paperclip-github-plugin 0.8.5 → 0.8.7

package/README.md

@@ -62,7 +62,7 @@ If a company already has a Paperclip project bound to a GitHub repository worksp
 
 ### Status sync with delivery context
 
-The plugin does more than mirror issue text. It looks at linked pull requests, mergeability, CI, review decisions, review threads, and trusted new GitHub comments so imported Paperclip issues can reflect where the work actually is. When GitHub links an issue to a pull request in another repository, GitHub Sync now follows that pull request's actual repository for status checks, review state, and deep links instead of assuming the issue repository. When sync closes an imported issue as `done` or `cancelled`, it also clears any pending Paperclip review or approval execution state so the host accepts the terminal transition cleanly.
+The plugin does more than mirror issue text. It looks at linked pull requests, mergeability, CI, review decisions, review threads, and trusted new GitHub comments so imported Paperclip issues can reflect where the work actually is. When GitHub links an issue to a pull request in another repository, GitHub Sync now follows that pull request's actual repository for status checks, review state, and deep links instead of assuming the issue repository. When sync closes an imported issue as `done` or `cancelled`, it also clears any pending Paperclip review or approval execution policy/state so the host accepts the terminal transition cleanly and does not keep waking stale review participants.
 
 ### Company KPI dashboard
 
@@ -158,7 +158,7 @@ When the local Paperclip API is available, the plugin also syncs labels by name,
 | --- | --- |
 | Open issue with no linked pull request, created by a repository maintainer | `todo` on first import |
 | Open issue with no linked pull request | Configured default status, which defaults to `backlog` |
-| Open issue with a linked pull request and unfinished CI | `in_progress` |
+| Open issue with a linked pull request and unfinished CI | `in_progress`; already-blocked pending-only PR waits remain `blocked` |
 | Open issue with failing CI, a non-mergeable linked pull request, or unresolved review threads | `todo`, or `in_progress` when GitHub Sync can hand the work back to an executor |
 | Open issue with green CI, a merge-ready linked pull request, and all review threads resolved | `in_review` |
 | Closed issue completed as finished work | `done` |
@@ -170,7 +170,7 @@ Additional behavior:
 - If the Paperclip host initially creates that imported maintainer issue in `backlog`, GitHub Sync promotes it to `todo` without replacing the configured default assignee with the executor handoff assignee, so triage ownership stays intact.
 - When Paperclip board access is connected for a company, the advanced assignee dropdowns list both company agents and `Me` for the connected board user.
 - Newly imported issues that finish sync in `todo` and are assigned to an agent enqueue an assignee wakeup so the agent can pick them up promptly.
-- For linked pull requests, GitHub Sync treats merge-conflict, behind-branch, blocked, draft, unstable merge states, and unresolved review threads as executor work, while merge-ready states such as `CLEAN` and `HAS_HOOKS` can move work into `in_review` when CI is green and review threads are resolved. A stale aggregate `CHANGES_REQUESTED` review decision alone does not move that maintainer wait back to active execution. Transient `UNKNOWN` mergeability also does not move an already `in_review` maintainer wait back to active execution when CI is green and review threads are resolved.
+- For linked pull requests, GitHub Sync treats merge-conflict, behind-branch, blocked, draft, unstable merge states, and unresolved review threads as executor work, while merge-ready states such as `CLEAN` and `HAS_HOOKS` can move work into `in_review` when CI is green and review threads are resolved. If an issue is already `blocked` and GitHub reports only pending external merge requirements while CI is unfinished, sync preserves the external wait instead of waking an executor. A stale aggregate `CHANGES_REQUESTED` review decision alone does not move that maintainer wait back to active execution. Transient `UNKNOWN` mergeability also does not move an already `in_review` maintainer wait back to active execution when CI is green and review threads are resolved.
 - Imported issues that are already `blocked` stay `blocked` while any first-class `blockedBy` issue is still non-terminal, even if the linked GitHub pull request is otherwise green and review-ready.
