paperclip-github-plugin 0.4.0 → 0.4.2

package/dist/worker.js

@@ -630,11 +630,13 @@ var COMMENT_ANNOTATION_ENTITY_TYPE = "paperclip-github-plugin.comment-annotation
 var AI_AUTHORED_COMMENT_FOOTER_PREFIX = "Created by a Paperclip AI agent using ";
 var HIDDEN_GITHUB_IMPORT_MARKER_PREFIX = "<!-- paperclip-github-plugin-imported-from: ";
 var HIDDEN_GITHUB_IMPORT_MARKER_SUFFIX = " -->";
+var EMPTY_GITHUB_ISSUE_DESCRIPTION_PLACEHOLDER = "_No description provided on GitHub._";
 function normalizeCompanyId(value) {
   return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
 var activeSyncPromise = null;
 var activeRunningSyncState = null;
+var activeRunningSyncCompanyId;
 var activePaperclipApiAuthTokensByCompanyId = null;
 var activeExternalConfigWarningKey = null;
 var activeProjectPullRequestPageCache = /* @__PURE__ */ new Map();
@@ -710,6 +712,7 @@ var FAILED_STATUS_CONTEXT_STATES = /* @__PURE__ */ new Set(["ERROR", "FAILURE"])
 var PENDING_STATUS_CONTEXT_STATES = /* @__PURE__ */ new Set(["EXPECTED", "PENDING"]);
 var GITHUB_REPOSITORY_MAINTAINER_WARMUP_CONCURRENCY = 4;
 var GITHUB_REPOSITORY_MAINTAINER_ROLE_NAMES = /* @__PURE__ */ new Set(["admin", "maintain"]);
+var GITHUB_REPOSITORY_TRUSTED_AUTHOR_ASSOCIATIONS = /* @__PURE__ */ new Set(["collaborator", "member", "owner"]);
 var GITHUB_ISSUE_STATUS_SNAPSHOT_QUERY = `
   query GitHubIssueStatusSnapshot($owner: String!, $repo: String!, $issueNumber: Int!, $after: String) {
     repository(owner: $owner, name: $repo) {
@@ -1613,6 +1616,20 @@ function normalizeGitHubUserLogin(value) {
 function normalizeGitHubTokenRef(value) {
   return normalizeSecretRef(value);
 }
+function normalizeGitHubTokenRefs(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, secretRef]) => {
+    const normalizedCompanyId = normalizeCompanyId(companyId);
+    const normalizedSecretRef = normalizeGitHubTokenRef(secretRef);
+    return normalizedCompanyId && normalizedSecretRef ? [normalizedCompanyId, normalizedSecretRef] : null;
+  }).filter((entry) => entry !== null);
+  if (entries.length === 0) {
+    return void 0;
+  }
+  return Object.fromEntries(entries);
+}
 function formatUtcTimestamp(value) {
   const parsed = new Date(value);
   if (Number.isNaN(parsed.getTime())) {
@@ -2237,7 +2254,7 @@ async function hydrateRecoveredPaperclipIssueGitHubLink(ctx, issueId, fallbackLi
   }
   let octokit;
   try {
-    octokit = await createGitHubToolOctokit(ctx);
+    octokit = await createGitHubToolOctokit(ctx, fallbackLink.companyId);
   } catch {
     return null;
   }
@@ -2410,10 +2427,10 @@ function extractGitHubLinksFromCommentBody(body) {
   return [...links.values()];
 }
 async function buildToolbarSyncState(ctx, input) {
-  const settings = await getActiveOrCurrentSyncState(ctx);
-  const config = await getResolvedConfig(ctx);
-  const githubTokenConfigured = hasConfiguredGithubToken(settings, config);
   const companyId = typeof input.companyId === "string" && input.companyId.trim() ? input.companyId.trim() : void 0;
+  const settings = await getActiveOrCurrentSyncState(ctx, companyId);
+  const config = await getResolvedConfig(ctx);
+  const githubTokenConfigured = hasConfiguredGithubToken(settings, config, companyId);
   const entityId = typeof input.entityId === "string" && input.entityId.trim() ? input.entityId.trim() : void 0;
   const entityType = typeof input.entityType === "string" && input.entityType.trim() ? input.entityType.trim() : void 0;
   const savedMappingCount = companyId ? getSyncableMappingsForTarget(settings.mappings, {
@@ -2454,7 +2471,7 @@ async function buildToolbarSyncState(ctx, input) {
     }) : [];
     return {
       kind: "issue",
-      visible: Boolean(link),
+      visible: false,
       canRun: githubTokenConfigured && mappings.length > 0,
       label: link?.githubIssueNumber ? `Sync #${link.githubIssueNumber}` : "Sync issue",
       message: link ? `Sync ${link.repositoryUrl.replace(/^https:\/\/github\.com\//, "")} issue #${link.githubIssueNumber}.` : "This Paperclip issue is not linked to GitHub yet.",
@@ -2625,14 +2642,26 @@ function sanitizeSettingsForCurrentSetup(settings, setup) {
 }
 function getPublicSettings(settings) {
   const {
+    githubTokenRefs: _githubTokenRefs,
+    githubTokenLoginByCompanyId: _githubTokenLoginByCompanyId,
     githubTokenRef: _githubTokenRef,
     paperclipBoardApiTokenRefs: _paperclipBoardApiTokenRefs,
     paperclipBoardAccessIdentityByCompanyId: _paperclipBoardAccessIdentityByCompanyId,
     companyAdvancedSettingsByCompanyId: _companyAdvancedSettingsByCompanyId,
+    syncStateByCompanyId: _syncStateByCompanyId,
+    scheduleFrequencyMinutesByCompanyId: _scheduleFrequencyMinutesByCompanyId,
+    paperclipApiBaseUrlByCompanyId: _paperclipApiBaseUrlByCompanyId,
     ...publicSettings
   } = settings;
   return publicSettings;
 }
+function getGitHubTokenLogin(settings, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  if (!normalizedCompanyId) {
+    return void 0;
+  }
+  return normalizeOptionalString2(settings.githubTokenLoginByCompanyId?.[normalizedCompanyId]) ?? normalizeOptionalString2(settings.githubTokenLogin);
+}
 function getPaperclipBoardAccessIdentity(settings, companyId) {
   const normalizedCompanyId = normalizeCompanyId(companyId);
   if (!normalizedCompanyId) {
@@ -2642,11 +2671,13 @@ function getPaperclipBoardAccessIdentity(settings, companyId) {
 }
 function getPublicSettingsForScope(settings, companyId) {
   const publicSettings = getPublicSettings(settings);
+  const githubTokenLogin = getGitHubTokenLogin(settings, companyId);
   const paperclipBoardAccessIdentity = getPaperclipBoardAccessIdentity(settings, companyId);
   return {
     ...publicSettings,
     mappings: filterMappingsByCompany(publicSettings.mappings, companyId),
     advancedSettings: getCompanyAdvancedSettings(settings, companyId),
+    ...githubTokenLogin ? { githubTokenLogin } : {},
     ...paperclipBoardAccessIdentity ? { paperclipBoardAccessIdentity } : {}
   };
 }
@@ -2830,14 +2861,11 @@ function createSetupConfigurationErrorSyncState(issue, trigger) {
       });
   }
 }
-async function saveSettingsSyncState(ctx, settings, syncState) {
-  const next = {
-    ...settings,
-    syncState
-  };
+async function saveSettingsSyncState(ctx, settings, syncState, companyId) {
+  const next = upsertScopedSyncState(normalizeSettings(settings), syncState, companyId);
   await ctx.state.set(SETTINGS_SCOPE, next);
-  await ctx.state.set(SYNC_STATE_SCOPE, next.syncState);
-  return next;
+  await ctx.state.set(SYNC_STATE_SCOPE, syncState);
+  return materializeScopedSettings(next, null, companyId);
 }
 async function setSyncCancellationRequest(ctx, request) {
   if (request) {
@@ -2862,8 +2890,8 @@ function buildCancelledSyncMessage(target, progress) {
   const completionSummary = completedIssueCount !== void 0 && totalIssueCount !== void 0 ? ` Completed ${Math.min(completedIssueCount, totalIssueCount)} of ${totalIssueCount} issues before stopping.` : "";
   return `${scopeLabel} was cancelled before it finished.${completionSummary}`;
 }
-async function createUnexpectedSyncErrorResult(ctx, trigger, error) {
-  const settings = normalizeSettings(await ctx.state.get(SETTINGS_SCOPE));
+async function createUnexpectedSyncErrorResult(ctx, trigger, error, companyId) {
+  const settings = materializeScopedSettings(normalizeSettings(await ctx.state.get(SETTINGS_SCOPE)), null, companyId);
   const errorDetails = buildSyncErrorDetails(error, {
     phase: "configuration"
   });
@@ -2888,7 +2916,8 @@ async function createUnexpectedSyncErrorResult(ctx, trigger, error) {
           errorDetails
         })
       )
-    })
+    }),
+    companyId
   );
 }
 async function waitForSyncResultWithinGracePeriod(promise, timeoutMs) {
@@ -2906,15 +2935,13 @@ async function waitForSyncResultWithinGracePeriod(promise, timeoutMs) {
     }
   }
 }
-async function getActiveOrCurrentSyncState(ctx) {
-  if (activeRunningSyncState?.syncState.status === "running") {
-    return activeRunningSyncState;
+async function getActiveOrCurrentSyncState(ctx, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  if (activeRunningSyncState?.syncState.status === "running" && activeRunningSyncCompanyId === normalizedCompanyId) {
