@openclaw/msteams 2026.9.5 → 2026.9.7

package/dist/.setup/{channel-Dzpbbht8.cjs → channel-ByzS7QJ0.cjs}

@@ -1,8 +1,9 @@
+const require_rolldown_runtime = require("./rolldown-runtime-BloeesfJ.cjs");
 require("../runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-CHzaaWiC.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Pl_NQFYH.cjs");
 const require_directory_contract_api = require("../directory-contract-api.cjs");
-const require_thread_session = require("./thread-session-CXgHK-yi.cjs");
-const require_channel_setup = require("./channel.setup-BVDfgdCc.cjs");
+const require_thread_session = require("./thread-session--rw3BTal.cjs");
+const require_channel_setup = require("./channel.setup-DL8lcWT_.cjs");
 let openclaw_plugin_sdk_approval_handler_adapter_runtime = require("openclaw/plugin-sdk/approval-handler-adapter-runtime");
 let openclaw_plugin_sdk_channel_actions = require("openclaw/plugin-sdk/channel-actions");
 let openclaw_plugin_sdk_channel_core = require("openclaw/plugin-sdk/channel-core");
@@ -21,7 +22,6 @@ let openclaw_plugin_sdk_reply_reference = require("openclaw/plugin-sdk/reply-ref
 let openclaw_plugin_sdk_approval_delivery_runtime = require("openclaw/plugin-sdk/approval-delivery-runtime");
 let openclaw_plugin_sdk_approval_native_runtime = require("openclaw/plugin-sdk/approval-native-runtime");
 let openclaw_plugin_sdk_channel_targets = require("openclaw/plugin-sdk/channel-targets");
-let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
 let openclaw_plugin_sdk_dangerous_name_runtime = require("openclaw/plugin-sdk/dangerous-name-runtime");
 let openclaw_plugin_sdk_runtime_group_policy = require("openclaw/plugin-sdk/runtime-group-policy");
 let openclaw_plugin_sdk_text_chunking = require("openclaw/plugin-sdk/text-chunking");
@@ -42,6 +42,52 @@ function resolveActionUploadFilePath(params) {
 	}
 }
 //#endregion
+//#region extensions/msteams/src/action-results.ts
+function jsonActionResult(data, details = data) {
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify(data)
+		}],
+		details
+	};
+}
+function jsonMSTeamsActionResult(action, data = {}) {
+	return jsonActionResult({
+		channel: "msteams",
+		action,
+		...data
+	});
+}
+function jsonMSTeamsOkActionResult(action, data = {}) {
+	return jsonActionResult({
+		ok: true,
+		channel: "msteams",
+		action,
+		...data
+	});
+}
+function jsonMSTeamsConversationResult(conversationId) {
+	return jsonActionResult({
+		ok: true,
+		channel: "msteams",
+		conversationId
+	}, {
+		ok: true,
+		channel: "msteams"
+	});
+}
+function actionError(message) {
+	return {
+		isError: true,
+		content: [{
+			type: "text",
+			text: message
+		}],
+		details: { error: message }
+	};
+}
+//#endregion
 //#region extensions/msteams/src/policy.ts
 const teamScopeKey = (teamKey) => (0, openclaw_plugin_sdk_channel_policy.scopeKey)(["team", teamKey]);
 const channelScopeKey = (teamKey, channelKey) => (0, openclaw_plugin_sdk_channel_policy.scopeKey)(["team", teamKey], ["channel", channelKey]);
@@ -185,18 +231,18 @@ function resolveMSTeamsGroupToolPolicy(params) {
 		...senderScope
 	});
 }
-function resolveMSTeamsAllowlistMatch(params) {
-	return (0, openclaw_plugin_sdk_allow_from.resolveAllowlistMatchSimple)(params);
-}
 function resolveMSTeamsReplyPolicy(params) {
 	if (params.isDirectMessage) return {
 		requireMention: false,
 		replyStyle: "thread"
 	};
 	const requireMention = params.channelConfig?.requireMention ?? params.teamConfig?.requireMention ?? params.globalConfig?.requireMention ?? true;
+	const explicitReplyStyle = params.channelConfig?.replyStyle ?? params.teamConfig?.replyStyle ?? params.globalConfig?.replyStyle;
+	const requireMentionInBotThreads = params.channelConfig?.requireMentionInBotThreads ?? params.teamConfig?.requireMentionInBotThreads ?? params.globalConfig?.requireMentionInBotThreads;
 	return {
 		requireMention,
-		replyStyle: params.channelConfig?.replyStyle ?? params.teamConfig?.replyStyle ?? params.globalConfig?.replyStyle ?? (requireMention ? "thread" : "top-level")
+		replyStyle: explicitReplyStyle ?? (requireMention ? "thread" : "top-level"),
+		...requireMentionInBotThreads === void 0 ? {} : { requireMentionInBotThreads }
 	};
 }
 //#endregion
@@ -347,7 +393,7 @@ const msTeamsLazyApprovalNativeRuntime = (0, openclaw_plugin_sdk_approval_handle
 		request
 	}),
 	load: async () => {
-		const { msTeamsApprovalNativeRuntime } = await Promise.resolve().then(() => require("./approval-handler.runtime-DDxGPJDz.cjs"));
