@vellumai/vellum-gateway 0.5.15 → 0.5.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/vellum-gateway",
-  "version": "0.5.15",
+  "version": "0.5.16",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/credential-watcher-managed-bootstrap.test.ts

@@ -76,7 +76,7 @@ async function startGateway(): Promise<void> {
     stdio: ["ignore", "pipe", "pipe"],
   });
 
-  const deadline = Date.now() + 5_000;
+  const deadline = Date.now() + 10_000;
   while (Date.now() < deadline) {
     try {
       const res = await fetch(`http://localhost:${gatewayPort}/healthz`);
@@ -86,7 +86,7 @@ async function startGateway(): Promise<void> {
     }
     await new Promise((resolve) => setTimeout(resolve, 100));
   }
-  throw new Error("Gateway failed to start within 5 seconds");
+  throw new Error("Gateway failed to start within 10 seconds");
 }
 
 function startFakeCes(opts: {
@@ -139,7 +139,7 @@ afterEach(() => {
   cesPort = 0;
 
   if (gatewayProc) {
-    gatewayProc.kill();
+    gatewayProc.kill("SIGKILL");
     gatewayProc = null;
   }
 
@@ -176,7 +176,7 @@ describe("gateway managed credential bootstrap retry", () => {
     }
 
     expect(status).toBe(401);
-  }, 15_000);
+  }, 20_000);
 
   test("keeps retrying until configured credential reads succeed after CES list is already available", async () => {
     mkdirSync(testDir, { recursive: true });
@@ -220,5 +220,5 @@ describe("gateway managed credential bootstrap retry", () => {
     }
 
     expect(status).toBe(401);
-  }, 15_000);
+  }, 20_000);
 });

package/src/__tests__/slack-normalize.test.ts

@@ -326,6 +326,32 @@ describe("normalizeSlackMessageEdit", () => {
     expect(result!.threadTs).toBe("1700000000.000100");
   });
 
+  test("DM edit without thread_ts omits threadTs", () => {
+    const config = makeConfig();
+    const event = makeMessageChangedEvent({ channel_type: "im" });
+    const result = normalizeSlackMessageEdit(event, "evt-dm-edit-1", config);
+
+    expect(result).not.toBeNull();
+    expect(result!.threadTs).toBeUndefined();
+  });
+
+  test("DM edit with thread_ts preserves threadTs", () => {
+    const config = makeConfig();
+    const event = makeMessageChangedEvent({
+      channel_type: "im",
+      message: {
+        user: "U_USER123",
+        text: "edited hello world",
+        ts: "1700000000.000100",
+        thread_ts: "1700000000.000050",
+      },
+    });
+    const result = normalizeSlackMessageEdit(event, "evt-dm-edit-2", config);
+
+    expect(result).not.toBeNull();
+    expect(result!.threadTs).toBe("1700000000.000050");
+  });
+
   test("DM edits use default assistant when channel is not in routing table", () => {
     const config = makeConfig({
       unmappedPolicy: "reject",

package/src/auth/scopes.ts

@@ -14,6 +14,7 @@ import type { Scope, ScopeProfile } from "./types.js";
 
 const PROFILE_SCOPES: Record<ScopeProfile, ReadonlySet<Scope>> = {
   actor_client_v1: new Set<Scope>([
+    "admin.write",
     "chat.read",
     "chat.write",
     "approval.read",

package/src/auth/types.ts

@@ -33,6 +33,7 @@ export type Scope =
   | "calls.write"
   | "ingress.write"
   | "internal.write"
+  | "admin.write"
   | "feature_flags.read"
   | "feature_flags.write"
   | "local.all";

package/src/config.ts

@@ -39,7 +39,8 @@ type RoutingEntry = {
 
 /**
  * Read the workspace config file at startup to populate gateway operational
- * settings. The CLI writes these values before starting the gateway.
+ * settings. In Docker, the daemon writes these values. In local mode, the
+ * CLI passes them via env vars (which take precedence in loadConfig()).
  */
 function readWorkspaceConfig(): Record<string, unknown> {
   try {
@@ -105,24 +106,46 @@ export function loadConfig(): GatewayConfig {
 
   const gatewayInternalBaseUrl = `http://127.0.0.1:${port}`;
 
