@vellumai/assistant 0.11.0-staging.2 → 0.11.0

package/src/config/__tests__/webhook-routing.test.ts

@@ -0,0 +1,229 @@
+/**
+ * Unit tests for `hasWebhookRoutingConfigured`'s resolution order (LUM-2882).
+ *
+ * The predicate has to agree with `handleWebhooksRegister` in
+ * `runtime/routes/webhook-routes.ts` tier for tier. Where they disagree, the
+ * status surfaces (channel readiness, the Telegram webhook health sweep) report
+ * a state the registration path contradicts, which hides a broken registration
+ * instead of surfacing it. The tier cases here mirror the ones in
+ * `runtime/routes/__tests__/webhook-routes.test.ts`.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+let isPlatform = false;
+let rawConfig: Record<string, unknown> = {};
+let platformContextEnabled = false;
+
+// Spread the real modules: these are broad barrels and replacing them wholesale
+// breaks unrelated importers pulled in by the module under test.
+const actualEnvRegistry = await import("../env-registry.js");
+mock.module("../env-registry.js", () => ({
+  ...actualEnvRegistry,
+  getIsPlatform: () => isPlatform,
+}));
+
+const actualLoader = await import("../loader.js");
+mock.module("../loader.js", () => ({
+  ...actualLoader,
+  loadRawConfig: () => rawConfig,
+  getConfig: () => rawConfig,
+}));
+
+const actualRegistration =
+  await import("../../inbound/platform-callback-registration.js");
+mock.module("../../inbound/platform-callback-registration.js", () => ({
+  ...actualRegistration,
+  resolvePlatformCallbackRegistrationContext: async () => ({
+    isPlatform,
+    platformBaseUrl: "https://api.vellum.ai",
+    assistantId: platformContextEnabled ? "assistant-123" : "",
+    hasAssistantApiKey: platformContextEnabled,
+    authHeader: platformContextEnabled ? "Api-Key secret" : null,
+    enabled: platformContextEnabled,
+  }),
+}));
+
+const { hasIngressConfigured, hasWebhookRoutingConfigured } =
+  await import("../webhook-routing.js");
+
+describe("hasWebhookRoutingConfigured resolution order", () => {
+  beforeEach(() => {
+    isPlatform = false;
+    rawConfig = {};
+    platformContextEnabled = false;
+  });
+
+  // ── Tier 1: platform pods ────────────────────────────────────────────────
+
+  test("platform pods use managed callbacks", async () => {
+    isPlatform = true;
+
+    expect(await hasWebhookRoutingConfigured(true)).toEqual({
+      configured: true,
+      usesManagedCallbacks: true,
+    });
+  });
+
+  test("platform pods report managed even with an ingress URL configured", async () => {
+    isPlatform = true;
+    rawConfig = { ingress: { publicBaseUrl: "https://tunnel.example.com" } };
+
+    // `handleWebhooksRegister` registers with the platform gateway before it
+    // ever reads the ingress config on a pod, so reporting the ingress URL
+    // here would name a URL no webhook is actually registered against.
+    expect(await hasWebhookRoutingConfigured(true)).toEqual({
+      configured: true,
+      usesManagedCallbacks: true,
+    });
+  });
+
+  // ── Tier 2: a configured ingress wins ────────────────────────────────────
+
+  test("ingress beats the platform-connected fallback", async () => {
+    platformContextEnabled = true;
+    rawConfig = { ingress: { publicBaseUrl: "https://tunnel.example.com" } };
+
+    // Any logged-in local assistant holds platform credentials for the LLM
+    // proxy, so credential presence must not reroute an explicitly configured
+    // self-hosted webhook through the platform.
+    expect(await hasWebhookRoutingConfigured(true)).toEqual({
+      configured: true,
+      usesManagedCallbacks: false,
+    });
+  });
+
+  test("the twilio option resolves ingress before the fallback too", async () => {
+    platformContextEnabled = true;
+    rawConfig = { ingress: { publicBaseUrl: "https://twilio.example.com" } };
+
+    expect(await hasWebhookRoutingConfigured(true, { twilio: true })).toEqual({
+      configured: true,
+      usesManagedCallbacks: false,
+    });
+  });
+
