paperclip-github-plugin 0.3.6 → 0.4.1

package/dist/ui/index.js

@@ -22400,6 +22400,11 @@ function requiresPaperclipBoardAccess(value) {
   const health = normalizePaperclipHealthResponse(value);
   return health?.deploymentMode?.toLowerCase() === "authenticated";
 }
+function shouldShowPaperclipBoardAccessSettings(value) {
+  const health = normalizePaperclipHealthResponse(value);
+  const deploymentMode = health?.deploymentMode?.toLowerCase();
+  return deploymentMode === "authenticated" || deploymentMode === "local_trusted";
+}
 
 // src/ui/assignees.ts
 function normalizeCompanyAssigneeOptionsResponse(response) {
@@ -22648,18 +22653,32 @@ function normalizePluginConfigBoardTokenRefs(value) {
   }
   return Object.fromEntries(entries);
 }
+function normalizePluginConfigGitHubTokenRefs(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, secretRef]) => {
+    const normalizedCompanyId = normalizeOptionalString2(companyId);
+    const normalizedSecretRef = normalizeOptionalString2(secretRef);
+    return normalizedCompanyId && normalizedSecretRef ? [normalizedCompanyId, normalizedSecretRef] : null;
+  }).filter((entry) => Boolean(entry));
+  if (entries.length === 0) {
+    return void 0;
+  }
+  return Object.fromEntries(entries);
+}
 function normalizePluginConfig(value) {
   if (!value || typeof value !== "object") {
     return {};
   }
   const record = { ...value };
-  const githubTokenRef = normalizeOptionalString2(record.githubTokenRef);
+  const githubTokenRefs = normalizePluginConfigGitHubTokenRefs(record.githubTokenRefs);
   const paperclipBoardApiTokenRefs = normalizePluginConfigBoardTokenRefs(record.paperclipBoardApiTokenRefs);
   const paperclipApiBaseUrl = normalizePaperclipApiBaseUrl(record.paperclipApiBaseUrl);
-  if (githubTokenRef) {
-    record.githubTokenRef = githubTokenRef;
+  if (githubTokenRefs) {
+    record.githubTokenRefs = githubTokenRefs;
   } else {
-    delete record.githubTokenRef;
+    delete record.githubTokenRefs;
   }
   if (paperclipBoardApiTokenRefs) {
     record.paperclipBoardApiTokenRefs = paperclipBoardApiTokenRefs;
@@ -22675,12 +22694,27 @@ function normalizePluginConfig(value) {
 }
 function mergePluginConfig(currentValue, patch5) {
   const current = normalizePluginConfig(currentValue);
+  const currentGitHubTokenRefs = normalizePluginConfigGitHubTokenRefs(current.githubTokenRefs);
+  const patchGitHubTokenRefs = normalizePluginConfigGitHubTokenRefs(patch5.githubTokenRefs);
   const currentBoardTokenRefs = normalizePluginConfigBoardTokenRefs(current.paperclipBoardApiTokenRefs);
   const patchBoardTokenRefs = normalizePluginConfigBoardTokenRefs(patch5.paperclipBoardApiTokenRefs);
   const next2 = normalizePluginConfig({
     ...current,
     ...patch5
   });
+  if ("githubTokenRefs" in patch5) {
+    const mergedGitHubTokenRefs = {
+      ...currentGitHubTokenRefs ?? {},
+      ...patchGitHubTokenRefs ?? {}
+    };
+    if (Object.keys(mergedGitHubTokenRefs).length > 0) {
+      next2.githubTokenRefs = mergedGitHubTokenRefs;
+    } else {
+      delete next2.githubTokenRefs;
+    }
+  } else if (currentGitHubTokenRefs) {
+    next2.githubTokenRefs = currentGitHubTokenRefs;
+  }
   if ("paperclipBoardApiTokenRefs" in patch5) {
     const mergedBoardTokenRefs = {
       ...currentBoardTokenRefs ?? {},
@@ -23011,6 +23045,7 @@ function getSyncSetupMessage(issue, hasCompanyContext) {
 }
 function usePaperclipBoardAccessRequirement() {
   const [status, setStatus] = useState2("loading");
+  const [visible, setVisible] = useState2(false);
   useEffect2(() => {
     let cancelled = false;
     void (async () => {
@@ -23020,8 +23055,10 @@ function usePaperclipBoardAccessRequirement() {
       }
       if (!health) {
         setStatus("unknown");
+        setVisible(false);
         return;
       }
+      setVisible(shouldShowPaperclipBoardAccessSettings(health));
       setStatus(requiresPaperclipBoardAccess(health) ? "required" : "not_required");
     })();
     return () => {
@@ -23030,7 +23067,8 @@ function usePaperclipBoardAccessRequirement() {
   }, []);
   return {
     status,
-    required: status === "required"
+    required: status === "required",
+    visible
   };
 }
 function getGitHubRateLimitResourceLabel(resource) {
@@ -26535,12 +26573,21 @@ function normalizeGitHubUsername(value) {
   const trimmed = value.trim().replace(/^@+/, "").toLowerCase();
   return trimmed ? trimmed : null;
 }
+function normalizeOptionalText(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
 function normalizeIgnoredIssueAuthorUsernames(value) {
   const rawEntries = Array.isArray(value) ? value : typeof value === "string" ? value.split(/[\s,]+/g) : [];
   return [...new Set(
