@ouro.bot/cli 0.1.0-alpha.933 → 0.1.0-alpha.934

package/changelog.json

@@ -1,6 +1,16 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.934",
+      "changes": [
+        "Hold duplicate Teams activities durably before model execution, steering or quoted queuing, preserving receipts across restart and session reset.",
+        "Do not replay uncertain Teams sends after a lost acknowledgement; split-message recovery requires an explicit HTTP 413 and smaller payloads.",
+        "Preserve unconsumed Teams steering in its original request context, reject incomplete production identities, and bypass the SDK stream hidden retry loop with acknowledged single-attempt messages.",
+        "Keep distinct Teams fallback actors separate when optional AAD metadata is empty.",
+        "Include bot and request correlation context on Teams handler and SDK error telemetry."
+      ]
+    },
     {
       "version": "0.1.0-alpha.933",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.933",
+  "runtimeVersion": "0.1.0-alpha.934",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.933</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.934</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/mind/session-transaction.js

@@ -37,6 +37,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionTransactionError = exports.SessionTurnBusyError = void 0;
+exports.admitSessionActivity = admitSessionActivity;
 exports.acquireSessionTurnLease = acquireSessionTurnLease;
 exports.withSessionTurnLease = withSessionTurnLease;
 exports.withImmediateSessionTurnLease = withImmediateSessionTurnLease;
@@ -176,21 +177,78 @@ function checkTemporary(pin, filePath, identity) {
 function openLeaseDatabase(lockPath, busyTimeoutMs = 0, confinement = null) {
     checkConfinement(confinement);
     const database = new better_sqlite3_1.default(lockPath);
-    database.pragma(`busy_timeout = ${busyTimeoutMs}`);
-    database.exec(`
-    CREATE TABLE IF NOT EXISTS session_turn_lease (
-      singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
-      pid INTEGER NOT NULL,
-      owner_id TEXT NOT NULL,
-      owner_token TEXT NOT NULL
-    )
-  `);
-    const columns = new Set(database.prepare(`PRAGMA table_info(session_turn_lease)`).all().map((column) => column.name));
-    if (!columns.has("boot_identity"))
-        database.exec(`ALTER TABLE session_turn_lease ADD COLUMN boot_identity TEXT`);
-    if (!columns.has("process_started_at"))
-        database.exec(`ALTER TABLE session_turn_lease ADD COLUMN process_started_at TEXT`);
-    return database;
+    try {
+        database.pragma(`busy_timeout = ${busyTimeoutMs}`);
+        database.transaction(() => {
+            database.exec(`
+        CREATE TABLE IF NOT EXISTS session_turn_lease (
+          singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+          pid INTEGER NOT NULL,
+          owner_id TEXT NOT NULL,
+          owner_token TEXT NOT NULL
+        )
+      `);
+            const columns = new Set(database.prepare(`PRAGMA table_info(session_turn_lease)`).all().map((column) => column.name));
+            if (!columns.has("boot_identity"))
+                database.exec(`ALTER TABLE session_turn_lease ADD COLUMN boot_identity TEXT`);
+            if (!columns.has("process_started_at"))
+                database.exec(`ALTER TABLE session_turn_lease ADD COLUMN process_started_at TEXT`);
+        }).immediate();
+        return database;
+    }
+    catch (error) {
+        database.close();
+        throw error;
+    }
+}
+/** Immutable admission, not proof of execution or delivery. Unknown effects must never be replayed. */
+function admitSessionActivity(sessionPath, input) {
+    if (typeof input.namespace !== "string" || !input.namespace.trim() || Buffer.byteLength(input.namespace) > 4096
+        || typeof input.activityId !== "string" || !input.activityId.trim() || Buffer.byteLength(input.activityId) > 1024
+        || typeof input.payloadDigest !== "string" || !/^[a-f0-9]{64}$/.test(input.payloadDigest)) {
+        throw new SessionTransactionError("invalid session activity admission");
+    }
+    const canonical = canonicalSessionPath(sessionPath);
+    const lockPath = `${canonical}.turn.lock`;
+    fs.mkdirSync(path.dirname(canonical), { recursive: true, mode: 0o700 });
+    const receiptId = revision(JSON.stringify([input.namespace, input.activityId]));
+    const database = openLeaseDatabase(lockPath, 1000);
+    try {
+        database.pragma("synchronous = FULL");
+        const state = database.transaction(() => {
+            database.exec(`
+        CREATE TABLE IF NOT EXISTS session_activity_receipts (
+          receipt_id TEXT PRIMARY KEY,
+          payload_digest TEXT NOT NULL,
+          admitted_at TEXT NOT NULL
+        )
+      `);
+            const existing = database.prepare("SELECT payload_digest FROM session_activity_receipts WHERE receipt_id = ?")