+  test("the twilio option falls back to managed callbacks with no ingress", async () => {
+    platformContextEnabled = true;
+
+    expect(await hasWebhookRoutingConfigured(true, { twilio: true })).toEqual({
+      configured: true,
+      usesManagedCallbacks: true,
+    });
+  });
+
+  // ── Tier 3: platform-connected fallback ──────────────────────────────────
+
+  test("a platform-connected assistant with no ingress uses managed callbacks", async () => {
+    platformContextEnabled = true;
+
+    // The LUM-2882 case: `webhooks register` hands back a platform callback
+    // URL here, so the status surfaces must not report missing ingress.
+    expect(await hasWebhookRoutingConfigured(true)).toEqual({
+      configured: true,
+      usesManagedCallbacks: true,
+    });
+  });
+
+  test("the fallback applies when the ingress URL is present but empty", async () => {
+    platformContextEnabled = true;
+    rawConfig = { ingress: { publicBaseUrl: "" } };
+
+    expect(await hasWebhookRoutingConfigured(true)).toEqual({
+      configured: true,
+      usesManagedCallbacks: true,
+    });
+  });
+
+  test("an explicit ingress.enabled false blocks the fallback", async () => {
+    platformContextEnabled = true;
+    rawConfig = { ingress: { enabled: false } };
+
+    // Opting out is a decision not to accept inbound webhooks at all, not an
+    // invitation to route them through the platform instead.
+    expect(await hasWebhookRoutingConfigured(true)).toEqual({
+      configured: false,
+      usesManagedCallbacks: false,
+    });
+  });
+
+  test("ingress.enabled false blocks the fallback even with a URL configured", async () => {
+    platformContextEnabled = true;
+    rawConfig = {
+      ingress: { enabled: false, publicBaseUrl: "https://tunnel.example.com" },
+    };
+
+    expect(await hasWebhookRoutingConfigured(true)).toEqual({
+      configured: false,
+      usesManagedCallbacks: false,
+    });
+  });
+
+  // ── Tier 4: nothing configured ───────────────────────────────────────────
+
+  test("no ingress and no platform connectivity is not configured", async () => {
+    expect(await hasWebhookRoutingConfigured(true)).toEqual({
+      configured: false,
+      usesManagedCallbacks: false,
+    });
+  });
+
+  // ── allowManagedCallbacks gating ─────────────────────────────────────────
+
+  test("allowManagedCallbacks false hides the platform-connected fallback", async () => {
+    platformContextEnabled = true;
+
+    // Channels that can only be served by a self-hosted ingress pass `false`
+    // and must never be told a managed route stands in for one.
+    expect(await hasWebhookRoutingConfigured(false)).toEqual({
+      configured: false,
+      usesManagedCallbacks: false,
+    });
+  });
+
+  test("allowManagedCallbacks false hides the platform-pod tier", async () => {
+    isPlatform = true;
+
+    expect(await hasWebhookRoutingConfigured(false)).toEqual({
+      configured: false,
+      usesManagedCallbacks: false,
+    });
+  });
+
+  test("allowManagedCallbacks false still honors a configured ingress", async () => {
+    rawConfig = { ingress: { publicBaseUrl: "https://tunnel.example.com" } };
+
+    expect(await hasWebhookRoutingConfigured(false)).toEqual({
+      configured: true,
+      usesManagedCallbacks: false,
+    });
+  });
+});
+
+describe("hasIngressConfigured", () => {
+  beforeEach(() => {
+    isPlatform = false;
+    rawConfig = {};
+    platformContextEnabled = false;
+  });
+
+  test("is unaffected by platform connectivity", () => {
+    platformContextEnabled = true;
+
+    expect(hasIngressConfigured()).toBe(false);
+  });
+
+  test("treats an unset enabled flag with a URL as enabled", () => {
+    rawConfig = { ingress: { publicBaseUrl: "https://tunnel.example.com" } };
+
+    expect(hasIngressConfigured()).toBe(true);
+  });
+
+  test("treats an explicit enabled false as not configured", () => {
+    rawConfig = {
+      ingress: { enabled: false, publicBaseUrl: "https://tunnel.example.com" },
+    };
+
+    expect(hasIngressConfigured()).toBe(false);
+  });
+});

