@microsoft/agents-hosting 1.6.0-beta.8.g226709c215 → 1.6.1

package/dist/src/utils/env.js

@@ -0,0 +1,113 @@
+"use strict";
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseBooleanEnv = parseBooleanEnv;
+exports.parseIntEnv = parseIntEnv;
+exports.suggestClosest = suggestClosest;
+/**
+ * Internal helpers for parsing environment-variable strings into typed values.
+ *
+ * These helpers are intentionally NOT exported from the package's public
+ * `index.ts`; they are an internal utility shared between the adapter,
+ * authentication, and connector-client modules. Keeping them internal lets us
+ * normalize behavior across the package without growing the public API.
+ */
+/**
+ * Parses an environment-variable string into a boolean.
+ *
+ * Recognized truthy values (case-insensitive, trimmed): `"true"`, `"1"`.
+ * Recognized falsy values (case-insensitive, trimmed): `"false"`, `"0"`.
+ * Returns `undefined` for unset (`undefined`), empty strings, or any other
+ * value, so callers can distinguish "not specified" from explicit `false`.
+ *
+ * @param value - The raw environment variable value (typically
+ *   `process.env.X`).
+ * @returns `true`, `false`, or `undefined` when the value is unset or
+ *   unrecognized.
+ */
+function parseBooleanEnv(value) {
+    if (value === undefined)
+        return undefined;
+    const v = value.trim().toLowerCase();
+    if (v === 'true' || v === '1')
+        return true;
+    if (v === '')
+        return undefined;
+    if (v === 'false' || v === '0')
+        return false;
+    return undefined;
+}
+/**
+ * Parses an environment-variable string into an integer, returning the
+ * supplied fallback for unset, empty, or non-numeric values.
+ *
+ * @param value - The raw environment variable value.
+ * @param fallback - The value to return when the input is unset or invalid.
+ * @returns A finite integer, or `fallback` when the input cannot be parsed.
+ */
+function parseIntEnv(value, fallback) {
+    if (value === undefined || value.trim() === '')
+        return fallback;
+    const parsed = parseInt(value, 10);
+    return Number.isNaN(parsed) ? fallback : parsed;
+}
+/**
+ * Returns the candidate from `candidates` that is closest to `input` by
+ * Levenshtein edit distance, provided the distance is no greater than
+ * `maxDistance`. Returns `undefined` when no candidate is close enough or the
+ * input is empty.
+ *
+ * Intended for "did you mean X?" hints on unknown configuration keys.
+ * Comparison is case-insensitive so casing differences alone never count as
+ * an edit. Ties are broken by the order in which candidates appear.
+ *
+ * In addition to `maxDistance`, the match must be within 50% of the input
+ * length (rounded up). This prevents confident-but-wrong suggestions on
+ * short inputs (e.g., a 4-char typo matching a 6-char canonical name).
+ *
+ * @param input - The unknown name supplied by the user.
+ * @param candidates - The set of known valid names.
+ * @param maxDistance - Maximum edit distance to consider a match (default 2).
+ */
+function suggestClosest(input, candidates, maxDistance = 2) {
+    if (!input)
+        return undefined;
+    const a = input.toLowerCase();
+    const cutoff = Math.min(maxDistance, Math.max(1, Math.ceil(a.length / 2)));
+    let best;
+    for (const candidate of candidates) {
+        const d = levenshtein(a, candidate.toLowerCase());
+        if (d <= cutoff && (!best || d < best.distance)) {
+            best = { name: candidate, distance: d };
+            if (d === 0)
+                break;
+        }
+    }
+    return best === null || best === void 0 ? void 0 : best.name;
+}
+/** Standard Levenshtein edit distance using a single-row dynamic-programming table. */
+function levenshtein(a, b) {
+    if (a === b)
+        return 0;
+    if (a.length === 0)
+        return b.length;
+    if (b.length === 0)
+        return a.length;
+    const row = new Array(b.length + 1);
+    for (let j = 0; j <= b.length; j++)
+        row[j] = j;
+    for (let i = 1; i <= a.length; i++) {
+        let prev = i - 1;
+        row[0] = i;
+        for (let j = 1; j <= b.length; j++) {
+            const temp = row[j];
+            row[j] = a[i - 1] === b[j - 1]
+                ? prev
+                : 1 + Math.min(prev, row[j - 1], row[j]);
+            prev = temp;
+        }
+    }
+    return row[b.length];
+}
+//# sourceMappingURL=env.js.map

