@openclaw/msteams 2026.9.5 → 2026.9.7

package/dist/.setup/{adapter.runtime-ChuVK6k_.cjs → adapter.runtime-BiWeMKXE.cjs}

@@ -1,12 +1,12 @@
-const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-BloeesfJ.cjs");
 let node_url = require("node:url");
 let openclaw_plugin_sdk_ssrf_runtime = require("openclaw/plugin-sdk/ssrf-runtime");
 let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
-let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_rolldown_runtime.__toESM(node_fs_promises, 1);
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let node_crypto = require("node:crypto");
 let node_timers_promises = require("node:timers/promises");
 let node_events = require("node:events");
 let node_http = require("node:http");
@@ -71,15 +71,6 @@ async function startMSTeamsQaBotFrameworkServer(options) {
 		}
 	};
 }
-async function reserveMSTeamsQaWebhookPort() {
-	const server = (0, node_http.createServer)();
-	server.listen(0, "127.0.0.1");
-	await (0, node_events.once)(server, "listening");
-	const { port } = server.address();
-	server.close();
-	await (0, node_events.once)(server, "close");
-	return port;
-}
 //#endregion
 //#region extensions/msteams/src/qa/adapter.runtime.ts
 const SERVICE_URL = "https://smba.trafficmanager.net/qa";
@@ -143,7 +134,7 @@ async function waitForMSTeamsChannelReady(gateway, timeoutMs = 6e4, pollInterval
 }
 async function createMSTeamsQaTransportAdapter(context) {
 	const accountId = context.adapterOptions?.sutAccountId?.trim() || DEFAULT_ACCOUNT_ID;
-	const webhookPort = await reserveMSTeamsQaWebhookPort();
+	let webhookUrl;
 	const nonce = (0, node_crypto.randomUUID)();
 	const botToken = createMSTeamsQaBotToken();
 	const bootstrapPath = node_path.default.join(context.outputDir, ".msteams-private-qa-bootstrap.mjs");
@@ -189,6 +180,7 @@ async function createMSTeamsQaTransportAdapter(context) {
 		await connector.close().catch(() => void 0);
 		throw error;
 	}
+	const bootstrapUrl = (0, node_url.pathToFileURL)(bootstrapPath).href;
 	return {
 		id: "msteams",
 		label: "Microsoft Teams live",
@@ -232,13 +224,13 @@ async function createMSTeamsQaTransportAdapter(context) {
 					channel: { id: conversationId }
 				}
 			};
-			const webhookUrl = `http://127.0.0.1:${webhookPort}/api/messages`;
+			if (!webhookUrl) throw new Error("Microsoft Teams QA Gateway URL has not been configured");
 			const { response, release } = await (0, openclaw_plugin_sdk_ssrf_runtime.fetchWithSsrFGuard)({
 				url: webhookUrl,
 				init: {
 					method: "POST",
 					headers: {
-						authorization: "Bearer private-qa",
+						authorization: `Bearer ${botToken}`,
 						"content-type": "application/json"
 					},
 					body: JSON.stringify(activity)
@@ -268,25 +260,27 @@ async function createMSTeamsQaTransportAdapter(context) {
 			conversationKindByNativeId.clear();
 			logicalConversationByNativeId.clear();
 		},
-		createGatewayConfig: () => ({ channels: { msteams: {
-			enabled: true,
-			appId: APP_ID,
-			appPassword: "private-qa-secret",
-			tenantId: TENANT_ID,
-			dmPolicy: "allowlist",
-			allowFrom: [DRIVER_AAD_OBJECT_ID],
-			groupPolicy: "open",
-			requireMention: requireGroupMention,
-			replyStyle: "thread",
-			webhook: {
-				port: webhookPort,
-				path: "/api/messages"
-			}
-		} } }),
+		createGatewayConfig: ({ baseUrl }) => {
+			webhookUrl = new URL("/api/messages", baseUrl).toString();
+			return { channels: { msteams: {
+				enabled: true,
+				appId: APP_ID,
+				appPassword: "private-qa-secret",
+				tenantId: TENANT_ID,
+				dmPolicy: "allowlist",
+				allowFrom: [DRIVER_AAD_OBJECT_ID],
+				groupPolicy: "open",
+				requireMention: requireGroupMention,
+				replyStyle: "thread",
+				webhook: { path: "/api/messages" },
+				legacyWebhook: false
+			} } };
+		},
 		createRuntimeEnvPatch: () => ({
 			OPENCLAW_BUILD_PRIVATE_QA: "1",
-			NODE_OPTIONS: [process.env.NODE_OPTIONS?.trim(), `--import=${(0, node_url.pathToFileURL)(bootstrapPath).href}`].filter(Boolean).join(" ")
+			NODE_OPTIONS: [process.env.NODE_OPTIONS?.trim(), `--import=${bootstrapUrl}`].filter(Boolean).join(" ")
 		}),
+		createRuntimePreloads: () => [bootstrapUrl],
 		waitReady: async ({ gateway, timeoutMs, pollIntervalMs }) => await waitForMSTeamsChannelReady(gateway, timeoutMs, pollIntervalMs),
 		buildAgentDelivery: ({ target }) => ({
 			channel: "msteams",

package/dist/.setup/{approval-card-CPNH_q3P.cjs → approval-card-DWPDItvq.cjs}

@@ -11,6 +11,9 @@ function readMSTeamsApprovalActionToken(value) {
 }
 //#endregion
 //#region extensions/msteams/src/approval-card.ts
+function formatMSTeamsApprovalKind(kind) {
+	return kind === "plugin" ? "Plugin" : kind === "system-agent" ? "OpenClaw Change" : "Exec";
+}
 function buildCardHeading(title, subtitle) {
 	return [{
 		type: "TextBlock",
@@ -103,7 +106,7 @@ function buildAdaptiveCard(body, actions) {
 }
 function buildMSTeamsPendingApprovalCard(params) {
 	const { view, nowMs } = params;
-	const kindLabel = view.approvalKind === "plugin" ? "Plugin" : view.approvalKind === "system-agent" ? "OpenClaw Change" : "Exec";
+	const kindLabel = formatMSTeamsApprovalKind(view.approvalKind);
 	const actionTokens = [];
 	const actions = view.actions.map(({ decision, label }) => {
 		const token = msTeamsApprovalControls.createToken();
@@ -136,7 +139,7 @@ function buildMSTeamsPendingApprovalCard(params) {
 	};
 }
 function buildMSTeamsResolvedApprovalCard(view) {
-	const kindLabel = view.approvalKind === "plugin" ? "Plugin" : view.approvalKind === "system-agent" ? "OpenClaw Change" : "Exec";
+	const kindLabel = formatMSTeamsApprovalKind(view.approvalKind);
 	const resolvedBy = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(view.resolvedBy);
 	return buildAdaptiveCard([
 		...buildCardHeading(`${kindLabel} Approval: ${(0, openclaw_plugin_sdk_approval_runtime.formatChannelApprovalResolvedLabel)(view)}`, resolvedBy ? `Resolved by ${resolvedBy}` : "Resolved"),
@@ -146,7 +149,7 @@ function buildMSTeamsResolvedApprovalCard(view) {
 }
 function buildMSTeamsExpiredApprovalCard(view) {
 	return buildAdaptiveCard([
-		...buildCardHeading(`${view.approvalKind === "plugin" ? "Plugin" : view.approvalKind === "system-agent" ? "OpenClaw Change" : "Exec"} Approval Expired`, "This approval request expired before it was resolved."),
+		...buildCardHeading(`${formatMSTeamsApprovalKind(view.approvalKind)} Approval Expired`, "This approval request expired before it was resolved."),
 		...buildApprovalSubject(view),
 		buildApprovalMetadata(view.approvalId, view.metadata)
 	]);

package/dist/.setup/{approval-handler.runtime-DDxGPJDz.cjs → approval-handler.runtime-D1s7UR3U.cjs}

@@ -1,7 +1,7 @@
-const require_resolve_allowlist = require("./resolve-allowlist-CHzaaWiC.cjs");
-const require_channel = require("./channel-Dzpbbht8.cjs");
-const require_approval_card = require("./approval-card-CPNH_q3P.cjs");
-const require_send = require("./send-D8ATH4QI.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Pl_NQFYH.cjs");
+const require_channel = require("./channel-ByzS7QJ0.cjs");
+const require_approval_card = require("./approval-card-DWPDItvq.cjs");
+const require_send = require("./send-VUM7Sryb.cjs");
 let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
 let openclaw_plugin_sdk_approval_native_runtime = require("openclaw/plugin-sdk/approval-native-runtime");
 let openclaw_plugin_sdk_approval_handler_runtime = require("openclaw/plugin-sdk/approval-handler-runtime");

package/dist/.setup/bot-framework-service-url-BUhTe8F3.cjs

@@ -0,0 +1,55 @@
+let openclaw_plugin_sdk_ssrf_policy = require("openclaw/plugin-sdk/ssrf-policy");
+//#region extensions/msteams/src/bot-framework-service-url.ts
+const BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST = (0, openclaw_plugin_sdk_ssrf_policy.normalizeHostnameSuffixAllowlist)([
+	"smba.trafficmanager.net",
+	"smba.infra.gcc.teams.microsoft.com",
+	"smba.infra.gov.teams.microsoft.us",
+	"smba.infra.dod.teams.microsoft.us",
+	"botframework.azure.cn"
+]);
+function describeBotFrameworkServiceUrlHost(serviceUrl) {
+	try {
+		return new URL(serviceUrl.trim()).hostname || "invalid-url";
+	} catch {
+		return "invalid-url";
+	}
+}
+function isAllowedBotFrameworkServiceUrl(serviceUrl) {
+	if (typeof serviceUrl !== "string") return false;
+	const trimmed = serviceUrl.trim();
+	return Boolean(trimmed && (0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(trimmed, BOT_FRAMEWORK_SERVICE_URL_HOST_ALLOWLIST));
+}
+function tryNormalizeBotFrameworkServiceUrl(serviceUrl) {
+	if (!isAllowedBotFrameworkServiceUrl(serviceUrl)) return;
+	return serviceUrl.trim().replace(/\/+$/, "");
+}
+function normalizeBotFrameworkServiceUrl(serviceUrl) {
+	const normalized = tryNormalizeBotFrameworkServiceUrl(serviceUrl);
+	if (normalized) return normalized;
+	throw new Error(`Blocked Microsoft Teams serviceUrl host: ${describeBotFrameworkServiceUrlHost(serviceUrl)}`);
+}
+//#endregion
+Object.defineProperty(exports, "describeBotFrameworkServiceUrlHost", {
+	enumerable: true,
+	get: function() {
+		return describeBotFrameworkServiceUrlHost;
+	}
+});
+Object.defineProperty(exports, "isAllowedBotFrameworkServiceUrl", {
+	enumerable: true,
+	get: function() {
+		return isAllowedBotFrameworkServiceUrl;
+	}
+});
+Object.defineProperty(exports, "normalizeBotFrameworkServiceUrl", {
+	enumerable: true,
+	get: function() {
+		return normalizeBotFrameworkServiceUrl;
+	}
+});
+Object.defineProperty(exports, "tryNormalizeBotFrameworkServiceUrl", {
+	enumerable: true,
+	get: function() {
+		return tryNormalizeBotFrameworkServiceUrl;
+	}
+});