feat: add GitHub project import + fix Agent tab scroll (shallow clone, heavy-dir stripping, /github slash command, UI box)

Adds GitHub import + Agent tab scroll fix:
- New tool: code/tools/github.py — import_github_repo() shallow-clones any
public GitHub repo into the sandboxed workspace, strips .git/node_modules/
__pycache__/.venv/dist/build/etc., and supports branch + subdir + target_subdir.
- New API: import_github(url, branch, subdir, target_subdir, depth, timeout)
- New API: github_url_examples() — return accepted URL formats
- New slash command: /github <url> [subdir] [--branch X] [--into Y]
- New UI: 'Import Project from GitHub' box at the top of the Agent tab.
Paste a URL → click Import → workspace tree refreshes → agent mode auto-enables.
- CSS fix: #pane-agent and #pane-deploy now use display:block !important
so the single .deploy-section child can grow and trigger overflow scrolling.
- Updated README.md and CLAUDE.md with new feature docs and module tree.

CLAUDE.md

@@ -26,7 +26,8 @@ code/
 ├── tools/
 │   ├── fs.py                   ← read_file, write_file, edit_file, glob, grep, list_dir
 │   ├── bash.py                 ← Sandboxed shell execution
-│   └── todos.py                ← Todo list management
+│   ├── todos.py                ← Todo list management
+│   └── github.py               ← GitHub repo import (shallow clone + strip heavy dirs)
 ├── skills/
 │   ├── __init__.py             ← Skill discovery + loading
 │   └── builtins/               ← Built-in skills (markdown)
@@ -35,7 +36,7 @@ code/
 │   └── builtins/               ← Built-in agents (code-reviewer, test-writer)
 ├── commands/
 │   ├── __init__.py             ← Slash command parser + expander
-│   └── builtins/               ← Built-in commands (markdown, includes /agent)
+│   └── builtins/               ← Built-in commands (markdown, includes /agent and /github)
 ├── hooks/
 │   ├── __init__.py             ← Hook rule engine
 │   └── builtins/               ← Built-in hook rules (markdown)
@@ -115,6 +116,7 @@ content: |
 | `/agent show <name>` | Show an agent's full definition |
 | `/agent delete <name>` | Delete a user-defined agent |
 | `/agent reset` | Reset to default SoniCoder persona |
+| `/github <url> [subdir] [--branch <name>] [--into <path>]` | Import a GitHub repo into the workspace |
 | `/help` | Show available commands and skills |
 
 ## Custom Agents
@@ -172,11 +174,52 @@ and any hard rules.
 | `save_agent(...)` | Create or overwrite a user agent (manual save) |
 | `delete_agent(name)` | Delete a user agent (built-ins protected) |
 | `set_active_agent(name)` | Set/clear the active agent for subsequent prompts |
+| `import_github(url, branch, subdir, target_subdir, depth, timeout)` | Clone a GitHub repo into the workspace (shallow, heavy dirs stripped) |
+| `github_url_examples()` | Return accepted GitHub URL formats |
 
 The `agent_run` endpoint also intercepts `/agent use|reset|delete|list` and
 dispatches them directly to the agents module, bypassing the model entirely
 for instant session-state updates.
 
+## GitHub Import
+
+SoniCoder can clone any public GitHub repo into the workspace, allowing the
+agent to read, edit, extend, or refactor real-world code.
+
+### How it works
+
+1. User submits a GitHub URL via the Agent tab UI box (or via `/github <url>`
+   slash command in chat while Agent mode is ON).
+2. The backend (`code/tools/github.py::import_github_repo`) parses the URL
+   (supports HTTPS, SSH, and `/tree/<branch>/<subdir>` forms) and validates
+   that the host is `github.com`.
+3. The repo is shallow-cloned (`git clone --depth 1 --single-branch`) into a
+   temp directory.
+4. Files are *copied* into the workspace (root or `target_subdir`) with these
+   directories stripped: `.git`, `.hg`, `.svn`, `node_modules`, `__pycache__`,
+   `.venv`, `venv`, `env`, `.tox`, `.mypy_cache`, `.pytest_cache`,
+   `.ruff_cache`, `dist`, `build`, `.next`, `.nuxt`, `.cache`, `.gradle`,
+   `target`, `Pods`. `.DS_Store` and `Thumbs.db` are also dropped.
+5. The workspace tree refreshes; Agent mode auto-enables if it wasn't already.
+
+### Security
+
+- Only `github.com` URLs are accepted (HTTPS or SSH form).
+- `target_subdir` is sanitized — no path escapes.
+- The upstream repo is never modified (clone happens in temp dir, then
+  copied). The `.git` directory is stripped so the agent doesn't walk it.
+- Default clone timeout: 120s (UI uses 180s). Max: 600s.
+
+### Slash command
+
+```
+/github <url> [subdir] [--branch <name>] [--into <path>] [--depth <N>] [--timeout <s>]
+```
+
+The slash command (defined in `code/commands/builtins/github.md`) instructs
+the agent to invoke `import_github_repo` via bash, then list the top-level
+files and suggest next steps based on what was imported.
+
 ## Skills
 
 | Skill | Description |

README.md

@@ -23,8 +23,9 @@ Inspired by [Claude Code](https://github.com/anthropics/claude-code), SoniCoder
 
