paperclip-github-plugin 0.9.0 → 0.9.1

package/README.md

@@ -205,7 +205,10 @@ If Paperclip-managed secrets are not available, the worker can read a local fall
 
 ```json
 {
-  "githubToken": "ghp_your_token_here"
+  "githubToken": "ghp_your_token_here",
+  "githubTokensByCompanyId": {
+    "company-uuid": "ghp_company_specific_token_here"
+  }
 }
 ```
 
@@ -213,7 +216,8 @@ Notes:
 
 - This file is read by the worker only.
 - The raw token is never persisted back into plugin state or plugin config.
-- A GitHub token secret saved through the settings UI takes precedence over the local file.
+- A GitHub token secret saved through the settings UI is the primary source. If the current Paperclip host rejects plugin secret-ref resolution while company-scoped plugin config is unavailable, GitHub Sync stores the validated token in `githubTokensByCompanyId` as a worker-local compatibility fallback.
+- On authenticated deployments, selected agents receive `GITHUB_TOKEN` as a latest-version secret-ref env binding, and the settings UI patches agent adapter config with `replaceAdapterConfig: true` so newer Paperclip hosts persist the merged env map.
 
 ### Worker-facing Paperclip API URL
 

package/dist/manifest.js

@@ -642,7 +642,7 @@ var PULL_REQUEST_ASSET_API_ROUTE_URL_PATH = `/api/plugins/${GITHUB_SYNC_PLUGIN_I
 var require2 = createRequire(import.meta.url);
 var packageJson = require2("../package.json");
 var SCHEDULE_TICK_CRON = "* * * * *";
-var MANIFEST_VERSION = "0.9.0"?.trim() || typeof packageJson.version === "string" && packageJson.version.trim() || process.env.npm_package_version?.trim() || "0.0.0-dev";
+var MANIFEST_VERSION = "0.9.1"?.trim() || typeof packageJson.version === "string" && packageJson.version.trim() || process.env.npm_package_version?.trim() || "0.0.0-dev";
 var manifest = {
   id: GITHUB_SYNC_PLUGIN_ID,
   apiVersion: 1,

