@vellumai/assistant 0.8.1 → 0.8.2

package/src/__tests__/conversation-workspace-tool-tracking.test.ts

@@ -61,7 +61,11 @@ mock.module("../config/loader.js", () => ({
       pricingOverrides: [],
     },
     rateLimit: { maxRequestsPerMinute: 0 },
-    memory: { enabled: false, v2: { enabled: false } },
+    memory: {
+      enabled: false,
+      v2: { enabled: false },
+      retrieval: { scratchpadInjection: { enabled: true } },
+    },
     daemon: {
       startupSocketWaitMs: 5000,
       stopTimeoutMs: 5000,

package/src/__tests__/credential-security-invariants.test.ts

@@ -189,10 +189,10 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "messaging/providers/slack/adapter.ts", // Slack bot token lookup for Socket Mode connectivity check
       "credential-health/credential-health-service.ts", // proactive credential health monitoring
       "daemon/handlers/config-slack-channel.ts", // Slack channel config credential management
-      "providers/managed-proxy/context.ts", // managed proxy API key lookup for provider initialization
+      "providers/platform-proxy/context.ts", // managed proxy API key lookup for provider initialization
       "platform/client.ts", // platform client credential store fallback for standalone CLI auth
       "mcp/mcp-oauth-provider.ts", // MCP OAuth token/client/discovery persistence
-      "runtime/routes/integrations/slack/share.ts", // Slack share routes credential lookup
+      "runtime/routes/integrations/slack/token.ts", // shared Slack token resolver (bot/user token lookup for CLI use routes)
       "mcp/client.ts", // MCP client cached-token lookup
       "oauth/token-persistence.ts", // OAuth token persistence (set/delete tokens)
       "oauth/credential-token-resolver.ts", // centralized access-token key resolution for OAuth and manual-token providers
@@ -226,6 +226,7 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "runtime/routes/platform-routes.ts", // CLI platform connect/disconnect/status routes (CLI-migrated to IPC)
       "ipc/skill-routes/providers.ts", // host.providers.secureKeys.getProviderKey IPC route (out-of-process SkillHost companion)
       "daemon/external-plugins-bootstrap.ts", // reads credentials at plugin init (manifest.requiresCredential) via the CES-mediated getSecureKeyAsync path
+      "plugins/external-api.ts", // globalThis runtime bridge that exposes getSecureKeyAsync to dynamically-imported workspace plugins (compiled-binary plugin loading)
       "inbound/platform-callback-registration.ts", // managed credential lookup for platform base URL, assistant ID, and API key
       "tts/providers/elevenlabs-provider.ts", // ElevenLabs TTS API key lookup
       "tts/providers/deepgram-provider.ts", // Deepgram TTS API key lookup