+		const { msTeamsApprovalNativeRuntime } = await Promise.resolve().then(() => require("./approval-handler.runtime-D1s7UR3U.cjs"));
 		return msTeamsApprovalNativeRuntime;
 	}
 });
@@ -363,7 +409,7 @@ const msTeamsApprovalCapability = {
 	...(0, openclaw_plugin_sdk_approval_delivery_runtime.createApproverRestrictedNativeApprovalCapability)({
 		channel: "msteams",
 		channelLabel: "Microsoft Teams",
-		describeExecApprovalSetup: () => "Approve it from the Web UI or terminal UI for now. Microsoft Teams supports native approvals when the bot is configured. Configure `channels.msteams.allowFrom` or `channels.msteams.defaultTo` with Microsoft Entra object ID approvers.",
+		describeExecApprovalSetup: () => "Approve it from the Web UI for now. Microsoft Teams supports native approvals when the bot is configured. Configure `channels.msteams.allowFrom` or `channels.msteams.defaultTo` with Microsoft Entra object ID approvers.",
 		listAccountIds: require_channel_setup.msteamsConfigAdapter.listAccountIds,
 		hasApprovers: ({ cfg, accountId }) => require_thread_session.getMSTeamsApprovalApprovers({
 			cfg,
@@ -394,6 +440,160 @@ const msTeamsApprovalCapability = {
 	authorizeActorAction: (params) => require_thread_session.msTeamsApprovalAuth.authorizeActorAction?.(params)
 };
 //#endregion
+//#region src/gateway/gateway-http-route-contracts.ts
+const GATEWAY_PROBE_ROUTES = /* @__PURE__ */ new Map([
+	["/health", "live"],
+	["/healthz", "live"],
+	["/ready", "ready"],
+	["/readyz", "ready"],
+	["/startup", "startup"],
+	["/startupz", "startup"]
+]);
+function classifyGatewayProbePath(pathname) {
+	for (const [root, status] of GATEWAY_PROBE_ROUTES) {
+		if (pathname === root) return status;
+		if (pathname.startsWith(`${root}/`)) return "namespace";
+	}
+	return "outside";
+}
+//#endregion
+//#region packages/normalization-core/src/string-coerce.ts
+/** Trims string input and returns null for non-strings or empty strings. */
+function normalizeNullableString(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed ? trimmed : null;
+}
+/** Trims string input and returns undefined for non-strings or empty strings. */
+function normalizeOptionalString$3(value) {
+	return normalizeNullableString(value) ?? void 0;
+}
+/** Lowercases a normalized optional string. */
+function normalizeOptionalLowercaseString(value) {
+	return normalizeOptionalString$3(value)?.toLowerCase();
+}
+/** Lowercases a normalized string or returns an empty string when absent. */
+function normalizeLowercaseStringOrEmpty$1(value) {
+	return normalizeOptionalLowercaseString(value) ?? "";
+}
+//#endregion
+//#region src/plugins/http-path-prefix.ts
+function prefixMatchPath(pathname, prefix) {
+	return pathname === prefix || pathname.startsWith(`${prefix}/`) || pathname.startsWith(`${prefix}%`);
+}
+//#endregion
+//#region src/gateway/security-path.ts
+const MAX_PATH_DECODE_PASSES = 32;
+function normalizePathSeparators(pathname) {
+	const collapsed = pathname.replace(/\/{2,}/g, "/");
+	if (collapsed.length <= 1) return collapsed;
+	return collapsed.replace(/\/+$/, "");
+}
+function resolveDotSegments(pathname) {
+	try {
+		return new URL(pathname, "http://localhost").pathname;
+	} catch {
+		return pathname;
+	}
+}
+function normalizePathForSecurity(pathname) {
+	return normalizePathSeparators(normalizeLowercaseStringOrEmpty$1(resolveDotSegments(pathname))) || "/";
+}
+function buildCanonicalPathCandidates(pathname, maxDecodePasses = MAX_PATH_DECODE_PASSES) {
+	const candidates = /* @__PURE__ */ new Set([normalizePathForSecurity(pathname)]);
+	let decoded = pathname;
+	let malformedEncoding = false;
+	let decodePasses = 0;
+	for (let pass = 0; pass < maxDecodePasses; pass++) {
+		let nextDecoded;
+		try {
+			nextDecoded = decodeURIComponent(decoded);
+		} catch {
+			malformedEncoding = true;
+			break;
+		}
+		if (nextDecoded === decoded) break;
+		decodePasses += 1;
+		decoded = nextDecoded;
+		candidates.add(normalizePathForSecurity(decoded));
+	}
+	let decodePassLimitReached = false;
+	if (!malformedEncoding) try {
+		decodePassLimitReached = decodeURIComponent(decoded) !== decoded;
+	} catch {
+		malformedEncoding = true;
+	}
+	return {
+		candidates: [...candidates],
+		decodePasses,
+		decodePassLimitReached,
+		malformedEncoding
+	};
+}
+function canonicalizePathForSecurity(pathname) {
+	const { candidates, decodePasses, decodePassLimitReached, malformedEncoding } = buildCanonicalPathCandidates(pathname);
