paperclip-github-plugin 0.4.0 → 0.4.1

package/dist/worker.js

@@ -2237,7 +2237,7 @@ async function hydrateRecoveredPaperclipIssueGitHubLink(ctx, issueId, fallbackLi
   }
   let octokit;
   try {
-    octokit = await createGitHubToolOctokit(ctx);
+    octokit = await createGitHubToolOctokit(ctx, fallbackLink.companyId);
   } catch {
     return null;
   }
@@ -2412,8 +2412,8 @@ function extractGitHubLinksFromCommentBody(body) {
 async function buildToolbarSyncState(ctx, input) {
   const settings = await getActiveOrCurrentSyncState(ctx);
   const config = await getResolvedConfig(ctx);
-  const githubTokenConfigured = hasConfiguredGithubToken(settings, config);
   const companyId = typeof input.companyId === "string" && input.companyId.trim() ? input.companyId.trim() : void 0;
+  const githubTokenConfigured = hasConfiguredGithubToken(settings, config, companyId);
   const entityId = typeof input.entityId === "string" && input.entityId.trim() ? input.entityId.trim() : void 0;
   const entityType = typeof input.entityType === "string" && input.entityType.trim() ? input.entityType.trim() : void 0;
   const savedMappingCount = companyId ? getSyncableMappingsForTarget(settings.mappings, {
@@ -2625,6 +2625,8 @@ function sanitizeSettingsForCurrentSetup(settings, setup) {
 }
 function getPublicSettings(settings) {
   const {
+    githubTokenRefs: _githubTokenRefs,
+    githubTokenLoginsByCompanyId: _githubTokenLoginsByCompanyId,
     githubTokenRef: _githubTokenRef,
     paperclipBoardApiTokenRefs: _paperclipBoardApiTokenRefs,
     paperclipBoardAccessIdentityByCompanyId: _paperclipBoardAccessIdentityByCompanyId,
@@ -2650,6 +2652,26 @@ function getPublicSettingsForScope(settings, companyId) {
     ...paperclipBoardAccessIdentity ? { paperclipBoardAccessIdentity } : {}
   };
 }
+function getSavedGitHubTokenRef(settings, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  if (normalizedCompanyId) {
+    const scopedSecretRef = normalizeSecretRef(settings?.githubTokenRefs?.[normalizedCompanyId]);
+    if (scopedSecretRef) {
+      return scopedSecretRef;
+    }
+  }
+  return normalizeGitHubTokenRef(settings?.githubTokenRef);
+}
+function getSavedGitHubTokenLogin(settings, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  if (normalizedCompanyId) {
+    const scopedLogin = normalizeOptionalString2(settings?.githubTokenLoginsByCompanyId?.[normalizedCompanyId]);
+    if (scopedLogin) {
+      return scopedLogin;
+    }
+  }
+  return normalizeOptionalString2(settings?.githubTokenLogin);
+}
 async function listAvailableAssignees(ctx, companyId) {
   try {
     const agents = await ctx.agents.list({
@@ -2953,11 +2975,13 @@ function normalizeConfig(value) {
     return {};
   }
   const record = value;
+  const githubTokenRefs = normalizeGitHubTokenRefs(record.githubTokenRefs);
   const githubTokenRef = normalizeGitHubTokenRef(record.githubTokenRef);
   const githubToken = normalizeGitHubToken(record.githubToken);
   const paperclipBoardApiTokenRefs = normalizePaperclipBoardApiTokenRefs(record.paperclipBoardApiTokenRefs);
   const paperclipApiBaseUrl = normalizePaperclipApiBaseUrl(record.paperclipApiBaseUrl);
   return {
+    ...githubTokenRefs ? { githubTokenRefs } : {},
     ...githubTokenRef ? { githubTokenRef } : {},
     ...githubToken ? { githubToken } : {},
     ...paperclipBoardApiTokenRefs ? { paperclipBoardApiTokenRefs } : {},
@@ -3036,6 +3060,12 @@ async function readExternalConfig(ctx) {
   }
 }
 function normalizePaperclipBoardApiTokenRefs(value) {
+  return normalizeCompanySecretRefs(value);
+}
+function normalizeGitHubTokenRefs(value) {
+  return normalizeCompanySecretRefs(value);
+}
+function normalizeCompanySecretRefs(value) {
   if (!value || typeof value !== "object") {
     return void 0;
   }
@@ -3049,6 +3079,20 @@ function normalizePaperclipBoardApiTokenRefs(value) {
   }
   return Object.fromEntries(entries);
 }
