feat(ai): stream AI suggestions over HTTP by Reversean · Pull Request #664 · codex-team/hawk.api.nodejs

Reversean · 2026-07-28T14:00:50Z

The suggestion reaches the client only when the model has finished writing it, so the user sees nothing until the whole generation is done.

The stream is served from a dedicated GET /integration/ai/stream Express route, which pipes the AI SDK's text stream onto the Express response with pipeTextStreamToResponse, as text/plain. The route sits behind the same workspace membership check as the GraphQL field, which is why checkUserInWorkspaceByProjectId becomes exported.

The Express request helper written for the GitHub route tests moves to test/helpers/expressRequest.ts so both suites share one copy.

e11sy · 2026-07-31T07:45:41Z

+    });
+  }
+
+  const res: any = new Writable({


probably could be typed, since you assign it right away

Added FakeResponse for this.

e11sy · 2026-07-31T08:11:10Z

+      const response = result.toUIMessageStreamResponse();
+
+      res.status(response.status);
+      response.headers.forEach((value, key) => res.setHeader(key, value));
+
+      if (!response.body) {
+        res.end();
+
+        return;
+      }
+
+      Readable.fromWeb(response.body as NodeReadableStream<Uint8Array>).pipe(res);
+    } catch (error) {
+      next(error);
+    }
+  });


we can just use

result.pipeUIMessageStreamToResponse(res);

with extra options or just

result.pipeTextStreamToResponse(res);

since we don't need any metadata toolcalls etc

Good suggestion. And since I don't see any possibilities that ask-ai will need text/event-stream format, I'm using pipeTextStreamToResponse here.

@FeironoX5 If you're still working on stream receiving in hawk.garage, could you agree/disagree with this?

Correction to my earlier reply: text/event-stream may turn out to be needed after all. On a rejected answer the guard in #668 can only append the fallback as more text, so the client shows a truncated prefix glued to it. Signalling a failure on its own channel needs the UI message stream. Leaving pipeTextStreamToResponse for now and revisiting once the feature is testable on stage.

codecov-commenter · 2026-08-05T12:36:43Z

Codecov Report

❌ Patch coverage is 97.60000% with 3 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (fix/ai-prompt-injection@56bb10e). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
test/helpers/expressRequest.ts	95.16%	3 Missing ⚠️

Additional details and impacted files

@@                    Coverage Diff                     @@
##             fix/ai-prompt-injection     #664   +/-   ##
==========================================================
  Coverage                           ?   48.91%           
==========================================================
  Files                              ?       62           
  Lines                              ?     2819           
  Branches                           ?      638           
==========================================================
  Hits                               ?     1379           
  Misses                             ?     1362           
  Partials                           ?       78

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

createFakeResponse assigned every Express-shaped method it needed right after construction, so it could be typed as that shape from the start instead of any - reviewer feedback on #664. Also adds writeHead, which the AI SDK's response-piping helpers call directly, bypassing Express's status()/setHeader() convenience methods.

routes.ts landed in integrations/vercel-ai/ in the original commit, even though it only calls askAiService and never touches the transport - the same domain-code-in-an-adapter-directory problem services/ai.ts itself had before it moved into askAi/. Wire its imports to the new location and expose it through the askAi barrel, alongside AskAiService. Also switches result.toUIMessageStreamResponse() + manual Response-to-Express bridging for result.pipeTextStreamToResponse(res) - reviewer feedback on #664. The model call is tool-less by design (see VercelAIApi's docstring), so there's no tool-call/reasoning metadata to carry, and plain text drops the SSE envelope this otherwise never needed. Drops the now-unused ReadableStream/Response ESLint globals that only existed for the old SSE-based test fixture.

Copilot

Pull request overview

Adds an HTTP streaming endpoint for AI suggestions and wires it into the API, alongside extending the Vercel AI integration with a streaming call and updating tests/utilities to support streaming responses.

Changes:

Introduces GET /integration/ai/stream Express route and app wiring for AI suggestion streaming.
Extends the Vercel AI integration with a stream() method and adds service-level streamSuggestion().
Adds/updates Jest tests and introduces a reusable Express request/response test helper that can capture streamed bodies/headers.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/services/askAiRoutes.test.ts	New tests covering auth/validation/error cases and streaming response behavior for `/integration/ai/stream`.
test/services/askAi.test.ts	Adds service-level coverage for `streamSuggestion()` behavior.
test/integrations/vercel-ai.test.ts	Adds integration-level coverage for `vercelAIApi.stream()` forwarding to `streamText`.
test/integrations/github-routes.test.ts	Refactors tests to reuse the new `makeExpressRequest` helper.
test/helpers/expressRequest.ts	New helper to drive Express apps without a socket and capture streamed responses/headers.
src/services/types.ts	Exports `Event` type for reuse by services.
src/services/askAi/service.ts	Adds `streamSuggestion()` and refactors event lookup into `getEventOrThrow()`.
src/services/askAi/routes.ts	New Express router for AI streaming endpoint and authorization checks.
src/services/askAi/index.ts	Exports `appendAiAssistantRoutes` for app integration.
src/integrations/vercel-ai/index.ts	Adds `stream()` wrapper around `streamText` and centralizes provider gateway options.
src/index.ts	Registers AI assistant routes on the main Express app.
src/directives/requireUserInWorkspace.ts	Exports `checkUserInWorkspaceByProjectId` for use from Express routes.
package.json	Bumps package version.

Suppressed comments (2)

src/services/askAi/routes.ts:87

The inner catch converts any streamSuggestion error into a 404 and returns error.message to the caller. That will misreport transport/DB failures as "not found" and can leak internal error details (e.g. events factory errors that include ids). Only map the known not-found case to 404; rethrow unexpected errors so the outer handler can next(error) and return a 5xx.

      try {
        result = await askAiService.streamSuggestion(eventsFactory, eventId, originalEventId);
      } catch (error) {
        res.status(404).json({ error: error instanceof Error ? error.message : 'Event not found' });

src/services/askAi/routes.ts:91

This route calls result.pipeTextStreamToResponse(res), but the PR description says the AI SDK's toUIMessageStreamResponse() (a Fetch API Response) is adapted onto the Express response. As written, there is no adaptation and the call isn’t type-checked (because result is implicitly any), so a wrong method name or incompatible stream type would only fail at runtime. Consider explicitly using toUIMessageStreamResponse() and piping its status/headers/body into Express.

      result.pipeTextStreamToResponse(res);

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot review on #664: projectId comes from req.query, which Express parses as string[] for a repeated key (?projectId=a&projectId=b). The route cast it straight to string and forwarded it to checkUserInWorkspaceByProjectId/getEventsFactory, both expecting a single id - eventId and originalEventId already had the typeof guard this was missing. authorizeProjectAccess now validates and returns the narrowed id instead of the caller re-casting it. makeExpressRequest's query param takes string | string[] now, to let tests simulate a repeated key.

Copilot review on #664: getEventOrThrow only handled a falsy return from getEventRepetition, but it can also throw - EventsFactory throws "Cant find event repetition for repetitionId: ..." on an unmatched id, echoing the raw id back, and an invalid id format throws a raw BSON error. Both reached the HTTP route's catch block unfiltered. Catches and normalizes to the same generic message as the missing-event case.

The suggestion reaches the client only once the model has finished writing it, so nothing appears until the whole generation is done. Serve it from GET /integration/ai/stream, adapting the Fetch Response that toUIMessageStreamResponse returns onto the Express response. The route reuses the workspace membership check that guards the GraphQL field, which is why checkUserInWorkspaceByProjectId becomes exported.

pipeTextStreamToResponse writes the model's text as bare bytes under text/plain. The body then carries no framing, so everything in it is content by definition and the server has no way to tell the client that what follows is a failure rather than more of the answer. Serve the stream with pipeUIMessageStreamToResponse instead. The response becomes text/event-stream carrying typed parts, which leaves room for an error part alongside the text deltas.

Reversean requested a review from FeironoX5 July 28, 2026 14:48

This was referenced Jul 29, 2026

refactor(ai): move Ask AI domain logic out of the provider adapter #666

Open

feat(ai): defend Ask AI suggestions against prompt injection #667

Open

Reversean force-pushed the feat/ai-streaming branch from 2265cba to 6bf913f Compare July 29, 2026 13:26

Reversean changed the base branch from chore/bump-types-node to fix/ai-prompt-injection July 29, 2026 14:31

Reversean mentioned this pull request Jul 29, 2026

feat(ai): extend the prompt injection defense to streamed suggestions #668

Open

Reversean force-pushed the feat/ai-streaming branch from 2ee7bd0 to 497be8b Compare July 29, 2026 16:04

Reversean force-pushed the feat/ai-streaming branch from 497be8b to 9ff73a0 Compare July 29, 2026 16:07

Reversean force-pushed the feat/ai-streaming branch from 9ff73a0 to 8f8ee4a Compare July 29, 2026 17:21

Reversean changed the title ~~feat: stream AI suggestions over HTTP via a plain Express route~~ feat(ai): stream AI suggestions over HTTP Jul 29, 2026

Reversean force-pushed the feat/ai-streaming branch from 8f8ee4a to bd3667c Compare July 29, 2026 17:49

e11sy reviewed Jul 31, 2026

View reviewed changes

Reversean mentioned this pull request Aug 3, 2026

chore(lint): adopt eslint-config-codex 2.x #674

Draft

Reversean force-pushed the feat/ai-streaming branch from bd3667c to 97fa6c2 Compare August 5, 2026 12:35

neSpecc requested a lite review from Copilot August 5, 2026 12:49

Copilot started reviewing on behalf of neSpecc August 5, 2026 12:49 View session

Copilot AI reviewed Aug 5, 2026

View reviewed changes

Comment thread src/services/askAi/routes.ts

Comment thread src/services/askAi/service.ts Outdated

Reversean force-pushed the feat/ai-streaming branch from 815fba8 to c805ff1 Compare August 16, 2026 15:02

Reversean force-pushed the feat/ai-streaming branch from 07d849e to f77e029 Compare August 17, 2026 18:41

Navigation Menu

Uh oh!

feat(ai): stream AI suggestions over HTTP - #664

feat(ai): stream AI suggestions over HTTP#664
Reversean wants to merge 2 commits into
fix/ai-prompt-injectionfrom
feat/ai-streaming

Reversean commented Jul 28, 2026 •

edited

Loading

Uh oh!

e11sy Jul 31, 2026

Uh oh!

Reversean Aug 5, 2026

Uh oh!

e11sy Jul 31, 2026

Uh oh!

Reversean Aug 5, 2026

Uh oh!

Reversean Aug 16, 2026

Uh oh!

codecov-commenter commented Aug 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

Reversean commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

e11sy Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reversean Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

e11sy Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reversean Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reversean Aug 16, 2026

Choose a reason for hiding this comment

Uh oh!

codecov-commenter commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Reversean commented Jul 28, 2026 •

edited

Loading

codecov-commenter commented Aug 5, 2026 •

edited

Loading