replacementSessionId, replacementAttempted: true, blockerTag, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath };
+  }
+  const replacementMetadata = clearClickUpPendingSessionMetadata(setClickUpSessionMetadata(metadataWithRouting, config.routing.metadataKey, replacementSessionId), config.routing.metadataKey);
+  await clickupClient.updateTaskMetadata({ taskId, fieldId: config.routing.metadataFieldId, value: replacementMetadata });
+  appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_succeeded", taskId, staleSessionId, replacementSessionId });
+  return { ok: true, action: "sent_to_replacement_session", taskId, sessionId: replacementSessionId, staleSessionId, replacementAttempted: true, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath, deliveryVerification: replacementDelivery.verification, deliveryFallback: replacementDelivery.fallback };
+}
 function formatClickUpWebhookPrompt({ eventType, taskId, payload, branch = "", worktree = "", deliveryEvidencePath = "" }) {
   const comment = clickUpCommentFromPayload(payload);
   const commentText = clickUpCommentText(comment).trim();
@@ -9940,8 +10042,8 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
   } catch (error) {
     const message = `Optima webhook could not create or reuse a task worktree for ${taskId}: ${error.message}`;
     appendClickUpWebhookLocalLog(worktree, { type: "task_worktree_failed", taskId, message });
-    const blockerTag2 = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "task_worktree_failed", source: "route_worktree" });
-    return { ok: false, action: "error", reason: "task_worktree_failed", taskId, message, blockerTag: blockerTag2 };
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "task_worktree_failed", source: "route_worktree" });
+    return { ok: false, action: "error", reason: "task_worktree_failed", taskId, message, blockerTag };
   }
   const deliveryEvidencePath = deliveryEvidencePathForClickUpTask(taskId);
   const routingMetadata = {
@@ -9982,14 +10084,17 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
   const sessionId = String(existingSessionId);
   if (await sessionExists(openCodeClient, sessionId)) {
     if (typeof clickupClient?.updateTaskMetadata === "function") await clickupClient.updateTaskMetadata({ taskId, fieldId: config.routing.metadataFieldId, value: metadataWithRouting });
-    const delivery = await deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent: config.routing.targetAgent, text: prompt, directory: taskRoute.worktree, opencodeBaseUrl: config.opencode?.baseUrl, eventMarkers: [taskId, eventType], verifySessionEventDelivery });
-    if (!delivery.ok) return finish({ ...delivery, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath: routingMetadata.evidence_path });
+    const delivery = await deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent: config.routing.targetAgent, text: prompt, directory: taskRoute.worktree, opencodeBaseUrl: config.opencode?.baseUrl, eventMarkers: [taskId, eventType], verifySessionEventDelivery, applyBlockerOnFailure: false });
+    if (!delivery.ok) {
+      const recovery2 = await recoverClickUpPmSession({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, staleSessionId: sessionId, sessionTitle, taskRoute, metadataWithRouting, config, prompt, eventMarkers: [taskId, eventType], deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, eventKey, createSession, verifySessionEventDelivery });
+      return finish(recovery2);
+    }
     return finish({ ok: true, action: "sent_to_existing_session", taskId, sessionId, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, deliveryVerification: delivery.verification, deliveryFallback: delivery.fallback });
   }
   const at = now().toISOString();
   appendClickUpWebhookLocalLog(worktree, { type: "missing_session", taskId, sessionId, host, at });
-  const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "missing_session", source: "route_existing_session" });
-  return finish({ ok: true, action: "missing_session_reported", taskId, sessionId, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, blockerTag });
+  const recovery = await recoverClickUpPmSession({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, staleSessionId: sessionId, sessionTitle, taskRoute, metadataWithRouting, config, prompt, eventMarkers: [taskId, eventType], deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, eventKey, createSession, verifySessionEventDelivery });
+  return finish(recovery);
 }
 async function routeClickUpWebhookEvent(options = {}) {
   const taskId = clickUpTaskIdFromPayload(options.payload || {});
@@ -10097,15 +10202,16 @@ function clickUpWebhookExpectedPath(config) {