package/dist/src/utils/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../../src/utils/env.ts"],"names":[],"mappings":";AAAA,4DAA4D;AAC5D,kCAAkC;;AAwBlC,0CAOC;AAUD,kCAIC;AAoBD,wCAiBC;AAhFD;;;;;;;GAOG;AAEH;;;;;;;;;;;;GAYG;AACH,SAAgB,eAAe,CAAE,KAAyB;IACxD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC1C,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAC9B,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IAC5C,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAE,KAAyB,EAAE,QAAgB;IACtE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAA;IAC/D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAClC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,cAAc,CAC5B,KAAa,EACb,UAA6B,EAC7B,WAAW,GAAG,CAAC;IAEf,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1E,IAAI,IAAoD,CAAA;IACxD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAA;QACjD,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;YACvC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAK;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,IAAI,CAAA;AACnB,CAAC;AAED,uFAAuF;AACvF,SAAS,WAAW,CAAE,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAA;IACrB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAA;IACnC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAA;IACnC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAChB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;YACnB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC5B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YAC1C,IAAI,GAAG,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AACtB,CAAC"}

package/dist/src/utils.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Utility function to prune undefined values from an object. This is useful for cleaning up configuration objects before logging or processing, ensuring that only defined values are included.
+ * @param obj The object to prune
+ * @returns A new object with all undefined values removed
+ */
+export declare const prune: <T extends Record<string, any>>(obj: T) => T;

package/dist/src/utils.js

@@ -0,0 +1,18 @@
+"use strict";
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prune = void 0;
+/**
+ * Utility function to prune undefined values from an object. This is useful for cleaning up configuration objects before logging or processing, ensuring that only defined values are included.
+ * @param obj The object to prune
+ * @returns A new object with all undefined values removed
+ */
+const prune = (obj) => {
+    const entries = Object.entries(obj).filter(([, value]) => value !== undefined);
+    return Object.fromEntries(entries);
+};
+exports.prune = prune;
+//# sourceMappingURL=utils.js.map

package/dist/src/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/utils.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH;;;;GAIG;AACI,MAAM,KAAK,GAAG,CAAgC,GAAM,EAAE,EAAE;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;IAC9E,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAM,CAAA;AACzC,CAAC,CAAA;AAHY,QAAA,KAAK,SAGjB"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "@microsoft/agents-hosting",
-  "version": "1.6.0-beta.8.g226709c215",
+  "version": "1.6.1",
   "homepage": "https://github.com/microsoft/Agents-for-js",
   "repository": {
     "type": "git",
@@ -20,13 +20,11 @@
   "types": "dist/src/index.d.ts",
   "dependencies": {
     "@azure/core-auth": "1.10.1",
-    "@azure/msal-node": "5.0.6",
-    "@microsoft/agents-activity": "1.6.0-beta.8.g226709c215",
-    "@microsoft/agents-telemetry": "1.6.0-beta.8.g226709c215",
-    "axios": "1.15.0",
+    "@azure/msal-node": "5.1.5",
+    "@microsoft/agents-activity": "1.6.1",
+    "@microsoft/agents-telemetry": "1.6.1",
     "jsonwebtoken": "9.0.3",
     "jwks-rsa": "4.0.1",
-    "object-path": "0.11.8",
     "zod": "3.25.75"
   },
   "license": "MIT",
@@ -46,8 +44,5 @@
   },
   "engines": {
     "node": ">=20.0.0"
-  },
-  "devDependencies": {
-    "@types/object-path": "0.11.4"
   }
 }

