@defend-tech/opencode-optima 0.1.71 → 0.1.73

package/dist/sanitize_cli.js

@@ -8634,6 +8634,7 @@ var activeWorkflows = /* @__PURE__ */ new Map();
 var activeClickUpWebhookListeners = /* @__PURE__ */ new Map();
 var activeClickUpWebhookLifecycleRegistry = /* @__PURE__ */ new Map();
 var activeClickUpTaskRoutes = /* @__PURE__ */ new Map();
+var GITHUB_WEBHOOK_EVENTS = ["pull_request", "pull_request_review", "pull_request_review_comment", "issue_comment"];
 function isRootDirectory(candidate) {
   const resolved = path6.resolve(candidate);
   return resolved === path6.parse(resolved).root;
@@ -8826,6 +8827,70 @@ function deriveClickUpPrTarget({ isRelease = false, parentTaskId, parentBranch,
   }
   return devBranch;
 }
+function deriveClickUpRequiredPullRequest({ taskId, taskType = "Tarea", parentTaskId = "", subtaskId = "", branch = "", parentBranch = "", devBranch = "dev", mainBranch = "main", isRelease = false, githubRemote = "origin", prUrl = "", prNumber = "" } = {}) {
+  const effectiveParent = parentTaskId || taskId;
+  const isSubtask = isClickUpSubtaskRoute({ taskType, parentTaskId: effectiveParent, subtaskId, taskId });
+  const sourceBranch = branch || deriveClickUpBranchName({ taskType, parentTaskId: effectiveParent, subtaskId, taskId });
+  const targetBranch = deriveClickUpPrTarget({
+    isRelease,
+    parentBranch: isSubtask ? parentBranch || deriveClickUpBranchName({ taskType, parentTaskId: effectiveParent }) : parentBranch,
+    parentTaskId: isSubtask ? effectiveParent : "",
+    parentTaskType: taskType,
+    taskType,
+    devBranch,
+    mainBranch
+  });
+  return {
+    required: true,
+    sourceBranch,
+    targetBranch,
+    githubRemote,
+    prUrl: String(prUrl || "").trim(),
+    prNumber: String(prNumber || "").trim(),
+    scope: isSubtask ? "subtask_to_parent" : isRelease ? "release_to_main" : "task_to_dev",
+    policy: "validation_requires_open_pull_request"
+  };
+}
+function buildClickUpReviewAutomationPlan({ isSubtask = false, humanApprover = "CTO", preproductionProvider = "Vercel", preproductionEnvironment = "preproduction" } = {}) {
+  return {
+    github_webhooks: {
+      listen_for: ["pull_request_review", "pull_request_review_comment", "issue_comment", "pull_request"],
+      comment_policy: "reply_before_change_and_after_change",
+      change_request_status: "in progress",
+      after_fix_status: "validation",
+      state_storage: "ClickUp agent_metadata.github"
+    },
+    review_comments: [
+      "Answer GitHub comments directly in GitHub.",
+      "If a comment implies a code/doc/test change, first reply with the intended action, move the ClickUp task/subtask to in progress, implement, push the same branch, move it back to validation, update the PR, then reply again with what changed.",
+      "Also update ClickUp with human-readable model work status; runtime/process noise stays in local logs."
+    ],
+    accepted_review: {
+      accepted_by: humanApprover,
+      trigger: "approved_pull_request_review",
+      action: isSubtask ? "merge_subtask_pr_into_parent_branch" : "merge_parent_pr_into_dev",
+      delete_source_branch_after_success: true,
+      delete_worktree_after_success: true,
+      preserve_opencode_sessions_in_agent_metadata: true
+    },
+    preproduction: isSubtask ? {
+      required: false,
+      reason: "Subtask merge stops at parent branch; parent task owns dev/preproduction."
+    } : {
+      required: true,
+      provider: preproductionProvider,
+      environment: preproductionEnvironment,
+      verify_deployment_after_merge: true,
+      run_smoke_regression: true,
+      on_failure: "create_bug_subtasks_and_return_parent_to_in_progress",
+      completion_gate: "preproduction_deployed_and_regression_passed"
+    },
+    completion: {
+      final_clickup_comment_required: true,
+      final_status: isSubtask ? "completed_or_parent_validation" : "completed"
+    }
+  };
+}
 function validateMainWorkspaceBranchSafety({ currentBranch, requiredBranch = "dev", forbiddenBranch = "main" } = {}) {
   const normalized = String(currentBranch ?? "").trim();
   if (!normalized) {
@@ -9488,6 +9553,7 @@ function buildClickUpStartTaskPayload({ taskId, taskType = "Tarea", parentTaskId
   const worktree = deriveClickUpWorktree({ baseWorktree, taskId, taskType, parentTaskId: effectiveParent, subtaskId });
   const prTarget = isSubtask ? parentBranch : "dev";
   const startFrom = isSubtask ? parentBranch : "dev";
+  const requiredPullRequest = deriveClickUpRequiredPullRequest({ taskId, taskType, parentTaskId: effectiveParent, subtaskId, branch, parentBranch });
   const estimate = preEstimateClickUpWork({ complexity, filesChanged, acceptanceCriteria, unknowns });
   const metadata = mergeClickUpAgentMetadata(existingAgentMetadata, {
     task: {
@@ -9501,6 +9567,10 @@ function buildClickUpStartTaskPayload({ taskId, taskType = "Tarea", parentTaskId
       mirror_task_path: `.optima/tasks/${branchSafeClickUpId(taskId || subtaskId || effectiveParent)}.md`,
       evidence_path: `.optima/evidences/${branchSafeClickUpId(taskId || subtaskId || effectiveParent)}/SUMMARY.md`,
       delivery_evidence_path: deliveryEvidencePathForClickUpTask(taskId || subtaskId || effectiveParent),
+      github: {
+        required_pull_request: requiredPullRequest,
+        review_automation: buildClickUpReviewAutomationPlan({ isSubtask })
+      },
       ...agentMetadata
     }
   });
@@ -9523,6 +9593,10 @@ function buildClickUpStartTaskPayload({ taskId, taskType = "Tarea", parentTaskId
       parentBranch: parentBranch || void 0,
       prTarget
     },
+    github: {
+      requiredPullRequest,
+      reviewAutomation: buildClickUpReviewAutomationPlan({ isSubtask })
+    },
     mirror: {
       taskPath: `.optima/tasks/${branchSafeClickUpId(taskId || subtaskId || effectiveParent)}.md`,
       evidenceSummaryPath: `.optima/evidences/${branchSafeClickUpId(taskId || subtaskId || effectiveParent)}/SUMMARY.md`,
@@ -9533,14 +9607,15 @@ function buildClickUpStartTaskPayload({ taskId, taskType = "Tarea", parentTaskId
       wouldCreate: true
     },
     clickup: {
