📔 feat: Preserve Owner Text During PII Redaction

api/app/clients/BaseClient.js

@@ -30,6 +30,9 @@ const {
   seedTurnConversation,
   needsRetentionConversation,
   getConversationWriteContext,
+  savePrivateTextMessage,
+  stampPrivateTextMessage,
+  requirePrivateTextPersistence,
 } = require('@librechat/api');
 const {
   Constants,
@@ -586,13 +589,16 @@ class BaseClient {
     } = await this.setMessageOptions(opts);
     this.options.startupTelemetry?.mark('history_loaded');
 
-    const userMessage = this.resolveStartUserMessage({
-      opts,
-      message,
-      userMessageId,
-      parentMessageId,
-      conversationId,
-    });
+    const userMessage = stampPrivateTextMessage(
+      this.options.req,
+      this.resolveStartUserMessage({
+        opts,
+        message,
+        userMessageId,
+        parentMessageId,
+        conversationId,
+      }),
+    );
 
     /**
      * Attach quoted excerpts (the "Add to chat" selections from `req.body.quotes`)
@@ -1029,6 +1035,9 @@ class BaseClient {
         await balanceReservations.track(balanceAdmission);
       }
 
+      await requirePrivateTextPersistence(this.options.req, () =>
+        userMessagePersistence != null ? userMessagePersistence.start() : userMessagePromise,
+      );
       completionResult = await this.sendCompletion(payload, opts);
     } catch (error) {
       if (userMessagePersistence?.isPending()) {
@@ -1349,7 +1358,9 @@ class BaseClient {
       req.resolvedConversation = await db.getConvo(req.user.id, message.conversationId);
     }
     const reqCtx = getConversationWriteContext(req);
-    const savedMessage = await db.saveMessage(
+    const savedMessage = await savePrivateTextMessage(
+      db.saveMessage,
+      req,
       reqCtx,
       {
         ...message,

api/server/controllers/agents/__tests__/request.partialDisconnect.spec.js

@@ -47,6 +47,8 @@ jest.mock('@librechat/data-schemas', () => ({
 }));
 
 jest.mock('@librechat/api', () => ({
+  savePrivateTextMessage: (save, _req, ...args) => save(...args),
+  stampPreliminaryPrivateTextMessage: (_req, message) => message,
   getAgentErrorMetadata: (...args) =>
     jest.requireActual('@librechat/api').getAgentErrorMetadata(...args),
   sendEvent: jest.fn(),

api/server/controllers/agents/__tests__/request.resumeMetadata.spec.js

@@ -252,6 +252,8 @@ jest.mock('@librechat/data-schemas', () => ({
 }));
 
 jest.mock('@librechat/api', () => ({
+  savePrivateTextMessage: (save, _req, ...args) => save(...args),
+  stampPreliminaryPrivateTextMessage: (_req, message) => message,
   getSteerRecoveryFailure: jest.requireActual(
     '../../../../../packages/api/src/stream/SteerRecovery',
   ).getSteerRecoveryFailure,

api/server/controllers/agents/request.js

@@ -52,6 +52,8 @@ const {
   resolvePersistableCodeEnvironmentDecision,
   getFailedTurnTraceFields,
   resolveFailedTurnContent,
+  savePrivateTextMessage,
+  stampPreliminaryPrivateTextMessage,
 } = require('@librechat/api');
 const { disposeClient } = require('~/server/cleanup');
 const {
@@ -459,7 +461,9 @@ async function saveErrorTurn(
     const iconURL = getEndpointIconURL(req, endpointOption);
 
