@vellumai/assistant 0.12.2 → 0.12.3-staging.2

package/src/runtime/routes/inbound-message-handler.ts

@@ -106,7 +106,10 @@ import { markProcessed } from "../../persistence/delivery-status.js";
 import { upsertBinding } from "../../persistence/external-conversation-store.js";
 import type { ContentBlock } from "../../providers/types.js";
 import { checkIngressForSecrets } from "../../security/secret-ingress.js";
-import { canonicalizeInboundIdentity } from "../../util/canonicalize-identity.js";
+import {
+  canonicalizeInboundIdentity,
+  inboundIdentitiesMatch,
+} from "../../util/canonicalize-identity.js";
 import { safeParseRecord } from "../../util/json.js";
 import { getLogger } from "../../util/logger.js";
 import { truncate } from "../../util/truncate.js";
@@ -126,6 +129,11 @@ import {
   enforceIngressAcl,
 } from "./inbound-stages/acl-enforcement.js";
 import { enforceAdmissionPolicy } from "./inbound-stages/admission-policy.js";
+import {
+  type BackfilledSenderProvenance,
+  type BackfilledSenderProvenanceResolver,
+  createBackfilledSenderProvenanceResolver,
+} from "./inbound-stages/backfill-sender-provenance.js";
 import { processChannelMessageInBackground } from "./inbound-stages/background-dispatch.js";
 import { handleBootstrapIntercept } from "./inbound-stages/bootstrap-intercept.js";
 import { handleEditIntercept } from "./inbound-stages/edit-intercept.js";
@@ -1531,8 +1539,7 @@ export async function handleChannelInbound({
         sourceMetadata.account.length > 0
           ? sourceMetadata.account
           : undefined;
-      const slackBotMentioned =
-        sourceChannel === "slack" && sourceMetadata?.slackBotMentioned === true;
+      const botMentioned = sourceMetadata?.botMentioned === true;
 
       // ── DM cold-start backfill ──
       // First time a Slack DM without thread_ts lands in a conversation that
@@ -1625,7 +1632,7 @@ export async function handleChannelInbound({
         approvalCopyGenerator,
         chatType: sourceChatType,
         clientTimezone: inboundClientTimezone,
-        slackBotMentioned,
+        botMentioned,
         slackInbound,
         channelInbound,
       });
@@ -1836,6 +1843,7 @@ async function persistBackfilledSlackMessage(params: {
   message: ProviderMessage;
   account?: string;
   guardianExternalUserId?: string;
+  resolveSenderProvenance: BackfilledSenderProvenanceResolver;
 }): Promise<boolean> {
   const { message } = params;
 
@@ -1873,10 +1881,19 @@ async function persistBackfilledSlackMessage(params: {
     message.metadata,
     "actorTimezoneLabel",
   );
-  const isGuardian = isBackfilledSlackGuardianMessage(
+  const role = (await isBackfilledSlackAssistantMessage(
     message,
-    params.guardianExternalUserId,
-  );
+    params.account,
+  ))
+    ? "assistant"
+    : "user";
+  // The assistant's own posts are replayed as assistant history, not as any
+  // person's words, so only a person's row asks who its sender is.
+  const provenance: BackfilledSenderProvenance =
+    role === "user"
+      ? await params.resolveSenderProvenance(actorExternalUserId)
+      : { provenanceTrustClass: "unknown" };
+  const isGuardian = provenance.provenanceTrustClass === "guardian";
   const slackTranscriptTimestampTimezone =
     resolveSlackTranscriptTimestampTimezone();
   const slackTimezoneFields = buildSlackTimezoneMetadata({
@@ -1900,13 +1917,6 @@ async function persistBackfilledSlackMessage(params: {
     ...(slackFiles.length > 0 ? { slackFiles } : {}),
   };
 
-  const role = (await isBackfilledSlackAssistantMessage(
-    message,
-    params.account,
-  ))
-    ? "assistant"
-    : "user";
-
   const rawText = message.text ?? "";
 
