@vellumai/assistant 0.10.8 → 0.10.9-dev.202607152225.ec6fdbf

package/src/persistence/conversation-crud.ts

@@ -35,6 +35,7 @@ import { HOOKS } from "../plugin-api/constants.js";
 import { forkConversationMemory } from "../plugins/defaults/memory/fork-conversation-memory.js";
 import { indexMessageNow } from "../plugins/defaults/memory/indexer.js";
 import { runHook } from "../plugins/pipeline.js";
+import type { ContentBlock } from "../providers/types.js";
 import { getCurrentSeq } from "../runtime/assistant-stream-state.js";
 import { publishSyncInvalidation } from "../runtime/sync/sync-publisher.js";
 import { trustClassSchema } from "../runtime/trust-class.js";
@@ -77,6 +78,7 @@ import {
   getDb,
   getLogsDb,
   getSqliteFrom,
+  getTelemetryDb,
 } from "./db-connection.js";
 import {
   copyForkMessagesViaSubprocess,
@@ -88,7 +90,8 @@ import {
   enqueueLexicalIndexForMessage,
   enqueuePurgeConversationLexical,
 } from "./job-handlers/message-lexical.js";
-import { resolveStoredMessageContent } from "./message-content-file.js";
+import { buildLifecycleTelemetryEvent } from "./lifecycle-events-store.js";
+import { resolveMessageContentBlocks } from "./message-content-file.js";
 import {
   rawAll,
   rawExec,
@@ -96,6 +99,7 @@ import {
   rawLogsRun,
   rawMemoryRun,
   rawRun,
+  rawTelemetryRun,
 } from "./raw-query.js";
 import {
   channelInboundEvents,
@@ -105,7 +109,7 @@ import {
   memorySegments,
   messageAttachments,
   messages,
-  skillLoadedEvents,
+  telemetryEvents,
   toolInvocations,
 } from "./schema/index.js";
 import { timeSyncSection } from "./slow-sync-log.js";
@@ -125,6 +129,20 @@ function logsDb(): DrizzleDb {
   return db;
 }
 
