@defend-tech/opencode-optima 0.1.74 → 0.1.75

package/dist/sanitize_cli.js

@@ -8635,6 +8635,8 @@ var activeClickUpWebhookListeners = /* @__PURE__ */ new Map();
 var activeClickUpWebhookLifecycleRegistry = /* @__PURE__ */ new Map();
 var activeClickUpTaskRoutes = /* @__PURE__ */ new Map();
 var GITHUB_WEBHOOK_EVENTS = ["pull_request", "pull_request_review", "pull_request_review_comment", "issue_comment"];
+var OPTIMA_GITHUB_COMMITTER_NAME = "Optima Product Manager";
+var OPTIMA_GITHUB_COMMITTER_EMAIL = "optima-product-manager[bot]@users.noreply.github.com";
 function isRootDirectory(candidate) {
   const resolved = path6.resolve(candidate);
   return resolved === path6.parse(resolved).root;
@@ -9295,6 +9297,40 @@ function addClickUpWorktreeForBranch({ baseWorktree, branch, worktreePath, start
     runGitFn(baseWorktree, ["worktree", "add", "-b", branch, worktreePath, startPoint]);
   }
 }
+function normalizeOptimaGitIdentity(identity = {}) {
+  return {
+    name: String(identity.name || OPTIMA_GITHUB_COMMITTER_NAME).trim(),
+    email: String(identity.email || OPTIMA_GITHUB_COMMITTER_EMAIL).trim(),
+    sign: identity.sign === true,
+    signingKey: String(identity.signingKey || identity.signing_key || "").trim(),
+    signingKeyFile: String(identity.signingKeyFile || identity.signing_key_file || "").trim(),
+    signingFormat: String(identity.signingFormat || identity.signing_format || "ssh").trim().toLowerCase()
+  };
+}
+function configureOptimaWorktreeGitIdentity({ worktreePath, identity = {}, runGitFn = runGit } = {}) {
+  if (!worktreePath || !fs5.existsSync(worktreePath)) return { configured: false, reason: "worktree_missing" };
+  const normalized = normalizeOptimaGitIdentity(identity);
+  if (!normalized.name || !normalized.email) return { configured: false, reason: "identity_missing" };
+  try {
+    runGitFn(worktreePath, ["config", "user.name", normalized.name]);
+    runGitFn(worktreePath, ["config", "user.email", normalized.email]);
+  } catch (error) {
+    return { configured: false, reason: "git_config_failed", message: error.message };
+  }
+  let signingKey = normalized.signingKey;
+  if (!signingKey && normalized.signingKeyFile) signingKey = expandHomePath(normalized.signingKeyFile);
+  if (normalized.sign) {
+    if (!signingKey) return { configured: false, reason: "signing_key_missing", name: normalized.name, email: normalized.email, sign: true };
+    try {
+      runGitFn(worktreePath, ["config", "commit.gpgsign", "true"]);
+      runGitFn(worktreePath, ["config", "gpg.format", normalized.signingFormat || "ssh"]);
+      runGitFn(worktreePath, ["config", "user.signingkey", signingKey]);
+    } catch (error) {
+      return { configured: false, reason: "git_signing_config_failed", message: error.message, name: normalized.name, email: normalized.email, sign: true };
+    }
+  }
+  return { configured: true, name: normalized.name, email: normalized.email, sign: normalized.sign, signingFormat: normalized.signingFormat, signingKeyConfigured: Boolean(signingKey) };
+}
 function clickUpOpenChamberWorktreeName(branch = "") {
   return String(branch || "").trim().replace(/\//g, "-");
 }
@@ -9445,7 +9481,7 @@ async function registerOpenChamberClickUpWorktree({ openchamberBaseUrl, opencode
   const visibility = await syncOpenChamberWorktreeVisibility({ openchamberBaseUrl: openchamberBaseUrl || baseUrl, opencodeBaseUrl: opencodeBaseUrl || baseUrl, baseWorktree, worktreePath, branch, fetchImpl });
   return { branch, worktree: path6.resolve(worktreePath), reused: true, provider: "openchamber", openChamber: { source, visibility } };
 }
-async function ensureClickUpTaskWorktreeOpenChamber({ baseWorktree = "", taskId, taskType = "Tarea", parentTaskId = "", subtaskId = "", existingMetadata = {}, runGitFn = runGit, openchamberBaseUrl = "", opencodeBaseUrl = "", baseUrl = "", fetchImpl = globalThis.fetch, log = null } = {}) {
+async function ensureClickUpTaskWorktreeOpenChamber({ baseWorktree = "", taskId, taskType = "Tarea", parentTaskId = "", subtaskId = "", existingMetadata = {}, runGitFn = runGit, openchamberBaseUrl = "", opencodeBaseUrl = "", baseUrl = "", fetchImpl = globalThis.fetch, log = null, gitIdentity = {} } = {}) {
   const effectiveOpenChamberBaseUrl = openchamberBaseUrl || baseUrl;
   const effectiveOpenCodeBaseUrl = opencodeBaseUrl || baseUrl;
   const effectiveParent = parentTaskId || taskId;
@@ -9456,27 +9492,33 @@ async function ensureClickUpTaskWorktreeOpenChamber({ baseWorktree = "", taskId,
   const existing = safeExistingClickUpWorktree({ metadata: existingMetadata, branch });
   if (existing) {
     const registered = await registerOpenChamberClickUpWorktree({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, opencodeBaseUrl: effectiveOpenCodeBaseUrl, baseWorktree, branch, worktreePath: existing.worktree, fetchImpl, source: "metadata_reuse" });
+    const identity2 = configureOptimaWorktreeGitIdentity({ worktreePath: registered.worktree, identity: gitIdentity, runGitFn });
     log?.({ type: "openchamber_worktree_registered", taskId, branch, worktree: registered.worktree, source: "metadata_reuse", visibility: registered.openChamber.visibility });
-    return { ...registered, parentBranch: parentBranch || void 0, prTarget };
+    return { ...registered, parentBranch: parentBranch || void 0, prTarget, gitIdentity: identity2 };
   }
   const worktreePath = deriveClickUpWorktree({ baseWorktree, taskId, taskType, parentTaskId: effectiveParent, subtaskId });
   if (fs5.existsSync(worktreePath)) {
     const registered = await registerOpenChamberClickUpWorktree({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, opencodeBaseUrl: effectiveOpenCodeBaseUrl, baseWorktree, branch, worktreePath, fetchImpl, source: "existing_directory" });
