People searching “Laravel AI conversation” pass a conversation id from Vue straight into continue(). The SDK does not check that this user owns that id. The AI SDK guide is the one-shot reply. This page is the thread.
TL;DR
- RemembersConversations stores the thread.
- Check that the id belongs to the user before you continue it.
- Do not also define
messages()on that class. - Do not trust the hidden field alone.
The fix#
Publish the migrations before you store anything. RemembersConversations needs agent_conversations and agent_conversation_messages.
use Laravel\Ai\Concerns\RemembersConversations;
use Laravel\Ai\Contracts\Conversational;
class DraftReply implements Agent, Conversational
{
use Promptable, RemembersConversations;
}What to avoid#
Gotcha
Do not also define messages() on that class. The trait is skipped when you do, and the stored thread is ignored.
$reply = (new DraftReply)->forUser($request->user())->prompt($validated['note']);The response exposes conversationId. On the next post, continue only after the conversation store says this user owns that id. continue does not check.
use Laravel\Ai\Contracts\ConversationStore;
$store = app(ConversationStore::class);
abort_unless($store->conversationBelongsTo(
$validated['conversation'],
$request->user()->getMorphClass(),
$request->user()->getKey(),
), 403);
$reply = (new DraftReply)
->continue($validated['conversation'], as: $request->user())
->prompt($validated['note']);Do not trust the hidden field alone. Do not render the stored messages with v-html.
FAQ#
How do I continue an AI SDK conversation you own?
RemembersConversations stores the thread. Check that the id belongs to the user before you continue it.
What goes wrong with Laravel AI conversation?
Many developers pass a conversation id from Vue straight into continue(). Do not also define messages() on that class.