+function normalizeGitHubTokenLoginsByCompanyId(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, login]) => {
+    const normalizedCompanyId = normalizeCompanyId(companyId);
+    const normalizedLogin = normalizeOptionalString2(login);
+    return normalizedCompanyId && normalizedLogin ? [normalizedCompanyId, normalizedLogin] : null;
+  }).filter((entry) => entry !== null);
+  if (entries.length === 0) {
+    return void 0;
+  }
+  return Object.fromEntries(entries);
+}
 function normalizePaperclipBoardAccessIdentityByCompanyId(value) {
   if (!value || typeof value !== "object") {
     return void 0;
@@ -3267,6 +3311,8 @@ function normalizeSettings(value) {
   }
   const record = value;
   const paperclipApiBaseUrl = resolvePaperclipApiBaseUrl(record.paperclipApiBaseUrl);
+  const githubTokenRefs = normalizeGitHubTokenRefs(record.githubTokenRefs);
+  const githubTokenLoginsByCompanyId = normalizeGitHubTokenLoginsByCompanyId(record.githubTokenLoginsByCompanyId);
   const githubTokenRef = normalizeGitHubTokenRef(record.githubTokenRef);
   const githubTokenLogin = normalizeOptionalString2(record.githubTokenLogin);
   const paperclipBoardApiTokenRefs = normalizePaperclipBoardApiTokenRefs(record.paperclipBoardApiTokenRefs);
@@ -3279,6 +3325,8 @@ function normalizeSettings(value) {
     syncState: normalizeSyncState(record.syncState),
     scheduleFrequencyMinutes: normalizeScheduleFrequencyMinutes(record.scheduleFrequencyMinutes),
     ...paperclipApiBaseUrl ? { paperclipApiBaseUrl } : {},
+    ...githubTokenRefs ? { githubTokenRefs } : {},
+    ...githubTokenLoginsByCompanyId ? { githubTokenLoginsByCompanyId } : {},
     ...githubTokenRef ? { githubTokenRef } : {},
     ...githubTokenLogin ? { githubTokenLogin } : {},
     ...paperclipBoardApiTokenRefs ? { paperclipBoardApiTokenRefs } : {},
@@ -6173,19 +6221,20 @@ async function getResolvedConfig(ctx) {
     ...normalizeConfig(savedConfig)
   };
 }
-function getConfiguredGithubTokenSource(settings, config) {
-  const secretRef = normalizeGitHubTokenRef(config.githubTokenRef) ?? normalizeGitHubTokenRef(settings?.githubTokenRef);
+function getConfiguredGithubTokenSource(settings, config, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  const secretRef = (normalizedCompanyId ? normalizeSecretRef(config.githubTokenRefs?.[normalizedCompanyId]) ?? getSavedGitHubTokenRef(settings, normalizedCompanyId) : void 0) ?? normalizeGitHubTokenRef(config.githubTokenRef) ?? getSavedGitHubTokenRef(settings);
   if (secretRef) {
     return { secretRef };
   }
   const token = normalizeGitHubToken(config.githubToken);
   return token ? { token } : {};
 }
-function getConfiguredGithubTokenRef(settings, config) {
-  return getConfiguredGithubTokenSource(settings, config).secretRef;
+function getConfiguredGithubTokenRef(settings, config, companyId) {
+  return getConfiguredGithubTokenSource(settings, config, companyId).secretRef;
 }
-function hasConfiguredGithubToken(settings, config) {
-  const configuredTokenSource = getConfiguredGithubTokenSource(settings, config);
+function hasConfiguredGithubToken(settings, config, companyId) {
+  const configuredTokenSource = getConfiguredGithubTokenSource(settings, config, companyId);
   return Boolean(configuredTokenSource.secretRef ?? configuredTokenSource.token);
 }
 function getSavedPaperclipBoardApiTokenRef(settings, companyId) {
@@ -6269,7 +6318,7 @@ async function resolvePaperclipApiAuthTokens(ctx, settings, config, mappings) {
 async function resolveGithubToken(ctx, options = {}) {
   const settings = options.settings ?? normalizeSettings(await ctx.state.get(SETTINGS_SCOPE));
   const config = options.config ?? await getResolvedConfig(ctx);
-  const configuredTokenSource = getConfiguredGithubTokenSource(settings, config);
+  const configuredTokenSource = getConfiguredGithubTokenSource(settings, config, options.companyId);
   if (configuredTokenSource.secretRef) {
