@vellumai/assistant 0.6.3 → 0.6.5

package/src/daemon/handlers/config-slack-channel.ts

@@ -30,6 +30,7 @@ export interface SlackChannelConfigResult {
   success: boolean;
   hasBotToken: boolean;
   hasAppToken: boolean;
+  hasUserToken: boolean;
   connected: boolean;
   teamId?: string;
   teamName?: string;
@@ -58,18 +59,33 @@ function ensureBotTokenInjectionTemplates(): void {
   });
 }
 
+/** Ensure the user token credential has injection templates for the proxy. */
+function ensureUserTokenInjectionTemplates(): void {
+  upsertCredentialMetadata("slack_channel", "user_token", {
+    allowedDomains: ["slack.com"],
+    injectionTemplates: SLACK_INJECTION_TEMPLATES,
+  });
+}
+
 /**
- * Backfill injection templates on the Slack bot token credential.
+ * Backfill injection templates on the Slack credentials.
  * Called on daemon startup so existing credentials get proxy support.
  */
 export function backfillSlackInjectionTemplates(): void {
-  const meta = getCredentialMetadata("slack_channel", "bot_token");
+  const botMeta = getCredentialMetadata("slack_channel", "bot_token");
   if (
-    meta &&
-    (!meta.injectionTemplates || meta.injectionTemplates.length === 0)
+    botMeta &&
+    (!botMeta.injectionTemplates || botMeta.injectionTemplates.length === 0)
   ) {
     ensureBotTokenInjectionTemplates();
   }
+  const userMeta = getCredentialMetadata("slack_channel", "user_token");
+  if (
+    userMeta &&
+    (!userMeta.injectionTemplates || userMeta.injectionTemplates.length === 0)
+  ) {
+    ensureUserTokenInjectionTemplates();
+  }
 }
 
 // -- Business logic --
@@ -87,6 +103,9 @@ export async function getSlackChannelConfig(): Promise<SlackChannelConfigResult>
   const hasAppToken = !!(await getSecureKeyAsync(
     credentialKey("slack_channel", "app_token"),
   ));
+  const hasUserToken = !!(await getSecureKeyAsync(
+    credentialKey("slack_channel", "user_token"),
+  ));
   const conn = getConnectionByProvider("slack_channel");
   const connected =
     !!(conn && conn.status === "active") && hasBotToken && hasAppToken;
@@ -96,11 +115,15 @@ export async function getSlackChannelConfig(): Promise<SlackChannelConfigResult>
   if (hasBotToken) {
     ensureBotTokenInjectionTemplates();
   }
+  if (hasUserToken) {
+    ensureUserTokenInjectionTemplates();
+  }
 
   return {
     success: true,
     hasBotToken,
     hasAppToken,
+    hasUserToken,
     connected,
     ...(teamId ? { teamId } : {}),
     ...(teamName ? { teamName } : {}),
@@ -109,9 +132,37 @@ export async function getSlackChannelConfig(): Promise<SlackChannelConfigResult>
   };
 }
 
+/** Build an error-path result snapshot that reports the current credential state. */
+async function currentErrorSnapshot(
+  error: string,
+): Promise<SlackChannelConfigResult> {
+  const errHasBotToken = !!(await getSecureKeyAsync(
+    credentialKey("slack_channel", "bot_token"),
+  ));
+  const errHasAppToken = !!(await getSecureKeyAsync(
+    credentialKey("slack_channel", "app_token"),
+  ));
+  const errHasUserToken = !!(await getSecureKeyAsync(
+    credentialKey("slack_channel", "user_token"),
+  ));
+  const errConn = getConnectionByProvider("slack_channel");
+  return {
+    success: false,
+    hasBotToken: errHasBotToken,
+    hasAppToken: errHasAppToken,
+    hasUserToken: errHasUserToken,
+    connected:
+      !!(errConn && errConn.status === "active") &&
+      errHasBotToken &&
+      errHasAppToken,
+    error,
+  };
+}
+
 export async function setSlackChannelConfig(
   botToken?: string,
   appToken?: string,
+  userToken?: string,
 ): Promise<SlackChannelConfigResult> {
   let metadata: {
     teamId?: string;
@@ -138,25 +189,9 @@ export async function setSlackChannelConfig(
         user?: string;
       };
       if (!data.ok) {
-        const errHasBotToken = !!(await getSecureKeyAsync(
-          credentialKey("slack_channel", "bot_token"),
-        ));
-        const errHasAppToken = !!(await getSecureKeyAsync(
-          credentialKey("slack_channel", "app_token"),
-        ));
-        const errConn = getConnectionByProvider("slack_channel");
-        return {
-          success: false,
-          hasBotToken: errHasBotToken,
-          hasAppToken: errHasAppToken,
-          connected:
-            !!(errConn && errConn.status === "active") &&
-            errHasBotToken &&
-            errHasAppToken,
-          error: `Slack API validation failed: ${
-            data.error ?? "unknown error"
-          }`,
-        };
+        return currentErrorSnapshot(
+          `Slack API validation failed: ${data.error ?? "unknown error"}`,
+        );
       }
       metadata = {
         teamId: data.team_id,
@@ -166,23 +201,7 @@ export async function setSlackChannelConfig(
       };
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      const errHasBotToken = !!(await getSecureKeyAsync(
-        credentialKey("slack_channel", "bot_token"),
-      ));
-      const errHasAppToken = !!(await getSecureKeyAsync(
-        credentialKey("slack_channel", "app_token"),
-      ));
-      const errConn = getConnectionByProvider("slack_channel");
-      return {
-        success: false,
-        hasBotToken: errHasBotToken,
-        hasAppToken: errHasAppToken,
-        connected:
-          !!(errConn && errConn.status === "active") &&
-          errHasBotToken &&
-          errHasAppToken,
-        error: `Failed to validate bot token: ${message}`,
-      };
+      return currentErrorSnapshot(`Failed to validate bot token: ${message}`);
     }
 
     const stored = await setSecureKeyAsync(
@@ -190,23 +209,7 @@ export async function setSlackChannelConfig(
       botToken,
     );
     if (!stored) {
-      const errHasBotToken = !!(await getSecureKeyAsync(
-        credentialKey("slack_channel", "bot_token"),
-      ));
-      const errHasAppToken = !!(await getSecureKeyAsync(
-        credentialKey("slack_channel", "app_token"),
-      ));
-      const errConn = getConnectionByProvider("slack_channel");
-      return {
-        success: false,
-        hasBotToken: errHasBotToken,
-        hasAppToken: errHasAppToken,
-        connected:
-          !!(errConn && errConn.status === "active") &&
-          errHasBotToken &&
-          errHasAppToken,
-        error: "Failed to store bot token in secure storage",
-      };
+      return currentErrorSnapshot("Failed to store bot token in secure storage");
     }
 
