@patimweb/pi-teams 1.0.0 → 1.1.0

package/src/config/index.ts

@@ -37,6 +37,7 @@ import {
 	type PermissionBlock,
 	type ResolvedPermissions,
 } from "./scope.ts";
+import { canOpenBrowser } from "../utils/environment.ts";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -45,15 +46,23 @@ import {
 /**
  * How pi obtains a token.
  *
- * - `device-code`: delegated. pi acts **as the signed-in user** — messages are
- *   sent from their account and everything they can see, pi can see.
+ * - `interactive`: delegated. The browser opens at the Microsoft sign-in page
+ *   and MSAL catches the redirect on a loopback port. pi then acts **as the
+ *   signed-in user** — messages come from their account, and everything they
+ *   can see, pi can see.
+ * - `device-code`: delegated as well, but the user types a short code on
+ *   another device. For SSH sessions, containers, and anything headless.
  * - `client-credentials`: app-only. No user identity; Microsoft Graph does not
  *   allow posting chat or channel messages this way (outside of migration
  *   scenarios), so writes are refused with an explanation.
- * - `auto`: use `client-credentials` when a secret is configured, otherwise
- *   `device-code`.
+ * - `auto`: `client-credentials` when a secret is configured, otherwise
+ *   `interactive` where a browser is reachable and `device-code` where it is
+ *   not.
  */
-export type AuthMode = "device-code" | "client-credentials" | "auto";
+export type AuthMode = "interactive" | "device-code" | "client-credentials" | "auto";
+
+/** An auth mode after "auto" has been resolved away. */
+export type ResolvedAuthMode = "interactive" | "device-code" | "client-credentials";
 
 /** Safety level for mutation operations. */
 export type SafetyLevel = "open" | "confirm" | "readonly";
@@ -72,6 +81,8 @@ export interface TenantConfig {
 	authMode?: AuthMode;
 	/** Requested Graph scopes override */
 	scopes?: string[];
+	/** Fixed loopback port for the browser sign-in redirect */
+	loopbackPort?: number;
 	/** Safety level override — most specific wins */
 	safetyLevel?: SafetyLevel;
 	/** Scope rules layered on top of the account's */
@@ -94,6 +105,14 @@ export interface AccountConfig {
 	authMode?: AuthMode;
 	/** Requested Graph scopes (default: DEFAULT_SCOPES) */
 	scopes?: string[];
+	/**
+	 * Fixed loopback port for the browser sign-in redirect.
+	 *
+	 * Only needed where the app registration lists an exact redirect URI such
+	 * as `http://localhost:3000`; by default MSAL picks a free port and Entra
+	 * accepts any port on localhost for a public client.
+	 */
+	loopbackPort?: number;
 	/** Safety level override */
 	safetyLevel?: SafetyLevel;
 	/** Scope rules layered on top of the global ones */
@@ -136,8 +155,10 @@ export interface TeamsConnection {
 	clientId: string;
 	clientSecret?: string;
 	/** Effective auth mode — never "auto" after resolution */
-	authMode: "device-code" | "client-credentials";
+	authMode: ResolvedAuthMode;
 	scopes: string[];
+	/** Fixed loopback port for the browser sign-in, when one is configured */
+	loopbackPort?: number;
 	safetyLevel: SafetyLevel;
 	permissions: ResolvedPermissions;
 	maxMessages: number;
@@ -165,13 +186,11 @@ export class ConfigError extends Error {
 /**
  * Delegated scopes requested by default.
  *
- * `offline_access` is what makes the sign-in last: without it pi would have to
- * ask for a device code again every hour.
+ * `openid`, `profile` and `offline_access` are absent on purpose: MSAL always
+ * requests them and rejects them in an explicit scope list. The lasting
+ * sign-in they buy is therefore automatic.
  */
 export const DEFAULT_SCOPES: string[] = [
-	"offline_access",
-	"openid",
-	"profile",
 	"User.Read",
 	"User.ReadBasic.All",
 	"Team.ReadBasic.All",
@@ -201,7 +220,12 @@ const DEFAULTS = {
 	authorityHost: "https://login.microsoftonline.com",
 };
 
-const VALID_AUTH_MODES = new Set<string>(["device-code", "client-credentials", "auto"]);
+const VALID_AUTH_MODES = new Set<string>([
+	"interactive",
+	"device-code",
+	"client-credentials",
+	"auto",
+]);
 const VALID_SAFETY_LEVELS = new Set<string>(["open", "confirm", "readonly"]);
 
 // ---------------------------------------------------------------------------
@@ -299,18 +323,27 @@ export function resolveEffectiveSafetyLevel(
 	);
 }
 
-/** Effective auth mode, resolving "auto" against the available credentials. */
+/**
+ * Effective auth mode, resolving "auto" against the available credentials and
+ * the environment.
+ *
+ * `browserAvailable` is injected rather than detected here so the cascade stays
+ * a pure function — the detection itself lives in ../auth/msal.ts.
+ */
 export function resolveAuthMode(
 	account: AccountConfig | undefined,
 	tenant: TenantConfig | undefined,
 	hasSecret: boolean,
-): "device-code" | "client-credentials" {
+	browserAvailable = true,
+): ResolvedAuthMode {
 	const configured =
 		validateAuthMode(tenant?.authMode) ??
 		validateAuthMode(account?.authMode) ??
 		DEFAULTS.authMode;
-	if (configured === "auto") return hasSecret ? "client-credentials" : "device-code";
-	return configured;
+
+	if (configured !== "auto") return configured;
+	if (hasSecret) return "client-credentials";
+	return browserAvailable ? "interactive" : "device-code";
 }
 
 // ---------------------------------------------------------------------------
@@ -395,7 +428,7 @@ export function resolveConnection(
 	if (missing.length > 0) throw new ConfigError(missing);
 
 	const clientSecret = tenant?.clientSecret ?? account.clientSecret ?? undefined;
-	const authMode = resolveAuthMode(account, tenant, !!clientSecret);
+	const authMode = resolveAuthMode(account, tenant, !!clientSecret, canOpenBrowser());
 
 	if (authMode === "client-credentials" && !clientSecret) {
 		throw new ConfigError(
@@ -417,6 +450,7 @@ export function resolveConnection(
 		clientId,
 		clientSecret,
 		authMode,
+		loopbackPort: tenant?.loopbackPort ?? account.loopbackPort,
 		scopes,
 		safetyLevel: resolveEffectiveSafetyLevel(config.safetyLevel, account, tenant),
 		permissions: resolvePermissions([config.permissions, account.permissions, tenant?.permissions]),
@@ -644,7 +678,7 @@ const TEMPLATE_JSON = `{
       "displayName": "Work account",
       "tenantId": "contoso.onmicrosoft.com",
       "clientId": "00000000-0000-0000-0000-000000000000",
-      "authMode": "device-code",
+      "authMode": "interactive",
       "safetyLevel": "confirm",
       "permissions": {
         "read": {

package/src/safety/index.ts

@@ -18,7 +18,7 @@
  * which channel a message is actually headed for.
  */
 
-import type { SafetyLevel, TeamsConnection } from "../config/index.ts";
+import type { ResolvedAuthMode, SafetyLevel, TeamsConnection } from "../config/index.ts";
 import { checkScope, type ScopeCategory, type ScopeMode } from "../config/scope.ts";
 import { ScopeDeniedError } from "../utils/errors.ts";
 import { MUTATION_TOOLS } from "../tools/tool-names.ts";
@@ -47,7 +47,7 @@ export const LOCAL_CONFIG_TOOLS = new Set<string>(["teams_setup", "teams_logout"
  */
 export function blockReason(
 	safetyLevel: SafetyLevel,
-	authMode: "device-code" | "client-credentials",
+	authMode: ResolvedAuthMode,
 	toolName: string,
 ): string | undefined {
 	if (!isMutationTool(toolName)) return undefined;
@@ -64,7 +64,7 @@ export function blockReason(
 		return (
 			`"${toolName}" cannot run on an app-only token. Microsoft Graph only permits app-only writes to ` +
 			`chats and channels for migration scenarios, so pi cannot post as a person this way. ` +
-			`Set authMode to "device-code" for this account and run teams_login.`
+			`Set authMode to "interactive" for this account and run teams_login.`
 		);
 	}
 

package/src/status.ts

@@ -6,7 +6,7 @@
  */
 
 import type { TeamsConnection } from "./config/index.ts";
-import { getToken, isFresh } from "./auth/token-store.ts";
+import { readCacheSummary } from "./auth/cache-plugin.ts";
 import { formatPermissions } from "./config/scope.ts";
 
 /** Immutable snapshot of the active Teams connection. */
@@ -34,7 +34,7 @@ export function buildConnectionCard(
 ): ConnectionCard | undefined {
 	if (!conn) return undefined;
 
-	const token = getToken(conn.account, conn.tenantId);
+	const cache = readCacheSummary(conn.account, conn.tenantId);
 
 	return {
 		account: conn.account,
@@ -43,9 +43,11 @@ export function buildConnectionCard(
 		tenantId: conn.tenantId,
 		authMode: conn.authMode,
 		safetyLevel: conn.safetyLevel,
-		user: token?.user?.upn ?? token?.user?.displayName,
-		signedIn: isFresh(token) || !!token?.refreshToken,
-		expiresAt: token ? new Date(token.expiresAt).toISOString() : undefined,
+		user: cache.username ?? cache.name,
+		// A cached session counts as signed in even when the access token has
+		// expired: MSAL renews it silently on the next call.
+		signedIn: cache.present,
+		expiresAt: cache.expiresAt ? new Date(cache.expiresAt).toISOString() : undefined,
 		otherAccounts: conn.allAccounts.map((a) => a.name).filter((name) => name !== conn.account),
 		permissionSummary: formatPermissions(conn.permissions),
 	};
@@ -78,9 +80,21 @@ export function formatStatusText(card: ConnectionCard | undefined): string {
 	if (card.tenant !== card.account) lines.push(`- **Tenant:** ${card.tenant}`);
 	lines.push(`- **Tenant ID:** ${card.tenantId}`);
 	lines.push(`- **Acting as:** ${card.signedIn ? (card.user ?? "(signed in)") : "not signed in — run teams_login"}`);
-	lines.push(`- **Auth mode:** ${card.authMode}${card.authMode === "client-credentials" ? " (app-only — cannot post as a person)" : ""}`);
+	lines.push(
+		`- **Auth mode:** ${card.authMode}${
+			card.authMode === "client-credentials"
+				? " (app-only — cannot post as a person)"
+				: card.authMode === "interactive"
+					? " (browser sign-in)"
+					: " (device code)"
+		}`,
+	);
 	lines.push(`- **Safety level:** ${card.safetyLevel}`);
-	if (card.expiresAt) lines.push(`- **Token expires:** ${new Date(card.expiresAt).toLocaleString()}`);
+	if (card.expiresAt) {
+		lines.push(
+			`- **Access token expires:** ${new Date(card.expiresAt).toLocaleString()} (renewed silently)`,
+		);
+	}
 	if (card.otherAccounts.length > 0) {
 		lines.push(`- **Other accounts:** ${card.otherAccounts.join(", ")}`);
 	}

package/src/tools/teams-accounts.ts

@@ -12,7 +12,8 @@ import {
 	setSafetyLevel,
 	validateSafetyLevel,
 } from "../config/index.ts";
-import { deleteToken, getToken, isFresh } from "../auth/token-store.ts";
+import { readCacheSummary, removeCache } from "../auth/cache-plugin.ts";
+import { resetApps } from "../auth/index.ts";
 import { clearUserCache, errorResult, run, textResult, type ToolResult } from "./shared.ts";
 
 interface AccountsParams {
@@ -69,12 +70,12 @@ export const teamsAccountsTool = {
 					const lines = ["## Configured Teams accounts", ""];
 					for (const account of config.accounts) {
 						const isDefault = config.defaultAccount === account.name;
-						const token = getToken(account.name, account.tenantId);
-						const state = isFresh(token)
-							? "signed in"
-							: token?.refreshToken
-								? "session saved"
-								: "not signed in";
+						const cache = readCacheSummary(account.name, account.tenantId);
+						const state = !cache.present
+							? "not signed in"
+							: cache.fresh
+								? "signed in"
+								: "session saved";
 
 						lines.push(
 							`### ${account.displayName ?? account.name}${isDefault ? " (default)" : ""}`,
@@ -83,16 +84,16 @@ export const teamsAccountsTool = {
 							`- tenant: ${account.tenantId}`,
 							`- auth mode: ${account.authMode ?? "device-code"}`,
 							`- safety: ${account.safetyLevel ?? config.safetyLevel ?? "confirm"}`,
-							`- status: ${state}${token?.user?.upn ? ` as ${token.user.upn}` : ""}`,
+							`- status: ${state}${cache.username ? ` as ${cache.username}` : ""}`,
 						);
 