   // `sentAt` is when the message was sent; the row's `createdAt` is when the
@@ -1945,7 +1955,7 @@ async function persistBackfilledSlackMessage(params: {
     metadata: {
       ...envelope,
       ...(sentAt !== undefined ? { sentAt } : {}),
-      provenanceTrustClass: isGuardian ? "guardian" : "unknown",
+      ...provenance,
       provenanceSourceChannel: "slack",
       ...(params.guardianExternalUserId
         ? { provenanceGuardianExternalUserId: params.guardianExternalUserId }
@@ -2064,22 +2074,6 @@ async function buildBackfilledSlackContentBlocks(
   return blocks;
 }
 
-function isBackfilledSlackGuardianMessage(
-  message: ProviderMessage,
-  guardianExternalUserId: string | undefined,
-): boolean {
-  const rawSenderId = message.sender?.id?.trim();
-  if (!rawSenderId || !guardianExternalUserId) {
-    return false;
-  }
-  const normalizedSender =
-    canonicalizeInboundIdentity("slack", rawSenderId) ?? rawSenderId;
-  const normalizedGuardian =
-    canonicalizeInboundIdentity("slack", guardianExternalUserId) ??
-    guardianExternalUserId.trim();
-  return normalizedSender === normalizedGuardian;
-}
-
 const SLACK_ASSISTANT_THREAD_PLACEHOLDER_TEXT = "New Assistant Thread";
 
 async function isSlackAssistantThreadPlaceholder(
@@ -2116,7 +2110,7 @@ async function isBackfilledSlackAssistantMessage(
     return false;
   }
 
-  if (rawSenderId && slackIdentityMatches(rawSenderId, botUserId)) {
+  if (rawSenderId && inboundIdentitiesMatch("slack", rawSenderId, botUserId)) {
     return true;
   }
 
@@ -2132,7 +2126,7 @@ async function isBackfilledSlackAssistantMessage(
     const resolvedBotUserId = await resolveSlackBotUserId(account, rawBotId);
     return (
       typeof resolvedBotUserId === "string" &&
-      slackIdentityMatches(resolvedBotUserId, botUserId)
+      inboundIdentitiesMatch("slack", resolvedBotUserId, botUserId)
     );
   } catch (err) {
     log.warn(
@@ -2143,14 +2137,6 @@ async function isBackfilledSlackAssistantMessage(
   }
 }
 
-function slackIdentityMatches(left: string, right: string): boolean {
-  const canonicalSender =
-    canonicalizeInboundIdentity("slack", left) ?? left.trim();
-  const canonicalBot =
-    canonicalizeInboundIdentity("slack", right) ?? right.trim();
-  return canonicalSender === canonicalBot;
-}
-
 /**
  * Transient view of `slackFiles` that preserves the download URLs added by
  * `mapSlackFiles` on the in-flight `ProviderMessage`. These URLs never reach
@@ -2291,6 +2277,10 @@ async function runBackfillSlackDmIfCold(params: {
     // and a transcript that reads correctly when the renderer joins on
     // monotonic createdAt.
     const ordered = [...fetched].reverse();
+    const resolveSenderProvenance = createBackfilledSenderProvenanceResolver(
+      params.guardianExternalUserId,
+      ordered,
+    );
     for (const message of ordered) {
       if (seen.has(message.id)) {
         continue;
@@ -2310,6 +2300,7 @@ async function runBackfillSlackDmIfCold(params: {
           ...(params.guardianExternalUserId
             ? { guardianExternalUserId: params.guardianExternalUserId }
             : {}),
+          resolveSenderProvenance,
         });
         seen.add(message.id);
         if (stored) {
@@ -2891,6 +2882,10 @@ export async function triggerSlackThreadBackfillIfNeeded(params: {
     }
 
     let persisted = 0;
+    const resolveSenderProvenance = createBackfilledSenderProvenanceResolver(
+      guardianExternalUserId,
+      fetched,
+    );
     for (const message of fetched) {
       if (!message.id) {
         continue;
@@ -2908,6 +2903,7 @@ export async function triggerSlackThreadBackfillIfNeeded(params: {
           message,
           ...(account ? { account } : {}),
           ...(guardianExternalUserId ? { guardianExternalUserId } : {}),
+          resolveSenderProvenance,
         });
         threadState.storedChannelTs.add(message.id);
         if (stored) {