+/**
+ * The telemetry connection (`assistant-telemetry.db`), where the
+ * `telemetry_events` outbox lives. Throws if the file cannot be opened — the
+ * conversation-delete call sites must not report success while unshipped
+ * events referencing the deleted conversation survive to be flushed.
+ */
+function telemetryDb(): DrizzleDb {
+  const db = getTelemetryDb();
+  if (!db) {
+    throw new Error("telemetry database unavailable");
+  }
+  return db;
+}
+
 // ── Message metadata Zod schema ──────────────────────────────────────
 // Validates the JSON stored in messages.metadata. Known fields are typed;
 // extra keys are allowed via passthrough so callers can attach ad-hoc data.
@@ -193,6 +211,17 @@ export const messageMetadataSchema = z
      * and read gate (conversation history loading) to enforce trust-aware access.
      */
     provenanceTrustClass: trustClassSchema.optional(),
+    /**
+     * Model that actually served this assistant row, carried on the agent
+     * loop's `message_complete` event (the provider's `response.model`, the
+     * same value `llm_usage` records) and persisted with the finalized content.
+     * Reflects per-call reroutes by a `pre-model-call` hook. Present only on
+     * assistant rows produced by a real model call; absent on user rows,
+     * tool-result rows, and synthetic assistant rows (provider-error / yield
+     * notices). Turn-trace assembly surfaces it as the per-message
+     * `TurnTraceMessage.model`.
+     */
+    model: z.string().optional(),
     provenanceSourceChannel: channelIdSchema.optional(),
     provenanceGuardianExternalUserId: z.string().optional(),
     provenanceRequesterIdentifier: z.string().optional(),
@@ -447,8 +476,13 @@ export interface MessageRow {
   id: string;
   conversationId: string;
   role: string;
-  /** Resolved content — always inline JSON, never a raw `{ ref }`. */
-  content: string;
+  /**
+   * Typed content blocks, resolved at the row-fetch chokepoint by
+   * `resolveMessageContentBlocks`: inline JSON parses, file-backed
+   * `{ ref }` rows fold their delta file, and legacy plain strings arrive
+   * wrapped in a single text block.
+   */
+  content: ContentBlock[];
   createdAt: number;
   metadata: string | null;
   clientMessageId: string | null;
@@ -460,12 +494,7 @@ const parseMessage = createRowMapper<typeof messages.$inferSelect, MessageRow>({
   id: "id",
   conversationId: "conversationId",
   role: "role",
-  // File-backed `{ ref }` content is resolved here, at the row-fetch
-  // chokepoint, so every consumer of MessageRow sees inline content.
-  content: {
-    from: "content",
-    transform: (v) => resolveStoredMessageContent(v as string),
-  },
+  content: { from: "content", transform: resolveMessageContentBlocks },
   createdAt: "createdAt",
   metadata: "metadata",
   clientMessageId: "clientMessageId",
@@ -504,6 +533,8 @@ interface InsertMessageCoreParams {
   conversationId: string;
   role: MessageRole;
   content: string;
+  /** 0 = row is born streaming (content is an in-flight `{ ref }`). Defaults to 1. */
+  finalized?: 0 | 1;
   metadata?: Record<string, unknown>;
   clientMessageId?: string;
   /** Pre-assigned message ID. When omitted, a time-ordered `uuidv7()` is
@@ -537,8 +568,15 @@ interface InsertMessageCoreParams {
 async function insertMessageCore(
   params: InsertMessageCoreParams,
 ): Promise<InsertedMessage> {
-  const { conversationId, role, content, metadata, clientMessageId, id } =
-    params;
+  const {
+    conversationId,
+    role,
+    content,
+    finalized,
+    metadata,
+    clientMessageId,
+    id,
+  } = params;
   const db = getDb();
   // Time-ordered UUIDv7 so server-generated message ids append to the tail of
   // the WITHOUT ROWID `messages` primary key instead of scattering (v4).
@@ -574,6 +612,7 @@ async function insertMessageCore(
             role,
             content,
             createdAt: now,
+            ...(finalized !== undefined ? { finalized } : {}),
             ...(metadataStr ? { metadata: metadataStr } : {}),
             ...(clientMessageId ? { clientMessageId } : {}),
           };
@@ -1077,7 +1116,7 @@ export function forkConversation(params: {
         id: forkedMessageId,
         conversationId: fc.id,
         role: message.role,
-        content: message.content,
+        content: JSON.stringify(message.content),
         createdAt: message.createdAt,
         metadata: cloneForkMessageMetadata(message.metadata, message.id),
       };
@@ -1617,12 +1656,20 @@ export function deleteConversation(id: string): DeletedMemoryIds {
   const convBeforeDelete = getConversation(id);
   const createdAtForDiskCleanup = convBeforeDelete?.createdAt;
 
-  // llm_request_logs lives in the dedicated logs connection, so it is deleted
-  // there — separately from the main-DB transaction below.
+  // llm_request_logs and pending telemetry_events rows live in the dedicated
+  // logs and telemetry connections, so they are deleted there — separately
+  // from (and before) the main-DB transaction below, so a failure leaves the
+  // conversation intact for a retried delete. Telemetry redaction keys on
+  // conversation_id regardless of event name, so every conversation-scoped
+  // pending event is covered.
   logsDb()
     .delete(llmRequestLogs)
     .where(eq(llmRequestLogs.conversationId, id))
     .run();
+  telemetryDb()
+    .delete(telemetryEvents)
+    .where(eq(telemetryEvents.conversationId, id))
+    .run();
 
   db.transaction((tx) => {
     // Collect all message IDs for this conversation.
@@ -1646,9 +1693,6 @@ export function deleteConversation(id: string): DeletedMemoryIds {
       tx.delete(toolInvocations)
         .where(eq(toolInvocations.conversationId, id))
         .run();
-      tx.delete(skillLoadedEvents)
-        .where(eq(skillLoadedEvents.conversationId, id))
-        .run();
       // Cascade deletes memory_segments, message_attachments.
       tx.delete(messages).where(eq(messages.conversationId, id)).run();
 
@@ -1668,9 +1712,6 @@ export function deleteConversation(id: string): DeletedMemoryIds {
       tx.delete(toolInvocations)
         .where(eq(toolInvocations.conversationId, id))
         .run();
-      tx.delete(skillLoadedEvents)
-        .where(eq(skillLoadedEvents.conversationId, id))
-        .run();
     }
 
     tx.delete(conversations).where(eq(conversations.id, id)).run();
@@ -1746,6 +1787,16 @@ export async function deleteConversationGently(
     .all()
     .map((r) => r.id);
 
