OpenRAG 0.6.0.dev24__py3-none-any.whl → 0.7.0.dev1__py3-none-any.whl

agent.py

@@ -1,6 +1,9 @@
+import uuid
 from typing import Any
 
+from config.config_manager import DEFAULT_SYSTEM_PROMPT
 from services.conversation_persistence_service import conversation_persistence
+from utils.langflow_utils import parse_knowledge_chunks, strip_untrusted_fence_recursive
 from utils.logging_config import get_logger
 
 logger = get_logger(__name__)
@@ -9,6 +12,109 @@ logger = get_logger(__name__)
 active_conversations: dict[str, dict[str, Any]] = {}
 
 
+def _format_provider_error_message(exc: BaseException) -> str:
+    """Return a concise, user-facing provider error string from an exception."""
+    from api.provider_validation import sanitize_provider_error_content
+
+    return sanitize_provider_error_content(str(exc))
+
+
+def _provider_error_display_text(error_text: str, partial_response: str = "") -> str:
+    """Combine any streamed partial answer with the provider error for display/history.
+
+    If the mid-stream text is itself a provider failure dump (often raw JSON), keep
+    only the sanitized error — do not paste the dump above the clean message.
+    """
+    from api.provider_validation import looks_like_provider_error_content
+
+    partial = (partial_response or "").strip()
+    if not partial:
+        return error_text
+    if looks_like_provider_error_content(partial) or "{" in partial:
+        return error_text
+    if error_text in partial:
+        return partial
+    return f"{partial}\n\n{error_text}"
+
+
+def _conversation_thread_in_memory(user_id: str, response_id: str | None) -> bool:
+    """True when response_id is already keyed in the in-process conversation cache."""
+    return bool(
+        response_id
+        and user_id in active_conversations
+        and response_id in active_conversations[user_id]
+    )
+
+
+def _resolve_conversation_store_id(
+    response_id: str | None,
+    thread_id: str | None,
+    *,
+    previous_loaded_from_memory: bool,
+    mint_if_missing: bool = False,
+) -> str | None:
+    """Resolve the OpenRAG conversation id used for persistence.
+
+    Prefer an in-memory thread id so follow-ups stay on one sidebar entry.
+    Never reuse a cold thread id (would overwrite metadata with empty state).
+    Fall back to the stream id, then optionally mint a UUID for failed first turns.
+    """
+    if previous_loaded_from_memory and thread_id:
+        return thread_id
+    if response_id:
+        return response_id
+    if mint_if_missing:
+        return str(uuid.uuid4())
+    return None
+
+
+def _conversation_ended_with_error(user_id: str, response_id: str | None) -> bool:
+    """True when the in-memory thread's last assistant message is a provider error."""
+    if not response_id or user_id not in active_conversations:
+        return False
+    messages = active_conversations[user_id].get(response_id, {}).get("messages") or []
+    for message in reversed(messages):
+        if message.get("role") == "assistant":
+            return bool(message.get("error"))
+    return False
+
+
+async def _persist_error_conversation(
+    user_id: str, store_id: str, conversation_state: dict
+) -> None:
+    """Store a failed turn and claim session ownership.
+
+    Claiming is required: otherwise the client may retry with this response_id and
+    ``_assert_owns`` returns 404 (session_not_found) for an unclaimed session.
+    """
+    from datetime import datetime
+
+    from services.session_ownership_service import session_ownership_service
+
+    conversation_state["last_activity"] = datetime.now()
+    await store_conversation_thread(user_id, store_id, conversation_state)
+    try:
+        await session_ownership_service.claim_session(user_id, store_id)
+        logger.debug(f"Claimed session {store_id} for user {user_id} after stream error")
+    except Exception as e:
+        logger.warning(f"Failed to claim session ownership after stream error: {e}")
+
+
+def _stream_error_chunk(message: str, response_id: str | None = None) -> bytes:
+    """NDJSON error event consumed by the chat streaming client."""
+    import json
+
+    payload: dict[str, Any] = {
+        "status": "failed",
+        "finish_reason": "error",
+        "error": {"message": message},
+    }
+    if response_id:
+        payload["id"] = response_id
+        payload["response_id"] = response_id
+    return (json.dumps(payload) + "\n").encode("utf-8")
+
+
 async def get_user_conversations(user_id: str):
     """Get conversation metadata for a user from persistent storage."""
     return await conversation_persistence.get_user_conversations(user_id)
@@ -34,7 +140,7 @@ def get_conversation_thread(user_id: str, previous_response_id: str = None):
         "messages": [
             {
                 "role": "system",
-                "content": 'You are the OpenRAG Agent. You answer questions using retrieval, reasoning, and tool use.\nYou have access to several tools. Your job is to determine **which tool to use and when**.\n### Available Tools\n- OpenSearch Retrieval Tool:\n  Use this to search the indexed knowledge base. Use when the user asks about product details, internal concepts, processes, architecture, documentation, roadmaps, or anything that may be stored in the index.\n- Conversation History:\n  Use this to maintain continuity when the user is referring to previous turns. \n  Do not treat history as a factual source.\n- Conversation File Context:\n  Use this when the user asks about a document they uploaded or refers directly to its contents.\n  **IMPORTANT**: If you receive confirmation that a file was uploaded (e.g., "Confirm that you received this file"), the file content is already available in the conversation context. Do NOT attempt to ingest it as a URL.\n  Simply acknowledge the file and answer questions about it directly from the context.\n- URL Ingestion Tool:\n  Use this **only** when the user explicitly asks you to read, summarize, or analyze the content of a web URL (http:// or https://).\n  **Do NOT use this tool for filenames** (e.g., README.md, document.pdf, data.txt). These are file uploads, not URLs.\n  Only use this tool for actual web addresses that the user explicitly provides.\n  If unclear → ask a clarifying question.\n- Calculator / Expression Evaluation Tool:\n  Use this when the user asks to compare numbers, compute estimates, calculate totals, analyze pricing, or answer any question requiring mathematics or quantitative reasoning.\n  If the answer requires arithmetic, call the calculator tool rather than calculating internally.\n### Retrieval Decision Rules\nUse OpenSearch **whenever**:\n1. The question may be answered from internal or indexed data.\n2. The user references team names, product names, release plans, configurations, requirements, or official information.\n3. The user needs a factual, grounded answer.\nDo **not** use retrieval if:\n- The question is purely creative (e.g., storytelling, analogies) or personal preference.\n- The user simply wants text reformatted or rewritten from what is already present in the conversation.\nWhen uncertain → **Retrieve.** Retrieval is low risk and improves grounding.\n### File Upload vs URL Distinction\n**File uploads** (already in context):\n- Filenames like: README.md, document.pdf, notes.txt, data.csv\n- When you see file confirmation messages\n- Use conversation context directly - do NOT call URL tool\n**Web URLs** (need ingestion):\n- Start with http:// or https://\n- Examples: https://example.com, http://docs.site.org\n- User explicitly asks to fetch from web\n### Calculator Usage Rules\nUse the calculator when:\n- Performing arithmetic\n- Estimating totals\n- Comparing values\n- Modeling cost, time, effort, scale, or projections\nDo not perform math internally. **Call the calculator tool instead.**\n### Answer Construction Rules\n1. When asked: "What is OpenRAG", answer the following:\n"OpenRAG is an open-source package for building agentic RAG systems. It supports integration with a wide range of orchestration tools, vector databases, and LLM providers. OpenRAG connects and amplifies three popular, proven open-source projects into one powerful platform:\n**Langflow** – Langflow is a powerful tool to build and deploy AI agents and MCP servers. [Read more](https://www.langflow.org/)\n**OpenSearch** – OpenSearch is an open source, search and observability suite that brings order to unstructured data at scale. [Read more](https://opensearch.org/)\n**Docling** – Docling simplifies document processing with advanced PDF understanding, OCR support, and seamless AI integrations. Parse PDFs, DOCX, PPTX, images & more. [Read more](https://www.docling.ai/)"\n2. Synthesize retrieved or ingested content in your own words.\n3. Support factual claims with citations in the format: (Source: <chunk_id>) placed exactly where the claim occurs (e.g., at the end of the sentence or clause making the claim). If multiple sources support a claim, cite them sequentially like: (Source: chunk_id_1)(Source: chunk_id_2). Use the exact chunk_id or id provided in the retrieved source block.\n4. If no supporting evidence is found:\n   Say: "No relevant supporting sources were found for that request."\n5. Never invent facts or hallucinate details.\n6. Be concise, direct, and confident. \n7. Do not reveal internal chain-of-thought.',
+                "content": DEFAULT_SYSTEM_PROMPT,
             }
         ],
         "previous_response_id": previous_response_id,  # Parent response_id for branching
@@ -60,6 +166,7 @@ async def store_conversation_thread(user_id: str, response_id: str, conversation
         content = first_user_msg.get("content", "")
         title = content[:50] + "..." if len(content) > 50 else content
 
+    user_assistant_messages = [msg for msg in messages if msg.get("role") in ["user", "assistant"]]
     metadata_only = {
         "response_id": response_id,
         "title": title,
@@ -68,11 +175,19 @@ async def store_conversation_thread(user_id: str, response_id: str, conversation
         "last_activity": conversation_state.get("last_activity"),
         "previous_response_id": conversation_state.get("previous_response_id"),
         "filter_id": conversation_state.get("filter_id"),
-        "total_messages": len(
-            [msg for msg in messages if msg.get("role") in ["user", "assistant"]]
-        ),
-        # Don't store actual messages - Langflow has them
+        "total_messages": len(user_assistant_messages),
     }
+    # Snapshot error-thread turns: Langflow history is incomplete after fresh-session retries.
+    if any(msg.get("error") for msg in user_assistant_messages):
+        metadata_only["messages"] = [
+            {
+                "role": msg.get("role"),
+                "content": msg.get("content"),
+                "timestamp": msg.get("timestamp"),
+                "error": bool(msg.get("error")),
+            }
+            for msg in user_assistant_messages
+        ]
 
     await conversation_persistence.store_conversation_thread(user_id, response_id, metadata_only)
 
@@ -145,13 +260,16 @@ async def async_response_stream(
             if hasattr(chunk, "output_text") and chunk.output_text:
                 full_response += chunk.output_text
             elif hasattr(chunk, "delta") and chunk.delta:
-                # Handle delta properly - it might be a dict or string
+                # Handle delta properly - it might be a dict or string.
+                # Do not fall back to str(dict) when content is "" — that pollutes
+                # the transcript with "{'content': ''}" prefixes on error chunks.
                 if isinstance(chunk.delta, dict):
-                    delta_text = (
-                        chunk.delta.get("content", "")
-                        or chunk.delta.get("text", "")
-                        or str(chunk.delta)
-                    )
+                    raw_delta = chunk.delta.get("content")
+                    if raw_delta is None:
+                        raw_delta = chunk.delta.get("text")
+                    delta_text = raw_delta if isinstance(raw_delta, str) else ""
+                elif chunk.delta is None:
+                    delta_text = ""
                 else:
                     delta_text = str(chunk.delta)
                 full_response += delta_text
@@ -190,6 +308,13 @@ async def async_response_stream(
                 else:
                     chunk_data = str(chunk)
 
+                # VULN-13906: the live chat UI always streams, so this is the only place
+                # retrieved/uploaded text (fenced in flows/components/opensearch_multimodal.py
+                # and src/agent.py's fence_untrusted_text) reaches the client — strip fence
+                # markers here, before anything is yielded. Frontend surfaces (tool-call trace
+                # panel, citation click-through popup) read this raw streamed payload directly.
+                strip_untrusted_fence_recursive(chunk_data)
+
                 # Log detailed chunk structure for investigation (especially for Granite 3.3 8b)
                 if isinstance(chunk_data, dict):
                     # Check for any fields that might indicate tool usage
@@ -228,16 +353,31 @@ async def async_response_stream(
                             total_tokens=usage.get("total_tokens"),
                         )
 
+                # Format native tool call results
+                if isinstance(chunk_data, dict):
+                    # Format: {"type": "response.output_item.added", "item": {"type": "tool_call", "results": ...}}
+                    item = chunk_data.get("item")
+                    if (
+                        isinstance(item, dict)
+                        and item.get("type") == "tool_call"
+                        and "results" in item
+                    ):
+                        item["results"] = parse_knowledge_chunks(item["results"])
+
+                    # Also check for direct tool_call chunks
+                    elif chunk_data.get("type") == "tool_call" and "results" in chunk_data:
+                        chunk_data["results"] = parse_knowledge_chunks(chunk_data["results"])
+
                 # Middleware: Detect implicit tool calls and inject standardized events
                 # This helps Granite 3.3 8b and other models that don't emit standard markers
                 if isinstance(chunk_data, dict) and not detected_tool_call:
                     # Check if this chunk contains retrieval results
                     has_results = any(
                         [
-                            "results" in chunk_data and isinstance(chunk_data.get("results"), list),
-                            "outputs" in chunk_data and isinstance(chunk_data.get("outputs"), list),
-                            "retrieved_documents" in chunk_data,
-                            "retrieval_results" in chunk_data,
+                            bool(chunk_data.get("results")),
+                            bool(chunk_data.get("outputs")),
+                            bool(chunk_data.get("retrieved_documents")),
+                            bool(chunk_data.get("retrieval_results")),
                         ]
                     )
 
@@ -256,11 +396,12 @@ async def async_response_stream(
                                 "tool_name": "Retrieval",
                                 "status": "completed",
                                 "inputs": {"implicit": True, "backend_detected": True},
-                                "results": chunk_data.get("results")
-                                or chunk_data.get("outputs")
-                                or chunk_data.get("retrieved_documents")
-                                or chunk_data.get("retrieval_results")
-                                or [],
+                                "results": parse_knowledge_chunks(
+                                    chunk_data.get("results")
+                                    or chunk_data.get("outputs")
+                                    or chunk_data.get("retrieved_documents")
+                                    or chunk_data.get("retrieval_results")
+                                ),
                             },
                         }
                         # Send the synthetic event first
@@ -489,6 +630,7 @@ async def async_chat_stream(
     previous_response_id: str = None,
     filter_id: str = None,
 ):
+    previous_loaded_from_memory = _conversation_thread_in_memory(user_id, previous_response_id)
     # Get the specific conversation thread (or create new one)
     conversation_state = get_conversation_thread(user_id, previous_response_id)
 
@@ -505,52 +647,78 @@ async def async_chat_stream(
     full_response = ""
     response_id = None
     usage_data = None
-    async for chunk in async_stream(
-        async_client,
-        prompt,
-        model,
-        previous_response_id=previous_response_id,
-        log_prefix="agent",
-    ):
-        # Extract text content to build full response for history
-        try:
-            import json
+    try:
+        async for chunk in async_stream(
+            async_client,
+            prompt,
+            model,
+            previous_response_id=previous_response_id,
+            log_prefix="agent",
+        ):
+            # Extract text content to build full response for history
+            try:
+                import json
 
-            chunk_data = json.loads(chunk.decode("utf-8"))
-            if "delta" in chunk_data and "content" in chunk_data["delta"]:
-                full_response += chunk_data["delta"]["content"]
-            # Extract response_id from chunk
-            if "id" in chunk_data:
-                response_id = chunk_data["id"]
-            elif "response_id" in chunk_data:
-                response_id = chunk_data["response_id"]
-            # Capture usage from response.completed event
-            if chunk_data.get("type") == "response.completed":
-                response_obj = chunk_data.get("response", {})
-                usage_data = response_obj.get("usage")
-        except Exception:
-            pass
-        yield chunk
+                chunk_data = json.loads(chunk.decode("utf-8"))
+                if "delta" in chunk_data and "content" in chunk_data["delta"]:
+                    full_response += chunk_data["delta"]["content"]
+                # Extract response_id from chunk
+                if "id" in chunk_data:
+                    response_id = chunk_data["id"]
+                elif "response_id" in chunk_data:
+                    response_id = chunk_data["response_id"]
+                # Capture usage from response.completed event
+                if chunk_data.get("type") == "response.completed":
+                    response_obj = chunk_data.get("response", {})
+                    usage_data = response_obj.get("usage")
+            except Exception:
+                pass
+            yield chunk
 
-    # Add the complete assistant response to message history with response_id and timestamp
-    assistant_message = {
-        "role": "assistant",
-        "content": full_response,
-        "response_id": response_id,
-        "timestamp": datetime.now(),
-    }
-    # Store usage data if available (from response.completed event)
-    if usage_data:
-        assistant_message["response_data"] = {"usage": usage_data}
-    conversation_state["messages"].append(assistant_message)
+        # Add the complete assistant response to message history with response_id and timestamp
+        assistant_message = {
+            "role": "assistant",
+            "content": full_response,
+            "response_id": response_id,
+            "timestamp": datetime.now(),
+        }
+        # Store usage data if available (from response.completed event)
+        if usage_data:
+            assistant_message["response_data"] = {"usage": usage_data}
+        conversation_state["messages"].append(assistant_message)
 