 - 🤖 **Agent Loop** — model calls tools (read/write/edit/glob/grep/bash/todos) in a feedback loop
 - 🎯 **Skills System** — load markdown skill files at runtime (frontend-design, feature-dev, code-review, debugging, fullstack-scaffold, commit-workflow)
-- ⚡ **Slash Commands** — `/commit`, `/review`, `/feature`, `/design`, `/explain`, `/test`, `/refactor`, `/skill`, `/agent`, `/help`
+- ⚡ **Slash Commands** — `/commit`, `/review`, `/feature`, `/design`, `/explain`, `/test`, `/refactor`, `/skill`, `/agent`, `/github`, `/help`
 - 🧠 **Custom Agents** — describe a specialized agent in natural language and the AI generates a full persona (system prompt + tool whitelist + auto-loaded skills + temperature + max iterations). Activate via `/agent use <name>` or the Agents panel. Built-ins: `code-reviewer`, `test-writer`.
+- 📥 **GitHub Import** — paste any GitHub URL (or use `/github <url>`) to shallow-clone a repo into the workspace. Heavy dirs (`.git`, `node_modules`, `__pycache__`, `.venv`, `dist`) are stripped automatically. Supports `branch`, `subdir`, and `target_subdir` options.
 - 🪝 **Hooks System** — pre/post tool execution rules (block dangerous commands, warn on debug code/secrets)
 - 📁 **Sandboxed Workspace** — agent manipulates files in `./workspace/` (path-escape protected)
 - ✅ **Todo Lists** — track multi-step tasks Claude Code-style
@@ -93,8 +94,43 @@ The agent can call these tools (Claude Code-style):
 | `/agent show <name>` | Display an agent's full definition |
 | `/agent delete <name>` | Delete a user-defined agent |
 | `/agent reset` | Reset to default SoniCoder persona |
+| `/github <url> [subdir] [--branch <name>] [--into <path>]` | **Import a GitHub repo into the workspace** (shallow clone, heavy dirs stripped) |
 | `/help` | Show available commands and skills |
 
+### GitHub Import
+
+SoniCoder can clone any public GitHub repository into the sandboxed workspace so the agent can read, edit, extend, or refactor it. Imported repos are shallow-cloned (depth 1) and stripped of heavy directories (`.git`, `node_modules`, `__pycache__`, `.venv`, `dist`, `build`, etc.) to keep the workspace lean.
+
+**Accepted URL formats:**
+
+- `https://github.com/<owner>/<repo>`
+- `https://github.com/<owner>/<repo>.git`
+- `https://github.com/<owner>/<repo>/tree/<branch>` — checkout a specific branch
+- `https://github.com/<owner>/<repo>/tree/<branch>/<subdir>` — import only a sub-directory
+- `git@github.com:<owner>/<repo>.git` — SSH form (rewritten to HTTPS internally)
+
+**Two ways to import:**
+
+1. **Via the Agent tab UI**: Open the **Agent** tab, paste the GitHub URL into the "Import Project from GitHub" box at the top, optionally specify `branch`, `subdir`, or `into path`, then click **⬇ Import**. The workspace tree and todo list refresh automatically, and agent mode is enabled if it wasn't already.
+2. **Via the `/github` slash command** (Agent mode): Type `/github https://github.com/owner/repo` in chat. The agent runs the import, lists the top-level files, and suggests next steps. Flags: `--branch <name>`, `--into <path>`, `--depth <N>`.
+
+**Examples:**
+
+```
+/github https://github.com/fastapi/fastapi
+/github https://github.com/vercel/next.js examples/with-typescript --into next-ts-demo
+/github https://github.com/pallets/flask --branch 2.3.x
+```
+
+**API endpoints:**
+
+| Endpoint | Description |
+|----------|-------------|
+| `import_github(url, branch, subdir, target_subdir, depth, timeout)` | Clone a GitHub repo into the workspace |
+| `github_url_examples()` | Return accepted URL formats and notes |
+
+**Security:** Only `github.com` URLs are accepted (HTTPS or SSH form). The clone happens in a temp directory and is then *copied* into the workspace — the upstream repo is never modified. Path-escape protection on `target_subdir` prevents writing outside the workspace.
+
 ### Custom Agents
 
