@vellumai/assistant 0.12.1 → 0.12.2-staging.1

package/src/oauth/seed-providers.ts

@@ -9,6 +9,30 @@ import { migrateProviderBaseUrl, seedProviders } from "./oauth-store.js";
  */
 const STALE_GOOGLE_BASE_URL = "https://gmail.googleapis.com/gmail/v1/users/me";
 
+/**
+ * The hosts a Slack credential may be sent to, shared by the person-identity
+ * `slack` provider and the `slack_channel` bot: both read messages, and a file
+ * shared in a message is fetched from the file object's `url_private`,
+ * `url_private_download`, or `thumb_*` URL on `files.slack.com` with the same
+ * Bearer token as the Web API. Slack documents that one file host by name.
+ */
+const SLACK_PROVIDER_INJECTION_TEMPLATES: NonNullable<
+  (typeof PROVIDER_SEED_DATA)[string]["injectionTemplates"]
+> = [
+  {
+    hostPattern: "slack.com",
+    injectionType: "header",
+    headerName: "Authorization",
+    valuePrefix: "Bearer ",
+  },
+  {
+    hostPattern: "files.slack.com",
+    injectionType: "header",
+    headerName: "Authorization",
+    valuePrefix: "Bearer ",
+  },
+];
+
 /**
  * Protocol-level seed data for each well-known OAuth provider.
  *
@@ -183,14 +207,13 @@ export const PROVIDER_SEED_DATA: Record<
     clientIdPlaceholder: null,
     logoUrl:
       "https://cdn.jsdelivr.net/gh/glincker/thesvg@main/public/icons/slack/default.svg",
-    // Sent as the bot `scope` parameter, while this flow persists the
-    // `authed_user` token and stores `authed_user.scope` as `grantedScopes`.
-    // Credential health compares this list against that grant, so a scope
-    // listed here that `user_scope` does not also request reports as
-    // `missing_scopes`, a hard failure that disables the provider's tools.
-    // The wider bot set belongs to Socket Mode installs, which verify the live
-    // `x-oauth-scopes` header against SLACK_REQUIRED_BOT_SCOPES in
-    // channel-readiness-service.ts.
+    // Sent as the bot `scope` parameter on the same authorize request. This
+    // flow persists the `authed_user` token and stores `authed_user.scope` as
+    // `grantedScopes`; credential health measures that grant against
+    // `user_scope` below, never against this list, so a scope the stored
+    // token needs belongs in `user_scope`. The wider bot set belongs to Socket
+    // Mode installs, which verify the live `x-oauth-scopes` header against
+    // SLACK_REQUIRED_BOT_SCOPES in channel-readiness-service.ts.
     defaultScopes: [
       "channels:join",
       "channels:read",
@@ -212,19 +235,17 @@ export const PROVIDER_SEED_DATA: Record<
     // only credential this flow stores, so it acts as the installer for every
     // call including `chat.postMessage`. The manifest's user list is read-only
     // instead, since a Socket Mode install keeps a bot token beside it.
+    // `files:read` is what lets that token fetch a file shared in a message
+    // from files.slack.com. Credential health measures every stored grant
+    // against this list, so a scope added here reports each existing
+    // connection as `missing_scopes` until it reconnects: that is how a newly
+    // required scope reaches an install.
     authorizeParams: {
       user_scope:
-        "channels:read,channels:history,groups:read,groups:history,im:read,im:history,im:write,mpim:read,mpim:history,users:read,chat:write,search:read,reactions:write",
+        "channels:read,channels:history,groups:read,groups:history,im:read,im:history,im:write,mpim:read,mpim:history,users:read,chat:write,search:read,reactions:write,files:read",
     },
     loopbackPort: 17322,
-    injectionTemplates: [
-      {
-        hostPattern: "slack.com",
-        injectionType: "header",
-        headerName: "Authorization",
-        valuePrefix: "Bearer ",
-      },
-    ],
+    injectionTemplates: SLACK_PROVIDER_INJECTION_TEMPLATES,
     appType: "Slack App",
     identityUrl: "https://slack.com/api/auth.test",
     identityOkField: "ok",
@@ -1194,14 +1215,7 @@ export const PROVIDER_SEED_DATA: Record<
     logoUrl:
       "https://cdn.jsdelivr.net/gh/glincker/thesvg@main/public/icons/slack/default.svg",
     defaultScopes: [],
-    injectionTemplates: [
-      {
-        hostPattern: "slack.com",
-        injectionType: "header",
-        headerName: "Authorization",
-        valuePrefix: "Bearer ",
-      },
-    ],
+    injectionTemplates: SLACK_PROVIDER_INJECTION_TEMPLATES,
   },
 