package/src/runtime/routes/inbound-stages/backfill-sender-provenance.test.ts

@@ -0,0 +1,168 @@
+import { afterAll, beforeEach, describe, expect, spyOn, test } from "bun:test";
+
+import type { TrustVerdict } from "@vellumai/gateway-client";
+
+import type { InboundTrustReadResult } from "../../../calls/inbound-trust-reader.js";
+import * as inboundTrustReader from "../../../calls/inbound-trust-reader.js";
+import type { Message as ProviderMessage } from "../../../messaging/provider-types.js";
+import { createBackfilledSenderProvenanceResolver } from "./backfill-sender-provenance.js";
+
+const readsBySender = new Map<string, InboundTrustReadResult>();
+const readInboundTrustMock = spyOn(
+  inboundTrustReader,
+  "readInboundTrust",
+).mockImplementation(
+  async (input) =>
+    readsBySender.get(input.actorExternalId ?? "") ?? { ok: false },
+);
+
+afterAll(() => {
+  readInboundTrustMock.mockRestore();
+});
+
+const GUARDIAN_ID = "U_GUARDIAN";
+
+function memberVerdict(
+  trustClass: TrustVerdict["trustClass"],
+  contactId: string,
+  status: string,
+): TrustVerdict {
+  return {
+    trustClass,
+    canonicalSenderId: `U_${contactId}`,
+    contactId,
+    channelId: `ch-${contactId}`,
+    status,
+    policy: "allow",
+  };
+}
+
+function readOf(verdict: TrustVerdict): InboundTrustReadResult {
+  return { ok: true, verdict, admissionPolicy: null };
+}
+
+beforeEach(() => {
+  readsBySender.clear();
+  readInboundTrustMock.mockClear();
+});
+
+describe("createBackfilledSenderProvenanceResolver", () => {
+  test("stamps the gateway verdict's trust class and contact id", async () => {
+    readsBySender.set(
+      "U_ALICE",
+      readOf(memberVerdict("trusted_contact", "c-alice", "active")),
+    );
+    readsBySender.set(
+      "U_BOB",
+      readOf(memberVerdict("unverified_contact", "c-bob", "unverified")),
+    );
+    const resolve = createBackfilledSenderProvenanceResolver(GUARDIAN_ID, []);
+
+    expect(await resolve("U_ALICE")).toEqual({
+      provenanceTrustClass: "trusted_contact",
+      provenanceContactId: "c-alice",
+    });
+    expect(await resolve("U_BOB")).toEqual({
+      provenanceTrustClass: "unverified_contact",
+      provenanceContactId: "c-bob",
+    });
+    expect(readInboundTrustMock).toHaveBeenCalledWith({
+      channelType: "slack",
+      actorExternalId: "U_ALICE",
+    });
+  });
+
+  test("a stranger verdict carries no contact id and no lookup-failed marker", async () => {
+    readsBySender.set(
+      "U_STRANGER",
+      readOf({ trustClass: "unknown", canonicalSenderId: "U_STRANGER" }),
+    );
+    const resolve = createBackfilledSenderProvenanceResolver(GUARDIAN_ID, []);
+
+    expect(await resolve("U_STRANGER")).toEqual({
+      provenanceTrustClass: "unknown",
+    });
+  });
+
