@vellumai/assistant 0.8.5 → 0.8.7

package/src/__tests__/schedule-tools.test.ts

@@ -316,6 +316,131 @@ describe("schedule_create with mode and routing", () => {
   });
 });
 
+// ── script timeout override ─────────────────────────────────────────
+
+describe("schedule_create / schedule_update timeout_ms", () => {
+  beforeEach(() => {
+    getRawDb().run("DELETE FROM cron_runs");
+    getRawDb().run("DELETE FROM cron_jobs");
+  });
+
+  test("persists timeout_ms when creating a script schedule", async () => {
+    // GIVEN a script schedule created with a custom timeout
+    const result = await executeScheduleCreate(
+      {
+        name: "Slow job",
+        expression: "0 9 * * *",
+        message: "",
+        mode: "script",
+        script: "sleep 5",
+        timeout_ms: 120_000,
+      },
+      ctx,
+    );
+
+    // THEN the override is stored on the row
+    expect(result.isError).toBe(false);
+    const row = getRawDb()
+      .query("SELECT timeout_ms FROM cron_jobs LIMIT 1")
+      .get() as { timeout_ms: number | null };
+    expect(row.timeout_ms).toBe(120_000);
+  });
+
+  test("rejects an out-of-range timeout_ms on create", async () => {
+    // WHEN creating with a timeout below the minimum
+    const result = await executeScheduleCreate(
+      {
+        name: "Too short",
+        expression: "0 9 * * *",
+        message: "",
+        mode: "script",
+        script: "echo hi",
+        timeout_ms: 10,
+      },
+      ctx,
+    );
+
+    // THEN the tool returns a validation error and stores nothing
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("timeout_ms must be between");
+    const count = getRawDb()
+      .query("SELECT COUNT(*) AS n FROM cron_jobs")
+      .get() as { n: number };
+    expect(count.n).toBe(0);
+  });
+
+  test("updates and clears timeout_ms", async () => {
+    // GIVEN an existing script schedule
+    await executeScheduleCreate(
+      {
+        name: "Adjustable",
+        expression: "0 9 * * *",
+        message: "",
+        mode: "script",
+        script: "echo hi",
+        timeout_ms: 90_000,
+      },
+      ctx,
+    );
+    const { id } = getRawDb()
+      .query("SELECT id FROM cron_jobs LIMIT 1")
+      .get() as { id: string };
+
+    // WHEN the timeout is updated
+    const updated = await executeScheduleUpdate(
+      { job_id: id, timeout_ms: 5_000 },
+      ctx,
+    );
+
+    // THEN the new value is stored
+    expect(updated.isError).toBe(false);
+    const afterUpdate = getRawDb()
+      .query("SELECT timeout_ms FROM cron_jobs WHERE id = ?")
+      .get(id) as { timeout_ms: number | null };
+    expect(afterUpdate.timeout_ms).toBe(5_000);
+
+    // AND WHEN the timeout is cleared with null
+    const cleared = await executeScheduleUpdate(
+      { job_id: id, timeout_ms: null },
+      ctx,
+    );
+
+    // THEN the override reverts to null
+    expect(cleared.isError).toBe(false);
+    const afterClear = getRawDb()
+      .query("SELECT timeout_ms FROM cron_jobs WHERE id = ?")
+      .get(id) as { timeout_ms: number | null };
+    expect(afterClear.timeout_ms).toBeNull();
+  });
+
+  test("rejects an out-of-range timeout_ms on update", async () => {
+    // GIVEN an existing script schedule
+    await executeScheduleCreate(
+      {
+        name: "Guarded",
+        expression: "0 9 * * *",
+        message: "",
+        mode: "script",
+        script: "echo hi",
+      },
+      ctx,
+    );
+    const { id } = getRawDb()
+      .query("SELECT id FROM cron_jobs LIMIT 1")
+      .get() as { id: string };
+
+    // WHEN updating with a timeout above the maximum
+    const result = await executeScheduleUpdate(
+      { job_id: id, timeout_ms: 60 * 60 * 1000 },
+      ctx,
+    );
+
+    // THEN the tool returns a validation error
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("timeout_ms must be between");
+  });
+});
+
 // ── schedule_list ───────────────────────────────────────────────────
 
 describe("schedule_list tool", () => {

package/src/__tests__/scheduler-reuse-conversation.test.ts

@@ -210,12 +210,57 @@ describe("scheduler conversation reuse", () => {
     expect(runs2[0].conversationId).toBe(firstConversationId);
   });
 
