paperclip-github-plugin 0.8.12 → 0.9.1

package/dist/worker.js

@@ -1,9 +1,9 @@
 // src/worker.ts
 import { Buffer } from "node:buffer";
 import { realpathSync } from "node:fs";
-import { readFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Octokit } from "@octokit/rest";
 import {
@@ -1604,6 +1604,10 @@ function getErrorMessage(error) {
   }
   return String(error);
 }
+function isPluginSecretReferenceDisabledError(error) {
+  const message = getErrorMessage(error).toLowerCase();
+  return message.includes("plugin secret reference") && message.includes("disabled") || message.includes("company-scoped plugin config lands");
+}
 function getErrorCause(error) {
   if (!error || typeof error !== "object" || !("cause" in error)) {
     return void 0;
@@ -1974,6 +1978,20 @@ function normalizeGitHubTokenRefs(value) {
   }
   return Object.fromEntries(entries);
 }
+function normalizeGitHubTokensByCompanyId(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, token]) => {
+    const normalizedCompanyId = normalizeCompanyId(companyId);
+    const normalizedToken = normalizeGitHubToken(token);
+    return normalizedCompanyId && normalizedToken ? [normalizedCompanyId, normalizedToken] : null;
+  }).filter((entry) => entry !== null);
+  if (entries.length === 0) {
+    return void 0;
+  }
+  return Object.fromEntries(entries);
+}
 function formatUtcTimestamp(value) {
   const parsed = new Date(value);
   if (Number.isNaN(parsed.getTime())) {
@@ -3710,12 +3728,14 @@ function normalizeConfig(value) {
   const githubTokenRefs = normalizeGitHubTokenRefs(record.githubTokenRefs);
   const githubTokenRef = normalizeGitHubTokenRef(record.githubTokenRef);
   const githubToken = normalizeGitHubToken(record.githubToken);
+  const githubTokensByCompanyId = normalizeGitHubTokensByCompanyId(record.githubTokensByCompanyId);
   const paperclipBoardApiTokenRefs = normalizePaperclipBoardApiTokenRefs(record.paperclipBoardApiTokenRefs);
   const paperclipApiBaseUrl = normalizePaperclipApiBaseUrl(record.paperclipApiBaseUrl);
   return {
     ...githubTokenRefs ? { githubTokenRefs } : {},
     ...githubTokenRef ? { githubTokenRef } : {},
     ...githubToken ? { githubToken } : {},
+    ...githubTokensByCompanyId ? { githubTokensByCompanyId } : {},
     ...paperclipBoardApiTokenRefs ? { paperclipBoardApiTokenRefs } : {},
     ...paperclipApiBaseUrl ? { paperclipApiBaseUrl } : {}
   };
@@ -3791,6 +3811,55 @@ async function readExternalConfig(ctx) {
     return {};
   }
 }
+async function readExternalConfigRecordForWrite(ctx, filePath) {
+  try {
+    const rawConfig = await readFile(filePath, "utf8");
+    const parsedConfig = JSON.parse(rawConfig);
+    return parsedConfig && typeof parsedConfig === "object" && !Array.isArray(parsedConfig) ? { ...parsedConfig } : {};
+  } catch (error) {
+    const errorCode = error && typeof error === "object" && "code" in error ? error.code : void 0;
+    if (errorCode === "ENOENT") {
+      return {};
+    }
+    if (error instanceof SyntaxError) {
+      ctx.logger.warn("Ignoring the GitHub Sync worker-local token fallback config file because it is not valid JSON.", {
+        filePath,
+        error: error.message
+      });
+      return {};
+    }
+    throw error;
+  }
+}
+async function writeExternalCompanyGitHubTokenFallback(ctx, companyId, token) {
+  const externalConfigFilePath = getExternalConfigFilePath();
+  if (!externalConfigFilePath) {
+    throw new Error("Could not resolve a Paperclip home directory for the GitHub Sync fallback token config.");
+  }
+  const currentRecord = await readExternalConfigRecordForWrite(ctx, externalConfigFilePath);
+  const currentCompanyTokens = normalizeGitHubTokensByCompanyId(currentRecord.githubTokensByCompanyId) ?? {};
+  const nextRecord = {
+    ...currentRecord,
+    githubTokensByCompanyId: {
+      ...currentCompanyTokens,
+      [companyId]: token
+    }
+  };
+  await mkdir(dirname(externalConfigFilePath), { recursive: true });