     return "/";
   }
 }
-async function handleClickUpWebhookRequest({ method = "POST", url = null, headers = {}, rawBody = "", config, state, worktree, clickupClient, openCodeClient, saveState, now = () => /* @__PURE__ */ new Date() } = {}) {
+async function handleClickUpWebhookRequest({ method = "POST", url = null, headers = {}, rawBody = "", config, state, worktree, clickupClient, openCodeClient, saveState, now = () => /* @__PURE__ */ new Date(), sessionExists, createSession, sendSessionEvent, ensureTaskWorktree, verifySessionEventDelivery } = {}) {
   let payload = null;
   let handled = null;
   let authenticatedWebhook = false;
   let receivedAt = null;
+  let activeState = state;
   const finish = (result) => {
     handled = result;
     receivedAt ??= now();
-    const auditState = authenticatedWebhook ? { ...state, lastWebhookAt: receivedAt.toISOString() } : state;
+    const auditState = authenticatedWebhook ? { ...activeState, lastWebhookAt: receivedAt.toISOString() } : activeState;
     if (saveState && authenticatedWebhook) saveState(auditState);
     writeClickUpWebhookAuditLog({ method, url, headers, rawBody, config, state: auditState, handled, payload, at: receivedAt });
     return result;
@@ -10120,7 +10226,11 @@ async function handleClickUpWebhookRequest({ method = "POST", url = null, header
     const bodyBytes = Buffer.isBuffer(rawBody) ? rawBody.length : Buffer.byteLength(String(rawBody || ""));
     if (bodyBytes > maxBodyBytes) return finish({ ok: false, status: 413, reason: "body_too_large" });
     const signature = headers["x-signature"] || headers["X-Signature"];
-    if (!verifyClickUpSignature(rawBody, signature, state?.secret)) return finish({ ok: false, status: 401, reason: "invalid_signature" });
+    if (!verifyClickUpSignature(rawBody, signature, activeState?.secret)) {
+      const resync = await resyncClickUpWebhookForSignatureDrift({ rawBody, signature, config, state: activeState, worktree, clickupClient, saveState });
+      if (!resync.ok) return finish({ ok: false, status: 401, reason: "invalid_signature", resync: { attempted: true, reason: resync.reason } });
+      activeState = resync.state;
+    }
     authenticatedWebhook = true;
     receivedAt = now();
     try {
@@ -10128,8 +10238,8 @@ async function handleClickUpWebhookRequest({ method = "POST", url = null, header
     } catch {
       return finish({ ok: false, status: 400, reason: "invalid_json" });
     }
-    const receivedState = { ...state, lastWebhookAt: receivedAt.toISOString() };
-    const result = await routeClickUpWebhookEvent({ payload, config, state: receivedState, worktree, clickupClient, openCodeClient, saveState });
+    const receivedState = { ...activeState, lastWebhookAt: receivedAt.toISOString() };
+    const result = await routeClickUpWebhookEvent({ payload, config, state: receivedState, worktree, clickupClient, openCodeClient, saveState, sessionExists, createSession, sendSessionEvent, ensureTaskWorktree, verifySessionEventDelivery });
     return finish({ ok: result.ok, status: result.ok ? 200 : 422, result });
   } catch (error) {
     writeClickUpWebhookAuditLog({ method, url, headers, rawBody, config, state, handled, error, payload, at: now() });
@@ -11869,7 +11979,7 @@ Follow-up: use optima_prompt_workflow with session_id '${sessionId}' to check in
     }
   };
 }
-OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, BUNDLE_ASSETS_DIR, CLICKUP_DEFINITION_DOC_PARENT, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentLedgerKey, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, deliveryEvidencePathForClickUpTask, ensureClickUpTaskWorktree, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, normalizeOpenCodeBaseUrl, readClickUpCommentLedger, readClickUpWebhookState, reconcileClickUpStartup, recordClickUpCommentVersionProcessed, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, sendOpenCodeSessionEventDirect, verifyOpenCodeSessionEventDelivery, stableClickUpCommentVersionMarker, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
+OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, BUNDLE_ASSETS_DIR, CLICKUP_DEFINITION_DOC_PARENT, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentLedgerKey, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, deliveryEvidencePathForClickUpTask, ensureClickUpTaskWorktree, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, normalizeOpenCodeBaseUrl, readClickUpCommentLedger, readClickUpWebhookState, reconcileClickUpStartup, recordClickUpCommentVersionProcessed, resyncClickUpWebhookForSignatureDrift, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, sendOpenCodeSessionEventDirect, verifyOpenCodeSessionEventDelivery, stableClickUpCommentVersionMarker, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
