@openclaw/msteams 2026.10.5-beta.4 → 2026.10.10-beta.2

package/dist/.setup/{monitor-C9x_CJhY.cjs → monitor-CzRI-Hsc.cjs}

@@ -1,20 +1,20 @@
 const require_rolldown_runtime = require("./rolldown-runtime-BloeesfJ.cjs");
+const require_bot_framework_service_url = require("./bot-framework-service-url-B3FWn2SV.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-tYgAHx0t.cjs");
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("../runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-DdDBVCzl.cjs");
-const require_bot_framework_service_url = require("./bot-framework-service-url-CPp4d-Q6.cjs");
-const require_token_config = require("./token-config-CqIh8z7Q.cjs");
-const require_channel = require("./channel-Cifn9fsv.cjs");
-const require_thread_session = require("./thread-session-B74FC1Id.cjs");
-const require_channel_setup = require("./channel.setup-BjbHugkL.cjs");
+const require_delegated_state = require("./delegated-state-Bv5cWuec.cjs");
+const require_channel = require("./channel-B7Gy3QUW.cjs");
+const require_thread_session = require("./thread-session-C7KTMwLU.cjs");
+const require_channel_setup = require("./channel.setup-B5ClEcNI.cjs");
 const require_approval_card = require("./approval-card-DWPDItvq.cjs");
-const require_conversation_store_state = require("./conversation-store-state-DprmOfl7.cjs");
-const require_reaction_types = require("./reaction-types-Ig9sQJuR.cjs");
+const require_conversation_store_state = require("./conversation-store-state-C3__T9mK.cjs");
+const require_reaction_types = require("./reaction-types-DSQWVA4Z.cjs");
 let openclaw_plugin_sdk_channel_outbound = require("openclaw/plugin-sdk/channel-outbound");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
+let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
 let openclaw_plugin_sdk_provider_http = require("openclaw/plugin-sdk/provider-http");
-let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
 let openclaw_plugin_sdk_media_runtime = require("openclaw/plugin-sdk/media-runtime");
 let openclaw_plugin_sdk_ssrf_runtime = require("openclaw/plugin-sdk/ssrf-runtime");
 let node_dns_promises = require("node:dns/promises");
@@ -22,12 +22,12 @@ let openclaw_plugin_sdk_ssrf_policy = require("openclaw/plugin-sdk/ssrf-policy")
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
 let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text-utility-runtime");
 let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
-let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");
-let openclaw_plugin_sdk_channel_inbound = require("openclaw/plugin-sdk/channel-inbound");
 let node_crypto = require("node:crypto");
 node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
-let openclaw_plugin_sdk_security_runtime = require("openclaw/plugin-sdk/security-runtime");
 let openclaw_plugin_sdk_webhook_targets = require("openclaw/plugin-sdk/webhook-targets");
+let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");
+let openclaw_plugin_sdk_channel_inbound = require("openclaw/plugin-sdk/channel-inbound");
+let openclaw_plugin_sdk_security_runtime = require("openclaw/plugin-sdk/security-runtime");
 let openclaw_plugin_sdk_approval_gateway_runtime = require("openclaw/plugin-sdk/approval-gateway-runtime");
 let openclaw_plugin_sdk_channel_ingress_runtime = require("openclaw/plugin-sdk/channel-ingress-runtime");
 let openclaw_plugin_sdk_context_visibility_runtime = require("openclaw/plugin-sdk/context-visibility-runtime");
@@ -86,7 +86,8 @@ async function storeSessionLearning(params) {
 */
 async function runFeedbackReflection(params) {
 	const { cfg, log, sessionKey } = params;
-	const cooldownMs = cfg.channels?.msteams?.feedbackReflectionCooldownMs ?? openclaw_plugin_sdk_channel_inbound.DEFAULT_CHANNEL_FEEDBACK_REFLECTION_COOLDOWN_MS;
+	const msteamsCfg = require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, params.accountId);
+	const cooldownMs = msteamsCfg.feedbackReflectionCooldownMs ?? openclaw_plugin_sdk_channel_inbound.DEFAULT_CHANNEL_FEEDBACK_REFLECTION_COOLDOWN_MS;
 	let reflection;
 	try {
 		reflection = await (0, openclaw_plugin_sdk_channel_inbound.runChannelFeedbackReflection)({
@@ -140,7 +141,10 @@ async function runFeedbackReflection(params) {
 		await require_conversation_store_state.sendMSTeamsActivityWithReference(params.app, require_conversation_store_state.buildConversationReference(params.conversationRef), {
 			type: "message",
 			text: reflection.userMessage
-		}, { serviceUrlBoundary: require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(cfg.channels?.msteams) });
+		}, {
+			accountId: params.accountId,
+			serviceUrlBoundary: require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(msteamsCfg)
+		});
 		log.info("sent reflection follow-up", { sessionKey });
 	} catch (err) {
 		log.debug?.("failed to send reflection follow-up", { error: require_channel_setup.formatUnknownError(err) });
@@ -197,7 +201,7 @@ async function maybeHandleMSTeamsApprovalCardSubmit(params) {
 		ignored("unknown or expired card token");
 		return true;
 	}
-	if (binding.accountId !== openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID) {
+	if ((0, openclaw_plugin_sdk_account_id.normalizeAccountId)(binding.accountId) !== (0, openclaw_plugin_sdk_account_id.normalizeAccountId)(deps.accountId)) {
 		ignored("card token account mismatch");
 		return true;
 	}
@@ -213,10 +217,16 @@ async function maybeHandleMSTeamsApprovalCardSubmit(params) {
 		ignored("card token decision is no longer allowed");
 		return true;
 	}
+	const cfg = deps.readConfig?.() ?? deps.cfg;
+	const account = require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, binding.accountId);
+	if (account.appId && account.appId !== deps.appId) {
+		ignored("issuing account is no longer active");
+		return true;
+	}
 	const senderId = context.activity.from?.aadObjectId;
 	if (!(require_thread_session.msTeamsApprovalAuth.authorizeActorAction?.({
-		cfg: deps.cfg,
-		accountId: openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID,
+		cfg,
+		accountId: binding.accountId,
 		senderId,
 		action: "approve",
 		approvalKind: binding.approvalKind
@@ -226,12 +236,12 @@ async function maybeHandleMSTeamsApprovalCardSubmit(params) {
 	}
 	const outcome = await require_approval_card.msTeamsApprovalControls.settle(token, async (consumed) => {
 		const result = await (0, openclaw_plugin_sdk_approval_gateway_runtime.resolveApprovalOverGateway)({
-			cfg: deps.cfg,
+			cfg,
 			approvalId: consumed.approvalId,
 			approvalKind: consumed.approvalKind,
 			decision: consumed.decision,
 			channel: "msteams",
-			accountId: openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID,
+			accountId: consumed.accountId,
 			senderId
 		});
 		await context.updateActivity({
@@ -306,7 +316,8 @@ function formatMSTeamsSenderReason(params) {
 }
 async function resolveMSTeamsSenderAccess(params) {
 	const activity = params.activity;
-	const msteamsCfg = params.cfg.channels?.msteams;
+	const accountId = params.accountId ?? openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID;
+	const msteamsCfg = params.cfg.channels?.msteams ? require_resolve_allowlist.resolveMSTeamsAccountConfig(params.cfg, accountId) : void 0;
 	const conversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(activity.conversation?.id ?? "unknown");
 	const convType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(activity.conversation?.conversationType);
 	const isDirectMessage = convType === "personal" || !convType && !activity.conversation?.isGroup;
