@posthog/mcp 0.10.7 → 0.10.9

package/src/extensions/instrumentation.ts

@@ -24,6 +24,7 @@ import {
   resolveConversationId,
 } from './conversation-id'
 import { stampMetaClientInfo } from './client-identity'
+import { addInstructionsToOutputSchemas, mirrorInstructionsIntoStructuredContent } from './output-instructions'
 import { captureEvent } from './capture'
 import { MCPAnalyticsEventType } from './event-types'
 import { captureException } from './exceptions'
@@ -31,7 +32,7 @@ import { resolveToolCallIntent, setEventIntent, setExplicitContextIntent } from
 import { getServerTrackingData, handleIdentify, setServerTrackingData, withIdentity } from './internal'
 import type { LoggerFn } from './logger'
 import { buildCapturedMcpParameters } from './mcp-payloads'
-import { getLiteralValue, getObjectShape } from './mcp-sdk-compat'
+import { readRequestHandlerMethod } from './mcp-sdk-compat'
 import { getSessionId, getSessionInfo, newSessionId } from './session'
 import { encodeSessionId, readMcpSessionHeader, writeSessionIdToTransport } from './session-token'
 import { getReportMissingToolDescriptor, resolveMissingCapabilityToolName } from './tools'
@@ -106,14 +107,7 @@ export async function captureToolCall(params: TraceToolCallParams): Promise<unkn
     parameterOwnership,
     resolvedEventType === MCPAnalyticsEventType.mcpMissingCapability
   )
-  const conversation = resolveConversationId(
-    ownership.conversationId,
-    request.params?.arguments,
-    request.params?.name,
-    resolvedEventType === MCPAnalyticsEventType.mcpMissingCapability
-      ? resolveMissingCapabilityToolName(data.options)
-      : ''
-  )
+  const conversation = resolveConversationId(ownership.conversationId, request.params?.arguments)
   const downstreamRequest = cloneRequestWithoutOwnedAnalyticsArguments(request, ownership)
 
   // Prepare the event in isolation: if identity/metadata/intent resolution
@@ -142,7 +136,7 @@ export async function captureToolCall(params: TraceToolCallParams): Promise<unkn
     throw error
   }
 
-  const finalResult = applyConversationPromptBack(preparedEvent?.event ?? null, result, conversation)
+  const finalResult = applyConversationInstructions(preparedEvent?.event ?? null, result, conversation, ownership)
   publishSuccessfulToolEvent(server, preparedEvent, finalResult, startTime, data.logger, takeCapturedError)
   return finalResult
 }
@@ -158,11 +152,28 @@ function getActiveAnalyticsParameterOwnership(
   override: AnalyticsParameterOwnership | undefined,
   isMissingCapabilityTool: boolean
 ): AnalyticsParameterOwnership {
-  const ownership = override ?? (toolName ? data.toolAnalyticsParameterOwnership.get(toolName) : undefined)
+  const listed = toolName ? data.toolAnalyticsParameterOwnership.get(toolName) : undefined
+  const ownership = override ?? listed
   return {
     context: !isMissingCapabilityTool && isContextEnabled(data.options.context) && ownership?.context === true,
-    conversationId:
-      !isMissingCapabilityTool && data.options.enableConversationId === true && ownership?.conversationId === true,
+    conversationId: data.options.enableConversationId === true && ownership?.conversationId === true,
+    // Deliberately read off `listed`, never the override. This asks whether
+    // `tools/list` actually declared `_mcp_instructions`, and only the advertised
+    // JSON Schema can answer it — an override is built from the live registry,
+    // which on the high-level path holds Zod.
+    //
+    // The cache is per-instance, so this is not merely "before the first
+    // `tools/list`": an instance that never serves a listing never writes the
+    // mirror at all. That is the per-request server pattern — `tools/list` lands
+    // on one instance, `tools/call` on a cold one — where the handle falls back
+    // to the `content` block and a structuredContent-only client misses it.
+    //
+    // Failing closed is deliberate. Writing a key the advertised schema did not
+    // declare fails the *entire* tool result under `additionalProperties: false`,
+    // so guessing costs the caller their result, while not guessing costs us one
+    // delivery channel. The fix is a process-scoped ownership cache, so a listing
+    // served by any instance answers for the rest — not a per-call guess.
+    outputInstructions: data.options.enableConversationId === true && listed?.outputInstructions === true,
   }
 }
 