package/src/agent-client/agentClient.ts

@@ -1,6 +1,6 @@
 import { AuthConfiguration, MsalTokenProvider } from '../auth'
 import { Activity, ConversationReference, RoleTypes } from '@microsoft/agents-activity'
-import { v4 } from 'uuid'
+import { randomUUID } from 'crypto'
 import { debug } from '@microsoft/agents-telemetry'
 import { ConversationState } from '../state'
 import { TurnContext } from '../turnContext'
@@ -88,7 +88,7 @@ export class AgentClient {
           ...activityCopy.conversation
         }
       }
-      activityCopy.conversation!.id = v4()
+      activityCopy.conversation!.id = randomUUID()
 
       const conversationDataAccessor = conversationState.createProperty<ConversationData>(activityCopy.conversation!.id)
       const convRef = await conversationDataAccessor.set(context,

package/src/agent-client/agentResponseHandler.ts

@@ -3,7 +3,7 @@ import { ActivityHandler } from '../activityHandler'
 import { CloudAdapter } from '../cloudAdapter'
 import { Request, Response, Application } from 'express'
 import { TurnContext } from '../turnContext'
-import { v4 } from 'uuid'
+import { randomUUID } from 'crypto'
 import { normalizeIncomingActivity } from '../activityWireCompat'
 import { debug } from '@microsoft/agents-telemetry'
 import { ConversationState } from '../state'
@@ -78,7 +78,7 @@ const handleResponse = (adapter: CloudAdapter, handler: ActivityHandler, convers
       applyActivityToTurnContext(turnContext, activity)
       await handler.run(turnContext)
 
-      response = v4().replace(/-/g, '')
+      response = randomUUID().replace(/-/g, '')
     } else {
       response = await turnContext.sendActivity(activity)
     }

package/src/app/agentApplication.ts

@@ -21,7 +21,7 @@ import { CloudAdapter } from '../cloudAdapter'
 import { Authorization, UserAuthorization, AuthorizationManager } from './auth'
 import { Proactive } from './proactive'
 import { JwtPayload } from 'jsonwebtoken'
-import { trace, debug } from '@microsoft/agents-telemetry'
+import { trace, debug, redactString } from '@microsoft/agents-telemetry'
 import { AgentApplicationTraceDefinitions } from '../observability'
 import { Errors } from '../errorHelper'
 
@@ -144,6 +144,8 @@ export class AgentApplication<TState extends TurnState> {
       this._adapter = new CloudAdapter()
     }
 
+    this._adapter.setAgentName(this._options.agentName)
+
     // Create Proactive whenever proactive options are explicitly configured or a storage
     // backend is available — no explicit `proactive` option is required.
     if (this._options.proactive !== undefined || this._options.storage !== undefined) {
@@ -164,10 +166,35 @@ export class AgentApplication<TState extends TurnState> {
       }
     }
 
-    logger.debug('AgentApplication created with options:', this._options)
-
     this._authorizationManager = new AuthorizationManager(this, this._adapter.connectionManager)
     this._authorization = new UserAuthorization(this._authorizationManager)
+
+    const className = (obj: any) => obj?.constructor?.name ?? (obj ? 'custom' : undefined)
+    logger.info('AgentApplication settings loaded', {
+      agentAppId: redactString(this._options.agentAppId, true),
+      adapter: {
+        className: className(this._adapter),
+        source: this._options.adapter ? 'consumed' : 'created',
+      },
+      storage: className(this._options.storage),
+      authorization: this._authorizationManager.handlers.map(e => e.id),
+      proactive: {
+        ...this.options.proactive,
+        storage: className(this._options.proactive?.storage ?? this._options.storage),
+        source: this._options.proactive ? 'options' : 'storage',
+      },
+      transcriptLogger: className(this._options.transcriptLogger),
+      typing: {
+        startTimer: this._options.startTypingTimer,
+        options: this._options.typing,
+      },
+      longRunningMessages: this._options.longRunningMessages,
+      removeRecipientMention: this._options.removeRecipientMention,
+      normalizeMentions: this._options.normalizeMentions,
+      fileDownloaders: this._options.fileDownloaders ? 'configured' : undefined,
+      turnStateFactory: options?.turnStateFactory ? 'custom' : 'default',
+      adaptiveCardsOptions: this._options.adaptiveCardsOptions,
+    })
   }
 
