@openclaw/msteams 2026.9.6 → 2026.9.8

package/dist/.setup/{src-BfOCwlHp.cjs → monitor-BJ7IyH4y.cjs}

@@ -1,15 +1,14 @@
-const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-BloeesfJ.cjs");
 const require_runtime = require("./runtime-gZTAuFux.cjs");
 require("../runtime-api.cjs");
-const require_resolve_allowlist = require("./resolve-allowlist-CHzaaWiC.cjs");
-const require_channel = require("./channel-BDp16XRR.cjs");
-const require_thread_session = require("./thread-session-CXgHK-yi.cjs");
-const require_channel_setup = require("./channel.setup-BVDfgdCc.cjs");
-const require_polls = require("./polls-BJ4-4uZm.cjs");
-const require_sso_token_store = require("./sso-token-store-YYLHXgFH.cjs");
-const require_approval_card = require("./approval-card-CPNH_q3P.cjs");
-const require_messenger = require("./messenger-8RA1FUJa.cjs");
-const require_reaction_types = require("./reaction-types-C7RA7Wxt.cjs");
+const require_resolve_allowlist = require("./resolve-allowlist-Pl_NQFYH.cjs");
+const require_bot_framework_service_url = require("./bot-framework-service-url-BUhTe8F3.cjs");
+const require_channel = require("./channel-ByzS7QJ0.cjs");
+const require_thread_session = require("./thread-session--rw3BTal.cjs");
+const require_channel_setup = require("./channel.setup-DL8lcWT_.cjs");
+const require_approval_card = require("./approval-card-DWPDItvq.cjs");
+const require_conversation_store_state = require("./conversation-store-state-B7JuyZTm.cjs");
+const require_reaction_types = require("./reaction-types-CQ4oSUe7.cjs");
 let openclaw_plugin_sdk_channel_outbound = require("openclaw/plugin-sdk/channel-outbound");
 let openclaw_plugin_sdk_string_coerce_runtime = require("openclaw/plugin-sdk/string-coerce-runtime");
 let openclaw_plugin_sdk_allow_from = require("openclaw/plugin-sdk/allow-from");
@@ -17,13 +16,16 @@ let openclaw_plugin_sdk_provider_http = require("openclaw/plugin-sdk/provider-ht
 let openclaw_plugin_sdk_account_id = require("openclaw/plugin-sdk/account-id");
 let openclaw_plugin_sdk_media_runtime = require("openclaw/plugin-sdk/media-runtime");
 let openclaw_plugin_sdk_ssrf_runtime = require("openclaw/plugin-sdk/ssrf-runtime");
+let openclaw_plugin_sdk_ssrf_policy = require("openclaw/plugin-sdk/ssrf-policy");
 let openclaw_plugin_sdk_number_runtime = require("openclaw/plugin-sdk/number-runtime");
 let openclaw_plugin_sdk_text_utility_runtime = require("openclaw/plugin-sdk/text-utility-runtime");
 let openclaw_plugin_sdk_error_runtime = require("openclaw/plugin-sdk/error-runtime");
 let openclaw_plugin_sdk_routing = require("openclaw/plugin-sdk/routing");
+let openclaw_plugin_sdk_channel_inbound = require("openclaw/plugin-sdk/channel-inbound");
 let node_crypto = require("node:crypto");
 node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
-let openclaw_plugin_sdk_channel_inbound = require("openclaw/plugin-sdk/channel-inbound");
+let openclaw_plugin_sdk_security_runtime = require("openclaw/plugin-sdk/security-runtime");
+let openclaw_plugin_sdk_webhook_targets = require("openclaw/plugin-sdk/webhook-targets");
 let openclaw_plugin_sdk_approval_gateway_runtime = require("openclaw/plugin-sdk/approval-gateway-runtime");
 let openclaw_plugin_sdk_channel_ingress_runtime = require("openclaw/plugin-sdk/channel-ingress-runtime");
 let openclaw_plugin_sdk_context_visibility_runtime = require("openclaw/plugin-sdk/context-visibility-runtime");
@@ -32,10 +34,9 @@ let openclaw_plugin_sdk_runtime_config_snapshot = require("openclaw/plugin-sdk/r
 let openclaw_plugin_sdk_agent_runtime = require("openclaw/plugin-sdk/agent-runtime");
 let openclaw_plugin_sdk_extension_shared = require("openclaw/plugin-sdk/extension-shared");
 let openclaw_plugin_sdk_plugin_runtime = require("openclaw/plugin-sdk/plugin-runtime");
-let openclaw_plugin_sdk_dedupe_runtime = require("openclaw/plugin-sdk/dedupe-runtime");
-let openclaw_plugin_sdk_plugin_state_runtime = require("openclaw/plugin-sdk/plugin-state-runtime");
 let openclaw_plugin_sdk_collection_runtime = require("openclaw/plugin-sdk/collection-runtime");
 let openclaw_plugin_sdk_gateway_runtime = require("openclaw/plugin-sdk/gateway-runtime");
+let openclaw_plugin_sdk_time_runtime = require("openclaw/plugin-sdk/time-runtime");
 let openclaw_plugin_sdk_channel_pairing = require("openclaw/plugin-sdk/channel-pairing");
 let openclaw_plugin_sdk_runtime_group_policy = require("openclaw/plugin-sdk/runtime-group-policy");
 let openclaw_plugin_sdk_dangerous_name_runtime = require("openclaw/plugin-sdk/dangerous-name-runtime");
@@ -150,7 +151,7 @@ async function runFeedbackReflection(params) {
 		return;
 	}
 	try {
-		await require_messenger.sendMSTeamsActivityWithReference(params.app, require_messenger.buildConversationReference(params.conversationRef), {
+		await require_conversation_store_state.sendMSTeamsActivityWithReference(params.app, require_conversation_store_state.buildConversationReference(params.conversationRef), {
 			type: "message",
 			text: reflection.userMessage
 		}, { serviceUrlBoundary: require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(cfg.channels?.msteams) });
@@ -248,12 +249,8 @@ async function maybeHandleMSTeamsApprovalCardSubmit(params) {
 			senderId
 		});
 		await context.updateActivity({
-			type: "message",
-			id: consumed.activityId,
-			attachments: [{
-				contentType: "application/vnd.microsoft.card.adaptive",
-				content: require_approval_card.buildMSTeamsCanonicalApprovalTerminalCard(result)
-			}]
+			...require_conversation_store_state.buildMSTeamsAdaptiveCardActivity(require_approval_card.buildMSTeamsCanonicalApprovalTerminalCard(result)),
+			id: consumed.activityId
 		});
 		return result;
 	});
@@ -455,7 +452,7 @@ async function admitMSTeamsMessage(params) {
 			params.log.debug?.("dropping dm (dms disabled)");
 			return null;
 		}
-		const allowMatch = require_channel.resolveMSTeamsAllowlistMatch({
+		const allowMatch = (0, openclaw_plugin_sdk_allow_from.resolveAllowlistMatchSimple)({
 			allowFrom: effectiveDmAllowFrom,
 			senderId,
 			senderName,
@@ -520,7 +517,7 @@ async function admitMSTeamsMessage(params) {
 			return null;
 		}
 		if (!senderAccess.allowed) {
-			const allowMatch = require_channel.resolveMSTeamsAllowlistMatch({
+			const allowMatch = (0, openclaw_plugin_sdk_allow_from.resolveAllowlistMatchSimple)({
 				allowFrom: effectiveGroupAllowFrom,
 				senderId,
 				senderName,
@@ -562,11 +559,19 @@ async function admitMSTeamsMessage(params) {
 	};
 }
 //#endregion
+//#region src/channels/mention-gating.ts
+function resolveBotThreadMentionPolicy(params) {
+	if (!params.isBotOwnedThread || params.requireMentionInBotThreads === void 0) return {
+		requireMention: params.requireMention,
+		implicitMentionKinds: params.implicitMentionKinds
+	};
+	return {
+		requireMention: params.requireMentionInBotThreads,
+		implicitMentionKinds: params.requireMentionInBotThreads ? params.implicitMentionKinds?.filter((kind) => kind === "native") : params.implicitMentionKinds
+	};
+}
+//#endregion
 //#region extensions/msteams/src/attachments/bot-framework.ts
-/**
-* Bot Framework Service token scope for requesting a token used against
-* the Bot Connector (v3) REST endpoints such as `/v3/attachments/{id}`.
