@openclaw/msteams 2026.11.3 → 2026.11.5-beta.2

package/dist/.setup/{channel.setup-BN3uhq3r.cjs → channel.setup-B9yKGEse.cjs}

@@ -1,8 +1,8 @@
-const require_token_config = require("./token-config-bEpua_Q7.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-gI34MnpE.cjs");
+const require_token_config = require("./token-config-DICiuJWr.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-7mIEepXB.cjs");
 require("../runtime-api.cjs");
-const require_delegated_state = require("./delegated-state-Bv5cWuec.cjs");
-const require_config_schema = require("./config-schema-CkKdphSp.cjs");
+const require_delegated_state = require("./delegated-state-ilYzKwD8.cjs");
+const require_config_schema = require("./config-schema-3lVZ45cB.cjs");
 let openclaw_plugin_sdk_channel_policy = require("openclaw/plugin-sdk/channel-policy");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_account_helpers = require("openclaw/plugin-sdk/account-helpers");
@@ -17,17 +17,6 @@ let openclaw_plugin_sdk_channel_dm_policy = require("openclaw/plugin-sdk/channel
 let openclaw_plugin_sdk_setup_runtime = require("openclaw/plugin-sdk/setup-runtime");
 let openclaw_plugin_sdk_retry_runtime = require("openclaw/plugin-sdk/retry-runtime");
 //#region extensions/msteams/src/accounts-mutations.ts
-function splitRootIdentity(msteams) {
-	const { appId, appPassword, ...root } = msteams;
-	return {
-		root,
-		defaultAccount: {
-			...msteams.enabled === false && (appId !== void 0 || appPassword !== void 0 || require_token_config.hasConfiguredMSTeamsCredentials(msteams)) ? { enabled: false } : {},
-			...appId !== void 0 ? { appId } : {},
-			...appPassword !== void 0 ? { appPassword } : {}
-		}
-	};
-}
 function patchMSTeamsAccountConfig(params) {
 	const accountId = (0, openclaw_plugin_sdk_account_id.normalizeAccountId)(params.accountId);
 	const msteams = params.cfg.channels?.msteams ?? {};
@@ -44,7 +33,12 @@ function patchMSTeamsAccountConfig(params) {
 			}
 		}
 	};
-	const { root: baseMsteams, defaultAccount } = splitRootIdentity(msteams);
+	const { appId, appPassword, ...baseMsteams } = msteams;
+	const defaultAccount = {
+		...msteams.enabled === false && (appId !== void 0 || appPassword !== void 0 || require_token_config.hasConfiguredMSTeamsCredentials(msteams)) ? { enabled: false } : {},
+		...appId !== void 0 ? { appId } : {},
+		...appPassword !== void 0 ? { appPassword } : {}
+	};
 	const baseAccounts = ensureEnabled && msteams.enabled === false ? Object.fromEntries(Object.entries(baseMsteams.accounts ?? {}).map(([key, account]) => [key, {
 		...account,
 		enabled: false
@@ -111,7 +105,7 @@ const collectMSTeamsSecurityWarnings = (0, openclaw_plugin_sdk_channel_policy.cr
 			accountId
 		});
 		const accounts = cfg.channels?.msteams?.accounts;
-		const rawAccountKey = accounts ? Object.keys(accounts).find((key) => (0, openclaw_plugin_sdk_account_id.normalizeAccountId)(key) === account.accountId) : void 0;
+		const rawAccountKey = require_resolve_allowlist.resolveMSTeamsAccountEntryKey(accounts, account.accountId);
 		const hasAccountPolicyOverride = rawAccountKey !== void 0 && accounts?.[rawAccountKey]?.groupPolicy !== void 0;
 		const configPath = account.accountId === openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID && !hasAccountPolicyOverride ? "channels.msteams" : `channels.msteams.accounts.${rawAccountKey ?? account.accountId}`;
 		return [`- ${configPath === "channels.msteams" ? "MS Teams" : `MS Teams[${account.accountId}]`} groups: groupPolicy="open" allows any member to trigger (mention-gated). Set ${configPath}.groupPolicy="allowlist" + ${configPath}.groupAllowFrom to restrict senders.`];
@@ -187,29 +181,9 @@ const msteamsConfigAdapter = {
 //#region extensions/msteams/src/setup-core.ts
 const t$1 = (0, openclaw_plugin_sdk_setup.createSetupTranslator)();
 const channel$1 = "msteams";
-function applySecretAuthCredentials(patch, existing) {
-	return {
-		...patch,
-		authType: "secret",
-		...existing.certificatePath !== void 0 ? { certificatePath: void 0 } : {},
-		...existing.certificateThumbprint !== void 0 ? { certificateThumbprint: void 0 } : {},
-		...existing.useManagedIdentity !== void 0 ? { useManagedIdentity: void 0 } : {},
-		...existing.managedIdentityClientId !== void 0 ? { managedIdentityClientId: void 0 } : {}
-	};
-}
 function resolveSetupAccountId(cfg, accountId) {
 	return (0, openclaw_plugin_sdk_setup.normalizeAccountId)(accountId ?? require_resolve_allowlist.resolveDefaultMSTeamsAccountId(cfg));
 }
-function resolveRawMSTeamsAccountConfig(cfg, accountId) {
-	const normalized = (0, openclaw_plugin_sdk_setup.normalizeAccountId)(accountId);
-	const msteams = cfg.channels?.msteams ?? {};
-	if (normalized === openclaw_plugin_sdk_setup.DEFAULT_ACCOUNT_ID) {
-		const rawAccountKey = require_resolve_allowlist.resolveMSTeamsAccountEntryKey(msteams.accounts, normalized);
-		return (rawAccountKey ? msteams.accounts?.[rawAccountKey] : void 0) ?? msteams;
-	}
-	const rawAccountKey = require_resolve_allowlist.resolveMSTeamsAccountEntryKey(msteams.accounts, normalized);
-	return (rawAccountKey ? msteams.accounts?.[rawAccountKey] : void 0) ?? {};
-}
 function resolveCredentialsForSetup(cfg, accountId) {
 	return require_token_config.resolveMSTeamsCredentials(require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, accountId), {
 		allowEnvFallback: accountId === openclaw_plugin_sdk_setup.DEFAULT_ACCOUNT_ID,
@@ -309,7 +283,9 @@ const msteamsSetupAdapter = {
 		const appId = input.appId;
 		const appPassword = input.appPassword;
 		const tenantId = input.tenantId;
-		const existing = resolveRawMSTeamsAccountConfig(cfg, resolvedAccountId);
+		const msteams = cfg.channels?.msteams ?? {};
+		const rawAccountKey = require_resolve_allowlist.resolveMSTeamsAccountEntryKey(msteams.accounts, resolvedAccountId);
+		const existing = (rawAccountKey ? msteams.accounts?.[rawAccountKey] : void 0) ?? (resolvedAccountId === openclaw_plugin_sdk_setup.DEFAULT_ACCOUNT_ID ? msteams : {});
 		const patch = {};
 		if (appId?.trim()) patch.appId = appId.trim();
 		if (appPassword?.trim()) patch.appPassword = appPassword.trim();
@@ -320,7 +296,14 @@ const msteamsSetupAdapter = {
 		};
 		const inheritedTenantId = require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, resolvedAccountId).tenantId?.trim();
 		const replacesWithSecretAuth = Boolean(appId?.trim() && appPassword?.trim() && (tenantId?.trim() || inheritedTenantId));
-		const credentialPatch = replacesWithSecretAuth ? applySecretAuthCredentials(patch, existing) : patch;
+		const credentialPatch = replacesWithSecretAuth ? {
+			...patch,
+			authType: "secret",
+			...existing.certificatePath !== void 0 ? { certificatePath: void 0 } : {},
+			...existing.certificateThumbprint !== void 0 ? { certificateThumbprint: void 0 } : {},
+			...existing.useManagedIdentity !== void 0 ? { useManagedIdentity: void 0 } : {},
+			...existing.managedIdentityClientId !== void 0 ? { managedIdentityClientId: void 0 } : {}
+		} : patch;
 		return patchMSTeamsAccountConfig({
 			cfg: input.useEnv && !replacesWithSecretAuth ? selectMSTeamsEnvironmentCredentials(cfg) : cfg,
 			accountId: resolvedAccountId,
@@ -390,15 +373,6 @@ async function promptMSTeamsCredentials(prompter) {
 		tenantId: await promptRequired(t$1("wizard.msteams.tenantIdPrompt"))
 	};
 }
-async function noteMSTeamsCredentialHelp(prompter) {
-	await prompter.note([
