feat: detect framework on directory browse

[ubadineke]

Adds framework auto-detection to the directory picker when browsing a GitHub repo — folders show a badge (Next.js, Go, Rust, etc.) as you expand them, resolved cheaply: a free hint from the repo's file tree on load, upgraded to a precise read only when you open a folder, and the root directory resolves immediately since it's just one read. Keeps GitHub API usage bounded even on large repos.

Also found and fixed two pre-existing bugs while building this:

• A subfolder with no manifest of its own could inherit the repo root's framework by mistake (readPackageJsons had an unconditional fallback to root's package.json) — previously only reachable if you deliberately picked such a folder as your deploy root, now closed for good
• Next.js's icon rendered as a blank white circle from a broken SVG (leftover React-generated IDs) combined with a CSS filter that isn't safe for gradient-based icon

---

Summary by cubic

Add framework auto-detection to the GitHub directory picker. Folders show badges as you browse with one tree fetch, then upgrade to precise detection when you open or select a folder; the root badge is resolved precisely up front.

• New Features

  • Coarse badges come from a cached repo tree; precise detection is deferred to a new on-demand endpoint and only reads files that actually exist.
  • Root directory returns rootFramework with the initial listing; rows include framework. UI shows a FrameworkMark on folder rows and on the root.
  • Server adds TTL caches for the repo tree and framework results with in-flight de‑dupe; client caches directory listings and per‑path frameworks.
  • JS/TS detection supports exactPathOnly to avoid workspace bleed; file-rule detector accepts known filenames to skip speculative reads.

• Bug Fixes

  • Subfolders no longer inherit the repo root’s package.json framework.
  • Next.js icon now renders correctly by cleaning SVG IDs and adjusting color handling.
  • Detection accuracy: Rust workspaces (Cargo [workspace]), Gradle builds, and Python (via requirements.txt/pyproject.toml presence) are recognized.
  • Avoid duplicate requests and stale updates when toggling quickly or switching repos.
  • Block path traversal by rejecting .. segments in exact-path package.json reads and GitHub file access.

^{Written for commit 734ab60. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 13 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/server/framework-tree-detector.ts">

<violation number="1" location="src/server/framework-tree-detector.ts:13">
P2: Folders with an ordinary `requirements.txt` can initially show a Python badge, then lose it when opened because precise detection returns no match unless the file contains Django/Flask or configured commands mention Python. This contradicts the coarse layer's no-false-positive rule; omit content-gated manifest names (the same issue affects several entries here) or make precise detection accept the same presence signal.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Folders with an ordinary requirements.txt can initially show a Python badge, then lose it when opened because precise detection returns no match unless the file contains Django/Flask or configured commands mention Python. This contradicts the coarse layer's no-false-positive rule; omit content-gated manifest names (the same issue affects several entries here) or make precise detection accept the same presence signal.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/server/framework-tree-detector.ts, line 13:

<comment>Folders with an ordinary `requirements.txt` can initially show a Python badge, then lose it when opened because precise detection returns no match unless the file contains Django/Flask or configured commands mention Python. This contradicts the coarse layer's no-false-positive rule; omit content-gated manifest names (the same issue affects several entries here) or make precise detection accept the same presence signal.</comment>

<file context>
@@ -0,0 +1,62 @@
+const FAMILY_SLUG_BY_FILE_NAME: Record<string, string> = {
+  "go.mod": "golang",
+  "Cargo.toml": "rust",
+  "requirements.txt": "python",
+  "pyproject.toml": "python",
+  "main.py": "python",
</file context>

[cubic-dev-ai]

All reported issues were addressed across 6 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[Adedoyin-Emmanuel]

@ubadineke can we add a video to illustrate this feature better?

[Adedoyin-Emmanuel]

Also, look into the comments raised by the PR review bot.

[ubadineke]

@ubadineke can we add a video to illustrate this feature better?

https://x.com/ubadinekethedev/status/2076081755207959008?s=20 this is a video highlighting the feature to be added.

@Adedoyin-Emmanuel

[Adedoyin-Emmanuel]

@ubadineke can we add a video to illustrate this feature better?

https://x.com/ubadinekethedev/status/2076081755207959008?s=20 this is a video highlighting the feature to be added.

@Adedoyin-Emmanuel

Awesome, Great work. I will look into it and keep you posted too.