@openclaw/msteams 2026.9.4 → 2026.9.5

package/dist/{send-CU61PSDN.cjs → .setup/send-D8ATH4QI.cjs}

@@ -1,12 +1,14 @@
 const require_runtime = require("./runtime-gZTAuFux.cjs");
-require("./runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-DmUTQxEz.cjs");
-const require_channel = require("./channel-B9LIyYeu.cjs");
-const require_channel_setup = require("./channel.setup-BhxokviI.cjs");
-const require_polls = require("./polls-BBdZPx_R.cjs");
-const require_messenger = require("./messenger-TLdZf9Ar.cjs");
+require("../runtime-api.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-CHzaaWiC.cjs");
+const require_channel = require("./channel-Dzpbbht8.cjs");
+const require_channel_setup = require("./channel.setup-BVDfgdCc.cjs");
+const require_polls = require("./polls-BJ4-4uZm.cjs");
+const require_messenger = require("./messenger-BR1l4zw-.cjs");
 let openclaw_plugin_sdk_channel_outbound = require("openclaw/plugin-sdk/channel-outbound");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
+let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
+let openclaw_plugin_sdk_channel_inbound = require("openclaw/plugin-sdk/channel-inbound");
 let openclaw_plugin_sdk_markdown_table_runtime = require("openclaw/plugin-sdk/markdown-table-runtime");
 let openclaw_plugin_sdk_account_helpers = require("openclaw/plugin-sdk/account-helpers");
 let openclaw_plugin_sdk_outbound_media = require("openclaw/plugin-sdk/outbound-media");
@@ -176,11 +178,27 @@ const FILE_CONSENT_THRESHOLD_BYTES = 4194304;
 */
 const MSTEAMS_MAX_MEDIA_BYTES = 104857600;
 function createMSTeamsSendError(errorPrefix, error) {
+	if (error instanceof Error && (error instanceof openclaw_plugin_sdk_error_runtime.PlatformMessageNotDispatchedError || (0, openclaw_plugin_sdk_channel_inbound.isChannelPartialDeliveryError)(error))) return error;
 	const classification = require_channel_setup.classifyMSTeamsSendError(error);
 	const hint = require_channel_setup.formatMSTeamsSendErrorHint(classification);
 	const status = classification.statusCode ? ` (HTTP ${classification.statusCode})` : "";
 	return new Error(`${errorPrefix} failed${status}: ${require_channel_setup.formatUnknownError(error)}${hint ? ` (${hint})` : ""}`, { cause: error });
 }
+function createMSTeamsPartialSendError(error, receipt) {
+	return (0, openclaw_plugin_sdk_channel_inbound.createChannelPartialDeliveryError)(error, {
+		visibleReplySent: true,
+		messageIds: receipt.platformMessageIds,
+		receipt
+	});
+}
+async function finishMSTeamsSend(result, settle) {
+	try {
+		await settle();
+	} catch (error) {
+		throw createMSTeamsPartialSendError(error, result.receipt);
+	}
+	return result;
+}
 function createMSTeamsSendReceipt(params) {
 	const receipt = (0, openclaw_plugin_sdk_channel_outbound.createMessageReceiptFromOutboundResults)({
 		kind: params.kind,
@@ -232,6 +250,7 @@ function createMSTeamsSendResult(params) {
 * - Group chats / channels: files require configured SharePoint storage
 */
 async function sendMessageMSTeams(params) {
+	require_resolve_allowlist.assertMSTeamsSendHandoff(params);
 	const { cfg, to, text, mediaUrl, filename, mediaAccess, mediaLocalRoots, mediaReadFile } = params;
 	const tableMode = (0, openclaw_plugin_sdk_markdown_table_runtime.resolveMarkdownTableMode)({
 		cfg,
@@ -275,6 +294,7 @@ async function sendMessageMSTeams(params) {
 			bufferSize: media.buffer.length,
 			thresholdBytes: FILE_CONSENT_THRESHOLD_BYTES
 		})) {
+			require_resolve_allowlist.assertMSTeamsSendHandoff(params);
 			const { activity, uploadId } = await require_messenger.prepareFileConsentActivityFs({
 				media: {