-*/
 const BOT_FRAMEWORK_SCOPE = "https://api.botframework.com";
 /**
 * Detect Bot Framework personal chat ("a:") and MSA orgid ("8:orgid:") conversation
@@ -580,45 +585,39 @@ function isBotFrameworkPersonalChatId(conversationId) {
 	const trimmed = conversationId.trim();
 	return trimmed.startsWith("a:") || trimmed.startsWith("8:orgid:");
 }
-function normalizeServiceUrl(serviceUrl) {
-	return serviceUrl.replace(/\/+$/, "");
-}
-function buildBotFrameworkAttachmentHeaders(params) {
-	const headers = require_resolve_allowlist.ensureUserAgentHeader();
-	require_resolve_allowlist.applyAuthorizationHeaderForUrl({
-		headers,
-		url: params.url,
-		authAllowHosts: params.policy.authAllowHosts,
-		bearerToken: params.accessToken
-	});
-	return headers;
-}
-async function fetchBotFrameworkAttachmentInfo(params) {
-	const url = `${normalizeServiceUrl(params.serviceUrl)}/v3/attachments/${encodeURIComponent(params.attachmentId)}`;
+async function fetchBotFrameworkAttachment(params, kind) {
 	let response;
 	try {
+		const headers = require_resolve_allowlist.ensureUserAgentHeader();
+		require_resolve_allowlist.applyAuthorizationHeaderForUrl({
+			headers,
+			url: params.url,
+			authAllowHosts: params.policy.authAllowHosts,
+			bearerToken: params.accessToken
+		});
 		response = await require_resolve_allowlist.safeFetchWithPolicy({
-			url,
+			url: params.url,
 			policy: params.policy,
 			fetchFn: params.fetchFn,
 			fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
 			resolveFn: params.resolveFn,
-			requestInit: { headers: buildBotFrameworkAttachmentHeaders({
-				url,
-				accessToken: params.accessToken,
-				policy: params.policy
-			}) },
+			requestInit: { headers },
 			timeoutMs: require_resolve_allowlist.resolveMSTeamsRequestTimeoutMs(params.deadline)
 		});
 	} catch (err) {
-		params.logger?.warn?.("msteams botFramework attachmentInfo fetch failed", { error: (0, openclaw_plugin_sdk_error_runtime.coerceErrorMessage)(err) });
+		params.logger?.warn?.(`msteams botFramework ${kind} fetch failed`, { error: (0, openclaw_plugin_sdk_error_runtime.coerceErrorMessage)(err) });
 		return;
 	}
 	if (!response.ok) {
 		await response.body?.cancel().catch(() => void 0);
-		params.logger?.warn?.("msteams botFramework attachmentInfo non-ok", { status: response.status });
+		params.logger?.warn?.(`msteams botFramework ${kind} non-ok`, { status: response.status });
 		return;
 	}
+	return response;
+}
+async function fetchBotFrameworkAttachmentInfo(params) {
+	const response = await fetchBotFrameworkAttachment(params, "attachmentInfo");
+	if (!response) return;
 	try {
 		return await (0, openclaw_plugin_sdk_provider_http.readProviderJsonResponse)(response, "msteams botFramework attachmentInfo");
 	} catch (err) {
@@ -627,31 +626,8 @@ async function fetchBotFrameworkAttachmentInfo(params) {
 	}
 }
 async function saveBotFrameworkAttachmentView(params) {
-	const url = `${normalizeServiceUrl(params.serviceUrl)}/v3/attachments/${encodeURIComponent(params.attachmentId)}/views/${encodeURIComponent(params.viewId)}`;
-	let response;
-	try {
-		response = await require_resolve_allowlist.safeFetchWithPolicy({
-			url,
-			policy: params.policy,
-			fetchFn: params.fetchFn,
-			fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
-			resolveFn: params.resolveFn,
-			requestInit: { headers: buildBotFrameworkAttachmentHeaders({
-				url,
-				accessToken: params.accessToken,
-				policy: params.policy
-			}) },
-			timeoutMs: require_resolve_allowlist.resolveMSTeamsRequestTimeoutMs(params.deadline)
-		});
-	} catch (err) {
-		params.logger?.warn?.("msteams botFramework attachmentView fetch failed", { error: (0, openclaw_plugin_sdk_error_runtime.coerceErrorMessage)(err) });
-		return;
-	}
-	if (!response.ok) {
-		await response.body?.cancel().catch(() => void 0);
-		params.logger?.warn?.("msteams botFramework attachmentView non-ok", { status: response.status });
-		return;
-	}
+	const response = await fetchBotFrameworkAttachment(params, "attachmentView");
+	if (!response) return;
 	let contentLength;
 	try {
 		contentLength = (0, openclaw_plugin_sdk_media_runtime.parseMediaContentLength)(response.headers.get("content-length"));
@@ -666,7 +642,7 @@ async function saveBotFrameworkAttachmentView(params) {
 	}
 	try {
 		return await require_runtime.getMSTeamsRuntime().channel.media.saveResponseMedia(response, {
-			sourceUrl: url,
+			sourceUrl: params.url,
 			filePathHint: params.fileNameHint,
 			maxBytes: params.maxBytes,
 			fallbackContentType: params.contentTypeHint,
@@ -680,12 +656,6 @@ async function saveBotFrameworkAttachmentView(params) {
 		await response.body?.cancel().catch(() => void 0);
 	}
 }
-/**
-* Download media for a single attachment via the Bot Framework v3 attachments
-* endpoint. Used for personal DM conversations where the Graph `/chats/{id}`
-* path is not usable because the Bot Framework conversation ID (`a:...`) is
-* not a valid Graph chat identifier.
-*/
 async function downloadMSTeamsBotFrameworkAttachment(params) {
 	if (!params.serviceUrl || !params.attachmentId || !params.tokenProvider) return;
 	const tokenProvider = params.tokenProvider;
@@ -693,8 +663,8 @@ async function downloadMSTeamsBotFrameworkAttachment(params) {
 		allowHosts: params.allowHosts,
 		authAllowHosts: params.authAllowHosts
 	});
-	const baseUrl = `${normalizeServiceUrl(params.serviceUrl)}/v3/attachments/${encodeURIComponent(params.attachmentId)}`;
-	if (!require_resolve_allowlist.isUrlAllowed(baseUrl, policy.allowHosts)) return;
+	const baseUrl = `${params.serviceUrl.replace(/\/+$/, "")}/v3/attachments/${encodeURIComponent(params.attachmentId)}`;
+	if (!(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(baseUrl, policy.allowHosts)) return;
 	let accessToken;
 	try {
 		accessToken = await require_resolve_allowlist.withMSTeamsRequestDeadline({
@@ -707,9 +677,8 @@ async function downloadMSTeamsBotFrameworkAttachment(params) {
 		return;
 	}
 	if (!accessToken) return;
-	const info = await fetchBotFrameworkAttachmentInfo({
-		serviceUrl: params.serviceUrl,
-		attachmentId: params.attachmentId,
+	const request = {
+		url: baseUrl,
 		accessToken,
 		policy,
 		fetchFn: params.fetchFn,
@@ -717,7 +686,8 @@ async function downloadMSTeamsBotFrameworkAttachment(params) {
 		resolveFn: params.resolveFn,
 		logger: params.logger,
 		deadline: params.deadline
-	});
+	};
+	const info = await fetchBotFrameworkAttachmentInfo(request);
 	if (!info) return;
 	const views = Array.isArray(info.views) ? info.views : [];
 	const candidateView = views.find((view) => view?.viewId === "original") ?? views.find((view) => typeof view?.viewId === "string");
@@ -727,20 +697,12 @@ async function downloadMSTeamsBotFrameworkAttachment(params) {
 	const fileNameHint = typeof params.fileNameHint === "string" && params.fileNameHint || typeof info.name === "string" && info.name || void 0;
 	const contentTypeHint = typeof params.contentTypeHint === "string" && params.contentTypeHint || typeof info.type === "string" && info.type || void 0;
 	const saved = await saveBotFrameworkAttachmentView({
-		serviceUrl: params.serviceUrl,
-		attachmentId: params.attachmentId,
-		viewId,
-		accessToken,
+		...request,
+		url: `${baseUrl}/views/${encodeURIComponent(viewId)}`,
 		maxBytes: params.maxBytes,
 		fileNameHint,
 		contentTypeHint,
-		preserveFilenames: params.preserveFilenames,
-		policy,
-		fetchFn: params.fetchFn,
-		fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
-		resolveFn: params.resolveFn,
-		logger: params.logger,
-		deadline: params.deadline
+		preserveFilenames: params.preserveFilenames
 	});
 	if (!saved) return;
 	return {
@@ -759,15 +721,7 @@ async function downloadMSTeamsBotFrameworkAttachment(params) {
 * reuse the existing logging path.
 */
 async function downloadMSTeamsBotFrameworkAttachments(params) {
-	const seen = /* @__PURE__ */ new Set();
-	const unique = [];
-	for (const id of params.attachmentIds ?? []) {
-		if (typeof id !== "string") continue;
-		const trimmed = id.trim();
-		if (!trimmed || seen.has(trimmed)) continue;
-		seen.add(trimmed);
-		unique.push(trimmed);
-	}
+	const unique = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeUniqueTrimmedStringList)(params.attachmentIds);
 	if (unique.length === 0 || !params.serviceUrl || !params.tokenProvider) return {
 		media: [],
 		attachmentCount: unique.length
@@ -775,20 +729,8 @@ async function downloadMSTeamsBotFrameworkAttachments(params) {
 	const media = [];
 	for (const attachmentId of unique) try {
 		const item = await downloadMSTeamsBotFrameworkAttachment({
-			serviceUrl: params.serviceUrl,
-			attachmentId,
-			tokenProvider: params.tokenProvider,
-			maxBytes: params.maxBytes,
-			allowHosts: params.allowHosts,
-			authAllowHosts: params.authAllowHosts,
-			fetchFn: params.fetchFn,
-			fetchFnSupportsDispatcher: params.fetchFnSupportsDispatcher,
-			resolveFn: params.resolveFn,
-			deadline: params.deadline,
-			fileNameHint: params.fileNameHint,
-			contentTypeHint: params.contentTypeHint,
-			preserveFilenames: params.preserveFilenames,
-			logger: params.logger
+			...params,
+			attachmentId
 		});
 		if (item) media.push({
 			...item,
@@ -828,11 +770,9 @@ function extractMSTeamsHtmlAttachmentIds(attachments) {
 		const html = require_resolve_allowlist.extractHtmlFromAttachment(att);
 		if (!html) continue;
 		require_resolve_allowlist.ATTACHMENT_TAG_RE.lastIndex = 0;
-		let match = require_resolve_allowlist.ATTACHMENT_TAG_RE.exec(html);
-		while (match) {
+		for (const match of html.matchAll(require_resolve_allowlist.ATTACHMENT_TAG_RE)) {
 			const id = match[1]?.trim();
 			if (id) ids.add(id);
-			match = require_resolve_allowlist.ATTACHMENT_TAG_RE.exec(html);
 		}
 	}
 	return Array.from(ids);
@@ -852,8 +792,7 @@ function summarizeMSTeamsHtmlAttachments(attachments) {
 		if (!html) continue;
 		htmlAttachments += 1;
 		require_resolve_allowlist.IMG_SRC_RE.lastIndex = 0;
-		let match = require_resolve_allowlist.IMG_SRC_RE.exec(html);
-		while (match) {
+		for (const match of html.matchAll(require_resolve_allowlist.IMG_SRC_RE)) {
 			imgTags += 1;
 			const src = match[1]?.trim();
 			if (src) {
@@ -861,15 +800,12 @@ function summarizeMSTeamsHtmlAttachments(attachments) {
 				else if (src.startsWith("cid:")) cidImages += 1;
 				else srcHosts.add(require_resolve_allowlist.safeHostForUrl(src));
 			}
-			match = require_resolve_allowlist.IMG_SRC_RE.exec(html);
 		}
 		require_resolve_allowlist.ATTACHMENT_TAG_RE.lastIndex = 0;
-		let attachmentMatch = require_resolve_allowlist.ATTACHMENT_TAG_RE.exec(html);
-		while (attachmentMatch) {
+		for (const attachmentMatch of html.matchAll(require_resolve_allowlist.ATTACHMENT_TAG_RE)) {
 			attachmentTags += 1;
 			const id = attachmentMatch[1]?.trim();
 			if (id) attachmentIds.add(id);
-			attachmentMatch = require_resolve_allowlist.ATTACHMENT_TAG_RE.exec(html);
 		}
 	}
 	if (htmlAttachments === 0) return;
@@ -893,9 +829,10 @@ function resolveUnrepresentedHtmlAttachmentIds(attachments) {
 	return extractMSTeamsHtmlAttachmentIds(attachments).filter((id) => !representedIds.has(id));
 }
 function createAdvertisedMediaFact(kind, sourceId) {
-	const media = { kind };
-	if (sourceId) media.sourceId = sourceId;
-	return media;
+	return {
+		kind,
+		...sourceId ? { sourceId } : {}
+	};
 }
 function resolveMSTeamsAdvertisedMedia(attachments) {
 	const list = Array.isArray(attachments) ? attachments : [];
@@ -919,49 +856,28 @@ function resolveMSTeamsAdvertisedMedia(attachments) {
 * implementation. This lets Teams-specific auth fallback own the request
 * sequence while keeping redirect and DNS pinning inside `safeFetchWithPolicy`.
