Function sanitizeMessages

apps/docs/app/api/chat/route.ts:124–132

* Strip everything the model shouldn't trust from client-supplied history: * drop `system` messages (client-injected instructions) and every non-text part * (e.g. crafted tool results faking searchDocs output). Only user/assistant text * survives, so grounding comes from the server-run searchDocs

(messages: UIMessage[])

 * client's payload.
 */
function sanitizeMessages(messages: UIMessage[]): UIMessage[] {
  return messages
    .filter((message) => message.role === 'user' || message.role === 'assistant')
    .map((message) => ({
      ...message,
      parts: message.parts.filter((part) => part.type === 'text' && typeof part.text === 'string'),
    }))
    .filter((message) => message.parts.length > 0)
}

/**
 * Reject obvious cross-origin calls. Same-origin browser requests send an