@ouro.bot/cli 0.0.1-alpha.0 → 0.1.0-alpha.2

package/dist/senses/teams.js

@@ -0,0 +1,696 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_FLUSH_INTERVAL_MS = void 0;
+exports.stripMentions = stripMentions;
+exports.splitMessage = splitMessage;
+exports.createTeamsCallbacks = createTeamsCallbacks;
+exports.resolvePendingConfirmation = resolvePendingConfirmation;
+exports.withConversationLock = withConversationLock;
+exports.handleTeamsMessage = handleTeamsMessage;
+exports.startTeamsApp = startTeamsApp;
+const teams_apps_1 = require("@microsoft/teams.apps");
+const teams_dev_1 = require("@microsoft/teams.dev");
+const core_1 = require("../heart/core");
+const config_1 = require("../heart/config");
+const prompt_1 = require("../mind/prompt");
+const phrases_1 = require("../mind/phrases");
+const format_1 = require("../mind/format");
+const config_2 = require("../heart/config");
+const context_1 = require("../mind/context");
+const commands_1 = require("./commands");
+const nerves_1 = require("../nerves");
+const runtime_1 = require("../nerves/runtime");
+const store_file_1 = require("../mind/friends/store-file");
+const resolver_1 = require("../mind/friends/resolver");
+const tokens_1 = require("../mind/friends/tokens");
+const turn_coordinator_1 = require("../heart/turn-coordinator");
+const identity_1 = require("../heart/identity");
+const path = __importStar(require("path"));
+const trust_gate_1 = require("./trust-gate");
+// Strip @mention markup from incoming messages.
+// Removes <at>...</at> tags and trims extra whitespace.
+// Fallback safety net -- the SDK's activity.mentions.stripText should handle
+// this automatically, but this utility is exported for testability.
+function stripMentions(text) {
+    if (!text)
+        return "";
+    return text.replace(/<at>[^<]*<\/at>/g, "").trim();
+}
+// Recovery chunk size for error-recovery splitting. When a full-text send fails
+// (e.g. 413 from Teams), we split into chunks of this size and retry.
+// Not used preemptively — the harness tries to send the full message first.
+const RECOVERY_CHUNK_SIZE = 4000;
+// Default interval (ms) for the periodic flush timer in chunked streaming mode.
+// Text is accumulated in textBuffer and flushed via safeEmit/safeSend at this
+// interval. This replaces per-token streaming, which caused compounding latency:
+//
+// - Teams throttles streaming updates to 1 req/sec with exponential backoff
+//   https://learn.microsoft.com/en-us/microsoftteams/platform/bots/streaming-ux
+// - SDK debounces at 500ms internally and re-sends ALL cumulative text each chunk
+// - Per-token streaming generates 100+ HTTP POSTs per response, each throttled
+// - Copilot enforces a 15s timeout for the initial stream.emit()
+//   https://learn.microsoft.com/en-us/answers/questions/2288017/m365-custom-engine-agents-timeout-message-after-15
+//
+// At 1000ms (1 req/sec), we stay at the Teams throttle floor while keeping the
+// stream alive well within the 15s Copilot timeout. Tune up if 429s observed.
+exports.DEFAULT_FLUSH_INTERVAL_MS = 1_000;
+// Split text into chunks that fit within maxLen, breaking at paragraph
+// boundaries (\n\n), then line boundaries (\n), then word boundaries.
+// Never loses content — all text is preserved across chunks.
+function splitMessage(text, maxLen) {
+    if (text.length <= maxLen)
+        return [text];
+    const chunks = [];
+    let remaining = text;
+    while (remaining.length > 0) {
+        if (remaining.length <= maxLen) {
+            chunks.push(remaining);
+            break;
+        }
+        // Find best split point: paragraph > line > word > hard cut
+        const slice = remaining.slice(0, maxLen);
+        let splitAt = slice.lastIndexOf("\n\n");
+        if (splitAt <= 0)
+            splitAt = slice.lastIndexOf("\n");
+        if (splitAt <= 0)
+            splitAt = slice.lastIndexOf(" ");
+        if (splitAt <= 0)
+            splitAt = maxLen; // hard cut as last resort
+        chunks.push(remaining.slice(0, splitAt));
+        remaining = remaining.slice(splitAt).replace(/^[\n ]+/, ""); // trim leading whitespace from next chunk
+    }
+    return chunks;
+}
+// Create Teams-specific callbacks for the agent loop.