     ensureBotTokenInjectionTemplates();
@@ -218,6 +221,73 @@ export async function setSlackChannelConfig(
     setNestedValue(raw, "slack.botUsername", metadata.botUsername ?? "");
     saveRawConfig(raw);
     invalidateConfigCache();
+
+    // Cross-check existing user_token against the newly-stored bot_token's
+    // workspace. A user_token persisted under a previous workspace (or whose
+    // auth.test returns ok:false) must be cleared so reads and writes never
+    // fan out across workspaces.
+    //
+    // IMPORTANT: we only clear on a definitive negative signal —
+    // (a) auth.test returned ok:false, or
+    // (b) auth.test returned ok:true with a team_id that differs from the new
+    //     bot_token's team_id.
+    //
+    // Transient failures (network error, non-JSON response, JSON parse error)
+    // must NOT wipe a still-valid user_token: for user-scope installs,
+    // re-issuing can require admin approval. The adapter already tolerates a
+    // stale token — it will surface on next real use, at which point the user
+    // can re-run setup.
+    const existingUserToken = await getSecureKeyAsync(
+      credentialKey("slack_channel", "user_token"),
+    );
+    if (existingUserToken) {
+      let shouldClear = false;
+      let clearReason: string | undefined;
+      try {
+        const res = await fetch("https://slack.com/api/auth.test", {
+          method: "POST",
+          headers: { Authorization: `Bearer ${existingUserToken}` },
+        });
+        const data = (await res.json()) as {
+          ok: boolean;
+          error?: string;
+          team_id?: string;
+        };
+        if (!data.ok) {
+          shouldClear = true;
+          clearReason = "User token validation failed; it has been removed.";
+        } else if (
+          metadata.teamId &&
+          data.team_id &&
+          data.team_id !== metadata.teamId
+        ) {
+          shouldClear = true;
+          clearReason =
+            "User token from a different workspace was removed.";
+        }
+      } catch (err) {
+        // Transient failure (DNS error, network blip, connection reset,
+        // non-JSON response, JSON parse failure). Leave the user_token in
+        // place — we have no definitive signal that it's invalid. Future
+        // reads that actually hit Slack will fail naturally if the token is
+        // actually bad, and the user can re-run setup then.
+        const message = err instanceof Error ? err.message : String(err);
+        _log.warn(
+          { err: message },
+          "Skipping user_token re-validation due to transient error; leaving existing user_token in place.",
+        );
+      }
+      if (shouldClear) {
+        const cleared = await clearSlackUserToken();
+        if (!cleared.success) {
+          const failMsg =
+            "User token workspace mismatch detected but removal failed; please clear it manually.";
+          warning = warning ? `${warning} ${failMsg}` : failMsg;
+        } else if (clearReason) {
+          warning = warning ? `${warning} ${clearReason}` : clearReason;
+        }
+      }
+    }
   } else {
     // Use existing metadata from config if no new bot token provided
     const { teamId, teamName, botUserId, botUsername } = getConfig().slack;
@@ -232,23 +302,7 @@ export async function setSlackChannelConfig(
   // Validate and store app token
   if (appToken) {
     if (!appToken.startsWith("xapp-")) {
-      const errHasBotToken = !!(await getSecureKeyAsync(
-        credentialKey("slack_channel", "bot_token"),
-      ));
-      const errHasAppToken = !!(await getSecureKeyAsync(
-        credentialKey("slack_channel", "app_token"),
-      ));
-      const errConn = getConnectionByProvider("slack_channel");
-      return {
-        success: false,
-        hasBotToken: errHasBotToken,
-        hasAppToken: errHasAppToken,
-        connected:
-          !!(errConn && errConn.status === "active") &&
-          errHasBotToken &&
-          errHasAppToken,
-        error: 'Invalid app token: must start with "xapp-"',
-      };
+      return currentErrorSnapshot('Invalid app token: must start with "xapp-"');
     }
 
     const stored = await setSecureKeyAsync(
@@ -256,41 +310,86 @@ export async function setSlackChannelConfig(
       appToken,
     );
     if (!stored) {
-      const errHasBotToken = !!(await getSecureKeyAsync(
-        credentialKey("slack_channel", "bot_token"),
-      ));
-      const errHasAppToken = !!(await getSecureKeyAsync(
-        credentialKey("slack_channel", "app_token"),
-      ));
-      const errConn = getConnectionByProvider("slack_channel");
-      return {
-        success: false,
-        hasBotToken: errHasBotToken,
-        hasAppToken: errHasAppToken,
-        connected:
-          !!(errConn && errConn.status === "active") &&
-          errHasBotToken &&
-          errHasAppToken,
-        error: "Failed to store app token in secure storage",
-      };
+      return currentErrorSnapshot("Failed to store app token in secure storage");
     }
 
     upsertCredentialMetadata("slack_channel", "app_token", {});
   }
 
+  // Validate and store user token (optional — grants read access to channels
+  // the bot isn't a member of; writes always continue to go through the bot).
+  if (userToken) {
+    if (!userToken.startsWith("xoxp-")) {
+      return currentErrorSnapshot(
+        'Invalid user token: must start with "xoxp-"',
+      );
+    }
+
+    let userTeamId: string | undefined;
+    try {
+      const res = await fetch("https://slack.com/api/auth.test", {
+        method: "POST",
+        headers: { Authorization: `Bearer ${userToken}` },
+      });
+      const data = (await res.json()) as {
+        ok: boolean;
+        error?: string;
+        team_id?: string;
+      };
+      if (!data.ok) {
+        return currentErrorSnapshot(
+          `Slack API validation failed: ${data.error ?? "unknown error"}`,
+        );
+      }
+      userTeamId = data.team_id;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return currentErrorSnapshot(
+        `Failed to validate user token: ${message}`,
+      );
+    }
+
+    // Cross-check: if a bot token has already been configured, the user token
+    // must be for the same workspace. If no bot token is configured yet, store
+    // provisionally and skip the cross-check — the order of setup can vary.
+    const existingBotTeamId = metadata.teamId;
+    if (existingBotTeamId && userTeamId && existingBotTeamId !== userTeamId) {
+      return currentErrorSnapshot(
+        "User token is for a different workspace than the bot token",
+      );
+    }
+
+    const stored = await setSecureKeyAsync(
+      credentialKey("slack_channel", "user_token"),
+      userToken,
+    );
+    if (!stored) {
+      return currentErrorSnapshot(
+        "Failed to store user token in secure storage",
+      );
+    }
+
+    ensureUserTokenInjectionTemplates();
+  }
+
   const hasBotToken = !!(await getSecureKeyAsync(
     credentialKey("slack_channel", "bot_token"),
   ));
   const hasAppToken = !!(await getSecureKeyAsync(
     credentialKey("slack_channel", "app_token"),
   ));
+  const hasUserToken = !!(await getSecureKeyAsync(
+    credentialKey("slack_channel", "user_token"),
+  ));
 