     rawEntries.map((entry) => typeof entry === "string" ? normalizeGitHubUsername(entry) : null).filter((entry) => Boolean(entry))
   )];
 }
+function normalizeAgentIds(value) {
+  const rawEntries = Array.isArray(value) ? value : [];
+  return [...new Set(
+    rawEntries.map((entry) => typeof entry === "string" && entry.trim() ? entry.trim() : null).filter((entry) => Boolean(entry))
+  )].sort((left, right) => left.localeCompare(right));
+}
 function normalizeAdvancedSettings(value) {
   if (!value || typeof value !== "object") {
     return DEFAULT_ADVANCED_SETTINGS;
@@ -26550,7 +26597,8 @@ function normalizeAdvancedSettings(value) {
   return {
     ...defaultAssigneeAgentId ? { defaultAssigneeAgentId } : {},
     defaultStatus: normalizePaperclipIssueStatus(record.defaultStatus),
-    ignoredIssueAuthorUsernames: "ignoredIssueAuthorUsernames" in record ? normalizeIgnoredIssueAuthorUsernames(record.ignoredIssueAuthorUsernames) : DEFAULT_ADVANCED_SETTINGS.ignoredIssueAuthorUsernames
+    ignoredIssueAuthorUsernames: "ignoredIssueAuthorUsernames" in record ? normalizeIgnoredIssueAuthorUsernames(record.ignoredIssueAuthorUsernames) : DEFAULT_ADVANCED_SETTINGS.ignoredIssueAuthorUsernames,
+    ...normalizeAgentIds(record.githubTokenPropagationAgentIds).length > 0 ? { githubTokenPropagationAgentIds: normalizeAgentIds(record.githubTokenPropagationAgentIds) } : {}
   };
 }
 function getComparableMappings(mappings) {
@@ -26567,7 +26615,8 @@ function getComparableAdvancedSettings(value) {
   return {
     ...settings.defaultAssigneeAgentId ? { defaultAssigneeAgentId: settings.defaultAssigneeAgentId } : {},
     defaultStatus: settings.defaultStatus,
-    ignoredIssueAuthorUsernames: [...settings.ignoredIssueAuthorUsernames].sort((left, right) => left.localeCompare(right))
+    ignoredIssueAuthorUsernames: [...settings.ignoredIssueAuthorUsernames].sort((left, right) => left.localeCompare(right)),
+    ...settings.githubTokenPropagationAgentIds?.length ? { githubTokenPropagationAgentIds: [...settings.githubTokenPropagationAgentIds].sort((left, right) => left.localeCompare(right)) } : {}
   };
 }
 function formatAssigneeOptionLabel(option) {
@@ -26583,7 +26632,20 @@ function getAvailableAssigneeOptions(options, selectedAgentId) {
   }
   return normalizedOptions;
 }
-function formatAdvancedSettingsSummary(advancedSettings, availableAssignees) {
+function getAvailablePropagationAgentOptions(options, selectedAgentIds) {
+  const normalizedOptions = [...options ?? []];
+  const selectedIds = normalizeAgentIds(selectedAgentIds);
+  for (const selectedAgentId of selectedIds) {
+    if (!normalizedOptions.some((option) => option.id === selectedAgentId)) {
+      normalizedOptions.push({
+        id: selectedAgentId,
+        name: "Unavailable agent"
+      });
+    }
+  }
+  return normalizedOptions.sort((left, right) => left.name.localeCompare(right.name));
+}
+function formatAdvancedSettingsSummary(advancedSettings, availableAssignees, options) {
   const assigneeLabel = advancedSettings.defaultAssigneeAgentId ? formatAssigneeOptionLabel(
     availableAssignees.find((option) => option.id === advancedSettings.defaultAssigneeAgentId) ?? {
       id: advancedSettings.defaultAssigneeAgentId,
@@ -26592,8 +26654,41 @@ function formatAdvancedSettingsSummary(advancedSettings, availableAssignees) {
   ) : "Unassigned";
   const statusLabel = PAPERCLIP_STATUS_OPTIONS.find((option) => option.value === advancedSettings.defaultStatus)?.label ?? "Backlog";
   const ignoredAuthorsLabel = advancedSettings.ignoredIssueAuthorUsernames.length > 0 ? advancedSettings.ignoredIssueAuthorUsernames.join(", ") : "none";
+  if (options?.includePropagation) {
+    const propagatedAgentsLabel = advancedSettings.githubTokenPropagationAgentIds?.length ? `${advancedSettings.githubTokenPropagationAgentIds.length} selected` : "none";
+    return `Assignee: ${assigneeLabel} \xB7 Status: ${statusLabel} \xB7 Ignore: ${ignoredAuthorsLabel} \xB7 Propagate: ${propagatedAgentsLabel}`;
+  }
   return `Assignee: ${assigneeLabel} \xB7 Status: ${statusLabel} \xB7 Ignore: ${ignoredAuthorsLabel}`;
 }
+function resolveSavedTokenUiState(params) {
+  if (params.githubTokenConfigured) {
+    return {
+      showSavedTokenHint: true,
+      showTokenEditor: false,
+      tokenStatusOverride: "valid",
+      validatedLogin: normalizeOptionalText(params.githubTokenLogin)
+    };
+  }
+  return {
+    showSavedTokenHint: false,
+    showTokenEditor: true,
+    tokenStatusOverride: null,
+    validatedLogin: null
+  };
+}
+function formatAgentMultiSelectionLabel(values, options) {
+  if (values.length === 0) {
+    return "No agents selected";
+  }