+    const identity2 = configureOptimaWorktreeGitIdentity({ worktreePath: registered.worktree, identity: gitIdentity, runGitFn });
     log?.({ type: "openchamber_worktree_registered", taskId, branch, worktree: registered.worktree, source: "existing_directory", visibility: registered.openChamber.visibility });
-    return { ...registered, parentBranch: parentBranch || void 0, prTarget };
+    return { ...registered, parentBranch: parentBranch || void 0, prTarget, gitIdentity: identity2 };
   }
   let parentBootstrap = null;
   if (isSubtask) {
     const parentWorktree = deriveClickUpWorktree({ baseWorktree, taskId: effectiveParent, taskType, parentTaskId: effectiveParent });
     if (fs5.existsSync(parentWorktree)) {
       const registeredParent = await registerOpenChamberClickUpWorktree({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, opencodeBaseUrl: effectiveOpenCodeBaseUrl, baseWorktree, branch: parentBranch, worktreePath: parentWorktree, fetchImpl, source: "parent_existing_directory" });
+      const parentIdentity = configureOptimaWorktreeGitIdentity({ worktreePath: registeredParent.worktree, identity: gitIdentity, runGitFn });
       parentBootstrap = { branch: parentBranch, worktree: registeredParent.worktree, reused: true, provider: "openchamber", visibility: registeredParent.openChamber.visibility };
+      if (parentIdentity.configured) parentBootstrap.gitIdentity = parentIdentity;
     } else {
       const parentStartPoint = resolveClickUpDevStartPoint(baseWorktree, runGitFn);
       const parentBranchExists = clickUpGitRefExists(baseWorktree, parentBranch, runGitFn);
       const createdParent = await createOpenChamberClickUpWorktree({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, baseWorktree, branch: parentBranch, worktreePath: parentWorktree, startPoint: parentStartPoint, branchExists: parentBranchExists, fetchImpl });
       const parentVisibility = await syncOpenChamberWorktreeVisibility({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, opencodeBaseUrl: effectiveOpenCodeBaseUrl, baseWorktree, worktreePath: createdParent.worktree, branch: parentBranch, fetchImpl });
       parentBootstrap = { branch: parentBranch, worktree: createdParent.worktree, startPoint: parentBranchExists ? parentBranch : parentStartPoint, reused: parentBranchExists, provider: "openchamber", visibility: parentVisibility };
+      const parentIdentity = configureOptimaWorktreeGitIdentity({ worktreePath: parentBootstrap.worktree, identity: gitIdentity, runGitFn });
+      if (parentIdentity.configured) parentBootstrap.gitIdentity = parentIdentity;
       log?.({ type: "openchamber_worktree_created", taskId: effectiveParent, branch: parentBranch, worktree: parentBootstrap.worktree, startPoint: parentBootstrap.startPoint, visibility: parentVisibility });
     }
   }
@@ -9484,8 +9526,9 @@ async function ensureClickUpTaskWorktreeOpenChamber({ baseWorktree = "", taskId,
   const branchExists = clickUpGitRefExists(baseWorktree, branch, runGitFn);
   const created = await createOpenChamberClickUpWorktree({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, baseWorktree, branch, worktreePath, startPoint, branchExists, fetchImpl });
   const visibility = await syncOpenChamberWorktreeVisibility({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, opencodeBaseUrl: effectiveOpenCodeBaseUrl, baseWorktree, worktreePath: created.worktree, branch, fetchImpl });
+  const identity = configureOptimaWorktreeGitIdentity({ worktreePath: created.worktree, identity: gitIdentity, runGitFn });
   log?.({ type: "openchamber_worktree_created", taskId, branch, worktree: created.worktree, startPoint: branchExists ? branch : startPoint, visibility });
-  return { branch, worktree: created.worktree, reused: false, startPoint, parentBranch: parentBranch || void 0, prTarget, parentBootstrap: parentBootstrap || void 0, provider: "openchamber", openChamber: { source: "created", visibility } };
+  return { branch, worktree: created.worktree, reused: false, startPoint, parentBranch: parentBranch || void 0, prTarget, parentBootstrap: parentBootstrap || void 0, provider: "openchamber", openChamber: { source: "created", visibility }, gitIdentity: identity };
 }
 async function ensureClickUpTaskWorktreeForWebhook({ opencodeBaseUrl = "", opencodeBaseUrlConfigured = false, openchamberBaseUrl = "", openchamberBaseUrlConfigured = false, clickupClient = null, webhookWorktree = process.cwd(), fetchImpl = globalThis.fetch, ...options } = {}) {
   void opencodeBaseUrlConfigured;
@@ -9498,15 +9541,18 @@ async function ensureClickUpTaskWorktreeForWebhook({ opencodeBaseUrl = "", openc
     throw new Error(message);
   }
 }
-function ensureClickUpTaskWorktree({ baseWorktree = "", taskId, taskType = "Tarea", parentTaskId = "", subtaskId = "", existingMetadata = {}, runGitFn = runGit, allowNonGitFallback = false } = {}) {
+function ensureClickUpTaskWorktree({ baseWorktree = "", taskId, taskType = "Tarea", parentTaskId = "", subtaskId = "", existingMetadata = {}, runGitFn = runGit, allowNonGitFallback = false, gitIdentity = {} } = {}) {
   const effectiveParent = parentTaskId || taskId;
   const isSubtask = isClickUpSubtaskRoute({ taskType, parentTaskId: effectiveParent, subtaskId, taskId });
   const parentBranch = isSubtask ? deriveClickUpBranchName({ taskType, parentTaskId: effectiveParent }) : "";
   const branch = deriveClickUpBranchName({ taskType, parentTaskId: effectiveParent, subtaskId, taskId });
   const existing = safeExistingClickUpWorktree({ metadata: existingMetadata, branch });
-  if (existing) return { ...existing, branch, parentBranch: parentBranch || void 0, prTarget: parentBranch || "dev" };
+  if (existing) return { ...existing, branch, parentBranch: parentBranch || void 0, prTarget: parentBranch || "dev", gitIdentity: configureOptimaWorktreeGitIdentity({ worktreePath: existing.worktree, identity: gitIdentity, runGitFn }) };
   const worktreePath = deriveClickUpWorktree({ baseWorktree, taskId, taskType, parentTaskId: effectiveParent, subtaskId });
-  if (fs5.existsSync(worktreePath)) return { branch, worktree: path6.resolve(worktreePath), reused: true, parentBranch: parentBranch || void 0, prTarget: parentBranch || "dev" };
+  if (fs5.existsSync(worktreePath)) {
+    const resolvedWorktree2 = path6.resolve(worktreePath);
+    return { branch, worktree: resolvedWorktree2, reused: true, parentBranch: parentBranch || void 0, prTarget: parentBranch || "dev", gitIdentity: configureOptimaWorktreeGitIdentity({ worktreePath: resolvedWorktree2, identity: gitIdentity, runGitFn }) };
+  }
   if (allowNonGitFallback) {
     fs5.mkdirSync(worktreePath, { recursive: true });
     return { branch, worktree: path6.resolve(worktreePath), reused: false, fallback: "non_git", parentBranch: parentBranch || void 0, prTarget: parentBranch || "dev", startPoint: parentBranch || "dev" };
@@ -9519,13 +9565,18 @@ function ensureClickUpTaskWorktree({ baseWorktree = "", taskId, taskType = "Tare
       const parentBranchExists = clickUpGitRefExists(baseWorktree, parentBranch, runGitFn);
       addClickUpWorktreeForBranch({ baseWorktree, branch: parentBranch, worktreePath: parentWorktree, startPoint: parentStartPoint, runGitFn });
       parentBootstrap = { branch: parentBranch, worktree: path6.resolve(parentWorktree), startPoint: parentBranchExists ? parentBranch : parentStartPoint, reused: parentBranchExists };
+      const parentIdentity = configureOptimaWorktreeGitIdentity({ worktreePath: parentBootstrap.worktree, identity: gitIdentity, runGitFn });
+      if (parentIdentity.configured) parentBootstrap.gitIdentity = parentIdentity;
     } else {
       parentBootstrap = { branch: parentBranch, worktree: path6.resolve(parentWorktree), reused: true };
+      const parentIdentity = configureOptimaWorktreeGitIdentity({ worktreePath: parentBootstrap.worktree, identity: gitIdentity, runGitFn });
+      if (parentIdentity.configured) parentBootstrap.gitIdentity = parentIdentity;
     }
   }
   const startPoint = isSubtask ? parentBranch : resolveClickUpDevStartPoint(baseWorktree, runGitFn);
   addClickUpWorktreeForBranch({ baseWorktree, branch, worktreePath, startPoint, runGitFn });
-  return { branch, worktree: path6.resolve(worktreePath), reused: false, startPoint, parentBranch: parentBranch || void 0, prTarget: parentBranch || "dev", parentBootstrap: parentBootstrap || void 0 };
+  const resolvedWorktree = path6.resolve(worktreePath);
+  return { branch, worktree: resolvedWorktree, reused: false, startPoint, parentBranch: parentBranch || void 0, prTarget: parentBranch || "dev", parentBootstrap: parentBootstrap || void 0, gitIdentity: configureOptimaWorktreeGitIdentity({ worktreePath: resolvedWorktree, identity: gitIdentity, runGitFn }) };
 }
 function normalizeClickUpDefinitionDocParent(parent = {}) {
   const docId = String(parent.doc_id || parent.docId || CLICKUP_DEFINITION_DOC_PARENT.doc_id).trim();
@@ -9904,6 +9955,8 @@ function defaultGitHubWebhookPublicUrl(clickupPublicUrl = "") {
 function normalizeGitHubWebhookConfig(rawGithub = {}, clickupWebhook = {}) {
   const github = isPlainObject(rawGithub) ? rawGithub : {};
   const webhook = isPlainObject(github.webhook) ? github.webhook : {};
+  const app = isPlainObject(github.app) ? github.app : {};
+  const committer = isPlainObject(github.committer) ? github.committer : {};
   const enabled = github.enabled === true || webhook.enabled === true;
   const events = Array.isArray(webhook.events) && webhook.events.length > 0 ? [...new Set(webhook.events.map((event) => String(event || "").trim()).filter(Boolean))] : [...GITHUB_WEBHOOK_EVENTS];
   const publicUrl = String(webhook.public_url || webhook.publicUrl || github.public_url || github.publicUrl || defaultGitHubWebhookPublicUrl(clickupWebhook.publicUrl)).trim();
@@ -9917,6 +9970,21 @@ function normalizeGitHubWebhookConfig(rawGithub = {}, clickupWebhook = {}) {
     repository,
     owner: String(github.owner || ownerFromRepo || "").trim(),
     repo: String(github.repo_name || github.repoName || nameFromRepo || "").trim(),
+    app: {
+      enabled: github.app_enabled === true || github.appEnabled === true || app.enabled === true,
+      appId: String(app.app_id || app.appId || github.app_id || github.appId || "").trim(),
+      installationId: String(app.installation_id || app.installationId || github.installation_id || github.installationId || "").trim(),
+      privateKey: String(app.private_key || app.privateKey || github.private_key || github.privateKey || "").trim(),
+      privateKeyFile: String(app.private_key_file || app.privateKeyFile || github.private_key_file || github.privateKeyFile || "").trim()
+    },
+    committer: {
+      name: String(committer.name || github.committer_name || github.committerName || OPTIMA_GITHUB_COMMITTER_NAME).trim(),
+      email: String(committer.email || github.committer_email || github.committerEmail || OPTIMA_GITHUB_COMMITTER_EMAIL).trim(),
+      sign: committer.sign === true || github.committer_sign === true || github.committerSign === true,
+      signingKey: String(committer.signing_key || committer.signingKey || github.signing_key || github.signingKey || "").trim(),
+      signingKeyFile: String(committer.signing_key_file || committer.signingKeyFile || github.signing_key_file || github.signingKeyFile || "").trim(),
+      signingFormat: String(committer.signing_format || committer.signingFormat || github.signing_format || github.signingFormat || "ssh").trim().toLowerCase()
+    },
     webhook: {
       enabled,
       publicUrl,
@@ -10011,6 +10079,11 @@ function normalizeClickUpWebhookConfig(rawClickUp = null, worktree = process.cwd