   // The bot that sits in a server and talks to people there, which is a
@@ -1329,6 +1343,171 @@ export const PROVIDER_SEED_DATA: Record<
     identityUrl: "https://api.link.com/userinfo",
     identityResponsePaths: ["email", "phone"],
   },
+  shopify: {
+    provider: "shopify",
+    // Shopify is per-tenant: every OAuth endpoint lives on the merchant's own
+    // myshopify.com domain, so these carry a {tenant_host} placeholder the
+    // platform fills in from the shop domain the user supplies at connect
+    // time. There is no global Shopify authorization host to point at.
+    authorizeUrl: "https://{tenant_host}/admin/oauth/authorize",
+    tokenExchangeUrl: "https://{tenant_host}/admin/oauth/access_token",
+    // Requesting `expiring=1` at token exchange yields a short-lived access
+    // token plus a refresh token, which is refreshed against the same
+    // per-shop endpoint.
+    refreshUrl: "https://{tenant_host}/admin/oauth/access_token",
+    pingUrl: "https://{tenant_host}/admin/api/2026-07/shop.json",
+    baseUrl: "https://{tenant_host}",
+    displayLabel: "Shopify",
+    description: "Products, orders, customers, and inventory",
+    dashboardUrl: "https://shopify.dev/dashboard",
+    clientIdPlaceholder: null,
+    logoUrl: "https://cdn.simpleicons.org/shopify",
+    // Shopify parses `scope` as a comma-separated list. A space-separated
+    // list is read as one malformed scope and the request is rejected.
+    scopeSeparator: ",",
+    // Admin API scopes only: Storefront, Customer Account and Shop APIs are
+    // buyer-facing surfaces an assistant has no use for. Every scope here is
+    // grantable without Shopify approval -- the approval-gated ones
+    // (read_all_orders, customer payment methods, subscription contracts,
+    // dispute evidence) are deliberately absent, because Shopify rejects the
+    // whole authorization request if the app cannot grant a requested scope.
+    // A write_* grant implies its read_* counterpart, so the response may
+    // name only the write scope.
+    defaultScopes: [
+      "read_products",
+      "write_products",
+      "read_orders",
+      "write_orders",
+      "read_draft_orders",
+      "write_draft_orders",
+      "read_customers",
+      "write_customers",
+      "read_inventory",
+      "read_locations",
+      "read_fulfillments",
+      "read_discounts",
+      "write_discounts",
+      "read_price_rules",
+    ],
+    availableScopes: [
+      {
+        scope: "read_products",
+        description: "Read products, variants, and collections",
+      },
+      {
+        scope: "write_products",
+        description: "Create and update products, variants, and collections",
+      },
+      {
+        scope: "read_orders",
+        description: "Read orders, transactions, and abandoned checkouts",
+      },
+      {
+        scope: "write_orders",
+        description: "Create and update orders and fulfillments",
+      },
+      { scope: "read_draft_orders", description: "Read draft orders" },
+      {
+        scope: "write_draft_orders",
+        description: "Create and update draft orders",
+      },
+      {
+        scope: "read_customers",
+        description: "Read customers, segments, and companies",
+      },
+      {
+        scope: "write_customers",
+        description: "Create and update customers and segments",
+      },
+      {
+        scope: "read_inventory",
+        description: "Read inventory levels and items",
+      },
+      {
+        scope: "write_inventory",
+        description: "Adjust inventory levels and items",
