@oneuptime/common 14.0.9 → 14.0.11

package/build/dist/Server/Utils/Workspace/MicrosoftTeams/MicrosoftTeams.js

@@ -35,7 +35,7 @@ import { truncateToLength } from "../../Database/TruncateColumnValue";
 import { CloudAdapter, ConfigurationBotFrameworkAuthentication, TeamsActivityHandler, TeamsInfo, MessageFactory, } from "botbuilder";
 import MicrosoftTeamsServiceUrl from "./MicrosoftTeamsServiceUrl";
 // Teams action handlers and types
-import MicrosoftTeamsAuthAction from "./Actions/Auth";
+import MicrosoftTeamsAuthAction, { MicrosoftTeamsAccountNotLinkedException, } from "./Actions/Auth";
 import MicrosoftTeamsIncidentActions from "./Actions/Incident";
 import MicrosoftTeamsAlertActions from "./Actions/Alert";
 import MicrosoftTeamsAlertEpisodeActions from "./Actions/AlertEpisode";
@@ -43,9 +43,14 @@ import MicrosoftTeamsIncidentEpisodeActions from "./Actions/IncidentEpisode";
 import MicrosoftTeamsMonitorActions from "./Actions/Monitor";
 import MicrosoftTeamsScheduledMaintenanceActions from "./Actions/ScheduledMaintenance";
 import MicrosoftTeamsOnCallDutyActions from "./Actions/OnCallDutyPolicy";
+import MicrosoftTeamsActivityDeduplicator from "./MicrosoftTeamsActivityDeduplicator";
+import MicrosoftTeamsCreateCommands from "./MicrosoftTeamsCreateCommands";
+import MicrosoftTeamsMessageSize from "./MicrosoftTeamsMessageSize";
+import MicrosoftTeamsReplies from "./MicrosoftTeamsReplies";
 import WorkspaceActionAuthorization from "../WorkspaceActionAuthorization";
 import NotAuthorizedException from "../../../../Types/Exception/NotAuthorizedException";
 import AIService, { AI_DISABLED_MESSAGE } from "../../../Services/AIService";
+import { escapeMarkdownInline } from "../../../../Utils/Markdown/MarkdownEscape";
 // Microsoft Teams apps should always be single-tenant
 const MICROSOFT_TEAMS_APP_TYPE = "SingleTenant";
 /*
@@ -123,6 +128,11 @@ const MICROSOFT_TEAMS_ROSTER_ERROR_FRAGMENTS = [
 ];
 // Maximum number of pages to fetch when paginating teams
 const MICROSOFT_TEAMS_MAX_PAGES = 500;
+// Bot commands that open a form; text after them becomes the form's title.
+const CREATE_INCIDENT_COMMAND = "create incident";
+const CREATE_MAINTENANCE_COMMAND = "create maintenance";
+// How many affected monitors a "show ..." reply names for one item.
+const MICROSOFT_TEAMS_MAX_AFFECTED_MONITOR_NAMES = 10;
 /*
  * Hosts that may receive a Teams incoming webhook. Legacy Connector webhooks
  * use Office domains. Teams Workflows use regional logic.azure.com hosts, and
@@ -1965,7 +1975,7 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
     }
     // Bot Framework specific methods
     static async handleBotMessageActivity(data) {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e;
         // Handle direct messages to bot or @mentions via Bot Framework
         const messageText = data.activity["text"] || "";
         const possibleActionValue = data.activity["value"] || {};
@@ -2024,18 +2034,8 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
                 onlyIfMissingOrStale: true,
             });
         }
-        // If this is actually an Adaptive Card submit wrapped as a message, route to invoke handler
-        if (possibleActionValue["action"] ||
-            ((_b = possibleActionValue["data"]) === null || _b === void 0 ? void 0 : _b["action"])) {
-            logger.debug("Message activity contains action payload; routing to invoke handler");
-            await this.handleBotInvokeActivity({
-                activity: data.activity,
-                turnContext: data.turnContext,
-            });
-            return;
-        }
         // Check if the bot was mentioned
-        const recipientId = (_c = data.activity["recipient"]) === null || _c === void 0 ? void 0 : _c["id"];
+        const recipientId = (_b = data.activity["recipient"]) === null || _b === void 0 ? void 0 : _b["id"];
         const conversationType = conversation["conversationType"] || "";
         const isDirectMessage = conversationType === "personal";
         const isMentioned = entities.some((entity) => {
@@ -2043,29 +2043,34 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
             return (entity["type"] === "mention" &&
                 ((_a = entity["mentioned"]) === null || _a === void 0 ? void 0 : _a["id"]) === recipientId);
         });
-        // Only respond if it's a direct message or the bot was mentioned
-        if (!isDirectMessage && !isMentioned) {
+        // An Adaptive Card submit arrives as a message whose value names the action.
