paperclip-github-plugin 0.4.0 → 0.4.1

package/README.md

@@ -29,7 +29,7 @@ With this plugin, you can:
 The plugin adds a full in-host workflow instead of a one-off import script:
 
 - a hosted settings page for GitHub auth, repository mappings, company defaults, and sync controls
-- authenticated-only setup controls for Paperclip board access and company-scoped agent token propagation
+- setup controls for Paperclip board access and company-scoped agent token propagation on authenticated and `local_trusted` deployments
 - a dashboard widget that shows readiness, sync status, and last-run results
 - saved sync diagnostics that let operators inspect the latest per-issue failures, raw errors, and suggested next steps
 - a project sidebar item that opens a live project-scoped Pull Requests page for the mapped repository and can show the open PR count through a lightweight badge read
@@ -39,7 +39,7 @@ The plugin adds a full in-host workflow instead of a one-off import script:
 
 ## How it works
 
-1. Save a GitHub token in the plugin settings.
+1. Save a GitHub token in the plugin settings for the current company.
 2. Connect one or more GitHub repositories to Paperclip projects.
 3. Run a sync manually or let the scheduled job keep things up to date.
 
@@ -53,7 +53,7 @@ Long-running syncs continue in the background, so quick actions do not have to w
 
 ### Company-aware configuration
 
-GitHub tokens and sync cadence are shared at the plugin instance level, while repository mappings, advanced import defaults, and Paperclip board access are managed per company. When you open settings inside a specific company, you only edit that company's mappings and defaults.
+GitHub tokens, repository mappings, advanced import defaults, and Paperclip board access are all managed per company, while sync cadence remains shared at the plugin instance level. When you open settings inside a specific company, you only edit that company's setup and defaults.
 
 ### Project binding that respects existing work
 
@@ -107,14 +107,15 @@ npx paperclipai plugin install --local "$PWD"
 
 1. Open the plugin settings for **GitHub Sync** from inside the Paperclip company you want to configure.
 2. Paste a GitHub token, validate it, and save it.
-3. If the deployment is authenticated, connect Paperclip board access from the same settings page and complete the approval flow.
-4. If the deployment is authenticated, choose which agents in the current company should receive the saved GitHub token as `GITHUB_TOKEN`.
-5. Add one or more repository mappings for the current company.
-6. For each mapping, either choose an existing GitHub-linked Paperclip project or enter the project name that should receive synced issues.
-7. Optionally configure company-wide defaults for imported issues, including the default assignee, the default Paperclip status, and ignored GitHub usernames. Bot aliases such as `renovate[bot]` are matched when you save `renovate`.
-8. Choose the automatic sync interval in minutes.
-9. Save the settings and run the first manual sync.
-10. Repeat inside other companies if they need their own mappings, defaults, board access, or agent token propagation.
+3. If the deployment is authenticated or `local_trusted`, the settings page shows Paperclip board access and GitHub token propagation controls so you can configure and test them locally.
+4. If the deployment is authenticated, connect Paperclip board access from the same settings page and complete the approval flow before running sync.
+5. If the deployment is authenticated or `local_trusted`, choose which agents in the current company should receive the saved GitHub token as `GITHUB_TOKEN`.
+6. Add one or more repository mappings for the current company.
+7. For each mapping, either choose an existing GitHub-linked Paperclip project or enter the project name that should receive synced issues.
+8. Optionally configure company-wide defaults for imported issues, including the default assignee, the default Paperclip status, and ignored GitHub usernames. Bot aliases such as `renovate[bot]` are matched when you save `renovate`.
+9. Choose the automatic sync interval in minutes.
+10. Save the settings and run the first manual sync.
+11. Repeat inside other companies if they need their own mappings, defaults, board access, or agent token propagation.
 
 Repository input accepts either `owner/repo` or `https://github.com/owner/repo`.
 When a token is saved, the settings page audits the mapped repositories for the permissions needed by pull request actions and warns when permissions are missing or GitHub cannot verify them yet.
@@ -153,10 +154,11 @@ Additional behavior:
 
 The plugin is designed to avoid persisting raw credentials in plugin state.
 
