Feature/sc 41194/ research this and cost it configure and3

[stevekaplan123]

This PR adds conversation turn limits and adds a setting to prohibit excessive prompt sizes via MAX_INPUT_CHARS. Both maximum number of prompts and maximum number of characters per prompt can be set by admins in RemoteConfig. However, for security reasons, both of these values are now set in the chatbot's settings.py so that absolute maximums of 10,000 characters and 100 prompts prohibit users from abusing our system. Once the user hits the maximum, the server returns an error which is handled by the client to stop the user from continuing the conversation.

[coolify-sefaria-github]

The preview deployment for sefaria/ai-chatbot:server is ready. 🟢

Open app | Open Build Logs | Open Application Logs

Last updated at: 2026-03-19 07:12:46 CET

[Copilot]

Pull request overview

This PR adds conversation turn limits and localized welcome messages to the chatbot. It introduces server-side enforcement of maximum prompts per session and maximum input character length, with corresponding client-side handling to disable input when limits are reached. It also adds context-aware welcome messages (first visit, restart, new session) with English/Hebrew localization support.

Changes:

• Server-side turn limit (MAX_PROMPTS) and input length (MAX_INPUT_CHARS) enforcement in the V2 streaming chat endpoint, with settings exposed via environment variables
• Client-side turn counting, limit display, and input disabling when conversation limits are reached, including both prop-based and server-based limit configuration
• Localized welcome messages with different text for first-time users, conversation restarts, and new sessions, supporting English and Hebrew

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
server/chatbot_server/settings.py	Adds MAX_PROMPTS and MAX_INPUT_CHARS settings from environment variables
server/chat/V2/views.py	Enforces turn limit (429) and input length (400) before processing chat requests; exposes maxPrompts in session info
server/chat/views.py	Exposes maxPrompts in the history endpoint's session info
src/components/LCChatbot.svelte	Adds client-side turn limit tracking, localized welcome messages, assistant bubble snippet, smaller default panel size
src/lib/storage.js	Adds HAS_USED storage key for first-time user detection
src/CLAUDE.md	Documents the new max-prompts widget attribute

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[yodem]

Review: SC-41194 — Conversation Turn Limit (ai-chatbot side)

The turn limit implementation is solid overall — server-side enforcement with MAX_PROMPTS and MAX_INPUT_CHARS in settings, 429 response code, and client-side sync of limits. A few issues to address below.

[yodem]

Moving syncSessionState() from the explicit openPanel() call into an $effect block means it will re-fire whenever any of sessionId, apiBaseUrl, or isOpen changes reactively. If sessionId is reassigned during chat flow (e.g., after handleNewChat), this could trigger an extra sync.

Not necessarily a bug, but worth verifying it doesn't cause duplicate API calls. The previous approach of calling sync explicitly on panel open was more predictable.

[stevekaplan123]

Before, when the user reset the page, and the chat was already open, the session state wouldn't sync and turn_count would be 0 allowing for longer conversations. So this change is mostly a good thing. However, you're right that there is an unnecessary API call when someone restarts the chat. I will change the code accordingly to prevent that.