+  const labels = values.map((value) => options.find((option) => option.value === value)?.label ?? "Unavailable agent").filter((label) => label.trim().length > 0);
+  if (labels.length === 0) {
+    return "No agents selected";
+  }
+  if (labels.length <= 2) {
+    return labels.join(", ");
+  }
+  return `${labels.length} agents selected`;
+}
 function PickerChevronIcon() {
   return /* @__PURE__ */ jsx2("svg", { viewBox: "0 0 16 16", fill: "none", "aria-hidden": "true", children: /* @__PURE__ */ jsx2("path", { d: "M4 6.5L8 10.5L12 6.5", stroke: "currentColor", strokeWidth: "1.5", strokeLinecap: "round", strokeLinejoin: "round" }) });
 }
@@ -26748,6 +26843,122 @@ function SettingsAssigneePicker(props) {
     ] }) : null
   ] });
 }
+function SettingsAgentMultiPicker(props) {
+  const { id, values, options, disabled, onChange } = props;
+  const [open, setOpen] = useState2(false);
+  const [query, setQuery] = useState2("");
+  const rootRef = useRef(null);
+  const searchInputRef = useRef(null);
+  const selectedValues = normalizeAgentIds(values);
+  const selectedValueSet = new Set(selectedValues);
+  const normalizedQuery = query.trim().toLowerCase();
+  const filteredOptions = normalizedQuery ? options.filter((option) => option.label.toLowerCase().includes(normalizedQuery)) : options;
+  const selectedLabel = formatAgentMultiSelectionLabel(selectedValues, options);
+  useEffect2(() => {
+    if (!open) {
+      setQuery("");
+      return;
+    }
+    const handlePointerDown = (event) => {
+      const target = event.target;
+      if (target instanceof Node && rootRef.current?.contains(target)) {
+        return;
+      }
+      setOpen(false);
+    };
+    const handleKeyDown = (event) => {
+      if (event.key === "Escape") {
+        setOpen(false);
+      }
+    };
+    document.addEventListener("pointerdown", handlePointerDown);
+    document.addEventListener("keydown", handleKeyDown);
+    globalThis.setTimeout(() => {
+      searchInputRef.current?.focus();
+      searchInputRef.current?.select();
+    }, 0);
+    return () => {
+      document.removeEventListener("pointerdown", handlePointerDown);
+      document.removeEventListener("keydown", handleKeyDown);
+    };
+  }, [open]);
+  useEffect2(() => {
+    if (disabled && open) {
+      setOpen(false);
+    }
+  }, [disabled, open]);
+  return /* @__PURE__ */ jsxs2("div", { className: "ghsync__picker", ref: rootRef, children: [
+    /* @__PURE__ */ jsxs2(
+      "button",
+      {
+        id,
+        type: "button",
+        className: "ghsync__picker-trigger ghsync__picker-trigger--assignee",
+        disabled,
+        "aria-haspopup": "dialog",
+        "aria-expanded": open,
+        onClick: () => {
+          if (disabled) {
+            return;
+          }
+          setOpen((current) => !current);
+        },
+        children: [
+          /* @__PURE__ */ jsxs2("span", { className: "ghsync__picker-trigger-main", children: [
+            /* @__PURE__ */ jsx2("span", { className: "ghsync__picker-agent-icon", "aria-hidden": "true", children: /* @__PURE__ */ jsx2(AgentIcon, {}) }),
+            /* @__PURE__ */ jsx2("span", { className: "ghsync__picker-trigger-label", children: selectedLabel })
+          ] }),
+          /* @__PURE__ */ jsx2("span", { className: "ghsync__picker-trigger-icon", children: /* @__PURE__ */ jsx2(PickerChevronIcon, {}) })
+        ]
+      }
+    ),
+    open ? /* @__PURE__ */ jsxs2("div", { className: "ghsync__picker-panel ghsync__picker-panel--assignee", role: "dialog", "aria-label": "Choose agents", children: [
+      /* @__PURE__ */ jsx2("div", { className: "ghsync__picker-search", children: /* @__PURE__ */ jsx2(
+        "input",
+        {
+          ref: searchInputRef,
+          type: "text",
+          className: "ghsync__picker-search-input",
+          placeholder: "Search agents...",
+          value: query,
+          onChange: (event) => {
+            setQuery(event.currentTarget.value);
+          },
+          onKeyDown: (event) => {
+            if (event.key === "Escape") {
+              event.preventDefault();
+              setOpen(false);
+            }
+          }
+        }
+      ) }),
+      /* @__PURE__ */ jsx2("div", { className: "ghsync__picker-list", role: "listbox", "aria-labelledby": id, "aria-multiselectable": "true", children: filteredOptions.length > 0 ? filteredOptions.map((option) => {
+        const selected = selectedValueSet.has(option.value);
+        return /* @__PURE__ */ jsxs2(
+          "button",
+          {
+            type: "button",
+            role: "option",
+            "aria-selected": selected,
+            className: `ghsync__picker-option${selected ? " ghsync__picker-option--selected" : ""}`,
