@openclaw/msteams 2026.2.22 → 2026.2.24

package/src/messenger.test.ts

@@ -49,6 +49,28 @@ const runtimeStub = {
   },
 } as unknown as PluginRuntime;
 
+const createNoopAdapter = (): MSTeamsAdapter => ({
+  continueConversation: async () => {},
+  process: async () => {},
+});
+
+const createRecordedSendActivity = (
+  sink: string[],
+  failFirstWithStatusCode?: number,
+): ((activity: unknown) => Promise<{ id: string }>) => {
+  let attempts = 0;
+  return async (activity: unknown) => {
+    const { text } = activity as { text?: string };
+    const content = text ?? "";
+    sink.push(content);
+    attempts += 1;
+    if (failFirstWithStatusCode !== undefined && attempts === 1) {
+      throw Object.assign(new Error("send failed"), { statusCode: failFirstWithStatusCode });
+    }
+    return { id: `id:${content}` };
+  };
+};
+
 describe("msteams messenger", () => {
   beforeEach(() => {
     setMSTeamsRuntime(runtimeStub);
@@ -117,17 +139,9 @@ describe("msteams messenger", () => {
     it("sends thread messages via the provided context", async () => {
       const sent: string[] = [];
       const ctx = {
-        sendActivity: async (activity: unknown) => {
-          const { text } = activity as { text?: string };
-          sent.push(text ?? "");
-          return { id: `id:${text ?? ""}` };
-        },
-      };
-
-      const adapter: MSTeamsAdapter = {
-        continueConversation: async () => {},
-        process: async () => {},
+        sendActivity: createRecordedSendActivity(sent),
       };
+      const adapter = createNoopAdapter();
 
       const ids = await sendMSTeamsMessages({
         replyStyle: "thread",
@@ -149,11 +163,7 @@ describe("msteams messenger", () => {
         continueConversation: async (_appId, reference, logic) => {
           seen.reference = reference;
           await logic({
-            sendActivity: async (activity: unknown) => {
-              const { text } = activity as { text?: string };
-              seen.texts.push(text ?? "");
-              return { id: `id:${text ?? ""}` };
-            },
+            sendActivity: createRecordedSendActivity(seen.texts),
           });
         },
         process: async () => {},
@@ -192,10 +202,7 @@ describe("msteams messenger", () => {
           },
         };
 
-        const adapter: MSTeamsAdapter = {
-          continueConversation: async () => {},
-          process: async () => {},
-        };
+        const adapter = createNoopAdapter();
 
         const ids = await sendMSTeamsMessages({
           replyStyle: "thread",
@@ -242,20 +249,9 @@ describe("msteams messenger", () => {
       const retryEvents: Array<{ nextAttempt: number; delayMs: number }> = [];
 
       const ctx = {
-        sendActivity: async (activity: unknown) => {
-          const { text } = activity as { text?: string };
-          attempts.push(text ?? "");
-          if (attempts.length === 1) {
-            throw Object.assign(new Error("throttled"), { statusCode: 429 });
-          }
-          return { id: `id:${text ?? ""}` };
-        },
-      };
-
-      const adapter: MSTeamsAdapter = {
-        continueConversation: async () => {},
-        process: async () => {},
+        sendActivity: createRecordedSendActivity(attempts, 429),
       };
+      const adapter = createNoopAdapter();
 
       const ids = await sendMSTeamsMessages({
         replyStyle: "thread",
@@ -280,10 +276,7 @@ describe("msteams messenger", () => {
         },
       };
 
-      const adapter: MSTeamsAdapter = {
-        continueConversation: async () => {},
-        process: async () => {},
-      };
+      const adapter = createNoopAdapter();
 
       await expect(
         sendMSTeamsMessages({
@@ -303,18 +296,7 @@ describe("msteams messenger", () => {
 
       const adapter: MSTeamsAdapter = {
         continueConversation: async (_appId, _reference, logic) => {
-          await logic({
-            sendActivity: async (activity: unknown) => {
-              const { text } = activity as { text?: string };
-              attempts.push(text ?? "");
-              if (attempts.length === 1) {
-                throw Object.assign(new Error("server error"), {
-                  statusCode: 503,
-                });
-              }
-              return { id: `id:${text ?? ""}` };
-            },
-          });
+          await logic({ sendActivity: createRecordedSendActivity(attempts, 503) });
         },
         process: async () => {},
       };

