Fix: Consolidation of Identified Codebase Bugs, Security, and Cross-Platform Issues

[purvanshjoshi]

[BUG] Consolidation of Codebase Bugs, Security, and Cross-Platform Issues

Overview

A detailed audit of the codebase has revealed several bugs, cross-platform compatibility issues, formatting errors, and minor security risks. This issue tracks the resolution of all identified problems to ensure the application runs correctly, especially on Windows environments.

---

1. Critical Windows Subprocess Crash (Severity: High)

• Impacted Files:
  • backend/main.py
  • backend/agents.py
• Details:
  On Windows, global Node-installed commands like gitnexus are created as command scripts (gitnexus.cmd or gitnexus.ps1), which are not native PE executables. Executing subprocess.Popen or asyncio.create_subprocess_exec with "gitnexus" directly (without extension or shell=True) raises a FileNotFoundError or NotImplementedError, breaking the lifespan server startup and agent tool execution.
• Suggested Fix:
  Detect the operating system and append .cmd on Windows.

  import platform
  cmd = "gitnexus.cmd" if platform.system() == "Windows" else "gitnexus"

---

2. PyGithub Directory Deletion Crash (Severity: High)

• Impacted File:
  • backend/main.py
• Details:
  In the DELETE endpoint /repo/{repo_name}/file, if a directory is passed to repo.get_contents(file_path), PyGithub returns a list of ContentFile objects rather than a single ContentFile. Accessing .path or .sha directly on a list causes the program to crash with AttributeError: 'list' object has no attribute 'path' and throw a 500 error.
• Suggested Fix:
  Check if the returned content is a list and return a clear error or handle recursive deletion:

  content = repo.get_contents(file_path)
  if isinstance(content, list):
      raise HTTPException(status_code=400, detail="Directories cannot be deleted directly.")

---

3. Missing Local File Synchronization in Agent Loop (Severity: Medium)

• Impacted File:
  • backend/agents.py
• Details:
  The implementer_node writes code and commits it directly to the GitHub remote using PyGithub. However, it never updates the local cloned workspace (repo_dir) on disk. Because the Web IDE reads files from the local clone, the user will see no updates or newly created files in their Web IDE until a manual pull is triggered.
• Suggested Fix:
  Write the generated file content to the local disk clone path inside the implementer_node:

  local_path = os.path.join(repo_dir, path)
  os.makedirs(os.path.dirname(local_path), exist_ok=True)
  with open(local_path, "w", encoding="utf-8") as f:
      f.write(code_to_commit)

---

4. Path Normalization Inconsistency (Severity: Medium)

• Impacted Files:
  • backend/agents.py
  • backend/main.py
• Details:
  In agents.py, local repository directories are mapped using repo.replace('/', '_'), whereas main.py maps them using clean_name = repo_name.replace("/", "_").replace("\\", "_"). If a user enters a path with a backslash on Windows (e.g. owner\repo), it maps to different directories between the cloning phase and API file retrieval endpoints.
• Suggested Fix:
  Use a shared path normalization utility function, such as get_safe_repo_dir, in both modules.

---

5. Table Formatting and Index Bug in Slide Generation (Severity: Low)

• Impacted File:
  • generate_ppt.py
• Details:
  Slide 8 initializes a table with 6 rows:

  table_shape = slide.shapes.add_table(6, 2, ...)

  But the script populates it starting at index 0 up to 4:

  for row_idx, (phase, desc) in enumerate(roadmap):
      table.cell(row_idx, 0).text = phase

  This overwrites row 0 (which should be the header) with the first data item and leaves the last row (row 5) completely blank.
• Suggested Fix:
  Change table rows count to 5 or start the index at 1 after inserting table headers.

---

6. Unhandled Error Response in test_groq.py (Severity: Low)

• Impacted File:
  • test_groq.py
• Details:
  The script parses the response JSON without checking the HTTP status code. If an authentication error or rate limit occurs, response.json() lacks the 'data' key, raising a generic KeyError.
• Suggested Fix:
  Add response.raise_for_status() to output proper request errors.

---

7. Overly Restrictive CORS Policy (Severity: Low)

• Impacted File:
  • backend/main.py
• Details:
  CORS allowed origins are limited strictly to "http://localhost:3000". Attempts to reach the backend from http://127.0.0.1:3000 or deployment URLs like Hugging Face Spaces fail preflight checks, while WebSockets allow them.
• Suggested Fix:
  Add common development and deployment URLs to allow_origins.

---

8. Hardcoded Credentials Security Warning (Severity: Medium)

• Impacted Files:
  • patch_comments.py
  • backend/.env
• Details:
  patch_comments.py contains a hardcoded GitHub token. backend/.env contains hardcoded GROQ_API_KEY, SUPABASE_URL, and SUPABASE_SERVICE_KEY. These keys should be loaded from env variables or local secrets files and not committed to git.

[purvanshjoshi]

Cl failing after merging the PR - NOTE

[purvanshjoshi]

development halted for a week