+            onClick: () => {
+              const nextValues = selected ? selectedValues.filter((value) => value !== option.value) : normalizeAgentIds([...selectedValues, option.value]);
+              onChange(nextValues);
+            },
+            children: [
+              /* @__PURE__ */ jsxs2("span", { className: "ghsync__picker-trigger-main", children: [
+                option.icon === "agent" ? /* @__PURE__ */ jsx2("span", { className: "ghsync__picker-agent-icon", "aria-hidden": "true", children: /* @__PURE__ */ jsx2(AgentIcon, {}) }) : null,
+                /* @__PURE__ */ jsx2("span", { className: "ghsync__picker-option-label", children: option.label })
+              ] }),
+              /* @__PURE__ */ jsx2("span", { className: "ghsync__picker-option-check", "aria-hidden": "true", children: selected ? /* @__PURE__ */ jsx2(PickerCheckIcon, {}) : null })
+            ]
+          },
+          option.value
+        );
+      }) : /* @__PURE__ */ jsx2("div", { className: "ghsync__picker-empty", children: "No agents match." }) })
+    ] }) : null
+  ] });
+}
 function SettingsStatusPicker(props) {
   const { id, value, options, disabled, onChange } = props;
   const [open, setOpen] = useState2(false);
@@ -27678,6 +27889,117 @@ async function patchPluginConfig(pluginId, patch5) {
     })
   });
 }
+var GITHUB_TOKEN_PROPAGATION_CONCURRENCY_LIMIT = 4;
+function normalizeAgentAdapterConfig(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? { ...value } : {};
+}
+function normalizeAgentEnvBindings(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? { ...value } : {};
+}
+function isMatchingSecretRefEnvBinding(value, secretId) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const record = value;
+  return record.type === "secret_ref" && record.secretId === secretId;
+}
+function getAgentPropagationPatch(params) {
+  const adapterConfig = normalizeAgentAdapterConfig(params.adapterConfig);
+  const currentEnv = normalizeAgentEnvBindings(adapterConfig.env);
+  if (params.mode === "ensure") {
+    const nextEnv2 = {
+      ...currentEnv,
+      GITHUB_TOKEN: {
+        type: "secret_ref",
+        secretId: params.githubTokenSecretRef
+      }
+    };
+    if (JSON.stringify(nextEnv2) === JSON.stringify(currentEnv)) {
+      return null;
+    }
+    return {
+      ...adapterConfig,
+      env: nextEnv2
+    };
+  }
+  if (!isMatchingSecretRefEnvBinding(currentEnv.GITHUB_TOKEN, params.githubTokenSecretRef)) {
+    return null;
+  }
+  const nextEnv = { ...currentEnv };
+  delete nextEnv.GITHUB_TOKEN;
+  const nextAdapterConfig = {
+    ...adapterConfig
+  };
+  if (Object.keys(nextEnv).length > 0) {
+    nextAdapterConfig.env = nextEnv;
+  } else {
+    delete nextAdapterConfig.env;
+  }
+  return nextAdapterConfig;
+}
+async function runWithConcurrencyLimit(items, concurrencyLimit, worker) {
+  if (items.length === 0) {
+    return;
+  }
+  let nextIndex = 0;
+  const runnerCount = Math.min(concurrencyLimit, items.length);
+  await Promise.all(
+    Array.from({ length: runnerCount }, async () => {
+      while (nextIndex < items.length) {
+        const currentIndex = nextIndex;
+        nextIndex += 1;
+        await worker(items[currentIndex]);
+      }
+    })
+  );
+}
+async function applyGitHubTokenPropagationUpdate(params) {
+  const agent = await fetchJson(`/api/agents/${params.agentId}`);
+  const nextAdapterConfig = getAgentPropagationPatch({
+    adapterConfig: agent?.adapterConfig,
+    githubTokenSecretRef: params.githubTokenSecretRef,
+    mode: params.mode
+  });
+  if (!nextAdapterConfig) {
+    return;
+  }
+  await fetchJson(`/api/agents/${params.agentId}`, {
+    method: "PATCH",
+    body: JSON.stringify({
+      adapterConfig: nextAdapterConfig
+    })
+  });
+}
+async function syncGitHubTokenPropagationForAgents(params) {
+  const selectedAgentIds = normalizeAgentIds(params.selectedAgentIds);
+  const selectedAgentIdSet = new Set(selectedAgentIds);
+  const previousAgentIds = normalizeAgentIds(params.previousAgentIds);
+  const failures = /* @__PURE__ */ new Set();
+  const operations = [
+    ...selectedAgentIds.map((agentId) => ({ agentId, mode: "ensure" })),
+    ...previousAgentIds.filter((agentId) => !selectedAgentIdSet.has(agentId)).map((agentId) => ({ agentId, mode: "remove" }))
+  ];
+  await runWithConcurrencyLimit(
+    operations,
+    GITHUB_TOKEN_PROPAGATION_CONCURRENCY_LIMIT,
+    async (operation) => {
+      try {
+        await applyGitHubTokenPropagationUpdate({
+          agentId: operation.agentId,
+          githubTokenSecretRef: params.githubTokenSecretRef,
+          mode: operation.mode
+        });
+      } catch {
+        failures.add(operation.agentId);
+      }
+    }