+  test("an unreadable verdict falls back to the guardian address comparison and marks the failed lookup", async () => {
+    const resolve = createBackfilledSenderProvenanceResolver(GUARDIAN_ID, []);
+
+    expect(await resolve(GUARDIAN_ID)).toEqual({
+      provenanceTrustClass: "guardian",
+      provenanceLookupFailed: true,
+    });
+    expect(await resolve("U_ALICE")).toEqual({
+      provenanceTrustClass: "unknown",
+      provenanceLookupFailed: true,
+    });
+  });
+
+  test("a resolver-failure verdict is not trusted for class or contact id", async () => {
+    readsBySender.set(
+      "U_ALICE",
+      readOf({
+        ...memberVerdict("trusted_contact", "c-alice", "active"),
+        resolutionFailed: true,
+      }),
+    );
+    const resolve = createBackfilledSenderProvenanceResolver(GUARDIAN_ID, []);
+
+    expect(await resolve("U_ALICE")).toEqual({
+      provenanceTrustClass: "unknown",
+      provenanceLookupFailed: true,
+    });
+  });
+
+  test("reads the gateway once per distinct sender", async () => {
+    readsBySender.set(
+      "U_ALICE",
+      readOf(memberVerdict("trusted_contact", "c-alice", "active")),
+    );
+    const resolve = createBackfilledSenderProvenanceResolver(GUARDIAN_ID, []);
+
+    await Promise.all([
+      resolve("U_ALICE"),
+      resolve(" U_ALICE "),
+      resolve("U_BOB"),
+    ]);
+    await resolve("U_ALICE");
+
+    expect(readInboundTrustMock).toHaveBeenCalledTimes(2);
+  });
+
+  test("a row with no sender id is unknown without a gateway read or a lookup-failed marker", async () => {
+    const resolve = createBackfilledSenderProvenanceResolver(GUARDIAN_ID, []);
+
+    expect(await resolve(undefined)).toEqual({
+      provenanceTrustClass: "unknown",
+    });
+    expect(readInboundTrustMock).not.toHaveBeenCalled();
+  });
+
+  test("starts every sender's read up front and together, bots included", () => {
+    const message = (id: string, senderId: string, isBot = false) =>
+      ({
+        id,
+        conversationId: "C1",
+        sender: { id: senderId, name: senderId },
+        text: "hi",
+        timestamp: 0,
+        platform: "slack",
+        ...(isBot ? { metadata: { isBot: true } } : {}),
+      }) satisfies ProviderMessage;
+
+    createBackfilledSenderProvenanceResolver(GUARDIAN_ID, [
+      message("1", "U_ALICE"),
+      message("2", "B_THIRD_PARTY", true),
+      message("3", "U_ALICE"),
+      message("4", "U_BOB"),
+    ]);
+
+    // Every read is in flight before any of them has settled.
+    expect(readInboundTrustMock.mock.calls.map(([input]) => input)).toEqual([
+      { channelType: "slack", actorExternalId: "U_ALICE" },
+      { channelType: "slack", actorExternalId: "B_THIRD_PARTY" },
+      { channelType: "slack", actorExternalId: "U_BOB" },
+    ]);
+  });
+});