@@ -196,11 +207,19 @@ async function prepareToolCallEvent(
   eventType: MCPAnalyticsEventType
 ): Promise<PreparedToolEvent | null> {
   try {
-    const sessionId = getSessionId(server, extra)
+    const sessionId = getSessionId(server, extra, conversation.conversationId)
     // Snapshot token/client/protocol metadata synchronously, before identify or
     // metadata callbacks can yield and let another request replace shared state.
     const sessionInfo = getSessionInfo(server, data, sessionId)
-    const identity = await handleIdentify(server, data, sessionId, request, sessionInfo, extra)
+    const identity = await handleIdentify(
+      server,
+      data,
+      sessionId,
+      request,
+      sessionInfo,
+      extra,
+      !!conversation.conversationId
+    )
     const requestAttribution = withIdentity(sessionInfo, identity)
 
     const toolName = request.params?.name
@@ -231,25 +250,51 @@ async function prepareToolCallEvent(
 }
 
 /**
- * When we minted a conversation id, append the prompt-back so the agent echoes
- * it on subsequent calls. If the result can't carry it, clear the id off the
- * event so analytics doesn't show an orphan the agent never received.
+ * Delivers the conversation session handle back to the agent, over both channels a tool
+ * result has:
+ *
+ * - `structuredContent`, on *every* response for a tool whose output schema we
+ *   declared the key on. Clients that read structured results never see the text
+ *   block, and re-sending it each time lets an agent that dropped the session handle read
+ *   it back.
+ * - `content`, as a text block, only on the response that minted the session handle.
+ *   Repeating it every call would put a `[SERVER]:` line in front of the user on
+ *   every single tool result.
+ *
+ * If neither channel could carry a session handle we minted, the agent never received it,
+ * so clear it off the event rather than showing analytics an id nobody has.
  */
-function applyConversationPromptBack(
+function applyConversationInstructions(
   event: McpEvent | null,
   result: unknown,
-  conversation: ConversationIdResolution
+  conversation: ConversationIdResolution,
+  ownership: AnalyticsParameterOwnership
 ): unknown {
-  if (!conversation.minted) {
+  const conversationId = conversation.conversationId
+  if (!conversationId) {
     return result
   }
-  if (canInjectConversationIdPromptBack(result)) {
-    return injectConversationIdPromptBack(result, conversation.conversationId)
+
+  let updated = result
+  let delivered = false
+
+  if (ownership.outputInstructions) {
+    const mirrored = mirrorInstructionsIntoStructuredContent(updated, conversationId)
+    delivered = mirrored !== updated
+    updated = mirrored
+  }
+
+  if (conversation.minted && canInjectConversationIdPromptBack(updated)) {
+    updated = injectConversationIdPromptBack(updated, conversationId)
+    delivered = true
   }
-  if (event) {
+
+  // Only a minted session handle can be lost this way — one the agent supplied, it has.
+  if (!delivered && conversation.minted && event) {
     event.conversationId = undefined
   }
-  return result
+
+  return updated
 }
 
 function publishSuccessfulToolEvent(
@@ -341,6 +386,37 @@ function rememberOriginalRequestHandler(
   handlers.set(handlerName, originalHandler)
 }
 
+/**
+ * Registers a synthetic fallback handler for `handlerName`, already wrapped in
+ * `patch`, by writing straight into `_requestHandlers` instead of going through
+ * `setRequestHandler`.
+ *
+ * Bypassing the SDK setter is deliberate, on three counts:
+ *
+ * - **Capability assertion.** `setRequestHandler` refuses a method the server
+ *   never declared a capability for, so instrumenting a low-level server built
+ *   without `capabilities.tools` used to throw `Server does not support tools`
+ *   and leave instrumentation half-applied. Our fallback is not a capability the
+ *   server offers — it exists only so a call for a tool nobody claims is still
+ *   captured — so the assertion has nothing to protect here.
+ * - **Schema validation.** The setter also wraps the handler in request/result
+ *   parsing, which a handler that can only ever throw `Unknown tool` never needs.
+ * - **Portability.** The setter's first argument is a Zod schema on SDK v1 and a
+ *   method string on v2; the map key is the same string on both, so this is the
+ *   one registration form that does not need to know which major it is talking
+ *   to — and it drops the last runtime `@modelcontextprotocol/sdk` import from
+ *   the shipped bundle.
+ */
+export function registerFallbackRequestHandler(
+  server: MCPServerLike,
+  handlerName: string,
+  fallbackHandler: MCPRequestHandler,
+  patch: HandlerPatch
+): void {
+  rememberOriginalRequestHandler(server, handlerName, fallbackHandler)
+  server._requestHandlers.set(handlerName, (request, extra) => patch(server, fallbackHandler, request, extra))
+}
+
 export function patchRequestHandlers(server: MCPServerLike, patches: Record<string, HandlerPatch>): void {
   // Monkey patch existing handlers.
   for (const [handlerName, patch] of Object.entries(patches)) {
@@ -352,18 +428,31 @@ export function patchRequestHandlers(server: MCPServerLike, patches: Record<stri
   }
 