package/src/config/webhook-routing.ts

@@ -14,8 +14,10 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "@vellumai/service-contracts/twilio-ingress";
 
+import { resolvePlatformCallbackRegistrationContext } from "../inbound/platform-callback-registration.js";
+import { isPublicIngressDisabled } from "../inbound/public-ingress-urls.js";
 import { getIsPlatform } from "./env-registry.js";
-import { loadRawConfig } from "./loader.js";
+import { getConfig, loadRawConfig } from "./loader.js";
 
 /**
  * True when a public ingress base URL is set and ingress is enabled.
@@ -43,25 +45,64 @@ export function hasIngressConfigured(
 }
 
 /**
- * True when inbound webhooks have somewhere to land: either a self-hosted
- * public ingress URL, or — when `allowManagedCallbacks` is set and this is a
- * platform deployment — the platform's managed callback routes.
+ * True when the user has explicitly switched public ingress off.
+ *
+ * Reads the validated config rather than the raw file so the check matches
+ * what `getPublicBaseUrl` enforces. A config that fails to load is treated as
+ * "not explicitly disabled": absence of a decision is not an opt-out.
  */
-export function hasWebhookRoutingConfigured(
+function isIngressExplicitlyDisabled(): boolean {
+  try {
+    return isPublicIngressDisabled(getConfig());
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * True when inbound webhooks have somewhere to land.
+ *
+ * Mirrors the resolution order `handleWebhooksRegister` uses in
+ * `runtime/routes/webhook-routes.ts`, because the two must agree: a probe that
+ * reports "no ingress" while `webhooks register` hands back a working callback
+ * URL hides a broken registration instead of surfacing it.
+ *
+ *   1. **Platform pods** (`IS_PLATFORM`) always use managed callbacks.
+ *   2. **A configured public ingress wins** for everyone else.
+ *   3. **Platform-connected assistants with no ingress** fall back to managed
+ *      callbacks. Connectivity is decided by credentials (platform base URL +
+ *      assistant ID + assistant API key), not by `IS_PLATFORM`, which is only
+ *      ever true on a platform pod.
+ *   4. Otherwise nothing is configured.
+ *
+ * Ingress deliberately precedes the platform fallback: any logged-in local
+ * assistant holds platform credentials for the LLM proxy, so treating
+ * credential presence as "managed" would misreport an explicitly configured
+ * self-hosted webhook as platform-routed. An explicit `ingress.enabled: false`
+ * is a decision not to accept inbound webhooks at all and blocks the fallback.
+ *
+ * `allowManagedCallbacks` gates both platform tiers: channels that can only be
+ * served by a self-hosted ingress pass `false` and never see them.
+ */
+export async function hasWebhookRoutingConfigured(
   allowManagedCallbacks = false,
   options: { twilio?: boolean } = {},
-): {
+): Promise<{
   configured: boolean;
   usesManagedCallbacks: boolean;
-} {
-  const ingressConfigured = hasIngressConfigured(options);
-  if (ingressConfigured) {
+}> {
+  if (allowManagedCallbacks && getIsPlatform()) {
+    return { configured: true, usesManagedCallbacks: true };
+  }
+
+  if (hasIngressConfigured(options)) {
     return { configured: true, usesManagedCallbacks: false };
   }
 
-  const usesManagedCallbacks = allowManagedCallbacks && getIsPlatform();
-  return {
-    configured: usesManagedCallbacks,
-    usesManagedCallbacks,
-  };
+  if (!allowManagedCallbacks || isIngressExplicitlyDisabled()) {
+    return { configured: false, usesManagedCallbacks: false };
+  }
+
+  const { enabled } = await resolvePlatformCallbackRegistrationContext();
+  return { configured: enabled, usesManagedCallbacks: enabled };
 }

package/src/daemon/handlers/config-telegram.ts

@@ -1,12 +1,12 @@
 import { z } from "zod";
 
-import { getIsPlatform } from "../../config/env-registry.js";
 import {
   invalidateConfigCache,
   loadRawConfig,
   saveRawConfig,
   setNestedValue,
 } from "../../config/loader.js";
+import { hasWebhookRoutingConfigured } from "../../config/webhook-routing.js";
 import { registerCallbackRoute } from "../../inbound/platform-callback-registration.js";
 import {
   ensureManualTokenConnection,
@@ -249,12 +249,17 @@ export async function setTelegramConfig(
     hasWebhookSecret,
   };
 
-  // When containerized with a platform, register the Telegram callback
-  // route so the platform knows how to forward Telegram webhooks.
-  // This must happen independently of effectiveUrl — in containerized
-  // deployments without ingress.publicBaseUrl, platform callbacks are the
-  // only way to receive Telegram webhooks.
-  if (getIsPlatform()) {
+  // Register the Telegram callback route so the platform knows how to
+  // forward Telegram webhooks. This applies whenever webhooks are delivered
+  // via managed callbacks: platform pods, and platform-connected local
+  // assistants with no public ingress. For both, platform callbacks are the
+  // only way to receive Telegram webhooks. `hasWebhookRoutingConfigured`
+  // encodes the resolution order (a configured ingress wins; an explicit
+  // `ingress.enabled: false` blocks the platform fallback) and is the same
+  // derivation the Telegram status checks read, so registration and reported
+  // status stay in agreement.
+  const { usesManagedCallbacks } = await hasWebhookRoutingConfigured(true);
+  if (usesManagedCallbacks) {
     registerCallbackRoute("webhooks/telegram", "telegram").catch((err) => {
       log.warn({ err }, "Failed to register Telegram platform callback route");
     });

package/src/inbound/platform-callback-registration.ts

@@ -21,6 +21,7 @@ import { getIsPlatform } from "../config/env-registry.js";
 import { credentialKey } from "../security/credential-key.js";
 import { getSecureKeyAsync } from "../security/secure-keys.js";
 import { getLogger } from "../util/logger.js";
+import { PublicIngressDisabledError } from "./public-ingress-urls.js";
 
 const log = getLogger("platform-callback-registration");
 
@@ -151,18 +152,35 @@ export async function registerCallbackRoute(
 }
 
 /**
- * Resolve a callback URL, registering with the platform when platform-managed.
+ * Resolve a callback URL, registering with the platform when appropriate.
  *
- * When platform callbacks are enabled, registers the route and returns the
- * platform's stable callback URL (optionally with query parameters appended).
- * Otherwise evaluates the lazy direct URL supplier and returns that value.
+ * Resolution order, matching `handleWebhooksRegister` in
+ * `runtime/routes/webhook-routes.ts` and `hasWebhookRoutingConfigured` in
+ * `config/webhook-routing.ts`:
+ *
+ *   1. **Platform pods** (`IS_PLATFORM`) always register with the platform
+ *      gateway: they have no ingress of their own to advertise.
+ *   2. **A configured public ingress wins** for everyone else, so the direct
+ *      supplier is tried first and its value returned when it resolves.
+ *   3. **Platform-connected assistants with no ingress** register with the
+ *      platform gateway rather than surfacing the direct builder's error.
+ *      Connectivity is decided by credentials (platform base URL + assistant
+ *      ID + assistant API key), not by `IS_PLATFORM`, which is only ever true
+ *      on a platform pod.
+ *
+ * An explicit `ingress.enabled: false` is a decision not to accept inbound
+ * webhooks at all, so `PublicIngressDisabledError` propagates instead of being
+ * routed around. Ingress precedes the platform fallback because any logged-in
+ * local assistant holds platform credentials for the LLM proxy: treating
+ * credential presence as "managed" would silently reroute an explicitly
+ * configured self-hosted callback through the platform.
  *
  * The `directUrl` parameter is a **lazy supplier** (a function returning a
  * string) rather than an eagerly-evaluated string. This is critical because
  * the direct URL builders (e.g. `getTwilioVoiceWebhookUrl`) call
  * `getPublicBaseUrl()` which throws when no public ingress URL is configured.
- * In platform-managed environments that rely solely on platform callbacks, the
- * direct URL is never needed — deferring evaluation avoids the throw.
+ * On a platform pod the direct URL is never needed, and deferring evaluation
+ * avoids the throw.
  *
  * @param directUrl - Lazy supplier for the direct callback URL.
  * @param callbackPath - The path to register (e.g. "webhooks/twilio/voice").
@@ -179,7 +197,22 @@ export async function resolveCallbackUrl(
   sourceIdentifier?: string,
 ): Promise<string> {
   if (!getIsPlatform()) {
-    return directUrl();
+    let ingressError: unknown;
+    try {
+      return directUrl();
+    } catch (err) {
+      if (err instanceof PublicIngressDisabledError) {
+        throw err;
+      }
+      ingressError = err;
+    }
+
+    // No ingress configured. Fall back to the platform gateway when this
+    // assistant is connected to the platform.
+    const context = await resolvePlatformCallbackRegistrationContext();
+    if (!context.enabled) {
+      throw ingressError;
+    }
   }
 
   try {
@@ -191,9 +224,10 @@ export async function resolveCallbackUrl(
     }
     return url;
   } catch (err) {
-    // In platform-managed mode there is no local-ingress fallback and
-    // ngrok is not applicable. Surface a clear error so callers (and the
-    // user) understand this is a platform-side issue, not a tunnel problem.
+    // Registration is only attempted once the local ingress has been ruled
+    // out, so there is nothing left to fall back to. Surface a clear error so
+    // callers (and the user) understand this is a platform-side issue, not a
+    // tunnel problem.
     const detail = err instanceof Error ? err.message : String(err);
     throw new Error(
       `Managed callback route registration failed: ${detail}. ` +

package/src/inbound/public-ingress-urls.ts

@@ -43,11 +43,41 @@ export interface IngressConfig {
   };
 }
 
-function assertPublicIngressEnabled(config: IngressConfig): void {
-  if (config.ingress?.enabled === false) {
-    throw new Error(
+/**
+ * True when the user has explicitly switched public ingress off.
+ *
+ * An explicit opt-out is a decision not to accept inbound webhooks at all, so
+ * it must not be silently routed around via platform callbacks. An *absent*
+ * ingress config is merely "not set up yet" and is eligible for the platform
+ * fallback, so only a literal `false` counts here.
+ *
+ * Every consumer that offers a platform-callback fallback has to consult this
+ * before falling back, which is why it lives here rather than in each caller.
+ */
+export function isPublicIngressDisabled(config: IngressConfig): boolean {
+  return config.ingress?.enabled === false;
+}
+
+/**
+ * Thrown when a URL builder is asked for a URL while ingress is opted out.
+ *
+ * Distinct from the "no URL configured" error so callers with a
+ * platform-callback fallback can tell the two apart: "not set up yet" is
+ * eligible for the fallback, an explicit opt-out is not. Matching on the
+ * message text would break the moment the copy is reworded.
+ */
+export class PublicIngressDisabledError extends Error {
+  constructor() {
+    super(
       "Public ingress is disabled. Ask the assistant to enable it, or update it from the Settings page.",
     );
+    this.name = "PublicIngressDisabledError";
+  }
+}
+
+function assertPublicIngressEnabled(config: IngressConfig): void {
+  if (isPublicIngressDisabled(config)) {
+    throw new PublicIngressDisabledError();
   }
 }
 
