@openclaw/msteams 2026.5.9-beta.1 → 2026.5.10-beta.2

package/dist/api.js

@@ -1,3 +1,3 @@
-import { t as msteamsPlugin } from "./channel-VjDbklu8.js";
-import { i as msteamsSetupAdapter, n as openDelegatedOAuthUrl, r as createMSTeamsSetupWizardBase, t as msteamsSetupWizard } from "./setup-surface-BeztPcxk.js";
+import { t as msteamsPlugin } from "./channel-kz4Rzh2w.js";
+import { i as msteamsSetupAdapter, n as openDelegatedOAuthUrl, r as createMSTeamsSetupWizardBase, t as msteamsSetupWizard } from "./setup-surface-C7d0jGM5.js";
 export { createMSTeamsSetupWizardBase, msteamsPlugin, msteamsSetupAdapter, msteamsSetupWizard, openDelegatedOAuthUrl };

package/dist/{channel-VjDbklu8.js → channel-kz4Rzh2w.js}

@@ -1,9 +1,9 @@
-import { o as buildProbeChannelStatusSummary, r as PAIRING_APPROVED_MESSAGE, s as chunkTextForOutbound, t as DEFAULT_ACCOUNT_ID, u as createDefaultChannelRuntimeState } from "./runtime-api-D92XOrVf.js";
-import { h as resolveMSTeamsCredentials } from "./graph-users-C9HaPg1v.js";
-import { a as parseMSTeamsTeamChannelInput, c as resolveMSTeamsUserAllowlist, i as parseMSTeamsConversationId, n as normalizeMSTeamsMessagingTarget, r as normalizeMSTeamsUserInput, s as resolveMSTeamsChannelAllowlist, t as looksLikeMSTeamsTargetId } from "./resolve-allowlist-C23ohQKQ.js";
+import { o as buildProbeChannelStatusSummary, r as PAIRING_APPROVED_MESSAGE, s as chunkTextForOutbound, t as DEFAULT_ACCOUNT_ID, u as createDefaultChannelRuntimeState } from "./runtime-api-C3EIaIpt.js";
+import { h as resolveMSTeamsCredentials } from "./graph-users-CCU0WVMZ.js";
+import { a as parseMSTeamsTeamChannelInput, c as resolveMSTeamsUserAllowlist, i as parseMSTeamsConversationId, n as normalizeMSTeamsMessagingTarget, r as normalizeMSTeamsUserInput, s as resolveMSTeamsChannelAllowlist, t as looksLikeMSTeamsTargetId } from "./resolve-allowlist-7CHP2hEA.js";
 import { t as MSTeamsChannelConfigSchema } from "./config-schema-DwOEthCC.js";
-import { r as resolveMSTeamsGroupToolPolicy } from "./policy-D32Kf1ED.js";
-import { i as msteamsSetupAdapter, t as msteamsSetupWizard } from "./setup-surface-BeztPcxk.js";
+import { n as resolveMSTeamsGroupToolPolicy } from "./policy-bM71GXRd.js";
+import { i as msteamsSetupAdapter, t as msteamsSetupWizard } from "./setup-surface-C7d0jGM5.js";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { formatAllowFromLowercase } from "openclaw/plugin-sdk/allow-from";
 import { createTopLevelChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
@@ -183,7 +183,7 @@ const collectMSTeamsSecurityWarnings = createAllowlistProviderGroupPolicyWarning
 	resolveGroupPolicy: ({ cfg }) => cfg.channels?.msteams?.groupPolicy,
 	collect: ({ groupPolicy }) => groupPolicy === "open" ? ["- MS Teams groups: groupPolicy=\"open\" allows any member to trigger (mention-gated). Set channels.msteams.groupPolicy=\"allowlist\" + channels.msteams.groupAllowFrom to restrict senders."] : []
 });
-const loadMSTeamsChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-VrE9r2nS.js"), "msTeamsChannelRuntime");
+const loadMSTeamsChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-C1IGCVBT.js"), "msTeamsChannelRuntime");
 const resolveMSTeamsChannelConfig = (cfg) => ({
 	allowFrom: cfg.channels?.msteams?.allowFrom,
 	defaultTo: cfg.channels?.msteams?.defaultTo
@@ -965,7 +965,7 @@ const msteamsPlugin = createChatChannelPlugin({
 			})
 		}),
 		gateway: { startAccount: async (ctx) => {
-			const { monitorMSTeamsProvider } = await import("./src-CiKTGSje.js");
+			const { monitorMSTeamsProvider } = await import("./src-DQ7ARgDd.js");
 			const port = ctx.cfg.channels?.msteams?.webhook?.port ?? 3978;
 			ctx.setStatus({
 				accountId: ctx.accountId,

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as msteamsPlugin } from "./channel-VjDbklu8.js";
+import { t as msteamsPlugin } from "./channel-kz4Rzh2w.js";
 export { msteamsPlugin };

package/dist/{channel.runtime-VrE9r2nS.js → channel.runtime-C1IGCVBT.js}

@@ -1,6 +1,6 @@
-import { s as chunkTextForOutbound } from "./runtime-api-D92XOrVf.js";
-import { a as fetchGraphJson, c as normalizeQuery, d as postGraphJson, f as resolveGraphToken, i as fetchGraphAbsoluteUrl, l as patchGraphJson, n as deleteGraphRequest, o as listChannelsForTeam, r as escapeOData, s as listTeamsByName, t as searchGraphUsers, u as postGraphBetaJson } from "./graph-users-C9HaPg1v.js";
-import { S as createMSTeamsConversationStoreFs, a as sendMessageMSTeams, b as createMSTeamsPollStoreFs, i as sendAdaptiveCardMSTeams, n as deleteMessageMSTeams, o as sendPollMSTeams, r as editMessageMSTeams, t as probeMSTeams } from "./probe-Bs955MJZ.js";
+import { s as chunkTextForOutbound } from "./runtime-api-C3EIaIpt.js";
+import { a as fetchGraphJson, c as normalizeQuery, d as postGraphJson, f as resolveGraphToken, i as fetchGraphAbsoluteUrl, l as patchGraphJson, n as deleteGraphRequest, o as listChannelsForTeam, r as escapeOData, s as listTeamsByName, t as searchGraphUsers, u as postGraphBetaJson } from "./graph-users-CCU0WVMZ.js";
+import { S as createMSTeamsConversationStoreFs, a as sendMessageMSTeams, b as createMSTeamsPollStoreFs, i as sendAdaptiveCardMSTeams, n as deleteMessageMSTeams, o as sendPollMSTeams, r as editMessageMSTeams, t as probeMSTeams } from "./probe-CQKmxtlj.js";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
 import { createAttachedChannelResultAdapter } from "openclaw/plugin-sdk/channel-send-result";
 import { resolveOutboundSendDep } from "openclaw/plugin-sdk/outbound-send-deps";

package/dist/{graph-users-C9HaPg1v.js → graph-users-CCU0WVMZ.js}

@@ -1,4 +1,4 @@
-import { L as getMSTeamsRuntime, g as fetchWithSsrFGuard$1 } from "./runtime-api-D92XOrVf.js";
+import { M as getMSTeamsRuntime, h as fetchWithSsrFGuard$1 } from "./runtime-api-C3EIaIpt.js";
 import { n as refreshMSTeamsDelegatedTokens } from "./oauth.token-xxpoLWy5.js";
 import { createRequire } from "node:module";
 import { isRecord as isRecord$2, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/text-runtime";

package/dist/{policy-D32Kf1ED.js → policy-bM71GXRd.js}

@@ -1,4 +1,4 @@
-import { C as normalizeChannelSlug, D as resolveChannelEntryMatchWithFallback, E as resolveAllowlistMatchSimple, M as resolveNestedAllowlistDecision, P as resolveToolsBySender, i as buildChannelKeyCandidates, p as evaluateSenderGroupAccessForPolicy, v as isDangerousNameMatchingEnabled } from "./runtime-api-D92XOrVf.js";
+import { O as resolveNestedAllowlistDecision, S as normalizeChannelSlug, T as resolveChannelEntryMatchWithFallback, _ as isDangerousNameMatchingEnabled, i as buildChannelKeyCandidates, k as resolveToolsBySender, w as resolveAllowlistMatchSimple } from "./runtime-api-C3EIaIpt.js";
 //#region extensions/msteams/src/policy.ts
 function resolveMSTeamsRouteConfig(params) {
 	const teamId = params.teamId?.trim();
@@ -130,13 +130,5 @@ function resolveMSTeamsReplyPolicy(params) {
 		replyStyle: params.channelConfig?.replyStyle ?? params.teamConfig?.replyStyle ?? params.globalConfig?.replyStyle ?? (requireMention ? "thread" : "top-level")
 	};
 }
-function isMSTeamsGroupAllowed(params) {
-	return evaluateSenderGroupAccessForPolicy({
-		groupPolicy: params.groupPolicy,
-		groupAllowFrom: params.allowFrom.map((entry) => String(entry)),
-		senderId: params.senderId,
-		isSenderAllowed: () => resolveMSTeamsAllowlistMatch(params).allowed
-	}).allowed;
-}
 //#endregion
-export { resolveMSTeamsRouteConfig as a, resolveMSTeamsReplyPolicy as i, resolveMSTeamsAllowlistMatch as n, resolveMSTeamsGroupToolPolicy as r, isMSTeamsGroupAllowed as t };
+export { resolveMSTeamsRouteConfig as i, resolveMSTeamsGroupToolPolicy as n, resolveMSTeamsReplyPolicy as r, resolveMSTeamsAllowlistMatch as t };

package/dist/{probe-Bs955MJZ.js → probe-CQKmxtlj.js}

@@ -1,6 +1,6 @@
-import { L as getMSTeamsRuntime, O as resolveChannelMediaMaxBytes, _ as getFileExtension, b as loadOutboundMediaFromUrl, d as detectMime, h as extractOriginalFilename, m as extensionForMime, w as normalizeStringEntries } from "./runtime-api-D92XOrVf.js";
-import { C as loadMSTeamsSdkWithAuth, D as formatMSTeamsSendErrorHint, E as classifyMSTeamsSendError, O as formatUnknownError, S as createMSTeamsTokenProvider, _ as resolveMSTeamsStorePath, h as resolveMSTeamsCredentials, k as isRevokedProxyError, m as loadDelegatedTokens, w as buildUserAgent, x as createMSTeamsAdapter, y as readAccessToken } from "./graph-users-C9HaPg1v.js";
-import { a as resolveMSTeamsRouteConfig, i as resolveMSTeamsReplyPolicy } from "./policy-D32Kf1ED.js";
+import { C as normalizeStringEntries, E as resolveChannelMediaMaxBytes, M as getMSTeamsRuntime, d as detectMime, g as getFileExtension, m as extractOriginalFilename, p as extensionForMime, y as loadOutboundMediaFromUrl } from "./runtime-api-C3EIaIpt.js";
+import { C as loadMSTeamsSdkWithAuth, D as formatMSTeamsSendErrorHint, E as classifyMSTeamsSendError, O as formatUnknownError, S as createMSTeamsTokenProvider, _ as resolveMSTeamsStorePath, h as resolveMSTeamsCredentials, k as isRevokedProxyError, m as loadDelegatedTokens, w as buildUserAgent, x as createMSTeamsAdapter, y as readAccessToken } from "./graph-users-CCU0WVMZ.js";
+import { i as resolveMSTeamsRouteConfig, r as resolveMSTeamsReplyPolicy } from "./policy-bM71GXRd.js";
 import { createMessageReceiptFromOutboundResults } from "openclaw/plugin-sdk/channel-message";
 import { convertMarkdownTables, isRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, sleep } from "openclaw/plugin-sdk/text-runtime";
 import { withFileLock } from "openclaw/plugin-sdk/file-lock";

package/dist/{resolve-allowlist-C23ohQKQ.js → resolve-allowlist-7CHP2hEA.js}

@@ -1,4 +1,4 @@
-import { c as normalizeQuery, f as resolveGraphToken, o as listChannelsForTeam, s as listTeamsByName, t as searchGraphUsers } from "./graph-users-C9HaPg1v.js";
+import { c as normalizeQuery, f as resolveGraphToken, o as listChannelsForTeam, s as listTeamsByName, t as searchGraphUsers } from "./graph-users-CCU0WVMZ.js";
 import { mapAllowlistResolutionInputs } from "openclaw/plugin-sdk/allow-from";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/text-runtime";
 //#region extensions/msteams/src/resolve-allowlist.ts

package/dist/{runtime-api-D92XOrVf.js → runtime-api-C3EIaIpt.js}

@@ -1,7 +1,7 @@
 import { mergeAllowlist, resolveAllowlistMatchSimple, summarizeMapping } from "openclaw/plugin-sdk/allow-from";
 import { createChannelMessageReplyPipeline } from "openclaw/plugin-sdk/channel-message";
 import { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";
-import { evaluateSenderGroupAccessForPolicy, readStoreAllowFromForDmPolicy, resolveDmGroupAccessWithLists, resolveEffectiveAllowFromLists, resolveSenderScopedGroupPolicy, resolveToolsBySender } from "openclaw/plugin-sdk/channel-policy";
+import { resolveToolsBySender } from "openclaw/plugin-sdk/channel-policy";
 import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
 import { logTypingFailure } from "openclaw/plugin-sdk/channel-logging";
 import { PAIRING_APPROVED_MESSAGE, buildProbeChannelStatusSummary, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/channel-status";
@@ -25,4 +25,4 @@ const { setRuntime: setMSTeamsRuntime, getRuntime: getMSTeamsRuntime, tryGetRunt
 	errorMessage: "MSTeams runtime not initialized"
 });
 //#endregion
-export { resolveDmGroupAccessWithLists as A, normalizeChannelSlug as C, resolveChannelEntryMatchWithFallback as D, resolveAllowlistMatchSimple as E, summarizeMapping as F, withFileLock$1 as I, getMSTeamsRuntime as L, resolveNestedAllowlistDecision as M, resolveSenderScopedGroupPolicy as N, resolveChannelMediaMaxBytes as O, resolveToolsBySender as P, getOptionalMSTeamsRuntime as R, mergeAllowlist as S, readStoreAllowFromForDmPolicy as T, getFileExtension as _, buildMediaPayload as a, loadOutboundMediaFromUrl as b, createChannelMessageReplyPipeline as c, detectMime as d, dispatchReplyFromConfigWithSettledDispatcher$1 as f, fetchWithSsrFGuard$1 as g, extractOriginalFilename as h, buildChannelKeyCandidates as i, resolveEffectiveAllowFromLists as j, resolveDefaultGroupPolicy as k, createChannelPairingController as l, extensionForMime as m, DEFAULT_WEBHOOK_MAX_BODY_BYTES as n, buildProbeChannelStatusSummary as o, evaluateSenderGroupAccessForPolicy as p, PAIRING_APPROVED_MESSAGE as r, chunkTextForOutbound as s, DEFAULT_ACCOUNT_ID as t, createDefaultChannelRuntimeState as u, isDangerousNameMatchingEnabled as v, normalizeStringEntries as w, logTypingFailure as x, keepHttpServerTaskAlive as y, setMSTeamsRuntime as z };
+export { summarizeMapping as A, normalizeStringEntries as C, resolveDefaultGroupPolicy as D, resolveChannelMediaMaxBytes as E, getMSTeamsRuntime as M, getOptionalMSTeamsRuntime as N, resolveNestedAllowlistDecision as O, setMSTeamsRuntime as P, normalizeChannelSlug as S, resolveChannelEntryMatchWithFallback as T, isDangerousNameMatchingEnabled as _, buildMediaPayload as a, logTypingFailure as b, createChannelMessageReplyPipeline as c, detectMime as d, dispatchReplyFromConfigWithSettledDispatcher$1 as f, getFileExtension as g, fetchWithSsrFGuard$1 as h, buildChannelKeyCandidates as i, withFileLock$1 as j, resolveToolsBySender as k, createChannelPairingController as l, extractOriginalFilename as m, DEFAULT_WEBHOOK_MAX_BODY_BYTES as n, buildProbeChannelStatusSummary as o, extensionForMime as p, PAIRING_APPROVED_MESSAGE as r, chunkTextForOutbound as s, DEFAULT_ACCOUNT_ID as t, createDefaultChannelRuntimeState as u, keepHttpServerTaskAlive as v, resolveAllowlistMatchSimple as w, mergeAllowlist as x, loadOutboundMediaFromUrl as y };

package/dist/runtime-api.js

@@ -1,2 +1,2 @@
-import { A as resolveDmGroupAccessWithLists, C as normalizeChannelSlug, D as resolveChannelEntryMatchWithFallback, E as resolveAllowlistMatchSimple, F as summarizeMapping, I as withFileLock, M as resolveNestedAllowlistDecision, N as resolveSenderScopedGroupPolicy, O as resolveChannelMediaMaxBytes, P as resolveToolsBySender, S as mergeAllowlist, T as readStoreAllowFromForDmPolicy, _ as getFileExtension, a as buildMediaPayload, b as loadOutboundMediaFromUrl, c as createChannelMessageReplyPipeline, d as detectMime, f as dispatchReplyFromConfigWithSettledDispatcher, g as fetchWithSsrFGuard, h as extractOriginalFilename, i as buildChannelKeyCandidates, j as resolveEffectiveAllowFromLists, k as resolveDefaultGroupPolicy, l as createChannelPairingController, m as extensionForMime, n as DEFAULT_WEBHOOK_MAX_BODY_BYTES, o as buildProbeChannelStatusSummary, p as evaluateSenderGroupAccessForPolicy, r as PAIRING_APPROVED_MESSAGE, s as chunkTextForOutbound, t as DEFAULT_ACCOUNT_ID, u as createDefaultChannelRuntimeState, v as isDangerousNameMatchingEnabled, w as normalizeStringEntries, x as logTypingFailure, y as keepHttpServerTaskAlive, z as setMSTeamsRuntime } from "./runtime-api-D92XOrVf.js";
-export { DEFAULT_ACCOUNT_ID, DEFAULT_WEBHOOK_MAX_BODY_BYTES, PAIRING_APPROVED_MESSAGE, buildChannelKeyCandidates, buildMediaPayload, buildProbeChannelStatusSummary, chunkTextForOutbound, createChannelMessageReplyPipeline, createChannelPairingController, createDefaultChannelRuntimeState, detectMime, dispatchReplyFromConfigWithSettledDispatcher, evaluateSenderGroupAccessForPolicy, extensionForMime, extractOriginalFilename, fetchWithSsrFGuard, getFileExtension, isDangerousNameMatchingEnabled, keepHttpServerTaskAlive, loadOutboundMediaFromUrl, logTypingFailure, mergeAllowlist, normalizeChannelSlug, normalizeStringEntries, readStoreAllowFromForDmPolicy, resolveAllowlistMatchSimple, resolveChannelEntryMatchWithFallback, resolveChannelMediaMaxBytes, resolveDefaultGroupPolicy, resolveDmGroupAccessWithLists, resolveEffectiveAllowFromLists, resolveNestedAllowlistDecision, resolveSenderScopedGroupPolicy, resolveToolsBySender, setMSTeamsRuntime, summarizeMapping, withFileLock };
+import { A as summarizeMapping, C as normalizeStringEntries, D as resolveDefaultGroupPolicy, E as resolveChannelMediaMaxBytes, O as resolveNestedAllowlistDecision, P as setMSTeamsRuntime, S as normalizeChannelSlug, T as resolveChannelEntryMatchWithFallback, _ as isDangerousNameMatchingEnabled, a as buildMediaPayload, b as logTypingFailure, c as createChannelMessageReplyPipeline, d as detectMime, f as dispatchReplyFromConfigWithSettledDispatcher, g as getFileExtension, h as fetchWithSsrFGuard, i as buildChannelKeyCandidates, j as withFileLock, k as resolveToolsBySender, l as createChannelPairingController, m as extractOriginalFilename, n as DEFAULT_WEBHOOK_MAX_BODY_BYTES, o as buildProbeChannelStatusSummary, p as extensionForMime, r as PAIRING_APPROVED_MESSAGE, s as chunkTextForOutbound, t as DEFAULT_ACCOUNT_ID, u as createDefaultChannelRuntimeState, v as keepHttpServerTaskAlive, w as resolveAllowlistMatchSimple, x as mergeAllowlist, y as loadOutboundMediaFromUrl } from "./runtime-api-C3EIaIpt.js";
+export { DEFAULT_ACCOUNT_ID, DEFAULT_WEBHOOK_MAX_BODY_BYTES, PAIRING_APPROVED_MESSAGE, buildChannelKeyCandidates, buildMediaPayload, buildProbeChannelStatusSummary, chunkTextForOutbound, createChannelMessageReplyPipeline, createChannelPairingController, createDefaultChannelRuntimeState, detectMime, dispatchReplyFromConfigWithSettledDispatcher, extensionForMime, extractOriginalFilename, fetchWithSsrFGuard, getFileExtension, isDangerousNameMatchingEnabled, keepHttpServerTaskAlive, loadOutboundMediaFromUrl, logTypingFailure, mergeAllowlist, normalizeChannelSlug, normalizeStringEntries, resolveAllowlistMatchSimple, resolveChannelEntryMatchWithFallback, resolveChannelMediaMaxBytes, resolveDefaultGroupPolicy, resolveNestedAllowlistDecision, resolveToolsBySender, setMSTeamsRuntime, summarizeMapping, withFileLock };

package/dist/setup-plugin-api.js

@@ -1,6 +1,6 @@
-import { h as resolveMSTeamsCredentials } from "./graph-users-C9HaPg1v.js";
+import { h as resolveMSTeamsCredentials } from "./graph-users-CCU0WVMZ.js";
 import { t as MSTeamsChannelConfigSchema } from "./config-schema-DwOEthCC.js";
-import { i as msteamsSetupAdapter, t as msteamsSetupWizard } from "./setup-surface-BeztPcxk.js";
+import { i as msteamsSetupAdapter, t as msteamsSetupWizard } from "./setup-surface-C7d0jGM5.js";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { formatAllowFromLowercase } from "openclaw/plugin-sdk/allow-from";
 import { createTopLevelChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";

package/dist/{setup-surface-BeztPcxk.js → setup-surface-C7d0jGM5.js}

@@ -1,5 +1,5 @@
-import { O as formatUnknownError, g as saveDelegatedTokens, h as resolveMSTeamsCredentials, p as hasConfiguredMSTeamsCredentials, v as normalizeSecretInputString } from "./graph-users-C9HaPg1v.js";
-import { c as resolveMSTeamsUserAllowlist, o as parseMSTeamsTeamEntry, s as resolveMSTeamsChannelAllowlist } from "./resolve-allowlist-C23ohQKQ.js";
+import { O as formatUnknownError, g as saveDelegatedTokens, h as resolveMSTeamsCredentials, p as hasConfiguredMSTeamsCredentials, v as normalizeSecretInputString } from "./graph-users-CCU0WVMZ.js";
+import { c as resolveMSTeamsUserAllowlist, o as parseMSTeamsTeamEntry, s as resolveMSTeamsChannelAllowlist } from "./resolve-allowlist-7CHP2hEA.js";
 import { DEFAULT_ACCOUNT_ID, createStandardChannelSetupStatus, createTopLevelChannelAllowFromSetter, createTopLevelChannelDmPolicy, createTopLevelChannelGroupPolicySetter, mergeAllowFromEntries, splitSetupEntries } from "openclaw/plugin-sdk/setup";
 import { formatDocsLink } from "openclaw/plugin-sdk/setup-tools";
 //#region extensions/msteams/src/setup-core.ts

package/dist/{src-CiKTGSje.js → src-DQ7ARgDd.js}

@@ -1,8 +1,8 @@
-import { A as resolveDmGroupAccessWithLists, F as summarizeMapping, L as getMSTeamsRuntime, N as resolveSenderScopedGroupPolicy, O as resolveChannelMediaMaxBytes, R as getOptionalMSTeamsRuntime, S as mergeAllowlist, T as readStoreAllowFromForDmPolicy, a as buildMediaPayload, c as createChannelMessageReplyPipeline, f as dispatchReplyFromConfigWithSettledDispatcher$1, j as resolveEffectiveAllowFromLists, k as resolveDefaultGroupPolicy, l as createChannelPairingController, n as DEFAULT_WEBHOOK_MAX_BODY_BYTES, p as evaluateSenderGroupAccessForPolicy$1, t as DEFAULT_ACCOUNT_ID, v as isDangerousNameMatchingEnabled, x as logTypingFailure, y as keepHttpServerTaskAlive } from "./runtime-api-D92XOrVf.js";
-import { A as ATTACHMENT_TAG_RE, B as isLikelyImageAttachment, C as loadMSTeamsSdkWithAuth, D as formatMSTeamsSendErrorHint, E as classifyMSTeamsSendError, F as estimateBase64DecodedBytes, G as resolveAttachmentFetchPolicy, H as isUrlAllowed, I as extractHtmlFromAttachment, J as safeFetchWithPolicy, K as resolveMediaSsrfPolicy, L as extractInlineImageCandidates, M as IMG_SRC_RE, N as applyAuthorizationHeaderForUrl, O as formatUnknownError, P as encodeGraphShareId, R as inferPlaceholder, S as createMSTeamsTokenProvider, T as ensureUserAgentHeader, U as normalizeContentType, V as isRecord$1, W as readNestedString, X as tryBuildGraphSharesUrlForSharedLink, Y as safeHostForUrl, _ as resolveMSTeamsStorePath, a as fetchGraphJson, b as createBotFrameworkJwtValidator, h as resolveMSTeamsCredentials, j as GRAPH_ROOT, q as resolveRequestUrl, w as buildUserAgent, x as createMSTeamsAdapter, z as isDownloadableAttachment } from "./graph-users-C9HaPg1v.js";
-import { c as resolveMSTeamsUserAllowlist, s as resolveMSTeamsChannelAllowlist } from "./resolve-allowlist-C23ohQKQ.js";
-import { a as resolveMSTeamsRouteConfig, i as resolveMSTeamsReplyPolicy, n as resolveMSTeamsAllowlistMatch, t as isMSTeamsGroupAllowed } from "./policy-D32Kf1ED.js";
-import { C as readJsonFile, S as createMSTeamsConversationStoreFs, T as writeJsonFile, _ as buildFileInfoCard, b as createMSTeamsPollStoreFs, c as renderReplyPayloadsToMessages, d as withRevokedProxyFallback, f as resolveGraphChatId, g as removePendingUploadFs, h as getPendingUploadFs, l as sendMSTeamsMessages, m as removePendingUpload, p as getPendingUpload, s as buildConversationReference, u as AI_GENERATED_ENTITY, v as parseFileConsentInvoke, w as withFileLock, x as extractMSTeamsPollVote, y as uploadToConsentUrl } from "./probe-Bs955MJZ.js";
+import { A as summarizeMapping, D as resolveDefaultGroupPolicy, E as resolveChannelMediaMaxBytes, M as getMSTeamsRuntime, N as getOptionalMSTeamsRuntime, _ as isDangerousNameMatchingEnabled, a as buildMediaPayload, b as logTypingFailure, c as createChannelMessageReplyPipeline, f as dispatchReplyFromConfigWithSettledDispatcher$1, l as createChannelPairingController, n as DEFAULT_WEBHOOK_MAX_BODY_BYTES, t as DEFAULT_ACCOUNT_ID, v as keepHttpServerTaskAlive, x as mergeAllowlist } from "./runtime-api-C3EIaIpt.js";
+import { A as ATTACHMENT_TAG_RE, B as isLikelyImageAttachment, C as loadMSTeamsSdkWithAuth, D as formatMSTeamsSendErrorHint, E as classifyMSTeamsSendError, F as estimateBase64DecodedBytes, G as resolveAttachmentFetchPolicy, H as isUrlAllowed, I as extractHtmlFromAttachment, J as safeFetchWithPolicy, K as resolveMediaSsrfPolicy, L as extractInlineImageCandidates, M as IMG_SRC_RE, N as applyAuthorizationHeaderForUrl, O as formatUnknownError, P as encodeGraphShareId, R as inferPlaceholder, S as createMSTeamsTokenProvider, T as ensureUserAgentHeader, U as normalizeContentType, V as isRecord$1, W as readNestedString, X as tryBuildGraphSharesUrlForSharedLink, Y as safeHostForUrl, _ as resolveMSTeamsStorePath, a as fetchGraphJson, b as createBotFrameworkJwtValidator, h as resolveMSTeamsCredentials, j as GRAPH_ROOT, q as resolveRequestUrl, w as buildUserAgent, x as createMSTeamsAdapter, z as isDownloadableAttachment } from "./graph-users-CCU0WVMZ.js";
+import { c as resolveMSTeamsUserAllowlist, s as resolveMSTeamsChannelAllowlist } from "./resolve-allowlist-7CHP2hEA.js";
+import { i as resolveMSTeamsRouteConfig, r as resolveMSTeamsReplyPolicy, t as resolveMSTeamsAllowlistMatch } from "./policy-bM71GXRd.js";
+import { C as readJsonFile, S as createMSTeamsConversationStoreFs, T as writeJsonFile, _ as buildFileInfoCard, b as createMSTeamsPollStoreFs, c as renderReplyPayloadsToMessages, d as withRevokedProxyFallback, f as resolveGraphChatId, g as removePendingUploadFs, h as getPendingUploadFs, l as sendMSTeamsMessages, m as removePendingUpload, p as getPendingUpload, s as buildConversationReference, u as AI_GENERATED_ENTITY, v as parseFileConsentInvoke, w as withFileLock, x as extractMSTeamsPollVote, y as uploadToConsentUrl } from "./probe-CQKmxtlj.js";
 import { formatAllowlistMatchMeta } from "openclaw/plugin-sdk/allow-from";
 import { createLiveMessageState, createPreviewMessageReceipt, defineFinalizableLivePreviewAdapter, deliverWithFinalizableLivePreviewAdapter, markLiveMessageFinalized } from "openclaw/plugin-sdk/channel-message";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, readStringValue } from "openclaw/plugin-sdk/text-runtime";
@@ -16,10 +16,9 @@ import { appendRegularFile } from "openclaw/plugin-sdk/security-runtime";
 import { writeJsonFileAtomically } from "openclaw/plugin-sdk/json-store";
 import { resolveThreadSessionKeys } from "openclaw/plugin-sdk/routing";
 import fs from "node:fs/promises";
+import { channelIngressRoutes, resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
