@vellumai/assistant 0.11.0-staging.2 → 0.11.0

package/src/messaging/providers/slack/deep-link.test.ts

@@ -0,0 +1,91 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  buildSlackMessageDeepLinks,
+  buildSlackWebChannelUrl,
+} from "./deep-link.js";
+
+describe("buildSlackMessageDeepLinks", () => {
+  test("builds workspace-branded links when team identity is configured", () => {
+    expect(
+      buildSlackMessageDeepLinks({
+        teamId: "T123",
+        teamUrl: "https://example.slack.com",
+        channelId: "C123",
+        messageTs: "1710000000.000200",
+        threadTs: "1710000000.000100",
+      }),
+    ).toEqual({
+      appUrl: "slack://channel?team=T123&id=C123&message=1710000000.000200",
+      webUrl:
+        "https://example.slack.com/archives/C123/p1710000000000200?thread_ts=1710000000.000100&cid=C123",
+    });
+  });
+
+  test("falls back to the workspace-agnostic permalink without a teamUrl", () => {
+    expect(
+      buildSlackMessageDeepLinks({
+        teamId: "",
+        teamUrl: "",
+        channelId: "C123",
+        messageTs: "1710000000.000200",
+        threadTs: "1710000000.000100",
+      }),
+    ).toEqual({
+      webUrl:
+        "https://slack.com/archives/C123/p1710000000000200?thread_ts=1710000000.000100&cid=C123",
+    });
+  });
+
+  test("fallback permalink omits thread params for a thread root", () => {
+    expect(
+      buildSlackMessageDeepLinks({
+        channelId: "C123",
+        messageTs: "1710000000.000100",
+        threadTs: "1710000000.000100",
+      }),
+    ).toEqual({
+      webUrl: "https://slack.com/archives/C123/p1710000000000100",
+    });
+  });
+
+  test("keeps the slack:// app link when only the teamUrl is missing", () => {
+    expect(
+      buildSlackMessageDeepLinks({
+        teamId: "T123",
+        channelId: "C123",
+        messageTs: "1710000000.000100",
+      }),
+    ).toEqual({
+      appUrl: "slack://channel?team=T123&id=C123&message=1710000000.000100",
+      webUrl: "https://slack.com/archives/C123/p1710000000000100",
+    });
+  });
+
+  test("rejects a non-https teamUrl and falls back to slack.com", () => {
+    expect(
+      buildSlackMessageDeepLinks({
+        teamUrl: "http://example.slack.com",
+        channelId: "C123",
+        messageTs: "1710000000.000100",
+      }).webUrl,
+    ).toBe("https://slack.com/archives/C123/p1710000000000100");
+  });
+});
+
+describe("buildSlackWebChannelUrl", () => {
+  test("uses the workspace URL when configured", () => {
+    expect(
+      buildSlackWebChannelUrl({
+        teamUrl: "https://example.slack.com",
+        channelId: "C123",
+      }),
+    ).toBe("https://example.slack.com/archives/C123");
+  });
+
+  test("falls back to slack.com without a teamUrl", () => {
+    expect(buildSlackWebChannelUrl({ channelId: "C123" })).toBe(
+      "https://slack.com/archives/C123",
+    );
+  });
+});

package/src/messaging/providers/slack/deep-link.ts

@@ -94,28 +94,47 @@ export function buildSlackPermalink(params: {
   );
 }
 
+/**
+ * Web URL for a channel. Workspace-branded when the team URL is known,
+ * otherwise the workspace-agnostic `https://slack.com/archives/…` form —
+ * Slack resolves the channel id to the right workspace for any
+ * authenticated viewer (the web client already synthesizes this exact
+ * shape from message permalinks, see `getSlackChannelLinkFromMessageLink`
+ * in `clients/web`).
+ */
 export function buildSlackWebChannelUrl(params: {
   teamUrl?: string | null;
   channelId: string;
-}): string | undefined {
-  const teamUrl = normalizeSlackTeamUrl(params.teamUrl);
-  if (!teamUrl) return undefined;
-
+}): string {
+  const teamUrl = normalizeSlackTeamUrl(params.teamUrl) ?? "https://slack.com";
   return `${teamUrl}/archives/${encodeURIComponent(params.channelId)}`;
 }
 
