Repository navigation
feat(codebase): code-aware requirements copilot with GitHub App - #128
Merged
Merged
Conversation
A project connects the client's GitHub repositories. ReqsAI indexes each into a map of modules (endpoints and entities from the code; summary, capabilities and implemented business rules from the AI; an embedding), keeps the stack it detects, never stores raw code and removes secrets before the model reads it. Private repositories use a read-only token stored encrypted. The realtime copilot and the assistant chat now read that map: the prompt carries an EXISTING SYSTEM section with the modules nearest to the conversation, and the model flags each story as already built or in conflict with an implemented rule, citing the modules. Every suggestion keeps the verbatim quote it comes from and the transcript segment holding it, the live card shows both, and an accepted story keeps its origin and code references.
Index JSON/YAML data under source folders, flattened to their values with figures first, so prices and limits in translations or catalogs reach the module rules. Spread the excerpt budget across every file of a module, ask for one rule per plan or item, and tell the copilot that modules are code (never a targetStoryId), that a matching capability means ALREADY_EXISTS and that a conflict compares the same subject.
Several folders of one product came back with the product's name (four modules called Reservas). The summary prompt now asks for the part a folder implements, so the module map and the copilot's references can be told apart.
Like the other token-shaped values in SecretRedactorTest, so no secret scanner flags the source.
The live transcriber cuts one sentence into short segments, so a quote of the client rarely fit one segment and the suggestion lost its link to the moment. QuoteLocator now looks across up to four consecutive segments, verbatim first and then by shared words, and answers the segment where the quote starts.
…-copilot # Conflicts: # CHANGELOG.md
Like Jira, an organization owner or admin installs the App once and picks the repositories ReqsAI may read. The install redirect is linked only with this organization's signed state and an OAuth code showing the GitHub user can access the installation. Projects pick from what the installations share; private repositories are read with installation tokens minted per use and never stored, so the pasted access token and its encryption are gone. Signed webhooks keep the index current: a push reindexes the repository (queued during a run), and a removed repository, an uninstall or a suspension stops the updates and says why. An installation is used only by the organization it is linked to.
A repository whose installation was removed, suspended or disconnected kept its installation id, so it still claimed to update on every push. Revoking now unlinks it, and a retry reads it through the organization's installation that shares it again, once GitHub is connected back.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Copiloto de requisitos que lee el código del cliente (parte API). Un owner/admin conecta GitHub una vez por organización mediante la GitHub App de ReqsAI (solo lectura) y cada proyecto elige sus repositorios, privados incluidos. El código se resume en un mapa de módulos (capacidades y reglas de negocio) y, durante la reunión, cada sugerencia avisa si lo pedido ya existe o contradice el código, con la cita del cliente. La historia aceptada conserva su origen.
codebase: indexación en segundo plano (secretos eliminados, sin guardar código ni credenciales), reindexación incremental y push webhooks firmados.statefirmado y comprobación OAuth, tokens de 1 hora generados al momento y nunca guardados.discovery: sección de código en el prompt, hallazgosALREADY_EXISTS/CONFLICTS_WITH_CODE, evidencia ubicada en el segmento de la transcripción (QuoteLocator).Bounded context / area: discovery, codebase (nuevo), shared
Closes #127
Type of Change
feat— new featureChecklist
developfeature/<issue>-<slug>./gradlew buildpasses locally (1237 tests,verifyModularityincluded)codebase::api).pemkeys are committed (fake tokens are built at runtime)CHANGELOG.mdupdated under[Unreleased]V20261009130000,…130100,…130200,…140000; commonV20261009140000How to Test
CODEBASE_GITHUB_APP_*(verdocs/CODE_COPILOT.md); sin ellas solo se leen repos públicos.Reindexar).Notes
Requiere la GitHub App en producción y sus 5 variables en el vault de
reqsai-infra. PR hermano en reqsai-web: issue #88.