   if (hasBotToken && !hasAppToken) {
-    warning =
+    const msg =
       "Bot token stored but app token is missing — connection incomplete.";
+    warning = warning ? `${warning} ${msg}` : msg;
   } else if (!hasBotToken && hasAppToken) {
-    warning =
+    const msg =
       "App token stored but bot token is missing — connection incomplete.";
+    warning = warning ? `${warning} ${msg}` : msg;
   }
 
   // Sync oauth_connection record so getConnectionByProvider("slack_channel")
@@ -309,12 +408,79 @@ export async function setSlackChannelConfig(
     success: true,
     hasBotToken,
     hasAppToken,
+    hasUserToken,
     connected: hasBotToken && hasAppToken,
     ...metadata,
     ...(warning ? { warning } : {}),
   };
 }
 
+/**
+ * Surgically remove the Slack user_token credential.
+ *
+ * Deletes only the user_token secure key and its credential metadata. Leaves
+ * the bot_token, app_token, oauth_connection row, and Slack config metadata
+ * untouched so the Socket Mode connection stays up. Returns a
+ * `SlackChannelConfigResult` reflecting the remaining state. A `not-found`
+ * delete outcome is reported as a failure to match the credential_store
+ * delete semantics (callers and automation rely on missing-credential
+ * detection).
+ */
+export async function clearSlackUserToken(): Promise<SlackChannelConfigResult> {
+  const result = await deleteSecureKeyAsync(
+    credentialKey("slack_channel", "user_token"),
+  );
+
+  if (result === "error" || result === "not-found") {
+    const hasBotToken = !!(await getSecureKeyAsync(
+      credentialKey("slack_channel", "bot_token"),
+    ));
+    const hasAppToken = !!(await getSecureKeyAsync(
+      credentialKey("slack_channel", "app_token"),
+    ));
+    const hasUserToken = !!(await getSecureKeyAsync(
+      credentialKey("slack_channel", "user_token"),
+    ));
+    const conn = getConnectionByProvider("slack_channel");
+    return {
+      success: false,
+      hasBotToken,
+      hasAppToken,
+      hasUserToken,
+      connected:
+        !!(conn && conn.status === "active") && hasBotToken && hasAppToken,
+      error:
+        result === "not-found"
+          ? "Slack user token not found in secure storage"
+          : "Failed to delete Slack user token from secure storage",
+    };
+  }
+
+  deleteCredentialMetadata("slack_channel", "user_token");
+
+  const hasBotToken = !!(await getSecureKeyAsync(
+    credentialKey("slack_channel", "bot_token"),
+  ));
+  const hasAppToken = !!(await getSecureKeyAsync(
+    credentialKey("slack_channel", "app_token"),
+  ));
+  const conn = getConnectionByProvider("slack_channel");
+  const { teamId, teamName, botUserId, botUsername } = getConfig().slack;
+
+  return {
+    success: true,
+    hasBotToken,
+    hasAppToken,
+    hasUserToken: false,
+    connected:
+      !!(conn && conn.status === "active") && hasBotToken && hasAppToken,
+    ...(teamId ? { teamId } : {}),
+    ...(teamName ? { teamName } : {}),
+    ...(botUserId ? { botUserId } : {}),
+    ...(botUsername ? { botUsername } : {}),
+  };
+}
+
 export async function clearSlackChannelConfig(): Promise<SlackChannelConfigResult> {
   const r1 = await deleteSecureKeyAsync(
     credentialKey("slack_channel", "bot_token"),
@@ -322,8 +488,11 @@ export async function clearSlackChannelConfig(): Promise<SlackChannelConfigResul
   const r2 = await deleteSecureKeyAsync(
     credentialKey("slack_channel", "app_token"),
   );
+  const r3 = await deleteSecureKeyAsync(
+    credentialKey("slack_channel", "user_token"),
+  );
 