   /**

package/src/app/agentApplicationOptions.ts

@@ -178,6 +178,17 @@ export interface AgentApplicationOptions<TState extends TurnState> {
    */
   headerPropagation?: HeaderPropagationDefinition
 
+  /**
+   * Optional. Human-friendly agent name sent in the `AgentName` header for
+   * SDK-managed outbound requests created during inbound turn processing.
+   *
+   * @remarks
+   * When omitted, the SDK uses the default value `Agent-SDK-JS`.
+   * The resolved value is trimmed and validated by the SDK. Only letters,
+   * numbers, spaces, hyphen, and underscore are allowed.
+   */
+  agentName?: string
+
   /**
    * Optional. Configuration for managing multiple authentication connections within the agent.
    * This allows the agent to handle authentication across different services or

package/src/app/attachmentDownloader.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import axios, { AxiosInstance } from 'axios'
+import { HttpClient } from '../httpClient'
 import { InputFile, InputFileDownloader } from './inputFileDownloader'
 import { TurnState } from './turnState'
 import { TurnContext } from '../turnContext'
@@ -25,7 +25,7 @@ const logger = debug('agents:attachmentDownloader')
  *
  */
 export class AttachmentDownloader<TState extends TurnState = TurnState> implements InputFileDownloader<TState> {
-  private _httpClient: AxiosInstance
+  private _httpClient: HttpClient
   private _stateKey: string
 
   /**
@@ -35,7 +35,7 @@ export class AttachmentDownloader<TState extends TurnState = TurnState> implemen
    * @param stateKey The key to store files in state. Defaults to 'inputFiles'.
    */
   public constructor (stateKey: string = 'inputFiles') {
-    this._httpClient = axios.create()
+    this._httpClient = new HttpClient()
     this._stateKey = stateKey
   }
 
@@ -86,18 +86,16 @@ export class AttachmentDownloader<TState extends TurnState = TurnState> implemen
       (attachment.contentUrl && attachment.contentUrl.startsWith('https://')) ||
             (attachment.contentUrl && attachment.contentUrl.startsWith('http://localhost'))
     ) {
-      let headers
+      const headers: Record<string, string> = {}
       if (accessToken.length > 0) {
-        headers = {
-          Authorization: `Bearer ${accessToken}`
-        }
+        headers.Authorization = `Bearer ${accessToken}`
       }
       const response = await this._httpClient.get(attachment.contentUrl, {
         headers,
         responseType: 'arraybuffer'
       })
 
-      const content = Buffer.from(response.data, 'binary')
+      const content = Buffer.from(response.data as ArrayBuffer)
 
       let contentType = attachment.contentType
       if (contentType === 'image/*') {

package/src/app/auth/authorizationManager.ts

@@ -4,7 +4,7 @@
  */
 
 import { Activity, ExceptionHelper } from '@microsoft/agents-activity'
-import { debug } from '@microsoft/agents-telemetry'
+import { debug, redactScopes } from '@microsoft/agents-telemetry'
 import { AgentApplication } from '../agentApplication'
 import { AgenticAuthorization, AzureBotAuthorization } from './handlers'
 import { TurnContext } from '../../turnContext'
@@ -13,7 +13,8 @@ import { Errors } from '../../errorHelper'
 import { ActiveAuthorizationHandler, AuthorizationHandlerStatus, AuthorizationHandler, AuthorizationHandlerSettings, AuthorizationOptions } from './types'
 import { Connections } from '../../auth/connections'
 import { sendInvokeResponse } from './utils'
-import { envParser, envParserUtils } from '../../auth'
+import { envParser, envParserUtils } from '../../auth/settings'
+import { prune } from '../../utils'
 
 const logger = debug('agents:authorization:manager')
 
