[Programcode]

Summary

• reject malformed visible AI controls at the shared Edge boundary before quota, research, or provider work
• make Ask streaming general-only in both client and server gates
• add enum, boolean, handler-ordering, payload, and isolated browser regression coverage

Verification

• Node 22.23.2, npm ci
• npm run lint
• npm run typecheck
• npm test -- --coverage: 95 files, 925 tests, 90.45% statements
• deno check supabase/functions/ai/index.ts supabase/functions/ai-stream/index.ts
• npm run test:edge: 121 tests
• npm run build
• CI=1 PORT=18081 PLAYWRIGHT_BASE_URL=http://127.0.0.1:18081 npm run test:e2e -- --workers=2: 126 tests

Rollout

Deploy ai and ai-stream Edge Functions after merge, then verify one valid general Ask request and one malformed-control rejection. No database migration or secret change.

Summary by CodeRabbit

• New Features

  • Added validation for AI controls, including modes, toggles, factoid limits, and citation settings.
  • Invalid AI requests now return clear client errors before processing begins.

• Bug Fixes

  • Streaming is now limited to general Ask mode; advanced modes use non-streaming responses.
  • Ask clarification requests correctly use the non-streaming AI flow.

• Tests

  • Expanded coverage for control validation, streaming eligibility, malformed requests, and successful clarification responses.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
debate-navigator	Ready	Preview	Sep 5, 2026 10:03pm UTC

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 5d17633e-e3ca-432e-a9b1-b6fdeeeffc21

📥 Commits

Reviewing files that changed from the base of the PR and between 7b1dfc8 and a6462ca.

📒 Files selected for processing (9)

• e2e/authed-pages.spec.ts
• src/lib/ai/streaming.ts
• src/test/ai/streaming.test.ts
• supabase/functions/_shared/control-enforcement.test.ts
• supabase/functions/_shared/control-enforcement.ts
• supabase/functions/ai-stream/index.ts
• supabase/functions/ai/control-matrix.test.ts
• supabase/functions/ai/handler-research.test.ts
• supabase/functions/ai/index.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Ask control validation is centralized for both AI handlers. Streaming is now limited to general mode. Tests cover control boundaries, malformed requests, advanced Ask responses, and the absence of streaming calls.

Changes

Ask control enforcement

Layer / File(s)	Summary
Central validation and streaming policy supabase/functions/_shared/control-enforcement.ts, supabase/functions/_shared/control-enforcement.test.ts, supabase/functions/ai/control-matrix.test.ts	Control schemas validate enum, boolean, timeframe, and source-count inputs. Only general mode is streaming-eligible.
Handler validation integration supabase/functions/ai/index.ts, supabase/functions/ai-stream/index.ts, supabase/functions/ai/handler-research.test.ts	Both handlers validate sanitized Ask controls before downstream processing. The streaming handler is exported and conditionally served.
Client contract and regression coverage src/lib/ai/streaming.ts, src/test/ai/streaming.test.ts, e2e/authed-pages.spec.ts	Advanced Ask modes use the non-streaming contract. Tests verify request fields, rendered responses, and zero /ai-stream calls.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AskClient
  participant AIHandler
  participant ControlValidator
  participant ProviderAndQuota
  AskClient->>AIHandler: Submit Ask request
  AIHandler->>ControlValidator: Validate sanitized controls
  ControlValidator-->>AIHandler: Validation result
  AIHandler->>ProviderAndQuota: Continue when controls are valid

Loading

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[Programcode]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.