@openclaw/msteams 2026.9.4 → 2026.9.6

package/dist/{src-D7Do7sM5.cjs → .setup/src-BfOCwlHp.cjs}

@@ -1,15 +1,15 @@
 const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
 const require_runtime = require("./runtime-gZTAuFux.cjs");
-require("./runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-DmUTQxEz.cjs");
-const require_channel = require("./channel-B9LIyYeu.cjs");
-const require_thread_session = require("./thread-session-NmA7_njI.cjs");
-const require_channel_setup = require("./channel.setup-BhxokviI.cjs");
-const require_polls = require("./polls-BBdZPx_R.cjs");
-const require_sso_token_store = require("./sso-token-store-DTeYxubp.cjs");
+require("../runtime-api.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-CHzaaWiC.cjs");
+const require_channel = require("./channel-BDp16XRR.cjs");
+const require_thread_session = require("./thread-session-CXgHK-yi.cjs");
+const require_channel_setup = require("./channel.setup-BVDfgdCc.cjs");
+const require_polls = require("./polls-BJ4-4uZm.cjs");
+const require_sso_token_store = require("./sso-token-store-YYLHXgFH.cjs");
 const require_approval_card = require("./approval-card-CPNH_q3P.cjs");
-const require_messenger = require("./messenger-TLdZf9Ar.cjs");
-const require_reaction_types = require("./reaction-types-BbBBdnQ5.cjs");
+const require_messenger = require("./messenger-8RA1FUJa.cjs");
+const require_reaction_types = require("./reaction-types-C7RA7Wxt.cjs");
 let openclaw_plugin_sdk_channel_outbound = require("openclaw/plugin-sdk/channel-outbound");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
@@ -19,10 +19,10 @@ let openclaw_plugin_sdk_media_runtime = require("openclaw/plugin-sdk/media-runti
 let openclaw_plugin_sdk_ssrf_runtime = require("openclaw/plugin-sdk/ssrf-runtime");
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
 let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text-utility-runtime");
+let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
 let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");
 let node_crypto = require("node:crypto");
 node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
-let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
 let openclaw_plugin_sdk_channel_inbound = require("openclaw/plugin-sdk/channel-inbound");
 let openclaw_plugin_sdk_approval_gateway_runtime = require("openclaw/plugin-sdk/approval-gateway-runtime");
 let openclaw_plugin_sdk_channel_ingress_runtime = require("openclaw/plugin-sdk/channel-ingress-runtime");
@@ -47,18 +47,35 @@ const MAX_LEARNING_ENTRIES = 1e4;
 function learningStoreKey(storePath, sessionKey) {
 	return node_crypto.default.createHash("sha256").update(`${storePath}\0${sessionKey}`, "utf8").digest("hex");
 }
+function appendFeedbackLearning(current, prepared) {
+	return {
+		sessionKey: prepared.sessionKey,
+		learnings: [...current?.learnings ?? [], prepared.learning].slice(-10),
+		updatedAt: prepared.updatedAt
+	};
+}
 async function storeSessionLearning(params) {
 	const store = require_runtime.getMSTeamsRuntime().state.openKeyedStore({
 		namespace: LEARNINGS_NAMESPACE,
 		maxEntries: MAX_LEARNING_ENTRIES
 	});
 	const key = learningStoreKey(params.storePath, params.sessionKey);
-	if (!store.update) throw new Error("plugin state atomic update is unavailable");
-	await store.update(key, (existing) => ({
+	if (!store.observe || !store.compareAndApply) throw new Error("plugin state atomic comparison is unavailable");
+	const prepared = {
 		sessionKey: params.sessionKey,
-		learnings: [...existing?.learnings ?? [], params.learning].slice(-10),
+		learning: params.learning,
 		updatedAt: Date.now()
-	}));
+	};
+	let observed = await store.observe(key);
+	while (true) {
+		const result = await store.compareAndApply(key, observed.comparison, {
+			operation: "update",
+			action: "set",
+			value: appendFeedbackLearning(observed.value, prepared)
+		});
+		if (result.status !== "conflict") return;
+		observed = result.current;
+	}
 }
 //#endregion
