@openclaw/msteams 2026.7.1-beta.1 → 2026.7.1-beta.4

package/node_modules/@azure/msal-browser/src/interaction_client/RedirectClient.ts

@@ -176,7 +176,7 @@ export class RedirectClient extends StandardInteractionClient {
             }
         } catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(this.correlationId);
+                e.correlationId = this.correlationId;
             }
             window.removeEventListener("pageshow", handleBackButton);
             throw e;
@@ -197,7 +197,9 @@ export class RedirectClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const pkceCodes = await invokeAsync(
@@ -258,7 +260,7 @@ export class RedirectClient extends StandardInteractionClient {
             }
         } catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(this.correlationId);
+                e.correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             throw e;
@@ -339,6 +341,7 @@ export class RedirectClient extends StandardInteractionClient {
                 reject(
                     createBrowserAuthError(
                         BrowserAuthErrorCodes.timedOut,
+                        "",
                         "failed_to_redirect"
                     )
                 );
@@ -386,6 +389,7 @@ export class RedirectClient extends StandardInteractionClient {
                 reject(
                     createBrowserAuthError(
                         BrowserAuthErrorCodes.timedOut,
+                        "",
                         "failed_to_redirect"
                     )
                 );
@@ -417,7 +421,9 @@ export class RedirectClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const navigateToLoginRequestUrl =
@@ -455,9 +461,15 @@ export class RedirectClient extends StandardInteractionClient {
                     true
                 ) || "";
             const loginRequestUrlNormalized =
-                UrlUtils.normalizeUrlForComparison(loginRequestUrl);
+                UrlUtils.normalizeUrlForComparison(
+                    loginRequestUrl,
+                    this.logger,
+                    this.correlationId
+                );
             const currentUrlNormalized = UrlUtils.normalizeUrlForComparison(
-                window.location.href
+                window.location.href,
+                this.logger,
+                this.correlationId
             );
 
             if (
@@ -518,9 +530,11 @@ export class RedirectClient extends StandardInteractionClient {
                  * The start page is expected to also call handleRedirectPromise which will process the hash in one of the checks above.
                  */
                 let processHashOnRedirect: boolean = true;
-                if (!loginRequestUrl || loginRequestUrl === "null") {
-                    // Redirect to home page if login request url is null (real null or the string null)
-                    const homepage = BrowserUtils.getHomepage();
+                if (!loginRequestUrl) {
+                    // Redirect to home page if login request url is empty
+                    const homepage = BrowserUtils.getHomepage(
+                        this.correlationId
+                    );
                     // Cache the homepage under ORIGIN_URI to ensure cached hash is processed on homepage
                     this.browserStorage.setTemporaryCache(
                         TemporaryCacheKeys.ORIGIN_URI,
@@ -563,7 +577,7 @@ export class RedirectClient extends StandardInteractionClient {
             return null;
         } catch (e) {
             if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             throw e;
@@ -603,7 +617,8 @@ export class RedirectClient extends StandardInteractionClient {
                 ResponseHandler.validateInteractionType(
                     response,
                     this.browserCrypto,
-                    InteractionType.Redirect
+                    InteractionType.Redirect,
+                    this.correlationId
                 );
             } catch (e) {
                 if (e instanceof AuthError) {
@@ -659,7 +674,10 @@ export class RedirectClient extends StandardInteractionClient {
     ): Promise<AuthenticationResult> {
         const state = serverParams.state;
         if (!state) {
-            throw createBrowserAuthError(BrowserAuthErrorCodes.noStateInHash);
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.noStateInHash,
+                request.correlationId
+            );
         }
 
         const { authority, azureCloudOptions, extraQueryParameters, account } =
@@ -802,7 +820,8 @@ export class RedirectClient extends StandardInteractionClient {
                 this.correlationId
             );
             throw createBrowserAuthError(
-                BrowserAuthErrorCodes.emptyNavigateUri
+                BrowserAuthErrorCodes.emptyNavigateUri,
+                this.correlationId
             );
         }
     }
@@ -820,7 +839,9 @@ export class RedirectClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {
@@ -882,7 +903,8 @@ export class RedirectClient extends StandardInteractionClient {
                 validLogoutRequest.state || "",
                 {
                     interactionType: InteractionType.Redirect,
-                }
+                },
+                validLogoutRequest.correlationId
             );
 
             // Create logout string and navigate user window to logout.
@@ -943,7 +965,7 @@ export class RedirectClient extends StandardInteractionClient {
             }
         } catch (e) {
             if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             this.eventHandler.emitEvent(
@@ -974,9 +996,17 @@ export class RedirectClient extends StandardInteractionClient {
      */
     protected getRedirectStartPage(requestStartPage?: string): string {
         const redirectStartPage = requestStartPage || window.location.href;
-        return UrlString.getAbsoluteUrl(
+        const absoluteRedirectStartPage = UrlString.getAbsoluteUrl(
             redirectStartPage,
-            BrowserUtils.getCurrentUri()
+            BrowserUtils.getCurrentUri(),
+            this.correlationId
+        );
+        // Sanity check the URL before it is cached so we never persist a malformed value (e.g. the literal string "null")
+        UrlUtils.validateUrl(
+            absoluteRedirectStartPage,
+            this.logger,
+            this.correlationId
         );
+        return absoluteRedirectStartPage;
     }
 }

package/node_modules/@azure/msal-browser/src/interaction_client/SilentAuthCodeClient.ts

@@ -73,7 +73,8 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
         // Auth code payload is required
         if (!request.code) {
             throw createBrowserAuthError(
-                BrowserAuthErrorCodes.authCodeRequired
+                BrowserAuthErrorCodes.authCodeRequired,
+                this.correlationId
             );
         }
 
@@ -104,7 +105,9 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {
@@ -166,7 +169,7 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
             );
         } catch (e) {
             if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             throw e;
@@ -180,7 +183,8 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
         // Synchronous so we must reject
         return Promise.reject(
             createBrowserAuthError(
-                BrowserAuthErrorCodes.silentLogoutUnsupported
+                BrowserAuthErrorCodes.silentLogoutUnsupported,
+                ""
             )
         );
     }

package/node_modules/@azure/msal-browser/src/interaction_client/SilentCacheClient.ts

@@ -36,7 +36,9 @@ export class SilentCacheClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const clientConfig = await invokeAsync(

package/node_modules/@azure/msal-browser/src/interaction_client/SilentIframeClient.ts

@@ -37,6 +37,7 @@ import {
     BrowserConstants,
 } from "../utils/BrowserConstants.js";
 import {
+    createHiddenIframe,
     initiateCodeRequest,
     initiateCodeFlowWithPost,
     initiateEarRequest,
@@ -199,7 +200,9 @@ export class SilentIframeClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {
@@ -227,7 +230,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             )(authClient, request);
         } catch (e) {
             if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
 
@@ -307,30 +310,45 @@ export class SilentIframeClient extends StandardInteractionClient {
             earJwk: earJwk,
             codeChallenge: pkceCodes.challenge,
         };
-        const iframe = await invokeAsync(
-            initiateEarRequest,
-            BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            this.config,
-            discoveredAuthority,
-            silentRequest,
-            this.logger,
-            this.performanceClient
-        );
+
+        // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+        const iframe = createHiddenIframe();
 
         const responseType = this.config.auth.OIDCOptions.responseMode;
         let responseString: string;
         try {
-            responseString = await invokeAsync(
+            const responsePromise = invokeAsync(
                 this.waitForIframeResponse.bind(this),
                 BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
                 this.logger,
                 this.performanceClient,
                 correlationId
             )(iframe, request);
+            responsePromise.catch(() => {
+                /*
+                 * If navigation below throws before responsePromise is awaited,
+                 * the listener still rejects on timeout. Swallow it here so it
+                 * does not surface as an unhandled rejection; the navigation
+                 * error is propagated instead.
+                 */
+            });
+
+            await invokeAsync(
+                initiateEarRequest,
+                BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                iframe,
+                this.config,
+                discoveredAuthority,
+                silentRequest,
+                this.logger,
+                this.performanceClient
+            );
+
+            responseString = await responsePromise;
         } finally {
             invoke(
                 removeHiddenIframe,
@@ -363,7 +381,9 @@ export class SilentIframeClient extends StandardInteractionClient {
                     this.config.auth.clientId,
                     correlationId,
                     this.browserStorage,
-                    this.logger
+                    this.logger,
+                    undefined,
+                    this.config.system.serverTelemetryEnabled
                 ),
                 requestAuthority: request.authority,
                 requestAzureCloudOptions: request.azureCloudOptions,
@@ -457,7 +477,9 @@ export class SilentIframeClient extends StandardInteractionClient {
                 this.config.auth.clientId,
                 this.correlationId,
                 this.browserStorage,
-                this.logger
+                this.logger,
+                undefined,
+                this.config.system.serverTelemetryEnabled
             ),
             requestAuthority: silentRequest.authority,
             requestAzureCloudOptions: silentRequest.azureCloudOptions,
@@ -475,7 +497,8 @@ export class SilentIframeClient extends StandardInteractionClient {
         // Validate the response - this checks for errors and validates state
         AuthorizeProtocol.validateAuthorizationResponse(
             serverParams,
-            silentRequest.state
+            silentRequest.state,
+            correlationId
         );
 
         // Verify a valid authorization code is present
@@ -501,7 +524,8 @@ export class SilentIframeClient extends StandardInteractionClient {
         // Synchronous so we must reject
         return Promise.reject(
             createBrowserAuthError(
-                BrowserAuthErrorCodes.silentLogoutUnsupported
+                BrowserAuthErrorCodes.silentLogoutUnsupported,
+                ""
             )
         );
     }
@@ -571,58 +595,72 @@ export class SilentIframeClient extends StandardInteractionClient {
             codeChallenge: pkceCodes.challenge,
         };
 
-        let iframe: HTMLIFrameElement;
-        if (request.httpMethod === Constants.HttpMethod.POST) {
-            iframe = await invokeAsync(
-                initiateCodeFlowWithPost,
-                BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(
-                this.config,
-                authClient.authority,
-                silentRequest,
-                this.logger,
-                this.performanceClient
-            );
-        } else {
-            // Create authorize request url
-            const navigateUrl = await invokeAsync(
-                Authorize.getAuthCodeRequestUrl,
-                PerformanceEvents.GetAuthCodeUrl,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(
-                this.config,
-                authClient.authority,
-                silentRequest,
-                this.logger,
-                this.performanceClient
-            );
-
-            // Get the frame handle for the silent request
-            iframe = await invokeAsync(
-                initiateCodeRequest,
-                BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(navigateUrl, this.performanceClient, this.logger, correlationId);
-        }
+        // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+        const iframe = createHiddenIframe();
 
         const responseType = this.config.auth.OIDCOptions.responseMode;
         // Wait for response from the redirect bridge.
         let responseString: string;
         try {
-            responseString = await invokeAsync(
+            const responsePromise = invokeAsync(
                 this.waitForIframeResponse.bind(this),
                 BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
                 this.logger,
                 this.performanceClient,
                 correlationId
             )(iframe, request);
+            responsePromise.catch(() => {
+                /*
+                 * If URL creation or navigation below throws before
+                 * responsePromise is awaited, the listener still rejects on
+                 * timeout. Swallow it here so it does not surface as an
+                 * unhandled rejection; the navigation error is propagated
+                 * instead.
+                 */
+            });
+
+            if (request.httpMethod === Constants.HttpMethod.POST) {
+                await invokeAsync(
+                    initiateCodeFlowWithPost,
+                    BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
+                    this.logger,
+                    this.performanceClient,
+                    correlationId
+                )(
+                    iframe,
+                    this.config,
+                    authClient.authority,
+                    silentRequest,
+                    this.logger,
+                    this.performanceClient
+                );
+            } else {
+                // Create authorize request url
+                const navigateUrl = await invokeAsync(
+                    Authorize.getAuthCodeRequestUrl,
+                    PerformanceEvents.GetAuthCodeUrl,
+                    this.logger,
+                    this.performanceClient,
+                    correlationId
+                )(
+                    this.config,
+                    authClient.authority,
+                    silentRequest,
+                    this.logger,
+                    this.performanceClient
+                );
+
+                // Navigate the iframe to the authorize request url
+                await invokeAsync(
+                    initiateCodeRequest,
+                    BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
+                    this.logger,
+                    this.performanceClient,
+                    correlationId
+                )(iframe, navigateUrl, this.logger, correlationId);
+            }
+
+            responseString = await responsePromise;
         } finally {
             invoke(
                 removeHiddenIframe,

package/node_modules/@azure/msal-browser/src/interaction_client/SilentRefreshClient.ts

@@ -68,7 +68,9 @@ export class SilentRefreshClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const refreshTokenClient = await this.createRefreshTokenClient({
@@ -88,7 +90,7 @@ export class SilentRefreshClient extends StandardInteractionClient {
             request.correlationId
         )(silentRequest, ApiId.acquireTokenSilent_silentFlow).catch(
             (e: AuthError) => {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
                 throw e;
             }
@@ -102,7 +104,8 @@ export class SilentRefreshClient extends StandardInteractionClient {
         // Synchronous so we must reject
         return Promise.reject(
             createBrowserAuthError(
-                BrowserAuthErrorCodes.silentLogoutUnsupported
+                BrowserAuthErrorCodes.silentLogoutUnsupported,
+                ""
             )
         );
     }

package/node_modules/@azure/msal-browser/src/interaction_client/StandardInteractionClient.ts

@@ -120,7 +120,8 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
                 validLogoutRequest.postLogoutRedirectUri =
                     UrlString.getAbsoluteUrl(
                         logoutRequest.postLogoutRedirectUri,
-                        BrowserUtils.getCurrentUri()
+                        BrowserUtils.getCurrentUri(),
+                        validLogoutRequest.correlationId
                     );
             } else if (this.config.auth.postLogoutRedirectUri === null) {
                 this.logger.verbose(
@@ -135,7 +136,8 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
                 validLogoutRequest.postLogoutRedirectUri =
                     UrlString.getAbsoluteUrl(
                         this.config.auth.postLogoutRedirectUri,
-                        BrowserUtils.getCurrentUri()
+                        BrowserUtils.getCurrentUri(),
+                        validLogoutRequest.correlationId
                     );
             } else {
                 this.logger.verbose(
@@ -145,7 +147,8 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
                 validLogoutRequest.postLogoutRedirectUri =
                     UrlString.getAbsoluteUrl(
                         BrowserUtils.getCurrentUri(),
-                        BrowserUtils.getCurrentUri()
+                        BrowserUtils.getCurrentUri(),
+                        validLogoutRequest.correlationId
                     );
             }
         } else {
@@ -349,7 +352,8 @@ export async function initializeAuthorizationRequest(
     const state = ProtocolUtils.setRequestState(
         browserCrypto,
         (request && request.state) || "",
-        browserState
+        browserState,
+        correlationId
     );
 
     const baseRequest: BaseAuthRequest = await invokeAsync(

package/node_modules/@azure/msal-browser/src/interaction_handler/InteractionHandler.ts