-  // Read operational settings from workspace config. The CLI writes these
-  // before spawning the gateway (see cli/src/lib/local.ts writeGatewayConfig).
+  // Read operational settings from workspace config (Docker) or env vars (CLI).
   const wsConfig = readWorkspaceConfig();
   const gw = (wsConfig.gateway ?? {}) as Record<string, unknown>;
 
+  // Env vars take precedence over workspace config values. This allows the
+  // CLI to pass gateway settings directly via the process environment instead
+  // of writing to the workspace config file.
   const runtimeProxyEnabled =
+    process.env.RUNTIME_PROXY_ENABLED === "true" ||
     gw.runtimeProxyEnabled === true ||
-    gw.runtimeProxyEnabled === "true" ||
-    process.env.RUNTIME_PROXY_ENABLED === "true";
+    gw.runtimeProxyEnabled === "true";
   const runtimeProxyRequireAuth =
-    gw.runtimeProxyRequireAuth !== false &&
-    gw.runtimeProxyRequireAuth !== "false";
-  const unmappedPolicy = gw.unmappedPolicy === "default" ? "default" : "reject";
+    process.env.RUNTIME_PROXY_REQUIRE_AUTH !== undefined
+      ? process.env.RUNTIME_PROXY_REQUIRE_AUTH !== "false"
+      : gw.runtimeProxyRequireAuth !== false &&
+        gw.runtimeProxyRequireAuth !== "false";
+  const unmappedPolicyEnv = process.env.UNMAPPED_POLICY?.trim();
+  const unmappedPolicy: "reject" | "default" =
+    unmappedPolicyEnv === "default" || unmappedPolicyEnv === "reject"
+      ? unmappedPolicyEnv
+      : gw.unmappedPolicy === "default"
+        ? "default"
+        : "reject";
   const defaultAssistantId =
-    typeof gw.defaultAssistantId === "string" && gw.defaultAssistantId
+    process.env.DEFAULT_ASSISTANT_ID?.trim() ||
+    (typeof gw.defaultAssistantId === "string" && gw.defaultAssistantId
       ? gw.defaultAssistantId
-      : undefined;
-  const routingEntries = parseRoutingEntries(gw.routingEntries);
+      : undefined);
+  let routingEntries: RoutingEntry[] = [];
+  if (process.env.ROUTING_ENTRIES) {
+    try {
+      routingEntries = parseRoutingEntries(
+        JSON.parse(process.env.ROUTING_ENTRIES),
+      );
+    } catch {
+      log.warn("Invalid JSON in ROUTING_ENTRIES env var — ignoring");
+    }
+  } else {
+    routingEntries = parseRoutingEntries(gw.routingEntries);
+  }
 
   const logFile: LogFileConfig = {
     dir: undefined,

package/src/feature-flag-registry.json

@@ -25,6 +25,14 @@
       "description": "Enable the Vellum Cloud hosting option on the Hosting screen",
       "defaultEnabled": false
     },
+    {
+      "id": "local-docker-enabled",
+      "scope": "macos",
+      "key": "local-docker-enabled",
+      "label": "Local Docker Mode",
+      "description": "When enabled, the Local hosting option uses Docker under the hood for sandboxed execution, hiding the separate Docker card",
+      "defaultEnabled": false
+    },
     {
       "id": "contacts",
       "scope": "assistant",
@@ -360,6 +368,14 @@
       "label": "Fast Mode",
       "description": "Enable Anthropic fast mode for Opus 4.6, delivering up to 2.5x higher output tokens per second at premium pricing",
       "defaultEnabled": false
+    },
+    {
+      "id": "outlook-oauth-integration",
+      "scope": "assistant",
+      "key": "outlook-oauth-integration",
+      "label": "Outlook / Microsoft Integration",
+      "description": "Enable the Outlook / Microsoft OAuth provider for connecting to Microsoft Graph APIs (email, calendar)",
+      "defaultEnabled": false
     }
   ]
 }

package/src/index.ts

@@ -89,6 +89,7 @@ import {
 } from "./slack/socket-mode.js";
 import { downloadSlackFile } from "./slack/download.js";
 import { fetchThreadContext } from "./slack/thread-context.js";
+import { fetchDmContext } from "./slack/dm-context.js";
 import { handleInbound } from "./handlers/handle-inbound.js";
 import { checkAuthRateLimit } from "./http/middleware/rate-limit.js";
 import {
@@ -780,7 +781,8 @@ async function main() {
     {
       path: "/v1/admin/upgrade-broadcast",
       method: "POST",
-      auth: "edge",
+      auth: "edge-scoped",
+      scope: "admin.write",
       handler: (req) => upgradeBroadcastProxy(req),
     },
 
@@ -802,7 +804,8 @@ async function main() {
     {
       path: "/v1/admin/workspace-commit",
       method: "POST",
-      auth: "edge",
+      auth: "edge-scoped",
+      scope: "admin.write",
       handler: (req) => workspaceCommitProxy(req),
     },
 
@@ -810,7 +813,8 @@ async function main() {
     {
       path: "/v1/admin/rollback-migrations",
       method: "POST",
-      auth: "edge",
+      auth: "edge-scoped",
+      scope: "admin.write",
       handler: (req) => migrationRollbackProxy(req),
     },
 
@@ -1208,7 +1212,13 @@ async function main() {
       { appToken, botToken, gatewayConfig: config },
       (normalized) => {
         const { threadTs, channel } = normalized;
-        const replyCallbackUrl = `${config.gatewayInternalBaseUrl}/deliver/slack?threadTs=${encodeURIComponent(threadTs)}&channel=${encodeURIComponent(channel)}`;
+        const params = new URLSearchParams({ channel });
+        if (threadTs) params.set("threadTs", threadTs);
+        // For non-threaded DMs, pass the original message ts so the runtime
+        // can target it for emoji-based thinking indicators.
+        const origMessageTs = normalized.event.source.messageId;
+        if (!threadTs && origMessageTs) params.set("messageTs", origMessageTs);
+        const replyCallbackUrl = `${config.gatewayInternalBaseUrl}/deliver/slack?${params}`;
 
         // Check if this is a regular thread reply (not an edit or callback action).
         // Edits and callbacks don't benefit from thread context and would just add
@@ -1245,10 +1255,7 @@ async function main() {
 
               // Filter oversized attachments
               const eligible = eventAttachments.filter((att) => {
-                if (
-                  att.fileSize !== undefined &&
-                  att.fileSize > maxBytes
-                ) {
+                if (att.fileSize !== undefined && att.fileSize > maxBytes) {
                   log.warn(
                     {
                       fileId: att.fileId,
@@ -1345,7 +1352,7 @@ async function main() {
           }
         };
 
-        if (isThreadReply && botToken) {
+        if (isThreadReply && botToken && threadTs) {
           fetchThreadContext(channel, threadTs, messageTs, botToken)
             .then((context) => context ?? undefined)
             .catch(() => undefined)
@@ -1356,6 +1363,23 @@ async function main() {
                 "Unhandled error in Slack forward (thread reply)",
               );
             });
+        } else if (
+          channel.startsWith("D") &&
+          botToken &&
+          messageTs &&
+          !isEdit &&
+          !isCallback
+        ) {
+          fetchDmContext(channel, messageTs, botToken)
+            .then((context) => context ?? undefined)
+            .catch(() => undefined)
+            .then((context) => forward(context))
+            .catch((err) => {
+              log.error(
+                { err, channel },
+                "Unhandled error in Slack forward (DM context)",
+              );
+            });
         } else {
           forward().catch((err) => {
             log.error(

package/src/runtime/client.ts

@@ -551,7 +551,12 @@ export async function uploadAttachment(
 ): Promise<UploadAttachmentResponse> {
   const skipCb = opts?.skipCircuitBreaker === true;
 
-  if (!skipCb) cbBeforeRequest();
+  // Always check the breaker for fail-fast (OPEN/HALF_OPEN rejection).
+  // skipCb only suppresses success/failure accounting so attachment errors
+  // don't trip the breaker — but half-open probes must always record their
+  // outcome to avoid getting stuck in HALF_OPEN permanently.
+  const isProbe = cbBeforeRequest();
+  const recordOutcome = !skipCb || isProbe;
 
   const url = `${config.assistantRuntimeBaseUrl}/v1/attachments`;
 
@@ -566,7 +571,7 @@ export async function uploadAttachment(
       signal: AbortSignal.timeout(config.runtimeTimeoutMs),
     });
   } catch (err) {
-    if (!skipCb) cbOnFailure();
+    if (recordOutcome) cbOnFailure();
     throw err;
   }
 
@@ -576,16 +581,16 @@ export async function uploadAttachment(
     // extension, missing fields). Distinguish from transient 5xx/network errors
     // so callers can decide whether to skip or propagate.
     if (response.status >= 400 && response.status < 500) {
-      if (!skipCb) cbOnSuccess();
+      if (recordOutcome) cbOnSuccess();
       throw new AttachmentValidationError(
         `Attachment rejected (${response.status}): ${body}`,
       );
     }
-    if (!skipCb) cbOnFailure();
+    if (recordOutcome) cbOnFailure();
     throw new Error(`Attachment upload failed (${response.status}): ${body}`);
   }
 
-  if (!skipCb) cbOnSuccess();
+  if (recordOutcome) cbOnSuccess();
   return (await response.json()) as UploadAttachmentResponse;
 }
 

package/src/schema.ts

@@ -3126,6 +3126,11 @@ export function buildSchema(): Record<string, unknown> {
               type: "array",
               items: { type: "string" },
             },
+            callback_transport: {
+              type: "string",
+              enum: ["loopback", "gateway"],
+              description: "OAuth callback transport. Defaults to loopback.",
+            },
           },
         },
         OAuthConnectDeferredResponse: {

package/src/slack/dm-context.test.ts

@@ -0,0 +1,170 @@
+import { describe, it, expect, beforeEach, mock } from "bun:test";
+
+type FetchFn = (
+  input: string | URL | Request,
+  init?: RequestInit,
+) => Promise<Response>;
+let fetchMock: ReturnType<typeof mock<FetchFn>> = mock(
+  async () => new Response(),
+);
+
+mock.module("../fetch.js", () => ({
+  fetchImpl: (...args: Parameters<FetchFn>) => fetchMock(...args),
+}));
+
+const { fetchDmContext } = await import("./dm-context.js");
+const { clearUserInfoCache, clearInFlightFetches } =
+  await import("./normalize.js");
+
+function mockSlackApi(
+  historyMessages: Array<{
+    user?: string;
+    text?: string;
+    ts?: string;
+    bot_id?: string;
+    username?: string;
+  }>,
+  userNames: Record<string, string> = {},
+) {
+  fetchMock = mock(async (url: string | URL | Request) => {
+    const urlStr = typeof url === "string" ? url : url.toString();
+    if (urlStr.includes("conversations.history")) {
+      return Response.json({ ok: true, messages: historyMessages });
+    }
+    if (urlStr.includes("users.info")) {
+      const userId = new URL(urlStr).searchParams.get("user");
+      const name = userNames[userId!] ?? userId;
+      return Response.json({
+        ok: true,
+        user: { name: userId, profile: { display_name: name } },
+      });
+    }
+    return Response.json({ ok: false });
+  });
+}
+
+describe("fetchDmContext", () => {
+  beforeEach(() => {
+    clearUserInfoCache();
+    clearInFlightFetches();
+  });
+
+  it("returns formatted context with prior messages", async () => {
+    // Slack returns newest-first; include a bot message
+    mockSlackApi(
+      [
+        {
+          user: "UBOT",
+          text: "Here's what I found",
+          ts: "1000.2",
+          bot_id: "B123",
+        },
+        { user: "U001", text: "Can you look this up?", ts: "1000.1" },
+        { user: "U001", text: "Hey there", ts: "1000.0" },
+      ],
+      { U001: "Alice", UBOT: "Assistant" },
+    );
+
+    const result = await fetchDmContext(
+      "D123",
+      "1000.3", // current message ts, excluded from context
+      "xoxb-test-token",
+    );
+
+    expect(result).toContain(
+      "Recent messages in this DM conversation (3 prior messages)",
+    );
+    // Should be in chronological order (oldest first)
+    const aliceHeyIdx = result!.indexOf("[Alice]: Hey there");
+    const aliceCanIdx = result!.indexOf("[Alice]: Can you look this up?");
+    const botIdx = result!.indexOf("[Assistant]: Here's what I found");
+    expect(aliceHeyIdx).toBeLessThan(aliceCanIdx);
+    expect(aliceCanIdx).toBeLessThan(botIdx);
+  });
+
+  it("excludes the current message", async () => {
+    mockSlackApi(
+      [
+        { user: "U001", text: "This is the current message", ts: "1000.1" },
+        { user: "U002", text: "Earlier message", ts: "1000.0" },
+      ],
+      { U001: "Alice", U002: "Bob" },
+    );
+
+    const result = await fetchDmContext(
+      "D123",
+      "1000.1", // matches first message — should be excluded
+      "xoxb-test-token",
+    );
+
+    expect(result).toContain("1 prior messages");
+    expect(result).toContain("[Bob]: Earlier message");
+    expect(result).not.toContain("This is the current message");
+  });
+
+  it("returns null when no prior messages", async () => {
+    // Only the current message in history
+    mockSlackApi([
+      { user: "U001", text: "Hello!", ts: "1000.0" },
+    ]);
+
+    const result = await fetchDmContext(
+      "D123",
+      "1000.0", // matches the only message
+      "xoxb-test-token",
+    );
+
+    expect(result).toBeNull();
+  });
+
+  it("returns null on API error", async () => {
+    fetchMock = mock(async () =>
+      Response.json({ ok: false, error: "channel_not_found" }),
+    );
+
+    const result = await fetchDmContext(
+      "D123",
+      "1000.0",
+      "xoxb-test-token",
+    );
+
+    expect(result).toBeNull();
+  });
+
+  it("returns null on HTTP error", async () => {
+    fetchMock = mock(async () => new Response("Server Error", { status: 500 }));
+
+    const result = await fetchDmContext(
+      "D123",
+      "1000.0",
+      "xoxb-test-token",
+    );
+
+    expect(result).toBeNull();
+  });
+
+  it("reverses API order to chronological", async () => {
+    // Slack API returns newest-first
+    mockSlackApi(
+      [
+        { user: "U001", text: "Third message", ts: "1000.2" },
+        { user: "U001", text: "Second message", ts: "1000.1" },
+        { user: "U001", text: "First message", ts: "1000.0" },
+      ],
+      { U001: "Alice" },
+    );
+
+    const result = await fetchDmContext(
+      "D123",
+      "9999.0", // current message not in list
+      "xoxb-test-token",
+    );
+
+    // Verify chronological order in output
+    const firstIdx = result!.indexOf("First message");
+    const secondIdx = result!.indexOf("Second message");
+    const thirdIdx = result!.indexOf("Third message");
+    expect(firstIdx).toBeLessThan(secondIdx);
+    expect(secondIdx).toBeLessThan(thirdIdx);
+  });
+});

package/src/slack/dm-context.ts

@@ -0,0 +1,135 @@
+/**
+ * Fetches recent DM history for inbound Slack direct messages so the
+ * assistant has context about prior messages in the conversation.
+ *
+ * Uses `conversations.history` to retrieve recent messages and formats
+ * them as a human-readable context string suitable for transport hints.
+ */
+
+import { fetchImpl } from "../fetch.js";
+import { getLogger } from "../logger.js";
+import { resolveSlackUser } from "./normalize.js";
+
+const log = getLogger("slack-dm-context");
+
+/** Maximum number of prior messages to include in context. */
+const MAX_CONTEXT_MESSAGES = 10;
+
+/**
+ * Over-fetch so the current message (which is filtered out) doesn't
+ * reduce the effective context window below MAX_CONTEXT_MESSAGES.
+ */
+const FETCH_LIMIT = 15;
+
+/** Timeout for the conversations.history API call. */
+const FETCH_TIMEOUT_MS = 5_000;
+
+interface SlackDmMessage {
+  user?: string;
+  text?: string;
+  ts?: string;
+  bot_id?: string;
+  username?: string;
+}
+
+/**
+ * Fetch recent DM history for a Slack direct-message channel.
+ *
+ * Returns a formatted string containing recent prior messages, or null
+ * if the fetch fails or there are no prior messages.
+ *
+ * @param channel - Slack DM channel ID (starts with "D")
+ * @param currentMessageTs - The current message's ts (excluded from context)
+ * @param botToken - Bot OAuth token for API calls
+ */
+export async function fetchDmContext(
+  channel: string,
+  currentMessageTs: string,
+  botToken: string,
+): Promise<string | null> {
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+
+    const params = new URLSearchParams({
+      channel,
+      limit: String(FETCH_LIMIT),
+    });
+
+    const resp = await fetchImpl(
+      `https://slack.com/api/conversations.history?${params.toString()}`,
+      {
+        method: "GET",
+        headers: { Authorization: `Bearer ${botToken}` },
+        signal: controller.signal,
+      },
+    );
+
+    clearTimeout(timeout);
+
+    if (!resp.ok) {
+      log.debug(
+        { status: resp.status, channel },
+        "conversations.history HTTP error",
+      );
+      return null;
+    }
+
+    const data = (await resp.json()) as {
+      ok?: boolean;
+      messages?: SlackDmMessage[];
+      error?: string;
+    };
+
+    if (!data.ok || !data.messages?.length) {
+      log.debug(
+        { error: data.error, channel },
+        "conversations.history returned no messages",
+      );
+      return null;
+    }
+
+    // Exclude the current message from context
+    const priorMessages = data.messages.filter(
+      (msg) => msg.ts !== currentMessageTs,
+    );
+
+    if (priorMessages.length === 0) return null;
+
+    // Slack returns newest-first; reverse to chronological order
+    priorMessages.reverse();
+
+    // Cap at MAX_CONTEXT_MESSAGES (take the most recent N)
+    const contextMessages =
+      priorMessages.length <= MAX_CONTEXT_MESSAGES
+        ? priorMessages
+        : priorMessages.slice(-MAX_CONTEXT_MESSAGES);
+
+    // Resolve user display names (best-effort, uses cache)
+    const formattedMessages = await Promise.all(
+      contextMessages.map(async (msg) => {
+        let authorLabel: string;
+        if (msg.user) {
+          const userInfo = await resolveSlackUser(msg.user, botToken).catch(
+            () => undefined,
+          );
+          authorLabel = userInfo?.displayName ?? msg.user;
+        } else {
+          authorLabel = msg.username ?? "Unknown";
+        }
+
+        const text = msg.text?.trim() || "(no text)";
+        return `[${authorLabel}]: ${text}`;
+      }),
+    );
+
+    return `Recent messages in this DM conversation (${contextMessages.length} prior messages):\n\n${formattedMessages.join("\n\n")}`;
+  } catch (err) {
+    // AbortError from timeout or any other fetch failure — non-fatal
+    log.debug(
+      { err, channel },
+      "Failed to fetch DM context (non-fatal)",
+    );
+    return null;
+  }
+}