     const missingGitHubEvents = GITHUB_WEBHOOK_EVENTS.filter((event) => !config.github.webhook.events.includes(event));
     if (missingGitHubEvents.length > 0) errors.push(`clickup.github.webhook.events missing: ${missingGitHubEvents.join(", ")}`);
   }
+  if (config.github.app.enabled) {
+    if (!config.github.app.appId) errors.push("clickup.github.app.app_id is required when GitHub App auth is enabled");
+    if (!config.github.app.installationId) errors.push("clickup.github.app.installation_id is required when GitHub App auth is enabled");
+    if (!config.github.app.privateKey && !config.github.app.privateKeyFile) errors.push("clickup.github.app.private_key_file is required when GitHub App auth is enabled");
+  }
   if (config.opencode.baseUrl) {
     try {
       new URL(config.opencode.baseUrl);
@@ -10166,26 +10239,209 @@ function createClickUpApiClient(config, fetchImpl = globalThis.fetch) {
     }
   };
 }
+function base64UrlJson(value) {
+  return Buffer.from(JSON.stringify(value)).toString("base64url");
+}
+function resolveGitHubAppPrivateKey(app = {}) {
+  const direct = resolveSecretReference(app.privateKey || "");
+  if (direct) return direct.replace(/\\n/g, "\n");
+  const file = expandHomePath(app.privateKeyFile || "");
+  if (!file) return "";
+  try {
+    return fs5.readFileSync(file, "utf8").trim().replace(/\\n/g, "\n");
+  } catch {
+    return "";
+  }
+}
+function createGitHubAppJwt({ appId, privateKey, now = () => /* @__PURE__ */ new Date() } = {}) {
+  const key = String(privateKey || "").trim();
+  const issuer = String(appId || "").trim();
+  if (!issuer || !key) throw new Error("GitHub App app_id and private key are required");
+  const nowSeconds = Math.floor(now().getTime() / 1e3);
+  const header = base64UrlJson({ alg: "RS256", typ: "JWT" });
+  const payload = base64UrlJson({ iat: nowSeconds - 60, exp: nowSeconds + 540, iss: issuer });
+  const unsigned = `${header}.${payload}`;
+  const signature = crypto.createSign("RSA-SHA256").update(unsigned).end().sign(key, "base64url");
+  return `${unsigned}.${signature}`;
+}
+function encodeGitHubPathSegment(value) {
+  return encodeURIComponent(String(value || ""));
+}
+function encodeGitHubBranchRef(branch = "") {
+  return String(branch || "").split("/").map(encodeGitHubPathSegment).join("/");
+}
+function parseNullSeparatedGitOutput(output = "") {
+  return String(output || "").split("\0").map((item) => item.trim()).filter(Boolean);
+}
+function listWorktreeChangedPaths(worktree, runGitFn = runGit) {
+  const tracked = parseNullSeparatedGitOutput(runGitFn(worktree, ["diff", "--name-only", "-z", "HEAD", "--"]));
+  const untracked = parseNullSeparatedGitOutput(runGitFn(worktree, ["ls-files", "--others", "--exclude-standard", "-z", "--"]));
+  return [.../* @__PURE__ */ new Set([...tracked, ...untracked])].filter((item) => item && !item.startsWith("../") && !path6.isAbsolute(item));
+}
+function currentGitBranch(worktree, runGitFn = runGit) {
+  return String(runGitFn(worktree, ["rev-parse", "--abbrev-ref", "HEAD"]) || "").trim();
+}
+function treeEntryForWorktreePath(worktree, gitPath) {
+  const absolutePath = path6.join(worktree, ...String(gitPath || "").split("/"));
+  if (!fs5.existsSync(absolutePath)) return { path: gitPath, mode: "100644", type: "blob", sha: null, deleted: true };
+  const stat = fs5.lstatSync(absolutePath);
+  if (stat.isDirectory()) return null;
+  if (stat.isSymbolicLink()) {
+    return {
+      path: gitPath,
+      mode: "120000",
+      type: "blob",
+      content: fs5.readlinkSync(absolutePath),
+      encoding: "utf-8"
+    };
+  }
+  return {
+    path: gitPath,
+    mode: stat.mode & 73 ? "100755" : "100644",
+    type: "blob",
+    content: fs5.readFileSync(absolutePath).toString("base64"),
+    encoding: "base64"
+  };
+}
 function createGitHubApiClient(config = {}, fetchImpl = globalThis.fetch) {
-  const token = resolveSecretReference(config?.apiToken);
+  const staticToken = resolveSecretReference(config?.apiToken);
+  const appConfig = isPlainObject(config?.app) ? config.app : {};
+  const appEnabled = appConfig.enabled === true || Boolean(appConfig.appId && appConfig.installationId && (appConfig.privateKey || appConfig.privateKeyFile));
+  const privateKey = resolveGitHubAppPrivateKey(appConfig);
   const owner = String(config?.owner || "").trim();
   const repo = String(config?.repo || "").trim();
-  const request = async (pathname) => {
+  let installationToken = null;
+  let installationTokenExpiresAt = 0;
+  const requestJson = async (url, { method = "GET", headers = {}, body = void 0 } = {}) => {
     if (typeof fetchImpl !== "function") throw new Error("fetch is unavailable; inject a GitHub client for live PR lookup");
-    if (!owner || !repo) throw new Error("GitHub repository owner/repo is not configured");
-    const response = await fetchImpl(`https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}${pathname}`, {
+    const response = await fetchImpl(url, {
+      method,
       headers: {
         Accept: "application/vnd.github+json",
         "X-GitHub-Api-Version": "2022-11-28",
-        ...token ? { Authorization: `Bearer ${token}` } : {}
-      }
+        ...body === void 0 ? {} : { "Content-Type": "application/json" },
+        ...headers
+      },
+      ...body === void 0 ? {} : { body: JSON.stringify(body) }
     });
     if (!response.ok) throw new Error(`GitHub API request failed: ${response.status}`);
-    return response.json();
+    return response.status === 204 ? null : response.json();
+  };
+  const getAuthToken = async () => {
+    if (!appEnabled) return staticToken || "";
+    const nowMs = Date.now();
+    if (installationToken && installationTokenExpiresAt - 6e4 > nowMs) return installationToken;