     return ctx.secrets.resolve(configuredTokenSource.secretRef);
   }
@@ -6347,8 +6396,8 @@ async function executeGitHubTool(fn) {
     return buildToolErrorResult(error);
   }
 }
-async function createGitHubToolOctokit(ctx) {
-  const token = (await resolveGithubToken(ctx)).trim();
+async function createGitHubToolOctokit(ctx, companyId) {
+  const token = (await resolveGithubToken(ctx, { companyId })).trim();
   if (!token) {
     throw new Error(MISSING_GITHUB_TOKEN_SYNC_MESSAGE);
   }
@@ -7770,7 +7819,7 @@ async function getOrLoadCachedProjectPullRequestMetricsEntry(ctx, scope, octokit
     return inFlightMetrics;
   }
   const loadMetricsPromise = (async () => {
-    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx);
+    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx, scope.companyId);
     const metrics = await listProjectPullRequestMetrics(resolvedOctokit, scope);
     return cacheProjectPullRequestMetricsEntry(scope, metrics);
   })();
@@ -7808,7 +7857,7 @@ async function getOrLoadCachedProjectPullRequestCount(ctx, scope, octokit) {
     return inFlightCount;
   }
   const loadCountPromise = (async () => {
-    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx);
+    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx, scope.companyId);
     const totalOpenPullRequests = await listProjectPullRequestCount(resolvedOctokit, scope);
     return setCacheValue(
       activeProjectPullRequestCountCache,
@@ -7920,7 +7969,7 @@ async function getOrLoadProjectPullRequestSummaryRecordsForNumbers(ctx, scope, p
   }
   const missingPullRequestNumbers = normalizedPullRequestNumbers.filter((pullRequestNumber) => !recordsByNumber.has(pullRequestNumber));
   if (missingPullRequestNumbers.length > 0) {
-    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx);
+    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx, scope.companyId);
     const loadedRecords = await listProjectPullRequestSummaryRecordsByNumbers(
       ctx,
       resolvedOctokit,
@@ -8030,7 +8079,7 @@ async function buildProjectPullRequestsPageData(ctx, input) {
   }
   const scope = await requireProjectPullRequestScope(ctx, input, projectMappings);
   const config = await getResolvedConfig(ctx);
-  if (!hasConfiguredGithubToken(settings, config)) {
+  if (!hasConfiguredGithubToken(settings, config, companyId)) {
     return {
       status: "missing_token",
       projectId,
@@ -8049,7 +8098,7 @@ async function buildProjectPullRequestsPageData(ctx, input) {
     };
   }
   try {
-    const octokit = await createGitHubToolOctokit(ctx);
+    const octokit = await createGitHubToolOctokit(ctx, companyId);
     const pageCacheKey = buildProjectPullRequestPageCacheKey(scope, filter, pageIndex, cursor);
     const cachedPage = getFreshCacheValue(activeProjectPullRequestPageCache, pageCacheKey);
     if (cachedPage) {
@@ -8221,7 +8270,7 @@ async function buildProjectPullRequestMetricsData(ctx, input) {
     };
   }
   const config = await getResolvedConfig(ctx);
-  if (!hasConfiguredGithubToken(settings, config)) {
+  if (!hasConfiguredGithubToken(settings, config, companyId)) {
     return {
       status: "missing_token",
       projectId,
@@ -8270,7 +8319,7 @@ async function buildProjectPullRequestCountData(ctx, input) {
     };
   }
   const config = await getResolvedConfig(ctx);
-  if (!hasConfiguredGithubToken(settings, config)) {
+  if (!hasConfiguredGithubToken(settings, config, companyId)) {
     return {
       status: "missing_token",
       projectId,
@@ -8307,7 +8356,7 @@ async function buildSettingsTokenPermissionAuditData(ctx, input) {
   }
   const settings = normalizeSettings(await ctx.state.get(SETTINGS_SCOPE));
   const config = await getResolvedConfig(ctx);
-  if (!hasConfiguredGithubToken(settings, config)) {
+  if (!hasConfiguredGithubToken(settings, config, requestedCompanyId)) {
     return {
       status: "missing_token",
       allRequiredPermissionsGranted: false,