+  // Pending telemetry_events rows live in the dedicated telemetry connection;
+  // delete them there (by conversation_id, regardless of event name) before
+  // ANY destructive work so a telemetry failure leaves the conversation fully
+  // intact for a retried delete — a throw after the bulk drains below would
+  // strand unredacted rows that could still flush.
+  telemetryDb()
+    .delete(telemetryEvents)
+    .where(eq(telemetryEvents.conversationId, id))
+    .run();
+
   // llm_request_logs lives in the dedicated logs connection, and each row is
   // bulky, so drain it off the event loop in batches against the logs DB file.
   const logsDel = await deleteConversationRowsInBatches({
@@ -1778,9 +1829,6 @@ export async function deleteConversationGently(
     tx.delete(toolInvocations)
       .where(eq(toolInvocations.conversationId, id))
       .run();
-    tx.delete(skillLoadedEvents)
-      .where(eq(skillLoadedEvents.conversationId, id))
-      .run();
 
     // Clean up segment embeddings (not FK-linked to segments, so the message
     // cascade above did not remove them).
@@ -2932,6 +2980,17 @@ export async function clearAll(): Promise<{
     }
   };
 
+  // Pending skill_loaded rows live in the telemetry_events outbox on the
+  // dedicated telemetry connection. Redact them FIRST, before any destructive
+  // delete: unshipped skill events reference conversations this wipe must
+  // redact, so a telemetry failure must abort the clear-all while the
+  // workspace is still fully intact — never after memory state is already
+  // gone.
+  rawTelemetryRun(
+    "conversation:clearAll:skillLoadedEvents",
+    "DELETE FROM telemetry_events WHERE name = 'skill_loaded'",
+  );
+
   // Delete in dependency order. Cascades handle memory_segments and
   // tool_invocations, but we explicitly clear non-cascading memory
   // tables too.
@@ -2939,8 +2998,8 @@ export async function clearAll(): Promise<{
   await runOrThrow("DELETE FROM memory_summaries");
   await runOrThrow("DELETE FROM memory_embeddings");
   // memory_jobs and llm_request_logs each live in their own dedicated
-  // connection; clear them directly on those connections rather than through a
-  // sqlite3 subprocess.
+  // connection; clear them directly on those connections rather than through
+  // a sqlite3 subprocess.
   rawMemoryRun("conversation:clearAll:memoryJobs", "DELETE FROM memory_jobs");
   await runOrThrow("DELETE FROM memory_checkpoints");
   rawLogsRun(
@@ -2951,19 +3010,32 @@ export async function clearAll(): Promise<{
   await runOrThrow("DELETE FROM message_attachments");
   await runOrThrow("DELETE FROM attachments");
   await runOrThrow("DELETE FROM tool_invocations");
-  await runOrThrow("DELETE FROM skill_loaded_events");
   await runOrThrow("DELETE FROM messages");
   await runOrThrow("DELETE FROM conversations");
 
-  // Record audit event — lifecycle_events is NOT deleted by clearAll(),
-  // so this survives the wipe and provides a permanent trail.
-  rawRun(
-    "conversation:clearAll:auditEvent",
-    `INSERT INTO lifecycle_events (id, event_name, created_at) VALUES (?, ?, ?)`,
-    uuid(),
-    "conversations_clear_all",
-    Date.now(),
-  );
+  // Record audit event into the telemetry_events outbox (consent-bypassing);
+  // the trail persists platform-side once flushed. Best-effort: the
+  // destructive deletes above already completed, so telemetry degradation
+  // must not turn a finished wipe into a failure or skip the cleanup below.
+  try {
+    const auditEventId = uuid();
+    const auditEventAt = Date.now();
+    rawTelemetryRun(
+      "conversation:clearAll:auditEvent",
+      `INSERT INTO telemetry_events (id, name, created_at, conversation_id, payload) VALUES (?, 'lifecycle', ?, NULL, ?)`,
+      auditEventId,
+      auditEventAt,
+      JSON.stringify(
+        buildLifecycleTelemetryEvent(
+          auditEventId,
+          "conversations_clear_all",
+          auditEventAt,
+        ),
+      ),
+    );
+  } catch (err) {
+    log.warn({ err }, "clearAll: failed to record audit event");
+  }
 
