@openclaw/msteams 2026.2.12 → 2026.2.14

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 2026.2.14
+
+### Changes
+
+- Version alignment with core OpenClaw release numbers.
+
+## 2026.2.13
+
+### Changes
+
+- Version alignment with core OpenClaw release numbers.
+
 ## 2026.2.6-3
 
 ### Changes

package/package.json

@@ -1,14 +1,13 @@
 {
   "name": "@openclaw/msteams",
-  "version": "2026.2.12",
+  "version": "2026.2.14",
   "description": "OpenClaw Microsoft Teams channel plugin",
   "type": "module",
   "dependencies": {
     "@microsoft/agents-hosting": "^1.2.3",
     "@microsoft/agents-hosting-express": "^1.2.3",
     "@microsoft/agents-hosting-extensions-teams": "^1.2.3",
-    "express": "^5.2.1",
-    "proper-lockfile": "^4.1.2"
+    "express": "^5.2.1"
   },
   "devDependencies": {
     "openclaw": "workspace:*"

package/src/directory-live.ts

@@ -1,95 +1,16 @@
-import type { ChannelDirectoryEntry, MSTeamsConfig } from "openclaw/plugin-sdk";
-import { GRAPH_ROOT } from "./attachments/shared.js";
-import { loadMSTeamsSdkWithAuth } from "./sdk.js";
-import { resolveMSTeamsCredentials } from "./token.js";
-
-type GraphUser = {
-  id?: string;
-  displayName?: string;
-  userPrincipalName?: string;
-  mail?: string;
-};
-
-type GraphGroup = {
-  id?: string;
-  displayName?: string;
-};
-
-type GraphChannel = {
-  id?: string;
-  displayName?: string;
-};
-
-type GraphResponse<T> = { value?: T[] };
-
-function readAccessToken(value: unknown): string | null {
-  if (typeof value === "string") {
-    return value;
-  }
-  if (value && typeof value === "object") {
-    const token =
-      (value as { accessToken?: unknown }).accessToken ?? (value as { token?: unknown }).token;
-    return typeof token === "string" ? token : null;
-  }
-  return null;
-}
-
-function normalizeQuery(value?: string | null): string {
-  return value?.trim() ?? "";
-}
-
-function escapeOData(value: string): string {
-  return value.replace(/'/g, "''");
-}
-
-async function fetchGraphJson<T>(params: {
-  token: string;
-  path: string;
-  headers?: Record<string, string>;
-}): Promise<T> {
-  const res = await fetch(`${GRAPH_ROOT}${params.path}`, {
-    headers: {
-      Authorization: `Bearer ${params.token}`,
-      ...params.headers,
-    },
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Graph ${params.path} failed (${res.status}): ${text || "unknown error"}`);
-  }
-  return (await res.json()) as T;
-}
-
-async function resolveGraphToken(cfg: unknown): Promise<string> {
-  const creds = resolveMSTeamsCredentials(
-    (cfg as { channels?: { msteams?: unknown } })?.channels?.msteams as MSTeamsConfig | undefined,
-  );
-  if (!creds) {
-    throw new Error("MS Teams credentials missing");
-  }
-  const { sdk, authConfig } = await loadMSTeamsSdkWithAuth(creds);
-  const tokenProvider = new sdk.MsalTokenProvider(authConfig);
-  const token = await tokenProvider.getAccessToken("https://graph.microsoft.com");
-  const accessToken = readAccessToken(token);
-  if (!accessToken) {
-    throw new Error("MS Teams graph token unavailable");
-  }
-  return accessToken;
-}
-
-async function listTeamsByName(token: string, query: string): Promise<GraphGroup[]> {
-  const escaped = escapeOData(query);
-  const filter = `resourceProvisioningOptions/Any(x:x eq 'Team') and startsWith(displayName,'${escaped}')`;
-  const path = `/groups?$filter=${encodeURIComponent(filter)}&$select=id,displayName`;
-  const res = await fetchGraphJson<GraphResponse<GraphGroup>>({ token, path });
-  return res.value ?? [];
-}
-
-async function listChannelsForTeam(token: string, teamId: string): Promise<GraphChannel[]> {
-  const path = `/teams/${encodeURIComponent(teamId)}/channels?$select=id,displayName`;
-  const res = await fetchGraphJson<GraphResponse<GraphChannel>>({ token, path });
-  return res.value ?? [];
-}
+import type { ChannelDirectoryEntry } from "openclaw/plugin-sdk";
+import {
+  escapeOData,
+  fetchGraphJson,
+  type GraphChannel,
+  type GraphGroup,
+  type GraphResponse,
+  type GraphUser,
+  listChannelsForTeam,
+  listTeamsByName,
+  normalizeQuery,
+  resolveGraphToken,
+} from "./graph.js";
 