+    return materializeScopedSettings(activeRunningSyncState, null, normalizedCompanyId);
   }
   const current = normalizeSettings(await ctx.state.get(SETTINGS_SCOPE));
-  if (current.syncState.status === "running") {
-    return current;
-  }
-  return current;
+  return materializeScopedSettings(current, null, normalizedCompanyId);
 }
 function updateSyncFailureContext(current, next) {
   if ("phase" in next) {
@@ -2953,11 +2980,13 @@ function normalizeConfig(value) {
     return {};
   }
   const record = value;
+  const githubTokenRefs = normalizeGitHubTokenRefs(record.githubTokenRefs);
   const githubTokenRef = normalizeGitHubTokenRef(record.githubTokenRef);
   const githubToken = normalizeGitHubToken(record.githubToken);
   const paperclipBoardApiTokenRefs = normalizePaperclipBoardApiTokenRefs(record.paperclipBoardApiTokenRefs);
   const paperclipApiBaseUrl = normalizePaperclipApiBaseUrl(record.paperclipApiBaseUrl);
   return {
+    ...githubTokenRefs ? { githubTokenRefs } : {},
     ...githubTokenRef ? { githubTokenRef } : {},
     ...githubToken ? { githubToken } : {},
     ...paperclipBoardApiTokenRefs ? { paperclipBoardApiTokenRefs } : {},
@@ -3049,6 +3078,20 @@ function normalizePaperclipBoardApiTokenRefs(value) {
   }
   return Object.fromEntries(entries);
 }
+function normalizeGitHubTokenLoginByCompanyId(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, login]) => {
+    const normalizedCompanyId = normalizeCompanyId(companyId);
+    const normalizedLogin = normalizeOptionalString2(login);
+    return normalizedCompanyId && normalizedLogin ? [normalizedCompanyId, normalizedLogin] : null;
+  }).filter((entry) => entry !== null);
+  if (entries.length === 0) {
+    return void 0;
+  }
+  return Object.fromEntries(entries);
+}
 function normalizePaperclipBoardAccessIdentityByCompanyId(value) {
   if (!value || typeof value !== "object") {
     return void 0;
@@ -3082,14 +3125,14 @@ function normalizeSyncState(value) {
   const recentFailures = normalizeSyncFailureLogEntries(record.recentFailures);
   return {
     status: status === "running" || status === "success" || status === "error" || status === "cancelled" ? status : "idle",
-    message: typeof record.message === "string" ? record.message : void 0,
-    checkedAt: typeof record.checkedAt === "string" ? record.checkedAt : void 0,
-    syncedIssuesCount: typeof record.syncedIssuesCount === "number" ? record.syncedIssuesCount : void 0,
-    createdIssuesCount: typeof record.createdIssuesCount === "number" ? record.createdIssuesCount : void 0,
-    skippedIssuesCount: typeof record.skippedIssuesCount === "number" ? record.skippedIssuesCount : void 0,
-    erroredIssuesCount: typeof record.erroredIssuesCount === "number" ? record.erroredIssuesCount : void 0,
-    lastRunTrigger: lastRunTrigger === "manual" || lastRunTrigger === "schedule" || lastRunTrigger === "retry" ? lastRunTrigger : void 0,
-    cancelRequestedAt: typeof record.cancelRequestedAt === "string" ? record.cancelRequestedAt : void 0,
+    ...typeof record.message === "string" ? { message: record.message } : {},
+    ...typeof record.checkedAt === "string" ? { checkedAt: record.checkedAt } : {},
+    ...typeof record.syncedIssuesCount === "number" ? { syncedIssuesCount: record.syncedIssuesCount } : {},
+    ...typeof record.createdIssuesCount === "number" ? { createdIssuesCount: record.createdIssuesCount } : {},
+    ...typeof record.skippedIssuesCount === "number" ? { skippedIssuesCount: record.skippedIssuesCount } : {},
+    ...typeof record.erroredIssuesCount === "number" ? { erroredIssuesCount: record.erroredIssuesCount } : {},
+    ...lastRunTrigger === "manual" || lastRunTrigger === "schedule" || lastRunTrigger === "retry" ? { lastRunTrigger } : {},
+    ...typeof record.cancelRequestedAt === "string" ? { cancelRequestedAt: record.cancelRequestedAt } : {},
     ...progress ? { progress } : {},
     ...errorDetails ? { errorDetails } : {},
     ...recentFailures ? { recentFailures } : {}
@@ -3199,6 +3242,26 @@ function normalizeScheduleFrequencyMinutes(value) {
   }
   return Math.floor(numericValue);
 }
+function normalizeSyncStateByCompanyId(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, syncState]) => {
+    const normalizedCompanyId = normalizeCompanyId(companyId);
+    return normalizedCompanyId ? [normalizedCompanyId, normalizeSyncState(syncState)] : null;
+  }).filter((entry) => entry !== null);
+  return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+}
+function normalizeScheduleFrequencyMinutesByCompanyId(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, scheduleFrequencyMinutes]) => {
+    const normalizedCompanyId = normalizeCompanyId(companyId);
+    return normalizedCompanyId ? [normalizedCompanyId, normalizeScheduleFrequencyMinutes(scheduleFrequencyMinutes)] : null;
+  }).filter((entry) => entry !== null);
+  return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+}
 function normalizePaperclipApiBaseUrl(value) {
   if (typeof value !== "string") {
     return void 0;
@@ -3213,6 +3276,17 @@ function normalizePaperclipApiBaseUrl(value) {
     return void 0;
   }
 }
+function normalizePaperclipApiBaseUrlByCompanyId(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, paperclipApiBaseUrl]) => {
+    const normalizedCompanyId = normalizeCompanyId(companyId);
+    const normalizedPaperclipApiBaseUrl = normalizePaperclipApiBaseUrl(paperclipApiBaseUrl);
+    return normalizedCompanyId && normalizedPaperclipApiBaseUrl ? [normalizedCompanyId, normalizedPaperclipApiBaseUrl] : null;
+  }).filter((entry) => entry !== null);
+  return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+}
 function getRuntimePaperclipApiBaseUrl() {
   if (typeof process === "undefined" || !process?.env) {
     return void 0;
@@ -3232,19 +3306,26 @@ function resolvePaperclipApiBaseUrl(...values) {
   }
   return void 0;
 }
-function getConfiguredPaperclipApiBaseUrl(settings, config) {
-  return resolvePaperclipApiBaseUrl(config?.paperclipApiBaseUrl, settings?.paperclipApiBaseUrl);
+function getConfiguredPaperclipApiBaseUrl(settings, config, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  return normalizedCompanyId ? resolvePaperclipApiBaseUrl(
+    config?.paperclipApiBaseUrl,
+    settings?.paperclipApiBaseUrlByCompanyId?.[normalizedCompanyId],
+    settings?.paperclipApiBaseUrl
+  ) : resolvePaperclipApiBaseUrl(config?.paperclipApiBaseUrl, settings?.paperclipApiBaseUrl);
 }
-function resolveTrustedPaperclipApiBaseUrlInput(value, settings, config) {
+function resolveTrustedPaperclipApiBaseUrlInput(value, settings, config, companyId) {
   const runtimePaperclipApiBaseUrl = getRuntimePaperclipApiBaseUrl();
   if (runtimePaperclipApiBaseUrl) {
     return runtimePaperclipApiBaseUrl;
   }
   const requestedPaperclipApiBaseUrl = normalizePaperclipApiBaseUrl(value);
   const configuredPaperclipApiBaseUrl = normalizePaperclipApiBaseUrl(config?.paperclipApiBaseUrl);
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  const savedCompanyPaperclipApiBaseUrl = normalizedCompanyId ? normalizePaperclipApiBaseUrl(settings?.paperclipApiBaseUrlByCompanyId?.[normalizedCompanyId]) : void 0;
   const savedPaperclipApiBaseUrl = normalizePaperclipApiBaseUrl(settings?.paperclipApiBaseUrl);
   if (!requestedPaperclipApiBaseUrl) {
-    return configuredPaperclipApiBaseUrl ?? savedPaperclipApiBaseUrl;
+    return configuredPaperclipApiBaseUrl ?? savedCompanyPaperclipApiBaseUrl ?? savedPaperclipApiBaseUrl;
   }
   if (configuredPaperclipApiBaseUrl) {
     if (requestedPaperclipApiBaseUrl !== configuredPaperclipApiBaseUrl) {
@@ -3254,6 +3335,9 @@ function resolveTrustedPaperclipApiBaseUrlInput(value, settings, config) {
     }
     return configuredPaperclipApiBaseUrl;
   }
+  if (savedCompanyPaperclipApiBaseUrl && requestedPaperclipApiBaseUrl === savedCompanyPaperclipApiBaseUrl) {
+    return savedCompanyPaperclipApiBaseUrl;
+  }
   if (savedPaperclipApiBaseUrl && requestedPaperclipApiBaseUrl === savedPaperclipApiBaseUrl) {
     return savedPaperclipApiBaseUrl;
   }
@@ -3266,7 +3350,14 @@ function normalizeSettings(value) {
     return DEFAULT_SETTINGS;
   }
   const record = value;
+  const syncStateByCompanyId = normalizeSyncStateByCompanyId(record.syncStateByCompanyId);
