@ouro.bot/cli 0.1.0-alpha.11 → 0.1.0-alpha.111

package/dist/senses/teams.js

@@ -40,10 +40,15 @@ exports.createTeamsCallbacks = createTeamsCallbacks;
 exports.resolvePendingConfirmation = resolvePendingConfirmation;
 exports.withConversationLock = withConversationLock;
 exports.handleTeamsMessage = handleTeamsMessage;
+exports.sendProactiveTeamsMessageToSession = sendProactiveTeamsMessageToSession;
+exports.drainAndSendPendingTeams = drainAndSendPendingTeams;
 exports.startTeamsApp = startTeamsApp;
+const fs = __importStar(require("fs"));
 const teams_apps_1 = require("@microsoft/teams.apps");
 const teams_dev_1 = require("@microsoft/teams.dev");
 const core_1 = require("../heart/core");
+const tools_1 = require("../repertoire/tools");
+const channel_1 = require("../mind/friends/channel");
 const config_1 = require("../heart/config");
 const prompt_1 = require("../mind/prompt");
 const phrases_1 = require("../mind/phrases");
@@ -54,12 +59,19 @@ const commands_1 = require("./commands");
 const nerves_1 = require("../nerves");
 const runtime_1 = require("../nerves/runtime");
 const store_file_1 = require("../mind/friends/store-file");
+const types_1 = require("../mind/friends/types");
 const resolver_1 = require("../mind/friends/resolver");
 const tokens_1 = require("../mind/friends/tokens");
 const turn_coordinator_1 = require("../heart/turn-coordinator");
 const identity_1 = require("../heart/identity");
+const mcp_manager_1 = require("../repertoire/mcp-manager");
+const progress_story_1 = require("../heart/progress-story");
+const http = __importStar(require("http"));
 const path = __importStar(require("path"));
 const trust_gate_1 = require("./trust-gate");
+const pipeline_1 = require("./pipeline");
+const pending_1 = require("../mind/pending");
+const continuity_1 = require("./continuity");
 // Strip @mention markup from incoming messages.
 // Removes <at>...</at> tags and trims extra whitespace.
 // Fallback safety net -- the SDK's activity.mentions.stripText should handle
@@ -317,14 +329,29 @@ function createTeamsCallbacks(stream, controller, sendMessage, options) {
         onToolStart: (name, args) => {
             stopPhraseRotation();
             flushTextBuffer();
-            const argSummary = Object.values(args).join(", ");
-            safeUpdate(`running ${name} (${argSummary})...`);
+            // Emit a placeholder to satisfy the 15s Copilot timeout for initial
+            // stream.emit(). Without this, long tool chains (e.g. ADO batch ops)
+            // never emit before the timeout and the user sees "this response was
+            // stopped". The placeholder is replaced by actual content on next emit.
+            // https://learn.microsoft.com/en-us/answers/questions/2288017/m365-custom-engine-agents-timeout-message-after-15
+            if (!streamHasContent)
+                safeEmit("⏳");
+            const argSummary = (0, tools_1.summarizeArgs)(name, args) || Object.keys(args).join(", ");
+            safeUpdate((0, progress_story_1.renderProgressStory)((0, progress_story_1.buildProgressStory)({
+                scope: "shared-work",
+                phase: "processing",
+                objective: `running ${name} (${argSummary})...`,
+            })));
             hadToolRun = true;
         },
         onToolEnd: (name, summary, success) => {
             stopPhraseRotation();
             const msg = (0, format_1.formatToolResult)(name, summary, success);
-            safeUpdate(msg);
+            safeUpdate((0, progress_story_1.renderProgressStory)((0, progress_story_1.buildProgressStory)({
+                scope: "shared-work",
+                phase: "processing",
+                objective: msg,
+            })));
         },
         onKick: () => {
             stopPhraseRotation();
@@ -335,7 +362,11 @@ function createTeamsCallbacks(stream, controller, sendMessage, options) {
             stopPhraseRotation();
             if (stopped)
                 return;
-            const msg = (0, format_1.formatError)(error);
+            const msg = (0, progress_story_1.renderProgressStory)((0, progress_story_1.buildProgressStory)({
+                scope: "shared-work",
+                phase: "errored",
+                outcomeText: (0, format_1.formatError)(error),
+            }));
             if (severity === "transient") {
                 safeUpdate(msg);
             }
@@ -424,6 +455,34 @@ function getFriendStore() {
     const friendsPath = path.join((0, identity_1.getAgentRoot)(), "friends");
     return new store_file_1.FileFriendStore(friendsPath);
 }
+function createTeamsCommandRegistry() {
+    const registry = (0, commands_1.createCommandRegistry)();
+    (0, commands_1.registerDefaultCommands)(registry);
+    return registry;
+}
+function handleTeamsSlashCommand(text, registry, friendId, conversationId, stream, emitResponse = true) {
+    const parsed = (0, commands_1.parseSlashCommand)(text);
+    if (!parsed)
+        return null;
+    const dispatchResult = registry.dispatch(parsed.command, { channel: "teams" });
+    if (!dispatchResult.handled || !dispatchResult.result) {
+        return null;
+    }
+    if (dispatchResult.result.action === "new") {
+        (0, context_1.deleteSession)((0, config_2.sessionPath)(friendId, "teams", conversationId));
+        if (emitResponse) {
+            stream.emit("session cleared");
+        }
+        return "new";
+    }
+    if (dispatchResult.result.action === "response") {
+        if (emitResponse) {
+            stream.emit(dispatchResult.result.message || "");
+        }
+        return "response";
+    }
+    return null;
+}
 // Handle an incoming Teams message
 async function handleTeamsMessage(text, stream, conversationId, teamsContext, sendMessage) {
     const turnKey = teamsTurnKey(conversationId);
@@ -434,148 +493,233 @@ async function handleTeamsMessage(text, stream, conversationId, teamsContext, se
     // before sync I/O (session load, trim) blocks the event loop.