+/**
+ * Deep-link pair for a message. The web URL always exists: it is
+ * workspace-branded when the team URL is configured and otherwise falls
+ * back to the workspace-agnostic `buildSlackPermalink` form, so installs
+ * that never learned their workspace identity (e.g. gateway-connected
+ * Slack) still get working links. The `slack://` app URL still requires
+ * a known team id.
+ */
 export function buildSlackMessageDeepLinks(params: {
   teamId?: string | null;
   teamUrl?: string | null;
   channelId: string;
   messageTs: string;
   threadTs?: string;
-}): SlackMessageDeepLinks | undefined {
+}): SlackMessageDeepLinks {
   const appUrl = buildSlackAppMessageUrl(params);
-  const webUrl = buildSlackWebMessageUrl(params);
-  if (!appUrl && !webUrl) return undefined;
+  const webUrl =
+    buildSlackWebMessageUrl(params) ??
+    buildSlackPermalink({
+      channelId: params.channelId,
+      messageTs: params.messageTs,
+      ...(params.threadTs ? { threadTs: params.threadTs } : {}),
+    });
   return {
     ...(appUrl ? { appUrl } : {}),
-    ...(webUrl ? { webUrl } : {}),
+    webUrl,
   };
 }

package/src/plugins/defaults/memory/src/memory-item-routes.test.ts

@@ -1407,5 +1407,27 @@ describe("Memory Item Routes", () => {
       };
       expect(body.graph_supported).toBe(false);
     });
+
+    // `tier` is what lets a client explain an unavailable graph instead of
+    // stating a bare "not available": the opt-out and a legacy engine are
+    // different problems with different fixes.
+    test.each([
+      ["off", { enabled: false, v3: { live: true } }],
+      ["v3", { enabled: true, v3: { live: true } }],
+      ["v2", { enabled: true, v2: { enabled: true }, v3: { live: false } }],
+      ["v1", { enabled: true, v2: { enabled: false }, v3: { live: false } }],
+    ] as const)("reports tier %s", async (tier, memory) => {
+      setConfig("memory", memory);
+      const res = await callHandler(route);
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as {
+        tier: string;
+        graph_supported: boolean;
+      };
+      expect(body.tier).toBe(tier);
+      // The capability bit and its explanation are derived from the same gate,
+      // so they can never disagree.
+      expect(body.graph_supported).toBe(tier === "v3");
+    });
   });
 });

package/src/plugins/defaults/memory/src/memory-item-routes.ts

@@ -32,6 +32,7 @@ import {
 import { z } from "zod";
 
 import { getConfig } from "../../../../config/loader.js";
+import { type MemoryTier, memoryTier } from "../../../../config/memory-tier.js";
 import {
   isV3TierActive,
   usesConceptPageMemory,
@@ -523,13 +524,24 @@ function handleGetMemoryItem(id: string) {
  * `GET /memory-graph` returns `supported: true` (memory enabled + v3 live). It
  * is a cheap config read (no page I/O), so glanceable surfaces can gate the
  * graph entry point on real availability without triggering the graph build.
+ *
+ * `tier` reports WHY the graph is or isn't available, so a client can say
+ * something true instead of a bare "not available": `"off"` is the user's own
+ * Memory opt-out (fixed in Settings), while `"v1"`/`"v2"` are legacy engines
+ * (fixed by migrating to v3). Both bits derive from the same gate predicates —
+ * `graph_supported` is exactly `tier === "v3"` (see `memory-tier.ts`) — so the
+ * capability and its explanation can never disagree.
  */
 async function handleGetMemoryStats(
   config: AssistantConfig,
-): Promise<{ concepts: number; graph_supported: boolean }> {
+): Promise<{ concepts: number; graph_supported: boolean; tier: MemoryTier }> {
   const pageIndex = await getPageIndex(getWorkspaceDir());
   const concepts = pageIndex.entries.filter((e) => e.modifiedAt > 0).length;
-  return { concepts, graph_supported: isV3TierActive(config) };
+  return {
+    concepts,
+    graph_supported: isV3TierActive(config),
+    tier: memoryTier(config),
+  };
 }
 
 async function handleCreateMemoryItem(body: Record<string, unknown>) {
@@ -864,7 +876,9 @@ export const ROUTES: RouteDefinition[] = [
       "concept pages only and never builds the memory-concept graph. Also " +
       "reports graph_supported: whether the memory-concept graph is available " +
       "for this assistant (memory enabled and v3 live), so callers can gate " +
-      "the graph entry point without building the graph.",
+      "the graph entry point without building the graph, plus tier: the coarse " +
+      "memory tier explaining why the graph is unavailable (off = the user's " +
+      "Memory opt-out, v1/v2 = a legacy engine that has not migrated to v3).",
     tags: ["memory"],
     responseBody: z.object({
       concepts: z.number().describe("Number of concept pages in memory"),
@@ -873,6 +887,11 @@ export const ROUTES: RouteDefinition[] = [
         .describe(
           "Whether the memory-concept graph is available (memory enabled and v3 live)",
         ),
+      tier: z
+        .enum(["off", "v1", "v2", "v3"])
+        .describe(
+          "Coarse memory tier for this assistant; graph_supported is exactly tier === 'v3'",
+        ),
     }),
     handler: () => handleGetMemoryStats(getConfig()),
   },

package/src/runtime/channel-readiness-service.ts

@@ -140,14 +140,12 @@ async function checkCredential(
 }
 
 /** Check that public ingress is configured and enabled. */
-function checkIngress(
+async function checkIngress(
   allowManagedCallbacks = false,
   options: { twilio?: boolean } = {},
-): ReadinessCheckResult {
-  const { configured, usesManagedCallbacks } = hasWebhookRoutingConfigured(
-    allowManagedCallbacks,
-    options,
-  );
+): Promise<ReadinessCheckResult> {
+  const { configured, usesManagedCallbacks } =
+    await hasWebhookRoutingConfigured(allowManagedCallbacks, options);
   return check(
     "ingress",
     configured,
@@ -173,7 +171,7 @@ const voiceProbe: ChannelProbe = {
   async runLocalChecks(): Promise<ReadinessCheckResult[]> {
     const hasCreds = await hasTwilioCredentials();
     const hasPhone = !!resolveTwilioPhoneNumber();
-    const ingress = checkIngress(true, { twilio: true });
+    const ingress = await checkIngress(true, { twilio: true });
 
     return [
       check(
@@ -211,7 +209,7 @@ const telegramProbe: ChannelProbe = {
         "webhook_secret",
         "Telegram webhook secret",
       ),
-      checkIngress(true),
+      await checkIngress(true),
     ];
   },
 };
@@ -234,7 +232,7 @@ const emailProbe: ChannelProbe = {
         "Email invite code redemption is enabled",
         "Email invite code redemption is disabled",
       ),
-      checkIngress(),
+      await checkIngress(),
     ];
   },
   async runRemoteChecks(): Promise<ReadinessCheckResult[]> {
@@ -307,7 +305,7 @@ const whatsappProbe: ChannelProbe = {
         "WhatsApp invite code redemption is enabled",
         "WhatsApp invite code redemption is disabled",
       ),
-      checkIngress(),
+      await checkIngress(),
     ];
   },
 };

package/src/runtime/routes/webhook-routes.ts

@@ -19,7 +19,7 @@ import {
 } from "../../inbound/platform-callback-registration.js";
 import {
   getPublicBaseUrl,
-  type IngressConfig,
+  isPublicIngressDisabled,
 } from "../../inbound/public-ingress-urls.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
@@ -101,18 +101,6 @@ async function registerWithPlatform(
   return { callbackUrl, type, path: webhookPath, mode: "platform" };
 }
 
-/**
- * True when the user has explicitly switched public ingress off.
- *
- * An explicit opt-out is a decision not to accept inbound webhooks at all, so
- * it must not be silently routed around via platform callbacks. An *absent*
- * ingress config is merely "not set up yet" and is eligible for the platform
- * fallback.
- */
-function isPublicIngressDisabled(config: IngressConfig): boolean {
-  return config.ingress?.enabled === false;
-}
-
 // ---------------------------------------------------------------------------
 // Handlers
 // ---------------------------------------------------------------------------

package/src/telegram/__tests__/webhook-health.test.ts

@@ -4,10 +4,14 @@ import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
 const secureKeyValues = new Map<string, string>();
 
-let webhookRouting: { configured: boolean; usesManagedCallbacks: boolean } = {
-  configured: true,
-  usesManagedCallbacks: false,
-};
+// Webhook routing is driven through its real inputs rather than by mocking
+// `hasWebhookRoutingConfigured` itself. Stubbing the predicate would have let
+// the sweep and the predicate drift apart unnoticed, which is exactly how
+// LUM-2882 stayed invisible: the predicate stopped matching what
+// `webhooks register` actually does for platform-connected local assistants.
+let ingressConfig: Record<string, unknown> = {};
+let isPlatform = false;
+let platformContextEnabled = false;
 
 type FetchOutcome =
   | { kind: "json"; status?: number; body: unknown }
@@ -34,11 +38,6 @@ mock.module("../../security/credential-key.js", () => ({
     `credential/${service}/${field}`,
 }));
 
-mock.module("../../config/webhook-routing.js", () => ({
-  hasWebhookRoutingConfigured: () => webhookRouting,
-  hasIngressConfigured: () => webhookRouting.configured,
-}));
-
 mock.module("../bot-username.js", () => ({
   getTelegramBotUsername: () => "test_bot",
   getTelegramBotId: () => "123",
@@ -46,8 +45,33 @@ mock.module("../bot-username.js", () => ({
 
 let apiBaseUrl = "https://api.telegram.org";
 