+	return {
+		canonicalPath: candidates[candidates.length - 1] ?? "/",
+		candidates,
+		decodePasses,
+		decodePassLimitReached,
+		malformedEncoding,
+		rawNormalizedPath: normalizePathSeparators(normalizeLowercaseStringOrEmpty$1(pathname)) || "/"
+	};
+}
+const PROTECTED_PLUGIN_ROUTE_PREFIXES = ["/api/channels"];
+//#endregion
+//#region src/gateway/server/plugins-http/path-context.ts
+function normalizeProtectedPrefix(prefix) {
+	const collapsed = normalizeLowercaseStringOrEmpty$1(prefix).replace(/\/{2,}/g, "/");
+	if (collapsed.length <= 1) return collapsed || "/";
+	return collapsed.replace(/\/+$/, "");
+}
+const NORMALIZED_PROTECTED_PLUGIN_ROUTE_PREFIXES = PROTECTED_PLUGIN_ROUTE_PREFIXES.map(normalizeProtectedPrefix);
+/** Returns true when any decoded path candidate targets a protected route. */
+function isProtectedPluginRoutePathFromContext(context) {
+	if (context.candidates.some((candidate) => NORMALIZED_PROTECTED_PLUGIN_ROUTE_PREFIXES.some((prefix) => prefixMatchPath(candidate, prefix)))) return true;
+	if (context.decodePassLimitReached) return true;
+	if (!context.malformedEncoding) return false;
+	return NORMALIZED_PROTECTED_PLUGIN_ROUTE_PREFIXES.some((prefix) => prefixMatchPath(context.rawNormalizedPath, prefix));
+}
+/** Builds all security-relevant decoded path candidates for a request path. */
+function resolvePluginRoutePathContext(pathname) {
+	const canonical = canonicalizePathForSecurity(pathname);
+	return {
+		pathname,
+		canonicalPath: canonical.canonicalPath,
+		candidates: canonical.candidates,
+		malformedEncoding: canonical.malformedEncoding,
+		decodePassLimitReached: canonical.decodePassLimitReached,
+		rawNormalizedPath: canonical.rawNormalizedPath
+	};
+}
+//#endregion
+//#region \0openclaw:bundled-sdk:openclaw/plugin-sdk/gateway-config-runtime
+var gateway_config_runtime_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	classifyGatewayProbePath: () => classifyGatewayProbePath,
+	isProtectedPluginRoutePathFromContext: () => isProtectedPluginRoutePathFromContext,
+	resolvePluginRoutePathContext: () => resolvePluginRoutePathContext
+});
+require_rolldown_runtime.__reExport(gateway_config_runtime_exports, require("openclaw/plugin-sdk/gateway-config-runtime"));
+//#endregion
+//#region extensions/msteams/src/webhook-route.ts
+function resolveMSTeamsLegacyWebhook(config) {
+	const listener = config?.legacyWebhook;
+	return listener === false ? void 0 : listener ?? { port: 3978 };
+}
+function resolveMSTeamsWebhookPathIssue({ cfg, env }) {
+	const channel = cfg.channels?.msteams;
+	const path = channel?.webhook?.path || "/api/messages";
+	const legacy = resolveMSTeamsLegacyWebhook(channel);
+	const pathname = URL.parse(path, "http://localhost")?.pathname ?? path;
+	const probe = classifyGatewayProbePath(pathname);
+	const reason = isProtectedPluginRoutePathFromContext(resolvePluginRoutePathContext(pathname)) ? "requires Gateway authentication on the main HTTP listener" : probe !== "namespace" && probe !== "outside" ? "is reserved for Gateway probes" : /[:*{}\\]/.test(path) ? "uses Express pattern syntax that requires the compatibility listener" : void 0;
+	if (!reason) return;
+	return `Microsoft Teams webhook path ${path} ${reason}. Set channels.msteams.webhook.path to /api/messages and update the Azure Bot messaging endpoint or reverse-proxy upstream to Gateway port ${(0, gateway_config_runtime_exports.resolveGatewayPort)(cfg, env)}/api/messages; verify delivery before setting channels.msteams.legacyWebhook=false.` + (legacy ? ` Compatibility port ${legacy.port} continues serving the current path.` : " The compatibility listener is disabled, so this path cannot receive Teams callbacks.");
+}
+//#endregion
 //#region extensions/msteams/src/doctor.ts
 const isMSTeamsMutableAllowEntry = (0, openclaw_plugin_sdk_channel_policy.buildMutableAllowEntryDetector)({
 	prefixes: ["msteams:", "user:"],
@@ -404,6 +604,39 @@ const collectMSTeamsMutableAllowlistWarnings = (0, openclaw_plugin_sdk_channel_p
 	detector: isMSTeamsMutableAllowEntry,
 	collectLists: (scope) => (0, openclaw_plugin_sdk_channel_policy.collectStandardAllowlistLists)(scope)
 });
+function runMSTeamsWebhookDoctorSequence({ cfg, env }) {
+	const channel = cfg.channels?.msteams;
+	if (!channel || channel.enabled === false) return {
+		changeNotes: [],
+		warningNotes: [],
+		infoNotes: []
+	};
+	const pathIssue = resolveMSTeamsWebhookPathIssue({
+		cfg,
+		env
+	});
+	if (pathIssue) return {
