@microsoft/agents-hosting 1.7.2 → 1.8.0-beta.36.gb033f0abc1

package/dist/src/app/attachmentDownloader.js

@@ -8,6 +8,7 @@ exports.AttachmentDownloader = void 0;
 const httpClient_1 = require("../httpClient");
 const agents_telemetry_1 = require("@microsoft/agents-telemetry");
 const auth_1 = require("../auth");
+const outboundHostValidator_1 = require("../outboundHostValidator");
 const logger = (0, agents_telemetry_1.debug)('agents:attachmentDownloader');
 /**
  * A utility class for downloading input files from activity attachments.
@@ -25,10 +26,12 @@ class AttachmentDownloader {
      * This class is responsible for downloading input files from attachments.
      *
      * @param stateKey The key to store files in state. Defaults to 'inputFiles'.
+     * @param outboundHostValidator Optional shared policy used to validate outbound attachment URLs.
      */
-    constructor(stateKey = 'inputFiles') {
+    constructor(stateKey = 'inputFiles', outboundHostValidator) {
         this._httpClient = new httpClient_1.HttpClient();
         this._stateKey = stateKey;
+        this._hostValidator = outboundHostValidator !== null && outboundHostValidator !== void 0 ? outboundHostValidator : (0, outboundHostValidator_1.createOutboundHostValidator)();
     }
     /**
      * Downloads files from the attachments in the current turn context.
@@ -37,15 +40,25 @@ class AttachmentDownloader {
      * @returns A promise that resolves to an array of downloaded input files.
      */
     async downloadFiles(context) {
-        var _a;
+        var _a, _b, _c, _d;
         const attachments = (_a = context.activity.attachments) === null || _a === void 0 ? void 0 : _a.filter((a) => !a.contentType.startsWith('text/html'));
         if (!attachments || attachments.length === 0) {
             logger.info('No Attachments to download');
             return Promise.resolve([]);
         }
-        // TODO: from adapter
-        const authProvider = new auth_1.MsalTokenProvider();
-        const accessToken = await authProvider.getAccessToken((0, auth_1.loadAuthConfigFromEnv)(), 'https://api.botframework.com');
+        let accessToken = '';
+        const connectionManager = (_b = context.adapter) === null || _b === void 0 ? void 0 : _b.connectionManager;
+        const identity = context.identity;
+        if (connectionManager && identity) {
+            const scope = (_d = (_c = identity.azp) !== null && _c !== void 0 ? _c : identity.appid) !== null && _d !== void 0 ? _d : 'https://api.botframework.com';
+            logger.debug(`Using adapter connection manager token provider for attachment downloads with scope ${scope}`);
+            accessToken = await connectionManager.getTokenProviderFromActivity(identity, context.activity).getAccessToken(scope);
+        }
+        else {
+            logger.debug('Using MsalTokenProvider fallback for attachment downloads');
+            const authProvider = new auth_1.MsalTokenProvider();
+            accessToken = await authProvider.getAccessToken((0, auth_1.loadAuthConfigFromEnv)(), 'https://api.botframework.com');
+        }
         const files = [];
         for (const attachment of attachments) {
             const file = await this.downloadFile(attachment, accessToken);
@@ -74,6 +87,15 @@ class AttachmentDownloader {
             if (accessToken.length > 0) {
                 headers.Authorization = `Bearer ${accessToken}`;
             }
+            if (!this._hostValidator.isAllowed(attachment.contentUrl)) {
+                let host = '[invalid-url]';
+                try {
+                    host = new URL(attachment.contentUrl).hostname;
+                }
+                catch { /* invalid */ }
+                logger.warn(`Attachment contentUrl host is not in the configured allowed hosts. Host='${host}'`);
+                return undefined;
+            }
             const response = await this._httpClient.get(attachment.contentUrl, {
                 headers,
                 responseType: 'arraybuffer'

