Skip to content

feat: add GitHub local project integration and enhance local attachments handling: - #324

Merged
yashdev9274 merged 1 commit into
mainfrom
supercode-cli
Oct 11, 2026
Merged

yashdev9274 merged 1 commit into
mainfrom
supercode-cli

Conversation

@yashdev9274

Copy link
Copy Markdown
Owner

Description

  • Introduced a new API route for creating local projects from GitHub repositories, allowing users to link their GitHub projects directly.
  • Implemented functionality to upsert local projects, ensuring existing projects are updated with the latest data.
  • Enhanced local attachments handling in session messages, increasing the maximum number of local attachments from 8 to 16.
  • Updated the local project context to provide clearer guidance on using attached files during sessions.
  • Added a .gitignore file to exclude Vercel-specific files from version control.

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update
  • Refactor (no functional changes)

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

  • bun test passes
  • bun run typecheck passes
  • bun run lint passes (if applicable)

Checklist:

  • My code follows the project's style guidelines
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works

…nts handling:

- Introduced a new API route for creating local projects from GitHub repositories, allowing users to link their GitHub projects directly.
- Implemented functionality to upsert local projects, ensuring existing projects are updated with the latest data.
- Enhanced local attachments handling in session messages, increasing the maximum number of local attachments from 8 to 16.
- Updated the local project context to provide clearer guidance on using attached files during sessions.
- Added a .gitignore file to exclude Vercel-specific files from version control.
@vercel

vercel Bot commented Oct 11, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
supercli Ready Ready Preview Oct 11, 2026 5:33am UTC
supercli-client Ready Ready Preview Oct 11, 2026 5:33am UTC
supercli-docs Ready Ready Preview Oct 11, 2026 5:33am UTC
1 Skipped Deployment
Project Deployment Actions Updated
vercel-supercodeai-integration Skipped Skipped Oct 11, 2026 5:33am UTC

@coderabbitai

coderabbitai Bot commented Oct 11, 2026

Copy link
Copy Markdown

Review in Change Stack →

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 92c06252-572a-4d01-9821-084bc333e3b3

📥 Commits

Reviewing files that changed from the base of the PR and between 44fc27f and dff9a34.


⛔ Files ignored due to path filters (2)
  • apps/web/public/brand/nova-icon-128.png is excluded by !**/*.png
  • apps/web/public/brand/nova-icon.png is excluded by !**/*.png

📒 Files selected for processing (31)
  • apps/web/.gitignore
  • apps/web/app/api/nova/local-projects/from-github/route.ts
  • apps/web/app/api/nova/sessions/[sessionId]/turn/route.ts
  • apps/web/modules/nova-web/api.ts
  • apps/web/modules/nova-web/components/home.tsx
  • apps/web/modules/nova-web/components/nova-icon.tsx
  • apps/web/modules/nova-web/components/project-picker.tsx
  • apps/web/modules/nova-web/components/settings.tsx
  • apps/web/modules/nova-web/components/sidebar.tsx
  • apps/web/modules/nova-web/components/thread.tsx
  • apps/web/modules/nova-web/components/timeline.tsx
  • apps/web/modules/nova-web/components/working-process.tsx
  • apps/web/modules/nova-web/local-workspace.ts
  • apps/web/modules/nova-web/models.ts
  • apps/web/modules/nova-web/nova-app.tsx
  • apps/web/modules/nova-web/nova-login.tsx
  • apps/web/modules/nova-web/project-pack.ts
  • apps/web/modules/nova-web/settings-sections.ts
  • apps/web/modules/nova-web/working-steps.ts
  • apps/web/modules/nova/attachments/contracts.test.ts
  • apps/web/modules/nova/attachments/contracts.ts
  • apps/web/modules/nova/harness/agent.test.ts
  • apps/web/modules/nova/harness/agent.ts
  • apps/web/modules/nova/local-projects/github.ts
  • apps/web/modules/nova/local-projects/pack.ts
  • apps/web/modules/nova/local-projects/rank-paths.test.ts
  • apps/web/modules/nova/local-projects/rank-paths.ts
  • apps/web/modules/nova/local-projects/service.ts
  • apps/web/modules/nova/sessions/local-attachments-turn.test.ts
  • apps/web/modules/nova/sessions/service.ts
  • apps/web/modules/nova/sessions/turn.ts

 _______________________________
< This hotfix needs oven mitts. >
 -------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR

🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@yashdev9274
yashdev9274 merged commit 411b9d6 into main Oct 11, 2026
7 of 11 checks passed
@greptile-apps

greptile-apps Bot commented Oct 11, 2026 •

Copy link
Copy Markdown

RetriggerConfidence Score: 0/5 Tier: plus

[Medium impact] Adds GitHub project integration and local attachment handling.