 export async function listMSTeamsDirectoryPeersLive(params: {
   cfg: unknown;

package/src/file-lock.ts

@@ -0,0 +1 @@
+export { withFileLock } from "openclaw/plugin-sdk";

package/src/graph.ts

@@ -0,0 +1,92 @@
+import type { MSTeamsConfig } from "openclaw/plugin-sdk";
+import { GRAPH_ROOT } from "./attachments/shared.js";
+import { loadMSTeamsSdkWithAuth } from "./sdk.js";
+import { resolveMSTeamsCredentials } from "./token.js";
+
+export type GraphUser = {
+  id?: string;
+  displayName?: string;
+  userPrincipalName?: string;
+  mail?: string;
+};
+
+export type GraphGroup = {
+  id?: string;
+  displayName?: string;
+};
+
+export type GraphChannel = {
+  id?: string;
+  displayName?: string;
+};
+
+export type GraphResponse<T> = { value?: T[] };
+
+function readAccessToken(value: unknown): string | null {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (value && typeof value === "object") {
+    const token =
+      (value as { accessToken?: unknown }).accessToken ?? (value as { token?: unknown }).token;
+    return typeof token === "string" ? token : null;
+  }
+  return null;
+}
+
+export function normalizeQuery(value?: string | null): string {
+  return value?.trim() ?? "";
+}
+
+export function escapeOData(value: string): string {
+  return value.replace(/'/g, "''");
+}
+
+export async function fetchGraphJson<T>(params: {
+  token: string;
+  path: string;
+  headers?: Record<string, string>;
+}): Promise<T> {
+  const res = await fetch(`${GRAPH_ROOT}${params.path}`, {
+    headers: {
+      Authorization: `Bearer ${params.token}`,
+      ...params.headers,
+    },
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`Graph ${params.path} failed (${res.status}): ${text || "unknown error"}`);
+  }
+  return (await res.json()) as T;
+}
+
+export async function resolveGraphToken(cfg: unknown): Promise<string> {
+  const creds = resolveMSTeamsCredentials(
+    (cfg as { channels?: { msteams?: unknown } })?.channels?.msteams as MSTeamsConfig | undefined,
+  );
+  if (!creds) {
+    throw new Error("MS Teams credentials missing");
+  }
+  const { sdk, authConfig } = await loadMSTeamsSdkWithAuth(creds);
+  const tokenProvider = new sdk.MsalTokenProvider(authConfig);
+  const token = await tokenProvider.getAccessToken("https://graph.microsoft.com");
+  const accessToken = readAccessToken(token);
+  if (!accessToken) {
+    throw new Error("MS Teams graph token unavailable");
+  }
+  return accessToken;
+}
+
+export async function listTeamsByName(token: string, query: string): Promise<GraphGroup[]> {
+  const escaped = escapeOData(query);
+  const filter = `resourceProvisioningOptions/Any(x:x eq 'Team') and startsWith(displayName,'${escaped}')`;
+  const path = `/groups?$filter=${encodeURIComponent(filter)}&$select=id,displayName`;
+  const res = await fetchGraphJson<GraphResponse<GraphGroup>>({ token, path });
+  return res.value ?? [];
+}
+
+export async function listChannelsForTeam(token: string, teamId: string): Promise<GraphChannel[]> {
+  const path = `/teams/${encodeURIComponent(teamId)}/channels?$select=id,displayName`;
+  const res = await fetchGraphJson<GraphResponse<GraphChannel>>({ token, path });
+  return res.value ?? [];
+}

package/src/media-helpers.test.ts

@@ -145,6 +145,15 @@ describe("msteams media-helpers", () => {
       expect(isLocalPath("~/Downloads/image.png")).toBe(true);
     });
 