+  await writeFile(externalConfigFilePath, `${JSON.stringify(nextRecord, null, 2)}
+`, {
+    encoding: "utf8",
+    mode: 384
+  });
+  try {
+    await chmod(externalConfigFilePath, 384);
+  } catch (error) {
+    ctx.logger.warn("GitHub Sync could not tighten permissions on the worker-local token fallback file.", {
+      filePath: externalConfigFilePath,
+      error: getErrorMessage(error)
+    });
+  }
+}
 function normalizePaperclipBoardApiTokenRefs(value) {
   if (!value || typeof value !== "object") {
     return void 0;
@@ -5681,9 +5750,19 @@ function buildPaperclipIssueStatusTransitionComment(params) {
   };
 }
 function buildPaperclipPullRequestIssueStatusTransitionComment(params) {
-  const reason = describeGitHubLinkedPullRequestsStatusReason([params.pullRequest]);
+  const reason = describeGitHubDirectPullRequestIssueStatusReason(params.pullRequests);
   return `GitHub Sync updated the status from \`${formatPaperclipIssueStatus(params.previousStatus)}\` to \`${formatPaperclipIssueStatus(params.nextStatus)}\` because ${reason}.`;
 }
+function describeGitHubDirectPullRequestIssueStatusReason(pullRequests) {
+  const openPullRequests = pullRequests.map((entry) => entry.pullRequest).filter((pullRequest) => Boolean(pullRequest));
+  if (openPullRequests.length > 0) {
+    return describeGitHubLinkedPullRequestsStatusReason(openPullRequests);
+  }
+  if (pullRequests.some((entry) => entry.lifecycleState === "merged")) {
+    return pullRequests.length === 1 ? "the linked pull request was merged" : "at least one linked pull request was merged";
+  }
+  return pullRequests.length === 1 ? "the linked pull request was closed without merge" : "all linked pull requests were closed without merge";
+}
 function resolvePaperclipIssueStatus(params) {
   const {
     currentStatus,
@@ -5736,6 +5815,23 @@ function resolvePaperclipPullRequestIssueStatus(params) {
     preserveTransientUnknownMergeabilityWait: currentStatus === "done" || currentStatus === "in_review"
   });
 }
+function resolvePaperclipDirectPullRequestIssueStatus(params) {
+  const { currentStatus, pullRequests, hasExecutorHandoffTarget } = params;
+  const openPullRequests = pullRequests.map((entry) => entry.pullRequest).filter((pullRequest) => Boolean(pullRequest));
+  if (openPullRequests.length > 0) {
+    if (shouldPreserveBlockedExternalPullRequestWait({
+      currentStatus,
+      linkedPullRequests: openPullRequests
+    })) {
+      return "blocked";
+    }
+    return resolvePaperclipStatusFromLinkedPullRequests(openPullRequests, {
+      preferInProgress: hasExecutorHandoffTarget,
+      preserveTransientUnknownMergeabilityWait: currentStatus === "done" || currentStatus === "in_review"
+    });
+  }
+  return pullRequests.some((entry) => entry.lifecycleState === "merged") ? "done" : "cancelled";
+}
 async function listLinkedPullRequestsForIssue(octokit, repository, issueNumber) {
   const linkedPullRequests = [];
   const seenPullRequestKeys = /* @__PURE__ */ new Set();
@@ -8975,6 +9071,16 @@ async function assignImportedPaperclipIssueToUser(ctx, params) {
     });
   }
 }
+async function ensurePaperclipIssueStandardWorkMode(ctx, issue, companyId) {
+  if (!("workMode" in issue) || issue.workMode === "standard") {
+    return issue;
+  }
+  return ctx.issues.update(
+    issue.id,
+    { workMode: "standard" },
+    companyId
+  );
+}
 async function createPaperclipIssue(ctx, mapping, advancedSettings, issue, availableLabels, paperclipApiBaseUrl, syncFailureContext) {
   if (!mapping.companyId || !mapping.paperclipProjectId) {
     throw new Error(`Mapping ${mapping.id} is missing resolved Paperclip project identifiers.`);
@@ -8982,15 +9088,20 @@ async function createPaperclipIssue(ctx, mapping, advancedSettings, issue, avail
   const title = issue.title;
   const description = buildPaperclipIssueDescription(issue);
   const defaultAssignee = getConfiguredAdvancedAssigneePrincipal(advancedSettings, "default");
-  const createdIssue = await ctx.issues.create({