+  );
+  if (failures.size > 0) {
+    throw new Error(
+      `GitHub token propagation could not update these agents: ${[...failures].join(", ")}.`
+    );
+  }
+}
 function normalizeCliAuthPollIntervalMs(value) {
   if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
     return CLI_AUTH_POLL_INTERVAL_FALLBACK_MS;
@@ -30765,6 +31087,7 @@ function GitHubSyncSettingsPage() {
   const themeMode = useResolvedThemeMode();
   const boardAccessRequirement = usePaperclipBoardAccessRequirement();
   const armSyncCompletionToast = useSyncCompletionToast(form.syncState, toast);
+  const githubTokenConfigSyncAttemptRef = useRef(null);
   const boardAccessConfigSyncAttemptRef = useRef(null);
   const assigneeFallbackAttemptRef = useRef(null);
   const currentSettings = settings.data ?? cachedSettings;
@@ -30778,6 +31101,11 @@ function GitHubSyncSettingsPage() {
     if (!settings.data) {
       return;
     }
+    const tokenUiState = resolveSavedTokenUiState({
+      githubTokenConfigured: settings.data.githubTokenConfigured,
+      githubTokenLogin: settings.data.githubTokenLogin
+    });
+    const savedBoardAccessIdentity = typeof settings.data.paperclipBoardAccessIdentity === "string" && settings.data.paperclipBoardAccessIdentity.trim() ? settings.data.paperclipBoardAccessIdentity.trim() : null;
     const nextScheduleFrequencyMinutes = normalizeScheduleFrequencyMinutes(settings.data.scheduleFrequencyMinutes);
     setForm({
       mappings: settings.data.mappings ?? [],
@@ -30794,18 +31122,12 @@ function GitHubSyncSettingsPage() {
     setScheduleFrequencyDraft(String(nextScheduleFrequencyMinutes));
     setIgnoredAuthorsDraft(normalizeAdvancedSettings(settings.data.advancedSettings).ignoredIssueAuthorUsernames.join(", "));
     setTokenDraft("");
-    if (!settings.data.paperclipBoardAccessConfigured) {
-      setBoardAccessIdentity(null);
-    }
-    if (settings.data.githubTokenConfigured) {
-      setShowSavedTokenHint(true);
-      setShowTokenEditor(false);
-      setTokenStatusOverride("valid");
-    } else if (!showSavedTokenHint) {
-      setShowTokenEditor(true);
-      setValidatedLogin(null);
-    }
-  }, [settings.data, showSavedTokenHint]);
+    setValidatedLogin(tokenUiState.validatedLogin);
+    setBoardAccessIdentity(settings.data.paperclipBoardAccessConfigured ? savedBoardAccessIdentity : null);
+    setShowSavedTokenHint(tokenUiState.showSavedTokenHint);
+    setShowTokenEditor(tokenUiState.showTokenEditor);
+    setTokenStatusOverride(tokenUiState.tokenStatusOverride);
+  }, [settings.data]);
   useEffect2(() => {
     const companyId = hostContext.companyId;
     if (!companyId || tokenStatusOverride === "invalid") {
@@ -30879,6 +31201,75 @@ function GitHubSyncSettingsPage() {
       cancelled = true;
     };
   }, [currentSettings?.availableAssignees?.length, currentSettings?.updatedAt, hostContext.companyId]);
+  useEffect2(() => {
+    const companyId = hostContext.companyId;
+    const secretRef = settings.data?.githubTokenNeedsConfigSync ? settings.data.githubTokenConfigSyncRef : void 0;
+    if (!companyId || !secretRef) {
+      return;
+    }
+    const attemptKey = `${companyId}:${secretRef}`;
+    if (githubTokenConfigSyncAttemptRef.current === attemptKey) {
+      return;
+    }
+    githubTokenConfigSyncAttemptRef.current = attemptKey;
+    let cancelled = false;
+    void (async () => {
+      try {
+        const pluginId = await resolveCurrentPluginId(pluginIdFromLocation);
+        if (!pluginId) {
+          throw new Error("Plugin id is required to finish syncing the GitHub token secret into plugin config.");
+        }
+        await patchPluginConfig(pluginId, {
+          githubTokenRefs: {
+            [companyId]: secretRef
+          }
+        });
+        if (cancelled) {
+          return;
+        }
+        const selectedAgentIds = normalizeAgentIds(settings.data?.advancedSettings?.githubTokenPropagationAgentIds);
+        if (selectedAgentIds.length > 0) {
+          try {
+            await propagateGitHubTokenToSelectedAgents({
+              selectedAgentIds,
+              previousAgentIds: selectedAgentIds,
+              githubTokenSecretRef: secretRef
+            });
+          } catch {
+          }
+        }
+        notifyGitHubSyncSettingsChanged();
+        try {
+          await settings.refresh();
+        } catch {
+          return;
+        }
+      } catch (error) {
+        if (cancelled) {
+          return;
+        }
+        toast({
+          title: "GitHub token needs reconnection",
+          body: getActionErrorMessage(
+            error,
+            "GitHub Sync could not finish migrating the saved GitHub token secret into plugin config."