package/src/__tests__/db-slack-external-content-normalization.test.ts

@@ -0,0 +1,301 @@
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import { getSqliteFrom } from "../memory/db-connection.js";
+import { createMessagesFts } from "../memory/migrations/116-messages-fts.js";
+import { migrateNormalizeSlackExternalContent } from "../memory/migrations/249-normalize-slack-external-content.js";
+import * as schema from "../memory/schema.js";
+import { writeSlackMetadata } from "../messaging/providers/slack/message-metadata.js";
+import { wrapUntrustedContent } from "../security/untrusted-content.js";
+
+interface MessageRow {
+  id: string;
+  content: string;
+  metadata: string | null;
+}
+
+interface FtsRow {
+  content: string;
+}
+
+function createTestDb() {
+  const sqlite = new Database(":memory:");
+  sqlite.exec("PRAGMA journal_mode=WAL");
+  sqlite.exec("PRAGMA foreign_keys = ON");
+  return drizzle(sqlite, { schema });
+}
+
+function bootstrapConversationTables(raw: Database): void {
+  raw.exec(/*sql*/ `
+    CREATE TABLE memory_checkpoints (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+
+    CREATE TABLE conversations (
+      id TEXT PRIMARY KEY,
+      title TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+
+    CREATE TABLE messages (
+      id TEXT PRIMARY KEY,
+      conversation_id TEXT NOT NULL REFERENCES conversations(id) ON DELETE CASCADE,
+      role TEXT NOT NULL,
+      content TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      metadata TEXT
+    );
+
+    INSERT INTO conversations (id, title, created_at, updated_at)
+    VALUES ('conv-slack', 'Slack conversation', 1000, 1000);
+  `);
+}
+
+function slackEnvelope(
+  channelTs: string,
+  extra: Record<string, unknown> = {},
+): string {
+  return JSON.stringify({
+    userMessageChannel: "slack",
+    assistantMessageChannel: "slack",
+    slackMeta: writeSlackMetadata({
+      source: "slack",
+      channelId: "C0123",
+      channelTs,
+      eventKind: "message",
+      displayName: "@alice",
+    }),
+    ...extra,
+  });
+}
+
+function slackBackfillEnvelope(
+  channelTs: string,
+  extra: Record<string, unknown> = {},
+): string {
+  const { slackFiles, ...outerExtra } = extra;
+  return JSON.stringify({
+    slackMeta: writeSlackMetadata({
+      source: "slack",
+      channelId: "C0123",
+      channelTs,
+      eventKind: "message",
+      displayName: "@alice",
+      ...(Array.isArray(slackFiles) ? { slackFiles } : {}),
+    }),
+    ...outerExtra,
+  });
+}
+
+function insertMessage(
+  raw: Database,
+  id: string,
+  content: string,
+  metadata: string,
+  role = "user",
+): void {
+  raw
+    .query(
+      /*sql*/ `
+        INSERT INTO messages (id, conversation_id, role, content, created_at, metadata)
+        VALUES (?, 'conv-slack', ?, ?, 1000, ?)
+      `,
+    )
+    .run(id, role, content, metadata);
+}
+
+function getRows(raw: Database): Record<string, MessageRow> {
+  const rows = raw
+    .query(`SELECT id, content, metadata FROM messages ORDER BY id`)
+    .all() as MessageRow[];
+  return Object.fromEntries(rows.map((row) => [row.id, row]));
+}
+
+function getFtsContent(raw: Database, messageId: string): string {
+  const row = raw
+    .query(`SELECT content FROM messages_fts WHERE message_id = ?`)
+    .get(messageId) as FtsRow | null;
+  return row?.content ?? "";
+}
+
+describe("migrateNormalizeSlackExternalContent", () => {
+  test("normalizes complete Slack envelopes and leaves unrelated rows unchanged", () => {
+    const db = createTestDb();
+    const raw = getSqliteFrom(db);
+    bootstrapConversationTables(raw);
+    createMessagesFts(db);
+
+    const wrappedPlain = wrapUntrustedContent("plain Slack text", {
+      source: "slack",
+      sourceDetail: "@alice",
+    });
+    const wrappedBlock = wrapUntrustedContent("block Slack text", {
+      source: "slack",
+      sourceDetail: "@alice",
+    });
+    const jsonContent = JSON.stringify([
+      { type: "text", text: wrappedBlock },
+      {
+        type: "image",
+        source: { type: "base64", media_type: "image/png", data: "aGVsbG8=" },
+      },
+      { type: "file", source: { type: "file_id", file_id: "file_1" } },
+    ]);
+    const nonSlackWrapped = wrapUntrustedContent("web text", {
+      source: "web",
+      sourceDetail: "https://example.com",
+    });
+    const guardianMetadata = slackEnvelope("1700000003.000000", {
+      provenanceTrustClass: "guardian",
+    });
+    const liveRawMissingProvenanceMetadata = slackEnvelope("1700000007.000000");
+    const legacyGuardianMetadata = slackBackfillEnvelope("1700000004.000000");
+    const legacyGuardianJsonContent = JSON.stringify([
+      { type: "text", text: "guardian image caption" },
+      {
+        type: "image",
+        source: { type: "base64", media_type: "image/png", data: "aGVsbG8=" },
+      },
+    ]);
+    const ambiguousAttachmentOnlyMetadata = slackBackfillEnvelope(
+      "1700000006.000000",
+      {
+        slackFiles: [
+          {
+            id: "F0123",
+            name: "example.png",
+            mimetype: "image/png",
+          },
+        ],
+      },
+    );
+    const ambiguousAttachmentOnlyContent = JSON.stringify([
+      {
+        type: "image",
+        source: { type: "base64", media_type: "image/png", data: "aGVsbG8=" },
+      },
+    ]);
+
+    insertMessage(
+      raw,
+      "slack-plain",
+      wrappedPlain,
+      slackEnvelope("1700000000.000000"),
+    );
+    insertMessage(
+      raw,
+      "slack-json",
+      jsonContent,
+      slackEnvelope("1700000001.000000"),
+    );
+    insertMessage(
+      raw,
+      "non-slack",
+      nonSlackWrapped,
+      JSON.stringify({ userMessageChannel: "web" }),
+    );
+    insertMessage(raw, "guardian-raw", "guardian Slack text", guardianMetadata);
+    insertMessage(
+      raw,
+      "live-raw-missing-provenance",
+      "live raw Slack text",
+      liveRawMissingProvenanceMetadata,
+    );
+    insertMessage(
+      raw,
+      "legacy-guardian-raw",
+      "legacy guardian Slack text",
+      legacyGuardianMetadata,
+    );
+    insertMessage(
+      raw,
+      "legacy-guardian-json",
+      legacyGuardianJsonContent,
+      slackBackfillEnvelope("1700000005.000000"),
+    );
+    insertMessage(
+      raw,
+      "ambiguous-attachment-only",
+      ambiguousAttachmentOnlyContent,
+      ambiguousAttachmentOnlyMetadata,
+    );
+
+    migrateNormalizeSlackExternalContent(db);
+    const afterFirstRun = getRows(raw);
+    migrateNormalizeSlackExternalContent(db);
+    const afterSecondRun = getRows(raw);
+
+    expect(afterSecondRun).toEqual(afterFirstRun);
+
+    expect(afterFirstRun["slack-plain"]?.content).toBe("plain Slack text");
+    const plainMetadata = JSON.parse(
+      afterFirstRun["slack-plain"]!.metadata!,
+    ) as Record<string, unknown>;
+    expect(plainMetadata.provenanceTrustClass).toBe("unknown");
+    expect(typeof plainMetadata.slackMeta).toBe("string");
+
+    const normalizedBlocks = JSON.parse(afterFirstRun["slack-json"]!.content);
+    expect(normalizedBlocks).toEqual([
+      { type: "text", text: "block Slack text" },
+      {
+        type: "image",
+        source: { type: "base64", media_type: "image/png", data: "aGVsbG8=" },
+      },
+      { type: "file", source: { type: "file_id", file_id: "file_1" } },
+    ]);
+    const jsonMetadata = JSON.parse(
+      afterFirstRun["slack-json"]!.metadata!,
+    ) as Record<string, unknown>;
+    expect(jsonMetadata.provenanceTrustClass).toBe("unknown");
+
+    expect(afterFirstRun["non-slack"]?.content).toBe(nonSlackWrapped);
+    expect(afterFirstRun["non-slack"]?.metadata).toBe(
+      JSON.stringify({ userMessageChannel: "web" }),
+    );
+
+    expect(afterFirstRun["guardian-raw"]?.content).toBe("guardian Slack text");
+    expect(afterFirstRun["guardian-raw"]?.metadata).toBe(guardianMetadata);
+
+    expect(afterFirstRun["live-raw-missing-provenance"]?.content).toBe(
+      "live raw Slack text",
+    );
+    expect(afterFirstRun["live-raw-missing-provenance"]?.metadata).toBe(
+      liveRawMissingProvenanceMetadata,
+    );
+
+    expect(afterFirstRun["legacy-guardian-raw"]?.content).toBe(
+      "legacy guardian Slack text",
+    );
+    const legacyGuardianMetadataAfter = JSON.parse(
+      afterFirstRun["legacy-guardian-raw"]!.metadata!,
+    ) as Record<string, unknown>;
+    expect(legacyGuardianMetadataAfter.provenanceTrustClass).toBe("guardian");
+    expect(legacyGuardianMetadataAfter.provenanceSourceChannel).toBe("slack");
+
+    expect(afterFirstRun["legacy-guardian-json"]?.content).toBe(
+      legacyGuardianJsonContent,
+    );
+    const legacyGuardianJsonMetadataAfter = JSON.parse(
+      afterFirstRun["legacy-guardian-json"]!.metadata!,
+    ) as Record<string, unknown>;
+    expect(legacyGuardianJsonMetadataAfter.provenanceTrustClass).toBe(
+      "guardian",
+    );
+
+    expect(afterFirstRun["ambiguous-attachment-only"]?.content).toBe(
+      ambiguousAttachmentOnlyContent,
+    );
+    expect(afterFirstRun["ambiguous-attachment-only"]?.metadata).toBe(
+      ambiguousAttachmentOnlyMetadata,
+    );
+
+    expect(getFtsContent(raw, "slack-plain")).toBe("plain Slack text");
+    expect(getFtsContent(raw, "slack-json")).toContain("block Slack text");
+    expect(getFtsContent(raw, "slack-json")).not.toContain("<external_content");
+  });
+});