-    companyId: mapping.companyId,
-    projectId: mapping.paperclipProjectId,
-    title,
-    ...description ? { description } : {},
-    originKind: GITHUB_ISSUE_ORIGIN_KIND,
-    originId: normalizeGitHubIssueHtmlUrl(issue.htmlUrl) ?? issue.htmlUrl,
-    ...defaultAssignee?.kind === "agent" ? { assigneeAgentId: defaultAssignee.id } : defaultAssignee?.kind === "user" ? { assigneeUserId: defaultAssignee.id } : {}
-  });
+  const createdIssue = await ensurePaperclipIssueStandardWorkMode(
+    ctx,
+    await ctx.issues.create({
+      companyId: mapping.companyId,
+      projectId: mapping.paperclipProjectId,
+      title,
+      ...description ? { description } : {},
+      status: advancedSettings.defaultStatus,
+      originKind: GITHUB_ISSUE_ORIGIN_KIND,
+      originId: normalizeGitHubIssueHtmlUrl(issue.htmlUrl) ?? issue.htmlUrl,
+      ...defaultAssignee?.kind === "agent" ? { assigneeAgentId: defaultAssignee.id } : defaultAssignee?.kind === "user" ? { assigneeUserId: defaultAssignee.id } : {}
+    }),
+    mapping.companyId
+  );
   const ensuredCreatedIssueId = createdIssue.id;
   const normalizedCreatedIssueDescription = createdIssue.description ?? void 0;
   const createPath = "sdk";
@@ -9708,6 +9819,18 @@ async function synchronizePaperclipIssueStatuses(ctx, octokit, repository, mappi
     updatedDescriptionsCount
   };
 }
+function groupGitHubPullRequestLinksByPaperclipIssue(pullRequestLinks) {
+  const groups = /* @__PURE__ */ new Map();
+  const sortedLinks = [...pullRequestLinks].sort(
+    (left, right) => left.paperclipIssueId.localeCompare(right.paperclipIssueId) || left.data.repositoryUrl.localeCompare(right.data.repositoryUrl) || left.data.githubPullRequestNumber - right.data.githubPullRequestNumber
+  );
+  for (const pullRequestLink of sortedLinks) {
+    const group = groups.get(pullRequestLink.paperclipIssueId) ?? [];
+    group.push(pullRequestLink);
+    groups.set(pullRequestLink.paperclipIssueId, group);
+  }
+  return groups;
+}
 async function synchronizePaperclipPullRequestIssueStatuses(ctx, octokit, mapping, advancedSettings, pullRequestLinks, paperclipApiBaseUrl, pullRequestStatusCache, syncFailureContext, failures, assertNotCancelled, onProgress) {
   if (!mapping.companyId || !ctx.issues || typeof ctx.issues.get !== "function" || typeof ctx.issues.update !== "function") {
     return {
@@ -9719,52 +9842,93 @@ async function synchronizePaperclipPullRequestIssueStatuses(ctx, octokit, mappin
   const mappingCompanyId = mapping.companyId;
   const mappingProjectId = mapping.paperclipProjectId;
   const totalIssueCount = pullRequestLinks.length;
+  const pullRequestLinkGroups = groupGitHubPullRequestLinksByPaperclipIssue(pullRequestLinks);
   const queuedIssueWakeups = [];
-  for (const pullRequestLink of pullRequestLinks) {
-    if (assertNotCancelled) {
-      await assertNotCancelled();
-    }
-    try {
-      const pullRequestRepository = requireRepositoryReference(pullRequestLink.data.repositoryUrl);
-      updateSyncFailureContext(syncFailureContext, {
-        phase: "evaluating_github_status",
-        repositoryUrl: pullRequestRepository.url,
-        githubIssueNumber: void 0
-      });
-      const pullRequestResponse = await octokit.rest.pulls.get({
-        owner: pullRequestRepository.owner,
-        repo: pullRequestRepository.repo,
-        pull_number: pullRequestLink.data.githubPullRequestNumber,
-        headers: {
-          "X-GitHub-Api-Version": GITHUB_API_VERSION
-        }
-      });
-      const livePullRequestState = getPullRequestApiState({
-        state: pullRequestResponse.data.state,
-        merged: pullRequestResponse.data.merged
-      }) === "open" ? "open" : "closed";
-      if (livePullRequestState !== pullRequestLink.data.githubPullRequestState || pullRequestResponse.data.html_url !== pullRequestLink.data.githubPullRequestUrl || pullRequestResponse.data.title !== pullRequestLink.data.title) {
-        await upsertGitHubPullRequestLinkRecord(ctx, {