@@ -8328,7 +8377,7 @@ async function buildSettingsTokenPermissionAuditData(ctx, input) {
     };
   }
   try {
-    const octokit = await createGitHubToolOctokit(ctx);
+    const octokit = await createGitHubToolOctokit(ctx, requestedCompanyId);
     const repositories = await Promise.all(
       [
         ...new Map(
@@ -8397,7 +8446,7 @@ async function buildProjectPullRequestDetailData(ctx, input) {
     buildProjectPullRequestSummaryRecordCacheKey(scope, pullRequestNumber)
   );
   const cachedLinkedIssue = cachedSummaryRecord ? getLinkedPaperclipIssueFromProjectPullRequestRecord(cachedSummaryRecord) : void 0;
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const response = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8528,7 +8577,7 @@ async function createProjectPullRequestPaperclipIssue(ctx, input) {
     throw new Error("This Paperclip runtime does not expose plugin issue creation yet.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const pullRequestResponse = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8602,7 +8651,7 @@ async function updateProjectPullRequestBranch(ctx, input) {
     throw new Error("pullRequestNumber is required.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const pullRequestResponse = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8665,7 +8714,7 @@ async function mergeProjectPullRequest(ctx, input) {
     throw new Error("pullRequestNumber is required.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const response = await octokit.rest.pulls.merge({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8689,7 +8738,7 @@ async function closeProjectPullRequest(ctx, input) {
     throw new Error("pullRequestNumber is required.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const response = await octokit.rest.pulls.update({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8718,7 +8767,7 @@ async function addProjectPullRequestComment(ctx, input) {
     throw new Error("Comment body cannot be empty.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const response = await createProjectPullRequestGitHubComment(octokit, scope, pullRequestNumber, body);
   invalidateProjectPullRequestCaches(scope);
   return {
@@ -8775,7 +8824,7 @@ async function requestProjectPullRequestCopilotAction(ctx, input) {
     throw new Error('action must be one of "fix_ci", "rebase", "address_review_feedback", or "review".');
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const pullRequestResponse = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8889,7 +8938,7 @@ async function reviewProjectPullRequest(ctx, input) {
   }
   const body = typeof input.body === "string" ? input.body.trim() : "";
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   let response;
   try {
     response = await octokit.rest.pulls.createReview({
@@ -8936,7 +8985,7 @@ async function rerunProjectPullRequestCi(ctx, input) {
     throw new Error("pullRequestNumber is required.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const pullRequestResponse = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -9672,9 +9721,11 @@ async function startSync(ctx, trigger, options = {}) {
     getResolvedConfig(ctx),
     ctx.state.get(SETTINGS_SCOPE).then((value) => normalizeSettings(value))
   ]);
+  const targetCompanyId = options.target?.companyId;
   const token = await resolveGithubToken(ctx, {
     config,
-    settings: persistedSettings
+    settings: persistedSettings,
+    companyId: targetCompanyId
   }).catch(() => "");
   let currentSettings = sanitizeSettingsForCurrentSetup(persistedSettings, {
     hasToken: Boolean(token.trim()),
@@ -9763,7 +9814,7 @@ function registerGitHubAgentTools(ctx) {
     getGitHubAgentToolDeclaration("search_repository_items"),
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const repository = await resolveGitHubToolRepository(ctx, runCtx, input);
       const rawQuery = normalizeOptionalToolString(input.query);
