@openclaw/msteams 2026.9.5 → 2026.9.7

package/dist/.setup/{channel.runtime-TE49QvFv.cjs → channel.runtime-Baz8XDFs.cjs}

@@ -1,10 +1,11 @@
 require("../runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-CHzaaWiC.cjs");
-const require_channel = require("./channel-Dzpbbht8.cjs");
-const require_channel_setup = require("./channel.setup-BVDfgdCc.cjs");
-const require_polls = require("./polls-BJ4-4uZm.cjs");
-const require_send = require("./send-D8ATH4QI.cjs");
-const require_reaction_types = require("./reaction-types-C7RA7Wxt.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Pl_NQFYH.cjs");
+const require_delegated_state = require("./delegated-state-u-ywZyZT.cjs");
+const require_channel = require("./channel-ByzS7QJ0.cjs");
+const require_channel_setup = require("./channel.setup-DL8lcWT_.cjs");
+const require_conversation_store_state = require("./conversation-store-state-B7JuyZTm.cjs");
+const require_send = require("./send-VUM7Sryb.cjs");
+const require_reaction_types = require("./reaction-types-CQ4oSUe7.cjs");
 let openclaw_plugin_sdk_channel_outbound = require("openclaw/plugin-sdk/channel-outbound");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_reply_payload = require("openclaw/plugin-sdk/reply-payload");
@@ -22,19 +23,19 @@ async function listMSTeamsDirectoryPeersLive(params) {
 		token,
 		query,
 		top: limit
-	})).map((user) => {
+	})).flatMap((user) => {
 		const id = user.id?.trim();
-		if (!id) return null;
+		if (!id) return [];
 		const name = user.displayName?.trim();
 		const handle = user.userPrincipalName?.trim() || user.mail?.trim();
-		return {
+		return [{
 			kind: "user",
 			id: `user:${id}`,
 			name: name || void 0,
 			handle: handle ? `@${handle}` : void 0,
 			raw: user
-		};
-	}).filter(Boolean);
+		}];
+	});
 }
 async function listMSTeamsDirectoryGroupsLive(params) {
 	const rawQuery = require_resolve_allowlist.normalizeQuery(params.query);
@@ -78,20 +79,8 @@ async function listMSTeamsDirectoryGroupsLive(params) {
 }
 //#endregion
 //#region extensions/msteams/src/graph-messages.ts
-/**
-* Resolve the Graph API path prefix for a conversation.
-* If `to` contains "/" it's a `teamId/channelId` (channel path),
-* otherwise it's a chat ID.
-*/
-/**
-* Strip common target prefixes (`conversation:`, `user:`) so raw
-* conversation IDs can be used directly in Graph paths.
-*/
 function stripTargetPrefix(raw) {
-	const trimmed = raw.trim();
-	if (/^conversation:/i.test(trimmed)) return trimmed.slice(13).trim();
-	if (/^user:/i.test(trimmed)) return trimmed.slice(5).trim();
-	return trimmed;
+	return raw.trim().replace(/^(conversation|user):/i, "").trim();
 }
 /**
 * Resolve a target to a Graph-compatible conversation ID.
@@ -104,7 +93,7 @@ async function resolveGraphConversationId(to) {
 	const isUserTarget = /^user:/i.test(trimmed);
 	const cleaned = stripTargetPrefix(trimmed);
 	if (!isUserTarget) return cleaned;
-	const found = await require_polls.createMSTeamsConversationStoreState().findPreferredDmByUserId(cleaned);
+	const found = await require_conversation_store_state.createMSTeamsConversationStoreState().findPreferredDmByUserId(cleaned);
 	if (!found) throw new Error(`No conversation found for user:${cleaned}. The bot must receive a message from this user before Graph API operations work.`);
 	if (found.conversationId.startsWith("19:")) return found.conversationId;
 	throw new Error(`Conversation for user:${cleaned} uses a Bot Framework ID (${found.conversationId}) that Graph API does not accept. Use a Graph-native conversation:19:... target when available.`);
@@ -128,9 +117,6 @@ function resolveConversationPath(to) {
 		chatId: cleaned
 	};
 }
-/**
-* Retrieve a single message by ID from a chat or channel via Graph API.
-*/
 async function getMessageMSTeams(params) {
 	const token = await require_resolve_allowlist.resolveGraphToken(params.cfg);
 	const { basePath } = resolveConversationPath(await resolveGraphConversationId(params.to));
@@ -146,17 +132,6 @@ async function getMessageMSTeams(params) {
 		createdAt: msg.createdDateTime
 	};
 }
-/**
-* Pin a message in a chat conversation via Graph API.
-*
-* Chat pinning uses the v1.0 endpoint: `POST /chats/{chatId}/pinnedMessages`.
-*
-* Channel pinning uses `POST /teams/{teamId}/channels/{channelId}/pinnedMessages`.
-* **Note:** The channel pin endpoint may require the Graph beta API or specific
-* tenant-level permissions. As of March 2026, general availability is not
-* confirmed for all tenants. If the call returns 404 or 403, the endpoint may
-* not be enabled for the target tenant.
-*/
 async function pinMessageMSTeams(params) {
 	const token = await require_resolve_allowlist.resolveGraphToken(params.cfg);
 	const conversationId = await resolveGraphConversationId(params.to);
@@ -173,14 +148,6 @@ async function pinMessageMSTeams(params) {
 		})).id
 	};
 }
-/**
-* Unpin a message in a chat conversation via Graph API.
-* `pinnedMessageId` is the pinned-message resource ID (from pin or list-pins),
-* not the underlying chat message ID.
-*
-* Channel unpin uses `DELETE /teams/{teamId}/channels/{channelId}/pinnedMessages/{id}`.
-* See the note on {@link pinMessageMSTeams} regarding beta/GA status.
-*/
 async function unpinMessageMSTeams(params) {
 	const token = await require_resolve_allowlist.resolveGraphToken(params.cfg);
 	const conv = resolveConversationPath(await resolveGraphConversationId(params.to));
@@ -192,15 +159,7 @@ async function unpinMessageMSTeams(params) {
 	});
 	return { ok: true };
 }
-/** Maximum number of pagination pages to follow to avoid unbounded loops. */
 const LIST_PINS_MAX_PAGES = 10;
-/**
-* List all pinned messages in a chat conversation via Graph API.
-* Follows `@odata.nextLink` pagination to collect the full pin set.
-*
-* Channel list-pins uses the same endpoint pattern as channel pin/unpin.
-* See the note on {@link pinMessageMSTeams} regarding beta/GA status.
-*/
 async function listPinsMSTeams(params) {
 	const token = await require_resolve_allowlist.resolveGraphToken(params.cfg);
 	const conv = resolveConversationPath(await resolveGraphConversationId(params.to));
@@ -229,47 +188,24 @@ async function listPinsMSTeams(params) {
 	}
 	return { pins: allPins };
 }
-/**
-* Add an emoji reaction to a message via Graph API (beta).
-*
-* Writes (setReaction) require a Delegated token, so we pass
-* `preferDelegated: true`. The resolver falls back to the app-only token when
-* delegated auth is not configured, preserving today's behavior while letting
-* delegated-auth-enabled deployments hit the user-scoped endpoint.
-*/
-async function reactMessageMSTeams(params) {
+async function mutateMessageReaction(params, operation) {
 	const reactionType = require_reaction_types.resolveMSTeamsReactionEmoji(params.reactionType);
 	const token = await require_resolve_allowlist.resolveGraphToken(params.cfg, { preferDelegated: true });
 	const { basePath } = resolveConversationPath(await resolveGraphConversationId(params.to));
-	const path = `${basePath}/messages/${encodeURIComponent(params.messageId)}/setReaction`;
 	await require_resolve_allowlist.mutateGraphJson({
 		token,
-		path,
+		path: `${basePath}/messages/${encodeURIComponent(params.messageId)}/${operation}`,
 		method: "POST",
 		body: { reactionType },
 		beta: true
 	});
 	return { ok: true };
 }
-/**
-* Remove an emoji reaction from a message via Graph API (beta).