+        const isCardSubmit = Boolean(possibleActionValue["action"] ||
+            ((_c = possibleActionValue["data"]) === null || _c === void 0 ? void 0 : _c["action"]));
+        // Only respond to card submits, direct messages and @mentions.
+        if (!isCardSubmit && !isDirectMessage && !isMentioned) {
             logger.debug("Bot not mentioned in channel message, ignoring");
             return;
         }
-        // Extract tenant ID to get project ID
-        const tenantId = (_d = channelData["tenant"]) === null || _d === void 0 ? void 0 : _d["id"];
-        if (!tenantId) {
-            logger.error("Tenant ID not found in channelData");
-            await data.turnContext.sendActivity("Sorry, I couldn't identify your organization. Please try again later.");
+        /*
+         * Teams delivers an activity again when the first delivery was slow or
+         * failed. Handling it twice sends every reply twice and creates a
+         * submitted incident twice, so only the first delivery is handled.
+         */
+        if (!(await MicrosoftTeamsActivityDeduplicator.claim(data.activity))) {
+            logger.debug("Microsoft Teams delivered this activity before; ignoring the repeat", {
+                activityId: data.activity["id"] || "",
+            });
             return;
         }
-        // Get project auth by tenant ID
-        const tenantResolution = await this.resolveProjectByTenantId({
-            tenantId: tenantId,
-        });
-        if (!tenantResolution.projectAuth ||
-            !tenantResolution.projectAuth.projectId) {
-            await data.turnContext.sendActivity(this.getTenantResolutionFailureMessage(tenantResolution));
+        // If this is actually an Adaptive Card submit wrapped as a message, route to invoke handler
+        if (isCardSubmit) {
+            logger.debug("Message activity contains action payload; routing to invoke handler");
+            await this.handleBotInvokeActivity({
+                activity: data.activity,
+                turnContext: data.turnContext,
+            });
             return;
         }
-        const projectId = tenantResolution.projectAuth.projectId;
-        logger.debug(`Found project ID: ${projectId.toString()} for tenant ID: ${tenantId}`);
         // Clean the message text by removing bot mentions
         const cleanText = messageText
             .replace(/<at[^>]*>.*?<\/at>/g, "")
@@ -2079,62 +2084,98 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
         const originalQuestionText = messageText
             .replace(/<at[^>]*>.*?<\/at>/g, "")
             .trim();
+        const isCreateIncidentCommand = cleanText === CREATE_INCIDENT_COMMAND ||
+            cleanText.startsWith(CREATE_INCIDENT_COMMAND + " ");
+        const isCreateMaintenanceCommand = cleanText === CREATE_MAINTENANCE_COMMAND ||
+            cleanText.startsWith(CREATE_MAINTENANCE_COMMAND + " ");
+        /*
+         * Explicit commands are matched precisely so that natural-language
+         * questions (which may incidentally contain words like "help" or
+         * "alerts") fall through to the AI assistant instead of a canned command.
+         */
+        const isHelpCommand = cleanText === "help" || cleanText === "" || cleanText === "?";
+        const isShowActiveIncidentsCommand = cleanText === "show active incidents" || cleanText === "active incidents";
+        const isShowScheduledMaintenanceCommand = cleanText === "show scheduled maintenance" ||
+            cleanText === "scheduled maintenance";
+        const isShowOngoingMaintenanceCommand = cleanText === "show ongoing maintenance" ||
+            cleanText === "ongoing maintenance";
+        const isShowActiveAlertsCommand = cleanText === "show active alerts" || cleanText === "active alerts";
+        /*
+         * "ask <question>" is an explicit prefix that always routes to the AI
+         * assistant. When present, strip the prefix and use the remainder as the
+         * question.
+         */
+        const isAskCommand = cleanText === "ask" || cleanText.startsWith("ask ");
+        /*
+         * The command, named for log lines that must not quote the message: a
+         * free-form question can carry things that do not belong in a log.
+         */
+        const commandName = (_d = [
+            { matches: isHelpCommand, name: "help" },
+            { matches: isCreateIncidentCommand, name: CREATE_INCIDENT_COMMAND },
+            { matches: isCreateMaintenanceCommand, name: CREATE_MAINTENANCE_COMMAND },
+            { matches: isShowActiveIncidentsCommand, name: "show active incidents" },
+            {
+                matches: isShowScheduledMaintenanceCommand,
+                name: "show scheduled maintenance",
+            },
+            {
+                matches: isShowOngoingMaintenanceCommand,
+                name: "show ongoing maintenance",
+            },
+            { matches: isShowActiveAlertsCommand, name: "show active alerts" },
+            { matches: isAskCommand, name: "ask" },
+        ].find((command) => {
+            return command.matches;
+        })) === null || _d === void 0 ? void 0 : _d.name;
+        let projectId = undefined;
         let responseText = "";
         try {
-            const isCreateIncidentCommand = cleanText === "create incident" ||
-                cleanText.startsWith("create incident ");
-            const isCreateMaintenanceCommand = cleanText === "create maintenance" ||
-                cleanText.startsWith("create maintenance ");
-            /*
-             * Explicit commands are matched precisely so that natural-language
-             * questions (which may incidentally contain words like "help" or
-             * "alerts") fall through to the AI assistant instead of a canned command.
-             */
-            const isHelpCommand = cleanText === "help" || cleanText === "" || cleanText === "?";
-            const isShowActiveIncidentsCommand = cleanText === "show active incidents" ||
-                cleanText === "active incidents";
-            const isShowScheduledMaintenanceCommand = cleanText === "show scheduled maintenance" ||
-                cleanText === "scheduled maintenance";
-            const isShowOngoingMaintenanceCommand = cleanText === "show ongoing maintenance" ||
-                cleanText === "ongoing maintenance";
-            const isShowActiveAlertsCommand = cleanText === "show active alerts" || cleanText === "active alerts";
-            /*
-             * "ask <question>" is an explicit prefix that always routes to the AI
-             * assistant. When present, strip the prefix and use the remainder as the
-             * question.
-             */
-            const isAskCommand = cleanText === "ask" || cleanText.startsWith("ask ");
+            // Extract tenant ID to get project ID
+            const tenantId = (_e = channelData["tenant"]) === null || _e === void 0 ? void 0 : _e["id"];
+            if (!tenantId) {
+                logger.error("Tenant ID not found in channelData");
+                await data.turnContext.sendActivity("Sorry, I couldn't identify your organization. Please try again later.");
+                return;
+            }
+            // Get project auth by tenant ID
+            const tenantResolution = await this.resolveProjectByTenantId({
+                tenantId: tenantId,
+            });
+            if (!tenantResolution.projectAuth ||
+                !tenantResolution.projectAuth.projectId) {
+                await data.turnContext.sendActivity(this.getTenantResolutionFailureMessage(tenantResolution));
+                return;
+            }
+            projectId = tenantResolution.projectAuth.projectId;
+            logger.debug(`Found project ID: ${projectId.toString()} for tenant ID: ${tenantId}`);
             if (isHelpCommand) {
                 responseText = this.getHelpMessage();
             }
             else if (isCreateIncidentCommand) {
-                // Handle create incident command (legacy slash command supported)
+                // "create incident <title>" opens the form with the title filled in.
                 logger.debug("Processing create incident command");
-                const card = await MicrosoftTeamsIncidentActions.buildNewIncidentCard(projectId);
-                await data.turnContext.sendActivity({
-                    attachments: [
-                        {
-                            contentType: "application/vnd.microsoft.card.adaptive",
-                            content: card,
-                        },
-                    ],
+                await MicrosoftTeamsCreateCommands.handleCreateIncidentCommand({
+                    turnContext: data.turnContext,
+                    activity: data.activity,
+                    projectId: projectId,
+                    initialTitle: originalQuestionText
+                        .substring(CREATE_INCIDENT_COMMAND.length)
+                        .trim(),
                 });
-                logger.debug("New incident card sent successfully");
                 return;
             }
             else if (isCreateMaintenanceCommand) {
-                // Handle create maintenance command (legacy slash command supported)
+                // "create maintenance <title>" opens the form with the title filled in.
                 logger.debug("Processing create maintenance command");
-                const card = await MicrosoftTeamsScheduledMaintenanceActions.buildNewScheduledMaintenanceCard(projectId);
-                await data.turnContext.sendActivity({
-                    attachments: [
-                        {
-                            contentType: "application/vnd.microsoft.card.adaptive",
-                            content: card,
-                        },
-                    ],
+                await MicrosoftTeamsCreateCommands.handleCreateScheduledMaintenanceCommand({
+                    turnContext: data.turnContext,
+                    activity: data.activity,
+                    projectId: projectId,
+                    initialTitle: originalQuestionText
+                        .substring(CREATE_MAINTENANCE_COMMAND.length)
+                        .trim(),
                 });
-                logger.debug("New scheduled maintenance card sent successfully");
                 return;
             }
             else if (isShowActiveIncidentsCommand) {
@@ -2172,18 +2213,71 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
                 });
                 return;
             }
-            // Send response directly using TurnContext - this is the recommended Bot Framework pattern
-            await data.turnContext.sendActivity(responseText);
+            /*
+             * Send response directly using TurnContext - this is the recommended Bot
+             * Framework pattern. Lists grow with the project, so the text is kept
+             * within what Teams accepts.
+             */
+            await data.turnContext.sendActivity(MicrosoftTeamsMessageSize.fitTextToBudget({ text: responseText }));
             logger.debug("Bot message sent successfully using TurnContext", {
                 projectId: projectId.toString(),
             });
         }
         catch (error) {
-            logger.error("Error sending bot message via TurnContext: " + error, {
-                projectId: projectId.toString(),
+            /*
+             * One reply, and no rethrow. This used to reply and then rethrow: the
+             * adapter answered Teams with HTTP 500, Teams delivered the message
+             * again, and every failure showed up twice (issue #4111).
+             */
+            /*
+             * The command is named, not quoted: a free-form question can carry
+             * things that do not belong in an error log. The text is in the debug
+             * log above.
+             */
+            MicrosoftTeamsReplies.logFailure(`Microsoft Teams message ${data.activity["id"] || ""} (${commandName
+                ? `"${commandName}"`
+                : `a ${cleanText.length}-character question`}) failed`, error, {
+                projectId: projectId === null || projectId === void 0 ? void 0 : projectId.toString(),
+            });
+            await MicrosoftTeamsReplies.sendBestEffort(data.turnContext, this.getUnexpectedErrorMessage(data.activity));
+        }
+    }
+    /*
+     * The reply to a message whose handling failed in a way nobody planned for.
+     * It names the activity id, which the server log line carries too, so an
+     * administrator can find what went wrong.
+     */
+    static getUnexpectedErrorMessage(activity) {
+        const reference = activity["id"] || "";
+        return `Sorry, something went wrong in OneUptime while handling that message. Please try again in a minute.${reference
+            ? ` If it keeps happening, ask your OneUptime administrator to look for reference ${reference} in the server logs.`
+            : ""}`;
+    }
+    /*
+     * The last line of defence for an inbound activity whose handler threw.
+     *
+     * The error is logged and the turn ends normally, so CloudAdapter answers
+     * Teams with 200. Letting the error through made CloudAdapter answer HTTP
+     * 500, Teams delivered the activity again, and every reply the turn had
+     * posted appeared twice (issue #4111). A message that got no reply yet gets
+     * one; an invoke gets the response it needs, or CloudAdapter answers 501.
+     *
+     * This is deliberately not adapter.onTurnError: the same adapter sends
+     * proactive notifications, and their callers need their errors thrown.
+     */
+    static async recoverFromFailedTurn(data) {
+        const { turnContext, error } = data;
+        const activity = turnContext.activity || {};
+        MicrosoftTeamsReplies.logFailure(`Microsoft Teams ${activity.type || "unknown"} activity ${activity.id || ""} failed`, error);
+        if (activity.type === "message" && !turnContext.responded) {
+            await MicrosoftTeamsReplies.sendBestEffort(turnContext, this.getUnexpectedErrorMessage(activity));
+            return;
+        }
+        if (activity.type === "invoke") {
+            await MicrosoftTeamsReplies.sendBestEffort(turnContext, {
+                type: "invokeResponse",
+                value: { status: 200 },
             });
-            await data.turnContext.sendActivity("Sorry, I encountered an error processing your request. Please try again later.");
-            throw error;
         }
     }
     /*
@@ -2192,13 +2286,31 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
      * channel/chat message bodies are typically HTML (body.contentType "html").
      */
     static toPlainTextFromTeamsMessageBody(rawContent) {
-        return rawContent
-            .replace(/<at[^>]*>.*?<\/at>/g, "")
-            .replace(/<[^>]*>/g, "")
+        return this.stripHtmlTags(rawContent.replace(/<at[^>]*>.*?<\/at>/g, ""))
             .replace(/&nbsp;/g, " ")
             .replace(/\s+/g, " ")
             .trim();
     }
+    /*
+     * Plain text out of a Teams message body, which Graph and the Bot Framework
+     * hand over as HTML. Removing complete tags is not enough on its own: an
+     * unclosed one ("<script" with no ">" after it) matches no tag pattern, so
+     * once no tag is left, any "<" still standing goes too, and the text holds
+     * no markup at all. The tag pass repeats until nothing changes - the shape
+     * code scanning recognises as complete, where a single pass is reported as
+     * incomplete multi-character sanitization. Teams sends a literal "<" in a
+     * message as "&lt;", which is left encoded: decoding it here would hand
+     * back what this removed.
+     */
+    static stripHtmlTags(html) {
+        let text = html;
+        let previous;
+        do {
+            previous = text;
+            text = text.replace(/<[^>]*>/g, "");
+        } while (text !== previous);
+        return text.replace(/</g, "");
+    }
     /*
      * AI Ops: gather the prior turns of the current Teams conversation/thread and
      * map them to the assistant's history shape ({ role, content }, oldest-first,
@@ -2382,12 +2494,18 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
                 });
         }
         catch (error) {
+            // A failed lookup is not a missing account; the caller answers it.
+            if (!(error instanceof MicrosoftTeamsAccountNotLinkedException)) {
+                throw error;
+            }
             logger.debug("No OneUptime user linked to Teams user; prompting to connect account", {
                 projectId: projectId.toString(),
                 workspaceUserId: teamsUserId,
             });
-            logger.debug(error);
-            await turnContext.sendActivity("I couldn't find your OneUptime account. Please connect your Microsoft Teams account in OneUptime User Settings before asking me questions.");
+            await turnContext.sendActivity(await MicrosoftTeamsReplies.getAccountNotLinkedMessage({
+                projectId: projectId,
+                purpose: "ask OneUptime questions from Microsoft Teams",
+            }));
             return;
         }
         // The user's real permission props - the assistant's tools run under these.
@@ -2488,6 +2606,25 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
             await turnContext.sendActivity("Sorry, I ran into a problem answering that question. Please try again later.");
         }
     }
+    /*
+     * The monitors an incident or maintenance event affects, as one line: the
+     * first few names, then how many more. An event can cover hundreds of
+     * monitors, and listing them all made the reply too large for Teams.
+     */
+    static formatAffectedMonitorNames(monitors) {
+        const names = monitors
+            .map((monitor) => {
+            return monitor.name || "";
+        })
+            .filter((name) => {
+            return Boolean(name);
+        });
+        const shownNames = names.slice(0, MICROSOFT_TEAMS_MAX_AFFECTED_MONITOR_NAMES);
+        const notShownCount = names.length - shownNames.length;
+        return notShownCount > 0
+            ? `${shownNames.join(", ")} and ${notShownCount} more`
+            : shownNames.join(", ");
+    }
     // Helper methods for bot commands
     static getHelpMessage() {
         return `Hello! I'm the OneUptime bot. I can help you with the following commands:
@@ -2495,8 +2632,8 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
 **Available Commands:**
 - **help** - Show this help message
 - **ask <question>** - Ask OneUptime AI about your logs, traces, metrics, incidents and monitors
-- **create incident** - Create a new incident
-- **create maintenance** - Create a new scheduled maintenance event
+- **create incident [title]** - Create a new incident
+- **create maintenance [title]** - Create a new scheduled maintenance event
 - **show active incidents** - Display all currently active incidents
 - **show scheduled maintenance** - Show upcoming scheduled maintenance events
 - **show ongoing maintenance** - Display currently ongoing maintenance events
@@ -2574,17 +2711,21 @@ If you need to report an incident or check historical incidents, please visit th
                         ? "🟠"
                         : "🟡";
                 const incidentUrl = await IncidentService.getIncidentLinkInDashboard(projectId, incident.id);
-                message += `${severityIcon} **[Incident ${incident.incidentNumberWithPrefix || "#" + incident.incidentNumber}: ${incident.title}](${incidentUrl.toString()})**
+                /*
+                 * The title - plain text, which anyone holding an incident form's
+                 * link may have typed - sits inside the link's text, so every
+                 * Markdown character in it is escaped: a "]" cannot end that text
+                 * early and point the rest somewhere else, and "![...](...)" is no
+                 * image. Escaping brackets alone is not enough there: marked, for
+                 * one, undoes "\[" and "\]" in a link's text before reading it.
+                 */
+                message += `${severityIcon} **[Incident ${incident.incidentNumberWithPrefix || "#" + incident.incidentNumber}: ${escapeMarkdownInline(incident.title)}](${incidentUrl.toString()})**
 • **Severity:** ${severity}
 • **Status:** ${state}
 • **Declared:** ${declaredAtText}
 `;
                 if (incident.monitors && incident.monitors.length > 0) {
-                    message += `• **Affected Services:** ${incident.monitors
-                        .map((m) => {
-                        return m.name;
-                    })
-                        .join(", ")}\n`;
+                    message += `• **Affected Services:** ${this.formatAffectedMonitorNames(incident.monitors)}\n`;
                 }
                 if (incident.description) {
                     const desc = incident.description.replace(/\s+/g, " ");
@@ -2668,11 +2809,7 @@ Check back later for upcoming maintenance windows.`;
 • **Ends:** ${endTime}
 `;
                 if (event.monitors && event.monitors.length > 0) {
-                    message += `• **Affected Services:** ${event.monitors
-                        .map((m) => {
-                        return m.name;
-                    })
-                        .join(", ")}\n`;
+                    message += `• **Affected Services:** ${this.formatAffectedMonitorNames(event.monitors)}\n`;
                 }
                 if (event.description) {
                     const desc = event.description.replace(/\s+/g, " ");
@@ -2755,11 +2892,7 @@ All systems are currently operating normally.`;
 • **Expected End:** ${endTime}
 `;
                 if (event.monitors && event.monitors.length > 0) {
-                    message += `• **Affected Services:** ${event.monitors
-                        .map((m) => {
-                        return m.name;
-                    })
-                        .join(", ")}\n`;
+                    message += `• **Affected Services:** ${this.formatAffectedMonitorNames(event.monitors)}\n`;
                 }
                 if (event.description) {
                     const desc = event.description.replace(/\s+/g, " ");
@@ -2871,6 +3004,7 @@ All monitoring checks are passing normally.`;
         const { actionType, actionValue } = this.extractActionFromValue(value);
         logger.debug(`Bot invoke activity - Action type: ${actionType}`);
         logger.debug(`Bot invoke value: ${JSON.stringify(value)}`);
+        let projectId = undefined;
         try {
             // Resolve project and user context from activity
             const channelData = data.activity["channelData"] || {};
@@ -2888,7 +3022,7 @@ All monitoring checks are passing normally.`;
                 await data.turnContext.sendActivity(this.getTenantResolutionFailureMessage(tenantResolution));
                 return;
             }
-            const projectId = tenantResolution.projectAuth.projectId;
+            projectId = tenantResolution.projectAuth.projectId;
             const fromObj = (data.activity["from"] ||
                 {});
             const teamsUserId = fromObj["aadObjectId"] || undefined;
@@ -3001,19 +3135,39 @@ All monitoring checks are passing normally.`;
             }
         }
         catch (error) {
+            /*
+             * Every reply below is sent best-effort: a reply that fails here must
+             * not escape, or the adapter answers Teams with HTTP 500 and Teams
+             * delivers the action again (issue #4111).
+             */
+            // The account is not connected: say where to connect it.
+            if (error instanceof MicrosoftTeamsAccountNotLinkedException &&
+                projectId) {
+                logger.debug("Bot invoke activity from a Teams user with no linked account", {
+                    actionType: actionType,
+                });
+                await MicrosoftTeamsReplies.sendBestEffort(data.turnContext, await MicrosoftTeamsReplies.getAccountNotLinkedMessage({
+                    projectId: projectId,
+                    purpose: "use OneUptime actions in Microsoft Teams",
+                }));
+                return;
+            }
             // Tell the user why they were refused; the message is written for them.
             if (error instanceof NotAuthorizedException) {
                 logger.debug("Bot invoke activity refused: " + error.message, {
                     actionType: actionType,
                 });
-                await data.turnContext.sendActivity(error.message);
+                await MicrosoftTeamsReplies.sendBestEffort(data.turnContext, error.message);
                 return;
             }
-            logger.error("Error handling bot invoke activity:", {
+            MicrosoftTeamsReplies.logFailure("Error handling bot invoke activity", error, {
                 actionType: actionType,
+                projectId: projectId === null || projectId === void 0 ? void 0 : projectId.toString(),
             });
-            logger.error(error);
-            await data.turnContext.sendActivity("Sorry, that action failed. Please try again later.");
+            const reason = MicrosoftTeamsReplies.getUserFacingErrorMessage(error);
+            await MicrosoftTeamsReplies.sendBestEffort(data.turnContext, reason
+                ? `Sorry, that action failed: ${reason}`
+                : "Sorry, that action failed. Please try again later.");
         }
     }
     static async handleConversationUpdateActivity(data) {
@@ -4308,8 +4462,17 @@ All monitoring checks are passing normally.`;
                         from: (_a = context.activity.from) === null || _a === void 0 ? void 0 : _a.name,
                         conversationId: (_b = context.activity.conversation) === null || _b === void 0 ? void 0 : _b.id,
                     }));
-                // Run the activity through our activity handler
-                await activityHandler.run(context);
+                try {
+                    // Run the activity through our activity handler
+                    await activityHandler.run(context);
+                }
+                catch (error) {
+                    // Never answer Teams with a 500; see recoverFromFailedTurn.
+                    await MicrosoftTeamsUtil.recoverFromFailedTurn({
+                        turnContext: context,
+                        error: error,
+                    });
+                }
             });
             logger.debug("Bot Framework activity processed successfully");
         }
@@ -4709,9 +4872,8 @@ All monitoring checks are passing normally.`;
                     }
                     const body = msg["body"];
                     let text = (body === null || body === void 0 ? void 0 : body["content"]) || "";
-                    // Remove HTML tags if present (Teams uses HTML)
-                    text = text.replace(/<[^>]*>/g, "");
-                    text = text.trim();
+                    // Teams message bodies are HTML.
+                    text = this.stripHtmlTags(text).trim();
                     // Skip empty messages
                     if (!text) {
                         continue;