 */
-async function saveRemoteMediaDirect(params) {
+async function downloadAndStoreMSTeamsRemoteMedia(params) {
 	const response = await params.fetchImpl(params.url, { redirect: "follow" });
 	try {
-		return await (0, openclaw_plugin_sdk_media_runtime.saveResponseMedia)(response, {
+		const saved = await (0, openclaw_plugin_sdk_media_runtime.saveResponseMedia)(response, {
 			sourceUrl: params.url,
 			filePathHint: params.filePathHint,
 			maxBytes: params.maxBytes,
 			fallbackContentType: params.contentTypeHint,
-			originalFilename: params.originalFilename
+			originalFilename: params.preserveFilenames ? params.filePathHint : void 0
 		});
+		return {
+			path: saved.path,
+			contentType: saved.contentType,
+			kind: params.kind ?? require_resolve_allowlist.resolveMSTeamsMediaKind({
+				contentType: saved.contentType,
+				fileName: params.filePathHint
+			})
+		};
 	} finally {
 		await response.body?.cancel().catch(() => void 0);
 	}
 }
-async function downloadAndStoreMSTeamsRemoteMedia(params) {
-	const originalFilename = params.preserveFilenames ? params.filePathHint : void 0;
-	let saved;
-	if (params.useDirectFetch && params.fetchImpl) saved = await saveRemoteMediaDirect({
-		url: params.url,
-		filePathHint: params.filePathHint,
-		fetchImpl: params.fetchImpl,
-		maxBytes: params.maxBytes,
-		contentTypeHint: params.contentTypeHint,
-		originalFilename
-	});
-	else saved = await require_runtime.getMSTeamsRuntime().channel.media.saveRemoteMedia({
-		url: params.url,
-		fetchImpl: params.fetchImpl,
-		filePathHint: params.filePathHint,
-		maxBytes: params.maxBytes,
-		ssrfPolicy: params.ssrfPolicy,
-		fallbackContentType: params.contentTypeHint,
-		originalFilename
-	});
-	return {
-		path: saved.path,
-		contentType: saved.contentType,
-		kind: params.kind ?? require_resolve_allowlist.resolveMSTeamsMediaKind({
-			contentType: saved.contentType,
-			fileName: params.filePathHint
-		})
-	};
-}
 //#endregion
 //#region extensions/msteams/src/attachments/download.ts
 function withSourceId(media, sourceId) {
@@ -1021,22 +937,8 @@ function scopeCandidatesForUrl(url) {
 }
 function canonicalizeInlineBase64Payload(value) {
 	let cleaned = "";
-	let padding = 0;
-	let sawPadding = false;
-	for (let index = 0; index < value.length; index += 1) {
-		const code = value.charCodeAt(index);
-		if (code <= 32) continue;
-		if (code === 61) {
-			padding += 1;
-			if (padding > 2) return;
-			sawPadding = true;
-			cleaned += "=";
-			continue;
-		}
-		if (sawPadding || !(code >= 65 && code <= 90 || code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 43 || code === 47)) return;
-		cleaned += value[index];
-	}
-	return cleaned && cleaned.length % 4 === 0 ? cleaned : void 0;
+	for (const char of value) if (char.charCodeAt(0) > 32) cleaned += char;
+	return cleaned.length % 4 === 0 && /^[A-Za-z0-9+/]+={0,2}$/.test(cleaned) ? cleaned : void 0;
 }
 function decodeInlineDataImage(src, maxBytes, totalBytes) {
 	const match = /^data:(image\/[a-z0-9.+-]+)?(;base64)?,(.*)$/i.exec(src);
@@ -1079,7 +981,7 @@ async function fetchWithAuthFallback(params) {
 	if (!params.tokenProvider) return firstAttempt;
 	const tokenProvider = params.tokenProvider;
 	if (firstAttempt.status !== 401 && firstAttempt.status !== 403) return firstAttempt;
-	if (!require_resolve_allowlist.isUrlAllowed(params.url, params.policy.authAllowHosts)) return firstAttempt;
+	if (!(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(params.url, params.policy.authAllowHosts)) return firstAttempt;
 	let fallbackAttempt = firstAttempt;
 	const scopes = scopeCandidatesForUrl(params.url);
 	const fetchFn = params.fetchFn ?? fetch;
@@ -1109,10 +1011,6 @@ async function fetchWithAuthFallback(params) {
 	} catch {}
 	return fallbackAttempt;
 }
-/**
-* Download all file attachments from a Teams message (images, documents, etc.).
-* Renamed from downloadMSTeamsImageAttachments to support all file types.
-*/
 async function downloadMSTeamsAttachments(params) {
 	const list = Array.isArray(params.attachments) ? params.attachments : [];
 	if (list.length === 0) return [];
@@ -1121,7 +1019,6 @@ async function downloadMSTeamsAttachments(params) {
 		authAllowHosts: params.authAllowHosts
 	});
 	const allowHosts = policy.allowHosts;
-	const ssrfPolicy = require_resolve_allowlist.resolveMediaSsrfPolicy(allowHosts);
 	const candidates = list.filter(require_resolve_allowlist.isAdvertisedFileAttachment).map((attachment) => {
 		return (require_resolve_allowlist.isDownloadableAttachment(attachment) ? resolveDownloadCandidate(attachment) : null) ?? {
 			kind: "unavailable",
@@ -1192,7 +1089,7 @@ async function downloadMSTeamsAttachments(params) {
 			}
 			continue;
 		}
-		if (!require_resolve_allowlist.isUrlAllowed(candidate.url, allowHosts)) {
+		if (!(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(candidate.url, allowHosts)) {
 			out.push(withSourceId({ kind: candidate.mediaKind }, candidate.sourceId));
 			continue;
 		}
@@ -1204,8 +1101,6 @@ async function downloadMSTeamsAttachments(params) {
 				contentTypeHint: candidate.contentTypeHint,
 				kind: candidate.mediaKind,
 				preserveFilenames: params.preserveFilenames,
-				ssrfPolicy,
-				useDirectFetch: true,
 				fetchImpl: (input, init) => fetchWithAuthFallback({
 					url: require_resolve_allowlist.resolveRequestUrl(input),
 					tokenProvider: params.tokenProvider,
@@ -1308,10 +1203,6 @@ function normalizeGraphAttachment(att) {
 		content
 	};
 }
-/**
-* Download all hosted content from a Teams message (images, documents, etc.).
-* Renamed from downloadGraphHostedImages to support all file types.
-*/
 async function downloadGraphHostedContent(params) {
 	let hosted;
 	try {
@@ -1389,7 +1280,7 @@ async function downloadMSTeamsGraphMedia(params) {
 		allowHosts: params.allowHosts,
 		authAllowHosts: params.authAllowHosts
 	});
-	const ssrfPolicy = require_resolve_allowlist.resolveMediaSsrfPolicy(policy.allowHosts);
+	const ssrfPolicy = (0, openclaw_plugin_sdk_ssrf_policy.buildHostnameAllowlistPolicyFromSuffixAllowlist)(policy.allowHosts);
 	const messageUrl = params.messageUrl;
 	let accessToken;
 	try {
@@ -1476,7 +1367,7 @@ async function downloadMSTeamsGraphMedia(params) {
 		downloadedReferenceUrls.add(shareUrl);
 		try {
 			const sharesUrl = `${require_resolve_allowlist.GRAPH_ROOT}/shares/${require_resolve_allowlist.encodeGraphShareId(shareUrl)}/driveItem/content`;
-			if (!require_resolve_allowlist.isUrlAllowed(sharesUrl, policy.allowHosts)) {
+			if (!(0, openclaw_plugin_sdk_ssrf_policy.isHttpsUrlAllowedByHostnameSuffixAllowlist)(sharesUrl, policy.allowHosts)) {
 				params.logger?.debug?.("graph media sharepoint url not in allowHosts", {
 					messageUrl,
 					sharesUrl
@@ -1490,8 +1381,6 @@ async function downloadMSTeamsGraphMedia(params) {
 				maxBytes: params.maxBytes,
 				contentTypeHint: "application/octet-stream",
 				preserveFilenames: params.preserveFilenames,
-				ssrfPolicy,
-				useDirectFetch: true,
 				fetchImpl: async (input, init) => {
 					const requestUrl = require_resolve_allowlist.resolveRequestUrl(input);
 					const headers = require_resolve_allowlist.ensureUserAgentHeader(init?.headers);
@@ -1532,7 +1421,6 @@ async function downloadMSTeamsGraphMedia(params) {
 		messageUrl,
 		maxBytes: params.maxBytes,
 		fetchFn: params.fetchFn,
-		preserveFilenames: params.preserveFilenames,
 		ssrfPolicy,
 		logger: params.logger,
 		deadline: params.deadline
@@ -1875,7 +1763,7 @@ function createTeamsReplyStreamController(params) {
 		} : payload;
 	};
 	const finalStreamActivity = (text) => ({
-		...require_messenger.buildMSTeamsMessageActivity(text === void 0 ? void 0 : require_messenger.formatMSTeamsMarkdown(text, params.tableMode ?? "code")),
+		...require_conversation_store_state.buildMSTeamsMessageActivity(text === void 0 ? void 0 : require_conversation_store_state.formatMSTeamsMarkdown(text, params.tableMode ?? "code")),
 		channelData: params.feedbackLoopEnabled ? { feedbackLoopEnabled: true } : {}
 	});
 	const deferredReplacementLogicalContent = () => {
@@ -1895,6 +1783,19 @@ function createTeamsReplyStreamController(params) {
 		deferredReplacementEntries = [];
 		return payloads;
 	};
+	const finalizeWithoutReceipt = (logicalContent, canceled = false) => {
+		const pending = pendingFinalPayload;
+		pendingFinalPayload = void 0;
+		const fallback = pending && !canceled ? fallbackPayloadAfterAcknowledgedText(pending) : void 0;
+		const postNativePayloads = replacementSettlementPending && !canceled ? takeDeferredReplacementPayloads(fallback) : [];
+		if (canceled) deferredReplacementEntries = [];
+		return {
+			...acknowledgedNativeDelivery(),
+			...!canceled && logicalContent ? { logicalContent } : {},
+			...!replacementSettlementPending && fallback ? { fallbackPayload: fallback } : {},
+			...postNativePayloads.length > 0 ? { postNativePayloads } : {}
+		};
+	};
 	const progressDraft = (0, openclaw_plugin_sdk_channel_outbound.createChannelProgressDraftCompositor)({
 		preparedItems: true,
 		formatPlainText: (text) => text,
@@ -1915,7 +1816,6 @@ function createTeamsReplyStreamController(params) {
 		}
 	});
 	return {
-		async onReplyStart() {},
 		onPartialReply(payload) {
 			if (!stream || !payload.text || wasCanceled() || streamMode !== "partial") return;
 			if (replacementSettlementPending && replacementFinalPending) {
@@ -1957,29 +1857,16 @@ function createTeamsReplyStreamController(params) {
 		},
 		pushItemEvent: progressDraft.pushItemEvent.bind(progressDraft),
 		pushToolEvent: progressDraft.pushToolEvent,
-		async pushReasoningProgress(text, options) {
-			await progressDraft.pushReasoningProgress(text, options);
-		},
-		resetReasoningProgress: () => progressDraft.resetReasoningProgress(),
-		async pushApprovalEvent(payload) {
-			await progressDraft.pushApprovalEvent(payload);
-		},
-		async pushPlanProgress(steps, options) {
-			await progressDraft.pushPlanProgress(steps, options);
-		},
+		pushReasoningProgress: progressDraft.pushReasoningProgress.bind(progressDraft),
+		resetReasoningProgress: progressDraft.resetReasoningProgress,
+		pushApprovalEvent: progressDraft.pushApprovalEvent.bind(progressDraft),
+		pushPlanProgress: progressDraft.pushPlanProgress.bind(progressDraft),
 		preparePayload(payload) {
 			if (!stream) return payload;
 			if (wasCanceled()) return;
 			if (payload.text) progressDraft.markFinalReplyStarted();
 			if (replacementSettlementPending) {
-				if (!replacementFinalPending) {
-					deferredReplacementEntries.push({
-						kind: "payload",
-						payload
-					});
-					return;
-				}
-				if (!payload.text) {
+				if (!replacementFinalPending || !payload.text) {
 					deferredReplacementEntries.push({
 						kind: "payload",
 						payload
@@ -2104,24 +1991,10 @@ function createTeamsReplyStreamController(params) {
 				}
 				const result = await stream.close();
 				streamFinalizationPending = false;
-				if (!result) {
-					const fallback = pendingFinalPayload;
-					pendingFinalPayload = void 0;
-					const canceled = wasCanceled();
-					const replacementFallback = replacementSettlementPending && fallback && !canceled ? fallbackPayloadAfterAcknowledgedText(fallback) : void 0;
-					const fallbackPayload = !replacementSettlementPending && fallback && !canceled ? fallbackPayloadAfterAcknowledgedText(fallback) : void 0;
-					const postNativePayloads = replacementSettlementPending && !canceled ? takeDeferredReplacementPayloads(replacementFallback) : [];
-					if (canceled) deferredReplacementEntries = [];
-					return {
-						...acknowledgedNativeDelivery(),
-						...!canceled && logicalContent ? { logicalContent } : {},
-						...fallbackPayload ? { fallbackPayload } : {},
-						...postNativePayloads.length > 0 ? { postNativePayloads } : {}
-					};
-				}
+				if (!result) return finalizeWithoutReceipt(logicalContent, wasCanceled());
 				const replacementFallback = replacementSettlementPending && replacementEmitFailed && pendingFinalPayload ? fallbackPayloadAfterAcknowledgedText(pendingFinalPayload) : void 0;
 				pendingFinalPayload = void 0;
-				const messageId = require_messenger.extractMessageId(result) ?? acknowledgedStreamId;
+				const messageId = require_conversation_store_state.extractMessageId(result) ?? acknowledgedStreamId;
 				const postNativePayloads = replacementSettlementPending ? takeDeferredReplacementPayloads(replacementFallback) : [];
 				const nativeContent = replacementEmitFailed ? acknowledgedText || void 0 : content;
 				return {
@@ -2142,17 +2015,7 @@ function createTeamsReplyStreamController(params) {
 				streamFailed = true;
 				streamFinalizationPending = false;
 				params.log?.warn?.(`msteams stream finalize failed: ${(0, openclaw_plugin_sdk_error_runtime.coerceErrorMessage)(err)}`);
-				const fallback = pendingFinalPayload;
-				pendingFinalPayload = void 0;
-				const replacementFallback = replacementSettlementPending && fallback ? fallbackPayloadAfterAcknowledgedText(fallback) : void 0;
-				const fallbackPayload = !replacementSettlementPending && fallback ? fallbackPayloadAfterAcknowledgedText(fallback) : void 0;
-				const postNativePayloads = replacementSettlementPending ? takeDeferredReplacementPayloads(replacementFallback) : [];
-				return {
-					...acknowledgedNativeDelivery(),
-					...logicalContent ? { logicalContent } : {},
-					...fallbackPayload ? { fallbackPayload } : {},
-					...postNativePayloads.length > 0 ? { postNativePayloads } : {}
-				};
+				return finalizeWithoutReceipt(logicalContent);
 			} finally {
 				failedSegmentFallbackPrepared = true;
 				queuedFinalActivity = void 0;
@@ -2180,43 +2043,22 @@ function createMSTeamsReplyDispatcher(params) {
 	const msteamsCfg = params.cfg.channels?.msteams;
 	const conversationType = (0, openclaw_plugin_sdk_string_coerce_runtime.normalizeOptionalLowercaseString)(params.conversationRef.conversation?.conversationType);
 	const isTypingSupported = conversationType === "personal" || conversationType === "groupchat";
-	/**
-	* Keepalive cadence for the typing indicator while the bot is running
-	* (including long tool chains). Bot Framework 1:1 TurnContext proxies
-	* expire after ~30s of inactivity; sending a typing activity every 8s
-	* keeps the proxy alive so the post-tool reply can still land via the
-	* turn context. Sits in the middle of the 5-10s range recommended in
-	* #59731.
-	*/
 	const TYPING_KEEPALIVE_INTERVAL_MS = 8e3;
-	/**
-	* TTL ceiling for the typing keepalive loop. The default in
-	* createTypingCallbacks is 60s, which is too short for the Teams long tool
-	* chains described in #59731 (60s+ total runs are common). Give tool
-	* chains up to 10 minutes before auto-stopping the keepalive.
-	*/
 	const TYPING_KEEPALIVE_MAX_DURATION_MS = 6e5;
-	const streamActiveRef = { current: () => false };
-	const streamCanceledRef = { current: () => false };
-	const rawSendTypingIndicator = async () => {
-		await require_messenger.withRevokedProxyFallback({
+	const sendTypingIndicator = async () => {
+		if (!isTypingSupported || streamController.isStreamActive() || streamController.wasCanceled()) return;
+		await require_conversation_store_state.withRevokedProxyFallback({
 			run: async () => {
 				await params.context.sendActivity({ type: "typing" });
 			},
 			onRevoked: async () => {
-				const baseRef = require_messenger.buildConversationReference(params.conversationRef);
-				await require_messenger.sendMSTeamsActivityWithReference(params.app, baseRef, { type: "typing" }, { serviceUrlBoundary: require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(msteamsCfg) });
+				await require_conversation_store_state.sendMSTeamsActivityWithReference(params.app, require_conversation_store_state.buildConversationReference(params.conversationRef), { type: "typing" }, { serviceUrlBoundary: require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(msteamsCfg) });
 			},
 			onRevokedLog: () => {
 				params.log.debug?.("turn context revoked, sending typing via proactive messaging");
 			}
 		});
 	};
-	const sendTypingIndicator = isTypingSupported ? async () => {
-		if (streamActiveRef.current()) return;
-		if (streamCanceledRef.current()) return;
-		await rawSendTypingIndicator();
-	} : async () => {};
 	const { onModelSelected, typingCallbacks, ...replyPipeline } = (0, openclaw_plugin_sdk_channel_outbound.createChannelMessageReplyPipeline)({
 		cfg: params.cfg,
 		agentId: params.agentId,
@@ -2257,8 +2099,6 @@ function createMSTeamsReplyDispatcher(params) {
 		msteamsConfig: msteamsCfg,
 		progressSeed: `${params.accountId ?? "default"}:${params.conversationRef.conversation?.id ?? ""}`
 	});
-	streamActiveRef.current = () => streamController.isStreamActive();
-	streamCanceledRef.current = () => streamController.wasCanceled();
 	const teamsStreamMode = (0, openclaw_plugin_sdk_channel_outbound.resolveChannelPreviewStreamMode)(msteamsCfg, "partial");
 	const blockStreamingResolved = teamsStreamMode === "block" ? true : (0, openclaw_plugin_sdk_channel_outbound.resolveChannelStreamingBlockEnabled)(msteamsCfg);
 	const blockStreamingEnabled = blockStreamingResolved ?? false;
@@ -2268,7 +2108,7 @@ function createMSTeamsReplyDispatcher(params) {
 	const findPendingNativeDelivery = () => pendingDeliveries.find((candidate) => candidate.native && !candidate.nativeSettled);
 	const joinAcceptedContents = (contents) => contents.filter((content) => Boolean(content)).join("\n");
 	const sendMessages = async (messages) => {
-		return require_messenger.sendMSTeamsMessages({
+		return require_conversation_store_state.sendMSTeamsMessages({
 			replyStyle: params.replyStyle,
 			app: params.app,
 			appId: params.appId,
@@ -2307,7 +2147,7 @@ function createMSTeamsReplyDispatcher(params) {
 		});
 	};
 	const renderReplyPayload = (payload) => {
-		return require_messenger.renderReplyPayloadsToMessages([payload], {
+		return require_conversation_store_state.renderReplyPayloadsToMessages([payload], {
 			textChunkLimit: params.textLimit,
 			chunkText: true,
 			mediaMode: "split",
@@ -2400,7 +2240,6 @@ function createMSTeamsReplyDispatcher(params) {
 		...replyPipeline,
 		humanDelay: (0, openclaw_plugin_sdk_agent_runtime.resolveHumanDelayConfig)(params.cfg, params.agentId),
 		onReplyStart: async () => {
-			await streamController.onReplyStart();
 			if (typingIndicatorEnabled) await typingCallbacks?.onReplyStart?.();
 		},
 		typingCallbacks
@@ -2531,32 +2370,6 @@ function createMSTeamsReplyDispatcher(params) {
 	};
 }
 //#endregion
-//#region extensions/msteams/src/sent-message-cache.ts
-const sentMessages = (0, openclaw_plugin_sdk_dedupe_runtime.createPersistentDedupeCache)({
-	globalKey: Symbol.for("openclaw.msteamsSentMessages"),
-	ttlMs: 864e5,
-	maxSize: 2e4,
-	persistent: {
-		namespace: "msteams.sent-messages",
-		maxEntries: 1e3,
-		openStore: (options) => require_runtime.getOptionalMSTeamsRuntime()?.state.openKeyedStore(options),
-		logError: (0, openclaw_plugin_sdk_plugin_state_runtime.createPluginStateErrorReporter)(require_runtime.getOptionalMSTeamsRuntime, "msteams", "sent-message-state", "Microsoft Teams persistent sent-message state failed"),
-		readTimestamp: (record) => record.sentAt
-	}
-});
-function makeKey(conversationId, messageId) {
-	return `${conversationId}:${messageId}`;
-}
-function recordMSTeamsSentMessage(conversationId, messageId) {
-	if (!conversationId || !messageId) return;
-	const sentAt = Date.now();
-	sentMessages.register(makeKey(conversationId, messageId), { sentAt }, { at: sentAt });
-}
-async function wasMSTeamsMessageSentWithPersistence(params) {
-	if (!params.conversationId || !params.messageId) return false;
-	return await sentMessages.lookup(makeKey(params.conversationId, params.messageId));
-}
-//#endregion
 //#region extensions/msteams/src/monitor-handler/inbound-dispatch.ts
 async function dispatchMSTeamsInboundTurn(params) {
 	const core = require_runtime.getMSTeamsRuntime();
@@ -2603,7 +2416,7 @@ async function dispatchMSTeamsInboundTurn(params) {
 		isGroup: !isDirectMessage,
 		groupPolicy,
 		allowFrom: effectiveGroupAllowFrom,
-		isSenderAllowed: (allowFrom) => require_channel.resolveMSTeamsAllowlistMatch({
+		isSenderAllowed: (allowFrom) => (0, openclaw_plugin_sdk_allow_from.resolveAllowlistMatchSimple)({
 			allowFrom,
 			senderId: quoteSenderId ?? "",
 			senderName: quoteSenderName,
@@ -2711,7 +2524,7 @@ async function dispatchMSTeamsInboundTurn(params) {
 		replyStyle,
 		textLimit,
 		onSentMessageIds: (ids) => {
-			for (const id of ids) recordMSTeamsSentMessage(conversationId, id);
+			for (const id of ids) require_conversation_store_state.recordMSTeamsSentMessage(conversationId, id);
 		},
 		tokenProvider,
 		sharePointSiteId: cfg.channels?.msteams?.sharePointSiteId
@@ -2805,7 +2618,7 @@ async function prepareMSTeamsDebounceEntry(params) {
 	const text = rawText ? require_resolve_allowlist.stripMSTeamsMentionTags(rawText) : extractTextFromHtmlAttachments(attachments) || require_resolve_allowlist.stripMSTeamsMentionTags(serializeMSTeamsAdaptiveCardActionValue(activity.value) || "");
 	const conversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(activity.conversation?.id ?? "");
 	const replyToId = activity.replyToId ?? void 0;
-	const implicitMentionKinds = conversationId && replyToId && await wasMSTeamsMessageSentWithPersistence({
