paperclip-github-plugin 0.4.0 → 0.4.2

package/README.md

@@ -53,11 +53,11 @@ Long-running syncs continue in the background, so quick actions do not have to w
 
 ### Company-aware configuration
 
-GitHub tokens and sync cadence are shared at the plugin instance level, while repository mappings, advanced import defaults, and Paperclip board access are managed per company. When you open settings inside a specific company, you only edit that company's mappings and defaults.
+GitHub tokens, repository mappings, advanced import defaults, Paperclip board access, and sync cadence are managed per company. When you open settings inside a specific company, you only edit that company's setup.
 
 ### Project binding that respects existing work
 
-If a company already has a Paperclip project bound to a GitHub repository workspace, the settings UI can reuse that project instead of creating a duplicate. New mappings can also create and bind a Paperclip project automatically, and those newly created projects opt into isolated issue checkouts.
+If a company already has a Paperclip project bound to a GitHub repository workspace, the settings UI can reuse that project instead of creating a duplicate. New mappings can also create and bind a Paperclip project automatically, and those newly created projects opt into isolated issue checkouts with new issues defaulting to isolated checkout.
 
 ### Status sync with delivery context
 
@@ -153,9 +153,9 @@ Additional behavior:
 
 The plugin is designed to avoid persisting raw credentials in plugin state.
 
-- GitHub tokens saved through the UI are stored as Paperclip secret references.
+- GitHub tokens saved through the UI are stored as per-company Paperclip secret references.
 - Paperclip board access tokens are also stored as per-company secret references.
-- The settings UI also keeps lightweight non-secret identity labels for those saved connections, so later visits can still show who the shared GitHub token and company board access are connected as.
+- The settings UI also keeps lightweight non-secret identity labels for those saved connections, so later visits can still show who each company GitHub token and board access are connected as.
 - On authenticated deployments, any selected propagation agents receive `GITHUB_TOKEN` as an agent env secret-ref binding that points at the same saved GitHub token secret instead of a copied raw token.
 - The worker resolves those secret references at runtime instead of storing raw tokens in plugin state.
 - On authenticated Paperclip deployments, sync is blocked until the relevant company has connected Paperclip board access.

package/dist/manifest.js

@@ -503,7 +503,7 @@ var require2 = createRequire(import.meta.url);
 var packageJson = require2("../package.json");
 var DASHBOARD_WIDGET_CAPABILITY = "ui.dashboardWidget.register";
 var SCHEDULE_TICK_CRON = "* * * * *";
-var MANIFEST_VERSION = "0.4.0"?.trim() || typeof packageJson.version === "string" && packageJson.version.trim() || process.env.npm_package_version?.trim() || "0.0.0-dev";
+var MANIFEST_VERSION = "0.4.2"?.trim() || typeof packageJson.version === "string" && packageJson.version.trim() || process.env.npm_package_version?.trim() || "0.0.0-dev";
 var manifest = {
   id: "paperclip-github-plugin",
   apiVersion: 1,
@@ -537,9 +537,12 @@ var manifest = {
   instanceConfigSchema: {
     type: "object",
     properties: {
-      githubTokenRef: {
-        type: "string",
-        title: "GitHub Token Secret"
+      githubTokenRefs: {
+        type: "object",
+        title: "GitHub Token Secrets",
+        additionalProperties: {
+          type: "string"
+        }
       },
       paperclipBoardApiTokenRefs: {
         type: "object",
@@ -591,10 +594,10 @@ var manifest = {
         exportName: "GitHubSyncDashboardWidget"
       },
       {
-        type: "detailTab",
+        type: "taskDetailView",
         id: "paperclip-github-plugin-issue-detail-tab",
         displayName: "GitHub",
-        exportName: "GitHubSyncIssueDetailTab",
+        exportName: "GitHubSyncIssueTaskDetailView",
         entityTypes: ["issue"]
       },
       {
@@ -615,7 +618,7 @@ var manifest = {
         id: "paperclip-github-plugin-toolbar-button",
         displayName: "GitHub Sync",
         exportName: "GitHubSyncEntityToolbarButton",
-        entityTypes: ["project", "issue"]
+        entityTypes: ["project"]
       },
       {
         type: "settingsPage",