   // Monkey patch dynamically added handlers (registered after instrument()).
-  const originalSetRequestHandler = server.setRequestHandler.bind(server)
-  server.setRequestHandler = ((requestSchema: unknown, originalHandler: MCPRequestHandler) => {
-    const shape = getObjectShape(requestSchema)
-    const handlerName = shape?.method ? getLiteralValue(shape.method) : undefined
-    const patch = typeof handlerName === 'string' ? patches[handlerName] : undefined
-    if (!patch || typeof handlerName !== 'string') {
-      return originalSetRequestHandler(requestSchema, originalHandler)
+  //
+  // Variadic, and every argument is forwarded verbatim. The registration form is
+  // the SDK's business, not ours — only *that* a registration happened is ours.
+  // SDK v2 has a three-argument form for custom methods,
+  // `setRequestHandler(method, { params, result }, handler)`, and a two-parameter
+  // wrapper drops the handler: the SDK then sees the schemas object where the
+  // handler should be and throws `setRequestHandler: handler is required`, which
+  // takes down the host server rather than just our instrumentation.
+  const originalSetRequestHandler = server.setRequestHandler.bind(server) as (...args: unknown[]) => unknown
+  server.setRequestHandler = ((...args: unknown[]) => {
+    const handlerName = readRequestHandlerMethod(args[0])
+    // `hasOwnProperty`, not a bare index: `handlerName` is now an arbitrary
+    // caller-supplied string, and a custom method named `toString` would
+    // otherwise resolve to an inherited function and be treated as a patch.
+    const patch =
+      handlerName !== undefined && Object.prototype.hasOwnProperty.call(patches, handlerName)
+        ? patches[handlerName]
+        : undefined
+    if (handlerName === undefined || !patch) {
+      return originalSetRequestHandler(...args)
     }
 
     // Register first so the MCP SDK's request/result validation stays inside
     // our analytics wrapper, matching handlers that existed before instrument().
-    const result = originalSetRequestHandler(requestSchema, originalHandler)
+    const result = originalSetRequestHandler(...args)
     const registeredHandler = server._requestHandlers.get(handlerName)
     if (registeredHandler) {
       rememberOriginalRequestHandler(server, handlerName, registeredHandler)
@@ -478,7 +567,7 @@ function cacheToolAnalyticsParameterOwnership(
   // Merge pages and concurrent enumerations; repeated tool names overwrite stale schemas.
   for (const tool of tools) {
     if (tool?.name) {
-      cache.set(tool.name, getAnalyticsParameterOwnership(tool.inputSchema))
+      cache.set(tool.name, getAnalyticsParameterOwnership(tool.inputSchema, tool.outputSchema))
     }
   }
 }
@@ -515,7 +604,6 @@ async function getTracedToolsList(
 
     if (data) {
       const missingToolName = resolveMissingCapabilityToolName(data.options)
-      let injectedMissingCapabilityTool = false
       if (data.options.reportMissing) {
         const alreadyPresent = tools.some((tool) => tool?.name === missingToolName)
         if (alreadyPresent) {
@@ -523,13 +611,17 @@ async function getTracedToolsList(
             `Warning: Cannot inject missing-capability tool "${missingToolName}" because a real tool already uses that name. The real tool will not be intercepted.`
           )
         } else {
-          tools.push(getReportMissingToolDescriptor(missingToolName))
-          injectedMissingCapabilityTool = true
+          const virtualTool = getReportMissingToolDescriptor(missingToolName)
+          tools.push(virtualTool)
+          // Cached separately because the virtual tool is added after the listing
+          // was cached, and its calls need ownership like any other tool's.
+          cacheToolAnalyticsParameterOwnership(data.toolAnalyticsParameterOwnership, [virtualTool])
         }
       }
 
       if (data.options.enableConversationId) {
-        tools = addConversationIdToTools(tools, missingToolName, injectedMissingCapabilityTool, data.logger)
+        tools = addConversationIdToTools(tools, data.logger)
+        tools = addInstructionsToOutputSchemas(tools, data.logger)
       }
     }
 

package/src/extensions/internal.ts

@@ -130,7 +130,14 @@ export async function handleIdentify(
   sessionId: string,
   request: MCPRequestLike,
   requestAttribution: SessionInfo,
-  extra?: CompatibleRequestHandlerExtra
+  extra?: CompatibleRequestHandlerExtra,
+  /**
+   * True when this session id came from an agent-carried `conversation_id`
+   * rather than the transport. Such a session is brand new and was never
+   * announced at `initialize`, whatever `data.sessionSource` still says about
+   * the connection.
+   */
+  sessionFromConversation = false
 ): Promise<UserIdentity | undefined> {
   const identityBeforeRequest = data.identifiedSessions.get(sessionId)
   const sessionSourceBeforeIdentify = data.sessionSource
@@ -166,7 +173,8 @@ export async function handleIdentify(
       // announced); revisit with the stateless-by-default rework.
       const changed = previousIdentity !== undefined && !areIdentitiesEqual(previousIdentity, mergedIdentity)
       const firstSeen = previousIdentity === undefined
-      const announcedAtInitialize = sessionSourceBeforeIdentify === 'token' && request.method !== 'initialize'
+      const announcedAtInitialize =
+        !sessionFromConversation && sessionSourceBeforeIdentify === 'token' && request.method !== 'initialize'
       const shouldPublish = changed || (firstSeen && !announcedAtInitialize)
 
       data.identifiedSessions.set(sessionId, mergedIdentity)

package/src/extensions/mcp-sdk-compat.ts

@@ -143,6 +143,24 @@ export function getObjectShape(schema: unknown): Record<string, unknown> | undef
   return rawShape
 }
 
+/**
+ * Reads the method name a `setRequestHandler` registration is for.
+ *
+ * The two SDK majors disagree on what the first argument is: v1 passes the Zod
+ * schema for the request and carries the method as a literal on its shape, v2
+ * passes the method string itself. A registration we cannot name is one we
+ * cannot match against a patch — which is how a handler registered after
+ * `instrument()` on v2 ends up replacing our wrapper instead of being wrapped.
+ */
+export function readRequestHandlerMethod(requestSchema: unknown): string | undefined {
+  if (typeof requestSchema === 'string') {
+    return requestSchema
+  }
+  const shape = getObjectShape(requestSchema)
+  const method = shape?.method ? getLiteralValue(shape.method) : undefined
+  return typeof method === 'string' ? method : undefined
+}
+
 export function getLiteralValue(schema: unknown): unknown {
   if (!schema || typeof schema !== 'object') {
     return

package/src/extensions/output-instructions.ts

@@ -0,0 +1,231 @@
+import type { LoggerFn } from './logger'
+import { log } from './logger'
+import type { AnalyticsInjectableJsonSchema } from './analytics-parameters'
+
+/**
+ * The `conversation_id` session handle reaches the agent as a text block appended to the
+ * tool result. That block is invisible to any client that reads
+ * `structuredContent` instead of `content` — which is what clients do whenever a
+ * tool declares an `outputSchema`. Measured against Claude Code, correlation for
+ * such tools drops to zero.
+ *
+ * The fix is to mirror the session handle into `structuredContent` as well, which this
+ * module does in two halves that must stay in that order:
+ *
+ *   1. declare `_mcp_instructions` on the tool's advertised `outputSchema`
+ *   2. write it into the result's `structuredContent`
+ *
+ * The declaration is what makes the write safe. The MCP client ajv-validates
+ * `structuredContent` against the schema from `tools/list`, and
+ * `zod-to-json-schema` emits `additionalProperties: false` for a plain
+ * `z.object`, so an undeclared key is not ignored — it fails the entire tool
+ * result. Only tools that got the declaration are ever written to.
+ */
+export const MCP_INSTRUCTIONS_KEY = '_mcp_instructions'
+
+const INSTRUCTIONS_FIELD_DESCRIPTION =
+  'Server-issued handles for this conversation, and what to do with them. Read and follow.'
+
+const CONVERSATION_ID_FIELD_DESCRIPTION =
+  'Echo this exact value as the conversation_id argument on every subsequent tool call.'
+
+export interface OutputInstructionsInjectableTool {
+  name?: string
+  outputSchema?: unknown
+  [key: string]: unknown
+}
+
+/**
+ * True when we can safely declare {@link MCP_INSTRUCTIONS_KEY} on this tool's
+ * advertised output schema.
+ *
+ * Requires a plain-object schema we can extend. A tool with no `outputSchema`
+ * has nothing to mirror into and keeps working through `content`; a composed
+ * schema (`oneOf`/`allOf`/`anyOf`/`$ref`) has no single `properties` bag to add
+ * to. Both stay content-only, matching the policy on the input side.
+ */
+export function canDeclareOutputInstructions(outputSchema: unknown): boolean {
+  if (!outputSchema || typeof outputSchema !== 'object') {
+    return false
+  }
+
+  // Only the JSON Schema a tool advertises can answer this. A Zod schema or raw
+  // shape — what the high-level registry stores — has no `properties` bag, so
+  // every check below would pass vacuously and report `true` for a tool whose
+  // schema we actually skipped. Refuse rather than guess: callers holding a Zod
+  // value must read the recorded answer off the ownership registry instead.
+  if (isSchemaObjectLike(outputSchema)) {
+    return false
+  }
+
+  const schema = outputSchema as AnalyticsInjectableJsonSchema
+  if (schema.$ref || schema.oneOf || schema.allOf || schema.anyOf) {
+    return false
+  }
+
+  // `properties` must be a plain object if it is present at all. A tool that
+  // advertises something else is malformed, and harmlessly so until we try to
+  // declare into it — assigning a key to a boolean throws, and that throw
+  // surfaces inside the `tools/list` wrapper, failing the entire listing over a
+  // schema we only wanted to annotate.
+  const { properties } = schema
+  if (
+    properties !== undefined &&
+    (typeof properties !== 'object' || properties === null || Array.isArray(properties))
+  ) {
+    return false
+  }
+  return !properties || !Object.prototype.hasOwnProperty.call(properties, MCP_INSTRUCTIONS_KEY)
+}
+
+/** A single Zod schema — the internals every version brands its instances with. */
+function isZodLike(entry: unknown): boolean {
+  return !!entry && typeof entry === 'object' && ('_def' in entry || '_zod' in entry || '~standard' in entry)
+}
+
+/**
+ * Whether this is a JSON Schema, judged on the *value* of each marker rather
+ * than the key alone — a raw Zod shape is free to name a field `type` or
+ * `properties`, but its values are Zod schemas, not a string and a property bag.
+ */
+function looksLikeJsonSchema(candidate: Record<string, unknown>): boolean {
+  if (typeof candidate.type === 'string' || typeof candidate.$ref === 'string') {
+    return true
+  }
+  if (Array.isArray(candidate.oneOf) || Array.isArray(candidate.allOf) || Array.isArray(candidate.anyOf)) {
+    return true
+  }
+  const { properties } = candidate
+  return !!properties && typeof properties === 'object' && !isZodLike(properties)
+}
+
+/** A Zod schema, or a raw shape whose values are Zod schemas. */
+function isSchemaObjectLike(value: unknown): boolean {
+  const candidate = value as Record<string, unknown>
+  if (isZodLike(candidate)) {