     if (userMessage) {
-      const savedUserMessage = await saveMessage(
+      const savedUserMessage = await savePrivateTextMessage(
+        saveMessage,
+        req,
         reqCtx,
         {
           ...userMessage,
@@ -1590,10 +1594,13 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
     const responseModel = getAgentResponseModel(req, endpointOption);
     const preliminaryUserMessage = isCompaction
       ? projectCompactionAnchor({ messageId: parentMessageId, conversationId })
-      : getPreliminaryUserMessage(
-          { ...req.body, messageId: preallocatedUserMessageId },
-          conversationId,
-          req._agentEventTriggerProjection,
+      : stampPreliminaryPrivateTextMessage(
+          req,
+          getPreliminaryUserMessage(
+            { ...req.body, messageId: preallocatedUserMessageId },
+            conversationId,
+            req._agentEventTriggerProjection,
+          ),
         );
     const job = await GenerationJobManager.createJob(streamId, userId, conversationId, {
       startupTelemetry,
@@ -2304,6 +2311,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
                 conversationId: userMsg.conversationId,
                 text: userMsg.text,
                 quotes: userMsg.quotes,
+                privacyRevision: userMsg.privacyRevision,
                 // Persist the turn's uploaded files here (authoritative job metadata) so a
                 // HITL resume sources them from the job, not the user DB row — which the
                 // approval prompt can race (the row save may still be in flight when a fast
@@ -2730,7 +2738,9 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
                   convoSignal.observeMessageWrite(Promise.resolve(savedUserTurn));
                 } else {
                   // Custom clients used by integrations/tests may not inherit BaseClient.
-                  const savedUserMessage = await saveMessage(
+                  const savedUserMessage = await savePrivateTextMessage(
+                    saveMessage,
+                    req,
                     {
                       userId,
                       isTemporary:
@@ -2983,9 +2993,15 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
           if (!userMessage) {
             throw new Error('User message was unavailable before terminal persistence');
           }
-          const savedUserMessage = await saveMessage(reqCtx, userMessage, {
-            context: 'api/server/controllers/agents/request.js - resumable user message',
-          });
+          const savedUserMessage = await savePrivateTextMessage(
+            saveMessage,
+            req,
+            reqCtx,
+            userMessage,
+            {
+              context: 'api/server/controllers/agents/request.js - resumable user message',
+            },
+          );
           if (!savedUserMessage) {
             throw new Error('User message could not be persisted before terminal publication');
           }

api/server/middleware/denyRequest.js

@@ -1,5 +1,10 @@
 const crypto = require('crypto');
-const { sendEvent } = require('@librechat/api');
+const {
+  sendEvent,
+  rejectUnprotectedDeniedMessage,
+  stampPrivateTextMessage,
+  savePrivateTextMessage,
+} = require('@librechat/api');
 const { getResponseSender, Constants } = require('librechat-data-provider');
 const { sendError } = require('~/server/middleware/error');
 const { saveMessage } = require('~/models');
@@ -21,28 +26,38 @@ const { saveMessage } = require('~/models');
  * @throws {Error} Throws an error if there's an issue saving the message or sending the error.
  */
 const denyRequest = async (req, res, errorMessage) => {
+  if (rejectUnprotectedDeniedMessage(req, res)) {
+    return;
+  }
+
   let responseText = errorMessage;
   if (typeof errorMessage === 'object') {
     responseText = JSON.stringify(errorMessage);
   }
 
   const { messageId, conversationId: _convoId, parentMessageId, text } = req.body;
   const conversationId = _convoId ?? crypto.randomUUID();
+  const shouldSaveMessage = Boolean(
+    _convoId && parentMessageId && parentMessageId !== Constants.NO_PARENT,
+  );
 
-  const userMessage = {
-    sender: 'User',
-    messageId: messageId ?? crypto.randomUUID(),
-    parentMessageId,
-    conversationId,
-    isCreatedByUser: true,
-    text,
-  };
-  sendEvent(res, { message: userMessage, created: true });
-
-  const shouldSaveMessage = _convoId && parentMessageId && parentMessageId !== Constants.NO_PARENT;
+  const userMessage = stampPrivateTextMessage(
+    req,
+    {
+      sender: 'User',
+      messageId: messageId ?? crypto.randomUUID(),
+      parentMessageId,
+      conversationId,
+      isCreatedByUser: true,
+      text,
+    },
+    shouldSaveMessage,
+  );
 
   if (shouldSaveMessage) {
-    await saveMessage(
+    await savePrivateTextMessage(
+      saveMessage,
+      req,
       {
         userId: req?.user?.id,
         isTemporary: req?.resolvedConversation?.isTemporary ?? req?.body?.isTemporary,
@@ -54,6 +69,7 @@ const denyRequest = async (req, res, errorMessage) => {
     );
   }
 
+  sendEvent(res, { message: userMessage, created: true });
   return await sendError(req, res, {
     sender: getResponseSender(req.body),
     messageId: crypto.randomUUID(),