-          companyId: pullRequestLink.data.companyId ?? mappingCompanyId,
-          projectId: pullRequestLink.data.paperclipProjectId ?? mappingProjectId,
-          issueId: pullRequestLink.paperclipIssueId,
+  for (const [paperclipIssueId, issuePullRequestLinks] of pullRequestLinkGroups.entries()) {
+    const pullRequestSnapshots = [];
+    let groupHadFailure = false;
+    for (const pullRequestLink of issuePullRequestLinks) {
+      if (assertNotCancelled) {
+        await assertNotCancelled();
+      }
+      try {
+        const pullRequestRepository = requireRepositoryReference(pullRequestLink.data.repositoryUrl);
+        updateSyncFailureContext(syncFailureContext, {
+          phase: "evaluating_github_status",
           repositoryUrl: pullRequestRepository.url,
-          pullRequestNumber: pullRequestLink.data.githubPullRequestNumber,
-          pullRequestUrl: pullRequestResponse.data.html_url ?? pullRequestLink.data.githubPullRequestUrl,
-          pullRequestTitle: pullRequestResponse.data.title || pullRequestLink.data.title || `Pull request #${pullRequestLink.data.githubPullRequestNumber}`,
-          pullRequestState: livePullRequestState
+          githubIssueNumber: void 0
+        });
+        const pullRequestResponse = await octokit.rest.pulls.get({
+          owner: pullRequestRepository.owner,
+          repo: pullRequestRepository.repo,
+          pull_number: pullRequestLink.data.githubPullRequestNumber,
+          headers: {
+            "X-GitHub-Api-Version": GITHUB_API_VERSION
+          }
         });
+        const livePullRequestLifecycleState = getPullRequestApiState({
+          state: pullRequestResponse.data.state,
+          merged: pullRequestResponse.data.merged
+        });
+        const livePullRequestLinkState = livePullRequestLifecycleState === "open" ? "open" : "closed";
+        if (livePullRequestLinkState !== pullRequestLink.data.githubPullRequestState || pullRequestResponse.data.html_url !== pullRequestLink.data.githubPullRequestUrl || pullRequestResponse.data.title !== pullRequestLink.data.title) {
+          await upsertGitHubPullRequestLinkRecord(ctx, {
+            companyId: pullRequestLink.data.companyId ?? mappingCompanyId,
+            projectId: pullRequestLink.data.paperclipProjectId ?? mappingProjectId,
+            issueId: pullRequestLink.paperclipIssueId,
+            repositoryUrl: pullRequestRepository.url,
+            pullRequestNumber: pullRequestLink.data.githubPullRequestNumber,
+            pullRequestUrl: pullRequestResponse.data.html_url ?? pullRequestLink.data.githubPullRequestUrl,
+            pullRequestTitle: pullRequestResponse.data.title || pullRequestLink.data.title || `Pull request #${pullRequestLink.data.githubPullRequestNumber}`,
+            pullRequestState: livePullRequestLinkState
+          });
+        }
+        if (livePullRequestLifecycleState === "open") {
+          const pullRequest = await getGitHubPullRequestStatusSnapshot(
+            octokit,
+            pullRequestRepository,
+            pullRequestLink.data.githubPullRequestNumber,
+            pullRequestStatusCache
+          );
+          pullRequestSnapshots.push({
+            pullRequestLink,
+            repository: pullRequestRepository,
+            lifecycleState: "open",
+            pullRequest
+          });
+        } else {
+          pullRequestSnapshots.push({
+            pullRequestLink,
+            repository: pullRequestRepository,
+            lifecycleState: livePullRequestLifecycleState
+          });
+        }
+      } catch (error) {
+        if (isGitHubRateLimitError(error)) {
+          throw error;
+        }
+        groupHadFailure = true;
+        recordRecoverableSyncFailure(ctx, failures, error, syncFailureContext);
+      } finally {
+        completedIssueCount += 1;
+        if (onProgress) {
+          await onProgress({
+            pullRequestLink,
+            completedIssueCount,
+            totalIssueCount
+          });