+// The SDK handles cumulative text, debouncing (500ms), and the streaming
+// protocol (streamSequence, streamId, informative/streaming/final types).
+//
+// Chunked streaming (unified mode):
+// Text is always accumulated in textBuffer and flushed periodically (via a
+// flush timer started on first onTextChunk) or at end-of-turn via flush().
+// First flush goes to safeEmit (primary output), subsequent flushes go to
+// safeSend (ctx.send). Tool results, kicks, and errors use safeUpdate
+// (transient status) or safeSend (terminal errors). Reasoning is accumulated
+// and periodically pushed via safeUpdate on the same flush timer tick.
+function createTeamsCallbacks(stream, controller, sendMessage, options) {
+    let stopped = false; // set when stream signals cancellation (403)
+    let hadToolRun = false;
+    let hadRealOutput = false; // true once reasoning/tool output shown; suppresses phrases
+    let reasoningBuf = ""; // accumulated reasoning text for status display
+    let textBuffer = ""; // accumulated text output for chunked streaming
+    let streamHasContent = false; // tracks whether primary output has received content
+    let phraseTimer = null;
+    let lastPhrase = "";
+    let flushTimer = null;
+    const flushInterval = options?.flushIntervalMs ?? exports.DEFAULT_FLUSH_INTERVAL_MS;
+    // Track whether reasoning has changed since last flush (avoid redundant updates).
+    let lastFlushedReasoningLen = 0;
+    // Periodic tick: flush text buffer and push reasoning updates.
+    function flushTick() {
+        flushTextBuffer();
+        if (reasoningBuf.length > lastFlushedReasoningLen) {
+            safeUpdate(reasoningBuf);
+            lastFlushedReasoningLen = reasoningBuf.length;
+        }
+    }
+    // Start the periodic flush timer. Idempotent -- no-op if already running.
+    function startFlushTimer() {
+        if (flushTimer)
+            return;
+        flushTimer = setInterval(flushTick, flushInterval);
+    }
+    // Stop the periodic flush timer. Idempotent.
+    function stopFlushTimer() {
+        if (flushTimer) {
+            clearInterval(flushTimer);
+            flushTimer = null;
+        }
+    }
+    // Mark stream as broken and abort the agent loop.
+    function markStopped() {
+        if (stopped)
+            return;
+        stopped = true;
+        stopPhraseRotation();
+        stopFlushTimer();
+        controller.abort();
+    }
+    // Clean up timers when the controller is aborted externally
+    controller.signal.addEventListener("abort", () => {
+        stopPhraseRotation();
+        stopFlushTimer();
+    });
+    // Handle the result of a stream call: if it returns a Promise (the Teams SDK
+    // does async HTTP under the hood even though the interface types it as void),
+    // catch its rejection so we detect a dead stream and abort the agent loop.
+    function catchAsync(result) {
+        if (result && typeof result.catch === "function") {
+            result.catch(() => markStopped());
+        }
+    }
+    // Safely emit a text delta to the stream.
+    // On error (e.g. 403 from Teams stop button), abort the controller.
+    function safeEmit(text) {
+        /* v8 ignore next -- defensive guard: stopped set by prior 403; tested via flush abort path @preserve */
+        if (stopped)
+            return;
+        try {
+            catchAsync(stream.emit(text));
+            streamHasContent = true;
+        }
+        catch {
+            markStopped();
+        }
+    }
+    // Awaitable emit — returns true if the emit succeeded, false if it failed.
+    // Used by flush() so it can fall back to sendMessage on async 413/failure.
+    async function tryEmit(text) {
+        /* v8 ignore next -- defensive guard: stopped set by prior error; tested via flush abort path @preserve */
+        if (stopped)
+            return false;
+        try {
+            // stream.emit() is typed as void but the Teams SDK returns a Promise
+            // internally (async HTTP). Cast to capture the result for awaiting.
+            const result = stream.emit(text);
+            streamHasContent = true;
+            if (result && typeof result.then === "function") {
+                await result;
+            }
+            return true;
+        }
+        catch {
+            markStopped();
+            return false;
+        }
+    }
+    // Safely send a status update to the stream.
+    // On error (e.g. 403 from Teams stop button), abort the controller.
+    function safeUpdate(text) {
+        if (stopped)
+            return;
+        try {
+            catchAsync(stream.update(text));
+        }
+        catch {
+            markStopped();
+        }
+    }
+    // Safely send a separate message via sendMessage (for content after first emit).
+    // Serialized via promise chain -- concurrent calls execute sequentially.
+    // If any send fails, the chain halts via markStopped().
+    let sendChain = Promise.resolve();
+    let sendChainBusy = false;
+    function safeSend(text) {
+        if (stopped || !sendMessage)
+            return;
+        if (!sendChainBusy) {
+            // Chain is idle -- start the send synchronously and mark busy
+            sendChainBusy = true;
+            try {
+                sendChain = sendMessage(text).catch(() => markStopped()).finally(() => { sendChainBusy = false; });
+            }
+            catch {
+                sendChainBusy = false;
+                markStopped();
+            }
+        }
+        else {
+            // Chain is busy -- queue onto the existing chain
+            sendChain = sendChain.then(() => {
+                if (stopped)
+                    return;
+                return sendMessage(text);
+            }).catch(() => markStopped());
+        }
+    }
+    // Flush accumulated text buffer via safeEmit. The Teams SDK accumulates
+    // emitted text into a single streaming message (cumulative), so every
+    // periodic flush appends to the same response — not separate messages.
+    // No preemptive splitting — sends full text. Error recovery happens in flush().
+    function flushTextBuffer() {
+        if (!textBuffer)
+            return;
+        safeEmit(textBuffer);
+        textBuffer = "";
+    }
+    function startPhraseRotation(pool) {
+        stopPhraseRotation();
+        phraseTimer = setInterval(() => {
+            const next = (0, phrases_1.pickPhrase)(pool, lastPhrase);
+            lastPhrase = next;
+            safeUpdate(next + "...");
+        }, 1500);
+    }
+    function stopPhraseRotation() {
+        if (phraseTimer) {
+            clearInterval(phraseTimer);
+            phraseTimer = null;
+        }
+    }
+    return {
+        onModelStart: () => {
+            if (hadRealOutput)
+                return; // real output already shown; don't overwrite with phrases
+            const phrases = (0, phrases_1.getPhrases)();
+            const pool = hadToolRun ? phrases.followup : phrases.thinking;
+            const first = (0, phrases_1.pickPhrase)(pool);
+            lastPhrase = first;
+            safeUpdate(first + "...");
+            startPhraseRotation(pool);
+        },
+        onModelStreamStart: () => {
+            // No-op: don't stop rotation here — keep cycling phrases through
+            // the reasoning phase until actual content arrives.
+        },
+        onReasoningChunk: (text) => {
+            /* v8 ignore next -- defensive guard: stopped set by prior error @preserve */
+            if (stopped)
+                return;
+            stopPhraseRotation();
+            hadRealOutput = true;
+            reasoningBuf += text;
+            startFlushTimer();
+        },
+        onTextChunk: (text) => {
+            if (stopped)
+                return;
+            stopPhraseRotation();
+            textBuffer += text;
+            startFlushTimer();
+        },
+        onClearText: () => {
+            textBuffer = "";
+        },
+        onToolStart: (name, args) => {
+            stopPhraseRotation();
+            flushTextBuffer();
+            const argSummary = Object.values(args).join(", ");
+            safeUpdate(`running ${name} (${argSummary})...`);
+            hadToolRun = true;
+        },
+        onToolEnd: (name, summary, success) => {
+            stopPhraseRotation();
+            const msg = (0, format_1.formatToolResult)(name, summary, success);
+            safeUpdate(msg);
+        },
+        onKick: () => {
+            stopPhraseRotation();
+            const msg = (0, format_1.formatKick)();
+            safeUpdate(msg);
+        },
+        onError: (error, severity) => {
+            stopPhraseRotation();
+            if (stopped)
+                return;
+            const msg = (0, format_1.formatError)(error);
+            if (severity === "transient") {
+                safeUpdate(msg);
+            }
+            else {
+                safeSend(msg);
+            }
+        },
+        onConfirmAction: options?.conversationId
+            ? async (name, args) => {
+                const convId = options.conversationId;
+                const argsDesc = Object.entries(args).map(([k, v]) => `${k}: ${v}`).join(", ");
+                safeUpdate(`Confirm action: ${name} (${argsDesc}) -- reply "yes" to confirm or "no" to cancel`);
+                return new Promise((resolve) => {
+                    _pendingConfirmations.set(convId, resolve);
+                    // Auto-deny after 2 minutes to prevent indefinite blocking
+                    // (e.g. when the stream dies and the user never sees the prompt).