 - When sync moves work into `in_review`, GitHub Sync first follows the Paperclip issue execution policy's current reviewer or approver when that stage is visible on the issue. If Paperclip exposes an internal review or approval stage but not yet the participant, the plugin falls back to the configured reviewer or approver handoff assignee. If the transition is only a healthy linked-PR wait with no visible internal review or approval stage, GitHub Sync leaves the issue unassigned so it can wait on normal maintainer review without waking an internal owner.
 - When sync moves work back into active execution, GitHub Sync first follows the Paperclip issue execution policy `returnAssignee` when it is available. Otherwise it falls back to the configured executor handoff assignee and then to the default imported assignee.

package/dist/manifest.js

@@ -535,7 +535,7 @@ var COMPANY_METRIC_API_ROUTE_URL_PATH = `/api/plugins/${GITHUB_SYNC_PLUGIN_ID}/a
 var require2 = createRequire(import.meta.url);
 var packageJson = require2("../package.json");
 var SCHEDULE_TICK_CRON = "* * * * *";
-var MANIFEST_VERSION = "0.8.5"?.trim() || typeof packageJson.version === "string" && packageJson.version.trim() || process.env.npm_package_version?.trim() || "0.0.0-dev";
+var MANIFEST_VERSION = "0.8.7"?.trim() || typeof packageJson.version === "string" && packageJson.version.trim() || process.env.npm_package_version?.trim() || "0.0.0-dev";
 var manifest = {
   id: GITHUB_SYNC_PLUGIN_ID,
   apiVersion: 1,

package/dist/worker.js

@@ -1498,6 +1498,88 @@ function getErrorResponseDataMessage(error) {
   const message = data.message;
   return typeof message === "string" && message.trim() ? message.trim() : void 0;
 }
+function getGitHubRequestId(error) {
+  const requestId = getErrorResponseHeaders(error)["x-github-request-id"]?.trim();
+  return requestId || void 0;
+}
+function buildGitHubOctokitLogMetadata(context) {
+  const metadata = {};
+  const companyId = normalizeCompanyId(context.companyId);
+  const operation = normalizeOptionalString2(context.operation);
+  const repositoryUrl = normalizeOptionalString2(context.repositoryUrl);
+  const toolName = normalizeOptionalString2(context.toolName);
+  if (companyId) {
+    metadata.companyId = companyId;
+  }
+  if (operation) {
+    metadata.operation = operation;
+  }
+  if (repositoryUrl) {
+    metadata.repositoryUrl = repositoryUrl;
+  }
+  if (context.syncTrigger) {
+    metadata.syncTrigger = context.syncTrigger;
+  }
+  if (toolName) {
+    metadata.toolName = toolName;
+  }
+  return metadata;
+}
+function getGitHubOctokitRequestPath(url, baseUrl) {
+  if (typeof url !== "string" || !url.trim()) {
+    return void 0;
+  }
+  const trimmedUrl = url.trim();
+  if (typeof baseUrl === "string" && baseUrl.trim() && trimmedUrl.startsWith(baseUrl.trim())) {
+    return trimmedUrl.slice(baseUrl.trim().length) || "/";
+  }
+  try {
+    const parsed = new URL(trimmedUrl);
+    return `${parsed.pathname}${parsed.search}`;
+  } catch {
+    return trimmedUrl;
+  }
+}
+function createGitHubOctokit(ctx, token, context = {}) {
+  const octokit = new Octokit({
+    auth: token,
+    log: {
+      debug: () => void 0,
+      info: () => void 0,
+      warn: (message) => {
+        ctx.logger.warn("GitHub Octokit warning.", {
+          ...buildGitHubOctokitLogMetadata(context),
+          message
+        });
+      },
+      error: () => void 0
+    }
+  });
+  if (context.logFailures === false) {
+    return octokit;
+  }
+  octokit.hook.wrap("request", async (request, options) => {
+    const start = Date.now();
+    const requestOptions = octokit.request.endpoint.parse(options);
+    try {
+      return await request(options);
+    } catch (error) {
+      const responseMessage = getErrorResponseDataMessage(error);
+      ctx.logger.warn("GitHub API request failed.", {
+        ...buildGitHubOctokitLogMetadata(context),
+        method: requestOptions.method,
+        path: getGitHubOctokitRequestPath(requestOptions.url, options.baseUrl),
+        status: getErrorStatus(error) ?? null,
+        requestId: getGitHubRequestId(error) ?? null,