+                .get(receiptId);
+            if (existing) {
+                if (typeof existing.payload_digest !== "string" || !/^[a-f0-9]{64}$/.test(existing.payload_digest)) {
+                    throw new SessionTransactionError("invalid session activity receipt");
+                }
+                if (existing.payload_digest !== input.payloadDigest)
+                    throw new SessionTransactionError("conflicting session activity payload");
+                return "duplicate";
+            }
+            // Never evict an admission: losing its identity would authorize uncertain work again.
+            if (fs.statSync(lockPath).size >= 64 * 1024 * 1024)
+                throw new SessionTransactionError("session activity receipt capacity exceeded");
+            database.prepare("INSERT INTO session_activity_receipts (receipt_id, payload_digest, admitted_at) VALUES (?, ?, ?)")
+                .run(receiptId, input.payloadDigest, new Date().toISOString());
+            return "admitted";
+        }).immediate();
+        (0, runtime_1.emitNervesEvent)({
+            component: "mind", event: "mind.session_activity_admission", message: "recorded session activity admission decision",
+            meta: { receiptId, state },
+        });
+        return { state, receiptId };
+    }
+    finally {
+        database.close();
+    }
 }
 function acquisitionRecord(options) {
     const pid = options.pid ?? process.pid;

package/dist/senses/teams.js

@@ -72,6 +72,7 @@ const tool_activity_callbacks_1 = require("../heart/tool-activity-callbacks");
 const commands_2 = require("./commands");
 const http = __importStar(require("http"));
 const path = __importStar(require("path"));
+const node_crypto_1 = require("node:crypto");
 const trust_gate_1 = require("./trust-gate");
 const pipeline_1 = require("./pipeline");
 const session_transaction_1 = require("../mind/session-transaction");
@@ -195,6 +196,11 @@ function buildWelcomeCard() {
 // safeSend (ctx.send). Tool results, kicks, and errors use safeUpdate
 // (transient status) or safeSend (terminal errors). Reasoning is accumulated
 // and periodically pushed via safeUpdate on the same flush timer tick.
+function isTeamsSizeRejection(error) {
+    return typeof error === "object" && error !== null && "response" in error
+        && typeof error.response === "object" && error.response !== null && "status" in error.response
+        && error.response.status === 413;
+}
 function createTeamsCallbacks(stream, controller, sendMessage, options) {
     const MIN_INITIAL_CHARS = 20;
     let stopped = false; // set when stream signals cancellation (403)
@@ -298,18 +304,22 @@ function createTeamsCallbacks(stream, controller, sendMessage, options) {
         /* v8 ignore next -- defensive guard: stopped set by prior error; tested via flush abort path @preserve */
         if (stopped)
             return false;
+        let awaitingTransport = false;
         try {
             // stream.emit() is typed as void but the Teams SDK returns a Promise
             // internally (async HTTP). Cast to capture the result for awaiting.
             const result = stream.emit(streamChunk(text));
             streamHasContent = true;
             if (result && typeof result.then === "function") {
+                awaitingTransport = true;
                 await result;
             }
             return true;
         }
         catch (err) {
             markStopped("tryEmit", err);
+            if (awaitingTransport && !isTeamsSizeRejection(err))
+                throw err;
             return false;
         }
     }
@@ -321,15 +331,21 @@ function createTeamsCallbacks(stream, controller, sendMessage, options) {
     // which has a sendMessage fallback that may still succeed. Caller (flushNow) is
     // responsible for the `!stopped` precondition; no defensive guard here.
     async function tryEmitNoAbort(text) {
+        let awaitingTransport = false;
         try {
             const result = stream.emit(streamChunk(text));
             streamHasContent = true;
             if (result && typeof result.then === "function") {
+                awaitingTransport = true;
                 await result;
             }
             return true;
         }
-        catch {
+        catch (error) {
+            if (awaitingTransport && !isTeamsSizeRejection(error)) {
+                markStopped("speak-unknown", error);
+                throw error;
+            }
             return false;
         }
     }
@@ -606,7 +622,10 @@ function createTeamsCallbacks(stream, controller, sendMessage, options) {
                     try {
                         await sendMessage(text);
                     }
-                    catch {
+                    catch (error) {
+                        // A lost acknowledgement is not a rejection. Only a definite size rejection permits a smaller retry.