 Custom agents are AI-generated personas that layer on top of the base SoniCoder system prompt. Each agent defines:

code/commands/builtins/github.md

@@ -0,0 +1,64 @@
+---
+name: github
+description: Import a GitHub repository into the workspace so the agent can edit it
+argument-hint: <github-url> [subdir] [--branch <name>] [--into <path>]
+allowed-tools: read_file, write_file, edit_file, multi_edit, list_dir, glob, grep, bash, todo_read, todo_write, todo_update
+---
+# GitHub Import Command
+
+The user invoked `/github` with arguments: `$ARGUMENTS`
+
+## Parse the arguments
+
+The argument string after `/github ` is `$ARGUMENTS`. Parse it as:
+
+* A required **GitHub URL** (first token starting with `https://github.com/` or `git@github.com:`).
+* An optional **subdir** — the second positional token if it doesn't start with `--`.
+* Optional flags:
+    * `--branch <name>` — checkout this branch/tag instead of the URL's default.
+    * `--into <path>` — place the import under `<path>/` inside the workspace instead of the root.
+    * `--depth <N>` — git clone depth (default 1).
+    * `--timeout <s>` — clone timeout in seconds (default 120).
+
+## Execute the import
+
+Use the `bash` tool to call the Python helper directly:
+
+```bash
+python -c "from code.tools.github import import_github_repo; import json; print(json.dumps(import_github_repo(url='<URL>', branch='<BRANCH>', subdir='<SUBDIR>', target_subdir='<INTO>', depth=<DEPTH>, timeout=<TIMEOUT>), default=str))"
+```
+
+(Quote arguments correctly; if any are empty, pass the empty string.)
+
+If the bash tool is unavailable, use `write_file` to drop a small script and then run it with `bash`.
+
+## After the import
+
+1. Read the JSON output of the command above.
+2. If `success` is `true`:
+    * Use `list_dir` on the workspace root (or the `--into` path) to confirm what landed.
+    * Read the top-level files you expect to find: `README.md`, `package.json`, `requirements.txt`, `pyproject.toml`, `app.py`, `index.html` — whichever exist.
+    * Summarize for the user:
+        - Repo imported: `owner/repo` (branch: X)
+        - Files imported: N
+        - Heavy dirs stripped: M
+        - Workspace location: `path/`
+        - A 5-10 line preview of what's in the workspace now.
+    * Suggest next steps based on the project type (e.g. "Want me to add tests? Modernize the build? Add a Dockerfile?").
+3. If `success` is `false`:
+    * Surface the `message` to the user verbatim.
+    * If the error mentions `subdir_not_found`, list the top-level directories of the repo (you can re-run the import with `--depth 1` and no subdir to discover what's there, or use `git ls-tree` via bash).
+    * If the error mentions `git binary not found`, tell the user git must be installed in the SoniCoder runtime.
+
+## Examples the user might type
+
+* `/github https://github.com/fastapi/fastapi`
+* `/github https://github.com/vercel/next.js examples/with-typescript --into next-ts-demo`
+* `/github https://github.com/pallets/flask --branch 2.3.x`
+* `/github git@github.com:owner/repo.git`
+
+## Rules
+
+* NEVER push to or modify the upstream repo. The clone is local-only and stripped of `.git`.
+* NEVER include secrets, API keys, or `.env` files in your summary — if you spot any, warn the user.
+* If the workspace already has files, warn the user that the import will overwrite the destination directory before running.

code/server/routes.py

@@ -21,6 +21,8 @@ Defines all HTTP and API endpoints:
 - API workspace_bash→ run a bash command in workspace
 - API todo_read    → read current todo list
 - API todo_write   → update todo list
+- API import_github → clone a GitHub repo into the workspace
+- API github_url_examples → return accepted GitHub URL formats
 """
 
 from __future__ import annotations
@@ -1112,3 +1114,74 @@ def handle_set_active_agent(name: str = "") -> str:
         "agents": list_agents(),
         "active_agent": get_active_agent(),
     }, default=str)
+
+
+# ─── GitHub Import Endpoint ────────────────────────────────────────────
+
+
+@app.api(name="import_github", concurrency_limit=1)
+def handle_import_github(
+    url: str,
+    branch: str = "",
+    subdir: str = "",
+    target_subdir: str = "",
+    depth: str = "1",
+    timeout: str = "120",
+) -> str:
+    """Clone a GitHub repo into the sandboxed workspace.
+
+    Parameters
+    ----------
+    url : str
+        GitHub URL. Accepts:
+          - https://github.com/<owner>/<repo>[.git]
+          - https://github.com/<owner>/<repo>/tree/<branch>[/<subdir>]
+          - git@github.com:<owner>/<repo>.git
+    branch : str
+        Optional branch/tag override. If empty, uses URL's branch or the
+        repo's default branch.
+    subdir : str
+        Optional sub-directory inside the repo to import.
+    target_subdir : str
+        Where inside the workspace to place the import. Empty = root.
+    depth : str
+        Git clone depth (default "1" for shallow clone).
+    timeout : str
+        Git clone timeout in seconds (default "120").
+
+    Yields
+    ------
+    JSON dict with keys: success, message, url, owner, repo, branch,
+    subdir, files_imported, dirs_skipped, workspace_path, tree_preview.
+    """
+    from code.tools.github import import_github_repo
+
+    try:
+        depth_int = int(depth) if str(depth).strip() else 1
+        depth_int = max(1, min(50, depth_int))
+    except (ValueError, TypeError):
+        depth_int = 1
+
+    try:
+        timeout_int = int(timeout) if str(timeout).strip() else 120
+        timeout_int = max(10, min(600, timeout_int))
+    except (ValueError, TypeError):
+        timeout_int = 120
+
+    result = import_github_repo(
+        url=url,
+        branch=branch,
+        subdir=subdir,
+        target_subdir=target_subdir,
+        depth=depth_int,
+        timeout=timeout_int,
+    )
+    yield json.dumps(result, default=str)
+
+
+@app.api(name="github_url_examples", concurrency_limit=4)
+def handle_github_url_examples() -> str:
+    """Return example GitHub URL formats accepted by import_github."""
+    from code.tools.github import list_github_url_examples
+    result = list_github_url_examples()
+    yield json.dumps(result, default=str)