+        durationMs: Date.now() - start,
+        error: getErrorMessage(error),
+        ...responseMessage ? { responseMessage } : {}
+      });
+      throw error;
+    }
+  });
+  return octokit;
+}
 function getErrorResponseDataErrors(error) {
   if (!error || typeof error !== "object" || !("response" in error)) {
     return [];
@@ -5247,6 +5329,9 @@ function isHealthyMaintainerWaitTransition(params) {
   const { currentStatus, nextStatus, syncContext } = params;
   return nextStatus === "in_review" && (currentStatus === "done" || currentStatus === "in_review") && syncContext.executionState === null && syncContext.executionPolicy !== null;
 }
+function shouldClearCompletedSyncExecutionPolicy(params) {
+  return (params.nextStatus === "done" || params.nextStatus === "cancelled") && (params.syncContext.executionPolicy !== null || params.syncContext.executionState !== null);
+}
 function shouldPreserveImportedTriageAssignee(params) {
   return params.wasImportedThisRun && params.maintainerAuthoredImportedIssue === true && params.currentStatus === "backlog" && params.nextStatus === "todo";
 }
@@ -5436,6 +5521,12 @@ function resolvePaperclipIssueStatus(params) {
     return hasExecutorHandoffTarget ? "in_progress" : "todo";
   }
   if (snapshot.linkedPullRequests.length > 0) {
+    if (shouldPreserveBlockedExternalPullRequestWait({
+      currentStatus,
+      linkedPullRequests: snapshot.linkedPullRequests
+    })) {
+      return "blocked";
+    }
     return resolvePaperclipStatusFromLinkedPullRequests(snapshot.linkedPullRequests, {
       preferInProgress: hasExecutorHandoffTarget,
       preserveTransientUnknownMergeabilityWait: currentStatus === "done" || currentStatus === "in_review"
@@ -5454,6 +5545,12 @@ function resolvePaperclipPullRequestIssueStatus(params) {
   if (currentStatus === "done" || currentStatus === "cancelled") {
     return currentStatus;
   }
+  if (shouldPreserveBlockedExternalPullRequestWait({
+    currentStatus,
+    linkedPullRequests: [pullRequest]
+  })) {
+    return "blocked";
+  }
   return resolvePaperclipStatusFromLinkedPullRequests([pullRequest], {
     preferInProgress: hasExecutorHandoffTarget,
     preserveTransientUnknownMergeabilityWait: currentStatus === "in_review"
@@ -5605,6 +5702,12 @@ function normalizeGitHubPullRequestReviewDecision(value) {
 function isGitHubPullRequestActionRequiredForSync(pullRequest) {
   return pullRequest.mergeability === "conflicting" || ACTION_REQUIRED_GITHUB_PULL_REQUEST_MERGE_STATE_STATUSES.has(pullRequest.mergeStateStatus);
 }
+function isGitHubPullRequestPendingExternalWaitForSync(pullRequest) {
+  return pullRequest.ciState === "unfinished" && !pullRequest.hasUnresolvedReviewThreads && pullRequest.mergeability !== "conflicting" && (pullRequest.mergeStateStatus === "blocked" || pullRequest.mergeStateStatus === "unstable");
+}
+function shouldPreserveBlockedExternalPullRequestWait(params) {
+  return params.currentStatus === "blocked" && params.linkedPullRequests.length > 0 && params.linkedPullRequests.every((pullRequest) => isGitHubPullRequestPendingExternalWaitForSync(pullRequest));
+}
 function isGitHubPullRequestTransientUnknownMergeabilityWait(pullRequest) {
   return pullRequest.ciState === "green" && !pullRequest.hasUnresolvedReviewThreads && pullRequest.mergeability !== "conflicting" && pullRequest.mergeStateStatus === "unknown";
 }
@@ -9089,6 +9192,10 @@ async function synchronizePaperclipIssueStatuses(ctx, octokit, repository, mappi
         nextStatus,
         syncContext: paperclipIssueSyncContext
       });
+      const shouldClearCompletedExecutionPolicy = shouldClearCompletedSyncExecutionPolicy({
+        nextStatus,
+        syncContext: paperclipIssueSyncContext
+      });
       const shouldPreserveImportedTriageRouting = shouldPreserveImportedTriageAssignee({
         currentStatus: paperclipIssue.status,
         nextStatus,
@@ -9110,7 +9217,7 @@ async function synchronizePaperclipIssueStatuses(ctx, octokit, repository, mappi
       importedIssue.lastSeenGitHubState = snapshot.state;
       importedIssue.linkedPullRequestCommentCounts = currentLinkedPullRequestCommentCounts;