+  test("recurring schedule defaults to reuseConversation=true", async () => {
+    /**
+     * When no explicit reuseConversation is provided, recurring schedules
+     * default to true — subsequent runs reuse the same conversation.
+     */
+
+    // GIVEN a recurring schedule with no explicit reuseConversation
+    const rruleExpr = buildEveryMinuteRrule();
+    const schedule = createSchedule({
+      name: "Default Reuse Test",
+      cronExpression: rruleExpr,
+      message: "Default reuse message",
+      syntax: "rrule",
+      expression: rruleExpr,
+      // no explicit reuseConversation — should default to true for recurring
+    });
+
+    // WHEN the schedule fires for the first time
+    forceScheduleDue(schedule.id);
+
+    const processMessage = async (conversationId: string, message: string) => {
+      processedMessages.push({ conversationId, message });
+    };
+
+    const scheduler1 = startScheduler(processMessage, () => {});
+    await new Promise((resolve) => setTimeout(resolve, 500));
+    scheduler1.stop();
+
+    expect(processedMessages).toHaveLength(1);
+    const firstConversationId = processedMessages[0].conversationId;
+    expect(firstConversationId).toBeTruthy();
+
+    // WHEN the schedule fires for the second time
+    forceScheduleDue(schedule.id);
+    processedMessages.length = 0;
+
+    const scheduler2 = startScheduler(processMessage, () => {});
+    await new Promise((resolve) => setTimeout(resolve, 500));
+    scheduler2.stop();
+
+    // THEN the same conversation is reused
+    expect(processedMessages).toHaveLength(1);
+    expect(processedMessages[0].conversationId).toBe(firstConversationId);
+  });
+
   test("recurring schedule with reuseConversation=false creates new conversation each run", async () => {
     /**
-     * Default behavior: each run creates a brand-new conversation.
+     * When explicitly opted out, each run creates a brand-new conversation.
      */
 
-    // GIVEN a recurring schedule with reuseConversation disabled (default)
+    // GIVEN a recurring schedule with reuseConversation explicitly disabled
     const rruleExpr = buildEveryMinuteRrule();
     const schedule = createSchedule({
       name: "No Reuse Test",
@@ -223,7 +268,7 @@ describe("scheduler conversation reuse", () => {
       message: "New conv each run",
       syntax: "rrule",
       expression: rruleExpr,
-      // reuseConversation defaults to false
+      reuseConversation: false, // explicitly opt out of conversation reuse
     });
 
     // WHEN the schedule fires for the first time

package/src/__tests__/secret-ingress-http.test.ts

@@ -100,12 +100,13 @@ mock.module("../memory/conversation-crud.js", () => ({
     conversationId: string,
     role: string,
     content: string,
-    metadata?: Record<string, unknown>,
-  ) => addMessageMock(conversationId, role, content, metadata),
+    options?: { metadata?: Record<string, unknown> },
+  ) => addMessageMock(conversationId, role, content, options),
   getMessages: () => [],
   provenanceFromTrustContext: () => undefined,
   setConversationOriginChannelIfUnset: () => {},
   setConversationOriginInterfaceIfUnset: () => {},
+  reserveMessage: mock(async () => ({ id: "msg-reserve" })),
 }));
 
 mock.module("../runtime/local-actor-identity.js", () => ({
@@ -187,7 +188,10 @@ function makeRequest(
   });
 }
 
-const persistUserMessageMock = mock(async () => "persisted-id");
+const persistUserMessageMock = mock(async () => ({
+  id: "persisted-id",
+  deduplicated: false,
+}));
 const runAgentLoopMock = mock(async () => undefined);
 
 function makeSendMessageDeps() {

package/src/__tests__/secret-prompt-log-hygiene.test.ts

@@ -1,9 +1,7 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-import type {
-  SecretRequest,
-  ServerMessage,
-} from "../daemon/message-protocol.js";
+import type { SecretRequestEvent } from "../api/events/secret-request.js";
+import type { ServerMessage } from "../daemon/message-protocol.js";
 
