feat(ai-sessions): persistent storage for AI design sessions

[Suharshit]

Why

The AI sidebar keeps its chat in React state only (useDesignAgent), so a reload loses the transcript and any in-flight run, and every prompt reaches the model with no history. This PR is step 1 of the AI sessions plan. It adds only the storage layer. The UI isn't connected yet; useDesignAgent and /api/ai/design are unchanged.

What

• Models: AiSession and AiMessage in prisma/models/ai-session.prisma, plus migration 20260915163917_add_ai_sessions.
  • The migration only adds tables, enums and indexes.
  • Sessions are deleted with their project, and messages with their session.
• Store: lib/ai/session-store.ts
  • Sessions expire 7 days after the last activity (expiresAt).
  • Each user keeps up to 10 sessions per project; creating another deletes the least recently active.
  • Up to 60 messages per session, 4,000 characters per message.
  • Every read skips expired sessions, even before the cleanup job removes them.
• Routes: all check Clerk auth and project access. Sessions are private to the user who created them; anyone else gets a 404.
  • GET/POST /api/projects/[projectId]/ai-sessions
  • GET/DELETE /api/projects/[projectId]/ai-sessions/[sessionId]
• Cleanup: GET /api/cron/ai-sessions/cleanup, scheduled daily at 03:00 UTC in the new vercel.json.
  • It requires Authorization: Bearer $CRON_SECRET.
  • It is listed as public in proxy.ts because Vercel Cron has no Clerk session.
• Types: types/ai-session.ts has request/response types without Prisma imports, for the client in step 2.

Deploy note

Set CRON_SECRET in the Vercel project's environment variables. Without it the cleanup route returns 401. It isn't in the committed .env.example, because .gitignore excludes .env*.

Verification

• pnpm typecheck and pnpm lint pass. Lint's only 2 warnings are in vendored skill templates.

• A tsx script against the database checked:

  • title cleanup and the 7-day expiry
  • the 10-session cap deleting the oldest rows
  • other users being unable to read or delete a session, or count toward the cap
  • transcripts loading
  • expired sessions hidden from get and list
  • cleanup deleting expired sessions along with their messages
  • deleting a project deleting its sessions

  Its test rows were removed afterwards.

• On a dev server: signed-out requests to the session routes are blocked by Clerk. The cron route returns 401 with no secret or a wrong one.

• Not yet exercised: the session routes with a signed-in user (step 2 uses them from the sidebar), and the cron route with the correct secret.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
draftly	Ready	Preview	Sep 15, 2026 4:47pm UTC

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: beb57d82-150d-462d-86eb-91c9aec5aaf7

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}