   // Drop the whole lexical (Qdrant) collection — a "delete all" leaves no ids
   // to key per-message cleanup on. AWAITED so the drop completes before
@@ -3101,30 +3173,49 @@ export async function reserveMessage(
   conversationId: string,
   role: MessageRole,
   metadata?: Record<string, unknown>,
+  /**
+   * Workspace-relative in-flight delta-file path. When provided, the row is
+   * created already streaming — `content` holds the `{ ref }` pointer and
+   * `finalized = 0` — so no later row write is needed to enter the
+   * streaming state. The finalize seam folds the row inline.
+   */
+  inflightRef?: string,
 ) {
   return insertMessageCore({
     conversationId,
     role,
-    content: "[]",
+    content: inflightRef ? JSON.stringify({ ref: inflightRef }) : "[]",
+    ...(inflightRef ? { finalized: 0 as const } : {}),
     metadata,
   });
 }
 
 /**
- * Update the content of an existing message. Used when consolidating
- * multiple assistant messages into one.
+ * Update the content of an existing message in place. Used for edits to
+ * already-finalized rows: consolidation, channel edit propagation, and the
+ * post-finalize tool-timing stamps (`_startedAt`/`_previewStartedAt`).
+ * Streaming writes do NOT come through here — the agent loop's partial
+ * flushes append to the in-flight delta file (`inflight-message-content.ts`)
+ * and land on the row once, at the finalize seam.
  *
- * This is a pure CRUD primitive: it does NOT enqueue a lexical reindex, because
- * it is also driven by mid-stream partial flushes and high-frequency tool-timing
- * stamps (`_startedAt`/`_previewStartedAt`) that either don't change searchable
- * text or would spam reindex jobs. Callers on genuine content-change seams
- * (streaming finalize, channel edits, consolidation) enqueue the reindex
- * themselves via `enqueueLexicalIndexForMessage`.
+ * This is a pure CRUD primitive: it does NOT enqueue a lexical reindex
+ * (the timing stamps don't change searchable text and would spam reindex
+ * jobs). Callers on genuine content-change seams (channel edits,
+ * consolidation) enqueue the reindex themselves via
+ * `enqueueLexicalIndexForMessage`.
  */
 export function updateMessageContent(
   messageId: string,
   newContent: string,
+  metadataUpdates?: Record<string, unknown>,
 ): void {
+  // When metadata updates ride along (e.g. the served model stamped at
+  // assistant-row finalize), delegate to the transactional content+metadata
+  // writer so both land atomically.
+  if (metadataUpdates) {
+    updateMessageContentAndMetadata(messageId, newContent, metadataUpdates);
+    return;
+  }
   const db = getDb();
   db.update(messages)
     .set({ content: newContent })
@@ -3132,6 +3223,45 @@ export function updateMessageContent(
     .run();
 }
 
+/**
+ * Terminal content write for a message: store the folded inline content and
+ * set `finalized = 1` in the same statement (with optional metadata riding
+ * the same transaction). After this, the row is immutable streaming-wise and
+ * eligible for batch readers (search, memory indexing).
+ */
+export function finalizeMessageContent(
+  messageId: string,
+  contentJson: string,
+  metadataUpdates?: Record<string, unknown>,
+): void {
+  const db = getDb();
+  if (!metadataUpdates) {
+    db.update(messages)
+      .set({ content: contentJson, finalized: 1 })
+      .where(eq(messages.id, messageId))
+      .run();
+    return;
+  }
+  db.transaction((tx) => {
+    const row = tx
+      .select({ metadata: messages.metadata })
+      .from(messages)
+      .where(eq(messages.id, messageId))
+      .get();
+    const existing = row?.metadata
+      ? (JSON.parse(row.metadata) as Record<string, unknown>)
+      : {};
+    tx.update(messages)
+      .set({
+        content: contentJson,
+        finalized: 1,
+        metadata: JSON.stringify({ ...existing, ...metadataUpdates }),
+      })
+      .where(eq(messages.id, messageId))
+      .run();
+  });
+}
+
 /**
  * Merge `updates` into the metadata JSON of an existing message.
  * Reads the current metadata, shallow-merges the new fields, and writes back.

