paperclip-github-plugin 0.3.6 → 0.4.1

package/dist/worker.js

@@ -1600,13 +1600,16 @@ function buildGitHubRepositoryTokenCapabilityAudit(params) {
 function normalizeSecretRef(value) {
   return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
-function normalizeGitHubUserLogin(value) {
+function normalizeGitHubLowercaseString(value) {
   if (typeof value !== "string") {
     return void 0;
   }
   const trimmed = stripNullBytes(value).trim();
   return trimmed ? trimmed.toLowerCase() : void 0;
 }
+function normalizeGitHubUserLogin(value) {
+  return normalizeGitHubLowercaseString(value);
+}
 function normalizeGitHubTokenRef(value) {
   return normalizeSecretRef(value);
 }
@@ -2234,7 +2237,7 @@ async function hydrateRecoveredPaperclipIssueGitHubLink(ctx, issueId, fallbackLi
   }
   let octokit;
   try {
-    octokit = await createGitHubToolOctokit(ctx);
+    octokit = await createGitHubToolOctokit(ctx, fallbackLink.companyId);
   } catch {
     return null;
   }
@@ -2409,8 +2412,8 @@ function extractGitHubLinksFromCommentBody(body) {
 async function buildToolbarSyncState(ctx, input) {
   const settings = await getActiveOrCurrentSyncState(ctx);
   const config = await getResolvedConfig(ctx);
-  const githubTokenConfigured = hasConfiguredGithubToken(settings, config);
   const companyId = typeof input.companyId === "string" && input.companyId.trim() ? input.companyId.trim() : void 0;
+  const githubTokenConfigured = hasConfiguredGithubToken(settings, config, companyId);
   const entityId = typeof input.entityId === "string" && input.entityId.trim() ? input.entityId.trim() : void 0;
   const entityType = typeof input.entityType === "string" && input.entityType.trim() ? input.entityType.trim() : void 0;
   const savedMappingCount = companyId ? getSyncableMappingsForTarget(settings.mappings, {
@@ -2622,21 +2625,53 @@ function sanitizeSettingsForCurrentSetup(settings, setup) {
 }
 function getPublicSettings(settings) {
   const {
+    githubTokenRefs: _githubTokenRefs,
+    githubTokenLoginsByCompanyId: _githubTokenLoginsByCompanyId,
     githubTokenRef: _githubTokenRef,
     paperclipBoardApiTokenRefs: _paperclipBoardApiTokenRefs,
+    paperclipBoardAccessIdentityByCompanyId: _paperclipBoardAccessIdentityByCompanyId,
     companyAdvancedSettingsByCompanyId: _companyAdvancedSettingsByCompanyId,
     ...publicSettings
   } = settings;
   return publicSettings;
 }
+function getPaperclipBoardAccessIdentity(settings, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  if (!normalizedCompanyId) {
+    return void 0;
+  }
+  return normalizeOptionalString2(settings.paperclipBoardAccessIdentityByCompanyId?.[normalizedCompanyId]);
+}
 function getPublicSettingsForScope(settings, companyId) {
   const publicSettings = getPublicSettings(settings);
+  const paperclipBoardAccessIdentity = getPaperclipBoardAccessIdentity(settings, companyId);
   return {
     ...publicSettings,
     mappings: filterMappingsByCompany(publicSettings.mappings, companyId),
-    advancedSettings: getCompanyAdvancedSettings(settings, companyId)
+    advancedSettings: getCompanyAdvancedSettings(settings, companyId),
+    ...paperclipBoardAccessIdentity ? { paperclipBoardAccessIdentity } : {}
   };
 }
+function getSavedGitHubTokenRef(settings, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  if (normalizedCompanyId) {
+    const scopedSecretRef = normalizeSecretRef(settings?.githubTokenRefs?.[normalizedCompanyId]);
+    if (scopedSecretRef) {
+      return scopedSecretRef;
+    }
+  }
+  return normalizeGitHubTokenRef(settings?.githubTokenRef);
+}
+function getSavedGitHubTokenLogin(settings, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  if (normalizedCompanyId) {
+    const scopedLogin = normalizeOptionalString2(settings?.githubTokenLoginsByCompanyId?.[normalizedCompanyId]);
+    if (scopedLogin) {
+      return scopedLogin;
+    }
+  }
+  return normalizeOptionalString2(settings?.githubTokenLogin);
+}
 async function listAvailableAssignees(ctx, companyId) {
   try {
     const agents = await ctx.agents.list({
@@ -2940,11 +2975,13 @@ function normalizeConfig(value) {
     return {};
   }
   const record = value;
+  const githubTokenRefs = normalizeGitHubTokenRefs(record.githubTokenRefs);
   const githubTokenRef = normalizeGitHubTokenRef(record.githubTokenRef);
   const githubToken = normalizeGitHubToken(record.githubToken);
   const paperclipBoardApiTokenRefs = normalizePaperclipBoardApiTokenRefs(record.paperclipBoardApiTokenRefs);
   const paperclipApiBaseUrl = normalizePaperclipApiBaseUrl(record.paperclipApiBaseUrl);
   return {
+    ...githubTokenRefs ? { githubTokenRefs } : {},
     ...githubTokenRef ? { githubTokenRef } : {},