+    return true
+  }
+
+  // Settle "is this a JSON Schema" before scanning the values, because a schema
+  // may legitimately declare a property named `_def` — and the scan below would
+  // read that property's schema object as a Zod value and skip a tool we could
+  // have annotated perfectly well.
+  if (looksLikeJsonSchema(candidate)) {
+    return false
+  }
+  return Object.values(candidate).some(isZodLike)
+}
+
+/**
+ * Returns a copy of the tool with an optional {@link MCP_INSTRUCTIONS_KEY}
+ * property added to its output schema, or the tool untouched when it has no
+ * output schema to extend.
+ *
+ * The property is never added to `required` — a result without it must stay
+ * valid, since every tool result predating this change lacks it.
+ */
+export function addInstructionsToOutputSchema<TTool extends OutputInstructionsInjectableTool>(
+  tool: TTool,
+  logger: LoggerFn = log
+): TTool {
+  const toolName = tool.name || 'unknown'
+  const original = tool.outputSchema
+
+  // No output schema means the client reads `content`, where the session handle already
+  // rides. Nothing to declare, and nothing broken.
+  if (!original || typeof original !== 'object') {
+    return tool
+  }
+
+  if (!canDeclareOutputInstructions(original)) {
+    const schema = original as AnalyticsInjectableJsonSchema
+    if (schema.properties && Object.prototype.hasOwnProperty.call(schema.properties, MCP_INSTRUCTIONS_KEY)) {
+      logger(
+        `WARN: Tool "${toolName}" already declares '${MCP_INSTRUCTIONS_KEY}' in its output schema. Leaving it alone.`
+      )
+    } else {
+      logger(
+        `WARN: Tool "${toolName}" has a complex output schema (oneOf/allOf/anyOf/$ref). Skipping '${MCP_INSTRUCTIONS_KEY}' declaration; its session handle stays content-only.`
+      )
+    }
+    return tool
+  }
+
+  const modifiedTool = { ...tool }
+  // Deep copy: the server may reuse or freeze the schema object it handed us.
+  const outputSchema = JSON.parse(JSON.stringify(original)) as AnalyticsInjectableJsonSchema
+
+  if (!outputSchema.properties) {
+    outputSchema.properties = {}
+  }
+
+  outputSchema.properties[MCP_INSTRUCTIONS_KEY] = {
+    type: 'object',
+    description: INSTRUCTIONS_FIELD_DESCRIPTION,
+    properties: {
+      conversation_id: {
+        type: 'string',
+        description: CONVERSATION_ID_FIELD_DESCRIPTION,
+      },
+      instructions: { type: 'string' },
+    },
+  }
+
+  modifiedTool.outputSchema = outputSchema
+  return modifiedTool
+}
+
+/**
+ * Declares {@link MCP_INSTRUCTIONS_KEY} across a tool listing. Tools without an
+ * output schema, and tools whose schema we cannot extend, pass through unchanged.
+ */
+export function addInstructionsToOutputSchemas<TTool extends OutputInstructionsInjectableTool>(
+  tools: TTool[],
+  logger: LoggerFn = log
+): TTool[] {
+  return tools.map((tool) => addInstructionsToOutputSchema(tool, logger))
+}
+
+export interface ConversationInstructions {
+  conversation_id: string
+  instructions: string
+}
+
+const ECHO_INSTRUCTION = 'Send this conversation_id as an argument on every subsequent tool call in this conversation.'
+
+/** The payload mirrored into `structuredContent` for a tool we declared the key on. */
+export function buildConversationInstructions(conversationId: string): ConversationInstructions {
+  return { conversation_id: conversationId, instructions: ECHO_INSTRUCTION }
+}
+
+/**
+ * Adds {@link MCP_INSTRUCTIONS_KEY} to a result's `structuredContent`, which is
+ * where clients look once a tool declares an `outputSchema` — the `content` text
+ * block carrying the session handle is invisible to them.
+ *
+ * Unlike the text block, this rides *every* response rather than only the one
+ * that minted the session handle, so an agent that drops it can read it back.
+ *
+ * Returns the result untouched when there is no plain-object `structuredContent`
+ * to extend, or when the tool already produced its own key — customer data wins.
+ * Never mutates the input.
+ */
+export function mirrorInstructionsIntoStructuredContent(result: unknown, conversationId: string): unknown {
+  if (!result || typeof result !== 'object') {
+    return result
+  }
+  const structuredContent = (result as { structuredContent?: unknown }).structuredContent
+  if (!structuredContent || typeof structuredContent !== 'object' || Array.isArray(structuredContent)) {
+    return result
+  }
+  if (Object.prototype.hasOwnProperty.call(structuredContent, MCP_INSTRUCTIONS_KEY)) {
+    return result
+  }
+  return {
+    ...result,
+    structuredContent: {
+      ...structuredContent,
+      [MCP_INSTRUCTIONS_KEY]: buildConversationInstructions(conversationId),
+    },
+  }
+}