@@ -155,10 +156,6 @@ export class AuthorizationManager {
     if (this.handlers.length === 0 && app.options.authorization !== undefined) {
       throw ExceptionHelper.generateException(Error, Errors.NoAuthHandlersConfigured)
     }
-
-    for (const [id, handler] of Object.entries(this._handlers)) {
-      logger.debug('auth handler "%s" type=%s scopes=%o', id, handler.type, handler.scopes)
-    }
   }
 
   /**
@@ -320,7 +317,7 @@ export class AuthorizationManager {
   private createHandlers () {
     let legacyMessage = ''
     const settings: AuthorizationHandlerSettings = { storage: this.app.options.storage!, connections: this.connections }
-    let runtimeEntries = Object.entries(this.app.options.authorization ?? {})
+    const runtimeOptionEntries = Object.entries(this.app.options.authorization ?? {})
     const result = { latest: {}, legacy: {} } as {
       latest: Record<string, Record<string, any> | undefined>;
       legacy: Record<string, Record<string, any> | undefined>;
@@ -335,7 +332,7 @@ export class AuthorizationManager {
 
       // Legacy: extract handler ID, handler options key and its value, and assign it to the correct runtime handler ID.
       if (!upperEnvKey.startsWith(this._envLatest.key.prefix.toUpperCase())) {
-        const [id] = runtimeEntries.find(([id]) => upperEnvKey.startsWith(`${id.toUpperCase()}${this._envLegacy.key.separator}`)) ?? []
+        const [id] = runtimeOptionEntries.find(([id]) => upperEnvKey.startsWith(`${id.toUpperCase()}${this._envLegacy.key.separator}`)) ?? []
         if (!id) {
           continue
         }
@@ -386,7 +383,7 @@ export class AuthorizationManager {
     const fixTypes = (entries: [string, any][]) => entries
       .map(([id, options]) => [id, { ...options, type: this.fixType(id, options?.type) }] as [string, AuthorizationOptions[string]])
 
-    runtimeEntries = fixTypes(runtimeEntries)
+    const runtimeEntries = fixTypes(runtimeOptionEntries)
     const latestEntries = fixTypes(Object.entries(result.latest))
     const legacyEntries = fixTypes(Object.entries(result.legacy))
 
@@ -396,39 +393,27 @@ export class AuthorizationManager {
         continue
       }
 
-      // Find entries case-insensitively for later processing
-      const [, runtime] = runtimeEntries.find(([key]) => key.toLowerCase() === id.toLowerCase()) ?? []
-      const [, latest] = latestEntries.find(([key]) => key.toLowerCase() === id.toLowerCase()) ?? []
-      const [, legacy] = legacyEntries.find(([key]) => key.toLowerCase() === id.toLowerCase()) ?? []
+      const { options, format } = this.resolveHandlerConfiguration(id, runtimeEntries, latestEntries, legacyEntries)
 
-      if (runtime !== undefined && latest !== undefined) {
-        logger.warn(this.prefix(id, 'Both runtime and latest environment variable configurations detected. Runtime configuration will take precedence over latest environment variables.'))
+      if (options.type === AZURE_BOT) {
+        // Set default values if not provided
+        options.title ||= 'Sign-in'
+        options.text ||= 'Please sign-in to continue'
+        options.oboScopes ??= []
+        options.enableSso = options.enableSso !== false // default value is true if undefined.
       }
 
-      // Normalize runtime legacy options to latest format
-      if (runtime?.type === AZURE_BOT) {
-        runtime.azureBotOAuthConnectionName ??= runtime.name
-        runtime.invalidSignInRetryMax ??= runtime.maxAttempts
-        runtime.invalidSignInRetryMessage ??= runtime.messages?.invalidCode
-        runtime.invalidSignInRetryMessageFormat ??= runtime.messages?.invalidCodeFormat
-        runtime.invalidSignInRetryMaxExceededMessage ??= runtime.messages?.maxAttemptsExceeded
-        runtime.oboConnectionName ??= runtime.obo?.connection
-        runtime.oboScopes ??= runtime.obo?.scopes
-        delete runtime.name
-        delete runtime.maxAttempts
-        delete runtime.messages
-        delete runtime.obo
+      const maskedOptions: any = {}
+
+      if ('oboScopes' in options && options.oboScopes && options.oboScopes.length > 0) {
+        maskedOptions.oboScopes = redactScopes(options.oboScopes)
       }
 