package/src/runtime/routes/inbound-stages/backfill-sender-provenance.ts

@@ -0,0 +1,96 @@
+/**
+ * Provenance for backfilled Slack rows, resolved per sender.
+ *
+ * A backfilled row was written by someone other than the live inbound actor,
+ * so the live turn's trust context says nothing about it. Each sender is
+ * classified by the same gateway verdict live ingress uses
+ * (`resolve_inbound_trust`), so a backfilled row and a live row from the same
+ * person carry the same trust class and contact id. The verdict answers for
+ * the contact list at import time, which is when the row is written.
+ *
+ * When the verdict is unreadable or unusable, the row falls back to the
+ * guardian-address comparison, carries no contact id, and is marked
+ * `provenanceLookupFailed` so it stays distinguishable from a stranger.
+ *
+ * A read goes through `readInboundTrust`, so it also refreshes the
+ * member-verdict cache for that sender, as a live inbound read does.
+ */
+
+import { readInboundTrust } from "../../../calls/inbound-trust-reader.js";
+import type { ActorAuthorProvenance } from "../../../daemon/message-provenance.js";
+import type { Message as ProviderMessage } from "../../../messaging/provider-types.js";
+import { inboundIdentitiesMatch } from "../../../util/canonicalize-identity.js";
+import type { TrustClass } from "../../trust-class.js";
+import {
+  verdictMemberFromVerdict,
+  verdictUsability,
+} from "../../trust-verdict-consumer.js";
+
+export interface BackfilledSenderProvenance extends ActorAuthorProvenance {
+  provenanceTrustClass: TrustClass;
+  /** The lookup ran and returned no usable verdict; see `messageMetadataSchema`. */
+  provenanceLookupFailed?: true;
+}
+
+/**
+ * Resolves a backfilled message's sender provenance. One resolver serves one
+ * backfill pass and reads the gateway at most once per distinct sender.
+ */
+export type BackfilledSenderProvenanceResolver = (
+  senderId: string | undefined,
+) => Promise<BackfilledSenderProvenance>;
+
+export function createBackfilledSenderProvenanceResolver(
+  guardianExternalUserId: string | undefined,
+  messages: readonly ProviderMessage[],
+): BackfilledSenderProvenanceResolver {
+  const bySender = new Map<string, Promise<BackfilledSenderProvenance>>();
+  const resolve: BackfilledSenderProvenanceResolver = (senderId) => {
+    const trimmed = senderId?.trim();
+    if (!trimmed) {
+      return Promise.resolve({ provenanceTrustClass: "unknown" });
+    }
+    let pending = bySender.get(trimmed);
+    if (!pending) {
+      pending = resolveSenderProvenance(trimmed, guardianExternalUserId);
+      bySender.set(trimmed, pending);
+    }
+    return pending;
+  };
+  // Every sender's read starts now, so the pass waits on the slowest read
+  // rather than their sum. Bots included: a third-party bot's post is a user
+  // row, and singling out this assistant's own posts needs an async lookup.
+  // A read reports failure as a result, never a rejection.
+  for (const message of messages) {
+    void resolve(message.sender?.id);
+  }
+  return resolve;
+}
+
+async function resolveSenderProvenance(
+  senderId: string,
+  guardianExternalUserId: string | undefined,
+): Promise<BackfilledSenderProvenance> {
+  const read = await readInboundTrust({
+    channelType: "slack",
+    actorExternalId: senderId,
+  });
+  if (read.ok) {
+    const usability = verdictUsability(read.verdict);
+    if (usability.usable) {
+      const member = verdictMemberFromVerdict(usability.verdict);
+      return {
+        provenanceTrustClass: usability.verdict.trustClass,
+        ...(member ? { provenanceContactId: member.contactId } : {}),
+      };
+    }
+  }
+  return {
+    provenanceTrustClass:
+      guardianExternalUserId !== undefined &&
+      inboundIdentitiesMatch("slack", senderId, guardianExternalUserId)
+        ? "guardian"
+        : "unknown",
+    provenanceLookupFailed: true,
+  };
+}

package/src/runtime/routes/inbound-stages/background-dispatch.test.ts

@@ -173,10 +173,10 @@ import {
 } from "../../../daemon/conversation-registry.js";
 import type { TrustContext } from "../../../daemon/trust-context-types.js";
 import type { MessageProcessor } from "../../http-types.js";
+import { hasDeliverableAssistantText } from "../../no-response.js";
 import {
   isBoundGuardianActor,
   processChannelMessageInBackground,
-  shouldShowActivityForText,
   shouldShowActivityImmediately,
 } from "./background-dispatch.js";
 import { __resetChannelTurnAdmissionForTests } from "./channel-turn-admission.js";
@@ -260,6 +260,35 @@ describe("processChannelMessageInBackground — reply delivery", () => {
   const flush = (): Promise<void> =>
     new Promise((resolve) => setTimeout(resolve, 10));
 
+  test("names the inbound sender as the persisted message's author", async () => {
+    let capturedAuthor: TrustContext | undefined;
+    const processMessage: MessageProcessor = async (
+      _conversationId,
+      _content,
+      options,
+    ) => {
+      capturedAuthor = options?.author;
+      return { messageId: "user-msg-author" };
+    };
+
+    processChannelMessageInBackground({
+      processMessage,
+      conversationId: "conv-author",
+      eventId: "evt-author",
+      content: "the export endpoint needs a scoped token",
+      sourceChannel: "slack",
+      sourceInterface: "slack",
+      externalChatId: "C-AUTHOR",
+      trustCtx,
+      metadataHints: [],
+      replyCallbackUrl: "https://example.test/deliver/slack?channel=C-AUTHOR",
+    });
+
+    await flush();
+
+    expect(capturedAuthor).toBe(trustCtx);
+  });
+
   test("records callback delivery failures without failing processing", async () => {
     const conversationId = "conv-delivery-failure";
     const channelId = "C-DELIVERY-FAILURE";
@@ -1070,14 +1099,14 @@ describe("channel activity timing", () => {
   });
 