-		t$1("wizard.msteams.helpAzureBot"),
-		t$1("wizard.msteams.helpClientSecret"),
-		t$1("wizard.msteams.helpWebhook"),
-		t$1("wizard.msteams.helpEnvTip"),
-		t$1("wizard.channels.docs", { link: (0, openclaw_plugin_sdk_setup_tools.formatDocsLink)("/channels/msteams", "msteams") })
-	].join("\n"), t$1("wizard.msteams.credentialsTitle"));
-}
 function createMSTeamsSetupWizardBase() {
 	return {
 		channel: channel$1,
@@ -425,7 +399,13 @@ function createMSTeamsSetupWizardBase() {
 			const hasConfigCreds = require_token_config.hasConfiguredMSTeamsCredentials(require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, resolvedAccountId), { allowEnvFallback: false });
 			const canUseEnv = Boolean(resolvedAccountId === openclaw_plugin_sdk_setup.DEFAULT_ACCOUNT_ID && !hasConfigCreds && resolveEnvironmentCredentialsForSetup());
 			let next = cfg;
-			if (!resolved && !hasConfigCreds) await noteMSTeamsCredentialHelp(prompter);
+			if (!resolved && !hasConfigCreds) await prompter.note([
+				t$1("wizard.msteams.helpAzureBot"),
+				t$1("wizard.msteams.helpClientSecret"),
+				t$1("wizard.msteams.helpWebhook"),
+				t$1("wizard.msteams.helpEnvTip"),
+				t$1("wizard.channels.docs", { link: (0, openclaw_plugin_sdk_setup_tools.formatDocsLink)("/channels/msteams", "msteams") })
+			].join("\n"), t$1("wizard.msteams.credentialsTitle"));
 			const keep = (canUseEnv || hasConfigCreds) && await prompter.confirm({
 				message: t$1(canUseEnv ? "wizard.msteams.envPrompt" : "wizard.msteams.credentialsKeep"),
 				initialValue: true
@@ -444,7 +424,6 @@ function createMSTeamsSetupWizardBase() {
 }
 //#endregion
 //#region extensions/msteams/src/errors.ts
-const MAX_SAFE_RETRY_AFTER_SECONDS = Number.MAX_SAFE_INTEGER / 1e3;
 function formatUnknownError(err) {
 	if (err instanceof Error) return err.message;
 	if (typeof err === "symbol") return err.description ?? err.toString();
@@ -457,57 +436,21 @@ function formatUnknownError(err) {
 	}
 }
 function extractStatusCode(err) {
-	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(err)) return null;
-	const parseStatusCode = (value) => {
-		if (typeof value === "number") return Number.isInteger(value) && value >= 100 && value <= 599 ? value : null;
-		if (typeof value === "string") {
-			const trimmed = value.trim();
-			if (!/^\d{3}$/.test(trimmed)) return null;
-			const parsed = Number(trimmed);
-			return parsed >= 100 && parsed <= 599 ? parsed : null;
-		}
-		return null;
+	const range = {
+		min: 100,
+		max: 599
 	};
-	const directStatus = parseStatusCode(err.statusCode ?? err.status);
-	if (directStatus !== null) return directStatus;
-	const response = err.response;
-	if ((0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(response)) {
-		const responseStatus = parseStatusCode(response.status);
-		if (responseStatus !== null) return responseStatus;
-	}
-	return null;
-}
-function extractErrorCode(err) {
-	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(err)) return null;
-	const direct = err.code;
-	if (typeof direct === "string" && direct.trim()) return direct;
+	const directStatus = (0, openclaw_plugin_sdk_number_runtime.asSafeIntegerInRange)(err.statusCode ?? err.status, range);
+	if (directStatus !== void 0) return directStatus;
 	const response = err.response;
-	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(response)) return null;
-	const body = response.body;
-	if ((0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(body)) {
-		const error = body.error;
-		if ((0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(error) && typeof error.code === "string" && error.code.trim()) return error.code;
-	}
-	return null;
