OneDrive and SharePoint

When a pull request, or the issue it implements, contains a OneDrive or SharePoint sharing link, MergeHarbor reads the file and gives it to the review as the specification for the change. You can also pin files that every review of a repository should read.

What it does in reviews

• Reads only what is referenced. MergeHarbor looks for sharing links (*.sharepoint.com, onedrive.live.com, 1drv.ms) in the pull request title, description and branch, and in the descriptions of its linked Jira, Linear and Asana issues, plus the files pinned for the repository. It never lists or crawls your drives and sites.
• Converts the file to text. Word documents (.docx) are converted by MergeHarbor with a size-limited extractor, PDFs likewise, and other Office formats (PowerPoint, Excel, older Word files) are converted to PDF by Microsoft Graph first. Text files are read as they are. Each file is trimmed to about 8,000 characters, and at most two files are read per pull request and per issue by default.
• Uses it as the specification. Files linked from the pull request, and pinned files, are sent to the review as the documents describing the change; files linked from an issue are added to that issue. Text that looks like a secret is redacted before it reaches the model.
• Costs no extra model call, and cites what it used under Docs read and in “Source used:” links.

Connect

1. In the console, open Integrations and choose Connect on OneDrive / SharePoint (under Docs & knowledge). You need the settings.manage permission.
2. Sign in with your work or school account and accept the permissions: sign you in and read your profile, read files you can access, and keep access (offline_access). Some organizations require an administrator to approve the app first.
3. Optionally, open Settings and paste sharing links of files to pin, choosing Read for all repositories or one repository.
4. Choose Test connection.

MergeHarbor reads a file only if the account that connected can open it. Use an account that can see your specs, or share them with it.

What is read and stored

• File name, link, last modified time and text. Text is cached for a short time (10 minutes by default), deleted within 24 hours, and never written to logs. If an administrator turns on Keep linked documents in the knowledge base, text that issue triage reads is kept for the days they choose (1–365) after last use instead.
• The connection is named after your Microsoft 365 organization. Tokens are encrypted at rest and never shown again.
• In Settings, you can limit the integration to some repositories.

Disconnect

Open the integration in Integrations and choose Disconnect. MergeHarbor deletes its tokens, pins and cached text. Microsoft has no way for MergeHarbor to revoke its access itself: remove the app at myapps.microsoft.com, or an administrator removes it under Enterprise applications in Microsoft Entra.

Self-hosted installations

Register an app in Microsoft Entra (step by step in docs/OAUTH_APPS.md, “OneDrive and SharePoint connections”): platform Web with the redirect URI {PUBLIC_URL}/integrations/connect/onedrive/callback, a client secret, and the delegated Microsoft Graph permissions offline_access, User.Read and Files.Read.All. Set ONEDRIVE_OAUTH_CLIENT_ID, ONEDRIVE_OAUTH_CLIENT_SECRET and, for a single tenant, ONEDRIVE_OAUTH_TENANT (default organizations). ONEDRIVE_SITES_READ_ALL=true also requests Sites.Read.All, which needs admin consent. OneDrive / SharePoint stays hidden in the console until the client ID and secret are set.