 export {
   OptimaPlugin as default
 };

package/dist/sanitize_cli.js

@@ -9255,12 +9255,16 @@ async function validateClickUpWebhookState(state, config, clickupClient = null,
   }
   return { valid: true, mode: "local_state", state: { ...state, lastValidatedAt: (/* @__PURE__ */ new Date()).toISOString() }, limitation: "ClickUp API validation unavailable; Optima trusts ignored local runtime state only after id/secret/config checks." };
 }
-async function ensureClickUpWebhookSubscription({ validation, worktree, clickupClient = null } = {}) {
+function clickUpWebhookValidationFromConfig(config = null) {
+  if (!config) return { complete: false, ok: false, errors: ["clickup_config_unavailable"] };
+  return { complete: true, ok: true, enabled: true, config, errors: [] };
+}
+async function ensureClickUpWebhookSubscription({ validation, worktree, clickupClient = null, existingState = null } = {}) {
   if (!validation?.complete) {
     return { active: false, valid: false, reason: "config_incomplete", errors: validation?.errors || [] };
   }
   const { config } = validation;
-  const existing = readClickUpWebhookState(worktree, config);
+  const existing = existingState ? sanitizeClickUpWebhookState(existingState, config) : readClickUpWebhookState(worktree, config);
   const existingValidation = await validateClickUpWebhookState(existing, config, clickupClient, { allowRemoteUnhealthyLocalRecovery: true });
   if (existingValidation.valid) {
     const state = writeClickUpWebhookState(worktree, { ...existingValidation.state, recentEventKeys: existing.recentEventKeys || [] }, config);
@@ -9313,6 +9317,30 @@ function verifyClickUpSignature(rawBody, signatureHeader, secret) {
   const wanted = Buffer.from(expected, "hex");
   return given.length === wanted.length && crypto.timingSafeEqual(given, wanted);
 }
+async function resyncClickUpWebhookForSignatureDrift({ rawBody, signature, config, state = {}, worktree = process.cwd(), clickupClient, saveState } = {}) {
+  const validation = clickUpWebhookValidationFromConfig(config);
+  if (!clickupClient?.listWebhooks && !clickupClient?.createWebhook) {
+    appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_skipped", reason: "clickup_client_unavailable", webhookId: state?.webhookId || null });
+    return { ok: false, reason: "clickup_client_unavailable", state };
+  }
+  try {
+    const resync = await ensureClickUpWebhookSubscription({ validation, worktree, clickupClient, existingState: state });
+    if (!resync?.valid || !resync?.state?.secret) {
+      appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_failed", reason: resync?.reason || "resync_failed", webhookId: state?.webhookId || null });
+      return { ok: false, reason: resync?.reason || "resync_failed", resync, state };
+    }
+    if (!verifyClickUpSignature(rawBody, signature, resync.state.secret)) {
+      appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_unverified", reason: "invalid_signature_after_resync", oldWebhookId: state?.webhookId || null, webhookId: resync.state.webhookId || null, mode: resync.mode || null });
+      return { ok: false, reason: "invalid_signature_after_resync", resync, state: resync.state };
+    }
+    if (saveState) saveState(resync.state);
+    appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_verified", oldWebhookId: state?.webhookId || null, webhookId: resync.state.webhookId || null, mode: resync.mode || null });
+    return { ok: true, state: resync.state, resync };
+  } catch (error) {
+    appendClickUpWebhookLocalLog(worktree, { type: "signature_resync_error", webhookId: state?.webhookId || null, message: error.message });
+    return { ok: false, reason: "resync_error", error: error.message, state };
+  }
+}
 function clickUpWebhookEventKey(payload = {}) {
   const history = Array.isArray(payload.history_items) ? payload.history_items[0] : payload.history_item;
   const comment = payload.comment || history?.comment || {};
@@ -9571,31 +9599,64 @@ function assertOpenCodePromptAccepted(result) {
   }
   return result;
 }
-async function sendOpenCodeSessionEventDirect({ baseUrl, sessionId, text, fetchImpl = globalThis.fetch } = {}) {
+function responseLooksLikeHtml(contentType = "", raw = "") {
+  return String(contentType || "").toLowerCase().includes("text/html") || /^\s*<!doctype\s+html\b/i.test(raw) || /^\s*<html\b/i.test(raw);
+}
+async function readOpenCodeJsonResponse(response, endpointName) {
+  const contentType = response.headers?.get?.("content-type") || "";
+  const raw = await response.text();