+	const implicitMentionKinds = conversationId && replyToId && await require_conversation_store_state.wasMSTeamsMessageSentWithPersistence({
 		conversationId,
 		messageId: replyToId
 	}) ? ["reply_to_bot"] : [];
@@ -2826,7 +2639,7 @@ function buildStoredConversationReference(params) {
 	const clientInfo = activity.entities?.find((entity) => entity.type === "clientInfo");
 	const tenantId = activity.channelData?.tenant?.id ?? conversation?.tenantId;
 	const aadObjectId = from?.aadObjectId;
-	const serviceUrl = require_resolve_allowlist.tryNormalizeBotFrameworkServiceUrl(activity.serviceUrl);
+	const serviceUrl = require_bot_framework_service_url.tryNormalizeBotFrameworkServiceUrl(activity.serviceUrl);
 	return {
 		activityId: activity.id,
 		user: from ? {
@@ -2925,12 +2738,9 @@ const parentCache = /* @__PURE__ */ new Map();
 const INJECTED_MAX = 200;
 const injectedParents = /* @__PURE__ */ new Map();
 function touchLru(map, key, value, max) {
-	if (map.has(key)) map.delete(key);
-	else if (map.size >= max) {
-		const firstKey = map.keys().next().value;
-		if (firstKey !== void 0) map.delete(firstKey);
-	}
+	map.delete(key);
 	map.set(key, value);
+	(0, openclaw_plugin_sdk_collection_runtime.pruneMapToMaxSize)(map, max);
 }
 function buildParentCacheKey(groupId, channelId, parentId) {
 	return `${groupId}\u0000${channelId}\u0000${parentId}`;
@@ -2939,12 +2749,6 @@ function resolveParentCacheExpiresAt(nowRaw) {
 	const nowMs = (0, openclaw_plugin_sdk_number_runtime.asDateTimestampMs)(nowRaw);
 	return nowMs === void 0 ? void 0 : (0, openclaw_plugin_sdk_number_runtime.resolveExpiresAtMsFromDurationMs)(PARENT_CACHE_TTL_MS, { nowMs });
 }
-/**
-* Fetch a channel parent message with an LRU+TTL cache.
-*
-* Uses the injected `fetchParent` (defaults to `fetchChannelMessage`) so
-* tests can swap in a stub without mocking the Graph transport.
-*/
 async function fetchParentMessageCached(token, groupId, channelId, parentId, fetchParent = require_reaction_types.fetchChannelMessage) {
 	const key = buildParentCacheKey(groupId, channelId, parentId);
 	const now = (0, openclaw_plugin_sdk_number_runtime.asDateTimestampMs)(Date.now());
@@ -2965,11 +2769,6 @@ async function fetchParentMessageCached(token, groupId, channelId, parentId, fet
 	return message;
 }
 const PARENT_TEXT_MAX_CHARS = 400;
-/**
-* Extract a compact summary (sender + plain-text body) from a Graph parent
-* message. Returns undefined when the parent cannot be summarized (missing
-* or blank body).
-*/
 function summarizeParentMessage(message) {
 	if (!message) return;
 	const sender = message.from?.user?.displayName ?? message.from?.application?.displayName ?? "unknown";
@@ -2982,28 +2781,12 @@ function summarizeParentMessage(message) {
 		text: text.length > PARENT_TEXT_MAX_CHARS ? `${(0, openclaw_plugin_sdk_text_utility_runtime.truncateUtf16Safe)(text, 399)}…` : text
 	};
 }
-/**
-* Build the single-line `Replying to @sender: body` system event text.
-* Callers should pass this text to `enqueueSystemEvent` together with a
-* stable contextKey derived from the parent id.
-*/
 function formatParentContextEvent(summary) {
 	return `Replying to @${summary.sender}: ${summary.text}`;
 }
-/**
-* Decide whether a parent context event should be enqueued for the current
-* session. Returns `false` when we already injected the same parent for this
-* session recently (prevents re-prepending identical context on every reply
-* in the thread).
-*/
 function shouldInjectParentContext(sessionKey, parentId) {
-	const key = sessionKey;
-	return injectedParents.get(key) !== parentId;
+	return injectedParents.get(sessionKey) !== parentId;
 }
-/**
-* Record that `parentId` was just injected for `sessionKey` so subsequent
-* replies with the same parent can short-circuit via `shouldInjectParentContext`.
-*/
 function markParentContextInjected(sessionKey, parentId) {
 	touchLru(injectedParents, sessionKey, parentId, INJECTED_MAX);
 }
@@ -3097,7 +2880,7 @@ async function resolveMSTeamsThreadContext(params) {
 			isGroup: params.isChannel,
 			groupPolicy: params.groupPolicy,
 			allowFrom: params.effectiveGroupAllowFrom,
-			isSenderAllowed: (allowFrom) => require_channel.resolveMSTeamsAllowlistMatch({
+			isSenderAllowed: (allowFrom) => (0, openclaw_plugin_sdk_allow_from.resolveAllowlistMatchSimple)({
 				allowFrom,
 				senderId: message.from?.user?.id ?? "",
 				senderName: message.from?.user?.displayName,
@@ -3177,8 +2960,35 @@ function createMSTeamsMessageHandler(deps) {
 			log.debug?.("skipping message without from.id");
 			return;
 		}
+		let currentCfg = readConfig();
+		let isBotOwnedThread = false;
+		if (isChannel && facts.threadId && activity.recipient?.id) {
+			const channelConfig = currentCfg.channels?.msteams;
+			const routeConfig = require_channel.resolveMSTeamsRouteConfig({
+				cfg: channelConfig,
+				teamId,
+				teamName: activity.channelData?.team?.name,
+				conversationId,
+				channelName: activity.channelData?.channel?.name,
+				allowNameMatching: channelConfig?.dangerouslyAllowNameMatching === true
+			});
+			if (require_channel.resolveMSTeamsReplyPolicy({
+				isDirectMessage: false,
+				globalConfig: channelConfig,
+				...routeConfig
+			}).requireMentionInBotThreads !== void 0) {
+				isBotOwnedThread = await require_conversation_store_state.wasMSTeamsMessageSentWithPersistence({
+					conversationId,
+					messageId: facts.threadId,
+					botId: activity.recipient.id
+				});
+				currentCfg = readConfig();
+			}
+		}
+		const currentMSTeamsCfg = currentCfg.channels?.msteams;
+		if (currentMSTeamsCfg?.enabled === false || currentMSTeamsCfg?.appId && currentMSTeamsCfg.appId !== appId) return;
 		const admission = await admitMSTeamsMessage({
-			cfg,
+			cfg: currentCfg,
 			activity,
 			text,
 			conversationId,
@@ -3190,7 +3000,7 @@ function createMSTeamsMessageHandler(deps) {
 		});
 		if (!admission) return;
 		const { senderId, senderName, isDirectMessage, channelGate, allowNameMatching, groupPolicy, commandAuthorized, effectiveGroupAllowFrom, allowTextCommands, isControlCommand } = admission;
-		const pollVote = require_polls.extractMSTeamsPollVote(activity);
+		const pollVote = require_conversation_store_state.extractMSTeamsPollVote(activity);
 		if (pollVote) {
 			try {
 				if (!await pollStore.recordVote({
@@ -3212,7 +3022,7 @@ function createMSTeamsMessageHandler(deps) {
 			return;
 		}
 		const threadRouting = prepareMSTeamsThreadRouting({
-			cfg,
+			cfg: currentCfg,
 			context,
 			isDirectMessage,
 			isChannel,
@@ -3230,18 +3040,25 @@ function createMSTeamsMessageHandler(deps) {
 		});
 		const channelId = conversationId;
 		const { teamConfig, channelConfig } = channelGate;
-		const { requireMention, replyStyle } = require_channel.resolveMSTeamsReplyPolicy({
+		const replyPolicy = require_channel.resolveMSTeamsReplyPolicy({
 			isDirectMessage,
-			globalConfig: msteamsCfg,
+			globalConfig: currentMSTeamsCfg,
 			teamConfig,
 			channelConfig
 		});
+		const { requireMention, implicitMentionKinds } = resolveBotThreadMentionPolicy({
+			isBotOwnedThread,
+			requireMention: replyPolicy.requireMention,
+			requireMentionInBotThreads: replyPolicy.requireMentionInBotThreads,
+			implicitMentionKinds: params.implicitMentionKinds
+		});
+		const { replyStyle } = replyPolicy;
 		const timestamp = require_resolve_allowlist.parseMSTeamsActivityTimestamp(activity.timestamp);
 		const mentionDecision = (0, openclaw_plugin_sdk_channel_inbound.resolveInboundMentionDecision)({
 			facts: {
 				canDetectMention: true,
 				wasMentioned: params.wasMentioned,
-				implicitMentionKinds: params.implicitMentionKinds
+				implicitMentionKinds
 			},
 			policy: {
 				isGroup: !isDirectMessage,
@@ -3288,9 +3105,9 @@ function createMSTeamsMessageHandler(deps) {
 			resolveTeamAadGroupId: threadRouting.resolveTeamAadGroupId,
 			mediaMaxBytes,
 			tokenProvider,
-			mediaAllowHosts: msteamsCfg?.mediaAllowHosts,
-			mediaAuthAllowHosts: msteamsCfg?.mediaAuthAllowHosts,
-			graphMediaFallback: msteamsCfg?.graphMediaFallback,
+			mediaAllowHosts: currentMSTeamsCfg?.mediaAllowHosts,
+			mediaAuthAllowHosts: currentMSTeamsCfg?.mediaAuthAllowHosts,
+			graphMediaFallback: currentMSTeamsCfg?.graphMediaFallback,
 			deadline: preprocessingDeadline,
 			log
 		});
@@ -3311,7 +3128,7 @@ function createMSTeamsMessageHandler(deps) {
 			log
 		});
 		await dispatchMSTeamsInboundTurn({
-			cfg,
+			cfg: currentCfg,
 			runtime,
 			appId,
 			app,
@@ -3336,10 +3153,19 @@ function createMSTeamsMessageHandler(deps) {
 		debounceMs: resolveDebounceMs(),
 		resolveDebounceMs,
 		buildKey: (entry) => {
-			const conversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(entry.context.activity.conversation?.id ?? "");
+			const activity = entry.context.activity;
+			const rawConversationId = activity.conversation?.id ?? "";
+			const conversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(rawConversationId);
+			const threadId = activity.conversation?.conversationType === "channel" ? require_resolve_allowlist.extractMSTeamsConversationMessageId(rawConversationId) ?? activity.replyToId : void 0;
 			const senderId = entry.context.activity.from?.aadObjectId ?? entry.context.activity.from?.id ?? "";
 			if (!senderId || !conversationId) return null;
-			return `msteams:${appId}:${conversationId}:${senderId}`;
+			return JSON.stringify([
+				"msteams",
+				appId,
+				conversationId,
+				threadId ?? null,
+				senderId
+			]);
 		},
 		shouldDebounce: (entry) => {
 			if (!entry.text.trim()) return false;
@@ -3612,56 +3438,10 @@ async function isCardActionInvokeAuthorized(context, deps) {
 		includeInvokeName: true
 	});
 }
-function registerMSTeamsHandlers(handler, deps) {
+function createMSTeamsActivityHandler(deps) {
 	const handleTeamsMessage = createMSTeamsMessageHandler(deps);
 	const handleReaction = createMSTeamsReactionHandler(deps);
-	const originalRun = handler.run;
-	if (originalRun) handler.run = async (context, turnAdoptionLifecycle) => {
-		const ctx = context;
-		if (ctx.activity?.type === "invoke" && ctx.activity?.name === "adaptiveCard/action") {
-			if (await maybeHandleMSTeamsApprovalCardSubmit({
-				context: ctx,
-				deps
-			})) return;
-			const text = serializeMSTeamsAdaptiveCardActionValue(ctx.activity?.value);
-			if (text) return await handleTeamsMessage({
-				...ctx,
-				activity: {
-					...ctx.activity,
-					type: "message",
-					text
-				}
-			}, turnAdoptionLifecycle);
-			return;
-		}
-		return originalRun.call(handler, context, turnAdoptionLifecycle);
-	};
-	handler.onMessage(async (context, next, turnAdoptionLifecycle) => {
-		let nextRan = false;
-		const runNext = async () => {
-			nextRan = true;