+                        if (!isTeamsSizeRejection(error) || text.length <= RECOVERY_CHUNK_SIZE)
+                            throw error;
                         const chunks = splitMessage(text, RECOVERY_CHUNK_SIZE);
                         for (const chunk of chunks)
                             await sendMessage(chunk);
@@ -636,19 +655,34 @@ const _turnCoordinator = (0, turn_coordinator_1.createTurnCoordinator)();
 function teamsTurnKey(conversationId) {
     return `teams:${conversationId}`;
 }
+function teamsAdmissionKey(conversationId) {
+    return `teams-admission:${conversationId}`;
+}
 const queuedTeamsTurns = new Map();
 const activeTeamsActors = new Map();
+const consumingTeamsSteering = new Set();
+function drainTeamsSteering(key) {
+    const followUps = _turnCoordinator.drainFollowUps(key);
+    const consumed = new Set(followUps);
+    const queue = queuedTeamsTurns.get(key);
+    if (queue)
+        queuedTeamsTurns.set(key, queue.filter(turn => !turn.steering || !consumed.has(turn.steering)));
+    return followUps;
+}
 /** Context-bearing replies cannot steer an already-running tool loop. Keep the
  * original SDK context/transport alive until a fresh handleTeamsMessage lease.
  * Ordinary same-actor steering still uses the existing coordinator buffer. */
 async function coordinateTeamsTurn(conversationId, text, identity, run) {
     const key = teamsTurnKey(conversationId);
-    const actorKey = JSON.stringify([identity.aadObjectId ?? identity.userId ?? "", identity.tenantId ?? ""]);
+    const actorKey = JSON.stringify([identity.aadObjectId || identity.userId || "", identity.tenantId ?? ""]);
     if (!_turnCoordinator.tryBeginTurn(key)) {
-        if (!identity.replyToId && !/\bfeedback:/i.test(text) &&
-            activeTeamsActors.get(key) === actorKey && !queuedTeamsTurns.get(key)?.length) {
-            _turnCoordinator.enqueueFollowUp(key, { conversationId, text, receivedAt: Date.now(),
-                effect: (0, continuity_1.classifySteeringFollowUpEffect)(text) });
+        if (!identity.replyToId && !/\bfeedback:/i.test(text) && consumingTeamsSteering.has(key) &&
+            activeTeamsActors.get(key) === actorKey && !queuedTeamsTurns.get(key)?.some(turn => !turn.steering)) {
+            const steering = { conversationId, text, receivedAt: Date.now(), effect: (0, continuity_1.classifySteeringFollowUpEffect)(text) };
+            _turnCoordinator.enqueueFollowUp(key, steering);
+            const queue = queuedTeamsTurns.get(key) ?? [];
+            queue.push({ actorKey, run, steering, resolve: () => { }, reject: () => { } });
+            queuedTeamsTurns.set(key, queue);
             return;
         }
         await new Promise((resolve, reject) => {
@@ -664,6 +698,12 @@ async function coordinateTeamsTurn(conversationId, text, identity, run) {
     try {
         while (next) {
             activeTeamsActors.set(key, next.actorKey);
+            if (next.steering) {
+                for (const followUp of _turnCoordinator.drainFollowUps(key)) {
+                    if (followUp !== next.steering)
+                        _turnCoordinator.enqueueFollowUp(key, followUp);
+                }
+            }
             try {
                 await next.run();
                 next.resolve();
@@ -674,6 +714,8 @@ async function coordinateTeamsTurn(conversationId, text, identity, run) {
                 next.reject(error);
             }
             first = false;
+            // Preserve received order while identity/admission I/O finishes, without holding admission through a model turn.
