@desplega.ai/agent-swarm 1.173.0 → 2.0.0

package/src/tests/chat-sdk-status-route.test.ts

@@ -0,0 +1,382 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { createServer as createHttpServer, type Server } from "node:http";
+import {
+  startTelegramBotApiMock,
+  type TelegramBotApiMock,
+} from "../../scripts/dev/telegram-bot-api-mock";
+import { closeDb, createAgent, initDb } from "../be/db";
+import { createIntegrationsHandler } from "../http/integrations";
+import { getPathSegments } from "../http/utils";
+import { stopChatRelayWatcher } from "../integrations/chat-sdk/relay";
+import { startChatSdk, stopChatSdk } from "../integrations/chat-sdk/runtime";
+import { snapshotChatSdkEnv, TELEGRAM_SECRET } from "./chat-sdk-harness";
+import { listenOnFreePort } from "./test-net";
+
+/*
+ * GET /api/integrations/chat/status and
+ * POST /api/integrations/chat/telegram/register-webhook.
+ * Telegram runs against the fake Bot API. Slack runs in socket mode against a
+ * stub Web API that answers every method with `invalid_auth`, so the socket
+ * start in `initialize()` fails at once (auth errors are not retried) and the
+ * adapter health is `error`. (Webhook mode only warns on a failed auth.test.)
+ */
+const TEST_DB_PATH = "./test-chat-sdk-status-route.sqlite";
+const PUBLIC_URL = "https://swarm.example.test";
+const BOT_TOKEN = "123456:status-route-test-token";
+const BOOT_ADAPTERS = {
+  telegram: { botToken: BOT_TOKEN, secretToken: TELEGRAM_SECRET, mode: "webhook" },
+  slack: { botToken: "xoxb-status-route", appToken: "xapp-status-route", mode: "socket" },
+};
+/** Configured but never started: `startChatSdk` ran before it was added. */
+const DISCORD_ENTRY = {
+  botToken: "discord-status-route-token",
+  publicKey: "0".repeat(64),
+  applicationId: "123456789012345678",
+};
+
+const restoreEnv = snapshotChatSdkEnv();
+const savedPublicUrl = process.env.PUBLIC_MCP_BASE_URL;
+let server: Server;
+let baseUrl = "";
+let telegram: TelegramBotApiMock;
+let slackStub: ReturnType<typeof Bun.serve>;
+let leadId = "";
+let workerId = "";
+
+async function removeDbFiles(): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    await unlink(`${TEST_DB_PATH}${suffix}`).catch(() => {});
+  }
+}
+
+beforeAll(async () => {
+  await removeDbFiles();
+  initDb(TEST_DB_PATH);
+  leadId = (
+    await createAgent({
+      id: crypto.randomUUID(),
+      name: "StatusRouteLead",
+      isLead: true,
+      status: "idle",
+      capabilities: [],
+    })
+  ).id;
+  workerId = (
+    await createAgent({
+      id: crypto.randomUUID(),
+      name: "StatusRouteWorker",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    })
+  ).id;
+
+  telegram = startTelegramBotApiMock();
+  slackStub = Bun.serve({
+    port: 0,
+    hostname: "127.0.0.1",
+    fetch: () => Response.json({ ok: false, error: "invalid_auth" }),
+  });
+  process.env.PUBLIC_MCP_BASE_URL = PUBLIC_URL;
+  process.env.SLACK_DISABLE = "true";
+  process.env.CHAT_SDK_ENABLED = "true";
+  process.env.CHAT_SDK_ADAPTERS = JSON.stringify(BOOT_ADAPTERS);
+  process.env.CHAT_SDK_API_URL_OVERRIDES = JSON.stringify({
+    telegram: telegram.url,
+    slack: `http://127.0.0.1:${slackStub.port}/api/`,
+  });
+  await startChatSdk();
+  await stopChatRelayWatcher();
+
+  const handler = createIntegrationsHandler();
+  server = createHttpServer(async (req, res) => {
+    const handled = await handler(req, res, getPathSegments(req.url || ""));
+    if (!handled) {
+      res.writeHead(404);
+      res.end("not found");
+    }
+  });
+  baseUrl = `http://127.0.0.1:${await listenOnFreePort(server)}`;
+});
+
+afterAll(async () => {
+  server.close();
+  await stopChatSdk();
+  telegram.stop();
+  slackStub.stop(true);
+  closeDb();
+  await removeDbFiles();
+  restoreEnv();
+  if (savedPublicUrl === undefined) delete process.env.PUBLIC_MCP_BASE_URL;
+  else process.env.PUBLIC_MCP_BASE_URL = savedPublicUrl;
+});
+
+/** Run `fn` with temporary env values, then restore them (undefined deletes). */
