feat(ai): stream AI suggestions over HTTP

[Reversean]

The suggestion reaches the client only once the model has finished writing it, so nothing appears until the whole generation is done.

GET /integration/ai/stream?projectId&eventId&originalEventId streams it as server-sent events:

data: {"type":"text-delta","delta":"The stack trace points at "}
data: {"type":"text-delta","delta":"a null dereference in "}
data: {"type":"error","errorText":"Could not generate an answer."}

Text and failure travel on channels of their own, which text/plain cannot offer: a body without framing is content by definition, so the server has no way to say that what follows is a failure rather than more of the answer. The route is an Express one and not a GraphQL field because the answer is written onto the response as it is produced; the field serving the one-shot answer is untouched.

The adapter translates the AI SDK's stream parts into a SuggestionStream, an AsyncIterable<SuggestionPart> declared in src/services/askAi/suggestionStream.ts, and the route writes the events itself. Nothing above src/integrations/vercel-ai/ names anything from the ai package, so a second provider implements stream(): SuggestionStream and stops there. SuggestionPart carries the names the client already reads, so no second vocabulary sits between the adapter and the browser. What the frames no longer carry is id, text-start/text-end and [DONE], none of which Garage reads; streaming reasoning or tool calls later brings block identity back.

An AbortController tied to the response stops the model when the client goes away, since the gateway otherwise bills for the rest of an answer nobody will read. It is declared as an eslint global because it is on globalThis since Node 15 while eslint's node env predates it.

checkUserInWorkspaceByProjectId becomes exported so the route runs the same workspace membership check that guards the GraphQL field. The Express request helper written for the GitHub route tests moves to test/helpers/expressRequest.ts, which is why github-routes.test.ts loses a hundred lines that have nothing to do with streaming.

Event lookup now fails the same way whether the factory throws or returns nothing: both become Event not found, which the route answers with 404. The one-shot path shares that helper, so a lookup error no longer leaves it carrying its original message.

[e11sy]

probably could be typed, since you assign it right away

[Reversean]

Added FakeResponse for this.

[e11sy]

we can just use

result.pipeUIMessageStreamToResponse(res);

with extra options or just

result.pipeTextStreamToResponse(res);

since we don't need any metadata toolcalls etc

[Reversean]

Good suggestion. And since I don't see any possibilities that ask-ai will need text/event-stream format, I'm using pipeTextStreamToResponse here.

@FeironoX5 If you're still working on stream receiving in hawk.garage, could you agree/disagree with this?

[Reversean]

Correction to my earlier reply: text/event-stream may turn out to be needed after all. On a rejected answer the guard in #668 can only append the fallback as more text, so the client shows a truncated prefix glued to it. Signalling a failure on its own channel needs the UI message stream. Leaving pipeTextStreamToResponse for now and revisiting once the feature is testable on stage.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 97.60000% with 3 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (fix/ai-prompt-injection@56bb10e). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
test/helpers/expressRequest.ts	95.16%	3 Missing ⚠️

Additional details and impacted files

@@                    Coverage Diff                     @@
##             fix/ai-prompt-injection     #664   +/-   ##
==========================================================
  Coverage                           ?   48.91%           
==========================================================
  Files                              ?       62           
  Lines                              ?     2819           
  Branches                           ?      638           
==========================================================
  Hits                               ?     1379           
  Misses                             ?     1362           
  Partials                           ?       78           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Adds an HTTP streaming endpoint for AI suggestions and wires it into the API, alongside extending the Vercel AI integration with a streaming call and updating tests/utilities to support streaming responses.

Changes:

• Introduces GET /integration/ai/stream Express route and app wiring for AI suggestion streaming.
• Extends the Vercel AI integration with a stream() method and adds service-level streamSuggestion().
• Adds/updates Jest tests and introduces a reusable Express request/response test helper that can capture streamed bodies/headers.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/services/askAiRoutes.test.ts	New tests covering auth/validation/error cases and streaming response behavior for /integration/ai/stream.
test/services/askAi.test.ts	Adds service-level coverage for streamSuggestion() behavior.
test/integrations/vercel-ai.test.ts	Adds integration-level coverage for vercelAIApi.stream() forwarding to streamText.
test/integrations/github-routes.test.ts	Refactors tests to reuse the new makeExpressRequest helper.
test/helpers/expressRequest.ts	New helper to drive Express apps without a socket and capture streamed responses/headers.
src/services/types.ts	Exports Event type for reuse by services.
src/services/askAi/service.ts	Adds streamSuggestion() and refactors event lookup into getEventOrThrow().
src/services/askAi/routes.ts	New Express router for AI streaming endpoint and authorization checks.
src/services/askAi/index.ts	Exports appendAiAssistantRoutes for app integration.
src/integrations/vercel-ai/index.ts	Adds stream() wrapper around streamText and centralizes provider gateway options.
src/index.ts	Registers AI assistant routes on the main Express app.
src/directives/requireUserInWorkspace.ts	Exports checkUserInWorkspaceByProjectId for use from Express routes.
package.json	Bumps package version.

Suppressed comments (2)

src/services/askAi/routes.ts:87

• The inner catch converts any streamSuggestion error into a 404 and returns error.message to the caller. That will misreport transport/DB failures as "not found" and can leak internal error details (e.g. events factory errors that include ids). Only map the known not-found case to 404; rethrow unexpected errors so the outer handler can next(error) and return a 5xx.

      try {
        result = await askAiService.streamSuggestion(eventsFactory, eventId, originalEventId);
      } catch (error) {
        res.status(404).json({ error: error instanceof Error ? error.message : 'Event not found' });

src/services/askAi/routes.ts:91

• This route calls result.pipeTextStreamToResponse(res), but the PR description says the AI SDK's toUIMessageStreamResponse() (a Fetch API Response) is adapted onto the Express response. As written, there is no adaptation and the call isn’t type-checked (because result is implicitly any), so a wrong method name or incompatible stream type would only fail at runtime. Consider explicitly using toUIMessageStreamResponse() and piping its status/headers/body into Express.

      result.pipeTextStreamToResponse(res);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[neSpecc]

Vercel implementation should not export Vercel's type outside of itself. Other layers above should not depend on "ai" package.

Maybe we should create own type for streaming text so we can add more integrations later?

[Reversean]

stream() and streamSuggestion() return AiStream now, declared in src/services/askAi/stream.ts. Converting SDK parts into our own types.

[neSpecc]

same here

[Reversean]

Same change, answered in the thread on vercel-ai/index.ts.

[FeironoX5]

todo: use types form hawk.types

[Reversean]

Waiting for codex-team/hawk.types#81

[FeironoX5]

may be move out to utils with validateProjectAdminAccess?

[Reversean]

I guess it's not worth it to put domain router logic into utils.