code/tools/__init__.py

@@ -6,6 +6,7 @@ Inspired by Claude Code's tool set:
 - bash (subprocess)
 - list_dir
 - todo_write / todo_read
+- import_github_repo (clone a GitHub repo into the workspace)
 """
 from code.tools.fs import (
     read_file,
@@ -22,6 +23,10 @@ from code.tools.todos import (
     todo_write,
     todo_update,
 )
+from code.tools.github import (
+    import_github_repo,
+    list_github_url_examples,
+)
 
 __all__ = [
     "read_file",
@@ -35,4 +40,6 @@ __all__ = [
     "todo_read",
     "todo_write",
     "todo_update",
+    "import_github_repo",
+    "list_github_url_examples",
 ]

code/tools/github.py

@@ -0,0 +1,396 @@
+"""GitHub import tool — clone a repo into the sandboxed workspace.
+
+This module lets the user (or the agent, via the `/github` slash command)
+import an existing GitHub repository into the SoniCoder workspace so the
+agent can read, edit, and build on top of real code instead of starting
+from scratch.
+
+Security model
+--------------
+* Only `https://github.com/...` URLs are accepted (no SSH, no file://, no
+  other hosts). This prevents the clone URL from being used to exfiltrate
+  data via a malicious git config.
+* The repo is cloned into a temp directory first, then *copied* into the
+  workspace root with `.git/`, `node_modules/`, `__pycache__/`, and other
+  heavy / unnecessary directories stripped. This:
+    - avoids polluting the workspace with a `.git` subdir the agent would
+      otherwise try to walk,
+    - caps the size of the import (clone-depth 1 + ignored dirs),
+    - sidesteps git's "destination exists" failure mode.
+* Optional `subdir` argument lets the user import only a sub-directory of
+  the repo (e.g. `examples/quickstart`). This is useful for monorepos.
+
+The function returns a JSON-serializable dict that the frontend / agent
+loop can consume directly.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import shutil
+import subprocess
+import tempfile
+from pathlib import Path
+from typing import Any
+
+from code.tools.fs import get_workspace_root
+
+# ─── URL validation ──────────────────────────────────────────────────────
+
+# Accept:
+#   https://github.com/owner/repo
+#   https://github.com/owner/repo.git
+#   https://github.com/owner/repo/tree/main
+#   https://github.com/owner/repo/tree/main/subdir
+#   https://github.com/owner/repo/branches/main/subdir  (older form)
+#   git@github.com:owner/repo.git  → rewritten to https
+_GITHUB_HTTPS = re.compile(
+    r"^https://github\.com/(?P<owner>[^/\s]+)/(?P<repo>[^/\s]+?)(?:\.git)?(?:/(?:tree|blob|branches)/([^/\s]+)(?:/(.*))?)?/?$",
+    re.IGNORECASE,
+)
+_GITHUB_SSH = re.compile(
+    r"^git@github\.com:(?P<owner>[^/\s]+)/(?P<repo>[^/\s]+?)(?:\.git)?/?$",
+    re.IGNORECASE,
+)
+
+# Directories that are usually huge / not useful in the agent workspace
+_STRIP_DIRS = {
+    ".git",
+    ".hg",
+    ".svn",
+    "node_modules",
+    "__pycache__",
+    ".venv",
+    "venv",
+    "env",
+    ".tox",
+    ".mypy_cache",
+    ".pytest_cache",
+    ".ruff_cache",
+    "dist",
+    "build",
+    ".next",
+    ".nuxt",
+    ".cache",
+    ".gradle",
+    "target",
+    "Pods",
+}
+
+# Files we never want to land in the workspace
+_STRIP_FILES = {
+    ".DS_Store",
+    "Thumbs.db",
+}
+
+
+def _parse_github_url(url: str) -> dict[str, str | None]:
+    """Parse a GitHub URL into owner, repo, branch, subdir.
+
+    Returns a dict with keys: owner, repo, branch, subdir, clone_url.
+    Raises ValueError if the URL is not a valid GitHub URL.
+    """
+    url = (url or "").strip()
+    if not url:
+        raise ValueError("Empty GitHub URL")
+
+    m = _GITHUB_HTTPS.match(url)
+    if m:
+        owner = m.group("owner")
+        repo = m.group("repo")
+        branch = m.group(3)
+        subdir = m.group(4) or ""
+        clone_url = f"https://github.com/{owner}/{repo}.git"
+        return {
+            "owner": owner,
+            "repo": repo,
+            "branch": branch,
+            "subdir": subdir.strip("/"),
+            "clone_url": clone_url,
+        }
+
+    m = _GITHUB_SSH.match(url)
+    if m:
+        owner = m.group("owner")
+        repo = m.group("repo")
+        clone_url = f"https://github.com/{owner}/{repo}.git"
+        return {
+            "owner": owner,
+            "repo": repo,
+            "branch": None,
+            "subdir": "",
+            "clone_url": clone_url,
+        }
+
+    raise ValueError(
+        f"Invalid GitHub URL: {url!r}. "
+        "Expected https://github.com/<owner>/<repo> or git@github.com:<owner>/<repo>.git"
+    )
+
+
+def _git_available() -> bool:
+    """Check whether the `git` binary is on PATH."""
+    try:
+        result = subprocess.run(
+            ["git", "--version"],
+            capture_output=True,
+            timeout=5,
+        )
+        return result.returncode == 0
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        return False
+
+
+def _safe_relpath(root: str, full: str) -> str:
+    """Return path relative to root, or empty if equal to root."""
+    return os.path.relpath(full, root)
+
+
+def _copy_filtered(src: str, dst: str) -> tuple[int, int]:
+    """Copy `src` (a directory) into `dst`, skipping _STRIP_DIRS/_STRIP_FILES.
+
+    Returns (files_copied, dirs_skipped).
+    """
+    files_copied = 0
+    dirs_skipped = 0
+
+    for dirpath, dirnames, fnames in os.walk(src, topdown=True):
+        # In-place mutate dirnames so os.walk skips them
+        keep_dirs = []
+        for d in dirnames:
+            if d in _STRIP_DIRS:
+                dirs_skipped += 1
+            else:
+                keep_dirs.append(d)
+        dirnames[:] = keep_dirs
+
+        rel = _safe_relpath(src, dirpath)
+        target_dir = dst if rel == "." else os.path.join(dst, rel)
+        os.makedirs(target_dir, exist_ok=True)
+
+        for fname in fnames:
+            if fname in _STRIP_FILES:
+                continue
+            try:
+                shutil.copy2(os.path.join(dirpath, fname), os.path.join(target_dir, fname))
+                files_copied += 1
+            except (OSError, shutil.SpecialFileError):
+                # Skip files we can't copy (sockets, fifos, etc.)
+                continue
+
+    return files_copied, dirs_skipped
+
+
+# ─── Public API ──────────────────────────────────────────────────────────
+
+
+def import_github_repo(
+    url: str,
+    branch: str = "",
+    subdir: str = "",
+    target_subdir: str = "",
+    depth: int = 1,
+    timeout: int = 120,
+) -> dict[str, Any]:
+    """Clone a GitHub repo into the workspace.
+
+    Args:
+        url: GitHub URL (https or SSH form). May include /tree/<branch>/<subdir>.
+        branch: Optional branch/tag to checkout. If empty, uses the URL's
+                embedded branch (if any) or the repo's default branch.
+        subdir: Optional sub-directory inside the repo to import. If the URL
+                already includes /tree/<branch>/<subdir>, this is added on
+                top (rare).
+        target_subdir: Where inside the workspace to place the import. If
+                empty, places at workspace root. If non-empty and the
+                directory exists, it will be overwritten.
+        depth: Git clone depth. Default 1 (shallow).
+        timeout: Git clone timeout in seconds.
+
+    Returns:
+        dict with keys:
+            success: bool
+            message: str
+            url: original URL
+            owner, repo, branch, subdir: parsed
+            files_imported: int
+            dirs_skipped: int
+            workspace_path: relative path inside the workspace where files landed
+            tree: dict (workspace tree summary, optional)
+            error: str (on failure)
+    """
+    try:
+        parsed = _parse_github_url(url)
+    except ValueError as exc:
+        return {
+            "success": False,
+            "message": str(exc),
+            "url": url,
+            "error": str(exc),
+        }
+
+    # Resolve effective branch / subdir
+    effective_branch = branch.strip() or parsed.get("branch") or ""
+    effective_subdir = subdir.strip() or parsed.get("subdir") or ""
+
+    if not _git_available():
+        return {
+            "success": False,
+            "message": "`git` is not installed in this environment. Cannot clone.",
+            "url": url,
+            "error": "git binary not found",
+        }
+
+    workspace_root = get_workspace_root()
+    os.makedirs(workspace_root, exist_ok=True)
+
+    # Decide destination inside workspace
+    if target_subdir.strip():
+        # Sanitize target_subdir — no path escapes
+        target_rel = target_subdir.strip().strip("/").lstrip(".")
+        if not target_rel or target_rel.startswith("/"):
+            return {
+                "success": False,
+                "message": f"Invalid target_subdir: {target_subdir!r}",
+                "url": url,
+                "error": "invalid target_subdir",
+            }
+        dest_root = os.path.join(workspace_root, target_rel)
+        workspace_rel = target_rel
+    else:
+        dest_root = workspace_root
+        workspace_rel = ""
+
+    # If dest_root already has content, clear it first so the import is clean.
+    # (We never touch anything outside dest_root.)
+    if os.path.isdir(dest_root):
+        for entry in os.listdir(dest_root):