+	return (0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(response) ? (0, openclaw_plugin_sdk_number_runtime.asSafeIntegerInRange)(response.status, range) ?? null : null;
 }
 function extractRetryAfterMs(err) {
-	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(err)) return null;
-	const direct = err.retryAfterMs ?? err.retry_after_ms;
-	const directMs = (0, openclaw_plugin_sdk_number_runtime.asFiniteNumberInRange)(direct, {
+	const directMs = (0, openclaw_plugin_sdk_number_runtime.asFiniteNumberInRange)(err.retryAfterMs, {
 		min: 0,
 		max: Number.MAX_SAFE_INTEGER
 	});
 	if (directMs !== void 0) return directMs;
-	const retryAfter = err.retryAfter ?? err.retry_after;
-	const retryAfterSeconds = (0, openclaw_plugin_sdk_number_runtime.asFiniteNumberInRange)(retryAfter, {
-		min: 0,
-		max: MAX_SAFE_RETRY_AFTER_SECONDS
-	});
-	if (retryAfterSeconds !== void 0) return retryAfterSeconds * 1e3;
-	if (typeof retryAfter === "string") {
-		const parsed = parseNonNegativeRetryAfterSeconds(retryAfter);
-		if (parsed !== void 0) return parsed * 1e3;
-	}
 	const response = err.response;
 	if (!(0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(response)) return null;
 	const headers = response.headers;
@@ -528,22 +471,15 @@ function extractRetryAfterMs(err) {
 	}
 	return null;
 }
-function parseNonNegativeRetryAfterSeconds(raw) {
-	const trimmed = raw.trim();
-	if (!/^\d+(?:\.\d+)?$/.test(trimmed)) return;
-	return (0, openclaw_plugin_sdk_number_runtime.asFiniteNumberInRange)((0, openclaw_plugin_sdk_number_runtime.parseStrictFiniteNumber)(trimmed), {
-		min: 0,
-		max: MAX_SAFE_RETRY_AFTER_SECONDS
-	});
-}
 /**
 * Owns retry safety and delivery ambiguity for Teams send failures.
 * Only Teams rate-limit rejection proves this unkeyed POST safe to replay.
 */
 function classifyMSTeamsSendError(err) {
-	const statusCode = extractStatusCode(err);
-	const retryAfterMs = extractRetryAfterMs(err);
-	const errorCode = extractErrorCode(err) ?? void 0;
+	const error = (0, openclaw_plugin_sdk_string_coerce_runtime.isRecord)(err) ? err : {};
+	const statusCode = extractStatusCode(error);
+	const retryAfterMs = extractRetryAfterMs(error);
+	const errorCode = typeof error.code === "string" && error.code.trim() ? error.code : void 0;
 	if (statusCode === 401) return {
 		kind: "auth",
 		statusCode,
@@ -589,18 +525,6 @@ function classifyMSTeamsSendError(err) {
 		errorCode
 	};
 }
-/**
-* Detect whether an error is caused by a revoked Proxy.
-*
-* The Bot Framework SDK wraps TurnContext in a Proxy that is revoked once the
-* turn handler returns.  Any later access (e.g. from a debounced callback)
-* throws a TypeError whose message contains the distinctive "proxy that has
-* been revoked" string.
-*/
-function isRevokedProxyError(err) {
-	if (!(err instanceof TypeError)) return false;
-	return /proxy that has been revoked/i.test(err.message);
-}
 function formatMSTeamsSendErrorHint(classification) {
 	if (classification.kind === "auth") return "check msteams appId/appPassword/tenantId (or env vars MSTEAMS_APP_ID/MSTEAMS_APP_PASSWORD/MSTEAMS_TENANT_ID)";
 	if (classification.errorCode === "ContentStreamNotAllowed") return "Teams expired the content stream; stop streaming earlier and fall back to normal message delivery";
@@ -621,148 +545,79 @@ const channel = "msteams";
 function openDelegatedOAuthUrl(url) {
 	return Promise.reject(/* @__PURE__ */ new Error(`Automatic browser launch is not available. Open this URL manually: ${url}`));
 }
-function looksLikeGuid(value) {
-	return /^[0-9a-fA-F-]{16,}$/.test(value);
-}
-async function promptMSTeamsAllowFrom(params) {
-	const accountId = (0, openclaw_plugin_sdk_account_id.normalizeAccountId)(params.accountId ?? require_resolve_allowlist.resolveDefaultMSTeamsAccountId(params.cfg));
-	const existing = require_resolve_allowlist.resolveMSTeamsAccountConfig(params.cfg, accountId).allowFrom ?? [];
-	await params.prompter.note([
-		t("wizard.msteams.allowlistIntro"),
-		t("wizard.msteams.allowlistResolve"),
-		t("wizard.msteams.examples"),
-		"- alex@example.com",
-		"- Alex Johnson",
-		"- 00000000-0000-0000-0000-000000000000"
-	].join("\n"), t("wizard.msteams.allowlistTitle"));
-	while (true) {
-		const entry = await params.prompter.text({
-			message: t("wizard.msteams.allowFromPrompt"),
-			placeholder: "alex@example.com, Alex Johnson",
-			initialValue: existing[0] ? existing[0] : void 0,
-			validate: (value) => value.trim() ? void 0 : t("common.required")
-		});
-		const parts = (0, openclaw_plugin_sdk_setup.splitSetupEntries)(entry);
-		if (parts.length === 0) {
-			await params.prompter.note(t("wizard.msteams.enterAtLeastOneUser"), t("wizard.msteams.allowlistTitle"));
-			continue;
-		}
-		const resolved = await require_resolve_allowlist.resolveMSTeamsUserAllowlist({
-			cfg: params.cfg,
-			accountId,
-			entries: parts
-		}).catch(() => null);
-		let ids;
-		if (!resolved) {
-			ids = parts.filter((part) => looksLikeGuid(part));
-			if (ids.length !== parts.length) {
-				await params.prompter.note(t("wizard.msteams.graphLookupUnavailable"), t("wizard.msteams.allowlistTitle"));
-				continue;
-			}
-		} else {
-			const unresolved = resolved.filter((item) => !item.resolved || !item.id);
-			if (unresolved.length > 0) {
-				await params.prompter.note(t("wizard.msteams.couldNotResolve", { entries: unresolved.map((item) => item.input).join(", ") }), t("wizard.msteams.allowlistTitle"));
-				continue;
-			}
-			ids = resolved.flatMap((item) => item.id ? [item.id] : []);
-		}
-		const unique = (0, openclaw_plugin_sdk_setup.mergeAllowFromEntries)(existing, ids);
-		return patchMSTeamsAccountConfig({
-			cfg: params.cfg,
-			accountId,
-			patch: {
-				dmPolicy: "allowlist",
-				allowFrom: unique
-			},
-			scopeDefaultToAccounts: shouldScopeMSTeamsDefaultToAccounts(params.cfg, accountId)
-		});
-	}
-}
 function shouldScopeMSTeamsDefaultToAccounts(cfg, accountId) {
 	if ((0, openclaw_plugin_sdk_account_id.normalizeAccountId)(accountId) !== openclaw_plugin_sdk_account_id.DEFAULT_ACCOUNT_ID) return false;
 	return Object.keys(cfg.channels?.msteams?.accounts ?? {}).length > 0;
 }
-function setMSTeamsTeamsAllowlist(cfg, accountId, entries) {
-	const teams = { ...require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, accountId).teams ?? {} };
-	for (const entry of entries) {
-		const teamKey = entry.teamKey;
-		if (!teamKey) continue;
-		const existing = teams[teamKey] ?? {};
-		if (entry.channelKey) {
-			const channels = { ...existing.channels };
-			channels[entry.channelKey] = channels[entry.channelKey] ?? {};
-			teams[teamKey] = {
-				...existing,
-				channels
-			};
-		} else teams[teamKey] = existing;
-	}
-	return patchMSTeamsAccountConfig({
-		cfg,
-		accountId,
-		patch: { teams },
-		scopeDefaultToAccounts: shouldScopeMSTeamsDefaultToAccounts(cfg, accountId)
-	});
-}
-function listMSTeamsGroupEntries(cfg, accountId) {
-	return Object.entries(require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, accountId).teams ?? {}).flatMap(([teamKey, value]) => {
-		const channels = value?.channels ?? {};
-		const channelKeys = Object.keys(channels);
-		if (channelKeys.length === 0) return [teamKey];
-		return channelKeys.map((channelKey) => `${teamKey}/${channelKey}`);
-	});
-}
-async function resolveMSTeamsGroupAllowlist(params) {
-	let resolvedEntries = params.entries.map((entry) => require_resolve_allowlist.parseMSTeamsTeamEntry(entry)).filter((entry) => entry !== null);
-	if (params.entries.length === 0 || !require_token_config.resolveMSTeamsCredentials(require_resolve_allowlist.resolveMSTeamsAccountConfig(params.cfg, params.accountId), {
-		allowEnvFallback: params.accountId === "default",
-		pathPrefix: require_resolve_allowlist.resolveMSTeamsAccountConfigPath(params.cfg, params.accountId)
-	})) return resolvedEntries;
-	try {
-		const lookups = await require_resolve_allowlist.resolveMSTeamsChannelAllowlist({
-			cfg: params.cfg,
-			accountId: params.accountId,
-			entries: params.entries
-		});
-		const resolvedChannels = lookups.filter((entry) => entry.resolved && entry.teamId && entry.channelId);
-		const resolvedTeams = lookups.filter((entry) => entry.resolved && entry.teamId && !entry.channelId);
-		const unresolved = lookups.filter((entry) => !entry.resolved).map((entry) => entry.input);
-		resolvedEntries = [
-			...resolvedChannels.flatMap((entry) => entry.teamId && entry.channelId ? [{
-				teamKey: entry.teamId,
-				channelKey: entry.channelId
-			}] : []),
-			...resolvedTeams.flatMap((entry) => entry.teamId ? [{ teamKey: entry.teamId }] : []),
-			...unresolved.map((entry) => require_resolve_allowlist.parseMSTeamsTeamEntry(entry)).filter((entry) => entry !== null)
-		];
-		const summary = [];
-		if (resolvedChannels.length > 0) summary.push(t("wizard.msteams.resolvedChannels", { entries: resolvedChannels.map((entry) => entry.channelId).filter(Boolean).join(", ") }));
-		if (resolvedTeams.length > 0) summary.push(t("wizard.msteams.resolvedTeams", { entries: resolvedTeams.map((entry) => entry.teamId).filter(Boolean).join(", ") }));
-		if (unresolved.length > 0) summary.push(t("wizard.msteams.unresolvedKept", { entries: unresolved.join(", ") }));
-		if (summary.length > 0) await params.prompter.note(summary.join("\n"), t("wizard.msteams.channelsLabel"));
-		return resolvedEntries;
-	} catch (err) {
-		await params.prompter.note(t("wizard.msteams.channelLookupFailed", { error: formatUnknownError(err) }), t("wizard.msteams.channelsLabel"));
-		return resolvedEntries;
-	}
-}
 const msteamsGroupAccess = {
 	...(0, openclaw_plugin_sdk_setup_runtime.createAccountScopedGroupAccessSection)({
 		channel,
 		label: t("wizard.msteams.channelsLabel"),
 		placeholder: "Team Name/Channel Name, teamId/conversationId",
 		currentPolicy: ({ cfg, accountId }) => require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, accountId).groupPolicy ?? "allowlist",
-		currentEntries: ({ cfg, accountId }) => listMSTeamsGroupEntries(cfg, accountId),
-		updatePrompt: ({ cfg, accountId }) => Boolean(require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, accountId).teams),
-		resolveAllowlist: ({ cfg, accountId, entries, prompter }) => resolveMSTeamsGroupAllowlist({
-			cfg,
-			accountId,
-			entries,
-			prompter
+		currentEntries: ({ cfg, accountId }) => Object.entries(require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, accountId).teams ?? {}).flatMap(([teamKey, value]) => {
+			const channels = value?.channels ?? {};
+			const channelKeys = Object.keys(channels);
+			if (channelKeys.length === 0) return [teamKey];
+			return channelKeys.map((channelKey) => `${teamKey}/${channelKey}`);
 		}),
+		updatePrompt: ({ cfg, accountId }) => Boolean(require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, accountId).teams),
+		resolveAllowlist: async (params) => {
+			let resolvedEntries = params.entries.map((entry) => require_resolve_allowlist.parseMSTeamsTeamEntry(entry)).filter((entry) => entry !== null);
+			if (params.entries.length === 0 || !require_token_config.resolveMSTeamsCredentials(require_resolve_allowlist.resolveMSTeamsAccountConfig(params.cfg, params.accountId), {
+				allowEnvFallback: params.accountId === "default",
+				pathPrefix: require_resolve_allowlist.resolveMSTeamsAccountConfigPath(params.cfg, params.accountId)
+			})) return resolvedEntries;
+			try {
+				const lookups = await require_resolve_allowlist.resolveMSTeamsChannelAllowlist({
+					cfg: params.cfg,
+					accountId: params.accountId,
+					entries: params.entries
+				});
+				const resolvedChannels = lookups.flatMap((entry) => entry.resolved && entry.teamId && entry.channelId ? [{
+					teamKey: entry.teamId,
+					channelKey: entry.channelId
+				}] : []);
+				const resolvedTeams = lookups.flatMap((entry) => entry.resolved && entry.teamId && !entry.channelId ? [{ teamKey: entry.teamId }] : []);
+				const unresolved = lookups.filter((entry) => !entry.resolved).map((entry) => entry.input);
+				resolvedEntries = [
+					...resolvedChannels,
+					...resolvedTeams,
+					...unresolved.map((entry) => require_resolve_allowlist.parseMSTeamsTeamEntry(entry)).filter((entry) => entry !== null)
+				];
+				const summary = [];
+				if (resolvedChannels.length > 0) summary.push(t("wizard.msteams.resolvedChannels", { entries: resolvedChannels.map((entry) => entry.channelKey).join(", ") }));
+				if (resolvedTeams.length > 0) summary.push(t("wizard.msteams.resolvedTeams", { entries: resolvedTeams.map((entry) => entry.teamKey).join(", ") }));
+				if (unresolved.length > 0) summary.push(t("wizard.msteams.unresolvedKept", { entries: unresolved.join(", ") }));
+				if (summary.length > 0) await params.prompter.note(summary.join("\n"), t("wizard.msteams.channelsLabel"));
+				return resolvedEntries;
+			} catch (err) {
+				await params.prompter.note(t("wizard.msteams.channelLookupFailed", { error: formatUnknownError(err) }), t("wizard.msteams.channelsLabel"));
+				return resolvedEntries;
+			}
+		},
 		fallbackResolved: (entries) => entries.map((entry) => require_resolve_allowlist.parseMSTeamsTeamEntry(entry)).filter((entry) => entry !== null),
-		applyAllowlist: ({ cfg, accountId, resolved }) => setMSTeamsTeamsAllowlist(cfg, accountId, resolved)
+		applyAllowlist: ({ cfg, accountId, resolved: entries }) => {
+			const teams = { ...require_resolve_allowlist.resolveMSTeamsAccountConfig(cfg, accountId).teams ?? {} };
+			for (const entry of entries) {
+				const teamKey = entry.teamKey;
+				const existing = teams[teamKey] ?? {};
+				if (entry.channelKey) {
+					const channels = { ...existing.channels };
+					channels[entry.channelKey] = channels[entry.channelKey] ?? {};
+					teams[teamKey] = {
+						...existing,
+						channels
+					};
+				} else teams[teamKey] = existing;
+			}
+			return patchMSTeamsAccountConfig({
+				cfg,
+				accountId,
+				patch: { teams },
+				scopeDefaultToAccounts: shouldScopeMSTeamsDefaultToAccounts(cfg, accountId)
+			});
+		}
 	}),
 	setPolicy: ({ cfg, accountId, policy }) => patchMSTeamsAccountConfig({
 		cfg,
@@ -797,16 +652,69 @@ const msteamsDmPolicy = (0, openclaw_plugin_sdk_channel_dm_policy.createChannelD
 		patch,
 		scopeDefaultToAccounts: shouldScopeMSTeamsDefaultToAccounts(cfg, account.accountId)
 	}),
-	promptAllowFrom: promptMSTeamsAllowFrom
+	promptAllowFrom: async (params) => {
+		const accountId = (0, openclaw_plugin_sdk_account_id.normalizeAccountId)(params.accountId ?? require_resolve_allowlist.resolveDefaultMSTeamsAccountId(params.cfg));
+		const existing = require_resolve_allowlist.resolveMSTeamsAccountConfig(params.cfg, accountId).allowFrom ?? [];
+		await params.prompter.note([
+			t("wizard.msteams.allowlistIntro"),
+			t("wizard.msteams.allowlistResolve"),
+			t("wizard.msteams.examples"),
+			"- alex@example.com",
+			"- Alex Johnson",
+			"- 00000000-0000-0000-0000-000000000000"