       if (!rawQuery) {
@@ -9832,7 +9883,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.rest.issues.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -9879,7 +9930,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const comments = await listAllGitHubIssueComments(octokit, target.repository, target.issueNumber);
       return buildToolSuccessResult(
         `Loaded ${comments.length} GitHub ${comments.length === 1 ? "comment" : "comments"} from issue #${target.issueNumber}.`,
@@ -9897,7 +9948,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const currentResponse = await octokit.rest.issues.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -9969,7 +10020,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const body = appendAiAuthorshipFooter(String(input.body ?? ""), normalizeOptionalToolString(input.llmModel) ?? "");
       const response = await octokit.rest.issues.createComment({
         owner: target.repository.owner,
@@ -10008,7 +10059,7 @@ function registerGitHubAgentTools(ctx) {
       if (!head || !base || !title) {
         throw new Error("head, base, and title are required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.rest.pulls.create({
         owner: repository.owner,
         repo: repository.repo,
@@ -10045,7 +10096,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.rest.pulls.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -10093,7 +10144,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       let currentResponse = await octokit.rest.pulls.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -10158,7 +10209,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const files = await listAllPullRequestFiles(octokit, target.repository, target.pullRequestNumber);
       return buildToolSuccessResult(
         `Loaded ${files.length} changed ${files.length === 1 ? "file" : "files"} from pull request #${target.pullRequestNumber}.`,
@@ -10176,7 +10227,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const pullRequestResponse = await octokit.rest.pulls.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -10274,7 +10325,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const threads = await listDetailedPullRequestReviewThreads(octokit, target.repository, target.pullRequestNumber);
       return buildToolSuccessResult(
         `Loaded ${threads.length} review ${threads.length === 1 ? "thread" : "threads"} from pull request #${target.pullRequestNumber}.`,
@@ -10289,14 +10340,14 @@ function registerGitHubAgentTools(ctx) {
   ctx.tools.register(
     "reply_to_review_thread",
     getGitHubAgentToolDeclaration("reply_to_review_thread"),
-    async (params) => executeGitHubTool(async () => {
+    async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const threadId = normalizeOptionalToolString(input.threadId);
       if (!threadId) {
         throw new Error("threadId is required.");
       }
       const body = appendAiAuthorshipFooter(String(input.body ?? ""), normalizeOptionalToolString(input.llmModel) ?? "");
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.graphql(
         GITHUB_ADD_PULL_REQUEST_REVIEW_THREAD_REPLY_MUTATION,
         {
@@ -10325,13 +10376,13 @@ function registerGitHubAgentTools(ctx) {
   ctx.tools.register(
     "resolve_review_thread",
     getGitHubAgentToolDeclaration("resolve_review_thread"),
-    async (params) => executeGitHubTool(async () => {
+    async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const threadId = normalizeOptionalToolString(input.threadId);
       if (!threadId) {
         throw new Error("threadId is required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.graphql(
         GITHUB_RESOLVE_REVIEW_THREAD_MUTATION,
         {
@@ -10356,13 +10407,13 @@ function registerGitHubAgentTools(ctx) {
   ctx.tools.register(
     "unresolve_review_thread",
     getGitHubAgentToolDeclaration("unresolve_review_thread"),
