add automatique upgrade in app import#3489
Conversation
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
|
@BugBot run |
There was a problem hiding this comment.
Code Review
This pull request implements the automatic application of the component tagger upgrade during GitHub imports and repository cloning. It refactors the upgrade logic into a new utility module, updates the UI to handle imported apps more deterministically, and improves the mock GitHub server for testing. Review feedback highlights a high-severity command injection risk in shell command interpolation and suggests more robust parsing for configuration file modifications. Additionally, the reviewer recommends using targeted git staging instead of gitAddAll to avoid committing unrelated files and improving error message accuracy by referencing actual filenames.
There was a problem hiding this comment.
4 issues found across 7 files
Confidence score: 2/5
- There is a high-confidence security risk in
src/ipc/utils/app_upgrade_utils.ts: interpolatingappNameinto ashell: truecommand can enable shell injection duringnpx cap init, so this is not a low-risk merge. src/ipc/handlers/github_handlers.tsappears to swallow upgrade failures after clone, which can report success while leaving apps partially upgraded and user-facingly broken.src/ipc/utils/app_upgrade_utils.tsalso stages withgitAddAll, which can unintentionally commit unrelated local changes; scoping staged files to the upgrade outputs would reduce regression risk.- Pay close attention to
src/ipc/utils/app_upgrade_utils.tsandsrc/ipc/handlers/github_handlers.ts- command execution safety, failure handling, and commit staging behavior need fixes before merging confidently.
Tip: cubic used a learning from your PR history. Let your coding agent read cubic learnings directly with the cubic MCP.
Re-trigger cubic
|
@BugBot run |
858483c to
4bd2f6c
Compare
|
@BugBot run |
4bd2f6c to
17c64ec
Compare
There was a problem hiding this comment.
3 issues found across 6 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
|
@BugBot run |
17c64ec to
33b32b8
Compare
|
@BugBot run |
|
@BugBot run |
There was a problem hiding this comment.
π‘ Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 87aba001b1
βΉοΈ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with π.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
π Dyadbot Code Review SummaryVerdict: β
YES - Ready to merge This PR cleanly extracts the component tagger logic into a shared utility, adds a well-designed opt-out UX, and handles failure gracefully without blocking import. The refactoring reduces duplication, adds a proper No HIGH severity issues found. Several MEDIUM notes below for consideration (none block merge): Issues Summary
New
First π’ Low Priority Notes (4 items)
Generated by Dyadbot persona-based code review |
π Playwright Test Resultsβ Some tests failed
Summary: 1038 passed, 2 failed, 4 flaky, 318 skipped Failed Testsπ macOS
πͺ Windows
π Re-run Failing Tests (macOS)Copy and paste to re-run all failing spec files locally: npm run e2e \
e2e-tests/local_agent_advanced.spec.ts
|
|
@BugBot run |
There was a problem hiding this comment.
π‘ Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f9b3899bdf
βΉοΈ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with π.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
π Dyadbot Code Review SummaryVerdict: β
YES - Ready to merge Well-structured PR that cleanly extracts Issues Summary
π’ Low Priority Notes (5 items)
Generated by Dyadbot persona-based code review |
There was a problem hiding this comment.
1 issue found across 2 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
|
@BugBot run |
There was a problem hiding this comment.
π‘ Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f36939bef9
βΉοΈ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with π.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
π Dyadbot Code Review SummaryVerdict: β NO - Do NOT merge Issues Summary
π΄ HIGH: Test passes wrong argument type to
|
|
@BugBot run |
There was a problem hiding this comment.
π‘ Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d9e5b0319d
βΉοΈ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with π.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@BugBot run |
π Dyadbot Code Review SummaryVerdict: β
YES - Ready to merge This PR cleanly extracts the component tagger logic into a shared utility, adds auto-upgrade on GitHub import with a user opt-out checkbox, and includes solid test coverage (both unit and E2E). The refactoring removes code duplication in Issues Summary
π’ Low Priority Notes (5 items)
Generated by Dyadbot persona-based code review |
|
@BugBot run |
π Dyadbot Code Review SummaryVerdict: β
YES - Ready to merge Well-structured PR that extracts and improves the component tagger logic into a reusable utility, adds a user-facing opt-out checkbox, and includes both unit and E2E test coverage. The refactoring correctly consolidates duplicated code, adds proper rollback on failure, uses Issues Summary
MEDIUM-1: Import insertion uses The import-finding loop uses MEDIUM-2: Behavior change in existing upgrade panel ( The new MEDIUM-3: Checkbox placement differs between tabs ( In the "Your GitHub Repos" tab, the "optimize for Dyad" checkbox is nested inside the "Advanced options" accordion and not visible by default. In the "GitHub URL" tab, the same checkbox is placed directly in the form, always visible. Since the checkbox defaults to MEDIUM-4: Shared
π’ Low Priority Notes (2 items)
Generated by Dyadbot persona-based code review |
|
@BugBot run |
There was a problem hiding this comment.
π‘ Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b61dd2e412
βΉοΈ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with π.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
π Dyadbot Code Review SummaryVerdict: β
YES - Ready to merge This PR cleanly extracts the component tagger logic into a reusable utility module, adds an opt-in/opt-out UI for automatic upgrades during GitHub imports, and includes both unit and E2E test coverage for the new feature. The refactoring deduplicates the import result handling via Issues Summary
π’ Low Priority Notes (6 items)
Generated by Dyadbot persona-based code review |
π Playwright Test Resultsβ Some tests failed
Summary: 1041 passed, 1 failed, 3 flaky, 318 skipped Failed Testsπ macOS
π Re-run Failing Tests (macOS)Copy and paste to re-run all failing spec files locally: npm run e2e \
e2e-tests/local_agent_advanced.spec.ts
|
closes #3451
This PR adds automatic component tagger support during GitHub imports for Vite React apps, so imported projects can be optimized for Dyad features with one click. It also updates the import UI to localize the optimize label, adds a warning toast when the optional upgrade fails, and expands test coverage for the unchecked opt-out path.
test
npm test -- app_upgrade_utils.test.ts
npm run e2e -- github-import.spec.ts --grep "should skip component tagger upgrade when optimize for Dyad is unchecked"
npm run e2e -- github-import.spec.ts --grep "should auto-apply component tagger upgrade on GitHub import"