 					buffer: media.buffer,
@@ -292,29 +312,37 @@ async function sendMessageMSTeams(params) {
 			const messageId = await sendProactiveActivity({
 				ctx,
 				activity,
-				errorPrefix: "msteams consent card send"
+				errorPrefix: "msteams consent card send",
+				assertDirectAdapterHandoff: params.assertDirectAdapterHandoff,
+				onPlatformSendDispatch: params.onPlatformSendDispatch
 			});
-			require_messenger.setPendingUploadActivityId(uploadId, messageId);
-			await require_messenger.setPendingUploadActivityIdFs(uploadId, messageId);
-			log.info("sent file consent card", {
-				conversationId,
-				messageId,
-				uploadId
-			});
-			return createMSTeamsSendResult({
+			const result = createMSTeamsSendResult({
 				messageId,
 				conversationId,
 				kind: "card",
 				pendingUploadId: uploadId
 			});
+			return finishMSTeamsSend(result, async () => {
+				require_messenger.setPendingUploadActivityId(uploadId, messageId);
+				try {
+					await params.onDeliveryResult?.(result);
+				} finally {
+					await require_messenger.setPendingUploadActivityIdFs(uploadId, messageId);
+				}
+				log.info("sent file consent card", {
+					conversationId,
+					messageId,
+					uploadId
+				});
+			});
 		}
 		if (conversationType === "personal") {
 			const base64 = media.buffer.toString("base64");
-			return sendTextWithMedia(ctx, messageText, `data:${media.contentType};base64,${base64}`);
+			return sendTextWithMedia(ctx, messageText, `data:${media.contentType};base64,${base64}`, params);
 		}
 		if (isImage && !sharePointSiteId) {
 			const base64 = media.buffer.toString("base64");
-			return sendTextWithMedia(ctx, messageText, `data:${media.contentType};base64,${base64}`);
+			return sendTextWithMedia(ctx, messageText, `data:${media.contentType};base64,${base64}`, params);
 		}
 		try {
 			const siteId = require_messenger.requireMSTeamsSharePointSiteId(sharePointSiteId);
@@ -324,6 +352,7 @@ async function sendMessageMSTeams(params) {
 				siteId
 			});
 			const uploaded = await require_messenger.uploadAndShareSharePoint({
+				assertDirectAdapterHandoff: params.assertDirectAdapterHandoff,
 				buffer: media.buffer,
 				filename: fileName,
 				contentType: media.contentType,
@@ -337,6 +366,7 @@ async function sendMessageMSTeams(params) {
 				shareUrl: uploaded.shareUrl
 			});
 			const driveItem = await require_messenger.getDriveItemProperties({
+				assertDirectAdapterHandoff: params.assertDirectAdapterHandoff,
 				siteId,
 				itemId: uploaded.itemId,
 				tokenProvider
@@ -351,36 +381,55 @@ async function sendMessageMSTeams(params) {
 				activity: {
 					...require_messenger.buildMSTeamsMessageActivity(messageText || void 0),
 					attachments: [fileCardAttachment]
-				}
+				},
+				assertDirectAdapterHandoff: params.assertDirectAdapterHandoff,
+				onPlatformSendDispatch: params.onPlatformSendDispatch
 			});
 			log.info("sent native file card", {
 				conversationId,
 				messageId,
 				fileName: driveItem.name
 			});
-			return createMSTeamsSendResult({
+			const result = createMSTeamsSendResult({
 				messageId,
 				conversationId,
 				kind: "media"
 			});
+			return await finishMSTeamsSend(result, async () => {
+				await params.onDeliveryResult?.(result);
+			});
 		} catch (err) {
 			throw createMSTeamsSendError("msteams file send", err);
 		}
 	}
-	return sendTextWithMedia(ctx, messageText, void 0);
+	return sendTextWithMedia(ctx, messageText, void 0, params);
 }
 /**
 * Send a text message with optional base64 media URL.
 */
-async function sendTextWithMedia(ctx, text, mediaUrl) {
+async function sendTextWithMedia(ctx, text, mediaUrl, options) {
 	const { app, appId, conversationId, ref, log, tokenProvider, sharePointSiteId, mediaMaxBytes, replyStyle } = ctx;
 	const messages = text && mediaUrl ? [{ text }, { mediaUrl }] : [{
 		text: text || void 0,
 		mediaUrl
 	}];
 	let platformMessageIds;
+	const acceptedIds = [];
+	const acceptedKinds = [];
 	try {
 		platformMessageIds = await require_messenger.sendMSTeamsMessages({
+			assertDirectAdapterHandoff: options.assertDirectAdapterHandoff,
+			onPlatformSendDispatch: options.onPlatformSendDispatch,
+			onMessageSent: async (messageId, messageIndex) => {
+				const kind = messages[messageIndex]?.mediaUrl ? "media" : "text";
+				acceptedIds.push(messageId);
+				acceptedKinds.push(kind);
+				await options.onDeliveryResult?.(createMSTeamsSendResult({
+					conversationId,
+					messageId,
+					kind
+				}));
+			},
 			replyStyle,
 			app,
 			appId,
@@ -399,7 +448,14 @@ async function sendTextWithMedia(ctx, text, mediaUrl) {
 			serviceUrlBoundary: ctx.sdkCloudOptions
 		});
 	} catch (err) {
-		throw createMSTeamsSendError("msteams send", err);
+		const error = createMSTeamsSendError("msteams send", err);
+		if (acceptedIds.length > 0) throw createMSTeamsPartialSendError(error, createMSTeamsSendReceipt({
+			conversationId,
+			platformMessageIds: acceptedIds,
+			kind: mediaUrl ? "media" : "text",
+			kinds: acceptedKinds
+		}));
+		throw error;
 	}
 	const messageId = platformMessageIds[0] ?? "unknown";
 	log.info("sent proactive message", {
@@ -417,22 +473,21 @@ async function sendTextWithMedia(ctx, text, mediaUrl) {
 		})
 	};
 }
-async function sendProactiveActivityRaw({ ctx, activity }) {
+async function sendProactiveActivityRaw({ ctx, activity, assertDirectAdapterHandoff, onPlatformSendDispatch }) {
 	const baseRef = require_messenger.buildConversationReference(ctx.ref);
 	const response = await require_messenger.sendMSTeamsActivityWithReference(ctx.app, baseRef, activity, {
+		assertDirectAdapterHandoff,
+		onPlatformSendDispatch,
 		...ctx.threadActivityId ? { threadActivityId: ctx.threadActivityId } : {},
 		serviceUrlBoundary: ctx.sdkCloudOptions
 	});
 	return require_messenger.extractMessageId(response) ?? "unknown";
 }
-async function sendProactiveActivity({ ctx, activity, errorPrefix }) {
+async function sendProactiveActivity(params) {
 	try {
-		return await sendProactiveActivityRaw({
-			ctx,
-			activity
-		});
+		return await sendProactiveActivityRaw(params);
 	} catch (err) {
-		throw createMSTeamsSendError(errorPrefix, err);
+		throw createMSTeamsSendError(params.errorPrefix, err);
 	}
 }
 /**
@@ -481,6 +536,7 @@ async function sendPollMSTeams(params) {
 * Send an arbitrary Adaptive Card to a Teams conversation or user.
 */
 async function sendAdaptiveCardMSTeams(params) {
+	require_resolve_allowlist.assertMSTeamsSendHandoff(params);
 	const { cfg, to, card } = params;
 	const ctx = await resolveMSTeamsSendContext({
 		cfg,
@@ -501,16 +557,22 @@ async function sendAdaptiveCardMSTeams(params) {
 				content: card
 			}]
 		},
-		errorPrefix: "msteams card send"
+		errorPrefix: "msteams card send",
+		assertDirectAdapterHandoff: params.assertDirectAdapterHandoff,
+		onPlatformSendDispatch: params.onPlatformSendDispatch
 	});
 	log.info("sent adaptive card", {
 		conversationId,
 		messageId
 	});
-	return {
+	const result = createMSTeamsSendResult({
 		messageId,
-		conversationId
-	};
+		conversationId,
+		kind: "card"
+	});
+	return finishMSTeamsSend(result, async () => {
+		await params.onDeliveryResult?.(result);
+	});
 }
 /**
 * Edit (update) a previously sent message in a Teams conversation.

package/dist/.setup/setup-plugin-api-DpiaA8z1.cjs

@@ -0,0 +1,3 @@
+const require_channel_setup = require("./channel.setup-BVDfgdCc.cjs");
+require("../setup-plugin-api.cjs");
+exports.msteamsSetupPlugin = require_channel_setup.msteamsSetupPlugin;

package/dist/{src-D7Do7sM5.cjs → .setup/src-CpKfpP1m.cjs}

@@ -1,15 +1,15 @@
 const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
 const require_runtime = require("./runtime-gZTAuFux.cjs");
-require("./runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-DmUTQxEz.cjs");
-const require_channel = require("./channel-B9LIyYeu.cjs");
-const require_thread_session = require("./thread-session-NmA7_njI.cjs");
-const require_channel_setup = require("./channel.setup-BhxokviI.cjs");
-const require_polls = require("./polls-BBdZPx_R.cjs");
-const require_sso_token_store = require("./sso-token-store-DTeYxubp.cjs");
+require("../runtime-api.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-CHzaaWiC.cjs");
+const require_channel = require("./channel-Dzpbbht8.cjs");
+const require_thread_session = require("./thread-session-CXgHK-yi.cjs");
+const require_channel_setup = require("./channel.setup-BVDfgdCc.cjs");
+const require_polls = require("./polls-BJ4-4uZm.cjs");
+const require_sso_token_store = require("./sso-token-store-YYLHXgFH.cjs");
 const require_approval_card = require("./approval-card-CPNH_q3P.cjs");
-const require_messenger = require("./messenger-TLdZf9Ar.cjs");
-const require_reaction_types = require("./reaction-types-BbBBdnQ5.cjs");
+const require_messenger = require("./messenger-BR1l4zw-.cjs");
+const require_reaction_types = require("./reaction-types-C7RA7Wxt.cjs");
 let openclaw_plugin_sdk_channel_outbound = require("openclaw/plugin-sdk/channel-outbound");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
@@ -19,10 +19,10 @@ let openclaw_plugin_sdk_media_runtime = require("openclaw/plugin-sdk/media-runti
 let openclaw_plugin_sdk_ssrf_runtime = require("openclaw/plugin-sdk/ssrf-runtime");
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
 let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text-utility-runtime");
+let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
 let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");
 let node_crypto = require("node:crypto");
 node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
-let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
 let openclaw_plugin_sdk_channel_inbound = require("openclaw/plugin-sdk/channel-inbound");
 let openclaw_plugin_sdk_approval_gateway_runtime = require("openclaw/plugin-sdk/approval-gateway-runtime");
 let openclaw_plugin_sdk_channel_ingress_runtime = require("openclaw/plugin-sdk/channel-ingress-runtime");
@@ -47,18 +47,35 @@ const MAX_LEARNING_ENTRIES = 1e4;
 function learningStoreKey(storePath, sessionKey) {
 	return node_crypto.default.createHash("sha256").update(`${storePath}\0${sessionKey}`, "utf8").digest("hex");
 }
+function appendFeedbackLearning(current, prepared) {
+	return {
+		sessionKey: prepared.sessionKey,
+		learnings: [...current?.learnings ?? [], prepared.learning].slice(-10),
+		updatedAt: prepared.updatedAt
+	};
+}
 async function storeSessionLearning(params) {
 	const store = require_runtime.getMSTeamsRuntime().state.openKeyedStore({
 		namespace: LEARNINGS_NAMESPACE,
 		maxEntries: MAX_LEARNING_ENTRIES
 	});
 	const key = learningStoreKey(params.storePath, params.sessionKey);
-	if (!store.update) throw new Error("plugin state atomic update is unavailable");
-	await store.update(key, (existing) => ({
+	if (!store.observe || !store.compareAndApply) throw new Error("plugin state atomic comparison is unavailable");
+	const prepared = {
 		sessionKey: params.sessionKey,
-		learnings: [...existing?.learnings ?? [], params.learning].slice(-10),
+		learning: params.learning,
 		updatedAt: Date.now()
-	}));
+	};
+	let observed = await store.observe(key);
+	while (true) {
+		const result = await store.compareAndApply(key, observed.comparison, {
+			operation: "update",
+			action: "set",
+			value: appendFeedbackLearning(observed.value, prepared)
+		});
+		if (result.status !== "conflict") return;
+		observed = result.current;
+	}
 }
 //#endregion
 //#region extensions/msteams/src/feedback-reflection.ts
@@ -310,6 +327,7 @@ async function resolveMSTeamsSenderAccess(params) {
 	const conversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(activity.conversation?.id ?? "unknown");
 	const convType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(activity.conversation?.conversationType);
 	const isDirectMessage = convType === "personal" || !convType && !activity.conversation?.isGroup;
+	const hasConflictingConversationScope = isDirectMessage && (activity.conversation?.isGroup === true || activity.channelData?.team !== void 0 || activity.channelData?.channel !== void 0);
 	const senderId = activity.from?.aadObjectId ?? activity.from?.id ?? "unknown";
 	const senderName = activity.from?.name ?? activity.from?.id ?? senderId;
 	const core = require_runtime.getMSTeamsRuntime();
@@ -397,6 +415,7 @@ async function resolveMSTeamsSenderAccess(params) {
 		channelIngress: resolved,
 		pairing,
 		isDirectMessage,
+		hasConflictingConversationScope,
 		conversationId,
 		senderId,
 		senderName,
@@ -419,9 +438,14 @@ async function admitMSTeamsMessage(params) {
 		activity: params.activity,
 		hasControlCommand: isControlCommand
 	});
-	const { dmPolicy, senderId, senderName, pairing, isDirectMessage, channelGate, senderAccess, commandAccess, allowNameMatching, groupPolicy, msteamsCfg } = access;
+	const { dmPolicy, senderId, senderName, pairing, isDirectMessage, hasConflictingConversationScope, channelGate, senderAccess, commandAccess, allowNameMatching, groupPolicy, msteamsCfg } = access;
 	const effectiveDmAllowFrom = senderAccess.effectiveAllowFrom;
 	const effectiveGroupAllowFrom = senderAccess.effectiveGroupAllowFrom;
+	if (hasConflictingConversationScope) {
+		params.log.info("dropping message (conflicting conversation scope)", { conversationId: params.conversationId });
+		params.log.debug?.("dropping message (conflicting conversation scope)");
+		return null;
+	}
 	if (isDirectMessage && msteamsCfg && senderAccess.decision !== "allow") {
 		if (senderAccess.reasonCode === "dm_policy_disabled") {
 			params.log.info("dropping dm (dms disabled)", {
@@ -873,11 +897,11 @@ function createAdvertisedMediaFact(kind, sourceId) {
 	if (sourceId) media.sourceId = sourceId;
 	return media;
 }
-function resolveMSTeamsAdvertisedMedia(attachments, limits) {
+function resolveMSTeamsAdvertisedMedia(attachments) {
 	const list = Array.isArray(attachments) ? attachments : [];
 	if (list.length === 0) return [];
 	const fileAttachments = list.filter(require_resolve_allowlist.isAdvertisedFileAttachment);
-	const inlineMedia = require_resolve_allowlist.extractInlineImageCandidates(list, limits).map((candidate) => createAdvertisedMediaFact("image", candidate.sourceId));
+	const inlineMedia = require_resolve_allowlist.extractInlineImageReferences(list).map((candidate) => createAdvertisedMediaFact("image", candidate.sourceId));
 	const htmlAttachmentIds = resolveUnrepresentedHtmlAttachmentIds(list);
 	return [
 		...fileAttachments.map((attachment) => createAdvertisedMediaFact(require_resolve_allowlist.isLikelyImageAttachment(attachment) ? "image" : require_resolve_allowlist.resolveMSTeamsMediaKind({
@@ -995,6 +1019,44 @@ function scopeCandidatesForUrl(url) {
 		return ["https://api.botframework.com", "https://graph.microsoft.com"];
 	}
 }
+function canonicalizeInlineBase64Payload(value) {
+	let cleaned = "";
+	let padding = 0;
+	let sawPadding = false;
+	for (let index = 0; index < value.length; index += 1) {
+		const code = value.charCodeAt(index);
+		if (code <= 32) continue;
+		if (code === 61) {
+			padding += 1;
+			if (padding > 2) return;
+			sawPadding = true;
+			cleaned += "=";
+			continue;
+		}
+		if (sawPadding || !(code >= 65 && code <= 90 || code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 43 || code === 47)) return;
+		cleaned += value[index];
+	}
+	return cleaned && cleaned.length % 4 === 0 ? cleaned : void 0;
+}
+function decodeInlineDataImage(src, maxBytes, totalBytes) {
+	const match = /^data:(image\/[a-z0-9.+-]+)?(;base64)?,(.*)$/i.exec(src);
+	if (!match) return null;
+	const contentType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(match[1] ?? "");
+	if (!Boolean(match[2])) return null;
+	const canonicalPayload = canonicalizeInlineBase64Payload(match[3] ?? "");
+	if (!canonicalPayload) return null;
+	const estimatedBytes = Buffer.byteLength(canonicalPayload, "base64");
+	if (estimatedBytes <= 0 || typeof maxBytes === "number" && (estimatedBytes > maxBytes || totalBytes + estimatedBytes > maxBytes)) return null;
+	try {
+		return {
+			data: Buffer.from(canonicalPayload, "base64"),
+			contentType,
+			estimatedBytes
+		};
+	} catch {
+		return null;
+	}
+}
 async function resolveInlineDataImageMime(inline) {
 	const detectedMime = await require_runtime.getMSTeamsRuntime().media.detectMime({
 		buffer: inline.data,
@@ -1070,15 +1132,12 @@ async function downloadMSTeamsAttachments(params) {
 			sourceId: attachment.id?.trim() || void 0
 		};
 	});
-	candidates.push(...require_resolve_allowlist.extractInlineImageCandidates(list, {
-		maxInlineBytes: params.maxBytes,
-		maxInlineTotalBytes: params.maxBytes
-	}).map((candidate) => {
+	const maxInlineBytes = params.maxBytes;
+	candidates.push(...require_resolve_allowlist.extractInlineImageReferences(list).map((candidate) => {
 		if (candidate.kind === "data") return {
 			kind: "data",
 			mediaKind: "image",
-			data: candidate.data,
-			contentType: candidate.contentType,
+			src: candidate.src,
 			sourceId: candidate.sourceId
 		};
 		if (candidate.kind === "url") return {
@@ -1095,30 +1154,33 @@ async function downloadMSTeamsAttachments(params) {
 			sourceId: candidate.sourceId
 		};
 	}));
-	const advertisedMedia = resolveMSTeamsAdvertisedMedia(list, {
-		maxInlineBytes: params.maxBytes,
-		maxInlineTotalBytes: params.maxBytes
-	});
-	for (const advertised of advertisedMedia.slice(candidates.length)) candidates.push({
+	for (const sourceId of resolveUnrepresentedHtmlAttachmentIds(list)) candidates.push({
 		kind: "unavailable",
-		mediaKind: advertised.kind,
-		sourceId: advertised.sourceId
+		mediaKind: "document",
+		sourceId
 	});
 	if (candidates.length === 0) return [];
 	const out = [];
+	let totalInlineBytes = 0;
 	for (const candidate of candidates) {
 		if (candidate.kind === "unavailable") {
 			out.push(withSourceId({ kind: candidate.mediaKind }, candidate.sourceId));
 			continue;
 		}
 		if (candidate.kind === "data") {
+			const decoded = decodeInlineDataImage(candidate.src, maxInlineBytes, totalInlineBytes);
+			if (!decoded) {
+				out.push(withSourceId({ kind: candidate.mediaKind }, candidate.sourceId));
+				continue;
+			}
+			totalInlineBytes += decoded.estimatedBytes;
 			try {
-				const contentType = await resolveInlineDataImageMime(candidate);
+				const contentType = await resolveInlineDataImageMime(decoded);
 				if (!contentType) {
 					out.push(withSourceId({ kind: candidate.mediaKind }, candidate.sourceId));
 					continue;
 				}
-				const saved = await require_runtime.getMSTeamsRuntime().channel.media.saveMediaBuffer(candidate.data, contentType, "inbound", params.maxBytes);
+				const saved = await require_runtime.getMSTeamsRuntime().channel.media.saveMediaBuffer(decoded.data, contentType, "inbound", params.maxBytes);
 				out.push(withSourceId({
 					path: saved.path,
 					contentType: saved.contentType,
@@ -1834,6 +1896,7 @@ function createTeamsReplyStreamController(params) {
 		return payloads;
 	};
 	const progressDraft = (0, openclaw_plugin_sdk_channel_outbound.createChannelProgressDraftCompositor)({
+		formatPlainText: (text) => text,
 		entry: params.msteamsConfig,
 		mode: streamMode,
 		active: Boolean(stream) && streamMode === "progress",
@@ -2460,7 +2523,10 @@ function createMSTeamsReplyDispatcher(params) {
 		},
 		onPlanUpdate: async (payload) => {
 			if (payload?.phase !== "update") return false;
-			await streamController.pushPlanProgress((0, openclaw_plugin_sdk_channel_outbound.normalizeAgentPlanSteps)(payload.steps), { explanation: typeof payload.explanation === "string" ? payload.explanation : void 0 });
+			await streamController.pushPlanProgress((0, openclaw_plugin_sdk_channel_outbound.normalizeAgentPlanSteps)(payload.steps), {
+				explanation: typeof payload.explanation === "string" ? payload.explanation : void 0,
+				explanationFormat: payload.explanationFormat === "plain" ? "plain" : void 0
+			});
 			return false;
 		},
 		onApprovalEvent: async (payload) => {
@@ -2843,8 +2909,7 @@ function buildStoredConversationReference(params) {
 		...threadId ? { threadId } : {}
 	};
 }
-function assembleMSTeamsInboundFacts(params) {
-	const { entry, mediaMaxBytes } = params;
+function assembleMSTeamsInboundFacts(entry) {
 	const activity = entry.context.activity;
 	const conversation = activity.conversation;
 	const rawConversationId = conversation?.id ?? "";
@@ -2854,10 +2919,7 @@ function assembleMSTeamsInboundFacts(params) {
 	const isChannel = conversationType === "channel";
 	const teamId = activity.channelData?.team?.id;
 	const threadId = isChannel ? conversationMessageId ?? activity.replyToId ?? void 0 : void 0;
-	const advertisedMedia = resolveMSTeamsAdvertisedMedia(entry.attachments, {
-		maxInlineBytes: mediaMaxBytes,
-		maxInlineTotalBytes: mediaMaxBytes
-	});
+	const advertisedMedia = resolveMSTeamsAdvertisedMedia(entry.attachments);
 	return {
 		...entry,
 		activity,
@@ -3157,10 +3219,7 @@ function createMSTeamsMessageHandler(deps) {
 		channel: "msteams"
 	});
 	const handleTeamsMessageNow = async (params) => {
-		const facts = assembleMSTeamsInboundFacts({
-			entry: params,
-			mediaMaxBytes
-		});
+		const facts = assembleMSTeamsInboundFacts(params);
 		const { context, activity, rawText, text, attachments, advertisedMedia, rawBody, quoteInfo, from, conversation, attachmentTypes, htmlSummary, conversationId, conversationMessageId, conversationType, isChannel, teamId, conversationRef } = facts;
 		const historyBody = [text, (0, openclaw_plugin_sdk_channel_inbound.formatMediaPlaceholderText)(advertisedMedia)].filter(Boolean).join("\n");
 		log.info("received message", {
@@ -3420,21 +3479,33 @@ function createMSTeamsReactionHandler(deps) {
 		}
 		const rawConversationId = activity.conversation?.id ?? "";
 		const conversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(rawConversationId);
-		const conversationType = activity.conversation?.conversationType ?? "personal";
-		const isGroupChat = conversationType === "groupChat" || activity.conversation?.isGroup === true;
-		const isChannel = conversationType === "channel";
-		const isDirectMessage = !isGroupChat && !isChannel;
+		const isChannel = activity.conversation?.conversationType === "channel";
 		const senderId = from.aadObjectId ?? from.id;
 		const senderName = from.name ?? from.id;
+		const access = await resolveMSTeamsSenderAccess({
+			cfg,
+			activity
+		});
+		const { isDirectMessage, channelGate } = access;
+		if (access.hasConflictingConversationScope) {
+			log.info("dropping reaction (conflicting conversation scope)", { conversationId });
+			return;
+		}
 		if (msteamsCfg) {
-			const senderAccess = await resolveMSTeamsSenderAccess({
-				cfg,
-				activity
-			});
-			if (senderAccess.senderAccess.decision !== "allow") {
+			if (access.senderAccess.decision !== "allow") {
 				log.debug?.("dropping reaction (access denied)", {
 					sender: senderId,
-					reason: senderAccess.senderAccess.reasonCode
+					reason: access.senderAccess.reasonCode
+				});
+				return;
+			}
+			if (!isDirectMessage && channelGate.allowlistConfigured && !channelGate.allowed) {
+				log.info("dropping reaction (not in team/channel allowlist)", {
+					conversationId,
+					teamKey: channelGate.teamKey ?? "none",
+					channelKey: channelGate.channelKey ?? "none",
+					channelMatchKey: channelGate.channelMatchKey ?? "none",
+					channelMatchSource: channelGate.channelMatchSource ?? "none"
 				});
 				return;
 			}
@@ -3523,8 +3594,15 @@ async function isInvokeAuthorized(params) {
 		activity: context.activity
 	});
 	const { msteamsCfg, isDirectMessage, conversationId, senderId } = resolved;
-	if (!msteamsCfg) return true;
 	const maybeInvokeName = includeInvokeName ? { name: context.activity.name } : void 0;
+	if (resolved.hasConflictingConversationScope) {
+		deps.log.info("dropping invoke (conflicting conversation scope)", {
+			conversationId,
+			...maybeInvokeName
+		});
+		return false;
+	}
+	if (!msteamsCfg) return true;
 	if (isDirectMessage && resolved.senderAccess.decision !== "allow") {
 		deps.log.debug?.(deniedLogs.dm, {
 			sender: senderId,

package/dist/{sso-token-store-DTeYxubp.cjs → .setup/sso-token-store-YYLHXgFH.cjs}

@@ -1,5 +1,5 @@
 const require_runtime = require("./runtime-gZTAuFux.cjs");
-const require_polls = require("./polls-BBdZPx_R.cjs");
+const require_polls = require("./polls-BJ4-4uZm.cjs");
 let node_crypto = require("node:crypto");
 //#region extensions/msteams/src/sso-token-store.ts
 /**

package/dist/{thread-session-NmA7_njI.cjs → .setup/thread-session-CXgHK-yi.cjs}

@@ -1,4 +1,4 @@
-const require_resolve_allowlist = require("./resolve-allowlist-DmUTQxEz.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-CHzaaWiC.cjs");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_approval_auth_runtime = require("openclaw/plugin-sdk/approval-auth-runtime");
 let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");

package/dist/api.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_channel = require("./channel-B9LIyYeu.cjs");
-const require_channel_setup = require("./channel.setup-BhxokviI.cjs");
+const require_channel = require("./.setup/channel-Dzpbbht8.cjs");
+const require_channel_setup = require("./.setup/channel.setup-BVDfgdCc.cjs");
 exports.createMSTeamsSetupWizardBase = require_channel_setup.createMSTeamsSetupWizardBase;
 exports.msteamsPlugin = require_channel.msteamsPlugin;
 exports.msteamsSetupAdapter = require_channel_setup.msteamsSetupAdapter;

package/dist/channel-config-api.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_config_schema = require("./config-schema-D22Lr1Qk.cjs");
+const require_config_schema = require("./.setup/config-schema-D22Lr1Qk.cjs");
 exports.MSTeamsChannelConfigSchema = require_config_schema.MSTeamsChannelConfigSchema;

package/dist/channel-plugin-api.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_channel = require("./channel-B9LIyYeu.cjs");
+const require_channel = require("./.setup/channel-Dzpbbht8.cjs");
 exports.msteamsPlugin = require_channel.msteamsPlugin;

package/dist/configured-state.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("./secret-input-C65t6kjM.cjs");
+require("./.setup/secret-input-C65t6kjM.cjs");
 let openclaw_plugin_sdk_secret_input = require("openclaw/plugin-sdk/secret-input");
 //#region extensions/msteams/configured-state.ts
 /** Mirror Teams auth-mode requirements without loading the Azure SDK or full channel. */

package/dist/directory-contract-api.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_resolve_allowlist = require("./resolve-allowlist-DmUTQxEz.cjs");
+const require_resolve_allowlist = require("./.setup/resolve-allowlist-CHzaaWiC.cjs");
 let openclaw_plugin_sdk_directory_runtime = require("openclaw/plugin-sdk/directory-runtime");
 const msteamsDirectoryContractPlugin = {
 	id: "msteams",