-*
-* Writes (unsetReaction) require a Delegated token, so we pass
-* `preferDelegated: true`. See `reactMessageMSTeams` for fallback rules.
-*/
-async function unreactMessageMSTeams(params) {
-	const reactionType = require_reaction_types.resolveMSTeamsReactionEmoji(params.reactionType);
-	const token = await require_resolve_allowlist.resolveGraphToken(params.cfg, { preferDelegated: true });
-	const { basePath } = resolveConversationPath(await resolveGraphConversationId(params.to));
-	const path = `${basePath}/messages/${encodeURIComponent(params.messageId)}/unsetReaction`;
-	await require_resolve_allowlist.mutateGraphJson({
-		token,
-		path,
-		method: "POST",
-		body: { reactionType },
-		beta: true
-	});
-	return { ok: true };
+function reactMessageMSTeams(params) {
+	return mutateMessageReaction(params, "setReaction");
+}
+function unreactMessageMSTeams(params) {
+	return mutateMessageReaction(params, "unsetReaction");
 }
 /**
 * List reactions on a message, grouped by type.
@@ -375,11 +311,10 @@ const MAX_CONVERSATION_MEMBER_PAGES = 100;
 async function findMSTeamsConversationMember(params) {
 	const conversationId = await resolveGraphConversationId(params.to);
 	const conversation = resolveConversationPath(conversationId);
-	const collection = conversation.kind === "channel" && params.includeIndirectChannelMembers ? "allMembers" : "members";
 	const userId = params.userId.trim().toLowerCase();
 	const result = await require_resolve_allowlist.fetchAllGraphPages({
 		token: params.token,
-		path: `${conversation.basePath}/${collection}`,
+		path: `${conversation.basePath}/members`,
 		maxPages: MAX_CONVERSATION_MEMBER_PAGES,
 		collectItems: false,
 		findOne: (candidate) => candidate.userId?.trim().toLowerCase() === userId || candidate.email?.trim().toLowerCase() === userId
@@ -403,9 +338,6 @@ function resolveConversationMemberRoles(role, kind) {
 	if (kind === "chat") return ["owner"];
 	return normalized === "owner" ? ["owner"] : [];
 }
-/**
-* Add a user to a chat or channel via Graph API.
-*/
 async function addParticipantMSTeams(params) {
 	const token = await require_resolve_allowlist.resolveGraphToken(params.cfg);
 	const conversationId = await resolveGraphConversationId(params.to);
@@ -448,9 +380,6 @@ async function removeParticipantMSTeams(params) {
 		chatId: conversationId
 	} };
 }
-/**
-* Rename a chat (topic) or channel (displayName) via Graph API.
-*/
 async function renameGroupMSTeams(params) {
 	const token = await require_resolve_allowlist.resolveGraphToken(params.cfg);
 	const conversationId = await resolveGraphConversationId(params.to);
@@ -522,11 +451,6 @@ async function getMemberInfoMSTeams(params) {
 }
 //#endregion
 //#region extensions/msteams/src/graph-teams.ts
-/**
-* List channels in a team via Graph API.
-* Returns id, displayName, description, and membershipType for each channel.
-* Follows @odata.nextLink for paginated results (up to 10 pages).
-*/
 async function listChannelsMSTeams(params) {
 	const token = await require_resolve_allowlist.resolveGraphToken(params.cfg);
 	const result = await require_resolve_allowlist.fetchAllGraphPages({
@@ -544,10 +468,6 @@ async function listChannelsMSTeams(params) {
 		truncated: result.truncated
 	};
 }
-/**
-* Get detailed information about a single channel in a team via Graph API.
-* Returns id, displayName, description, membershipType, webUrl, and createdDateTime.
