[Programcode]

Summary

• reuse the authenticated session token already owned by AuthProvider
• bypass the Supabase function client's redundant session lookup for non-streaming AI calls
• keep streaming and non-streaming request paths aligned
• add a regression test that proves an authenticated AI request reaches fetch without another session lookup

Verification

• npm run verify
• 1,028 unit tests passed with coverage
• 30 collaboration tests passed
• 238 Edge tests passed
• production build and service-worker checks passed
• 226 desktop/mobile Chromium tests passed, 6 expected skips

Release boundary

Frontend-only. No migrations, Edge Function deploys, secrets, billing, or infrastructure changes.

Rollback: revert the merge commit and redeploy the previous frontend image.

Summary by CodeRabbit

• Improvements
  • AI requests now reuse the active sign-in token when available, avoiding an extra session lookup.
  • Requests continue to retrieve a session when no active token is available, and preserve existing cancellation and authentication error handling.
  • AI requests are sent through an authenticated function request, with responses and errors handled consistently.

Confidence Score: 5/5

Safe to merge; there are no outstanding blocking issues.

Summary

This update keeps identical in-flight sparring requests deduplicated when an authenticated user’s access token refreshes. Authentication state now caches the stable user ID alongside the token, and sparring request keys prefer that identity.

_{Reviews (3) · Last reviewed commit: "fix(sparring): dedupe across token refre..."}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
debate-navigator	Ready	Preview	Sep 23, 2026 1:03pm UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Programcode]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Next included review available in 34 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: e9f01e53-9f00-4f4a-9ec4-1a6a2d4457e5

📥 Commits

Reviewing files that changed from the base of the PR and between 78ad480 and a6f0728.

📒 Files selected for processing (5)

• src/lib/ai/client.ts
• src/lib/supabase/AuthProvider.tsx
• src/lib/supabase/client.ts
• src/test/ai/request-dispatch.test.ts
• src/test/ai/sparring.test.ts

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 623c6485-846c-4bf7-a225-5266cd283b61

📥 Commits

Reviewing files that changed from the base of the PR and between 9e1e016 and 78ad480.

📒 Files selected for processing (15)

• src/lib/ai/client.ts
• src/lib/ai/streaming.ts
• src/lib/supabase/AuthProvider.tsx
• src/lib/supabase/client.ts
• src/test/ai/client-analytics.test.ts
• src/test/ai/client-branches.test.ts
• src/test/ai/client.test.ts
• src/test/ai/control-payload-matrix.test.ts
• src/test/ai/crossfire-client.test.ts
• src/test/ai/request-dispatch.test.ts
• src/test/ai/sparring.test.ts
• src/test/ai/streaming-integration.test.ts
• src/test/ai/streaming.test.ts
• src/test/auth/AuthFlow.test.tsx
• src/test/auth/AuthProvider.behavior.test.tsx

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Supabase client now stores an active access token and provides authenticated function invocation. AuthProvider updates the token with session changes. AI request paths use the active token when available and fall back to session lookup otherwise.

Changes

Authenticated AI requests

Layer / File(s)	Summary
Active-token state and authenticated invocation src/lib/supabase/client.ts, src/lib/supabase/AuthProvider.tsx, src/test/auth/*	The client adds active-token accessors and a function invocation helper that sends JSON requests and returns HTTP or relay errors. AuthProvider sets or clears the active token during session hydration, initialization, and auth-state changes.
AI request token use and validation src/lib/ai/client.ts, src/lib/ai/streaming.ts, src/test/ai/*	AI request paths use the active token before falling back to session lookup. The non-streaming path uses the authenticated invocation helper. Tests update client mocks and verify that an initialized session avoids an additional getSession call.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AuthProvider
  participant AIRequest
  participant SupabaseClient
  participant SupabaseFunction
  AuthProvider->>SupabaseClient: Set or clear active access token
  AIRequest->>SupabaseClient: Read active access token
  AIRequest->>SupabaseClient: Call getSession if the token is absent
  AIRequest->>SupabaseClient: Invoke function with request body and headers
  SupabaseClient->>SupabaseFunction: POST JSON request
  SupabaseFunction-->>SupabaseClient: Return function response

Loading

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[Programcode]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Programcode]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Programcode]

@coderabbitai review

[Programcode]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Programcode]

Production follow-through complete for merge 6eb5bed5599ca7e86c4458f212a1b5909868d331.

• Vercel production deployment dpl_5RxfMK8gMuzNR3N9obsVknsbGBWi is READY and aliases https://debate.pi-stack.org.
• Main workflow 35865993190 passed, including quality and Docker build/push.
• Live production-bundle smoke reached /app/ask, dispatched the non-streaming AI request with the initialized bearer token, and rendered the intercepted response. This proves client dispatch only; it is not authenticated provider proof.
• No database migrations or Edge Function changes were part of this frontend-only PR.