+  const scheduleFrequencyMinutesByCompanyId = normalizeScheduleFrequencyMinutesByCompanyId(
+    record.scheduleFrequencyMinutesByCompanyId
+  );
   const paperclipApiBaseUrl = resolvePaperclipApiBaseUrl(record.paperclipApiBaseUrl);
+  const paperclipApiBaseUrlByCompanyId = normalizePaperclipApiBaseUrlByCompanyId(record.paperclipApiBaseUrlByCompanyId);
+  const githubTokenRefs = normalizeGitHubTokenRefs(record.githubTokenRefs);
+  const githubTokenLoginByCompanyId = normalizeGitHubTokenLoginByCompanyId(record.githubTokenLoginByCompanyId);
   const githubTokenRef = normalizeGitHubTokenRef(record.githubTokenRef);
   const githubTokenLogin = normalizeOptionalString2(record.githubTokenLogin);
   const paperclipBoardApiTokenRefs = normalizePaperclipBoardApiTokenRefs(record.paperclipBoardApiTokenRefs);
@@ -3277,8 +3368,13 @@ function normalizeSettings(value) {
   return {
     mappings: normalizeMappings(record.mappings),
     syncState: normalizeSyncState(record.syncState),
+    ...syncStateByCompanyId ? { syncStateByCompanyId } : {},
     scheduleFrequencyMinutes: normalizeScheduleFrequencyMinutes(record.scheduleFrequencyMinutes),
+    ...scheduleFrequencyMinutesByCompanyId ? { scheduleFrequencyMinutesByCompanyId } : {},
     ...paperclipApiBaseUrl ? { paperclipApiBaseUrl } : {},
+    ...paperclipApiBaseUrlByCompanyId ? { paperclipApiBaseUrlByCompanyId } : {},
+    ...githubTokenRefs ? { githubTokenRefs } : {},
+    ...githubTokenLoginByCompanyId ? { githubTokenLoginByCompanyId } : {},
     ...githubTokenRef ? { githubTokenRef } : {},
     ...githubTokenLogin ? { githubTokenLogin } : {},
     ...paperclipBoardApiTokenRefs ? { paperclipBoardApiTokenRefs } : {},
@@ -3287,6 +3383,103 @@ function normalizeSettings(value) {
     updatedAt: typeof record.updatedAt === "string" ? record.updatedAt : void 0
   };
 }
+function getScopedSyncState(settings, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  if (!normalizedCompanyId) {
+    return normalizeSyncState(settings.syncState);
+  }
+  const scopedSyncState = settings.syncStateByCompanyId?.[normalizedCompanyId];
+  return scopedSyncState ? normalizeSyncState(scopedSyncState) : normalizeSyncState(settings.syncState);
+}
+function getScopedScheduleFrequencyMinutes(settings, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  if (!normalizedCompanyId) {
+    return normalizeScheduleFrequencyMinutes(settings.scheduleFrequencyMinutes);
+  }
+  const scopedScheduleFrequencyMinutes = settings.scheduleFrequencyMinutesByCompanyId?.[normalizedCompanyId];
+  return scopedScheduleFrequencyMinutes !== void 0 ? normalizeScheduleFrequencyMinutes(scopedScheduleFrequencyMinutes) : normalizeScheduleFrequencyMinutes(settings.scheduleFrequencyMinutes);
+}
+function materializeScopedSettings(settings, config, companyId) {
+  const syncState = getScopedSyncState(settings, companyId);
+  const scheduleFrequencyMinutes = getScopedScheduleFrequencyMinutes(settings, companyId);
+  const paperclipApiBaseUrl = getConfiguredPaperclipApiBaseUrl(settings, config, companyId);
+  return {
+    ...settings,
+    syncState,
+    scheduleFrequencyMinutes,
+    ...paperclipApiBaseUrl ? { paperclipApiBaseUrl } : {}
+  };
+}
+function upsertScopedSyncState(settings, syncState, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  if (!normalizedCompanyId) {
+    return {
+      ...settings,
+      syncState
+    };
+  }
+  return {
+    ...settings,
+    syncState,
+    syncStateByCompanyId: {
+      ...settings.syncStateByCompanyId ?? {},
+      [normalizedCompanyId]: syncState
+    }
+  };
+}
+function upsertScopedScheduleFrequencyMinutes(settings, scheduleFrequencyMinutes, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  if (!normalizedCompanyId) {
+    return {
+      ...settings,
+      scheduleFrequencyMinutes
+    };
+  }
+  return {
+    ...settings,
+    scheduleFrequencyMinutes,
+    scheduleFrequencyMinutesByCompanyId: {
+      ...settings.scheduleFrequencyMinutesByCompanyId ?? {},
+      [normalizedCompanyId]: scheduleFrequencyMinutes
+    }
+  };
+}
+function upsertScopedPaperclipApiBaseUrl(settings, paperclipApiBaseUrl, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  if (!normalizedCompanyId) {
+    return {
+      ...settings,
+      ...paperclipApiBaseUrl ? { paperclipApiBaseUrl } : {}
+    };
+  }
+  const nextPaperclipApiBaseUrlByCompanyId = {
+    ...settings.paperclipApiBaseUrlByCompanyId ?? {}
+  };
+  if (paperclipApiBaseUrl) {
+    nextPaperclipApiBaseUrlByCompanyId[normalizedCompanyId] = paperclipApiBaseUrl;
+  } else {
+    delete nextPaperclipApiBaseUrlByCompanyId[normalizedCompanyId];
+  }
+  return {
+    ...settings,
+    ...paperclipApiBaseUrl ? { paperclipApiBaseUrl } : {},
+    ...Object.keys(nextPaperclipApiBaseUrlByCompanyId).length > 0 ? { paperclipApiBaseUrlByCompanyId: nextPaperclipApiBaseUrlByCompanyId } : {}
+  };
+}
+function getScopedSyncTarget(companyId) {
+  return {
+    kind: "company",
+    companyId,
+    displayLabel: "this company"
+  };
+}
+function getSyncableMappingsForScope(mappings, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  return normalizedCompanyId ? getSyncableMappingsForTarget(mappings, getScopedSyncTarget(normalizedCompanyId)) : getSyncableMappings(mappings);
+}
+function hasAnyScopedValue(valueByCompanyId) {
+  return Boolean(valueByCompanyId && Object.keys(valueByCompanyId).length > 0);
+}
 function normalizeImportRegistry(value) {
   if (!Array.isArray(value)) {
     return [];
@@ -3446,6 +3639,7 @@ function normalizeGitHubIssueRecord(issue) {
     body: typeof issue.body === "string" ? stripNullBytes(issue.body) : null,
     htmlUrl: issue.html_url,
     ...normalizeGitHubUsername(issue.user?.login) ? { authorLogin: normalizeGitHubUsername(issue.user?.login) } : {},
+    ...normalizeGitHubLowercaseString(issue.author_association) ? { authorAssociation: normalizeGitHubLowercaseString(issue.author_association) } : {},
     labels: normalizeGitHubIssueLabels(issue.labels),
     state: issue.state === "closed" ? "closed" : "open",
     stateReason: normalizeGitHubIssueStateReason(issue.state_reason),
@@ -4226,6 +4420,22 @@ async function getGitHubIssueStatusSnapshot(octokit, repository, issueNumber, gi
 function buildGitHubRepositoryActorCacheKey(repository, login) {
   return `${repository.owner.toLowerCase()}/${repository.repo.toLowerCase()}:${login}`;
 }
+function getGitHubRepositoryTrustedAuthorStatusFromAssociation(authorAssociation) {
+  const normalizedAssociation = normalizeGitHubLowercaseString(authorAssociation);
+  if (!normalizedAssociation) {
+    return void 0;
+  }
+  return GITHUB_REPOSITORY_TRUSTED_AUTHOR_ASSOCIATIONS.has(normalizedAssociation);
+}
+function cacheGitHubRepositoryTrustedAuthorStatusFromAssociation(repository, login, authorAssociation, cache) {
+  const normalizedLogin = normalizeGitHubUserLogin(login);
+  const trustedAuthorStatus = getGitHubRepositoryTrustedAuthorStatusFromAssociation(authorAssociation);
+  if (!normalizedLogin || trustedAuthorStatus === void 0) {
+    return trustedAuthorStatus;
+  }
+  cache.set(buildGitHubRepositoryActorCacheKey(repository, normalizedLogin), trustedAuthorStatus);
+  return trustedAuthorStatus;
+}
 async function isGitHubUserRepositoryMaintainer(octokit, repository, login, cache) {
   const normalizedLogin = normalizeGitHubUserLogin(login);
   if (!normalizedLogin) {
@@ -4291,6 +4501,7 @@ async function listNewGitHubIssueCommentsSinceCount(octokit, repository, issueNu
         body: typeof comment.body === "string" ? stripNullBytes(comment.body) : "",
         url: comment.html_url ?? void 0,
         authorLogin: normalizeGitHubUserLogin(comment.user?.login),
+        ...normalizeGitHubLowercaseString(comment.author_association) ? { authorAssociation: normalizeGitHubLowercaseString(comment.author_association) } : {},
         createdAt: comment.created_at ?? void 0,
         updatedAt: comment.updated_at ?? void 0
       });
@@ -4332,6 +4543,18 @@ async function hasTrustedNewGitHubIssueComment(params) {
     if (originalPosterLogin && authorLogin === originalPosterLogin) {
       return true;
     }
+    const trustedAuthorStatus = cacheGitHubRepositoryTrustedAuthorStatusFromAssociation(
+      params.repository,
+      authorLogin,
+      comment.authorAssociation,
+      params.maintainerCache