+            await _turnCoordinator.withTurnLock(teamsAdmissionKey(conversationId), async () => { });
             next = queuedTeamsTurns.get(key)?.shift();
         }
     }
@@ -786,7 +828,7 @@ async function handleTeamsMessage(text, stream, conversationId, teamsContext, se
             catch (error) {
                 if (!(error instanceof feedback_reply_1.FeedbackReplyRefusal))
                     throw error;
-                stream.emit(error.message);
+                await stream.emit(error.message);
                 return;
             }
             // Do not emit any activity until this turn owns the durable session.
@@ -818,7 +860,7 @@ async function handleTeamsMessage(text, stream, conversationId, teamsContext, se
                     },
                     mcpManager,
                     drainSteeringFollowUps: () => {
-                        drainedSteeringFollowUps = _turnCoordinator.drainFollowUps(turnKey)
+                        drainedSteeringFollowUps = drainTeamsSteering(turnKey)
                             .map(({ text: followUpText, effect }) => ({ text: followUpText, effect }));
                         return drainedSteeringFollowUps;
                     },
@@ -881,16 +923,24 @@ async function handleTeamsMessage(text, stream, conversationId, teamsContext, se
                     enforceTrustGate: trust_gate_1.enforceTrustGate,
                     drainPending: pending_1.drainPending,
                     drainDeferredReturns: (deferredFriendId) => (0, pending_1.drainDeferredReturns)(agentName, deferredFriendId),
-                    runAgent: (msgs, cb, channel, sig, opts) => (0, core_1.runAgent)(msgs, cb, channel, sig, {
-                        ...opts,
-                        toolContext: {
-                            /* v8 ignore next -- default no-op signin; pipeline provides the real one @preserve */
-                            signin: async () => undefined,
-                            ...opts?.toolContext,
-                            ...owner,
-                            summarize: teamsToolContext.summarize,
-                        },
-                    }),
+                    runAgent: async (msgs, cb, channel, sig, opts) => {
+                        consumingTeamsSteering.add(turnKey);
+                        try {
+                            return await (0, core_1.runAgent)(msgs, cb, channel, sig, {
+                                ...opts,
+                                toolContext: {
+                                    /* v8 ignore next -- default no-op signin; pipeline provides the real one @preserve */
+                                    signin: async () => undefined,
+                                    ...opts?.toolContext,
+                                    ...owner,
+                                    summarize: teamsToolContext.summarize,
+                                },
+                            });
+                        }
+                        finally {
+                            consumingTeamsSteering.delete(turnKey);
+                        }
+                    },
                     postTurn: (turnMessages, sessionPathArg, usage, hooks, state) => {
                         const prepared = (0, context_1.postTurnTrim)(turnMessages, usage, hooks);
                         return (0, context_1.deferPostTurnPersist)(sessionPathArg, prepared, usage, state);
@@ -916,7 +966,7 @@ async function handleTeamsMessage(text, stream, conversationId, teamsContext, se
                 if (result.turnOutcome === "command") {
                     if (result.commandAction === "new") {
                         (0, context_1.deleteSession)(sessPath);
-                        stream.emit("session cleared");
+                        await stream.emit("session cleared");
                     }
                     // For "response" commands: pipeline already emitted the response via onTextChunk
                     await callbacks.flush();
@@ -924,7 +974,7 @@ async function handleTeamsMessage(text, stream, conversationId, teamsContext, se
                 }
                 /* v8 ignore start -- failover display: tested via pipeline integration tests @preserve */
                 if (result.failoverMessage) {
-                    stream.emit(result.failoverMessage);
+                    await stream.emit(result.failoverMessage);
                 }
                 else if (capturedTerminalError) {
                     callbacks.onError(capturedTerminalError, "terminal");
@@ -933,7 +983,7 @@ async function handleTeamsMessage(text, stream, conversationId, teamsContext, se
                 // ── Handle gate result ────────────────────────────────────────
                 if (!result.gateResult.allowed) {
                     if ("autoReply" in result.gateResult && result.gateResult.autoReply) {