+            full = os.path.join(dest_root, entry)
+            try:
+                if os.path.isdir(full):
+                    shutil.rmtree(full)
+                else:
+                    os.remove(full)
+            except OSError as exc:
+                # Don't fail the whole import over a single file
+                pass
+
+    # Clone into a temp dir
+    with tempfile.TemporaryDirectory(prefix="sonicoder_gh_") as tmp:
+        clone_target = os.path.join(tmp, parsed["repo"])
+        cmd = [
+            "git",
+            "clone",
+            "--depth",
+            str(int(depth)),
+            "--single-branch",
+        ]
+        if effective_branch:
+            cmd.extend(["--branch", effective_branch])
+        cmd.extend([parsed["clone_url"], clone_target])
+
+        try:
+            proc = subprocess.run(
+                cmd,
+                capture_output=True,
+                timeout=timeout,
+                text=True,
+            )
+        except subprocess.TimeoutExpired:
+            return {
+                "success": False,
+                "message": f"Git clone timed out after {timeout}s",
+                "url": url,
+                "error": "clone_timeout",
+            }
+
+        if proc.returncode != 0:
+            stderr = (proc.stderr or "").strip()
+            return {
+                "success": False,
+                "message": f"git clone failed: {stderr[:500]}",
+                "url": url,
+                "error": stderr[:500],
+            }
+
+        if not os.path.isdir(clone_target):
+            return {
+                "success": False,
+                "message": "git clone appeared to succeed but the target directory is missing",
+                "url": url,
+                "error": "clone_dir_missing",
+            }
+
+        # If subdir is requested, validate it
+        src_root = clone_target
+        if effective_subdir:
+            candidate = os.path.join(clone_target, effective_subdir)
+            if not os.path.isdir(candidate):
+                return {
+                    "success": False,
+                    "message": (
+                        f"Subdirectory '{effective_subdir}' not found in repo "
+                        f"{parsed['owner']}/{parsed['repo']}"
+                    ),
+                    "url": url,
+                    "error": "subdir_not_found",
+                }
+            src_root = candidate
+
+        # Copy filtered files into dest_root
+        files_imported, dirs_skipped = _copy_filtered(src_root, dest_root)
+
+    # Build a brief tree summary (top 2 levels) for the response
+    tree_summary: list[str] = []
+    try:
+        for name in sorted(os.listdir(dest_root))[:30]:
+            full = os.path.join(dest_root, name)
+            tree_summary.append(f"{name}/" if os.path.isdir(full) else name)
+    except OSError:
+        pass
+
+    msg = (
+        f"Imported {files_imported} file(s) from {parsed['owner']}/{parsed['repo']}"
+        + (f" (branch: {effective_branch})" if effective_branch else "")
+        + (f" subdir: {effective_subdir}" if effective_subdir else "")
+        + (f" into {workspace_rel}/" if workspace_rel else " into workspace root")
+        + f". Skipped {dirs_skipped} heavy dir(s) (.git, node_modules, etc.)."
+    )
+
+    return {
+        "success": True,
+        "message": msg,
+        "url": url,
+        "owner": parsed["owner"],
+        "repo": parsed["repo"],
+        "branch": effective_branch or None,
+        "subdir": effective_subdir or None,
+        "files_imported": files_imported,
+        "dirs_skipped": dirs_skipped,
+        "workspace_path": workspace_rel or ".",
+        "tree_preview": tree_summary,
+    }
+
+
+def list_github_url_examples() -> dict[str, Any]:
+    """Return example GitHub URL formats accepted by import_github_repo.
+
+    Useful for surfacing help in the UI / agent.
+    """
+    return {
+        "success": True,
+        "examples": [
+            "https://github.com/owner/repo",
+            "https://github.com/owner/repo.git",
+            "https://github.com/owner/repo/tree/main",
+            "https://github.com/owner/repo/tree/main/examples/quickstart",
+            "git@github.com:owner/repo.git",
+        ],
+        "notes": [
+            "Only github.com URLs are accepted (HTTPS or SSH form).",
+            "Shallow clone (depth=1) is used by default to keep imports fast.",
+            "Directories like .git, node_modules, __pycache__, .venv, dist, build are stripped.",
+            "If a /tree/<branch>/<subdir> path is included, only that subdir is imported.",
+        ],
+    }