-			await next();
-		};
-		try {
-			const ctx = context;
-			if (await maybeHandleMSTeamsApprovalCardSubmit({
-				context: ctx,
-				deps
-			})) {
-				await runNext();
-				return;
-			}
-			const result = await handleTeamsMessage(ctx, turnAdoptionLifecycle);
-			await runNext();
-			return result;
-		} catch (err) {
-			if (turnAdoptionLifecycle) throw err;
-			deps.runtime.error(`msteams handler failed: ${require_channel_setup.formatUnknownError(err)}`);
-		}
-		if (!nextRan) await runNext();
-	});
-	handler.onMembersAdded(async (context, next) => {
-		const ctx = context;
+	const handleMembersAdded = async (ctx) => {
 		const membersAdded = ctx.activity?.membersAdded ?? [];
 		const botId = ctx.activity?.recipient?.id;
 		const msteamsCfg = deps.cfg.channels?.msteams;
@@ -3673,13 +3453,7 @@ function registerMSTeamsHandlers(handler, deps) {
 					promptStarters: msteamsCfg?.promptStarters
 				});
 				try {
-					await ctx.sendActivity({
-						type: "message",
-						attachments: [{
-							contentType: "application/vnd.microsoft.card.adaptive",
-							content: card
-						}]
-					});
+					await ctx.sendActivity(require_conversation_store_state.buildMSTeamsAdaptiveCardActivity(card));
 					deps.log.info("sent welcome card");
 				} catch (err) {
 					deps.log.debug?.("failed to send welcome card", { error: require_channel_setup.formatUnknownError(err) });
@@ -3694,25 +3468,45 @@ function registerMSTeamsHandlers(handler, deps) {
 				}
 			} else deps.log.debug?.("skipping welcome (disabled by config or conversation type)");
 		} else deps.log.debug?.("member added", { member: member.id });
-		await next();
-	});
-	handler.onReactionsAdded(async (context, next) => {
-		try {
-			await handleReaction(context, "added");
-		} catch (err) {
-			deps.runtime.error(`msteams reaction handler failed: ${String(err)}`);
+	};
+	return async (context, turnAdoptionLifecycle) => {
+		const activity = context.activity;
+		if (activity?.type === "invoke" && activity.name === "adaptiveCard/action") {
+			if (await maybeHandleMSTeamsApprovalCardSubmit({
+				context,
+				deps
+			})) return;
+			const text = serializeMSTeamsAdaptiveCardActionValue(activity.value);
+			if (text) return handleTeamsMessage({
+				...context,
+				activity: {
+					...activity,
+					type: "message",
+					text
+				}
+			}, turnAdoptionLifecycle);
+			return;
 		}
-		await next();
-	});
-	handler.onReactionsRemoved(async (context, next) => {
-		try {
-			await handleReaction(context, "removed");
+		if (activity?.type === "message") try {
+			if (await maybeHandleMSTeamsApprovalCardSubmit({
+				context,
+				deps
+			})) return;
+			return await handleTeamsMessage(context, turnAdoptionLifecycle);
 		} catch (err) {
-			deps.runtime.error(`msteams reaction handler failed: ${String(err)}`);
+			if (turnAdoptionLifecycle) throw err;
+			deps.runtime.error(`msteams handler failed: ${require_channel_setup.formatUnknownError(err)}`);
 		}
-		await next();
-	});
-	return handler;
+		else if (activity?.type === "conversationUpdate") await handleMembersAdded(context);
+		else if (activity?.type === "messageReaction") for (const direction of ["added", "removed"]) {
+			if (!(direction === "added" ? activity.reactionsAdded : activity.reactionsRemoved)?.length) continue;
+			try {
+				await handleReaction(context, direction);
+			} catch (err) {
+				deps.runtime.error(`msteams reaction handler failed: ${String(err)}`);
+			}
+		}
+	};
 }
 //#endregion
 //#region extensions/msteams/src/feedback-invoke.ts
@@ -3839,14 +3633,14 @@ async function handleMSTeamsFileConsentInvoke(context, log) {
 	const expiredUploadMessage = "The file upload request has expired. Please try sending the file again.";
 	const activity = context.activity;
 	if (activity.type !== "invoke" || activity.name !== "fileConsent/invoke") return false;
-	const consentResponse = require_messenger.parseFileConsentInvoke(activity);
+	const consentResponse = require_conversation_store_state.parseFileConsentInvoke(activity);
 	if (!consentResponse) {
 		log.debug?.("invalid file consent invoke", { value: activity.value });
 		return false;
 	}
 	const uploadId = typeof consentResponse.context?.uploadId === "string" ? consentResponse.context.uploadId : void 0;
-	const inMemoryFile = require_messenger.getPendingUpload(uploadId);
-	const fsFile = inMemoryFile ? void 0 : await require_messenger.getPendingUploadFs(uploadId);
+	const inMemoryFile = require_conversation_store_state.getPendingUpload(uploadId);
+	const fsFile = inMemoryFile ? void 0 : await require_conversation_store_state.getPendingUploadFs(uploadId);
 	const pendingFile = inMemoryFile ?? fsFile;
 	if (pendingFile) {
 		const pendingConversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(pendingFile.conversationId);
@@ -3869,33 +3663,29 @@ async function handleMSTeamsFileConsentInvoke(context, log) {
 				size: pendingFile.buffer.length
 			});
 			try {
-				await require_messenger.uploadToConsentUrl({
+				await require_conversation_store_state.uploadToConsentUrl({
 					url: consentResponse.uploadInfo.uploadUrl,
 					buffer: pendingFile.buffer,
 					contentType: pendingFile.contentType
 				});
-				const fileInfoCard = require_messenger.buildFileInfoCard({
-					filename: consentResponse.uploadInfo.name,
-					contentUrl: consentResponse.uploadInfo.contentUrl,
-					uniqueId: consentResponse.uploadInfo.uniqueId,
-					fileType: consentResponse.uploadInfo.fileType
-				});
-				if (!pendingFile.consentCardActivityId) await context.sendActivity({
+				const fileActivity = {
 					type: "message",
-					attachments: [fileInfoCard]
-				});
+					attachments: [require_conversation_store_state.buildFileInfoCard({
+						filename: consentResponse.uploadInfo.name,
+						contentUrl: consentResponse.uploadInfo.contentUrl,
+						uniqueId: consentResponse.uploadInfo.uniqueId,
+						fileType: consentResponse.uploadInfo.fileType
+					})]
+				};
 				if (pendingFile.consentCardActivityId) try {
 					await context.updateActivity({
-						id: pendingFile.consentCardActivityId,
-						type: "message",
-						attachments: [fileInfoCard]
+						...fileActivity,
+						id: pendingFile.consentCardActivityId
 					});
 				} catch {
-					await context.sendActivity({
-						type: "message",
-						attachments: [fileInfoCard]
-					});
+					await context.sendActivity(fileActivity);
 				}
+				else await context.sendActivity(fileActivity);
 				log.info("file upload complete", {
 					uploadId,
 					filename: consentResponse.uploadInfo.name,
@@ -3908,8 +3698,8 @@ async function handleMSTeamsFileConsentInvoke(context, log) {
 				});
 				await context.sendActivity("File upload failed. Please try again.");
 			} finally {
-				require_messenger.removePendingUpload(uploadId);
-				await require_messenger.removePendingUploadFs(uploadId);
+				require_conversation_store_state.removePendingUpload(uploadId);
+				await require_conversation_store_state.removePendingUploadFs(uploadId);
 			}
 		} else {
 			log.debug?.("pending file not found for consent", { uploadId });
@@ -3917,8 +3707,8 @@ async function handleMSTeamsFileConsentInvoke(context, log) {
 		}
 	} else {
 		log.debug?.("user declined file consent", { uploadId });
-		require_messenger.removePendingUpload(uploadId);
-		await require_messenger.removePendingUploadFs(uploadId);
+		require_conversation_store_state.removePendingUpload(uploadId);
+		await require_conversation_store_state.removePendingUploadFs(uploadId);
 	}
 	return true;
 }
@@ -3929,7 +3719,7 @@ async function handleMSTeamsFileConsentInvoke(context, log) {
 */
 async function runMSTeamsFileConsentInvokeHandler(context, log) {
 	try {
-		await require_messenger.withRevokedProxyFallback({
+		await require_conversation_store_state.withRevokedProxyFallback({
 			run: async () => await handleMSTeamsFileConsentInvoke(context, log),
 			onRevoked: async () => true,
 			onRevokedLog: () => {
@@ -3948,13 +3738,6 @@ function publishMSTeamsBlocked(statusSink, lastError) {
 function publishMSTeamsReady(statusSink, now = Date.now()) {
 	statusSink?.((0, openclaw_plugin_sdk_gateway_runtime.channelReadyPatch)({ lastConnectedAt: now }));
 }
-function publishMSTeamsRecovering(statusSink, lastError) {
-	statusSink?.({
-		connected: false,
-		lifecycle: "recovering",
-		lastError
-	});
-}
 function publishMSTeamsStopped(statusSink) {
 	statusSink?.((0, openclaw_plugin_sdk_gateway_runtime.channelStoppedPatch)());
 }
@@ -4124,7 +3907,7 @@ function createMSTeamsReplayContext(activity, app, serviceUrlBoundary) {
 		...threadActivityId ? { threadActivityId } : {},
 		serviceUrlBoundary
 	};
-	const sendActivity = (outbound) => require_messenger.sendMSTeamsActivityWithReference(app, reference, outbound, proactiveOptions);
+	const sendActivity = (outbound) => require_conversation_store_state.sendMSTeamsActivityWithReference(app, reference, outbound, proactiveOptions);
 	return {
 		activity,
 		sendActivity,
@@ -4134,26 +3917,108 @@ function createMSTeamsReplayContext(activity, app, serviceUrlBoundary) {
 			return results;
 		},
 		updateActivity: async (outbound) => {
-			return await require_messenger.updateMSTeamsActivityWithReference(app, reference, typeof outbound.id === "string" ? outbound.id : "", outbound, proactiveOptions);
+			return await require_conversation_store_state.updateMSTeamsActivityWithReference(app, reference, typeof outbound.id === "string" ? outbound.id : "", outbound, proactiveOptions);
 		},
 		deleteActivity: async (activityId) => {
-			await require_messenger.deleteMSTeamsActivityWithReference(app, reference, activityId, proactiveOptions);
+			await require_conversation_store_state.deleteMSTeamsActivityWithReference(app, reference, activityId, proactiveOptions);
 		},
 		getTeamDetails: (teamId) => app.api.teams.getById(teamId)
 	};
 }
 //#endregion
-//#region extensions/msteams/src/webhook-timeouts.ts
-const MSTEAMS_WEBHOOK_INACTIVITY_TIMEOUT_MS = 3e4;
-const MSTEAMS_WEBHOOK_REQUEST_TIMEOUT_MS = 3e4;
-const MSTEAMS_WEBHOOK_HEADERS_TIMEOUT_MS = 15e3;
-function applyMSTeamsWebhookTimeouts(httpServer, opts) {
-	const inactivityTimeoutMs = opts?.inactivityTimeoutMs ?? MSTEAMS_WEBHOOK_INACTIVITY_TIMEOUT_MS;
-	const requestTimeoutMs = opts?.requestTimeoutMs ?? MSTEAMS_WEBHOOK_REQUEST_TIMEOUT_MS;
-	const headersTimeoutMs = Math.min(opts?.headersTimeoutMs ?? MSTEAMS_WEBHOOK_HEADERS_TIMEOUT_MS, requestTimeoutMs);
-	httpServer.setTimeout(inactivityTimeoutMs);
-	httpServer.requestTimeout = requestTimeoutMs;
-	httpServer.headersTimeout = headersTimeoutMs;
+//#region extensions/msteams/src/sso-token-store.ts
+/**
+* SQLite-backed store for Bot Framework OAuth SSO tokens.
+*
+* Tokens are keyed by (connectionName, userId). `userId` should be the
+* stable AAD object ID (`activity.from.aadObjectId`) when available,
+* falling back to the Bot Framework `activity.from.id`.
+*
+* The store is intentionally minimal: it persists the exchanged user
+* token plus its expiration so consumers (for example tool handlers
+* that call Microsoft Graph with delegated permissions) can fetch a
+* valid token without reaching back into Bot Framework every turn.
+*/
+const MSTEAMS_SSO_TOKENS_NAMESPACE = "sso-tokens";
+const SSO_TOKEN_MUTATION_KEY = "sso-tokens";
+const MSTEAMS_MAX_SSO_TOKENS = 5e3;
+const STORE_KEY_VERSION_PREFIX = "v2:";
+function makeMSTeamsSsoTokenStoreKey(connectionName, userId) {
+	return `${STORE_KEY_VERSION_PREFIX}${(0, node_crypto.createHash)("sha256").update(JSON.stringify([connectionName, userId])).digest("hex")}`;
+}
+function createTokenStore(params) {
+	return require_runtime.getMSTeamsRuntime().state.openKeyedStore({
+		namespace: MSTEAMS_SSO_TOKENS_NAMESPACE,
+		maxEntries: MSTEAMS_MAX_SSO_TOKENS,
+		env: require_conversation_store_state.resolveMSTeamsSqliteStateEnv(params)
+	});
+}
+function createMSTeamsSsoTokenStoreFs(params) {
+	const tokenStore = createTokenStore(params);
+	return {
+		async get({ connectionName, userId }) {
+			return await tokenStore.lookup(makeMSTeamsSsoTokenStoreKey(connectionName, userId)) ?? null;
+		},
+		async save(token) {
+			await require_conversation_store_state.withMSTeamsSqliteMutationLock(params, SSO_TOKEN_MUTATION_KEY, async () => {
+				await tokenStore.register(makeMSTeamsSsoTokenStoreKey(token.connectionName, token.userId), require_conversation_store_state.toPluginJsonValue({ ...token }));
+			});
+		},
+		async remove({ connectionName, userId }) {
+			let removed = false;
+			await require_conversation_store_state.withMSTeamsSqliteMutationLock(params, SSO_TOKEN_MUTATION_KEY, async () => {
+				removed = await tokenStore.delete(makeMSTeamsSsoTokenStoreKey(connectionName, userId));
+			});
+			return removed;
+		}
+	};
+}
+//#endregion
+//#region extensions/msteams/src/webhook-handler.ts
+/** Keep Express response ownership until the channel's route can be released. */
+function createMSTeamsWebhookHandler(expressApp, warn) {
+	const responses = /* @__PURE__ */ new Map();
+	let closing = false;
+	let closeTask;
+	return {
+		handler: ((req, res) => {
+			if (closing) {
+				res.writeHead(503, { "Retry-After": "1" });
+				res.end("Service Unavailable");
+				return Promise.resolve();
+			}
+			const response = (0, openclaw_plugin_sdk_extension_shared.createDeferred)();
+			responses.set(res, response.promise);
+			const done = () => {
+				res.off("finish", done);
+				res.off("close", done);
+				responses.delete(res);
+				response.resolve();
+			};
+			res.once("finish", done);
+			res.once("close", done);
+			try {
+				expressApp(req, res);
+			} catch (error) {
+				done();
+				throw error;
+			}
+			return response.promise;
+		}),
+		close: () => {
+			closing = true;
+			closeTask ??= (async () => {
+				if (responses.size === 0) return;
+				try {
+					await (0, openclaw_plugin_sdk_time_runtime.withTimeout)(Promise.all(responses.values()), require_resolve_allowlist.MSTEAMS_REQUEST_TIMEOUT_MS, "Microsoft Teams webhook shutdown");
+				} catch {
+					warn("Microsoft Teams webhook shutdown exceeded 30 seconds; closing active responses");
+					for (const response of responses.keys()) response.destroy();
+				}
+			})();
+			return closeTask;
+		}
+	};
 }
 //#endregion
 //#region extensions/msteams/src/monitor.ts
@@ -4267,20 +4132,26 @@ async function monitorMSTeamsProvider(opts) {
 			msteams: msteamsCfg
 		}
 	};
-	const port = msteamsCfg.webhook?.port ?? 3978;
+	const legacyListener = require_channel.resolveMSTeamsLegacyWebhook(msteamsCfg);
+	const pathIssue = require_channel.resolveMSTeamsWebhookPathIssue({ cfg });
+	if (pathIssue) {
+		if (!legacyListener) throw new Error(pathIssue);
+		log.warn?.(pathIssue);
+	}
 	const textLimit = core.channel.text.resolveTextChunkLimit(cfg, "msteams");
 	const mediaMaxBytes = (0, openclaw_plugin_sdk_account_helpers.resolveChannelMediaMaxBytes)({
 		cfg,
 		resolveChannelLimitMb: ({ cfg: channelCfg }) => channelCfg.channels?.msteams?.mediaMaxMb
 	}) ?? 8388608;
-	const conversationStore = opts.conversationStore ?? require_polls.createMSTeamsConversationStoreState();
-	const pollStore = opts.pollStore ?? require_polls.createMSTeamsPollStoreState();
-	log.info(`starting provider (port ${port})`);
+	const conversationStore = opts.conversationStore ?? require_conversation_store_state.createMSTeamsConversationStoreState();
+	const pollStore = opts.pollStore ?? require_conversation_store_state.createMSTeamsPollStoreState();
+	log.info("starting provider on Gateway HTTP routes");
 	const express = await import("express");
 	const expressApp = express.default();
+	const privateQaToken = await require_resolve_allowlist.resolveMSTeamsPrivateQaRuntime()?.token();
 	expressApp.use((req, res, next) => {
 		const auth = req.headers.authorization;
-		if (!auth || !auth.startsWith("Bearer ")) {
+		if (!auth || !auth.startsWith("Bearer ") || privateQaToken && !(0, openclaw_plugin_sdk_security_runtime.safeEqualSecret)(auth.slice(7), privateQaToken)) {
 			res.status(401).json({ error: "Unauthorized" });
 			return;
 		}
@@ -4294,7 +4165,7 @@ async function monitorMSTeamsProvider(opts) {
 		}
 		next(err);
 	});
-	const configuredPath = msteamsCfg.webhook?.path ?? "/api/messages";
+	const configuredPath = msteamsCfg.webhook?.path || "/api/messages";
 	const ssoConnectionName = msteamsCfg.sso?.enabled && msteamsCfg.sso.connectionName ? msteamsCfg.sso.connectionName : void 0;
 	const { app } = await require_resolve_allowlist.loadMSTeamsSdkWithAuth(creds, {
 		...require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(msteamsCfg),
@@ -4315,11 +4186,10 @@ async function monitorMSTeamsProvider(opts) {
 	}
 	const tokenProvider = require_resolve_allowlist.createMSTeamsTokenProvider(app);
 	const ssoDeps = ssoConnectionName ? {
-		tokenStore: require_sso_token_store.createMSTeamsSsoTokenStoreFs(),
+		tokenStore: createMSTeamsSsoTokenStoreFs(),
 		connectionName: ssoConnectionName
 	} : void 0;
 	if (ssoDeps) log.debug?.("msteams sso enabled", { connectionName: ssoDeps.connectionName });
-	const handler = buildActivityHandler();
 	const handlerDeps = {
 		cfg,
 		runtime,
@@ -4332,37 +4202,29 @@ async function monitorMSTeamsProvider(opts) {
 		pollStore,
 		log
 	};
-	registerMSTeamsHandlers(handler, handlerDeps);
+	const handleActivity = createMSTeamsActivityHandler(handlerDeps);
 	const ingress = createMSTeamsIngress({
 		accountId: appId,
 		runtime,
 		dispatch: async (activity, lifecycle, liveContext) => {
 			if (liveContext) liveContext.activity = activity;
 			const context = liveContext ?? createMSTeamsReplayContext(activity, app, require_resolve_allowlist.resolveMSTeamsSdkCloudOptions(msteamsCfg));
-			return await handler.run(context, lifecycle);
+			return await handleActivity(context, lifecycle);
 		}
 	});
 	app.on("card.action", async (ctx) => {
 		const adaptedCtx = adaptSdkContext(ctx, app);
 		try {
 			const activity = adaptedCtx.activity;
-			const vote = require_polls.extractMSTeamsPollVote(activity);
+			const vote = require_conversation_store_state.extractMSTeamsPollVote(activity);
 			if (vote) {
 				const voterId = activity?.from?.aadObjectId ?? activity?.from?.id ?? "unknown";
 				try {
-					if (!await isCardActionInvokeAuthorized(adaptedCtx, handlerDeps)) return {
-						statusCode: 200,
-						type: "application/vnd.microsoft.activity.message",
-						value: "Not authorized."