+      },
+      { scope: "read_locations", description: "Read store locations" },
+      { scope: "read_fulfillments", description: "Read fulfillment services" },
+      {
+        scope: "write_fulfillments",
+        description: "Create and update fulfillment services",
+      },
+      { scope: "read_discounts", description: "Read discounts" },
+      { scope: "write_discounts", description: "Create and update discounts" },
+      { scope: "read_price_rules", description: "Read price rules" },
+      {
+        scope: "write_price_rules",
+        description: "Create and update price rules",
+      },
+      { scope: "read_files", description: "Read files uploaded to the store" },
+      { scope: "write_files", description: "Upload and update files" },
+      { scope: "read_gift_cards", description: "Read gift cards" },
+      {
+        scope: "write_gift_cards",
+        description: "Create and update gift cards",
+      },
+      { scope: "read_returns", description: "Read returns" },
+      { scope: "write_returns", description: "Create and update returns" },
+      { scope: "read_markets", description: "Read markets" },
+      { scope: "read_locales", description: "Read shop locales" },
+      {
+        scope: "read_shipping",
+        description: "Read shipping and delivery carrier services",
+      },
+      { scope: "read_analytics", description: "Read analytics and reports" },
+      {
+        scope: "read_marketing_events",
+        description: "Read marketing events and activities",
+      },
+      { scope: "read_order_edits", description: "Read order edits" },
+      {
+        scope: "write_order_edits",
+        description: "Create and apply order edits",
+      },
+      {
+        scope: "read_metaobjects",
+        description: "Read metaobjects and their definitions",
+      },
+      {
+        scope: "write_metaobjects",
+        description: "Create and update metaobjects",
+      },
+      { scope: "read_translations", description: "Read translated content" },
+      {
+        scope: "read_shopify_payments_payouts",
+        description: "Read Shopify Payments payouts and balance",
+      },
+      {
+        scope: "read_shopify_payments_disputes",
+        description: "Read Shopify Payments disputes",
+      },
+    ],
+    loopbackPort: 17341,
+    managedServiceConfigKey: "shopify-oauth",
+    injectionTemplates: [
+      {
+        hostPattern: "*.myshopify.com",
+        injectionType: "header",
+        headerName: "X-Shopify-Access-Token",
+        valuePrefix: "",
+      },
+    ],
+    appType: "App",
+    setupNotes: [
+      "Shopify OAuth is per-shop: the authorize, token and API endpoints all live on the merchant's own myshopify.com domain, so connecting requires the shop domain (for example your-store.myshopify.com) alongside the usual credentials.",
+      "The Admin API authenticates with the X-Shopify-Access-Token header rather than an Authorization Bearer header.",
+    ],
+    // The Admin API's shop endpoint nests its payload under "shop"; the
+    // myshopify domain is the stable, human-recognisable handle.
+    identityUrl: "https://{tenant_host}/admin/api/2026-07/shop.json",
+    identityResponsePaths: ["shop.myshopify_domain", "shop.name"],
+    // Gated like monday/figma/stripe-link: the platform side and the
+    // shop-domain input in the clients land separately, and until both are
+    // in place a visible Shopify tile would offer a connect flow that
+    // cannot complete.
+    featureFlag: "shopify-oauth",
+  },
 };
 