+                    setTimeout(() => {
+                        if (_pendingConfirmations.has(convId)) {
+                            _pendingConfirmations.delete(convId);
+                            resolve("denied");
+                        }
+                    }, 120_000);
+                });
+            }
+            : undefined,
+        flush: async () => {
+            stopFlushTimer();
+            if (textBuffer) {
+                const text = textBuffer;
+                textBuffer = "";
+                if (!stopped) {
+                    // Stream is alive — await the emit so we can catch async 413/failure
+                    // and fall through to sendMessage recovery.
+                    const ok = await tryEmit(text);
+                    if (!ok)
+                        markStopped();
+                }
+                if (stopped && sendMessage) {
+                    // Stream is dead — fall back to sendMessage; split on failure as recovery.
+                    try {
+                        await sendMessage(text);
+                    }
+                    catch {
+                        const chunks = splitMessage(text, RECOVERY_CHUNK_SIZE);
+                        for (const chunk of chunks)
+                            await sendMessage(chunk);
+                    }
+                }
+            }
+            else if (!streamHasContent) {
+                safeEmit("(completed with tool calls only \u2014 no text response)");
+            }
+        },
+    };
+}
+// Per-conversation pending confirmation resolvers.
+// When a mutate tool needs confirmation, the resolver is stored here.
+// The next message from the same conversation resolves it.
+const _pendingConfirmations = new Map();
+// Confirmation response words (case-insensitive)
+const CONFIRM_WORDS = new Set(["yes", "confirm", "go", "y", "ok", "approve", "proceed"]);
+function resolvePendingConfirmation(convId, text) {
+    const resolver = _pendingConfirmations.get(convId);
+    if (!resolver)
+        return false;
+    _pendingConfirmations.delete(convId);
+    const word = text.trim().toLowerCase();
+    if (CONFIRM_WORDS.has(word)) {
+        resolver("confirmed");
+    }
+    else {
+        resolver("denied");
+    }
+    return true;
+}
+const _turnCoordinator = (0, turn_coordinator_1.createTurnCoordinator)();
+function teamsTurnKey(conversationId) {
+    return `teams:${conversationId}`;
+}
+async function withConversationLock(convId, fn) {
+    await _turnCoordinator.withTurnLock(teamsTurnKey(convId), fn);
+}
+// Create a fresh friend store per request so mkdirSync re-runs if directories
+// are deleted while the process is alive.
+function getFriendStore() {
+    const friendsPath = path.join((0, identity_1.getAgentRoot)(), "friends");
+    return new store_file_1.FileFriendStore(friendsPath);
+}
+// Handle an incoming Teams message
+async function handleTeamsMessage(text, stream, conversationId, teamsContext, sendMessage) {
+    const turnKey = teamsTurnKey(conversationId);
+    // NOTE: Confirmation resolution is handled in the app.on("message") handler
+    // BEFORE the conversation lock.  By the time we get here, any pending
+    // confirmation has already been resolved and the reply consumed.
+    // Send first thinking phrase immediately so the user sees feedback
+    // before sync I/O (session load, trim) blocks the event loop.