Do not merge until the private-file disclosure paths and broken attachment flows are fixed.

Findings

  1. P1 Security Email selects another account ▶
  2. P1 Security Cleared projects still upload files ▶
  3. P1 Uploaded images lose their pixels ▶
  4. P1 GitHub file mentions cannot attach ▶
  5. P1 Packing skips supported source languages ▶
  6. P1 Long paths block ordinary turns ▶
  7. P2 Work logs vanish after reload ▶
  8. P2 Proposed patches look already applied ▶
  9. P2 Project instructions conflict with modes ▶
  10. P2 Refresh can create duplicate projects ▶
  11. P2 Complete indexes appear partial ▶
  12. P2 GitHub management opens the profile ▶
  13. P2 Project actions do nothing ▶
  14. P2 Automatic context needs a budget ▶

Summary

Adds GitHub-backed projects, a project picker, and a projects settings page. Turns now automatically gather relevant source files, accept 16 attachments, apply mode instructions, and show a completed working log.

  • Nova web can use connected GitHub repositories as projects.
  • Nova web turns use clear modes and readable project files.
  • The thread shows which files Nova reads and proposes to change.
  • Nova's login, sidebar, and timeline use the shared app icon.
  • The web app ignores its local .vercel files.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Picker["Choose folder or GitHub project"] --> Project["Save project and path index"]
  Project --> Bind["Bind project to session"]
  Message["Send message"] --> BrowserPack["Pack files from browser folder"]
  BrowserPack --> Turn["POST session turn"]
  Bind --> Turn
  Turn --> Context["Load session and project"]
  Context --> GithubPack["Pack GitHub source files"]
  GithubPack --> Prompt["Add project paths and source text"]
  Prompt --> Harness["Send messages to harness"]
  Harness --> Answer["Stream answer"]
  Answer --> Activities["Save response and work activities"]
  Activities --> LiveLog["Show completed working log"]
Loading

Reviews (1) · Last reviewed commit: "feat: add GitHub local project integrati..." · Reviewed by Greptile

Comment on lines +24 to +26
const account = await terminalPrisma.account.findFirst({
where: { providerId: "github", user: { email: { equals: user.email, mode: "insensitive" } } },
select: { accessToken: true, accessTokenExpiresAt: true },

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Email selects another account

If the caller's GitHub authorization is unavailable, this fallback selects a terminal account's token by their stored email. updateUserProfile lets the caller change that email without proving ownership. They can also create a local project with any repositoryFullName and paths; unlike indexGithubRepository, packGithubProjectForTurn never checks repository ownership. Together, these paths allow reads of another person's private files. Require a verified account link and check repository access before fetching.

How this was verified: An authenticated profile update controls the email used to select the terminal GitHub token, and caller-supplied project paths reach getContent without a repository ownership check.

Comment on lines +385 to +387
if (selection.kind === "none") {
setLocalProject(null)
setVirtualProjectIndex(null)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Cleared projects still upload files

After opening a local folder, selecting “No project” only clears localProject and virtualProject. The old memoryState, memoryHandle, and cached file handles remain active. Switching to GitHub leaves them active too. Both workspace getters still prefer the old folder, so the next runTurn binds it again and automatically uploads its files. Clear or replace the active folder state when switching, and pack only the selected project.

How this was verified: The selection leaves the old folder handles intact, the workspace getters return that folder first, and the next turn sends files read through those handles.

Comment on lines +580 to +589
const imageNotes = localAttachments
.filter((file) => file.kind === "image" && file.dataBase64)
.map((file) => `Image attachment “${file.name}” (${file.mediaType}, ${file.size} bytes) was provided as base64 and is available to vision-capable routes.`)
if (imageNotes.length) {
text += `\n\n${imageNotes.join("\n")}`
}
if (mode === "agent") {
text += `\n\n[Nova agent mode] Implement now. Prefer full file replacements with path= fences for every file you change. Do not reply with only a plan.`
}
userMessage.content = text

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Uploaded images lose their pixels

Image attachments now become filename and size notes rather than image parts. No image bytes reach streamHarnessChat, despite the note saying they are available to vision routes. flattenHarnessContent also drops image parts from other callers. Screenshot questions therefore stop working even on vision-capable models. Preserve image parts through both functions and fix string conversion only on routes that need it.