-      comment: `Starting task from ${startFrom}. Branch: ${branch}. Worktree: ${worktree}. Delivery evidence: ${deliveryEvidencePathForClickUpTask(taskId || subtaskId || effectiveParent)}.`,
+      comment: `Starting task from ${startFrom}. Branch: ${branch}. Worktree: ${worktree}. Validation PR target: ${requiredPullRequest.targetBranch}. Delivery evidence: ${deliveryEvidencePathForClickUpTask(taskId || subtaskId || effectiveParent)}.`,
       description,
       fields: {
         Definition: definitionContent,
         "Story Points": estimate.storyPoints,
         agent_metadata: metadata,
         branch,
-        worktree
+        worktree,
+        pr_target: requiredPullRequest.targetBranch
       },
       definition_doc: {
         parent: normalizeClickUpDefinitionDocParent(definitionDocParent),
@@ -9550,23 +9625,29 @@ function buildClickUpStartTaskPayload({ taskId, taskType = "Tarea", parentTaskId
     }
   };
 }
-function buildClickUpTransitionPayload({ fromStatus, toStatus, validationPassed = false, validationFailed = false, isSubtask = false, reopen = false, assignees = [], removeAssignees = [], productManagerAssignee = "", requireProductManagerAssignee = true, planDescription = "", definition = "", definitionDocParent = CLICKUP_DEFINITION_DOC_PARENT, humansRegistry } = {}) {
+function buildClickUpTransitionPayload({ fromStatus, toStatus, validationPassed = false, validationFailed = false, isSubtask = false, reopen = false, assignees = [], removeAssignees = [], productManagerAssignee = "", requireProductManagerAssignee = true, planDescription = "", definition = "", definitionDocParent = CLICKUP_DEFINITION_DOC_PARENT, humansRegistry, taskId = "", taskType = "Tarea", parentTaskId = "", subtaskId = "", branch = "", parentBranch = "", prUrl = "", prNumber = "", githubRemote = "origin", devBranch = "dev", mainBranch = "main", preproductionProvider = "Vercel", preproductionEnvironment = "preproduction" } = {}) {
   const from = normalizeClickUpStatus(fromStatus);
+  const effectiveIsSubtask = Boolean(isSubtask || isClickUpSubtaskRoute({ taskType, parentTaskId: parentTaskId || taskId, subtaskId, taskId }));
   let to = normalizeClickUpStatus(toStatus);
   if (validationFailed) to = "in progress";
-  if (!to && validationPassed) to = isSubtask ? "completed" : "merge";
+  if (!to && validationPassed) to = effectiveIsSubtask ? "completed" : "merge";
   if ((from === "completed" || from === "closed") && !reopen) {
     return { ok: true, noop: true, dryRun: true, message: "Completed/closed task is a no-op unless reopen is explicit." };
   }
   const key = `${from}->${to}`;
   const rule = CLICKUP_TRANSITIONS.get(key);
   if (!rule) return { ok: false, dryRun: true, message: `Transition not allowed: ${key}` };
-  const assignsFinalApprovers = rule.assignFinalApprovers === true && !(rule.parentOnlyFinalApproval && isSubtask);
+  const assignsFinalApprovers = rule.assignFinalApprovers === true && !(rule.parentOnlyFinalApproval && effectiveIsSubtask);
   const requiresPlanCompletionContract = from === "plan" && to === "in progress";
+  const requiresValidationPullRequest = from === "in progress" && to === "validation";
   const definitionContent = compactMarkdownValue(definition);
   const description = compactMarkdownValue(planDescription);
+  const canDerivePullRequest = Boolean(taskId || branch);
+  const shouldAttachPullRequest = requiresValidationPullRequest || (from === "validation" || to === "merge" || from === "merge") && canDerivePullRequest;
+  const requiredPullRequest = shouldAttachPullRequest && canDerivePullRequest ? deriveClickUpRequiredPullRequest({ taskId, taskType, parentTaskId, subtaskId, branch, parentBranch, devBranch, mainBranch, githubRemote, prUrl, prNumber }) : null;
+  const reviewAutomation = requiredPullRequest ? buildClickUpReviewAutomationPlan({ isSubtask: effectiveIsSubtask, preproductionProvider, preproductionEnvironment }) : null;
   const validationErrors = [];
-  if (rule.parentOnlyFinalApproval && isSubtask) {
+  if (rule.parentOnlyFinalApproval && effectiveIsSubtask) {
     validationErrors.push("Subtasks must not use the parent final-approval transition; merge validated subtasks directly into the parent branch/workspace.");
   }
   if (assignsFinalApprovers && !isRealClickUpAssigneeId(productManagerAssignee) && requireProductManagerAssignee !== false) {
@@ -9576,19 +9657,34 @@ function buildClickUpTransitionPayload({ fromStatus, toStatus, validationPassed
     if (!description) validationErrors.push("planDescription is required for the plan-completion ClickUp task description rewrite.");
     if (!definitionContent) validationErrors.push("definition is required and must contain the complete plan/Definition content at plan completion.");
   }
+  if (requiresValidationPullRequest) {
+    if (!requiredPullRequest) validationErrors.push("taskId or branch is required before moving a ClickUp task to validation.");
+    if (!requiredPullRequest?.sourceBranch) validationErrors.push("branch/sourceBranch is required before moving a ClickUp task to validation.");
+    if (!requiredPullRequest?.targetBranch) validationErrors.push("PR target branch is required before moving a ClickUp task to validation.");
+    if (!requiredPullRequest?.prUrl && !requiredPullRequest?.prNumber) validationErrors.push("An open GitHub pull request URL or number is required before moving a ClickUp task to validation.");
+  }
   if (validationErrors.length > 0) return clickUpPayloadValidationError(validationErrors);
   const finalApprovers = assignsFinalApprovers ? finalApprovalAssignees(CLICKUP_FINAL_APPROVER_ROLES, humansRegistry) : [];
   const explicitRemovals = (removeAssignees || []).filter(Boolean);
   const normalizedProductManagerAssignee = isRealClickUpAssigneeId(productManagerAssignee) ? String(productManagerAssignee).trim() : "";
   const removalTargets = assignsFinalApprovers ? [...new Set([normalizedProductManagerAssignee, ...explicitRemovals].filter(Boolean))] : explicitRemovals;
   const assigned = [...new Set([...assignees || [], ...finalApprovers].filter(Boolean))].filter((assignee) => !removalTargets.includes(assignee));