package/src/monitor-handler/message-handler.ts

@@ -6,6 +6,7 @@ import {
   recordPendingHistoryEntryIfEnabled,
   resolveControlCommandGate,
   resolveDefaultGroupPolicy,
+  isDangerousNameMatchingEnabled,
   resolveMentionGating,
   formatAllowlistMatchMeta,
   type HistoryEntry,
@@ -145,10 +146,12 @@ export function createMSTeamsMessageHandler(deps: MSTeamsMessageHandlerDeps) {
 
       if (dmPolicy !== "open") {
         const effectiveAllowFrom = [...allowFrom.map((v) => String(v)), ...storedAllowFrom];
+        const allowNameMatching = isDangerousNameMatchingEnabled(msteamsCfg);
         const allowMatch = resolveMSTeamsAllowlistMatch({
           allowFrom: effectiveAllowFrom,
           senderId,
           senderName,
+          allowNameMatching,
         });
 
         if (!allowMatch.allowed) {
@@ -226,10 +229,12 @@ export function createMSTeamsMessageHandler(deps: MSTeamsMessageHandlerDeps) {
           return;
         }
         if (effectiveGroupAllowFrom.length > 0) {
+          const allowNameMatching = isDangerousNameMatchingEnabled(msteamsCfg);
           const allowMatch = resolveMSTeamsAllowlistMatch({
             allowFrom: effectiveGroupAllowFrom,
             senderId,
             senderName,
+            allowNameMatching,
           });
           if (!allowMatch.allowed) {
             log.debug?.("dropping group message (not in groupAllowFrom)", {
@@ -248,12 +253,14 @@ export function createMSTeamsMessageHandler(deps: MSTeamsMessageHandlerDeps) {
       allowFrom: effectiveDmAllowFrom,
       senderId,
       senderName,
+      allowNameMatching: isDangerousNameMatchingEnabled(msteamsCfg),
     });
     const groupAllowedForCommands = isMSTeamsGroupAllowed({
       groupPolicy: "allowlist",
       allowFrom: effectiveGroupAllowFrom,
       senderId,
       senderName,
+      allowNameMatching: isDangerousNameMatchingEnabled(msteamsCfg),
     });
     const hasControlCommandInMessage = core.channel.text.hasControlCommand(text, cfg);
     const commandGate = resolveControlCommandGate({

package/src/policy.test.ts

@@ -184,7 +184,7 @@ describe("msteams policy", () => {
       ).toBe(true);
     });
 
-    it("allows allowlist when sender name matches", () => {
+    it("blocks sender-name allowlist matches by default", () => {
       expect(
         isMSTeamsGroupAllowed({
           groupPolicy: "allowlist",
@@ -192,6 +192,18 @@ describe("msteams policy", () => {
           senderId: "other",
           senderName: "User",
         }),
+      ).toBe(false);
+    });
+
+    it("allows sender-name allowlist matches when explicitly enabled", () => {
+      expect(
+        isMSTeamsGroupAllowed({
+          groupPolicy: "allowlist",
+          allowFrom: ["user"],
+          senderId: "other",
+          senderName: "User",
+          allowNameMatching: true,
+        }),
       ).toBe(true);
     });
 

package/src/policy.ts

@@ -209,6 +209,7 @@ export function resolveMSTeamsAllowlistMatch(params: {
   allowFrom: Array<string | number>;
   senderId: string;
   senderName?: string | null;
+  allowNameMatching?: boolean;
 }): MSTeamsAllowlistMatch {
   return resolveAllowlistMatchSimple(params);
 }
@@ -245,6 +246,7 @@ export function isMSTeamsGroupAllowed(params: {
   allowFrom: Array<string | number>;
   senderId: string;
   senderName?: string | null;
+  allowNameMatching?: boolean;
 }): boolean {
   const { groupPolicy } = params;
   if (groupPolicy === "disabled") {

package/src/reply-dispatcher.ts

@@ -68,6 +68,7 @@ export function createMSTeamsReplyDispatcher(params: {
     core.channel.reply.createReplyDispatcherWithTyping({
       ...prefixOptions,
       humanDelay: core.channel.reply.resolveHumanDelayConfig(params.cfg, params.agentId),
+      typingCallbacks,
       deliver: async (payload) => {
         const tableMode = core.channel.text.resolveMarkdownTableMode({
           cfg: params.cfg,
@@ -121,7 +122,6 @@ export function createMSTeamsReplyDispatcher(params: {
           hint,
         });
       },
-      onReplyStart: typingCallbacks.onReplyStart,
     });
 
   return {