package/src/persistence/conversation-disk-view.ts

@@ -143,7 +143,9 @@ interface FlattenedContent {
  * Parse the message `content` JSON string (ContentBlock[]) and extract
  * text, tool_use, and tool_result blocks into flat fields.
  */
-export function flattenContentBlocks(rawContent: string): FlattenedContent {
+export function flattenContentBlocks(
+  rawContent: string | ContentBlock[],
+): FlattenedContent {
   const result: FlattenedContent = {
     content: "",
     toolCalls: [],
@@ -151,16 +153,20 @@ export function flattenContentBlocks(rawContent: string): FlattenedContent {
   };
 
   let blocks: ContentBlock[];
-  try {
-    const parsed = JSON.parse(rawContent);
-    if (!Array.isArray(parsed)) {
-      // Plain text content (not block array)
+  if (Array.isArray(rawContent)) {
+    blocks = rawContent;
+  } else {
+    try {
+      const parsed = JSON.parse(rawContent);
+      if (!Array.isArray(parsed)) {
+        // Plain text content (not block array)
+        return { ...result, content: rawContent };
+      }
+      blocks = parsed;
+    } catch {
+      // Not valid JSON — treat as plain text
       return { ...result, content: rawContent };
     }
-    blocks = parsed;
-  } catch {
-    // Not valid JSON — treat as plain text
-    return { ...result, content: rawContent };
   }
 
   const textParts: string[] = [];
@@ -198,7 +204,9 @@ export function flattenContentBlocks(rawContent: string): FlattenedContent {
  */
 export function resolveUniqueFilename(dir: string, filename: string): string {
   const sanitized = basename(filename);
-  if (!existsSync(join(dir, sanitized))) return sanitized;
+  if (!existsSync(join(dir, sanitized))) {
+    return sanitized;
+  }
 
   const ext = extname(sanitized);
   const base = basename(sanitized, ext);
@@ -235,7 +243,9 @@ function writeAttachmentFile(
     }
 
     const content = getAttachmentContent(attachmentId);
-    if (!content) return null;
+    if (!content) {
+      return null;
+    }
 
     const resolvedName = resolveUniqueFilename(attachDir, originalFilename);
     writeFileSync(join(attachDir, resolvedName), content);
@@ -301,11 +311,18 @@ export function syncMessageToDisk(
       ts: new Date(message.createdAt).toISOString(),
     };
 
-    if (content) record.content = content;
-    if (toolCalls.length > 0) record.toolCalls = toolCalls;
-    if (toolResults.length > 0) record.toolResults = toolResults;
-    if (attachmentFilenames.length > 0)
+    if (content) {
+      record.content = content;
+    }
+    if (toolCalls.length > 0) {
+      record.toolCalls = toolCalls;
+    }
+    if (toolResults.length > 0) {
+      record.toolResults = toolResults;
+    }
+    if (attachmentFilenames.length > 0) {
       record.attachments = attachmentFilenames;
+    }
     if (message.metadata) {
       try {
         record.metadata = JSON.parse(message.metadata);

package/src/persistence/conversation-group-migration.test.ts

@@ -1,11 +1,4 @@
-import { beforeAll, describe, expect, mock, test } from "bun:test";
-
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
+import { beforeAll, describe, expect, test } from "bun:test";
 
 import { ensureGroupMigration } from "./conversation-group-migration.js";
 import { initializeDb } from "./db-init.js";

package/src/persistence/conversation-title-service.ts

@@ -98,7 +98,9 @@ const REPLACEABLE_PATTERNS = [
  * user-provided custom titles.
  */
 export function isReplaceableTitle(title: string | null): boolean {
-  if (title == null || title.trim() === "") return true;
+  if (title == null || title.trim() === "") {
+    return true;
+  }
   return REPLACEABLE_PATTERNS.some((pattern) => pattern.test(title));
 }
 
@@ -467,12 +469,21 @@ function buildTitlePrompt(
 
   if (context) {
     const hints: string[] = [];
-    if (context.sourceChannel) hints.push(`Channel: ${context.sourceChannel}`);
-    if (context.displayName) hints.push(`User: ${context.displayName}`);
-    if (context.systemHint) hints.push(`Context: ${context.systemHint}`);
-    if (context.uxBrief) hints.push(`Brief: ${context.uxBrief}`);
-    if (context.metadataHints?.length)
+    if (context.sourceChannel) {
+      hints.push(`Channel: ${context.sourceChannel}`);
+    }
+    if (context.displayName) {
+      hints.push(`User: ${context.displayName}`);
+    }
+    if (context.systemHint) {
+      hints.push(`Context: ${context.systemHint}`);
+    }
+    if (context.uxBrief) {
+      hints.push(`Brief: ${context.uxBrief}`);
+    }
+    if (context.metadataHints?.length) {
       hints.push(`Hints: ${context.metadataHints.join(", ")}`);
+    }
     if (hints.length > 0) {
       parts.push("Metadata:", ...hints, "");
     }
@@ -513,7 +524,9 @@ function retryableFallbackLogFields(
     reason,
     fallbackSource: params.context ? "context" : "untitled",
   };
-  if (err) fields.err = err;
+  if (err) {
+    fields.err = err;
+  }
   return fields;
 }
 