+        }
       }
-      if (livePullRequestState !== "open") {
-        continue;
+    }
+    if (groupHadFailure || pullRequestSnapshots.length === 0) {
+      continue;
+    }
+    const primaryRepository = pullRequestSnapshots[0]?.repository;
+    try {
+      if (assertNotCancelled) {
+        await assertNotCancelled();
       }
-      const pullRequest = await getGitHubPullRequestStatusSnapshot(
-        octokit,
-        pullRequestRepository,
-        pullRequestLink.data.githubPullRequestNumber,
-        pullRequestStatusCache
-      );
-      const paperclipIssue = await ctx.issues.get(pullRequestLink.paperclipIssueId, mapping.companyId);
+      const paperclipIssue = await ctx.issues.get(paperclipIssueId, mapping.companyId);
       if (!paperclipIssue) {
         continue;
       }
@@ -9773,12 +9937,12 @@ async function synchronizePaperclipPullRequestIssueStatuses(ctx, octokit, mappin
         paperclipIssueSyncContext,
         advancedSettings
       );
-      let nextStatus = resolvePaperclipPullRequestIssueStatus({
+      let nextStatus = resolvePaperclipDirectPullRequestIssueStatus({
         currentStatus: paperclipIssue.status,
-        pullRequest,
+        pullRequests: pullRequestSnapshots,
         hasExecutorHandoffTarget: Boolean(executorTransitionAssignee)
       });
-      if (paperclipIssue.status === "blocked" && nextStatus !== "blocked" && await hasUnresolvedPaperclipIssueBlocker(ctx, paperclipIssue, mapping.companyId)) {
+      if (paperclipIssue.status === "blocked" && nextStatus !== "blocked" && pullRequestSnapshots.some((entry) => entry.lifecycleState === "open") && await hasUnresolvedPaperclipIssueBlocker(ctx, paperclipIssue, mapping.companyId)) {
         nextStatus = "blocked";
       }
       const shouldPreserveMaintainerWaitRouting = isHealthyMaintainerWaitTransition({
@@ -9786,6 +9950,10 @@ async function synchronizePaperclipPullRequestIssueStatuses(ctx, octokit, mappin
         nextStatus,
         syncContext: paperclipIssueSyncContext
       });
+      const shouldClearCompletedExecutionPolicy = shouldClearCompletedSyncExecutionPolicy({
+        nextStatus,
+        syncContext: paperclipIssueSyncContext
+      });
       const nextTransitionAssignee = resolveSyncTransitionAssignee({
         currentStatus: paperclipIssue.status,
         nextStatus,
@@ -9796,20 +9964,20 @@ async function synchronizePaperclipPullRequestIssueStatuses(ctx, octokit, mappin
       const nextAssigneeChanged = nextTransitionAssignee ? !doesPaperclipIssueAssigneeMatch(paperclipIssueSyncContext.assignee, nextTransitionAssignee.principal) : false;
       const shouldWakeTransitionAssignee = paperclipIssue.status !== nextStatus && nextTransitionAssignee?.principal.kind === "agent" && isActionablePaperclipIssueStatus(nextStatus) && (nextAssigneeChanged || paperclipIssue.status !== nextStatus);
       if (paperclipIssue.status === nextStatus) {
-        if (shouldClearTransitionAssignee) {
+        if (shouldClearTransitionAssignee || shouldClearCompletedExecutionPolicy) {
           updateSyncFailureContext(syncFailureContext, {
             phase: "updating_paperclip_status",
-            repositoryUrl: pullRequestRepository.url,
+            repositoryUrl: primaryRepository?.url,
             githubIssueNumber: void 0
           });
           await updatePaperclipIssueState(ctx, {
             companyId: mapping.companyId,
-            issueId: pullRequestLink.paperclipIssueId,
+            issueId: paperclipIssueId,
             currentStatus: paperclipIssue.status,
             syncContext: paperclipIssueSyncContext,
             nextStatus,
-            clearAssignee: true,
-            ...shouldPreserveMaintainerWaitRouting ? { clearExecutionPolicy: true } : {},
+            ...shouldClearTransitionAssignee ? { clearAssignee: true } : {},
+            ...shouldPreserveMaintainerWaitRouting || shouldClearCompletedExecutionPolicy ? { clearExecutionPolicy: true } : {},
             transitionComment: "",