   test("recognizes only deliverable text as a reason to show activity", () => {
-    expect(shouldShowActivityForText("")).toBe(false);
-    expect(shouldShowActivityForText("   ")).toBe(false);
-    expect(shouldShowActivityForText("<")).toBe(false);
-    expect(shouldShowActivityForText("<no_response")).toBe(false);
-    expect(shouldShowActivityForText("<no_response/>")).toBe(false);
-    expect(shouldShowActivityForText("  <no_response />  ")).toBe(false);
-    expect(shouldShowActivityForText("Real response.")).toBe(true);
-    expect(shouldShowActivityForText("<no_response/>\nReal response.")).toBe(
+    expect(hasDeliverableAssistantText("")).toBe(false);
+    expect(hasDeliverableAssistantText("   ")).toBe(false);
+    expect(hasDeliverableAssistantText("<")).toBe(false);
+    expect(hasDeliverableAssistantText("<no_response")).toBe(false);
+    expect(hasDeliverableAssistantText("<no_response/>")).toBe(false);
+    expect(hasDeliverableAssistantText("  <no_response />  ")).toBe(false);
+    expect(hasDeliverableAssistantText("Real response.")).toBe(true);
+    expect(hasDeliverableAssistantText("<no_response/>\nReal response.")).toBe(
       true,
     );
   });
@@ -1169,7 +1198,7 @@ describe("channel activity timing", () => {
       externalChatId: channelId,
       trustCtx,
       metadataHints: [],
-      slackBotMentioned: true,
+      botMentioned: true,
       replyCallbackUrl: `https://example.test/deliver/slack?channel=${channelId}&threadTs=${threadTs}`,
     });
 

package/src/runtime/routes/inbound-stages/background-dispatch.ts

@@ -105,8 +105,11 @@ export interface BackgroundProcessingParams {
   chatType?: string;
   /** IANA timezone reported by the active client for the current turn. */
   clientTimezone?: string;
-  /** Slack app_mention/direct bot mention signal from the gateway. */
-  slackBotMentioned?: boolean;
+  /**
+   * The message addresses the assistant by name, as stated by the channel
+   * (`sourceMetadata.botMentioned`). Absent means not established.
+   */
+  botMentioned?: boolean;
   /**
    * Slack-specific inbound metadata extracted at the HTTP boundary. Threaded
    * through to `persistUserMessage` so the row can be tagged with a
@@ -166,7 +169,7 @@ export function processChannelMessageInBackground(
     sourceLanguageCode,
     chatType,
     clientTimezone,
-    slackBotMentioned,
+    botMentioned,
     slackInbound,
     channelInbound,
     slackReactionRowMeta,
@@ -204,7 +207,7 @@ export function processChannelMessageInBackground(
       initiatorUserId: slackInbound?.actorExternalUserId,
       startImmediately: shouldShowActivityImmediately({
         chatType,
-        botMentioned: slackBotMentioned,
+        botMentioned,
       }),
     });
     const stopApprovalWatcher = replyCallbackUrl
@@ -283,6 +286,7 @@ export function processChannelMessageInBackground(
           },
           assistantId,
           trustContext: trustCtx,
+          author: trustCtx,
           isInteractive: resolveRoutingState(trustCtx).promptWaitingAllowed,
           ...(displayContent !== undefined ? { displayContent } : {}),
           ...(cmdIntent ? { commandIntent: cmdIntent } : {}),
@@ -449,10 +453,6 @@ type ChannelActivityController = {
   stop: () => void;
 };
 
-export function shouldShowActivityForText(text: string): boolean {
-  return hasDeliverableAssistantText(text);
-}
-
 /**
  * Room shapes with one other participant, in each channel's own word for it.
  *
@@ -610,7 +610,7 @@ function startChannelActivity(params: {
         return;
       }
       observedAssistantText += msg.text;
-      if (shouldShowActivityForText(observedAssistantText)) {
+      if (hasDeliverableAssistantText(observedAssistantText)) {
         show();
       }
     },