+  if (responseLooksLikeHtml(contentType, raw)) {
+    throw new Error(`OpenCode ${endpointName} returned the HTML app shell instead of an API response.`);
+  }
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw);
+  } catch (error) {
+    if (response.ok) throw new Error(`OpenCode ${endpointName} response was not JSON: ${error.message}`);
+    return { raw };
+  }
+}
+async function sendOpenCodeSessionEventDirect({ baseUrl, sessionId, text, agent, fetchImpl = globalThis.fetch } = {}) {
   if (typeof fetchImpl !== "function") throw new Error("OpenCode direct prompt delivery requires fetch.");
   const root = normalizeOpenCodeBaseUrl(baseUrl, "");
   if (!root) throw new Error("OpenCode direct prompt delivery requires a base URL.");
-  const url = `${root}/api/session/${encodeURIComponent(sessionId)}/prompt`;
-  const response = await fetchImpl(url, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ prompt: { text }, delivery: "queue", resume: true })
-  });
-  const raw = await response.text();
-  let data = null;
-  if (raw) {
-    try {
-      data = JSON.parse(raw);
-    } catch (error) {
-      if (response.ok) throw new Error(`OpenCode prompt response was not JSON: ${error.message}`);
+  const encodedSession = encodeURIComponent(sessionId);
+  const attempts = [
+    {
+      name: "v2 prompt",
+      url: `${root}/api/session/${encodedSession}/prompt`,
+      body: { prompt: { text }, delivery: "queue", resume: true },
+      accept: (response, data) => {
+        if (!response.ok) return null;
+        if (!data?.data?.id) throw new Error("OpenCode v2 prompt response did not include data.id.");
+        return { ok: true, method: "http", endpoint: "/api/session/{sessionID}/prompt", status: response.status, data: data.data, response: data };
+      }
+    },
+    {
+      name: "legacy async prompt",
+      url: `${root}/session/${encodedSession}/prompt_async`,
+      body: { agent, parts: [{ type: "text", text }] },
+      accept: (response, data) => {
+        if (response.status !== 204 && !response.ok) return null;
+        return { ok: true, method: "http", endpoint: "/session/{sessionID}/prompt_async", status: response.status, data: data?.data || null, response: data };
+      }
     }
+  ];
+  let firstError = null;
+  for (const attempt of attempts) {
+    const response = await fetchImpl(attempt.url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(attempt.body)
+    });
+    const data = await readOpenCodeJsonResponse(response, attempt.name);
+    const accepted = attempt.accept(response, data);
+    if (accepted) return accepted;
+    const message = data?.error?.message || data?.message || data?.raw || `OpenCode ${attempt.name} request failed with status ${response.status}.`;
+    firstError ??= new Error(message);
+    if (![404, 405].includes(Number(response.status))) break;
   }
-  if (!response.ok) {
-    const message = data?.error?.message || data?.message || raw || `OpenCode prompt request failed with status ${response.status}.`;
-    throw new Error(message);
-  }
-  if (!data?.data?.id) throw new Error("OpenCode prompt response did not include data.id.");
-  return { ok: true, method: "http", status: response.status, data: data.data, response: data };
+  throw firstError || new Error("OpenCode direct prompt delivery failed.");
 }
 async function sendOpenCodeSessionEvent(client, { sessionId, agent, text, directory, opencodeBaseUrl, baseUrl, fetchImpl, direct = false } = {}) {
   const directBaseUrl = opencodeBaseUrl || baseUrl;
@@ -9611,7 +9672,7 @@ async function sendOpenCodeSessionEvent(client, { sessionId, agent, text, direct
   if (!direct && typeof client?.session?.prompt === "function") {
     return assertOpenCodePromptAccepted(await client.session.prompt(structuredPayload));
   }
-  if (directBaseUrl) return sendOpenCodeSessionEventDirect({ baseUrl: directBaseUrl, sessionId, text, fetchImpl });
+  if (directBaseUrl) return sendOpenCodeSessionEventDirect({ baseUrl: directBaseUrl, sessionId, text, agent, fetchImpl });
   throw new Error("OpenCode client does not expose session.prompt or session.promptAsync.");
 }
 function normalizeOpenCodeSessionMessages(result) {
@@ -9679,7 +9740,7 @@ async function applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason,
     return { ok: false, error: error.message, tagName };
   }
 }
-async function deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent, text, directory, opencodeBaseUrl, eventMarkers = [], verifySessionEventDelivery = verifyOpenCodeSessionEventDelivery } = {}) {