 // Capture all logger calls so we can verify secret values never appear
 const logCalls: Array<{ level: string; args: unknown[] }> = [];
@@ -43,7 +41,11 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
 const _piStore = new Map<string, object>();
 mock.module("../runtime/pending-interactions.js", () => ({
   register: (id: string, entry: object) => _piStore.set(id, entry),
-  resolve: (id: string) => { const e = _piStore.get(id); _piStore.delete(id); return e; },
+  resolve: (id: string) => {
+    const e = _piStore.get(id);
+    _piStore.delete(id);
+    return e;
+  },
   get: (id: string) => _piStore.get(id),
   getAll: () => [..._piStore.values()],
   getByConversation: () => [],
@@ -83,7 +85,7 @@ describe("secret prompt log hygiene", () => {
   test("resolveSecret never logs the secret value", async () => {
     const secret = "sv42";
     const promise = prompter.prompt("myservice", "apikey", "API Key");
-    const requestId = (broadcastedMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastedMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, secret, "store");
     const result = await promise;
 
@@ -124,7 +126,9 @@ describe("secret prompt log hygiene", () => {
 
   test("sent message contains value=undefined (value flows through event, not logs)", async () => {
     const promise = prompter.prompt("svc", "tok", "Token");
-    const msg = broadcastedMessages[0] as SecretRequest & { value?: unknown };
+    const msg = broadcastedMessages[0] as SecretRequestEvent & {
+      value?: unknown;
+    };
     // The message should NOT contain a value field
     expect(msg.value).toBeUndefined();
     prompter.resolveSecret(msg.requestId, undefined);

package/src/__tests__/secret-prompter-channel-fallback.test.ts

@@ -1,9 +1,7 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-import type {
-  SecretRequest,
-  ServerMessage,
-} from "../daemon/message-protocol.js";
+import type { SecretRequestEvent } from "../api/events/secret-request.js";
+import type { ServerMessage } from "../daemon/message-protocol.js";
 
 // Use a tiny timeout so the setTimeout branch fires quickly in tests
 const mockConfig = {
@@ -42,7 +40,11 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
 const _piStore = new Map<string, object>();
 mock.module("../runtime/pending-interactions.js", () => ({
   register: (id: string, entry: object) => _piStore.set(id, entry),
-  resolve: (id: string) => { const e = _piStore.get(id); _piStore.delete(id); return e; },
+  resolve: (id: string) => {
+    const e = _piStore.get(id);
+    _piStore.delete(id);
+    return e;
+  },
   get: (id: string) => _piStore.get(id),
   getAll: () => [..._piStore.values()],
   getByConversation: () => [],
@@ -70,7 +72,7 @@ describe("secret prompter channel fallback", () => {
     expect(broadcastMessages).toHaveLength(1);
     expect(broadcastMessages[0]!.type).toBe("secret_request");
 
-    const requestId = (broadcastMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, "test-secret", "store");
     const result = await promise;
     expect(result.value).toBe("test-secret");
@@ -88,7 +90,7 @@ describe("secret prompter channel fallback", () => {
     expect(broadcastMessages).toHaveLength(1);
     expect(broadcastMessages[0]!.type).toBe("secret_request");
 
-    const requestId = (broadcastMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, "test-secret", "store");
     await promise;
   });
@@ -101,7 +103,7 @@ describe("secret prompter channel fallback", () => {
     expect(broadcastMessages).toHaveLength(1);
     expect(broadcastMessages[0]!.type).toBe("secret_request");
 
-    const requestId = (broadcastMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, "val", "store");
     await promise;
   });
@@ -110,7 +112,7 @@ describe("secret prompter channel fallback", () => {
     const prompter = new SecretPrompter();
 
     const promise = prompter.prompt("myservice", "apikey", "API Key");
-    const requestId = (broadcastMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastMessages[0] as SecretRequestEvent).requestId;
 
     expect(prompter.hasPendingRequest(requestId)).toBe(true);
 

package/src/__tests__/secret-response-routing.test.ts

@@ -1,9 +1,7 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-import type {
-  SecretRequest,
-  ServerMessage,
-} from "../daemon/message-protocol.js";
+import type { SecretRequestEvent } from "../api/events/secret-request.js";
+import type { ServerMessage } from "../daemon/message-protocol.js";
 import type { SecretPromptResult } from "../permissions/secret-prompter.js";
 
 let broadcastedMessages: ServerMessage[] = [];
@@ -15,7 +13,11 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
 const _piStore = new Map<string, object>();
 mock.module("../runtime/pending-interactions.js", () => ({
   register: (id: string, entry: object) => _piStore.set(id, entry),
-  resolve: (id: string) => { const e = _piStore.get(id); _piStore.delete(id); return e; },
+  resolve: (id: string) => {
+    const e = _piStore.get(id);
+    _piStore.delete(id);
+    return e;
+  },
   get: (id: string) => _piStore.get(id),
   getAll: () => [..._piStore.values()],
   getByConversation: () => [],
@@ -36,7 +38,7 @@ describe("secret response routing", () => {
 
   test("resolveSecret defaults delivery to store when omitted", async () => {
     const promise = prompter.prompt("github", "token", "GitHub Token");
-    const requestId = (broadcastedMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastedMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, "test-value");
     const result: SecretPromptResult = await promise;
     expect(result.value).toBe("test-value");
@@ -45,7 +47,7 @@ describe("secret response routing", () => {
 
   test("resolveSecret passes store delivery", async () => {
     const promise = prompter.prompt("github", "token", "GitHub Token");
-    const requestId = (broadcastedMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastedMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, "test-value", "store");
     const result = await promise;
     expect(result.value).toBe("test-value");
@@ -54,7 +56,7 @@ describe("secret response routing", () => {
 
   test("resolveSecret passes transient_send delivery", async () => {
     const promise = prompter.prompt("github", "token", "GitHub Token");
-    const requestId = (broadcastedMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastedMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, "one-time-value", "transient_send");
     const result = await promise;
     expect(result.value).toBe("one-time-value");
@@ -63,7 +65,7 @@ describe("secret response routing", () => {
 
   test("resolveSecret with cancelled value defaults delivery to store", async () => {
     const promise = prompter.prompt("github", "token", "GitHub Token");
-    const requestId = (broadcastedMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastedMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, undefined);
     const result = await promise;
     expect(result.value).toBeNull();
@@ -74,7 +76,7 @@ describe("secret response routing", () => {
     // We can't easily test the full timeout, but we verify the structure
     // by resolving immediately (the timeout path also returns { value: null, delivery: 'store' })
     const promise = prompter.prompt("github", "token", "GitHub Token");
-    const requestId = (broadcastedMessages[0] as SecretRequest).requestId;
+    const requestId = (broadcastedMessages[0] as SecretRequestEvent).requestId;
     prompter.resolveSecret(requestId, undefined, undefined);
     const result = await promise;
     expect(result.value).toBeNull();
@@ -91,7 +93,7 @@ describe("secret response routing", () => {
       "session-1",
     );
     expect(broadcastedMessages.length).toBe(1);
-    const msg = broadcastedMessages[0] as SecretRequest;
+    const msg = broadcastedMessages[0] as SecretRequestEvent;
     expect(msg.type).toBe("secret_request");
     expect(msg.service).toBe("github");
     expect(msg.field).toBe("token");

package/src/__tests__/secure-keys.test.ts

@@ -25,7 +25,6 @@ mock.module("../util/logger.js", () => ({
 
 import type { CesClient } from "../credential-execution/client.js";
 import * as encryptedStore from "../security/encrypted-store.js";
-import { _setStorePath } from "../security/encrypted-store.js";
 import {
   _resetBackend,
   deleteSecureKeyAsync,
@@ -36,6 +35,7 @@ import {
   setCesReconnect,
   setSecureKeyAsync,
 } from "../security/secure-keys.js";
+import { setStorePathForTesting } from "./encrypted-store-test-helpers.js";
 