@@ -66,11 +96,15 @@ export function getPublicBaseUrl(config: IngressConfig): string {
 
   const ingressValue = config.ingress?.publicBaseUrl;
   const normalizedIngressValue = normalizePublicBaseUrl(ingressValue);
-  if (normalizedIngressValue) return normalizedIngressValue;
+  if (normalizedIngressValue) {
+    return normalizedIngressValue;
+  }
 
   const ingressEnvValue = getIngressPublicBaseUrl();
   const normalizedIngressEnvValue = normalizePublicBaseUrl(ingressEnvValue);
-  if (normalizedIngressEnvValue) return normalizedIngressEnvValue;
+  if (normalizedIngressEnvValue) {
+    return normalizedIngressEnvValue;
+  }
 
   throw new Error(
     "No public base URL configured. Set ingress.publicBaseUrl in config.",
@@ -90,10 +124,7 @@ export function getTwilioVoiceWebhookUrl(
   config: IngressConfig,
   callSessionId?: string,
 ): string {
-  return buildTwilioVoiceWebhookUrl(
-    getPublicBaseUrl(config),
-    callSessionId,
-  );
+  return buildTwilioVoiceWebhookUrl(getPublicBaseUrl(config), callSessionId);
 }
 
 /**

package/src/messaging/providers/slack/binding-metadata.test.ts

@@ -3,9 +3,9 @@ import { beforeEach, describe, expect, test } from "bun:test";
 import { setConfig } from "../../../__tests__/helpers/set-config.js";
 import type { ExternalConversationBinding } from "../../../persistence/external-conversation-store.js";
 
-// Seed the Slack workspace identity that the deep-link builders read. An
-// empty `teamUrl` (schema default) makes the URL builders return undefined,
-// standing in for the "no slack config" case.
+// Seed the Slack workspace identity that the deep-link builders read. Empty
+// `teamId`/`teamUrl` (the schema defaults) stand in for installs that never
+// learned their workspace identity.
 function seedSlack(
   overrides: { teamId?: string; teamUrl?: string } = {},
 ): void {
@@ -55,11 +55,40 @@ describe("buildSlackBindingMetadata sourceLink", () => {
     });
   });
 
-  test("omits sourceLink entirely without slack config", () => {
-    // An empty teamUrl is the schema default — the URL builders return
-    // undefined, so no source link is produced.
-    seedSlack({ teamUrl: "" });
+  test("falls back to workspace-agnostic slack.com links without a teamUrl", () => {
+    // An empty teamUrl is the schema default — e.g. installs whose Slack
+    // connection came through the gateway and never ran the local bot-token
+    // setup. Links must still be produced via the slack.com permalink form.
+    seedSlack({ teamId: "", teamUrl: "" });
     const metadata = buildSlackBindingMetadata(makeBinding({}));
-    expect(metadata.sourceLink).toBeUndefined();
+    expect(metadata.sourceLink).toEqual({
+      webUrl: "https://slack.com/archives/C0CHANNEL",
+    });
+    expect(metadata.slackChannel?.link).toEqual({
+      webUrl: "https://slack.com/archives/C0CHANNEL",
+    });
+  });
+
+  test("thread link falls back to the slack.com permalink without a teamUrl", () => {
+    seedSlack({ teamId: "", teamUrl: "" });
+    const metadata = buildSlackBindingMetadata(
+      makeBinding({ externalThreadId: "1720000000.000100" }),
+    );
+    expect(metadata.slackThread?.link).toEqual({
+      webUrl: "https://slack.com/archives/C0CHANNEL/p1720000000000100",
+    });
+    expect(metadata.sourceLink).toEqual(metadata.slackThread?.link);
+  });
+
+  test("keeps the slack:// app link when only the teamUrl is missing", () => {
+    seedSlack({ teamUrl: "" });
+    const metadata = buildSlackBindingMetadata(
+      makeBinding({ externalThreadId: "1720000000.000100" }),
+    );
+    expect(metadata.slackThread?.link).toEqual({
+      appUrl:
+        "slack://channel?team=T0EXAMPLE&id=C0CHANNEL&message=1720000000.000100",
+      webUrl: "https://slack.com/archives/C0CHANNEL/p1720000000000100",
+    });
   });
 });

