Summary

Fixes #24152 — cross-channel reply routing privacy leak in shared sessions.

Problem

When dmScope="main" (the default), all DM channels share a single session. The session's lastChannel/lastTo fields get overwritten by each inbound message, regardless of source channel.

Race condition: If a Slack DM arrives while the agent is generating a WhatsApp reply, lastChannel flips to "slack" and the reply routes to the Slack sender instead of the WhatsApp user — a privacy violation.

Reproduction conditions (from issue):

• Active WhatsApp conversation in progress
• Incoming Slack system message (team member DM)
• Agent generates response → delivered to Slack DM instead of WhatsApp

Fix

Adds optional turnSourceChannel, turnSourceTo, turnSourceAccountId, and turnSourceThreadId parameters to:

1. resolveSessionDeliveryTarget() in targets.ts
2. resolveAgentDeliveryPlan() in agent-delivery.ts

When turnSourceChannel is set, it overrides the session-level lastChannel for "last" channel resolution. This ensures the reply always routes back to the channel that originated the turn, regardless of concurrent inbound messages from other channels.

Key design decisions:

• Backward compatible — all new parameters are optional; existing call sites work unchanged
• Opt-in — callers pass the originating channel context when they want cross-channel safety
• No session schema changes — operates at the delivery resolution layer, not storage
• Follows existing patterns — mirrors the requestedChannel / explicitTo parameter style

Changes

Test cases

1. ✅ turnSourceChannel overrides session lastChannel when provided
2. ✅ Falls back to session lastChannel when turnSourceChannel is absent
3. ✅ Explicit requestedChannel takes priority over turnSourceChannel
4. ✅ Preserves turnSourceAccountId and turnSourceThreadId

Next steps

Upstream callers (channel monitors, agent turn pipeline) need to pass turnSourceChannel when initiating turns. This PR provides the infrastructure; wiring the callers is a follow-up.

AI-assisted: Claude analyzed the routing code and authored the fix. Human reviewed the approach and design decisions.

Greptile Summary

Adds optional turnSource* parameters to delivery resolution functions to prevent cross-channel reply routing in shared sessions (dmScope="main"). When a turn originates from WhatsApp but a concurrent Slack message updates the session's lastChannel, replies could be misrouted to Slack—this fix ensures replies route back to the originating channel by letting callers override session state with turn-specific context.

Key changes:

• resolveSessionDeliveryTarget() and resolveAgentDeliveryPlan() accept new optional turnSourceChannel, turnSourceTo, turnSourceAccountId, and turnSourceThreadId parameters
• When turnSourceChannel is set, it overrides session-level lastChannel for "last" channel resolution
• Backward compatible—all parameters optional, existing call sites unchanged
• Test coverage includes cross-channel guard scenarios and priority handling

As noted in PR description: This provides the infrastructure; upstream callers (channel monitors, agent turn pipeline) need updates in follow-up work to pass turn source context.

Confidence Score: 5/5

• Safe to merge with minimal risk—addresses privacy issue with backward-compatible infrastructure
• Clean implementation following existing patterns, comprehensive test coverage for new functionality, well-documented with issue references, backward compatible design, and PR explicitly scopes this as infrastructure-only (follow-up needed for caller integration)
• No files require special attention

_{Last reviewed commit: 53250c8}