+    it("returns true for Windows absolute drive paths", () => {
+      expect(isLocalPath("C:\\Users\\test\\image.png")).toBe(true);
+      expect(isLocalPath("D:/data/photo.jpg")).toBe(true);
+    });
+
+    it("returns true for Windows UNC paths", () => {
+      expect(isLocalPath("\\\\server\\share\\image.png")).toBe(true);
+    });
+
     it("returns false for http URLs", () => {
       expect(isLocalPath("http://example.com/image.png")).toBe(false);
       expect(isLocalPath("https://example.com/image.png")).toBe(false);

package/src/media-helpers.ts

@@ -65,7 +65,21 @@ export async function extractFilename(url: string): Promise<string> {
  * Check if a URL refers to a local file path.
  */
 export function isLocalPath(url: string): boolean {
-  return url.startsWith("file://") || url.startsWith("/") || url.startsWith("~");
+  if (url.startsWith("file://") || url.startsWith("/") || url.startsWith("~")) {
+    return true;
+  }
+
+  // Windows drive-letter absolute path (e.g. C:\foo\bar.txt or C:/foo/bar.txt)
+  if (/^[a-zA-Z]:[\\/]/.test(url)) {
+    return true;
+  }
+
+  // Windows UNC path (e.g. \\server\share\file.txt)
+  if (url.startsWith("\\\\")) {
+    return true;
+  }
+
+  return false;
 }
 
 /**

package/src/mentions.test.ts

@@ -0,0 +1,235 @@
+import { describe, expect, it } from "vitest";
+import { buildMentionEntities, formatMentionText, parseMentions } from "./mentions.js";
+
+describe("parseMentions", () => {
+  it("parses single mention", () => {
+    const result = parseMentions("Hello @[John Doe](28:a1b2c3-d4e5f6)!");
+
+    expect(result.text).toBe("Hello <at>John Doe</at>!");
+    expect(result.entities).toHaveLength(1);
+    expect(result.entities[0]).toEqual({
+      type: "mention",
+      text: "<at>John Doe</at>",
+      mentioned: {
+        id: "28:a1b2c3-d4e5f6",
+        name: "John Doe",
+      },
+    });
+  });
+
+  it("parses multiple mentions", () => {
+    const result = parseMentions("Hey @[Alice](28:aaa) and @[Bob](28:bbb), can you review this?");
+
+    expect(result.text).toBe("Hey <at>Alice</at> and <at>Bob</at>, can you review this?");
+    expect(result.entities).toHaveLength(2);
+    expect(result.entities[0]).toEqual({
+      type: "mention",
+      text: "<at>Alice</at>",
+      mentioned: {
+        id: "28:aaa",
+        name: "Alice",
+      },
+    });
+    expect(result.entities[1]).toEqual({
+      type: "mention",
+      text: "<at>Bob</at>",
+      mentioned: {
+        id: "28:bbb",
+        name: "Bob",
+      },
+    });
+  });
+
+  it("handles text without mentions", () => {
+    const result = parseMentions("Hello world!");
+
+    expect(result.text).toBe("Hello world!");
+    expect(result.entities).toHaveLength(0);
+  });
+
+  it("handles empty text", () => {
+    const result = parseMentions("");
+
+    expect(result.text).toBe("");
+    expect(result.entities).toHaveLength(0);
+  });
+
+  it("handles mention with spaces in name", () => {
+    const result = parseMentions("@[John Peter Smith](28:a1b2c3)");
+
+    expect(result.text).toBe("<at>John Peter Smith</at>");
+    expect(result.entities[0]?.mentioned.name).toBe("John Peter Smith");
+  });
+
+  it("trims whitespace from id and name", () => {
+    const result = parseMentions("@[ John Doe ]( 28:a1b2c3 )");
+
+    expect(result.entities[0]).toEqual({
+      type: "mention",
+      text: "<at>John Doe</at>",
+      mentioned: {
+        id: "28:a1b2c3",
+        name: "John Doe",
+      },
+    });
+  });
+
+  it("handles Japanese characters in mention at start of message", () => {
+    const input = "@[タナカ タロウ](a1b2c3d4-e5f6-7890-abcd-ef1234567890) スキル化完了しました！";
+    const result = parseMentions(input);
+
+    expect(result.text).toBe("<at>タナカ タロウ</at> スキル化完了しました！");
+    expect(result.entities).toHaveLength(1);
+    expect(result.entities[0]).toEqual({
+      type: "mention",
+      text: "<at>タナカ タロウ</at>",
+      mentioned: {
+        id: "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
+        name: "タナカ タロウ",
+      },
+    });
+
+    // Verify entity text exactly matches what's in the formatted text
+    const entityText = result.entities[0]?.text;
+    expect(result.text).toContain(entityText);
+    expect(result.text.indexOf(entityText)).toBe(0);
+  });
+
+  it("skips mention-like patterns with non-Teams IDs (e.g. in code blocks)", () => {
+    // This reproduces the actual failing payload: the message contains a real mention
+    // plus `@[表示名](ユーザーID)` as documentation text inside backticks.
+    const input =
+      "@[タナカ タロウ](a1b2c3d4-e5f6-7890-abcd-ef1234567890) スキル化完了しました！📋\n\n" +
+      "**作成したスキル:** `teams-mention`\n" +
+      "- 機能: Teamsでのメンション形式 `@[表示名](ユーザーID)`\n\n" +
+      "**追加対応:**\n" +
+      "- ユーザーのID `a1b2c3d4-e5f6-7890-abcd-ef1234567890` を登録済み";
+    const result = parseMentions(input);
+
+    // Only the real mention should be parsed; the documentation example should be left as-is
+    expect(result.entities).toHaveLength(1);
+    expect(result.entities[0]?.mentioned.id).toBe("a1b2c3d4-e5f6-7890-abcd-ef1234567890");
+    expect(result.entities[0]?.mentioned.name).toBe("タナカ タロウ");
+
+    // The documentation pattern must remain untouched in the text
+    expect(result.text).toContain("`@[表示名](ユーザーID)`");
+  });
+
+  it("accepts Bot Framework IDs (28:xxx)", () => {
+    const result = parseMentions("@[Bot](28:abc-123)");
+    expect(result.entities).toHaveLength(1);
+    expect(result.entities[0]?.mentioned.id).toBe("28:abc-123");
+  });
+
+  it("accepts Bot Framework IDs with non-hex payloads (29:xxx)", () => {
+    const result = parseMentions("@[Bot](29:08q2j2o3jc09au90eucae)");
+    expect(result.entities).toHaveLength(1);
+    expect(result.entities[0]?.mentioned.id).toBe("29:08q2j2o3jc09au90eucae");
+  });
+
+  it("accepts org-scoped IDs with extra segments (8:orgid:...)", () => {
+    const result = parseMentions("@[User](8:orgid:2d8c2d2c-1111-2222-3333-444444444444)");
+    expect(result.entities).toHaveLength(1);
+    expect(result.entities[0]?.mentioned.id).toBe("8:orgid:2d8c2d2c-1111-2222-3333-444444444444");
+  });
+
+  it("accepts AAD object IDs (UUIDs)", () => {
+    const result = parseMentions("@[User](a1b2c3d4-e5f6-7890-abcd-ef1234567890)");
+    expect(result.entities).toHaveLength(1);
+    expect(result.entities[0]?.mentioned.id).toBe("a1b2c3d4-e5f6-7890-abcd-ef1234567890");
+  });
+
+  it("rejects non-ID strings as mention targets", () => {
+    const result = parseMentions("See @[docs](https://example.com) for details");
+    expect(result.entities).toHaveLength(0);
+    // Original text preserved
+    expect(result.text).toBe("See @[docs](https://example.com) for details");
+  });
+});
+
+describe("buildMentionEntities", () => {
+  it("builds entities from mention info", () => {
+    const mentions = [
+      { id: "28:aaa", name: "Alice" },
+      { id: "28:bbb", name: "Bob" },
+    ];
+
+    const entities = buildMentionEntities(mentions);
+
+    expect(entities).toHaveLength(2);
+    expect(entities[0]).toEqual({
+      type: "mention",
+      text: "<at>Alice</at>",
+      mentioned: {
+        id: "28:aaa",
+        name: "Alice",
+      },
+    });
+    expect(entities[1]).toEqual({
+      type: "mention",
+      text: "<at>Bob</at>",
+      mentioned: {
+        id: "28:bbb",
+        name: "Bob",
+      },
+    });
+  });
+
+  it("handles empty list", () => {
+    const entities = buildMentionEntities([]);
+    expect(entities).toHaveLength(0);
+  });
+});
+
+describe("formatMentionText", () => {
+  it("formats text with single mention", () => {
+    const text = "Hello @John!";
+    const mentions = [{ id: "28:xxx", name: "John" }];
+
+    const result = formatMentionText(text, mentions);
+
+    expect(result).toBe("Hello <at>John</at>!");
+  });
+
+  it("formats text with multiple mentions", () => {
+    const text = "Hey @Alice and @Bob";
+    const mentions = [
+      { id: "28:aaa", name: "Alice" },
+      { id: "28:bbb", name: "Bob" },
+    ];
+
+    const result = formatMentionText(text, mentions);
+
+    expect(result).toBe("Hey <at>Alice</at> and <at>Bob</at>");
+  });
+
+  it("handles case-insensitive matching", () => {
+    const text = "Hey @alice and @ALICE";
+    const mentions = [{ id: "28:aaa", name: "Alice" }];
+
+    const result = formatMentionText(text, mentions);
+
+    expect(result).toBe("Hey <at>Alice</at> and <at>Alice</at>");
+  });
+
+  it("handles text without mentions", () => {
+    const text = "Hello world";
+    const mentions = [{ id: "28:xxx", name: "John" }];
+
+    const result = formatMentionText(text, mentions);
+
+    expect(result).toBe("Hello world");
+  });
+
+  it("escapes regex metacharacters in names", () => {
+    const text = "Hey @John(Test) and @Alice.Smith";
+    const mentions = [
+      { id: "28:xxx", name: "John(Test)" },
+      { id: "28:yyy", name: "Alice.Smith" },
+    ];
+
+    const result = formatMentionText(text, mentions);
+
+    expect(result).toBe("Hey <at>John(Test)</at> and <at>Alice.Smith</at>");
+  });
+});

package/src/mentions.ts

@@ -0,0 +1,114 @@
+/**
+ * MS Teams mention handling utilities.
+ *
+ * Mentions in Teams require:
+ * 1. Text containing <at>Name</at> tags
+ * 2. entities array with mention metadata
+ */
+
+export type MentionEntity = {
+  type: "mention";
+  text: string;
+  mentioned: {
+    id: string;
+    name: string;
+  };
+};
+
+export type MentionInfo = {
+  /** User/bot ID (e.g., "28:xxx" or AAD object ID) */
+  id: string;
+  /** Display name */
+  name: string;
+};
+
+/**
+ * Check whether an ID looks like a valid Teams user/bot identifier.
+ * Accepts:
+ * - Bot Framework IDs: "28:xxx..." / "29:xxx..." / "8:orgid:..."
+ * - AAD object IDs (UUIDs): "d5318c29-33ac-4e6b-bd42-57b8b793908f"
+ *
+ * Keep this permissive enough for real Teams IDs while still rejecting
+ * documentation placeholders like `@[表示名](ユーザーID)`.
+ */
+const TEAMS_BOT_ID_PATTERN = /^\d+:[a-z0-9._=-]+(?::[a-z0-9._=-]+)*$/i;
+const AAD_OBJECT_ID_PATTERN = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+
+function isValidTeamsId(id: string): boolean {
+  return TEAMS_BOT_ID_PATTERN.test(id) || AAD_OBJECT_ID_PATTERN.test(id);
+}
+
+/**
+ * Parse mentions from text in the format @[Name](id).
+ * Example: "Hello @[John Doe](28:xxx-yyy-zzz)!"
+ *
+ * Only matches where the id looks like a real Teams user/bot ID are treated
+ * as mentions. This avoids false positives from documentation or code samples
+ * embedded in the message (e.g. `@[表示名](ユーザーID)` in backticks).
+ *
+ * Returns both the formatted text with <at> tags and the entities array.
+ */
+export function parseMentions(text: string): {
+  text: string;
+  entities: MentionEntity[];
+} {
+  const mentionPattern = /@\[([^\]]+)\]\(([^)]+)\)/g;
+  const entities: MentionEntity[] = [];
+
+  // Replace @[Name](id) with <at>Name</at> only for valid Teams IDs
+  const formattedText = text.replace(mentionPattern, (match, name, id) => {
+    const trimmedId = id.trim();
+
+    // Skip matches where the id doesn't look like a real Teams identifier
+    if (!isValidTeamsId(trimmedId)) {
+      return match;
+    }
+
+    const trimmedName = name.trim();
+    const mentionTag = `<at>${trimmedName}</at>`;
+    entities.push({
+      type: "mention",
+      text: mentionTag,
+      mentioned: {
+        id: trimmedId,
+        name: trimmedName,
+      },
+    });
+    return mentionTag;
+  });
+
+  return {
+    text: formattedText,
+    entities,
+  };
+}
+
+/**
+ * Build mention entities array from a list of mentions.
+ * Use this when you already have the mention info and formatted text.
+ */
+export function buildMentionEntities(mentions: MentionInfo[]): MentionEntity[] {
+  return mentions.map((mention) => ({
+    type: "mention",
+    text: `<at>${mention.name}</at>`,
+    mentioned: {
+      id: mention.id,
+      name: mention.name,
+    },
+  }));
+}
+
+/**
+ * Format text with mentions using <at> tags.
+ * This is a convenience function when you want to manually format mentions.
+ */
+export function formatMentionText(text: string, mentions: MentionInfo[]): string {
+  let formatted = text;
+  for (const mention of mentions) {
+    // Replace @Name or @name with <at>Name</at>
+    const escapedName = mention.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const namePattern = new RegExp(`@${escapedName}`, "gi");
+    formatted = formatted.replace(namePattern, `<at>${mention.name}</at>`);
+  }
+  return formatted;
+}

package/src/messenger.test.ts

@@ -1,6 +1,21 @@
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
 import { SILENT_REPLY_TOKEN, type PluginRuntime } from "openclaw/plugin-sdk";
-import { beforeEach, describe, expect, it } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 import type { StoredConversationReference } from "./conversation-store.js";
+const graphUploadMockState = vi.hoisted(() => ({
+  uploadAndShareOneDrive: vi.fn(),
+}));
+
+vi.mock("./graph-upload.js", async () => {
+  const actual = await vi.importActual<typeof import("./graph-upload.js")>("./graph-upload.js");
+  return {
+    ...actual,
+    uploadAndShareOneDrive: graphUploadMockState.uploadAndShareOneDrive,
+  };
+});
+
 import {
   type MSTeamsAdapter,
   renderReplyPayloadsToMessages,
@@ -36,6 +51,13 @@ const runtimeStub = {
 describe("msteams messenger", () => {
   beforeEach(() => {
     setMSTeamsRuntime(runtimeStub);
+    graphUploadMockState.uploadAndShareOneDrive.mockReset();
+    graphUploadMockState.uploadAndShareOneDrive.mockResolvedValue({
+      itemId: "item123",
+      webUrl: "https://onedrive.example.com/item123",
+      shareUrl: "https://onedrive.example.com/share/item123",
+      name: "upload.txt",
+    });
   });
 
   describe("renderReplyPayloadsToMessages", () => {
@@ -153,6 +175,64 @@ describe("msteams messenger", () => {
       expect(ref.conversation?.id).toBe("19:abc@thread.tacv2");
     });
 
+    it("preserves parsed mentions when appending OneDrive fallback file links", async () => {
+      const tmpDir = await mkdtemp(path.join(os.tmpdir(), "msteams-mention-"));
+      const localFile = path.join(tmpDir, "note.txt");
+      await writeFile(localFile, "hello");
+
+      try {
+        const sent: Array<{ text?: string; entities?: unknown[] }> = [];
+        const ctx = {
+          sendActivity: async (activity: unknown) => {
+            sent.push(activity as { text?: string; entities?: unknown[] });
+            return { id: "id:one" };
+          },
+        };
+
+        const adapter: MSTeamsAdapter = {
+          continueConversation: async () => {},
+        };
+
+        const ids = await sendMSTeamsMessages({
+          replyStyle: "thread",
+          adapter,
+          appId: "app123",
+          conversationRef: {
+            ...baseRef,
+            conversation: {
+              ...baseRef.conversation,
+              conversationType: "channel",
+            },
+          },
+          context: ctx,
+          messages: [{ text: "Hello @[John](29:08q2j2o3jc09au90eucae)", mediaUrl: localFile }],
+          tokenProvider: {
+            getAccessToken: async () => "token",
+          },
+        });
+
+        expect(ids).toEqual(["id:one"]);
+        expect(graphUploadMockState.uploadAndShareOneDrive).toHaveBeenCalledOnce();
+        expect(sent).toHaveLength(1);
+        expect(sent[0]?.text).toContain("Hello <at>John</at>");
+        expect(sent[0]?.text).toContain(
+          "📎 [upload.txt](https://onedrive.example.com/share/item123)",
+        );
+        expect(sent[0]?.entities).toEqual([
+          {
+            type: "mention",
+            text: "<at>John</at>",
+            mentioned: {
+              id: "29:08q2j2o3jc09au90eucae",
+              name: "John",
+            },
+          },
+        ]);
+      } finally {
+        await rm(tmpDir, { recursive: true, force: true });
+      }
+    });
+
     it("retries thread sends on throttling (429)", async () => {
       const attempts: string[] = [];
       const retryEvents: Array<{ nextAttempt: number; delayMs: number }> = [];

package/src/messenger.ts

@@ -19,6 +19,7 @@ import {
   uploadAndShareSharePoint,
 } from "./graph-upload.js";
 import { extractFilename, extractMessageId, getMimeType, isLocalPath } from "./media-helpers.js";
+import { parseMentions } from "./mentions.js";
 import { getMSTeamsRuntime } from "./runtime.js";
 
 /**
@@ -269,7 +270,14 @@ async function buildActivity(
   const activity: Record<string, unknown> = { type: "message" };
 
   if (msg.text) {
-    activity.text = msg.text;
+    // Parse mentions from text (format: @[Name](id))
+    const { text: formattedText, entities } = parseMentions(msg.text);
+    activity.text = formattedText;
+
+    // Add mention entities if any mentions were found
+    if (entities.length > 0) {
+      activity.entities = entities;
+    }
   }
 
   if (msg.mediaUrl) {
@@ -350,7 +358,8 @@ async function buildActivity(
 
         // Bot Framework doesn't support "reference" attachment type for sending
         const fileLink = `📎 [${uploaded.name}](${uploaded.shareUrl})`;
-        activity.text = msg.text ? `${msg.text}\n\n${fileLink}` : fileLink;
+        const existingText = typeof activity.text === "string" ? activity.text : undefined;
+        activity.text = existingText ? `${existingText}\n\n${fileLink}` : fileLink;
         return activity;
       }
 

package/src/monitor.ts

@@ -1,5 +1,6 @@
 import type { Request, Response } from "express";
 import {
+  DEFAULT_WEBHOOK_MAX_BODY_BYTES,
   mergeAllowlist,
   summarizeMapping,
   type OpenClawConfig,
@@ -32,6 +33,8 @@ export type MonitorMSTeamsResult = {
   shutdown: () => Promise<void>;
 };
 
+const MSTEAMS_WEBHOOK_MAX_BODY_BYTES = DEFAULT_WEBHOOK_MAX_BODY_BYTES;
+
 export async function monitorMSTeamsProvider(
   opts: MonitorMSTeamsOpts,
 ): Promise<MonitorMSTeamsResult> {
@@ -239,7 +242,14 @@ export async function monitorMSTeamsProvider(
 
   // Create Express server
   const expressApp = express.default();
-  expressApp.use(express.json());
+  expressApp.use(express.json({ limit: MSTEAMS_WEBHOOK_MAX_BODY_BYTES }));
+  expressApp.use((err: unknown, _req: Request, res: Response, next: (err?: unknown) => void) => {
+    if (err && typeof err === "object" && "status" in err && err.status === 413) {
+      res.status(413).json({ error: "Payload too large" });
+      return;
+    }
+    next(err);
+  });
   expressApp.use(authorizeJWT(authConfig));
 
   // Set up the messages endpoint - use configured path and /api/messages as fallback

package/src/resolve-allowlist.ts

@@ -1,26 +1,13 @@
-import type { MSTeamsConfig } from "openclaw/plugin-sdk";
-import { GRAPH_ROOT } from "./attachments/shared.js";
-import { loadMSTeamsSdkWithAuth } from "./sdk.js";
-import { resolveMSTeamsCredentials } from "./token.js";
-
-type GraphUser = {
-  id?: string;
-  displayName?: string;
-  userPrincipalName?: string;
-  mail?: string;
-};
-
-type GraphGroup = {
-  id?: string;
-  displayName?: string;
-};
-
-type GraphChannel = {
-  id?: string;
-  displayName?: string;
-};
-
-type GraphResponse<T> = { value?: T[] };
+import {
+  escapeOData,
+  fetchGraphJson,
+  type GraphResponse,
+  type GraphUser,
+  listChannelsForTeam,
+  listTeamsByName,
+  normalizeQuery,
+  resolveGraphToken,
+} from "./graph.js";
 
 export type MSTeamsChannelResolution = {
   input: string;
@@ -40,18 +27,6 @@ export type MSTeamsUserResolution = {
   note?: string;
 };
 
