@openclaw/msteams 2026.5.7-beta.1 → 2026.5.9-beta.1

package/dist/api.js

@@ -1,3 +1,3 @@
-import { t as msteamsPlugin } from "./channel-BOwKBAvY.js";
-import { i as msteamsSetupAdapter, n as openDelegatedOAuthUrl, r as createMSTeamsSetupWizardBase, t as msteamsSetupWizard } from "./setup-surface-BLkFQYIQ.js";
+import { t as msteamsPlugin } from "./channel-VjDbklu8.js";
+import { i as msteamsSetupAdapter, n as openDelegatedOAuthUrl, r as createMSTeamsSetupWizardBase, t as msteamsSetupWizard } from "./setup-surface-BeztPcxk.js";
 export { createMSTeamsSetupWizardBase, msteamsPlugin, msteamsSetupAdapter, msteamsSetupWizard, openDelegatedOAuthUrl };

package/dist/{channel-BOwKBAvY.js → channel-VjDbklu8.js}

@@ -1,13 +1,14 @@
-import { o as buildProbeChannelStatusSummary, r as PAIRING_APPROVED_MESSAGE, s as chunkTextForOutbound, t as DEFAULT_ACCOUNT_ID, u as createDefaultChannelRuntimeState } from "./runtime-api-DV1iVMn1.js";
-import { h as resolveMSTeamsCredentials } from "./graph-users-9uQJepqr.js";
-import { a as parseMSTeamsTeamChannelInput, c as resolveMSTeamsUserAllowlist, i as parseMSTeamsConversationId, n as normalizeMSTeamsMessagingTarget, r as normalizeMSTeamsUserInput, s as resolveMSTeamsChannelAllowlist, t as looksLikeMSTeamsTargetId } from "./resolve-allowlist-D41JSziq.js";
+import { o as buildProbeChannelStatusSummary, r as PAIRING_APPROVED_MESSAGE, s as chunkTextForOutbound, t as DEFAULT_ACCOUNT_ID, u as createDefaultChannelRuntimeState } from "./runtime-api-D92XOrVf.js";
+import { h as resolveMSTeamsCredentials } from "./graph-users-C9HaPg1v.js";
+import { a as parseMSTeamsTeamChannelInput, c as resolveMSTeamsUserAllowlist, i as parseMSTeamsConversationId, n as normalizeMSTeamsMessagingTarget, r as normalizeMSTeamsUserInput, s as resolveMSTeamsChannelAllowlist, t as looksLikeMSTeamsTargetId } from "./resolve-allowlist-C23ohQKQ.js";
 import { t as MSTeamsChannelConfigSchema } from "./config-schema-DwOEthCC.js";
-import { r as resolveMSTeamsGroupToolPolicy } from "./policy-DTnU2GR7.js";
-import { i as msteamsSetupAdapter, t as msteamsSetupWizard } from "./setup-surface-BLkFQYIQ.js";
+import { r as resolveMSTeamsGroupToolPolicy } from "./policy-D32Kf1ED.js";
+import { i as msteamsSetupAdapter, t as msteamsSetupWizard } from "./setup-surface-BeztPcxk.js";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { formatAllowFromLowercase } from "openclaw/plugin-sdk/allow-from";
 import { createTopLevelChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
 import { buildChannelOutboundSessionRoute, createChatChannelPlugin, stripChannelTargetPrefix, stripTargetKindPrefix } from "openclaw/plugin-sdk/channel-core";
+import { createChannelMessageAdapterFromOutbound } from "openclaw/plugin-sdk/channel-message";
 import { createPairingPrefixStripper } from "openclaw/plugin-sdk/channel-pairing";
 import { createAllowlistProviderGroupPolicyWarningCollector, createDangerousNameMatchingMutableAllowlistWarningCollector, projectConfigWarningCollector } from "openclaw/plugin-sdk/channel-policy";
 import { createChannelDirectoryAdapter, createRuntimeDirectoryLiveAdapter, listDirectoryEntriesFromSources } from "openclaw/plugin-sdk/directory-runtime";
@@ -182,7 +183,7 @@ const collectMSTeamsSecurityWarnings = createAllowlistProviderGroupPolicyWarning
 	resolveGroupPolicy: ({ cfg }) => cfg.channels?.msteams?.groupPolicy,
 	collect: ({ groupPolicy }) => groupPolicy === "open" ? ["- MS Teams groups: groupPolicy=\"open\" allows any member to trigger (mention-gated). Set channels.msteams.groupPolicy=\"allowlist\" + channels.msteams.groupAllowFrom to restrict senders."] : []
 });
-const loadMSTeamsChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-BC1ruIfN.js"), "msTeamsChannelRuntime");
+const loadMSTeamsChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-VrE9r2nS.js"), "msTeamsChannelRuntime");
 const resolveMSTeamsChannelConfig = (cfg) => ({
 	allowFrom: cfg.channels?.msteams?.allowFrom,
 	defaultTo: cfg.channels?.msteams?.defaultTo
@@ -376,6 +377,41 @@ function describeMSTeamsMessageTool({ cfg }) {
 		} : null
 	};
 }
+const msteamsChannelOutbound = {
+	deliveryMode: "direct",
+	chunker: chunkTextForOutbound,
+	chunkerMode: "markdown",
+	textChunkLimit: 4e3,
+	pollMaxOptions: 12,
+	deliveryCapabilities: { durableFinal: {
+		text: true,
+		media: true,
+		messageSendingHooks: true
+	} },
+	...createRuntimeOutboundDelegates({
+		getRuntime: loadMSTeamsChannelRuntime,
+		sendText: { resolve: (runtime) => runtime.msteamsOutbound.sendText },
+		sendMedia: { resolve: (runtime) => runtime.msteamsOutbound.sendMedia },
+		sendPoll: { resolve: (runtime) => runtime.msteamsOutbound.sendPoll }
+	})
+};
+const msteamsMessageAdapter = createChannelMessageAdapterFromOutbound({
+	id: "msteams",
+	outbound: msteamsChannelOutbound,
+	live: {
+		capabilities: {
+			draftPreview: true,
+			previewFinalization: true,
+			progressUpdates: true,
+			nativeStreaming: true
+		},
+		finalizer: { capabilities: {
+			finalEdit: true,
+			normalFallback: true,
+			previewReceipt: true
+		} }
+	}
+});
 const msteamsPlugin = createChatChannelPlugin({
 	base: {
 		id: "msteams",
@@ -428,6 +464,7 @@ const msteamsPlugin = createChatChannelPlugin({
 				hint: "<conversationId|user:ID|conversation:ID>"
 			}
 		},
+		message: msteamsMessageAdapter,
 		directory: createChannelDirectoryAdapter({
 			self: async ({ cfg }) => {
 				const creds = resolveMSTeamsCredentials(cfg.channels?.msteams);
@@ -928,7 +965,7 @@ const msteamsPlugin = createChatChannelPlugin({
 			})
 		}),
 		gateway: { startAccount: async (ctx) => {
-			const { monitorMSTeamsProvider } = await import("./src-CP7V_TeZ.js");
+			const { monitorMSTeamsProvider } = await import("./src-CiKTGSje.js");
 			const port = ctx.cfg.channels?.msteams?.webhook?.port ?? 3978;
 			ctx.setStatus({
 				accountId: ctx.accountId,
@@ -966,19 +1003,7 @@ const msteamsPlugin = createChatChannelPlugin({
 			hasRepliedRef
 		};
 	} },
-	outbound: {
-		deliveryMode: "direct",
-		chunker: chunkTextForOutbound,
-		chunkerMode: "markdown",
-		textChunkLimit: 4e3,
-		pollMaxOptions: 12,
-		...createRuntimeOutboundDelegates({
-			getRuntime: loadMSTeamsChannelRuntime,
-			sendText: { resolve: (runtime) => runtime.msteamsOutbound.sendText },
-			sendMedia: { resolve: (runtime) => runtime.msteamsOutbound.sendMedia },
-			sendPoll: { resolve: (runtime) => runtime.msteamsOutbound.sendPoll }
-		})
-	}
+	outbound: msteamsChannelOutbound
 });
 //#endregion
 export { msteamsPlugin as t };

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as msteamsPlugin } from "./channel-BOwKBAvY.js";
+import { t as msteamsPlugin } from "./channel-VjDbklu8.js";
 export { msteamsPlugin };

package/dist/{channel.runtime-BC1ruIfN.js → channel.runtime-VrE9r2nS.js}

@@ -1,6 +1,6 @@
-import { s as chunkTextForOutbound } from "./runtime-api-DV1iVMn1.js";
-import { a as fetchGraphJson, c as normalizeQuery, d as postGraphJson, f as resolveGraphToken, i as fetchGraphAbsoluteUrl, l as patchGraphJson, n as deleteGraphRequest, o as listChannelsForTeam, r as escapeOData, s as listTeamsByName, t as searchGraphUsers, u as postGraphBetaJson } from "./graph-users-9uQJepqr.js";
-import { S as createMSTeamsConversationStoreFs, a as sendMessageMSTeams, b as createMSTeamsPollStoreFs, i as sendAdaptiveCardMSTeams, n as deleteMessageMSTeams, o as sendPollMSTeams, r as editMessageMSTeams, t as probeMSTeams } from "./probe-D_H8yFps.js";
+import { s as chunkTextForOutbound } from "./runtime-api-D92XOrVf.js";
+import { a as fetchGraphJson, c as normalizeQuery, d as postGraphJson, f as resolveGraphToken, i as fetchGraphAbsoluteUrl, l as patchGraphJson, n as deleteGraphRequest, o as listChannelsForTeam, r as escapeOData, s as listTeamsByName, t as searchGraphUsers, u as postGraphBetaJson } from "./graph-users-C9HaPg1v.js";
+import { S as createMSTeamsConversationStoreFs, a as sendMessageMSTeams, b as createMSTeamsPollStoreFs, i as sendAdaptiveCardMSTeams, n as deleteMessageMSTeams, o as sendPollMSTeams, r as editMessageMSTeams, t as probeMSTeams } from "./probe-Bs955MJZ.js";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
 import { createAttachedChannelResultAdapter } from "openclaw/plugin-sdk/channel-send-result";
 import { resolveOutboundSendDep } from "openclaw/plugin-sdk/outbound-send-deps";