+async function withEnv(
+  values: Record<string, string | undefined>,
+  fn: () => Promise<void>,
+): Promise<void> {
+  const saved = Object.fromEntries(Object.keys(values).map((key) => [key, process.env[key]]));
+  for (const [key, value] of Object.entries(values)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+  try {
+    await fn();
+  } finally {
+    for (const [key, value] of Object.entries(saved)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  }
+}
+
+async function getStatus(): Promise<StatusBody> {
+  const res = await fetch(`${baseUrl}/api/integrations/chat/status`);
+  expect(res.status).toBe(200);
+  return (await res.json()) as StatusBody;
+}
+
+async function registerAsLead(): Promise<Response> {
+  return fetch(`${baseUrl}/api/integrations/chat/telegram/register-webhook`, {
+    method: "POST",
+    headers: { "content-type": "application/json", "x-agent-id": leadId },
+    body: "{}",
+  });
+}
+
+interface StatusBody {
+  enabled: boolean;
+  slackClash: boolean;
+  error?: string;
+  adapters: Array<{
+    name: string;
+    configured: boolean;
+    enabled: boolean;
+    health: string;
+    error?: string;
+    webhookUrl: string;
+    mode?: string;
+    guilds?: { count: number; names: string[] };
+  }>;
+}
+
+describe("GET /api/integrations/chat/status", () => {
+  test("reports one ok and one error adapter, webhook URLs, and no secrets", async () => {
+    const res = await fetch(`${baseUrl}/api/integrations/chat/status`);
+    expect(res.status).toBe(200);
+    const text = await res.text();
+    for (const secret of [BOT_TOKEN, TELEGRAM_SECRET, "xoxb-status-route", "xapp-status-route"]) {
+      expect(text).not.toContain(secret);
+    }
+    const body = JSON.parse(text) as StatusBody;
+    expect(body.enabled).toBe(true);
+    expect(body.slackClash).toBe(false);
+    const byName = Object.fromEntries(body.adapters.map((a) => [a.name, a]));
+    expect(Object.keys(byName).sort()).toEqual(["discord", "slack", "teams", "telegram"]);
+
+    expect(byName.telegram).toMatchObject({
+      configured: true,
+      health: "ok",
+      mode: "webhook",
+      webhookUrl: `${PUBLIC_URL}/api/integrations/chat/telegram/webhook`,
+    });
+    expect(byName.telegram?.error).toBeUndefined();
+
+    expect(byName.slack).toMatchObject({ configured: true, health: "error", mode: "socket" });
+    expect(byName.slack?.error).toContain("invalid_auth");
+
+    expect(byName.discord).toMatchObject({
+      configured: false,
+      health: "disabled",
+      webhookUrl: `${PUBLIC_URL}/api/integrations/chat/discord/webhook`,
+    });
+    expect(byName.teams).toMatchObject({ configured: false, health: "disabled" });
+  });
+
+  test("flags the Slack clash when SLACK_DISABLE is not true", async () => {
+    process.env.SLACK_DISABLE = "false";
+    try {
+      const body = (await (
+        await fetch(`${baseUrl}/api/integrations/chat/status`)
+      ).json()) as StatusBody;
+      expect(body.slackClash).toBe(true);
+    } finally {
+      process.env.SLACK_DISABLE = "true";
+    }
+  });
+
+  test("a configured adapter that is not running says it is still starting", async () => {
+    await withEnv(
+      { CHAT_SDK_ADAPTERS: JSON.stringify({ ...BOOT_ADAPTERS, discord: DISCORD_ENTRY }) },
+      async () => {
+        const discord = (await getStatus()).adapters.find((a) => a.name === "discord");
+        expect(discord).toMatchObject({ configured: true, health: "disabled" });
+        expect(discord?.error).toStartWith("The adapter is starting");
+      },
+    );
+  });
+
+  test("a Slack clash blocks boot: the idle adapter says Not started with the cause", async () => {
+    await withEnv(
+      {
+        SLACK_DISABLE: "false",
+        CHAT_SDK_ADAPTERS: JSON.stringify({ ...BOOT_ADAPTERS, discord: DISCORD_ENTRY }),
+      },
+      async () => {
+        const body = await getStatus();
+        expect(body.slackClash).toBe(true);
+        const discord = body.adapters.find((a) => a.name === "discord");
+        expect(discord?.error).toStartWith("Not started: ");
+        expect(discord?.error).toContain("SLACK_DISABLE=true");
+      },
+    );
+  });
+
+  test("a missing $config row makes that adapter incomplete; the others keep running", async () => {
+    const discord = { ...DISCORD_ENTRY, botToken: { $config: "CHAT_SDK_DISCORD_STATUS_MISSING" } };
+    await withEnv(
+      { CHAT_SDK_ADAPTERS: JSON.stringify({ ...BOOT_ADAPTERS, discord }) },
+      async () => {
+        const body = await getStatus();
+        expect(body.error).toBeUndefined();
+        const entry = body.adapters.find((a) => a.name === "discord");
+        expect(entry).toMatchObject({ configured: true, health: "incomplete" });
+        expect(entry?.error).toContain("CHAT_SDK_DISCORD_STATUS_MISSING");
+        expect(entry?.error?.length ?? 0).toBeLessThanOrEqual(300);
+        expect(body.adapters.find((a) => a.name === "telegram")?.health).toBe("ok");
+      },
+    );
+  });
+
+  test("a partial save (required field missing) is incomplete and names the field", async () => {
+    await withEnv(
+      { CHAT_SDK_ADAPTERS: JSON.stringify({ ...BOOT_ADAPTERS, discord: { botToken: "x" } }) },
+      async () => {
+        const body = await getStatus();
+        expect(body.error).toBeUndefined();
+        const entry = body.adapters.find((a) => a.name === "discord");
+        expect(entry).toMatchObject({ configured: true, health: "incomplete" });
+        expect(entry?.error).toBe("CHAT_SDK_ADAPTERS.discord.publicKey: required");
+        expect(entry?.guilds).toBeUndefined();
+      },
+    );
+  });
+
+  test("an entry with enabled: false is configured, not enabled, and says the config is kept", async () => {
+    await withEnv(
+      {
+        CHAT_SDK_ADAPTERS: JSON.stringify({
+          ...BOOT_ADAPTERS,
+          discord: { ...DISCORD_ENTRY, enabled: false },
+        }),
+      },
+      async () => {
+        const body = await getStatus();
+        const entry = body.adapters.find((a) => a.name === "discord");
+        expect(entry).toMatchObject({ configured: true, enabled: false, health: "disabled" });
+        expect(entry?.error).toContain("configuration is kept");
+        expect(body.adapters.find((a) => a.name === "telegram")?.enabled).toBe(true);
+      },
+    );
+  });
+
+  test("a forbidden key blocks boot: Not started with the config error, bounded", async () => {
+    const discord = { ...DISCORD_ENTRY, apiUrl: "http://evil.example" };
+    await withEnv(
+      { CHAT_SDK_ADAPTERS: JSON.stringify({ ...BOOT_ADAPTERS, discord }) },
+      async () => {
+        const body = await getStatus();
+        expect(body.error).toContain("discord.apiUrl");
+        expect(body.error?.length ?? 0).toBeLessThanOrEqual(300);
+        const entry = body.adapters.find((a) => a.name === "discord");
+        expect(entry?.error).toStartWith("Not started: ");
+        expect(entry?.error).toContain("discord.apiUrl");
+      },
+    );
+  });
+
+  test("invalid JSON reports a fixed error without the parser message or the input", async () => {
+    const broken = `{"telegram":{"botToken":"${BOT_TOKEN}",`;
+    await withEnv({ CHAT_SDK_ADAPTERS: broken }, async () => {
+      const res = await fetch(`${baseUrl}/api/integrations/chat/status`);
+      const text = await res.text();
+      expect(text).not.toContain(BOT_TOKEN);
+      expect((JSON.parse(text) as StatusBody).error).toBe("CHAT_SDK_ADAPTERS is not valid JSON");
+    });
+  });
+});
+
+describe("POST /api/integrations/chat/telegram/register-webhook", () => {
+  test("refuses a non-lead agent with 403 and calls no Bot API method", async () => {
+    const before = telegram.calls.length;
+    const res = await fetch(`${baseUrl}/api/integrations/chat/telegram/register-webhook`, {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-agent-id": workerId },
+      body: "{}",
+    });
+    expect(res.status).toBe(403);
+    expect(telegram.calls.slice(before).map((c) => c.method)).not.toContain("setWebhook");
+  });
+
+  test("lead registers the public URL and secret, gets getWebhookInfo back", async () => {
+    const before = telegram.calls.length;
+    const res = await fetch(`${baseUrl}/api/integrations/chat/telegram/register-webhook`, {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-agent-id": leadId },
+      body: "{}",
+    });
+    expect(res.status).toBe(200);
+    const expectedUrl = `${PUBLIC_URL}/api/integrations/chat/telegram/webhook`;
+    const body = (await res.json()) as {
+      webhookUrl: string;
+      webhookInfo: { url: string; pending_update_count?: number };
+    };
+    expect(body.webhookUrl).toBe(expectedUrl);
+    expect(body.webhookInfo.url).toBe(expectedUrl);
+    expect(body.webhookInfo.pending_update_count).toBe(0);
+
+    const calls = telegram.calls.slice(before);
+    expect(calls.map((c) => c.method)).toEqual(["setWebhook", "getWebhookInfo"]);
+    expect(calls[0]?.body).toEqual({ url: expectedUrl, secret_token: TELEGRAM_SECRET });
+  });
+
+  test("400 in polling mode, with no Bot API call", async () => {
+    const before = telegram.calls.length;
+    const adapters = { ...BOOT_ADAPTERS, telegram: { botToken: BOT_TOKEN, mode: "polling" } };
+    await withEnv({ CHAT_SDK_ADAPTERS: JSON.stringify(adapters) }, async () => {
+      const res = await registerAsLead();
+      expect(res.status).toBe(400);
+      expect(((await res.json()) as { error: string }).error).toContain("polling mode");
+    });
+    expect(telegram.calls.length).toBe(before);
+  });
+
+  test("400 says the channel is disabled when CHAT_SDK_ENABLED is false", async () => {
+    const before = telegram.calls.length;
+    await withEnv({ CHAT_SDK_ENABLED: "false" }, async () => {
+      const res = await registerAsLead();
+      expect(res.status).toBe(400);
+      const { error } = (await res.json()) as { error: string };
+      expect(error).toContain("disabled");
+      expect(error).not.toContain("not configured");
+    });
+    expect(telegram.calls.length).toBe(before);
+  });
+
+  test("502 when the Bot API rejects setWebhook, with the bot token redacted", async () => {
+    telegram.failSetWebhook(true);
+    try {
+      const res = await registerAsLead();
+      expect(res.status).toBe(502);
+      const text = await res.text();
+      expect(text).not.toContain(BOT_TOKEN);
+      const { error } = JSON.parse(text) as { error: string };
+      expect(error).toContain("Telegram setWebhook failed");
+      expect(error).toContain("[REDACTED]");
+    } finally {
+      telegram.failSetWebhook(false);
+    }
+  });
+});

package/src/tests/chat-sdk-teams.test.ts

@@ -0,0 +1,277 @@
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { closeDb, createAgent, getDbClient, initDb } from "../be/db";
+import { drainBackground } from "../integrations/chat-sdk/background";
+import { stopChatRelayWatcher } from "../integrations/chat-sdk/relay";
+import { getChatSdkHealth, startChatSdk, stopChatSdk } from "../integrations/chat-sdk/runtime";
+import { isTrustedTeamsServiceUrl } from "../integrations/chat-sdk/teams-origin";
+import { setChatSdkTestHooks } from "../integrations/chat-sdk/test-hooks";
+import { registerChatPostTool } from "../tools/chat-post";
+import { flushChatBuffers, postChatWebhook, snapshotChatSdkEnv } from "./chat-sdk-harness";
+import { getFreePort } from "./test-net";
+
+/*
+ * Network: Teams `initialize()` only registers routes (no token or JWKS
+ * fetch), and an inbound activity without `aadObjectId` in a new thread reads
+ * nothing from Microsoft (no member lookup, no thread history). The Teams SDK
+ * talks HTTP through axios and MSAL, not `fetch`, so a `fetch` stub would not
+ * catch a call anyway. `apiUrl` points at a port nothing listens on
+ * (from `getFreePort()`), so an unexpected connector call fails here. It
+ * redirects connector calls only, not the MSAL token call to
+ * login.microsoftonline.com. The tests send nothing outbound, so no token
+ * call happens.
+ *
+ * No health-isolation case here: Teams `initialize()` only registers routes and
+ * has no clean failure (the schema rejects blank ids), and a failing second
+ * adapter needs a slow Slack WebClient retry or a real network call.
+ */
+const TEST_DB_PATH = "./test-chat-sdk-teams.sqlite";
+const APP_ID = "00000000-0000-0000-0000-00000000a99";
+let UNREACHABLE_API_URL = "";
+
+const restoreEnv = snapshotChatSdkEnv();
+let leadId: string;
+let nextActivityId = 1_700_000_000_000;
+
+async function removeDbFiles(): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    await unlink(`${TEST_DB_PATH}${suffix}`).catch(() => {});
+  }
+}
+
+async function startTeams(teams: Record<string, unknown>, extra: Record<string, unknown> = {}) {
+  process.env.CHAT_SDK_ENABLED = "true";
+  process.env.CHAT_SDK_ADAPTERS = JSON.stringify({ teams, ...extra });
+  await startChatSdk();
+  await stopChatRelayWatcher();
+}
+
+/** A minimal Bot Framework `message` Activity that mentions the bot in a group chat. */
+function teamsMention(conversationId: string, text: string): Record<string, unknown> {
+  const bot = { id: `28:${APP_ID}`, name: "swarm" };
+  return {
+    type: "message",
+    id: String(++nextActivityId),
+    timestamp: new Date().toISOString(),
+    channelId: "msteams",
+    serviceUrl: "https://smba.trafficmanager.net/teams/",
+    from: { id: "29:user-1", name: "Tester" },
+    recipient: bot,
+    conversation: { id: conversationId, conversationType: "groupChat", isGroup: true },
+    text: `<at>swarm</at> ${text}`,
+    entities: [{ type: "mention", mentioned: bot, text: "<at>swarm</at>" }],
+  };
+}
+
+async function postActivity(activity: unknown) {
+  return postChatWebhook("teams", JSON.stringify(activity), {
+    "content-type": "application/json",
+  });
+}
+
+beforeAll(async () => {
+  await removeDbFiles();
+  initDb(TEST_DB_PATH);
+  const lead = await createAgent({
+    id: crypto.randomUUID(),
+    name: "TeamsChatLead",
+    isLead: true,
+    status: "idle",
+    capabilities: [],
+  });
+  leadId = lead.id;
+  UNREACHABLE_API_URL = `http://127.0.0.1:${await getFreePort()}/`;
+  process.env.CHAT_SDK_BUFFER_MS = "60000";
+  process.env.CHAT_SDK_API_URL_OVERRIDES = JSON.stringify({ teams: UNREACHABLE_API_URL });
+});
+
+afterEach(async () => {
+  await stopChatSdk();
+  setChatSdkTestHooks({});
+});
+
+afterAll(async () => {
+  restoreEnv();
+  closeDb();
+  await removeDbFiles();
+});
+
+describe("Chat SDK Teams adapter", () => {
+  test("with the test verifier, a mention Activity creates a teams chat task", async () => {
+    setChatSdkTestHooks({ teamsWebhookVerifier: () => true });
+    await startTeams({ appId: APP_ID, appPassword: "teams-test-password" });
+    expect(getChatSdkHealth().teams?.status).toBe("ok");
+
+    const response = await postActivity(teamsMention("19:group-one@thread.v2", "triage the inbox"));
+    expect(response.status).toBe(200);
+    expect(await drainBackground(5_000)).toBe(true);
+    await flushChatBuffers();
+
+    const tasks = await getDbClient().query<{
+      contextKey: string;
+      source: string;
+      agentId: string | null;
+      task: string;
+    }>("SELECT contextKey, source, agentId, task FROM agent_tasks WHERE contextKey GLOB ?", [
+      "task:chat-sdk:teams:*",
+    ]);
+    expect(tasks).toHaveLength(1);
+    expect(tasks[0]!.source).toBe("chat");
+    expect(tasks[0]!.agentId).toBe(leadId);
+    expect(tasks[0]!.task).toContain("triage the inbox");
+  });
+
+  test("without a verifier, an unsigned Activity is rejected with 401", async () => {
+    await startTeams({ appId: APP_ID, appPassword: "teams-test-password" });
+    expect(getChatSdkHealth().teams?.status).toBe("ok");
+    const response = await postActivity(teamsMention("19:group-two@thread.v2", "should not land"));
+    expect(response.status).toBe(401);