-    # Store the conversation thread with its response_id
-    if response_id:
-        conversation_state["last_activity"] = datetime.now()
-        await store_conversation_thread(user_id, response_id, conversation_state)
-        logger.debug(
-            f"Stored conversation thread for user {user_id} with response_id: {response_id}"
+        # Store the conversation thread with its response_id
+        if response_id:
+            conversation_state["last_activity"] = datetime.now()
+            await store_conversation_thread(user_id, response_id, conversation_state)
+            logger.debug(
+                f"Stored conversation thread for user {user_id} with response_id: {response_id}"
+            )
+    except Exception as e:
+        logger.error(f"Error in chat stream: {e}", exc_info=True)
+        from api.provider_validation import resolve_chat_stream_error_message_async
+
+        error_text = await resolve_chat_stream_error_message_async(e)
+        display_text = _provider_error_display_text(error_text, full_response)
+        conversation_state["messages"].append(
+            {
+                "role": "assistant",
+                "content": display_text,
+                "timestamp": datetime.now(),
+                "error": True,
+            }
         )
+        store_id = _resolve_conversation_store_id(
+            response_id,
+            previous_response_id,
+            previous_loaded_from_memory=previous_loaded_from_memory,
+            mint_if_missing=True,
+        )
+        try:
+            await _persist_error_conversation(user_id, store_id, conversation_state)
+        except Exception as store_error:
+            logger.error(f"Failed to store error conversation: {store_error}")
+        yield _stream_error_chunk(display_text, store_id)
 
 
 # Async langflow function with conversation storage (non-streaming)
@@ -561,6 +729,7 @@ async def async_langflow_chat(
     user_id: str,
     extra_headers: dict = None,
     previous_response_id: str = None,
+    conversation_id: str = None,
     store_conversation: bool = True,
     filter_id: str = None,
 ):
@@ -568,11 +737,13 @@ async def async_langflow_chat(
         "async_langflow_chat called",
         user_id=user_id,
         previous_response_id=previous_response_id,
+        conversation_id=conversation_id,
     )
 
+    thread_id = conversation_id or previous_response_id
     if store_conversation:
         # Get the specific conversation thread (or create new one)
-        conversation_state = get_conversation_thread(user_id, previous_response_id)
+        conversation_state = get_conversation_thread(user_id, thread_id)
         logger.debug(
             "Got langflow conversation state",
             message_count=len(conversation_state["messages"]),
@@ -637,28 +808,7 @@ async def async_langflow_chat(
     # regardless of `type` string (Langflow may use different type names).
     if hasattr(response_obj, "output") and response_obj.output:
         for output_item in response_obj.output:
-            for result in getattr(output_item, "results", None) or []:
-                rd = (
-                    result.model_dump()
-                    if hasattr(result, "model_dump")
-                    else (result if isinstance(result, dict) else {})
-                )
-                if "text" in rd:
-                    sources.append(
-                        {
-                            "filename": rd.get("filename", ""),
-                            "text": rd.get("text", ""),
-                            "score": rd.get("score", 0),
-                            "page": rd.get("page"),
-                            "mimetype": rd.get("mimetype"),
-                            "chunk_id": rd.get("chunk_id") or rd.get("id") or "",
-                            "id": rd.get("id") or rd.get("chunk_id") or "",
-                            "embedding_model": rd.get("embedding_model"),
-                            "parser": rd.get("parser"),
-                            "chunk_size": rd.get("chunk_size"),
-                            "chunk_overlap": rd.get("chunk_overlap"),
-                        }
-                    )
+            sources.extend(parse_knowledge_chunks(getattr(output_item, "results", None)))
 
     # Layer 2: Top-level dict inspection (mirrors streaming middleware in async_response_stream).
     # Langflow may embed retrieval results directly in the response dict rather than
@@ -674,26 +824,8 @@ async def async_langflow_chat(
             or resp_dict.get("outputs")
             or resp_dict.get("retrieved_documents")
             or resp_dict.get("retrieval_results")
-            or []
         )
-        if isinstance(implicit_results, list):
-            for result in implicit_results:
-                if isinstance(result, dict) and "text" in result:
-                    sources.append(
-                        {
-                            "filename": result.get("filename", ""),
-                            "text": result.get("text", ""),
-                            "score": result.get("score", 0),
-                            "page": result.get("page"),
-                            "mimetype": result.get("mimetype"),
-                            "chunk_id": result.get("chunk_id") or result.get("id") or "",
-                            "id": result.get("id") or result.get("chunk_id") or "",
-                            "embedding_model": result.get("embedding_model"),
-                            "parser": result.get("parser"),
-                            "chunk_size": result.get("chunk_size"),
-                            "chunk_overlap": result.get("chunk_overlap"),
-                        }
-                    )
+        sources.extend(parse_knowledge_chunks(implicit_results))
 