package/dist/{graph-users-9uQJepqr.js → graph-users-C9HaPg1v.js}

@@ -1,14 +1,15 @@
-import { L as getMSTeamsRuntime, g as fetchWithSsrFGuard$1 } from "./runtime-api-DV1iVMn1.js";
+import { L as getMSTeamsRuntime, g as fetchWithSsrFGuard$1 } from "./runtime-api-D92XOrVf.js";
 import { n as refreshMSTeamsDelegatedTokens } from "./oauth.token-xxpoLWy5.js";
 import { createRequire } from "node:module";
-import { isRecord as isRecord$1, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/text-runtime";
+import { isRecord as isRecord$2, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/text-runtime";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 import { Buffer } from "node:buffer";
 import { lookup } from "node:dns/promises";
 import { buildHostnameAllowlistPolicyFromSuffixAllowlist, isHttpsUrlAllowedByHostnameSuffixAllowlist, isPrivateIpAddress, normalizeHostnameSuffixAllowlist } from "openclaw/plugin-sdk/ssrf-policy";
-import * as fs$1 from "node:fs";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import path, { dirname } from "node:path";
+import * as fs from "node:fs";
+import { readFileSync } from "node:fs";
+import path, { basename, dirname } from "node:path";
+import { privateFileStoreSync } from "openclaw/plugin-sdk/security-runtime";
 import { hasConfiguredSecretInput, normalizeResolvedSecretInputString, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
 //#region extensions/msteams/src/attachments/shared.ts
 const IMAGE_EXT_RE = /\.(avif|bmp|gif|heic|heif|jpe?g|png|tiff?|webp)$/i;
@@ -122,7 +123,7 @@ function tryBuildGraphSharesUrlForSharedLink(url) {
 function readNestedString(value, keys) {
 	let current = value;
 	for (const key of keys) {
-		if (!isRecord$1(current)) return;
+		if (!isRecord$2(current)) return;
 		current = current[key];
 	}
 	return normalizeOptionalString(current);
@@ -153,7 +154,7 @@ function isLikelyImageAttachment(att) {
 	const name = typeof att.name === "string" ? att.name : "";
 	if (contentType.startsWith("image/")) return true;
 	if (IMAGE_EXT_RE.test(name)) return true;
-	if (contentType === "application/vnd.microsoft.teams.file.download.info" && isRecord$1(att.content)) {
+	if (contentType === "application/vnd.microsoft.teams.file.download.info" && isRecord$2(att.content)) {
 		const fileType = typeof att.content.fileType === "string" ? att.content.fileType : "";
 		if (fileType && IMAGE_EXT_RE.test(`x.${fileType}`)) return true;
 		const fileName = typeof att.content.fileName === "string" ? att.content.fileName : "";
@@ -166,7 +167,7 @@ function isLikelyImageAttachment(att) {
 * Used when downloading all files, not just images.
 */
 function isDownloadableAttachment(att) {
-	if ((normalizeContentType(att.contentType) ?? "") === "application/vnd.microsoft.teams.file.download.info" && isRecord$1(att.content) && typeof att.content.downloadUrl === "string") return true;
+	if ((normalizeContentType(att.contentType) ?? "") === "application/vnd.microsoft.teams.file.download.info" && isRecord$2(att.content) && typeof att.content.downloadUrl === "string") return true;
 	if (typeof att.contentUrl === "string" && att.contentUrl.trim()) return true;
 	return false;
 }
@@ -176,7 +177,7 @@ function isHtmlAttachment(att) {
 function extractHtmlFromAttachment(att) {
 	if (!isHtmlAttachment(att)) return;
 	if (typeof att.content === "string") return att.content;
-	if (!isRecord$1(att.content)) return;
+	if (!isRecord$2(att.content)) return;
 	return typeof att.content.text === "string" ? att.content.text : typeof att.content.body === "string" ? att.content.body : typeof att.content.content === "string" ? att.content.content : void 0;
 }
 function isLikelyBase64Payload(value) {
@@ -387,7 +388,7 @@ async function safeFetchWithPolicy(params) {
 }
 //#endregion
 //#region extensions/msteams/src/errors.ts
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function formatUnknownError(err) {
@@ -405,7 +406,7 @@ function formatUnknownError(err) {
 	}
 }
 function extractStatusCode(err) {
-	if (!isRecord(err)) return null;
+	if (!isRecord$1(err)) return null;
 	const direct = err.statusCode ?? err.status;
 	if (typeof direct === "number" && Number.isFinite(direct)) return direct;
 	if (typeof direct === "string") {
@@ -413,7 +414,7 @@ function extractStatusCode(err) {
 		if (Number.isFinite(parsed)) return parsed;
 	}
 	const response = err.response;
-	if (isRecord(response)) {
+	if (isRecord$1(response)) {
 		const status = response.status;
 		if (typeof status === "number" && Number.isFinite(status)) return status;
 		if (typeof status === "string") {
@@ -424,20 +425,20 @@ function extractStatusCode(err) {
 	return null;
 }
 function extractErrorCode(err) {
-	if (!isRecord(err)) return null;
+	if (!isRecord$1(err)) return null;
 	const direct = err.code;
 	if (typeof direct === "string" && direct.trim()) return direct;
 	const response = err.response;
-	if (!isRecord(response)) return null;
+	if (!isRecord$1(response)) return null;
 	const body = response.body;
-	if (isRecord(body)) {
+	if (isRecord$1(body)) {
 		const error = body.error;
-		if (isRecord(error) && typeof error.code === "string" && error.code.trim()) return error.code;
+		if (isRecord$1(error) && typeof error.code === "string" && error.code.trim()) return error.code;
 	}
 	return null;
 }
 function extractRetryAfterMs(err) {
-	if (!isRecord(err)) return null;
+	if (!isRecord$1(err)) return null;
 	const direct = err.retryAfterMs ?? err.retry_after_ms;
 	if (typeof direct === "number" && Number.isFinite(direct) && direct >= 0) return direct;
 	const retryAfter = err.retryAfter ?? err.retry_after;
@@ -447,10 +448,10 @@ function extractRetryAfterMs(err) {
 		if (Number.isFinite(parsed) && parsed >= 0) return parsed * 1e3;
 	}
 	const response = err.response;
-	if (!isRecord(response)) return null;
+	if (!isRecord$1(response)) return null;
 	const headers = response.headers;
 	if (!headers) return null;
-	if (isRecord(headers)) {
+	if (isRecord$1(headers)) {
 		const raw = headers["retry-after"] ?? headers["Retry-After"];
 		if (typeof raw === "string") {
 			const parsed = Number.parseFloat(raw);
@@ -512,6 +513,13 @@ function classifyMSTeamsSendError(err) {
 		statusCode,
 		errorCode
 	};
+	if (statusCode == null) {
+		const networkCode = isRecord$1(err) && typeof err.code === "string" ? err.code : null;
+		if (networkCode === "ECONNREFUSED" || networkCode === "ENOTFOUND" || networkCode === "EHOSTUNREACH" || networkCode === "ETIMEDOUT" || networkCode === "ECONNRESET") return {
+			kind: "network",
+			errorCode: networkCode
+		};
+	}
 	return {
 		kind: "unknown",
 		statusCode: statusCode ?? void 0,
@@ -536,6 +544,7 @@ function formatMSTeamsSendErrorHint(classification) {
 	if (classification.errorCode === "ContentStreamNotAllowed") return "Teams expired the content stream; stop streaming earlier and fall back to normal message delivery";
 	if (classification.kind === "throttled") return "Teams throttled the bot; backing off may help";
 	if (classification.kind === "transient") return "transient Teams/Bot Framework error; retry may succeed";
+	if (classification.kind === "network") return "transport-level failure sending reply to Teams Bot Connector (smba.trafficmanager.net) — check egress firewall rules allow outbound HTTPS to smba.trafficmanager.net";
 }
 //#endregion
 //#region extensions/msteams/src/user-agent.ts
@@ -617,7 +626,7 @@ function createFederatedApp(creds, sdk) {
 	if (!creds.certificatePath) throw new Error("Federated credentials require either a certificate path or managed identity.");
 	let privateKey;
 	try {
-		privateKey = fs$1.readFileSync(creds.certificatePath, "utf-8");
+		privateKey = fs.readFileSync(creds.certificatePath, "utf-8");
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
 		throw new Error(`Failed to read certificate file at '${creds.certificatePath}': ${msg}`, { cause: err });
@@ -1045,11 +1054,23 @@ async function createBotFrameworkJwtValidator(creds) {
 			if (!isJwtPayloadObject(verifiedPayload)) return false;
 			if (getAudienceClaims(verifiedPayload).includes(BOT_FRAMEWORK_GLOBAL_AUDIENCE) && !hasExpectedBotIdentity(verifiedPayload, creds.appId)) return false;
 			return true;
-		} catch {
+		} catch (err) {
+			if (isJwksNetworkError(err)) throw err;
 			return false;
 		}
 	} };
 }
+/**
+* Return true when the error originated from a network-level failure fetching
+* the JWKS endpoint (DNS resolution, connection refused, TLS handshake, etc.)
+* rather than from token verification logic.
+*/
+function isJwksNetworkError(err) {
+	if (!(err instanceof Error)) return false;
+	const code = err.code;
+	if (code === "ECONNREFUSED" || code === "ENOTFOUND" || code === "EHOSTUNREACH" || code === "ETIMEDOUT" || code === "ECONNRESET") return true;
+	return /jwks|key fetch|getSigningKey/i.test(err.message) && /network|fetch|connect/i.test(err.message);
+}
 //#endregion
 //#region extensions/msteams/src/token-response.ts
 function readAccessToken(value) {
@@ -1135,8 +1156,7 @@ function loadDelegatedTokens() {
 }
 function saveDelegatedTokens(tokens) {
 	const tokenPath = resolveDelegatedTokenPath();
-	mkdirSync(dirname(tokenPath), { recursive: true });
-	writeFileSync(tokenPath, JSON.stringify(tokens, null, 2), "utf8");
+	privateFileStoreSync(dirname(tokenPath)).writeJson(basename(tokenPath), tokens);
 }
 async function resolveDelegatedAccessToken(params) {
 	const tokens = loadDelegatedTokens();
@@ -1351,4 +1371,4 @@ async function searchGraphUsers(params) {
 	})).value ?? [];
 }
 //#endregion
-export { ATTACHMENT_TAG_RE as A, isLikelyImageAttachment as B, loadMSTeamsSdkWithAuth as C, formatMSTeamsSendErrorHint as D, classifyMSTeamsSendError as E, estimateBase64DecodedBytes as F, resolveAttachmentFetchPolicy as G, isUrlAllowed as H, extractHtmlFromAttachment as I, safeFetchWithPolicy as J, resolveMediaSsrfPolicy as K, extractInlineImageCandidates as L, IMG_SRC_RE as M, applyAuthorizationHeaderForUrl as N, formatUnknownError as O, encodeGraphShareId as P, inferPlaceholder as R, createMSTeamsTokenProvider as S, ensureUserAgentHeader as T, normalizeContentType as U, isRecord$1 as V, readNestedString as W, tryBuildGraphSharesUrlForSharedLink as X, safeHostForUrl as Y, resolveMSTeamsStorePath as _, fetchGraphJson as a, createBotFrameworkJwtValidator as b, normalizeQuery as c, postGraphJson as d, resolveGraphToken as f, saveDelegatedTokens as g, resolveMSTeamsCredentials as h, fetchGraphAbsoluteUrl as i, GRAPH_ROOT as j, isRevokedProxyError as k, patchGraphJson as l, loadDelegatedTokens as m, deleteGraphRequest as n, listChannelsForTeam as o, hasConfiguredMSTeamsCredentials as p, resolveRequestUrl as q, escapeOData as r, listTeamsByName as s, searchGraphUsers as t, postGraphBetaJson as u, normalizeSecretInputString as v, buildUserAgent as w, createMSTeamsAdapter as x, readAccessToken as y, isDownloadableAttachment as z };
+export { ATTACHMENT_TAG_RE as A, isLikelyImageAttachment as B, loadMSTeamsSdkWithAuth as C, formatMSTeamsSendErrorHint as D, classifyMSTeamsSendError as E, estimateBase64DecodedBytes as F, resolveAttachmentFetchPolicy as G, isUrlAllowed as H, extractHtmlFromAttachment as I, safeFetchWithPolicy as J, resolveMediaSsrfPolicy as K, extractInlineImageCandidates as L, IMG_SRC_RE as M, applyAuthorizationHeaderForUrl as N, formatUnknownError as O, encodeGraphShareId as P, inferPlaceholder as R, createMSTeamsTokenProvider as S, ensureUserAgentHeader as T, normalizeContentType as U, isRecord$2 as V, readNestedString as W, tryBuildGraphSharesUrlForSharedLink as X, safeHostForUrl as Y, resolveMSTeamsStorePath as _, fetchGraphJson as a, createBotFrameworkJwtValidator as b, normalizeQuery as c, postGraphJson as d, resolveGraphToken as f, saveDelegatedTokens as g, resolveMSTeamsCredentials as h, fetchGraphAbsoluteUrl as i, GRAPH_ROOT as j, isRevokedProxyError as k, patchGraphJson as l, loadDelegatedTokens as m, deleteGraphRequest as n, listChannelsForTeam as o, hasConfiguredMSTeamsCredentials as p, resolveRequestUrl as q, escapeOData as r, listTeamsByName as s, searchGraphUsers as t, postGraphBetaJson as u, normalizeSecretInputString as v, buildUserAgent as w, createMSTeamsAdapter as x, readAccessToken as y, isDownloadableAttachment as z };

package/dist/{policy-DTnU2GR7.js → policy-D32Kf1ED.js}

@@ -1,4 +1,4 @@
-import { C as normalizeChannelSlug, D as resolveChannelEntryMatchWithFallback, E as resolveAllowlistMatchSimple, M as resolveNestedAllowlistDecision, P as resolveToolsBySender, i as buildChannelKeyCandidates, p as evaluateSenderGroupAccessForPolicy, v as isDangerousNameMatchingEnabled } from "./runtime-api-DV1iVMn1.js";
+import { C as normalizeChannelSlug, D as resolveChannelEntryMatchWithFallback, E as resolveAllowlistMatchSimple, M as resolveNestedAllowlistDecision, P as resolveToolsBySender, i as buildChannelKeyCandidates, p as evaluateSenderGroupAccessForPolicy, v as isDangerousNameMatchingEnabled } from "./runtime-api-D92XOrVf.js";
 //#region extensions/msteams/src/policy.ts
 function resolveMSTeamsRouteConfig(params) {
 	const teamId = params.teamId?.trim();

package/dist/{probe-D_H8yFps.js → probe-Bs955MJZ.js}

@@ -1,11 +1,14 @@
-import { L as getMSTeamsRuntime, O as resolveChannelMediaMaxBytes, _ as getFileExtension, b as loadOutboundMediaFromUrl, d as detectMime, h as extractOriginalFilename, m as extensionForMime, w as normalizeStringEntries } from "./runtime-api-DV1iVMn1.js";
-import { C as loadMSTeamsSdkWithAuth, D as formatMSTeamsSendErrorHint, E as classifyMSTeamsSendError, O as formatUnknownError, S as createMSTeamsTokenProvider, _ as resolveMSTeamsStorePath, h as resolveMSTeamsCredentials, k as isRevokedProxyError, m as loadDelegatedTokens, w as buildUserAgent, x as createMSTeamsAdapter, y as readAccessToken } from "./graph-users-9uQJepqr.js";
-import { convertMarkdownTables, normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, sleep } from "openclaw/plugin-sdk/text-runtime";
+import { L as getMSTeamsRuntime, O as resolveChannelMediaMaxBytes, _ as getFileExtension, b as loadOutboundMediaFromUrl, d as detectMime, h as extractOriginalFilename, m as extensionForMime, w as normalizeStringEntries } from "./runtime-api-D92XOrVf.js";
+import { C as loadMSTeamsSdkWithAuth, D as formatMSTeamsSendErrorHint, E as classifyMSTeamsSendError, O as formatUnknownError, S as createMSTeamsTokenProvider, _ as resolveMSTeamsStorePath, h as resolveMSTeamsCredentials, k as isRevokedProxyError, m as loadDelegatedTokens, w as buildUserAgent, x as createMSTeamsAdapter, y as readAccessToken } from "./graph-users-C9HaPg1v.js";
+import { a as resolveMSTeamsRouteConfig, i as resolveMSTeamsReplyPolicy } from "./policy-D32Kf1ED.js";
+import { createMessageReceiptFromOutboundResults } from "openclaw/plugin-sdk/channel-message";
+import { convertMarkdownTables, isRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, sleep } from "openclaw/plugin-sdk/text-runtime";
 import { withFileLock } from "openclaw/plugin-sdk/file-lock";
 import { resolveSendableOutboundReplyParts } from "openclaw/plugin-sdk/reply-payload";
 import { lookup } from "node:dns/promises";
-import fs from "node:fs";
+import { isPrivateIpAddress } from "openclaw/plugin-sdk/ssrf-policy";
 import path from "node:path";
+import { pathExists } from "openclaw/plugin-sdk/security-runtime";
 import { readJsonFileWithFallback, writeJsonFileAtomically } from "openclaw/plugin-sdk/json-store";
 import crypto from "node:crypto";
 import { resolveMarkdownTableMode } from "openclaw/plugin-sdk/markdown-table-runtime";
@@ -72,11 +75,7 @@ async function writeJsonFile(filePath, value) {
 	await writeJsonFileAtomically(filePath, value);
 }
 async function ensureJsonFile(filePath, fallback) {
-	try {
-		await fs.promises.access(filePath);
-	} catch {
-		await writeJsonFile(filePath, fallback);
-	}
+	if (!await pathExists(filePath)) await writeJsonFile(filePath, fallback);
 }
 async function withFileLock$1(filePath, fallback, fn) {
 	await ensureJsonFile(filePath, fallback);
@@ -182,14 +181,6 @@ function createMSTeamsConversationStoreFs(params) {
 const STORE_FILENAME$1 = "msteams-polls.json";
 const MAX_POLLS = 1e3;
 const POLL_TTL_MS = 720 * 60 * 60 * 1e3;
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function normalizeOptionalString$1(value) {
-	if (typeof value !== "string") return;
-	const trimmed = value.trim();
-	return trimmed ? trimmed : void 0;
-}
 function normalizeChoiceValue(value) {
 	if (typeof value === "string") {
 		const trimmed = value.trim();
@@ -214,7 +205,7 @@ function readNestedValue(value, keys) {
 	return current;
 }
 function readNestedString(value, keys) {
-	return normalizeOptionalString$1(readNestedValue(value, keys));
+	return normalizeOptionalString(readNestedValue(value, keys));
 }
 function extractMSTeamsPollVote(activity) {
 	const value = activity?.value;
@@ -395,9 +386,6 @@ function createMSTeamsPollStoreFs(params) {
 * - Building FileInfoCard attachments (to confirm upload completion)
 * - Parsing fileConsent/invoke activities
 */
-function normalizeLowercaseStringOrEmpty$1(value) {
-	return typeof value === "string" ? value.trim().toLowerCase() : "";
-}
 /**
 * Allowlist of domains that are valid targets for file consent uploads.
 * These are the Microsoft/SharePoint domains that Teams legitimately provides
@@ -418,31 +406,10 @@ const CONSENT_UPLOAD_HOST_ALLOWLIST = [
 	"graph.microsoft.cn"
 ];
 /**
-* Returns true if the given IPv4 or IPv6 address is in a private, loopback,
-* or link-local range that must never be reached via consent uploads.
+* Returns true if the given IPv4 or IPv6 address is private, internal, or
+* special-use and must never be reached via consent uploads.
 */
-function isPrivateOrReservedIP(ip) {
-	const ipv4MappedMatch = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(ip);
-	if (ipv4MappedMatch) return isPrivateOrReservedIP(ipv4MappedMatch[1]);
-	const v4Parts = ip.split(".");
-	if (v4Parts.length === 4) {
-		const octets = v4Parts.map(Number);
-		if (octets.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return false;
-		const [a, b] = octets;
-		if (a === 10) return true;
-		if (a === 172 && b >= 16 && b <= 31) return true;
-		if (a === 192 && b === 168) return true;
-		if (a === 127) return true;
-		if (a === 169 && b === 254) return true;
-		if (a === 0) return true;
-	}
-	const normalized = normalizeLowercaseStringOrEmpty$1(ip);
-	if (normalized === "::1") return true;
-	if (normalized.startsWith("fe80:") || normalized.startsWith("fe80")) return true;
-	if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true;
-	if (normalized === "::") return true;
-	return false;
-}
+const isPrivateOrReservedIP = isPrivateIpAddress;
 /**
 * Validate that a consent upload URL is safe to PUT to.
 * Checks:
@@ -460,7 +427,7 @@ async function validateConsentUploadUrl(url, opts) {
 		throw new Error("Consent upload URL is not a valid URL");
 	}
 	if (parsed.protocol !== "https:") throw new Error(`Consent upload URL must use HTTPS, got ${parsed.protocol}`);
-	const hostname = normalizeLowercaseStringOrEmpty$1(parsed.hostname);
+	const hostname = normalizeLowercaseStringOrEmpty(parsed.hostname);
 	if (!(opts?.allowlist ?? CONSENT_UPLOAD_HOST_ALLOWLIST).some((entry) => hostname === entry || hostname.endsWith(`.${entry}`))) throw new Error(`Consent upload URL hostname "${hostname}" is not in the allowed domains`);
 	const resolveFn = opts?.resolveFn ?? ((name) => lookup(name, { all: true }));
 	let resolved;
@@ -1554,7 +1521,7 @@ async function sendMSTeamsMessages(params) {
 	const resolvedThreadId = params.conversationRef.threadId ?? params.conversationRef.activityId;
 	if (params.replyStyle === "thread") {
 		const ctx = params.context;
-		if (!ctx) throw new Error("Missing context for replyStyle=thread");
+		if (!ctx) return await sendProactively(messages, 0, resolvedThreadId);
 		const messageIds = [];
 		for (const [idx, message] of messages.entries()) {
 			const result = await withRevokedProxyFallback({
@@ -1579,6 +1546,23 @@ async function sendMSTeamsMessages(params) {
 }
 //#endregion
 //#region extensions/msteams/src/send-context.ts
+function resolveMSTeamsProactiveReplyStyle(params) {
+	const threadRootId = params.ref.threadId ?? params.ref.activityId;
+	if (params.conversationType !== "channel" || !threadRootId) return "top-level";
+	const routeConfig = resolveMSTeamsRouteConfig({
+		cfg: params.cfg,
+		teamId: params.ref.teamId,
+		conversationId: params.conversationId,
+		allowNameMatching: false
+	});
+	const { replyStyle } = resolveMSTeamsReplyPolicy({
+		isDirectMessage: false,
+		globalConfig: params.cfg,
+		teamConfig: routeConfig.teamConfig,
+		channelConfig: routeConfig.channelConfig
+	});
+	return replyStyle;
+}
 /**
 * Parse the target value into a conversation reference lookup key.
 * Supported formats:
@@ -1646,6 +1630,12 @@ async function resolveMSTeamsSendContext(params) {
 	if (storedConversationType === "personal") conversationType = "personal";
 	else if (storedConversationType === "channel") conversationType = "channel";
 	else conversationType = "groupChat";
+	const replyStyle = resolveMSTeamsProactiveReplyStyle({
+		cfg: msteamsCfg,
+		conversationId,
+		ref,
+		conversationType
+	});
 	const sharePointSiteId = msteamsCfg.sharePointSiteId;
 	const mediaMaxBytes = resolveChannelMediaMaxBytes({
 		cfg: params.cfg,
@@ -1678,6 +1668,7 @@ async function resolveMSTeamsSendContext(params) {
 		adapter,
 		log,
 		conversationType,
+		replyStyle,
 		tokenProvider,
 		sharePointSiteId,
 		mediaMaxBytes,
@@ -1693,6 +1684,29 @@ const FILE_CONSENT_THRESHOLD_BYTES = 4 * 1024 * 1024;
 * Higher than the default because OneDrive upload handles large files well.
 */
 const MSTEAMS_MAX_MEDIA_BYTES = 100 * 1024 * 1024;
+function createMSTeamsSendReceipt(params) {
+	return createMessageReceiptFromOutboundResults({
+		kind: params.kind,
+		results: params.platformMessageIds.map((messageId) => ({
+			channel: "msteams",
+			messageId,
+			conversationId: params.conversationId
+		}))
+	});
+}
+function createMSTeamsSendResult(params) {
+	const platformMessageIds = (params.platformMessageIds?.length ? [...params.platformMessageIds] : [params.messageId]).map((messageId) => messageId.trim()).filter((messageId) => messageId && messageId !== "unknown");
+	return {
+		messageId: params.messageId,
+		conversationId: params.conversationId,
+		receipt: createMSTeamsSendReceipt({
+			conversationId: params.conversationId,
+			platformMessageIds,
+			kind: params.kind
+		}),
+		...params.pendingUploadId ? { pendingUploadId: params.pendingUploadId } : {}
+	};
+}
 /**
 * Send a message to a Teams conversation or user.
 *
@@ -1774,11 +1788,12 @@ async function sendMessageMSTeams(params) {
 				messageId,
 				uploadId
 			});
-			return {
+			return createMSTeamsSendResult({
 				messageId,
 				conversationId,
+				kind: "card",
 				pendingUploadId: uploadId
-			};
+			});
 		}
 		if (conversationType === "personal") {
 			const base64 = media.buffer.toString("base64");
@@ -1833,10 +1848,11 @@ async function sendMessageMSTeams(params) {
 					messageId,
 					fileName: driveItem.name
 				});
-				return {
+				return createMSTeamsSendResult({
 					messageId,
-					conversationId
-				};
+					conversationId,
+					kind: "media"
+				});
 			}
 			log.debug?.("uploading to OneDrive (no SharePoint site configured)", {
 				fileName,
@@ -1867,10 +1883,11 @@ async function sendMessageMSTeams(params) {
 				messageId,
 				shareUrl: uploaded.shareUrl
 			});
-			return {
+			return createMSTeamsSendResult({
 				messageId,
-				conversationId
-			};
+				conversationId,
+				kind: "media"
+			});
 		} catch (err) {
 			const classification = classifyMSTeamsSendError(err);
 			const hint = formatMSTeamsSendErrorHint(classification);
@@ -1884,11 +1901,11 @@ async function sendMessageMSTeams(params) {
 * Send a text message with optional base64 media URL.
 */
 async function sendTextWithMedia(ctx, text, mediaUrl) {
-	const { adapter, appId, conversationId, ref, log, tokenProvider, sharePointSiteId, mediaMaxBytes } = ctx;
-	let messageIds;
+	const { adapter, appId, conversationId, ref, log, tokenProvider, sharePointSiteId, mediaMaxBytes, replyStyle } = ctx;
+	let platformMessageIds;
 	try {
-		messageIds = await sendMSTeamsMessages({
-			replyStyle: "top-level",
+		platformMessageIds = await sendMSTeamsMessages({
+			replyStyle,
 			adapter,
 			appId,
 			conversationRef: ref,
@@ -1913,14 +1930,19 @@ async function sendTextWithMedia(ctx, text, mediaUrl) {
 		const status = classification.statusCode ? ` (HTTP ${classification.statusCode})` : "";
 		throw new Error(`msteams send failed${status}: ${formatUnknownError(err)}${hint ? ` (${hint})` : ""}`, { cause: err });
 	}
-	const messageId = messageIds[0] ?? "unknown";
+	const messageId = platformMessageIds[0] ?? "unknown";
 	log.info("sent proactive message", {
 		conversationId,
 		messageId
 	});
 	return {
 		messageId,
-		conversationId
+		conversationId,
+		receipt: createMSTeamsSendReceipt({
+			conversationId,
+			platformMessageIds,
+			kind: mediaUrl ? "media" : "text"
+		})
 	};
 }
 async function sendProactiveActivityRaw({ adapter, appId, ref, activity }) {

package/dist/{resolve-allowlist-D41JSziq.js → resolve-allowlist-C23ohQKQ.js}

@@ -1,4 +1,4 @@
-import { c as normalizeQuery, f as resolveGraphToken, o as listChannelsForTeam, s as listTeamsByName, t as searchGraphUsers } from "./graph-users-9uQJepqr.js";
+import { c as normalizeQuery, f as resolveGraphToken, o as listChannelsForTeam, s as listTeamsByName, t as searchGraphUsers } from "./graph-users-C9HaPg1v.js";
 import { mapAllowlistResolutionInputs } from "openclaw/plugin-sdk/allow-from";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/text-runtime";
 //#region extensions/msteams/src/resolve-allowlist.ts

package/dist/{runtime-api-DV1iVMn1.js → runtime-api-D92XOrVf.js}

@@ -1,9 +1,9 @@
 import { mergeAllowlist, resolveAllowlistMatchSimple, summarizeMapping } from "openclaw/plugin-sdk/allow-from";
+import { createChannelMessageReplyPipeline } from "openclaw/plugin-sdk/channel-message";
 import { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";
 import { evaluateSenderGroupAccessForPolicy, readStoreAllowFromForDmPolicy, resolveDmGroupAccessWithLists, resolveEffectiveAllowFromLists, resolveSenderScopedGroupPolicy, resolveToolsBySender } from "openclaw/plugin-sdk/channel-policy";
 import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
 import { logTypingFailure } from "openclaw/plugin-sdk/channel-logging";
-import { createChannelReplyPipeline } from "openclaw/plugin-sdk/channel-reply-pipeline";
 import { PAIRING_APPROVED_MESSAGE, buildProbeChannelStatusSummary, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/channel-status";
 import { buildChannelKeyCandidates, normalizeChannelSlug, resolveChannelEntryMatchWithFallback, resolveNestedAllowlistDecision } from "openclaw/plugin-sdk/channel-targets";
 import { isDangerousNameMatchingEnabled } from "openclaw/plugin-sdk/dangerous-name-runtime";
@@ -25,4 +25,4 @@ const { setRuntime: setMSTeamsRuntime, getRuntime: getMSTeamsRuntime, tryGetRunt
 	errorMessage: "MSTeams runtime not initialized"
 });
 //#endregion
-export { resolveDmGroupAccessWithLists as A, normalizeChannelSlug as C, resolveChannelEntryMatchWithFallback as D, resolveAllowlistMatchSimple as E, summarizeMapping as F, withFileLock$1 as I, getMSTeamsRuntime as L, resolveNestedAllowlistDecision as M, resolveSenderScopedGroupPolicy as N, resolveChannelMediaMaxBytes as O, resolveToolsBySender as P, getOptionalMSTeamsRuntime as R, mergeAllowlist as S, readStoreAllowFromForDmPolicy as T, getFileExtension as _, buildMediaPayload as a, loadOutboundMediaFromUrl as b, createChannelPairingController as c, detectMime as d, dispatchReplyFromConfigWithSettledDispatcher$1 as f, fetchWithSsrFGuard$1 as g, extractOriginalFilename as h, buildChannelKeyCandidates as i, resolveEffectiveAllowFromLists as j, resolveDefaultGroupPolicy as k, createChannelReplyPipeline as l, extensionForMime as m, DEFAULT_WEBHOOK_MAX_BODY_BYTES as n, buildProbeChannelStatusSummary as o, evaluateSenderGroupAccessForPolicy as p, PAIRING_APPROVED_MESSAGE as r, chunkTextForOutbound as s, DEFAULT_ACCOUNT_ID as t, createDefaultChannelRuntimeState as u, isDangerousNameMatchingEnabled as v, normalizeStringEntries as w, logTypingFailure as x, keepHttpServerTaskAlive as y, setMSTeamsRuntime as z };
+export { resolveDmGroupAccessWithLists as A, normalizeChannelSlug as C, resolveChannelEntryMatchWithFallback as D, resolveAllowlistMatchSimple as E, summarizeMapping as F, withFileLock$1 as I, getMSTeamsRuntime as L, resolveNestedAllowlistDecision as M, resolveSenderScopedGroupPolicy as N, resolveChannelMediaMaxBytes as O, resolveToolsBySender as P, getOptionalMSTeamsRuntime as R, mergeAllowlist as S, readStoreAllowFromForDmPolicy as T, getFileExtension as _, buildMediaPayload as a, loadOutboundMediaFromUrl as b, createChannelMessageReplyPipeline as c, detectMime as d, dispatchReplyFromConfigWithSettledDispatcher$1 as f, fetchWithSsrFGuard$1 as g, extractOriginalFilename as h, buildChannelKeyCandidates as i, resolveEffectiveAllowFromLists as j, resolveDefaultGroupPolicy as k, createChannelPairingController as l, extensionForMime as m, DEFAULT_WEBHOOK_MAX_BODY_BYTES as n, buildProbeChannelStatusSummary as o, evaluateSenderGroupAccessForPolicy as p, PAIRING_APPROVED_MESSAGE as r, chunkTextForOutbound as s, DEFAULT_ACCOUNT_ID as t, createDefaultChannelRuntimeState as u, isDangerousNameMatchingEnabled as v, normalizeStringEntries as w, logTypingFailure as x, keepHttpServerTaskAlive as y, setMSTeamsRuntime as z };

package/dist/runtime-api.js

@@ -1,2 +1,2 @@
-import { A as resolveDmGroupAccessWithLists, C as normalizeChannelSlug, D as resolveChannelEntryMatchWithFallback, E as resolveAllowlistMatchSimple, F as summarizeMapping, I as withFileLock, M as resolveNestedAllowlistDecision, N as resolveSenderScopedGroupPolicy, O as resolveChannelMediaMaxBytes, P as resolveToolsBySender, S as mergeAllowlist, T as readStoreAllowFromForDmPolicy, _ as getFileExtension, a as buildMediaPayload, b as loadOutboundMediaFromUrl, c as createChannelPairingController, d as detectMime, f as dispatchReplyFromConfigWithSettledDispatcher, g as fetchWithSsrFGuard, h as extractOriginalFilename, i as buildChannelKeyCandidates, j as resolveEffectiveAllowFromLists, k as resolveDefaultGroupPolicy, l as createChannelReplyPipeline, m as extensionForMime, n as DEFAULT_WEBHOOK_MAX_BODY_BYTES, o as buildProbeChannelStatusSummary, p as evaluateSenderGroupAccessForPolicy, r as PAIRING_APPROVED_MESSAGE, s as chunkTextForOutbound, t as DEFAULT_ACCOUNT_ID, u as createDefaultChannelRuntimeState, v as isDangerousNameMatchingEnabled, w as normalizeStringEntries, x as logTypingFailure, y as keepHttpServerTaskAlive, z as setMSTeamsRuntime } from "./runtime-api-DV1iVMn1.js";
-export { DEFAULT_ACCOUNT_ID, DEFAULT_WEBHOOK_MAX_BODY_BYTES, PAIRING_APPROVED_MESSAGE, buildChannelKeyCandidates, buildMediaPayload, buildProbeChannelStatusSummary, chunkTextForOutbound, createChannelPairingController, createChannelReplyPipeline, createDefaultChannelRuntimeState, detectMime, dispatchReplyFromConfigWithSettledDispatcher, evaluateSenderGroupAccessForPolicy, extensionForMime, extractOriginalFilename, fetchWithSsrFGuard, getFileExtension, isDangerousNameMatchingEnabled, keepHttpServerTaskAlive, loadOutboundMediaFromUrl, logTypingFailure, mergeAllowlist, normalizeChannelSlug, normalizeStringEntries, readStoreAllowFromForDmPolicy, resolveAllowlistMatchSimple, resolveChannelEntryMatchWithFallback, resolveChannelMediaMaxBytes, resolveDefaultGroupPolicy, resolveDmGroupAccessWithLists, resolveEffectiveAllowFromLists, resolveNestedAllowlistDecision, resolveSenderScopedGroupPolicy, resolveToolsBySender, setMSTeamsRuntime, summarizeMapping, withFileLock };
+import { A as resolveDmGroupAccessWithLists, C as normalizeChannelSlug, D as resolveChannelEntryMatchWithFallback, E as resolveAllowlistMatchSimple, F as summarizeMapping, I as withFileLock, M as resolveNestedAllowlistDecision, N as resolveSenderScopedGroupPolicy, O as resolveChannelMediaMaxBytes, P as resolveToolsBySender, S as mergeAllowlist, T as readStoreAllowFromForDmPolicy, _ as getFileExtension, a as buildMediaPayload, b as loadOutboundMediaFromUrl, c as createChannelMessageReplyPipeline, d as detectMime, f as dispatchReplyFromConfigWithSettledDispatcher, g as fetchWithSsrFGuard, h as extractOriginalFilename, i as buildChannelKeyCandidates, j as resolveEffectiveAllowFromLists, k as resolveDefaultGroupPolicy, l as createChannelPairingController, m as extensionForMime, n as DEFAULT_WEBHOOK_MAX_BODY_BYTES, o as buildProbeChannelStatusSummary, p as evaluateSenderGroupAccessForPolicy, r as PAIRING_APPROVED_MESSAGE, s as chunkTextForOutbound, t as DEFAULT_ACCOUNT_ID, u as createDefaultChannelRuntimeState, v as isDangerousNameMatchingEnabled, w as normalizeStringEntries, x as logTypingFailure, y as keepHttpServerTaskAlive, z as setMSTeamsRuntime } from "./runtime-api-D92XOrVf.js";
+export { DEFAULT_ACCOUNT_ID, DEFAULT_WEBHOOK_MAX_BODY_BYTES, PAIRING_APPROVED_MESSAGE, buildChannelKeyCandidates, buildMediaPayload, buildProbeChannelStatusSummary, chunkTextForOutbound, createChannelMessageReplyPipeline, createChannelPairingController, createDefaultChannelRuntimeState, detectMime, dispatchReplyFromConfigWithSettledDispatcher, evaluateSenderGroupAccessForPolicy, extensionForMime, extractOriginalFilename, fetchWithSsrFGuard, getFileExtension, isDangerousNameMatchingEnabled, keepHttpServerTaskAlive, loadOutboundMediaFromUrl, logTypingFailure, mergeAllowlist, normalizeChannelSlug, normalizeStringEntries, readStoreAllowFromForDmPolicy, resolveAllowlistMatchSimple, resolveChannelEntryMatchWithFallback, resolveChannelMediaMaxBytes, resolveDefaultGroupPolicy, resolveDmGroupAccessWithLists, resolveEffectiveAllowFromLists, resolveNestedAllowlistDecision, resolveSenderScopedGroupPolicy, resolveToolsBySender, setMSTeamsRuntime, summarizeMapping, withFileLock };

package/dist/setup-plugin-api.js

@@ -1,6 +1,6 @@
-import { h as resolveMSTeamsCredentials } from "./graph-users-9uQJepqr.js";
+import { h as resolveMSTeamsCredentials } from "./graph-users-C9HaPg1v.js";
 import { t as MSTeamsChannelConfigSchema } from "./config-schema-DwOEthCC.js";
-import { i as msteamsSetupAdapter, t as msteamsSetupWizard } from "./setup-surface-BLkFQYIQ.js";
+import { i as msteamsSetupAdapter, t as msteamsSetupWizard } from "./setup-surface-BeztPcxk.js";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { formatAllowFromLowercase } from "openclaw/plugin-sdk/allow-from";
 import { createTopLevelChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";

package/dist/{setup-surface-BLkFQYIQ.js → setup-surface-BeztPcxk.js}

@@ -1,5 +1,5 @@
-import { O as formatUnknownError, g as saveDelegatedTokens, h as resolveMSTeamsCredentials, p as hasConfiguredMSTeamsCredentials, v as normalizeSecretInputString } from "./graph-users-9uQJepqr.js";
-import { c as resolveMSTeamsUserAllowlist, o as parseMSTeamsTeamEntry, s as resolveMSTeamsChannelAllowlist } from "./resolve-allowlist-D41JSziq.js";
+import { O as formatUnknownError, g as saveDelegatedTokens, h as resolveMSTeamsCredentials, p as hasConfiguredMSTeamsCredentials, v as normalizeSecretInputString } from "./graph-users-C9HaPg1v.js";
+import { c as resolveMSTeamsUserAllowlist, o as parseMSTeamsTeamEntry, s as resolveMSTeamsChannelAllowlist } from "./resolve-allowlist-C23ohQKQ.js";
 import { DEFAULT_ACCOUNT_ID, createStandardChannelSetupStatus, createTopLevelChannelAllowFromSetter, createTopLevelChannelDmPolicy, createTopLevelChannelGroupPolicySetter, mergeAllowFromEntries, splitSetupEntries } from "openclaw/plugin-sdk/setup";
 import { formatDocsLink } from "openclaw/plugin-sdk/setup-tools";
 //#region extensions/msteams/src/setup-core.ts

package/dist/{src-CP7V_TeZ.js → src-CiKTGSje.js}

@@ -1,9 +1,10 @@
-import { A as resolveDmGroupAccessWithLists, F as summarizeMapping, L as getMSTeamsRuntime, N as resolveSenderScopedGroupPolicy, O as resolveChannelMediaMaxBytes, R as getOptionalMSTeamsRuntime, S as mergeAllowlist, T as readStoreAllowFromForDmPolicy, a as buildMediaPayload, c as createChannelPairingController, f as dispatchReplyFromConfigWithSettledDispatcher$1, j as resolveEffectiveAllowFromLists, k as resolveDefaultGroupPolicy, l as createChannelReplyPipeline, n as DEFAULT_WEBHOOK_MAX_BODY_BYTES, p as evaluateSenderGroupAccessForPolicy$1, t as DEFAULT_ACCOUNT_ID, v as isDangerousNameMatchingEnabled, x as logTypingFailure, y as keepHttpServerTaskAlive } from "./runtime-api-DV1iVMn1.js";
-import { A as ATTACHMENT_TAG_RE, B as isLikelyImageAttachment, C as loadMSTeamsSdkWithAuth, D as formatMSTeamsSendErrorHint, E as classifyMSTeamsSendError, F as estimateBase64DecodedBytes, G as resolveAttachmentFetchPolicy, H as isUrlAllowed, I as extractHtmlFromAttachment, J as safeFetchWithPolicy, K as resolveMediaSsrfPolicy, L as extractInlineImageCandidates, M as IMG_SRC_RE, N as applyAuthorizationHeaderForUrl, O as formatUnknownError, P as encodeGraphShareId, R as inferPlaceholder, S as createMSTeamsTokenProvider, T as ensureUserAgentHeader, U as normalizeContentType, V as isRecord, W as readNestedString, X as tryBuildGraphSharesUrlForSharedLink, Y as safeHostForUrl, _ as resolveMSTeamsStorePath, a as fetchGraphJson, b as createBotFrameworkJwtValidator, h as resolveMSTeamsCredentials, j as GRAPH_ROOT, q as resolveRequestUrl, w as buildUserAgent, x as createMSTeamsAdapter, z as isDownloadableAttachment } from "./graph-users-9uQJepqr.js";
-import { c as resolveMSTeamsUserAllowlist, s as resolveMSTeamsChannelAllowlist } from "./resolve-allowlist-D41JSziq.js";
-import { a as resolveMSTeamsRouteConfig, i as resolveMSTeamsReplyPolicy, n as resolveMSTeamsAllowlistMatch, t as isMSTeamsGroupAllowed } from "./policy-DTnU2GR7.js";
-import { C as readJsonFile, S as createMSTeamsConversationStoreFs, T as writeJsonFile, _ as buildFileInfoCard, b as createMSTeamsPollStoreFs, c as renderReplyPayloadsToMessages, d as withRevokedProxyFallback, f as resolveGraphChatId, g as removePendingUploadFs, h as getPendingUploadFs, l as sendMSTeamsMessages, m as removePendingUpload, p as getPendingUpload, s as buildConversationReference, u as AI_GENERATED_ENTITY, v as parseFileConsentInvoke, w as withFileLock, x as extractMSTeamsPollVote, y as uploadToConsentUrl } from "./probe-D_H8yFps.js";
+import { A as resolveDmGroupAccessWithLists, F as summarizeMapping, L as getMSTeamsRuntime, N as resolveSenderScopedGroupPolicy, O as resolveChannelMediaMaxBytes, R as getOptionalMSTeamsRuntime, S as mergeAllowlist, T as readStoreAllowFromForDmPolicy, a as buildMediaPayload, c as createChannelMessageReplyPipeline, f as dispatchReplyFromConfigWithSettledDispatcher$1, j as resolveEffectiveAllowFromLists, k as resolveDefaultGroupPolicy, l as createChannelPairingController, n as DEFAULT_WEBHOOK_MAX_BODY_BYTES, p as evaluateSenderGroupAccessForPolicy$1, t as DEFAULT_ACCOUNT_ID, v as isDangerousNameMatchingEnabled, x as logTypingFailure, y as keepHttpServerTaskAlive } from "./runtime-api-D92XOrVf.js";
+import { A as ATTACHMENT_TAG_RE, B as isLikelyImageAttachment, C as loadMSTeamsSdkWithAuth, D as formatMSTeamsSendErrorHint, E as classifyMSTeamsSendError, F as estimateBase64DecodedBytes, G as resolveAttachmentFetchPolicy, H as isUrlAllowed, I as extractHtmlFromAttachment, J as safeFetchWithPolicy, K as resolveMediaSsrfPolicy, L as extractInlineImageCandidates, M as IMG_SRC_RE, N as applyAuthorizationHeaderForUrl, O as formatUnknownError, P as encodeGraphShareId, R as inferPlaceholder, S as createMSTeamsTokenProvider, T as ensureUserAgentHeader, U as normalizeContentType, V as isRecord$1, W as readNestedString, X as tryBuildGraphSharesUrlForSharedLink, Y as safeHostForUrl, _ as resolveMSTeamsStorePath, a as fetchGraphJson, b as createBotFrameworkJwtValidator, h as resolveMSTeamsCredentials, j as GRAPH_ROOT, q as resolveRequestUrl, w as buildUserAgent, x as createMSTeamsAdapter, z as isDownloadableAttachment } from "./graph-users-C9HaPg1v.js";
+import { c as resolveMSTeamsUserAllowlist, s as resolveMSTeamsChannelAllowlist } from "./resolve-allowlist-C23ohQKQ.js";
+import { a as resolveMSTeamsRouteConfig, i as resolveMSTeamsReplyPolicy, n as resolveMSTeamsAllowlistMatch, t as isMSTeamsGroupAllowed } from "./policy-D32Kf1ED.js";
+import { C as readJsonFile, S as createMSTeamsConversationStoreFs, T as writeJsonFile, _ as buildFileInfoCard, b as createMSTeamsPollStoreFs, c as renderReplyPayloadsToMessages, d as withRevokedProxyFallback, f as resolveGraphChatId, g as removePendingUploadFs, h as getPendingUploadFs, l as sendMSTeamsMessages, m as removePendingUpload, p as getPendingUpload, s as buildConversationReference, u as AI_GENERATED_ENTITY, v as parseFileConsentInvoke, w as withFileLock, x as extractMSTeamsPollVote, y as uploadToConsentUrl } from "./probe-Bs955MJZ.js";
 import { formatAllowlistMatchMeta } from "openclaw/plugin-sdk/allow-from";
+import { createLiveMessageState, createPreviewMessageReceipt, defineFinalizableLivePreviewAdapter, deliverWithFinalizableLivePreviewAdapter, markLiveMessageFinalized } from "openclaw/plugin-sdk/channel-message";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, readStringValue } from "openclaw/plugin-sdk/text-runtime";
 import { createDraftStreamLoop } from "openclaw/plugin-sdk/channel-lifecycle";
 import { readResponseWithLimit } from "openclaw/plugin-sdk/media-runtime";
@@ -11,14 +12,16 @@ import { dispatchReplyFromConfigWithSettledDispatcher, hasFinalInboundReplyDispa
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 import { Buffer as Buffer$1 } from "node:buffer";
 import path from "node:path";
-import fs from "node:fs/promises";
+import { appendRegularFile } from "openclaw/plugin-sdk/security-runtime";
+import { writeJsonFileAtomically } from "openclaw/plugin-sdk/json-store";
 import { resolveThreadSessionKeys } from "openclaw/plugin-sdk/routing";
+import fs from "node:fs/promises";
 import { logInboundDrop, resolveInboundMentionDecision, resolveInboundSessionEnvelopeContext } from "openclaw/plugin-sdk/channel-inbound";
 import { resolveDualTextControlCommandGate } from "openclaw/plugin-sdk/command-gating";
 import { filterSupplementalContextItems, resolveChannelContextVisibilityMode, shouldIncludeSupplementalContext } from "openclaw/plugin-sdk/context-visibility-runtime";
 import { evaluateSenderGroupAccessForPolicy } from "openclaw/plugin-sdk/group-access";
 import { DEFAULT_GROUP_HISTORY_LIMIT, buildPendingHistoryContextFromMap, recordPendingHistoryEntryIfEnabled } from "openclaw/plugin-sdk/reply-history";
-import { createChannelProgressDraftGate, formatChannelProgressDraftLine, formatChannelProgressDraftLineForEntry, formatChannelProgressDraftText, isChannelProgressDraftWorkToolName, resolveChannelPreviewStreamMode, resolveChannelProgressDraftMaxLines, resolveChannelStreamingBlockEnabled, resolveChannelStreamingPreviewToolProgress } from "openclaw/plugin-sdk/channel-streaming";
+import { buildChannelProgressDraftLine, buildChannelProgressDraftLineForEntry, createChannelProgressDraftGate, formatChannelProgressDraftText, isChannelProgressDraftWorkToolName, resolveChannelPreviewStreamMode, resolveChannelProgressDraftMaxLines, resolveChannelStreamingBlockEnabled, resolveChannelStreamingPreviewToolProgress } from "openclaw/plugin-sdk/channel-streaming";
 //#region extensions/msteams/src/feedback-reflection-prompt.ts
 /** Max chars of the thumbed-down response to include in the reflection prompt. */
 const MAX_RESPONSE_CHARS = 500;
@@ -126,8 +129,7 @@ async function storeSessionLearning(params) {
 	let learnings = exists ? existingLearnings : legacyLearnings;
 	learnings.push(params.learning);
 	if (learnings.length > 10) learnings = learnings.slice(-10);
-	await fs.mkdir(path.dirname(learningsFile), { recursive: true });
-	await fs.writeFile(learningsFile, JSON.stringify(learnings, null, 2), "utf-8");
+	await writeJsonFileAtomically(learningsFile, learnings);
 	if (!exists && legacyLearningsFile !== learningsFile) await fs.rm(legacyLearningsFile, { force: true }).catch(() => void 0);
 }
 //#endregion
@@ -842,7 +844,7 @@ function resolveDownloadCandidate(att) {
 	const contentType = normalizeContentType(att.contentType);
 	const name = normalizeOptionalString(att.name) ?? "";
 	if (contentType === "application/vnd.microsoft.teams.file.download.info") {
-		if (!isRecord(att.content)) return null;
+		if (!isRecord$1(att.content)) return null;
 		const downloadUrl = normalizeOptionalString(att.content.downloadUrl) ?? "";
 		if (!downloadUrl) return null;
 		const fileType = normalizeOptionalString(att.content.fileType) ?? "";
@@ -1612,6 +1614,7 @@ var TeamsHttpStream = class {
 		this.finalized = false;
 		this.streamFailed = false;
 		this.lastStreamedText = "";
+		this.finalMessageId = void 0;
 		this.streamStartedAt = void 0;
 		this.sendActivity = options.sendActivity;
 		this.feedbackLoopEnabled = options.feedbackLoopEnabled ?? false;
@@ -1678,22 +1681,23 @@ var TeamsHttpStream = class {
 	* Finalize the stream — send the final message activity.
 	*/
 	async finalize() {
-		if (this.finalized) return;
+		if (this.finalized) return this.finalMessageId;
 		this.finalized = true;
 		this.stopped = true;
 		this.loop.stop();
 		await this.loop.waitForInFlight();
-		if (!this.accumulatedText.trim()) return;
+		if (!this.accumulatedText.trim()) return this.finalMessageId;
 		if (this.streamFailed) {
 			if (this.streamId) try {
-				await this.sendActivity({
+				const response = await this.sendActivity({
 					type: "message",
 					text: this.lastStreamedText || "",
 					channelData: { feedbackLoopEnabled: this.feedbackLoopEnabled },
 					entities: [AI_GENERATED_ENTITY, buildStreamInfoEntity(this.streamId, "final")]
 				});
+				this.finalMessageId = extractId(response);
 			} catch {}
-			return;
+			return this.finalMessageId;
 		}
 		try {
 			const entities = [AI_GENERATED_ENTITY];
@@ -1704,11 +1708,13 @@ var TeamsHttpStream = class {
 				channelData: { feedbackLoopEnabled: this.feedbackLoopEnabled },
 				entities
 			};
-			await this.sendActivity(finalActivity);
+			const response = await this.sendActivity(finalActivity);
+			this.finalMessageId = extractId(response);
 		} catch (err) {
 			this.streamFailed = true;
 			this.onError?.(err);
 		}
+		return this.finalMessageId;
 	}
 	/** Whether streaming successfully delivered content (at least one chunk sent, not failed). */
 	get hasContent() {
@@ -1726,6 +1732,14 @@ var TeamsHttpStream = class {
 	get isFinalized() {
 		return this.finalized;
 	}
+	/** Platform id returned by the final message activity, when available. */
+	get messageId() {
+		return this.finalMessageId;
+	}
+	/** Stream id returned by the first streaminfo activity, when available. */
+	get previewStreamId() {
+		return this.streamId;
+	}
 	/** Whether streaming fell back (not used in this implementation). */
 	get isFallback() {
 		return false;
@@ -1781,6 +1795,13 @@ function createTeamsReplyStreamController(params) {
 	let progressLines = [];
 	let lastInformativeText = "";
 	let pendingFinalize;
+	let liveState = createLiveMessageState({ canFinalizeInPlace: Boolean(stream) });
+	const markStreamFinalized = () => {
+		if (!stream || stream.isFailed) return;
+		const messageId = stream.messageId ?? stream.previewStreamId;
+		if (!messageId) return;
+		liveState = markLiveMessageFinalized(liveState, createPreviewMessageReceipt({ id: messageId }));
+	};
 	const renderInformativeUpdate = async () => {
 		if (!stream) return;
 		const informativeText = formatChannelProgressDraftText({
@@ -1806,9 +1827,12 @@ function createTeamsReplyStreamController(params) {
 		if (!stream || streamMode !== "progress") return;
 		if (options?.toolName !== void 0 && !isChannelProgressDraftWorkToolName(options.toolName)) return;
 		if (shouldStreamPreviewToolProgress) {
-			const normalized = line?.replace(/\s+/g, " ").trim();
+			const normalized = normalizeProgressLineIdentity(line);
 			if (normalized) {
-				if (progressLines.at(-1) !== normalized) progressLines = [...progressLines, normalized].slice(-resolveChannelProgressDraftMaxLines(params.msteamsConfig));
+				if (normalizeProgressLineIdentity(progressLines.at(-1)) !== normalized) {
+					const progressLine = typeof line === "object" && line !== void 0 ? line : normalized;
+					progressLines = [...progressLines, progressLine].slice(-resolveChannelProgressDraftMaxLines(params.msteamsConfig));
+				}
 			}
 		}
 		await noteProgressWork();
@@ -1827,6 +1851,39 @@ function createTeamsReplyStreamController(params) {
 			text: remainingText
 		};
 	};
+	const finalizeProgressPayload = async (payload, hasMedia) => {
+		if (!stream || !payload.text) return payload;
+		return (await deliverWithFinalizableLivePreviewAdapter({
+			kind: "final",
+			payload,
+			liveState,
+			adapter: defineFinalizableLivePreviewAdapter({
+				draft: {
+					flush: async () => {},
+					clear: async () => {},
+					id: () => stream.previewStreamId
+				},
+				buildFinalEdit: (candidate) => candidate.text ? { text: candidate.text } : void 0,
+				editFinal: async (_previewId, edit) => {
+					const finalized = await stream.replaceInformativeWithFinal(edit.text);
+					informativeUpdateSent = false;
+					if (!finalized || stream.isFailed) throw new Error("Teams progress stream finalization failed");
+				},
+				resolveFinalizedId: (previewId) => stream.messageId ?? stream.previewStreamId ?? previewId,
+				createPreviewReceipt: (id) => createPreviewMessageReceipt({ id }),
+				onPreviewFinalized: (_id, _receipt, state) => {
+					liveState = state;
+				},
+				logPreviewEditFailure: (err) => {
+					params.log.debug?.(`stream finalization failed: ${formatUnknownError(err)}`);
+				}
+			}),
+			deliverNormally: async () => false
+		})).kind === "preview-finalized" ? hasMedia ? {
+			...payload,
+			text: void 0
+		} : void 0 : payload;
+	};
 	return {
 		async onReplyStart() {},
 		async noteProgressWork(options) {
@@ -1851,13 +1908,7 @@ function createTeamsReplyStreamController(params) {
 			const hasMedia = Boolean(payload.mediaUrl || payload.mediaUrls?.length);
 			if (stream && streamMode === "progress" && informativeUpdateSent && !stream.isFinalized) {
 				if (!payload.text) return payload;
-				const finalized = await stream.replaceInformativeWithFinal(payload.text);
-				informativeUpdateSent = false;
-				if (!finalized || stream.isFailed) return payload;
-				return hasMedia ? {
-					...payload,
-					text: void 0
-				} : void 0;
+				return await finalizeProgressPayload(payload, hasMedia);
 			}
 			if (!stream || !streamReceivedTokens) return payload;
 			if (stream.isFailed) {
@@ -1866,7 +1917,9 @@ function createTeamsReplyStreamController(params) {
 			}
 			if (!stream.hasContent || stream.isFinalized) return payload;
 			streamReceivedTokens = false;
-			pendingFinalize = stream.finalize();
+			pendingFinalize = stream.finalize().then(() => {
+				markStreamFinalized();
+			});
 			if (!hasMedia) return;
 			return {
 				...payload,
@@ -1876,11 +1929,17 @@ function createTeamsReplyStreamController(params) {
 		async finalize() {
 			progressDraftGate.cancel();
 			await pendingFinalize;
-			await stream?.finalize();
+			if (!pendingFinalize) {
+				await stream?.finalize();
+				markStreamFinalized();
+			}
 		},
 		hasStream() {
 			return Boolean(stream);
 		},
+		liveState() {
+			return liveState;
+		},
 		/**
 		* Whether the Teams streaming card is currently receiving LLM tokens.
 		* Used to gate side-channel keepalive activity so we don't overlay plain
@@ -1905,6 +1964,9 @@ function createTeamsReplyStreamController(params) {
 		}
 	};
 }
+function normalizeProgressLineIdentity(line) {
+	return (typeof line === "string" ? line : line?.text)?.replace(/\s+/g, " ").trim() ?? "";
+}
 //#endregion
 //#region extensions/msteams/src/reply-dispatcher.ts
 function createMSTeamsReplyDispatcher(params) {
@@ -1952,7 +2014,7 @@ function createMSTeamsReplyDispatcher(params) {
 		if (streamActiveRef.current()) return;
 		await rawSendTypingIndicator();
 	} : async () => {};
-	const { onModelSelected, typingCallbacks, ...replyPipeline } = createChannelReplyPipeline({
+	const { onModelSelected, typingCallbacks, ...replyPipeline } = createChannelMessageReplyPipeline({
 		cfg: params.cfg,
 		agentId: params.agentId,
 		channel: "msteams",
@@ -2145,7 +2207,7 @@ function createMSTeamsReplyDispatcher(params) {
 			...streamController.shouldSuppressDefaultToolProgressMessages() ? { suppressDefaultToolProgressMessages: true } : {},
 			...streamController.shouldStreamPreviewToolProgress() ? {
 				onToolStart: async (payload) => {
-					await streamController.pushProgressLine(formatChannelProgressDraftLineForEntry(msteamsCfg, {
+					await streamController.pushProgressLine(buildChannelProgressDraftLineForEntry(msteamsCfg, {
 						event: "tool",
 						name: payload.name,
 						phase: payload.phase,
@@ -2153,7 +2215,7 @@ function createMSTeamsReplyDispatcher(params) {
 					}, payload.detailMode ? { detailMode: payload.detailMode } : void 0), { toolName: payload.name });
 				},
 				onItemEvent: async (payload) => {
-					await streamController.pushProgressLine(formatChannelProgressDraftLineForEntry(msteamsCfg, {
+					await streamController.pushProgressLine(buildChannelProgressDraftLineForEntry(msteamsCfg, {
 						event: "item",
 						itemKind: payload.kind,
 						title: payload.title,
@@ -2167,7 +2229,7 @@ function createMSTeamsReplyDispatcher(params) {
 				},
 				onPlanUpdate: async (payload) => {
 					if (payload.phase !== "update") return;
-					await streamController.pushProgressLine(formatChannelProgressDraftLine({
+					await streamController.pushProgressLine(buildChannelProgressDraftLine({
 						event: "plan",
 						phase: payload.phase,
 						title: payload.title,
@@ -2177,7 +2239,7 @@ function createMSTeamsReplyDispatcher(params) {
 				},
 				onApprovalEvent: async (payload) => {
 					if (payload.phase !== "requested") return;
-					await streamController.pushProgressLine(formatChannelProgressDraftLine({
+					await streamController.pushProgressLine(buildChannelProgressDraftLine({
 						event: "approval",
 						phase: payload.phase,
 						title: payload.title,
@@ -2188,7 +2250,7 @@ function createMSTeamsReplyDispatcher(params) {
 				},
 				onCommandOutput: async (payload) => {
 					if (payload.phase !== "end") return;
-					await streamController.pushProgressLine(formatChannelProgressDraftLine({
+					await streamController.pushProgressLine(buildChannelProgressDraftLine({
 						event: "command-output",
 						phase: payload.phase,
 						title: payload.title,
@@ -2199,7 +2261,7 @@ function createMSTeamsReplyDispatcher(params) {
 				},
 				onPatchSummary: async (payload) => {
 					if (payload.phase !== "end") return;
-					await streamController.pushProgressLine(formatChannelProgressDraftLine({
+					await streamController.pushProgressLine(buildChannelProgressDraftLine({
 						event: "patch",
 						phase: payload.phase,
 						title: payload.title,
@@ -2430,7 +2492,7 @@ function extractTextFromHtmlAttachments(attachments) {
 	for (const attachment of attachments) {
 		if (attachment.contentType !== "text/html") continue;
 		const content = attachment.content;
-		const raw = typeof content === "string" ? content : isRecord(content) && typeof content.text === "string" ? content.text : isRecord(content) && typeof content.body === "string" ? content.body : "";
+		const raw = typeof content === "string" ? content : isRecord$1(content) && typeof content.text === "string" ? content.text : isRecord$1(content) && typeof content.body === "string" ? content.body : "";
 		if (!raw) continue;
 		const text = raw.replace(/<at[^>]*>.*?<\/at>/gis, " ").replace(/<a\b[^>]*href=["']([^"']+)["'][^>]*>(.*?)<\/a>/gis, "$2 $1").replace(/<br\s*\/?>/gi, "\n").replace(/<\/p>/gi, "\n").replace(/<[^>]+>/g, " ").replace(/&nbsp;/gi, " ").replace(/&amp;/gi, "&").replace(/\s+/g, " ").trim();
 		if (text) return text;
@@ -3021,7 +3083,7 @@ function createMSTeamsMessageHandler(deps) {
 			logVerboseMessage(`msteams: delivered ${finalCount} reply${finalCount === 1 ? "" : "ies"} to ${teamsTo}`);
 		} catch (err) {
 			log.error("dispatch failed", { error: formatUnknownError(err) });
-			runtime.error?.(`msteams dispatch failed: ${formatUnknownError(err)}`);
+			runtime.error(`msteams dispatch failed: ${formatUnknownError(err)}`);
 			try {
 				await context.sendActivity("⚠️ Something went wrong. Please try again.");
 			} catch {}
@@ -3062,7 +3124,7 @@ function createMSTeamsMessageHandler(deps) {
 			});
 		},
 		onError: (err) => {
-			runtime.error?.(`msteams debounce flush failed: ${formatUnknownError(err)}`);
+			runtime.error(`msteams debounce flush failed: ${formatUnknownError(err)}`);
 		}
 	});
 	return async function handleTeamsMessage(context) {
@@ -3603,8 +3665,11 @@ async function handleFeedbackInvoke(context, deps) {
 	try {
 		const storePath = core.channel.session.resolveStorePath(deps.cfg.session?.store, { agentId: route.agentId });
 		const safeKey = route.sessionKey.replace(/[^a-zA-Z0-9_-]/g, "_");
-		const transcriptFile = path.join(storePath, `${safeKey}.jsonl`);
-		await fs.appendFile(transcriptFile, JSON.stringify(feedbackEvent) + "\n", "utf-8").catch(() => {});
+		await appendRegularFile({
+			filePath: path.join(storePath, `${safeKey}.jsonl`),
+			content: `${JSON.stringify(feedbackEvent)}\n`,
+			rejectSymlinkParents: true
+		}).catch(() => {});
 	} catch {}
 	const conversationRef = {
 		activityId: activity.id,
@@ -3744,7 +3809,7 @@ function registerMSTeamsHandlers(handler, deps) {
 		try {
 			await handleTeamsMessage(context);
 		} catch (err) {
-			deps.runtime.error?.(`msteams handler failed: ${formatUnknownError(err)}`);
+			deps.runtime.error(`msteams handler failed: ${formatUnknownError(err)}`);
 		}
 		await next();
 	});
@@ -3788,7 +3853,7 @@ function registerMSTeamsHandlers(handler, deps) {
 		try {
 			await handleReaction(context, "added");
 		} catch (err) {
-			deps.runtime.error?.(`msteams reaction handler failed: ${String(err)}`);
+			deps.runtime.error(`msteams reaction handler failed: ${String(err)}`);
 		}
 		await next();
 	});
@@ -3796,7 +3861,7 @@ function registerMSTeamsHandlers(handler, deps) {
 		try {
 			await handleReaction(context, "removed");
 		} catch (err) {
-			deps.runtime.error?.(`msteams reaction handler failed: ${String(err)}`);
+			deps.runtime.error(`msteams reaction handler failed: ${String(err)}`);
 		}
 		await next();
 	});
@@ -3941,7 +4006,17 @@ async function monitorMSTeamsProvider(opts) {
 	let allowFrom = msteamsCfg.allowFrom;
 	let groupAllowFrom = msteamsCfg.groupAllowFrom;
 	let teamsConfig = msteamsCfg.teams;
+	const allowNameMatching = isDangerousNameMatchingEnabled(msteamsCfg);
 	const cleanAllowEntry = (entry) => entry.replace(/^(msteams|teams):/i, "").replace(/^user:/i, "").trim();
+	const isStableUserId = (entry) => /^[0-9a-fA-F-]{16,}$/.test(entry);
+	const cleanAllowEntries = (entries) => entries?.map((entry) => cleanAllowEntry(entry)).filter((entry) => entry && entry !== "*") ?? [];
+	const mergeStableUserIds = (entries) => {
+		const additions = cleanAllowEntries(entries).filter((entry) => isStableUserId(entry));
+		return additions.length > 0 ? mergeAllowlist({
+			existing: entries,
+			additions
+		}) : entries;
+	};
 	const resolveAllowlistUsers = async (label, entries) => {
 		if (entries.length === 0) return {
 			additions: [],
@@ -3962,23 +4037,27 @@ async function monitorMSTeamsProvider(opts) {
 		};
 	};
 	try {
-		const allowEntries = allowFrom?.map((entry) => cleanAllowEntry(entry)).filter((entry) => entry && entry !== "*") ?? [];
-		if (allowEntries.length > 0) {
-			const { additions } = await resolveAllowlistUsers("msteams users", allowEntries);
-			allowFrom = mergeAllowlist({
-				existing: allowFrom,
-				additions
-			});
-		}
-		if (Array.isArray(groupAllowFrom) && groupAllowFrom.length > 0) {
-			const groupEntries = groupAllowFrom.map((entry) => cleanAllowEntry(entry)).filter((entry) => entry && entry !== "*");
-			if (groupEntries.length > 0) {
-				const { additions } = await resolveAllowlistUsers("msteams group users", groupEntries);
-				groupAllowFrom = mergeAllowlist({
-					existing: groupAllowFrom,
+		allowFrom = mergeStableUserIds(allowFrom);
+		if (Array.isArray(groupAllowFrom) && groupAllowFrom.length > 0) groupAllowFrom = mergeStableUserIds(groupAllowFrom);
+		if (allowNameMatching) {
+			const allowEntries = cleanAllowEntries(allowFrom).filter((entry) => !isStableUserId(entry));
+			if (allowEntries.length > 0) {
+				const { additions } = await resolveAllowlistUsers("msteams users", allowEntries);
+				allowFrom = mergeAllowlist({
+					existing: allowFrom,
 					additions
 				});
 			}
+			if (Array.isArray(groupAllowFrom) && groupAllowFrom.length > 0) {
+				const groupEntries = cleanAllowEntries(groupAllowFrom).filter((entry) => !isStableUserId(entry));
+				if (groupEntries.length > 0) {
+					const { additions } = await resolveAllowlistUsers("msteams group users", groupEntries);
+					groupAllowFrom = mergeAllowlist({
+						existing: groupAllowFrom,
+						additions
+					});
+				}
+			}
 		}
 		if (teamsConfig && Object.keys(teamsConfig).length > 0) {
 			const entries = [];
@@ -4046,7 +4125,7 @@ async function monitorMSTeamsProvider(opts) {
 			}
 		}
 	} catch (err) {
-		runtime.log?.(`msteams resolve failed; using config entries. ${formatUnknownError(err)}`);
+		runtime?.error(`msteams resolve failed; falling back to raw config entries — allowlist members resolved via Graph may be missing. ${formatUnknownError(err)}`);
 	}
 	msteamsCfg = {
 		...msteamsCfg,
@@ -4116,7 +4195,8 @@ async function monitorMSTeamsProvider(opts) {
 			}
 			next();
 		}).catch((err) => {
-			log.debug?.(`JWT validation error: ${formatUnknownError(err)}`);
+			if (err instanceof Error && /ECONNREFUSED|ENOTFOUND|EHOSTUNREACH|ETIMEDOUT|ECONNRESET/i.test(err.code ?? err.message)) runtime?.error(`msteams: JWKS key fetch failed — check egress to login.botframework.com:443 (firewall or DNS may be blocking it). Bot will 401 all inbound requests until this is resolved. Error: ${formatUnknownError(err)}`);
+			else log.debug?.(`JWT validation error: ${formatUnknownError(err)}`);
 			res.status(401).json({ error: "Unauthorized" });
 		});
 	});

package/dist/test-api.js

@@ -1,2 +1,2 @@
-import { t as msteamsPlugin } from "./channel-BOwKBAvY.js";
+import { t as msteamsPlugin } from "./channel-VjDbklu8.js";
 export { msteamsPlugin };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/msteams",
-  "version": "2026.5.7-beta.1",
+  "version": "2026.5.9-beta.1",
   "description": "OpenClaw Microsoft Teams channel plugin",
   "repository": {
     "type": "git",
@@ -9,12 +9,12 @@
   "type": "module",
   "dependencies": {
     "@azure/identity": "4.13.1",
-    "@microsoft/teams.api": "2.0.9",
-    "@microsoft/teams.apps": "2.0.9",
+    "@microsoft/teams.api": "2.0.10",
+    "@microsoft/teams.apps": "2.0.10",
     "express": "5.2.1",
     "jsonwebtoken": "9.0.3",
     "jwks-rsa": "4.0.1",
-    "typebox": "1.1.37"
+    "typebox": "1.1.38"
   },
   "devDependencies": {
     "@openclaw/plugin-sdk": "workspace:*",
@@ -22,7 +22,7 @@
     "openclaw": "workspace:*"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.5.7-beta.1"
+    "openclaw": ">=2026.5.9-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -58,10 +58,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.5.7-beta.1"
+      "pluginApi": ">=2026.5.9-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.5.7-beta.1"
+      "openclawVersion": "2026.5.9-beta.1"
     },
     "release": {
       "publishToClawHub": true,