Token counting is performed before API calls to prevent hard limit errors

Sending an oversized payload to the AI API is never free — even when the provider rejects it. The request consumes a full network round-trip, counts toward rate limit quotas on some configurations, and surfaces to the user as a generic 500 error rather than an actionable message. CWE-770 and CWE-400 both apply: unguarded resource allocation with no application-side limit check. NIST AI RMF MANAGE 1.3 requires predictable failure modes; a silent hard crash on context overflow is the opposite. A pre-flight guard converts this crash into a recoverable, user-friendly state.

Add a synchronous token check before every AI call that returns a structured 422 response when the payload would exceed the model's limit. Reserve headroom for the expected response length.

// src/app/api/chat/route.ts
const RESPONSE_RESERVE = 1000;

const totalTokens = countMessageTokens([
  { role: "system", content: systemPrompt },
  ...boundedMessages,
], model);

if (totalTokens > MODEL_CONFIG[model].contextWindow - RESPONSE_RESERVE) {
  return Response.json(
    { error: "Conversation is too long. Please start a new chat to continue." },
    { status: 422 }
  );
}

Verify by constructing a payload that exceeds the limit and confirming the UI displays the specific error rather than a generic failure screen.