package/dist/ui/index.js

@@ -22648,18 +22648,32 @@ function normalizePluginConfigBoardTokenRefs(value) {
   }
   return Object.fromEntries(entries);
 }
+function normalizePluginConfigGitHubTokenRefs(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, secretRef]) => {
+    const normalizedCompanyId = normalizeOptionalString2(companyId);
+    const normalizedSecretRef = normalizeOptionalString2(secretRef);
+    return normalizedCompanyId && normalizedSecretRef ? [normalizedCompanyId, normalizedSecretRef] : null;
+  }).filter((entry) => Boolean(entry));
+  if (entries.length === 0) {
+    return void 0;
+  }
+  return Object.fromEntries(entries);
+}
 function normalizePluginConfig(value) {
   if (!value || typeof value !== "object") {
     return {};
   }
   const record = { ...value };
-  const githubTokenRef = normalizeOptionalString2(record.githubTokenRef);
+  const githubTokenRefs = normalizePluginConfigGitHubTokenRefs(record.githubTokenRefs);
   const paperclipBoardApiTokenRefs = normalizePluginConfigBoardTokenRefs(record.paperclipBoardApiTokenRefs);
   const paperclipApiBaseUrl = normalizePaperclipApiBaseUrl(record.paperclipApiBaseUrl);
-  if (githubTokenRef) {
-    record.githubTokenRef = githubTokenRef;
+  if (githubTokenRefs) {
+    record.githubTokenRefs = githubTokenRefs;
   } else {
-    delete record.githubTokenRef;
+    delete record.githubTokenRefs;
   }
   if (paperclipBoardApiTokenRefs) {
     record.paperclipBoardApiTokenRefs = paperclipBoardApiTokenRefs;
@@ -22675,12 +22689,27 @@ function normalizePluginConfig(value) {
 }
 function mergePluginConfig(currentValue, patch5) {
   const current = normalizePluginConfig(currentValue);
+  const currentGitHubTokenRefs = normalizePluginConfigGitHubTokenRefs(current.githubTokenRefs);
+  const patchGitHubTokenRefs = normalizePluginConfigGitHubTokenRefs(patch5.githubTokenRefs);
   const currentBoardTokenRefs = normalizePluginConfigBoardTokenRefs(current.paperclipBoardApiTokenRefs);
   const patchBoardTokenRefs = normalizePluginConfigBoardTokenRefs(patch5.paperclipBoardApiTokenRefs);
   const next2 = normalizePluginConfig({
     ...current,
     ...patch5
   });
+  if ("githubTokenRefs" in patch5) {
+    const mergedGitHubTokenRefs = {
+      ...currentGitHubTokenRefs ?? {},
+      ...patchGitHubTokenRefs ?? {}
+    };
+    if (Object.keys(mergedGitHubTokenRefs).length > 0) {
+      next2.githubTokenRefs = mergedGitHubTokenRefs;
+    } else {
+      delete next2.githubTokenRefs;
+    }
+  } else if (currentGitHubTokenRefs) {
+    next2.githubTokenRefs = currentGitHubTokenRefs;
+  }
   if ("paperclipBoardApiTokenRefs" in patch5) {
     const mergedBoardTokenRefs = {
       ...currentBoardTokenRefs ?? {},
@@ -27733,7 +27762,8 @@ async function resolveOrCreateProject(companyId, projectName) {
       name: projectName.trim(),
       status: "planned",
       executionWorkspacePolicy: {
-        enabled: true
+        enabled: true,
+        defaultMode: "isolated_workspace"
       }
     })
   });
@@ -31294,7 +31324,7 @@ function GitHubSyncSettingsPage() {
   const tokenTone = tokenStatus === "valid" ? "success" : tokenStatus === "invalid" ? "danger" : "warning";
   const tokenBannerLabel = tokenStatus === "valid" ? "Token valid" : tokenStatus === "invalid" ? "Token invalid" : "Token required";
   const tokenBadgeLabel = tokenStatus === "valid" ? "Valid" : tokenStatus === "invalid" ? "Invalid" : "Required";
-  const tokenStatusDescription = tokenStatus === "invalid" ? "GitHub rejected the last token." : tokenStatus === "required" ? "Add a token." : "Shared token.";
+  const tokenStatusDescription = tokenStatus === "invalid" ? "GitHub rejected the last token." : tokenStatus === "required" ? hasCompanyContext ? "Add a token for this company." : "Select a company." : hasCompanyContext ? "Token configured for the selected company context." : "Saved in one or more companies.";
   const tokenDescription = tokenStatusDescription;
   const tokenPermissionAuditData = tokenPermissionAudit.data;
   const tokenPermissionAuditMeta = getGitHubTokenPermissionAuditMeta(tokenPermissionAuditData);
@@ -31418,7 +31448,7 @@ function GitHubSyncSettingsPage() {
         ] }),
         /* @__PURE__ */ jsxs2("div", { className: "ghsync__section-head-actions", children: [
           /* @__PURE__ */ jsx2("span", { className: `ghsync__scope-pill ${hasCompanyContext ? "ghsync__scope-pill--company" : "ghsync__scope-pill--mixed"}`, children: hasCompanyContext ? currentCompanyName : "No company" }),