package/dist/src/app/attachmentDownloader.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachmentDownloader.js","sourceRoot":"","sources":["../../../src/app/attachmentDownloader.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,8CAA0C;AAM1C,kEAAmD;AACnD,kCAAkE;AAElE,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,6BAA6B,CAAC,CAAA;AAEnD;;;;;;;;;GASG;AACH,MAAa,oBAAoB;IAI/B;;;;;OAKG;IACH,YAAoB,WAAmB,YAAY;QACjD,IAAI,CAAC,WAAW,GAAG,IAAI,uBAAU,EAAE,CAAA;QACnC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAA;IAC3B,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,aAAa,CAAE,OAAoB;;QAC9C,MAAM,WAAW,GAAG,MAAA,OAAO,CAAC,QAAQ,CAAC,WAAW,0CAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;QACvG,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;YACzC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC5B,CAAC;QAED,qBAAqB;QACrB,MAAM,YAAY,GAAiB,IAAI,wBAAiB,EAAE,CAAA;QAE1D,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,IAAA,4BAAqB,GAAE,EAAE,8BAA8B,CAAC,CAAA;QAE9G,MAAM,KAAK,GAAgB,EAAE,CAAA;QAC7B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;YAC7D,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACrC,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,qBAAqB,CAAE,OAAoB,EAAE,KAAa;QACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QAC/C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IACvC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAE,UAAsB,EAAE,WAAmB;QACrE,IACE,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACjE,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,EACrF,CAAC;YACD,MAAM,OAAO,GAA2B,EAAE,CAAA;YAC1C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,aAAa,GAAG,UAAU,WAAW,EAAE,CAAA;YACjD,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE;gBACjE,OAAO;gBACP,YAAY,EAAE,aAAa;aAC5B,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAmB,CAAC,CAAA;YAEzD,IAAI,WAAW,GAAG,UAAU,CAAC,WAAW,CAAA;YACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,WAAW,GAAG,WAAW,CAAA;YAC3B,CAAC;YAED,OAAO;gBACL,OAAO;gBACP,WAAW;gBACX,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC,CAAA;QACH,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAc,CAAC;gBAC/C,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC,CAAA;QACH,CAAC;IACH,CAAC;CACF;AA3FD,oDA2FC"}
+{"version":3,"file":"attachmentDownloader.js","sourceRoot":"","sources":["../../../src/app/attachmentDownloader.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,8CAA0C;AAM1C,kEAAmD;AACnD,kCAAkE;AAClE,oEAAyF;AAGzF,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,6BAA6B,CAAC,CAAA;AAEnD;;;;;;;;;GASG;AACH,MAAa,oBAAoB;IAK/B;;;;;;OAMG;IACH,YAAoB,WAAmB,YAAY,EAAE,qBAAyC;QAC5F,IAAI,CAAC,WAAW,GAAG,IAAI,uBAAU,EAAE,CAAA;QACnC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAA;QACzB,IAAI,CAAC,cAAc,GAAG,qBAAqB,aAArB,qBAAqB,cAArB,qBAAqB,GAAI,IAAA,mDAA2B,GAAE,CAAA;IAC9E,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,aAAa,CAAE,OAAoB;;QAC9C,MAAM,WAAW,GAAG,MAAA,OAAO,CAAC,QAAQ,CAAC,WAAW,0CAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;QACvG,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;YACzC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC5B,CAAC;QAED,IAAI,WAAW,GAAG,EAAE,CAAA;QACpB,MAAM,iBAAiB,GAAG,MAAC,OAAO,CAAC,OAA+C,0CAAE,iBAAiB,CAAA;QACrG,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QACjC,IAAI,iBAAiB,IAAI,QAAQ,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAA,MAAA,QAAQ,CAAC,GAAG,mCAAI,QAAQ,CAAC,KAAK,mCAAI,8BAA8B,CAAA;YAC9E,MAAM,CAAC,KAAK,CAAC,uFAAuF,KAAK,EAAE,CAAC,CAAA;YAC5G,WAAW,GAAG,MAAM,iBAAiB,CAAC,4BAA4B,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QACtH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAA;YACzE,MAAM,YAAY,GAAiB,IAAI,wBAAiB,EAAE,CAAA;YAC1D,WAAW,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,IAAA,4BAAqB,GAAE,EAAE,8BAA8B,CAAC,CAAA;QAC1G,CAAC;QAED,MAAM,KAAK,GAAgB,EAAE,CAAA;QAC7B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;YAC7D,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACrC,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,qBAAqB,CAAE,OAAoB,EAAE,KAAa;QACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QAC/C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IACvC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAE,UAAsB,EAAE,WAAmB;QACrE,IACE,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACjE,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,EACrF,CAAC;YACD,MAAM,OAAO,GAA2B,EAAE,CAAA;YAC1C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,aAAa,GAAG,UAAU,WAAW,EAAE,CAAA;YACjD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC1D,IAAI,IAAI,GAAG,eAAe,CAAA;gBAC1B,IAAI,CAAC;oBAAC,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC9E,MAAM,CAAC,IAAI,CAAC,4EAA4E,IAAI,GAAG,CAAC,CAAA;gBAChG,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE;gBACjE,OAAO;gBACP,YAAY,EAAE,aAAa;aAC5B,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAmB,CAAC,CAAA;YAEzD,IAAI,WAAW,GAAG,UAAU,CAAC,WAAW,CAAA;YACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,WAAW,GAAG,WAAW,CAAA;YAC3B,CAAC;YAED,OAAO;gBACL,OAAO;gBACP,WAAW;gBACX,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC,CAAA;QACH,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAc,CAAC;gBAC/C,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC,CAAA;QACH,CAAC;IACH,CAAC;CACF;AA7GD,oDA6GC"}

package/dist/src/app/auth/handlers/agenticAuthorization.d.ts

@@ -13,7 +13,7 @@ import { TokenResponse } from '../../../oauth';
  * where `{handlerId}` is the handler's unique identifier and `{propertyName}` matches the property name.
  *
  * @example
- * ```env
+ * ```
  * # For a handler with id "myAuth":
  * AgentApplication__UserAuthorization__handlers__myAuth__settings__type=AgenticUserAuthorization
  * AgentApplication__UserAuthorization__handlers__myAuth__settings__scopes=api://scope1 api://scope2

package/dist/src/app/auth/handlers/azureBotAuthorization.d.ts

@@ -30,7 +30,7 @@ interface AzureBotActiveHandler extends ActiveAuthorizationHandler {
  * where `{handlerId}` is the handler's unique identifier and `{propertyName}` matches the property name.
  *
  * @example
- * ```env
+ * ```
  * # For a handler with id "myAuth":
  * AgentApplication__UserAuthorization__handlers__myAuth__settings__azureBotOAuthConnectionName=MyConnection
  * AgentApplication__UserAuthorization__handlers__myAuth__settings__oboScopes=api://scope1 api://scope2

package/dist/src/app/auth/types.d.ts

@@ -118,7 +118,7 @@ export interface AuthorizationHandlerTokenOptions {
  * where `{handlerId}` is the handler's unique identifier and `{propertyName}` matches the property name.
  *
  * @example
- * ```env
+ * ```
  * # For a handler with id "myAuth":
  * AgentApplication__UserAuthorization__handlers__myAuth__settings__azureBotOAuthConnectionName=MyConnection
  * AgentApplication__UserAuthorization__handlers__myAuth__settings__oboScopes=api://scope1 api://scope2
@@ -161,7 +161,7 @@ export interface AzureBotAuthorizationOptionsLegacy {
  * @deprecated
  * Messages configuration for the AzureBotAuthorization handler.
  */
-interface AzureBotAuthorizationOptionsMessages {
+export interface AzureBotAuthorizationOptionsMessages {
     /**
      * @deprecated Use `invalidSignInRetryMessage` instead.
      * Message displayed when an invalid code is entered.
@@ -188,7 +188,7 @@ interface AzureBotAuthorizationOptionsMessages {
  * @deprecated
  * Settings for on-behalf-of token acquisition.
  */
-interface AzureBotAuthorizationOptionsOBO {
+export interface AzureBotAuthorizationOptionsOBO {
     /**
      * @deprecated Use `oboConnectionName` instead.
      * Connection name to use for on-behalf-of token acquisition.
@@ -200,4 +200,3 @@ interface AzureBotAuthorizationOptionsOBO {
      */
     scopes?: string[];
 }
-export {};

package/dist/src/app/index.d.ts

@@ -3,6 +3,8 @@ export * from './agentApplicationBuilder';
 export * from './agentApplicationOptions';
 export * from './appRoute';
 export { Authorization } from './auth/authorization';
+export type { AgenticAuthorizationOptions, AzureBotAuthorizationOptions } from './auth/handlers';
+export type { AuthorizationOptions, AuthorizationHandlerTokenOptions, AzureBotAuthorizationOptionsLegacy, AzureBotAuthorizationOptionsMessages, AzureBotAuthorizationOptionsOBO } from './auth/types';
 export * from './routeHandler';
 export * from './routeList';
 export * from './routeRank';

package/dist/src/app/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/app/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAkC;AAClC,4DAAyC;AACzC,4DAAyC;AACzC,6CAA0B;AAE1B,iDAA8B;AAC9B,8CAA2B;AAC3B,8CAA2B;AAC3B,kDAA+B;AAC/B,yDAAsC;AACtC,6DAA0C;AAC1C,8CAA2B;AAC3B,+CAA4B;AAC5B,mDAAgC;AAChC,wDAAqC;AACrC,8CAA2B;AAC3B,+CAA4B;AAC5B,kDAA+B;AAC/B,gEAA6C;AAC7C,uDAAoC;AACpC,8DAA2C;AAC3C,8CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/app/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAkC;AAClC,4DAAyC;AACzC,4DAAyC;AACzC,6CAA0B;AAU1B,iDAA8B;AAC9B,8CAA2B;AAC3B,8CAA2B;AAC3B,kDAA+B;AAC/B,yDAAsC;AACtC,6DAA0C;AAC1C,8CAA2B;AAC3B,+CAA4B;AAC5B,mDAAgC;AAChC,wDAAqC;AACrC,8CAA2B;AAC3B,+CAA4B;AAC5B,kDAA+B;AAC/B,gEAA6C;AAC7C,uDAAoC;AACpC,8DAA2C;AAC3C,8CAA2B"}

package/dist/src/app/streaming/streamingResponse.d.ts

@@ -49,6 +49,13 @@ export declare class StreamingResponse {
     private _finalMessage?;
     private _canceled;
     private _userCanceled;
+    private _streamTimedOut;
+    private _streamTimeoutNotificationSent;
+    private _lastInformationalMessageSent;
+    private _streamStartedAt?;
+    private _keepAliveTimer?;
+    private _streamTimeoutTimer?;
+    private _streamingTakingTooLongMessage;
     private _queue;
     private _queueSync;
     private _chunkQueued;
@@ -95,6 +102,14 @@ export declare class StreamingResponse {
      * Gets whether the channel supports streaming.
      */
     get isStreamingChannel(): boolean;
+    /**
+     * Gets the message sent when streaming takes longer than the channel allows.
+     */
+    get streamingTakingTooLongMessage(): string;
+    /**
+     * Sets the message sent when streaming takes longer than the channel allows.
+     */
+    set streamingTakingTooLongMessage(message: string);
     /**
      * Queues an informative update to be sent to the client.
      *
@@ -189,6 +204,13 @@ export declare class StreamingResponse {
      * @returns The streamed message.
      */
     getMessage(): string;
+    /**
+     * Ends the streaming portion of a response while allowing the underlying operation to continue.
+     *
+     * @param message Message sent to notify the user that streaming has stopped.
+     * @returns Whether the streaming response was stopped.
+     */
+    sendStreamTimedOutNotification(message: string): Promise<boolean>;
     /**
      * Waits for the outgoing activity queue to be empty.
      *
@@ -216,6 +238,19 @@ export declare class StreamingResponse {
      * Creates the final message to be sent at the end of the stream.
      */
     private createFinalMessage;
+    /**
+     * Creates the final streaming notification used when streaming stops but processing continues.
+     */
+    private createStreamStoppedMessage;
+    /**
+     * Creates a checkpoint or final notification for a channel streaming timeout.
+     */
+    private createStreamTimedOutMessage;
+    /**
+     * Creates the last streaming update sent before proactively finalizing an
+     * M365 Copilot stream.
+     */
+    private createStreamTimedOutStreamingUpdate;
     /**
      * Sends an activity to the client and saves the stream ID returned.
      *
@@ -224,6 +259,27 @@ export declare class StreamingResponse {
      * @private
      */
     private sendActivity;
+    /**
+     * Updates the existing streaming activity without allowing failures to escape the queue.
+     */
+    private updateActivity;
+    /**
+     * Starts M365 Copilot keep-alive and maximum-duration timers.
+     */
+    private startStreamTimers;
+    /**
+     * Schedules an informative update before M365 Copilot's idle timeout.
+     */
+    private scheduleKeepAlive;
+    /**
+     * Finalizes an M365 Copilot stream that reached the channel duration limit.
+     */
+    private handleM365StreamTimeout;
+    /**
+     * Stops active channel timeout timers.
+     */
+    private clearStreamTimers;
+    private isM365Copilot;
     /**
      * Loads default values for the streaming response.
      */

package/dist/src/app/streaming/streamingResponse.js

@@ -10,6 +10,10 @@ const citationUtil_1 = require("./citationUtil");
 const agents_telemetry_1 = require("@microsoft/agents-telemetry");
 const errorHelper_1 = require("../../errorHelper");
 const logger = (0, agents_telemetry_1.debug)('agents:streamingResponse');
+const teamsStreamTimedOut = 'Content stream finished due to exceeded streaming time.';
+const defaultStreamingTakingTooLongMessage = 'The response is taking longer than expected. Please wait while we continue to generate the response.';
+const m365StreamingTimeoutMs = 105000;
+const m365WorkingNoticeIntervalMs = 35000;
 /**
  * Results for streaming response operations.
  */
@@ -58,6 +62,10 @@ class StreamingResponse {
         this._isStreamingChannel = true;
         this._canceled = false;
         this._userCanceled = false;
+        this._streamTimedOut = false;
+        this._streamTimeoutNotificationSent = false;
+        this._lastInformationalMessageSent = '';
+        this._streamingTakingTooLongMessage = defaultStreamingTakingTooLongMessage;
         // Queue for outgoing activities
         this._queue = [];
         this._chunkQueued = false;
@@ -109,12 +117,27 @@ class StreamingResponse {
     get isStreamingChannel() {
         return this._isStreamingChannel;
     }
+    /**
+     * Gets the message sent when streaming takes longer than the channel allows.
+     */
+    get streamingTakingTooLongMessage() {
+        return this._streamingTakingTooLongMessage;
+    }
+    /**
+     * Sets the message sent when streaming takes longer than the channel allows.
+     */
+    set streamingTakingTooLongMessage(message) {
+        this._streamingTakingTooLongMessage = message;
+    }
     /**
      * Queues an informative update to be sent to the client.
      *
      * @param {string} text Text of the update to send.
      */
     queueInformativeUpdate(text) {
+        if (this.isM365Copilot()) {
+            this._lastInformationalMessageSent = text;
+        }
         if (!this.isStreamingChannel || !text.trim() || this._canceled) {
             return;
         }
@@ -166,6 +189,7 @@ class StreamingResponse {
      * @returns {Promise<StreamingResponseResult>} - StreamingResponseResult with the result of the streaming response.
      */
     async endStream() {
+        var _a;
         if (this._ended) {
             return StreamingResponseResult.AlreadyEnded;
         }
@@ -174,14 +198,33 @@ class StreamingResponse {
         }
         // Queue final message
         this._ended = true;
+        this.clearStreamTimers();
         if (!this.isStreamingChannel) {
-            await this.sendActivity(this.createFinalMessage());
+            // A failed streaming send may still be updating the timed-out activity.
+            // Preserve ordering so that the completed response is always the last update.
+            await this.waitForQueue();
+            if (this._streamTimeoutNotificationSent && !this._message && !this._finalMessage && !((_a = this._attachments) === null || _a === void 0 ? void 0 : _a.length)) {
+                return StreamingResponseResult.Success;
+            }
+            const finalMessage = this.createFinalMessage();
+            if (this._streamTimedOut) {
+                await this.updateActivity(finalMessage);
+            }
+            else {
+                await this.sendActivity(finalMessage);
+            }
             return StreamingResponseResult.Success;
         }
         // Queue final message
         this.queueNextChunk();
         // Wait for the queue to drain
         await this.waitForQueue();
+        // The final streaming send itself can report that the channel timed out. In
+        // that case the queued final activity is discarded and must be applied as
+        // an update after the timeout recovery has completed.
+        if (this._streamTimedOut) {
+            await this.updateActivity(this.createFinalMessage());
+        }
         return StreamingResponseResult.Success;
     }
     /**
@@ -190,12 +233,17 @@ class StreamingResponse {
      */
     async reset() {
         await this.waitForQueue();
+        this.clearStreamTimers();
         this._queueSync = undefined;
         this._queue = [];
         this._chunkQueued = false;
         this._ended = false;
         this._canceled = false;
         this._userCanceled = false;
+        this._streamTimedOut = false;
+        this._streamTimeoutNotificationSent = false;
+        this._lastInformationalMessageSent = '';
+        this._streamStartedAt = undefined;
         this._message = '';
         this._nextSequence = 1;
         this._streamId = undefined;
@@ -311,6 +359,26 @@ class StreamingResponse {
     getMessage() {
         return this._message;
     }
+    /**
+     * Ends the streaming portion of a response while allowing the underlying operation to continue.
+     *
+     * @param message Message sent to notify the user that streaming has stopped.
+     * @returns Whether the streaming response was stopped.
+     */
+    async sendStreamTimedOutNotification(message) {
+        if (this._ended || this._canceled || !this.isStreamingChannel) {
+            return false;
+        }
+        // Ensure any in-flight queued sends complete before we send the timeout notification.
+        await this.waitForQueue();
+        await this.sendActivity(this.createStreamStoppedMessage(message));
+        this._streamTimeoutNotificationSent = true;
+        this._isStreamingChannel = false;
+        this._queue = [];
+        this._chunkQueued = false;
+        this.clearStreamTimers();
+        return true;
+    }
     /**
      * Waits for the outgoing activity queue to be empty.
      *
@@ -395,6 +463,9 @@ class StreamingResponse {
         (_b = activity.entities) !== null && _b !== void 0 ? _b : (activity.entities = []);
         activity.attachments = this._attachments;
         this._nextSequence++; // Increment sequence for final message, even if not streaming.
+        if (this._streamTimedOut && this._streamId) {
+            activity.id = this._streamId;
+        }
         if (this.isStreamingChannel) {
             activity.entities.push({
                 type: 'streaminfo',
@@ -404,6 +475,65 @@ class StreamingResponse {
         }
         return activity;
     }
+    /**
+     * Creates the final streaming notification used when streaming stops but processing continues.
+     */
+    createStreamStoppedMessage(message) {
+        return agents_activity_1.Activity.fromObject({
+            type: 'message',
+            text: message || 'No text was streamed',
+            entities: [{
+                    type: 'streaminfo',
+                    streamType: 'final',
+                    streamResult: this._message ? 'success' : 'error',
+                    streamSequence: this._nextSequence++
+                }]
+        });
+    }
+    /**
+     * Creates a checkpoint or final notification for a channel streaming timeout.
+     */
+    createStreamTimedOutMessage(addStreamFinal = false) {
+        const text = this._message
+            ? `${this._message}\n\n${this.streamingTakingTooLongMessage}\n`
+            : this.streamingTakingTooLongMessage;
+        const activity = agents_activity_1.Activity.fromObject({
+            type: 'message',
+            text,
+            entities: []
+        });
+        if (this._streamId) {
+            activity.id = this._streamId;
+        }
+        if (addStreamFinal) {
+            activity.entities.push({
+                type: 'streaminfo',
+                streamType: 'final',
+                streamId: this._streamId,
+                streamResult: this._message ? 'success' : 'error',
+                streamSequence: this._nextSequence++
+            });
+        }
+        return activity;
+    }
+    /**
+     * Creates the last streaming update sent before proactively finalizing an
+     * M365 Copilot stream.
+     */
+    createStreamTimedOutStreamingUpdate() {
+        const text = this._message
+            ? `${this._message}\n\n${this.streamingTakingTooLongMessage}\n`
+            : this.streamingTakingTooLongMessage;
+        return agents_activity_1.Activity.fromObject({
+            type: 'typing',
+            text,
+            entities: [{
+                    type: 'streaminfo',
+                    streamType: 'streaming',
+                    streamSequence: this._nextSequence++
+                }]
+        });
+    }
     /**
      * Sends an activity to the client and saves the stream ID returned.
      *
@@ -412,21 +542,19 @@ class StreamingResponse {
      * @private
      */
     async sendActivity(activity) {
-        var _a, _b;
-        // Set activity ID to the assigned stream ID
-        if (this._streamId) {
+        var _a, _b, _c;
+        this.startStreamTimers();
+        // Only streaming activities should carry stream metadata. Once streaming
+        // has stopped, the completed response must be sent as an independent
+        // message without an orphaned streamId entity.
+        const streamInfo = (_a = activity.entities) === null || _a === void 0 ? void 0 : _a.find(entity => { var _a; return ((_a = entity.type) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'streaminfo'; });
+        if (this._streamId && streamInfo) {
             activity.id = this._streamId;
-            if (!activity.entities) {
-                activity.entities = [];
-            }
-            if (!activity.entities[0]) {
-                activity.entities[0] = {};
-            }
-            activity.entities[0].streamId = this._streamId;
+            streamInfo.streamId = this._streamId;
         }
         if (this._citations && this._citations.length > 0 && !this._ended) {
             // Filter out the citations unused in content.
-            const currCitations = (_a = citationUtil_1.CitationUtil.getUsedCitations(this._message, this._citations)) !== null && _a !== void 0 ? _a : undefined;
+            const currCitations = (_b = citationUtil_1.CitationUtil.getUsedCitations(this._message, this._citations)) !== null && _b !== void 0 ? _b : undefined;
             activity.entities.push({
                 type: 'https://schema.org/Message',
                 '@type': 'Message',
@@ -438,7 +566,7 @@ class StreamingResponse {
         // Add in Powered by AI feature flags
         if (this._ended) {
             activity.channelData = {
-                feedbackLoopEnabled: (_b = this._enableFeedbackLoop) !== null && _b !== void 0 ? _b : false,
+                feedbackLoopEnabled: (_c = this._enableFeedbackLoop) !== null && _c !== void 0 ? _c : false,
                 ...(this._feedbackLoopType ? { type: this._feedbackLoopType } : {})
             };
             // Add in Generated by AI
@@ -451,24 +579,127 @@ class StreamingResponse {
             if (!this._streamId) {
                 this._streamId = response === null || response === void 0 ? void 0 : response.id;
             }
+            if (this.isM365Copilot() && this.isStreamingChannel && !this._ended) {
+                this.scheduleKeepAlive();
+            }
             await new Promise((resolve) => setTimeout(resolve, this.delayInMs));
         }
         catch (error) {
-            const { message } = error;
+            const message = error instanceof Error ? error.message : String(error);
             this._canceled = true;
-            this._queueSync = undefined;
             this._queue = [];
+            this._chunkQueued = false;
+            this.clearStreamTimers();
             // MS Teams code list: https://learn.microsoft.com/en-us/microsoftteams/platform/bots/streaming-ux?tabs=jsts#error-codes
-            if (message.includes('ContentStreamNotAllowed')) {
+            const normalizedMessage = message.toLowerCase();
+            if (normalizedMessage.includes('contentstreamnotallowed') && normalizedMessage.includes(teamsStreamTimedOut.toLowerCase())) {
+                logger.warn('Client canceled due to exceeded allowed streaming time.', { originalError: message });
+                this._streamTimedOut = true;
+                this._canceled = false;
+                this._isStreamingChannel = false;
+                await this.updateActivity(this.createStreamTimedOutMessage());
+            }
+            else if (normalizedMessage.includes('contentstreamnotallowed')) {
                 logger.warn('Streaming content is not allowed by the client side.', { originalError: message });
                 this._userCanceled = true;
             }
-            else if (message.includes('BadArgument') && message.toLowerCase().includes('streaming api is not enabled')) {
+            else if (normalizedMessage.includes('badargument') && normalizedMessage.includes('streaming api is not enabled')) {
                 logger.warn('Interaction does not support streaming. Defaulting to non-streaming response.', { originalError: message });
                 this._canceled = false;
                 this._isStreamingChannel = false;
             }
+            else {
+                logger.error('Exception during StreamingResponse sendActivity.', { originalError: message });
+            }
+        }
+    }
+    /**
+     * Updates the existing streaming activity without allowing failures to escape the queue.
+     */
+    async updateActivity(activity) {
+        try {
+            await this._context.updateActivity(activity);
+        }
+        catch (error) {
+            logger.warn('Exception during StreamingResponse updateActivity.', { originalError: error.message });
+        }
+    }
+    /**
+     * Starts M365 Copilot keep-alive and maximum-duration timers.
+     */
+    startStreamTimers() {
+        if (!this.isM365Copilot() || !this.isStreamingChannel || this._streamStartedAt !== undefined) {
+            return;
+        }
+        this._streamStartedAt = Date.now();
+        this.scheduleKeepAlive();
+        this._streamTimeoutTimer = setTimeout(() => {
+            this.handleM365StreamTimeout().catch(error => {
+                logger.error('Error handling the M365 Copilot streaming timeout.', { originalError: error.message });
+            });
+        }, m365StreamingTimeoutMs);
+    }
+    /**
+     * Schedules an informative update before M365 Copilot's idle timeout.
+     */
+    scheduleKeepAlive() {
+        if (!this.isM365Copilot() || !this.isStreamingChannel || this._ended) {
+            return;
+        }
+        if (this._keepAliveTimer) {
+            clearTimeout(this._keepAliveTimer);
+        }
+        this._keepAliveTimer = setTimeout(() => {
+            this._keepAliveTimer = undefined;
+            if (!this._ended && this.isStreamingChannel && this._queue.length === 0) {
+                this.queueInformativeUpdate(this._lastInformationalMessageSent.trim()
+                    ? this._lastInformationalMessageSent
+                    : this.streamingTakingTooLongMessage);
+            }
+        }, m365WorkingNoticeIntervalMs);
+    }
+    /**
+     * Finalizes an M365 Copilot stream that reached the channel duration limit.
+     */
+    async handleM365StreamTimeout() {
+        if (this._ended || this._canceled || !this.isStreamingChannel || !this.isM365Copilot()) {
+            return;
+        }
+        logger.warn('M365 Copilot streaming response reached the maximum duration. Finalizing the stream and continuing in non-streaming mode.', {
+            streamId: this._streamId,
+            elapsedMs: this._streamStartedAt === undefined ? undefined : Date.now() - this._streamStartedAt
+        });
+        const timedOutActivities = this._message
+            ? [this.createStreamTimedOutStreamingUpdate(), this.createStreamTimedOutMessage(true)]
+            : [this.createStreamTimedOutMessage(true)];
+        this._streamTimeoutNotificationSent = true;
+        this._isStreamingChannel = false;
+        this._queue = [];
+        this._chunkQueued = false;
+        this.clearStreamTimers();
+        // Queue these behind any in-flight send. Clearing pending activities and
+        // using the same drain prevents out-of-order stream sequences.
+        for (const activity of timedOutActivities) {
+            this.queueActivity(() => activity);
         }
+        await this.waitForQueue();
+    }
+    /**
+     * Stops active channel timeout timers.
+     */
+    clearStreamTimers() {
+        if (this._keepAliveTimer) {
+            clearTimeout(this._keepAliveTimer);
+            this._keepAliveTimer = undefined;
+        }
+        if (this._streamTimeoutTimer) {
+            clearTimeout(this._streamTimeoutTimer);
+            this._streamTimeoutTimer = undefined;
+        }
+    }
+    isM365Copilot() {
+        var _a;
+        return ((_a = this._context.activity.channelId) === null || _a === void 0 ? void 0 : _a.toLocaleLowerCase()) === agents_activity_1.Channels.M365Copilot.toLocaleLowerCase();
     }
     /**
      * Loads default values for the streaming response.
@@ -481,15 +712,8 @@ class StreamingResponse {
             this._isStreamingChannel = false;
         }
         else if (agents_activity_1.Channels.Msteams === activity.channelIdChannel) {
-            if (activity.isAgenticRequest()) {
-                // Agentic requests do not support streaming responses at this time.
-                // TODO: Enable streaming for agentic requests when supported.
-                this._isStreamingChannel = false;
-            }
-            else {
-                this._isStreamingChannel = true;
-                this._delayInMs = 1000;
-            }
+            this._isStreamingChannel = true;
+            this._delayInMs = 1000;
         }
         else if (agents_activity_1.Channels.Webchat === activity.channelId || agents_activity_1.Channels.Directline === activity.channelId || agents_activity_1.Channels.Emulator === activity.channelId) {
             this._isStreamingChannel = true;