+async function deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent, text, directory, opencodeBaseUrl, eventMarkers = [], verifySessionEventDelivery = verifyOpenCodeSessionEventDelivery, applyBlockerOnFailure = true } = {}) {
   const beforeMessages = await readOpenCodeSessionMessages(openCodeClient, { sessionId, limit: 50 }).catch(() => null);
   await sendSessionEvent(openCodeClient, { sessionId, agent, text, directory, opencodeBaseUrl });
   let verification = await verifySessionEventDelivery(openCodeClient, { sessionId, beforeMessages, expectedText: text, markers: eventMarkers });
@@ -9693,9 +9754,50 @@ async function deliverClickUpSessionEventWithVerification({ openCodeClient, send
   }
   const reason = verification?.reason || "message_delivery_failed";
   appendClickUpWebhookLocalLog(worktree, { type: "message_delivery_failed", taskId, sessionId, reason, fallbackAttempted: canFallbackDirect });
+  if (!applyBlockerOnFailure) return { ok: false, action: "message_delivery_failed", reason, taskId, sessionId, fallbackAttempted: canFallbackDirect };
   const blocker = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason, source: canFallbackDirect ? "delivery_fallback_failed" : "delivery_verification_failed" });
   return { ok: false, action: "message_delivery_failed", reason, taskId, sessionId, fallbackAttempted: canFallbackDirect, blockerTag: blocker };
 }
+async function recoverClickUpPmSession({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, staleSessionId, sessionTitle, taskRoute, metadataWithRouting, config, prompt, eventMarkers = [], deliveryEvidencePath, evidencePath, eventKey, createSession, verifySessionEventDelivery } = {}) {
+  appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_started", taskId, staleSessionId, worktree: taskRoute?.worktree });
+  let replacementSessionId = "";
+  try {
+    replacementSessionId = await createSession(openCodeClient, { title: `${sessionTitle} (recovery)`, directory: taskRoute.worktree, agent: config.routing.targetAgent });
+  } catch (error) {
+    appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_create_failed", taskId, staleSessionId, message: error.message });
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "replacement_session_create_failed", source: "pm_session_recovery" });
+    return { ok: false, action: "message_delivery_failed", reason: "replacement_session_create_failed", taskId, sessionId: staleSessionId, replacementAttempted: true, blockerTag, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath };
+  }
+  if (!String(replacementSessionId || "").startsWith("ses_")) {
+    appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_create_invalid", taskId, staleSessionId, replacementSessionId });
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "replacement_session_create_failed", source: "pm_session_recovery" });
+    return { ok: false, action: "message_delivery_failed", reason: "replacement_session_create_failed", taskId, sessionId: staleSessionId, replacementAttempted: true, blockerTag, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath };
+  }
+  const replacementDelivery = await deliverClickUpSessionEventWithVerification({
+    openCodeClient,
+    sendSessionEvent,
+    clickupClient,
+    worktree,
+    taskId,
+    sessionId: replacementSessionId,
+    agent: config.routing.targetAgent,
+    text: prompt,
+    directory: taskRoute.worktree,
+    opencodeBaseUrl: config.opencode?.baseUrl,
+    eventMarkers,
+    verifySessionEventDelivery,
+    applyBlockerOnFailure: false
+  });
+  if (!replacementDelivery.ok) {
+    appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_delivery_failed", taskId, staleSessionId, replacementSessionId, reason: replacementDelivery.reason });
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: replacementDelivery.reason || "replacement_delivery_failed", source: "pm_session_recovery" });
+    return { ...replacementDelivery, sessionId: staleSessionId, replacementSessionId, replacementAttempted: true, blockerTag, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath };
+  }
+  const replacementMetadata = clearClickUpPendingSessionMetadata(setClickUpSessionMetadata(metadataWithRouting, config.routing.metadataKey, replacementSessionId), config.routing.metadataKey);
+  await clickupClient.updateTaskMetadata({ taskId, fieldId: config.routing.metadataFieldId, value: replacementMetadata });
+  appendClickUpWebhookLocalLog(worktree, { type: "pm_session_recovery_succeeded", taskId, staleSessionId, replacementSessionId });
+  return { ok: true, action: "sent_to_replacement_session", taskId, sessionId: replacementSessionId, staleSessionId, replacementAttempted: true, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath, deliveryVerification: replacementDelivery.verification, deliveryFallback: replacementDelivery.fallback };