+    );
+    if (trustedAuthorStatus === true) {
+      return true;
+    }
+    if (trustedAuthorStatus === false) {
+      continue;
+    }
     unseenAuthors.add(authorLogin);
   }
   for (const authorLogin of unseenAuthors) {
@@ -4351,6 +4574,15 @@ async function isMaintainerAuthoredGitHubIssue(params) {
   if (!authorLogin) {
     return false;
   }
+  const trustedAuthorStatus = cacheGitHubRepositoryTrustedAuthorStatusFromAssociation(
+    params.repository,
+    authorLogin,
+    params.githubIssue.authorAssociation,
+    params.maintainerCache
+  );
+  if (trustedAuthorStatus !== void 0) {
+    return trustedAuthorStatus;
+  }
   return isGitHubUserRepositoryMaintainer(
     params.octokit,
     params.repository,
@@ -4360,7 +4592,19 @@ async function isMaintainerAuthoredGitHubIssue(params) {
 }
 async function warmGitHubRepositoryMaintainerCache(params) {
   const uniqueAuthorLogins = [...new Set(
-    params.githubIssues.map((issue) => normalizeGitHubUserLogin(issue.authorLogin)).filter((authorLogin) => Boolean(authorLogin))
+    params.githubIssues.flatMap((issue) => {
+      const authorLogin = normalizeGitHubUserLogin(issue.authorLogin);
+      if (!authorLogin) {
+        return [];
+      }
+      const trustedAuthorStatus = cacheGitHubRepositoryTrustedAuthorStatusFromAssociation(
+        params.repository,
+        authorLogin,
+        issue.authorAssociation,
+        params.maintainerCache
+      );
+      return trustedAuthorStatus === void 0 ? [authorLogin] : [];
+    })
   )].filter((authorLogin) => !params.maintainerCache.has(buildGitHubRepositoryActorCacheKey(params.repository, authorLogin)));
   if (uniqueAuthorLogins.length === 0) {
     return;
@@ -4575,7 +4819,9 @@ function buildPaperclipIssueDescription(issue, linkedPullRequestNumbers = []) {
     return normalizedBody ?? "";
   }
   if (!normalizedBody) {
-    return hiddenImportMarker;
+    return `${EMPTY_GITHUB_ISSUE_DESCRIPTION_PLACEHOLDER}
+
+${hiddenImportMarker}`;
   }
   return `${normalizedBody}
 
@@ -6173,20 +6419,34 @@ async function getResolvedConfig(ctx) {
     ...normalizeConfig(savedConfig)
   };
 }
-function getConfiguredGithubTokenSource(settings, config) {
-  const secretRef = normalizeGitHubTokenRef(config.githubTokenRef) ?? normalizeGitHubTokenRef(settings?.githubTokenRef);
+function getConfiguredGithubTokenSource(settings, config, companyId) {
+  const normalizedCompanyId = normalizeCompanyId(companyId);
+  const hasScopedGitHubTokenRefs = hasAnyScopedValue(settings?.githubTokenRefs) || hasAnyScopedValue(config.githubTokenRefs);
+  const secretRef = normalizedCompanyId ? normalizeSecretRef(config.githubTokenRefs?.[normalizedCompanyId]) ?? normalizeSecretRef(settings?.githubTokenRefs?.[normalizedCompanyId]) ?? (!hasScopedGitHubTokenRefs ? normalizeGitHubTokenRef(config.githubTokenRef) ?? normalizeGitHubTokenRef(settings?.githubTokenRef) : void 0) : normalizeGitHubTokenRef(config.githubTokenRef) ?? normalizeGitHubTokenRef(settings?.githubTokenRef) ?? (() => {
+    const configuredRefs = [
+      ...Object.values(config.githubTokenRefs ?? {}),
+      ...Object.values(settings?.githubTokenRefs ?? {})
+    ].map((value) => normalizeGitHubTokenRef(value)).filter((value) => Boolean(value));
+    const uniqueRefs = [...new Set(configuredRefs)];
+    return uniqueRefs.length === 1 ? uniqueRefs[0] : void 0;
+  })();
   if (secretRef) {
     return { secretRef };
   }
-  const token = normalizeGitHubToken(config.githubToken);
+  const token = !normalizedCompanyId || !hasScopedGitHubTokenRefs ? normalizeGitHubToken(config.githubToken) : void 0;
   return token ? { token } : {};
 }
-function getConfiguredGithubTokenRef(settings, config) {
-  return getConfiguredGithubTokenSource(settings, config).secretRef;
-}
-function hasConfiguredGithubToken(settings, config) {
-  const configuredTokenSource = getConfiguredGithubTokenSource(settings, config);
-  return Boolean(configuredTokenSource.secretRef ?? configuredTokenSource.token);
+function hasConfiguredGithubToken(settings, config, companyId) {
+  const configuredTokenSource = getConfiguredGithubTokenSource(settings, config, companyId);
+  if (configuredTokenSource.secretRef ?? configuredTokenSource.token) {
+    return true;
+  }
+  if (normalizeCompanyId(companyId)) {
+    return false;
+  }
+  return Boolean(
+    settings?.githubTokenRefs && Object.keys(settings.githubTokenRefs).length > 0 || config.githubTokenRefs && Object.keys(config.githubTokenRefs).length > 0
+  );
 }
 function getSavedPaperclipBoardApiTokenRef(settings, companyId) {
   if (!companyId) {
@@ -6269,7 +6529,7 @@ async function resolvePaperclipApiAuthTokens(ctx, settings, config, mappings) {
 async function resolveGithubToken(ctx, options = {}) {
   const settings = options.settings ?? normalizeSettings(await ctx.state.get(SETTINGS_SCOPE));
   const config = options.config ?? await getResolvedConfig(ctx);
-  const configuredTokenSource = getConfiguredGithubTokenSource(settings, config);
+  const configuredTokenSource = getConfiguredGithubTokenSource(settings, config, options.companyId);
   if (configuredTokenSource.secretRef) {
     return ctx.secrets.resolve(configuredTokenSource.secretRef);
   }
@@ -6347,8 +6607,8 @@ async function executeGitHubTool(fn) {
     return buildToolErrorResult(error);
   }
 }
-async function createGitHubToolOctokit(ctx) {
-  const token = (await resolveGithubToken(ctx)).trim();
+async function createGitHubToolOctokit(ctx, companyId) {
+  const token = (await resolveGithubToken(ctx, { companyId })).trim();
   if (!token) {
     throw new Error(MISSING_GITHUB_TOKEN_SYNC_MESSAGE);
   }
@@ -6888,6 +7148,7 @@ async function listAllGitHubIssueComments(octokit, repository, issueNumber) {
         body: typeof comment.body === "string" ? stripNullBytes(comment.body) : "",
         url: comment.html_url ?? void 0,
         authorLogin: normalizeGitHubUserLogin(comment.user?.login),
+        ...normalizeGitHubLowercaseString(comment.author_association) ? { authorAssociation: normalizeGitHubLowercaseString(comment.author_association) } : {},
         authorUrl: comment.user?.html_url ?? void 0,
         authorAvatarUrl: comment.user?.avatar_url ?? void 0,
         createdAt: comment.created_at ?? void 0,
@@ -7770,7 +8031,7 @@ async function getOrLoadCachedProjectPullRequestMetricsEntry(ctx, scope, octokit
     return inFlightMetrics;
   }
   const loadMetricsPromise = (async () => {
-    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx);
+    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx, scope.companyId);
     const metrics = await listProjectPullRequestMetrics(resolvedOctokit, scope);
     return cacheProjectPullRequestMetricsEntry(scope, metrics);
   })();
@@ -7808,7 +8069,7 @@ async function getOrLoadCachedProjectPullRequestCount(ctx, scope, octokit) {
     return inFlightCount;
   }
   const loadCountPromise = (async () => {
-    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx);
+    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx, scope.companyId);
     const totalOpenPullRequests = await listProjectPullRequestCount(resolvedOctokit, scope);
     return setCacheValue(
       activeProjectPullRequestCountCache,
@@ -7920,7 +8181,7 @@ async function getOrLoadProjectPullRequestSummaryRecordsForNumbers(ctx, scope, p
   }
   const missingPullRequestNumbers = normalizedPullRequestNumbers.filter((pullRequestNumber) => !recordsByNumber.has(pullRequestNumber));
   if (missingPullRequestNumbers.length > 0) {
-    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx);
+    const resolvedOctokit = octokit ?? await createGitHubToolOctokit(ctx, scope.companyId);
     const loadedRecords = await listProjectPullRequestSummaryRecordsByNumbers(
       ctx,
       resolvedOctokit,
@@ -8030,7 +8291,7 @@ async function buildProjectPullRequestsPageData(ctx, input) {
   }
   const scope = await requireProjectPullRequestScope(ctx, input, projectMappings);
   const config = await getResolvedConfig(ctx);
-  if (!hasConfiguredGithubToken(settings, config)) {
+  if (!hasConfiguredGithubToken(settings, config, scope.companyId)) {
     return {
       status: "missing_token",
       projectId,
@@ -8049,7 +8310,7 @@ async function buildProjectPullRequestsPageData(ctx, input) {
