Summary

Fixes #13559

Problem

When dmScope is set to per-channel-peer (or per-peer/per-account-channel-peer), Telegram DMs get their own isolated session key (e.g. agent:main:telegram:direct:12345). However, recordInboundSession still unconditionally calls updateLastRoute targeting route.mainSessionKey (agent:main:main), overwriting the webchat session's deliveryContext with Telegram routing info. This causes webchat responses to be routed to Telegram.

Fix

Gate updateLastRoute on baseSessionKey === route.mainSessionKey — only update the main session's delivery context when the DM session actually IS the main session (i.e. dmScope: "main").

Before:

updateLastRoute: !isGroup
  ? { sessionKey: route.mainSessionKey, ... }
  : undefined,

After:

updateLastRoute:
  !isGroup && baseSessionKey === route.mainSessionKey
    ? { sessionKey: route.mainSessionKey, ... }
    : undefined,

Reproduction & Verification

Before fix (main branch) — Bug reproduced with real function calls:

Scenario 2: dmScope = 'per-channel-peer'
  sessionKey:     agent:main:telegram:direct:12345
  mainSessionKey: agent:main:main
  same? false
  updateLastRoute would write to: agent:main:main
  BUG CONFIRMED: DM has its own session but updateLastRoute
     still overwrites mainSessionKey's deliveryContext!

After fix — Verified with real function calls:

Test 1: dmScope='main' DM — updateLastRoute fires           PASS
Test 2: dmScope='per-channel-peer' DM — skipped              PASS
Test 3: dmScope='per-peer' DM — skipped                      PASS
Test 4: group message — skipped                               PASS
Test 5: dmScope='per-account-channel-peer' DM — skipped      PASS
--- Result: ALL PASSED (9/9) ---

Effect on User Experience

Before fix:
With dmScope: "per-channel-peer", every Telegram DM overwrites the webchat session's deliveryContext, causing webchat responses and heartbeats to be routed to Telegram instead of back to the browser.

After fix:
Telegram DMs with isolated sessions no longer corrupt the main session. Webchat responses are correctly routed back to the browser. Default behavior (dmScope: "main") is unchanged.

Testing

• 4 tests pass (3 existing + 1 new regression test)
• Lint passes

Greptile Overview

Greptile Summary

This PR prevents Telegram DM traffic from overwriting the main/webchat session’s deliveryContext when session.dmScope isolates DM sessions. The change gates the recordInboundSession({ updateLastRoute: ... }) call in src/telegram/bot-message-context.ts so updateLastRoute only runs when the DM’s baseSessionKey equals route.mainSessionKey (i.e., dmScope: "main"). A regression test was added to cover the isolated-session case, and a changelog entry documents the fix.

Confidence Score: 4/5

• Mostly safe to merge, with one test correctness issue to address.
• The production change is small and clearly targeted (gating updateLastRoute on main-session equality) and aligns with recordInboundSession’s behavior. The main concern is the new regression test: it mocks loadConfig() but still passes cfg: baseConfig into buildTelegramMessageContext, so it may not actually exercise the isolated dmScope route depending on how config is consumed. Fixing the test to ensure it truly covers the bug would make this PR low-risk.
• src/telegram/bot-message-context.dm-topic-threadid.test.ts