+    const row = await getDbClient().get<{ n: number }>(
+      "SELECT COUNT(*) AS n FROM agent_tasks WHERE task LIKE '%should not land%'",
+    );
+    expect(row?.n).toBe(0);
+  });
+});
+
+/** A Teams thread id in the adapter's encoding, pointing at `serviceUrl`. */
+function teamsThreadId(conversationId: string, serviceUrl: string): string {
+  const encode = (value: string) => Buffer.from(value).toString("base64url");
+  return `teams:${encode(conversationId)}:${encode(serviceUrl)}`;
+}
+
+/** An unsigned JWT the Teams SDK accepts from a token factory (it only decodes it). */
+function fakeBotToken(): string {
+  const encode = (value: Record<string, unknown>) =>
+    Buffer.from(JSON.stringify(value)).toString("base64url");
+  const exp = Math.floor(Date.now() / 1000) + 3600;
+  return `${encode({ alg: "none", typ: "JWT" })}.${encode({ exp, aud: APP_ID })}.sig`;
+}
+
+interface ConnectorListener {
+  url: string;
+  requests: { method: string; path: string; authorization: string | null }[];
+  stop: () => void;
+}
+
+/** A local stand-in for a connector host that records every request. */
+function startConnectorListener(): ConnectorListener {
+  const requests: ConnectorListener["requests"] = [];
+  const server = Bun.serve({
+    port: 0,
+    hostname: "127.0.0.1",
+    fetch(req) {
+      requests.push({
+        method: req.method,
+        path: new URL(req.url).pathname,
+        authorization: req.headers.get("authorization"),
+      });
+      return Response.json({ id: "activity-1" });
+    },
+  });
+  return { url: `http://127.0.0.1:${server.port}/`, requests, stop: () => server.stop(true) };
+}
+
+type ToolResult = {
+  isError?: boolean;
+  structuredContent: { success: boolean; message: string; [key: string]: unknown };
+};
+
+async function callChatPost(args: Record<string, unknown>): Promise<ToolResult> {
+  const server = new McpServer({ name: "chat-sdk-teams-test", version: "1.0.0" });
+  registerChatPostTool(server);
+  // biome-ignore lint/complexity/noBannedTypes: accessing internal MCP SDK type for test
+  const tools = (server as unknown as { _registeredTools: Record<string, { handler: Function }> })
+    ._registeredTools;
+  return (await tools["chat-post"]!.handler(args, {
+    sessionId: "test-session",
+    requestInfo: { headers: { "x-agent-id": leadId } },
+  })) as ToolResult;
+}
+
+describe("Chat SDK Teams service URL allowlist", () => {
+  test("only https Bot Framework hosts are trusted by default", () => {
+    const saved = process.env.CHAT_SDK_API_URL_OVERRIDES;
+    delete process.env.CHAT_SDK_API_URL_OVERRIDES;
+    try {
+      expect(isTrustedTeamsServiceUrl("https://smba.trafficmanager.net/teams/")).toBe(true);
+      expect(isTrustedTeamsServiceUrl("https://smba.trafficmanager.net/emea/")).toBe(true);
+      expect(isTrustedTeamsServiceUrl("https://smba.infra.gcc.teams.microsoft.com/teams")).toBe(
+        true,
+      );
+      expect(isTrustedTeamsServiceUrl("http://smba.trafficmanager.net/teams/")).toBe(false);
+      expect(isTrustedTeamsServiceUrl("https://smba.trafficmanager.net.evil.test/")).toBe(false);
+      expect(isTrustedTeamsServiceUrl("https://smba.trafficmanager.net@evil.test/")).toBe(false);
+      expect(isTrustedTeamsServiceUrl("http://127.0.0.1:8080/")).toBe(false);
+      expect(isTrustedTeamsServiceUrl("not a url")).toBe(false);
+    } finally {
+      if (saved === undefined) delete process.env.CHAT_SDK_API_URL_OVERRIDES;
+      else process.env.CHAT_SDK_API_URL_OVERRIDES = saved;
+    }
+  });
+
+  test("chat-post to a forged Teams id sends no request to its service URL", async () => {
+    const listener = startConnectorListener();
+    const saved = process.env.CHAT_SDK_API_URL_OVERRIDES;
+    // Production shape: no apiUrl override, so the adapter would send to the id's service URL.