 export const SEEDED_PROVIDER_KEYS = new Set(Object.keys(PROVIDER_SEED_DATA));

package/src/outbound-proxy/certs.ts

@@ -2,6 +2,8 @@ import { X509Certificate } from "node:crypto";
 import { chmod, mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
+import { writeCombinedCABundle } from "../util/ca-bundle.js";
+
 const CA_CERT_FILENAME = "ca.pem";
 const CA_KEY_FILENAME = "ca-key.pem";
 const COMBINED_CA_FILENAME = "combined-ca-bundle.pem";
@@ -263,11 +265,7 @@ export async function ensureCombinedCABundle(
   }
 
   try {
-    const [systemCAs, proxyCACert] = await Promise.all([
-      readFile(systemBundlePath, "utf-8"),
-      readFile(caCertPath, "utf-8"),
-    ]);
-    await writeFile(combinedPath, systemCAs + "\n" + proxyCACert);
+    await writeCombinedCABundle(systemBundlePath, caCertPath, combinedPath);
     return combinedPath;
   } catch {
     return null;

package/src/permissions/checker.test.ts

@@ -15,13 +15,16 @@ mock.module("../config/assistant-feature-flags.js", () => ({
 }));
 
 // `buildPolicyContext` (used by the integration tests below) precomputes the
-// proc-to-skills gate via `isV3TierActive`. Drive it through this slot so a
-// test can put the production threading path in the active / inactive state.
+// retrospective skill-improvement gate. Keep the v3 tier active while the
+// dedicated gate changes so the production threading test covers the new
+// opt-out rather than the old v3 condition.
 let mockV3TierActive = true;
+let mockSkillImprovementActive = true;
 mock.module("../config/memory-v3-gate.js", () => ({
   isMemoryEnabled: (config?: { memory?: { enabled?: boolean } }) =>
     config?.memory?.enabled !== false,
   isV3TierActive: () => mockV3TierActive,
+  isSkillImprovementActive: () => mockSkillImprovementActive,
   isMemoryV3Live: () => mockV3TierActive,
   usesConceptPageMemory: (memory?: {
     enabled?: boolean;
@@ -219,6 +222,7 @@ describe("Permission Checker (gateway IPC)", () => {
     mockCachedThreshold = "low";
     mockRefreshedThreshold = null;
     mockV3TierActive = true;
+    mockSkillImprovementActive = true;
     thresholdCallLog.length = 0;
     mockSkillCatalog = [];
     mockResolvedSkill = null;
@@ -1173,10 +1177,11 @@ describe("Permission Checker (gateway IPC)", () => {
     });
 
     test("grant does NOT fire when proc-to-skills is inactive, even for the retrospective turn", async () => {
-      // Same retrospective ToolContext, but the feature is inactive (flag off
-      // or v3 not live). buildPolicyContext stamps `procToSkillsActive: false`,
-      // so the grant is dead and the high-risk scaffold prompts.
-      mockV3TierActive = false;
+      // The retrospective keeps its live v3 tier, but this independent flag is
+      // off. buildPolicyContext stamps `procToSkillsActive: false`, so the
+      // grant is dead and the high-risk scaffold prompts.
+      mockV3TierActive = true;
+      mockSkillImprovementActive = false;
       mockIpcClassifyRiskResult = {
         risk: "high",
         reason: "Skill scaffold",

package/src/persistence/compaction-log-store-clickhouse.ts

@@ -26,6 +26,7 @@
  */
 import type { AgentEvent } from "../agent/loop.js";
 import { getConfig } from "../config/loader.js";
+import { resolvePlatformAssistantIdOrNull } from "../config/platform-identity.js";
 import type { CompactionLogsClickHouseConfig } from "../config/schemas/compaction-logs.js";
 import { credentialKey } from "../security/credential-key.js";
 import { getSecureKeyAsync } from "../security/secure-keys.js";
@@ -136,7 +137,7 @@ export interface ClickHouseCompactionLogStoreDeps {
   resolveUrl?: () => Promise<string | null>;
   /** Override the credential read for `clickhouse:password`. */
   resolvePassword?: () => Promise<string | null>;
-  /** Override the credential read for `vellum:platform_assistant_id`. */
+  /** Override the in-memory platform assistant id. */
   resolveAssistantId?: () => Promise<string | null>;
   /** Override fetch for testing. */
   fetchImpl?: CompactionLogFetch;
@@ -163,8 +164,7 @@ export class ClickHouseCompactionLogStore {
       deps.resolvePassword ??
       (() => readCredentialOrNull("clickhouse", "password"));
     this.resolveAssistantId =
-      deps.resolveAssistantId ??
-      (() => readCredentialOrNull("vellum", "platform_assistant_id"));
+      deps.resolveAssistantId ?? resolvePlatformAssistantIdOrNull;
     this.fetchImpl = deps.fetchImpl ?? globalThis.fetch.bind(globalThis);
   }
 