+    stream.update((0, phrases_1.pickPhrase)((0, phrases_1.getPhrases)().thinking) + "...");
+    await new Promise(r => setImmediate(r));
+    // Resolve context kernel (identity + channel) early so we can use the friend UUID for session path
+    const store = getFriendStore();
+    const provider = teamsContext?.aadObjectId ? "aad" : "teams-conversation";
+    const externalId = teamsContext?.aadObjectId || conversationId;
+    const toolContext = teamsContext ? {
+        graphToken: teamsContext.graphToken,
+        adoToken: teamsContext.adoToken,
+        githubToken: teamsContext.githubToken,
+        signin: teamsContext.signin,
+        friendStore: store,
+        summarize: (0, core_1.createSummarize)(),
+    } : undefined;
+    if (toolContext) {
+        const resolver = new resolver_1.FriendResolver(store, {
+            provider,
+            externalId,
+            tenantId: teamsContext?.tenantId,
+            displayName: teamsContext?.displayName || "Unknown",
+            channel: "teams",
+        });
+        toolContext.context = await resolver.resolve();
+    }
+    const friendId = toolContext?.context?.friend?.id || "default";
+    if (toolContext?.context?.friend) {
+        const trustGate = (0, trust_gate_1.enforceTrustGate)({
+            friend: toolContext.context.friend,
+            provider,
+            externalId,
+            tenantId: teamsContext?.tenantId,
+            channel: "teams",
+        });
+        if (!trustGate.allowed) {
+            if (trustGate.reason === "stranger_first_reply") {
+                stream.emit(trustGate.autoReply);
+            }
+            return;
+        }
+    }
+    const registry = (0, commands_1.createCommandRegistry)();
+    (0, commands_1.registerDefaultCommands)(registry);
+    // Check for slash commands
+    const parsed = (0, commands_1.parseSlashCommand)(text);
+    if (parsed) {
+        const dispatchResult = registry.dispatch(parsed.command, { channel: "teams" });
+        if (dispatchResult.handled && dispatchResult.result) {
+            if (dispatchResult.result.action === "new") {
+                const sessPath = (0, config_2.sessionPath)(friendId, "teams", conversationId);
+                (0, context_1.deleteSession)(sessPath);
+                stream.emit("session cleared");
+                return;
+            }
+            else if (dispatchResult.result.action === "response") {
+                stream.emit(dispatchResult.result.message || "");
+                return;
+            }
+        }
+    }
+    // Load or create session
+    const sessPath = (0, config_2.sessionPath)(friendId, "teams", conversationId);
+    const existing = (0, context_1.loadSession)(sessPath);
+    const messages = existing?.messages && existing.messages.length > 0
+        ? existing.messages
+        : [{ role: "system", content: await (0, prompt_1.buildSystem)("teams", undefined, toolContext?.context) }];
+    // Push user message
+    messages.push({ role: "user", content: text });
+    // Run agent
+    const controller = new AbortController();
+    const channelConfig = (0, config_2.getTeamsChannelConfig)();
+    const callbacks = createTeamsCallbacks(stream, controller, sendMessage, { conversationId, flushIntervalMs: channelConfig.flushIntervalMs });
+    const traceId = (0, nerves_1.createTraceId)();
+    const agentOptions = {};
+    agentOptions.traceId = traceId;
+    if (toolContext)
+        agentOptions.toolContext = toolContext;
+    if (channelConfig.skipConfirmation)
+        agentOptions.skipConfirmation = true;
+    agentOptions.drainSteeringFollowUps = () => _turnCoordinator.drainFollowUps(turnKey).map((m) => ({ text: m.text }));
+    const result = await (0, core_1.runAgent)(messages, callbacks, "teams", controller.signal, agentOptions);
+    // Flush any remaining accumulated text at end of turn
+    await callbacks.flush();
+    // After the agent loop, check if any tool returned AUTH_REQUIRED and trigger signin.
+    // This must happen after the stream is done so the OAuth card renders properly.