     ...githubToken ? { githubToken } : {},
     ...paperclipBoardApiTokenRefs ? { paperclipBoardApiTokenRefs } : {},
@@ -3023,6 +3060,12 @@ async function readExternalConfig(ctx) {
   }
 }
 function normalizePaperclipBoardApiTokenRefs(value) {
+  return normalizeCompanySecretRefs(value);
+}
+function normalizeGitHubTokenRefs(value) {
+  return normalizeCompanySecretRefs(value);
+}
+function normalizeCompanySecretRefs(value) {
   if (!value || typeof value !== "object") {
     return void 0;
   }
@@ -3036,6 +3079,34 @@ function normalizePaperclipBoardApiTokenRefs(value) {
   }
   return Object.fromEntries(entries);
 }
+function normalizeGitHubTokenLoginsByCompanyId(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, login]) => {
+    const normalizedCompanyId = normalizeCompanyId(companyId);
+    const normalizedLogin = normalizeOptionalString2(login);
+    return normalizedCompanyId && normalizedLogin ? [normalizedCompanyId, normalizedLogin] : null;
+  }).filter((entry) => entry !== null);
+  if (entries.length === 0) {
+    return void 0;
+  }
+  return Object.fromEntries(entries);
+}
+function normalizePaperclipBoardAccessIdentityByCompanyId(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, identityLabel]) => {
+    const normalizedCompanyId = normalizeCompanyId(companyId);
+    const normalizedIdentityLabel = normalizeOptionalString2(identityLabel);
+    return normalizedCompanyId && normalizedIdentityLabel ? [normalizedCompanyId, normalizedIdentityLabel] : null;
+  }).filter((entry) => entry !== null);
+  if (entries.length === 0) {
+    return void 0;
+  }
+  return Object.fromEntries(entries);
+}
 function normalizeSyncCancellationRequest(value) {
   if (!value || typeof value !== "object") {
     return null;
@@ -3122,6 +3193,10 @@ function normalizeIgnoredIssueAuthorUsernames(value) {
   const entries = Array.isArray(value) ? value.map((entry) => normalizeGitHubUsername(entry)).filter((entry) => Boolean(entry)) : typeof value === "string" ? parseIgnoredIssueAuthorUsernames(value) : [];
   return [...new Set(entries)];
 }
+function normalizeAgentIds(value) {
+  const entries = Array.isArray(value) ? value.map((entry) => normalizeOptionalString2(entry)).filter((entry) => Boolean(entry)) : [];
+  return [...new Set(entries)].sort((left, right) => left.localeCompare(right));
+}
 function normalizeAdvancedSettings(value) {
   if (!value || typeof value !== "object") {
     return DEFAULT_ADVANCED_SETTINGS;
@@ -3130,10 +3205,12 @@ function normalizeAdvancedSettings(value) {
   const defaultAssigneeAgentId = normalizeOptionalString2(record.defaultAssigneeAgentId);
   const defaultStatus = "defaultStatus" in record ? coercePaperclipIssueStatus(record.defaultStatus) : DEFAULT_ADVANCED_SETTINGS.defaultStatus;
   const ignoredIssueAuthorUsernames = "ignoredIssueAuthorUsernames" in record ? normalizeIgnoredIssueAuthorUsernames(record.ignoredIssueAuthorUsernames) : DEFAULT_ADVANCED_SETTINGS.ignoredIssueAuthorUsernames;
+  const githubTokenPropagationAgentIds = "githubTokenPropagationAgentIds" in record ? normalizeAgentIds(record.githubTokenPropagationAgentIds) : [];
   return {
     ...defaultAssigneeAgentId ? { defaultAssigneeAgentId } : {},
     defaultStatus,
-    ignoredIssueAuthorUsernames
+    ignoredIssueAuthorUsernames,
+    ...githubTokenPropagationAgentIds.length > 0 ? { githubTokenPropagationAgentIds } : {}
   };
 }
 function normalizeCompanyAdvancedSettingsByCompanyId(value) {
@@ -3234,16 +3311,26 @@ function normalizeSettings(value) {
   }
   const record = value;
   const paperclipApiBaseUrl = resolvePaperclipApiBaseUrl(record.paperclipApiBaseUrl);
+  const githubTokenRefs = normalizeGitHubTokenRefs(record.githubTokenRefs);
+  const githubTokenLoginsByCompanyId = normalizeGitHubTokenLoginsByCompanyId(record.githubTokenLoginsByCompanyId);
   const githubTokenRef = normalizeGitHubTokenRef(record.githubTokenRef);
+  const githubTokenLogin = normalizeOptionalString2(record.githubTokenLogin);
   const paperclipBoardApiTokenRefs = normalizePaperclipBoardApiTokenRefs(record.paperclipBoardApiTokenRefs);
+  const paperclipBoardAccessIdentityByCompanyId = normalizePaperclipBoardAccessIdentityByCompanyId(
+    record.paperclipBoardAccessIdentityByCompanyId
+  );
   const companyAdvancedSettingsByCompanyId = normalizeCompanyAdvancedSettingsByCompanyId(record.companyAdvancedSettingsByCompanyId);
   return {
     mappings: normalizeMappings(record.mappings),
     syncState: normalizeSyncState(record.syncState),
     scheduleFrequencyMinutes: normalizeScheduleFrequencyMinutes(record.scheduleFrequencyMinutes),
     ...paperclipApiBaseUrl ? { paperclipApiBaseUrl } : {},
+    ...githubTokenRefs ? { githubTokenRefs } : {},