     stream.update((0, phrases_1.pickPhrase)((0, phrases_1.getPhrases)().thinking) + "...");
     await new Promise(r => setImmediate(r));
-    // Resolve context kernel (identity + channel) early so we can use the friend UUID for session path
+    // Resolve identity provider early for friend resolution + slash command session path
     const store = getFriendStore();
     const provider = teamsContext?.aadObjectId ? "aad" : "teams-conversation";
     const externalId = teamsContext?.aadObjectId || conversationId;
-    const toolContext = teamsContext ? {
+    // Build FriendResolver for the pipeline
+    const resolver = new resolver_1.FriendResolver(store, {
+        provider,
+        externalId,
+        tenantId: teamsContext?.tenantId,
+        displayName: teamsContext?.displayName || "Unknown",
+        channel: "teams",
+    });
+    // Pre-resolve friend for session path + slash commands (pipeline will re-use the cached result)
+    const resolvedContext = await resolver.resolve();
+    const friendId = resolvedContext.friend.id;
+    const registry = createTeamsCommandRegistry();
+    // Check for slash commands (before pipeline -- these are transport-level concerns)
+    if (handleTeamsSlashCommand(text, registry, friendId, conversationId, stream)) {
+        return;
+    }
+    // ── Teams adapter concerns: controller, callbacks, session path ──────────
+    const controller = new AbortController();
+    const channelConfig = (0, config_2.getTeamsChannelConfig)();
+    const callbacks = createTeamsCallbacks(stream, controller, sendMessage, { conversationId, flushIntervalMs: channelConfig.flushIntervalMs });
+    const traceId = (0, nerves_1.createTraceId)();
+    const sessPath = (0, config_2.sessionPath)(friendId, "teams", conversationId);
+    const teamsCapabilities = (0, channel_1.getChannelCapabilities)("teams");
+    const pendingDir = (0, pending_1.getPendingDir)((0, identity_1.getAgentName)(), friendId, "teams", conversationId);
+    // Build Teams-specific toolContext fields for injection into the pipeline
+    const teamsToolContext = teamsContext ? {
         graphToken: teamsContext.graphToken,
         adoToken: teamsContext.adoToken,
         githubToken: teamsContext.githubToken,
         signin: teamsContext.signin,
-        friendStore: store,
         summarize: (0, core_1.createSummarize)(),
-    } : undefined;
-    if (toolContext) {
-        const resolver = new resolver_1.FriendResolver(store, {
-            provider,
-            externalId,
-            tenantId: teamsContext?.tenantId,
-            displayName: teamsContext?.displayName || "Unknown",
+        tenantId: teamsContext.tenantId,
+        botApi: teamsContext.botApi,
+    } : {};
+    let currentText = text;
+    const mcpManager = await (0, mcp_manager_1.getSharedMcpManager)() ?? undefined;
+    while (true) {
+        let drainedSteeringFollowUps = [];
+        // Build runAgentOptions with Teams-specific fields
+        const agentOptions = {
+            traceId,
+            toolContext: teamsToolContext,
+            mcpManager,
+            drainSteeringFollowUps: () => {
+                drainedSteeringFollowUps = _turnCoordinator.drainFollowUps(turnKey)
+                    .map(({ text: followUpText, effect }) => ({ text: followUpText, effect }));
+                return drainedSteeringFollowUps;
+            },
+        };
+        if (channelConfig.skipConfirmation)
+            agentOptions.skipConfirmation = true;
+        // ── Call shared pipeline ──────────────────────────────────────────
+        const result = await (0, pipeline_1.handleInboundTurn)({
             channel: "teams",
-        });
-        toolContext.context = await resolver.resolve();
-    }
-    const friendId = toolContext?.context?.friend?.id || "default";
-    if (toolContext?.context?.friend) {
-        const trustGate = (0, trust_gate_1.enforceTrustGate)({
-            friend: toolContext.context.friend,
+            sessionKey: conversationId,
+            capabilities: teamsCapabilities,
+            messages: [{ role: "user", content: currentText }],
+            continuityIngressTexts: [currentText],
+            callbacks,
+            friendResolver: { resolve: () => Promise.resolve(resolvedContext) },
+            sessionLoader: {
+                loadOrCreate: async () => {
+                    const existing = (0, context_1.loadSession)(sessPath);
+                    const messages = existing?.messages && existing.messages.length > 0
+                        ? existing.messages
+                        : [{ role: "system", content: await (0, prompt_1.buildSystem)("teams", { mcpManager }, resolvedContext) }];
+                    (0, core_1.repairOrphanedToolCalls)(messages);
+                    return {
+                        messages,