-  const authority = from === "validation" || to === "merge" ? determineClickUpMergeAuthority({ isSubtask, clickupStatus: to, validationPassed: validationPassed || to === "merge", humansRegistry }) : null;
+  const authority = from === "validation" || to === "merge" ? determineClickUpMergeAuthority({ isSubtask: effectiveIsSubtask, clickupStatus: to, validationPassed: validationPassed || to === "merge", humansRegistry }) : null;
   const fields = authority ? { merge_authority: JSON.stringify(authority) } : {};
+  if (requiredPullRequest) {
+    fields.github_pull_request = JSON.stringify(requiredPullRequest);
+    fields.github_review_automation = JSON.stringify(reviewAutomation);
+  }
   if (definitionContent) fields.Definition = definitionContent;
   return {
     ok: true,
     dryRun: true,
-    transition: { fromStatus: from, toStatus: rule.status, validationPassed, validationFailed, isSubtask },
+    transition: { fromStatus: from, toStatus: rule.status, validationPassed, validationFailed, isSubtask: effectiveIsSubtask },
+    github: requiredPullRequest ? {
+      requiredPullRequest,
+      reviewAutomation
+    } : void 0,
+    vercel: reviewAutomation?.preproduction?.required ? reviewAutomation.preproduction : void 0,
     clickup: {
       status: rule.status,
       assignees: assigned,
@@ -9792,9 +9888,48 @@ function normalizeNonNegativeInteger(value, defaultValue) {
   const number = Number(value);
   return Number.isInteger(number) && number >= 0 ? number : defaultValue;
 }
+function defaultGitHubWebhookPublicUrl(clickupPublicUrl = "") {
+  const raw = String(clickupPublicUrl || "").trim();
+  if (!raw) return "";
+  try {
+    const url = new URL(raw);
+    url.pathname = "/optima/github/webhook";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return raw.replace(/\/optima\/clickup\/webhook\b/, "/optima/github/webhook");
+  }
+}
+function normalizeGitHubWebhookConfig(rawGithub = {}, clickupWebhook = {}) {
+  const github = isPlainObject(rawGithub) ? rawGithub : {};
+  const webhook = isPlainObject(github.webhook) ? github.webhook : {};
+  const enabled = github.enabled === true || webhook.enabled === true;
+  const events = Array.isArray(webhook.events) && webhook.events.length > 0 ? [...new Set(webhook.events.map((event) => String(event || "").trim()).filter(Boolean))] : [...GITHUB_WEBHOOK_EVENTS];
+  const publicUrl = String(webhook.public_url || webhook.publicUrl || github.public_url || github.publicUrl || defaultGitHubWebhookPublicUrl(clickupWebhook.publicUrl)).trim();
+  const secret = String(webhook.secret || github.secret || "").trim();
+  const apiToken = String(github.api_token || github.apiToken || "").trim();
+  const repository = String(github.repository || github.repo || "").trim();
+  const [ownerFromRepo, nameFromRepo] = repository.includes("/") ? repository.split("/", 2) : ["", ""];
+  return {
+    enabled,
+    apiToken,
+    repository,
+    owner: String(github.owner || ownerFromRepo || "").trim(),
+    repo: String(github.repo_name || github.repoName || nameFromRepo || "").trim(),
+    webhook: {
+      enabled,
+      publicUrl,
+      secret,
+      path: publicUrl ? new URL(publicUrl, "http://localhost").pathname : "/optima/github/webhook",
+      events
+    }
+  };
+}
 function normalizeClickUpWebhookConfig(rawClickUp = null, worktree = process.cwd()) {
   const raw = isPlainObject(rawClickUp) ? rawClickUp : {};
   const webhook = isPlainObject(raw.webhook) ? raw.webhook : {};
+  const github = normalizeGitHubWebhookConfig(raw.github, { publicUrl: String(webhook.public_url || webhook.publicUrl || "").trim() });
   const routing = isPlainObject(raw.routing) ? raw.routing : {};
   const opencode = isPlainObject(raw.opencode) ? raw.opencode : {};
   const openchamber = isPlainObject(raw.openchamber) ? raw.openchamber : {};
@@ -9847,6 +9982,7 @@ function normalizeClickUpWebhookConfig(rawClickUp = null, worktree = process.cwd
       },
       events
     },
+    github,
     routing: {
       targetAgent: String(routing.target_agent || routing.targetAgent || "workflow_product_manager").trim(),
       productManagerAssigneeId: String(routing.product_manager_assignee_id || routing.productManagerAssigneeId || "").trim(),
@@ -9868,6 +10004,13 @@ function normalizeClickUpWebhookConfig(rawClickUp = null, worktree = process.cwd
   if (!config.webhook.bindHost) errors.push("clickup.webhook.bind_host is required");
   if (!Number.isInteger(config.webhook.bindPort) || config.webhook.bindPort <= 0) errors.push("clickup.webhook.bind_port must be a positive integer");
   if (!config.webhook.location.list_id && !config.webhook.location.folder_id && !config.webhook.location.space_id) errors.push("one clickup.webhook.location id is required");
+  if (config.github.webhook.enabled) {
+    if (!config.github.webhook.publicUrl) errors.push("clickup.github.webhook.public_url is required when GitHub webhook is enabled");
+    if (!config.github.webhook.secret) errors.push("clickup.github.webhook.secret is required when GitHub webhook is enabled");
+    if (!config.github.webhook.path || config.github.webhook.path === clickUpWebhookExpectedPath(config)) errors.push("clickup.github.webhook.path must be distinct from the ClickUp webhook path");
+    const missingGitHubEvents = GITHUB_WEBHOOK_EVENTS.filter((event) => !config.github.webhook.events.includes(event));
+    if (missingGitHubEvents.length > 0) errors.push(`clickup.github.webhook.events missing: ${missingGitHubEvents.join(", ")}`);
+  }
   if (config.opencode.baseUrl) {
     try {
       new URL(config.opencode.baseUrl);
@@ -9905,6 +10048,8 @@ function sanitizeClickUpWebhookState(state = {}, config = null) {
     listener: isPlainObject(state.listener) ? state.listener : {},
     pendingSessions: isPlainObject(state.pendingSessions) ? state.pendingSessions : {},
     lastWebhookAt: state.lastWebhookAt || state.last_webhook_at || null,
+    githubLastWebhookAt: state.githubLastWebhookAt || state.github_last_webhook_at || null,
+    githubRecentEventKeys: Array.isArray(state.githubRecentEventKeys) ? state.githubRecentEventKeys.slice(-200) : [],
     recentEventKeys
   };
 }
@@ -10021,6 +10166,29 @@ function createClickUpApiClient(config, fetchImpl = globalThis.fetch) {
     }
   };
 }
+function createGitHubApiClient(config = {}, fetchImpl = globalThis.fetch) {
+  const token = resolveSecretReference(config?.apiToken);
+  const owner = String(config?.owner || "").trim();
+  const repo = String(config?.repo || "").trim();
+  const request = async (pathname) => {
+    if (typeof fetchImpl !== "function") throw new Error("fetch is unavailable; inject a GitHub client for live PR lookup");
+    if (!owner || !repo) throw new Error("GitHub repository owner/repo is not configured");
+    const response = await fetchImpl(`https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}${pathname}`, {
+      headers: {
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+        ...token ? { Authorization: `Bearer ${token}` } : {}
+      }
+    });
+    if (!response.ok) throw new Error(`GitHub API request failed: ${response.status}`);
+    return response.json();
+  };
+  return {
+    async getPullRequest(number) {
+      return request(`/pulls/${encodeURIComponent(number)}`);
+    }
+  };
+}
 function createTestClickUpApiClient(config) {
   const metadata = /* @__PURE__ */ new Map();
   return {
@@ -10251,6 +10419,19 @@ function verifyClickUpSignature(rawBody, signatureHeader, secret) {
   const wanted = Buffer.from(expected, "hex");
   return given.length === wanted.length && crypto.timingSafeEqual(given, wanted);
 }
+function verifyGitHubSignature(rawBody, signatureHeader, secret) {
+  return verifyClickUpSignature(rawBody, signatureHeader, secret);
+}
+function gitHubWebhookEventKey({ headers = {}, event = "", payload = {} } = {}) {
+  const delivery = headers["x-github-delivery"] || headers["X-GitHub-Delivery"] || payload.delivery || payload.delivery_id || "";
+  const id = delivery || payload.pull_request?.id || payload.comment?.id || payload.review?.id || payload.issue?.id || "unknown";
+  return ["github", event || headers["x-github-event"] || headers["X-GitHub-Event"] || "event", id].filter(Boolean).join(":");
+}
+function rememberGitHubWebhookEvent(state = {}, eventKey, limit = 200) {
+  const recent = Array.isArray(state.githubRecentEventKeys) ? state.githubRecentEventKeys : [];
+  if (recent.includes(eventKey)) return { duplicate: true, state };
+  return { duplicate: false, state: { ...state, githubRecentEventKeys: [...recent, eventKey].slice(-limit) } };
+}
 async function resyncClickUpWebhookForSignatureDrift({ rawBody, signature, config, state = {}, worktree = process.cwd(), clickupClient, saveState } = {}) {
   const validation = clickUpWebhookValidationFromConfig(config);
   if (!clickupClient?.listWebhooks && !clickupClient?.createWebhook) {
@@ -10457,6 +10638,105 @@ function clickUpTaskAgentMetadata(task = {}, fieldId = "") {
   const field = fields.find((item) => String(item?.id || "") === fieldId || String(item?.name || "") === "agent_metadata");
   return field?.value || "";
 }
+function gitHubWebhookExpectedPath(config = {}) {
+  return config?.github?.webhook?.path || "/optima/github/webhook";
+}
+function gitHubWebhookEnabled(config = {}) {
+  return Boolean(config?.github?.webhook?.enabled && resolveSecretReference(config?.github?.webhook?.secret));
+}
+function clickUpTaskIdFromGitHubBranch(branch = "") {
+  const tail = String(branch || "").trim().split("/").filter(Boolean).at(-1) || "";
+  if (!tail) return "";
+  const subtask = tail.match(/-subtask-(.+)$/);
+  return branchSafeClickUpId(subtask ? subtask[1] : tail);
+}
+async function gitHubPullRequestContextFromPayload(payload = {}, event = "", githubClient = null) {
+  let pr = payload.pull_request || null;
+  if (!pr && event === "issue_comment" && payload.issue?.pull_request && githubClient?.getPullRequest) {
+    pr = await githubClient.getPullRequest(payload.issue.number);
+  }
+  if (!pr) return null;
+  const headRef = String(pr.head?.ref || pr.head_ref || "").trim();
+  const baseRef = String(pr.base?.ref || pr.base_ref || "").trim();
+  return {
+    number: pr.number || payload.issue?.number || "",
+    id: pr.id || "",
+    url: pr.html_url || pr.url || "",
+    title: pr.title || payload.issue?.title || "",
+    state: pr.state || "",
+    merged: pr.merged === true,
+    headRef,
+    baseRef,
+    taskId: clickUpTaskIdFromGitHubBranch(headRef),
+    repository: pr.head?.repo?.full_name || pr.base?.repo?.full_name || payload.repository?.full_name || ""
+  };
+}
+function gitHubWebhookCommentBody(payload = {}) {
+  return String(payload.comment?.body || payload.review?.body || payload.pull_request?.body || "").trim();
+}
+function formatGitHubWebhookPrompt({ event = "", action = "", pr = {}, payload = {}, taskId = "" } = {}) {
+  const sender = payload.sender?.login || payload.comment?.user?.login || payload.review?.user?.login || "unknown";
+  const reviewState = String(payload.review?.state || "").trim();
+  const commentBody = gitHubWebhookCommentBody(payload);
+  const lines = [
+    "[GitHub Webhook Event]",
+    `Event: ${event}`,
+    `Action: ${action || "unknown"}`,
+    `Task ID: ${taskId || pr.taskId || "unknown"}`,
+    `Pull Request: #${pr.number || "unknown"} ${pr.url || ""}`.trim(),
+    `PR Branch: ${pr.headRef || "unknown"} -> ${pr.baseRef || "unknown"}`,
+    `Sender: ${sender}`,
+    reviewState ? `Review State: ${reviewState}` : null,
+    commentBody ? ["", "Comment/Review Body:", commentBody].join("\n") : null,
+    "",
+    "Required handling:",
+    "- Answer human GitHub comments in GitHub.",
+    "- If the comment/review implies a change, reply first with what you will do, move the ClickUp task/subtask to in progress, implement/fix in the same branch, push, return ClickUp to validation, update the PR, and reply again with what changed.",
+    "- If this is an approved parent PR by the configured final approver/CTO, continue the merge-to-dev, Vercel preproduction verification, smoke regression, cleanup, and ClickUp completion workflow.",
+    "- Keep Optima runtime/process failures out of ClickUp comments; use local logs for process noise."
+  ].filter(Boolean);
+  return lines.join("\n");
+}
+function mergeGitHubWebhookMetadata(existingMetadata, { pr = {}, event = "", action = "", delivery = "" } = {}) {
+  const current = normalizeAgentMetadataJson(existingMetadata);
+  const next = {
+    ...current,
+    task: {
+      ...isPlainObject(current.task) ? current.task : {},
+      github: {
+        ...isPlainObject(current.task?.github) ? current.task.github : {},
+        pull_request: Object.fromEntries(Object.entries({
+          number: pr.number || void 0,
+          url: pr.url || void 0,
+          source_branch: pr.headRef || void 0,
+          target_branch: pr.baseRef || void 0,
+          repository: pr.repository || void 0
+        }).filter(([, value]) => value !== void 0 && value !== "")),
+        last_webhook: {
+          event,
+          action,
+          delivery,
+          at: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      }
+    }
+  };
+  return JSON.stringify(sortJsonValue(next), null, 2);
+}
+function summarizeGitHubRouteForLog(result = {}, payload = {}, event = "") {
+  return {
+    taskId: result.taskId || null,
+    event: event || null,
+    eventKey: result.eventKey || null,
+    ok: result.ok === true,
+    action: result.action || null,
+    reason: result.reason || null,
+    sessionId: result.sessionId || null,
+    pullRequest: result.prNumber || payload?.pull_request?.number || payload?.issue?.number || null,
+    branch: result.branch || null,
+    worktree: result.worktree || null
+  };
+}
 function getNestedMetadataValue(metadata, dottedKey) {
   const parts = String(dottedKey || "").split(".").filter(Boolean);
   let cursor = metadata;
@@ -11362,9 +11642,9 @@ function buildClickUpWebhookAuditSummary({ method, url, config, handled, error,
     ok: Boolean(handled?.ok),
     reason: handled?.reason || result.reason || (error ? "handler_error" : void 0),
     action: result.action,
-    event: payload ? clickUpEventType(payload) : void 0,
+    event: result.event || (payload ? clickUpEventType(payload) : void 0),
     task: result.taskId || clickUpTaskIdFromPayload(payload || {}),
-    comment: clickUpCommentFromPayload(payload || {})?.id || payload?.comment_id || payload?.commentId,
+    comment: clickUpCommentFromPayload(payload || {})?.id || payload?.comment_id || payload?.commentId || payload?.comment?.id || payload?.review?.id,
     session: result.sessionId,
     base_path: config?.basePath || "",
     request_file: requestFile || void 0
@@ -11378,7 +11658,13 @@ function writeClickUpWebhookAuditLog({ method, url, headers = {}, rawBody = "",
     if (level === "error" && !failed) return;
     const logDir = clickUpWebhookAuditLogDir();
     fs5.mkdirSync(logDir, { recursive: true });
-    const secretValues = [resolveSecretReference(config?.apiToken), state?.secret, config?.webhook?.secret].filter(Boolean);
+    const secretValues = [
+      resolveSecretReference(config?.apiToken),
+      resolveSecretReference(config?.github?.apiToken),
+      state?.secret,
+      config?.webhook?.secret,
+      resolveSecretReference(config?.github?.webhook?.secret)
+    ].filter(Boolean);
     let requestFile;
     if (level === "verbose") {
       const absoluteRequestFile = clickUpWebhookRequestFilePath(at, logDir);
@@ -11840,6 +12126,176 @@ function runClickUpWebhookRouteInBackground({ payload, config, state, worktree,
   });
   return route;
 }
+async function routeGitHubWebhookEventUnlocked({ payload, event = "", delivery = "", config, state = {}, worktree = process.cwd(), clickupClient, githubClient = null, openCodeClient, sendSessionEvent = sendOpenCodeSessionEvent, verifySessionEventDelivery = verifyOpenCodeSessionEventDelivery } = {}) {
+  const normalizedEvent = String(event || payload?.event || "").trim();
+  const action = String(payload?.action || "").trim();
+  const eventKey = gitHubWebhookEventKey({ headers: { "x-github-delivery": delivery, "x-github-event": normalizedEvent }, event: normalizedEvent, payload });
+  if (!config?.github?.webhook?.events?.includes(normalizedEvent)) {
+    return { ok: true, action: "ignored", reason: "unsupported_event", event: normalizedEvent, eventKey };
+  }
+  let pr;
+  try {
+    pr = await gitHubPullRequestContextFromPayload(payload, normalizedEvent, githubClient);
+  } catch (error) {
+    appendClickUpWebhookLocalLog(worktree, { type: "github_pr_context_failed", event: normalizedEvent, delivery, message: error.message });
+    return { ok: false, action: "error", reason: "pull_request_context_failed", event: normalizedEvent, eventKey, message: error.message };
+  }
+  if (!pr) {
+    appendClickUpWebhookLocalLog(worktree, { type: "github_pr_context_unavailable", event: normalizedEvent, delivery, action });
+    return { ok: true, action: "ignored", reason: "pull_request_context_unavailable", event: normalizedEvent, eventKey };
+  }
+  const taskId = String(pr.taskId || "").trim();
+  if (!taskId) {
+    appendClickUpWebhookLocalLog(worktree, { type: "github_task_id_unavailable", event: normalizedEvent, delivery, prNumber: pr.number || null, headRef: pr.headRef || null });
+    return { ok: false, action: "error", reason: "task_id_unavailable", event: normalizedEvent, eventKey, prNumber: pr.number || null };
+  }
+  const task = payload.task || (clickupClient?.getTask ? await clickupClient.getTask(taskId) : null);
+  if (!task) {
+    appendClickUpWebhookLocalLog(worktree, { type: "github_clickup_task_unavailable", taskId, event: normalizedEvent, delivery, prNumber: pr.number || null });
+    return { ok: false, action: "error", reason: "task_unavailable", taskId, event: normalizedEvent, eventKey, prNumber: pr.number || null };
+  }
+  if (isClickUpTaskTerminal(task, {}, config.routing?.ignoredStatuses)) {
+    return { ok: true, action: "ignored", reason: "terminal_status", taskId, event: normalizedEvent, eventKey, prNumber: pr.number || null };
+  }
+  const existingMetadata = clickUpTaskAgentMetadata(task, config.routing.metadataFieldId);
+  const metadata = normalizeAgentMetadataJson(existingMetadata);
+  const rawSessionId = getNestedMetadataValue(metadata, config.routing.metadataKey) || getNestedMetadataValue(metadata, "optima.sessions.product_manager");
+  const sessionId = typeof rawSessionId === "string" && rawSessionId.startsWith("ses_") ? rawSessionId : "";
+  const directory = String(
+    getNestedMetadataValue(metadata, "task.worktree") || getNestedMetadataValue(metadata, "task.subtask_worktree") || ""
+  ).trim();
+  const branch = String(
+    getNestedMetadataValue(metadata, "task.branch") || getNestedMetadataValue(metadata, "task.subtask_branch") || pr.headRef || ""
+  ).trim();
+  if (!sessionId) {
+    appendClickUpWebhookLocalLog(worktree, { type: "github_session_missing", taskId, event: normalizedEvent, delivery, prNumber: pr.number || null, branch: branch || null });
+    return { ok: false, action: "error", reason: "session_missing", taskId, event: normalizedEvent, eventKey, prNumber: pr.number || null, branch: branch || null };
+  }
+  if (!directory) {
+    appendClickUpWebhookLocalLog(worktree, { type: "github_worktree_missing", taskId, event: normalizedEvent, delivery, sessionId, prNumber: pr.number || null });
+    return { ok: false, action: "error", reason: "worktree_missing", taskId, event: normalizedEvent, eventKey, sessionId, prNumber: pr.number || null, branch: branch || null };
+  }
+  const prompt = formatGitHubWebhookPrompt({ event: normalizedEvent, action, pr, payload, taskId });
+  const nextMetadata = mergeGitHubWebhookMetadata(existingMetadata, { pr, event: normalizedEvent, action, delivery });
+  if (typeof clickupClient?.updateTaskMetadata === "function") {
+    await clickupClient.updateTaskMetadata({ taskId, fieldId: config.routing.metadataFieldId, value: nextMetadata });
+  }
+  const deliveryResult = await deliverClickUpSessionEventWithVerification({
+    openCodeClient,
+    sendSessionEvent,
+    clickupClient,
+    worktree,
+    taskId,
+    sessionId,
+    agent: config.routing.targetAgent,
+    text: prompt,
+    directory,
+    opencodeBaseUrl: config.opencode?.baseUrl,
+    directPrompt: config.opencode?.promptDelivery === "http",
+    directDelivery: "steer",
+    acceptPromptAdmission: config.opencode?.acceptPromptAdmission === true,
+    eventMarkers: [taskId, String(pr.number || ""), normalizedEvent].filter(Boolean),
+    verifySessionEventDelivery,
+    applyBlockerOnFailure: false
+  });
+  if (!deliveryResult.ok) {
+    appendClickUpWebhookLocalLog(worktree, { type: "github_message_delivery_failed", taskId, event: normalizedEvent, delivery, sessionId, prNumber: pr.number || null, reason: deliveryResult.reason || "message_delivery_failed" });
+    return { ...deliveryResult, eventKey, taskId, event: normalizedEvent, prNumber: pr.number || null, branch: branch || pr.headRef || null, worktree: directory };
+  }
+  return {
+    ok: true,
+    action: "github_event_delivered",
+    taskId,
+    sessionId,
+    event: normalizedEvent,
+    eventKey,
+    prNumber: pr.number || null,
+    branch: branch || pr.headRef || null,
+    worktree: directory,
+    deliveryVerification: deliveryResult.verification,
+    deliveryAdmission: deliveryResult.admissionVerification,
+    deliveryFallback: deliveryResult.fallback
+  };
+}
+async function routeGitHubWebhookEvent(options = {}) {
+  let taskId = "";
+  try {
+    const pr = await gitHubPullRequestContextFromPayload(options.payload || {}, options.event || "", options.githubClient || null);
+    taskId = pr?.taskId || "";
+  } catch {
+    taskId = "";
+  }
+  return withClickUpTaskRouteLock(taskId, () => routeGitHubWebhookEventUnlocked(options));
+}
+function runGitHubWebhookRouteInBackground({ payload, event, delivery, config, state, worktree, clickupClient, githubClient, openCodeClient, sendSessionEvent, verifySessionEventDelivery } = {}) {
+  const eventKey = gitHubWebhookEventKey({ headers: { "x-github-delivery": delivery, "x-github-event": event }, event, payload });
+  appendClickUpWebhookLocalLog(worktree, { type: "github_webhook_route_started", event, eventKey, async: true, delivery: delivery || null });
+  const route = Promise.resolve().then(() => routeGitHubWebhookEvent({ payload, event, delivery, config, state, worktree, clickupClient, githubClient, openCodeClient, sendSessionEvent, verifySessionEventDelivery })).then((result) => {
+    appendClickUpWebhookLocalLog(worktree, { type: "github_webhook_route_finished", async: true, ...summarizeGitHubRouteForLog(result, payload, event) });
+    return result;
+  }).catch((error) => {
+    appendClickUpWebhookLocalLog(worktree, { type: "github_webhook_route_failed", event, eventKey, async: true, delivery: delivery || null, message: error.message });
+    return { ok: false, action: "error", reason: "background_route_failed", message: error.message };
+  });
+  route.catch(() => {
+  });
+  return route;
+}
+async function handleGitHubWebhookRequest({ method = "POST", url = null, headers = {}, rawBody = "", config, state, worktree, clickupClient, githubClient = null, openCodeClient, saveState, now = () => /* @__PURE__ */ new Date(), sendSessionEvent, verifySessionEventDelivery, asyncRouting = false } = {}) {
+  let payload = null;
+  let handled = null;
+  let authenticatedWebhook = false;
+  let receivedAt = null;
+  let latestPersistedState = state;
+  const persistState = (nextState) => {
+    latestPersistedState = nextState;
+    if (saveState) saveState(nextState);
+  };
+  const finish = (result) => {
+    handled = result;
+    receivedAt ??= now();
+    const auditState = authenticatedWebhook ? { ...latestPersistedState, githubLastWebhookAt: receivedAt.toISOString() } : latestPersistedState;
+    if (saveState && authenticatedWebhook) persistState(auditState);
+    writeClickUpWebhookAuditLog({ method, url, headers, rawBody, config, state: auditState, handled, payload, at: receivedAt });
+    return result;
+  };
+  try {
+    if (method !== "POST") return finish({ ok: false, status: 405, reason: "method_not_allowed" });
+    if (url !== null) {