+		changeNotes: [],
+		warningNotes: [pathIssue],
+		infoNotes: []
+	};
+	const path = channel.webhook?.path || "/api/messages";
+	const port = (0, gateway_config_runtime_exports.resolveGatewayPort)(cfg, env);
+	const legacy = resolveMSTeamsLegacyWebhook(channel);
+	return {
+		changeNotes: [],
+		warningNotes: [],
+		infoNotes: [legacy ? `Microsoft Teams: compatibility port ${legacy.port} continues forwarding to Gateway route ${path}. To use only the Gateway listener, update the Azure Bot messaging endpoint or reverse-proxy upstream to Gateway port ${port}${path}, verify delivery, then set channels.msteams.legacyWebhook=false to close the old port.` : `Microsoft Teams webhooks use Gateway port ${port}${path}; the compatibility listener is disabled by channels.msteams.legacyWebhook=false. Point the Azure Bot messaging endpoint or reverse-proxy upstream to this route.`]
+	};
+}
+const msteamsDoctor = {
+	dmAllowFromMode: "topOnly",
+	groupModel: "hybrid",
+	groupAllowFromFallbackToAllowFrom: true,
+	warnOnEmptyGroupSenderAllowlist: true,
+	collectMutableAllowlistWarnings: collectMSTeamsMutableAllowlistWarnings,
+	runConfigSequence: runMSTeamsWebhookDoctorSequence
+};
 //#endregion
 //#region extensions/msteams/src/graph-action-context.ts
 const MSTEAMS_GROUP_MANAGEMENT_ACTIONS = /* @__PURE__ */ new Set([
@@ -806,50 +1039,7 @@ const collectMSTeamsSecurityFindings = openclaw_plugin_sdk_channel_policy.create
 	severity: "warn",
 	title: "MS Teams security warning"
 });
-const loadMSTeamsChannelRuntime = (0, openclaw_plugin_sdk_lazy_runtime.createLazyRuntimeNamedExport)(() => Promise.resolve().then(() => require("./channel.runtime-TE49QvFv.cjs")), "msTeamsChannelRuntime");
-function jsonActionResult(data) {
-	return {
-		content: [{
-			type: "text",
-			text: JSON.stringify(data)
-		}],
-		details: data
-	};
-}
-function jsonMSTeamsActionResult(action, data = {}) {
-	return jsonActionResult({
-		channel: "msteams",
-		action,
-		...data
-	});
-}
-function jsonMSTeamsOkActionResult(action, data = {}) {
-	return jsonActionResult({
-		ok: true,
-		channel: "msteams",
-		action,
-		...data
-	});
-}
-function jsonMSTeamsConversationResult(conversationId) {
-	return jsonActionResultWithDetails({
-		ok: true,
-		channel: "msteams",
-		conversationId
-	}, {
-		ok: true,
-		channel: "msteams"
-	});
-}
-function jsonActionResultWithDetails(contentData, details) {
-	return {
-		content: [{
-			type: "text",
-			text: JSON.stringify(contentData)
-		}],
-		details
-	};
-}
+const loadMSTeamsChannelRuntime = (0, openclaw_plugin_sdk_lazy_runtime.createLazyRuntimeNamedExport)(() => Promise.resolve().then(() => require("./channel.runtime-Baz8XDFs.cjs")), "msTeamsChannelRuntime");
 const MSTEAMS_REACTION_TYPES = [
 	"like",
 	"heart",
@@ -858,16 +1048,6 @@ const MSTEAMS_REACTION_TYPES = [
 	"sad",
 	"angry"
 ];
-function actionError(message) {
-	return {
-		isError: true,
-		content: [{
-			type: "text",
-			text: message
-		}],
-		details: { error: message }
-	};
-}
 function requireMSTeamsGroupManagementAuthorization(ctx) {
 	if (ctx.senderIsOwner === true || ctx.gatewayClientScopes?.includes("operator.admin")) return null;
 	return actionError("Microsoft Teams group management requires an owner or operator.admin requester.");
@@ -889,18 +1069,6 @@ function resolveGraphActionTarget(params, currentChannelId, currentGraphChannelI
 function resolveCurrentGraphActionTarget(toolContext) {
 	return (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(toolContext?.currentGraphChannelId) ?? (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(toolContext?.currentMessagingTarget);
 }
-function resolveActionMessageId(params) {
-	return (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(params.messageId) ?? "";
-}
-function resolveActionPinnedMessageId(params) {
-	return typeof params.pinnedMessageId === "string" ? params.pinnedMessageId.trim() : typeof params.messageId === "string" ? params.messageId.trim() : "";
-}
-function resolveActionQuery(params) {
-	return (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(params.query) ?? "";
-}
-function readOptionalTrimmedString(params, key) {
-	return (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(params[key]);
-}
 function resolveMSTeamsActionTarget(params) {
 	return params.graphOnly ? resolveGraphActionTarget(params.toolParams, params.currentChannelId, params.currentGraphChannelId, params.currentChatType) : resolveActionTarget(params.toolParams, params.currentChannelId);