Comment on lines +393 to +396
const labelRoot = state.displayName || state.rootName
// GitHub-backed virtual projects still use local: ids for path search UX;
// content is resolved via attachments or GitHub references on the server.
return matched.slice(0, limit).map((entry) => localFileReference(entry, labelRoot, state.projectId))

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 GitHub file mentions cannot attach

GitHub-backed virtual entries now receive local: IDs. The file picker puts them before remote results, but Composer.pickReference treats every local: ID as a browser-folder file. With no folder handle, selecting one returns “Local file is no longer available” and never attaches it. Emit a server-resolvable GitHub reference or add a GitHub read path for these entries.

Comment on lines +230 to +234
export function isLikelyTextProjectPath(path: string): boolean {
const base = path.toLowerCase().split("/").pop() || ""
if (CONFIG_NAMES.has(base)) return true
return SOURCE_EXT.test(base)
|| /\.(json|ya?ml|toml|svg|graphql|gql|sql|prisma|env|sh|html)$/i.test(base)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Packing skips supported source languages

indexGithubRepository indexes Python, Go, Rust, Java, and other supported files through isReferenceFile, but this second filter removes them before fetching. A project containing main.py and requirements.txt sends the requirements but never the Python source, even when the request names main.py. Use the same supported-file rules for indexing and packing, and include these languages in SOURCE_EXT.

Comment on lines +74 to +76
const existing = (await listLocalProjects(userId)).find(
(project) => project.repositoryFullName?.toLowerCase() === fullName.toLowerCase(),
)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Refresh can create duplicate projects

This lookup searches only the recent-project list. listLocalProjects returns 50 active projects, so an older match is missed and duplicated. Concurrent requests can also both miss the project and create separate rows because there is no unique repository key. Look up the repository directly and make the create-or-update operation safe for concurrent requests.


return {
paths,
truncated: Boolean(tree.truncated) || (tree.tree?.length ?? 0) > paths.length,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Complete indexes appear partial

tree.tree includes directories and unsupported files, while paths contains only supported blobs. Comparing their lengths marks a complete repository as truncated whenever it contains a directory or an ignored file. Users and the model then receive a false partial-index warning. Compare the supported path count before and after the limit, while retaining GitHub's tree.truncated flag.


<button
type="button"
onClick={() => onNavigate("/settings?section=profile")}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 GitHub management opens the profile

“Manage the GitHub installation” opens the profile page, which only shows account details and account deletion guidance. It has no GitHub connection or installation controls. Users with missing repositories reach a page that cannot help them. Point the button to the actual GitHub setup flow.

Comment on lines +504 to +509
<button
type="button"
className="flex size-7 items-center justify-center rounded-md text-[#5c5c5c] hover:bg-white/[0.05] hover:text-[#c8c8c8]"
aria-label="Project actions"
>
<MoreHorizontal className="size-3.5" />

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Project actions do nothing

Each new project row offers a “Project actions” button with no click handler or menu. Clicking it gives users no response. Wire it to supported project actions, or remove it until those actions exist.

Comment on lines +561 to +564
const packedAttachments = await packLocalProjectForTurn(
content,
opts?.localAttachments ?? [],
)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Automatic context needs a budget

Every turn now automatically adds up to 16 source files, but packing only checks file counts and bytes. Local reads retain up to 120,000 characters per file, so nearly 1.92 million characters can be appended after buildTurnContext applies its 24,000-character history limit. This can overwhelm smaller models and sharply increase input cost without the user choosing those attachments. Give automatic packing a total text budget and report files shortened or omitted.

This branch was successfully deployed

3 active and 1 inactive deployments
Preview – supercli — dff9a342 Deployed Oct 11, 2026 by vercel[bot]
Preview – supercli-docs — dff9a342 Deployed Oct 11, 2026 by vercel[bot]
Preview – supercli-client — dff9a342 Deployed Oct 11, 2026 by vercel[bot]
Preview – vercel-supercodeai-integration — dff9a342 Deployed Oct 11, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant