@open-everywhere/provider-teams 0.1.4 → 0.2.1

package/NOTICE

@@ -8,10 +8,40 @@ This product is licensed under the Apache License, Version 2.0 (see LICENSE).
 Built on Vercel Eve (https://github.com/vercel/eve), licensed under the
 Apache License, Version 2.0.
 
-@open-everywhere/core also ships a patch that modifies Vercel Eve (the file in
-its patches/ directory), with the oe-eve-patch command that applies it to a
-consumer's own installed copy. The patch is licensed under the Apache License,
-Version 2.0. No modified Vercel Eve files are distributed.
+---
+
+Modifications to eve
+
+The @open-everywhere/core package distributes patches/eve+0.71.0.patch. That
+patch file is a modification of eve 0.71.0. Vercel licenses eve 0.71.0 under the
+Apache License, Version 2.0. The copyright notice of eve 0.71.0 reads
+"Copyright 2026 Vercel, Inc. and contributors". The Open Everywhere authors made
+the changes in the patch file.
+
+The patch modifies four files of eve 0.71.0:
+
+  dist/src/execution/web-fetch/request.js
+  dist/src/harness/tool-loop.js
+  dist/src/internal/authored-package-boundary.js
+  dist/src/protocol/message.d.ts
+
+Open Everywhere does not ship the eve package. eve is a peer dependency, so the
+consumer installs eve 0.71.0 from the registry. The patch file carries the
+modified portions of eve. The oe-eve-patch command, which
+@open-everywhere/core ships, applies them to the eve that the consumer
+installed. The command patches no file outside the consumer's own project. To
+restore an eve that holds an older Open Everywhere patch, it also writes to npm's
+cache and to a temporary directory.
+
+The attribution notice of eve 0.71.0 follows, as section 4(d) of the Apache
+License, Version 2.0 requires. The notices for eve's bundled code-mode runtime
+are not reproduced, because the patch modifies no part of that runtime.
+
+eve
+Copyright 2026 Vercel, Inc. and contributors
+
+This product includes software developed at Vercel, Inc.
+(https://vercel.com/).
 
 ---
 

package/README.md

@@ -15,7 +15,7 @@ the hosts `graph.microsoft.com` and `smba.trafficmanager.net`. Core's registries
 ## Install
 
 ```sh
-npm i @open-everywhere/core @open-everywhere/provider-teams eve@0.54.3
+npm i @open-everywhere/core @open-everywhere/provider-teams eve@0.71.0
 npx oe-eve-patch
 ```
 

package/agent/app-manifest.ts

@@ -0,0 +1,133 @@
+// THE Teams app manifest — rendered, never static (OPE-2334).
+//
+// This used to be the static `teams-app/manifest.json`, with the brand written into `name.short`,
+// `name.full` and `description.full`. A deployment is meant to be locally namable, so the manifest
+// is now a TEMPLATE the deployment's configured name renders, the same way the Slack manifest is.
+// `agent/ops.ts` registers it with core's `registerSurfaceAppManifest`, so the ops MCP tool
+// `surface_manifest { surface: "teams" }` serves it with this deployment's host substituted.
+//
+// 🔴 THIS MODULE IMPORTS NOTHING, DELIBERATELY — the same rule as the Slack bundle's manifest. The
+// caller reads the settings and passes the name in; this file holds only the vendor's own knowledge.
+//
+// TWO PLACEHOLDERS STAY FOR A HUMAN. `{{MICROSOFT_APP_ID}}` is the Azure Bot's application id and
+// `{{DEVELOPER_NAME}}` is the publishing org. Neither is a deployment setting this plane can read,
+// so `teams-app/README.md` walks the operator through both. The host is the shared
+// `YOUR-DEPLOY-URL` placeholder, which `surface_manifest` substitutes.
+
+/** The token the URLs carry where the deployment's own host belongs (core's DEPLOY_HOST_PLACEHOLDER). */
+export const TEAMS_DEPLOY_HOST_PLACEHOLDER = "YOUR-DEPLOY-URL";
+
+/** The app name the manifest carries when neither an explicit name nor `identity.name` is given. */
+export const TEAMS_DEFAULT_APP_NAME = "Open Everywhere";
+
+/** Teams' limit on `name.short`. A longer one fails the package upload. */
+export const TEAMS_APP_NAME_MAX = 30;
+
+/** Teams' limit on `name.full`. */
+const TEAMS_APP_FULL_NAME_MAX = 100;
+
+/** The manifest `version`. RSC consent is captured at install time, so a permission change needs a
+ *  bump (scripts/teams-provider-integration-test.ts pins it past the bumps that carried each grant). */
+const TEAMS_APP_MANIFEST_VERSION = "1.0.3";
+
+/** Options for {@link teamsAppManifestTemplate}. */
+export interface TeamsAppManifestOptions {
+  /** An EXPLICIT app name (the ops tool's `appName`). It wins over {@link agentName}. */
+  readonly appName?: string;
+  /** The deployment's configured name — the `identity.name` setting. Absent ⇒ {@link TEAMS_DEFAULT_APP_NAME}. */
+  readonly agentName?: string;
+}
+
+/** The app name a manifest carries: the explicit name, else the configured name cut to Teams' limit,
+ *  else the default. */
+function teamsManifestAppName(opts: TeamsAppManifestOptions = {}): string {
+  const explicit = opts.appName?.trim();
+  if (explicit) return explicit;
+  const configured = opts.agentName?.trim();
+  if (configured) return configured.slice(0, TEAMS_APP_NAME_MAX).trim();
+  return TEAMS_DEFAULT_APP_NAME;
+}
+
+/** The ready-to-zip Teams app manifest (schema 1.17), named for this deployment. */
+export function teamsAppManifestTemplate(opts: TeamsAppManifestOptions = {}): string {
+  const name = teamsManifestAppName(opts);
+  const fullNamed = `${name} — autonomous teammate`;
+  const host = TEAMS_DEPLOY_HOST_PLACEHOLDER;
+  return JSON.stringify(
+    {
+      $schema: "https://developer.microsoft.com/en-us/json-schemas/teams/v1.17/MicrosoftTeams.schema.json",
+      manifestVersion: "1.17",
+      version: TEAMS_APP_MANIFEST_VERSION,
+      id: "{{MICROSOFT_APP_ID}}",
+      developer: {
+        name: "{{DEVELOPER_NAME}}",
+        websiteUrl: `https://${host}`,
+        // The deployment serves both pages itself (packages/core/agent/pages/policy-pages.ts).
+        privacyUrl: `https://${host}/privacy`,
+        termsOfUseUrl: `https://${host}/terms`,
+      },
+      name: {
+        short: name,
+        full: fullNamed.length <= TEAMS_APP_FULL_NAME_MAX ? fullNamed : name,
+      },
+      description: {
+        short: "An autonomous teammate with per-conversation memory.",
+        // OPE-1954: the agent acts under ONE shared bot credential, never on a person's behalf.
+        full:
+          `${name} runs as a Teams bot: @mention it in a team channel, drop it into a group chat, or DM it 1:1. ` +
+          "It acts under one bot identity shared by this deployment — never under your account and never with your " +
+          "permissions — and its memory is scoped per tenant and per conversation. Learnings stay siloed to a " +
+          "conversation until that channel is confirmed team-wide.",
+      },
+      icons: { color: "color.png", outline: "outline.png" },
+      accentColor: "#5865F2",
+      bots: [
+        {
+          botId: "{{MICROSOFT_APP_ID}}",
+          scopes: ["team", "groupChat", "personal"],
+          supportsFiles: false,
+          isNotificationOnly: false,
+          supportsCalling: false,
+          supportsVideo: false,
+        },
+      ],
+      permissions: ["identity", "messageTeamMembers"],
+      // REQUIRED whenever `authorization` is present: without it the upload fails with a generic
+      // "couldn't parse the app manifest".
+      webApplicationInfo: { id: "{{MICROSOFT_APP_ID}}", resource: `api://${host}/{{MICROSOFT_APP_ID}}` },
+      // The RSC grants that make Microsoft deliver non-@mention activities (teams-app/README.md).
+      authorization: {
+        permissions: {
+          resourceSpecific: [
+            { name: "ChannelMessage.Read.Group", type: "Application" },
+            { name: "ChatMessage.Read.Chat", type: "Application" },
+            { name: "ChannelMember.Read.Group", type: "Application" },
+          ],
+        },
+      },
+      validDomains: [host],
+    },
+    null,
+    2,
+  );
+}
+
+/** Where the operator uploads the package. */
+export const TEAMS_APP_CONSOLE_URL = "https://admin.teams.microsoft.com";
+
+/** The ordered steps, from the manifest to an installed app. */
+export const TEAMS_APP_MANIFEST_STEPS: readonly string[] = [
+  "Save the manifest below as manifest.json in the teams-app/ directory, beside color.png and outline.png.",
+  "Replace {{MICROSOFT_APP_ID}} with the Azure Bot's Application (client) ID (MICROSOFT_APP_ID) — it appears three times and must match everywhere.",
+  "Replace {{DEVELOPER_NAME}} with your org's name.",
+  "Zip it flat: zip -j app.zip manifest.json color.png outline.png (Teams requires the manifest at the zip root).",
+  "Upload it: Teams → Apps → Manage your apps → Upload a custom app for one team, or the Teams Admin Center → Manage apps → Upload new app for the org.",
+];
+
+/** What the operator brings back. Teams needs no value from the package itself: the bot's
+ *  credentials come from the Azure Bot resource (docs/deploy/surfaces/teams.md). */
+export const TEAMS_APP_MANIFEST_COLLECT: readonly string[] = [
+  "Azure Bot → Configuration → Microsoft App ID = MICROSOFT_APP_ID",
+  "The app registration's client secret = MICROSOFT_APP_PASSWORD",
+  "The Entra tenant id = MICROSOFT_TENANT_ID",
+];

package/agent/channels/teams-engagement.ts

@@ -16,7 +16,7 @@
 // 🔴 THE PLATFORM CONSTRAINT, AND WHY IT IS NOT A DEFECT. Microsoft delivers a NON-MENTION message
 // to a bot only where the tenant has consented to the matching resource-specific-consent (RSC)
 // grant: `ChannelMessage.Read.Group` for a team channel, `ChatMessage.Read.Chat` for a chat (both
-// are in `teams-app/manifest.json`). Without it, only @mention activities ever arrive, so the seam
+// are in the rendered Teams app manifest, `agent/app-manifest.ts`). Without it, only @mention activities ever arrive, so the seam
 // is armed but nothing can exercise it — the surface answers once per mention, exactly as before.
 // There is NO API that reports whether a tenant granted an RSC permission, so this module states
 // the dependency out loud instead of guessing, and logs the named reason ONCE per scope while no

package/agent/channels/teams-front.ts

@@ -33,7 +33,7 @@
 // domain becomes a judged channel-watch wake in the shared window. NOTE the platform reality:
 // Teams only delivers non-mention messages to a bot whose app carries the matching RSC permission
 // — `ChannelMessage.Read.Group` for a team channel, `ChatMessage.Read.Chat` for a chat (both are
-// in teams-app/manifest.json). Without the relevant one, only @mention activities arrive and Leg A
+// in the rendered Teams app manifest, agent/app-manifest.ts). Without the relevant one, only @mention activities arrive and Leg A
 // is simply never exercised (no code path depends on it firing).
 //
 // CHAT SCOPE IS DELIBERATELY NOT LEG A. The plan's privacy floor (teams-supervisor.ts

