[tannerlinsley]

Saved-project sync detached crypto.randomUUID from its Crypto receiver. Chrome rejects that call with Illegal invocation when generating a browser session after the save redirect. Call it through crypto in both default generators.

Adds regressions that enforce the browser receiver check for both the session helper and saved-project sync startup. Both failed before the fix and pass now. All 16 sync tests pass, and the local full test, type, and lint checks pass.

This PR contains only the sync fix and its tests. No OpenRouter integration, dependency changes, or database migrations.

Summary by CodeRabbit

• Bug Fixes

  • Improved browser session ID generation to reliably use the browser’s native cryptographic context.
  • Ensured saved project sync clients initialize with a consistent browser session ID.

• Tests

  • Added coverage for session ID generation and default project sync client initialization.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a697306f-5239-4c8b-8e37-173b85ec31ca

📥 Commits

Reviewing files that changed from the base of the PR and between aeff399 and ee7cf29.

📒 Files selected for processing (2)

• src/utils/builder-project-sync.client.ts
• tests/builder-project-sync-client.test.ts

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The change wraps crypto.randomUUID in receiver-preserving arrow functions for browser session ID generation. Tests verify the Crypto receiver, UUID format, stable storage behavior, and default project sync client initialization.

Changes

Browser session ID generation

Layer / File(s)	Summary
Receiver-safe session ID generation src/utils/builder-project-sync.client.ts, tests/builder-project-sync-client.test.ts	The session ID helpers now invoke crypto.randomUUID with the Crypto receiver. Tests verify the receiver, UUID format, and repeated session ID behavior.
Default client session initialization tests/builder-project-sync-client.test.ts	A test verifies that a client without a custom session ID generator uses getBuilderProjectBrowserSessionId.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to ee7cf

Saved Builder projects now generate browser session IDs without the Chrome Illegal invocation failure. Coverage includes both affected startup paths, so the change is ready to merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: fixing the Illegal invocation error when opening saved Builder projects.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch taren/builder-session-crypto

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}