             paperclipApiBaseUrl
           });
@@ -9819,22 +9987,22 @@ async function synchronizePaperclipPullRequestIssueStatuses(ctx, octokit, mappin
       const transitionComment = buildPaperclipPullRequestIssueStatusTransitionComment({
         previousStatus: paperclipIssue.status,
         nextStatus,
-        pullRequest
+        pullRequests: pullRequestSnapshots
       });
       updateSyncFailureContext(syncFailureContext, {
         phase: "updating_paperclip_status",
-        repositoryUrl: pullRequestRepository.url,
+        repositoryUrl: primaryRepository?.url,
         githubIssueNumber: void 0
       });
       await updatePaperclipIssueState(ctx, {
         companyId: mapping.companyId,
-        issueId: pullRequestLink.paperclipIssueId,
+        issueId: paperclipIssueId,
         currentStatus: paperclipIssue.status,
         syncContext: paperclipIssueSyncContext,
         nextStatus,
         ...nextTransitionAssignee ? { nextAssignee: nextTransitionAssignee.principal } : {},
         ...shouldClearTransitionAssignee ? { clearAssignee: true } : {},
-        ...shouldPreserveMaintainerWaitRouting ? { clearExecutionPolicy: true } : {},
+        ...shouldPreserveMaintainerWaitRouting || shouldClearCompletedExecutionPolicy ? { clearExecutionPolicy: true } : {},
         transitionComment,
         paperclipApiBaseUrl
       });
@@ -9842,7 +10010,7 @@ async function synchronizePaperclipPullRequestIssueStatuses(ctx, octokit, mappin
       if (shouldWakeTransitionAssignee && nextTransitionAssignee?.principal.kind === "agent") {
         queuedIssueWakeups.push({
           assigneeAgentId: nextTransitionAssignee.principal.id,
-          paperclipIssueId: pullRequestLink.paperclipIssueId,
+          paperclipIssueId,
           reason: STATUS_TRANSITION_WAKE_REASON,
           mutation: "status_transition",
           previousStatus: paperclipIssue.status,
@@ -9854,16 +10022,6 @@ async function synchronizePaperclipPullRequestIssueStatuses(ctx, octokit, mappin
         throw error;
       }
       recordRecoverableSyncFailure(ctx, failures, error, syncFailureContext);
-      continue;
-    } finally {
-      completedIssueCount += 1;
-      if (onProgress) {
-        await onProgress({
-          pullRequestLink,
-          completedIssueCount,
-          totalIssueCount
-        });
-      }
     }
   }
   await mapWithConcurrency(
@@ -9896,6 +10054,7 @@ async function getResolvedConfig(ctx) {
 }
 function getConfiguredGithubTokenSource(settings, config, companyId) {
   const normalizedCompanyId = normalizeCompanyId(companyId);
+  const companyFallbackToken = normalizedCompanyId ? normalizeGitHubToken(config.githubTokensByCompanyId?.[normalizedCompanyId]) : void 0;
   const hasScopedGitHubTokenRefs = hasAnyScopedValue(settings?.githubTokenRefs) || hasAnyScopedValue(config.githubTokenRefs);
   const secretRef = normalizedCompanyId ? normalizeSecretRef(config.githubTokenRefs?.[normalizedCompanyId]) ?? normalizeSecretRef(settings?.githubTokenRefs?.[normalizedCompanyId]) ?? (!hasScopedGitHubTokenRefs ? normalizeGitHubTokenRef(config.githubTokenRef) ?? normalizeGitHubTokenRef(settings?.githubTokenRef) : void 0) : normalizeGitHubTokenRef(config.githubTokenRef) ?? normalizeGitHubTokenRef(settings?.githubTokenRef) ?? (() => {
     const configuredRefs = [
@@ -9906,14 +10065,17 @@ function getConfiguredGithubTokenSource(settings, config, companyId) {
     return uniqueRefs.length === 1 ? uniqueRefs[0] : void 0;
   })();
   if (secretRef) {
-    return { secretRef };
+    return {
+      secretRef,
+      ...companyFallbackToken ? { fallbackToken: companyFallbackToken } : {}
+    };
   }
-  const token = !normalizedCompanyId || !hasScopedGitHubTokenRefs ? normalizeGitHubToken(config.githubToken) : void 0;
+  const token = companyFallbackToken ?? (!normalizedCompanyId || !hasScopedGitHubTokenRefs ? normalizeGitHubToken(config.githubToken) : void 0);
   return token ? { token } : {};
 }