+    const jwt = createGitHubAppJwt({ appId: appConfig.appId, privateKey });
+    const installation = await requestJson(`https://api.github.com/app/installations/${encodeURIComponent(appConfig.installationId)}/access_tokens`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${jwt}` }
+    });
+    installationToken = String(installation?.token || "").trim();
+    installationTokenExpiresAt = Date.parse(installation?.expires_at || "") || nowMs + 3e6;
+    if (!installationToken) throw new Error("GitHub App installation token response did not include a token");
+    return installationToken;
   };
+  const request = async (pathname, { method = "GET", body = void 0 } = {}) => {
+    if (!owner || !repo) throw new Error("GitHub repository owner/repo is not configured");
+    const token = await getAuthToken();
+    return requestJson(`https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}${pathname}`, {
+      method,
+      body,
+      headers: token ? { Authorization: `Bearer ${token}` } : {}
+    });
+  };
+  const getRef = async (branch) => request(`/git/ref/heads/${encodeGitHubBranchRef(branch)}`);
+  const getCommitObject = async (sha) => request(`/git/commits/${encodeURIComponent(sha)}`);
+  const createBlob = async ({ content, encoding }) => request("/git/blobs", { method: "POST", body: { content, encoding } });
+  const createTree = async ({ baseTree, tree }) => request("/git/trees", { method: "POST", body: { base_tree: baseTree, tree } });
+  const createCommit = async ({ message, treeSha, parents }) => request("/git/commits", { method: "POST", body: { message, tree: treeSha, parents } });
+  const updateRef = async ({ branch, sha, force = false }) => request(`/git/refs/heads/${encodeGitHubBranchRef(branch)}`, { method: "PATCH", body: { sha, force } });
   return {
     async getPullRequest(number) {
       return request(`/pulls/${encodeURIComponent(number)}`);
+    },
+    async createPullRequest({ title, head, base, body = "", draft = false, maintainerCanModify = true }) {
+      return request("/pulls", {
+        method: "POST",
+        body: {
+          title: String(title || ""),
+          head: String(head || ""),
+          base: String(base || ""),
+          body: String(body || ""),
+          draft: draft === true,
+          maintainer_can_modify: maintainerCanModify !== false
+        }
+      });
+    },
+    async createIssueComment({ issueNumber, body }) {
+      return request(`/issues/${encodeURIComponent(issueNumber)}/comments`, { method: "POST", body: { body: String(body || "") } });
+    },
+    async replyToReviewComment({ commentId, body }) {
+      return request(`/pulls/comments/${encodeURIComponent(commentId)}/replies`, { method: "POST", body: { body: String(body || "") } });
+    },
+    async createPullRequestReview({ pullNumber, body, event = "COMMENT" }) {
+      return request(`/pulls/${encodeURIComponent(pullNumber)}/reviews`, { method: "POST", body: { body: String(body || ""), event: String(event || "COMMENT").toUpperCase() } });
+    },
+    async mergePullRequest({ pullNumber, commitTitle = "", commitMessage = "", mergeMethod = "squash" }) {
+      const body = {
+        merge_method: String(mergeMethod || "squash")
+      };
+      if (commitTitle) body.commit_title = String(commitTitle);
+      if (commitMessage) body.commit_message = String(commitMessage);
+      return request(`/pulls/${encodeURIComponent(pullNumber)}/merge`, { method: "PUT", body });
+    },
+    async commitWorktree({ worktree, branch = "", message = "", runGitFn = runGit, syncLocal = false } = {}) {
+      const directory = path6.resolve(String(worktree || ""));
+      if (!directory || !fs5.existsSync(directory)) throw new Error("worktree does not exist");
+      const targetBranch = String(branch || currentGitBranch(directory, runGitFn)).trim();
+      if (!targetBranch || targetBranch === "HEAD") throw new Error("target branch is required for GitHub API commit");
+      const commitMessage = String(message || "").trim();
+      if (!commitMessage) throw new Error("commit message is required");
+      const changedPaths = listWorktreeChangedPaths(directory, runGitFn);
+      if (changedPaths.length === 0) return { ok: true, action: "no_changes", branch: targetBranch, changedPaths: [] };
+      const ref = await getRef(targetBranch);
+      const headSha = ref?.object?.sha;
+      if (!headSha) throw new Error(`GitHub ref for ${targetBranch} did not include a head sha`);
+      const headCommit = await getCommitObject(headSha);
+      const baseTree = headCommit?.tree?.sha;
+      if (!baseTree) throw new Error(`GitHub commit ${headSha} did not include a tree sha`);
+      const tree = [];
+      for (const gitPath of changedPaths) {
+        const entry = treeEntryForWorktreePath(directory, gitPath);
+        if (!entry) continue;
+        if (entry.deleted) {
+          tree.push({ path: entry.path, mode: entry.mode, type: entry.type, sha: null });
+          continue;
+        }
+        const blob = await createBlob({ content: entry.content, encoding: entry.encoding });
+        if (!blob?.sha) throw new Error(`GitHub blob creation failed for ${gitPath}`);
+        tree.push({ path: entry.path, mode: entry.mode, type: entry.type, sha: blob.sha });
+      }
+      if (tree.length === 0) return { ok: true, action: "no_changes", branch: targetBranch, changedPaths: [] };
+      const nextTree = await createTree({ baseTree, tree });
+      const nextCommit = await createCommit({ message: commitMessage, treeSha: nextTree.sha, parents: [headSha] });
+      if (!nextCommit?.sha) throw new Error("GitHub commit creation did not return a sha");
+      const updatedRef = await updateRef({ branch: targetBranch, sha: nextCommit.sha, force: false });
+      if (syncLocal) {