+// Spread the real modules below: these are broad barrels shared with peer test
+// files, and replacing one wholesale drops the exports those files import.
+const actualLoader = await import("../../config/loader.js");
 mock.module("../../config/loader.js", () => ({
-  getConfig: () => ({ telegram: { apiBaseUrl } }),
+  ...actualLoader,
+  getConfig: () => ({ telegram: { apiBaseUrl }, ingress: ingressConfig }),
+  loadRawConfig: () => ({ ingress: ingressConfig }),
+}));
+
+const actualEnvRegistry = await import("../../config/env-registry.js");
+mock.module("../../config/env-registry.js", () => ({
+  ...actualEnvRegistry,
+  getIsPlatform: () => isPlatform,
+}));
+
+const actualRegistration =
+  await import("../../inbound/platform-callback-registration.js");
+mock.module("../../inbound/platform-callback-registration.js", () => ({
+  ...actualRegistration,
+  resolvePlatformCallbackRegistrationContext: async () => ({
+    isPlatform,
+    platformBaseUrl: "https://api.vellum.ai",
+    assistantId: platformContextEnabled ? "assistant-123" : "",
+    hasAssistantApiKey: platformContextEnabled,
+    authHeader: platformContextEnabled ? "Api-Key secret" : null,
+    enabled: platformContextEnabled,
+  }),
 }));
 
 // Mirrors the real `emitNotificationSignal` contract: it swallows pipeline
@@ -121,7 +145,9 @@ beforeEach(() => {
   secureKeyValues.clear();
   secureKeyValues.set(BOT_TOKEN_KEY, "12345:test-token");
   secureKeyValues.set(WEBHOOK_SECRET_KEY, "s3cret");
-  webhookRouting = { configured: true, usesManagedCallbacks: false };
+  ingressConfig = { publicBaseUrl: "https://example.test" };
+  isPlatform = false;
+  platformContextEnabled = false;
   setWebhookInfo({ url: WEBHOOK_URL, pending_update_count: 0 });
   fetchCallCount = 0;
   fetchedUrls.length = 0;
@@ -158,7 +184,20 @@ describe("gating", () => {
   });
 
   test("does not run when no webhook routing is configured", async () => {
-    webhookRouting = { configured: false, usesManagedCallbacks: false };
+    ingressConfig = {};
+
+    const result = await runTelegramWebhookHealthCheck();
+
+    expect(result.status).toBe("skipped");
+    expect(fetchCallCount).toBe(0);
+    expect(emittedSignals).toHaveLength(0);
+  });
+
+  test("does not run when public ingress is explicitly disabled", async () => {
+    // An opt-out means no inbound webhook is expected at all, so the sweep has
+    // nothing to verify even though platform credentials are present.
+    ingressConfig = { enabled: false };
+    platformContextEnabled = true;
 
     const result = await runTelegramWebhookHealthCheck();
 
@@ -167,8 +206,32 @@ describe("gating", () => {
     expect(emittedSignals).toHaveLength(0);
   });
 
+  test("runs for a platform-connected local assistant with no ingress", async () => {
+    // LUM-2882: `webhooks register telegram` registers a platform callback
+    // route in this exact configuration, so a broken registration is real and
+    // the sweep has to verify it rather than skip.
+    ingressConfig = {};
+    platformContextEnabled = true;
+    setWebhookInfo({
+      url: WEBHOOK_URL,
+      last_error_date: unixSecondsAgo(30),
+      last_error_message: "Wrong response from the webhook: 404 Not Found",
+    });
+
+    const result = await runTelegramWebhookHealthCheck();
+
+    expect(result.status).toBe("delivery_failing");
+    expect(fetchCallCount).toBeGreaterThan(0);
+    expect(emittedSignals).toHaveLength(1);
+    // The callback route is platform-owned, so the self-hosted remediation
+    // (point config at a new tunnel URL) does not apply.
+    expect(result.detail).not.toContain("assistant config set");
+    expect(result.detail).toContain("contact support");
+  });
+
   test("runs when platform-managed callbacks stand in for public ingress", async () => {
-    webhookRouting = { configured: true, usesManagedCallbacks: true };
+    isPlatform = true;
+    ingressConfig = {};
     setWebhookInfo({
       url: WEBHOOK_URL,
       last_error_date: unixSecondsAgo(30),

package/src/telegram/webhook-health.ts

@@ -191,7 +191,7 @@ export async function checkTelegramWebhookHealth(): Promise<TelegramWebhookHealt
   }
 
   const { configured, usesManagedCallbacks } =
-    hasWebhookRoutingConfigured(true);
+    await hasWebhookRoutingConfigured(true);
   if (!configured) {
     return {
       status: "skipped",