@@ -64,7 +64,8 @@ export class InteractionHandler {
         try {
             authCodeResponse = AuthorizeProtocol.getAuthorizationCodePayload(
                 response,
-                request.state
+                request.state,
+                request.correlationId
             );
         } catch (e) {
             if (
@@ -73,7 +74,8 @@ export class InteractionHandler {
             ) {
                 // Translate server error caused by user closing native prompt to corresponding first class MSAL error
                 throw createBrowserAuthError(
-                    BrowserAuthErrorCodes.userCancelled
+                    BrowserAuthErrorCodes.userCancelled,
+                    request.correlationId
                 );
             } else {
                 throw e;

package/node_modules/@azure/msal-browser/src/interaction_handler/SilentHandler.ts

@@ -6,11 +6,9 @@
 import {
     Logger,
     IPerformanceClient,
-    invoke,
     Authority,
     CommonAuthorizationUrlRequest,
 } from "@azure/msal-common/browser";
-import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
@@ -19,39 +17,37 @@ import { BrowserConfiguration } from "../config/Configuration.js";
 import { getCodeForm, getEARForm } from "../protocol/Authorize.js";
 
 /**
- * Creates a hidden iframe to given URL using user-requested scopes as an id.
- * @param urlNavigate
- * @param userRequestScopes
+ * Navigates the given hidden iframe to the provided URL.
+ * @param frame
+ * @param requestUrl
  */
 export async function initiateCodeRequest(
+    frame: HTMLIFrameElement,
     requestUrl: string,
-    performanceClient: IPerformanceClient,
     logger: Logger,
     correlationId: string
 ): Promise<HTMLIFrameElement> {
     if (!requestUrl) {
         // Throw error if request URL is empty.
         logger.info("Navigate url is empty", correlationId);
-        throw createBrowserAuthError(BrowserAuthErrorCodes.emptyNavigateUri);
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.emptyNavigateUri,
+            correlationId
+        );
     }
 
-    return invoke(
-        loadFrameSync,
-        BrowserPerformanceEvents.SilentHandlerLoadFrameSync,
-        logger,
-        performanceClient,
-        correlationId
-    )(requestUrl);
+    frame.src = requestUrl;
+    return frame;
 }
 
 export async function initiateCodeFlowWithPost(
+    frame: HTMLIFrameElement,
     config: BrowserConfiguration,
     authority: Authority,
     request: CommonAuthorizationUrlRequest,
     logger: Logger,
     performanceClient: IPerformanceClient
 ): Promise<HTMLIFrameElement> {
-    const frame = createHiddenIframe();
     if (!frame.contentDocument) {
         throw "No document associated with iframe!";
     }
@@ -68,13 +64,13 @@ export async function initiateCodeFlowWithPost(
 }
 
 export async function initiateEarRequest(
+    frame: HTMLIFrameElement,
     config: BrowserConfiguration,
     authority: Authority,
     request: CommonAuthorizationUrlRequest,
     logger: Logger,
     performanceClient: IPerformanceClient
 ): Promise<HTMLIFrameElement> {
-    const frame = createHiddenIframe();
     if (!frame.contentDocument) {
         throw "No document associated with iframe!";
     }
@@ -92,25 +88,11 @@ export async function initiateEarRequest(
 
 /**
  * @hidden
- * Loads the iframe synchronously when the navigateTimeFrame is set to `0`
- * @param urlNavigate
- * @param frameName
- * @param logger
- */
-function loadFrameSync(urlNavigate: string): HTMLIFrameElement {
-    const frameHandle = createHiddenIframe();
-
-    frameHandle.src = urlNavigate;
-
-    return frameHandle;
-}
-
-/**
- * @hidden
- * Creates a new hidden iframe or gets an existing one for silent token renewal.
+ * Creates a new hidden iframe for silent token renewal. Callers navigate it
+ * (set `src` or submit a form) after registering the response listener.
  * @ignore
  */
-function createHiddenIframe(): HTMLIFrameElement {
+export function createHiddenIframe(): HTMLIFrameElement {
     const authFrame = document.createElement("iframe");
 
     authFrame.className = "msalSilentIframe";