+        runGitFn(directory, ["fetch", "origin", targetBranch]);
+        runGitFn(directory, ["reset", "--hard", "FETCH_HEAD"]);
+      }
+      return {
+        ok: true,
+        action: "committed",
+        branch: targetBranch,
+        before: headSha,
+        after: nextCommit.sha,
+        changedPaths,
+        treeEntries: tree.length,
+        verification: nextCommit.verification || null,
+        ref: updatedRef
+      };
+    },
+    async authMode() {
+      if (appEnabled) return { mode: "github_app", appId: String(appConfig.appId || ""), installationId: String(appConfig.installationId || "") };
+      if (staticToken) return { mode: "token" };
+      return { mode: "anonymous" };
     }
   };
 }
@@ -11765,7 +12021,22 @@ async function routeClickUpWebhookEventUnlocked({ payload, config, state = {}, w
   const subtaskId = parentTaskId && parentTaskId !== taskId ? taskId : "";
   let taskRoute;
   try {
-    taskRoute = await ensureTaskWorktree({ baseWorktree: config.basePath, taskId, taskType, parentTaskId, subtaskId, existingMetadata: metadata, allowNonGitFallback: process.env.NODE_ENV === "test" || config.test === true, opencodeBaseUrl: config.opencode?.baseUrl, opencodeBaseUrlConfigured: config.opencode?.baseUrlConfigured === true, openchamberBaseUrl: config.openchamber?.baseUrl, openchamberBaseUrlConfigured: config.openchamber?.baseUrlConfigured === true, clickupClient, webhookWorktree: worktree });
+    taskRoute = await ensureTaskWorktree({
+      baseWorktree: config.basePath,
+      taskId,
+      taskType,
+      parentTaskId,
+      subtaskId,
+      existingMetadata: metadata,
+      allowNonGitFallback: process.env.NODE_ENV === "test" || config.test === true,
+      opencodeBaseUrl: config.opencode?.baseUrl,
+      opencodeBaseUrlConfigured: config.opencode?.baseUrlConfigured === true,
+      openchamberBaseUrl: config.openchamber?.baseUrl,
+      openchamberBaseUrlConfigured: config.openchamber?.baseUrlConfigured === true,
+      clickupClient,
+      webhookWorktree: worktree,
+      gitIdentity: config.github?.committer
+    });
   } catch (error) {
     const message = `Optima webhook could not create or reuse a task worktree for ${taskId}: ${error.message}`;
     appendClickUpWebhookLocalLog(worktree, { type: "task_worktree_failed", taskId, message });
@@ -13637,6 +13908,14 @@ async function OptimaPlugin(input = {}, pluginOptions = {}) {
       }
     });
   };
+  const requireGitHubAppClient = async () => {
+    if (!runtimeGitHubClient?.authMode) return { ok: false, error: "github_client_unavailable" };
+    const auth = await runtimeGitHubClient.authMode();
+    if (auth.mode !== "github_app") {
+      return { ok: false, error: "github_app_auth_required", auth };
+    }
+    return { ok: true, auth };
+  };
   const tools = {
     optima_init: tool({
       description: "Initialize the Optima workflow and CodeMap in the current repository",
@@ -13890,6 +14169,152 @@ Restart or reload OpenCode manually if the newly scaffolded config or agents are
         return JSON.stringify(result, null, 2);
       }
     }),
+    optima_github_auth_mode: tool({
+      description: "Report whether Optima GitHub operations use anonymous, user token, or GitHub App installation authentication",
+      args: {},
+      async execute() {
+        try {
+          if (!runtimeGitHubClient?.authMode) return JSON.stringify({ ok: false, error: "github_client_unavailable" }, null, 2);
+          return JSON.stringify({ ok: true, ...await runtimeGitHubClient.authMode() }, null, 2);
+        } catch (error) {
+          return JSON.stringify({ ok: false, error: error.message }, null, 2);
+        }
+      }
+    }),
+    optima_github_create_pr: tool({
+      description: "Create a GitHub PR through the Optima GitHub App identity so human owners can approve it",
+      args: {
+        title: tool.schema.string().describe("Pull request title"),
+        head: tool.schema.string().describe("Source branch"),
+        base: tool.schema.string().describe("Target branch"),
+        body: tool.schema.string().describe("Pull request body"),
+        draft: tool.schema.string().describe("Set to 'true' to create a draft PR")
+      },
+      async execute(args) {
+        try {
+          const auth = await requireGitHubAppClient();
+          if (!auth.ok) return JSON.stringify(auth, null, 2);
+          if (!runtimeGitHubClient?.createPullRequest) return JSON.stringify({ ok: false, error: "github_client_unavailable" }, null, 2);
+          const result = await runtimeGitHubClient.createPullRequest({
+            title: args.title,
+            head: args.head,
+            base: args.base,
+            body: args.body,
+            draft: String(args.draft || "").toLowerCase() === "true"
+          });
+          return JSON.stringify({ ok: true, pull_request: result }, null, 2);
+        } catch (error) {
+          return JSON.stringify({ ok: false, error: error.message }, null, 2);
+        }
+      }
+    }),
+    optima_github_comment_pr: tool({
+      description: "Post a PR conversation comment through the Optima GitHub App identity",
+      args: {
+        pr_number: tool.schema.number().describe("Pull request number"),
+        body: tool.schema.string().describe("Markdown comment body")
+      },
+      async execute(args) {
+        try {
+          const auth = await requireGitHubAppClient();
+          if (!auth.ok) return JSON.stringify(auth, null, 2);
+          if (!runtimeGitHubClient?.createIssueComment) return JSON.stringify({ ok: false, error: "github_client_unavailable" }, null, 2);
+          const result = await runtimeGitHubClient.createIssueComment({ issueNumber: args.pr_number, body: args.body });
+          return JSON.stringify({ ok: true, comment: result }, null, 2);
+        } catch (error) {