-  if (r1 === "error" || r2 === "error") {
+  if (r1 === "error" || r2 === "error" || r3 === "error") {
     // Check each key individually so partial deletions report accurate status.
     const hasBotToken = !!(await getSecureKeyAsync(
       credentialKey("slack_channel", "bot_token"),
@@ -331,11 +500,15 @@ export async function clearSlackChannelConfig(): Promise<SlackChannelConfigResul
     const hasAppToken = !!(await getSecureKeyAsync(
       credentialKey("slack_channel", "app_token"),
     ));
+    const hasUserToken = !!(await getSecureKeyAsync(
+      credentialKey("slack_channel", "user_token"),
+    ));
     const conn = getConnectionByProvider("slack_channel");
     return {
       success: false,
       hasBotToken,
       hasAppToken,
+      hasUserToken,
       connected:
         !!(conn && conn.status === "active") && hasBotToken && hasAppToken,
       error: "Failed to delete Slack channel credentials from secure storage",
@@ -344,6 +517,7 @@ export async function clearSlackChannelConfig(): Promise<SlackChannelConfigResul
 
   deleteCredentialMetadata("slack_channel", "bot_token");
   deleteCredentialMetadata("slack_channel", "app_token");
+  deleteCredentialMetadata("slack_channel", "user_token");
 
   // Remove the oauth_connection row so getConnectionByProvider returns undefined.
   removeManualTokenConnection("slack_channel");
@@ -360,6 +534,7 @@ export async function clearSlackChannelConfig(): Promise<SlackChannelConfigResul
     success: true,
     hasBotToken: false,
     hasAppToken: false,
+    hasUserToken: false,
     connected: false,
   };
 }

package/src/daemon/handlers/conversations.ts

@@ -16,6 +16,7 @@ import * as pendingInteractions from "../../runtime/pending-interactions.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
 import { getSubagentManager } from "../../subagent/index.js";
 import { summarizeToolInput } from "../../tools/tool-input-summary.js";
+import { createAbortReason } from "../../util/abort-reasons.js";
 import { truncate } from "../../util/truncate.js";
 import type { Conversation } from "../conversation.js";
 import type {
@@ -147,12 +148,19 @@ export function handleConfirmationResponse(
   // Route by requestId to the conversation that originated the prompt, not by
   // the current conversation binding which may have changed since the
   // request was issued (e.g. after a conversation switch).
+  // Normalize legacy decision: older clients may still send
+  // "always_allow_high_risk" via WebSocket for high-risk prompts.
+  const decision =
+    msg.decision === ("always_allow_high_risk" as typeof msg.decision)
+      ? "always_allow"
+      : msg.decision;
+
   for (const [conversationId, conversation] of ctx.conversations) {
     if (conversation.hasPendingConfirmation(msg.requestId)) {
       ctx.touchConversation(conversationId);
       conversation.handleConfirmationResponse(
         msg.requestId,
-        msg.decision,
+        decision,
         msg.selectedPattern,
         msg.selectedScope,
         undefined,
@@ -323,7 +331,9 @@ export function cancelGeneration(
     return false;
   }
   ctx.touchConversation(conversationId);
-  conversation.abort();
+  conversation.abort(
+    createAbortReason("user_cancel", "cancelGeneration", conversationId),
+  );
   // Also abort any child subagents spawned by this conversation.
   // Omit sendToClient to suppress parent notifications — the parent is
   // being cancelled, so enqueuing synthetic messages would trigger
@@ -432,7 +442,7 @@ export function handleUsageRequest(
     totalInputTokens: conversation.totalInputTokens,
     totalOutputTokens: conversation.totalOutputTokens,
     estimatedCost: conversation.totalEstimatedCost,
-    model: config.services.inference.model,
+    model: config.llm.default.model,
   });
 }
 

package/src/daemon/handlers/shared.ts

@@ -1,9 +1,10 @@
 import { v4 as uuid } from "uuid";
 