     # Layer 3: Citation-text fallback.
     # Parse "(Source: filename)" patterns emitted by the LLM when it cites documents.
@@ -730,23 +862,11 @@ async def async_langflow_chat(
         except Exception as e:
             logger.warning(f"Failed to claim session ownership: {e}")
 
-        logger.debug(
-            f"Stored langflow conversation thread for user {user_id} with response_id: {response_id}"
-        )
         logger.debug(
             "Stored langflow conversation thread",
             user_id=user_id,
             response_id=response_id,
         )
-
-        # Debug: Check what's in user_conversations now
-        conversations = await get_user_conversations(user_id)
-        logger.debug(
-            "User conversations updated",
-            user_id=user_id,
-            conversation_count=len(conversations),
-            conversation_ids=list(conversations.keys()),
-        )
     else:
         logger.warning("No response_id received from langflow, conversation not stored")
 
@@ -761,27 +881,35 @@ async def async_langflow_chat_stream(
     user_id: str,
     extra_headers: dict = None,
     previous_response_id: str = None,
+    conversation_id: str = None,
     filter_id: str = None,
 ):
     logger.debug(
         "async_langflow_chat_stream called",
         user_id=user_id,
         previous_response_id=previous_response_id,
+        conversation_id=conversation_id,
     )
 
-    # Get the specific conversation thread (or create new one)
-    conversation_state = get_conversation_thread(user_id, previous_response_id)
+    # conversation_id keeps the OpenRAG sidebar thread; previous_response_id chains
+    # the Langflow session. After errors the client omits previous_response_id.
+    thread_id = conversation_id or previous_response_id
+    previous_loaded_from_memory = _conversation_thread_in_memory(user_id, thread_id)
+    conversation_state = get_conversation_thread(user_id, thread_id)
 
-    # Add user message to conversation with timestamp
     from datetime import datetime
 
-    user_message = {"role": "user", "content": prompt, "timestamp": datetime.now()}
-    conversation_state["messages"].append(user_message)
-
-    # Store filter_id in conversation state if provided
+    conversation_state["messages"].append(
+        {"role": "user", "content": prompt, "timestamp": datetime.now()}
+    )
     if filter_id:
         conversation_state["filter_id"] = filter_id
 
+    # Safety net: never continue a Langflow session that already ended in error.
+    langflow_previous_response_id = previous_response_id
+    if previous_response_id and _conversation_ended_with_error(user_id, thread_id):
+        langflow_previous_response_id = None
+
     full_response = ""
     response_id = None
     usage_data = None
@@ -794,7 +922,7 @@ async def async_langflow_chat_stream(
             prompt,
             flow_id,
             extra_headers=extra_headers,
-            previous_response_id=previous_response_id,
+            previous_response_id=langflow_previous_response_id,
             log_prefix="langflow",
         ):
             # Extract text content to build full response for history
@@ -812,13 +940,32 @@ async def async_langflow_chat_stream(
                 elif "response_id" in chunk_data:
                     response_id = chunk_data["response_id"]
 
-                # Check for error status
+                # Check for error status. Do not forward bare Langflow error
+                # chunks — they often lack a useful message and the client would
+                # show a generic failure before our sanitized terminal chunk.
                 if (
                     chunk_data.get("finish_reason") == "error"
                     or chunk_data.get("status") == "failed"
                 ):
                     error_occurred = True
                     logger.error("Error detected in Langflow stream chunk")
+                    err = chunk_data.get("error")
+                    if isinstance(err, dict):
+                        err_msg = err.get("message")
+                    else:
+                        err_msg = err
+                    if isinstance(err_msg, str) and err_msg.strip():
+                        if err_msg not in full_response:
+                            full_response = (
+                                f"{full_response}\n\n{err_msg}" if full_response else err_msg
+                            )
+                    elif (
+                        isinstance(chunk_data.get("message"), str) and chunk_data["message"].strip()
+                    ):
+                        msg = chunk_data["message"]
+                        if msg not in full_response:
+                            full_response = f"{full_response}\n\n{msg}" if full_response else msg
+                    continue
                 # Capture usage from response.completed event
                 if chunk_data.get("type") == "response.completed":
                     response_obj = chunk_data.get("response", {})
@@ -827,7 +974,39 @@ async def async_langflow_chat_stream(
                 pass
             yield chunk
 