+    ...githubTokenLoginsByCompanyId ? { githubTokenLoginsByCompanyId } : {},
     ...githubTokenRef ? { githubTokenRef } : {},
+    ...githubTokenLogin ? { githubTokenLogin } : {},
     ...paperclipBoardApiTokenRefs ? { paperclipBoardApiTokenRefs } : {},
+    ...paperclipBoardAccessIdentityByCompanyId ? { paperclipBoardAccessIdentityByCompanyId } : {},
     ...companyAdvancedSettingsByCompanyId ? { companyAdvancedSettingsByCompanyId } : {},
     updatedAt: typeof record.updatedAt === "string" ? record.updatedAt : void 0
   };
@@ -4207,8 +4294,9 @@ async function isGitHubUserRepositoryMaintainer(octokit, repository, login, cach
         "X-GitHub-Api-Version": GITHUB_API_VERSION
       }
     });
-    const roleName = response.data && typeof response.data === "object" && "role_name" in response.data ? normalizeGitHubUserLogin(response.data.role_name) : void 0;
-    const isMaintainer = roleName ? GITHUB_REPOSITORY_MAINTAINER_ROLE_NAMES.has(roleName) : false;
+    const permission = response.data && typeof response.data === "object" && "permission" in response.data ? normalizeGitHubLowercaseString(response.data.permission) : void 0;
+    const roleName = response.data && typeof response.data === "object" && "role_name" in response.data ? normalizeGitHubLowercaseString(response.data.role_name) : void 0;
+    const isMaintainer = (permission ? GITHUB_REPOSITORY_MAINTAINER_ROLE_NAMES.has(permission) : false) || (roleName ? GITHUB_REPOSITORY_MAINTAINER_ROLE_NAMES.has(roleName) : false);
     cache.set(cacheKey, isMaintainer);
     return isMaintainer;
   } catch (error) {
@@ -6133,19 +6221,20 @@ async function getResolvedConfig(ctx) {
     ...normalizeConfig(savedConfig)
   };
 }
-function getConfiguredGithubTokenSource(settings, config) {
-  const secretRef = normalizeGitHubTokenRef(config.githubTokenRef) ?? normalizeGitHubTokenRef(settings?.githubTokenRef);
+function getConfiguredGithubTokenSource(settings, config, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  const secretRef = (normalizedCompanyId ? normalizeSecretRef(config.githubTokenRefs?.[normalizedCompanyId]) ?? getSavedGitHubTokenRef(settings, normalizedCompanyId) : void 0) ?? normalizeGitHubTokenRef(config.githubTokenRef) ?? getSavedGitHubTokenRef(settings);
   if (secretRef) {
     return { secretRef };
   }
   const token = normalizeGitHubToken(config.githubToken);
   return token ? { token } : {};
 }
-function getConfiguredGithubTokenRef(settings, config) {
-  return getConfiguredGithubTokenSource(settings, config).secretRef;
+function getConfiguredGithubTokenRef(settings, config, companyId) {
+  return getConfiguredGithubTokenSource(settings, config, companyId).secretRef;
 }
-function hasConfiguredGithubToken(settings, config) {
-  const configuredTokenSource = getConfiguredGithubTokenSource(settings, config);
+function hasConfiguredGithubToken(settings, config, companyId) {
+  const configuredTokenSource = getConfiguredGithubTokenSource(settings, config, companyId);
   return Boolean(configuredTokenSource.secretRef ?? configuredTokenSource.token);
 }
 function getSavedPaperclipBoardApiTokenRef(settings, companyId) {
@@ -6229,7 +6318,7 @@ async function resolvePaperclipApiAuthTokens(ctx, settings, config, mappings) {
 async function resolveGithubToken(ctx, options = {}) {
   const settings = options.settings ?? normalizeSettings(await ctx.state.get(SETTINGS_SCOPE));
   const config = options.config ?? await getResolvedConfig(ctx);
-  const configuredTokenSource = getConfiguredGithubTokenSource(settings, config);
+  const configuredTokenSource = getConfiguredGithubTokenSource(settings, config, options.companyId);
   if (configuredTokenSource.secretRef) {
     return ctx.secrets.resolve(configuredTokenSource.secretRef);
   }
@@ -6307,8 +6396,8 @@ async function executeGitHubTool(fn) {
     return buildToolErrorResult(error);
   }
 }
-async function createGitHubToolOctokit(ctx) {
-  const token = (await resolveGithubToken(ctx)).trim();
+async function createGitHubToolOctokit(ctx, companyId) {
+  const token = (await resolveGithubToken(ctx, { companyId })).trim();
   if (!token) {
     throw new Error(MISSING_GITHUB_TOKEN_SYNC_MESSAGE);
   }
@@ -7730,7 +7819,7 @@ async function getOrLoadCachedProjectPullRequestMetricsEntry(ctx, scope, octokit
     return inFlightMetrics;
   }
   const loadMetricsPromise = (async () => {
-    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx);
+    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx, scope.companyId);
     const metrics = await listProjectPullRequestMetrics(resolvedOctokit, scope);
     return cacheProjectPullRequestMetricsEntry(scope, metrics);
   })();