+		].join("\n"), t("wizard.msteams.allowlistTitle"));
+		while (true) {
+			const entry = await params.prompter.text({
+				message: t("wizard.msteams.allowFromPrompt"),
+				placeholder: "alex@example.com, Alex Johnson",
+				initialValue: existing[0] ? existing[0] : void 0,
+				validate: (value) => value.trim() ? void 0 : t("common.required")
+			});
+			const parts = (0, openclaw_plugin_sdk_setup.splitSetupEntries)(entry);
+			if (parts.length === 0) {
+				await params.prompter.note(t("wizard.msteams.enterAtLeastOneUser"), t("wizard.msteams.allowlistTitle"));
+				continue;
+			}
+			const resolved = await require_resolve_allowlist.resolveMSTeamsUserAllowlist({
+				cfg: params.cfg,
+				accountId,
+				entries: parts
+			}).catch(() => null);
+			let ids;
+			if (!resolved) {
+				ids = parts.filter((part) => /^[0-9a-fA-F-]{16,}$/.test(part));
+				if (ids.length !== parts.length) {
+					await params.prompter.note(t("wizard.msteams.graphLookupUnavailable"), t("wizard.msteams.allowlistTitle"));
+					continue;
+				}
+			} else {
+				const unresolved = resolved.filter((item) => !item.resolved || !item.id);
+				if (unresolved.length > 0) {
+					await params.prompter.note(t("wizard.msteams.couldNotResolve", { entries: unresolved.map((item) => item.input).join(", ") }), t("wizard.msteams.allowlistTitle"));
+					continue;
+				}
+				ids = resolved.flatMap((item) => item.id ? [item.id] : []);
+			}
+			const unique = (0, openclaw_plugin_sdk_setup.mergeAllowFromEntries)(existing, ids);
+			return patchMSTeamsAccountConfig({
+				cfg: params.cfg,
+				accountId,
+				patch: {
+					dmPolicy: "allowlist",
+					allowFrom: unique
+				},
+				scopeDefaultToAccounts: shouldScopeMSTeamsDefaultToAccounts(params.cfg, accountId)
+			});
+		}
+	}
 });
 const msteamsSetupWizardBase = createMSTeamsSetupWizardBase();
 const msteamsSetupWizard = {
 	...msteamsSetupWizardBase,
 	finalize: async (params) => {
-		const baseFinalize = msteamsSetupWizardBase.finalize;
-		const baseResult = baseFinalize ? await baseFinalize(params) : void 0;
-		let next = baseResult?.cfg ?? params.cfg;
-		const resolvedAccountId = baseResult && "accountId" in baseResult && typeof baseResult.accountId === "string" ? baseResult.accountId : params.accountId;
+		const baseResult = await msteamsSetupWizardBase.finalize(params);
+		let next = baseResult.cfg;
+		const resolvedAccountId = baseResult.accountId;
 		const finalCreds = require_token_config.resolveMSTeamsCredentials(require_resolve_allowlist.resolveMSTeamsAccountConfig(next, resolvedAccountId), {
 			allowEnvFallback: resolvedAccountId === "default",
 			pathPrefix: require_resolve_allowlist.resolveMSTeamsAccountConfigPath(next, resolvedAccountId)
@@ -827,7 +735,7 @@ const msteamsSetupWizard = {
 				};
 				let oauthModule;
 				try {
-					oauthModule = await Promise.resolve().then(() => require("./oauth-BBUQCwmq.cjs"));
+					oauthModule = await Promise.resolve().then(() => require("./oauth-CUtfkgKE.cjs"));
 				} catch (err) {
 					await noteDelegatedAuthFailure(err);
 					return {
@@ -882,10 +790,7 @@ const msteamsSetupWizard = {
 //#region extensions/msteams/src/channel.setup.ts
 const msteamsSetupPlugin = {
 	id: "msteams",
-	meta: {
-		...msteamsMeta,
-		aliases: [...msteamsMeta.aliases]
-	},
+	meta: msteamsMeta,
 	capabilities: {
 		chatTypes: [
 			"direct",
@@ -952,12 +857,6 @@ Object.defineProperty(exports, "formatUnknownError", {
 		return formatUnknownError;
 	}
 });
-Object.defineProperty(exports, "isRevokedProxyError", {
-	enumerable: true,
-	get: function() {
-		return isRevokedProxyError;
-	}
-});
 Object.defineProperty(exports, "msteamsConfigAdapter", {
 	enumerable: true,
 	get: function() {