package/src/__tests__/delete-managed-skill-tool.test.ts

@@ -9,6 +9,7 @@ import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 const TEST_DIR = process.env.VELLUM_WORKSPACE_DIR!;
+const mockRefreshSkillCapabilityMemories = mock(() => {});
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -17,6 +18,10 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
+mock.module("../daemon/skill-memory-refresh.js", () => ({
+  refreshSkillCapabilityMemories: mockRefreshSkillCapabilityMemories,
+}));
+
 import { executeDeleteManagedSkill } from "../tools/skills/delete-managed.js";
 import type { ToolContext } from "../tools/types.js";
 
@@ -35,16 +40,11 @@ function createSkill(id: string): void {
     join(skillDir, "SKILL.md"),
     '---\nname: "Test"\ndescription: "Test"\n---\n\nBody.\n',
   );
-  // Update SKILLS.md
-  const indexPath = join(TEST_DIR, "skills", "SKILLS.md");
-  const existing = existsSync(indexPath)
-    ? readFileSync(indexPath, "utf-8")
-    : "";
-  writeFileSync(indexPath, existing + `- ${id}\n`);
 }
 
 beforeEach(() => {
   mkdirSync(join(TEST_DIR, "skills"), { recursive: true });
+  mockRefreshSkillCapabilityMemories.mockClear();
 });
 
 afterEach(() => {
@@ -52,9 +52,34 @@ afterEach(() => {
 });
 
 describe("delete_managed_skill tool", () => {
-  test("deletes existing skill and updates index", async () => {
+  test("keeps legacy index control as a deprecated no-op schema field", () => {
+    const tools = JSON.parse(
+      readFileSync(
+        join(
+          import.meta.dirname,
+          "../config/bundled-skills/skill-management/TOOLS.json",
+        ),
+        "utf-8",
+      ),
+    );
+    const deleteTool = tools.tools.find(
+      (tool: { name: string }) => tool.name === "delete_managed_skill",
+    );
+
+    expect(deleteTool).toBeDefined();
+    expect(deleteTool.input_schema.properties.remove_from_index).toEqual({
+      type: "boolean",
+      description:
+        "Deprecated no-op compatibility field. Skill deletion does not edit SKILLS.md.",
+    });
+  });
+
+  test("deletes existing skill without modifying the legacy index", async () => {
     createSkill("doomed");
     createSkill("survivor");
+    const indexPath = join(TEST_DIR, "skills", "SKILLS.md");
+    const staleIndex = "- doomed\n- survivor\n";
+    writeFileSync(indexPath, staleIndex);
 
     const result = await executeDeleteManagedSkill(
       {
@@ -67,16 +92,32 @@ describe("delete_managed_skill tool", () => {
     const parsed = JSON.parse(result.content);
     expect(parsed.deleted).toBe(true);
     expect(parsed.skill_id).toBe("doomed");
-    expect(parsed.index_updated).toBe(true);
+    expect(parsed).not.toHaveProperty("index_updated");
 
     expect(existsSync(join(TEST_DIR, "skills", "doomed"))).toBe(false);
 
-    const indexContent = readFileSync(
-      join(TEST_DIR, "skills", "SKILLS.md"),
-      "utf-8",
+    expect(existsSync(indexPath)).toBe(true);
+    expect(readFileSync(indexPath, "utf-8")).toBe(staleIndex);
+    expect(mockRefreshSkillCapabilityMemories).toHaveBeenCalledTimes(1);
+  });
+
+  test("accepts legacy remove_from_index input without returning index metadata", async () => {
+    createSkill("legacy-delete");
+
+    const result = await executeDeleteManagedSkill(
+      {
+        skill_id: "legacy-delete",
+        remove_from_index: true,
+      },
+      makeContext(),
     );
-    expect(indexContent).not.toContain("doomed");
-    expect(indexContent).toContain("survivor");
+
+    expect(result.isError).toBe(false);
+    const parsed = JSON.parse(result.content);
+    expect(parsed.deleted).toBe(true);
+    expect(parsed).not.toHaveProperty("index_updated");
+    expect(existsSync(join(TEST_DIR, "skills", "legacy-delete"))).toBe(false);
+    expect(mockRefreshSkillCapabilityMemories).toHaveBeenCalledTimes(1);
   });
 