-                        stream.emit(result.gateResult.autoReply);
+                        await stream.emit(result.gateResult.autoReply);
                     }
                     return;
                 }
@@ -981,7 +1031,7 @@ async function handleTeamsMessage(text, stream, conversationId, teamsContext, se
     catch (error) {
         if (error instanceof session_transaction_1.SessionTurnBusyError || (error instanceof Error && error.name === "SessionTurnBusyError")) {
             reportTeamsRequest("failed", conversationId, teamsContext, { traceId, reason: "lease_busy" });
-            stream.emit("this conversation is busy finishing another turn; please try again");
+            await stream.emit("this conversation is busy finishing another turn; please try again");
             return;
         }
         reportTeamsRequest("failed", conversationId, teamsContext, { traceId, reason: "turn_failed" });
@@ -1173,7 +1223,7 @@ function registerBotHandlers(app, label) {
     });
     /* v8 ignore stop */
     app.on("message", async (ctx) => {
-        const { stream, activity, api, signin } = ctx;
+        const { activity, api, signin } = ctx;
         const text = activity.text || "";
         const convId = activity.conversation?.id || "unknown";
         const turnKey = teamsTurnKey(convId);
@@ -1183,126 +1233,172 @@ function registerBotHandlers(app, label) {
             inboundActivityId: activity.id, tenantId: activity.conversation?.tenantId,
             botApi: app.id && api ? { id: app.id, conversations: api.conversations } : undefined,
         };
+        const sendText = async (text) => {
+            try {
+                const receipt = await ctx.send({ type: "message", text, replyToId: activity.id, entities: aiLabelEntities(), channelData: { feedbackLoopEnabled: true } });
+                const messageId = receipt && typeof receipt === "object" && "id" in receipt && typeof receipt.id === "string" ? receipt.id : undefined;
+                reportTeamsRequest(messageId ? "replied" : "reply_emitted", convId, requestContext, { delivery: messageId ? "accepted" : "unconfirmed", ...(messageId ? { outboundActivityId: messageId } : {}) });
+            }
+            catch (error) {
+                reportTeamsRequest("failed", convId, requestContext, { reason: "send_unknown" });
+                throw error;
+            }
+        };
+        // HttpStream queues void emits and retries unknown HTTP failures internally.
+        // Use the SDK's single-attempt, awaitable send instead of that hidden retry loop.
+        const stream = {
+            emit: value => sendText(typeof value === "string" ? value : value.text),
+            update: () => ctx.send({ type: "typing" }),
+            close: async () => undefined,
+        };
         (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.message_received", component: "channels", message: `[${label}] incoming teams message`, meta: { stage: "received", inboundActivityId: activity.id, botId: app.id, tenantId: requestContext.tenantId, userId: userId.slice(0, 12), conversationId: convId } });
-        const commandRegistry = createTeamsCommandRegistry();
-        const parsedSlashCommand = (0, commands_1.parseSlashCommand)(text);
-        if (parsedSlashCommand) {
-            const dispatchResult = commandRegistry.dispatch(parsedSlashCommand.command, { channel: "teams" });
-            if (dispatchResult.handled && dispatchResult.result) {
-                if (dispatchResult.result.action === "response") {
-                    stream.emit(dispatchResult.result.message || "");
-                    return;
+        let work;
+        await _turnCoordinator.withTurnLock(teamsAdmissionKey(convId), async () => {
+            try {
+                if (process.env.OURO_TEAMS_DEVTOOLS !== "1" && [
+                    app.id, activity.id, activity.channelId, activity.conversation?.id,
+                    activity.conversation?.tenantId, activity.from?.aadObjectId || activity.from?.id,
+                ].some(value => typeof value !== "string" || !value.trim())) {
+                    throw new session_transaction_1.SessionTransactionError("Teams activity identity is incomplete");
                 }
-                if (dispatchResult.result.action === "new") {
-                    const commandStore = getFriendStore();
-                    const commandProvider = activity.from?.aadObjectId ? "aad" : "teams-conversation";
-                    const commandExternalId = activity.from?.aadObjectId || convId;
-                    const commandResolver = new friends_1.FriendResolver(commandStore, {
-                        provider: commandProvider,
-                        externalId: commandExternalId,
+                if (activity.id) {
+                    const store = getFriendStore();
+                    const identity = await new friends_1.FriendResolver(store, {