package/src/persistence/conversation-crud.ts

@@ -35,7 +35,10 @@ import { findConversation } from "../daemon/conversation-registry.js";
 import { conversationMetadataSyncTag } from "../daemon/message-types/sync.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
 import { clearAllConversationIds } from "../home/feed-writer.js";
-import type { ConversationDeletedInputContext } from "../hooks/types.js";
+import type {
+  ConversationDeletedInputContext,
+  MessageDeletedInputContext,
+} from "../hooks/types.js";
 import { readProviderMetadata } from "../messaging/read-provider-metadata.js";
 import { HOOKS } from "../plugin-api/constants.js";
 import { forkConversationMemory } from "../plugins/defaults/memory/fork-conversation-memory.js";
@@ -81,7 +84,6 @@ import { ensureDisplayOrderMigration } from "./conversation-display-order-migrat
 import { ensureGroupMigration } from "./conversation-group-migration.js";
 import {
   isReferentialFork,
-  type LineageBound,
   type LineageConversationRow,
   lineageMessageFilter,
   lineageMessagesAfterFilter,
@@ -121,6 +123,11 @@ import {
 } from "./job-handlers/message-lexical.js";
 import { buildLifecycleTelemetryEvent } from "./lifecycle-events-store.js";
 import { resolveMessageContentBlocks } from "./message-content-file.js";
+import {
+  loadMessageBound,
+  type MessagesAfterRef,
+  resolveMessagesAfterBound,
+} from "./message-cursor.js";
 import { mergeMessageMetadata } from "./message-metadata.js";
 import {
   rawAll,
@@ -2641,16 +2648,6 @@ function loadLineageRow(id: string): LineageConversationRow | null {
   return row ?? null;
 }
 
-/** The `(createdAt, id)` bound of a single message, or null when it is gone. */
-function loadMessageBound(messageId: string): LineageBound | null {
-  const row = getDb()
-    .select({ createdAt: messages.createdAt, id: messages.id })
-    .from(messages)
-    .where(eq(messages.id, messageId))
-    .get();
-  return row ?? null;
-}
-
 /**
  * The segments making up a conversation's logical message set. Non-forks and
  * copied forks resolve to a single unbounded segment after one row lookup, so
@@ -2972,81 +2969,67 @@ export function selectNewestSightFrameCapture(
 }
 
 /**
- * Count messages in a conversation that were created strictly after the
- * `afterMessageId` reference message. If `afterMessageId` is `null` or empty,
- * counts all messages in the conversation. If the referenced message no
- * longer exists (e.g. deleted by a separate flow), returns 0 — callers
- * decide how to react to a vanished reference, and the conservative answer
- * here is "no new work."
+ * Count messages in a conversation created strictly after the `after`
+ * reference. `null`, `""`, or a cursor with an empty id counts every message.
+ * The reference resolves through `resolveMessagesAfterBound`: a live row's
+ * `(createdAt, id)` is authoritative, a `MessageCursor` whose row has been
+ * deleted still bounds the count from the `createdAt` it carries, and a bare
+ * id whose row is gone counts 0: a caller holding only an id has no
+ * defensible starting point, and the conservative answer is "no new work."
  *
  * Used by the memory-retrospective trigger check to decide whether to fire
  * the message-count trigger without loading message bodies.
  */
 export function countMessagesAfter(
   conversationId: string,
-  afterMessageId: string | null,
+  after: MessagesAfterRef,
 ): number {
   const db = getDb();
   const segments = resolveLineage(conversationId);
-  if (afterMessageId === null || afterMessageId === "") {
-    const row = db
-      .select({ c: count() })
-      .from(messages)
-      .where(lineageMessageFilter(segments))
-      .get();
-    return row?.c ?? 0;
-  }
-  const ref = loadMessageBound(afterMessageId);
-  if (!ref) {
+  const start = resolveMessagesAfterBound(after);
+  if (start.kind === "vanished") {
     return 0;
   }
-  // Tie-breaker on `messages.id` so rows that share a millisecond timestamp
-  // with the reference are not permanently skipped. Mirrors the
-  // `(createdAt, id)` cursor pattern used by the backfill job-handler and
-  // turn-events-store.
   const row = db
     .select({ c: count() })
     .from(messages)
-    .where(lineageMessagesAfterFilter(segments, ref))
+    .where(
+      start.kind === "all"
+        ? lineageMessageFilter(segments)
+        : lineageMessagesAfterFilter(segments, start.bound),
+    )
     .get();
   return row?.c ?? 0;
 }
 