       if (paperclipIssue.status === nextStatus) {
-        if (shouldClearTransitionAssignee) {
+        if (shouldClearTransitionAssignee || shouldClearCompletedExecutionPolicy) {
           updateSyncFailureContext(syncFailureContext, {
             phase: "updating_paperclip_status",
             repositoryUrl: repository.url,
@@ -9122,8 +9229,8 @@ async function synchronizePaperclipIssueStatuses(ctx, octokit, repository, mappi
             currentStatus: paperclipIssue.status,
             syncContext: paperclipIssueSyncContext,
             nextStatus,
-            clearAssignee: true,
-            ...shouldPreserveMaintainerWaitRouting ? { clearExecutionPolicy: true } : {},
+            ...shouldClearTransitionAssignee ? { clearAssignee: true } : {},
+            ...shouldPreserveMaintainerWaitRouting || shouldClearCompletedExecutionPolicy ? { clearExecutionPolicy: true } : {},
             transitionComment: "",
             paperclipApiBaseUrl
           });
@@ -9159,7 +9266,7 @@ async function synchronizePaperclipIssueStatuses(ctx, octokit, repository, mappi
         nextStatus,
         ...nextTransitionAssignee ? { nextAssignee: nextTransitionAssignee.principal } : {},
         ...shouldClearTransitionAssignee ? { clearAssignee: true } : {},
-        ...shouldPreserveMaintainerWaitRouting ? { clearExecutionPolicy: true } : {},
+        ...shouldPreserveMaintainerWaitRouting || shouldClearCompletedExecutionPolicy ? { clearExecutionPolicy: true } : {},
         transitionComment: transitionComment.body,
         transitionCommentAnnotation: transitionComment.annotation,
         paperclipApiBaseUrl
@@ -9778,12 +9885,16 @@ async function handleCompanyMetricApiRoute(ctx, input) {
     }
   };
 }
-async function createGitHubToolOctokit(ctx, companyId) {
+async function createGitHubToolOctokit(ctx, companyId, context = {}) {
   const token = (await resolveGithubToken(ctx, { companyId })).trim();
   if (!token) {
     throw new Error(MISSING_GITHUB_TOKEN_SYNC_MESSAGE);
   }
-  return new Octokit({ auth: token });
+  return createGitHubOctokit(ctx, token, {
+    companyId,
+    operation: "github-api",
+    ...context
+  });
 }
 async function listGitHubRepositoryOpenPullRequestNumbers(octokit, repository) {
   const response = await octokit.rest.pulls.list({
@@ -12684,8 +12795,11 @@ function mergeNamedValues(currentValues, params) {
   }
   return [...values.values()];
 }
-async function validateGithubToken(token) {
-  const octokit = new Octokit({ auth: token.trim() });
+async function validateGithubToken(ctx, token) {
+  const octokit = createGitHubOctokit(ctx, token.trim(), {
+    logFailures: false,
+    operation: "settings.validateToken"
+  });
   try {
     const response = await octokit.rest.users.getAuthenticated();
     return {
@@ -12797,7 +12911,12 @@ async function performSync(ctx, trigger, options = {}) {
     return saveSettingsSyncState(ctx, settings, next.syncState, targetCompanyId);
   }
   activePaperclipApiAuthTokensByCompanyId = await resolvePaperclipApiAuthTokens(ctx, settings, config, mappings);
-  const octokit = new Octokit({ auth: token });
+  const octokitLogContext = {
+    companyId: targetCompanyId,
+    operation: "sync.github-issues",
+    syncTrigger: trigger
+  };
+  const octokit = createGitHubOctokit(ctx, token, octokitLogContext);
   let syncedIssuesCount = 0;
   let createdIssuesCount = 0;
   let skippedIssuesCount = 0;
@@ -12947,6 +13066,7 @@ async function performSync(ctx, trigger, options = {}) {
       await throwIfSyncCancelled();
       try {
         const repository = requireRepositoryReference(mapping.repositoryUrl);
+        octokitLogContext.repositoryUrl = repository.url;
         const importedIssueRecords = nextRegistry.filter((entry) => doesImportedIssueRecordMatchMapping(entry, mapping)).filter((entry) => doesImportedIssueMatchTarget(entry, options.target));
         const shouldLoadClosedIssues = options.target?.kind === "issue" || importedIssueRecords.length > 0;
         currentProgress = {
@@ -13068,6 +13188,7 @@ async function performSync(ctx, trigger, options = {}) {