+                        provider: activity.from?.aadObjectId ? "aad" : "teams-conversation",
+                        externalId: activity.from?.aadObjectId || convId,
                         tenantId: activity.conversation?.tenantId,
                         displayName: activity.from?.name || "Unknown",
                         channel: "teams",
+                    }).resolve();
+                    const admission = (0, session_transaction_1.admitSessionActivity)((0, config_2.sessionPath)(identity.friend.id, "teams", convId), {
+                        namespace: JSON.stringify(["teams.message", channelId, app.id?.toLowerCase() ?? null,
+                            activity.conversation?.tenantId?.toLowerCase() ?? null,
+                            activity.from?.aadObjectId?.toLowerCase() || userId, convId]),
+                        activityId: activity.id,
+                        payloadDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify([text, activity.replyToId ?? null])).digest("hex"),
                     });
-                    const commandContext = await commandResolver.resolve();
-                    (0, context_1.deleteSession)((0, config_2.sessionPath)(commandContext.friend.id, "teams", convId));
-                    stream.emit("session cleared");
-                    if (_turnCoordinator.isTurnActive(turnKey)) {
-                        _turnCoordinator.enqueueFollowUp(turnKey, {
-                            conversationId: convId,
-                            text,
-                            receivedAt: Date.now(),
-                            effect: "clear_and_supersede",
-                        });
+                    if (admission.state === "duplicate") {
+                        reportTeamsRequest("duplicate_held", convId, requestContext, { receiptId: admission.receiptId, outcome: "not_replayed" });
+                        return;
                     }
-                    return;
                 }
-            }
-        }
-        await coordinateTeamsTurn(convId, text, {
-            aadObjectId: activity.from?.aadObjectId, userId, tenantId: activity.conversation?.tenantId,
-            replyToId: activity.replyToId,
-        }, async () => {
-            try {
                 reportTeamsRequest("admitted", convId, requestContext);
-                // Resolve OAuth connection names for this user's tenant (supports per-tenant overrides).
-                const tenantId = activity.conversation?.tenantId;
-                const tenantOAuth = (0, config_1.resolveOAuthForTenant)(tenantId);
-                // Fetch tokens for both OAuth connections independently.
-                // Failures are silently caught -- the tool handler will request signin if needed.
-                let graphToken;
-                let adoToken;
-                let githubToken;
-                try {
-                    const graphRes = await api.users.token.get({ userId, connectionName: tenantOAuth.graphConnectionName, channelId });
-                    graphToken = graphRes?.token;
-                }
-                catch { /* no token yet — tool handler will trigger signin */ }
-                try {
-                    const adoRes = await api.users.token.get({ userId, connectionName: tenantOAuth.adoConnectionName, channelId });
-                    adoToken = adoRes?.token;
+            }
+            catch (error) {
+                reportTeamsRequest("failed", convId, requestContext, { reason: "activity_admission_failed" });
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error", component: "channels", event: "channel.activity_admission_error",
+                    message: "Teams activity was not safely admitted; no new turn or steering was started",
+                    meta: { conversationId: convId, inboundActivityId: activity.id, reason: "activity_admission_failed" },
+                });
+                throw error;
+            }
+            const commandRegistry = createTeamsCommandRegistry();
+            const parsedSlashCommand = (0, commands_1.parseSlashCommand)(text);
+            if (parsedSlashCommand) {
+                const dispatchResult = commandRegistry.dispatch(parsedSlashCommand.command, { channel: "teams" });
+                if (dispatchResult.handled && dispatchResult.result) {
+                    if (dispatchResult.result.action === "response") {
+                        await stream.emit(dispatchResult.result.message || "");
+                        return;
+                    }
+                    if (dispatchResult.result.action === "new") {
+                        const commandStore = getFriendStore();
+                        const commandProvider = activity.from?.aadObjectId ? "aad" : "teams-conversation";
+                        const commandExternalId = activity.from?.aadObjectId || convId;