-					};
+					if (!await isCardActionInvokeAuthorized(adaptedCtx, handlerDeps)) return cardActionMessage("Not authorized.");
 					const existingPoll = await pollStore.getPoll(vote.pollId);
 					if (!existingPoll) {
 						log.debug?.("poll vote ignored (poll not found)", { pollId: vote.pollId });
-						return {
-							statusCode: 200,
-							type: "application/vnd.microsoft.activity.message",
-							value: "Poll not found."
-						};
+						return cardActionMessage("Poll not found.");
 					}
 					const pollConversationId = existingPoll.conversationId ? require_resolve_allowlist.normalizeMSTeamsConversationId(existingPoll.conversationId) : void 0;
 					const activityConversationId = require_resolve_allowlist.normalizeMSTeamsConversationId(activity?.conversation?.id ?? "");
@@ -4372,11 +4234,7 @@ async function monitorMSTeamsProvider(opts) {
 							expectedConversationId: pollConversationId,
 							receivedConversationId: activityConversationId || void 0
 						});
-						return {
-							statusCode: 200,
-							type: "application/vnd.microsoft.activity.message",
-							value: "Poll not found."
-						};
+						return cardActionMessage("Poll not found.");
 					}
 					if (await pollStore.recordVote({
 						pollId: vote.pollId,
@@ -4387,18 +4245,10 @@ async function monitorMSTeamsProvider(opts) {
 							pollId: vote.pollId,
 							voterId
 						});
-						return {
-							statusCode: 200,
-							type: "application/vnd.microsoft.activity.message",
-							value: "Vote recorded."
-						};
+						return cardActionMessage("Vote recorded.");
 					}
 					log.debug?.("poll vote ignored (poll not found)", { pollId: vote.pollId });
-					return {
-						statusCode: 200,
-						type: "application/vnd.microsoft.activity.message",
-						value: "Poll not found."
-					};
+					return cardActionMessage("Poll not found.");
 				} catch (err) {
 					log.error("failed to record poll vote", {
 						pollId: vote.pollId,
@@ -4419,11 +4269,7 @@ async function monitorMSTeamsProvider(opts) {
 				}
 			}
 			await ingress.accept(activity, adaptedCtx);
-			return {
-				statusCode: 200,
-				type: "application/vnd.microsoft.activity.message",
-				value: "OK"
-			};
+			return cardActionMessage("OK");
 		} catch (err) {
 			log.error("msteams card.action failed", { error: require_channel_setup.formatUnknownError(err) });
 			return {
@@ -4446,26 +4292,27 @@ async function monitorMSTeamsProvider(opts) {
 	app.on("file.consent.decline", (ctx) => {
 		runMSTeamsFileConsentInvokeHandler(adaptSdkContext(ctx, app), log);
 	});
-	const handleSdkSigninInvoke = async (ctx, delegateName) => {
-		const adaptedCtx = adaptSdkContext(ctx, app);
-		if (!await isSigninInvokeAuthorized(adaptedCtx, handlerDeps)) return {
+	const processActivity = app.process.bind(app);
+	app.process = async (event) => {
+		const activity = event.body;
+		if (activity.type !== "invoke" || !("name" in activity) || activity.name !== "signin/tokenExchange" && activity.name !== "signin/verifyState") return processActivity(event);
+		if (!await isSigninInvokeAuthorized({ activity: {
+			...activity,
+			type: activity.type,
+			name: activity.name
+		} }, handlerDeps)) return {
 			status: 200,
 			body: {}
 		};
 		if (!ssoDeps) {
-			log.debug?.("signin invoke received but msteams.sso is not configured", { name: adaptedCtx.activity?.name });
+			log.debug?.("signin invoke received but msteams.sso is not configured", { name: activity.name });
 			return {
 				status: 200,
 				body: {}
 			};
 		}
-		const sdkSigninApp = app;
-		const delegate = sdkSigninApp[delegateName];
-		if (typeof delegate !== "function") throw new Error(`Teams SDK ${delegateName} handler is unavailable`);
-		return delegate.call(sdkSigninApp, ctx);
+		return processActivity(event);
 	};
-	app.on("signin.token-exchange", (ctx) => handleSdkSigninInvoke(ctx, "onTokenExchange"));
-	app.on("signin.verify-state", (ctx) => handleSdkSigninInvoke(ctx, "onVerifyState"));
 	if (ssoDeps) app.event("signin", (ctx) => {
 		(async () => {
 			if (!await isSigninInvokeAuthorized(adaptSdkContext(ctx, app), handlerDeps)) return;
@@ -4512,93 +4359,76 @@ async function monitorMSTeamsProvider(opts) {
 			return;
 		}
 		try {
-			await handler.run(adaptedCtx);
+			await handleActivity(adaptedCtx);
 		} catch (err) {
 			log.error("msteams non-turn activity failed", { error: require_channel_setup.formatUnknownError(err) });
 		}
 	});
 	await app.initialize();
 	ingress.start();
-	const privateQaRuntime = require_resolve_allowlist.resolveMSTeamsPrivateQaRuntime();
-	const httpServer = await new Promise((resolve, reject) => {
-		const onListen = (err) => err ? reject(err) : resolve(server);
-		const server = privateQaRuntime ? expressApp.listen(port, privateQaRuntime.listenHost, onListen) : expressApp.listen(port, onListen);
-	}).catch(async (err) => {
-		log.error("msteams server error", { error: require_channel_setup.formatUnknownError(err) });
+	const unregisterRoutes = [];
+	const webhook = createMSTeamsWebhookHandler(expressApp, (message) => log.warn?.(message));
+	try {
+		unregisterRoutes.push((0, openclaw_plugin_sdk_webhook_targets.registerPluginHttpRoute)({
+			path: configuredPath,
+			auth: "plugin",
+			pluginId: "msteams",
+			source: "msteams-webhook",
+			accountId: appId,
+			handler: webhook.handler,
+			legacyListener: legacyListener ? {
+				...legacyListener,
+				timeouts: {
+					headers: 15e3,
+					request: 3e4,
+					socket: 3e4
+				}
+			} : void 0,
+			throwOnFailure: true,
+			log: (message) => log.warn?.(message)
+		}));
+		if (configuredPath !== "/api/messages") unregisterRoutes.push((0, openclaw_plugin_sdk_webhook_targets.registerPluginHttpRoute)({
+			path: "/api/messages",
+			auth: "plugin",
+			pluginId: "msteams",
+			source: "msteams-webhook-alias",
+			accountId: appId,
+			handler: webhook.handler,
+			log: (message) => log.warn?.(message)
+		}));
+	} catch (error) {
+		for (const unregister of unregisterRoutes) unregister();
 		await ingress.stop();
-		throw err;
-	});
-	log.info(`msteams provider started on port ${port}`);
+		throw error;
+	}
+	log.info(`msteams provider started on Gateway route ${configuredPath}`);
 	publishMSTeamsReady(opts.statusSink);
-	applyMSTeamsWebhookTimeouts(httpServer);
-	httpServer.on("error", (err) => {
-		log.error("msteams server error", { error: require_channel_setup.formatUnknownError(err) });
-		publishMSTeamsRecovering(opts.statusSink, require_channel_setup.formatUnknownError(err));
-	});
-	const shutdown = async () => {
-		log.info("shutting down msteams provider");
-		await new Promise((resolve) => {
-			httpServer.close((err) => {
-				if (err) log.debug?.("msteams server close error", { error: require_channel_setup.formatUnknownError(err) });
-				resolve();
-			});
-		});
-		await ingress.stop();
-		publishMSTeamsStopped(opts.statusSink);
+	let shutdownTask;
+	const shutdown = () => {
+		shutdownTask ??= (async () => {
+			await webhook.close();
+			for (const unregister of unregisterRoutes.splice(0)) unregister();
+			await ingress.stop();
+			publishMSTeamsStopped(opts.statusSink);
+		})();
+		return shutdownTask;
 	};
-	await (0, openclaw_plugin_sdk_channel_outbound.keepHttpServerTaskAlive)({
-		server: httpServer,
-		abortSignal: opts.abortSignal,
-		onAbort: shutdown
-	});
+	try {
+		await (0, openclaw_plugin_sdk_channel_outbound.waitUntilAbort)(opts.abortSignal, shutdown);
+	} finally {
+		await shutdown();
+	}
 	return {
 		app: expressApp,
 		shutdown
 	};
 }
-/**
-* Build a minimal ActivityHandler-compatible object that supports
-* onMessage / onMembersAdded registration and a run() method.
-*/
-function buildActivityHandler() {
-	const messageHandlers = [];
-	const membersAddedHandlers = [];
-	const reactionsAddedHandlers = [];
-	const reactionsRemovedHandlers = [];
-	const handler = {
-		onMessage(cb) {
-			messageHandlers.push(cb);
-			return handler;
-		},
-		onMembersAdded(cb) {
-			membersAddedHandlers.push(cb);
-			return handler;
-		},
-		onReactionsAdded(cb) {
-			reactionsAddedHandlers.push(cb);
-			return handler;
-		},
-		onReactionsRemoved(cb) {
-			reactionsRemovedHandlers.push(cb);
-			return handler;
-		},
-		async run(context, turnAdoptionLifecycle) {
-			const ctx = context;
-			const activityType = ctx?.activity?.type;
-			const noop = async () => {};
-			if (activityType === "message") for (const h of messageHandlers) {
-				const result = await h(context, noop, turnAdoptionLifecycle);
-				if (result) return result;
-			}
-			else if (activityType === "conversationUpdate") for (const h of membersAddedHandlers) await h(context, noop);
-			else if (activityType === "messageReaction") {
-				const activity = ctx?.activity;
-				if (activity?.reactionsAdded?.length) for (const h of reactionsAddedHandlers) await h(context, noop);
-				if (activity?.reactionsRemoved?.length) for (const h of reactionsRemovedHandlers) await h(context, noop);
-			}
-		}
+function cardActionMessage(value) {
+	return {
+		statusCode: 200,
+		type: "application/vnd.microsoft.activity.message",
+		value
 	};
-	return handler;
 }
 /**
 * Adapt a new @microsoft/teams.apps SDK context to the MSTeamsTurnContext interface