+          ),
+          tone: "error"
+        });
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [
+    hostContext.companyId,
+    pluginIdFromLocation,
+    settings.data?.advancedSettings?.githubTokenPropagationAgentIds,
+    settings.data?.githubTokenConfigSyncRef,
+    settings.data?.githubTokenNeedsConfigSync,
+    settings.refresh,
+    toast
+  ]);
   useEffect2(() => {
     const companyId = hostContext.companyId;
     const secretRef = settings.data?.paperclipBoardAccessNeedsConfigSync ? settings.data.paperclipBoardAccessConfigSyncRef : void 0;
@@ -31006,6 +31397,7 @@ function GitHubSyncSettingsPage() {
   const hasSavedToken = Boolean(form.githubTokenConfigured || showSavedTokenHint);
   const boardAccessConfigured = Boolean(form.paperclipBoardAccessConfigured);
   const boardAccessRequired = boardAccessRequirement.required;
+  const boardAccessVisible = boardAccessRequirement.visible;
   const boardAccessReady = !boardAccessRequired || hasCompanyContext && boardAccessConfigured;
   const tokenStatus = tokenStatusOverride ?? (hasSavedToken ? "valid" : "required");
   const tokenTone = tokenStatus === "valid" ? "success" : tokenStatus === "invalid" ? "danger" : "warning";
@@ -31028,6 +31420,10 @@ function GitHubSyncSettingsPage() {
     (currentSettings?.availableAssignees?.length ? currentSettings.availableAssignees : null) ?? (form.availableAssignees?.length ? form.availableAssignees : null) ?? browserAvailableAssignees,
     form.advancedSettings.defaultAssigneeAgentId
   );
+  const propagationAgents = getAvailablePropagationAgentOptions(
+    (currentSettings?.availableAssignees?.length ? currentSettings.availableAssignees : null) ?? (form.availableAssignees?.length ? form.availableAssignees : null) ?? browserAvailableAssignees,
+    form.advancedSettings.githubTokenPropagationAgentIds
+  );
   const savedMappingsSource = currentSettings ? currentSettings.mappings ?? [] : form.mappings;
   const savedMappings = getComparableMappings(savedMappingsSource);
   const draftMappings = getComparableMappings(form.mappings);
@@ -31069,7 +31465,7 @@ function GitHubSyncSettingsPage() {
   const canConnectBoardAccess = hasCompanyContext && !settingsMutationsLocked && !connectingBoardAccess && !showInitialLoadingState;
   const boardAccessStatusLabel = !hasCompanyContext ? "Unavailable" : boardAccessBannerLabel;
   const boardAccessStatusTone = !hasCompanyContext ? boardAccessRequired ? "warning" : "neutral" : boardAccessTone;
-  const boardAccessSummaryText = !hasCompanyContext ? boardAccessRequired ? "Select a company." : "Select a company." : connectingBoardAccess ? "Approval in progress." : boardAccessConfigured ? "Connected." : boardAccessRequired ? "Required for sync." : boardAccessRequirement.status === "loading" ? "Checking requirement." : "Optional.";
+  const boardAccessSummaryText = !hasCompanyContext ? boardAccessRequired ? "Select a company." : "Select a company." : connectingBoardAccess ? "Approval in progress." : boardAccessConfigured ? boardAccessIdentity ? `Connected as ${boardAccessIdentity}.` : "Connected." : boardAccessRequired ? "Required for sync." : boardAccessRequirement.status === "loading" ? "Checking requirement." : "Optional.";
   const showTokenForm = tokenStatus !== "valid" || showTokenEditor;
   const lastUpdated = formatDate(form.updatedAt ?? currentSettings?.updatedAt, "Not saved yet");
   const lastSync = formatDate(displaySyncState.checkedAt, "Never");
@@ -31095,7 +31491,9 @@ function GitHubSyncSettingsPage() {
   const manualSyncScopePillClass = hasCompanyContext ? "ghsync__scope-pill ghsync__scope-pill--company" : "ghsync__scope-pill ghsync__scope-pill--mixed";
   const manualSyncScopePillLabel = hasCompanyContext ? "This company" : "All companies";
   const manualSyncButtonLabel = hasCompanyContext ? "Run sync for this company" : "Run sync across all companies";
-  const advancedSettingsSummary = formatAdvancedSettingsSummary(form.advancedSettings, availableAssignees);
+  const advancedSettingsSummary = formatAdvancedSettingsSummary(form.advancedSettings, availableAssignees, {
+    includePropagation: boardAccessVisible
+  });
   const assigneeSelectOptions = [
     { value: "", label: "Unassigned" },
     ...availableAssignees.map((option) => ({
@@ -31104,6 +31502,11 @@ function GitHubSyncSettingsPage() {
       icon: "agent"
     }))
   ];
+  const propagationAgentOptions = propagationAgents.map((option) => ({
+    value: option.id,
+    label: formatAssigneeOptionLabel(option),
+    icon: "agent"
+  }));
   const statusSelectOptions = PAPERCLIP_STATUS_OPTIONS.map((option) => ({
     value: option.value,
     label: option.label,
@@ -31234,6 +31637,37 @@ function GitHubSyncSettingsPage() {
       };
     });
   }
+  async function propagateGitHubTokenToSelectedAgents(options) {