+          return JSON.stringify({ ok: false, error: error.message }, null, 2);
+        }
+      }
+    }),
+    optima_github_reply_review_comment: tool({
+      description: "Reply to a GitHub PR review comment through the Optima GitHub App identity",
+      args: {
+        comment_id: tool.schema.number().describe("GitHub review comment id to reply to"),
+        body: tool.schema.string().describe("Markdown reply body")
+      },
+      async execute(args) {
+        try {
+          const auth = await requireGitHubAppClient();
+          if (!auth.ok) return JSON.stringify(auth, null, 2);
+          if (!runtimeGitHubClient?.replyToReviewComment) return JSON.stringify({ ok: false, error: "github_client_unavailable" }, null, 2);
+          const result = await runtimeGitHubClient.replyToReviewComment({ commentId: args.comment_id, body: args.body });
+          return JSON.stringify({ ok: true, comment: result }, null, 2);
+        } catch (error) {
+          return JSON.stringify({ ok: false, error: error.message }, null, 2);
+        }
+      }
+    }),
+    optima_github_review_pr: tool({
+      description: "Create a GitHub PR review through the Optima GitHub App identity",
+      args: {
+        pr_number: tool.schema.number().describe("Pull request number"),
+        body: tool.schema.string().describe("Markdown review body"),
+        event: tool.schema.string().describe("Review event: COMMENT, APPROVE, or REQUEST_CHANGES")
+      },
+      async execute(args) {
+        try {
+          const auth = await requireGitHubAppClient();
+          if (!auth.ok) return JSON.stringify(auth, null, 2);
+          if (!runtimeGitHubClient?.createPullRequestReview) return JSON.stringify({ ok: false, error: "github_client_unavailable" }, null, 2);
+          const result = await runtimeGitHubClient.createPullRequestReview({ pullNumber: args.pr_number, body: args.body, event: args.event || "COMMENT" });
+          return JSON.stringify({ ok: true, review: result }, null, 2);
+        } catch (error) {
+          return JSON.stringify({ ok: false, error: error.message }, null, 2);
+        }
+      }
+    }),
+    optima_github_merge_pr: tool({
+      description: "Merge a GitHub PR through the Optima GitHub App identity after required human approval gates pass",
+      args: {
+        pr_number: tool.schema.number().describe("Pull request number"),
+        commit_title: tool.schema.string().describe("Optional merge commit title"),
+        commit_message: tool.schema.string().describe("Optional merge commit message"),
+        merge_method: tool.schema.string().describe("merge, squash, or rebase; defaults to squash")
+      },
+      async execute(args) {
+        try {
+          const auth = await requireGitHubAppClient();
+          if (!auth.ok) return JSON.stringify(auth, null, 2);
+          if (!runtimeGitHubClient?.mergePullRequest) return JSON.stringify({ ok: false, error: "github_client_unavailable" }, null, 2);
+          const result = await runtimeGitHubClient.mergePullRequest({
+            pullNumber: args.pr_number,
+            commitTitle: args.commit_title,
+            commitMessage: args.commit_message,
+            mergeMethod: args.merge_method || "squash"
+          });
+          return JSON.stringify({ ok: true, merge: result }, null, 2);
+        } catch (error) {
+          return JSON.stringify({ ok: false, error: error.message }, null, 2);
+        }
+      }
+    }),
+    optima_github_commit_worktree: tool({
+      description: "Commit current worktree changes directly through the Optima GitHub App API so commits are authored by the App/bot and can be GitHub-verified",
+      args: {
+        directory: tool.schema.string().describe("Task worktree directory containing the file changes"),
+        branch: tool.schema.string().describe("Target branch to update; defaults to the current local branch"),
+        message: tool.schema.string().describe("Commit message"),
+        sync_local: tool.schema.string().describe("Set to 'true' to fetch/reset the local worktree to the API-created commit after success")
+      },
+      async execute(args, context) {
+        try {
+          const auth = await requireGitHubAppClient();
+          if (!auth.ok) return JSON.stringify(auth, null, 2);
+          if (!runtimeGitHubClient?.commitWorktree) return JSON.stringify({ ok: false, error: "github_client_unavailable" }, null, 2);
+          const directory = resolveSessionToolDirectory({ requestedDirectory: args.directory, context, pluginWorktree: worktree, clickUpWebhookValidation });
+          if (!directory.ok) return JSON.stringify({ ok: false, error: directory.error }, null, 2);
+          const result = await runtimeGitHubClient.commitWorktree({
+            worktree: directory.directory,
+            branch: args.branch,
+            message: args.message,
+            syncLocal: String(args.sync_local || "").toLowerCase() === "true"
+          });
+          return JSON.stringify(result, null, 2);
+        } catch (error) {
+          return JSON.stringify({ ok: false, error: error.message }, null, 2);
+        }
+      }
+    }),
     optima_validate: tool({
       description: "Validate Optima workflow artifacts and CodeMap integrity",
       args: {},

package/docs/core/agent_orchestration.md

@@ -26,6 +26,7 @@
 - Human approval assignment is prohibited except for the strict allowlist: parent `plan` with clear questions already posted in ClickUp comments; `in progress` blocked by missing credentials, permissions, external tools, or access; or parent `validation` with a functional preview URL such as `https://<taskid>-preview.defend.tech`. Do not assign `CTO`/`PO` for generic handoff, routine validation, cleanup, subtask planning/validation, or partial-phase stops.