+}
 function formatClickUpWebhookPrompt({ eventType, taskId, payload, branch = "", worktree = "", deliveryEvidencePath = "" }) {
   const comment = clickUpCommentFromPayload(payload);
   const commentText = clickUpCommentText(comment).trim();
@@ -9947,8 +10049,8 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
   } catch (error) {
     const message = `Optima webhook could not create or reuse a task worktree for ${taskId}: ${error.message}`;
     appendClickUpWebhookLocalLog(worktree, { type: "task_worktree_failed", taskId, message });
-    const blockerTag2 = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "task_worktree_failed", source: "route_worktree" });
-    return { ok: false, action: "error", reason: "task_worktree_failed", taskId, message, blockerTag: blockerTag2 };
+    const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "task_worktree_failed", source: "route_worktree" });
+    return { ok: false, action: "error", reason: "task_worktree_failed", taskId, message, blockerTag };
   }
   const deliveryEvidencePath = deliveryEvidencePathForClickUpTask(taskId);
   const routingMetadata = {
@@ -9989,14 +10091,17 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
   const sessionId = String(existingSessionId);
   if (await sessionExists(openCodeClient, sessionId)) {
     if (typeof clickupClient?.updateTaskMetadata === "function") await clickupClient.updateTaskMetadata({ taskId, fieldId: config.routing.metadataFieldId, value: metadataWithRouting });
-    const delivery = await deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent: config.routing.targetAgent, text: prompt, directory: taskRoute.worktree, opencodeBaseUrl: config.opencode?.baseUrl, eventMarkers: [taskId, eventType], verifySessionEventDelivery });
-    if (!delivery.ok) return finish({ ...delivery, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath: routingMetadata.evidence_path });
+    const delivery = await deliverClickUpSessionEventWithVerification({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, sessionId, agent: config.routing.targetAgent, text: prompt, directory: taskRoute.worktree, opencodeBaseUrl: config.opencode?.baseUrl, eventMarkers: [taskId, eventType], verifySessionEventDelivery, applyBlockerOnFailure: false });
+    if (!delivery.ok) {
+      const recovery2 = await recoverClickUpPmSession({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, staleSessionId: sessionId, sessionTitle, taskRoute, metadataWithRouting, config, prompt, eventMarkers: [taskId, eventType], deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, eventKey, createSession, verifySessionEventDelivery });
+      return finish(recovery2);
+    }
     return finish({ ok: true, action: "sent_to_existing_session", taskId, sessionId, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, deliveryVerification: delivery.verification, deliveryFallback: delivery.fallback });
   }
   const at = now().toISOString();
   appendClickUpWebhookLocalLog(worktree, { type: "missing_session", taskId, sessionId, host, at });
-  const blockerTag = await applyClickUpBlockerTag({ clickupClient, worktree, taskId, reason: "missing_session", source: "route_existing_session" });
-  return finish({ ok: true, action: "missing_session_reported", taskId, sessionId, eventKey, branch: taskRoute.branch, worktree: taskRoute.worktree, deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, blockerTag });
+  const recovery = await recoverClickUpPmSession({ openCodeClient, sendSessionEvent, clickupClient, worktree, taskId, staleSessionId: sessionId, sessionTitle, taskRoute, metadataWithRouting, config, prompt, eventMarkers: [taskId, eventType], deliveryEvidencePath, evidencePath: routingMetadata.evidence_path, eventKey, createSession, verifySessionEventDelivery });
+  return finish(recovery);
 }
 async function routeClickUpWebhookEvent(options = {}) {
   const taskId = clickUpTaskIdFromPayload(options.payload || {});
@@ -10104,15 +10209,16 @@ function clickUpWebhookExpectedPath(config) {
     return "/";
   }
 }
-async function handleClickUpWebhookRequest({ method = "POST", url = null, headers = {}, rawBody = "", config, state, worktree, clickupClient, openCodeClient, saveState, now = () => /* @__PURE__ */ new Date() } = {}) {
+async function handleClickUpWebhookRequest({ method = "POST", url = null, headers = {}, rawBody = "", config, state, worktree, clickupClient, openCodeClient, saveState, now = () => /* @__PURE__ */ new Date(), sessionExists, createSession, sendSessionEvent, ensureTaskWorktree, verifySessionEventDelivery } = {}) {
   let payload = null;