-- GitHub tokens saved through the UI are stored as Paperclip secret references.
+- GitHub tokens saved through the UI are stored as per-company Paperclip secret references.
 - Paperclip board access tokens are also stored as per-company secret references.
-- The settings UI also keeps lightweight non-secret identity labels for those saved connections, so later visits can still show who the shared GitHub token and company board access are connected as.
-- On authenticated deployments, any selected propagation agents receive `GITHUB_TOKEN` as an agent env secret-ref binding that points at the same saved GitHub token secret instead of a copied raw token.
+- The settings UI also keeps lightweight non-secret identity labels for those saved connections, so later visits can still show who that company’s GitHub token and board access are connected as.
+- On authenticated and `local_trusted` deployments, any selected propagation agents receive `GITHUB_TOKEN` as an agent env secret-ref binding that points at the same saved GitHub token secret instead of a copied raw token.
+- If an older save left the company token secret only in plugin state, the settings UI repairs the config mirror and retries selected-agent propagation from that same company secret.
 - The worker resolves those secret references at runtime instead of storing raw tokens in plugin state.
 - On authenticated Paperclip deployments, sync is blocked until the relevant company has connected Paperclip board access.
 

package/dist/manifest.js

@@ -503,7 +503,7 @@ var require2 = createRequire(import.meta.url);
 var packageJson = require2("../package.json");
 var DASHBOARD_WIDGET_CAPABILITY = "ui.dashboardWidget.register";
 var SCHEDULE_TICK_CRON = "* * * * *";
-var MANIFEST_VERSION = "0.4.0"?.trim() || typeof packageJson.version === "string" && packageJson.version.trim() || process.env.npm_package_version?.trim() || "0.0.0-dev";
+var MANIFEST_VERSION = "0.4.1"?.trim() || typeof packageJson.version === "string" && packageJson.version.trim() || process.env.npm_package_version?.trim() || "0.0.0-dev";
 var manifest = {
   id: "paperclip-github-plugin",
   apiVersion: 1,
@@ -537,9 +537,12 @@ var manifest = {
   instanceConfigSchema: {
     type: "object",
     properties: {
-      githubTokenRef: {
-        type: "string",
-        title: "GitHub Token Secret"
+      githubTokenRefs: {
+        type: "object",
+        title: "GitHub Token Secrets",
+        additionalProperties: {
+          type: "string"
+        }
       },
       paperclipBoardApiTokenRefs: {
         type: "object",

package/dist/ui/index.js

@@ -22400,6 +22400,11 @@ function requiresPaperclipBoardAccess(value) {
   const health = normalizePaperclipHealthResponse(value);
   return health?.deploymentMode?.toLowerCase() === "authenticated";
 }
+function shouldShowPaperclipBoardAccessSettings(value) {
+  const health = normalizePaperclipHealthResponse(value);
+  const deploymentMode = health?.deploymentMode?.toLowerCase();
+  return deploymentMode === "authenticated" || deploymentMode === "local_trusted";
+}
 