+    delete process.env.CHAT_SDK_API_URL_OVERRIDES;
+    try {
+      setChatSdkTestHooks({ teamsToken: fakeBotToken });
+      await startTeams({ appId: APP_ID, appPassword: "teams-test-password" });
+      const threadId = teamsThreadId("19:forged@thread.v2", listener.url);
+
+      const result = await callChatPost({ adapter: "teams", threadId, text: "leak test" });
+
+      expect(result.isError).toBe(true);
+      expect(result.structuredContent.message).toContain("not a Microsoft Bot Framework");
+      expect(listener.requests).toHaveLength(0);
+    } finally {
+      listener.stop();
+      if (saved === undefined) delete process.env.CHAT_SDK_API_URL_OVERRIDES;
+      else process.env.CHAT_SDK_API_URL_OVERRIDES = saved;
+    }
+  });
+
+  test("chat-post to a Teams id with a Bot Framework service URL still sends", async () => {
+    const listener = startConnectorListener();
+    const saved = process.env.CHAT_SDK_API_URL_OVERRIDES;
+    // The override pins every connector call to the listener, whatever the id says.
+    process.env.CHAT_SDK_API_URL_OVERRIDES = JSON.stringify({ teams: listener.url });
+    try {
+      setChatSdkTestHooks({ teamsToken: fakeBotToken });
+      await startTeams({ appId: APP_ID, appPassword: "teams-test-password" });
+      const threadId = teamsThreadId(
+        "19:allowed@thread.v2",
+        "https://smba.trafficmanager.net/teams/",
+      );
+
+      const result = await callChatPost({ adapter: "teams", threadId, text: "hello teams" });
+
+      expect(result.isError).toBeFalsy();
+      expect(listener.requests).toHaveLength(1);
+      expect(listener.requests[0]!.method).toBe("POST");
+      expect(listener.requests[0]!.path).toContain("/v3/conversations/");
+      expect(listener.requests[0]!.authorization).toStartWith("Bearer ");
+    } finally {
+      listener.stop();
+      if (saved === undefined) delete process.env.CHAT_SDK_API_URL_OVERRIDES;
+      else process.env.CHAT_SDK_API_URL_OVERRIDES = saved;
+    }
+  });
+
+  test("a Teams activity with an untrusted serviceUrl is refused before the adapter", async () => {
+    setChatSdkTestHooks({ teamsWebhookVerifier: () => true });
+    await startTeams({ appId: APP_ID, appPassword: "teams-test-password" });
+    const activity = {
+      ...teamsMention("19:group-three@thread.v2", "hostile tenant"),
+      serviceUrl: "https://attacker.example/teams/",
+    };
+    const response = await postActivity(activity);
+    expect(response.status).toBe(403);
+    await flushChatBuffers();
+    const row = await getDbClient().get<{ n: number }>(
+      "SELECT COUNT(*) AS n FROM agent_tasks WHERE task LIKE '%hostile tenant%'",
+    );
+    expect(row?.n).toBe(0);
+  });
+});