@@ -317,7 +328,7 @@ async function resolveMSTeamsSenderAccess(params) {
 	const pairing = (0, openclaw_plugin_sdk_channel_pairing.createChannelPairingController)({
 		core,
 		channel: "msteams",
-		accountId: openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID
+		accountId
 	});
 	const dmPolicy = msteamsCfg?.dmPolicy ?? "pairing";
 	const configuredDmAllowFrom = msteamsCfg?.allowFrom ?? [];
@@ -418,6 +429,7 @@ async function admitMSTeamsMessage(params) {
 	const isControlCommand = allowTextCommands && core.channel.commands.isControlCommandMessage(params.text, params.cfg);
 	const access = await resolveMSTeamsSenderAccess({
 		cfg: params.cfg,
+		accountId: params.accountId,
 		activity: params.activity,
 		hasControlCommand: isControlCommand
 	});
@@ -543,6 +555,32 @@ function resolveBotThreadMentionPolicy(params) {
 	};
 }
 //#endregion
+//#region extensions/msteams/src/monitor-handler/config.ts
+function createMSTeamsHandlerConfigReader(deps) {
+	const source = deps.accountPolicyCfg ?? deps.cfg;
+	const read = (0, openclaw_plugin_sdk_runtime_config_snapshot.createRuntimeConfigReader)(source);
+	const originallyConfigured = require_resolve_allowlist.listMSTeamsAccountIds(source).includes(deps.accountId);
+	let lastSource;
+	let lastProjection = deps.cfg;
+	return () => {
+		const current = read();
+		if (current === lastSource) return lastProjection;
+		lastSource = current;
+		if (current === source && deps.accountPolicyCfg) return lastProjection = deps.cfg;
+		const retired = originallyConfigured && !require_resolve_allowlist.listMSTeamsAccountIds(current).includes(deps.accountId);
+		if (deps.accountId === "default" && !current.channels?.msteams?.accounts && !retired) return lastProjection = current;
+		const accountConfig = require_resolve_allowlist.resolveMSTeamsAccountConfig(current, deps.accountId);
+		return lastProjection = require_resolve_allowlist.withAccountScopedMSTeamsConfig({
+			cfg: current,
+			accountId: deps.accountId,
+			accountConfig: {
+				...accountConfig,
+				...current.channels?.msteams?.enabled === false || retired ? { enabled: false } : {}
+			}
+		});
+	};
+}
+//#endregion
 //#region extensions/msteams/src/attachments/bot-framework.ts
 const BOT_FRAMEWORK_SCOPE = "https://api.botframework.com";
 /**
@@ -598,18 +636,6 @@ async function fetchBotFrameworkAttachmentInfo(params) {
 async function saveBotFrameworkAttachmentView(params) {
 	const response = await fetchBotFrameworkAttachment(params, "attachmentView");
 	if (!response) return;
-	let contentLength;
-	try {
-		contentLength = (0, openclaw_plugin_sdk_media_runtime.parseMediaContentLength)(response.headers.get("content-length"));
-	} catch (err) {
-		await response.body?.cancel().catch(() => void 0);
-		params.logger?.warn?.("msteams botFramework attachmentView invalid content-length", { error: (0, openclaw_plugin_sdk_error_runtime.coerceErrorMessage)(err) });
-		return;
-	}
-	if (contentLength !== null && contentLength > params.maxBytes) {
-		await response.body?.cancel().catch(() => void 0);
-		return;
-	}
 	try {
 		return await require_runtime.getMSTeamsRuntime().channel.media.saveResponseMedia(response, {
 			sourceUrl: params.url,
@@ -845,8 +871,9 @@ async function downloadAndStoreMSTeamsRemoteMedia(params) {
 }
 //#endregion
 //#region extensions/msteams/src/attachments/download.ts
-function resolveDownloadCandidate(att) {
+function resolveDownloadCandidate(att, graphReferenceToken) {
 	const contentType = require_resolve_allowlist.normalizeContentType(att.contentType);
+	const graphReference = graphReferenceToken !== void 0 && contentType === "reference";
 	const name = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(att.name) ?? "";
 	if (contentType === "application/vnd.microsoft.teams.file.download.info") {
 		if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(att.content)) return null;
@@ -869,11 +896,11 @@ function resolveDownloadCandidate(att) {
 			sourceId: att.id?.trim() || void 0
 		};
 	}
-	const contentUrl = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(att.contentUrl) ?? "";
+	const contentUrl = graphReference ? att.contentUrl ?? "" : (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(att.contentUrl) ?? "";
 	if (!contentUrl) return null;
-	const sharesUrl = require_resolve_allowlist.tryBuildGraphSharesUrlForSharedLink(contentUrl);
+	const sharesUrl = graphReference ? `${require_resolve_allowlist.GRAPH_ROOT}/shares/${require_resolve_allowlist.encodeGraphShareId(contentUrl)}/driveItem/content` : require_resolve_allowlist.tryBuildGraphSharesUrlForSharedLink(contentUrl);
 	const resolvedUrl = sharesUrl ?? contentUrl;
-	const resolvedContentTypeHint = sharesUrl ? void 0 : contentType;
+	const resolvedContentTypeHint = graphReference ? "application/octet-stream" : sharesUrl ? void 0 : contentType;
 	return {
 		kind: "remote",
 		mediaKind: require_resolve_allowlist.resolveMSTeamsMediaKind({
@@ -881,9 +908,10 @@ function resolveDownloadCandidate(att) {
 			fileName: name
 		}),
 		url: resolvedUrl,
-		fileHint: name || void 0,
+		fileHint: graphReference ? att.name ?? void 0 : name || void 0,
 		contentTypeHint: resolvedContentTypeHint,
-		sourceId: att.id?.trim() || void 0
+		sourceId: att.id?.trim() || void 0,
+		graphReference
 	};
 }
 function scopeCandidatesForUrl(url) {
@@ -931,6 +959,19 @@ async function fetchWithAuthFallback(params) {
 		resolveFn: params.resolveFn,
 		timeoutMs: require_resolve_allowlist.resolveMSTeamsRequestTimeoutMs(params.deadline)
 	});
+	if (params.bearerToken !== void 0) {
+		const headers = require_resolve_allowlist.ensureUserAgentHeader(params.requestInit?.headers);
+		require_resolve_allowlist.applyAuthorizationHeaderForUrl({
+			headers,
+			url: params.url,
+			authAllowHosts: params.policy.authAllowHosts,
+			bearerToken: params.bearerToken
+		});
+		return fetchAttempt(params.fetchFn, {
+			...params.requestInit,
+			headers
+		});
+	}
 	const firstAttempt = await fetchAttempt(params.fetchFn, params.requestInit);
 	if (firstAttempt.ok) return firstAttempt;
 	if (!params.tokenProvider) return firstAttempt;
@@ -967,7 +1008,7 @@ async function downloadMSTeamsAttachments(params) {
 	});
 	const allowHosts = policy.allowHosts;
 	const candidates = list.filter(require_resolve_allowlist.isAdvertisedFileAttachment).map((attachment) => {
-		return (require_resolve_allowlist.isDownloadableAttachment(attachment) ? resolveDownloadCandidate(attachment) : null) ?? {
+		return (require_resolve_allowlist.isDownloadableAttachment(attachment) ? resolveDownloadCandidate(attachment, params.graphReferenceToken) : null) ?? {
 			kind: "unavailable",
 			mediaKind: require_resolve_allowlist.resolveMSTeamsMediaKind({
 				contentType: require_resolve_allowlist.normalizeContentType(attachment.contentType),
@@ -1022,7 +1063,7 @@ async function downloadMSTeamsAttachments(params) {
 				filePathHint: candidate.fileHint ?? candidate.url,
 				maxBytes: params.maxBytes,
 				contentTypeHint: candidate.contentTypeHint,
-				kind: candidate.mediaKind,
+				kind: candidate.graphReference ? void 0 : candidate.mediaKind,
 				preserveFilenames: params.preserveFilenames,
 				fetchImpl: (input, init) => fetchWithAuthFallback({
 					url: (0, openclaw_plugin_sdk_request_url.resolveRequestUrl)(input),
@@ -1031,10 +1072,18 @@ async function downloadMSTeamsAttachments(params) {
 					requestInit: init,
 					resolveFn: params.resolveFn,
 					policy,
-					deadline: params.deadline
+					deadline: params.deadline,
+					bearerToken: candidate.graphReference ? params.graphReferenceToken : void 0
 				})
 			});
 		} catch (err) {
+			if (candidate.graphReference) {
+				params.logger?.warn?.("msteams SharePoint reference download failed", {
+					error: (0, openclaw_plugin_sdk_error_runtime.coerceErrorMessage)(err),
+					name: candidate.fileHint
+				});
+				return;
+			}
 			const msg = (0, openclaw_plugin_sdk_error_runtime.coerceErrorMessage)(err);
 			params.logger?.warn?.(`msteams attachment download failed host=${safeHostForLog(candidate.url)} error=${msg}`);
 		}
@@ -1220,9 +1269,6 @@ async function downloadMSTeamsGraphMedia(params) {
 			tokenError: true
 		};
 	}
-	const fetchFn = params.fetchFn ?? fetch;
-	const sharePointMedia = [];
-	const downloadedReferenceUrls = /* @__PURE__ */ new Set();
 	let messageAttachments = [];
 	let referenceAttachments = [];
 	let messageStatus;
@@ -1251,72 +1297,13 @@ async function downloadMSTeamsGraphMedia(params) {
 	} catch (err) {
 		logGraphFailure("message fetch", err);
 	}
-	for (const att of referenceAttachments) {
-		const name = att.name ?? "file";
-		const shareUrl = att.contentUrl ?? "";
-		const sourceId = att.id?.trim();
-		const unavailableMedia = {
-			kind: require_resolve_allowlist.resolveMSTeamsMediaKind({
-				contentType: att.contentType ?? void 0,
-				fileName: name
-			}),
-			...sourceId ? { sourceId } : {}
-		};
-		if (!shareUrl) {
-			sharePointMedia.push(unavailableMedia);
-			continue;
-		}
-		downloadedReferenceUrls.add(shareUrl);
-		try {
-			const sharesUrl = `${require_resolve_allowlist.GRAPH_ROOT}/shares/${require_resolve_allowlist.encodeGraphShareId(shareUrl)}/driveItem/content`;
-			if (!(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(sharesUrl, policy.allowHosts)) {
-				params.logger?.debug?.("graph media sharepoint url not in allowHosts", {
-					messageUrl,
-					sharesUrl
-				});
-				sharePointMedia.push(unavailableMedia);
-				continue;
-			}
-			const media = await downloadAndStoreMSTeamsRemoteMedia({
-				url: sharesUrl,
-				filePathHint: name,
-				maxBytes: params.maxBytes,
-				contentTypeHint: "application/octet-stream",
-				preserveFilenames: params.preserveFilenames,
-				fetchImpl: async (input, init) => {
-					const requestUrl = (0, openclaw_plugin_sdk_request_url.resolveRequestUrl)(input);
-					const headers = require_resolve_allowlist.ensureUserAgentHeader(init?.headers);
-					require_resolve_allowlist.applyAuthorizationHeaderForUrl({
-						headers,
-						url: requestUrl,
-						authAllowHosts: policy.authAllowHosts,
-						bearerToken: accessToken
-					});
-					return await require_resolve_allowlist.safeFetchWithPolicy({
-						url: requestUrl,
-						policy,
-						fetchFn,
-						requestInit: {
-							...init,
-							headers
-						},
-						resolveFn: params.resolveFn,
-						timeoutMs: require_resolve_allowlist.resolveMSTeamsRequestTimeoutMs(params.deadline)
-					});
-				}
-			});
-			sharePointMedia.push(sourceId ? {
-				...media,
-				sourceId
-			} : media);
-		} catch (err) {
-			sharePointMedia.push(unavailableMedia);
-			params.logger?.warn?.("msteams SharePoint reference download failed", {
-				error: (0, openclaw_plugin_sdk_error_runtime.coerceErrorMessage)(err),
-				name
-			});
-		}
-	}
+	const sharePointMedia = await downloadMSTeamsAttachments({
+		...params,
+		attachments: referenceAttachments,
+		graphReferenceToken: accessToken,
+		allowHosts: policy.allowHosts,
+		authAllowHosts: policy.authAllowHosts
+	});
 	const hosted = await downloadGraphHostedContent({
 		accessToken,
 		messageUrl,
@@ -1327,7 +1314,8 @@ async function downloadMSTeamsGraphMedia(params) {
 		deadline: params.deadline
 	});
 	const normalizedAttachments = messageAttachments.map(normalizeGraphAttachment);
-	const filteredAttachments = sharePointMedia.length > 0 ? normalizedAttachments.filter((att) => att.contentType !== "reference" || typeof att.contentUrl !== "string" || !att.contentUrl || !downloadedReferenceUrls.has(att.contentUrl)) : normalizedAttachments;
+	const referenceUrls = new Set(referenceAttachments.map((att) => att.contentUrl));
+	const filteredAttachments = normalizedAttachments.filter((att) => att.contentType !== "reference" || !referenceUrls.has(att.contentUrl));
 	let attachmentMedia = [];
 	try {
 		attachmentMedia = await downloadMSTeamsAttachments({
@@ -1447,14 +1435,14 @@ async function resolveMSTeamsInboundMedia(params) {
 					authAllowHosts: params.authAllowHosts,
 					deadline: params.deadline
 				});
-				if (bfMedia.media.length > 0) mediaList = mergeMSTeamsMediaFacts(mediaList, bfMedia.media, { positionallyAligned: false });
+				mediaList = mergeMSTeamsMediaFacts(mediaList, bfMedia.media, { positionallyAligned: false });
 				if (!hasMaterializedMedia(bfMedia.media)) log.debug?.("bot framework attachments fetch empty", {
 					conversationType,
 					attachmentCount: bfMedia.attachmentCount ?? attachmentIds.length
 				});
 			}
 		}
-		if (shouldFetchGraphMessage && !hasMaterializedMedia(mediaList) && !isBotFrameworkPersonalChat) {
+		if (shouldFetchGraphMessage && !isBotFrameworkPersonalChat) {
 			const graphTeamAadGroupId = conversationType.trim().toLowerCase() === "channel" && !teamAadGroupId ? await params.resolveTeamAadGroupId?.() : teamAadGroupId;
 			const messageUrl = buildMSTeamsGraphMessageUrl({
 				conversationType,
@@ -1480,7 +1468,7 @@ async function resolveMSTeamsInboundMedia(params) {
 					deadline: params.deadline,
 					logger: log
 				});
-				if (graphMedia.media.length > 0) mediaList = mergeMSTeamsMediaFacts(mediaList, graphMedia.media, { positionallyAligned: false });
+				mediaList = mergeMSTeamsMediaFacts(mediaList, graphMedia.media, { positionallyAligned: false });
 				if (!hasMaterializedMedia(mediaList)) log.debug?.("graph media fetch empty", {
 					messageUrl,
 					hostedStatus: graphMedia.hostedStatus,
@@ -1517,9 +1505,10 @@ async function prepareMSTeamsInboundContent(params) {
 		return null;
 	}
 	let mediaList = [];
+	const deadline = require_resolve_allowlist.createMSTeamsInboundMediaDeadline();
 	try {
 		mediaList = await require_resolve_allowlist.withMSTeamsRequestDeadline({
-			deadline: params.deadline,
+			deadline,
 			label: "MS Teams inbound media",
 			work: () => resolveMSTeamsInboundMedia({
 				attachments: params.entry.attachments,
@@ -1533,7 +1522,7 @@ async function prepareMSTeamsInboundContent(params) {
 				conversationId: params.conversationId,
 				conversationMessageId: params.conversationMessageId,
 				teamAadGroupId: params.teamAadGroupId,
-				resolveTeamAadGroupId: params.resolveTeamAadGroupId,
+				resolveTeamAadGroupId: () => params.resolveTeamAadGroupId(deadline),
 				serviceUrl: activity.serviceUrl,
 				activity: {
 					id: activity.id,
@@ -1541,7 +1530,7 @@ async function prepareMSTeamsInboundContent(params) {
 					channelData: activity.channelData
 				},
 				log: params.log,
-				deadline: params.deadline
+				deadline
 			})
 		});
 	} catch (err) {
@@ -1567,6 +1556,30 @@ async function prepareMSTeamsInboundContent(params) {
 	};
 }
 //#endregion
+//#region extensions/msteams/src/informative-status.ts
+const INFORMATIVE_MAX_CHARS = 1e3;
+const INFORMATIVE_MAX_BYTES = 1024;
+const ELLIPSIS = "…";
+const segmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+const utf8 = new TextEncoder();
+function flattenInformativeStatus(text) {
+	const joined = text.split("\n").map((line) => line.trim().replace(/^[•-]\s+/u, "")).filter(Boolean).join(" · ");
+	if (joined.length <= INFORMATIVE_MAX_CHARS && utf8.encode(joined).length <= INFORMATIVE_MAX_BYTES) return joined;
+	const graphemes = Array.from(segmenter.segment(joined), (s) => s.segment);
+	let chars = 1;
+	let bytes = utf8.encode(ELLIPSIS).length;
+	let start = graphemes.length;
+	while (start > 0) {
+		const next = graphemes[start - 1];
+		const nextBytes = utf8.encode(next).length;
+		if (chars + next.length > INFORMATIVE_MAX_CHARS || bytes + nextBytes > INFORMATIVE_MAX_BYTES) break;
+		chars += next.length;
+		bytes += nextBytes;
+		start -= 1;
+	}
+	return ELLIPSIS + graphemes.slice(start).join("");
+}
+//#endregion
 //#region extensions/msteams/src/reply-stream-controller.ts
 function isStreamCancelledError(err) {
 	return err instanceof Error && err.name === "StreamCancelledError";
@@ -1581,19 +1594,16 @@ function createTeamsReplyStreamController(params) {
 	let nativeDeliveryClaimed = false;
 	let streamFinalizationPending = false;
 	let canceledLocally = false;
-	let streamFailed = false;
 	let pendingFinalPayload;
 	let emittedText = "";
 	let acknowledgedText = "";
 	let acknowledgedLogicalText = "";
 	let acknowledgedStreamId;
 	let replacementFinalPending = false;
-	let replacementEmitFailed = false;
 	let replacementSettlementPending = false;
 	let replacementTextAwaitingAcknowledgement;
 	let deferredReplacementEntries = [];
 	let queuedFinalActivity;
-	let failedSegmentFallbackPrepared = false;
 	const streamEvents = stream?.events;
 	let streamChunkSubscription;
 	if (typeof streamEvents?.on === "function" && typeof streamEvents.off === "function") streamChunkSubscription = streamEvents.on("chunk", (activity) => {
@@ -1640,6 +1650,16 @@ function createTeamsReplyStreamController(params) {
 		...require_conversation_store_state.buildMSTeamsMessageActivity(text === void 0 ? void 0 : require_conversation_store_state.formatMSTeamsMarkdown(text, params.tableMode ?? "code")),
 		channelData: params.feedbackLoopEnabled ? { feedbackLoopEnabled: true } : {}
 	});
+	const queueFinalReplacement = (activeStream, text) => {
+		const activity = finalStreamActivity(text);
+		replacementTextAwaitingAcknowledgement = {
+			text: activity.text,
+			logicalText: text
+		};
+		activeStream.emit(activity);
+		queuedFinalActivity = activity;
+		emittedText = text;
+	};
 	const deferredReplacementLogicalContent = () => {
 		return deferredReplacementEntries.map((entry) => entry.payload.text).filter((text) => Boolean(text)).join("\n") || void 0;
 	};
@@ -1673,7 +1693,7 @@ function createTeamsReplyStreamController(params) {
 		update: (text) => {
 			if (!stream || wasCanceled() || streamFinalizationPending) return false;
 			try {
-				stream.update(text.replace(/^• /gmu, "- "));
+				stream.update(flattenInformativeStatus(text));
 				return true;
 			} catch (err) {
 				if (isStreamCancelledError(err)) canceledLocally = true;
@@ -1698,10 +1718,6 @@ function createTeamsReplyStreamController(params) {
 			if (!delta) return;
 			if (previousRemainder.trim()) {
 				stream.clearText();
-				if (streamFailed) {
-					streamFinalizationPending = true;
-					return;
-				}
 				replacementFinalPending = true;
 				replacementSettlementPending = true;
 				pendingFinalPayload = { text: fullText };
@@ -1718,8 +1734,7 @@ function createTeamsReplyStreamController(params) {
 					canceledLocally = true;
 					return;
 				}
-				streamFailed = true;
-				params.log?.warn?.(`msteams stream emit failed, falling back to block delivery: ${(0, openclaw_plugin_sdk_error_runtime.coerceErrorMessage)(err)}`);
+				throw err;
 			}
 		},
 		pushItemEvent: progressDraft.pushItemEvent.bind(progressDraft),
@@ -1747,14 +1762,7 @@ function createTeamsReplyStreamController(params) {
 				});
 				pendingFinalPayload = fallbackPayloadForSuppressedFinal(payload);
 				try {
-					const activity = finalStreamActivity(payload.text);
-					replacementTextAwaitingAcknowledgement = {
-						text: activity.text,
-						logicalText: payload.text
-					};
-					stream.emit(activity);
-					queuedFinalActivity = activity;
-					emittedText = payload.text;
+					queueFinalReplacement(stream, payload.text);
 					tokensEmitted = false;
 					return;
 				} catch (err) {
@@ -1766,18 +1774,9 @@ function createTeamsReplyStreamController(params) {
 						deferredReplacementEntries = [];
 						return;
 					}
-					streamFailed = true;
-					replacementEmitFailed = true;
-					params.log?.warn?.(`msteams stream replacement failed, falling back to block delivery: ${(0, openclaw_plugin_sdk_error_runtime.coerceErrorMessage)(err)}`);
-					return;
+					throw err;
 				}
 			}
-			if (streamFailed) {
-				const fallback = failedSegmentFallbackPrepared ? payload : fallbackPayloadAfterAcknowledgedText(payload);
-				failedSegmentFallbackPrepared = true;
-				pendingFinalPayload = void 0;
-				return fallback;
-			}
 			if (streamMode === "progress" && payload.text && !nativeDispatchStarted) try {
 				stream.emit(payload.text);
 				emittedText = payload.text;
@@ -1788,7 +1787,7 @@ function createTeamsReplyStreamController(params) {
 					canceledLocally = true;
 					return;
 				}
-				params.log?.debug?.(`progress-mode finalize failed: ${(0, openclaw_plugin_sdk_error_runtime.coerceErrorMessage)(err)}`);
+				throw err;
 			}
 			if (tokensEmitted) {
 				const hasMedia = Boolean(payload.mediaUrl || payload.mediaUrls?.length);
@@ -1822,15 +1821,8 @@ function createTeamsReplyStreamController(params) {
 						kind: "replacement",
 						payload: pendingFinalPayload
 					});
-					const activity = finalStreamActivity(pendingFinalPayload.text);
-					replacementTextAwaitingAcknowledgement = {
-						text: activity.text,
-						logicalText: pendingFinalPayload.text
-					};
 					logicalContent = deferredReplacementLogicalContent();
-					stream.emit(activity);
-					queuedFinalActivity = activity;
-					emittedText = pendingFinalPayload.text;
+					queueFinalReplacement(stream, pendingFinalPayload.text);
 				}
 				logicalContent ??= replacementSettlementPending ? deferredReplacementLogicalContent() : void 0;
 				const logicalText = pendingFinalPayload?.text ?? (emittedText || void 0);
@@ -1852,15 +1844,13 @@ function createTeamsReplyStreamController(params) {
 				}
 				const result = await stream.close();
 				if (!result) return finalizeWithoutReceipt(logicalContent, wasCanceled());
-				const replacementFallback = replacementSettlementPending && replacementEmitFailed && pendingFinalPayload ? fallbackPayloadAfterAcknowledgedText(pendingFinalPayload) : void 0;
 				const messageId = require_conversation_store_state.extractMessageId(result) ?? acknowledgedStreamId;
-				const postNativePayloads = replacementSettlementPending ? deferredReplacementPayloads(replacementFallback) : [];
-				const nativeContent = replacementEmitFailed ? acknowledgedText || void 0 : content;
+				const postNativePayloads = replacementSettlementPending ? deferredReplacementPayloads(void 0) : [];
 				return {
-					visibleReplySent: replacementEmitFailed ? Boolean(nativeContent) : true,
-					...nativeContent === void 0 ? {} : { content: nativeContent },
+					visibleReplySent: true,
+					...content === void 0 ? {} : { content },
 					...logicalContent ? { logicalContent } : {},
-					...messageId && (!replacementEmitFailed || nativeContent) ? { messageId } : {},
+					...messageId ? { messageId } : {},
 					...postNativePayloads.length > 0 ? { postNativePayloads } : {}
 				};
 			} catch (err) {
@@ -1868,15 +1858,12 @@ function createTeamsReplyStreamController(params) {
 					canceledLocally = true;
 					return acknowledgedNativeDelivery();
 				}
-				streamFailed = true;
 				params.log?.warn?.(`msteams stream finalize failed: ${(0, openclaw_plugin_sdk_error_runtime.coerceErrorMessage)(err)}`);
 				return finalizeWithoutReceipt(logicalContent);
 			} finally {
 				pendingFinalPayload = void 0;
 				streamFinalizationPending = false;
-				failedSegmentFallbackPrepared = true;
 				queuedFinalActivity = void 0;
-				replacementEmitFailed = false;
 				replacementFinalPending = false;
 				replacementSettlementPending = false;
 				replacementTextAwaitingAcknowledgement = void 0;
@@ -1888,7 +1875,7 @@ function createTeamsReplyStreamController(params) {
 			return Boolean(stream);
 		},
 		isStreamActive() {
-			return Boolean(stream) && tokensEmitted && !wasCanceled() && !streamFailed;
+			return Boolean(stream) && tokensEmitted && !wasCanceled();
 		},
 		wasCanceled
 	};
@@ -1897,7 +1884,12 @@ function createTeamsReplyStreamController(params) {
 //#region extensions/msteams/src/reply-dispatcher.ts
 function createMSTeamsReplyDispatcher(params) {
 	const core = require_runtime.getMSTeamsRuntime();
-	const msteamsCfg = params.cfg.channels?.msteams;
+	const msteamsCfg = require_resolve_allowlist.resolveMSTeamsAccountConfig(params.cfg, params.accountId);
+	const mediaMaxBytes = (0, openclaw_plugin_sdk_account_helpers.resolveChannelMediaMaxBytes)({
+		cfg: params.cfg,
+		resolveChannelLimitMb: () => msteamsCfg.mediaMaxMb
+	});
+	const feedbackLoopEnabled = msteamsCfg.feedbackEnabled !== false;
 	const conversationType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(params.conversationRef.conversation?.conversationType);
 	const isTypingSupported = conversationType === "personal" || conversationType === "groupchat";
 	const TYPING_KEEPALIVE_INTERVAL_MS = 8e3;
@@ -1909,7 +1901,10 @@ function createMSTeamsReplyDispatcher(params) {
 				await params.context.sendActivity({ type: "typing" });
 			},
 			onRevoked: async () => {
-				await require_conversation_store_state.sendMSTeamsActivityWithReference(params.app, require_conversation_store_state.buildConversationReference(params.conversationRef), { type: "typing" }, { serviceUrlBoundary: require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(msteamsCfg) });
+				await require_conversation_store_state.sendMSTeamsActivityWithReference(params.app, require_conversation_store_state.buildConversationReference(params.conversationRef), { type: "typing" }, {
+					accountId: params.accountId,
+					serviceUrlBoundary: require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(msteamsCfg)
+				});
 			},
 			onRevokedLog: () => {
 				params.log.debug?.("turn context revoked, sending typing via proactive messaging");
@@ -1935,16 +1930,12 @@ function createMSTeamsReplyDispatcher(params) {
 			}
 		}
 	});
-	const chunkMode = core.channel.text.resolveChunkMode(params.cfg, "msteams");
+	const chunkMode = core.channel.text.resolveChunkMode(params.cfg, "msteams", params.accountId);
 	const tableMode = core.channel.text.resolveMarkdownTableMode({
 		cfg: params.cfg,
-		channel: "msteams"
-	});
-	const mediaMaxBytes = (0, openclaw_plugin_sdk_account_helpers.resolveChannelMediaMaxBytes)({
-		cfg: params.cfg,
-		resolveChannelLimitMb: ({ cfg }) => cfg.channels?.msteams?.mediaMaxMb
+		channel: "msteams",
+		accountId: params.accountId
 	});
-	const feedbackLoopEnabled = params.cfg.channels?.msteams?.feedbackEnabled !== false;
 	const hookRunner = (0, openclaw_plugin_sdk_plugin_runtime.getGlobalHookRunner)();
 	const streamController = createTeamsReplyStreamController({
 		tableMode,
@@ -2018,6 +2009,7 @@ function createMSTeamsReplyDispatcher(params) {
 			const sentIds = [];
 			for (const msg of toSend) try {
 				const msgIds = await require_conversation_store_state.sendMSTeamsMessages({
+					accountId: params.accountId,
 					replyStyle: params.replyStyle,
 					app: params.app,
 					conversationRef: params.conversationRef,
@@ -2048,9 +2040,14 @@ function createMSTeamsReplyDispatcher(params) {
 				params.log.debug?.("individual message send failed, continuing with remaining blocks");
 			}
 			if (failed > 0) {
+				const classification = require_channel_setup.classifyMSTeamsSendError(lastFailedError);
+				const hint = require_channel_setup.formatMSTeamsSendErrorHint(classification);
 				params.log.warn?.(`failed to deliver ${failed} of ${total} message blocks`, {
 					failed,
-					total
+					total,
+					error: require_channel_setup.formatUnknownError(lastFailedError),
+					classification,
+					...hint ? { hint } : {}
 				});
 				queueDeliveryFailureSystemEvent({
 					failed,
@@ -2205,7 +2202,7 @@ async function dispatchMSTeamsInboundTurn(params) {
 	const core = require_runtime.getMSTeamsRuntime();
 	const { cfg, runtime, app, tokenProvider, textLimit, log, logVerboseMessage, facts, admission, content, routing, thread, replyStyle, timestamp, contextVisibilityMode, conversationHistories, historyLimit } = params;
 	const { context, activity, rawBody, text, quoteInfo, conversationRef } = facts;
-	const { senderId, senderName, isDirectMessage, allowNameMatching, groupPolicy, commandAuthorized, effectiveGroupAllowFrom } = admission;
+	const { senderId, senderName, isDirectMessage, allowNameMatching, groupPolicy, commandAuthorized, effectiveGroupAllowFrom, msteamsCfg } = admission;
 	const { route } = routing;
 	const { agentBody, inboundMedia } = content;
 	const { teamAadGroupId, quoteBodyFull, quoteSenderId, quoteSenderName, threadContext } = thread;
@@ -2255,7 +2252,8 @@ async function dispatchMSTeamsInboundTurn(params) {
 	}) : true;
 	const nativeChannelId = isChannel && teamAadGroupId ? `${teamAadGroupId}/${graphChannelId}` : void 0;
 	const boundIngress = await resolveMSTeamsSenderAccess({
-		cfg,
+		cfg: route.accountId === params.listenerAccountId ? params.readConfig() : params.accountPolicyCfg,
+		accountId: route.accountId,
 		activity,
 		hasControlCommand: admission.isControlCommand,
 		conversationThreadId: facts.threadId,
@@ -2267,6 +2265,13 @@ async function dispatchMSTeamsInboundTurn(params) {
 			inboundEventKind: "user_request"
 		}
 	});
+	if (!boundIngress.senderAccess.allowed || boundIngress.hasConflictingConversationScope || boundIngress.msteamsCfg?.enabled === false || boundIngress.commandAccess.shouldBlockControlCommand) {
+		log.info("dropping message (dispatch-time account authorization changed)");
+		return {
+			kind: "completed",
+			finalResponses: 0
+		};
+	}
 	const ctxPayload = core.channel.inbound.buildContext({
 		channelIngress: boundIngress.channelIngress,
 		channel: "msteams",
@@ -2353,10 +2358,10 @@ async function dispatchMSTeamsInboundTurn(params) {
 		replyStyle,
 		textLimit,
 		onSentMessageIds: (ids) => {
-			for (const id of ids) require_conversation_store_state.recordMSTeamsSentMessage(conversationId, id);
+			for (const id of ids) require_conversation_store_state.recordMSTeamsSentMessage(conversationId, id, { accountId: route.accountId });
 		},
 		tokenProvider,
-		sharePointSiteId: cfg.channels?.msteams?.sharePointSiteId
+		sharePointSiteId: msteamsCfg?.sharePointSiteId
 	});
 	const senderTimezone = (activity.entities?.find((entity) => entity.type === "clientInfo"))?.timezone || conversationRef.timezone;
 	const turnConfig = senderTimezone && !cfg.agents?.defaults?.userTimezone ? {
@@ -2449,7 +2454,8 @@ async function prepareMSTeamsDebounceEntry(params) {
 	const replyToId = activity.replyToId ?? void 0;
 	const implicitMentionKinds = conversationId && replyToId && await require_conversation_store_state.wasMSTeamsMessageSentWithPersistence({
 		conversationId,
-		messageId: replyToId
+		messageId: replyToId,
+		accountId: params.accountId
 	}) ? ["reply_to_bot"] : [];
 	return {
 		context: params.context,
@@ -2574,26 +2580,19 @@ function touchLru(map, key, value, max) {
 function buildParentCacheKey(groupId, channelId, parentId) {
 	return `${groupId}\u0000${channelId}\u0000${parentId}`;
 }
-function resolveParentCacheExpiresAt(nowRaw) {
-	const nowMs = (0, openclaw_plugin_sdk_number_runtime.asDateTimestampMs)(nowRaw);
-	return nowMs === void 0 ? void 0 : (0, openclaw_plugin_sdk_number_runtime.resolveExpiresAtMsFromDurationMs)(PARENT_CACHE_TTL_MS, { nowMs });
-}
 async function fetchParentMessageCached(token, groupId, channelId, parentId, deadline) {
 	const key = buildParentCacheKey(groupId, channelId, parentId);
-	const now = (0, openclaw_plugin_sdk_number_runtime.asDateTimestampMs)(Date.now());
 	const cached = parentCache.get(key);
-	const cachedExpiresAt = cached ? (0, openclaw_plugin_sdk_number_runtime.asDateTimestampMs)(cached.expiresAt) : void 0;
-	if (cached && now !== void 0 && cachedExpiresAt !== void 0 && cachedExpiresAt > now) {
+	if (cached && cached.expiresAt > Date.now()) {
 		parentCache.delete(key);
 		parentCache.set(key, cached);
 		return cached.message;
 	}
 	if (cached) parentCache.delete(key);
 	const message = await require_reaction_types.fetchChannelMessage(token, groupId, channelId, parentId, deadline);
-	const expiresAt = resolveParentCacheExpiresAt(Date.now());
-	if (expiresAt !== void 0) touchLru(parentCache, key, {
+	touchLru(parentCache, key, {
 		message,
-		expiresAt
+		expiresAt: Date.now() + PARENT_CACHE_TTL_MS
 	}, PARENT_CACHE_MAX);
 	return message;
 }
@@ -2625,6 +2624,7 @@ function prepareMSTeamsThreadRouting(params) {
 	const route = require_runtime.getMSTeamsRuntime().channel.routing.resolveAgentRoute({
 		cfg: params.cfg,
 		channel: "msteams",
+		accountId: params.accountId,
 		teamId: params.teamId,
 		peer: {
 			kind: params.isDirectMessage ? "direct" : params.isChannel ? "channel" : "group",
@@ -2637,11 +2637,10 @@ function prepareMSTeamsThreadRouting(params) {
 		conversationMessageId: params.conversationMessageId,
 		replyToId: params.context.activity.replyToId
 	});
-	const deadline = require_resolve_allowlist.createMSTeamsInboundDeadline();
 	let teamAadGroupId = params.context.activity.channelData?.team?.aadGroupId?.trim() || void 0;
 	const conversationTeamId = params.isChannel ? params.teamId : void 0;
 	let teamGroupIdPromise;
-	const resolveTeamAadGroupId = async () => {
+	const resolveTeamAadGroupId = async (deadline) => {
 		if (!conversationTeamId) return;
 		teamGroupIdPromise ??= resolveTeamGroupId({
 			conversationTeamId,
@@ -2660,7 +2659,6 @@ function prepareMSTeamsThreadRouting(params) {
 	return {
 		route,
 		threadRootId: params.conversationMessageId ?? params.context.activity.replyToId,
-		deadline,
 		resolveTeamAadGroupId,
 		getTeamAadGroupId: () => teamAadGroupId
 	};
@@ -2668,8 +2666,9 @@ function prepareMSTeamsThreadRouting(params) {
 async function resolveMSTeamsThreadContext(params) {
 	const core = require_runtime.getMSTeamsRuntime();
 	const activity = params.context.activity;
-	const { route, deadline } = params.routing;
-	const teamAadGroupId = await params.routing.resolveTeamAadGroupId();
+	const { route } = params.routing;
+	const deadline = require_resolve_allowlist.createMSTeamsInboundEnrichmentDeadline();
+	const teamAadGroupId = await params.routing.resolveTeamAadGroupId(deadline);
 	let quoteBodyFull;
 	let quoteSenderId;
 	let quoteSenderName;
@@ -2755,19 +2754,21 @@ async function resolveMSTeamsThreadContext(params) {
 //#endregion
 //#region extensions/msteams/src/monitor-handler/message-handler.ts
 function createMSTeamsMessageHandler(deps) {
-	const { cfg, runtime, appId, app, tokenProvider, textLimit, mediaMaxBytes, conversationStore, pollStore, log } = deps;
+	const { cfg, accountPolicyCfg = cfg, accountId, runtime, appId, app, tokenProvider, textLimit, mediaMaxBytes, conversationStore, pollStore, log } = deps;
 	const core = require_runtime.getMSTeamsRuntime();
 	const logVerboseMessage = (message) => {
 		if (core.logging.shouldLogVerbose()) log.debug?.(message);
 	};
-	const msteamsCfg = cfg.channels?.msteams;
+	const msteamsCfg = cfg.channels?.msteams ? require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, accountId) : void 0;
 	const contextVisibilityMode = (0, openclaw_plugin_sdk_context_visibility_runtime.resolveChannelContextVisibilityMode)({
 		cfg,
-		channel: "msteams"
+		channel: "msteams",
+		accountId
 	});
 	const historyLimit = (0, openclaw_plugin_sdk_number_runtime.resolvePromptHistoryLimit)(msteamsCfg?.historyLimit ?? cfg.messages?.groupChat?.historyLimit);
 	const conversationHistories = /* @__PURE__ */ new Map();
-	const readConfig = (0, openclaw_plugin_sdk_runtime_config_snapshot.createRuntimeConfigReader)(cfg);
+	const readFullConfig = (0, openclaw_plugin_sdk_runtime_config_snapshot.createRuntimeConfigReader)(accountPolicyCfg);
+	const readConfig = deps.readConfig ?? createMSTeamsHandlerConfigReader(deps);
 	const resolveDebounceMs = () => core.channel.debounce.resolveInboundDebounceMs({
 		cfg: readConfig(),
 		channel: "msteams"
@@ -2809,7 +2810,8 @@ function createMSTeamsMessageHandler(deps) {
 				isBotOwnedThread = await require_conversation_store_state.wasMSTeamsMessageSentWithPersistence({
 					conversationId,
 					messageId: facts.threadId,
-					botId: activity.recipient.id
+					botId: activity.recipient.id,
+					accountId
 				});
 				currentCfg = readConfig();
 			}
@@ -2818,6 +2820,7 @@ function createMSTeamsMessageHandler(deps) {
 		if (currentMSTeamsCfg?.enabled === false || currentMSTeamsCfg?.appId && currentMSTeamsCfg.appId !== appId) return;
 		const admission = await admitMSTeamsMessage({
 			cfg: currentCfg,
+			accountId,
 			activity,
 			text,
 			conversationId,
@@ -2852,6 +2855,7 @@ function createMSTeamsMessageHandler(deps) {
 		}
 		const threadRouting = prepareMSTeamsThreadRouting({
 			cfg: currentCfg,
+			accountId,
 			context,
 			isDirectMessage,
 			isChannel,
@@ -2861,7 +2865,7 @@ function createMSTeamsMessageHandler(deps) {
 			teamId,
 			log
 		});
-		const { route, deadline: preprocessingDeadline } = threadRouting;
+		const { route } = threadRouting;
 		const inboundLabel = isDirectMessage ? `Teams DM from ${senderName}` : `Teams message in ${conversationType} from ${senderName}`;
 		const enqueuePrimaryMessageSystemEvent = () => core.system.enqueueSystemEvent(inboundLabel, {
 			sessionKey: route.sessionKey,
@@ -2937,7 +2941,6 @@ function createMSTeamsMessageHandler(deps) {
 			mediaAllowHosts: currentMSTeamsCfg?.mediaAllowHosts,
 			mediaAuthAllowHosts: currentMSTeamsCfg?.mediaAuthAllowHosts,
 			graphMediaFallback: currentMSTeamsCfg?.graphMediaFallback,
-			deadline: preprocessingDeadline,
 			log
 		});
 		if (!content) return;
@@ -2958,6 +2961,9 @@ function createMSTeamsMessageHandler(deps) {
 		});
 		await dispatchMSTeamsInboundTurn({
 			cfg: currentCfg,
+			accountPolicyCfg: readFullConfig(),
+			readConfig,
+			listenerAccountId: accountId,
 			runtime,
 			app,
 			tokenProvider,
@@ -3044,6 +3050,7 @@ function createMSTeamsMessageHandler(deps) {
 	return async function handleTeamsMessage(context, turnAdoptionLifecycle) {
 		const entry = await prepareMSTeamsDebounceEntry({
 			context,
+			accountId,
 			turnAdoptionLifecycle
 		});
 		await inboundDebouncer.enqueue(entry);
@@ -3053,10 +3060,11 @@ function createMSTeamsMessageHandler(deps) {
 //#endregion
 //#region extensions/msteams/src/monitor-handler/reaction-handler.ts
 function createMSTeamsReactionHandler(deps) {
-	const { cfg, log } = deps;
+	const { accountId, log } = deps;
+	const readConfig = deps.readConfig ?? createMSTeamsHandlerConfigReader(deps);
 	const core = require_runtime.getMSTeamsRuntime();
-	const msteamsCfg = cfg.channels?.msteams;
 	return async function handleReaction(context, direction) {
+		const cfg = readConfig();
 		const activity = context.activity;
 		const rawReactions = direction === "added" ? activity.reactionsAdded : activity.reactionsRemoved;
 		const reactions = Array.isArray(rawReactions) ? rawReactions : [];
@@ -3076,9 +3084,11 @@ function createMSTeamsReactionHandler(deps) {
 		const senderName = from.name ?? from.id;
 		const access = await resolveMSTeamsSenderAccess({
 			cfg,
+			accountId,
 			activity
 		});
-		const { isDirectMessage, channelGate } = access;
+		const { isDirectMessage, channelGate, msteamsCfg } = access;
+		if (msteamsCfg?.enabled === false || msteamsCfg?.appId && msteamsCfg.appId !== deps.appId) return;
 		if (access.hasConflictingConversationScope) {
 			log.info("dropping reaction (conflicting conversation scope)", { conversationId });
 			return;
@@ -3106,6 +3116,7 @@ function createMSTeamsReactionHandler(deps) {
 		const route = core.channel.routing.resolveAgentRoute({
 			cfg,
 			channel: "msteams",
+			accountId,
 			peer: {
 				kind: isDirectMessage ? "direct" : isChannel ? "channel" : "group",
 				id: isDirectMessage ? senderId : conversationId
@@ -3177,8 +3188,12 @@ function buildGroupWelcomeText(botName) {
 //#region extensions/msteams/src/monitor-handler.ts
 async function isMSTeamsInvokeAuthorized(params) {
 	const { context, deps, invokeKind } = params;
+	const cfg = deps.readConfig?.() ?? deps.cfg;
+	const account = require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, deps.accountId);
+	if (account.enabled === false || account.appId && account.appId !== deps.appId) return false;
 	const resolved = await resolveMSTeamsSenderAccess({
-		cfg: deps.cfg,
+		cfg,
+		accountId: deps.accountId,
 		activity: context.activity
 	});
 	const { msteamsCfg, isDirectMessage, conversationId, senderId } = resolved;
@@ -3224,7 +3239,7 @@ function createMSTeamsActivityHandler(deps) {
 	const handleMembersAdded = async (ctx) => {
 		const membersAdded = ctx.activity?.membersAdded ?? [];
 		const botId = ctx.activity?.recipient?.id;
-		const msteamsCfg = deps.cfg.channels?.msteams;
+		const msteamsCfg = deps.cfg.channels?.msteams ? require_resolve_allowlist.resolveMSTeamsAccountConfig(deps.cfg, deps.accountId) : void 0;
 		for (const member of membersAdded) if (member.id === botId) {
 			const isPersonal = ((0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(ctx.activity?.conversation?.conversationType) ?? "personal") === "personal";
 			if (isPersonal && msteamsCfg?.welcomeCard !== false) {
@@ -3301,7 +3316,8 @@ async function runMSTeamsFeedbackInvokeHandler(context, deps) {
 		deps.log.debug?.("ignoring feedback with unknown reaction", { reaction });
 		return false;
 	}
-	const msteamsCfg = deps.cfg.channels?.msteams;
+	const cfg = deps.readConfig?.() ?? deps.cfg;
+	const msteamsCfg = require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, deps.accountId);
 	if (msteamsCfg?.feedbackEnabled === false) {
 		deps.log.debug?.("feedback handling disabled");
 		return true;
@@ -3324,8 +3340,9 @@ async function runMSTeamsFeedbackInvokeHandler(context, deps) {
 	const isDirectMessage = convType === "personal" || !convType && !activity.conversation?.isGroup;
 	const isChannel = convType === "channel";
 	const route = require_runtime.getMSTeamsRuntime().channel.routing.resolveAgentRoute({
-		cfg: deps.cfg,
+		cfg,
 		channel: "msteams",
+		accountId: deps.accountId,
 		peer: {
 			kind: isDirectMessage ? "direct" : isChannel ? "channel" : "group",
 			id: isDirectMessage ? senderId : conversationId
@@ -3356,7 +3373,7 @@ async function runMSTeamsFeedbackInvokeHandler(context, deps) {
 	});
 	try {
 		await (0, openclaw_plugin_sdk_channel_inbound.recordChannelFeedbackEvent)({
-			cfg: deps.cfg,
+			cfg,
 			agentId: route.agentId,
 			sessionKey: route.sessionKey,
 			event: feedbackEvent
@@ -3383,8 +3400,9 @@ async function runMSTeamsFeedbackInvokeHandler(context, deps) {
 		locale: activity.locale
 	};
 	if (isNegative && msteamsCfg?.feedbackReflection !== false) runFeedbackReflection({
-		cfg: deps.cfg,
+		cfg,
 		app: deps.app,
+		accountId: deps.accountId,
 		conversationRef,
 		sessionKey: route.sessionKey,
 		agentId: route.agentId,
@@ -3405,7 +3423,7 @@ async function handleMSTeamsFileConsentInvoke(context, log) {
 	if (activity.type !== "invoke" || activity.name !== "fileConsent/invoke") return false;
 	const consentResponse = require_conversation_store_state.parseFileConsentInvoke(activity);
 	if (!consentResponse) {
-		log.debug?.("invalid file consent invoke", { value: activity.value });
+		log.debug?.("invalid file consent invoke");
 		return false;
 	}
 	const uploadId = typeof consentResponse.context?.uploadId === "string" ? consentResponse.context.uploadId : void 0;
@@ -3501,6 +3519,14 @@ async function runMSTeamsFileConsentInvokeHandler(context, log) {
 	}
 }
 //#endregion
+//#region extensions/msteams/src/monitor-account-stores.ts
+function createMSTeamsMonitorStores(accountId, overrides) {
+	return {
+		conversationStore: overrides.conversationStore ?? require_conversation_store_state.createMSTeamsConversationStoreState({ accountId }),
+		pollStore: overrides.pollStore ?? require_conversation_store_state.createMSTeamsPollStoreState({ accountId })
+	};
+}
+//#endregion
 //#region extensions/msteams/src/monitor-status.ts
 function publishMSTeamsBlocked(statusSink, lastError) {
 	statusSink?.((0, openclaw_plugin_sdk_gateway_runtime.channelBlockedPatch)(lastError, { running: true }));
@@ -3613,7 +3639,7 @@ function createMSTeamsIngress(options) {
 			const installedLiveContext = Boolean(liveContext) && !liveContexts.has(facts.eventId);
 			if (liveContext && installedLiveContext) liveContexts.set(facts.eventId, liveContext);
 			const uninstallLiveContext = () => {
-				if (installedLiveContext && liveContexts.get(facts.eventId) === liveContext) liveContexts.delete(facts.eventId);
+				if (installedLiveContext) liveContexts.delete(facts.eventId);
 			};
 			let result;
 			try {
@@ -3643,7 +3669,7 @@ function createMSTeamsIngress(options) {
 }
 //#endregion
 //#region extensions/msteams/src/replay-context.ts
-function createMSTeamsReplayContext(activity, app, serviceUrlBoundary) {
+function createMSTeamsReplayContext(activity, app, serviceUrlBoundary, accountId) {
 	const rawConversationId = activity.conversation?.id ?? "";
 	const conversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(rawConversationId);
 	const conversationType = activity.conversation?.conversationType ?? "personal";
@@ -3667,6 +3693,7 @@ function createMSTeamsReplayContext(activity, app, serviceUrlBoundary) {
 		...activity.from?.aadObjectId ? { aadObjectId: activity.from.aadObjectId } : {}
 	};
 	const proactiveOptions = {
+		accountId,
 		...quoteActivityId ? { quoteActivityId } : {},
 		...threadActivityId ? { threadActivityId } : {},
 		serviceUrlBoundary
@@ -3699,15 +3726,15 @@ function createMSTeamsReplayContext(activity, app, serviceUrlBoundary) {
 * falling back to the Bot Framework `activity.from.id`.
 */
 const MSTEAMS_SSO_TOKENS_NAMESPACE = "sso-tokens";
-const SSO_TOKEN_MUTATION_KEY = "sso-tokens";
 const MSTEAMS_MAX_SSO_TOKENS = 5e3;
 const STORE_KEY_VERSION_PREFIX = "v2:";
 function makeMSTeamsSsoTokenStoreKey(connectionName, userId) {
 	return `${STORE_KEY_VERSION_PREFIX}${(0, node_crypto.createHash)("sha256").update(JSON.stringify([connectionName, userId])).digest("hex")}`;
 }
-function createMSTeamsSsoTokenStoreFs() {
+function createMSTeamsSsoTokenStoreFs(params) {
+	const namespace = require_delegated_state.resolveMSTeamsAccountStateNamespace(MSTEAMS_SSO_TOKENS_NAMESPACE, params?.accountId);
 	const tokenStore = require_runtime.getMSTeamsRuntime().state.openKeyedStore({
-		namespace: MSTEAMS_SSO_TOKENS_NAMESPACE,
+		namespace,
 		maxEntries: MSTEAMS_MAX_SSO_TOKENS
 	});
 	return {
@@ -3715,12 +3742,12 @@ function createMSTeamsSsoTokenStoreFs() {
 			return await tokenStore.lookup(makeMSTeamsSsoTokenStoreKey(connectionName, userId)) ?? null;
 		},
 		async save(token) {
-			await require_conversation_store_state.withMSTeamsSqliteMutationLock(SSO_TOKEN_MUTATION_KEY, async () => {
-				await tokenStore.register(makeMSTeamsSsoTokenStoreKey(token.connectionName, token.userId), require_conversation_store_state.toPluginJsonValue({ ...token }));
+			await require_delegated_state.withMSTeamsSqliteMutationLock(namespace, async () => {
+				await tokenStore.register(makeMSTeamsSsoTokenStoreKey(token.connectionName, token.userId), require_delegated_state.toPluginJsonValue({ ...token }));
 			});
 		},
 		async remove({ connectionName, userId }) {
-			return require_conversation_store_state.withMSTeamsSqliteMutationLock(SSO_TOKEN_MUTATION_KEY, () => tokenStore.delete(makeMSTeamsSsoTokenStoreKey(connectionName, userId)));
+			return require_delegated_state.withMSTeamsSqliteMutationLock(namespace, () => tokenStore.delete(makeMSTeamsSsoTokenStoreKey(connectionName, userId)));
 		}
 	};
 }
@@ -3776,9 +3803,12 @@ function createMSTeamsWebhookHandler(expressApp, warn) {
 async function monitorMSTeamsProvider(opts) {
 	const core = require_runtime.getMSTeamsRuntime();
 	const log = core.logging.getChildLogger({ name: "msteams" });
-	let cfg = opts.cfg;
-	let msteamsCfg = cfg.channels?.msteams;
-	if (!msteamsCfg?.enabled) {
+	const account = require_resolve_allowlist.resolveMSTeamsRuntimeAccount(opts);
+	const { accountId, credentials: creds } = account;
+	const accountPolicyCfg = opts.cfg;
+	let cfg = accountPolicyCfg;
+	let msteamsCfg = account.config;
+	if (opts.cfg.channels?.msteams?.enabled !== true || msteamsCfg.enabled === false) {
 		log.debug?.("msteams provider disabled");
 		publishMSTeamsBlocked(opts.statusSink, "Microsoft Teams provider is disabled");
 		return {
@@ -3786,7 +3816,6 @@ async function monitorMSTeamsProvider(opts) {
 			shutdown: async () => {}
 		};
 	}
-	const creds = require_token_config.resolveMSTeamsCredentials(msteamsCfg);
 	if (!creds) {
 		log.error("msteams credentials not configured");
 		publishMSTeamsBlocked(opts.statusSink, "Microsoft Teams credentials are not configured");
@@ -3795,6 +3824,8 @@ async function monitorMSTeamsProvider(opts) {
 			shutdown: async () => {}
 		};
 	}
+	const collisionIssue = require_channel.resolveMSTeamsWebhookCollisionIssue(accountPolicyCfg);
+	if (collisionIssue) throw new Error(collisionIssue);
 	const appId = creds.appId;
 	const runtime = opts.runtime ?? {
 		log: console.log,
@@ -3803,6 +3834,11 @@ async function monitorMSTeamsProvider(opts) {
 			throw new Error(`exit ${code}`);
 		}
 	};
+	cfg = require_resolve_allowlist.withAccountScopedMSTeamsConfig({
+		cfg,
+		accountId,
+		accountConfig: msteamsCfg
+	});
 	const configuredAllowFrom = msteamsCfg.allowFrom;
 	const configuredGroupAllowFrom = msteamsCfg.groupAllowFrom;
 	let allowFrom = require_resolve_allowlist.projectStableMSTeamsUserAllowlist(configuredAllowFrom);
@@ -3816,6 +3852,7 @@ async function monitorMSTeamsProvider(opts) {
 	const resolveAllowlistUsers = async (label, entries) => {
 		const resolved = await require_resolve_allowlist.resolveMSTeamsUserAllowlist({
 			cfg,
+			accountId,
 			entries
 		});
 		const additions = [];
@@ -3853,6 +3890,7 @@ async function monitorMSTeamsProvider(opts) {
 		if (msteamsCfg.teams && Object.keys(msteamsCfg.teams).length > 0) {
 			const resolved = await require_resolve_allowlist.resolveMSTeamsTeamsConfig({
 				cfg,
+				accountId,
 				teamIdMode: "bot-framework",
 				teams: msteamsCfg.teams
 			});
@@ -3872,15 +3910,17 @@ async function monitorMSTeamsProvider(opts) {
 		groupAllowFrom,
 		teams: teamsConfig
 	};
-	cfg = {
-		...cfg,
-		channels: {
-			...cfg.channels,
-			msteams: msteamsCfg
-		}
-	};
+	cfg = require_resolve_allowlist.withAccountScopedMSTeamsConfig({
+		cfg,
+		accountId,
+		accountConfig: msteamsCfg
+	});
 	const legacyListener = require_channel.resolveMSTeamsLegacyWebhook(msteamsCfg);
-	const pathIssue = require_channel.resolveMSTeamsWebhookPathIssue({ cfg });
+	const pathIssue = require_channel.resolveMSTeamsWebhookPathIssue({
+		cfg: accountPolicyCfg,
+		accountId,
+		accountConfig: msteamsCfg
+	});
 	if (pathIssue) {
 		if (!legacyListener) throw new Error(pathIssue);
 		log.warn?.(pathIssue);
@@ -3890,8 +3930,7 @@ async function monitorMSTeamsProvider(opts) {
 		cfg,
 		resolveChannelLimitMb: ({ cfg: channelCfg }) => channelCfg.channels?.msteams?.mediaMaxMb
 	}) ?? 8388608;
-	const conversationStore = opts.conversationStore ?? require_conversation_store_state.createMSTeamsConversationStoreState();
-	const pollStore = opts.pollStore ?? require_conversation_store_state.createMSTeamsPollStoreState();
+	const { conversationStore, pollStore } = createMSTeamsMonitorStores(accountId, opts);
 	log.info("starting provider on Gateway HTTP routes");
 	const express = await import("express");
 	const expressApp = express.default();
@@ -3920,7 +3959,7 @@ async function monitorMSTeamsProvider(opts) {
 		messagingEndpoint: configuredPath,
 		...ssoConnectionName ? { oauthDefaultConnectionName: ssoConnectionName } : {}
 	});
-	if (configuredPath !== "/api/messages") {
+	if (accountId === openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID && configuredPath !== "/api/messages") {
 		let warnedLegacyMessagesRoute = false;
 		expressApp.post("/api/messages", (req, res, next) => {
 			if (!warnedLegacyMessagesRoute) {
@@ -3933,12 +3972,14 @@ async function monitorMSTeamsProvider(opts) {
 	}
 	const tokenProvider = require_resolve_allowlist.createMSTeamsTokenProvider(app);
 	const ssoDeps = ssoConnectionName ? {
-		tokenStore: createMSTeamsSsoTokenStoreFs(),
+		tokenStore: createMSTeamsSsoTokenStoreFs({ accountId }),
 		connectionName: ssoConnectionName
 	} : void 0;
 	if (ssoDeps) log.debug?.("msteams sso enabled", { connectionName: ssoDeps.connectionName });
 	const handlerDeps = {
 		cfg,
+		accountPolicyCfg,
+		accountId,
 		runtime,
 		appId,
 		app,
@@ -3949,13 +3990,14 @@ async function monitorMSTeamsProvider(opts) {
 		pollStore,
 		log
 	};
+	handlerDeps.readConfig = createMSTeamsHandlerConfigReader(handlerDeps);
 	const handleActivity = createMSTeamsActivityHandler(handlerDeps);
 	const ingress = createMSTeamsIngress({
 		accountId: appId,
 		runtime,
 		dispatch: async (activity, lifecycle, liveContext) => {
 			if (liveContext) liveContext.activity = activity;
-			const context = liveContext ?? createMSTeamsReplayContext(activity, app, require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(msteamsCfg));
+			const context = liveContext ?? createMSTeamsReplayContext(activity, app, require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(msteamsCfg), accountId);
 			return await handleActivity(context, lifecycle);
 		}
 	});
@@ -4065,6 +4107,7 @@ async function monitorMSTeamsProvider(opts) {
 				return;
 			}
 			await Promise.all(userIds.map((userId) => ssoDeps.tokenStore.save({
+				...accountId === openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID ? {} : { accountId },
 				connectionName,
 				userId,
 				token: ctx.token.token,
@@ -4111,7 +4154,7 @@ async function monitorMSTeamsProvider(opts) {
 			auth: "plugin",
 			pluginId: "msteams",
 			source: "msteams-webhook",
-			accountId: appId,
+			accountId,
 			handler: webhook.handler,
 			legacyListener: legacyListener ? {
 				...legacyListener,
@@ -4124,12 +4167,12 @@ async function monitorMSTeamsProvider(opts) {
 			throwOnFailure: true,
 			log: (message) => log.warn?.(message)
 		}));
-		if (configuredPath !== "/api/messages") unregisterRoutes.push((0, openclaw_plugin_sdk_webhook_targets.registerPluginHttpRoute)({
+		if (accountId === openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID && configuredPath !== "/api/messages") unregisterRoutes.push((0, openclaw_plugin_sdk_webhook_targets.registerPluginHttpRoute)({
 			path: "/api/messages",
 			auth: "plugin",
 			pluginId: "msteams",
 			source: "msteams-webhook-alias",
-			accountId: appId,
+			accountId,
 			handler: webhook.handler,
 			log: (message) => log.warn?.(message)
 		}));