 // src/ui/assignees.ts
 function normalizeCompanyAssigneeOptionsResponse(response) {
@@ -22648,18 +22653,32 @@ function normalizePluginConfigBoardTokenRefs(value) {
   }
   return Object.fromEntries(entries);
 }
+function normalizePluginConfigGitHubTokenRefs(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, secretRef]) => {
+    const normalizedCompanyId = normalizeOptionalString2(companyId);
+    const normalizedSecretRef = normalizeOptionalString2(secretRef);
+    return normalizedCompanyId && normalizedSecretRef ? [normalizedCompanyId, normalizedSecretRef] : null;
+  }).filter((entry) => Boolean(entry));
+  if (entries.length === 0) {
+    return void 0;
+  }
+  return Object.fromEntries(entries);
+}
 function normalizePluginConfig(value) {
   if (!value || typeof value !== "object") {
     return {};
   }
   const record = { ...value };
-  const githubTokenRef = normalizeOptionalString2(record.githubTokenRef);
+  const githubTokenRefs = normalizePluginConfigGitHubTokenRefs(record.githubTokenRefs);
   const paperclipBoardApiTokenRefs = normalizePluginConfigBoardTokenRefs(record.paperclipBoardApiTokenRefs);
   const paperclipApiBaseUrl = normalizePaperclipApiBaseUrl(record.paperclipApiBaseUrl);
-  if (githubTokenRef) {
-    record.githubTokenRef = githubTokenRef;
+  if (githubTokenRefs) {
+    record.githubTokenRefs = githubTokenRefs;
   } else {
-    delete record.githubTokenRef;
+    delete record.githubTokenRefs;
   }
   if (paperclipBoardApiTokenRefs) {
     record.paperclipBoardApiTokenRefs = paperclipBoardApiTokenRefs;
@@ -22675,12 +22694,27 @@ function normalizePluginConfig(value) {
 }
 function mergePluginConfig(currentValue, patch5) {
   const current = normalizePluginConfig(currentValue);
+  const currentGitHubTokenRefs = normalizePluginConfigGitHubTokenRefs(current.githubTokenRefs);
+  const patchGitHubTokenRefs = normalizePluginConfigGitHubTokenRefs(patch5.githubTokenRefs);
   const currentBoardTokenRefs = normalizePluginConfigBoardTokenRefs(current.paperclipBoardApiTokenRefs);
   const patchBoardTokenRefs = normalizePluginConfigBoardTokenRefs(patch5.paperclipBoardApiTokenRefs);
   const next2 = normalizePluginConfig({
     ...current,
     ...patch5
   });
+  if ("githubTokenRefs" in patch5) {
+    const mergedGitHubTokenRefs = {
+      ...currentGitHubTokenRefs ?? {},
+      ...patchGitHubTokenRefs ?? {}
+    };
+    if (Object.keys(mergedGitHubTokenRefs).length > 0) {
+      next2.githubTokenRefs = mergedGitHubTokenRefs;
+    } else {
+      delete next2.githubTokenRefs;
+    }
+  } else if (currentGitHubTokenRefs) {
+    next2.githubTokenRefs = currentGitHubTokenRefs;
+  }
   if ("paperclipBoardApiTokenRefs" in patch5) {
     const mergedBoardTokenRefs = {
       ...currentBoardTokenRefs ?? {},
@@ -23011,6 +23045,7 @@ function getSyncSetupMessage(issue, hasCompanyContext) {
 }
 function usePaperclipBoardAccessRequirement() {
   const [status, setStatus] = useState2("loading");
+  const [visible, setVisible] = useState2(false);
   useEffect2(() => {
     let cancelled = false;
     void (async () => {
@@ -23020,8 +23055,10 @@ function usePaperclipBoardAccessRequirement() {
       }
       if (!health) {
         setStatus("unknown");
+        setVisible(false);
         return;
       }
+      setVisible(shouldShowPaperclipBoardAccessSettings(health));
       setStatus(requiresPaperclipBoardAccess(health) ? "required" : "not_required");
     })();
     return () => {
@@ -23030,7 +23067,8 @@ function usePaperclipBoardAccessRequirement() {
   }, []);
   return {
     status,
-    required: status === "required"
+    required: status === "required",
+    visible
   };
 }
 function getGitHubRateLimitResourceLabel(resource) {
@@ -31049,6 +31087,7 @@ function GitHubSyncSettingsPage() {
   const themeMode = useResolvedThemeMode();
   const boardAccessRequirement = usePaperclipBoardAccessRequirement();
   const armSyncCompletionToast = useSyncCompletionToast(form.syncState, toast);
+  const githubTokenConfigSyncAttemptRef = useRef(null);
   const boardAccessConfigSyncAttemptRef = useRef(null);
   const assigneeFallbackAttemptRef = useRef(null);
   const currentSettings = settings.data ?? cachedSettings;
@@ -31162,6 +31201,75 @@ function GitHubSyncSettingsPage() {
       cancelled = true;
     };
   }, [currentSettings?.availableAssignees?.length, currentSettings?.updatedAt, hostContext.companyId]);
+  useEffect2(() => {
+    const companyId = hostContext.companyId;
+    const secretRef = settings.data?.githubTokenNeedsConfigSync ? settings.data.githubTokenConfigSyncRef : void 0;