   test("returns error for non-existent skill", async () => {
@@ -89,6 +130,7 @@ describe("delete_managed_skill tool", () => {
 
     expect(result.isError).toBe(true);
     expect(result.content).toContain("not found");
+    expect(mockRefreshSkillCapabilityMemories).not.toHaveBeenCalled();
   });
 
   test("rejects missing skill_id", async () => {

package/src/__tests__/disk-pressure-tools.test.ts

@@ -25,6 +25,7 @@ const mockConfig = {
     },
   },
   permissions: { mode: "workspace" as const },
+  tools: { exclude: [] },
 };
 
 mock.module("../config/loader.js", () => ({

package/src/__tests__/dm-backfill.test.ts

@@ -63,7 +63,10 @@ import { upsertContactChannel } from "../contacts/contacts-write.js";
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
 import { messages } from "../memory/schema/conversations.js";
-import { readSlackMetadata } from "../messaging/providers/slack/message-metadata.js";
+import {
+  readSlackMetadata,
+  type SlackMessageMetadata,
+} from "../messaging/providers/slack/message-metadata.js";
 import { handleChannelInbound } from "./helpers/channel-test-adapter.js";
 
 initializeDb();
@@ -98,6 +101,18 @@ function seedActiveMember(): void {
   });
 }
 
+function seedSlackGuardian(): void {
+  upsertContactChannel({
+    sourceChannel: "slack",
+    externalUserId: SLACK_DM_USER_ID,
+    externalChatId: SLACK_DM_CHANNEL_ID,
+    status: "active",
+    policy: "allow",
+    displayName: SLACK_DM_DISPLAY_NAME,
+    role: "guardian",
+  });
+}
+
 let msgCounter = 0;
 
 function buildDmRequest(
@@ -136,7 +151,12 @@ function buildDmRequest(
 function readPersistedSlackRows(): Array<{
   role: string;
   content: string;
-  metadata: string | null;
+  rawContent: string;
+  slackMeta: SlackMessageMetadata | null;
+  provenanceTrustClass: string | undefined;
+  provenanceSourceChannel: string | undefined;
+  provenanceGuardianExternalUserId: string | undefined;
+  provenanceRequesterIdentifier: string | undefined;
 }> {
   const db = getDb();
   return db
@@ -146,7 +166,58 @@ function readPersistedSlackRows(): Array<{
       metadata: messages.metadata,
     })
     .from(messages)
-    .all();
+    .all()
+    .map((row) => {
+      let envelope: Record<string, unknown> = {};
+      if (row.metadata) {
+        try {
+          const parsed = JSON.parse(row.metadata) as unknown;
+          if (
+            parsed !== null &&
+            typeof parsed === "object" &&
+            !Array.isArray(parsed)
+          ) {
+            envelope = parsed as Record<string, unknown>;
+          }
+        } catch {
+          envelope = {};
+        }
+      }
+      const slackMeta =
+        typeof envelope.slackMeta === "string"
+          ? readSlackMetadata(envelope.slackMeta)
+          : null;
+      return {
+        role: row.role,
+        content: unwrapExternalContent(row.content),
+        rawContent: row.content,
+        slackMeta,
+        provenanceTrustClass:
+          typeof envelope.provenanceTrustClass === "string"
+            ? envelope.provenanceTrustClass
+            : undefined,
+        provenanceSourceChannel:
+          typeof envelope.provenanceSourceChannel === "string"
+            ? envelope.provenanceSourceChannel
+            : undefined,
+        provenanceGuardianExternalUserId:
+          typeof envelope.provenanceGuardianExternalUserId === "string"
+            ? envelope.provenanceGuardianExternalUserId
+            : undefined,
+        provenanceRequesterIdentifier:
+          typeof envelope.provenanceRequesterIdentifier === "string"
+            ? envelope.provenanceRequesterIdentifier
+            : undefined,
+      };
+    });
+}
+
+const EXTERNAL_CONTENT_WRAPPER =
+  /^<external_content[^>]*>\n([\s\S]*?)\n<\/external_content>$/;
+
+function unwrapExternalContent(content: string): string {
+  const match = content.match(EXTERNAL_CONTENT_WRAPPER);
+  return match ? match[1] : content;
 }
 
 function makeBackfilledMessage(overrides: Partial<Message> = {}): Message {
@@ -228,12 +299,15 @@ describe("PR 23 — Slack DM cold-start backfill", () => {
     expect(rows.length).toBe(3);
 
