fix(ai): load source context server-side by Programcode · Pull Request #66 · Programcode/DebateOwl

Programcode · 2026-09-23T16:58:23Z

Summary

send stable active-source IDs instead of full source content
load and bound personal sources in the authenticated ai Edge Function
cap ordinary Ask history and custom prompts before serialization

Root cause

The browser serialized the entire active source library and full Ask history. Real accounts could exceed the Edge Function's 200,000-byte request limit before server-side prompt bounds ran.

Verification

npm run verify
1,031 unit tests
30 collaboration tests
238 Edge tests
226 desktop/mobile Chromium tests, 6 expected skips
red/green regression reproducing the exact Request body exceeds 200000 bytes response

Production follow-through

This changes the ai Edge Function and frontend. No database migration is required. After merge, deploy only ai, verify the production source-ID path, then confirm the exact merge commit on Vercel.

Follow-up to #65.

Summary by CodeRabbit

AI Improvements
- Ask conversations now include up to the latest eight messages, with individual message content and custom instructions capped to keep requests within limits.
- AI requests use up to 10 selected active sources, with source content loaded securely for your account.
- Source-based AI results continue to reflect the requested source order.

Confidence Score: 5/5

Safe to merge; the remaining concern is non-blocking but should be addressed to prevent Workspace users from losing rejected drafts.

What we checked:

Generated a proof for the first posted P2 finding and attached its workspace oversized-draft test source and its execution output.
Generated a proof for the second posted P2 finding.
Validated the authored focused Playwright test: 2 tests passed, it rendered the Ask route with workspace context, filled an 80,004-byte UTF-8 draft, submitted it, verified the rendered size error and empty composer, and confirmed zero calls to both AI endpoints.

Summary

Ask requests now reject messages that exceed the UTF-8 input budget instead of silently shortening them.
AskPage shows the size warning before dispatching an oversized request.
Workspace Ask still clears an oversized rejected draft, forcing the user to recreate it.

Merge safety

The reproduced draft-loss concern is non-blocking, but preserving rejected Workspace drafts would avoid losing user work.

_{Reviews (3) · Last reviewed commit: "fix(ask): reject oversized messages visi..."}

vercel · 2026-09-23T16:58:24Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
debate-navigator	Ready	Preview	Sep 23, 2026 5:33pm UTC

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

coderabbitai · 2026-09-23T16:58:33Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Next included review available in 25 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 2b626563-a0ed-47f5-acb5-b82caed0ed21

📥 Commits

Reviewing files that changed from the base of the PR and between 23af8f8 and 613d7b3.

📒 Files selected for processing (9)

docs/architecture.md
src/lib/ai/client.ts
src/lib/ai/streaming.ts
src/locales/en.json
src/locales/es.json
src/locales/hu.json
src/pages/AskPage.tsx
src/test/ai/request-dispatch.test.ts
src/test/pages/ConversationPages.test.tsx

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: ffabb915-f810-4fbb-82f4-b878eda1a0ad

📥 Commits

Reviewing files that changed from the base of the PR and between 6eb5bed and 23af8f8.

📒 Files selected for processing (9)

docs/architecture.md
src/lib/ai/client.ts
src/lib/ai/streaming.ts
src/test/ai/client-branches.test.ts
src/test/ai/client.test.ts
src/test/ai/crossfire-client.test.ts
src/test/ai/request-dispatch.test.ts
supabase/functions/ai/handler-research.test.ts
supabase/functions/ai/index.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The client now sends active source IDs and bounded Ask context in AI requests. The Edge Function validates source selections, loads active sources for the authenticated user, and applies Crossfire source validation after loading.

Changes

AI Request Flow

Layer / File(s)	Summary
Client source-ID payload `src/lib/ai/client.ts`, `src/test/ai/client*.test.ts`, `src/test/ai/crossfire-client.test.ts`	The client sends up to 10 active source IDs instead of personal source objects. Source-related tests now check the ID payload.
Bounded Ask context `src/lib/ai/client.ts`, `src/lib/ai/streaming.ts`, `src/test/ai/request-dispatch.test.ts`	Ask requests and streaming requests send at most eight recent messages, with each message capped at 6,000 characters. Custom system prompts are capped at 50,000 characters. The request test checks these limits and a body size of no more than 200,000 bytes.
Authenticated source loading `supabase/functions/ai/index.ts`, `supabase/functions/ai/handler-research.test.ts`, `docs/architecture.md`	The Edge Function validates source IDs, loads active rows owned by the authenticated user, restores the requested order, and bounds the loaded sources. Crossfire validation runs after loading. The research test and architecture documentation reflect the source-ID request flow.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AIClient
  participant AIEdgeFunction
  participant SupabaseSources
  AIClient->>AIEdgeFunction: Send selected sourceIds
  AIEdgeFunction->>SupabaseSources: Load active sources for authenticated user
  SupabaseSources-->>AIEdgeFunction: Return matching source rows
  AIEdgeFunction->>AIEdgeFunction: Order, bound, and validate loaded sources

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

Programcode · 2026-09-23T16:58:59Z

@coderabbitai review

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

coderabbitai · 2026-09-23T17:05:20Z

⚠️ Action not completed

Already reviewed the last commit. Use @coderabbitai full review to rerun a review of the entire changeset.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

greptile-apps · 2026-09-23T17:10:23Z

Comments Outside Diff

These findings sit on lines the diff does not cover, so they could not be posted inline. Each one leaves this list once its file changes.

Keep rejected drafts src/components/features/ask/AskChat.tsx:407 ▶

The composer is cleared immediately after it calls onSend, but Workspace Ask validates the assembled message only inside that handler. A Workspace user who submits more than 80,000 UTF-8 bytes sees the size warning after their draft has already been erased, with no request or saved message from which to recover it. Clear the composer only after the handler accepts the message, or retain the draft when validation rejects it.

Programcode · 2026-09-23T17:15:44Z

@coderabbitai review

coderabbitai · 2026-09-23T17:15:49Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Programcode · 2026-09-23T17:20:05Z

@coderabbitai review

coderabbitai · 2026-09-23T17:20:11Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Programcode · 2026-09-23T17:32:41Z

@coderabbitai review

coderabbitai · 2026-09-23T17:32:46Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Programcode · 2026-09-23T17:57:19Z

Production follow-through complete for merge 653aeac8b192db8a64cdb2eaf70da7f6df71b8ef.

Vercel production deployment dpl_F1zsmh7LFUtFfe6kkrrLMwyUw7Gh is READY and aliases https://debate.pi-stack.org.
Supabase ai Edge Function advanced from version 76 to ACTIVE version 77; all 17 downloaded deployed source files byte-match the merged tree.
Production CORS accepts the public origin and unauthenticated requests fail closed with 401.
The live production bundle sent a 140,943-byte bounded request with source UUIDs only; source text and legacy local IDs were absent. An oversized multibyte message showed the visible error and made no AI request. This browser smoke uses a stub session and intercepted AI response, so it proves client dispatch rather than an authenticated provider completion.
Main workflow 35898429384 passed, including quality and Docker build/push.
No database migration or other Edge Function deployment was required.
Rollback source for the previous ai version 76 is stored at /home/codex/.codex/backups/debatelab-ai-v76-OgIPRoKf.

* fix(settings): persist preferences to the account again Since the 2026-08-19 hardening revoked INSERT on user_settings, the client's upsert was always denied, so language, output language, theme, model choices, and the custom system prompt never left the browser. The hardening grant also omitted output_language. Update the provisioned row instead and grant the missing column. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(mobile): stop toasts, Library, and Flowchart widening the page Sonner's mobile toaster overflowed by its left offset, the Library grid let a source row's min-content width stretch the card, and the Flowchart toolbar did not wrap. Each widened the phone layout viewport and pushed controls off-screen. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test(e2e): drive every feature through the real local stack Add full-stack browser journeys that sign in through the real demo-code flow and exercise Auth, RLS, quota, every Edge Function, streaming, and persistence against local Supabase. Only OpenRouter is replaced, by a strict fake container reached through the new OPENROUTER_API_URL override. The case-generation test fails against the pre-#66 client, which silently dropped oversized requests. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test(e2e): fail the CI gate instead of skipping full-stack specs Also warm the admin and announcements functions before the browser run. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * ci(db-gate): retry supabase start after registry rate limits Both database-tests attempts on this PR failed while pulling Supabase images from ghcr.io with toomanyrequests, before any test ran. Retry the start up to three times and stop a partially started stack between attempts. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

fix(ai): load source context server-side

23af8f8

Copilot AI lite review requested due to automatic review settings September 23, 2026 16:58

Copilot AI reviewed Sep 23, 2026

Programcode requested a lite review from Copilot September 23, 2026 16:58

vercel Bot deployed to Preview September 23, 2026 16:59

View deployment

Copilot AI reviewed Sep 23, 2026

greptile-apps Bot reviewed Sep 23, 2026

View reviewed changes

Comment thread src/lib/ai/client.ts Resolved

Comment thread src/lib/ai/client.ts Resolved

fix(ai): enforce UTF-8 request budget

3b2d480

Programcode requested a lite review from Copilot September 23, 2026 17:15

vercel Bot deployed to Preview September 23, 2026 17:15

View deployment

Copilot AI reviewed Sep 23, 2026

greptile-apps Bot reviewed Sep 23, 2026

View reviewed changes

Comment thread src/lib/ai/client.ts Resolved

fix(ask): reject oversized messages visibly

613d7b3

Programcode requested a lite review from Copilot September 23, 2026 17:32

Copilot AI reviewed Sep 23, 2026

vercel Bot deployed to Preview September 23, 2026 17:33

View deployment

Programcode merged commit 653aeac into main Sep 23, 2026
8 checks passed

Programcode deleted the t3code/fix-ai-request-size branch September 23, 2026 17:57

Programcode mentioned this pull request Sep 23, 2026

test(e2e): full-stack feature journeys, plus the bugs they found #67

Merged

Conversation

Programcode commented Sep 23, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root cause

Verification

Production follow-through

Summary by CodeRabbit

Confidence Score: 5/5

Summary

Merge safety

Uh oh!

vercel Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

Programcode commented Sep 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Comments Outside Diff

Uh oh!

Programcode commented Sep 23, 2026

Uh oh!

coderabbitai Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Programcode commented Sep 23, 2026

Uh oh!

coderabbitai Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Programcode commented Sep 23, 2026

Uh oh!

coderabbitai Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Programcode commented Sep 23, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Programcode commented Sep 23, 2026 •

edited by greptile-apps Bot

Loading

vercel Bot commented Sep 23, 2026 •

edited

Loading

coderabbitai Bot commented Sep 23, 2026 •

edited

Loading

coderabbitai Bot commented Sep 23, 2026 •

edited

Loading

greptile-apps Bot commented Sep 23, 2026 •

edited

Loading

coderabbitai Bot commented Sep 23, 2026 •

edited

Loading

coderabbitai Bot commented Sep 23, 2026 •

edited

Loading

coderabbitai Bot commented Sep 23, 2026 •

edited

Loading