+    if (!companyId || !secretRef) {
+      return;
+    }
+    const attemptKey = `${companyId}:${secretRef}`;
+    if (githubTokenConfigSyncAttemptRef.current === attemptKey) {
+      return;
+    }
+    githubTokenConfigSyncAttemptRef.current = attemptKey;
+    let cancelled = false;
+    void (async () => {
+      try {
+        const pluginId = await resolveCurrentPluginId(pluginIdFromLocation);
+        if (!pluginId) {
+          throw new Error("Plugin id is required to finish syncing the GitHub token secret into plugin config.");
+        }
+        await patchPluginConfig(pluginId, {
+          githubTokenRefs: {
+            [companyId]: secretRef
+          }
+        });
+        if (cancelled) {
+          return;
+        }
+        const selectedAgentIds = normalizeAgentIds(settings.data?.advancedSettings?.githubTokenPropagationAgentIds);
+        if (selectedAgentIds.length > 0) {
+          try {
+            await propagateGitHubTokenToSelectedAgents({
+              selectedAgentIds,
+              previousAgentIds: selectedAgentIds,
+              githubTokenSecretRef: secretRef
+            });
+          } catch {
+          }
+        }
+        notifyGitHubSyncSettingsChanged();
+        try {
+          await settings.refresh();
+        } catch {
+          return;
+        }
+      } catch (error) {
+        if (cancelled) {
+          return;
+        }
+        toast({
+          title: "GitHub token needs reconnection",
+          body: getActionErrorMessage(
+            error,
+            "GitHub Sync could not finish migrating the saved GitHub token secret into plugin config."
+          ),
+          tone: "error"
+        });
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [
+    hostContext.companyId,
+    pluginIdFromLocation,
+    settings.data?.advancedSettings?.githubTokenPropagationAgentIds,
+    settings.data?.githubTokenConfigSyncRef,
+    settings.data?.githubTokenNeedsConfigSync,
+    settings.refresh,
+    toast
+  ]);
   useEffect2(() => {
     const companyId = hostContext.companyId;
     const secretRef = settings.data?.paperclipBoardAccessNeedsConfigSync ? settings.data.paperclipBoardAccessConfigSyncRef : void 0;
@@ -31289,6 +31397,7 @@ function GitHubSyncSettingsPage() {
   const hasSavedToken = Boolean(form.githubTokenConfigured || showSavedTokenHint);
   const boardAccessConfigured = Boolean(form.paperclipBoardAccessConfigured);
   const boardAccessRequired = boardAccessRequirement.required;
+  const boardAccessVisible = boardAccessRequirement.visible;
   const boardAccessReady = !boardAccessRequired || hasCompanyContext && boardAccessConfigured;
   const tokenStatus = tokenStatusOverride ?? (hasSavedToken ? "valid" : "required");
   const tokenTone = tokenStatus === "valid" ? "success" : tokenStatus === "invalid" ? "danger" : "warning";
@@ -31383,7 +31492,7 @@ function GitHubSyncSettingsPage() {
   const manualSyncScopePillLabel = hasCompanyContext ? "This company" : "All companies";
   const manualSyncButtonLabel = hasCompanyContext ? "Run sync for this company" : "Run sync across all companies";
   const advancedSettingsSummary = formatAdvancedSettingsSummary(form.advancedSettings, availableAssignees, {
-    includePropagation: boardAccessRequired
+    includePropagation: boardAccessVisible
   });
   const assigneeSelectOptions = [
     { value: "", label: "Unassigned" },
@@ -31529,7 +31638,7 @@ function GitHubSyncSettingsPage() {
     });
   }
   async function propagateGitHubTokenToSelectedAgents(options) {
-    if (!boardAccessRequired) {
+    if (!boardAccessVisible) {
       return;
     }
     const selectedAgentIds = normalizeAgentIds(options.selectedAgentIds);
@@ -31539,12 +31648,16 @@ function GitHubSyncSettingsPage() {
     }
     let githubTokenSecretRef = typeof options.githubTokenSecretRef === "string" && options.githubTokenSecretRef.trim() ? options.githubTokenSecretRef.trim() : void 0;
     if (!githubTokenSecretRef) {
+      const companyId = hostContext.companyId;
+      if (!companyId) {
+        throw new Error("Company context is required to propagate the GitHub token to selected agents.");
+      }
       const pluginId = await resolveCurrentPluginId(pluginIdFromLocation);
       if (!pluginId) {
         throw new Error("Plugin id is required to propagate the GitHub token to selected agents.");
       }
       const currentConfigResponse = await fetchJson(`/api/plugins/${pluginId}/config`);
-      githubTokenSecretRef = normalizePluginConfig(currentConfigResponse?.configJson).githubTokenRef;