 function hasConfiguredGithubToken(settings, config, companyId) {
   const configuredTokenSource = getConfiguredGithubTokenSource(settings, config, companyId);
-  if (configuredTokenSource.secretRef ?? configuredTokenSource.token) {
+  if (configuredTokenSource.secretRef ?? configuredTokenSource.token ?? configuredTokenSource.fallbackToken) {
     return true;
   }
   if (normalizeCompanyId(companyId)) {
@@ -9923,6 +10085,18 @@ function hasConfiguredGithubToken(settings, config, companyId) {
     settings?.githubTokenRefs && Object.keys(settings.githubTokenRefs).length > 0 || config.githubTokenRefs && Object.keys(config.githubTokenRefs).length > 0
   );
 }
+function getSavedGitHubTokenRef(settings, companyId) {
+  if (!companyId) {
+    return void 0;
+  }
+  return normalizeSecretRef(settings?.githubTokenRefs?.[companyId]);
+}
+function getConfiguredGitHubTokenRef(config, companyId) {
+  if (!companyId) {
+    return void 0;
+  }
+  return normalizeSecretRef(config?.githubTokenRefs?.[companyId]);
+}
 function getSavedPaperclipBoardApiTokenRef(settings, companyId) {
   if (!companyId) {
     return void 0;
@@ -10006,7 +10180,23 @@ async function resolveGithubToken(ctx, options = {}) {
   const config = options.config ?? await getResolvedConfig(ctx);
   const configuredTokenSource = getConfiguredGithubTokenSource(settings, config, options.companyId);
   if (configuredTokenSource.secretRef) {
-    return ctx.secrets.resolve(configuredTokenSource.secretRef);
+    try {
+      const token = (await ctx.secrets.resolve(configuredTokenSource.secretRef)).trim();
+      if (token) {
+        return token;
+      }
+      return configuredTokenSource.fallbackToken ?? "";
+    } catch (error) {
+      if (configuredTokenSource.fallbackToken && isPluginSecretReferenceDisabledError(error)) {
+        ctx.logger.warn("GitHub Sync is using a worker-local company token fallback because plugin secret refs are unavailable in this host.", {
+          companyId: normalizeCompanyId(options.companyId),
+          secretRef: configuredTokenSource.secretRef,
+          error: getErrorMessage(error)
+        });
+        return configuredTokenSource.fallbackToken;
+      }
+      throw error;
+    }
   }
   return configuredTokenSource.token ?? "";
 }
@@ -12888,19 +13078,24 @@ async function createProjectPullRequestPaperclipIssue(ctx, input) {
     };
   }
   const requestedTitle = typeof input.title === "string" && input.title.trim() ? input.title.trim() : pullRequest.title.trim();
-  const createdIssue = await ctx.issues.create({
-    companyId: scope.companyId,
-    projectId: scope.projectId,
-    title: requestedTitle,
-    originKind: GITHUB_PULL_REQUEST_ORIGIN_KIND,
-    originId: pullRequestUrl,
-    description: buildPaperclipIssueDescriptionFromPullRequest({
-      repository: scope.repository,
-      pullRequestNumber,
-      pullRequestUrl,
-      body: pullRequest.body
-    })
-  });
+  const createdIssue = await ensurePaperclipIssueStandardWorkMode(
+    ctx,
+    await ctx.issues.create({
+      companyId: scope.companyId,
+      projectId: scope.projectId,
+      title: requestedTitle,
+      status: "todo",
+      originKind: GITHUB_PULL_REQUEST_ORIGIN_KIND,
+      originId: pullRequestUrl,
+      description: buildPaperclipIssueDescriptionFromPullRequest({
+        repository: scope.repository,
+        pullRequestNumber,
+        pullRequestUrl,
+        body: pullRequest.body
+      })
+    }),
+    scope.companyId
+  );
   const resolvedIssue = await ctx.issues.get(createdIssue.id, scope.companyId) ?? createdIssue;
   await upsertGitHubPullRequestLinkRecord(ctx, {
     companyId: scope.companyId,
@@ -15459,6 +15654,7 @@ var __testing = {
   formatPaperclipApiFetchErrorMessage,
   hasUnresolvedPaperclipIssueBlocker,
   isHealthyMaintainerWaitTransition,
+  resolveGithubToken,
   resolvePaperclipPullRequestIssueStatus,
   resolveSyncTransitionAssignee
 };
@@ -15475,6 +15671,8 @@ var plugin = definePlugin({
       const normalizedSettings = normalizeSettings(saved);