 }
@@ -911,7 +1079,14 @@ async function runWithRequiredActionTarget(params) {
 }
 async function runWithRequiredActionMessageTarget(params) {
 	const to = resolveMSTeamsActionTarget(params);
-	const messageId = resolveActionMessageId(params.toolParams);
+	const messageIdRaw = params.allowCurrentMessageIdFallback === true && msteamsContextTargetsMatch(to, {
+		currentChannelId: params.currentChannelId ?? void 0,
+		currentMessagingTarget: params.currentGraphChannelId ?? void 0
+	}) ? (0, openclaw_plugin_sdk_channel_actions.resolveReactionMessageId)({
+		args: params.toolParams,
+		toolContext: { currentMessageId: params.currentMessageId ?? void 0 }
+	}) : (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(params.toolParams.messageId) ?? "";
+	const messageId = messageIdRaw == null ? "" : String(messageIdRaw).trim();
 	if (!to || !messageId) return actionError(`${params.actionLabel} requires a target (to) and messageId.`);
 	return await params.run({
 		to,
@@ -920,7 +1095,7 @@ async function runWithRequiredActionMessageTarget(params) {
 }
 async function runWithRequiredActionPinnedMessageTarget(params) {
 	const to = resolveMSTeamsActionTarget(params);
-	const pinnedMessageId = resolveActionPinnedMessageId(params.toolParams);
+	const pinnedMessageId = typeof params.toolParams.pinnedMessageId === "string" ? params.toolParams.pinnedMessageId.trim() : (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(params.toolParams.messageId) ?? "";
 	if (!to || !pinnedMessageId) return actionError(`${params.actionLabel} requires a target (to) and pinnedMessageId.`);
 	return await params.run({
 		to,
@@ -1013,21 +1188,15 @@ const msteamsPlugin = (0, openclaw_plugin_sdk_channel_core.createChatChannelPlug
 		agentPrompt: { messageToolHints: () => ["- Adaptive Cards supported. Use `action=send` with `card={type,version,body}` to send rich cards.", "- MSTeams targeting: omit `target` to reply to the current conversation (auto-inferred). Explicit targets: `user:ID` or `user:Display Name` (requires Graph API) for DMs, `conversation:19:...@thread.tacv2` for groups/channels. Prefer IDs over display names for speed."] },
 		groups: { resolveToolPolicy: resolveMSTeamsGroupToolPolicy },
 		approvalCapability: msTeamsApprovalCapability,
-		doctor: {
-			dmAllowFromMode: "topOnly",
-			groupModel: "hybrid",
-			groupAllowFromFallbackToAllowFrom: true,
-			warnOnEmptyGroupSenderAllowlist: true,
-			collectMutableAllowlistWarnings: collectMSTeamsMutableAllowlistWarnings
-		},
+		doctor: msteamsDoctor,
 		messaging: {
 			targetPrefixes: ["msteams", "teams"],
 			directTargetStyle: "user-prefixed",
 			normalizeTarget: require_resolve_allowlist.normalizeMSTeamsMessagingTarget,
 			inferTargetChatType: ({ to }) => inferMSTeamsTargetChatType(to),
-			resolveOutboundSessionRoute: (params) => resolveMSTeamsOutboundSessionRoute(params),
+			resolveOutboundSessionRoute: resolveMSTeamsOutboundSessionRoute,
 			targetResolver: {
-				looksLikeId: (raw) => require_resolve_allowlist.looksLikeMSTeamsTargetId(raw),
+				looksLikeId: require_resolve_allowlist.looksLikeMSTeamsTargetId,
 				hint: "<conversationId|user:ID|conversation:ID>"
 			}
 		},
@@ -1048,7 +1217,6 @@ const msteamsPlugin = (0, openclaw_plugin_sdk_channel_core.createChatChannelPlug
 				name: void 0,
 				note: void 0
 			}));
-			const stripPrefix = (value) => require_resolve_allowlist.normalizeMSTeamsUserInput(value);
 			const markPendingLookupFailed = (pending) => {
 				pending.forEach(({ index }) => {
 					const entry = results[index];
@@ -1076,7 +1244,7 @@ const msteamsPlugin = (0, openclaw_plugin_sdk_channel_core.createChatChannelPlug
 						entry.note = "empty input";
 						return;
 					}
-					const cleaned = stripPrefix(trimmed);
+					const cleaned = require_resolve_allowlist.normalizeMSTeamsUserInput(trimmed);
 					if (/^[0-9a-fA-F-]{16,}$/.test(cleaned) || cleaned.includes("@")) {
 						entry.resolved = true;
 						entry.id = cleaned;
@@ -1189,15 +1357,11 @@ const msteamsPlugin = (0, openclaw_plugin_sdk_channel_core.createChatChannelPlug
 								assertDirectAdapterHandoff: ctx.assertDirectAdapterHandoff,
 								onPlatformSendDispatch: ctx.onPlatformSendDispatch
 							});
-							return jsonActionResultWithDetails({
+							return jsonActionResult({
 								ok: true,
 								channel: "msteams",
 								messageId: result.messageId,
 								conversationId: result.conversationId
-							}, {
-								ok: true,