+                        const commandResolver = new friends_1.FriendResolver(commandStore, {
+                            provider: commandProvider,
+                            externalId: commandExternalId,
+                            tenantId: activity.conversation?.tenantId,
+                            displayName: activity.from?.name || "Unknown",
+                            channel: "teams",
+                        });
+                        const commandContext = await commandResolver.resolve();
+                        (0, context_1.deleteSession)((0, config_2.sessionPath)(commandContext.friend.id, "teams", convId));
+                        await stream.emit("session cleared");
+                        if (_turnCoordinator.isTurnActive(turnKey)) {
+                            _turnCoordinator.enqueueFollowUp(turnKey, {
+                                conversationId: convId,
+                                text,
+                                receivedAt: Date.now(),
+                                effect: "clear_and_supersede",
+                            });
+                        }
+                        return;
+                    }
                 }
-                catch { /* no token yet — tool handler will trigger signin */ }
+            }
+            work = coordinateTeamsTurn(convId, text, {
+                aadObjectId: activity.from?.aadObjectId, userId, tenantId: activity.conversation?.tenantId,
+                replyToId: activity.replyToId,
+            }, async () => {
                 try {
-                    const githubRes = await api.users.token.get({ userId, connectionName: tenantOAuth.githubConnectionName, channelId });
-                    githubToken = githubRes?.token;
-                }
-                catch { /* no token yet — tool handler will trigger signin */ }
-                (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.token_status", component: "channels", message: "oauth token availability", meta: { graph: !!graphToken, ado: !!adoToken, github: !!githubToken, tenantId } });
-                const teamsContext = {
-                    inboundActivityId: activity.id,
-                    replyToId: activity.replyToId,
-                    graphToken,
-                    adoToken,
-                    githubToken,
-                    signin: async (cn) => {
-                        try {
-                            const result = await signin({ connectionName: cn });
-                            (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.signin_result", component: "channels", message: `signin(${cn}): ${result ? "token received" : "no token"}`, meta: { connectionName: cn, hasToken: !!result } });
-                            return result;
-                        }
-                        catch (e) {
-                            const msg = e instanceof Error ? e.message : String(e);
-                            (0, runtime_1.emitNervesEvent)({ level: "error", event: "channel.signin_error", component: "channels", message: `signin(${cn}) failed`, meta: { connectionName: cn, reason: msg.slice(0, 100) } });
-                            return undefined;
-                        }
-                    },
-                    aadObjectId: activity.from?.aadObjectId,
-                    tenantId: activity.conversation?.tenantId,
-                    displayName: activity.from?.name,
-                    graphConnectionName: tenantOAuth.graphConnectionName,
-                    adoConnectionName: tenantOAuth.adoConnectionName,
-                    githubConnectionName: tenantOAuth.githubConnectionName,
-                    /* v8 ignore next -- bot API availability branch; requires live SDK context @preserve */
-                    botApi: app.id && api ? { id: app.id, conversations: api.conversations } : undefined,
-                    teamsSendImage: (0, teams_image_1.createTeamsImageSender)((message) => ctx.send(message), activity.id, aiLabelEntities()),
-                };
-                /* v8 ignore next 5 -- bot-framework integration callback; tested via handleTeamsMessage sendMessage path @preserve */
-                const ctxSend = async (t) => {
-                    // Use send with replyToId (not reply, which adds a blockquote).
-                    // replyToId anchors the message after the user's message in Copilot Chat.
+                    // Resolve OAuth connection names for this user's tenant (supports per-tenant overrides).
+                    const tenantId = activity.conversation?.tenantId;
+                    const tenantOAuth = (0, config_1.resolveOAuthForTenant)(tenantId);
+                    // Fetch tokens for both OAuth connections independently.
+                    // Failures are silently caught -- the tool handler will request signin if needed.