 // ---------------------------------------------------------------------------
 // Use a temp directory for encrypted store tests
@@ -59,11 +59,11 @@ describe("secure-keys", () => {
       rmSync(TEST_DIR, { recursive: true });
     }
     mkdirSync(TEST_DIR, { recursive: true });
-    _setStorePath(STORE_PATH);
+    setStorePathForTesting(STORE_PATH);
   });
 
   afterEach(() => {
-    _setStorePath(null);
+    setStorePathForTesting(null);
     _resetBackend();
     delete process.env.VELLUM_DEV;
     delete process.env.VELLUM_DESKTOP_APP;

package/src/__tests__/send-endpoint-busy.test.ts

@@ -136,13 +136,9 @@ function makeCompletingConversation(): Conversation {
   const messages: unknown[] = [];
   return {
     isProcessing: () => processing,
-    persistUserMessage: (
-      _content: string,
-      _attachments: unknown[],
-      requestId?: string,
-    ) => {
+    persistUserMessage: (options: { requestId?: string }) => {
       processing = true;
-      return requestId ?? "msg-1";
+      return { id: options.requestId ?? "msg-1", deduplicated: false };
     },
     memoryPolicy: {
       scopeId: "default",
@@ -170,8 +166,9 @@ function makeCompletingConversation(): Conversation {
     runAgentLoop: async (
       _content: string,
       _messageId: string,
-      onEvent: (msg: ServerMessage) => void,
+      options?: { onEvent?: (msg: ServerMessage) => void },
     ) => {
+      const onEvent = options?.onEvent ?? (() => {});
       onEvent({ type: "assistant_text_delta", text: "Hello!" });
       onEvent({ type: "message_complete", conversationId: "test-session" });
       processing = false;
@@ -188,18 +185,14 @@ function makeHangingConversation(): Conversation {
   const messages: unknown[] = [];
   const enqueuedMessages: Array<{
     content: string;
-    onEvent: (msg: ServerMessage) => void;
-    requestId: string;
+    onEvent?: (msg: ServerMessage) => void;
+    requestId?: string;
   }> = [];
   return {
     isProcessing: () => processing,
-    persistUserMessage: (
-      _content: string,
-      _attachments: unknown[],
-      requestId?: string,
-    ) => {
+    persistUserMessage: (options: { requestId?: string }) => {
       processing = true;
-      return requestId ?? "msg-1";
+      return { id: options.requestId ?? "msg-1", deduplicated: false };
     },
     memoryPolicy: {
       scopeId: "default",
@@ -223,14 +216,20 @@ function makeHangingConversation(): Conversation {
     hasPendingConfirmation: () => false,
     denyAllPendingConfirmations: () => {},
     getQueueDepth: () => enqueuedMessages.length,
-    enqueueMessage: (
-      content: string,
-      _attachments: unknown[],
-      onEvent: (msg: ServerMessage) => void,
-      requestId: string,
-    ) => {
-      enqueuedMessages.push({ content, onEvent, requestId });
-      return { queued: true, requestId };
+    enqueueMessage: (options: {
+      content: string;
+      onEvent?: (msg: ServerMessage) => void;
+      requestId?: string;
+    }) => {
+      enqueuedMessages.push({
+        content: options.content,
+        onEvent: options.onEvent,
+        requestId: options.requestId,
+      });
+      return {
+        queued: true,
+        requestId: options.requestId ?? "hanging-req",
+      };
     },
     runAgentLoop: async () => {
       // Hang forever
@@ -259,14 +258,9 @@ function makePendingApprovalConversation(
   const messages: unknown[] = [];
   const runAgentLoopMock = mock(async () => {});
   const enqueueMessageMock = mock(
-    (
-      _content: string,
-      _attachments: unknown[],
-      _onEvent: (msg: ServerMessage) => void,
-      queuedRequestId: string,
-    ) => ({
+    (options: { content: string; requestId?: string }) => ({
       queued: true,
-      requestId: queuedRequestId,
+      requestId: options.requestId ?? "queued-req",
     }),
   );
   const denyAllPendingConfirmationsMock = mock(() => {
@@ -278,11 +272,10 @@ function makePendingApprovalConversation(
 
   const conversation = {
     isProcessing: () => processing,
-    persistUserMessage: (
-      _content: string,
-      _attachments: unknown[],
-      reqId?: string,
-    ) => reqId ?? "msg-1",
+    persistUserMessage: (options: { requestId?: string }) => ({
+      id: options.requestId ?? "msg-1",
+      deduplicated: false,
+    }),
     memoryPolicy: {
       scopeId: "default",
       includeDefaultFallback: false,
@@ -895,7 +888,7 @@ describe("POST /v1/messages — queue-if-busy and hub publishing", () => {
     await stopServer();
   });
 