   let handled = null;
   let authenticatedWebhook = false;
   let receivedAt = null;
+  let activeState = state;
   const finish = (result) => {
     handled = result;
     receivedAt ??= now();
-    const auditState = authenticatedWebhook ? { ...state, lastWebhookAt: receivedAt.toISOString() } : state;
+    const auditState = authenticatedWebhook ? { ...activeState, lastWebhookAt: receivedAt.toISOString() } : activeState;
     if (saveState && authenticatedWebhook) saveState(auditState);
     writeClickUpWebhookAuditLog({ method, url, headers, rawBody, config, state: auditState, handled, payload, at: receivedAt });
     return result;
@@ -10127,7 +10233,11 @@ async function handleClickUpWebhookRequest({ method = "POST", url = null, header
     const bodyBytes = Buffer.isBuffer(rawBody) ? rawBody.length : Buffer.byteLength(String(rawBody || ""));
     if (bodyBytes > maxBodyBytes) return finish({ ok: false, status: 413, reason: "body_too_large" });
     const signature = headers["x-signature"] || headers["X-Signature"];
-    if (!verifyClickUpSignature(rawBody, signature, state?.secret)) return finish({ ok: false, status: 401, reason: "invalid_signature" });
+    if (!verifyClickUpSignature(rawBody, signature, activeState?.secret)) {
+      const resync = await resyncClickUpWebhookForSignatureDrift({ rawBody, signature, config, state: activeState, worktree, clickupClient, saveState });
+      if (!resync.ok) return finish({ ok: false, status: 401, reason: "invalid_signature", resync: { attempted: true, reason: resync.reason } });
+      activeState = resync.state;
+    }
     authenticatedWebhook = true;
     receivedAt = now();
     try {
@@ -10135,8 +10245,8 @@ async function handleClickUpWebhookRequest({ method = "POST", url = null, header
     } catch {
       return finish({ ok: false, status: 400, reason: "invalid_json" });
     }
-    const receivedState = { ...state, lastWebhookAt: receivedAt.toISOString() };
-    const result = await routeClickUpWebhookEvent({ payload, config, state: receivedState, worktree, clickupClient, openCodeClient, saveState });
+    const receivedState = { ...activeState, lastWebhookAt: receivedAt.toISOString() };
+    const result = await routeClickUpWebhookEvent({ payload, config, state: receivedState, worktree, clickupClient, openCodeClient, saveState, sessionExists, createSession, sendSessionEvent, ensureTaskWorktree, verifySessionEventDelivery });
     return finish({ ok: result.ok, status: result.ok ? 200 : 422, result });
   } catch (error) {
     writeClickUpWebhookAuditLog({ method, url, headers, rawBody, config, state, handled, error, payload, at: now() });
@@ -11876,7 +11986,7 @@ Follow-up: use optima_prompt_workflow with session_id '${sessionId}' to check in
     }
   };
 }
-OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, BUNDLE_ASSETS_DIR, CLICKUP_DEFINITION_DOC_PARENT, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentLedgerKey, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, deliveryEvidencePathForClickUpTask, ensureClickUpTaskWorktree, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, normalizeOpenCodeBaseUrl, readClickUpCommentLedger, readClickUpWebhookState, reconcileClickUpStartup, recordClickUpCommentVersionProcessed, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, sendOpenCodeSessionEventDirect, verifyOpenCodeSessionEventDelivery, stableClickUpCommentVersionMarker, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
+OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, BUNDLE_ASSETS_DIR, CLICKUP_DEFINITION_DOC_PARENT, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentLedgerKey, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, createClickUpApiClient, deliveryEvidencePathForClickUpTask, ensureClickUpTaskWorktree, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, isClickUpWebhookStateActive, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, normalizeOpenCodeBaseUrl, readClickUpCommentLedger, readClickUpWebhookState, reconcileClickUpStartup, recordClickUpCommentVersionProcessed, resyncClickUpWebhookForSignatureDrift, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, sendOpenCodeSessionEventDirect, verifyOpenCodeSessionEventDelivery, stableClickUpCommentVersionMarker, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
 
 // src/sanitize_cli.js
 var { migrateLegacyOptimaLayout: migrateLegacyOptimaLayout2 } = OptimaPlugin.__internals;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defend-tech/opencode-optima",
-  "version": "0.1.40",
+  "version": "0.1.43",
   "repository": {
     "type": "git",
     "url": "git+ssh://git@github.com/defend-tech/opencode-optima.git"