package/src/slack/normalize.test.ts

@@ -260,6 +260,26 @@ describe("normalizeSlackReactionAdded", () => {
   });
 });
 
+describe("DM threading", () => {
+  it("non-threaded DM has no threadTs", () => {
+    const config = makeConfig();
+    const event = makeDmEvent();
+    const result = normalizeSlackDirectMessage(event, "evt-dm-1", config);
+
+    expect(result).not.toBeNull();
+    expect(result!.threadTs).toBeUndefined();
+  });
+
+  it("threaded DM preserves threadTs", () => {
+    const config = makeConfig();
+    const event = makeDmEvent({ thread_ts: "1700000000.000050" });
+    const result = normalizeSlackDirectMessage(event, "evt-dm-2", config);
+
+    expect(result).not.toBeNull();
+    expect(result!.threadTs).toBe("1700000000.000050");
+  });
+});
+
 // --- Attachment extraction tests ---
 
 function makeSlackFile(overrides?: Partial<SlackFile>): SlackFile {

package/src/slack/normalize.ts

@@ -291,7 +291,7 @@ export type NormalizedSlackEvent = {
   event: GatewayInboundEvent;
   routing: RouteResult;
   /** Thread timestamp for reply threading. */
-  threadTs: string;
+  threadTs?: string;
   /** Slack channel ID. */
   channel: string;
   /** Original Slack file objects keyed by file ID, for download in the I/O layer. */
@@ -379,7 +379,7 @@ export function normalizeSlackDirectMessage(
       raw: event as unknown as Record<string, unknown>,
     },
     routing,
-    threadTs: event.thread_ts ?? event.ts,
+    ...(event.thread_ts ? { threadTs: event.thread_ts } : {}),
     channel: event.channel,
     ...(slackFiles ? { slackFiles } : {}),
   };
@@ -754,8 +754,9 @@ export function normalizeSlackMessageEdit(
       raw: event as unknown as Record<string, unknown>,
     },
     routing,
-    // Fall back to the original message ts, not the wrapper event ts
-    threadTs: edited.thread_ts ?? edited.ts,
+    // For DMs without a thread, omit threadTs so the reply goes directly in conversation.
+    // For channels (or DMs already in a thread), fall back to edited.ts.
+    ...(isDm && !edited.thread_ts ? {} : { threadTs: edited.thread_ts ?? edited.ts }),
     channel: event.channel,
   };
 }