+      const requestPath = new URL(String(url), config?.github?.webhook?.publicUrl || config?.webhook?.publicUrl || "http://localhost").pathname;
+      if (requestPath !== gitHubWebhookExpectedPath(config)) return finish({ ok: false, status: 404, reason: "wrong_path" });
+    }
+    if (!gitHubWebhookEnabled(config)) return finish({ ok: false, status: 404, reason: "github_webhook_disabled" });
+    const maxBodyBytes = Number(config?.webhook?.maxBodyBytes || CLICKUP_WEBHOOK_MAX_BODY_BYTES);
+    const bodyBytes = Buffer.isBuffer(rawBody) ? rawBody.length : Buffer.byteLength(String(rawBody || ""));
+    if (bodyBytes > maxBodyBytes) return finish({ ok: false, status: 413, reason: "body_too_large" });
+    const signature = headers["x-hub-signature-256"] || headers["X-Hub-Signature-256"];
+    const secret = resolveSecretReference(config.github.webhook.secret);
+    if (!verifyGitHubSignature(rawBody, signature, secret)) return finish({ ok: false, status: 401, reason: "invalid_signature" });
+    authenticatedWebhook = true;
+    receivedAt = now();
+    try {
+      payload = JSON.parse(Buffer.isBuffer(rawBody) ? rawBody.toString("utf8") : String(rawBody));
+    } catch {
+      return finish({ ok: false, status: 400, reason: "invalid_json" });
+    }
+    const event = String(headers["x-github-event"] || headers["X-GitHub-Event"] || "").trim();
+    const delivery = String(headers["x-github-delivery"] || headers["X-GitHub-Delivery"] || "").trim();
+    const eventKey = gitHubWebhookEventKey({ headers, event, payload });
+    const remembered = rememberGitHubWebhookEvent({ ...state, githubLastWebhookAt: receivedAt.toISOString() }, eventKey);
+    persistState(remembered.state);
+    if (remembered.duplicate) return finish({ ok: true, status: 200, reason: "duplicate_event", result: { action: "ignored", reason: "duplicate", event, eventKey } });
+    if (asyncRouting) {
+      runGitHubWebhookRouteInBackground({ payload, event, delivery, config, state: remembered.state, worktree, clickupClient, githubClient, openCodeClient, sendSessionEvent, verifySessionEventDelivery });
+      return finish({ ok: true, status: 200, reason: "accepted", result: { action: "accepted", event, eventKey } });
+    }
+    const result = await routeGitHubWebhookEvent({ payload, event, delivery, config, state: remembered.state, worktree, clickupClient, githubClient, openCodeClient, sendSessionEvent, verifySessionEventDelivery });
+    return finish({ ok: result.ok, status: result.ok ? 200 : 422, result });
+  } catch (error) {
+    writeClickUpWebhookAuditLog({ method, url, headers, rawBody, config, state, handled, error, payload, at: now() });
+    throw error;
+  }
+}
 async function handleClickUpWebhookRequest({ method = "POST", url = null, headers = {}, rawBody = "", config, state, worktree, clickupClient, openCodeClient, saveState, now = () => /* @__PURE__ */ new Date(), sessionExists, createSession, sendSessionEvent, ensureTaskWorktree, verifySessionEventDelivery, asyncRouting = false } = {}) {
   let payload = null;
   let handled = null;
@@ -11902,13 +12358,17 @@ function clickUpListenerFingerprint({ config, state, worktree, clickupClient, op
     teamId: config?.teamId || "",
     publicUrl: config?.webhook?.publicUrl || "",
     path: clickUpWebhookExpectedPath(config),
+    githubPublicUrl: config?.github?.webhook?.publicUrl || "",
+    githubPath: gitHubWebhookExpectedPath(config),
+    githubEnabled: gitHubWebhookEnabled(config),
+    githubEvents: config?.github?.webhook?.events || [],
     location: config?.webhook?.location || {},
     webhookId: state?.webhookId || "",
     secret: state?.secret || "",
     events: config?.webhook?.events || []
   });
 }
-function startClickUpWebhookListener({ config, state, worktree, clickupClient, openCodeClient, listenerRegistry = activeClickUpWebhookListeners } = {}) {
+function startClickUpWebhookListener({ config, state, worktree, clickupClient, githubClient = null, openCodeClient, listenerRegistry = activeClickUpWebhookListeners } = {}) {
   if (!isClickUpWebhookStateActive(state, config)) return { active: false, ready: false, reason: "inactive_state" };
   const key = clickUpListenerKey(config);
   const fingerprint = clickUpListenerFingerprint({ config, state, worktree, clickupClient, openCodeClient });
@@ -11927,7 +12387,9 @@ function startClickUpWebhookListener({ config, state, worktree, clickupClient, o
       return;
     }
     const requestPath = new URL(req.url || "/", config.webhook.publicUrl).pathname;
-    if (requestPath !== clickUpWebhookExpectedPath(config)) {
+    const isClickUpPath = requestPath === clickUpWebhookExpectedPath(config);
+    const isGitHubPath = gitHubWebhookEnabled(config) && requestPath === gitHubWebhookExpectedPath(config);
+    if (!isClickUpPath && !isGitHubPath) {
       res.writeHead(404, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ ok: false, reason: "wrong_path" }));
       return;
@@ -11954,7 +12416,7 @@ function startClickUpWebhookListener({ config, state, worktree, clickupClient, o
       if (overflow || res.writableEnded) return;
       const latestState = readClickUpWebhookState(worktree, config);
       try {
-        const handled = await handleClickUpWebhookRequest({
+        const common = {
           method: req.method,
           url: req.url,
           headers: req.headers,
@@ -11966,7 +12428,8 @@ function startClickUpWebhookListener({ config, state, worktree, clickupClient, o
           openCodeClient,
           saveState: (nextState) => writeClickUpWebhookState(worktree, nextState, config),
           asyncRouting: true
-        });
+        };
+        const handled = isGitHubPath ? await handleGitHubWebhookRequest({ ...common, githubClient }) : await handleClickUpWebhookRequest(common);
         res.writeHead(handled.status, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ ok: handled.ok, reason: handled.reason, result: handled.result?.action }));
       } catch (error) {
@@ -13084,6 +13547,7 @@ async function OptimaPlugin(input = {}, pluginOptions = {}) {
   const operatingTeamMode = getOperatingTeamMode(repoCfg);