 import { logInboundDrop, resolveInboundMentionDecision, resolveInboundSessionEnvelopeContext } from "openclaw/plugin-sdk/channel-inbound";
-import { resolveDualTextControlCommandGate } from "openclaw/plugin-sdk/command-gating";
 import { filterSupplementalContextItems, resolveChannelContextVisibilityMode, shouldIncludeSupplementalContext } from "openclaw/plugin-sdk/context-visibility-runtime";
-import { evaluateSenderGroupAccessForPolicy } from "openclaw/plugin-sdk/group-access";
 import { DEFAULT_GROUP_HISTORY_LIMIT, buildPendingHistoryContextFromMap, recordPendingHistoryEntryIfEnabled } from "openclaw/plugin-sdk/reply-history";
 import { buildChannelProgressDraftLine, buildChannelProgressDraftLineForEntry, createChannelProgressDraftGate, formatChannelProgressDraftText, isChannelProgressDraftWorkToolName, resolveChannelPreviewStreamMode, resolveChannelProgressDraftMaxLines, resolveChannelStreamingBlockEnabled, resolveChannelStreamingPreviewToolProgress } from "openclaw/plugin-sdk/channel-streaming";
 //#region extensions/msteams/src/feedback-reflection-prompt.ts
@@ -492,6 +491,22 @@ async function respondToMSTeamsFileConsentInvoke(context, log) {
 }
 //#endregion
 //#region extensions/msteams/src/monitor-handler/access.ts
+const msteamsIngressIdentity = {
+	key: "sender-id",
+	normalize: normalizeIngressValue,
+	aliases: [{
+		key: "sender-name",
+		kind: "plugin:msteams-sender-name",
+		normalizeEntry: normalizeIngressValue,
+		normalizeSubject: normalizeIngressValue,
+		dangerous: true
+	}],
+	isWildcardEntry: (entry) => normalizeIngressValue(entry) === "*",
+	resolveEntryId: ({ entryIndex, fieldKey }) => `msteams-entry-${entryIndex + 1}:${fieldKey === "sender-name" ? "name" : "id"}`
+};
+function normalizeIngressValue(value) {
+	return normalizeOptionalLowercaseString(value) ?? null;
+}
 async function resolveMSTeamsSenderAccess(params) {
 	const activity = params.activity;
 	const msteamsCfg = params.cfg.channels?.msteams;
@@ -506,23 +521,10 @@ async function resolveMSTeamsSenderAccess(params) {
 		accountId: DEFAULT_ACCOUNT_ID
 	});
 	const dmPolicy = msteamsCfg?.dmPolicy ?? "pairing";
-	const storedAllowFrom = await readStoreAllowFromForDmPolicy({
-		provider: "msteams",
-		accountId: pairing.accountId,
-		dmPolicy,
-		readStore: pairing.readStoreForDmPolicy
-	});
 	const configuredDmAllowFrom = msteamsCfg?.allowFrom ?? [];
 	const groupAllowFrom = msteamsCfg?.groupAllowFrom;
-	const resolvedAllowFromLists = resolveEffectiveAllowFromLists({
-		allowFrom: configuredDmAllowFrom,
-		groupAllowFrom,
-		storeAllowFrom: storedAllowFrom,
-		dmPolicy
-	});
 	const defaultGroupPolicy = resolveDefaultGroupPolicy(params.cfg);
 	const groupPolicy = !isDirectMessage && msteamsCfg ? msteamsCfg.groupPolicy ?? defaultGroupPolicy ?? "allowlist" : "disabled";
-	const effectiveGroupAllowFrom = resolvedAllowFromLists.effectiveGroupAllowFrom;
 	const allowNameMatching = isDangerousNameMatchingEnabled(msteamsCfg);
 	const channelGate = resolveMSTeamsRouteConfig({
 		cfg: msteamsCfg,
@@ -532,49 +534,55 @@ async function resolveMSTeamsSenderAccess(params) {
 		channelName: activity.channelData?.channel?.name,
 		allowNameMatching
 	});
-	const senderGroupPolicy = channelGate.allowlistConfigured && effectiveGroupAllowFrom.length === 0 ? groupPolicy : resolveSenderScopedGroupPolicy({
-		groupPolicy,
-		groupAllowFrom: effectiveGroupAllowFrom
-	});
-	const access = resolveDmGroupAccessWithLists({
-		isGroup: !isDirectMessage,
-		dmPolicy,
-		groupPolicy: senderGroupPolicy,
-		allowFrom: configuredDmAllowFrom,
-		groupAllowFrom,
-		storeAllowFrom: storedAllowFrom,
-		groupAllowFromFallbackToAllowFrom: false,
-		isSenderAllowed: (allowFrom) => resolveMSTeamsAllowlistMatch({
-			allowFrom,
-			senderId,
-			senderName,
-			allowNameMatching
-		}).allowed
-	});
 	return {
-		msteamsCfg,
+		...await resolveStableChannelMessageIngress({
+			channelId: "msteams",
+			accountId: pairing.accountId,
+			identity: msteamsIngressIdentity,
+			cfg: params.cfg,
+			readStoreAllowFrom: pairing.readAllowFromStore,
+			subject: {
+				stableId: senderId,
+				aliases: { "sender-name": senderName }
+			},
+			conversation: {
+				kind: isDirectMessage ? "direct" : convType === "channel" ? "channel" : "group",
+				id: conversationId,
+				parentId: activity.channelData?.team?.id
+			},
+			route: channelIngressRoutes(!isDirectMessage && channelGate.allowlistConfigured && {
+				id: "msteams:team-channel",
+				kind: "nestedAllowlist",
+				allowed: channelGate.allowed,
+				precedence: 0,
+				matchId: "msteams-route",
+				...channelGate.allowed && groupPolicy === "allowlist" ? {
+					senderPolicy: "deny-when-empty",
+					senderAllowFromSource: "effective-group"
+				} : {}
+			}),
+			dmPolicy,
+			groupPolicy,
+			policy: {
+				groupAllowFromFallbackToAllowFrom: true,
+				mutableIdentifierMatching: allowNameMatching ? "enabled" : "disabled"
+			},
+			allowFrom: configuredDmAllowFrom,
+			groupAllowFrom,
+			command: {
+				allowTextCommands: true,
+				hasControlCommand: params.hasControlCommand === true,
+				directGroupAllowFrom: isDirectMessage ? "effective" : "none"
+			}
+		}),
 		pairing,
 		isDirectMessage,
 		conversationId,
 		senderId,
 		senderName,
+		msteamsCfg,
 		dmPolicy,
 		channelGate,
-		access,
-		senderGroupAccess: evaluateSenderGroupAccessForPolicy$1({
-			groupPolicy,
-			groupAllowFrom: effectiveGroupAllowFrom,
-			senderId,
-			isSenderAllowed: (_senderId, allowFrom) => resolveMSTeamsAllowlistMatch({
-				allowFrom,
-				senderId,
-				senderName,
-				allowNameMatching
-			}).allowed
-		}),
-		configuredDmAllowFrom,
-		effectiveDmAllowFrom: access.effectiveAllowFrom,
-		effectiveGroupAllowFrom,
 		allowNameMatching,
 		groupPolicy
 	};
@@ -2499,6 +2507,22 @@ function extractTextFromHtmlAttachments(attachments) {
 	}
 	return "";
 }
+function formatMSTeamsSenderReason(params) {
+	switch (params.reasonCode) {
+		case "dm_policy_open": return "dmPolicy=open";
+		case "dm_policy_disabled": return "dmPolicy=disabled";
+		case "dm_policy_pairing_required": return "dmPolicy=pairing (not allowlisted)";
+		case "dm_policy_allowlisted": return `dmPolicy=${params.dmPolicy ?? "allowlist"} (allowlisted)`;
+		case "dm_policy_not_allowlisted": return `dmPolicy=${params.dmPolicy ?? "allowlist"} (not allowlisted)`;
+		case "group_policy_disabled": return "groupPolicy=disabled";
+		case "group_policy_empty_allowlist":
+		case "route_sender_empty": return "groupPolicy=allowlist (empty allowlist)";
+		case "group_policy_not_allowlisted": return "groupPolicy=allowlist (not allowlisted)";
+		case "group_policy_open": return "groupPolicy=open";
+		case "group_policy_allowed": return `groupPolicy=${params.groupPolicy ?? "allowlist"}`;
+		default: return params.reasonCode;
+	}
+}
 function buildStoredConversationReference(params) {
 	const { activity, conversationId, conversationType, teamId, threadId } = params;
 	const from = activity.from;
@@ -2594,14 +2618,17 @@ function createMSTeamsMessageHandler(deps) {
 			teamId,
 			threadId: conversationType === "channel" ? conversationMessageId ?? activity.replyToId ?? void 0 : void 0
 		});
-		const { dmPolicy, senderId, senderName, pairing, isDirectMessage, channelGate, access, configuredDmAllowFrom, effectiveDmAllowFrom, effectiveGroupAllowFrom, allowNameMatching, groupPolicy } = await resolveMSTeamsSenderAccess({
+		const { dmPolicy, senderId, senderName, pairing, isDirectMessage, channelGate, senderAccess, commandAccess, allowNameMatching, groupPolicy } = await resolveMSTeamsSenderAccess({
 			cfg,
-			activity
+			activity,
+			hasControlCommand: core.channel.text.hasControlCommand(text, cfg)
 		});
-		const useAccessGroups = cfg.commands?.useAccessGroups !== false;
+		const commandAuthorized = commandAccess.requested ? commandAccess.authorized : void 0;
+		const effectiveDmAllowFrom = senderAccess.effectiveAllowFrom;
+		const effectiveGroupAllowFrom = senderAccess.effectiveGroupAllowFrom;
 		const isChannel = conversationType === "channel";
-		if (isDirectMessage && msteamsCfg && access.decision !== "allow") {
-			if (access.reason === "dmPolicy=disabled") {
+		if (isDirectMessage && msteamsCfg && senderAccess.decision !== "allow") {
+			if (senderAccess.reasonCode === "dm_policy_disabled") {
 				log.info("dropping dm (dms disabled)", {
 					sender: senderId,
 					label: senderName
@@ -2615,7 +2642,7 @@ function createMSTeamsMessageHandler(deps) {
 				senderName,
 				allowNameMatching
 			});
-			if (access.decision === "pairing") {
+			if (senderAccess.decision === "pairing") {
 				conversationStore.upsert(conversationId, conversationRef).catch((err) => {
 					log.debug?.("failed to save conversation reference", { error: formatUnknownError(err) });
 				});
@@ -2636,7 +2663,11 @@ function createMSTeamsMessageHandler(deps) {
 				sender: senderId,
 				label: senderName,
 				dmPolicy,
-				reason: access.reason,
+				reason: formatMSTeamsSenderReason({
+					reasonCode: senderAccess.reasonCode,
+					dmPolicy,
+					groupPolicy
+				}),
 				allowlistMatch: formatAllowlistMatchMeta(allowMatch)
 			});
 			return;
@@ -2659,28 +2690,17 @@ function createMSTeamsMessageHandler(deps) {
 				});
 				return;
 			}
-			const senderGroupAccess = evaluateSenderGroupAccessForPolicy({
-				groupPolicy,
-				groupAllowFrom: effectiveGroupAllowFrom,
-				senderId,
-				isSenderAllowed: (_senderId, allowFrom) => resolveMSTeamsAllowlistMatch({
-					allowFrom,
-					senderId,
-					senderName,
-					allowNameMatching
-				}).allowed
-			});
-			if (!senderGroupAccess.allowed && senderGroupAccess.reason === "disabled") {
+			if (!senderAccess.allowed && senderAccess.reasonCode === "group_policy_disabled") {
 				log.info("dropping group message (groupPolicy: disabled)", { conversationId });
 				log.debug?.("dropping group message (groupPolicy: disabled)", { conversationId });
 				return;
 			}
-			if (!senderGroupAccess.allowed && senderGroupAccess.reason === "empty_allowlist") {
+			if (!senderAccess.allowed && (senderAccess.reasonCode === "group_policy_empty_allowlist" || senderAccess.reasonCode === "route_sender_empty")) {
 				log.info("dropping group message (groupPolicy: allowlist, no allowlist)", { conversationId });
 				log.debug?.("dropping group message (groupPolicy: allowlist, no allowlist)", { conversationId });
 				return;
 			}
-			if (!senderGroupAccess.allowed && senderGroupAccess.reason === "sender_not_allowlisted") {
+			if (!senderAccess.allowed && senderAccess.reasonCode === "group_policy_not_allowlisted") {
 				const allowMatch = resolveMSTeamsAllowlistMatch({
 					allowFrom: effectiveGroupAllowFrom,
 					senderId,
@@ -2700,30 +2720,7 @@ function createMSTeamsMessageHandler(deps) {
 				return;
 			}
 		}
-		const commandDmAllowFrom = isDirectMessage ? effectiveDmAllowFrom : configuredDmAllowFrom;
-		const ownerAllowedForCommands = isMSTeamsGroupAllowed({
-			groupPolicy: "allowlist",
-			allowFrom: commandDmAllowFrom,
-			senderId,
-			senderName,
-			allowNameMatching
-		});
-		const groupAllowedForCommands = isMSTeamsGroupAllowed({
-			groupPolicy: "allowlist",
-			allowFrom: effectiveGroupAllowFrom,
-			senderId,
-			senderName,
-			allowNameMatching
-		});
-		const { commandAuthorized, shouldBlock } = resolveDualTextControlCommandGate({
-			useAccessGroups,
-			primaryConfigured: commandDmAllowFrom.length > 0,
-			primaryAllowed: ownerAllowedForCommands,
-			secondaryConfigured: effectiveGroupAllowFrom.length > 0,
-			secondaryAllowed: groupAllowedForCommands,
-			hasControlCommand: core.channel.text.hasControlCommand(text, cfg)
-		});
-		if (shouldBlock) {
+		if (commandAccess.shouldBlockControlCommand) {
 			logInboundDrop({
 				log: logVerboseMessage,
 				channel: "msteams",
@@ -3176,11 +3173,6 @@ function createMSTeamsReactionHandler(deps) {
 	const { cfg, log } = deps;
 	const core = getMSTeamsRuntime();
 	const msteamsCfg = cfg.channels?.msteams;
-	const pairing = createChannelPairingController({
-		core,
-		channel: "msteams",
-		accountId: DEFAULT_ACCOUNT_ID
-	});
 	return async function handleReaction(context, direction) {
 		const activity = context.activity;
 		const reactions = direction === "added" ? activity.reactionsAdded ?? [] : activity.reactionsRemoved ?? [];
@@ -3200,74 +3192,19 @@ function createMSTeamsReactionHandler(deps) {
 		const isDirectMessage = !isGroupChat && !isChannel;
 		const senderId = from.aadObjectId ?? from.id;
 		const senderName = from.name ?? from.id;
-		const dmPolicy = msteamsCfg?.dmPolicy ?? "pairing";
-		const storedAllowFrom = await readStoreAllowFromForDmPolicy({
-			provider: "msteams",
-			accountId: pairing.accountId,
-			dmPolicy,
-			readStore: pairing.readStoreForDmPolicy
-		});
-		const dmAllowFrom = msteamsCfg?.allowFrom ?? [];
-		const groupAllowFrom = msteamsCfg?.groupAllowFrom;
-		const resolvedAllowFromLists = resolveEffectiveAllowFromLists({
-			allowFrom: dmAllowFrom,
-			groupAllowFrom,
-			storeAllowFrom: storedAllowFrom,
-			dmPolicy
-		});
-		const defaultGroupPolicy = resolveDefaultGroupPolicy(cfg);
-		if (isDirectMessage && msteamsCfg) {
-			const access = resolveDmGroupAccessWithLists({
-				isGroup: false,
-				dmPolicy,
-				groupPolicy: msteamsCfg.groupPolicy ?? defaultGroupPolicy ?? "allowlist",
-				allowFrom: dmAllowFrom,
-				groupAllowFrom,
-				storeAllowFrom: storedAllowFrom,
-				groupAllowFromFallbackToAllowFrom: false,
-				isSenderAllowed: (allowFrom) => resolveMSTeamsAllowlistMatch({
-					allowFrom,
-					senderId,
-					senderName,
-					allowNameMatching: isDangerousNameMatchingEnabled(msteamsCfg)
-				}).allowed
+		if (msteamsCfg) {
+			const senderAccess = await resolveMSTeamsSenderAccess({
+				cfg,
+				activity
 			});
-			if (access.decision !== "allow") {
-				log.debug?.("dropping reaction (dm access denied)", {
+			if (senderAccess.senderAccess.decision !== "allow") {
+				log.debug?.("dropping reaction (access denied)", {
 					sender: senderId,
-					reason: access.reason
+					reason: senderAccess.senderAccess.reasonCode
 				});
 				return;
 			}
 		}
-		if (!isDirectMessage && msteamsCfg) {
-			const teamId = activity.channelData?.team?.id;
-			const teamName = activity.channelData?.team?.name;
-			const channelName = activity.channelData?.channel?.name;
-			const channelGate = resolveMSTeamsRouteConfig({
-				cfg: msteamsCfg,
-				teamId,
-				teamName,
-				conversationId,
-				channelName,
-				allowNameMatching: isDangerousNameMatchingEnabled(msteamsCfg)
-			});
-			if (channelGate.allowlistConfigured && !channelGate.allowed) {
-				log.debug?.("dropping reaction (not in team/channel allowlist)", { conversationId });
-				return;
-			}
-			const effectiveGroupAllowFrom = resolvedAllowFromLists.effectiveGroupAllowFrom;
-			if (!isMSTeamsGroupAllowed({
-				groupPolicy: msteamsCfg.groupPolicy ?? defaultGroupPolicy ?? "allowlist",
-				allowFrom: effectiveGroupAllowFrom,
-				senderId,
-				senderName,
-				allowNameMatching: isDangerousNameMatchingEnabled(msteamsCfg)
-			})) {
-				log.debug?.("dropping reaction (sender not in group allowlist)", { sender: senderId });
-				return;
-			}
-		}
 		const teamId = isDirectMessage ? void 0 : activity.channelData?.team?.id;
 		const route = core.channel.routing.resolveAgentRoute({
 			cfg,
@@ -3551,7 +3488,7 @@ async function isInvokeAuthorized(params) {
 	const { msteamsCfg, isDirectMessage, conversationId, senderId } = resolved;
 	if (!msteamsCfg) return true;
 	const maybeInvokeName = includeInvokeName ? { name: context.activity.name } : void 0;
-	if (isDirectMessage && resolved.access.decision !== "allow") {
+	if (isDirectMessage && resolved.senderAccess.decision !== "allow") {
 		deps.log.debug?.(deniedLogs.dm, {
 			sender: senderId,
 			conversationId,
@@ -3568,7 +3505,7 @@ async function isInvokeAuthorized(params) {
 		});
 		return false;
 	}
-	if (!isDirectMessage && !resolved.senderGroupAccess.allowed) {
+	if (!isDirectMessage && !resolved.senderAccess.allowed) {
 		deps.log.debug?.(deniedLogs.group, {
 			sender: senderId,
 			conversationId,

package/dist/test-api.js

@@ -1,2 +1,2 @@
-import { t as msteamsPlugin } from "./channel-VjDbklu8.js";
+import { t as msteamsPlugin } from "./channel-kz4Rzh2w.js";
 export { msteamsPlugin };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/msteams",
-  "version": "2026.5.9-beta.1",
+  "version": "2026.5.10-beta.2",
   "description": "OpenClaw Microsoft Teams channel plugin",
   "repository": {
     "type": "git",
@@ -22,7 +22,7 @@
     "openclaw": "workspace:*"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.5.9-beta.1"
+    "openclaw": ">=2026.5.10-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -58,10 +58,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.5.9-beta.1"
+      "pluginApi": ">=2026.5.10-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.5.9-beta.1"
+      "openclawVersion": "2026.5.10-beta.2"
     },
     "release": {
       "publishToClawHub": true,