@openclaw/msteams 2026.3.13 → 2026.5.2-beta.1

package/src/conversation-store.shared.test.ts

@@ -0,0 +1,225 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { createMSTeamsConversationStoreFs } from "./conversation-store-fs.js";
+import { createMSTeamsConversationStoreMemory } from "./conversation-store-memory.js";
+import type { MSTeamsConversationStore } from "./conversation-store.js";
+import { setMSTeamsRuntime } from "./runtime.js";
+import { msteamsRuntimeStub } from "./test-runtime.js";
+
+type StoreFactory = {
+  name: string;
+  createStore: () => Promise<MSTeamsConversationStore>;
+};
+
+const storeFactories: StoreFactory[] = [
+  {
+    name: "fs",
+    createStore: async () => {
+      const stateDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "openclaw-msteams-store-"));
+      return createMSTeamsConversationStoreFs({
+        env: { ...process.env, OPENCLAW_STATE_DIR: stateDir },
+        ttlMs: 60_000,
+      });
+    },
+  },
+  {
+    name: "memory",
+    createStore: async () => createMSTeamsConversationStoreMemory(),
+  },
+];
+
+describe.each(storeFactories)("msteams conversation store ($name)", ({ createStore }) => {
+  beforeEach(() => {
+    setMSTeamsRuntime(msteamsRuntimeStub);
+  });
+
+  it("normalizes conversation ids consistently", async () => {
+    const store = await createStore();
+
+    await store.upsert("conv-norm;messageid=123", {
+      conversation: { id: "conv-norm" },
+      channelId: "msteams",
+      serviceUrl: "https://service.example.com",
+      user: { id: "u1" },
+    });
+
+    await expect(store.get("conv-norm")).resolves.toEqual(
+      expect.objectContaining({
+        conversation: { id: "conv-norm" },
+      }),
+    );
+    await expect(store.remove("conv-norm")).resolves.toBe(true);
+    await expect(store.get("conv-norm;messageid=123")).resolves.toBeNull();
+  });
+
+  it("upserts, lists, removes, and resolves users by both AAD and Bot Framework ids", async () => {
+    const store = await createStore();
+
+    await store.upsert("conv-a", {
+      conversation: { id: "conv-a" },
+      channelId: "msteams",
+      serviceUrl: "https://service.example.com",
+      user: { id: "user-a", aadObjectId: "aad-a", name: "Alice" },
+    });
+
+    await store.upsert("conv-b", {
+      conversation: { id: "conv-b" },
+      channelId: "msteams",
+      serviceUrl: "https://service.example.com",
+      user: { id: "user-b", aadObjectId: "aad-b", name: "Bob" },
+    });
+
+    await expect(store.get("conv-a")).resolves.toEqual({
+      conversation: { id: "conv-a" },
+      channelId: "msteams",
+      serviceUrl: "https://service.example.com",
+      user: { id: "user-a", aadObjectId: "aad-a", name: "Alice" },
+      lastSeenAt: expect.any(String),
+    });
+
+    await expect(store.list()).resolves.toEqual([
+      {
+        conversationId: "conv-a",
+        reference: {
+          conversation: { id: "conv-a" },
+          channelId: "msteams",
+          serviceUrl: "https://service.example.com",
+          user: { id: "user-a", aadObjectId: "aad-a", name: "Alice" },
+          lastSeenAt: expect.any(String),
+        },
+      },
+      {
+        conversationId: "conv-b",
+        reference: {
+          conversation: { id: "conv-b" },
+          channelId: "msteams",
+          serviceUrl: "https://service.example.com",
+          user: { id: "user-b", aadObjectId: "aad-b", name: "Bob" },
+          lastSeenAt: expect.any(String),
+        },
+      },
+    ]);
+
+    await expect(store.findPreferredDmByUserId("  aad-b  ")).resolves.toEqual({
+      conversationId: "conv-b",
+      reference: {
+        conversation: { id: "conv-b" },
+        channelId: "msteams",
+        serviceUrl: "https://service.example.com",
+        user: { id: "user-b", aadObjectId: "aad-b", name: "Bob" },
+        lastSeenAt: expect.any(String),
+      },
+    });
+    await expect(store.findPreferredDmByUserId("user-a")).resolves.toEqual({
+      conversationId: "conv-a",
+      reference: {
+        conversation: { id: "conv-a" },
+        channelId: "msteams",
+        serviceUrl: "https://service.example.com",
+        user: { id: "user-a", aadObjectId: "aad-a", name: "Alice" },
+        lastSeenAt: expect.any(String),
+      },
+    });
+    await expect(store.findByUserId("user-a")).resolves.toEqual(
+      await store.findPreferredDmByUserId("user-a"),
+    );
+    await expect(store.findPreferredDmByUserId("   ")).resolves.toBeNull();
+
+    await expect(store.remove("conv-a")).resolves.toBe(true);
+    await expect(store.get("conv-a")).resolves.toBeNull();
+    await expect(store.remove("missing")).resolves.toBe(false);
+  });
+
+  it("preserves existing timezone when upsert omits timezone", async () => {
+    const store = await createStore();
+
+    await store.upsert("conv-tz", {
+      conversation: { id: "conv-tz" },
+      channelId: "msteams",
+      serviceUrl: "https://service.example.com",
+      user: { id: "u1" },
+      timezone: "Europe/London",
+    });
+
+    await store.upsert("conv-tz", {
+      conversation: { id: "conv-tz" },
+      channelId: "msteams",
+      serviceUrl: "https://service.example.com",
+      user: { id: "u1" },
+    });
+
+    await expect(store.get("conv-tz")).resolves.toMatchObject({
+      timezone: "Europe/London",
+    });
+  });
+
+  it("preserves graphChatId across upserts that omit it", async () => {
+    const store = await createStore();
+
+    await store.upsert("conv-graph", {
+      conversation: { id: "conv-graph", conversationType: "personal" },
+      channelId: "msteams",
+      serviceUrl: "https://service.example.com",
+      user: { id: "u1" },
+      graphChatId: "19:resolved-chat-id@unq.gbl.spaces",
+    });
+
+    // Second upsert without graphChatId (normal activity-based upsert)
+    await store.upsert("conv-graph", {
+      conversation: { id: "conv-graph", conversationType: "personal" },
+      channelId: "msteams",
+      serviceUrl: "https://service.example.com",
+      user: { id: "u1" },
+    });
+
+    await expect(store.get("conv-graph")).resolves.toMatchObject({
+      graphChatId: "19:resolved-chat-id@unq.gbl.spaces",
+    });
+  });
+
+  it("prefers the freshest personal conversation for repeated upserts of the same user", async () => {
+    const store = await createStore();
+
+    vi.useFakeTimers();
+    try {
+      vi.setSystemTime(new Date("2026-03-25T20:00:00.000Z"));
+      await store.upsert("dm-old", {
+        conversation: { id: "dm-old", conversationType: "personal" },
+        channelId: "msteams",
+        serviceUrl: "https://service.example.com",
+        user: { id: "user-shared-old", aadObjectId: "aad-shared", name: "Old DM" },
+      });
+
+      vi.setSystemTime(new Date("2026-03-25T20:30:00.000Z"));
+      await store.upsert("group-shared", {
+        conversation: { id: "group-shared", conversationType: "groupChat" },
+        channelId: "msteams",
+        serviceUrl: "https://service.example.com",
+        user: { id: "user-shared-group", aadObjectId: "aad-shared", name: "Group" },
+      });
+
+      vi.setSystemTime(new Date("2026-03-25T21:00:00.000Z"));
+      await store.upsert("dm-new", {
+        conversation: { id: "dm-new", conversationType: "personal" },
+        channelId: "msteams",
+        serviceUrl: "https://service.example.com",
+        user: { id: "user-shared-new", aadObjectId: "aad-shared", name: "New DM" },
+      });
+
+      await expect(store.findPreferredDmByUserId("aad-shared")).resolves.toEqual({
+        conversationId: "dm-new",
+        reference: {
+          conversation: { id: "dm-new", conversationType: "personal" },
+          channelId: "msteams",
+          serviceUrl: "https://service.example.com",
+          user: { id: "user-shared-new", aadObjectId: "aad-shared", name: "New DM" },
+          lastSeenAt: "2026-03-25T21:00:00.000Z",
+        },
+      });
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});

package/src/conversation-store.ts

@@ -7,8 +7,12 @@
 
 /** Minimal ConversationReference shape for proactive messaging */
 export type StoredConversationReference = {
+  /** Timestamp when this reference was last seen/updated. */
+  lastSeenAt?: string;
   /** Activity ID from the last message */
   activityId?: string;
+  /** Channel thread root activity ID for threaded replies. */
+  threadId?: string;
   /** User who sent the message */
   user?: { id?: string; name?: string; aadObjectId?: string };
   /** Agent/bot that received the message */
@@ -17,6 +21,20 @@ export type StoredConversationReference = {
   bot?: { id?: string; name?: string };
   /** Conversation details */
   conversation?: { id?: string; conversationType?: string; tenantId?: string };
+  /**
+   * Tenant ID sourced from `activity.channelData.tenant.id` at inbound time.
+   * Bot Framework requires this on outbound proactive messages so the connector
+   * can route them to the correct Azure AD tenant; without it, the connector
+   * rejects the request with HTTP 403. For channel activities, `conversation.tenantId`
+   * is often unset, making `channelData.tenant.id` the reliable source.
+   */
+  tenantId?: string;
+  /**
+   * Azure AD object ID of the user who sent the last inbound activity,
+   * mirrored from `activity.from.aadObjectId` so outbound proactive sends
+   * can include it on the connector request (required for personal DMs).
+   */
+  aadObjectId?: string;
   /** Team ID for channel messages (when available). */
   teamId?: string;
   /** Channel ID (usually "msteams") */
@@ -25,6 +43,15 @@ export type StoredConversationReference = {
   serviceUrl?: string;
   /** Locale */
   locale?: string;
+  /**
+   * Cached Graph API chat ID (format: `19:xxx@thread.tacv2` or `19:xxx@unq.gbl.spaces`).
+   * Bot Framework conversation IDs for personal DMs use a different format (`a:1xxx` or
+   * `8:orgid:xxx`) that the Graph API does not accept. This field caches the resolved
+   * Graph-native chat ID so we don't need to re-query the API on every send.
+   */
+  graphChatId?: string;
+  /** IANA timezone from Teams clientInfo entity (e.g. "America/New_York") */
+  timezone?: string;
 };
 
 export type MSTeamsConversationStoreEntry = {
@@ -37,5 +64,8 @@ export type MSTeamsConversationStore = {
   get: (conversationId: string) => Promise<StoredConversationReference | null>;
   list: () => Promise<MSTeamsConversationStoreEntry[]>;
   remove: (conversationId: string) => Promise<boolean>;
+  /** Person-targeted proactive lookup: prefer the freshest personal DM reference. */
+  findPreferredDmByUserId: (id: string) => Promise<MSTeamsConversationStoreEntry | null>;
+  /** @deprecated Use `findPreferredDmByUserId` for proactive user-targeted sends. */
   findByUserId: (id: string) => Promise<MSTeamsConversationStoreEntry | null>;
 };