 - Store ClickUp `agent_metadata` JSON with session IDs per agent/type/task/subtask; keep `Definition` as the plan contract and final Documentation as delivered behavior docs.
 - Validation is not complete until the model leaves the current GitHub PR link visible in ClickUp with source branch, target branch, and validation owner; Optima runtime must still limit its own ClickUp writes to metadata.
+- PR creation, PR comments, reviews, merges, and commits must use the Optima GitHub App/API identity, not a human token. Final commits for ClickUp/GitHub delivery are created with `optima_github_commit_worktree`; human approval must not be requested until GitHub reports those commits as Verified.
 - `workflow_product_manager` is registered only when explicit ClickUp webhook mode is configured and the local webhook subscription state is active/valid.
 - Webhook mode is opt-in: Optima validates signed `X-Signature` HMAC SHA-256 ClickUp requests, routes status/assignee events only for Product Manager-assigned non-terminal tasks, routes comments only when they mention `@Defend Tech Product Manager`, and stores new `ses_...` ids in ClickUp `agent_metadata`. Runtime/process failures stay in local logs and must not create ClickUp comments or tags.
 - The same gated in-process listener can also accept signed GitHub `X-Hub-Signature-256` PR/review/comment events at `/optima/github/webhook` when `clickup.github.webhook` is enabled. GitHub events resolve the ClickUp task from the PR source branch, update only `agent_metadata.task.github`, and steer the existing `workflow_product_manager` session; they do not create replacement sessions or ClickUp runtime comments.

package/docs/core/agent_orchestration.prompt.md

@@ -19,6 +19,7 @@
 - Git rules: principal workspace stays on `dev`, never `main`; parent branches use `<type>/<parent-id>`; subtask branches use non-nested `<type>/<parent-id>-subtask-<subtask-id>` and pending subtasks use `<type>/<parent-id>-pending-<title-slug>`; parent task pulls remote once at start; subtasks start from and PR to the parent local branch, bootstrapping the parent from `dev`/`origin/dev` first when missing; PoC branches stay `poc/<clickup-task-id>`; parents PR to `dev`, releases PR `dev` -> `main`; failed/conflicted subtask or parent merges return the affected item to `in progress` for the coding owner; no direct `main` pushes.
 - Store `agent_metadata` session JSON; `Definition` is the plan contract, final Documentation is delivered behavior docs.
 - Validation requires a model-owned ClickUp status comment with the current GitHub PR link, source branch, target branch, and validation owner; Optima runtime itself writes only metadata/logs.
+- PRs, GitHub comments/reviews/merges, and final commits use Optima GitHub App/API identity; create final commits with `optima_github_commit_worktree` and require GitHub `Verified` before human approval.
 - `workflow_product_manager` is registered only when opt-in ClickUp webhook mode is complete and active/valid.
 - Webhook mode validates ClickUp `X-Signature` HMAC SHA-256, routes only PM-assigned non-terminal status/assignee events, routes comments only on `@Defend Tech Product Manager`, writes new `ses_...` ids to `agent_metadata`, and keeps runtime/process failures in local logs, never ClickUp comments/tags.
 - The listener is gated in-process local runtime; production needs a stable public URL/tunnel and ignored `.optima/.config/runtime/` webhook state. It can also accept GitHub `X-Hub-Signature-256` PR/review/comment webhooks at `/optima/github/webhook`; these update only `agent_metadata.task.github` and steer the existing WPM session resolved from the PR source branch.

package/docs/guides/AGENTS.md

@@ -68,6 +68,7 @@ For ClickUp-first delivery, Validation is a GitHub PR state, not a comment-only
 
 - Subtasks open/update a PR from the subtask branch into the parent task branch before entering Validation.
 - Parent tasks open/update a PR from the task branch into `dev` before entering Validation.
+- Final commits must be created with `optima_github_commit_worktree`, not local `git commit`, so GitHub attributes them to the Optima App/bot and can mark them Verified. If GitHub does not show the commits as Verified, do not request human approval.
 - The model must leave the current PR link visible in ClickUp when it moves a task/subtask to Validation, including source/target branch and validation owner. Optima runtime still writes only metadata/logs; the ClickUp comment is model-owned work status.
 - GitHub review/comment webhooks wake the workflow owner. The agent replies in GitHub; if a comment requires a change, it moves ClickUp back to `in progress`, fixes/pushes the same branch, returns ClickUp to `validation`, updates the PR, and replies again with the result.
 - The configured final approver/CTO approving the parent PR is the merge trigger. After merge to `dev`, Vercel preproduction must deploy automatically and pass a small smoke/regression check before cleanup and ClickUp `completed`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defend-tech/opencode-optima",
-  "version": "0.1.74",
+  "version": "0.1.75",
   "repository": {
     "type": "git",
     "url": "git+ssh://git@github.com/defend-tech/opencode-optima.git"