+                        sessionPath: sessPath,
+                        state: existing?.state,
+                    };
+                },
+            },
+            pendingDir,
+            friendStore: store,
             provider,
             externalId,
             tenantId: teamsContext?.tenantId,
-            channel: "teams",
+            isGroupChat: false,
+            groupHasFamilyMember: false,
+            hasExistingGroupWithFamily: false,
+            enforceTrustGate: trust_gate_1.enforceTrustGate,
+            drainPending: pending_1.drainPending,
+            drainDeferredReturns: (deferredFriendId) => (0, pending_1.drainDeferredReturns)((0, identity_1.getAgentName)(), deferredFriendId),
+            runAgent: (msgs, cb, channel, sig, opts) => (0, core_1.runAgent)(msgs, cb, channel, sig, {
+                ...opts,
+                toolContext: {
+                    /* v8 ignore next -- default no-op signin; pipeline provides the real one @preserve */
+                    signin: async () => undefined,
+                    ...opts?.toolContext,
+                    summarize: teamsToolContext.summarize,
+                },
+            }),
+            postTurn: context_1.postTurn,
+            accumulateFriendTokens: tokens_1.accumulateFriendTokens,
+            signal: controller.signal,
+            runAgentOptions: agentOptions,
         });
-        if (!trustGate.allowed) {
-            if (trustGate.reason === "stranger_first_reply") {
-                stream.emit(trustGate.autoReply);
+        // ── Handle gate result ────────────────────────────────────────
+        if (!result.gateResult.allowed) {
+            if ("autoReply" in result.gateResult && result.gateResult.autoReply) {
+                stream.emit(result.gateResult.autoReply);
             }
             return;
         }
+        // Flush any remaining accumulated text at end of turn
+        await callbacks.flush();
+        // After the agent loop, check if any tool returned AUTH_REQUIRED and trigger signin.
+        // This must happen after the stream is done so the OAuth card renders properly.
+        if (teamsContext && result.messages) {
+            const allContent = result.messages.map(m => typeof m.content === "string" ? m.content : "").join("\n");
+            if (allContent.includes("AUTH_REQUIRED:graph") && teamsContext.graphConnectionName)
+                await teamsContext.signin(teamsContext.graphConnectionName);
+            if (allContent.includes("AUTH_REQUIRED:ado") && teamsContext.adoConnectionName)
+                await teamsContext.signin(teamsContext.adoConnectionName);
+            if (allContent.includes("AUTH_REQUIRED:github") && teamsContext.githubConnectionName)
+                await teamsContext.signin(teamsContext.githubConnectionName);
+        }
+        if (result.turnOutcome !== "superseded") {
+            return;
+        }
+        const supersedingIndex = drainedSteeringFollowUps
+            .map((followUp) => followUp.effect)
+            .lastIndexOf("clear_and_supersede");
+        if (supersedingIndex < 0) {
+            return;
+        }
+        const supersedingFollowUp = drainedSteeringFollowUps[supersedingIndex];
+        const replayTail = drainedSteeringFollowUps
+            .slice(supersedingIndex + 1)
+            .map((followUp) => followUp.text.trim())
+            .filter((followUpText) => followUpText.length > 0)
+            .join("\n");
+        if (replayTail) {
+            currentText = replayTail;
+            continue;
+        }
+        if (handleTeamsSlashCommand(supersedingFollowUp.text, registry, friendId, conversationId, stream, false)) {
+            return;
+        }
+        currentText = supersedingFollowUp.text;
     }
-    const registry = (0, commands_1.createCommandRegistry)();
-    (0, commands_1.registerDefaultCommands)(registry);
-    // Check for slash commands
-    const parsed = (0, commands_1.parseSlashCommand)(text);
-    if (parsed) {
-        const dispatchResult = registry.dispatch(parsed.command, { channel: "teams" });
-        if (dispatchResult.handled && dispatchResult.result) {
-            if (dispatchResult.result.action === "new") {
-                const sessPath = (0, config_2.sessionPath)(friendId, "teams", conversationId);
-                (0, context_1.deleteSession)(sessPath);
-                stream.emit("session cleared");
-                return;
-            }
-            else if (dispatchResult.result.action === "response") {
-                stream.emit(dispatchResult.result.message || "");
-                return;
-            }
+}
+// Internal port for the secondary bot App (not exposed externally).
+// The primary app proxies /api/messages-secondary → localhost:SECONDARY_PORT/api/messages.