index.html

@@ -672,8 +672,18 @@ body.hide-thinking .think-block { display: none; }
 .tab-pane { display: none; height: 100%; min-height: 0; }
 .tab-pane.active { display: flex; flex-direction: column; }
 
-/* Agent tab — scrollable like the Deploy tab */
-#pane-agent { padding: 16px; gap: 14px; overflow-y: auto; }
+/* Agent tab — scrollable like the Deploy tab.
+   Override .tab-pane.active's `display:flex` so the single .deploy-section
+   child does not get squished by flex shrink, which was preventing the
+   pane from scrolling. */
+#pane-agent {
+  display: block !important;
+  padding: 16px;
+  overflow-y: auto;
+  overflow-x: hidden;
+}
+#pane-agent.active { display: block !important; }
+#pane-agent > .deploy-section { flex: 0 0 auto; }
 
 /* Preview tab */
 #pane-preview {
@@ -860,7 +870,14 @@ body.hide-thinking .think-block { display: none; }
 /* ═══════════════════════════════════════════════════════
    DEPLOY TAB
    ═══════════════════════════════════════════════════════ */
-#pane-deploy { padding: 16px; gap: 14px; overflow-y: auto; }
+#pane-deploy {
+  display: block !important;
+  padding: 16px;
+  overflow-y: auto;
+  overflow-x: hidden;
+}
+#pane-deploy.active { display: block !important; }
+#pane-deploy > .deploy-section { flex: 0 0 auto; }
 
 .deploy-section {
   border: 1px solid var(--border);
@@ -1224,6 +1241,28 @@ body.hide-thinking .think-block { display: none; }
           <div class="deploy-section">
             <div class="deploy-title">&#129302; Agent Mode (Claude Code-style)</div>
 
+            <!-- GitHub Import -->
+            <div class="deploy-field" style="border-left:3px solid var(--cyan, #00d4ff);padding-left:10px;margin-bottom:14px;">
+              <label>&#128226; Import Project from GitHub</label>
+              <div style="display:flex;gap:6px;flex-wrap:wrap;margin-bottom:6px;">
+                <input type="text" id="github-url-input" placeholder="https://github.com/owner/repo  (or owner/repo/tree/main/subdir)" style="flex:1;min-width:220px;background:var(--bg-deep,#0d1117);color:var(--text);border:1px solid var(--border);border-radius:3px;padding:6px 10px;font-family:var(--font-mono);font-size:11px;">
+                <button onclick="importGithub()" id="btn-import-github" style="font-size:11px;background:var(--cyan, #00d4ff);color:#000;border:none;padding:6px 14px;cursor:pointer;border-radius:3px;font-weight:600;">&#11015; Import</button>
+              </div>
+              <div style="display:flex;gap:8px;flex-wrap:wrap;margin-bottom:4px;font-size:10px;color:var(--gray-dim);">
+                <input type="text" id="github-branch-input" placeholder="branch (optional)" style="flex:1;min-width:120px;max-width:200px;background:var(--bg-deep,#0d1117);color:var(--green);border:1px solid var(--border);border-radius:3px;padding:4px 8px;font-family:var(--font-mono);font-size:10px;">
+                <input type="text" id="github-subdir-input" placeholder="subdir (optional)" style="flex:1;min-width:120px;max-width:200px;background:var(--bg-deep,#0d1117);color:var(--green);border:1px solid var(--border);border-radius:3px;padding:4px 8px;font-family:var(--font-mono);font-size:10px;">
+                <input type="text" id="github-into-input" placeholder="into path (optional)" style="flex:1;min-width:120px;max-width:200px;background:var(--bg-deep,#0d1117);color:var(--green);border:1px solid var(--border);border-radius:3px;padding:4px 8px;font-family:var(--font-mono);font-size:10px;">
+              </div>
+              <div class="deploy-hint">
+                Paste any GitHub URL. Accepts <code>https://github.com/owner/repo</code>,
+                <code>/tree/branch/subdir</code> URLs, and SSH form.
+                The repo is shallow-cloned and copied into the workspace with
+                <code>.git</code>, <code>node_modules</code>, <code>__pycache__</code>,
+                <code>.venv</code> stripped. Or type <code>/github &lt;url&gt;</code> in chat for the AI to do it.
+              </div>
+              <div id="github-import-status" style="font-size:10px;margin-top:4px;color:var(--gray-dim);"></div>
+            </div>
+
             <!-- Agent mode toggle -->
             <div class="deploy-field">
               <label>Agent Mode</label>
@@ -2623,6 +2662,123 @@ function createAgentViaAI() {
   document.getElementById('agent-create-input').value = '';
 }
 