-function readAccessToken(value: unknown): string | null {
-  if (typeof value === "string") {
-    return value;
-  }
-  if (value && typeof value === "object") {
-    const token =
-      (value as { accessToken?: unknown }).accessToken ?? (value as { token?: unknown }).token;
-    return typeof token === "string" ? token : null;
-  }
-  return null;
-}
-
 function stripProviderPrefix(raw: string): string {
   return raw.replace(/^(msteams|teams):/i, "");
 }
@@ -128,63 +103,6 @@ export function parseMSTeamsTeamEntry(
   };
 }
 
-function normalizeQuery(value?: string | null): string {
-  return value?.trim() ?? "";
-}
-
-function escapeOData(value: string): string {
-  return value.replace(/'/g, "''");
-}
-
-async function fetchGraphJson<T>(params: {
-  token: string;
-  path: string;
-  headers?: Record<string, string>;
-}): Promise<T> {
-  const res = await fetch(`${GRAPH_ROOT}${params.path}`, {
-    headers: {
-      Authorization: `Bearer ${params.token}`,
-      ...params.headers,
-    },
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Graph ${params.path} failed (${res.status}): ${text || "unknown error"}`);
-  }
-  return (await res.json()) as T;
-}
-
-async function resolveGraphToken(cfg: unknown): Promise<string> {
-  const creds = resolveMSTeamsCredentials(
-    (cfg as { channels?: { msteams?: unknown } })?.channels?.msteams as MSTeamsConfig | undefined,
-  );
-  if (!creds) {
-    throw new Error("MS Teams credentials missing");
-  }
-  const { sdk, authConfig } = await loadMSTeamsSdkWithAuth(creds);
-  const tokenProvider = new sdk.MsalTokenProvider(authConfig);
-  const token = await tokenProvider.getAccessToken("https://graph.microsoft.com");
-  const accessToken = readAccessToken(token);
-  if (!accessToken) {
-    throw new Error("MS Teams graph token unavailable");
-  }
-  return accessToken;
-}
-
-async function listTeamsByName(token: string, query: string): Promise<GraphGroup[]> {
-  const escaped = escapeOData(query);
-  const filter = `resourceProvisioningOptions/Any(x:x eq 'Team') and startsWith(displayName,'${escaped}')`;
-  const path = `/groups?$filter=${encodeURIComponent(filter)}&$select=id,displayName`;
-  const res = await fetchGraphJson<GraphResponse<GraphGroup>>({ token, path });
-  return res.value ?? [];
-}
-
-async function listChannelsForTeam(token: string, teamId: string): Promise<GraphChannel[]> {
-  const path = `/teams/${encodeURIComponent(teamId)}/channels?$select=id,displayName`;
-  const res = await fetchGraphJson<GraphResponse<GraphChannel>>({ token, path });
-  return res.value ?? [];
-}
-
 export async function resolveMSTeamsChannelAllowlist(params: {
   cfg: unknown;
   entries: string[];

package/src/store-fs.ts

@@ -2,7 +2,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { safeParseJson } from "openclaw/plugin-sdk";
-import lockfile from "proper-lockfile";
+import { withFileLock as withPathLock } from "./file-lock.js";
 
 const STORE_LOCK_OPTIONS = {
   retries: {
@@ -60,17 +60,7 @@ export async function withFileLock<T>(
   fn: () => Promise<T>,
 ): Promise<T> {
   await ensureJsonFile(filePath, fallback);
-  let release: (() => Promise<void>) | undefined;
-  try {
-    release = await lockfile.lock(filePath, STORE_LOCK_OPTIONS);
+  return await withPathLock(filePath, STORE_LOCK_OPTIONS, async () => {
     return await fn();
-  } finally {
-    if (release) {
-      try {
-        await release();
-      } catch {
-        // ignore unlock errors
-      }
-    }
-  }
+  });
 }