 //#region extensions/msteams/src/feedback-reflection.ts
@@ -310,6 +327,7 @@ async function resolveMSTeamsSenderAccess(params) {
 	const conversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(activity.conversation?.id ?? "unknown");
 	const convType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(activity.conversation?.conversationType);
 	const isDirectMessage = convType === "personal" || !convType && !activity.conversation?.isGroup;
+	const hasConflictingConversationScope = isDirectMessage && (activity.conversation?.isGroup === true || activity.channelData?.team !== void 0 || activity.channelData?.channel !== void 0);
 	const senderId = activity.from?.aadObjectId ?? activity.from?.id ?? "unknown";
 	const senderName = activity.from?.name ?? activity.from?.id ?? senderId;
 	const core = require_runtime.getMSTeamsRuntime();
@@ -332,7 +350,7 @@ async function resolveMSTeamsSenderAccess(params) {
 		channelName: activity.channelData?.channel?.name,
 		allowNameMatching
 	});
-	const resolved = await (0, openclaw_plugin_sdk_channel_ingress_runtime.resolveStableChannelMessageIngress)({
+	const resolved = await core.channel.inbound.ingress.resolveStable({
 		channelId: "msteams",
 		accountId: pairing.accountId,
 		identity: {
@@ -397,6 +415,7 @@ async function resolveMSTeamsSenderAccess(params) {
 		channelIngress: resolved,
 		pairing,
 		isDirectMessage,
+		hasConflictingConversationScope,
 		conversationId,
 		senderId,
 		senderName,
@@ -419,9 +438,14 @@ async function admitMSTeamsMessage(params) {
 		activity: params.activity,
 		hasControlCommand: isControlCommand
 	});
-	const { dmPolicy, senderId, senderName, pairing, isDirectMessage, channelGate, senderAccess, commandAccess, allowNameMatching, groupPolicy, msteamsCfg } = access;
+	const { dmPolicy, senderId, senderName, pairing, isDirectMessage, hasConflictingConversationScope, channelGate, senderAccess, commandAccess, allowNameMatching, groupPolicy, msteamsCfg } = access;
 	const effectiveDmAllowFrom = senderAccess.effectiveAllowFrom;
 	const effectiveGroupAllowFrom = senderAccess.effectiveGroupAllowFrom;
+	if (hasConflictingConversationScope) {
+		params.log.info("dropping message (conflicting conversation scope)", { conversationId: params.conversationId });
+		params.log.debug?.("dropping message (conflicting conversation scope)");
+		return null;
+	}
 	if (isDirectMessage && msteamsCfg && senderAccess.decision !== "allow") {
 		if (senderAccess.reasonCode === "dm_policy_disabled") {
 			params.log.info("dropping dm (dms disabled)", {
@@ -873,11 +897,11 @@ function createAdvertisedMediaFact(kind, sourceId) {
 	if (sourceId) media.sourceId = sourceId;
 	return media;
 }
-function resolveMSTeamsAdvertisedMedia(attachments, limits) {
+function resolveMSTeamsAdvertisedMedia(attachments) {
 	const list = Array.isArray(attachments) ? attachments : [];
 	if (list.length === 0) return [];
 	const fileAttachments = list.filter(require_resolve_allowlist.isAdvertisedFileAttachment);
-	const inlineMedia = require_resolve_allowlist.extractInlineImageCandidates(list, limits).map((candidate) => createAdvertisedMediaFact("image", candidate.sourceId));
+	const inlineMedia = require_resolve_allowlist.extractInlineImageReferences(list).map((candidate) => createAdvertisedMediaFact("image", candidate.sourceId));
 	const htmlAttachmentIds = resolveUnrepresentedHtmlAttachmentIds(list);
 	return [
 		...fileAttachments.map((attachment) => createAdvertisedMediaFact(require_resolve_allowlist.isLikelyImageAttachment(attachment) ? "image" : require_resolve_allowlist.resolveMSTeamsMediaKind({
@@ -995,6 +1019,44 @@ function scopeCandidatesForUrl(url) {
 		return ["https://api.botframework.com", "https://graph.microsoft.com"];
 	}
 }
+function canonicalizeInlineBase64Payload(value) {
+	let cleaned = "";
+	let padding = 0;
+	let sawPadding = false;
+	for (let index = 0; index < value.length; index += 1) {
+		const code = value.charCodeAt(index);
+		if (code <= 32) continue;
+		if (code === 61) {
+			padding += 1;
+			if (padding > 2) return;
+			sawPadding = true;
+			cleaned += "=";
+			continue;
+		}
+		if (sawPadding || !(code >= 65 && code <= 90 || code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 43 || code === 47)) return;
+		cleaned += value[index];
+	}
+	return cleaned && cleaned.length % 4 === 0 ? cleaned : void 0;
+}
+function decodeInlineDataImage(src, maxBytes, totalBytes) {
+	const match = /^data:(image\/[a-z0-9.+-]+)?(;base64)?,(.*)$/i.exec(src);
+	if (!match) return null;
+	const contentType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeLowercaseStringOrEmpty)(match[1] ?? "");
+	if (!Boolean(match[2])) return null;
+	const canonicalPayload = canonicalizeInlineBase64Payload(match[3] ?? "");
+	if (!canonicalPayload) return null;
+	const estimatedBytes = Buffer.byteLength(canonicalPayload, "base64");
+	if (estimatedBytes <= 0 || typeof maxBytes === "number" && (estimatedBytes > maxBytes || totalBytes + estimatedBytes > maxBytes)) return null;
+	try {
+		return {
+			data: Buffer.from(canonicalPayload, "base64"),
+			contentType,
+			estimatedBytes
+		};
+	} catch {
+		return null;
+	}
+}
 async function resolveInlineDataImageMime(inline) {
 	const detectedMime = await require_runtime.getMSTeamsRuntime().media.detectMime({
 		buffer: inline.data,
@@ -1070,15 +1132,12 @@ async function downloadMSTeamsAttachments(params) {
 			sourceId: attachment.id?.trim() || void 0
 		};
 	});
-	candidates.push(...require_resolve_allowlist.extractInlineImageCandidates(list, {
-		maxInlineBytes: params.maxBytes,
-		maxInlineTotalBytes: params.maxBytes
-	}).map((candidate) => {
+	const maxInlineBytes = params.maxBytes;
+	candidates.push(...require_resolve_allowlist.extractInlineImageReferences(list).map((candidate) => {
 		if (candidate.kind === "data") return {
 			kind: "data",
 			mediaKind: "image",
-			data: candidate.data,
-			contentType: candidate.contentType,
+			src: candidate.src,
 			sourceId: candidate.sourceId
 		};
 		if (candidate.kind === "url") return {
@@ -1095,30 +1154,33 @@ async function downloadMSTeamsAttachments(params) {
 			sourceId: candidate.sourceId
 		};
 	}));
-	const advertisedMedia = resolveMSTeamsAdvertisedMedia(list, {
-		maxInlineBytes: params.maxBytes,
-		maxInlineTotalBytes: params.maxBytes
-	});
-	for (const advertised of advertisedMedia.slice(candidates.length)) candidates.push({
+	for (const sourceId of resolveUnrepresentedHtmlAttachmentIds(list)) candidates.push({
 		kind: "unavailable",
-		mediaKind: advertised.kind,
-		sourceId: advertised.sourceId
+		mediaKind: "document",
+		sourceId
 	});
 	if (candidates.length === 0) return [];
 	const out = [];
+	let totalInlineBytes = 0;
 	for (const candidate of candidates) {
 		if (candidate.kind === "unavailable") {
 			out.push(withSourceId({ kind: candidate.mediaKind }, candidate.sourceId));
 			continue;
 		}
 		if (candidate.kind === "data") {
+			const decoded = decodeInlineDataImage(candidate.src, maxInlineBytes, totalInlineBytes);
+			if (!decoded) {
+				out.push(withSourceId({ kind: candidate.mediaKind }, candidate.sourceId));
+				continue;
+			}
+			totalInlineBytes += decoded.estimatedBytes;
 			try {
-				const contentType = await resolveInlineDataImageMime(candidate);
+				const contentType = await resolveInlineDataImageMime(decoded);
 				if (!contentType) {
 					out.push(withSourceId({ kind: candidate.mediaKind }, candidate.sourceId));
 					continue;
 				}
-				const saved = await require_runtime.getMSTeamsRuntime().channel.media.saveMediaBuffer(candidate.data, contentType, "inbound", params.maxBytes);
+				const saved = await require_runtime.getMSTeamsRuntime().channel.media.saveMediaBuffer(decoded.data, contentType, "inbound", params.maxBytes);
 				out.push(withSourceId({
 					path: saved.path,
 					contentType: saved.contentType,
@@ -1834,6 +1896,8 @@ function createTeamsReplyStreamController(params) {
 		return payloads;
 	};
 	const progressDraft = (0, openclaw_plugin_sdk_channel_outbound.createChannelProgressDraftCompositor)({
+		preparedItems: true,
+		formatPlainText: (text) => text,
 		entry: params.msteamsConfig,
 		mode: streamMode,
 		active: Boolean(stream) && streamMode === "progress",
@@ -1891,13 +1955,8 @@ function createTeamsReplyStreamController(params) {
 				params.log?.warn?.(`msteams stream emit failed, falling back to block delivery: ${(0, openclaw_plugin_sdk_error_runtime.coerceErrorMessage)(err)}`);
 			}
 		},
-		async noteProgressWork(options) {
-			if (options?.toolName !== void 0 && !(0, openclaw_plugin_sdk_channel_outbound.isChannelProgressDraftWorkToolName)(options.toolName)) return;
-			await progressDraft.noteActivity();
-		},
-		async pushProgressLine(line, options) {
-			await progressDraft.pushToolProgress(line, options);
-		},
+		pushItemEvent: progressDraft.pushItemEvent.bind(progressDraft),
+		pushToolEvent: progressDraft.pushToolEvent,
 		async pushReasoningProgress(text, options) {
 			await progressDraft.pushReasoningProgress(text, options);
 		},
@@ -2429,38 +2488,14 @@ function createMSTeamsReplyDispatcher(params) {
 			streamController.resetReasoningProgress();
 			return false;
 		},
-		onToolStart: async (payload) => {
-			const name = typeof payload?.name === "string" ? payload.name : void 0;
-			const detailMode = typeof payload?.detailMode === "string" ? payload.detailMode : void 0;
-			await streamController.pushProgressLine((0, openclaw_plugin_sdk_channel_outbound.buildChannelProgressDraftLineForEntry)(msteamsCfg, {
-				event: "tool",
-				...typeof payload?.itemId === "string" ? { itemId: payload.itemId } : {},
-				...typeof payload?.toolCallId === "string" ? { toolCallId: payload.toolCallId } : {},
-				...name ? { name } : {},
-				...typeof payload?.phase === "string" ? { phase: payload.phase } : {},
-				...payload?.args && typeof payload.args === "object" ? { args: payload.args } : {}
-			}, detailMode === "explain" || detailMode === "raw" ? { detailMode } : void 0), name ? { toolName: name } : void 0);
-			return false;
-		},
-		onItemEvent: async (payload) => {
-			await streamController.pushProgressLine((0, openclaw_plugin_sdk_channel_outbound.buildChannelProgressDraftLineForEntry)(msteamsCfg, {
-				event: "item",
-				...typeof payload?.itemId === "string" ? { itemId: payload.itemId } : {},
-				...typeof payload?.toolCallId === "string" ? { toolCallId: payload.toolCallId } : {},
-				...typeof payload?.kind === "string" ? { itemKind: payload.kind } : {},
-				...typeof payload?.title === "string" ? { title: payload.title } : {},
-				...typeof payload?.name === "string" ? { name: payload.name } : {},
-				...typeof payload?.phase === "string" ? { phase: payload.phase } : {},
-				...typeof payload?.status === "string" ? { status: payload.status } : {},
-				...typeof payload?.summary === "string" ? { summary: payload.summary } : {},
-				...typeof payload?.progressText === "string" ? { progressText: payload.progressText } : {},
-				...typeof payload?.meta === "string" ? { meta: payload.meta } : {}
-			}));
-			return false;
-		},
+		onToolStart: streamController.pushToolEvent,
+		onItemEvent: streamController.pushItemEvent,
 		onPlanUpdate: async (payload) => {
 			if (payload?.phase !== "update") return false;
-			await streamController.pushPlanProgress((0, openclaw_plugin_sdk_channel_outbound.normalizeAgentPlanSteps)(payload.steps), { explanation: typeof payload.explanation === "string" ? payload.explanation : void 0 });
+			await streamController.pushPlanProgress((0, openclaw_plugin_sdk_channel_outbound.normalizeAgentPlanSteps)(payload.steps), {
+				explanation: typeof payload.explanation === "string" ? payload.explanation : void 0,
+				explanationFormat: payload.explanationFormat === "plain" ? "plain" : void 0
+			});
 			return false;
 		},
 		onApprovalEvent: async (payload) => {
@@ -2473,36 +2508,6 @@ function createMSTeamsReplyDispatcher(params) {
 				...typeof payload?.message === "string" ? { message: payload.message } : {}
 			});
 			return false;
-		},
-		onCommandOutput: async (payload) => {
-			if (payload?.phase !== "end") return false;
-			await streamController.pushProgressLine((0, openclaw_plugin_sdk_channel_outbound.buildChannelProgressDraftLineForEntry)(msteamsCfg, {
-				event: "command-output",
-				...typeof payload?.itemId === "string" ? { itemId: payload.itemId } : {},
-				...typeof payload?.toolCallId === "string" ? { toolCallId: payload.toolCallId } : {},
-				phase: payload.phase,
-				...typeof payload?.title === "string" ? { title: payload.title } : {},
-				...typeof payload?.name === "string" ? { name: payload.name } : {},
-				...typeof payload?.status === "string" ? { status: payload.status } : {},
-				...typeof payload?.exitCode === "number" ? { exitCode: payload.exitCode } : {}
-			}));
-			return false;
-		},
-		onPatchSummary: async (payload) => {
-			if (payload?.phase !== "end") return false;
-			await streamController.pushProgressLine((0, openclaw_plugin_sdk_channel_outbound.buildChannelProgressDraftLine)({
-				event: "patch",
-				...typeof payload?.itemId === "string" ? { itemId: payload.itemId } : {},
-				...typeof payload?.toolCallId === "string" ? { toolCallId: payload.toolCallId } : {},
-				phase: payload.phase,
-				...typeof payload?.title === "string" ? { title: payload.title } : {},
-				...typeof payload?.name === "string" ? { name: payload.name } : {},
-				...Array.isArray(payload?.added) && payload.added.every((s) => typeof s === "string") ? { added: payload.added } : {},
-				...Array.isArray(payload?.modified) && payload.modified.every((s) => typeof s === "string") ? { modified: payload.modified } : {},
-				...Array.isArray(payload?.deleted) && payload.deleted.every((s) => typeof s === "string") ? { deleted: payload.deleted } : {},
-				...typeof payload?.summary === "string" ? { summary: payload.summary } : {}
-			}));
-			return false;
 		}
 	} : {};
 	return {
@@ -2512,6 +2517,8 @@ function createMSTeamsReplyDispatcher(params) {
 		},
 		delivery,
 		replyOptions: {
+			progressPreambleEnabled: shouldSuppressDefaultToolProgressMessages,
+			commentaryProgressEnabled: shouldSuppressDefaultToolProgressMessages,
 			...streamController.hasStream() ? { onPartialReply: (payload) => {
 				streamController.onPartialReply(payload);
 				return false;
@@ -2574,7 +2581,7 @@ async function dispatchMSTeamsInboundTurn(params) {
 		body: agentBody
 	});
 	const isRoomish = !isDirectMessage;
-	const historyKey = isRoomish ? conversationId : void 0;
+	const historyKey = isRoomish ? facts.historyKey : void 0;
 	if (isRoomish && historyKey) combinedBody = (0, openclaw_plugin_sdk_reply_history.createChannelHistoryWindow)({ historyMap: conversationHistories }).buildPendingContext({
 		historyKey,
 		limit: historyLimit,
@@ -2843,8 +2850,7 @@ function buildStoredConversationReference(params) {
 		...threadId ? { threadId } : {}
 	};
 }
-function assembleMSTeamsInboundFacts(params) {
-	const { entry, mediaMaxBytes } = params;
+function assembleMSTeamsInboundFacts(entry) {
 	const activity = entry.context.activity;
 	const conversation = activity.conversation;
 	const rawConversationId = conversation?.id ?? "";
@@ -2854,10 +2860,7 @@ function assembleMSTeamsInboundFacts(params) {
 	const isChannel = conversationType === "channel";
 	const teamId = activity.channelData?.team?.id;
 	const threadId = isChannel ? conversationMessageId ?? activity.replyToId ?? void 0 : void 0;
-	const advertisedMedia = resolveMSTeamsAdvertisedMedia(entry.attachments, {
-		maxInlineBytes: mediaMaxBytes,
-		maxInlineTotalBytes: mediaMaxBytes
-	});
+	const advertisedMedia = resolveMSTeamsAdvertisedMedia(entry.attachments);
 	return {
 		...entry,
 		activity,
@@ -2876,6 +2879,7 @@ function assembleMSTeamsInboundFacts(params) {
 		teamId,
 		graphChannelId: activity.channelData?.channel?.id?.trim() || conversationId,
 		threadId,
+		historyKey: threadId ? `${conversationId}:thread:${threadId}` : conversationId,
 		conversationRef: buildStoredConversationReference({
 			activity,
 			conversationId,
@@ -3149,7 +3153,7 @@ function createMSTeamsMessageHandler(deps) {
 		cfg,
 		channel: "msteams"
 	});
-	const historyLimit = Math.max(0, msteamsCfg?.historyLimit ?? cfg.messages?.groupChat?.historyLimit ?? openclaw_plugin_sdk_reply_history.DEFAULT_GROUP_HISTORY_LIMIT);
+	const historyLimit = (0, openclaw_plugin_sdk_number_runtime.resolvePromptHistoryLimit)(msteamsCfg?.historyLimit ?? cfg.messages?.groupChat?.historyLimit);
 	const conversationHistories = /* @__PURE__ */ new Map();
 	const readConfig = (0, openclaw_plugin_sdk_runtime_config_snapshot.createRuntimeConfigReader)(cfg);
 	const resolveDebounceMs = () => core.channel.debounce.resolveInboundDebounceMs({
@@ -3157,10 +3161,7 @@ function createMSTeamsMessageHandler(deps) {
 		channel: "msteams"
 	});
 	const handleTeamsMessageNow = async (params) => {
-		const facts = assembleMSTeamsInboundFacts({
-			entry: params,
-			mediaMaxBytes
-		});
+		const facts = assembleMSTeamsInboundFacts(params);
 		const { context, activity, rawText, text, attachments, advertisedMedia, rawBody, quoteInfo, from, conversation, attachmentTypes, htmlSummary, conversationId, conversationMessageId, conversationType, isChannel, teamId, conversationRef } = facts;
 		const historyBody = [text, (0, openclaw_plugin_sdk_channel_inbound.formatMediaPlaceholderText)(advertisedMedia)].filter(Boolean).join("\n");
 		log.info("received message", {
@@ -3262,7 +3263,7 @@ function createMSTeamsMessageHandler(deps) {
 				if (historyBody) {
 					enqueuePrimaryMessageSystemEvent();
 					(0, openclaw_plugin_sdk_reply_history.createChannelHistoryWindow)({ historyMap: conversationHistories }).record({
-						historyKey: conversationId,
+						historyKey: facts.historyKey,
 						limit: historyLimit,
 						entry: {
 							sender: senderName,
@@ -3420,21 +3421,33 @@ function createMSTeamsReactionHandler(deps) {
 		}
 		const rawConversationId = activity.conversation?.id ?? "";
 		const conversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(rawConversationId);
-		const conversationType = activity.conversation?.conversationType ?? "personal";
-		const isGroupChat = conversationType === "groupChat" || activity.conversation?.isGroup === true;
-		const isChannel = conversationType === "channel";
-		const isDirectMessage = !isGroupChat && !isChannel;
+		const isChannel = activity.conversation?.conversationType === "channel";
 		const senderId = from.aadObjectId ?? from.id;
 		const senderName = from.name ?? from.id;
+		const access = await resolveMSTeamsSenderAccess({
+			cfg,
+			activity
+		});
+		const { isDirectMessage, channelGate } = access;
+		if (access.hasConflictingConversationScope) {
+			log.info("dropping reaction (conflicting conversation scope)", { conversationId });
+			return;
+		}
 		if (msteamsCfg) {
-			const senderAccess = await resolveMSTeamsSenderAccess({
-				cfg,
-				activity
-			});
-			if (senderAccess.senderAccess.decision !== "allow") {
+			if (access.senderAccess.decision !== "allow") {
 				log.debug?.("dropping reaction (access denied)", {
 					sender: senderId,
-					reason: senderAccess.senderAccess.reasonCode
+					reason: access.senderAccess.reasonCode
+				});
+				return;
+			}
+			if (!isDirectMessage && channelGate.allowlistConfigured && !channelGate.allowed) {
+				log.info("dropping reaction (not in team/channel allowlist)", {
+					conversationId,
+					teamKey: channelGate.teamKey ?? "none",
+					channelKey: channelGate.channelKey ?? "none",
+					channelMatchKey: channelGate.channelMatchKey ?? "none",
+					channelMatchSource: channelGate.channelMatchSource ?? "none"
 				});
 				return;
 			}
@@ -3449,6 +3462,11 @@ function createMSTeamsReactionHandler(deps) {
 			},
 			...teamId ? { teamId } : {}
 		});
+		const sessionKey = require_thread_session.resolveMSTeamsRouteSessionKey({
+			baseSessionKey: route.sessionKey,
+			isChannel,
+			conversationMessageId: require_resolve_allowlist.extractMSTeamsConversationMessageId(rawConversationId)
+		});
 		const targetMessageId = activity.replyToId ?? "unknown";
 		for (const reaction of reactions) {
 			const reactionType = reaction.type ?? "unknown";
@@ -3462,7 +3480,7 @@ function createMSTeamsReactionHandler(deps) {
 				conversationId
 			});
 			core.system.enqueueSystemEvent(label, {
-				sessionKey: route.sessionKey,
+				sessionKey,
 				contextKey: `msteams:reaction:${conversationId}:${targetMessageId}:${senderId}:${reactionType}:${direction}`
 			});
 		}
@@ -3523,8 +3541,15 @@ async function isInvokeAuthorized(params) {
 		activity: context.activity
 	});
 	const { msteamsCfg, isDirectMessage, conversationId, senderId } = resolved;
-	if (!msteamsCfg) return true;
 	const maybeInvokeName = includeInvokeName ? { name: context.activity.name } : void 0;
+	if (resolved.hasConflictingConversationScope) {
+		deps.log.info("dropping invoke (conflicting conversation scope)", {
+			conversationId,
+			...maybeInvokeName
+		});
+		return false;
+	}
+	if (!msteamsCfg) return true;
 	if (isDirectMessage && resolved.senderAccess.decision !== "allow") {
 		deps.log.debug?.(deniedLogs.dm, {
 			sender: senderId,

package/dist/{sso-token-store-DTeYxubp.cjs → .setup/sso-token-store-YYLHXgFH.cjs}

@@ -1,5 +1,5 @@
 const require_runtime = require("./runtime-gZTAuFux.cjs");
-const require_polls = require("./polls-BBdZPx_R.cjs");
+const require_polls = require("./polls-BJ4-4uZm.cjs");
 let node_crypto = require("node:crypto");
 //#region extensions/msteams/src/sso-token-store.ts
 /**

package/dist/{thread-session-NmA7_njI.cjs → .setup/thread-session-CXgHK-yi.cjs}

@@ -1,4 +1,4 @@
-const require_resolve_allowlist = require("./resolve-allowlist-DmUTQxEz.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-CHzaaWiC.cjs");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_approval_auth_runtime = require("openclaw/plugin-sdk/approval-auth-runtime");
 let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");

package/dist/api.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_channel = require("./channel-B9LIyYeu.cjs");
-const require_channel_setup = require("./channel.setup-BhxokviI.cjs");
+const require_channel = require("./.setup/channel-BDp16XRR.cjs");
+const require_channel_setup = require("./.setup/channel.setup-BVDfgdCc.cjs");
 exports.createMSTeamsSetupWizardBase = require_channel_setup.createMSTeamsSetupWizardBase;
 exports.msteamsPlugin = require_channel.msteamsPlugin;
 exports.msteamsSetupAdapter = require_channel_setup.msteamsSetupAdapter;

package/dist/channel-config-api.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_config_schema = require("./config-schema-D22Lr1Qk.cjs");
+const require_config_schema = require("./.setup/config-schema-D22Lr1Qk.cjs");
 exports.MSTeamsChannelConfigSchema = require_config_schema.MSTeamsChannelConfigSchema;

package/dist/channel-plugin-api.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_channel = require("./channel-B9LIyYeu.cjs");
+const require_channel = require("./.setup/channel-BDp16XRR.cjs");
 exports.msteamsPlugin = require_channel.msteamsPlugin;

package/dist/configured-state.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("./secret-input-C65t6kjM.cjs");
+require("./.setup/secret-input-C65t6kjM.cjs");
 let openclaw_plugin_sdk_secret_input = require("openclaw/plugin-sdk/secret-input");
 //#region extensions/msteams/configured-state.ts
 /** Mirror Teams auth-mode requirements without loading the Azure SDK or full channel. */

package/dist/directory-contract-api.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_resolve_allowlist = require("./resolve-allowlist-DmUTQxEz.cjs");
+const require_resolve_allowlist = require("./.setup/resolve-allowlist-CHzaaWiC.cjs");
 let openclaw_plugin_sdk_directory_runtime = require("openclaw/plugin-sdk/directory-runtime");
 const msteamsDirectoryContractPlugin = {
 	id: "msteams",