-    async (params) => executeGitHubTool(async () => {
+    async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const threadId = normalizeOptionalToolString(input.threadId);
       if (!threadId) {
         throw new Error("threadId is required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.graphql(
         GITHUB_UNRESOLVE_REVIEW_THREAD_MUTATION,
         {
@@ -10395,7 +10446,7 @@ function registerGitHubAgentTools(ctx) {
       if (userReviewers.length === 0 && teamReviewers.length === 0) {
         throw new Error("Provide at least one user reviewer or team reviewer.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.rest.pulls.requestReviewers({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -10420,13 +10471,13 @@ function registerGitHubAgentTools(ctx) {
   ctx.tools.register(
     "list_organization_projects",
     getGitHubAgentToolDeclaration("list_organization_projects"),
-    async (params) => executeGitHubTool(async () => {
+    async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const organization = normalizeOptionalToolString(input.organization);
       if (!organization) {
         throw new Error("organization is required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const projects = await listGitHubOrganizationProjects(octokit, organization, {
         includeClosed: input.includeClosed === true,
         query: normalizeOptionalToolString(input.query),
@@ -10447,7 +10498,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const projectTarget = await resolveGitHubProjectToolTarget(octokit, input);
       const pullRequest = await getGitHubPullRequestProjectItems(
         octokit,
@@ -10524,14 +10575,30 @@ var plugin = definePlugin({
       const importRegistry = normalizeImportRegistry(await ctx.state.get(IMPORT_REGISTRY_SCOPE));
       const normalizedSettings = normalizeSettings(saved);
       const config = await getResolvedConfig(ctx);
-      const githubTokenRef = getConfiguredGithubTokenRef(normalizedSettings, config);
+      const configuredGitHubTokenRef = requestedCompanyId ? normalizeSecretRef(config.githubTokenRefs?.[requestedCompanyId]) : normalizeGitHubTokenRef(config.githubTokenRef);
+      const savedGitHubTokenRef = getSavedGitHubTokenRef(normalizedSettings, requestedCompanyId);
+      const githubTokenRef = getConfiguredGithubTokenRef(normalizedSettings, config, requestedCompanyId);
+      const githubTokenLogin = getSavedGitHubTokenLogin(normalizedSettings, requestedCompanyId);
       const paperclipApiBaseUrl = getConfiguredPaperclipApiBaseUrl(normalizedSettings, config);
-      const githubTokenConfigured = hasConfiguredGithubToken(normalizedSettings, config);
+      const githubTokenConfigured = hasConfiguredGithubToken(normalizedSettings, config, requestedCompanyId);
       const configuredBoardTokenRef = getConfiguredPaperclipBoardApiTokenRef(config, requestedCompanyId);
       const savedBoardTokenRef = getSavedPaperclipBoardApiTokenRef(normalizedSettings, requestedCompanyId);
-      const settingsWithResolvedToken = githubTokenRef === normalizedSettings.githubTokenRef && paperclipApiBaseUrl === normalizedSettings.paperclipApiBaseUrl ? normalizedSettings : {
+      const settingsWithResolvedToken = githubTokenRef === getSavedGitHubTokenRef(normalizedSettings, requestedCompanyId) && githubTokenLogin === getSavedGitHubTokenLogin(normalizedSettings, requestedCompanyId) && paperclipApiBaseUrl === normalizedSettings.paperclipApiBaseUrl ? normalizedSettings : {
         ...normalizedSettings,
-        ...githubTokenRef ? { githubTokenRef } : {},
+        ...requestedCompanyId && githubTokenRef ? {
+          githubTokenRefs: {
+            ...normalizedSettings.githubTokenRefs ?? {},
+            [requestedCompanyId]: githubTokenRef
+          }
+        } : {},
+        ...requestedCompanyId && githubTokenLogin ? {
+          githubTokenLoginsByCompanyId: {