+      githubTokenSecretRef = normalizePluginConfig(currentConfigResponse?.configJson).githubTokenRefs?.[companyId];
     }
     if (!githubTokenSecretRef) {
       throw new Error("GitHub token propagation requires a GitHub token saved through this settings page.");
@@ -31594,7 +31707,9 @@ function GitHubSyncSettingsPage() {
       const secretName = `github_sync_${companyId.replace(/[^a-z0-9]+/gi, "_").toLowerCase()}`;
       const secret = await resolveOrCreateCompanySecret(companyId, secretName, trimmedToken);
       await patchPluginConfig(pluginId, {
-        githubTokenRef: secret.id
+        githubTokenRefs: {
+          [companyId]: secret.id
+        }
       });
       await saveRegistration({
         companyId,
@@ -32048,7 +32163,7 @@ function GitHubSyncSettingsPage() {
             /* @__PURE__ */ jsx2("div", { className: "ghsync__permission-audit-list", children: /* @__PURE__ */ jsx2("div", { className: "ghsync__permission-audit-item", children: /* @__PURE__ */ jsx2("span", { children: tokenPermissionAuditData?.warnings[0] ?? "Add a mapped repository in this company so GitHub Sync can verify the token permissions it needs." }) }) })
           ] }) : null
         ] }),
-        boardAccessRequired ? /* @__PURE__ */ jsxs2("section", { className: "ghsync__section", children: [
+        boardAccessVisible ? /* @__PURE__ */ jsxs2("section", { className: "ghsync__section", children: [
           /* @__PURE__ */ jsxs2("div", { className: "ghsync__section-head", children: [
             /* @__PURE__ */ jsxs2("div", { className: "ghsync__section-copy", children: [
               /* @__PURE__ */ jsxs2("div", { className: "ghsync__section-title-row", children: [
@@ -32062,7 +32177,7 @@ function GitHubSyncSettingsPage() {
           hostContext.companyId ? /* @__PURE__ */ jsxs2("div", { className: "ghsync__connected", children: [
             /* @__PURE__ */ jsxs2("div", { children: [
               /* @__PURE__ */ jsx2("strong", { children: boardAccessConfigured ? boardAccessIdentity ? `Connected as ${boardAccessIdentity}` : "Connected" : boardAccessRequired ? "Required" : boardAccessRequirement.status === "loading" ? "Checking requirement" : "Optional" }),
-              /* @__PURE__ */ jsx2("span", { children: boardAccessConfigured ? "Used for Paperclip API calls." : boardAccessRequired ? "Required in authenticated deployments." : boardAccessRequirement.status === "loading" ? "Checking whether it is required." : "Only needed when Paperclip API calls require sign-in." })
+              /* @__PURE__ */ jsx2("span", { children: boardAccessConfigured ? "Used for Paperclip API calls." : boardAccessRequired ? "Required in authenticated deployments." : boardAccessRequirement.status === "loading" ? "Checking whether it is required." : "Available here for local testing and only required when Paperclip API calls need sign-in." })
             ] }),
             /* @__PURE__ */ jsx2(
               "button",
@@ -32318,7 +32433,7 @@ function GitHubSyncSettingsPage() {
               ),
               /* @__PURE__ */ jsx2("p", { className: "ghsync__hint", children: "Comma or newline separated." })
             ] }),
-            boardAccessRequired ? /* @__PURE__ */ jsxs2("div", { className: "ghsync__field", children: [
+            boardAccessVisible ? /* @__PURE__ */ jsxs2("div", { className: "ghsync__field", children: [
               /* @__PURE__ */ jsx2("label", { htmlFor: "advanced-token-propagation", children: "Propagate GitHub token to agents" }),
               /* @__PURE__ */ jsx2(
                 SettingsAgentMultiPicker,
@@ -32492,7 +32607,7 @@ function GitHubSyncSettingsPage() {
             ] }),
             /* @__PURE__ */ jsx2("span", { children: !repositoriesUnlocked ? "Requires a token." : savedMappingCount > 0 ? hasCompanyContext ? `${savedMappingCount} saved.` : `${savedMappingCount} saved.` : hasCompanyContext ? "Add a repository." : "Select a company." })
           ] }),
-          boardAccessRequired ? /* @__PURE__ */ jsxs2("div", { className: "ghsync__check", children: [
+          boardAccessVisible ? /* @__PURE__ */ jsxs2("div", { className: "ghsync__check", children: [
             /* @__PURE__ */ jsxs2("div", { className: "ghsync__check-top", children: [
               /* @__PURE__ */ jsx2("strong", { children: "Paperclip board access" }),
               /* @__PURE__ */ jsx2("span", { className: `ghsync__badge ${getToneClass(boardAccessStatusTone)}`, children: boardAccessStatusLabel })