+const SECONDARY_INTERNAL_PORT = 3979;
+// Collect all unique OAuth connection names across top-level config and tenant overrides.
+/* v8 ignore start -- runtime Teams SDK config; no unit-testable surface @preserve */
+function allOAuthConnectionNames() {
+    const oauthConfig = (0, config_1.getOAuthConfig)();
+    const names = new Set();
+    if (oauthConfig.graphConnectionName)
+        names.add(oauthConfig.graphConnectionName);
+    if (oauthConfig.adoConnectionName)
+        names.add(oauthConfig.adoConnectionName);
+    if (oauthConfig.githubConnectionName)
+        names.add(oauthConfig.githubConnectionName);
+    if (oauthConfig.tenantOverrides) {
+        for (const ov of Object.values(oauthConfig.tenantOverrides)) {
+            if (ov.graphConnectionName)
+                names.add(ov.graphConnectionName);
+            if (ov.adoConnectionName)
+                names.add(ov.adoConnectionName);
+            if (ov.githubConnectionName)
+                names.add(ov.githubConnectionName);
         }
     }
-    // Load or create session
-    const sessPath = (0, config_2.sessionPath)(friendId, "teams", conversationId);
-    const existing = (0, context_1.loadSession)(sessPath);
-    const messages = existing?.messages && existing.messages.length > 0
-        ? existing.messages
-        : [{ role: "system", content: await (0, prompt_1.buildSystem)("teams", undefined, toolContext?.context) }];
-    // Push user message
-    messages.push({ role: "user", content: text });
-    // Run agent
-    const controller = new AbortController();
-    const channelConfig = (0, config_2.getTeamsChannelConfig)();
-    const callbacks = createTeamsCallbacks(stream, controller, sendMessage, { conversationId, flushIntervalMs: channelConfig.flushIntervalMs });
-    const traceId = (0, nerves_1.createTraceId)();
-    const agentOptions = {};
-    agentOptions.traceId = traceId;
-    if (toolContext)
-        agentOptions.toolContext = toolContext;
-    if (channelConfig.skipConfirmation)
-        agentOptions.skipConfirmation = true;
-    agentOptions.drainSteeringFollowUps = () => _turnCoordinator.drainFollowUps(turnKey).map((m) => ({ text: m.text }));
-    const result = await (0, core_1.runAgent)(messages, callbacks, "teams", controller.signal, agentOptions);
-    // Flush any remaining accumulated text at end of turn
-    await callbacks.flush();
-    // After the agent loop, check if any tool returned AUTH_REQUIRED and trigger signin.
-    // This must happen after the stream is done so the OAuth card renders properly.
-    if (teamsContext) {
-        const allContent = messages.map(m => typeof m.content === "string" ? m.content : "").join("\n");
-        if (allContent.includes("AUTH_REQUIRED:graph"))
-            await teamsContext.signin("graph");
-        if (allContent.includes("AUTH_REQUIRED:ado"))
-            await teamsContext.signin("ado");
-        if (allContent.includes("AUTH_REQUIRED:github"))
-            await teamsContext.signin("github");
-    }
-    // Trim context and save session
-    (0, context_1.postTurn)(messages, sessPath, result.usage);
-    // Accumulate token usage on friend record
-    if (toolContext?.context?.friend?.id) {
-        await (0, tokens_1.accumulateFriendTokens)(store, toolContext.context.friend.id, result.usage);
-    }
-    // SDK auto-closes the stream after our handler returns (app.process.js)
+    return [...names];
 }
-// Start the Teams app in DevtoolsPlugin mode (local dev) or Bot Service mode (real Teams).
-// Mode is determined by getTeamsConfig().clientId.
-// Text is always accumulated in textBuffer and flushed periodically (chunked streaming).
-function startTeamsApp() {
+// Create an App instance from a TeamsConfig. Returns { app, mode }.
+function createBotApp(teamsConfig) {
     const mentionStripping = { activity: { mentions: { stripText: true } } };
-    const teamsConfig = (0, config_2.getTeamsConfig)();
-    let app;
-    let mode;
     const oauthConfig = (0, config_1.getOAuthConfig)();
-    if (teamsConfig.clientId) {
-        // Bot Service mode -- real Teams connection with SingleTenant credentials
-        app = new teams_apps_1.App({
-            clientId: teamsConfig.clientId,
-            clientSecret: teamsConfig.clientSecret,
-            tenantId: teamsConfig.tenantId,
-            oauth: { defaultConnectionName: oauthConfig.graphConnectionName },
-            ...mentionStripping,
-        });
-        mode = "Bot Service";
+    if (teamsConfig.clientId && teamsConfig.clientSecret) {
+        return {
+            app: new teams_apps_1.App({
+                clientId: teamsConfig.clientId,
+                clientSecret: teamsConfig.clientSecret,
+                tenantId: teamsConfig.tenantId,
+                oauth: { defaultConnectionName: oauthConfig.graphConnectionName },
+                ...mentionStripping,
+            }),
+            mode: "Bot Service (client secret)",
+        };
+    }
+    else if (teamsConfig.clientId) {
+        return {
+            app: new teams_apps_1.App({
+                clientId: teamsConfig.clientId,
+                tenantId: teamsConfig.tenantId,
+                ...(teamsConfig.managedIdentityClientId ? { managedIdentityClientId: teamsConfig.managedIdentityClientId } : {}),
+                oauth: { defaultConnectionName: oauthConfig.graphConnectionName },
+                ...mentionStripping,
+            }),
+            mode: "Bot Service (managed identity)",
+        };
     }
     else {
-        // DevtoolsPlugin mode -- local development with Teams DevtoolsPlugin UI
-        app = new teams_apps_1.App({
-            plugins: [new teams_dev_1.DevtoolsPlugin()],
-            ...mentionStripping,
-        });
-        mode = "DevtoolsPlugin";
+        return {
+            app: new teams_apps_1.App({
+                plugins: [new teams_dev_1.DevtoolsPlugin()],
+                ...mentionStripping,
+            }),
+            mode: "DevtoolsPlugin",
+        };
     }
+}
+/* v8 ignore stop */
+// Register message, verify-state, and error handlers on an App instance.
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function registerBotHandlers(app, label) {
+    const connectionNames = allOAuthConnectionNames();
     // Override default OAuth verify-state handler.  The SDK's built-in handler
     // uses a single defaultConnectionName, which breaks multi-connection setups
     // (graph + ado + github).  The verifyState activity only carries a `state`
     // code with no connectionName, so we try each configured connection until
     // one succeeds.
-    const allConnectionNames = [
-        oauthConfig.graphConnectionName,
-        oauthConfig.adoConnectionName,
-        oauthConfig.githubConnectionName,
-    ].filter(Boolean);
     app.on("signin.verify-state", async (ctx) => {
         const { api, activity } = ctx;
         if (!activity.value?.state)
             return { status: 404 };
-        for (const cn of allConnectionNames) {
+        for (const cn of connectionNames) {
             try {
                 await api.users.token.get({
                     channelId: activity.channelId,
@@ -583,12 +727,12 @@ function startTeamsApp() {
                     connectionName: cn,
                     code: activity.value.state,
                 });
-                (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.verify_state", component: "channels", message: `verify-state succeeded for connection "${cn}"`, meta: { connectionName: cn } });
+                (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.verify_state", component: "channels", message: `[${label}] verify-state succeeded for connection "${cn}"`, meta: { connectionName: cn } });
                 return { status: 200 };
             }
             catch { /* try next */ }
         }
-        (0, runtime_1.emitNervesEvent)({ level: "warn", event: "channel.verify_state", component: "channels", message: "verify-state failed for all connections", meta: {} });
+        (0, runtime_1.emitNervesEvent)({ level: "warn", event: "channel.verify_state", component: "channels", message: `[${label}] verify-state failed for all connections`, meta: {} });
         return { status: 412 };
     });
     app.on("message", async (ctx) => {
@@ -598,18 +742,49 @@ function startTeamsApp() {
         const turnKey = teamsTurnKey(convId);
         const userId = activity.from?.id || "";
         const channelId = activity.channelId || "msteams";
-        (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.message_received", component: "channels", message: "incoming teams message", meta: { userId: userId.slice(0, 12), conversationId: convId.slice(0, 20) } });
+        (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.message_received", component: "channels", message: `[${label}] incoming teams message`, meta: { userId: userId.slice(0, 12), conversationId: convId.slice(0, 20) } });
         // Resolve pending confirmations IMMEDIATELY — before token fetches or
         // the conversation lock.  The original message holds the lock while
         // awaiting confirmation, so acquiring it here would deadlock.  Token
         // fetches are also unnecessary (and slow) for a simple yes/no reply.
         if (resolvePendingConfirmation(convId, text)) {
-            // Don't emit on this stream — the original message's stream is still
-            // active.  Opening a second streaming response in the same conversation
-            // can corrupt the first.  The original stream will show tool progress
-            // once the confirmation Promise resolves.
             return;
         }
+        const commandRegistry = createTeamsCommandRegistry();
+        const parsedSlashCommand = (0, commands_1.parseSlashCommand)(text);
+        if (parsedSlashCommand) {
+            const dispatchResult = commandRegistry.dispatch(parsedSlashCommand.command, { channel: "teams" });
+            if (dispatchResult.handled && dispatchResult.result) {
+                if (dispatchResult.result.action === "response") {
+                    stream.emit(dispatchResult.result.message || "");
+                    return;
+                }
+                if (dispatchResult.result.action === "new") {
+                    const commandStore = getFriendStore();
+                    const commandProvider = activity.from?.aadObjectId ? "aad" : "teams-conversation";
+                    const commandExternalId = activity.from?.aadObjectId || convId;
+                    const commandResolver = new resolver_1.FriendResolver(commandStore, {
+                        provider: commandProvider,
+                        externalId: commandExternalId,
+                        tenantId: activity.conversation?.tenantId,
+                        displayName: activity.from?.name || "Unknown",
+                        channel: "teams",
+                    });
+                    const commandContext = await commandResolver.resolve();
+                    (0, context_1.deleteSession)((0, config_2.sessionPath)(commandContext.friend.id, "teams", convId));
+                    stream.emit("session cleared");
+                    if (_turnCoordinator.isTurnActive(turnKey)) {
+                        _turnCoordinator.enqueueFollowUp(turnKey, {
+                            conversationId: convId,
+                            text,
+                            receivedAt: Date.now(),
+                            effect: "clear_and_supersede",
+                        });
+                    }
+                    return;
+                }
+            }
+        }
         // If this conversation already has an active turn, steer follow-up input
         // into that turn and avoid starting a second concurrent turn.