   const clickUpWebhookValidation = normalizeClickUpWebhookConfig(pickConfiguredClickUp(input, repoCfg, resolvedPluginOptions), worktree);
   const runtimeClickUpClient = input.clickupClient || (clickUpWebhookValidation.config?.test === true ? createTestClickUpApiClient(clickUpWebhookValidation.config) : createClickUpApiClient(clickUpWebhookValidation.config, input.fetch));
+  const runtimeGitHubClient = input.githubClient || (clickUpWebhookValidation.config?.github?.webhook?.enabled === true ? createGitHubApiClient(clickUpWebhookValidation.config.github, input.fetch) : null);
   let clickUpWebhookRuntime = { active: false, valid: false, reason: "not_configured" };
   if (clickUpWebhookValidation.complete) {
     try {
@@ -13108,6 +13572,7 @@ async function OptimaPlugin(input = {}, pluginOptions = {}) {
         state: listenerState,
         worktree,
         clickupClient: lifecycleClickUpClient,
+        githubClient: runtimeGitHubClient,
         openCodeClient: input.client,
         listenerRegistry
       });
@@ -13783,7 +14248,7 @@ Follow-up: use optima_prompt_workflow with session_id '${sessionId}' to check in
     }
   };
 }
-OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, BUNDLE_ASSETS_DIR, CLICKUP_DEFINITION_DOC_PARENT, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentLedgerKey, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, compactPromptPath, createClickUpApiClient, createTestClickUpApiClient, createOpenCodeSession, createOpenCodeSessionControl, deliveryEvidencePathForClickUpTask, ensureClickUpTaskWorktree, ensureClickUpTaskWorktreeForWebhook, ensureClickUpTaskWorktreeOpenChamber, ensureClickUpWebhookSubscription, handleClickUpWebhookRequest, inspectOpenCodeSessionActivity, isClickUpDerivedWorktreeSibling, isClickUpSubtaskRoute, isClickUpWebhookStateActive, isSameOrNestedPath, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, normalizeOpenCodeBaseUrl, openCodeSessionExists, promptOpenCodeSessionControl, probeOpenCodeSessionControl, readClickUpCommentLedger, readClickUpWebhookState, readOpenCodeSessionControl, readOpenCodeSessionMessages, reconcileClickUpStartup, registerOpenChamberClickUpWorktree, scheduleClickUpAssignmentWatchdog, scheduleClickUpStartupReconciliation, syncOpenChamberWorktreeVisibility, waitForOpenCodeReadiness, recordClickUpCommentVersionProcessed, resyncClickUpWebhookForSignatureDrift, resolveIncludeFile, resolveIncludes, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, sendOpenCodeSessionEventDirect, summarizeOpenCodeMessages, verifyOpenCodeSessionEventDelivery, stableClickUpCommentVersionMarker, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatRepairResult, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, optimaRepairDependencies, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, planOptimaRepair, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
+OptimaPlugin.__internals = { BUNDLE_AGENTS_DIR, BUNDLE_ASSETS_DIR, CLICKUP_DEFINITION_DOC_PARENT, activeClickUpWebhookLifecycleRegistry, cleanupManagedClickUpWebhook, deleteClickUpWebhookBestEffort, BUNDLE_POLICIES_DIR, buildClickUpApplyPayloadResult, buildClickUpCreateSubtasksPayload, buildClickUpReviewAutomationPlan, buildClickUpStartTaskPayload, buildClickUpSummaryPayload, buildClickUpTransitionPayload, buildOptimaAgents, clickUpCommentLedgerKey, clickUpCommentMentionsProductManager, clickUpWebhookAuditLogDir, clickUpWebhookAuditLogPath, compactPromptPath, createClickUpApiClient, createGitHubApiClient, createTestClickUpApiClient, createOpenCodeSession, createOpenCodeSessionControl, deliveryEvidencePathForClickUpTask, ensureClickUpTaskWorktree, ensureClickUpTaskWorktreeForWebhook, ensureClickUpTaskWorktreeOpenChamber, ensureClickUpWebhookSubscription, gitHubPullRequestContextFromPayload, gitHubWebhookExpectedPath, handleClickUpWebhookRequest, handleGitHubWebhookRequest, inspectOpenCodeSessionActivity, isClickUpDerivedWorktreeSibling, isClickUpSubtaskRoute, isClickUpWebhookStateActive, isSameOrNestedPath, normalizeClickUpWebhookConfig, normalizeClickUpWebhookLogLevel, normalizeOpenCodeBaseUrl, openCodeSessionExists, promptOpenCodeSessionControl, probeOpenCodeSessionControl, readClickUpCommentLedger, readClickUpWebhookState, readOpenCodeSessionControl, readOpenCodeSessionMessages, reconcileClickUpStartup, registerOpenChamberClickUpWorktree, routeGitHubWebhookEvent, scheduleClickUpAssignmentWatchdog, scheduleClickUpStartupReconciliation, syncOpenChamberWorktreeVisibility, waitForOpenCodeReadiness, recordClickUpCommentVersionProcessed, resyncClickUpWebhookForSignatureDrift, resolveIncludeFile, resolveIncludes, resolveOptimaPluginOptions, resolveSecretReference, routeClickUpWebhookEvent, sendOpenCodeSessionEvent, sendOpenCodeSessionEventDirect, summarizeOpenCodeMessages, verifyOpenCodeSessionEventDelivery, stableClickUpCommentVersionMarker, startClickUpWebhookListener, validateClickUpWebhookState, verifyClickUpSignature, verifyGitHubSignature, writeClickUpWebhookState, decideClickUpStatusAction, deriveClickUpBranchName, deriveClickUpPendingSubtaskBranch, deriveClickUpPrTarget, deriveClickUpRequiredPullRequest, deriveClickUpWorktree, determineClickUpMergeAuthority, ensureOptimaGitignoreRules, explicitSafeInputWorktree, finalApprovalAssignees, formatRepairResult, formatValidationResult, isIgnoredClickUpTaskType, isOptimaPluginPackageWorktree, isSafeWritableDirectory, loadHumansRegistry, mergeClickUpAgentMetadata, mergeClickUpSessionMetadata, migrateLegacyOptimaLayout, normalizeAgentMetadataJson, normalizeClickUpStatus, normalizeClickUpTaskType, normalizePromptResponseParts, normalizeWorkflowTaskPath, optimaRepairDependencies, parseClickUpSubtasksMarkdown, parseHumansRegistry, parseMarkdownArtifact, parseMarkdownSections, planOptimaRepair, preEstimateClickUpWork, readMarkdownArtifact, resolveHumanRoles, resolveSafeWorktree, safeWorktreeOrFailure, stripRawLogSections, validateMainWorkspaceBranchSafety, workflowFinalMessageFromPromptResponse };
 
 // src/sanitize_cli.js
 var { migrateLegacyOptimaLayout: migrateLegacyOptimaLayout2 } = OptimaPlugin.__internals;