@@ -7768,7 +7857,7 @@ async function getOrLoadCachedProjectPullRequestCount(ctx, scope, octokit) {
     return inFlightCount;
   }
   const loadCountPromise = (async () => {
-    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx);
+    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx, scope.companyId);
     const totalOpenPullRequests = await listProjectPullRequestCount(resolvedOctokit, scope);
     return setCacheValue(
       activeProjectPullRequestCountCache,
@@ -7880,7 +7969,7 @@ async function getOrLoadProjectPullRequestSummaryRecordsForNumbers(ctx, scope, p
   }
   const missingPullRequestNumbers = normalizedPullRequestNumbers.filter((pullRequestNumber) => !recordsByNumber.has(pullRequestNumber));
   if (missingPullRequestNumbers.length > 0) {
-    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx);
+    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx, scope.companyId);
     const loadedRecords = await listProjectPullRequestSummaryRecordsByNumbers(
       ctx,
       resolvedOctokit,
@@ -7990,7 +8079,7 @@ async function buildProjectPullRequestsPageData(ctx, input) {
   }
   const scope = await requireProjectPullRequestScope(ctx, input, projectMappings);
   const config = await getResolvedConfig(ctx);
-  if (!hasConfiguredGithubToken(settings, config)) {
+  if (!hasConfiguredGithubToken(settings, config, companyId)) {
     return {
       status: "missing_token",
       projectId,
@@ -8009,7 +8098,7 @@ async function buildProjectPullRequestsPageData(ctx, input) {
     };
   }
   try {
-    const octokit = await createGitHubToolOctokit(ctx);
+    const octokit = await createGitHubToolOctokit(ctx, companyId);
     const pageCacheKey = buildProjectPullRequestPageCacheKey(scope, filter, pageIndex, cursor);
     const cachedPage = getFreshCacheValue(activeProjectPullRequestPageCache, pageCacheKey);
     if (cachedPage) {
@@ -8181,7 +8270,7 @@ async function buildProjectPullRequestMetricsData(ctx, input) {
     };
   }
   const config = await getResolvedConfig(ctx);
-  if (!hasConfiguredGithubToken(settings, config)) {
+  if (!hasConfiguredGithubToken(settings, config, companyId)) {
     return {
       status: "missing_token",
       projectId,
@@ -8230,7 +8319,7 @@ async function buildProjectPullRequestCountData(ctx, input) {
     };
   }
   const config = await getResolvedConfig(ctx);
-  if (!hasConfiguredGithubToken(settings, config)) {
+  if (!hasConfiguredGithubToken(settings, config, companyId)) {
     return {
       status: "missing_token",
       projectId,
@@ -8267,7 +8356,7 @@ async function buildSettingsTokenPermissionAuditData(ctx, input) {
   }
   const settings = normalizeSettings(await ctx.state.get(SETTINGS_SCOPE));
   const config = await getResolvedConfig(ctx);
-  if (!hasConfiguredGithubToken(settings, config)) {
+  if (!hasConfiguredGithubToken(settings, config, requestedCompanyId)) {
     return {
       status: "missing_token",
       allRequiredPermissionsGranted: false,
@@ -8288,7 +8377,7 @@ async function buildSettingsTokenPermissionAuditData(ctx, input) {
     };
   }
   try {
-    const octokit = await createGitHubToolOctokit(ctx);
+    const octokit = await createGitHubToolOctokit(ctx, requestedCompanyId);
     const repositories = await Promise.all(
       [
         ...new Map(
@@ -8357,7 +8446,7 @@ async function buildProjectPullRequestDetailData(ctx, input) {
     buildProjectPullRequestSummaryRecordCacheKey(scope, pullRequestNumber)
   );
   const cachedLinkedIssue = cachedSummaryRecord ? getLinkedPaperclipIssueFromProjectPullRequestRecord(cachedSummaryRecord) : void 0;
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const response = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8488,7 +8577,7 @@ async function createProjectPullRequestPaperclipIssue(ctx, input) {
     throw new Error("This Paperclip runtime does not expose plugin issue creation yet.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const pullRequestResponse = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8562,7 +8651,7 @@ async function updateProjectPullRequestBranch(ctx, input) {
     throw new Error("pullRequestNumber is required.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const pullRequestResponse = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8625,7 +8714,7 @@ async function mergeProjectPullRequest(ctx, input) {
     throw new Error("pullRequestNumber is required.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const response = await octokit.rest.pulls.merge({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8649,7 +8738,7 @@ async function closeProjectPullRequest(ctx, input) {