package/src/directory-live.test.ts

@@ -0,0 +1,156 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const {
+  searchGraphUsersMock,
+  listTeamsByNameMock,
+  listChannelsForTeamMock,
+  normalizeQueryMock,
+  resolveGraphTokenMock,
+} = vi.hoisted(() => {
+  return {
+    searchGraphUsersMock: vi.fn(),
+    listTeamsByNameMock: vi.fn(),
+    listChannelsForTeamMock: vi.fn(),
+    normalizeQueryMock: vi.fn((value?: string | null) => value?.trim() ?? ""),
+    resolveGraphTokenMock: vi.fn(),
+  };
+});
+
+vi.mock("./graph-users.js", () => {
+  return { searchGraphUsers: searchGraphUsersMock };
+});
+
+vi.mock("./graph.js", () => {
+  return {
+    listTeamsByName: listTeamsByNameMock,
+    listChannelsForTeam: listChannelsForTeamMock,
+    normalizeQuery: normalizeQueryMock,
+    resolveGraphToken: resolveGraphTokenMock,
+  };
+});
+
+import { listMSTeamsDirectoryGroupsLive, listMSTeamsDirectoryPeersLive } from "./directory-live.js";
+
+describe("msteams directory live", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    normalizeQueryMock.mockImplementation((value?: string | null) => value?.trim() ?? "");
+  });
+
+  it("returns normalized peer entries and skips users without ids", async () => {
+    resolveGraphTokenMock.mockResolvedValue("graph-token");
+    searchGraphUsersMock.mockResolvedValue([
+      {
+        id: "user-1",
+        displayName: "Alice",
+        userPrincipalName: "alice@example.com",
+      },
+      {
+        id: "user-2",
+        displayName: "Bob",
+        mail: "bob@example.com",
+      },
+      {
+        displayName: "Missing Id",
+      },
+    ]);
+
+    await expect(
+      listMSTeamsDirectoryPeersLive({
+        cfg: {},
+        query: "  ali  ",
+      }),
+    ).resolves.toEqual([
+      {
+        kind: "user",
+        id: "user:user-1",
+        name: "Alice",
+        handle: "@alice@example.com",
+        raw: {
+          id: "user-1",
+          displayName: "Alice",
+          userPrincipalName: "alice@example.com",
+        },
+      },
+      {
+        kind: "user",
+        id: "user:user-2",
+        name: "Bob",
+        handle: "@bob@example.com",
+        raw: {
+          id: "user-2",
+          displayName: "Bob",
+          mail: "bob@example.com",
+        },
+      },
+    ]);
+
+    expect(searchGraphUsersMock).toHaveBeenCalledWith({
+      token: "graph-token",
+      query: "ali",
+      top: 20,
+    });
+  });
+
+  it("returns team entries without channel queries and honors limits", async () => {
+    resolveGraphTokenMock.mockResolvedValue("graph-token");
+    listTeamsByNameMock.mockResolvedValue([
+      { id: "team-1", displayName: "Platform" },
+      { id: "team-2", displayName: "Infra" },
+    ]);
+
+    await expect(
+      listMSTeamsDirectoryGroupsLive({
+        cfg: {},
+        query: "platform",
+        limit: 1,
+      }),
+    ).resolves.toEqual([
+      {
+        kind: "group",
+        id: "team:team-1",
+        name: "Platform",
+        handle: "#Platform",
+        raw: { id: "team-1", displayName: "Platform" },
+      },
+    ]);
+  });
+
+  it("searches channels within matching teams when a team/channel query is used", async () => {
+    resolveGraphTokenMock.mockResolvedValue("graph-token");
+    listTeamsByNameMock.mockResolvedValue([
+      { id: "team-1", displayName: "Platform" },
+      { id: "team-2", displayName: "Infra" },
+    ]);
+    listChannelsForTeamMock
+      .mockResolvedValueOnce([
+        { id: "chan-1", displayName: "Deployments" },
+        { id: "chan-2", displayName: "General" },
+      ])
+      .mockResolvedValueOnce([{ id: "chan-3", displayName: "Deployments-West" }]);
+
+    await expect(
+      listMSTeamsDirectoryGroupsLive({
+        cfg: {},
+        query: "plat / deploy",
+      }),
+    ).resolves.toEqual([
+      {
+        kind: "group",
+        id: "conversation:chan-1",
+        name: "Platform/Deployments",
+        handle: "#Deployments",
+        raw: { id: "chan-1", displayName: "Deployments" },
+      },
+      {
+        kind: "group",
+        id: "conversation:chan-3",
+        name: "Infra/Deployments-West",
+        handle: "#Deployments-West",
+        raw: { id: "chan-3", displayName: "Deployments-West" },
+      },
+    ]);
+
+    expect(listTeamsByNameMock).toHaveBeenCalledWith("graph-token", "plat");
+  });
+});

package/src/directory-live.ts

@@ -1,8 +1,7 @@
-import type { ChannelDirectoryEntry } from "openclaw/plugin-sdk/msteams";
+import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
+import type { ChannelDirectoryEntry } from "../runtime-api.js";
 import { searchGraphUsers } from "./graph-users.js";
 import {
-  type GraphChannel,
-  type GraphGroup,
   listChannelsForTeam,
   listTeamsByName,
   normalizeQuery,
@@ -88,7 +87,11 @@ export async function listMSTeamsDirectoryGroupsLive(params: {
       if (!name) {
         continue;
       }
-      if (!name.toLowerCase().includes(channelQuery.toLowerCase())) {
+      if (
+        !normalizeLowercaseStringOrEmpty(name).includes(
+          normalizeLowercaseStringOrEmpty(channelQuery),
+        )
+      ) {
         continue;
       }
       results.push({

package/src/doctor.ts

@@ -0,0 +1,27 @@
+import { createDangerousNameMatchingMutableAllowlistWarningCollector } from "openclaw/plugin-sdk/channel-policy";
+
+function isMSTeamsMutableAllowEntry(raw: string): boolean {
+  const text = raw.trim();
+  if (!text || text === "*") {
+    return false;
+  }
+
+  const withoutPrefix = text.replace(/^(msteams|user):/i, "").trim();
+  return /\s/.test(withoutPrefix) || withoutPrefix.includes("@");
+}
+
+export const collectMSTeamsMutableAllowlistWarnings =
+  createDangerousNameMatchingMutableAllowlistWarningCollector({
+    channel: "msteams",
+    detector: isMSTeamsMutableAllowEntry,
+    collectLists: (scope) => [
+      {
+        pathLabel: `${scope.prefix}.allowFrom`,
+        list: scope.account.allowFrom,
+      },
+      {
+        pathLabel: `${scope.prefix}.groupAllowFrom`,
+        list: scope.account.groupAllowFrom,
+      },
+    ],
+  });

package/src/errors.test.ts

@@ -1,10 +1,11 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 import {
   classifyMSTeamsSendError,
   formatMSTeamsSendErrorHint,
   formatUnknownError,
   isRevokedProxyError,
 } from "./errors.js";
+import { withRevokedProxyFallback } from "./revoked-context.js";
 
 describe("msteams errors", () => {
   it("formats unknown errors", () => {
@@ -17,6 +18,25 @@ describe("msteams errors", () => {
     expect(classifyMSTeamsSendError({ statusCode: 403 }).kind).toBe("auth");
   });
 
+  it("classifies ContentStreamNotAllowed as permanent instead of auth", () => {
+    expect(
+      classifyMSTeamsSendError({
+        statusCode: 403,
+        response: {
+          body: {
+            error: {
+              code: "ContentStreamNotAllowed",
+            },
+          },
+        },
+      }),
+    ).toMatchObject({
+      kind: "permanent",
+      statusCode: 403,
+      errorCode: "ContentStreamNotAllowed",
+    });
+  });
+
   it("classifies throttling errors and parses retry-after", () => {
     expect(classifyMSTeamsSendError({ statusCode: 429, retryAfter: "1.5" })).toMatchObject({
       kind: "throttled",
@@ -42,6 +62,12 @@ describe("msteams errors", () => {
   it("provides actionable hints for common cases", () => {
     expect(formatMSTeamsSendErrorHint({ kind: "auth" })).toContain("msteams");
     expect(formatMSTeamsSendErrorHint({ kind: "throttled" })).toContain("throttled");
+    expect(
+      formatMSTeamsSendErrorHint({
+        kind: "permanent",
+        errorCode: "ContentStreamNotAllowed",
+      }),
+    ).toContain("expired the content stream");
   });
 
   describe("isRevokedProxyError", () => {
@@ -67,4 +93,41 @@ describe("msteams errors", () => {
       expect(isRevokedProxyError("proxy that has been revoked")).toBe(false);
     });
   });
+
+  describe("withRevokedProxyFallback", () => {
+    it("returns primary result when no error occurs", async () => {
+      await expect(
+        withRevokedProxyFallback({
+          run: async () => "ok",
+          onRevoked: async () => "fallback",
+        }),
+      ).resolves.toBe("ok");
+    });
+
+    it("uses fallback when proxy-revoked TypeError is thrown", async () => {
+      const onRevokedLog = vi.fn();
+      await expect(
+        withRevokedProxyFallback({
+          run: async () => {
+            throw new TypeError("Cannot perform 'get' on a proxy that has been revoked");
+          },
+          onRevoked: async () => "fallback",
+          onRevokedLog,
+        }),
+      ).resolves.toBe("fallback");
+      expect(onRevokedLog).toHaveBeenCalledOnce();
+    });
+
+    it("rethrows non-revoked errors", async () => {
+      const err = Object.assign(new Error("boom"), { statusCode: 500 });
+      await expect(
+        withRevokedProxyFallback({
+          run: async () => {
+            throw err;
+          },
+          onRevoked: async () => "fallback",
+        }),
+      ).rejects.toBe(err);
+    });
+  });
 });