-  test("accepts message when conversationKey is omitted (defaults to stable channel key)", async () => {
+  test("accepts message when conversationKey is omitted (vellum channel mints fresh)", async () => {
     await startServer(() => makeCompletingConversation());
 
     const res = await fetch(messagesUrl(), {
@@ -908,14 +901,24 @@ describe("POST /v1/messages — queue-if-busy and hub publishing", () => {
       }),
     });
     expect(res.status).toBe(202);
+    const body = (await res.json()) as {
+      accepted: boolean;
+      conversationId: string;
+    };
+    expect(body.accepted).toBe(true);
+    expect(body.conversationId).toBeTruthy();
+
+    // The vellum channel never falls through to the shared
+    // `default:vellum:<interface>` thread: each empty-handed send mints
+    // a fresh conversation so the first-message id surfaces to the client.
+    expect(getConversationByKey("default:vellum:macos")).toBeNull();
 
     await stopServer();
   });
 
-  test("two calls without conversationKey use the same conversation", async () => {
+  test("two empty-handed vellum sends each mint distinct conversations", async () => {
     await startServer(() => makeCompletingConversation());
 
-    // First message — no conversationKey
     const res1 = await fetch(messagesUrl(), {
       method: "POST",
       headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
@@ -926,8 +929,8 @@ describe("POST /v1/messages — queue-if-busy and hub publishing", () => {
       }),
     });
     expect(res1.status).toBe(202);
+    const body1 = (await res1.json()) as { conversationId: string };
 
-    // Second message — same channel/interface, still no conversationKey
     const res2 = await fetch(messagesUrl(), {
       method: "POST",
       headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
@@ -938,12 +941,49 @@ describe("POST /v1/messages — queue-if-busy and hub publishing", () => {
       }),
     });
     expect(res2.status).toBe(202);
+    const body2 = (await res2.json()) as { conversationId: string };
+
+    expect(body1.conversationId).toBeTruthy();
+    expect(body2.conversationId).toBeTruthy();
+    expect(body1.conversationId).not.toBe(body2.conversationId);
+
+    await stopServer();
+  });
+
+  test("two empty-handed phone sends share the default channel thread", async () => {
+    await startServer(() => makeCompletingConversation());
+
+    const res1 = await fetch(messagesUrl(), {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+      body: JSON.stringify({
+        content: "First",
+        sourceChannel: "phone",
+        interface: "phone",
+      }),
+    });
+    expect(res1.status).toBe(202);
+    const body1 = (await res1.json()) as { conversationId: string };
+
+    const res2 = await fetch(messagesUrl(), {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+      body: JSON.stringify({
+        content: "Second",
+        sourceChannel: "phone",
+        interface: "phone",
+      }),
+    });
+    expect(res2.status).toBe(202);
+    const body2 = (await res2.json()) as { conversationId: string };
 
-    // Both should have resolved to the same default conversation key
-    // ("default:vellum:macos"), which maps to the same conversationId.
-    const mapping = getConversationByKey("default:vellum:macos");
+    // Non-vellum channels keep the legacy `default:<channel>:<interface>`
+    // co-location so repeated inbound messages from the same external
+    // channel/interface land on a single thread.
+    expect(body1.conversationId).toBe(body2.conversationId);
+    const mapping = getConversationByKey("default:phone:phone");
     expect(mapping).not.toBeNull();
-    expect(mapping!.conversationId).toBeTruthy();
+    expect(mapping!.conversationId).toBe(body1.conversationId);
 
     await stopServer();
   });

package/src/__tests__/server-history-render.test.ts

@@ -578,7 +578,10 @@ describe("getAttachmentsForMessage", () => {
     db.run("DELETE FROM conversations");
   });
 
-  async function createMessage(role: string, content: string): Promise<string> {
+  async function createMessage(
+    role: "user" | "assistant" | "system",
+    content: string,
+  ): Promise<string> {
     const conv = createConversation("test");
     const msg = await addMessage(conv.id, role, content);
     return msg.id;