-      // Helper to remove undefined options
-      const prune = <T extends Record<string, any>>(obj: T) => {
-        const entries = Object.entries(obj).filter(([, e]) => e !== undefined)
-        return Object.fromEntries(entries) as T
+      if ('scopes' in options && options.scopes && options.scopes.length > 0) {
+        maskedOptions.scopes = redactScopes(options.scopes)
       }
 
-      // Priority: runtime > latest > legacy
-      // Pruning done individually to avoid overwriting with undefined when merging.
-      const options: AuthorizationOptions[string] = runtime ? { ...prune(legacy || {}), ...prune(runtime) } : prune(latest || {})
+      logger.info(this.prefix(id, 'settings loaded from \'%s\''), format, { ...options, ...maskedOptions })
 
       if (!settings.storage) {
         throw ExceptionHelper.generateException(Error, Errors.StorageRequiredForAuthorization)
@@ -437,12 +422,6 @@ export class AuthorizationManager {
       if (options.type === AGENTIC) {
         this._handlers[id] = new AgenticAuthorization(id, options, settings)
       } else if (options.type === AZURE_BOT) {
-        // Set default values if not provided
-        options.title ||= 'Sign-in'
-        options.text ||= 'Please sign-in to continue'
-        options.oboScopes ??= []
-        options.enableSso = options.enableSso !== false // default value is true if undefined.
-
         this._handlers[id] = new AzureBotAuthorization(id, options, settings)
       }
 
@@ -473,4 +452,68 @@ export class AuthorizationManager {
 
     throw ExceptionHelper.generateException(Error, Errors.UnsupportedAuthHandlerType, undefined, { handlerType: type })
   }
+
+  /**
+   * Resolves the effective handler configuration for a given handler ID.
+   */
+  private resolveHandlerConfiguration (
+    id: string,
+    runtimeEntries: Array<[string, AuthorizationOptions[string]]>,
+    latestEntries: Array<[string, AuthorizationOptions[string]]>,
+    legacyEntries: Array<[string, AuthorizationOptions[string]]>
+  ): {
+      options: AuthorizationOptions[string];
+      format: string;
+    } {
+    const matchesId = ([_id]: [string, AuthorizationOptions[string]]) => _id.toLowerCase() === id.toLowerCase()
+
+    // Find entries case-insensitively for later processing
+    const [, runtime] = runtimeEntries.find(matchesId) ?? []
+    const [, latest] = latestEntries.find(matchesId) ?? []
+    const [, legacy] = legacyEntries.find(matchesId) ?? []
+
+    if (runtime !== undefined && latest !== undefined) {
+      logger.warn(this.prefix(id, 'Both runtime options and latest environment variable configurations detected. Runtime configuration will take precedence over latest environment variables.'))
+    }
+
+    const runtimeLegacyKeys = ['name', 'maxAttempts', 'messages', 'obo']
+    const isRuntimeLegacy = runtime !== undefined && Object.keys(runtime).some(key => runtimeLegacyKeys.includes(key))
+
+    let runtimeLegacyFormat = ''
+    if (isRuntimeLegacy && runtime.type === AZURE_BOT) {
+      runtime.azureBotOAuthConnectionName ??= runtime.name
+      runtime.invalidSignInRetryMax ??= runtime.maxAttempts
+      runtime.invalidSignInRetryMessage ??= runtime.messages?.invalidCode
+      runtime.invalidSignInRetryMessageFormat ??= runtime.messages?.invalidCodeFormat
+      runtime.invalidSignInRetryMaxExceededMessage ??= runtime.messages?.maxAttemptsExceeded
+      runtime.oboConnectionName ??= runtime.obo?.connection
+      runtime.oboScopes ??= runtime.obo?.scopes
+      delete runtime.name
+      delete runtime.maxAttempts
+      delete runtime.messages
+      delete runtime.obo
+      runtimeLegacyFormat = 'runtime options (legacy)'
+    }
+
+    if (runtime !== undefined && legacy !== undefined) {
+      return { format: `${runtimeLegacyFormat || 'runtime options'} + .env variables (legacy)`, options: { ...prune(legacy), ...prune(runtime) } }
+    }
+
+    if (runtime !== undefined) {
+      return { format: runtimeLegacyFormat || 'runtime options', options: prune(runtime) }
+    }
+
+    if (latest !== undefined) {
+      return { format: '.env variables', options: prune(latest) }
+    }
+
+    if (legacy !== undefined) {
+      // Note: this should never happen, as legacy requires runtime to be present.
+      // However, we show a warning just in case to detect if something goes wrong.
+      logger.warn(this.prefix(id, 'Legacy environment variable configuration detected without a corresponding runtime options configuration.'))
+      return { format: '.env variables (legacy)', options: prune(legacy) }
+    }
+
+    return { format: 'empty options', options: {} }
+  }
 }

package/src/app/auth/handlers/azureBotAuthorization.ts

@@ -334,7 +334,7 @@ export class AzureBotAuthorization implements AuthorizationHandler {
       const { activity } = context
       const userTokenClient = await this.getUserTokenClient(context)
       // Using getTokenOrSignInResource instead of getUserToken to avoid HTTP 404 errors.
-      const { tokenResponse } = await userTokenClient.getTokenOrSignInResource(activity.from?.id!, this.options.azureBotOAuthConnectionName!, activity.channelId!, activity.getConversationReference(), activity.relatesTo!, '')
+      const { tokenResponse } = await userTokenClient.getTokenOrSignInResource(activity.from?.id!, this.options.azureBotOAuthConnectionName!, activity.channelId!, activity.getConversationReference({ forceBaseChannel: true }), activity.relatesTo!, '')
       return tokenResponse?.token
     }
 
@@ -399,7 +399,7 @@ export class AzureBotAuthorization implements AuthorizationHandler {
     const { activity } = context
 
     const userTokenClient = await this.getUserTokenClient(context)
-    const { tokenResponse, signInResource } = await userTokenClient.getTokenOrSignInResource(activity.from?.id!, this.options.azureBotOAuthConnectionName!, activity.channelId!, activity.getConversationReference(), activity.relatesTo!, code ?? '')
+    const { tokenResponse, signInResource } = await userTokenClient.getTokenOrSignInResource(activity.from?.id!, this.options.azureBotOAuthConnectionName!, activity.channelId!, activity.getConversationReference({ forceBaseChannel: true }), activity.relatesTo!, code ?? '')
 
     if (!tokenResponse && active && code) {
       reason.message = 'Invalid code entered. Restarting sign-in flow'

package/src/app/proactive/createConversationOptionsBuilder.ts

@@ -66,6 +66,9 @@ export class CreateConversationOptionsBuilder {
     const builder = new CreateConversationOptionsBuilder(claims, channelId, serviceUrl)
     if (parameters) {
       builder._parameters = { ...builder._parameters, ...parameters }
+      if (parameters.activity) {
+        builder._activity = parameters.activity
+      }
     }
 
     // Set parameters.agent if not already provided — matches C# behavior
@@ -161,9 +164,10 @@ export class CreateConversationOptionsBuilder {
       throw ExceptionHelper.generateException(Error, Errors.CreateConversationBuilderMembersRequired)
     }
 
-    const activity: Partial<Activity> = {
-      type: 'message',
-      ...this._activity,
+    const isTeamsChannel = this._channelId === Channels.Msteams &&
+      Boolean((this._parameters.channelData as Record<string, any>)?.channel?.id)
+    if (isTeamsChannel && !this._activity) {
+      throw ExceptionHelper.generateException(Error, Errors.CreateConversationBuilderChannelActivityRequired)
     }
 
     return {
@@ -174,7 +178,7 @@ export class CreateConversationOptionsBuilder {
       storeConversation: this._storeConversation,
       parameters: {
         ...this._parameters,
-        activity: activity as Activity,
+        activity: this._activity ? { type: 'message', ...this._activity } as Activity : undefined,
       },
     }
   }