Fix setup token propagation after config stripping

[alvarosanchez]

Summary

• Resolve GitHub token propagation from the freshly returned/saved settings secret ref before falling back to plugin config.
• Keep plugin-config lookup only as a legacy fallback for older state.
• Add a regression for the 0.9.4 failure mode where config secret-ref maps are stripped but settings.registration still exposes the saved GitHub secret ref.

Root Cause

PRs 122 and 123 correctly stopped writing secret refs back into plugin config when the host rejects plugin secret references. The setup save path for adding propagation agents still tried to rediscover the GitHub token ref from plugin config unless the token was saved in that exact submit flow. In production 0.9.4, that leaves no config ref to read, so the UI throws: GitHub token propagation requires a GitHub token saved through this settings page.

The worker already returns githubTokenConfigSyncRef from settings.registration; setup save now uses that state-backed ref directly.

Production Evidence

• Confirmed paperclip-github-plugin@0.9.4 is installed on cliponaut.duckdns.org.
• Confirmed the installed UI bundle has the failing branch: propagateGitHubTokenToSelectedAgents() only checks an explicit option, then /api/plugins/:id/config, then throws the exact production message.

Validation

• pnpm typecheck
• pnpm test
• pnpm build
• pnpm test:e2e

Model Used

GPT-5.5 (gpt-5.5), 400k token context window, medium reasoning, with shell, SSH, GitHub CLI, and local patch tool use.

[Copilot]

Pull request overview

This PR fixes a regression where GitHub token propagation to selected agents could fail after plugin-config secret-ref maps were stripped by the host. The UI now resolves the GitHub token secret ref from the saved settings/registration state first, keeping plugin-config lookup only as a legacy fallback, and adds a regression test for the 0.9.4 failure mode.

Changes:

• Add resolveGitHubTokenSecretRefForPropagation to consistently resolve the token secret ref from (1) explicit input, (2) settings-backed ref, then (3) legacy plugin config.
• Update setup save + propagation flow to pass/use the settings-backed githubTokenConfigSyncRef instead of relying on plugin config.
• Add a regression test covering “settings ref present, config refs stripped” behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/ui/index.tsx	Adds secret-ref resolution helper and updates propagation/setup flows to prioritize settings-backed token refs, with config as fallback.
tests/plugin.spec.ts	Adds a regression test ensuring the resolver prefers saved settings ref when config refs are missing/stripped.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.