     };
   }
   try {
-    const octokit = await createGitHubToolOctokit(ctx);
+    const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
     const pageCacheKey = buildProjectPullRequestPageCacheKey(scope, filter, pageIndex, cursor);
     const cachedPage = getFreshCacheValue(activeProjectPullRequestPageCache, pageCacheKey);
     if (cachedPage) {
@@ -8221,7 +8482,7 @@ async function buildProjectPullRequestMetricsData(ctx, input) {
     };
   }
   const config = await getResolvedConfig(ctx);
-  if (!hasConfiguredGithubToken(settings, config)) {
+  if (!hasConfiguredGithubToken(settings, config, companyId)) {
     return {
       status: "missing_token",
       projectId,
@@ -8270,7 +8531,7 @@ async function buildProjectPullRequestCountData(ctx, input) {
     };
   }
   const config = await getResolvedConfig(ctx);
-  if (!hasConfiguredGithubToken(settings, config)) {
+  if (!hasConfiguredGithubToken(settings, config, companyId)) {
     return {
       status: "missing_token",
       projectId,
@@ -8307,7 +8568,7 @@ async function buildSettingsTokenPermissionAuditData(ctx, input) {
   }
   const settings = normalizeSettings(await ctx.state.get(SETTINGS_SCOPE));
   const config = await getResolvedConfig(ctx);
-  if (!hasConfiguredGithubToken(settings, config)) {
+  if (!hasConfiguredGithubToken(settings, config, requestedCompanyId)) {
     return {
       status: "missing_token",
       allRequiredPermissionsGranted: false,
@@ -8328,7 +8589,7 @@ async function buildSettingsTokenPermissionAuditData(ctx, input) {
     };
   }
   try {
-    const octokit = await createGitHubToolOctokit(ctx);
+    const octokit = await createGitHubToolOctokit(ctx, requestedCompanyId);
     const repositories = await Promise.all(
       [
         ...new Map(
@@ -8397,7 +8658,7 @@ async function buildProjectPullRequestDetailData(ctx, input) {
     buildProjectPullRequestSummaryRecordCacheKey(scope, pullRequestNumber)
   );
   const cachedLinkedIssue = cachedSummaryRecord ? getLinkedPaperclipIssueFromProjectPullRequestRecord(cachedSummaryRecord) : void 0;
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const response = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8528,7 +8789,7 @@ async function createProjectPullRequestPaperclipIssue(ctx, input) {
     throw new Error("This Paperclip runtime does not expose plugin issue creation yet.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const pullRequestResponse = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8602,7 +8863,7 @@ async function updateProjectPullRequestBranch(ctx, input) {
     throw new Error("pullRequestNumber is required.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const pullRequestResponse = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8665,7 +8926,7 @@ async function mergeProjectPullRequest(ctx, input) {
     throw new Error("pullRequestNumber is required.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const response = await octokit.rest.pulls.merge({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8689,7 +8950,7 @@ async function closeProjectPullRequest(ctx, input) {
     throw new Error("pullRequestNumber is required.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const response = await octokit.rest.pulls.update({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8718,7 +8979,7 @@ async function addProjectPullRequestComment(ctx, input) {
     throw new Error("Comment body cannot be empty.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const response = await createProjectPullRequestGitHubComment(octokit, scope, pullRequestNumber, body);
   invalidateProjectPullRequestCaches(scope);
   return {
@@ -8775,7 +9036,7 @@ async function requestProjectPullRequestCopilotAction(ctx, input) {
     throw new Error('action must be one of "fix_ci", "rebase", "address_review_feedback", or "review".');
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const pullRequestResponse = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -8889,7 +9150,7 @@ async function reviewProjectPullRequest(ctx, input) {
   }
   const body = typeof input.body === "string" ? input.body.trim() : "";
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   let response;
   try {
     response = await octokit.rest.pulls.createReview({
@@ -8936,7 +9197,7 @@ async function rerunProjectPullRequestCi(ctx, input) {
     throw new Error("pullRequestNumber is required.");
   }
   const scope = await requireProjectPullRequestScope(ctx, input);
-  const octokit = await createGitHubToolOctokit(ctx);
+  const octokit = await createGitHubToolOctokit(ctx, scope.companyId);
   const pullRequestResponse = await octokit.rest.pulls.get({
     owner: scope.repository.owner,
     repo: scope.repository.repo,
@@ -9122,12 +9383,25 @@ function shouldRunScheduledSync(settings, scheduledAt) {
   }
   return now - lastCheckedAt >= settings.scheduleFrequencyMinutes * 6e4;
 }
+function listScheduledSyncTargets(settings) {
+  const companyIds = [
+    ...new Set(
+      settings.mappings.map((mapping) => normalizeCompanyId(mapping.companyId)).filter((companyId) => Boolean(companyId))
+    )
+  ];
+  if (companyIds.length === 0) {
+    return settings.mappings.length > 0 ? [void 0] : [];
+  }
+  return companyIds.map((companyId) => getScopedSyncTarget(companyId));
+}
 async function performSync(ctx, trigger, options = {}) {
-  const settings = normalizeSettings(await ctx.state.get(SETTINGS_SCOPE));
+  const targetCompanyId = normalizeCompanyId(options.target?.companyId);
+  const baseSettings = normalizeSettings(await ctx.state.get(SETTINGS_SCOPE));
   const config = await getResolvedConfig(ctx);
+  const settings = materializeScopedSettings(baseSettings, config, targetCompanyId);
   const importRegistry = normalizeImportRegistry(await ctx.state.get(IMPORT_REGISTRY_SCOPE));
-  const token = typeof options.resolvedToken === "string" ? options.resolvedToken : await resolveGithubToken(ctx);
-  const paperclipApiBaseUrl = getConfiguredPaperclipApiBaseUrl(settings, config);
+  const token = typeof options.resolvedToken === "string" ? options.resolvedToken : await resolveGithubToken(ctx, { companyId: targetCompanyId });
+  const paperclipApiBaseUrl = getConfiguredPaperclipApiBaseUrl(baseSettings, config, targetCompanyId);
   const mappings = getSyncableMappingsForTarget(settings.mappings, options.target);
   activePaperclipApiAuthTokensByCompanyId = null;
   const failureContext = {
@@ -9138,18 +9412,14 @@ async function performSync(ctx, trigger, options = {}) {
       ...settings,
       syncState: createSetupConfigurationErrorSyncState("missing_token", trigger)
     };
-    await ctx.state.set(SETTINGS_SCOPE, next);
-    await ctx.state.set(SYNC_STATE_SCOPE, next.syncState);
-    return next;
+    return saveSettingsSyncState(ctx, settings, next.syncState, targetCompanyId);
   }
   if (mappings.length === 0) {
     const next = {
       ...settings,
       syncState: createSetupConfigurationErrorSyncState("missing_mapping", trigger)
     };
-    await ctx.state.set(SETTINGS_SCOPE, next);
-    await ctx.state.set(SYNC_STATE_SCOPE, next.syncState);
-    return next;
+    return saveSettingsSyncState(ctx, settings, next.syncState, targetCompanyId);
   }
   const mappingsMissingBoardAccess = getMappingsMissingPaperclipBoardAccess(settings, config, mappings);
   if (mappingsMissingBoardAccess.length > 0 && await detectPaperclipBoardAccessRequirement(paperclipApiBaseUrl)) {
@@ -9157,9 +9427,7 @@ async function performSync(ctx, trigger, options = {}) {
       ...settings,
       syncState: createSetupConfigurationErrorSyncState("missing_board_access", trigger)
     };
-    await ctx.state.set(SETTINGS_SCOPE, next);
-    await ctx.state.set(SYNC_STATE_SCOPE, next.syncState);
-    return next;
+    return saveSettingsSyncState(ctx, settings, next.syncState, targetCompanyId);
   }
   if (!ctx.issues || typeof ctx.issues.create !== "function") {
     const errorDetails = {
@@ -9185,9 +9453,7 @@ async function performSync(ctx, trigger, options = {}) {
         )
       })
     };
-    await ctx.state.set(SETTINGS_SCOPE, next);
-    await ctx.state.set(SYNC_STATE_SCOPE, next.syncState);
-    return next;
+    return saveSettingsSyncState(ctx, settings, next.syncState, targetCompanyId);