@@ -546,14 +559,18 @@ const MAX_TITLE_LENGTH = 40;
 const MAX_TITLE_WORDS = 7;
 
 function truncateTitle(title: string): string {
-  if (title.length <= MAX_TITLE_LENGTH) return title;
+  if (title.length <= MAX_TITLE_LENGTH) {
+    return title;
+  }
   const words = title.split(/\s+/);
   if (words.length <= MAX_TITLE_WORDS) {
     // Long words but few of them — truncate to char limit at word boundary
     let result = "";
     for (const word of words) {
       const candidate = result ? result + " " + word : word;
-      if (candidate.length > MAX_TITLE_LENGTH) break;
+      if (candidate.length > MAX_TITLE_LENGTH) {
+        break;
+      }
       result = candidate;
     }
     return result || title.slice(0, MAX_TITLE_LENGTH);
@@ -566,7 +583,9 @@ function normalizeTitle(raw: string): string {
   let title = raw.trim().replace(/^["']|["']$/g, "");
   title = stripMarkdown(title);
   title = stripThinkingTags(title).trim();
-  if (!title) return "";
+  if (!title) {
+    return "";
+  }
   // Reject outputs that are the model reasoning aloud or continuing the
   // conversation instead of naming it (e.g. "I need to generate a…", "I'll
   // work through these files…"). Callers fall back to a deterministic title.
@@ -646,8 +665,12 @@ const LEAKED_PROSE_PREFIXES = [
  * fallback title, while a false accept persists a broken one.
  */
 function looksLikeLeakedProse(title: string): boolean {
-  if (/\n/.test(title)) return true;
-  if (/\b(?:user|assistant)\s*:/i.test(title)) return true;
+  if (/\n/.test(title)) {
+    return true;
+  }
+  if (/\b(?:user|assistant)\s*:/i.test(title)) {
+    return true;
+  }
   const lower = title.toLowerCase();
   if (LEAKED_PROSE_PREFIXES.some((prefix) => lower.startsWith(prefix))) {
     return true;
@@ -688,9 +711,15 @@ function stripMarkdown(text: string): string {
 }
 
 function deriveFallbackTitle(context?: TitleContext): string | null {
-  if (!context) return null;
-  if (context.systemHint) return context.systemHint;
-  if (context.uxBrief) return context.uxBrief;
+  if (!context) {
+    return null;
+  }
+  if (context.systemHint) {
+    return context.systemHint;
+  }
+  if (context.uxBrief) {
+    return context.uxBrief;
+  }
   return null;
 }
 
@@ -705,14 +734,20 @@ function deriveFallbackTitle(context?: TitleContext): string | null {
  * Returns empty string for content-block arrays with no extractable text,
  * preventing raw JSON from polluting the title prompt.
  */
-function extractTextForTitle(raw: string): string {
+function extractTextForTitle(raw: string | Array<{ type: string }>): string {
   try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed === "string") return parsed;
-    if (!Array.isArray(parsed)) return raw;
+    const parsed = Array.isArray(raw) ? raw : JSON.parse(raw);
+    if (typeof parsed === "string") {
+      return parsed;
+    }
+    if (!Array.isArray(parsed)) {
+      return raw as string;
+    }
     const texts: string[] = [];
     for (const block of parsed) {
-      if (!block || typeof block !== "object") continue;
+      if (!block || typeof block !== "object") {
+        continue;
+      }
       if (block.type === "text" && typeof block.text === "string") {
         texts.push(block.text);
         // guard:allow-tool-result-only — web_search_tool_result has structured
@@ -737,7 +772,7 @@ function extractTextForTitle(raw: string): string {
     }
     return texts.join("\n");
   } catch {
-    return raw;
+    return Array.isArray(raw) ? "" : raw;
   }
 }
 
@@ -746,7 +781,9 @@ function buildRegenerationPrompt(recentMessages: MessageRow[]): string {
 
   for (const msg of recentMessages) {
     const text = extractTextForTitle(msg.content);
-    if (!text) continue;
+    if (!text) {
+      continue;
+    }
     const role = msg.role === "user" ? "User" : "Assistant";
     parts.push(`${role}: ${stripThinkingTags(text)}`);
   }