package/dist/ui/index.js

@@ -23165,6 +23165,9 @@ function resolveToolbarButtonState(params) {
     syncStartPending
   };
 }
+function clearGitHubTokenConfigSyncAttemptOnFailure(currentAttemptKey, failedAttemptKey) {
+  return currentAttemptKey === failedAttemptKey ? null : currentAttemptKey;
+}
 function getSyncToastTitle(syncState) {
   if (getActiveRateLimitPause(syncState)) {
     return "GitHub sync is paused";
@@ -28430,7 +28433,8 @@ function getAgentPropagationPatch(params) {
       ...currentEnv,
       GITHUB_TOKEN: {
         type: "secret_ref",
-        secretId: params.githubTokenSecretRef
+        secretId: params.githubTokenSecretRef,
+        version: "latest"
       }
     };
     if (JSON.stringify(nextEnv2) === JSON.stringify(currentEnv)) {
@@ -28485,7 +28489,8 @@ async function applyGitHubTokenPropagationUpdate(params) {
   await fetchJson(`/api/agents/${params.agentId}`, {
     method: "PATCH",
     body: JSON.stringify({
-      adapterConfig: nextAdapterConfig
+      adapterConfig: nextAdapterConfig,
+      replaceAdapterConfig: true
     })
   });
 }
@@ -31968,6 +31973,7 @@ function GitHubSyncSettingsPage() {
   const saveRegistration = usePluginAction("settings.saveRegistration");
   const updateBoardAccess = usePluginAction("settings.updateBoardAccess");
   const validateToken = usePluginAction("settings.validateToken");
+  const ensureGitHubTokenAvailable = usePluginAction("settings.ensureGitHubTokenAvailable");
   const runSyncNow = usePluginAction("sync.runNow");
   const cancelSync = usePluginAction("sync.cancel");
   const [form, setForm] = useState2(EMPTY_SETTINGS);
@@ -31995,6 +32001,7 @@ function GitHubSyncSettingsPage() {
   const themeMode = useResolvedThemeMode();
   const boardAccessRequirement = usePaperclipBoardAccessRequirement();
   const armSyncCompletionToast = useSyncCompletionToast(form.syncState, toast);
+  const githubTokenConfigSyncAttemptRef = useRef(null);
   const boardAccessConfigSyncAttemptRef = useRef(null);
   const assigneeFallbackAttemptRef = useRef(null);
   const currentSettings = settings.data ?? cachedSettings;
@@ -32111,6 +32118,76 @@ function GitHubSyncSettingsPage() {
       cancelled = true;
     };
   }, [currentSettings?.availableAssignees?.length, currentSettings?.updatedAt, hostContext.companyId]);
+  useEffect2(() => {
+    const companyId = hostContext.companyId;
+    const secretRef = settings.data?.githubTokenNeedsConfigSync ? settings.data.githubTokenConfigSyncRef : void 0;
+    if (!companyId || !secretRef) {
+      return;
+    }
+    const attemptKey = `${companyId}:${secretRef}`;
+    if (githubTokenConfigSyncAttemptRef.current === attemptKey) {
+      return;
+    }
+    githubTokenConfigSyncAttemptRef.current = attemptKey;
+    let cancelled = false;
+    void (async () => {
+      try {
+        const pluginId = await resolveCurrentPluginId(pluginIdFromLocation);
+        if (!pluginId) {
+          throw new Error("Plugin id is required to finish syncing the GitHub token into plugin config.");
+        }
+        await patchPluginConfig(pluginId, {
+          githubTokenRefs: {
+            [companyId]: secretRef
+          }
+        });
+        const selectedAgentIds = normalizeAgentIds(settings.data?.advancedSettings?.githubTokenPropagationAgentIds);
+        if (selectedAgentIds.length > 0) {
+          await propagateGitHubTokenToSelectedAgents({
+            selectedAgentIds,
+            previousAgentIds: selectedAgentIds,
+            githubTokenSecretRef: secretRef
+          });
+        }
+        if (cancelled) {
+          return;
+        }
+        notifyGitHubSyncSettingsChanged();
+        try {
+          await settings.refresh();
+        } catch {
+          return;
+        }
+      } catch (error) {
+        githubTokenConfigSyncAttemptRef.current = clearGitHubTokenConfigSyncAttemptOnFailure(
+          githubTokenConfigSyncAttemptRef.current,
+          attemptKey
+        );
+        if (cancelled) {
+          return;
+        }
+        toast({
+          title: "GitHub token needs reconnection",
+          body: getActionErrorMessage(
+            error,
+            "GitHub Sync could not finish migrating the saved GitHub token into plugin config."
+          ),
+          tone: "error"
+        });
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [
+    hostContext.companyId,
+    pluginIdFromLocation,
+    settings.data?.advancedSettings?.githubTokenPropagationAgentIds,
+    settings.data?.githubTokenNeedsConfigSync,
+    settings.data?.githubTokenConfigSyncRef,
+    settings.refresh,
+    toast
+  ]);
   useEffect2(() => {
     const companyId = hostContext.companyId;
     const secretRef = settings.data?.paperclipBoardAccessNeedsConfigSync ? settings.data.paperclipBoardAccessConfigSyncRef : void 0;
@@ -32581,6 +32658,16 @@ function GitHubSyncSettingsPage() {
         },
         githubTokenLogin: validation.login
       });
+      let availabilityWarning = null;
+      try {
+        await ensureGitHubTokenAvailable({
+          companyId,
+          githubTokenRef: secret.id,
+          token: trimmedToken
+        });
+      } catch (error) {
+        availabilityWarning = error;
+      }
       const selectedAgentIds = normalizeAgentIds(currentSettings?.advancedSettings?.githubTokenPropagationAgentIds);
       let propagationError = null;
       try {
@@ -32616,6 +32703,16 @@ function GitHubSyncSettingsPage() {
           tone: "error"
         });
       }
+      if (availabilityWarning) {
+        toast({
+          title: "GitHub token saved, but worker token access needs attention",
+          body: getActionErrorMessage(
+            availabilityWarning,
+            "GitHub Sync could not verify worker access to the saved token."
+          ),
+          tone: "error"
+        });
+      }
       notifyGitHubSyncSettingsChanged();
       try {
         await settings.refresh();
@@ -35133,6 +35230,7 @@ export {
   GitHubSyncProjectPullRequestsPage,
   GitHubSyncProjectPullRequestsSidebarItem,
   GitHubSyncSettingsPage,
+  clearGitHubTokenConfigSyncAttemptOnFailure,
   index_default as default,
   resolveGitHubIssueDetailTabState,
   resolveOrCreateProject,