 /**
- * Return messages in a conversation created strictly after the
- * `afterMessageId` reference. If the reference is `null`/empty, returns all
- * messages. If the reference doesn't exist, returns an empty array (mirrors
- * `countMessagesAfter`'s conservative semantics). Used by the
- * memory-retrospective job handler to load the message slice it processes.
+ * Return messages in a conversation created strictly after the `after`
+ * reference, in `(createdAt, id)` order. Resolves the reference exactly as
+ * `countMessagesAfter` does, returning an empty array where that returns 0.
+ * Used by the memory-retrospective job handler to load the message slice it
+ * processes.
  */
 export function getMessagesAfter(
   conversationId: string,
-  afterMessageId: string | null,
+  after: MessagesAfterRef,
 ): MessageRow[] {
   const db = getDb();
   const segments = resolveLineage(conversationId);
-  if (afterMessageId === null || afterMessageId === "") {
-    // Secondary `asc(messages.id)` matches the non-null path's cursor
-    // ordering, so callers tracking `cutoffMessageId` across runs see a
-    // consistent ordering when multiple rows share a millisecond timestamp.
-    return db
-      .select()
-      .from(messages)
-      .where(lineageMessageFilter(segments))
-      .orderBy(asc(messages.createdAt), asc(messages.id))
-      .all()
-      .map(parseMessage);
-  }
-  const ref = loadMessageBound(afterMessageId);
-  if (!ref) {
+  const start = resolveMessagesAfterBound(after);
+  if (start.kind === "vanished") {
     return [];
   }
-  // Same `(createdAt, id)` cursor as `countMessagesAfter` — rows sharing
-  // the reference's millisecond timestamp would otherwise be skipped.
+  // Secondary `asc(messages.id)` mirrors the bound's tie-breaker, so callers
+  // tracking `cutoffMessageId` across runs see a consistent ordering when
+  // multiple rows share a millisecond timestamp.
   return db
     .select()
     .from(messages)
-    .where(lineageMessagesAfterFilter(segments, ref))
+    .where(
+      start.kind === "all"
+        ? lineageMessageFilter(segments)
+        : lineageMessagesAfterFilter(segments, start.bound),
+    )
     .orderBy(asc(messages.createdAt), asc(messages.id))
     .all()
     .map(parseMessage);
@@ -4304,12 +4287,12 @@ export function deleteLastExchange(conversationId: string): number {
 
   // Collect attachment IDs linked to the messages being deleted so we can
   // scope orphan cleanup to only those candidates (not freshly uploaded ones).
-  const messageIds = db
-    .select({ id: messages.id })
+  const deletedRows = db
+    .select({ id: messages.id, createdAt: messages.createdAt })
     .from(messages)
     .where(condition)
-    .all()
-    .map((r) => r.id);
+    .all();
+  const messageIds = deletedRows.map((r) => r.id);
   const candidateAttachmentIds =
     messageIds.length > 0
       ? db
@@ -4356,6 +4339,17 @@ export function deleteLastExchange(conversationId: string): number {
     enqueueDeleteMessageLexical(deletedMessageId);
   }
 
+  // Notify `message-deleted` hooks for each removed row, as the
+  // single-message primitive does: undo removes the same tail a regenerate
+  // does, and a hook keeping a cursor on one of these rows needs its position.
+  for (const row of deletedRows) {
+    void runHook(HOOKS.MESSAGE_DELETED, {
+      conversationId,
+      messageId: row.id,
+      createdAt: row.createdAt,
+    } satisfies MessageDeletedInputContext);
+  }
+
   return deleted;
 }
 