   }
   activePaperclipApiAuthTokensByCompanyId = await resolvePaperclipApiAuthTokens(ctx, settings, config, mappings);
   const octokit = new Octokit({ auth: token });
@@ -9255,7 +9521,8 @@ async function performSync(ctx, trigger, options = {}) {
         erroredIssuesCount: recoverableFailures.length,
         progress,
         recentFailures
-      })
+      }),
+      targetCompanyId
     );
     activeRunningSyncState = currentSettings;
     lastProgressPersistedAt = now;
@@ -9592,10 +9859,9 @@ async function performSync(ctx, trigger, options = {}) {
           recentFailures: buildRecentSyncFailureLogEntries(recoverableFailures)
         })
       };
-      await ctx.state.set(SETTINGS_SCOPE, next2);
-      await ctx.state.set(SYNC_STATE_SCOPE, next2.syncState);
+      await saveSettingsSyncState(ctx, currentSettings, next2.syncState, targetCompanyId);
       await ctx.state.set(IMPORT_REGISTRY_SCOPE, nextRegistry);
-      return next2;
+      return materializeScopedSettings(next2, config, targetCompanyId);
     }
     const next = {
       ...currentSettings,
@@ -9651,10 +9917,9 @@ async function performSync(ctx, trigger, options = {}) {
         )
       })
     };
-    await ctx.state.set(SETTINGS_SCOPE, next);
-    await ctx.state.set(SYNC_STATE_SCOPE, next.syncState);
+    await saveSettingsSyncState(ctx, currentSettings, next.syncState, targetCompanyId);
     await ctx.state.set(IMPORT_REGISTRY_SCOPE, nextRegistry);
-    return next;
+    return materializeScopedSettings(next, config, targetCompanyId);
   }
 }
 async function startSync(ctx, trigger, options = {}) {
@@ -9672,26 +9937,32 @@ async function startSync(ctx, trigger, options = {}) {
     getResolvedConfig(ctx),
     ctx.state.get(SETTINGS_SCOPE).then((value) => normalizeSettings(value))
   ]);
+  const targetCompanyId = normalizeCompanyId(options.target?.companyId);
   const token = await resolveGithubToken(ctx, {
+    companyId: targetCompanyId,
     config,
     settings: persistedSettings
   }).catch(() => "");
-  let currentSettings = sanitizeSettingsForCurrentSetup(persistedSettings, {
+  let currentSettings = sanitizeSettingsForCurrentSetup(materializeScopedSettings(persistedSettings, config, targetCompanyId), {
     hasToken: Boolean(token.trim()),
-    hasMappings: getSyncableMappings(persistedSettings.mappings).length > 0
+    hasMappings: getSyncableMappingsForScope(persistedSettings.mappings, targetCompanyId).length > 0
   });
-  const nextPaperclipApiBaseUrl = trigger === "manual" ? resolveTrustedPaperclipApiBaseUrlInput(options.paperclipApiBaseUrl, currentSettings, config) : getConfiguredPaperclipApiBaseUrl(currentSettings, config);
+  const nextPaperclipApiBaseUrl = trigger === "manual" ? resolveTrustedPaperclipApiBaseUrlInput(options.paperclipApiBaseUrl, persistedSettings, config, targetCompanyId) : getConfiguredPaperclipApiBaseUrl(persistedSettings, config, targetCompanyId);
   if (nextPaperclipApiBaseUrl !== currentSettings.paperclipApiBaseUrl) {
-    currentSettings = {
-      ...currentSettings,
-      ...nextPaperclipApiBaseUrl ? { paperclipApiBaseUrl: nextPaperclipApiBaseUrl } : {},
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    await ctx.state.set(SETTINGS_SCOPE, currentSettings);
+    const nextPersistedSettings = upsertScopedPaperclipApiBaseUrl(
+      {
+        ...persistedSettings,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      nextPaperclipApiBaseUrl,
+      targetCompanyId
+    );
+    await ctx.state.set(SETTINGS_SCOPE, nextPersistedSettings);
     await ctx.state.set(SYNC_STATE_SCOPE, currentSettings.syncState);
+    currentSettings = materializeScopedSettings(nextPersistedSettings, config, targetCompanyId);
   }
-  if (currentSettings !== persistedSettings) {
-    await saveSettingsSyncState(ctx, currentSettings, currentSettings.syncState);
+  if (JSON.stringify(currentSettings.syncState) !== JSON.stringify(getScopedSyncState(persistedSettings, targetCompanyId))) {
+    await saveSettingsSyncState(ctx, persistedSettings, currentSettings.syncState, targetCompanyId);
   }
   if (getActiveGitHubRateLimitPause(currentSettings.syncState)) {
     return currentSettings;
@@ -9720,7 +9991,8 @@ async function startSync(ctx, trigger, options = {}) {
       ...currentSettings,
       syncState
     };
-    return saveSettingsSyncState(ctx, currentSettings, syncState);
+    activeRunningSyncCompanyId = targetCompanyId;
+    return saveSettingsSyncState(ctx, currentSettings, syncState, targetCompanyId);
   })();
   activeSyncPromise = (async () => {
     try {
@@ -9730,11 +10002,12 @@ async function startSync(ctx, trigger, options = {}) {
         target: options.target
       });
     } catch (error) {
-      return await createUnexpectedSyncErrorResult(ctx, trigger, error);
+      return await createUnexpectedSyncErrorResult(ctx, trigger, error, targetCompanyId);
     } finally {
       await setSyncCancellationRequest(ctx, null);
       activePaperclipApiAuthTokensByCompanyId = null;
       activeRunningSyncState = null;
+      activeRunningSyncCompanyId = void 0;
       activeSyncPromise = null;
     }
   })();
@@ -9763,7 +10036,7 @@ function registerGitHubAgentTools(ctx) {
     getGitHubAgentToolDeclaration("search_repository_items"),
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const repository = await resolveGitHubToolRepository(ctx, runCtx, input);
       const rawQuery = normalizeOptionalToolString(input.query);
       if (!rawQuery) {
@@ -9832,7 +10105,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.rest.issues.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -9879,7 +10152,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const comments = await listAllGitHubIssueComments(octokit, target.repository, target.issueNumber);
       return buildToolSuccessResult(
         `Loaded ${comments.length} GitHub ${comments.length === 1 ? "comment" : "comments"} from issue #${target.issueNumber}.`,
@@ -9897,7 +10170,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const currentResponse = await octokit.rest.issues.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -9969,7 +10242,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const body = appendAiAuthorshipFooter(String(input.body ?? ""), normalizeOptionalToolString(input.llmModel) ?? "");
       const response = await octokit.rest.issues.createComment({
         owner: target.repository.owner,
@@ -10008,7 +10281,7 @@ function registerGitHubAgentTools(ctx) {
       if (!head || !base || !title) {
         throw new Error("head, base, and title are required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.rest.pulls.create({
         owner: repository.owner,
         repo: repository.repo,
@@ -10045,7 +10318,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.rest.pulls.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -10093,7 +10366,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       let currentResponse = await octokit.rest.pulls.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -10158,7 +10431,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const files = await listAllPullRequestFiles(octokit, target.repository, target.pullRequestNumber);
       return buildToolSuccessResult(
         `Loaded ${files.length} changed ${files.length === 1 ? "file" : "files"} from pull request #${target.pullRequestNumber}.`,
@@ -10176,7 +10449,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const pullRequestResponse = await octokit.rest.pulls.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -10274,7 +10547,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const threads = await listDetailedPullRequestReviewThreads(octokit, target.repository, target.pullRequestNumber);
       return buildToolSuccessResult(
         `Loaded ${threads.length} review ${threads.length === 1 ? "thread" : "threads"} from pull request #${target.pullRequestNumber}.`,
@@ -10289,14 +10562,14 @@ function registerGitHubAgentTools(ctx) {
   ctx.tools.register(
     "reply_to_review_thread",
     getGitHubAgentToolDeclaration("reply_to_review_thread"),
-    async (params) => executeGitHubTool(async () => {
+    async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const threadId = normalizeOptionalToolString(input.threadId);