+            ...normalizedSettings.githubTokenLoginsByCompanyId ?? {},
+            [requestedCompanyId]: githubTokenLogin
+          }
+        } : {},
+        ...!requestedCompanyId && githubTokenRef ? { githubTokenRef } : {},
+        ...!requestedCompanyId && githubTokenLogin ? { githubTokenLogin } : {},
         ...paperclipApiBaseUrl ? { paperclipApiBaseUrl } : {}
       };
       const settingsForResponse = sanitizeSettingsForCurrentSetup(settingsWithResolvedToken, {
@@ -10548,6 +10615,9 @@ var plugin = definePlugin({
         ...includeAssignees ? { availableAssignees } : {},
         totalSyncedIssuesCount: countImportedIssuesForMappings(importRegistry, scopedMappings),
         githubTokenConfigured,
+        ...githubTokenLogin ? { githubTokenLogin } : {},
+        ...savedGitHubTokenRef ? { githubTokenConfigSyncRef: savedGitHubTokenRef } : {},
+        githubTokenNeedsConfigSync: Boolean(requestedCompanyId && savedGitHubTokenRef && !configuredGitHubTokenRef),
         paperclipBoardAccessConfigured: requestedCompanyId ? hasConfiguredPaperclipBoardAccess(settingsForResponse, config, requestedCompanyId) : hasConfiguredPaperclipBoardAccessForMappings(settingsForResponse, config, scopedMappings),
         ...savedBoardTokenRef ? { paperclipBoardAccessConfigSyncRef: savedBoardTokenRef } : {},
         paperclipBoardAccessNeedsConfigSync: Boolean(savedBoardTokenRef && !configuredBoardTokenRef)
@@ -10600,12 +10670,32 @@ var plugin = definePlugin({
       const requestedCompanyId = normalizeCompanyId(record.companyId);
       const hasMappingsPatch = "mappings" in record;
       const hasAdvancedSettingsPatch = "advancedSettings" in record;
-      const githubTokenRef = "githubTokenRef" in record ? normalizeGitHubTokenRef(record.githubTokenRef) : normalizeGitHubTokenRef(previous.githubTokenRef) ?? normalizeGitHubTokenRef(config.githubTokenRef);
-      const githubTokenLogin = "githubTokenLogin" in record ? normalizeOptionalString2(record.githubTokenLogin) : previous.githubTokenLogin;
+      const githubTokenRef = "githubTokenRef" in record ? normalizeGitHubTokenRef(record.githubTokenRef) : void 0;
+      const githubTokenLogin = "githubTokenLogin" in record ? normalizeOptionalString2(record.githubTokenLogin) : void 0;
       const inputMappings = hasMappingsPatch ? normalizeMappings(record.mappings) : previous.mappings;
+      const nextGitHubTokenRefs = {
+        ...previous.githubTokenRefs ?? {}
+      };
+      const nextGitHubTokenLoginsByCompanyId = {
+        ...previous.githubTokenLoginsByCompanyId ?? {}
+      };
       const nextCompanyAdvancedSettingsByCompanyId = {
         ...previous.companyAdvancedSettingsByCompanyId ?? {}
       };
+      if (requestedCompanyId && "githubTokenRef" in record) {
+        if (githubTokenRef) {
+          nextGitHubTokenRefs[requestedCompanyId] = githubTokenRef;
+        } else {
+          delete nextGitHubTokenRefs[requestedCompanyId];
+        }
+      }
+      if (requestedCompanyId && "githubTokenLogin" in record) {
+        if (githubTokenLogin) {
+          nextGitHubTokenLoginsByCompanyId[requestedCompanyId] = githubTokenLogin;
+        } else {
+          delete nextGitHubTokenLoginsByCompanyId[requestedCompanyId];
+        }
+      }
       if (requestedCompanyId && hasAdvancedSettingsPatch) {
         nextCompanyAdvancedSettingsByCompanyId[requestedCompanyId] = normalizeAdvancedSettings(record.advancedSettings);
       }
@@ -10621,11 +10711,13 @@ var plugin = definePlugin({
         syncState: previous.syncState,
         scheduleFrequencyMinutes: "scheduleFrequencyMinutes" in record ? record.scheduleFrequencyMinutes : previous.scheduleFrequencyMinutes,
         paperclipApiBaseUrl: "paperclipApiBaseUrl" in record ? resolveTrustedPaperclipApiBaseUrlInput(record.paperclipApiBaseUrl, previous, config) : getConfiguredPaperclipApiBaseUrl(previous, config),
-        ...githubTokenLogin ? { githubTokenLogin } : {},