-*/
 async function getChannelInfoMSTeams(params) {
 	const token = await require_resolve_allowlist.resolveGraphToken(params.cfg);
 	const path = `/teams/${encodeURIComponent(params.teamId)}/channels/${encodeURIComponent(params.channelId)}?$select=id,displayName,description,membershipType,webUrl,createdDateTime`;
@@ -597,7 +517,7 @@ function resolveMSTeamsThreadTarget(to, threadId) {
 	if (!normalizedThreadId || /(?:^|;)messageid=/iu.test(to) || !isConversationTarget) return to;
 	return `${to};messageid=${normalizedThreadId}`;
 }
-function resolveMSTeamsTextSend(params) {
+function resolveMSTeamsSend(params) {
 	return (0, openclaw_plugin_sdk_channel_outbound.resolveOutboundSendDep)(params.deps, "msteams") ?? ((to, text, opts) => require_send.sendMessageMSTeams({
 		cfg: params.cfg,
 		to,
@@ -605,13 +525,19 @@ function resolveMSTeamsTextSend(params) {
 		...opts
 	}));
 }
-function resolveMSTeamsMediaSend(params) {
-	return (0, openclaw_plugin_sdk_channel_outbound.resolveOutboundSendDep)(params.deps, "msteams") ?? ((to, text, opts) => require_send.sendMessageMSTeams({
-		cfg: params.cfg,
-		to,
-		text,
-		...opts
-	}));
+async function sendMSTeamsOutbound(ctx, includeMedia) {
+	const send = resolveMSTeamsSend(ctx);
+	return toMSTeamsOutboundResult(await sendWithDeliveryResults((report) => send(resolveMSTeamsThreadTarget(ctx.to, ctx.threadId), ctx.text, {
+		...includeMedia ? {
+			mediaUrl: ctx.mediaUrl,
+			mediaAccess: ctx.mediaAccess,
+			mediaLocalRoots: ctx.mediaLocalRoots,
+			mediaReadFile: ctx.mediaReadFile
+		} : {},
+		assertDirectAdapterHandoff: ctx.assertDirectAdapterHandoff,
+		onPlatformSendDispatch: ctx.onPlatformSendDispatch,
+		onDeliveryResult: report
+	}), ctx.onDeliveryResult));
 }
 const msteamsOutbound = {
 	deliveryMode: "direct",
@@ -667,7 +593,7 @@ const msteamsOutbound = {
 			mediaUrl: payload.mediaUrl ?? mediaUrl
 		}));
 		if (mediaUrls.length > 0) {
-			const send = resolveMSTeamsMediaSend({
+			const send = resolveMSTeamsSend({
 				cfg,
 				deps
 			});
@@ -686,7 +612,7 @@ const msteamsOutbound = {
 			if (result) return (0, openclaw_plugin_sdk_channel_send_result.attachChannelToResult)("msteams", toMSTeamsOutboundResult(result));
 		}
 		if (text.trim()) {
-			const send = resolveMSTeamsTextSend({
+			const send = resolveMSTeamsSend({
 				cfg,
 				deps
 			});
@@ -702,42 +628,20 @@ const msteamsOutbound = {
 	},
 	...(0, openclaw_plugin_sdk_channel_send_result.createAttachedChannelResultAdapter)({
 		channel: "msteams",
-		sendText: async ({ cfg, to, text, deps, threadId, assertDirectAdapterHandoff, onPlatformSendDispatch, onDeliveryResult }) => {
-			const send = resolveMSTeamsTextSend({
-				cfg,
-				deps
-			});
-			return toMSTeamsOutboundResult(await sendWithDeliveryResults((report) => send(resolveMSTeamsThreadTarget(to, threadId), text, {
-				assertDirectAdapterHandoff,
-				onPlatformSendDispatch,
-				onDeliveryResult: report
-			}), onDeliveryResult));
-		},
-		sendMedia: async ({ cfg, to, text, mediaUrl, mediaAccess, mediaLocalRoots, mediaReadFile, deps, threadId, assertDirectAdapterHandoff, onPlatformSendDispatch, onDeliveryResult }) => {
-			const send = resolveMSTeamsMediaSend({
-				cfg,
-				deps
-			});
-			return toMSTeamsOutboundResult(await sendWithDeliveryResults((report) => send(resolveMSTeamsThreadTarget(to, threadId), text, {
-				mediaUrl,
-				mediaAccess,