       if (!threadId) {
         throw new Error("threadId is required.");
       }
       const body = appendAiAuthorshipFooter(String(input.body ?? ""), normalizeOptionalToolString(input.llmModel) ?? "");
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.graphql(
         GITHUB_ADD_PULL_REQUEST_REVIEW_THREAD_REPLY_MUTATION,
         {
@@ -10325,13 +10598,13 @@ function registerGitHubAgentTools(ctx) {
   ctx.tools.register(
     "resolve_review_thread",
     getGitHubAgentToolDeclaration("resolve_review_thread"),
-    async (params) => executeGitHubTool(async () => {
+    async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const threadId = normalizeOptionalToolString(input.threadId);
       if (!threadId) {
         throw new Error("threadId is required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.graphql(
         GITHUB_RESOLVE_REVIEW_THREAD_MUTATION,
         {
@@ -10356,13 +10629,13 @@ function registerGitHubAgentTools(ctx) {
   ctx.tools.register(
     "unresolve_review_thread",
     getGitHubAgentToolDeclaration("unresolve_review_thread"),
-    async (params) => executeGitHubTool(async () => {
+    async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const threadId = normalizeOptionalToolString(input.threadId);
       if (!threadId) {
         throw new Error("threadId is required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.graphql(
         GITHUB_UNRESOLVE_REVIEW_THREAD_MUTATION,
         {
@@ -10395,7 +10668,7 @@ function registerGitHubAgentTools(ctx) {
       if (userReviewers.length === 0 && teamReviewers.length === 0) {
         throw new Error("Provide at least one user reviewer or team reviewer.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const response = await octokit.rest.pulls.requestReviewers({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -10420,13 +10693,13 @@ function registerGitHubAgentTools(ctx) {
   ctx.tools.register(
     "list_organization_projects",
     getGitHubAgentToolDeclaration("list_organization_projects"),
-    async (params) => executeGitHubTool(async () => {
+    async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const organization = normalizeOptionalToolString(input.organization);
       if (!organization) {
         throw new Error("organization is required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const projects = await listGitHubOrganizationProjects(octokit, organization, {
         includeClosed: input.includeClosed === true,
         query: normalizeOptionalToolString(input.query),
@@ -10447,7 +10720,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx);
+      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const projectTarget = await resolveGitHubProjectToolTarget(octokit, input);
       const pullRequest = await getGitHubPullRequestProjectItems(
         octokit,
@@ -10524,22 +10797,18 @@ var plugin = definePlugin({
       const importRegistry = normalizeImportRegistry(await ctx.state.get(IMPORT_REGISTRY_SCOPE));
       const normalizedSettings = normalizeSettings(saved);
       const config = await getResolvedConfig(ctx);
-      const githubTokenRef = getConfiguredGithubTokenRef(normalizedSettings, config);
-      const paperclipApiBaseUrl = getConfiguredPaperclipApiBaseUrl(normalizedSettings, config);
-      const githubTokenConfigured = hasConfiguredGithubToken(normalizedSettings, config);
+      const githubTokenConfigured = hasConfiguredGithubToken(normalizedSettings, config, requestedCompanyId);
       const configuredBoardTokenRef = getConfiguredPaperclipBoardApiTokenRef(config, requestedCompanyId);
       const savedBoardTokenRef = getSavedPaperclipBoardApiTokenRef(normalizedSettings, requestedCompanyId);
-      const settingsWithResolvedToken = githubTokenRef === normalizedSettings.githubTokenRef && paperclipApiBaseUrl === normalizedSettings.paperclipApiBaseUrl ? normalizedSettings : {
-        ...normalizedSettings,
-        ...githubTokenRef ? { githubTokenRef } : {},
-        ...paperclipApiBaseUrl ? { paperclipApiBaseUrl } : {}
-      };
-      const settingsForResponse = sanitizeSettingsForCurrentSetup(settingsWithResolvedToken, {
-        hasToken: githubTokenConfigured,
-        hasMappings: getSyncableMappings(settingsWithResolvedToken.mappings).length > 0
-      });
-      if (settingsForResponse !== normalizedSettings) {
-        await saveSettingsSyncState(ctx, settingsForResponse, settingsForResponse.syncState);
+      const settingsForResponse = sanitizeSettingsForCurrentSetup(
+        materializeScopedSettings(normalizedSettings, config, requestedCompanyId),
+        {
+          hasToken: githubTokenConfigured,
+          hasMappings: getSyncableMappingsForScope(normalizedSettings.mappings, requestedCompanyId).length > 0
+        }
+      );
+      if (JSON.stringify(settingsForResponse.syncState) !== JSON.stringify(getScopedSyncState(normalizedSettings, requestedCompanyId))) {
+        await saveSettingsSyncState(ctx, normalizedSettings, settingsForResponse.syncState, requestedCompanyId);
       }
       const scopedMappings = filterMappingsByCompany(settingsForResponse.mappings, requestedCompanyId);
       const availableAssignees = includeAssignees && requestedCompanyId ? await listAvailableAssignees(ctx, requestedCompanyId) : [];
@@ -10598,10 +10867,34 @@ var plugin = definePlugin({
       const config = await getResolvedConfig(ctx);
       const record = input && typeof input === "object" ? input : {};
       const requestedCompanyId = normalizeCompanyId(record.companyId);
+      const requestedGitHubTokenLogin = "githubTokenLogin" in record ? normalizeOptionalString2(record.githubTokenLogin) : void 0;
       const hasMappingsPatch = "mappings" in record;
       const hasAdvancedSettingsPatch = "advancedSettings" in record;
-      const githubTokenRef = "githubTokenRef" in record ? normalizeGitHubTokenRef(record.githubTokenRef) : normalizeGitHubTokenRef(previous.githubTokenRef) ?? normalizeGitHubTokenRef(config.githubTokenRef);
-      const githubTokenLogin = "githubTokenLogin" in record ? normalizeOptionalString2(record.githubTokenLogin) : previous.githubTokenLogin;
+      const previousScopedSettings = materializeScopedSettings(previous, config, requestedCompanyId);
+      const nextGitHubTokenRefs = {
+        ...previous.githubTokenRefs ?? {}
+      };
+      if (requestedCompanyId) {
+        const companyScopedGitHubTokenRef = normalizeGitHubTokenRefs(record.githubTokenRefs)?.[requestedCompanyId] ?? ("githubTokenRef" in record ? normalizeGitHubTokenRef(record.githubTokenRef) : void 0);
+        if (companyScopedGitHubTokenRef) {
+          nextGitHubTokenRefs[requestedCompanyId] = companyScopedGitHubTokenRef;
+        }
+      }
+      const githubTokenRefs = Object.keys(nextGitHubTokenRefs).length > 0 ? nextGitHubTokenRefs : void 0;
+      const githubTokenRef = !requestedCompanyId && "githubTokenRef" in record ? normalizeGitHubTokenRef(record.githubTokenRef) : normalizeGitHubTokenRef(previous.githubTokenRef) ?? normalizeGitHubTokenRef(config.githubTokenRef);
+      const nextGitHubTokenLoginByCompanyId = {
+        ...previous.githubTokenLoginByCompanyId ?? {}
+      };
+      if (requestedCompanyId && "githubTokenLogin" in record) {
+        const companyScopedGitHubTokenLogin = requestedGitHubTokenLogin;
+        if (companyScopedGitHubTokenLogin) {
+          nextGitHubTokenLoginByCompanyId[requestedCompanyId] = companyScopedGitHubTokenLogin;
+        } else {
+          delete nextGitHubTokenLoginByCompanyId[requestedCompanyId];
+        }
+      }
+      const githubTokenLoginByCompanyId = Object.keys(nextGitHubTokenLoginByCompanyId).length > 0 ? nextGitHubTokenLoginByCompanyId : void 0;
+      const githubTokenLogin = !requestedCompanyId && "githubTokenLogin" in record ? requestedGitHubTokenLogin : previous.githubTokenLogin;
       const inputMappings = hasMappingsPatch ? normalizeMappings(record.mappings) : previous.mappings;
       const nextCompanyAdvancedSettingsByCompanyId = {
         ...previous.companyAdvancedSettingsByCompanyId ?? {}
@@ -10616,17 +10909,26 @@ var plugin = definePlugin({
           companyId: requestedCompanyId
         }))
       ] : inputMappings;
-      const current = normalizeSettings({
+      let current = normalizeSettings({
