fix(gateway): validate turns before session binding

steipete · steipete · commit 1960114a1f1a · 2026-07-17T13:11:26.000+01:00
diff --git a/src/gateway/conversation-turn.test.ts b/src/gateway/conversation-turn.test.ts
@@ -516,6 +516,13 @@ describe("runGatewayConversationTurn", () => {
 
   it("rejects unsupported channels before registering or sending", async () => {
     const deps = createDeps();
+    const {
+      sessionId: _sessionId,
+      sessionKey: _sessionKey,
+      role: _role,
+      ...unbound
+    } = conversation;
+    deps.resolveConversation.mockReturnValue(unbound);
     deps.resolveOutboundChannelPlugin.mockReturnValueOnce({ outbound: {} } as never);
 
     await expect(
@@ -532,6 +539,9 @@ describe("runGatewayConversationTurn", () => {
         deps,
       ),
     ).rejects.toBeInstanceOf(ConversationInputError);
+    expect(deps.resolveOutboundSessionRoute).not.toHaveBeenCalled();
+    expect(deps.ensureOutboundSessionEntry).not.toHaveBeenCalled();
+    expect(deps.beginOperation).not.toHaveBeenCalled();
     expect(deps.registerPendingConversationTurn).not.toHaveBeenCalled();
     expect(deps.runMessageAction).not.toHaveBeenCalled();
   });
diff --git a/src/gateway/conversation-turn.ts b/src/gateway/conversation-turn.ts
@@ -262,6 +262,19 @@ export async function runGatewayConversationTurn(
     channel: discoveredConversation.channel,
     cfg: params.config,
   });
+  const candidatePreparedMessageId = begun
+    ? begun.record.preparedMessageId
+    : prepareConversationMessageId({
+        plugin,
+        config: params.config,
+        conversation: discoveredConversation,
+        message: params.message,
+      });
+  if (!candidatePreparedMessageId) {
+    throw new ConversationInputError(
+      `Conversation turn ${params.turnId} is missing its prepared message id`,
+    );
+  }
   const conversation = await ensureConversationContextBinding({
     deps,
     scope,
@@ -271,12 +284,6 @@ export async function runGatewayConversationTurn(
     plugin,
   });
   if (!begun) {
-    const candidatePreparedMessageId = prepareConversationMessageId({
-      plugin,
-      config: params.config,
-      conversation,
-      message: params.message,
-    });
     try {
       begun = deps.beginOperation(scope, {
         operationId: params.turnId,