-								channel: "msteams",
-								messageId: result.messageId
 							});
 						}
 					});
@@ -1216,62 +1380,47 @@ const msteamsPlugin = (0, openclaw_plugin_sdk_channel_core.createChatChannelPlug
 								to,
 								text: resolveActionContent(ctx.params),
 								mediaUrl,
-								filename: readOptionalTrimmedString(ctx.params, "filename") ?? readOptionalTrimmedString(ctx.params, "title"),
+								filename: (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(ctx.params.filename) ?? (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(ctx.params.title),
 								mediaAccess: ctx.mediaAccess,
 								mediaLocalRoots: ctx.mediaLocalRoots,
 								mediaReadFile: ctx.mediaReadFile,
 								assertDirectAdapterHandoff: ctx.assertDirectAdapterHandoff,
 								onPlatformSendDispatch: ctx.onPlatformSendDispatch
 							});
-							return jsonActionResultWithDetails({
+							return jsonActionResult({
 								ok: true,
 								channel: "msteams",
 								action: "upload-file",
 								messageId: result.messageId,
 								conversationId: result.conversationId,
 								...result.pendingUploadId ? { pendingUploadId: result.pendingUploadId } : {}
-							}, {
-								ok: true,
-								channel: "msteams",
-								messageId: result.messageId,
-								...result.pendingUploadId ? { pendingUploadId: result.pendingUploadId } : {}
 							});
 						}
 					});
 				}
-				if (ctx.action === "edit") {
-					const content = resolveActionContent(ctx.params);
-					if (!content) return actionError("Edit requires content.");
+				if (ctx.action === "edit" || ctx.action === "delete") {
+					const action = ctx.action;
+					const content = action === "edit" ? resolveActionContent(ctx.params) : "";
+					if (action === "edit" && !content) return actionError("Edit requires content.");
 					return await runWithRequiredActionMessageTarget({
-						actionLabel: "Edit",
+						actionLabel: action === "edit" ? "Edit" : "Delete",
 						toolParams: ctx.params,
 						currentChannelId: ctx.toolContext?.currentChannelId,
 						run: async (target) => {
 							const to = await authorizeActionTarget(target.to);
-							const { editMessageMSTeams } = await loadMSTeamsChannelRuntime();
-							return jsonMSTeamsConversationResult((await editMessageMSTeams({
+							const runtime = await loadMSTeamsChannelRuntime();
+							const params = {
 								cfg: ctx.cfg,
 								to,
-								activityId: target.messageId,
+								activityId: target.messageId
+							};
+							return jsonMSTeamsConversationResult((action === "edit" ? await runtime.editMessageMSTeams({
+								...params,
 								text: content
-							})).conversationId);
+							}) : await runtime.deleteMessageMSTeams(params)).conversationId);
 						}
 					});
 				}
-				if (ctx.action === "delete") return await runWithRequiredActionMessageTarget({
-					actionLabel: "Delete",
-					toolParams: ctx.params,
-					currentChannelId: ctx.toolContext?.currentChannelId,
-					run: async (target) => {
-						const to = await authorizeActionTarget(target.to);
-						const { deleteMessageMSTeams } = await loadMSTeamsChannelRuntime();
-						return jsonMSTeamsConversationResult((await deleteMessageMSTeams({
-							cfg: ctx.cfg,
-							to,
-							activityId: target.messageId
-						})).conversationId);
-					}
-				});
 				const graphActionTarget = {
 					toolParams: ctx.action === "search" || ctx.action === "member-info" ? {
 						...ctx.params,
@@ -1280,34 +1429,36 @@ const msteamsPlugin = (0, openclaw_plugin_sdk_channel_core.createChatChannelPlug
 					currentChannelId: ctx.toolContext?.currentChannelId,
 					currentGraphChannelId: resolveCurrentGraphActionTarget(ctx.toolContext),
 					currentChatType: ctx.toolContext?.currentChatType,
+					currentMessageId: ctx.toolContext?.currentMessageId,
 					graphOnly: true
 				};
-				if (ctx.action === "read") return await runWithRequiredActionMessageTarget({
-					actionLabel: "Read",
-					...graphActionTarget,
-					run: async (target) => {
-						const to = await authorizeActionTarget(target.to);
-						const { getMessageMSTeams } = await loadMSTeamsChannelRuntime();
-						return jsonMSTeamsOkActionResult("read", { message: await getMessageMSTeams({
-							cfg: ctx.cfg,
-							to,
-							messageId: target.messageId
-						}) });
-					}
-				});
-				if (ctx.action === "pin") return await runWithRequiredActionMessageTarget({
-					actionLabel: "Pin",
-					...graphActionTarget,
-					run: async (target) => {