+                    let graphToken;
+                    let adoToken;
+                    let githubToken;
                     try {
-                        const receipt = await ctx.send({ type: "message", text: t, replyToId: activity.id, entities: aiLabelEntities(), channelData: { feedbackLoopEnabled: true } });
-                        const messageId = receipt && typeof receipt === "object" && "id" in receipt && typeof receipt.id === "string" ? receipt.id : undefined;
-                        reportTeamsRequest(messageId ? "replied" : "reply_emitted", convId, teamsContext, { delivery: messageId ? "accepted" : "unconfirmed", ...(messageId ? { outboundActivityId: messageId } : {}) });
+                        const graphRes = await api.users.token.get({ userId, connectionName: tenantOAuth.graphConnectionName, channelId });
+                        graphToken = graphRes?.token;
                     }
-                    catch (error) {
-                        reportTeamsRequest("failed", convId, teamsContext, { reason: "send_unknown" });
-                        throw error;
+                    catch { /* no token yet — tool handler will trigger signin */ }
+                    try {
+                        const adoRes = await api.users.token.get({ userId, connectionName: tenantOAuth.adoConnectionName, channelId });
+                        adoToken = adoRes?.token;
                     }
-                };
-                await handleTeamsMessage(text, stream, convId, teamsContext, ctxSend);
-            }
-            catch (err) {
-                reportTeamsRequest("failed", convId, requestContext, { reason: "handler_failed" });
-                const msg = err instanceof Error ? err.message : String(err);
-                (0, runtime_1.emitNervesEvent)({ level: "error", event: "channel.handler_error", component: "channels", message: msg.slice(0, 200), meta: {} });
-            }
+                    catch { /* no token yet — tool handler will trigger signin */ }
+                    try {
+                        const githubRes = await api.users.token.get({ userId, connectionName: tenantOAuth.githubConnectionName, channelId });
+                        githubToken = githubRes?.token;
+                    }
+                    catch { /* no token yet — tool handler will trigger signin */ }
+                    (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.token_status", component: "channels", message: "oauth token availability", meta: { graph: !!graphToken, ado: !!adoToken, github: !!githubToken, tenantId } });
+                    const teamsContext = {
+                        inboundActivityId: activity.id,
+                        replyToId: activity.replyToId,
+                        graphToken,
+                        adoToken,
+                        githubToken,
+                        signin: async (cn) => {
+                            try {
+                                const result = await signin({ connectionName: cn });
+                                (0, runtime_1.emitNervesEvent)({ level: "info", event: "channel.signin_result", component: "channels", message: `signin(${cn}): ${result ? "token received" : "no token"}`, meta: { connectionName: cn, hasToken: !!result } });
+                                return result;
+                            }
+                            catch (e) {
+                                const msg = e instanceof Error ? e.message : String(e);
+                                (0, runtime_1.emitNervesEvent)({ level: "error", event: "channel.signin_error", component: "channels", message: `signin(${cn}) failed`, meta: { connectionName: cn, reason: msg.slice(0, 100) } });
+                                return undefined;
+                            }
+                        },
+                        aadObjectId: activity.from?.aadObjectId,
+                        tenantId: activity.conversation?.tenantId,
+                        displayName: activity.from?.name,
+                        graphConnectionName: tenantOAuth.graphConnectionName,
+                        adoConnectionName: tenantOAuth.adoConnectionName,
+                        githubConnectionName: tenantOAuth.githubConnectionName,
+                        /* v8 ignore next -- bot API availability branch; requires live SDK context @preserve */
+                        botApi: app.id && api ? { id: app.id, conversations: api.conversations } : undefined,
+                        teamsSendImage: (0, teams_image_1.createTeamsImageSender)((message) => ctx.send(message), activity.id, aiLabelEntities()),
+                    };
+                    await handleTeamsMessage(text, stream, convId, teamsContext, sendText);
+                }
+                catch (err) {
+                    reportTeamsRequest("failed", convId, requestContext, { reason: "handler_failed" });
+                    const msg = err instanceof Error ? err.message : String(err);
+                    (0, runtime_1.emitNervesEvent)({ level: "error", event: "channel.handler_error", component: "channels", message: msg.slice(0, 200), meta: { conversationId: convId, inboundActivityId: activity.id, botId: app.id } });
+                }
+            });
         });
+        await work;
     });
     app.event("error", ({ error }) => {
         const msg = error instanceof Error ? error.message : String(error);
-        (0, runtime_1.emitNervesEvent)({ level: "error", event: "channel.app_error", component: "channels", message: `[${label}] ${msg}`, meta: {} });
+        (0, runtime_1.emitNervesEvent)({ level: "error", event: "channel.app_error", component: "channels", message: `[${label}] ${msg}`, meta: { botId: app.id, label } });
     });
 }
 function findAadObjectId(friend) {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.933",
+  "version": "0.1.0-alpha.934",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.933",
+      "version": "0.1.0-alpha.934",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.933",
+  "version": "0.1.0-alpha.934",
   "engines": {
     "node": ">=22"
   },