-        # Add the complete assistant response to message history with response_id, timestamp, and function call data
+        from api.provider_validation import (
+            looks_like_provider_error_content,
+            resolve_chat_stream_error_message_async,
+        )
+
+        # Credential failures are often streamed as plain assistant text with no
+        # exception. Sanitize, mark as error, and emit a terminal error chunk so
+        # the client shows the error card instead of raw JSON.
+        if error_occurred or looks_like_provider_error_content(full_response):
+            display_text = await resolve_chat_stream_error_message_async(full_response)
+            conversation_state["messages"].append(
+                {
+                    "role": "assistant",
+                    "content": display_text,
+                    "response_id": response_id,
+                    "timestamp": datetime.now(),
+                    "chunks": collected_chunks,
+                    "error": True,
+                }
+            )
+            store_id = _resolve_conversation_store_id(
+                response_id,
+                thread_id,
+                previous_loaded_from_memory=previous_loaded_from_memory,
+                mint_if_missing=True,
+            )
+            try:
+                await _persist_error_conversation(user_id, store_id, conversation_state)
+            except Exception as store_error:
+                logger.error(f"Failed to store error conversation: {store_error}")
+            yield _stream_error_chunk(display_text, store_id)
+            return
+
         if full_response:
             assistant_message = {
                 "role": "assistant",
@@ -841,50 +1020,48 @@ async def async_langflow_chat_stream(
                 assistant_message["response_data"] = {"usage": usage_data}
             conversation_state["messages"].append(assistant_message)
 
-        # Store the conversation thread with its response_id
-        if response_id:
+        persist_id = _resolve_conversation_store_id(
+            response_id,
+            thread_id,
+            previous_loaded_from_memory=previous_loaded_from_memory,
+        )
+        if persist_id:
             conversation_state["last_activity"] = datetime.now()
-            await store_conversation_thread(user_id, response_id, conversation_state)
-
+            await store_conversation_thread(user_id, persist_id, conversation_state)
             try:
                 from services.session_ownership_service import session_ownership_service
 
-                await session_ownership_service.claim_session(user_id, response_id)
-                logger.debug(f"Claimed session {response_id} for user {user_id}")
+                await session_ownership_service.claim_session(user_id, persist_id)
             except Exception as e:
                 logger.warning(f"Failed to claim session ownership: {e}")
-
-            logger.debug(
-                f"Stored langflow conversation thread for user {user_id} with response_id: {response_id}"
-            )
     except Exception as e:
-        # Log the error
         logger.error(f"Error in langflow chat stream: {e}", exc_info=True)
-        error_occurred = True
-
-        # Store error message in conversation history so it persists
-        error_message = {
-            "role": "assistant",
-            "content": f"Sorry, I encountered an error: {str(e)}",
-            "timestamp": datetime.now(),
-            "error": True,
-        }
-        conversation_state["messages"].append(error_message)
+        from api.provider_validation import resolve_chat_stream_error_message_async
 
-        # Try to store the conversation with error message
-        # Use a temporary response_id if we don't have one
-        if not response_id:
-            response_id = f"error_{user_id}_{int(datetime.now().timestamp())}"
+        error_text = await resolve_chat_stream_error_message_async(e)
+        display_text = _provider_error_display_text(error_text, full_response)
+        if full_response:
+            display_text = await resolve_chat_stream_error_message_async(display_text)
 
+        conversation_state["messages"].append(
+            {
+                "role": "assistant",
+                "content": display_text,
+                "timestamp": datetime.now(),
+                "error": True,
+            }
+        )
+        store_id = _resolve_conversation_store_id(
+            response_id,
+            thread_id,
+            previous_loaded_from_memory=previous_loaded_from_memory,
+            mint_if_missing=True,
+        )
         try:
-            conversation_state["last_activity"] = datetime.now()
-            await store_conversation_thread(user_id, response_id, conversation_state)
-            logger.debug(f"Stored conversation with error for user {user_id}")
+            await _persist_error_conversation(user_id, store_id, conversation_state)
         except Exception as store_error:
             logger.error(f"Failed to store error conversation: {store_error}")
-
-        # Re-raise the exception so it propagates to the API layer
-        raise
+        yield _stream_error_chunk(display_text, store_id)
 
 
 async def delete_user_conversation(user_id: str, response_id: str) -> bool: