Update prod - #677
Open
github-actions[bot] wants to merge 8 commits into
Open
Conversation
@types/node is pinned to ^16.11.46 while .nvmrc requires Node 24. The definitions predate APIs the runtime already provides, such as Readable.fromWeb, so code calling them does not type-check.
chore(deps): bump @types/node to match the Node 24 runtime
The Ask AI prompt assembly, the model instruction and the event serialisation live in src/integrations/vercel-ai/ although none of them import anything from the provider. Replacing the provider drags the domain with it, and anything applied around the model call can only be reused by importing from another adapter's internals. Move those modules to src/services/askAi/ and reduce VercelAIApi to a transport taking a system/prompt pair. The service moves with them and is renamed to AskAiService, which is why src/resolvers/event.js changes too.
refactor(ai): move Ask AI domain logic out of the provider adapter
The event payload sent to the model carries headers, user agent, query and POST parameters, all written by whoever triggered the error. Nothing in the prompt marks them as data, so an instruction planted in a header competes with the system instruction on equal terms. Wrap the payload in markers carrying a random per-request nonce and state in the system prompt that the marked block is data. A fixed marker was rejected: JSON.stringify leaves < and > alone, so a known marker can be closed early from inside a header. An answer reproducing the nonce is replaced with a fallback message.
feat(ai): defend Ask AI suggestions against prompt injection
New HTTP route GET /integration/ai/stream added. This route calls Ask AI service about specified event and responds text/event-stream. Reponse carrying AiStream which represent AiStreamPart sequence: either text-delta (text-increments generated by AI assistant) or error (failure description during response generation). NOTE: Response doesn't carry reasoning, tooling and start/end parts since they're not required yet. Route checks workspace membership before calling Ask AI. For this purpose function checkUserInWorkspaceByProjectId became exported. Failed membership check leads to response with 403. Also route checks if specified event exists. Failed check leads to response with 404. Aborting request cancel Ask AI suggestion generation. For this purpose AbortController is declared as an eslint global: it is on globalThis since Node 15, but eslint's node env predates it.
feat(ai): stream AI suggestions over HTTP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto-generated prod update suggestion