@@ -4594,9 +4588,13 @@ export function deleteMessageById(
     .map((r) => r.attachmentId)
     .filter((id): id is string => id !== undefined);
 
-  // Look up the conversation before the transaction so we can recalculate lastMessageAt.
+  // Look up the conversation before the transaction so we can recalculate
+  // lastMessageAt, and the row's createdAt for the `message-deleted` hook.
   const msgRow = db
-    .select({ conversationId: messages.conversationId })
+    .select({
+      conversationId: messages.conversationId,
+      createdAt: messages.createdAt,
+    })
     .from(messages)
     .where(eq(messages.id, messageId))
     .get();
@@ -4652,6 +4650,16 @@ export function deleteMessageById(
   // not go through the conversation-level purge.
   if (msgRow) {
     enqueueDeleteMessageLexical(messageId);
+
+    // Notify `message-deleted` hooks (e.g. the memory plugin stamping a
+    // retrospective cursor that sat on this row). Fire-and-forget from this
+    // synchronous primitive, like `conversation-deleted`; the context carries
+    // the row's position because the row itself is gone.
+    void runHook(HOOKS.MESSAGE_DELETED, {
+      conversationId: msgRow.conversationId,
+      messageId,
+      createdAt: msgRow.createdAt,
+    } satisfies MessageDeletedInputContext);
   }
 
   return result;

package/src/persistence/conversation-lineage.ts

@@ -227,9 +227,17 @@ export function lineageMessagesAfterFilter(
 ): SQL {
   return and(
     lineageMessageFilter(segments),
-    or(
-      gt(messages.createdAt, after.createdAt),
-      and(eq(messages.createdAt, after.createdAt), gt(messages.id, after.id)),
-    ),
+    messagesAfterBoundFilter(after),
+  ) as SQL;
+}
+
+/**
+ * Predicate for rows strictly after a `(createdAt, id)` bound, with the id
+ * tie-breaker so rows sharing the bound's millisecond keep their order.
+ */
+export function messagesAfterBoundFilter(after: LineageBound): SQL {
+  return or(
+    gt(messages.createdAt, after.createdAt),
+    and(eq(messages.createdAt, after.createdAt), gt(messages.id, after.id)),
   ) as SQL;
 }

package/src/persistence/conversation-queries.ts

@@ -17,6 +17,7 @@ import {
   wrapUntrustedContent,
 } from "../security/untrusted-content.js";
 import { getLogger } from "../util/logger.js";
+import { safeStringSlice } from "../util/unicode.js";
 import { isLexicalBackfillComplete } from "./checkpoints.js";
 import { unseenAttentionStateConditions } from "./conversation-attention-store.js";
 import type { ConversationRow } from "./conversation-crud.js";
@@ -1443,8 +1444,7 @@ function buildExcerptFromText(
   if (!match) {
     // Neither the query nor any of its tokens is present (e.g. the lexical
     // index matched JSON structure instead); fall back to the text start.
-    return text
-      .slice(0, EXCERPT_WINDOW * 2)
+    return safeStringSlice(text, 0, EXCERPT_WINDOW * 2)
       .replace(/\s+/g, " ")
       .trim();
   }

package/src/persistence/conversation-title-placeholders.ts

@@ -0,0 +1,23 @@
+import { isMessageKey } from "../i18n/index.js";
+
+const REPLACEABLE_PATTERNS = [
+  /^Runtime:\s/,
+  /^New Conversation$/,
+  /^Untitled$/,
+  /^Untitled Conversation$/,
+  /^Generating title\.\.\.$/,
+];
+
+/**
+ * Check whether a title is a system-generated placeholder that can be
+ * replaced or omitted without discarding user-provided copy.
+ */
+export function isReplaceableTitle(title: string | null): boolean {
+  if (title == null || title.trim() === "") {
+    return true;
+  }
+  if (isMessageKey(title.trim())) {
+    return true;
+  }
+  return REPLACEABLE_PATTERNS.some((pattern) => pattern.test(title));
+}