package/agent/channels/teams-graph-boundary.ts

@@ -6,7 +6,7 @@
 //   - the PER-TEAM RSC grant `ChannelMessage.Read.Group` — resource-specific consent, granted by a
 //     team owner when the Teams app is installed INTO that team. Microsoft evaluates it per
 //     request against the team in the URL, so the app can read that team's channels and no others.
-//     This is the shipped default (teams-app/manifest.json declares it).
+//     This is the shipped default (the rendered Teams app manifest, agent/app-manifest.ts, declares it).
 //   - a TENANT-WIDE application permission on the Entra app registration. Microsoft then applies
 //     no team boundary at all: the app can read every channel message in the tenant, and the ONLY
 //     remaining fence is Open Everywhere's own domain allowlist (teams-read.ts's
@@ -46,7 +46,8 @@
 // 🔴 KNOWN LIMIT, STATED RATHER THAN HIDDEN: a denylist reports "per-team" for any FUTURE
 // tenant-wide role Microsoft adds to those endpoints. An allowlist is not available (point 1 —
 // there is nothing positive to match). Re-check the two API pages when Graph changes; the list
-// below is the whole of the claim, and TEAMS_READ_BOUNDARY_SOURCES records where it came from.
+// in teams-graph-roles.ts (TENANT_WIDE_CHANNEL_READ_ROLES) is the whole of the claim, and
+// TEAMS_READ_BOUNDARY_SOURCES below records where it came from.
 //
 // NO SIGNATURE VERIFICATION, ON PURPOSE. We decode a token WE minted, over TLS, from
 // login.microsoftonline.com, seconds earlier. It is not attacker-supplied, and the decoded value
@@ -55,16 +56,18 @@
 // of the token itself.
 
 import { appendAudit, deploymentOrg } from "@open-everywhere/core/agent/adapter-api.js";
+import { boundaryFromRoles, decodeJwtRoles, tenantWideRolesIn, type TeamsReadBoundary } from "./teams-graph-roles.js";
 
-/** Which boundary governs this deployment's Teams channel reads.
- *  - `per-team`    — Microsoft enforces the team boundary (the RSC path, shipped default).
- *  - `tenant-wide` — Microsoft enforces NO team boundary; only OE's domain allowlist remains.
- *  - `unknown`     — not determined yet, or the minted token did not parse. */
-export type TeamsReadBoundary = "per-team" | "tenant-wide" | "unknown";
-
-/** The Graph APPLICATION permissions that read Teams channel messages TENANT-WIDE. See the header
- *  for why this is a denylist and what it can miss. */
-export const TENANT_WIDE_CHANNEL_READ_ROLES: readonly string[] = ["ChannelMessage.Read.All", "Group.Read.All", "Group.ReadWrite.All"];
+// The pure predicate lives in teams-graph-roles.ts, which imports nothing from core (OPE-2219). The
+// ops arm needs only the predicate, and this file's audit row needs the main core barrel, which
+// costs about 1.9 s to load. Re-exported here so this file's public names stay the same.
+export {
+  boundaryFromRoles,
+  boundaryOfGraphToken,
+  decodeJwtRoles,
+  TENANT_WIDE_CHANNEL_READ_ROLES,
+  type TeamsReadBoundary,
+} from "./teams-graph-roles.js";
 
 /** Where the denylist came from — quoted in the runbook so a future reader can re-verify it. */
 export const TEAMS_READ_BOUNDARY_SOURCES: readonly string[] = [
@@ -76,50 +79,6 @@ export const TEAMS_READ_BOUNDARY_SOURCES: readonly string[] = [
 /** The audit action that records a boundary determination. */
 const TEAMS_READ_BOUNDARY_ACTION = "teams.read_boundary";
 
-/**
- * The `roles` claim of a JWT's payload, or `undefined` when the token does not parse as one.
- *
- * Returns an EMPTY array — not `undefined` — for a token that parses but carries no `roles` claim:
- * that is a real, meaningful state (an app registration with no consented Graph application
- * permissions), and it is exactly the per-team case. Only a genuine parse failure is `undefined`,
- * which is what keeps "malformed" from being reported as "per-team". Pure.
- */
-export function decodeJwtRoles(token: string): readonly string[] | undefined {
-  const parts = token.split(".");
-  if (parts.length !== 3 || parts[1].length === 0) return undefined;
-  let payload: unknown;
-  try {
-    payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
-  } catch {
-    return undefined;
-  }
-  // An ARRAY passes `typeof === "object"`, so it needs its own rejection: a JWT payload is a JSON
-  // object, and letting an array through would read its absent `roles` as [] — reporting "per-team"
-  // for a token that never parsed as a claims set at all.
-  if (typeof payload !== "object" || payload === null || Array.isArray(payload)) return undefined;
-  const roles = (payload as { roles?: unknown }).roles;
-  if (roles === undefined) return [];
-  if (!Array.isArray(roles)) return undefined;
-  return roles.filter((r): r is string => typeof r === "string");
-}
-
-/** Every tenant-wide role the token actually carries (empty on the per-team path). Pure. */
-function tenantWideRolesIn(roles: readonly string[]): readonly string[] {
-  return TENANT_WIDE_CHANNEL_READ_ROLES.filter((r) => roles.includes(r));
-}
-
-/** The boundary a decoded `roles` claim implies — see the header for the one-sided reasoning.
- *  `undefined` roles (a token that did not parse) yield `"unknown"`, never a guess. Pure. */
-export function boundaryFromRoles(roles: readonly string[] | undefined): TeamsReadBoundary {
-  if (roles === undefined) return "unknown";
-  return tenantWideRolesIn(roles).length > 0 ? "tenant-wide" : "per-team";
-}
-
-/** The boundary a minted Graph token implies. Pure; never logs or returns any part of the token. */
-export function boundaryOfGraphToken(token: string): TeamsReadBoundary {
-  return boundaryFromRoles(decodeJwtRoles(token));
-}
-
 // --- the process-held determination + its audit row -------------------------------------------
 
 let held: TeamsReadBoundary = "unknown";

package/agent/channels/teams-graph-roles.ts

@@ -0,0 +1,62 @@
+// THE PURE HALF of the Teams channel-read boundary predicate (OPE-428): decode a Graph token's
+// `roles` claim and map it to a boundary. teams-graph-boundary.ts holds the reasoning (why a
+// denylist, what it can miss) and the process-held determination with its audit row.
+//
+// 🔴 NO CORE IMPORT, ON PURPOSE (OPE-2219). The ops arm (agent/ops.ts) runs this predicate in the
+// standalone ops MCP server. teams-graph-boundary.ts imports the main core barrel for its audit row,
+// and that barrel loads most of core: about 1.9 s on a warm Windows machine. Boundary rule 4d
+// (packages/core/scripts/boundary-test.ts) refuses an ops arm that reaches the main barrel.
+
+/** Which boundary governs this deployment's Teams channel reads.
+ *  - `per-team`    — Microsoft enforces the team boundary (the RSC path, shipped default).
+ *  - `tenant-wide` — Microsoft enforces NO team boundary; only OE's domain allowlist remains.
+ *  - `unknown`     — not determined yet, or the minted token did not parse. */
+export type TeamsReadBoundary = "per-team" | "tenant-wide" | "unknown";
+
+/** The Graph APPLICATION permissions that read Teams channel messages TENANT-WIDE. See
+ *  teams-graph-boundary.ts's header for why this is a denylist and what it can miss. */
+export const TENANT_WIDE_CHANNEL_READ_ROLES: readonly string[] = ["ChannelMessage.Read.All", "Group.Read.All", "Group.ReadWrite.All"];
+
+/**
+ * The `roles` claim of a JWT's payload, or `undefined` when the token does not parse as one.
+ *
+ * Returns an EMPTY array — not `undefined` — for a token that parses but carries no `roles` claim:
+ * that is a real, meaningful state (an app registration with no consented Graph application
+ * permissions), and it is exactly the per-team case. Only a genuine parse failure is `undefined`,
+ * which is what keeps "malformed" from being reported as "per-team". Pure.
+ */
+export function decodeJwtRoles(token: string): readonly string[] | undefined {
+  const parts = token.split(".");
+  if (parts.length !== 3 || parts[1].length === 0) return undefined;
+  let payload: unknown;
+  try {
+    payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+  } catch {
+    return undefined;
+  }
+  // An ARRAY passes `typeof === "object"`, so it needs its own rejection: a JWT payload is a JSON
+  // object, and letting an array through would read its absent `roles` as [] — reporting "per-team"
+  // for a token that never parsed as a claims set at all.
+  if (typeof payload !== "object" || payload === null || Array.isArray(payload)) return undefined;
+  const roles = (payload as { roles?: unknown }).roles;
+  if (roles === undefined) return [];
+  if (!Array.isArray(roles)) return undefined;
+  return roles.filter((r): r is string => typeof r === "string");
+}
+
+/** Every tenant-wide role the token actually carries (empty on the per-team path). Pure. */
+export function tenantWideRolesIn(roles: readonly string[]): readonly string[] {
+  return TENANT_WIDE_CHANNEL_READ_ROLES.filter((r) => roles.includes(r));
+}
+
+/** The boundary a decoded `roles` claim implies — see teams-graph-boundary.ts's header for the one-sided reasoning.
+ *  `undefined` roles (a token that did not parse) yield `"unknown"`, never a guess. Pure. */
+export function boundaryFromRoles(roles: readonly string[] | undefined): TeamsReadBoundary {
+  if (roles === undefined) return "unknown";
+  return tenantWideRolesIn(roles).length > 0 ? "tenant-wide" : "per-team";
+}
+
+/** The boundary a minted Graph token implies. Pure; never logs or returns any part of the token. */
+export function boundaryOfGraphToken(token: string): TeamsReadBoundary {
+  return boundaryFromRoles(decodeJwtRoles(token));
+}

package/agent/channels/teams-read.ts

@@ -18,7 +18,7 @@
 // registration must ALSO hold a Graph permission that can read channel messages
 // (`ChannelMessage.Read.All`, admin-consented) OR already have the per-team RSC grant
 // `ChannelMessage.Read.Group` this deployment's own Teams app manifest already requests for
-// ambient watching (teams-app/manifest.json, docs/deploy/surfaces/teams.md) — when a team already
+// ambient watching (the rendered Teams app manifest agent/app-manifest.ts, docs/deploy/surfaces/teams.md) — when a team already
 // has that grant, THIS adapter needs no extra Azure configuration at all. Undocumented/absent
 // either way surfaces as a Graph 401/403, fail-loud (see below), never a silent empty read.
 //

package/agent/channels/teams.ts

@@ -42,6 +42,7 @@ import {
   authPrincipalId,
   type ChatAuditPartition,
 } from "@open-everywhere/core/agent/adapter-api.js";
+import { withEndsTurnFinalChannel } from "@open-everywhere/core/agent/adapter-api.js";
 
 // The audit partition for a terminal event, rebuilt from the LIVE session state the same
 // way slack.ts rebuilds its own (the completion handler has no auth context): tenant →
@@ -267,4 +268,6 @@ const native = teamsChannel({
   },
 });
 
-export default frontTeamsChannel(native);
+// OPE-2252 — `reply`/`no_reply` end the turn natively (`endsTurn`) and eve then emits no final message,
+// so the wrapper decides such a turn at `turn.completed` (core `channels/ends-turn-final.ts`).
+export default withEndsTurnFinalChannel(frontTeamsChannel(native));