         if (!_turnCoordinator.tryBeginTurn(turnKey)) {
@@ -617,31 +792,35 @@ function startTeamsApp() {
                 conversationId: convId,
                 text,
                 receivedAt: Date.now(),
+                effect: (0, continuity_1.classifySteeringFollowUpEffect)(text),
             });
             return;
         }
         try {
+            // Resolve OAuth connection names for this user's tenant (supports per-tenant overrides).
+            const tenantId = activity.conversation?.tenantId;
+            const tenantOAuth = (0, config_1.resolveOAuthForTenant)(tenantId);
             // Fetch tokens for both OAuth connections independently.
             // Failures are silently caught -- the tool handler will request signin if needed.
             let graphToken;
             let adoToken;
             let githubToken;
             try {
-                const graphRes = await api.users.token.get({ userId, connectionName: oauthConfig.graphConnectionName, channelId });
+                const graphRes = await api.users.token.get({ userId, connectionName: tenantOAuth.graphConnectionName, channelId });
                 graphToken = graphRes?.token;
             }
             catch { /* no token yet — tool handler will trigger signin */ }
             try {
-                const adoRes = await api.users.token.get({ userId, connectionName: oauthConfig.adoConnectionName, channelId });
+                const adoRes = await api.users.token.get({ userId, connectionName: tenantOAuth.adoConnectionName, channelId });
                 adoToken = adoRes?.token;
             }
             catch { /* no token yet — tool handler will trigger signin */ }
             try {
-                const githubRes = await api.users.token.get({ userId, connectionName: oauthConfig.githubConnectionName, channelId });
+                const githubRes = await api.users.token.get({ userId, connectionName: tenantOAuth.githubConnectionName, channelId });
                 githubToken = githubRes?.token;
             }
             catch { /* no token yet — tool handler will trigger signin */ }
-            (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.token_status", component: "channels", message: "oauth token availability", meta: { graph: !!graphToken, ado: !!adoToken, github: !!githubToken } });
+            (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.token_status", component: "channels", message: "oauth token availability", meta: { graph: !!graphToken, ado: !!adoToken, github: !!githubToken, tenantId } });
             const teamsContext = {
                 graphToken,
                 adoToken,
@@ -661,6 +840,11 @@ function startTeamsApp() {
                 aadObjectId: activity.from?.aadObjectId,
                 tenantId: activity.conversation?.tenantId,
                 displayName: activity.from?.name,
+                graphConnectionName: tenantOAuth.graphConnectionName,
+                adoConnectionName: tenantOAuth.adoConnectionName,
+                githubConnectionName: tenantOAuth.githubConnectionName,
+                /* v8 ignore next -- bot API availability branch; requires live SDK context @preserve */
+                botApi: app.id && api ? { id: app.id, conversations: api.conversations } : undefined,
             };
             /* v8 ignore next 5 -- bot-framework integration callback; tested via handleTeamsMessage sendMessage path @preserve */
             const ctxSend = async (t) => {
@@ -678,6 +862,227 @@ function startTeamsApp() {
             _turnCoordinator.endTurn(turnKey);
         }
     });
+    app.event("error", ({ error }) => {
+        const msg = error instanceof Error ? error.message : String(error);
+        (0, runtime_1.emitNervesEvent)({ level: "error", event: "channel.app_error", component: "channels", message: `[${label}] ${msg}`, meta: {} });
+    });
+}
+function findAadObjectId(friend) {
+    for (const ext of friend.externalIds) {
+        if (ext.provider === "aad" && !ext.externalId.startsWith("group:")) {
+            return { aadObjectId: ext.externalId, tenantId: ext.tenantId };
+        }
+    }
+    return undefined;
+}
+function resolveTeamsFriendStore(deps) {
+    return deps.store
+        ?? deps.createFriendStore?.()
+        ?? new store_file_1.FileFriendStore(path.join((0, identity_1.getAgentRoot)(), "friends"));
+}
+function getTeamsConversations(botApi) {
+    return botApi.conversations;
+}
+function hasExplicitCrossChatAuthorization(params) {
+    return params.intent === "explicit_cross_chat"
+        && types_1.TRUSTED_LEVELS.has(params.authorizingSession?.trustLevel ?? "stranger");
+}
+async function sendProactiveTeamsMessageToSession(params, deps) {
+    const store = resolveTeamsFriendStore(deps);
+    const conversations = getTeamsConversations(deps.botApi);
+    let friend;
+    try {
+        friend = await store.get(params.friendId);
+    }
+    catch {
+        friend = null;
+    }
+    if (!friend) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "senses",
+            event: "senses.teams_proactive_no_friend",
+            message: "proactive send skipped: friend not found",
+            meta: { friendId: params.friendId, sessionKey: params.sessionKey },
+        });
+        return { delivered: false, reason: "friend_not_found" };
+    }
+    if (!hasExplicitCrossChatAuthorization(params) && !types_1.TRUSTED_LEVELS.has(friend.trustLevel ?? "stranger")) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.teams_proactive_trust_skip",
