fix(inbox): scope reply threading to the receiving workspace

[waleedlatif1]

Summary

• The AgentMail webhook matched an incoming reply's In-Reply-To against every workspace's inbox tasks, so a reply delivered to one inbox could inherit another workspace's chatId; the executor then ran with that chat and appended the turn to its transcript. Both the parent-task lookup and the email_message_id dedupe are now scoped to the workspace that owns the receiving inbox (message ids are sender-controlled and visible to every recipient)
• Executor only continues an inherited chat when it is a live chat in the task's workspace; otherwise it starts a fresh chat in that workspace, same as a first message
• Inbox persistence now goes through the shared persistCopilotChatTurn, which gains an optional workspace scope, replacing the hand-copied transaction (and picking up its existing soft-deleted-chat guard)
• Same-workspace replies keep threading, including replies from a different member of the workspace

Type of Change

• Bug fix

Testing

• New thread-scope.integration.ts against real Postgres with real Svix signatures: cross-workspace reply gets no inherited chat, same-workspace reply continues the thread, a message id already received by another workspace's inbox is still accepted, and a task carrying another workspace's chat runs in a fresh chat of its own workspace with the foreign transcript untouched. The first, third, and fourth fail on the pre-fix code; the second is the positive control
• executor.test.ts, route.test.ts, messages-store.test.ts pass locally; biome clean on changed files
• Verified against existing data that no current task threads across workspaces or carries a chat outside its workspace, so the change drops nothing that exists today
• Full lint/type-check/audits/integration left to CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 10, 2026 7:58pm UTC

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge, with no new actionable issues found.

Summary

The PR keeps inbox replies and saved chat turns inside the receiving workspace.

• Inbox replies stay in the workspace that received them.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Incoming email] --> B[Find receiving workspace]
  B --> C[Check duplicate and parent task within workspace]
  C --> D[Claim task and check inherited chat]
  D --> E{Live chat in task workspace?}
  E -->|Yes| F[Continue chat]
  E -->|No| G[Create fresh chat]
  F --> H[Run inbox task]
  G --> H
  H --> I[Save turn only to live chat in workspace]

Loading

_{Reviews (2) · Last reviewed commit: "fix(inbox): resolve the inherited chat i..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 5 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Turn on auto-fix | Re-trigger cubic</sub>