-				mediaLocalRoots,
-				mediaReadFile,
-				assertDirectAdapterHandoff,
-				onPlatformSendDispatch,
-				onDeliveryResult: report
-			}), onDeliveryResult));
-		},
-		sendPoll: async ({ cfg, to, poll, threadId }) => {
+		sendText: (ctx) => sendMSTeamsOutbound(ctx, false),
+		sendMedia: (ctx) => sendMSTeamsOutbound(ctx, true),
+		sendPoll: async ({ cfg, to, poll, threadId, assertDirectAdapterHandoff, onPlatformSendDispatch }) => {
 			const maxSelections = poll.maxSelections ?? 1;
 			const result = await require_send.sendPollMSTeams({
 				cfg,
 				to: resolveMSTeamsThreadTarget(to, threadId),
 				question: poll.question,
 				options: poll.options,
-				maxSelections
+				maxSelections,
+				assertDirectAdapterHandoff,
+				onPlatformSendDispatch
 			});
-			await require_polls.createMSTeamsPollStoreState().createPoll({
+			await require_conversation_store_state.createMSTeamsPollStoreState().createPoll({
 				id: result.pollId,
 				question: poll.question,
 				options: poll.options,
@@ -791,11 +695,10 @@ async function probeMSTeams(cfg) {
 		})) throw new Error("Failed to acquire bot token");
 		let graph;
 		try {
-			const graphTokenValue = await require_resolve_allowlist.withMSTeamsRequestDeadline({
+			const accessToken = await require_resolve_allowlist.withMSTeamsRequestDeadline({
 				label: "MS Teams Graph probe token",
 				work: () => tokenProvider.getAccessToken("https://graph.microsoft.com")
 			});
-			const accessToken = require_resolve_allowlist.readAccessToken(graphTokenValue);
 			const payload = accessToken ? decodeJwtPayload(accessToken) : null;
 			graph = {
 				ok: true,
@@ -810,7 +713,7 @@ async function probeMSTeams(cfg) {
 		}
 		let delegatedAuth;
 		if (cfg?.delegatedAuth?.enabled) try {
-			const tokens = await require_resolve_allowlist.loadDelegatedTokens();
+			const tokens = await require_delegated_state.loadMSTeamsDelegatedTokens();
 			if (tokens) {
 				const isExpired = !(0, openclaw_plugin_sdk_number_runtime.isFutureDateTimestampMs)(tokens.expiresAt);
 				delegatedAuth = {

package/dist/.setup/{channel.setup-BVDfgdCc.cjs → channel.setup-DL8lcWT_.cjs}

@@ -1,18 +1,18 @@
-const require_resolve_allowlist = require("./resolve-allowlist-CHzaaWiC.cjs");
-require("./secret-input-C65t6kjM.cjs");
-const require_config_schema = require("./config-schema-D22Lr1Qk.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Pl_NQFYH.cjs");
+const require_delegated_state = require("./delegated-state-u-ywZyZT.cjs");
+const require_config_schema = require("./config-schema-0KoBzb0t.cjs");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
 let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
 let openclaw_plugin_sdk_account_helpers = require("openclaw/plugin-sdk/account-helpers");
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
+let openclaw_plugin_sdk_secret_input = require("openclaw/plugin-sdk/secret-input");
 let openclaw_plugin_sdk_channel_config_helpers = require("openclaw/plugin-sdk/channel-config-helpers");
 let openclaw_plugin_sdk_secret_file_runtime = require("openclaw/plugin-sdk/secret-file-runtime");
 let openclaw_plugin_sdk_channel_setup = require("openclaw/plugin-sdk/channel-setup");
 let openclaw_plugin_sdk_setup = require("openclaw/plugin-sdk/setup");
 let openclaw_plugin_sdk_setup_tools = require("openclaw/plugin-sdk/setup-tools");
 let openclaw_plugin_sdk_retry_runtime = require("openclaw/plugin-sdk/retry-runtime");