+    if (!boardAccessVisible) {
+      return;
+    }
+    const selectedAgentIds = normalizeAgentIds(options.selectedAgentIds);
+    const previousAgentIds = normalizeAgentIds(options.previousAgentIds);
+    if (selectedAgentIds.length === 0 && previousAgentIds.length === 0) {
+      return;
+    }
+    let githubTokenSecretRef = typeof options.githubTokenSecretRef === "string" && options.githubTokenSecretRef.trim() ? options.githubTokenSecretRef.trim() : void 0;
+    if (!githubTokenSecretRef) {
+      const companyId = hostContext.companyId;
+      if (!companyId) {
+        throw new Error("Company context is required to propagate the GitHub token to selected agents.");
+      }
+      const pluginId = await resolveCurrentPluginId(pluginIdFromLocation);
+      if (!pluginId) {
+        throw new Error("Plugin id is required to propagate the GitHub token to selected agents.");
+      }
+      const currentConfigResponse = await fetchJson(`/api/plugins/${pluginId}/config`);
+      githubTokenSecretRef = normalizePluginConfig(currentConfigResponse?.configJson).githubTokenRefs?.[companyId];
+    }
+    if (!githubTokenSecretRef) {
+      throw new Error("GitHub token propagation requires a GitHub token saved through this settings page.");
+    }
+    await syncGitHubTokenPropagationForAgents({
+      githubTokenSecretRef,
+      selectedAgentIds,
+      previousAgentIds
+    });
+  }
   async function handleSaveToken(event) {
     event.preventDefault();
     setSubmittingToken(true);
@@ -31273,12 +31707,26 @@ function GitHubSyncSettingsPage() {
       const secretName = `github_sync_${companyId.replace(/[^a-z0-9]+/gi, "_").toLowerCase()}`;
       const secret = await resolveOrCreateCompanySecret(companyId, secretName, trimmedToken);
       await patchPluginConfig(pluginId, {
-        githubTokenRef: secret.id
+        githubTokenRefs: {
+          [companyId]: secret.id
+        }
       });
       await saveRegistration({
         companyId,
-        githubTokenRef: secret.id
+        githubTokenRef: secret.id,
+        githubTokenLogin: validation.login
       });
+      const selectedAgentIds = normalizeAgentIds(currentSettings?.advancedSettings?.githubTokenPropagationAgentIds);
+      let propagationError = null;
+      try {
+        await propagateGitHubTokenToSelectedAgents({
+          selectedAgentIds,
+          previousAgentIds: selectedAgentIds,
+          githubTokenSecretRef: secret.id
+        });
+      } catch (error) {
+        propagationError = error;
+      }
       setForm((current) => ({
         ...current,
         githubTokenConfigured: true
@@ -31293,6 +31741,16 @@ function GitHubSyncSettingsPage() {
         body: "Token saved.",
         tone: "success"
       });
+      if (propagationError) {
+        toast({
+          title: "GitHub token saved, but agent propagation needs attention",
+          body: getActionErrorMessage(
+            propagationError,
+            "GitHub Sync could not update the selected agents with the saved token."
+          ),
+          tone: "error"
+        });
+      }
       notifyGitHubSyncSettingsChanged();
       try {
         await settings.refresh();
@@ -31348,7 +31806,8 @@ function GitHubSyncSettingsPage() {
       });
       await updateBoardAccess({
         companyId,
-        paperclipBoardApiTokenRef: secret.id
+        paperclipBoardApiTokenRef: secret.id,
+        paperclipBoardAccessIdentity: identity ?? ""
       });
       setBoardAccessIdentity(identity);
       setForm((current) => ({
@@ -31428,6 +31887,15 @@ function GitHubSyncSettingsPage() {
         scheduleFrequencyMinutes,
         ...trustedPaperclipApiBaseUrl ? { paperclipApiBaseUrl: trustedPaperclipApiBaseUrl } : {}
       });
+      let propagationError = null;
+      try {
+        await propagateGitHubTokenToSelectedAgents({
+          selectedAgentIds: normalizeAgentIds(normalizeAdvancedSettings(result.advancedSettings).githubTokenPropagationAgentIds),
+          previousAgentIds: normalizeAgentIds(currentSettings?.advancedSettings?.githubTokenPropagationAgentIds)
+        });
+      } catch (error) {
+        propagationError = error;
+      }
       setForm((current) => ({
         ...current,
         mappings: result.mappings.length > 0 ? result.mappings : [createEmptyMapping(0)],
@@ -31444,6 +31912,16 @@ function GitHubSyncSettingsPage() {
         body: `Advanced defaults, mappings, and automatic sync are saved for ${currentCompanyName}.`,
         tone: "success"
       });
+      if (propagationError) {
+        toast({
+          title: "Settings saved, but agent propagation needs attention",
+          body: getActionErrorMessage(
+            propagationError,
+            "GitHub Sync could not apply the selected agent token propagation updates."