 import { getConfig } from "../../config/loader.js";
-import type { Speed } from "../../config/schemas/inference.js";
+import type { LLMCallSite, Speed } from "../../config/schemas/llm.js";
 import type { HeartbeatService } from "../../heartbeat/heartbeat-service.js";
 import type { SecretPromptResult } from "../../permissions/secret-prompter.js";
+import { isPlaceholderSentinelText } from "../../providers/anthropic/client.js";
 import type { AuthContext } from "../../runtime/auth/types.js";
 import type { DebouncerMap } from "../../util/debounce.js";
 import { getLogger } from "../../util/logger.js";
@@ -81,6 +82,7 @@ export interface HistorySurface {
   data: Record<string, unknown>;
   actions?: Array<{ id: string; label: string; style?: string }>;
   display?: string;
+  persistent?: boolean;
   completed?: boolean;
   completionSummary?: string;
 }
@@ -100,6 +102,22 @@ export interface RenderedHistoryContent {
   thinkingSegments: string[];
 }
 
+/**
+ * Slack-specific metadata extracted at the inbound HTTP boundary and threaded
+ * through to user-message persistence so the row can be tagged with a
+ * `slackMeta` envelope for the chronological renderer.
+ */
+export interface SlackInboundMessageMetadata {
+  /** Slack channel id (conversation external id) — recorded as `channelId`. */
+  channelId: string;
+  /** Slack `ts` for this message — required so persistence can record `channelTs`. */
+  channelTs: string;
+  /** Parent `thread_ts` when the message lives inside a thread; absent for top-level. */
+  threadTs?: string;
+  /** Resolved sender label (display name preferred, username fallback). */
+  displayName?: string;
+}
+
 /**
  * Optional overrides for conversation creation (e.g. interview mode).
  */
@@ -126,6 +144,26 @@ export interface ConversationCreateOptions {
   commandIntent?: { type: string; payload?: string; languageCode?: string };
   /** Optional callback to receive real-time agent loop events (text deltas, tool starts, etc.). */
   onEvent?: (msg: ServerMessage) => void;
+  /**
+   * Optional explicit model override (provider/model string) for this
+   * conversation's agent loop. Used by the auto-analyze loop to pin the
+   * analysis agent to a specific model.
+   */
+  modelOverride?: string;
+  /**
+   * Optional LLM call-site identifier threaded through to the per-call
+   * provider config. Adapter callers (heartbeat, filing, schedule, etc.)
+   * pass their call-site here so the agent loop routes through
+   * `resolveCallSiteConfig` instead of the global default.
+   */
+  callSite?: LLMCallSite;
+  /**
+   * Slack inbound metadata captured at the channel ingress boundary. When
+   * present (and the turn channel resolves to Slack), persistence writes a
+   * `slackMeta` sub-object into the message's `metadata` JSON for the
+   * chronological renderer to consume.
+   */
+  slackInbound?: SlackInboundMessageMetadata;
 }
 
 /**
@@ -288,6 +326,7 @@ export function renderHistoryContent(content: unknown): RenderedHistoryContent {
           : {},
         actions: Array.isArray(block.actions) ? block.actions : undefined,
         display: typeof block.display === "string" ? block.display : undefined,
+        persistent: block.persistent === true ? true : undefined,
         completed: block.completed === true ? true : undefined,
         completionSummary:
           typeof block.completionSummary === "string"
@@ -307,6 +346,17 @@ export function renderHistoryContent(content: unknown): RenderedHistoryContent {
     }
 
     if (block.type === "text" && typeof block.text === "string") {
+      // Skip empty/whitespace-only text blocks. During streaming the client
+      // discards empty text deltas (guard !text.isEmpty), so including them
+      // here produces a contentOrder that differs from the live streaming
+      // path — e.g. empty segments between consecutive tool_use blocks that
+      // break tool-call grouping in the UI.
+      if (block.text.trim().length === 0) continue;
+      // Drop Anthropic provider placeholder sentinels. These are injected
+      // into outbound API requests to preserve role alternation and must
+      // never be rendered to users. Belt-and-suspenders with the persist-
+      // time filter in cleanAssistantContent and migration 222.
+      if (isPlaceholderSentinelText(block.text)) continue;
       textParts.push(block.text);
       ensureSegment();
       currentSegmentParts.push(block.text);