+            message: "proactive send skipped: trust level not allowed",
+            meta: {
+                friendId: params.friendId,
+                trustLevel: friend.trustLevel ?? "unknown",
+                intent: params.intent ?? "generic_outreach",
+                authorizingTrustLevel: params.authorizingSession?.trustLevel ?? null,
+            },
+        });
+        return { delivered: false, reason: "trust_skip" };
+    }
+    const aadInfo = findAadObjectId(friend);
+    if (!aadInfo) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "senses",
+            event: "senses.teams_proactive_no_aad_id",
+            message: "proactive send skipped: no AAD object ID found",
+            meta: { friendId: params.friendId, sessionKey: params.sessionKey },
+        });
+        return { delivered: false, reason: "missing_target" };
+    }
+    try {
+        const conversation = await conversations.create({
+            bot: { id: deps.botApi.id },
+            members: [{ id: aadInfo.aadObjectId, role: "user", name: friend.name || aadInfo.aadObjectId }],
+            tenantId: aadInfo.tenantId,
+            isGroup: false,
+        });
+        await conversations.activities(conversation.id).create({
+            type: "message",
+            text: params.text,
+        });
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.teams_proactive_sent",
+            message: "proactive teams message sent",
+            meta: { friendId: params.friendId, aadObjectId: aadInfo.aadObjectId, sessionKey: params.sessionKey },
+        });
+        return { delivered: true };
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "senses",
+            event: "senses.teams_proactive_send_error",
+            message: "proactive teams send failed",
+            meta: {
+                friendId: params.friendId,
+                aadObjectId: aadInfo.aadObjectId,
+                sessionKey: params.sessionKey,
+                reason: error instanceof Error ? error.message : String(error),
+            },
+        });
+        return { delivered: false, reason: "send_error" };
+    }
+}
+function scanPendingTeamsFiles(pendingRoot) {
+    const results = [];
+    let friendIds;
+    try {
+        friendIds = fs.readdirSync(pendingRoot);
+    }
+    catch {
+        return results;
+    }
+    for (const friendId of friendIds) {
+        const teamsDir = path.join(pendingRoot, friendId, "teams");
+        let keys;
+        try {
+            keys = fs.readdirSync(teamsDir);
+        }
+        catch {
+            continue;
+        }
+        for (const key of keys) {
+            const keyDir = path.join(teamsDir, key);
+            let files;
+            try {
+                files = fs.readdirSync(keyDir);
+            }
+            catch {
+                continue;
+            }
+            for (const file of files.filter((f) => f.endsWith(".json")).sort()) {
+                const filePath = path.join(keyDir, file);
+                try {
+                    const content = fs.readFileSync(filePath, "utf-8");
+                    results.push({ friendId, key, filePath, content });
+                }
+                catch {
+                    // skip unreadable files
+                }
+            }
+        }
+    }
+    return results;
+}
+async function drainAndSendPendingTeams(store, botApi, pendingRoot) {
+    const root = pendingRoot ?? path.join((0, identity_1.getAgentRoot)(), "state", "pending");
+    const pendingFiles = scanPendingTeamsFiles(root);
+    const result = { sent: 0, skipped: 0, failed: 0 };
+    for (const { friendId, key, filePath, content } of pendingFiles) {
+        let parsed;
+        try {
+            parsed = JSON.parse(content);
+        }
+        catch {
+            result.failed++;
+            try {
+                fs.unlinkSync(filePath);
+            }
+            catch { /* ignore */ }
+            continue;
+        }
+        const messageText = typeof parsed.content === "string" ? parsed.content : "";
+        if (!messageText.trim()) {
+            result.skipped++;
+            try {
+                fs.unlinkSync(filePath);
+            }
+            catch { /* ignore */ }
+            continue;
+        }
+        const sendResult = await sendProactiveTeamsMessageToSession({
+            friendId,
+            sessionKey: key,
+            text: messageText,
+            intent: "generic_outreach",
+        }, {
+            botApi,
+            store,
+        });
+        if (sendResult.delivered) {
+            result.sent++;
+            try {
+                fs.unlinkSync(filePath);
+            }
+            catch { /* ignore */ }
+            continue;
+        }
+        if (sendResult.reason === "friend_not_found" || sendResult.reason === "trust_skip" || sendResult.reason === "missing_target") {
+            result.skipped++;
+            try {
+                fs.unlinkSync(filePath);
+            }
+            catch { /* ignore */ }
+            continue;
+        }
+        result.failed++;
+    }
+    if (result.sent > 0 || result.skipped > 0 || result.failed > 0) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.teams_proactive_drain_complete",
+            message: "teams proactive drain complete",
+            meta: { sent: result.sent, skipped: result.skipped, failed: result.failed },
+        });
+    }
+    return result;
+}
+// Start the Teams app in DevtoolsPlugin mode (local dev) or Bot Service mode (real Teams).
