feat: Add GitHub Account Binding, One-click Sync & Security Updates by Che-Zhu · Pull Request #112 · FullAgent/fulling

Che-Zhu · 2025-12-11T15:22:27Z

Summary

This PR introduces full GitHub integration capabilities, enabling users to bind their GitHub accounts via OAuth and synchronize their project code to a remote GitHub repository with a single click. It also includes critical security updates and UX improvements for a seamless authentication flow.

It addresses the need for users to easily backup their work and manage version control without leaving the application interface or manually using the command line.

Key Features

1. GitHub Account Binding (OAuth) & UX Improvements

Account Linking: Implemented GitHub OAuth flow allowing logged-in users to bind their GitHub account to their existing identity.
[NEW] Auto-prompt for Binding: Improved the UX by implementing a strict check for GitHub identity. If a user attempts to sync or commit without binding, the Settings Dialog automatically pops up and navigates to the GitHub tab, guiding the user to connect immediately.
Security: Used state parameter with CSRF protection to prevent unauthorized binding attempts.
Settings UI: Added a new "GitHub" tab in the Settings dialog to view binding status and unlink accounts.

2. One-click Repository Synchronization

Auto Initialization: Automated the git init and GitHub repository creation process.
AI-Enhanced Commits: Integrated claude CLI to automatically generate descriptive commit messages for staged changes.
Remote Execution: Built a secure WebSocket-based execution pipeline (ttyd-exec) to run git commands directly in the user's sandbox environment.
Status Indicator: Added a real-time repository status indicator in the bottom status bar, supporting instant sync and linking to the remote repo.

Security Updates

Critical Dependency Update: Bumped next to 16.0.10 to address security vulnerabilities CVE-2025-55184 (DoS via malicious HTTP request) and CVE-2025-55183 (Source code exposure).
Error Propagation: Enhanced repoService to strictly propagate GITHUB_NOT_BOUND error codes, ensuring precise frontend handling and preventing silent failures.

Technical Details

Remote Execution (ttyd-exec): reliable command execution via WebSocket connection to the sandbox's ttyd instance, handling authentication and output parsing.
Service Layer (RepoService): Encapsulates all git logic including createGithubRepo (via GitHub API) and pushToGithub (via git remote operations).
Security: IDOR protection is enforced in getTtydContext, ensuring users can only execute commands on projects they explicitly own.

Verification Plan

Account Binding: Verified that a user can successfully link and unlink a GitHub account.
[NEW] Unbound UX: Verified that clicking "Sync to GitHub" without an account correctly triggers the Settings Dialog.
Repo Creation: Verified that clicking "Sync to GitHub" creates a new private repository on the user's GitHub.
Code Push: Verified that local changes are correctly committed (with AI messages) and pushed to the remote branch.
Security: Verified that accessing another user's project execution context throws an unauthorized error, and verified the application build with the new Next.js version.

Implement GitHub OAuth binding functionality that allows users (e.g., password-authenticated users) to link their GitHub accounts to their existing sessions. Changes: - Add GitHub binding status API (GET /api/user/github) - Add GitHub unbind API (DELETE /api/user/github) - Add OAuth initiation endpoint (GET /api/user/github/bind) - Add OAuth callback handler (GET /api/auth/github/callback) - Add GitHub tab to Settings Dialog with binding UI - Implement popup-based OAuth flow with postMessage communication Technical details: - Use CSRF protection with state parameter stored in httpOnly cookie - Store GitHub credentials in UserIdentity.metadata (token, login, avatar) - Prevent unbinding if GitHub is the only login method - Set isPrimary=false for binding (not primary authentication) - State expires after 10 minutes for security The binding flow uses a popup window to avoid disrupting the main application, with automatic status refresh upon successful binding.

- Integrate pushToGithub into initializeRepo and commitChanges workflows to ensure code syncs to remote. - Add router.refresh() in RepoStatusIndicator to update UI state immediately after initialization. - Refactor RepoStatusIndicator to use semantic button elements for accessibility. - Enhance UI with better loading states and adjusted icon sizes.

Che-Zhu · 2025-12-11T15:27:39Z

Please hold off on merging this PR. I have one more change to make.

It's missing one edge case: attempting to sync a project to GitHub without a linked GitHub account.

github-actions · 2025-12-11T15:28:10Z

✅ PR Check Results: Passed

Build Checks

Check	Status
Lint & Build	✅ Passed
Docker Build	✅ Passed

✨ Great work!

All checks passed successfully. Your PR is ready for review.

Details:

✅ Code quality verified (linting passed)
✅ Build successful
✅ Docker image build verified (linux/amd64)
Commit: 90fdc60e39ff422918139a9acff68b8ed19e1299
Branch: feat/github-account-binding

🔗 View Details:

…ervice

Update repoService to propagate 'GITHUB_NOT_BOUND' error code when identity is missing. Update RepoStatusIndicator to catch this error and trigger the local SettingsDialog, streamlining the authentication flow.