-let openclaw_plugin_sdk_secret_input = require("openclaw/plugin-sdk/secret-input");
 //#region extensions/msteams/src/channel-config.ts
 const msteamsMeta = {
 	id: "msteams",
@@ -475,7 +475,7 @@ const msteamsSetupWizard = {
 				};
 				let oauthModule;
 				try {
-					oauthModule = await Promise.resolve().then(() => require("./oauth-C6m7dvHj.cjs"));
+					oauthModule = await Promise.resolve().then(() => require("./oauth-DQjOnJ4l.cjs"));
 				} catch (err) {
 					await noteDelegatedAuthFailure(err);
 					return {
@@ -515,7 +515,7 @@ const msteamsSetupWizard = {
 					progress.stop();
 					throw err;
 				}
-				await require_resolve_allowlist.saveDelegatedTokens(tokens);
+				await require_delegated_state.saveMSTeamsDelegatedTokens(tokens);
 				progress.stop(t("wizard.msteams.delegatedAuthConfigured"));
 			}
 		}

package/dist/.setup/{config-schema-D22Lr1Qk.cjs → config-schema-0KoBzb0t.cjs}

@@ -1,4 +1,6 @@
+const require_bot_framework_service_url = require("./bot-framework-service-url-BUhTe8F3.cjs");
 let openclaw_plugin_sdk_channel_core = require("openclaw/plugin-sdk/channel-core");
+let openclaw_plugin_sdk_ssrf_policy = require("openclaw/plugin-sdk/ssrf-policy");
 let openclaw_plugin_sdk_secret_input = require("openclaw/plugin-sdk/secret-input");
 let openclaw_plugin_sdk_channel_config_schema = require("openclaw/plugin-sdk/channel-config-schema");
 let zod = require("zod");
@@ -24,6 +26,18 @@ const msTeamsChannelConfigUiHints = {
 		label: "MS Teams Graph Media Fallback",
 		help: "Query Microsoft Graph for unresolved channel or group-chat HTML media. Adds one lookup per matching message when enabled (default: false)."
 	},
+	requireMentionInBotThreads: {
+		label: "Require Mentions in Bot Threads",
+		help: "Override mention requirements for channel threads rooted at this bot's tracked messages. Unset preserves existing behavior. Channel overrides win over team and global values. Ownership tracking lasts up to 24 hours."
+	},
+	"teams.*.requireMentionInBotThreads": {
+		label: "Team Bot Thread Mentions",
+		help: "Override mention requirements for this bot's channel threads in this team. Unset inherits the global value."
+	},
+	"teams.*.channels.*.requireMentionInBotThreads": {
+		label: "Channel Bot Thread Mentions",
+		help: "Override mention requirements for this bot's threads in this channel. Unset inherits the team or global value."
+	},
 	...(0, openclaw_plugin_sdk_channel_core.createChannelConfigUiHints)({
 		channelLabel: "MS Teams",
 		streaming: { "": {
@@ -42,43 +56,14 @@ const SecretInputSchema = (0, openclaw_plugin_sdk_secret_input.buildSecretInputS
 const ToolPolicyBySenderSchema = zod.z.record(zod.z.string(), openclaw_plugin_sdk_channel_config_schema.ToolPolicySchema).optional();
 const MSTeamsChannelSchema = zod.z.object({
 	requireMention: zod.z.boolean().optional(),
+	requireMentionInBotThreads: zod.z.boolean().optional(),
 	tools: openclaw_plugin_sdk_channel_config_schema.ToolPolicySchema,
 	toolsBySender: ToolPolicyBySenderSchema,
 	replyStyle: openclaw_plugin_sdk_channel_config_schema.MSTeamsReplyStyleSchema.optional()
 }).strict();
-const MSTeamsTeamSchema = zod.z.object({
-	requireMention: zod.z.boolean().optional(),
-	tools: openclaw_plugin_sdk_channel_config_schema.ToolPolicySchema,
-	toolsBySender: ToolPolicyBySenderSchema,