       const config = await getResolvedConfig(ctx);
       const githubTokenConfigured = hasConfiguredGithubToken(normalizedSettings, config, requestedCompanyId);
+      const configuredGitHubTokenRef = getConfiguredGitHubTokenRef(config, requestedCompanyId);
+      const savedGitHubTokenRef = getSavedGitHubTokenRef(normalizedSettings, requestedCompanyId);
       const configuredBoardTokenRef = getConfiguredPaperclipBoardApiTokenRef(config, requestedCompanyId);
       const savedBoardTokenRef = getSavedPaperclipBoardApiTokenRef(normalizedSettings, requestedCompanyId);
       const settingsForResponse = sanitizeSettingsForCurrentSetup(
@@ -15496,6 +15694,8 @@ var plugin = definePlugin({
         paperclipApiBaseUrlConfigured: Boolean(normalizePaperclipApiBaseUrl(config.paperclipApiBaseUrl)),
         githubTokenConfigured,
         paperclipBoardAccessConfigured: requestedCompanyId ? hasConfiguredPaperclipBoardAccess(settingsForResponse, config, requestedCompanyId) : hasConfiguredPaperclipBoardAccessForMappings(settingsForResponse, config, scopedMappings),
+        ...savedGitHubTokenRef ? { githubTokenConfigSyncRef: savedGitHubTokenRef } : {},
+        githubTokenNeedsConfigSync: Boolean(savedGitHubTokenRef && configuredGitHubTokenRef !== savedGitHubTokenRef),
         ...savedBoardTokenRef ? { paperclipBoardAccessConfigSyncRef: savedBoardTokenRef } : {},
         paperclipBoardAccessNeedsConfigSync: Boolean(savedBoardTokenRef && !configuredBoardTokenRef)
       };
@@ -15762,6 +15962,44 @@ var plugin = definePlugin({
       }
       return validateGithubToken(ctx, trimmedToken);
     });
+    ctx.actions.register("settings.ensureGitHubTokenAvailable", async (input) => {
+      const record = input && typeof input === "object" ? input : {};
+      const companyId = normalizeCompanyId(record.companyId);
+      const githubTokenRef = normalizeSecretRef(record.githubTokenRef);
+      const token = normalizeGitHubToken(record.token);
+      if (!companyId) {
+        throw new Error("Company context is required to verify worker access to the GitHub token.");
+      }
+      if (!githubTokenRef) {
+        throw new Error("A GitHub token secret ref is required to verify worker token access.");
+      }
+      if (!token) {
+        throw new Error("A validated GitHub token is required to prepare the worker token fallback.");
+      }
+      try {
+        const resolvedToken = (await ctx.secrets.resolve(githubTokenRef)).trim();
+        if (resolvedToken) {
+          return {
+            secretResolvable: true,
+            fallbackStored: false
+          };
+        }
+      } catch (error) {
+        if (!isPluginSecretReferenceDisabledError(error)) {
+          throw error;
+        }
+        await writeExternalCompanyGitHubTokenFallback(ctx, companyId, token);
+        return {
+          secretResolvable: false,
+          fallbackStored: true
+        };
+      }
+      await writeExternalCompanyGitHubTokenFallback(ctx, companyId, token);
+      return {
+        secretResolvable: false,
+        fallbackStored: true
+      };
+    });
     ctx.actions.register("project.pullRequests.createIssue", async (input) => {
       const record = input && typeof input === "object" ? input : {};
       return createProjectPullRequestPaperclipIssue(ctx, record);

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "paperclip-github-plugin",
-  "version": "0.8.12",
+  "version": "0.9.1",
   "description": "Paperclip plugin for synchronizing GitHub issues into Paperclip projects.",
   "license": "Apache-2.0",
   "type": "module",
-  "packageManager": "pnpm@10.33.2",
+  "packageManager": "pnpm@11.0.9",
   "engines": {
     "node": ">=20"
   },
@@ -41,7 +41,7 @@
   },
   "dependencies": {
     "@octokit/rest": "^22.0.1",
-    "@paperclipai/plugin-sdk": "^2026.428.0",
+    "@paperclipai/plugin-sdk": "^2026.512.0",
     "react": "^19.2.6",
     "react-markdown": "^10.1.0",
     "rehype-raw": "^7.0.0",