+        ...Object.keys(nextGitHubTokenRefs).length > 0 ? { githubTokenRefs: nextGitHubTokenRefs } : {},
+        ...Object.keys(nextGitHubTokenLoginsByCompanyId).length > 0 ? { githubTokenLoginsByCompanyId: nextGitHubTokenLoginsByCompanyId } : {},
+        ...!requestedCompanyId ? githubTokenLogin ? { githubTokenLogin } : previous.githubTokenLogin ? { githubTokenLogin: previous.githubTokenLogin } : {} : {},
         paperclipBoardApiTokenRefs: previous.paperclipBoardApiTokenRefs,
         paperclipBoardAccessIdentityByCompanyId: previous.paperclipBoardAccessIdentityByCompanyId,
         ...Object.keys(nextCompanyAdvancedSettingsByCompanyId).length > 0 ? { companyAdvancedSettingsByCompanyId: nextCompanyAdvancedSettingsByCompanyId } : {},
-        ...githubTokenRef ? { githubTokenRef } : {}
+        ...!requestedCompanyId ? githubTokenRef ? { githubTokenRef } : previous.githubTokenRef ? { githubTokenRef: previous.githubTokenRef } : {} : {}
       });
       const nextMappings = current.mappings.map((mapping, index) => ({
         id: mapping.id.trim() || createMappingId(index),
@@ -10639,21 +10731,25 @@ var plugin = definePlugin({
         syncState: previous.syncState,
         scheduleFrequencyMinutes: current.scheduleFrequencyMinutes,
         ...current.paperclipApiBaseUrl ? { paperclipApiBaseUrl: current.paperclipApiBaseUrl } : {},
+        ...current.githubTokenRefs ? { githubTokenRefs: current.githubTokenRefs } : {},
+        ...current.githubTokenLoginsByCompanyId ? { githubTokenLoginsByCompanyId: current.githubTokenLoginsByCompanyId } : {},
         ...current.githubTokenLogin ? { githubTokenLogin: current.githubTokenLogin } : {},
         ...current.paperclipBoardApiTokenRefs ? { paperclipBoardApiTokenRefs: current.paperclipBoardApiTokenRefs } : {},
         ...current.paperclipBoardAccessIdentityByCompanyId ? { paperclipBoardAccessIdentityByCompanyId: current.paperclipBoardAccessIdentityByCompanyId } : {},
         ...current.companyAdvancedSettingsByCompanyId ? { companyAdvancedSettingsByCompanyId: current.companyAdvancedSettingsByCompanyId } : {},
-        ...githubTokenRef ? { githubTokenRef } : {},
+        ...current.githubTokenRef ? { githubTokenRef: current.githubTokenRef } : {},
         updatedAt: (/* @__PURE__ */ new Date()).toISOString()
       }, {
-        hasToken: hasConfiguredGithubToken({ githubTokenRef }, config),
+        hasToken: hasConfiguredGithubToken(current, config, requestedCompanyId),
         hasMappings: getSyncableMappings(nextMappings).length > 0
       });
       await ctx.state.set(SETTINGS_SCOPE, next);
       await ctx.state.set(SYNC_STATE_SCOPE, next.syncState);
       clearGitHubRepositoryTokenCapabilityAudits();
+      const scopedGitHubTokenLogin = getSavedGitHubTokenLogin(next, requestedCompanyId);
       return {
         ...getPublicSettingsForScope(next, requestedCompanyId),
+        ...scopedGitHubTokenLogin ? { githubTokenLogin: scopedGitHubTokenLogin } : {},
         availableAssignees: requestedCompanyId ? await listAvailableAssignees(ctx, requestedCompanyId) : []
       };
     });
@@ -10697,7 +10793,7 @@ var plugin = definePlugin({
         ...Object.keys(nextPaperclipBoardAccessIdentityByCompanyId).length > 0 ? { paperclipBoardAccessIdentityByCompanyId: nextPaperclipBoardAccessIdentityByCompanyId } : {},
         updatedAt: (/* @__PURE__ */ new Date()).toISOString()
       }, {
-        hasToken: hasConfiguredGithubToken(previous, config),
+        hasToken: hasConfiguredGithubToken(previous, config, companyId),
         hasMappings: getSyncableMappings(previous.mappings).length > 0
       });
       await ctx.state.set(SETTINGS_SCOPE, next);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paperclip-github-plugin",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Paperclip plugin for synchronizing GitHub issues into Paperclip projects.",
   "license": "Apache-2.0",
   "type": "module",