-          /* @__PURE__ */ jsx2("span", { className: "ghsync__scope-pill ghsync__scope-pill--global", children: "Shared" }),
+          hasCompanyContext ? /* @__PURE__ */ jsx2("span", { className: "ghsync__scope-pill ghsync__scope-pill--company", children: "Company" }) : null,
           /* @__PURE__ */ jsxs2("span", { className: "ghsync__badge ghsync__badge--neutral", children: [
             /* @__PURE__ */ jsx2(LoadingSpinner, { size: "sm", label: "Loading settings" }),
             "Loading"
@@ -31538,13 +31568,18 @@ function GitHubSyncSettingsPage() {
       return;
     }
     let githubTokenSecretRef = typeof options.githubTokenSecretRef === "string" && options.githubTokenSecretRef.trim() ? options.githubTokenSecretRef.trim() : void 0;
+    const companyId = hostContext.companyId;
     if (!githubTokenSecretRef) {
+      if (!companyId) {
+        throw new Error("Company context is required to propagate the GitHub token.");
+      }
       const pluginId = await resolveCurrentPluginId(pluginIdFromLocation);
       if (!pluginId) {
         throw new Error("Plugin id is required to propagate the GitHub token to selected agents.");
       }
       const currentConfigResponse = await fetchJson(`/api/plugins/${pluginId}/config`);
-      githubTokenSecretRef = normalizePluginConfig(currentConfigResponse?.configJson).githubTokenRef;
+      const normalizedConfig = normalizePluginConfig(currentConfigResponse?.configJson);
+      githubTokenSecretRef = normalizedConfig.githubTokenRefs?.[companyId];
     }
     if (!githubTokenSecretRef) {
       throw new Error("GitHub token propagation requires a GitHub token saved through this settings page.");
@@ -31594,11 +31629,15 @@ function GitHubSyncSettingsPage() {
       const secretName = `github_sync_${companyId.replace(/[^a-z0-9]+/gi, "_").toLowerCase()}`;
       const secret = await resolveOrCreateCompanySecret(companyId, secretName, trimmedToken);
       await patchPluginConfig(pluginId, {
-        githubTokenRef: secret.id
+        githubTokenRefs: {
+          [companyId]: secret.id
+        }
       });
       await saveRegistration({
         companyId,
-        githubTokenRef: secret.id,
+        githubTokenRefs: {
+          [companyId]: secret.id
+        },
         githubTokenLogin: validation.login
       });
       const selectedAgentIds = normalizeAgentIds(currentSettings?.advancedSettings?.githubTokenPropagationAgentIds);
@@ -31920,7 +31959,7 @@ function GitHubSyncSettingsPage() {
       ] }),
       /* @__PURE__ */ jsxs2("div", { className: "ghsync__section-head-actions", children: [
         /* @__PURE__ */ jsx2("span", { className: `ghsync__scope-pill ${hasCompanyContext ? "ghsync__scope-pill--company" : "ghsync__scope-pill--mixed"}`, children: hasCompanyContext ? currentCompanyName : "No company" }),
-        /* @__PURE__ */ jsx2("span", { className: "ghsync__scope-pill ghsync__scope-pill--global", children: "Shared" }),
+        /* @__PURE__ */ jsx2("span", { className: "ghsync__scope-pill ghsync__scope-pill--company", children: "Company" }),
         /* @__PURE__ */ jsxs2("span", { className: `ghsync__badge ${getToneClass(tokenTone)}`, children: [
           /* @__PURE__ */ jsx2("span", { className: "ghsync__badge-dot", "aria-hidden": "true" }),
           tokenBannerLabel
@@ -31942,7 +31981,7 @@ function GitHubSyncSettingsPage() {
             /* @__PURE__ */ jsxs2("div", { className: "ghsync__section-copy", children: [
               /* @__PURE__ */ jsxs2("div", { className: "ghsync__section-title-row", children: [
                 /* @__PURE__ */ jsx2("h4", { children: "GitHub access" }),
-                /* @__PURE__ */ jsx2("div", { className: "ghsync__section-tags", children: /* @__PURE__ */ jsx2("span", { className: "ghsync__scope-pill ghsync__scope-pill--global", children: "Shared" }) })
+                /* @__PURE__ */ jsx2("div", { className: "ghsync__section-tags", children: /* @__PURE__ */ jsx2("span", { className: "ghsync__scope-pill ghsync__scope-pill--company", children: "Company" }) })
               ] }),
               /* @__PURE__ */ jsx2("p", { children: tokenDescription })
             ] }),
@@ -31950,8 +31989,8 @@ function GitHubSyncSettingsPage() {
           ] }),
           !hasCompanyContext ? /* @__PURE__ */ jsxs2("div", { className: "ghsync__locked", children: [