package/src/messaging/providers/slack/binding-metadata.ts

@@ -16,8 +16,8 @@ import {
  * (`ChannelBindingMetadata`) — the single source of truth that also drives
  * `openapi.yaml` and the web client's generated types — so this builder cannot
  * drift from the wire contract. Slack is the only channel that can currently
- * produce message-level deep links, because the link inputs (workspace team
- * id/url + a stable per-message timestamp) only exist for Slack.
+ * produce message-level deep links, because the link inputs (a channel id and
+ * a stable per-message timestamp) only exist for Slack.
  */
 export function buildSlackBindingMetadata(
   binding: ExternalConversationBinding,
@@ -26,15 +26,18 @@ export function buildSlackBindingMetadata(
     binding.externalChatName?.trim() || binding.externalChatId;
   const slackConfig = getConfig().slack;
 
-  const threadLink =
-    slackConfig && binding.externalThreadId
-      ? buildSlackMessageDeepLinks({
-          teamId: slackConfig.teamId,
-          teamUrl: slackConfig.teamUrl,
-          channelId: binding.externalChatId,
-          messageTs: binding.externalThreadId,
-        })
-      : undefined;
+  // The deep-link builders fall back to workspace-agnostic slack.com URLs
+  // when the workspace identity (teamId/teamUrl) is not configured — e.g.
+  // installs whose Slack connection came through the gateway and never ran
+  // the local bot-token setup — so links are always produced.
+  const threadLink = binding.externalThreadId
+    ? buildSlackMessageDeepLinks({
+        teamId: slackConfig?.teamId,
+        teamUrl: slackConfig?.teamUrl,
+        channelId: binding.externalChatId,
+        messageTs: binding.externalThreadId,
+      })
+    : undefined;
   const slackThread = binding.externalThreadId
     ? {
         channelId: binding.externalChatId,
@@ -43,17 +46,14 @@ export function buildSlackBindingMetadata(
       }
     : undefined;
 
-  const channelWebUrl = slackConfig
-    ? buildSlackWebChannelUrl({
-        teamUrl: slackConfig.teamUrl,
-        channelId: binding.externalChatId,
-      })
-    : undefined;
+  const channelWebUrl = buildSlackWebChannelUrl({
+    teamUrl: slackConfig?.teamUrl,
+    channelId: binding.externalChatId,
+  });
 
   // Channel-neutral source link: prefer the bound thread, fall back to the
   // channel, so clients land on the most specific source available.
-  const sourceLink =
-    threadLink ?? (channelWebUrl ? { webUrl: channelWebUrl } : undefined);
+  const sourceLink = threadLink ?? { webUrl: channelWebUrl };
 
   return {
     externalChatName,
@@ -61,8 +61,8 @@ export function buildSlackBindingMetadata(
     slackChannel: {
       channelId: binding.externalChatId,
       name: externalChatName,
-      ...(channelWebUrl ? { link: { webUrl: channelWebUrl } } : {}),
+      link: { webUrl: channelWebUrl },
     },
-    ...(sourceLink ? { sourceLink } : {}),
+    sourceLink,
   };
 }