-						const to = await authorizeActionTarget(target.to);
-						const { pinMessageMSTeams } = await loadMSTeamsChannelRuntime();
-						return jsonMSTeamsActionResult("pin", await pinMessageMSTeams({
-							cfg: ctx.cfg,
-							to,
-							messageId: target.messageId
-						}));
-					}
-				});
+				if (ctx.action === "read" || ctx.action === "pin" || ctx.action === "reactions") {
+					const action = ctx.action;
+					return await runWithRequiredActionMessageTarget({
+						actionLabel: {
+							read: "Read",
+							pin: "Pin",
+							reactions: "Reactions"
+						}[action],
+						...graphActionTarget,
+						allowCurrentMessageIdFallback: action === "reactions",
+						run: async (target) => {
+							const to = await authorizeActionTarget(target.to);
+							const runtime = await loadMSTeamsChannelRuntime();
+							const params = {
+								cfg: ctx.cfg,
+								to,
+								messageId: target.messageId
+							};
+							if (action === "read") {
+								const message = await runtime.getMessageMSTeams(params);
+								return jsonMSTeamsOkActionResult(action, { message });
+							}
+							if (action === "pin") return jsonMSTeamsActionResult(action, await runtime.pinMessageMSTeams(params));
+							return jsonMSTeamsOkActionResult(action, await runtime.listReactionsMSTeams(params));
+						}
+					});
+				}
 				if (ctx.action === "unpin") return await runWithRequiredActionPinnedMessageTarget({
 					actionLabel: "Unpin",
 					...graphActionTarget,
@@ -1336,6 +1487,7 @@ const msteamsPlugin = (0, openclaw_plugin_sdk_channel_core.createChatChannelPlug
 				if (ctx.action === "react") return await runWithRequiredActionMessageTarget({
 					actionLabel: "React",
 					...graphActionTarget,
+					allowCurrentMessageIdFallback: true,
 					run: async (target) => {
 						const emoji = typeof ctx.params.emoji === "string" ? ctx.params.emoji.trim() : "";
 						const remove = typeof ctx.params.remove === "boolean" ? ctx.params.remove : false;
@@ -1351,50 +1503,26 @@ const msteamsPlugin = (0, openclaw_plugin_sdk_channel_core.createChatChannelPlug
 							}
 						};
 						const to = await authorizeActionTarget(target.to);
-						if (remove) {
-							const { unreactMessageMSTeams } = await loadMSTeamsChannelRuntime();
-							return jsonMSTeamsActionResult("react", {
-								removed: true,
-								reactionType: emoji,
-								...await unreactMessageMSTeams({
-									cfg: ctx.cfg,
-									to,
-									messageId: target.messageId,
-									reactionType: emoji
-								})
-							});
-						}
-						const { reactMessageMSTeams } = await loadMSTeamsChannelRuntime();
+						const runtime = await loadMSTeamsChannelRuntime();
+						const result = await (remove ? runtime.unreactMessageMSTeams : runtime.reactMessageMSTeams)({
+							cfg: ctx.cfg,
+							to,
+							messageId: target.messageId,
+							reactionType: emoji
+						});
 						return jsonMSTeamsActionResult("react", {
+							...remove ? { removed: true } : {},
 							reactionType: emoji,
-							...await reactMessageMSTeams({
-								cfg: ctx.cfg,
-								to,
-								messageId: target.messageId,
-								reactionType: emoji
-							})
+							...result
 						});
 					}
 				});
-				if (ctx.action === "reactions") return await runWithRequiredActionMessageTarget({
-					actionLabel: "Reactions",
-					...graphActionTarget,
-					run: async (target) => {
-						const to = await authorizeActionTarget(target.to);
-						const { listReactionsMSTeams } = await loadMSTeamsChannelRuntime();
-						return jsonMSTeamsOkActionResult("reactions", await listReactionsMSTeams({
-							cfg: ctx.cfg,
-							to,
-							messageId: target.messageId
-						}));
-					}
-				});
 				if (ctx.action === "search") return await runWithRequiredActionTarget({
 					actionLabel: "Search",
 					...graphActionTarget,
 					run: async (to) => {
 						const allowedTarget = await authorizeActionTarget(to);
-						const query = resolveActionQuery(ctx.params);
+						const query = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(ctx.params.query);
 						if (!query) return actionError("Search requires a target (to) and query.");
 						const limit = (0, openclaw_plugin_sdk_channel_actions.readPositiveIntegerParam)(ctx.params, "limit");
 						const from = typeof ctx.params.from === "string" ? ctx.params.from.trim() : void 0;
@@ -1457,39 +1585,27 @@ const msteamsPlugin = (0, openclaw_plugin_sdk_channel_core.createChatChannelPlug
 						channelId: graphChannelId
 					})).channel });
 				}
-				if (ctx.action === "addParticipant") {
-					const userId = typeof ctx.params.userId === "string" ? ctx.params.userId.trim() : "";
-					if (!userId) return actionError("addParticipant requires a userId.");
+				if (ctx.action === "addParticipant" || ctx.action === "removeParticipant") {
+					const action = ctx.action;
+					const userId = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(ctx.params.userId);
+					if (!userId) return actionError(`${action} requires a userId.`);
 					return await runWithRequiredActionTarget({
-						actionLabel: "addParticipant",
+						actionLabel: action,
 						toolParams: ctx.params,
 						currentChannelId: ctx.toolContext?.currentChannelId,
 						run: async (to) => {
-							const role = readOptionalTrimmedString(ctx.params, "role");
-							const { addParticipantMSTeams } = await loadMSTeamsChannelRuntime();
-							return jsonMSTeamsOkActionResult("addParticipant", await addParticipantMSTeams({
-								cfg: ctx.cfg,
-								to,
-								userId,
-								role
-							}));
-						}
-					});
-				}
-				if (ctx.action === "removeParticipant") {
-					const userId = typeof ctx.params.userId === "string" ? ctx.params.userId.trim() : "";
-					if (!userId) return actionError("removeParticipant requires a userId.");
-					return await runWithRequiredActionTarget({
-						actionLabel: "removeParticipant",
-						toolParams: ctx.params,
-						currentChannelId: ctx.toolContext?.currentChannelId,
-						run: async (to) => {
-							const { removeParticipantMSTeams } = await loadMSTeamsChannelRuntime();
-							return jsonMSTeamsOkActionResult("removeParticipant", await removeParticipantMSTeams({
+							const role = action === "addParticipant" ? (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalString)(ctx.params.role) : void 0;
+							const runtime = await loadMSTeamsChannelRuntime();
+							const params = {
 								cfg: ctx.cfg,
 								to,
 								userId
-							}));
+							};
+							const result = action === "addParticipant" ? await runtime.addParticipantMSTeams({
+								...params,
+								role
+							}) : await runtime.removeParticipantMSTeams(params);
+							return jsonMSTeamsOkActionResult(action, result);
 						}
 					});
 				}
@@ -1541,25 +1657,21 @@ const msteamsPlugin = (0, openclaw_plugin_sdk_channel_core.createChatChannelPlug
 				}
 				return lines;
 			},
-			resolveAccountSnapshot: ({ account, runtime }) => ({
+			resolveAccountSnapshot: ({ account }) => ({
 				accountId: account.accountId,
 				enabled: account.enabled,
 				configured: account.configured,
-				extra: {
-					port: runtime?.port ?? null,
-					tokenStatus: account.tokenStatus
-				}
+				extra: { tokenStatus: account.tokenStatus }
 			})
 		}),
 		gateway: { startAccount: async (ctx) => {
-			const { monitorMSTeamsProvider } = await Promise.resolve().then(() => require("./src-CpKfpP1m.cjs"));
-			const port = ctx.cfg.channels?.msteams?.webhook?.port ?? 3978;
+			const { monitorMSTeamsProvider } = await Promise.resolve().then(() => require("./monitor-BJ7IyH4y.cjs"));
+			const webhookPath = ctx.cfg.channels?.msteams?.webhook?.path || "/api/messages";
 			const statusSink = (0, openclaw_plugin_sdk_channel_outbound.createAccountStatusSink)({
 				accountId: ctx.accountId,
 				setStatus: ctx.setStatus
 			});
-			statusSink({ port });
-			ctx.log?.info(`starting provider (port ${port})`);
+			ctx.log?.info(`starting provider (Gateway route ${webhookPath})`);
 			if (isMSTeamsNativeApprovalClientEnabled({
 				cfg: ctx.cfg,
 				accountId: ctx.accountId
@@ -1649,10 +1761,10 @@ Object.defineProperty(exports, "msteamsPlugin", {
 		return msteamsPlugin;
 	}
 });
-Object.defineProperty(exports, "resolveMSTeamsAllowlistMatch", {
+Object.defineProperty(exports, "resolveMSTeamsLegacyWebhook", {
 	enumerable: true,
 	get: function() {
-		return resolveMSTeamsAllowlistMatch;
+		return resolveMSTeamsLegacyWebhook;
 	}
 });
 Object.defineProperty(exports, "resolveMSTeamsReplyPolicy", {
@@ -1667,6 +1779,12 @@ Object.defineProperty(exports, "resolveMSTeamsRouteConfig", {
 		return resolveMSTeamsRouteConfig;
 	}
 });
+Object.defineProperty(exports, "resolveMSTeamsWebhookPathIssue", {
+	enumerable: true,
+	get: function() {
+		return resolveMSTeamsWebhookPathIssue;
+	}
+});
 Object.defineProperty(exports, "shouldHandleMSTeamsNativeApprovalRequest", {
 	enumerable: true,
 	get: function() {