       await throwIfSyncCancelled();
       try {
         const { mapping, advancedSettings, repository, repositoryIndex, allIssuesById, issues, pullRequestLinks } = plan;
+        octokitLogContext.repositoryUrl = repository.url;
         const companyId = mapping.companyId;
         let availableLabels = companyId ? companyLabelDirectoryCache.get(companyId) : void 0;
         if (!availableLabels) {
@@ -13509,13 +13630,19 @@ async function startSync(ctx, trigger, options = {}) {
   }
 }
 function registerGitHubAgentTools(ctx) {
+  async function createAgentToolOctokit(runCtx, toolName, repository) {
+    return createGitHubToolOctokit(ctx, runCtx.companyId, {
+      toolName,
+      ...repository ? { repositoryUrl: repository.url } : {}
+    });
+  }
   ctx.tools.register(
     "search_repository_items",
     getGitHubAgentToolDeclaration("search_repository_items"),
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
       const repository = await resolveGitHubToolRepository(ctx, runCtx, input);
+      const octokit = await createAgentToolOctokit(runCtx, "search_repository_items", repository);
       const rawQuery = normalizeOptionalToolString(input.query);
       if (!rawQuery) {
         throw new Error("query is required.");
@@ -13583,7 +13710,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "get_issue", target.repository);
       const response = await octokit.rest.issues.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -13630,7 +13757,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "list_issue_comments", target.repository);
       const comments = await listAllGitHubIssueComments(octokit, target.repository, target.issueNumber);
       return buildToolSuccessResult(
         `Loaded ${comments.length} GitHub ${comments.length === 1 ? "comment" : "comments"} from issue #${target.issueNumber}.`,
@@ -13648,7 +13775,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "update_issue", target.repository);
       const currentResponse = await octokit.rest.issues.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -13721,7 +13848,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "assign_to_current_user", target.repository);
       const [currentResponse, authenticatedUserResponse] = await Promise.all([
         octokit.rest.issues.get({
           owner: target.repository.owner,
@@ -13781,7 +13908,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubIssueToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "add_issue_comment", target.repository);
       const body = appendAiAuthorshipFooter(String(input.body ?? ""), "comment", normalizeOptionalToolString(input.llmModel));
       const response = await octokit.rest.issues.createComment({
         owner: target.repository.owner,
@@ -13831,7 +13958,7 @@ function registerGitHubAgentTools(ctx) {
         "pull request description",
         normalizeOptionalToolString(input.llmModel)
       ) : void 0;
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "create_pull_request", repository);
       const response = await octokit.rest.pulls.create({
         owner: repository.owner,
         repo: repository.repo,
@@ -13907,7 +14034,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "get_pull_request", target.repository);
       const response = await octokit.rest.pulls.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -13955,7 +14082,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "update_pull_request", target.repository);
       let currentResponse = await octokit.rest.pulls.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -14021,7 +14148,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "list_pull_request_files", target.repository);
       const files = await listAllPullRequestFiles(octokit, target.repository, target.pullRequestNumber);
       return buildToolSuccessResult(
         `Loaded ${files.length} changed ${files.length === 1 ? "file" : "files"} from pull request #${target.pullRequestNumber}.`,
@@ -14039,7 +14166,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "get_pull_request_checks", target.repository);