package/src/runtime/routes/inbound-stages/reaction-intercept.ts

@@ -35,6 +35,7 @@ import { createApprovalCopyGenerator } from "../../../daemon/approval-generators
 import { findConversation } from "../../../daemon/conversation-registry.js";
 import { getDiskPressureStatus } from "../../../daemon/disk-pressure-guard.js";
 import { classifyDiskPressureTurnPolicy } from "../../../daemon/disk-pressure-policy.js";
+import { actorAuthorProvenance } from "../../../daemon/message-provenance.js";
 import { processMessage } from "../../../daemon/process-message.js";
 import { renderReactionHistoryText } from "../../../daemon/reaction-history-render.js";
 import type { TrustContext } from "../../../daemon/trust-context-types.js";
@@ -544,6 +545,7 @@ async function persistReactionAsMessage(params: {
     {
       metadata: {
         ...provenanceFromTrustContext(params.trustCtx),
+        ...actorAuthorProvenance(params.trustCtx),
         ...buildReactionRowEnvelope(facts),
       },
       skipIndexing: true,

package/src/runtime/routes/inference-profile-session-handler.ts

@@ -16,6 +16,10 @@ import { randomUUID } from "node:crypto";
 
 import { getUserSelectableProfilesForProvider } from "../../config/default-profile-catalog.js";
 import { loadConfig } from "../../config/loader.js";
+import {
+  nonTextConversationProfileMessage,
+  profileSupportsTextGeneration,
+} from "../../config/profile-text-generation.js";
 import { findConversation } from "../../daemon/conversation-registry.js";
 import {
   getConversation,
@@ -163,10 +167,16 @@ export async function setInferenceProfileSession({
     );
   }
 
+  const selectable = profiles as Record<string, unknown>;
+  const selected = selectable[profile] as Record<string, unknown>;
+  if (!profileSupportsTextGeneration(selected, selectable)) {
+    throw new BadRequestError(nonTextConversationProfileMessage(profile));
+  }
+
   // Pinning a profile that provably cannot dispatch turns the next turn in
   // this conversation into a hard failure, so refuse the pin the same way the
   // active-profile setter does.
-  const entry = profiles[profile] as Record<string, unknown>;
+  const entry = selected;
   const availability = await computeProfileAvailability(entry);
   if (isUnavailable(availability)) {
     throw new BadRequestError(

package/src/runtime/routes/inference-profiles-routes.ts

@@ -29,6 +29,10 @@ import {
   getConfigReadOnly,
   loadRawConfig,
 } from "../../config/loader.js";
+import {
+  nonTextConversationProfileMessage,
+  profileSupportsTextGeneration,
+} from "../../config/profile-text-generation.js";
 import {
   ProfileEntry,
   routingIdentityModelIssue,
@@ -891,6 +895,11 @@ async function handleSetActiveProfile({ body = {} }: RouteHandlerArgs) {
       `Profile "${name}" is disabled and cannot be set as the active profile. Enable it first, or pick another.`,
     );
   }
+  if (
+    !profileSupportsTextGeneration(entry, effective as Record<string, unknown>)
+  ) {
+    throw new BadRequestError(nonTextConversationProfileMessage(name));
+  }
   // No escape hatch here: an active profile that cannot dispatch locks the
   // user out of chat entirely, and nothing about the write signals that.
   await guardProfileAvailability({

package/src/runtime/routes/llm-context-normalization.ts

@@ -1025,7 +1025,7 @@ function anthropicMessageSections(
         toolName: asString(block.name) ?? asString(block.tool_use_id),
         data:
           type === "web_search_tool_result"
-            ? sanitizeAnthropicWebSearchToolResultData(block)
+            ? sanitizeAnthropicStructuredValue(block)
             : undefined,
         text: collectAnthropicToolResultText(block),
       });
@@ -1397,12 +1397,6 @@ function collectAnthropicToolResultText(
   return collectAnthropicText(block.content);
 }
 
-function sanitizeAnthropicWebSearchToolResultData(
-  block: Record<string, unknown>,
-): unknown {
-  return sanitizeAnthropicStructuredValue(block);
-}
-
 function sanitizeAnthropicStructuredValue(value: unknown): unknown {
   if (Array.isArray(value)) {
     return value.map((entry) => sanitizeAnthropicStructuredValue(entry));