         mappings: mergedMappings,
         syncState: previous.syncState,
-        scheduleFrequencyMinutes: "scheduleFrequencyMinutes" in record ? record.scheduleFrequencyMinutes : previous.scheduleFrequencyMinutes,
-        paperclipApiBaseUrl: "paperclipApiBaseUrl" in record ? resolveTrustedPaperclipApiBaseUrlInput(record.paperclipApiBaseUrl, previous, config) : getConfiguredPaperclipApiBaseUrl(previous, config),
+        ...previous.syncStateByCompanyId ? { syncStateByCompanyId: previous.syncStateByCompanyId } : {},
+        scheduleFrequencyMinutes: previous.scheduleFrequencyMinutes,
+        ...previous.scheduleFrequencyMinutesByCompanyId ? { scheduleFrequencyMinutesByCompanyId: previous.scheduleFrequencyMinutesByCompanyId } : {},
+        ...previous.paperclipApiBaseUrl ? { paperclipApiBaseUrl: previous.paperclipApiBaseUrl } : {},
+        ...previous.paperclipApiBaseUrlByCompanyId ? { paperclipApiBaseUrlByCompanyId: previous.paperclipApiBaseUrlByCompanyId } : {},
+        ...githubTokenRefs ? { githubTokenRefs } : {},
+        ...githubTokenLoginByCompanyId ? { githubTokenLoginByCompanyId } : {},
         ...githubTokenLogin ? { githubTokenLogin } : {},
         paperclipBoardApiTokenRefs: previous.paperclipBoardApiTokenRefs,
         paperclipBoardAccessIdentityByCompanyId: previous.paperclipBoardAccessIdentityByCompanyId,
         ...Object.keys(nextCompanyAdvancedSettingsByCompanyId).length > 0 ? { companyAdvancedSettingsByCompanyId: nextCompanyAdvancedSettingsByCompanyId } : {},
         ...githubTokenRef ? { githubTokenRef } : {}
       });
+      const nextScheduleFrequencyMinutes = "scheduleFrequencyMinutes" in record ? normalizeScheduleFrequencyMinutes(record.scheduleFrequencyMinutes) : getScopedScheduleFrequencyMinutes(previous, requestedCompanyId);
+      current = upsertScopedScheduleFrequencyMinutes(current, nextScheduleFrequencyMinutes, requestedCompanyId);
+      const nextPaperclipApiBaseUrl = "paperclipApiBaseUrl" in record ? resolveTrustedPaperclipApiBaseUrlInput(record.paperclipApiBaseUrl, previous, config, requestedCompanyId) : getConfiguredPaperclipApiBaseUrl(previous, config, requestedCompanyId);
+      current = upsertScopedPaperclipApiBaseUrl(current, nextPaperclipApiBaseUrl, requestedCompanyId);
       const nextMappings = current.mappings.map((mapping, index) => ({
         id: mapping.id.trim() || createMappingId(index),
         repositoryUrl: parseRepositoryReference(mapping.repositoryUrl)?.url ?? mapping.repositoryUrl.trim(),
@@ -10634,11 +10936,15 @@ var plugin = definePlugin({
         paperclipProjectId: mapping.paperclipProjectId,
         companyId: mapping.companyId
       }));
+      const materializedCurrent = materializeScopedSettings(current, config, requestedCompanyId);
       const next = sanitizeSettingsForCurrentSetup({
+        ...current,
         mappings: nextMappings,
-        syncState: previous.syncState,
-        scheduleFrequencyMinutes: current.scheduleFrequencyMinutes,
-        ...current.paperclipApiBaseUrl ? { paperclipApiBaseUrl: current.paperclipApiBaseUrl } : {},
+        syncState: materializedCurrent.syncState,
+        scheduleFrequencyMinutes: materializedCurrent.scheduleFrequencyMinutes,
+        ...materializedCurrent.paperclipApiBaseUrl ? { paperclipApiBaseUrl: materializedCurrent.paperclipApiBaseUrl } : {},
+        ...current.githubTokenRefs ? { githubTokenRefs: current.githubTokenRefs } : {},
+        ...current.githubTokenLoginByCompanyId ? { githubTokenLoginByCompanyId: current.githubTokenLoginByCompanyId } : {},
         ...current.githubTokenLogin ? { githubTokenLogin: current.githubTokenLogin } : {},
         ...current.paperclipBoardApiTokenRefs ? { paperclipBoardApiTokenRefs: current.paperclipBoardApiTokenRefs } : {},
         ...current.paperclipBoardAccessIdentityByCompanyId ? { paperclipBoardAccessIdentityByCompanyId: current.paperclipBoardAccessIdentityByCompanyId } : {},
@@ -10646,14 +10952,16 @@ var plugin = definePlugin({
         ...githubTokenRef ? { githubTokenRef } : {},
         updatedAt: (/* @__PURE__ */ new Date()).toISOString()
       }, {
-        hasToken: hasConfiguredGithubToken({ githubTokenRef }, config),
-        hasMappings: getSyncableMappings(nextMappings).length > 0
+        hasToken: hasConfiguredGithubToken(current, config, requestedCompanyId),
+        hasMappings: getSyncableMappingsForScope(nextMappings, requestedCompanyId).length > 0
       });
       await ctx.state.set(SETTINGS_SCOPE, next);
       await ctx.state.set(SYNC_STATE_SCOPE, next.syncState);
       clearGitHubRepositoryTokenCapabilityAudits();
+      const scopedGitHubTokenLogin = (requestedCompanyId && "githubTokenLogin" in record ? requestedGitHubTokenLogin : void 0) ?? getGitHubTokenLogin(next, requestedCompanyId);
       return {
         ...getPublicSettingsForScope(next, requestedCompanyId),
+        ...scopedGitHubTokenLogin ? { githubTokenLogin: scopedGitHubTokenLogin } : {},
         availableAssignees: requestedCompanyId ? await listAvailableAssignees(ctx, requestedCompanyId) : []
       };
     });
@@ -10691,15 +10999,16 @@ var plugin = definePlugin({
         paperclipBoardAccessIdentityByCompanyId: _previousPaperclipBoardAccessIdentityByCompanyId,
         ...previousWithoutBoardAccess
       } = previous;
-      const next = sanitizeSettingsForCurrentSetup({
+      const nextBase = sanitizeSettingsForCurrentSetup({
         ...previousWithoutBoardAccess,
         ...Object.keys(nextPaperclipBoardApiTokenRefs).length > 0 ? { paperclipBoardApiTokenRefs: nextPaperclipBoardApiTokenRefs } : {},
         ...Object.keys(nextPaperclipBoardAccessIdentityByCompanyId).length > 0 ? { paperclipBoardAccessIdentityByCompanyId: nextPaperclipBoardAccessIdentityByCompanyId } : {},
         updatedAt: (/* @__PURE__ */ new Date()).toISOString()
       }, {
-        hasToken: hasConfiguredGithubToken(previous, config),
-        hasMappings: getSyncableMappings(previous.mappings).length > 0
+        hasToken: hasConfiguredGithubToken(previous, config, companyId),
+        hasMappings: getSyncableMappingsForScope(previous.mappings, companyId).length > 0
       });
+      const next = materializeScopedSettings(nextBase, config, companyId);
       await ctx.state.set(SETTINGS_SCOPE, next);
       await ctx.state.set(SYNC_STATE_SCOPE, next.syncState);
       return {
@@ -10770,7 +11079,7 @@ var plugin = definePlugin({
       });
     });
     ctx.actions.register("sync.cancel", async () => {
-      const currentSettings = await getActiveOrCurrentSyncState(ctx);
+      const currentSettings = await getActiveOrCurrentSyncState(ctx, activeRunningSyncCompanyId);
       if (currentSettings.syncState.status !== "running") {
         return currentSettings;
       }
@@ -10790,7 +11099,8 @@ var plugin = definePlugin({
           progress: currentSettings.syncState.progress,
           message: CANCELLING_SYNC_MESSAGE,
           cancelRequestedAt: cancellationRequest.requestedAt
-        })
+        }),
+        activeRunningSyncCompanyId
       );
       activeRunningSyncState = next;
       return next;
@@ -10798,10 +11108,22 @@ var plugin = definePlugin({
     registerGitHubAgentTools(ctx);
     ctx.jobs.register("sync.github-issues", async (job) => {
       const settings = normalizeSettings(await ctx.state.get(SETTINGS_SCOPE));
-      if (job.trigger === "schedule" && !shouldRunScheduledSync(settings, job.scheduledAt)) {
+      const trigger = job.trigger === "retry" ? "retry" : "schedule";
+      const scheduledTargets = listScheduledSyncTargets(settings);
+      if (scheduledTargets.length === 0) {
+        if (job.trigger === "schedule" && !shouldRunScheduledSync(settings, job.scheduledAt)) {
+          return;
+        }
+        await startSync(ctx, trigger);
         return;
       }
-      await startSync(ctx, job.trigger === "retry" ? "retry" : "schedule");
+      for (const target of scheduledTargets) {
+        const scopedSettings = materializeScopedSettings(settings, null, target?.companyId);
+        if (job.trigger === "schedule" && !shouldRunScheduledSync(scopedSettings, job.scheduledAt)) {
+          continue;
+        }
+        await startSync(ctx, trigger, target ? { target } : {});
+      }
     });
   }
 });