+          ),
+          tone: "error"
+        });
+      }
       notifyGitHubSyncSettingsChanged();
       try {
         await settings.refresh();
@@ -31685,7 +32163,7 @@ function GitHubSyncSettingsPage() {
             /* @__PURE__ */ jsx2("div", { className: "ghsync__permission-audit-list", children: /* @__PURE__ */ jsx2("div", { className: "ghsync__permission-audit-item", children: /* @__PURE__ */ jsx2("span", { children: tokenPermissionAuditData?.warnings[0] ?? "Add a mapped repository in this company so GitHub Sync can verify the token permissions it needs." }) }) })
           ] }) : null
         ] }),
-        /* @__PURE__ */ jsxs2("section", { className: "ghsync__section", children: [
+        boardAccessVisible ? /* @__PURE__ */ jsxs2("section", { className: "ghsync__section", children: [
           /* @__PURE__ */ jsxs2("div", { className: "ghsync__section-head", children: [
             /* @__PURE__ */ jsxs2("div", { className: "ghsync__section-copy", children: [
               /* @__PURE__ */ jsxs2("div", { className: "ghsync__section-title-row", children: [
@@ -31699,7 +32177,7 @@ function GitHubSyncSettingsPage() {
           hostContext.companyId ? /* @__PURE__ */ jsxs2("div", { className: "ghsync__connected", children: [
             /* @__PURE__ */ jsxs2("div", { children: [
               /* @__PURE__ */ jsx2("strong", { children: boardAccessConfigured ? boardAccessIdentity ? `Connected as ${boardAccessIdentity}` : "Connected" : boardAccessRequired ? "Required" : boardAccessRequirement.status === "loading" ? "Checking requirement" : "Optional" }),
-              /* @__PURE__ */ jsx2("span", { children: boardAccessConfigured ? "Used for Paperclip API calls." : boardAccessRequired ? "Required in authenticated deployments." : boardAccessRequirement.status === "loading" ? "Checking whether it is required." : "Only needed when Paperclip API calls require sign-in." })
+              /* @__PURE__ */ jsx2("span", { children: boardAccessConfigured ? "Used for Paperclip API calls." : boardAccessRequired ? "Required in authenticated deployments." : boardAccessRequirement.status === "loading" ? "Checking whether it is required." : "Available here for local testing and only required when Paperclip API calls need sign-in." })
             ] }),
             /* @__PURE__ */ jsx2(
               "button",
@@ -31727,7 +32205,7 @@ function GitHubSyncSettingsPage() {
             ] }),
             /* @__PURE__ */ jsx2("span", { className: "ghsync__badge ghsync__badge--neutral", children: "Unavailable" })
           ] })
-        ] }),
+        ] }) : null,
         /* @__PURE__ */ jsxs2("section", { className: "ghsync__section", children: [
           /* @__PURE__ */ jsxs2("div", { className: "ghsync__section-head", children: [
             /* @__PURE__ */ jsxs2("div", { className: "ghsync__section-copy", children: [
@@ -31954,7 +32432,29 @@ function GitHubSyncSettingsPage() {
                 }
               ),
               /* @__PURE__ */ jsx2("p", { className: "ghsync__hint", children: "Comma or newline separated." })
-            ] })
+            ] }),
+            boardAccessVisible ? /* @__PURE__ */ jsxs2("div", { className: "ghsync__field", children: [
+              /* @__PURE__ */ jsx2("label", { htmlFor: "advanced-token-propagation", children: "Propagate GitHub token to agents" }),
+              /* @__PURE__ */ jsx2(
+                SettingsAgentMultiPicker,
+                {
+                  id: "advanced-token-propagation",
+                  values: form.advancedSettings.githubTokenPropagationAgentIds ?? [],
+                  options: propagationAgentOptions,
+                  disabled: settingsMutationsLocked || tokenStatus !== "valid",
+                  onChange: (nextValues) => {
+                    setForm((current) => ({
+                      ...current,
+                      advancedSettings: {
+                        ...current.advancedSettings,
+                        ...nextValues.length > 0 ? { githubTokenPropagationAgentIds: nextValues } : { githubTokenPropagationAgentIds: void 0 }
+                      }
+                    }));
+                  }
+                }
+              ),
+              /* @__PURE__ */ jsx2("p", { className: "ghsync__hint", children: tokenStatus === "valid" ? "Selected agents receive `GITHUB_TOKEN` from the saved GitHub secret when you save settings." : "Save a valid GitHub token before choosing agents to propagate it to." })
+            ] }) : null
           ] }) : null
         ] }),
         /* @__PURE__ */ jsxs2("section", { className: "ghsync__section", children: [
@@ -32107,13 +32607,13 @@ function GitHubSyncSettingsPage() {
             ] }),
             /* @__PURE__ */ jsx2("span", { children: !repositoriesUnlocked ? "Requires a token." : savedMappingCount > 0 ? hasCompanyContext ? `${savedMappingCount} saved.` : `${savedMappingCount} saved.` : hasCompanyContext ? "Add a repository." : "Select a company." })
           ] }),
-          /* @__PURE__ */ jsxs2("div", { className: "ghsync__check", children: [
+          boardAccessVisible ? /* @__PURE__ */ jsxs2("div", { className: "ghsync__check", children: [
             /* @__PURE__ */ jsxs2("div", { className: "ghsync__check-top", children: [
               /* @__PURE__ */ jsx2("strong", { children: "Paperclip board access" }),
               /* @__PURE__ */ jsx2("span", { className: `ghsync__badge ${getToneClass(boardAccessStatusTone)}`, children: boardAccessStatusLabel })
             ] }),
             /* @__PURE__ */ jsx2("span", { children: boardAccessSummaryText })
-          ] }),
+          ] }) : null,
           /* @__PURE__ */ jsxs2("div", { className: "ghsync__check", children: [
             /* @__PURE__ */ jsxs2("div", { className: "ghsync__check-top", children: [
               /* @__PURE__ */ jsx2("strong", { children: "Sync" }),
@@ -33123,6 +33623,8 @@ export {
   GitHubSyncProjectPullRequestsSidebarItem,
   GitHubSyncSettingsPage,
   index_default as default,
-  resolveOrCreateProject
+  resolveOrCreateProject,
+  resolveSavedTokenUiState,
+  syncGitHubTokenPropagationForAgents
 };
 //# sourceMappingURL=index.js.map