Addresses CVE-2025-55184 and CVE-2025-55183. Ref: https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183

Copilot

Pull request overview

This PR introduces comprehensive GitHub integration features including OAuth account binding, one-click repository synchronization, and AI-enhanced git commits. It also addresses critical security vulnerabilities by updating Next.js from 16.0.7 to 16.0.10 to patch CVE-2025-55184 (DoS) and CVE-2025-55183 (source code exposure).

Key changes include:

GitHub OAuth binding flow with CSRF protection for secure account linking
Automated repository creation and code synchronization via WebSocket-based command execution
UI improvements with auto-prompt for GitHub binding and real-time repository status indicator
Security-focused error propagation for GITHUB_NOT_BOUND states

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
pnpm-lock.yaml	Updates Next.js and related packages from 16.0.7 to 16.0.10 for security patches
package.json	Specifies Next.js version 16.0.10 as dependency
lib/util/ttyd-exec.ts	Adds optional timeout parameter to execCommand for longer-running git operations
lib/services/repoService.ts	New service implementing git repository initialization, GitHub repo creation, commit/push operations with ownership validation
components/layout/status-bar.tsx	Integrates RepoStatusIndicator component and makes project prop required
components/layout/repo-status-indicator.tsx	New component providing GitHub sync UI with loading states and Settings dialog integration
components/dialog/settings-dialog.tsx	Adds GitHub tab for account binding/unbinding with OAuth popup flow
app/api/user/github/route.ts	New API endpoints for retrieving GitHub binding status and unbinding accounts
app/api/user/github/bind/route.ts	Initiates GitHub OAuth flow with state parameter for CSRF protection
app/api/auth/github/callback/route.ts	Handles OAuth callback, validates state, exchanges code for token, and creates UserIdentity

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

lib/services/repoService.ts

components/dialog/settings-dialog.tsx

components/layout/repo-status-indicator.tsx

lib/services/repoService.ts

app/api/auth/github/callback/route.ts

lib/services/repoService.ts

app/api/auth/github/callback/route.ts

lib/services/repoService.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Che-Zhu added 5 commits December 5, 2025 15:20

Merge branch 'FullAgent:main' into feat/github-account-binding

91920e1

add repo connection status to status bar

63ea875

fix lint issue

afa6163

Che-Zhu added 3 commits December 12, 2025 14:22

fix(security): sanitize repo URL and patch command injection in repoS…

217bb2a

…ervice

feat(repo): auto-prompt settings dialog when GitHub is not bound

106a1dc

Update repoService to propagate 'GITHUB_NOT_BOUND' error code when identity is missing. Update RepoStatusIndicator to catch this error and trigger the local SettingsDialog, streamlining the authentication flow.

chore(deps): bump next.js to 16.0.10 for security fixes

1c09474

Addresses CVE-2025-55184 and CVE-2025-55183. Ref: https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183

Che-Zhu changed the title ~~feat: Add GitHub Account Binding and One-click Repository Sync~~ feat: Add GitHub Account Binding, One-click Sync & Security Updates Dec 12, 2025

HUAHUAI23 requested a review from Copilot December 12, 2025 07:31

Copilot started reviewing on behalf of HUAHUAI23 December 12, 2025 07:32 View session

Copilot AI reviewed Dec 12, 2025

View reviewed changes

Che-Zhu and others added 3 commits December 12, 2025 15:56

Update lib/services/repoService.ts

34c6d74

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update lib/services/repoService.ts

90fdc60

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update components/layout/status-bar.tsx

253e1a5

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Che-Zhu merged commit 82ba12a into FullAgent:main Dec 12, 2025
9 checks passed

Che-Zhu deleted the feat/github-account-binding branch December 16, 2025 12:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add GitHub Account Binding, One-click Sync & Security Updates#112

feat: Add GitHub Account Binding, One-click Sync & Security Updates#112
Che-Zhu merged 11 commits intoFullAgent:mainfrom
Che-Zhu:feat/github-account-binding

Che-Zhu commented Dec 11, 2025 •

edited

Loading

Uh oh!

Che-Zhu commented Dec 11, 2025

Uh oh!

github-actions bot commented Dec 11, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Che-Zhu commented Dec 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Key Features

1. GitHub Account Binding (OAuth) & UX Improvements

2. One-click Repository Synchronization

Security Updates

Technical Details

Verification Plan

Uh oh!

Che-Zhu commented Dec 11, 2025

Uh oh!

github-actions bot commented Dec 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ PR Check Results: Passed

Build Checks

✨ Great work!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Che-Zhu commented Dec 11, 2025 •

edited

Loading

github-actions bot commented Dec 11, 2025 •

edited

Loading