             /* @__PURE__ */ jsxs2("div", { children: [
-              /* @__PURE__ */ jsx2("strong", { children: hasSavedToken ? "Shared token ready" : "Company required" }),
-              /* @__PURE__ */ jsx2("span", { children: hasSavedToken ? "Open a company to replace it." : "Open a company to save it." })
+              /* @__PURE__ */ jsx2("strong", { children: "Company required" }),
+              /* @__PURE__ */ jsx2("span", { children: "Open a company to view or save its token." })
             ] }),
             /* @__PURE__ */ jsx2("span", { className: "ghsync__badge ghsync__badge--neutral", children: "Read only" })
           ] }) : showTokenForm ? /* @__PURE__ */ jsxs2("form", { className: "ghsync__stack", onSubmit: handleSaveToken, children: [
@@ -32008,8 +32047,8 @@ function GitHubSyncSettingsPage() {
             ] }) })
           ] }) : /* @__PURE__ */ jsxs2("div", { className: "ghsync__connected", children: [
             /* @__PURE__ */ jsxs2("div", { children: [
-              /* @__PURE__ */ jsx2("strong", { children: validatedLogin ? `Authenticated as ${validatedLogin}` : "Shared token ready" }),
-              /* @__PURE__ */ jsx2("span", { children: "Shared across all companies." })
+              /* @__PURE__ */ jsx2("strong", { children: validatedLogin ? `Authenticated as ${validatedLogin}` : "Company token ready" }),
+              /* @__PURE__ */ jsx2("span", { children: `Used for sync in ${currentCompanyName}.` })
             ] }),
             /* @__PURE__ */ jsx2(
               "button",
@@ -32349,7 +32388,7 @@ function GitHubSyncSettingsPage() {
                 /* @__PURE__ */ jsx2("h4", { children: "Sync" }),
                 /* @__PURE__ */ jsxs2("div", { className: "ghsync__section-tags", children: [
                   /* @__PURE__ */ jsx2("span", { className: manualSyncScopePillClass, children: manualSyncScopePillLabel }),
-                  /* @__PURE__ */ jsx2("span", { className: "ghsync__scope-pill ghsync__scope-pill--global", children: "Shared cadence" })
+                  /* @__PURE__ */ jsx2("span", { className: "ghsync__scope-pill ghsync__scope-pill--global", children: "Company cadence" })
                 ] })
               ] }),
               syncSectionDescription ? /* @__PURE__ */ jsx2("p", { children: syncSectionDescription }) : null
@@ -32386,12 +32425,16 @@ function GitHubSyncSettingsPage() {
                 /* @__PURE__ */ jsx2("p", { className: `ghsync__hint${scheduleFrequencyError ? " ghsync__hint--error" : ""}`, children: scheduleFrequencyError ?? "Minutes." })
               ] }),
               /* @__PURE__ */ jsxs2("div", { className: "ghsync__schedule-meta", children: [
-                /* @__PURE__ */ jsx2("span", { className: "ghsync__scope-pill ghsync__scope-pill--global", children: "Shared" }),
+                /* @__PURE__ */ jsx2("span", { className: "ghsync__scope-pill ghsync__scope-pill--global", children: "Company" }),
                 /* @__PURE__ */ jsxs2("strong", { children: [
                   "Auto-sync ",
                   scheduleDescription
                 ] }),
-                /* @__PURE__ */ jsx2("span", { children: "All companies." })
+                /* @__PURE__ */ jsxs2("span", { children: [
+                  "Used for sync in ",
+                  currentCompanyName,
+                  "."
+                ] })
               ] })
             ] }),
             !syncUnlocked ? /* @__PURE__ */ jsxs2("div", { className: "ghsync__locked", children: [
@@ -33436,7 +33479,7 @@ function GitHubSyncIssueDetailTabContent(props) {
     ] }) : null
   ] });
 }
-function GitHubSyncIssueDetailTab() {
+function GitHubSyncIssueTaskDetailView() {
   const context = useHostContext();
   const themeMode = useResolvedThemeMode();
   const theme = themeMode === "light" ? LIGHT_PALETTE : DARK_PALETTE;
@@ -33459,6 +33502,7 @@ function GitHubSyncIssueDetailTab() {
     detailKey
   );
 }
+var GitHubSyncIssueDetailTab = GitHubSyncIssueTaskDetailView;
 function GitHubSyncCommentAnnotation() {
   const context = useHostContext();
   const themeMode = useResolvedThemeMode();
@@ -33504,6 +33548,7 @@ export {
   GitHubSyncEntityToolbarButton,
   GitHubSyncGlobalToolbarButton,
   GitHubSyncIssueDetailTab,
+  GitHubSyncIssueTaskDetailView,
   GitHubSyncProjectPullRequestsPage,
   GitHubSyncProjectPullRequestsSidebarItem,
   GitHubSyncSettingsPage,