     throw new Error("pullRequestNumber is required.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const response = await octokit.rest.pulls.update({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8678,7 +8767,7 @@ async function addProjectPullRequestComment(ctx, input) {
     throw new Error("Comment body cannot be empty.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const response = await createProjectPullRequestGitHubComment(octokit, scope, pullRequestNumber, body);
   invalidateProjectPullRequestCaches(scope);
   return {
@@ -8735,7 +8824,7 @@ async function requestProjectPullRequestCopilotAction(ctx, input) {
     throw new Error('action must be one of "fix_ci", "rebase", "address_review_feedback", or "review".');
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const pullRequestResponse = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8849,7 +8938,7 @@ async function reviewProjectPullRequest(ctx, input) {
   }
   const body = typeof input.body === "string" ? input.body.trim() : "";
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   let response;
   try {
     response = await octokit.rest.pulls.createReview({
@@ -8896,7 +8985,7 @@ async function rerunProjectPullRequestCi(ctx, input) {
     throw new Error("pullRequestNumber is required.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const pullRequestResponse = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -9632,9 +9721,11 @@ async function startSync(ctx, trigger, options = {}) {
     getResolvedConfig(ctx),
     ctx.state.get(SETTINGS_SCOPE).then((value) => normalizeSettings(value))
   ]);
+  const targetCompanyId = options.target?.companyId;
   const token = await resolveGithubToken(ctx, {
     config,
-    settings: persistedSettings
+    settings: persistedSettings,
+    companyId: targetCompanyId
   }).catch(() => "");
   let currentSettings = sanitizeSettingsForCurrentSetup(persistedSettings, {
     hasToken: Boolean(token.trim()),
@@ -9723,7 +9814,7 @@ function registerGitHubAgentTools(ctx) {
     getGitHubAgentToolDeclaration("search_repository_items"),
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const repository = await resolveGitHubToolRepository(ctx, runCtx, input);
       const rawQuery = normalizeOptionalToolString(input.query);
       if (!rawQuery) {
@@ -9792,7 +9883,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.rest.issues.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -9839,7 +9930,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const comments = await listAllGitHubIssueComments(octokit, target.repository, target.issueNumber);
       return buildToolSuccessResult(
         `Loaded ${comments.length} GitHub ${comments.length === 1 ? "comment" : "comments"} from issue #${target.issueNumber}.`,
@@ -9857,7 +9948,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const currentResponse = await octokit.rest.issues.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -9929,7 +10020,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const body = appendAiAuthorshipFooter(String(input.body ?? ""), normalizeOptionalToolString(input.llmModel) ?? "");
       const response = await octokit.rest.issues.createComment({
         owner: target.repository.owner,
@@ -9968,7 +10059,7 @@ function registerGitHubAgentTools(ctx) {
       if (!head || !base || !title) {
         throw new Error("head, base, and title are required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.rest.pulls.create({
         owner: repository.owner,
         repo: repository.repo,
@@ -10005,7 +10096,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.rest.pulls.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -10053,7 +10144,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       let currentResponse = await octokit.rest.pulls.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -10118,7 +10209,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const files = await listAllPullRequestFiles(octokit, target.repository, target.pullRequestNumber);
       return buildToolSuccessResult(
         `Loaded ${files.length} changed ${files.length === 1 ? "file" : "files"} from pull request #${target.pullRequestNumber}.`,
@@ -10136,7 +10227,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const pullRequestResponse = await octokit.rest.pulls.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -10234,7 +10325,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const threads = await listDetailedPullRequestReviewThreads(octokit, target.repository, target.pullRequestNumber);
       return buildToolSuccessResult(
         `Loaded ${threads.length} review ${threads.length === 1 ? "thread" : "threads"} from pull request #${target.pullRequestNumber}.`,
@@ -10249,14 +10340,14 @@ function registerGitHubAgentTools(ctx) {