+    if (teamsContext) {
+        const allContent = messages.map(m => typeof m.content === "string" ? m.content : "").join("\n");
+        if (allContent.includes("AUTH_REQUIRED:graph"))
+            await teamsContext.signin("graph");
+        if (allContent.includes("AUTH_REQUIRED:ado"))
+            await teamsContext.signin("ado");
+        if (allContent.includes("AUTH_REQUIRED:github"))
+            await teamsContext.signin("github");
+    }
+    // Trim context and save session
+    (0, context_1.postTurn)(messages, sessPath, result.usage);
+    // Accumulate token usage on friend record
+    if (toolContext?.context?.friend?.id) {
+        await (0, tokens_1.accumulateFriendTokens)(store, toolContext.context.friend.id, result.usage);
+    }
+    // SDK auto-closes the stream after our handler returns (app.process.js)
+}
+// Start the Teams app in DevtoolsPlugin mode (local dev) or Bot Service mode (real Teams).
+// Mode is determined by getTeamsConfig().clientId.
+// Text is always accumulated in textBuffer and flushed periodically (chunked streaming).
+function startTeamsApp() {
+    const mentionStripping = { activity: { mentions: { stripText: true } } };
+    const teamsConfig = (0, config_2.getTeamsConfig)();
+    let app;
+    let mode;
+    const oauthConfig = (0, config_1.getOAuthConfig)();
+    if (teamsConfig.clientId) {
+        // Bot Service mode -- real Teams connection with SingleTenant credentials
+        app = new teams_apps_1.App({
+            clientId: teamsConfig.clientId,
+            clientSecret: teamsConfig.clientSecret,
+            tenantId: teamsConfig.tenantId,
+            oauth: { defaultConnectionName: oauthConfig.graphConnectionName },
+            ...mentionStripping,
+        });
+        mode = "Bot Service";
+    }
+    else {
+        // DevtoolsPlugin mode -- local development with Teams DevtoolsPlugin UI
+        app = new teams_apps_1.App({
+            plugins: [new teams_dev_1.DevtoolsPlugin()],
+            ...mentionStripping,
+        });
+        mode = "DevtoolsPlugin";
+    }
+    // Override default OAuth verify-state handler.  The SDK's built-in handler
+    // uses a single defaultConnectionName, which breaks multi-connection setups
+    // (graph + ado + github).  The verifyState activity only carries a `state`
+    // code with no connectionName, so we try each configured connection until
+    // one succeeds.
+    const allConnectionNames = [
+        oauthConfig.graphConnectionName,
+        oauthConfig.adoConnectionName,
+        oauthConfig.githubConnectionName,
+    ].filter(Boolean);
+    app.on("signin.verify-state", async (ctx) => {
+        const { api, activity } = ctx;
+        if (!activity.value?.state)
+            return { status: 404 };
+        for (const cn of allConnectionNames) {
+            try {
+                await api.users.token.get({
+                    channelId: activity.channelId,
+                    userId: activity.from.id,
+                    connectionName: cn,
+                    code: activity.value.state,
+                });
+                (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.verify_state", component: "channels", message: `verify-state succeeded for connection "${cn}"`, meta: { connectionName: cn } });
+                return { status: 200 };
+            }
+            catch { /* try next */ }
+        }
+        (0, runtime_1.emitNervesEvent)({ level: "warn", event: "channel.verify_state", component: "channels", message: "verify-state failed for all connections", meta: {} });
+        return { status: 412 };
+    });
+    app.on("message", async (ctx) => {
+        const { stream, activity, api, signin } = ctx;
+        const text = activity.text || "";
+        const convId = activity.conversation?.id || "unknown";
+        const turnKey = teamsTurnKey(convId);
+        const userId = activity.from?.id || "";
+        const channelId = activity.channelId || "msteams";
+        (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.message_received", component: "channels", message: "incoming teams message", meta: { userId: userId.slice(0, 12), conversationId: convId.slice(0, 20) } });
+        // Resolve pending confirmations IMMEDIATELY — before token fetches or
+        // the conversation lock.  The original message holds the lock while
+        // awaiting confirmation, so acquiring it here would deadlock.  Token
+        // fetches are also unnecessary (and slow) for a simple yes/no reply.
+        if (resolvePendingConfirmation(convId, text)) {
+            // Don't emit on this stream — the original message's stream is still
+            // active.  Opening a second streaming response in the same conversation
+            // can corrupt the first.  The original stream will show tool progress
+            // once the confirmation Promise resolves.
+            return;
+        }
+        // If this conversation already has an active turn, steer follow-up input
+        // into that turn and avoid starting a second concurrent turn.
+        if (!_turnCoordinator.tryBeginTurn(turnKey)) {
+            _turnCoordinator.enqueueFollowUp(turnKey, {
+                conversationId: convId,
+                text,
+                receivedAt: Date.now(),
+            });
+            return;
+        }
+        try {
+            // Fetch tokens for both OAuth connections independently.
+            // Failures are silently caught -- the tool handler will request signin if needed.
+            let graphToken;
+            let adoToken;
+            let githubToken;
+            try {
+                const graphRes = await api.users.token.get({ userId, connectionName: oauthConfig.graphConnectionName, channelId });
+                graphToken = graphRes?.token;
+            }
+            catch { /* no token yet — tool handler will trigger signin */ }
+            try {
+                const adoRes = await api.users.token.get({ userId, connectionName: oauthConfig.adoConnectionName, channelId });
+                adoToken = adoRes?.token;
+            }
+            catch { /* no token yet — tool handler will trigger signin */ }
+            try {
+                const githubRes = await api.users.token.get({ userId, connectionName: oauthConfig.githubConnectionName, channelId });
+                githubToken = githubRes?.token;
+            }
+            catch { /* no token yet — tool handler will trigger signin */ }
+            (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.token_status", component: "channels", message: "oauth token availability", meta: { graph: !!graphToken, ado: !!adoToken, github: !!githubToken } });
+            const teamsContext = {
+                graphToken,
+                adoToken,
+                githubToken,
+                signin: async (cn) => {
+                    try {
+                        const result = await signin({ connectionName: cn });
+                        (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.signin_result", component: "channels", message: `signin(${cn}): ${result ? "token received" : "no token"}`, meta: { connectionName: cn, hasToken: !!result } });
+                        return result;
+                    }
+                    catch (e) {
+                        const msg = e instanceof Error ? e.message : String(e);
+                        (0, runtime_1.emitNervesEvent)({ level: "error", event: "channel.signin_error", component: "channels", message: `signin(${cn}) failed`, meta: { connectionName: cn, reason: msg.slice(0, 100) } });
+                        return undefined;
+                    }
+                },
+                aadObjectId: activity.from?.aadObjectId,
+                tenantId: activity.conversation?.tenantId,
+                displayName: activity.from?.name,
+            };
+            /* v8 ignore next 5 -- bot-framework integration callback; tested via handleTeamsMessage sendMessage path @preserve */
+            const ctxSend = async (t) => {
+                // Use send with replyToId (not reply, which adds a blockquote).
+                // replyToId anchors the message after the user's message in Copilot Chat.
+                await ctx.send({ type: "message", text: t, replyToId: activity.id });
+            };
+            await handleTeamsMessage(text, stream, convId, teamsContext, ctxSend);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            (0, runtime_1.emitNervesEvent)({ level: "error", event: "channel.handler_error", component: "channels", message: msg.slice(0, 200), meta: {} });
+        }
+        finally {
+            _turnCoordinator.endTurn(turnKey);
+        }
+    });
+    if (!process.listeners("unhandledRejection").some((l) => l.__agentHandler)) {
+        const handler = (err) => {
+            const msg = err instanceof Error ? err.message : String(err);
+            (0, runtime_1.emitNervesEvent)({ level: "error", event: "channel.unhandled_rejection", component: "channels", message: msg.slice(0, 200), meta: {} });
+        };
+        handler.__agentHandler = true;
+        process.on("unhandledRejection", handler);
+    }
+    app.event("error", ({ error }) => {
+        const msg = error instanceof Error ? error.message : String(error);
+        (0, runtime_1.emitNervesEvent)({ level: "error", event: "channel.app_error", component: "channels", message: msg, meta: {} });
+    });
+    const port = (0, config_2.getTeamsChannelConfig)().port;
+    app.start(port);
+    (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.app_started", component: "channels", message: `Teams bot started on port ${port} with ${mode} (chunked streaming)`, meta: { port, mode } });
+}