       const pullRequestResponse = await octokit.rest.pulls.get({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -14138,7 +14265,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "list_pull_request_review_threads", target.repository);
       const threads = await listDetailedPullRequestReviewThreads(octokit, target.repository, target.pullRequestNumber);
       return buildToolSuccessResult(
         `Loaded ${threads.length} review ${threads.length === 1 ? "thread" : "threads"} from pull request #${target.pullRequestNumber}.`,
@@ -14160,7 +14287,7 @@ function registerGitHubAgentTools(ctx) {
         throw new Error("threadId is required.");
       }
       const body = appendAiAuthorshipFooter(String(input.body ?? ""), "comment", normalizeOptionalToolString(input.llmModel));
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "reply_to_review_thread");
       const response = await octokit.graphql(
         GITHUB_ADD_PULL_REQUEST_REVIEW_THREAD_REPLY_MUTATION,
         {
@@ -14195,7 +14322,7 @@ function registerGitHubAgentTools(ctx) {
       if (!threadId) {
         throw new Error("threadId is required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "resolve_review_thread");
       const response = await octokit.graphql(
         GITHUB_RESOLVE_REVIEW_THREAD_MUTATION,
         {
@@ -14226,7 +14353,7 @@ function registerGitHubAgentTools(ctx) {
       if (!threadId) {
         throw new Error("threadId is required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "unresolve_review_thread");
       const response = await octokit.graphql(
         GITHUB_UNRESOLVE_REVIEW_THREAD_MUTATION,
         {
@@ -14259,7 +14386,7 @@ function registerGitHubAgentTools(ctx) {
       if (userReviewers.length === 0 && teamReviewers.length === 0) {
         throw new Error("Provide at least one user reviewer or team reviewer.");
       }
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "request_pull_request_reviewers", target.repository);
       const response = await octokit.rest.pulls.requestReviewers({
         owner: target.repository.owner,
         repo: target.repository.repo,
@@ -14290,7 +14417,7 @@ function registerGitHubAgentTools(ctx) {
       if (!organization) {
         throw new Error("organization is required.");
       }
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "list_organization_projects");
       const projects = await listGitHubOrganizationProjects(octokit, organization, {
         includeClosed: input.includeClosed === true,
         query: normalizeOptionalToolString(input.query),
@@ -14311,7 +14438,7 @@ function registerGitHubAgentTools(ctx) {
     async (params, runCtx) => executeGitHubTool(async () => {
       const input = getToolInputRecord(params);
       const target = await resolveGitHubPullRequestToolTarget(ctx, runCtx, input);
-      const octokit = await createGitHubToolOctokit(ctx, runCtx.companyId);
+      const octokit = await createAgentToolOctokit(runCtx, "add_pull_request_to_project", target.repository);
       const projectTarget = await resolveGitHubProjectToolTarget(octokit, input);
       const pullRequest = await getGitHubPullRequestProjectItems(
         octokit,
@@ -14380,6 +14507,7 @@ function shouldStartWorkerHost(moduleUrl, entry = process.argv[1]) {
 }
 var __testing = {
   buildSyncFallbackExecutionStatePatch,
+  createGitHubToolOctokit,
   hasUnresolvedPaperclipIssueBlocker,
   isHealthyMaintainerWaitTransition,
   resolveSyncTransitionAssignee
@@ -14681,7 +14809,7 @@ var plugin = definePlugin({
       if (!trimmedToken) {
         throw new Error("Enter a GitHub token.");
       }
-      return validateGithubToken(trimmedToken);
+      return validateGithubToken(ctx, trimmedToken);
     });
     ctx.actions.register("project.pullRequests.createIssue", async (input) => {
       const record = input && typeof input === "object" ? input : {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paperclip-github-plugin",
-  "version": "0.8.5",
+  "version": "0.8.7",
   "description": "Paperclip plugin for synchronizing GitHub issues into Paperclip projects.",
   "license": "Apache-2.0",
   "type": "module",