   ctx.tools.register(
     "reply_to_review_thread",
     getGitHubAgentToolDeclaration("reply_to_review_thread"),
-    async (params) => executeGitHubTool(async () => {
+    async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const threadId = normalizeOptionalToolString(input.threadId);
       if (!threadId) {
         throw new Error("threadId is required.");
       }
       const body = appendAiAuthorshipFooter(String(input.body ?? ""), normalizeOptionalToolString(input.llmModel) ?? "");
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.graphql(
         GITHUB_ADD_PULL_REQUEST_REVIEW_THREAD_REPLY_MUTATION,
         {
@@ -10285,13 +10376,13 @@ function registerGitHubAgentTools(ctx) {
   ctx.tools.register(
     "resolve_review_thread",
     getGitHubAgentToolDeclaration("resolve_review_thread"),
-    async (params) => executeGitHubTool(async () => {
+    async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const threadId = normalizeOptionalToolString(input.threadId);
       if (!threadId) {
         throw new Error("threadId is required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.graphql(
         GITHUB_RESOLVE_REVIEW_THREAD_MUTATION,
         {
@@ -10316,13 +10407,13 @@ function registerGitHubAgentTools(ctx) {
   ctx.tools.register(
     "unresolve_review_thread",
     getGitHubAgentToolDeclaration("unresolve_review_thread"),
-    async (params) => executeGitHubTool(async () => {
+    async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const threadId = normalizeOptionalToolString(input.threadId);
       if (!threadId) {
         throw new Error("threadId is required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.graphql(
         GITHUB_UNRESOLVE_REVIEW_THREAD_MUTATION,
         {
@@ -10355,7 +10446,7 @@ function registerGitHubAgentTools(ctx) {
       if (userReviewers.length === 0 && teamReviewers.length === 0) {
         throw new Error("Provide at least one user reviewer or team reviewer.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.rest.pulls.requestReviewers({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -10380,13 +10471,13 @@ function registerGitHubAgentTools(ctx) {
   ctx.tools.register(
     "list_organization_projects",
     getGitHubAgentToolDeclaration("list_organization_projects"),
-    async (params) => executeGitHubTool(async () => {
+    async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const organization = normalizeOptionalToolString(input.organization);
       if (!organization) {
         throw new Error("organization is required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const projects = await listGitHubOrganizationProjects(octokit, organization, {
         includeClosed: input.includeClosed === true,
         query: normalizeOptionalToolString(input.query),
@@ -10407,7 +10498,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const projectTarget = await resolveGitHubProjectToolTarget(octokit, input);
       const pullRequest = await getGitHubPullRequestProjectItems(
         octokit,
@@ -10484,14 +10575,30 @@ var plugin = definePlugin({
       const importRegistry = normalizeImportRegistry(await ctx.state.get(IMPORT_REGISTRY_SCOPE));
       const normalizedSettings = normalizeSettings(saved);
       const config = await getResolvedConfig(ctx);
-      const githubTokenRef = getConfiguredGithubTokenRef(normalizedSettings, config);
+      const configuredGitHubTokenRef = requestedCompanyId ? normalizeSecretRef(config.githubTokenRefs?.[requestedCompanyId]) : normalizeGitHubTokenRef(config.githubTokenRef);
+      const savedGitHubTokenRef = getSavedGitHubTokenRef(normalizedSettings, requestedCompanyId);
+      const githubTokenRef = getConfiguredGithubTokenRef(normalizedSettings, config, requestedCompanyId);
+      const githubTokenLogin = getSavedGitHubTokenLogin(normalizedSettings, requestedCompanyId);
       const paperclipApiBaseUrl = getConfiguredPaperclipApiBaseUrl(normalizedSettings, config);
-      const githubTokenConfigured = hasConfiguredGithubToken(normalizedSettings, config);
+      const githubTokenConfigured = hasConfiguredGithubToken(normalizedSettings, config, requestedCompanyId);
       const configuredBoardTokenRef = getConfiguredPaperclipBoardApiTokenRef(config, requestedCompanyId);
       const savedBoardTokenRef = getSavedPaperclipBoardApiTokenRef(normalizedSettings, requestedCompanyId);
-      const settingsWithResolvedToken = githubTokenRef === normalizedSettings.githubTokenRef && paperclipApiBaseUrl === normalizedSettings.paperclipApiBaseUrl ? normalizedSettings : {