+// ═══════════════════════════════════════════════════════
+// GITHUB IMPORT
+// ═══════════════════════════════════════════════════════
+
+async function importGithub() {
+  const urlEl = document.getElementById('github-url-input');
+  const branchEl = document.getElementById('github-branch-input');
+  const subdirEl = document.getElementById('github-subdir-input');
+  const intoEl = document.getElementById('github-into-input');
+  const statusEl = document.getElementById('github-import-status');
+  const btn = document.getElementById('btn-import-github');
+
+  if (!urlEl) return;
+  const url = urlEl.value.trim();
+  if (!url) {
+    if (statusEl) {
+      statusEl.style.color = 'var(--red)';
+      statusEl.textContent = 'Please paste a GitHub URL first.';
+    }
+    return;
+  }
+
+  // Basic URL sanity check (server validates too, but quick client-side check first)
+  if (!/^https:\/\/github\.com\//i.test(url) && !/^git@github\.com:/i.test(url)) {
+    if (statusEl) {
+      statusEl.style.color = 'var(--red)';
+      statusEl.textContent = 'URL must start with https://github.com/ or git@github.com:';
+    }
+    return;
+  }
+
+  const branch = (branchEl && branchEl.value.trim()) || '';
+  const subdir = (subdirEl && subdirEl.value.trim()) || '';
+  const into = (intoEl && intoEl.value.trim()) || '';
+
+  // Disable button + show working state
+  if (btn) { btn.disabled = true; btn.textContent = '⏳ Cloning...'; }
+  if (statusEl) {
+    statusEl.style.color = 'var(--cyan, #00d4ff)';
+    statusEl.textContent = `Cloning ${url} (depth=1)... this may take 10-60 seconds for large repos.`;
+  }
+
+  try {
+    const es = await callAgentApi('import_github', [url, branch, subdir, into, '1', '180']);
+    es.addEventListener('complete', (e) => {
+      try {
+        const data = JSON.parse(e.data);
+        const result = JSON.parse(data[0]);
+        if (result.success) {
+          if (statusEl) {
+            statusEl.style.color = 'var(--green)';
+            const treePreview = (result.tree_preview || []).slice(0, 12).join(', ');
+            statusEl.innerHTML =
+              `✓ ${result.message}` +
+              (treePreview ? `<br><span style="color:var(--gray-dim);">Top-level: ${treePreview}</span>` : '');
+          }
+          addSystemMessage(`📥 Imported ${result.owner}/${result.repo} — ${result.files_imported} files. Workspace refreshed.`);
+          // Clear inputs on success
+          urlEl.value = '';
+          if (branchEl) branchEl.value = '';
+          if (subdirEl) subdirEl.value = '';
+          if (intoEl) intoEl.value = '';
+          // Refresh workspace tree + todos so the new files are visible
+          refreshWorkspace();
+          refreshTodos();
+          // Optionally auto-enable agent mode so the user can immediately edit
+          const toggle = document.getElementById('agent-mode-toggle');
+          if (toggle && !toggle.checked) {
+            toggle.checked = true;
+            toggleAgentMode();
+          }
+        } else {
+          if (statusEl) {
+            statusEl.style.color = 'var(--red)';
+            statusEl.textContent = `✗ ${result.message || result.error || 'Import failed.'}`;
+          }
+          addSystemMessage(`GitHub import failed: ${result.message || result.error}`);
+        }
+      } catch (err) {
+        console.error('import_github parse error:', err);
+        if (statusEl) {
+          statusEl.style.color = 'var(--red)';
+          statusEl.textContent = '✗ Unexpected response from server.';
+        }
+      }
+      if (btn) { btn.disabled = false; btn.textContent = '⬇ Import'; }
+      es.close();
+    });
+    es.addEventListener('error', () => {
+      if (btn) { btn.disabled = false; btn.textContent = '⬇ Import'; }
+      if (statusEl) {
+        statusEl.style.color = 'var(--red)';
+        statusEl.textContent = '✗ Network error during clone.';
+      }
+      es.close();
+    });
+  } catch (err) {
+    console.error('importGithub failed:', err);
+    if (btn) { btn.disabled = false; btn.textContent = '⬇ Import'; }
+    if (statusEl) {
+      statusEl.style.color = 'var(--red)';
+      statusEl.textContent = `✗ ${err.message || err}`;
+    }
+  }
+}
+
+// Allow pressing Enter in the URL input to trigger import
+function setupGithubImportEnterKey() {
+  const urlEl = document.getElementById('github-url-input');
+  if (urlEl && !urlEl.dataset.enterBound) {
+    urlEl.dataset.enterBound = '1';
+    urlEl.addEventListener('keydown', (ev) => {
+      if (ev.key === 'Enter') { ev.preventDefault(); importGithub(); }
+    });
+  }
+}
+
 async function refreshTodos() {
   try {
     const es = await callAgentApi('todo_read', ['default']);
@@ -2953,6 +3109,8 @@ document.addEventListener('DOMContentLoaded', () => {
     refreshAgents();
     renderAgentsList();
     renderActiveAgentBadge();
+    // Wire up Enter-key handler on the GitHub import URL input
+    setupGithubImportEnterKey();
   }, 100);
 });