+// Mode is determined by getTeamsConfig().clientId.
+// Text is always accumulated in textBuffer and flushed periodically (chunked streaming).
+//
+// Dual-bot support: if teamsSecondary is configured with a clientId, a second App
+// instance starts on an internal port and the primary app proxies requests from
+// /api/messages-secondary to it. This lets a single App Service serve two bot
+// registrations (e.g. one per tenant) without SDK modifications.
+function startTeamsApp() {
+    const teamsConfig = (0, config_2.getTeamsConfig)();
+    const { app, mode } = createBotApp(teamsConfig);
+    registerBotHandlers(app, "primary");
     if (!process.listeners("unhandledRejection").some((l) => l.__agentHandler)) {
         const handler = (err) => {
             const msg = err instanceof Error ? err.message : String(err);
@@ -686,11 +1091,54 @@ function startTeamsApp() {
         handler.__agentHandler = true;
         process.on("unhandledRejection", handler);
     }
-    app.event("error", ({ error }) => {
-        const msg = error instanceof Error ? error.message : String(error);
-        (0, runtime_1.emitNervesEvent)({ level: "error", event: "channel.app_error", component: "channels", message: msg, meta: {} });
-    });
-    const port = (0, config_2.getTeamsChannelConfig)().port;
+    /* v8 ignore next -- PORT env branch; runtime-only @preserve */
+    const port = process.env.PORT ? Number(process.env.PORT) : (0, config_2.getTeamsChannelConfig)().port;
     app.start(port);
-    (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.app_started", component: "channels", message: `Teams bot started on port ${port} with ${mode} (chunked streaming)`, meta: { port, mode } });
+    // Diagnostic: log tool count at startup to verify deploy
+    const startupTools = (0, tools_1.getToolsForChannel)((0, channel_1.getChannelCapabilities)("teams"));
+    const toolNames = startupTools.map((t) => t.function.name);
+    (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.app_started", component: "channels", message: `Teams bot started on port ${port} with ${mode} (chunked streaming)`, meta: { port, mode, toolCount: toolNames.length, hasProactive: toolNames.includes("teams_send_message") } });
+    // --- Secondary bot (dual-bot support) ---
+    // If teamsSecondary has a clientId, start a second App on an internal port
+    // and proxy /api/messages-secondary on the primary app to it.
+    /* v8 ignore start -- dual-bot proxy wiring; requires live Teams SDK + HTTP @preserve */
+    const secondaryConfig = (0, config_1.getTeamsSecondaryConfig)();
+    if (secondaryConfig.clientId) {
+        const { app: secondaryApp, mode: secondaryMode } = createBotApp(secondaryConfig);
+        registerBotHandlers(secondaryApp, "secondary");
+        secondaryApp.start(SECONDARY_INTERNAL_PORT);
+        (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.app_started", component: "channels", message: `Secondary bot started on internal port ${SECONDARY_INTERNAL_PORT} with ${secondaryMode}`, meta: { port: SECONDARY_INTERNAL_PORT, mode: secondaryMode } });
+        // Proxy: forward /api/messages-secondary on the primary app's Express
+        // to localhost:SECONDARY_INTERNAL_PORT/api/messages.
+        // The SDK's HttpPlugin exposes .post() bound to its Express instance.
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const httpPlugin = app.http;
+        httpPlugin.post("/api/messages-secondary", (req, res) => {
+            const body = JSON.stringify(req.body);
+            const proxyReq = http.request({
+                hostname: "127.0.0.1",
+                port: SECONDARY_INTERNAL_PORT,
+                path: "/api/messages",
+                method: "POST",
+                headers: {
+                    ...req.headers,
+                    "content-length": Buffer.byteLength(body).toString(),
+                },
+            }, (proxyRes) => {
+                res.writeHead(proxyRes.statusCode ?? 200, proxyRes.headers);
+                proxyRes.pipe(res);
+            });
+            proxyReq.on("error", (err) => {
+                (0, runtime_1.emitNervesEvent)({ level: "error", event: "channel.proxy_error", component: "channels", message: `secondary proxy error: ${err.message}`, meta: {} });
+                if (!res.headersSent) {
+                    res.writeHead(502);
+                    res.end("Bad Gateway");
+                }
+            });
+            proxyReq.write(body);
+            proxyReq.end();
+        });
+        (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.proxy_ready", component: "channels", message: "proxy /api/messages-secondary → secondary bot ready", meta: {} });
+    }
+    /* v8 ignore stop */
 }