     const persistedTs = rows.map((r) => {
-      const envelope = JSON.parse(r.metadata!) as Record<string, unknown>;
-      const meta = readSlackMetadata(envelope.slackMeta as string);
+      const meta = r.slackMeta;
       expect(meta).not.toBeNull();
       expect(meta!.source).toBe("slack");
       expect(meta!.eventKind).toBe("message");
       expect(meta!.channelId).toBe(SLACK_DM_CHANNEL_ID);
+      expect(meta!.actorExternalUserId).toBe(SLACK_DM_USER_ID);
+      expect(r.provenanceTrustClass).toBe("unknown");
+      expect(r.provenanceSourceChannel).toBe("slack");
+      expect(r.provenanceRequesterIdentifier).toBe(SLACK_DM_USER_ID);
       return meta!.channelTs;
     });
     expect(new Set(persistedTs)).toEqual(
@@ -246,6 +320,36 @@ describe("PR 23 — Slack DM cold-start backfill", () => {
     expect(texts).toEqual(["older A", "older B", "older C"]);
   });
 
+  test("guardian DM backfill persists guardian text without external_content wrapping", async () => {
+    resetState();
+    seedSlackGuardian();
+
+    backfillDmMock.mockImplementation(async () => [
+      makeBackfilledMessage({
+        id: "1700000000.000001",
+        text: "trusted older context",
+        sender: { id: SLACK_DM_USER_ID, name: "Guardian Sender" },
+      }),
+    ]);
+
+    await handleChannelInbound(
+      buildDmRequest("live guardian DM"),
+      noopProcessMessage,
+      TEST_BEARER_TOKEN,
+    );
+
+    const [row] = readPersistedSlackRows();
+    expect(row).toBeDefined();
+    expect(row.role).toBe("user");
+    expect(row.rawContent).toBe("trusted older context");
+    expect(row.rawContent).not.toContain("<external_content");
+    expect(row.slackMeta?.actorExternalUserId).toBe(SLACK_DM_USER_ID);
+    expect(row.provenanceTrustClass).toBe("guardian");
+    expect(row.provenanceSourceChannel).toBe("slack");
+    expect(row.provenanceGuardianExternalUserId).toBe(SLACK_DM_USER_ID);
+    expect(row.provenanceRequesterIdentifier).toBe(SLACK_DM_USER_ID);
+  });
+
   test("warm storage prevents re-trigger on subsequent DMs", async () => {
     backfillDmMock.mockImplementation(async () => [
       makeBackfilledMessage({ id: "1700000000.000001", text: "older A" }),
@@ -352,10 +456,10 @@ describe("PR 23 — Slack DM cold-start backfill", () => {
     expect(texts).toEqual(["older A", "older B"]);
   });
 
-  test("bot-authored backfilled messages are persisted with role=assistant", async () => {
-    // Slack DM history includes our own prior bot replies. If those rows
-    // were rehydrated as `user` turns, the assistant would later treat its
-    // own output as new user input and speaker attribution would break.
+  test("bot-authored backfilled messages are persisted raw as user history", async () => {
+    // Backfilled Slack history is third-party channel replay. Even bot rows
+    // must not become `assistant` messages; that role is reserved for outputs
+    // produced by the local assistant loop.
     backfillDmMock.mockImplementation(async () => [
       makeBackfilledMessage({
         id: "1700000000.000001",
@@ -380,7 +484,14 @@ describe("PR 23 — Slack DM cold-start backfill", () => {
     expect(rows.length).toBe(2);
     const byText = new Map(rows.map((r) => [r.content, r.role]));
     expect(byText.get("user reply")).toBe("user");
-    expect(byText.get("assistant reply")).toBe("assistant");
+    expect(byText.get("assistant reply")).toBe("user");
+    const botRow = rows.find((r) => r.content === "assistant reply");
+    expect(botRow?.rawContent).toBe("assistant reply");
+    expect(botRow?.rawContent).not.toContain("<external_content");
+    expect(botRow?.slackMeta?.actorExternalUserId).toBe("B_BOT");
+    expect(botRow?.provenanceTrustClass).toBe("unknown");
+    expect(botRow?.provenanceSourceChannel).toBe("slack");
+    expect(botRow?.provenanceRequesterIdentifier).toBe("B_BOT");
   });
 
   test("backfill skips channelTs values already stored", async () => {