-	replyStyle: openclaw_plugin_sdk_channel_config_schema.MSTeamsReplyStyleSchema.optional(),
-	channels: zod.z.record(zod.z.string(), MSTeamsChannelSchema.optional()).optional()
-}).strict();
-const MSTEAMS_SERVICE_URL_HOST_ALLOWLIST = [
-	"smba.trafficmanager.net",
-	"smba.infra.gcc.teams.microsoft.com",
-	"smba.infra.gov.teams.microsoft.us",
-	"smba.infra.dod.teams.microsoft.us",
-	"botframework.azure.cn"
-];
-function isAllowedMSTeamsServiceUrl(value) {
-	try {
-		const parsed = new URL(value.trim());
-		if (parsed.protocol !== "https:") return false;
-		const host = parsed.hostname.toLowerCase();
-		return MSTEAMS_SERVICE_URL_HOST_ALLOWLIST.some((allowed) => host === allowed || host.endsWith(`.${allowed}`));
-	} catch {
-		return false;
-	}
-}
+const MSTeamsTeamSchema = MSTeamsChannelSchema.extend({ channels: zod.z.record(zod.z.string(), MSTeamsChannelSchema.optional()).optional() });
 function isAzureChinaBotFrameworkServiceUrl(value) {
-	try {
-		const parsed = new URL(value.trim());
-		if (parsed.protocol !== "https:") return false;
-		const host = parsed.hostname.toLowerCase();
-		return host === "botframework.azure.cn" || host.endsWith(".botframework.azure.cn");
-	} catch {
-		return false;
-	}
+	return (0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(value.trim(), ["botframework.azure.cn"]);
 }
 const { accountShape, rootPolicyShape } = (0, openclaw_plugin_sdk_channel_config_schema.buildChannelAccountSchemaParts)({
 	omit: [
@@ -103,24 +88,25 @@ const MSTeamsConfigSchema = zod.z.object({
 		"USGovDoD",
 		"China"
 	]).optional(),
-	serviceUrl: zod.z.string().url().refine(isAllowedMSTeamsServiceUrl, { message: "channels.msteams.serviceUrl must use a supported Microsoft Teams Bot Connector host" }).optional(),
+	serviceUrl: zod.z.string().url().refine(require_bot_framework_service_url.isAllowedBotFrameworkServiceUrl, { message: "channels.msteams.serviceUrl must use a supported Microsoft Teams Bot Connector host" }).optional(),
 	authType: zod.z.enum(["secret", "federated"]).optional(),
 	certificatePath: zod.z.string().optional(),
 	certificateThumbprint: zod.z.string().optional(),
 	useManagedIdentity: zod.z.boolean().optional(),
 	managedIdentityClientId: zod.z.string().optional(),
-	webhook: zod.z.object({
-		port: zod.z.number().int().positive().optional(),
-		path: zod.z.string().optional()
-	}).strict().optional(),
+	webhook: zod.z.object({ path: zod.z.string().optional() }).strict().optional(),
+	legacyWebhook: zod.z.union([zod.z.literal(false), zod.z.object({
+		port: zod.z.number().int().min(1).max(65535),
+		host: zod.z.string().optional()
+	}).strict()]).optional(),
 	typingIndicator: zod.z.boolean().optional(),
 	mediaAllowHosts: zod.z.array(zod.z.string()).optional(),
 	mediaAuthAllowHosts: zod.z.array(zod.z.string()).optional(),
 	graphMediaFallback: zod.z.boolean().optional(),
 	requireMention: zod.z.boolean().optional(),
+	requireMentionInBotThreads: zod.z.boolean().optional(),
 	replyStyle: openclaw_plugin_sdk_channel_config_schema.MSTeamsReplyStyleSchema.optional(),
 	teams: zod.z.record(zod.z.string(), MSTeamsTeamSchema.optional()).optional(),
-	/** Max inbound and outbound media size in MB (default: 100MB). */
 	/** SharePoint site ID for file uploads in group chats/channels (e.g., "contoso.sharepoint.com,guid1,guid2") */
 	sharePointSiteId: zod.z.string().optional(),
 	welcomeCard: zod.z.boolean().optional(),