+      const settingsWithResolvedToken = githubTokenRef === getSavedGitHubTokenRef(normalizedSettings, requestedCompanyId) && githubTokenLogin === getSavedGitHubTokenLogin(normalizedSettings, requestedCompanyId) && paperclipApiBaseUrl === normalizedSettings.paperclipApiBaseUrl ? normalizedSettings : {
         ...normalizedSettings,
-        ...githubTokenRef ? { githubTokenRef } : {},
+        ...requestedCompanyId && githubTokenRef ? {
+          githubTokenRefs: {
+            ...normalizedSettings.githubTokenRefs ?? {},
+            [requestedCompanyId]: githubTokenRef
+          }
+        } : {},
+        ...requestedCompanyId && githubTokenLogin ? {
+          githubTokenLoginsByCompanyId: {
+            ...normalizedSettings.githubTokenLoginsByCompanyId ?? {},
+            [requestedCompanyId]: githubTokenLogin
+          }
+        } : {},
+        ...!requestedCompanyId && githubTokenRef ? { githubTokenRef } : {},
+        ...!requestedCompanyId && githubTokenLogin ? { githubTokenLogin } : {},
         ...paperclipApiBaseUrl ? { paperclipApiBaseUrl } : {}
       };
       const settingsForResponse = sanitizeSettingsForCurrentSetup(settingsWithResolvedToken, {
@@ -10508,6 +10615,9 @@ var plugin = definePlugin({
         ...includeAssignees ? { availableAssignees } : {},
         totalSyncedIssuesCount: countImportedIssuesForMappings(importRegistry, scopedMappings),
         githubTokenConfigured,
+        ...githubTokenLogin ? { githubTokenLogin } : {},
+        ...savedGitHubTokenRef ? { githubTokenConfigSyncRef: savedGitHubTokenRef } : {},
+        githubTokenNeedsConfigSync: Boolean(requestedCompanyId && savedGitHubTokenRef && !configuredGitHubTokenRef),
         paperclipBoardAccessConfigured: requestedCompanyId ? hasConfiguredPaperclipBoardAccess(settingsForResponse, config, requestedCompanyId) : hasConfiguredPaperclipBoardAccessForMappings(settingsForResponse, config, scopedMappings),
         ...savedBoardTokenRef ? { paperclipBoardAccessConfigSyncRef: savedBoardTokenRef } : {},
         paperclipBoardAccessNeedsConfigSync: Boolean(savedBoardTokenRef && !configuredBoardTokenRef)
@@ -10560,11 +10670,32 @@ var plugin = definePlugin({
       const requestedCompanyId = normalizeCompanyId(record.companyId);
       const hasMappingsPatch = "mappings" in record;
       const hasAdvancedSettingsPatch = "advancedSettings" in record;
-      const githubTokenRef = "githubTokenRef" in record ? normalizeGitHubTokenRef(record.githubTokenRef) : normalizeGitHubTokenRef(previous.githubTokenRef) ?? normalizeGitHubTokenRef(config.githubTokenRef);
+      const githubTokenRef = "githubTokenRef" in record ? normalizeGitHubTokenRef(record.githubTokenRef) : void 0;
+      const githubTokenLogin = "githubTokenLogin" in record ? normalizeOptionalString2(record.githubTokenLogin) : void 0;
       const inputMappings = hasMappingsPatch ? normalizeMappings(record.mappings) : previous.mappings;
+      const nextGitHubTokenRefs = {
+        ...previous.githubTokenRefs ?? {}
+      };
+      const nextGitHubTokenLoginsByCompanyId = {
+        ...previous.githubTokenLoginsByCompanyId ?? {}
+      };
       const nextCompanyAdvancedSettingsByCompanyId = {
         ...previous.companyAdvancedSettingsByCompanyId ?? {}
       };
+      if (requestedCompanyId && "githubTokenRef" in record) {
+        if (githubTokenRef) {
+          nextGitHubTokenRefs[requestedCompanyId] = githubTokenRef;
+        } else {
+          delete nextGitHubTokenRefs[requestedCompanyId];
+        }
+      }
+      if (requestedCompanyId && "githubTokenLogin" in record) {
+        if (githubTokenLogin) {
+          nextGitHubTokenLoginsByCompanyId[requestedCompanyId] = githubTokenLogin;
+        } else {
+          delete nextGitHubTokenLoginsByCompanyId[requestedCompanyId];
+        }
+      }
       if (requestedCompanyId && hasAdvancedSettingsPatch) {
         nextCompanyAdvancedSettingsByCompanyId[requestedCompanyId] = normalizeAdvancedSettings(record.advancedSettings);
       }
@@ -10580,9 +10711,13 @@ var plugin = definePlugin({
         syncState: previous.syncState,
         scheduleFrequencyMinutes: "scheduleFrequencyMinutes" in record ? record.scheduleFrequencyMinutes : previous.scheduleFrequencyMinutes,
         paperclipApiBaseUrl: "paperclipApiBaseUrl" in record ? resolveTrustedPaperclipApiBaseUrlInput(record.paperclipApiBaseUrl, previous, config) : getConfiguredPaperclipApiBaseUrl(previous, config),
+        ...Object.keys(nextGitHubTokenRefs).length > 0 ? { githubTokenRefs: nextGitHubTokenRefs } : {},
+        ...Object.keys(nextGitHubTokenLoginsByCompanyId).length > 0 ? { githubTokenLoginsByCompanyId: nextGitHubTokenLoginsByCompanyId } : {},
+        ...!requestedCompanyId ? githubTokenLogin ? { githubTokenLogin } : previous.githubTokenLogin ? { githubTokenLogin: previous.githubTokenLogin } : {} : {},
         paperclipBoardApiTokenRefs: previous.paperclipBoardApiTokenRefs,
+        paperclipBoardAccessIdentityByCompanyId: previous.paperclipBoardAccessIdentityByCompanyId,
         ...Object.keys(nextCompanyAdvancedSettingsByCompanyId).length > 0 ? { companyAdvancedSettingsByCompanyId: nextCompanyAdvancedSettingsByCompanyId } : {},
-        ...githubTokenRef ? { githubTokenRef } : {}
+        ...!requestedCompanyId ? githubTokenRef ? { githubTokenRef } : previous.githubTokenRef ? { githubTokenRef: previous.githubTokenRef } : {} : {}
       });
       const nextMappings = current.mappings.map((mapping, index) => ({
         id: mapping.id.trim() || createMappingId(index),
@@ -10596,19 +10731,25 @@ var plugin = definePlugin({
         syncState: previous.syncState,
         scheduleFrequencyMinutes: current.scheduleFrequencyMinutes,
         ...current.paperclipApiBaseUrl ? { paperclipApiBaseUrl: current.paperclipApiBaseUrl } : {},
+        ...current.githubTokenRefs ? { githubTokenRefs: current.githubTokenRefs } : {},
+        ...current.githubTokenLoginsByCompanyId ? { githubTokenLoginsByCompanyId: current.githubTokenLoginsByCompanyId } : {},
+        ...current.githubTokenLogin ? { githubTokenLogin: current.githubTokenLogin } : {},
         ...current.paperclipBoardApiTokenRefs ? { paperclipBoardApiTokenRefs: current.paperclipBoardApiTokenRefs } : {},
+        ...current.paperclipBoardAccessIdentityByCompanyId ? { paperclipBoardAccessIdentityByCompanyId: current.paperclipBoardAccessIdentityByCompanyId } : {},
         ...current.companyAdvancedSettingsByCompanyId ? { companyAdvancedSettingsByCompanyId: current.companyAdvancedSettingsByCompanyId } : {},
-        ...githubTokenRef ? { githubTokenRef } : {},
+        ...current.githubTokenRef ? { githubTokenRef: current.githubTokenRef } : {},
         updatedAt: (/* @__PURE__ */ new Date()).toISOString()
       }, {
-        hasToken: hasConfiguredGithubToken({ githubTokenRef }, config),
+        hasToken: hasConfiguredGithubToken(current, config, requestedCompanyId),
         hasMappings: getSyncableMappings(nextMappings).length > 0
       });
       await ctx.state.set(SETTINGS_SCOPE, next);
       await ctx.state.set(SYNC_STATE_SCOPE, next.syncState);
       clearGitHubRepositoryTokenCapabilityAudits();
+      const scopedGitHubTokenLogin = getSavedGitHubTokenLogin(next, requestedCompanyId);
       return {
         ...getPublicSettingsForScope(next, requestedCompanyId),
+        ...scopedGitHubTokenLogin ? { githubTokenLogin: scopedGitHubTokenLogin } : {},
         availableAssignees: requestedCompanyId ? await listAvailableAssignees(ctx, requestedCompanyId) : []
       };
     });
@@ -10624,21 +10765,35 @@ var plugin = definePlugin({
       const nextPaperclipBoardApiTokenRefs = {
         ...previous.paperclipBoardApiTokenRefs ?? {}
       };
+      const nextPaperclipBoardAccessIdentityByCompanyId = {
+        ...previous.paperclipBoardAccessIdentityByCompanyId ?? {}
+      };
       if (nextSecretRef) {
         nextPaperclipBoardApiTokenRefs[companyId] = nextSecretRef;
       } else {
         delete nextPaperclipBoardApiTokenRefs[companyId];
+        delete nextPaperclipBoardAccessIdentityByCompanyId[companyId];
+      }
+      if ("paperclipBoardAccessIdentity" in record) {
+        const nextIdentityLabel = normalizeOptionalString2(record.paperclipBoardAccessIdentity);
+        if (nextIdentityLabel) {
+          nextPaperclipBoardAccessIdentityByCompanyId[companyId] = nextIdentityLabel;
+        } else {
+          delete nextPaperclipBoardAccessIdentityByCompanyId[companyId];
+        }
       }
       const {
         paperclipBoardApiTokenRefs: _previousPaperclipBoardApiTokenRefs,
+        paperclipBoardAccessIdentityByCompanyId: _previousPaperclipBoardAccessIdentityByCompanyId,
         ...previousWithoutBoardAccess
       } = previous;
       const next = sanitizeSettingsForCurrentSetup({
         ...previousWithoutBoardAccess,
         ...Object.keys(nextPaperclipBoardApiTokenRefs).length > 0 ? { paperclipBoardApiTokenRefs: nextPaperclipBoardApiTokenRefs } : {},
+        ...Object.keys(nextPaperclipBoardAccessIdentityByCompanyId).length > 0 ? { paperclipBoardAccessIdentityByCompanyId: nextPaperclipBoardAccessIdentityByCompanyId } : {},
         updatedAt: (/* @__PURE__ */ new Date()).toISOString()
       }, {
-        hasToken: hasConfiguredGithubToken(previous, config),
+        hasToken: hasConfiguredGithubToken(previous, config, companyId),
         hasMappings: getSyncableMappings(previous.mappings).length > 0
       });
       await ctx.state.set(SETTINGS_SCOPE, next);