 						for (const tenant of account.tenants ?? []) {
-							const tenantToken = getToken(account.name, tenant.tenantId);
-							const tenantState = isFresh(tenantToken)
-								? "signed in"
-								: tenantToken?.refreshToken
-									? "session saved"
-									: "not signed in";
+							const tenantCache = readCacheSummary(account.name, tenant.tenantId);
+							const tenantState = !tenantCache.present
+								? "not signed in"
+								: tenantCache.fresh
+									? "signed in"
+									: "session saved";
 							lines.push(
 								`  - tenant \`${tenant.name}\` (${tenant.tenantId}) — ${tenantState}` +
 									`${tenant.safetyLevel ? `, safety: ${tenant.safetyLevel}` : ""}`,
@@ -125,7 +126,10 @@ export const teamsAccountsTool = {
 							.find((a) => a.name === params.account)
 							?.tenants?.find((t) => t.name === params.tenant);
 						const removed = removeTenant(params.account, params.tenant);
-						if (removed && tenantConfig) deleteToken(params.account, tenantConfig.tenantId);
+						if (removed && tenantConfig) {
+							removeCache(params.account, tenantConfig.tenantId);
+							resetApps();
+						}
 						return removed
 							? textResult(`✅ Removed tenant "${params.tenant}" from account "${params.account}".`, {})
 							: errorResult(`Tenant "${params.tenant}" not found in account "${params.account}".`);
@@ -134,10 +138,11 @@ export const teamsAccountsTool = {
 					const accountConfig = config.accounts.find((a) => a.name === params.account);
 					const removed = removeAccount(params.account);
 					if (removed && accountConfig) {
-						deleteToken(params.account, accountConfig.tenantId);
+						removeCache(params.account, accountConfig.tenantId);
 						for (const tenant of accountConfig.tenants ?? []) {
-							deleteToken(params.account, tenant.tenantId);
+							removeCache(params.account, tenant.tenantId);
 						}
+						resetApps();
 					}
 					clearUserCache();
 					return removed

package/src/tools/teams-doctor.ts

@@ -13,9 +13,9 @@ import {
 	DEFAULT_SCOPES,
 	type TeamsConnection,
 } from "../config/index.ts";
-import { getToken, getTokenPath, isFresh } from "../auth/token-store.ts";
+import { getCacheDir, readCacheSummary } from "../auth/cache-plugin.ts";
 import { tokenScopes } from "../auth/jwt.ts";
-import { getAccessToken } from "../auth/index.ts";
+import { browserUnavailableReason, canOpenBrowser, getAccessToken } from "../auth/index.ts";
 import { getMe } from "../graph/me.ts";
 import { listJoinedTeams } from "../graph/teams.ts";
 import { formatGraphError, describeScope } from "../utils/errors.ts";
@@ -47,28 +47,46 @@ async function checkConnection(
 			"- ⚠️ app-only: pi cannot post messages as a person with this mode " +
 				"(Microsoft Graph restricts app-only message writes to migration scenarios)",
 		);
+	} else if (conn.authMode === "interactive" && !canOpenBrowser()) {
+		lines.push(
+			`- ⚠️ browser sign-in is configured but unavailable here (${browserUnavailableReason()}); ` +
+				"`teams_login` will use the device code flow",
+		);
 	}
 
-	const token = getToken(conn.account, conn.tenantId);
-	if (!token) {
+	const cache = readCacheSummary(conn.account, conn.tenantId);
+	if (!cache.present) {
 		lines.push("- ❌ not signed in — run `teams_login`");
 		return lines;
 	}
 
 	lines.push(
-		isFresh(token)
-			? `- ✅ token valid until ${new Date(token.expiresAt).toLocaleString()}`
-			: token.refreshToken
-				? "- ⚠️ access token expired, refresh token present (will renew on the next call)"
-				: "- ❌ token expired and no refresh token — run `teams_login`",
+		cache.fresh
+			? `- ✅ access token valid until ${new Date(cache.expiresAt!).toLocaleString()}`
+			: "- ⚠️ access token expired; MSAL renews it silently on the next call",
 	);
+	if (cache.username) lines.push(`- cached identity: ${cache.username}`);
+
+	if (offline) {
+		lines.push("- _offline check: scopes and connectivity not verified_");
+		return lines;
+	}
+
+	// Everything below needs a live token. Acquiring it also proves that silent
+	// renewal works, which is the failure users actually hit.
+	let accessToken: string;
+	try {
+		const token = await getAccessToken(conn, signal);
+		accessToken = token.accessToken;
+	} catch (err) {
+		lines.push(`- ❌ could not obtain a token: ${formatGraphError(err)}`);
+		return lines;
+	}
 
-	// Consent check works offline: the scopes are inside the token.
-	const granted = tokenScopes(token.accessToken);
+	// The granted scopes are inside the token, so this needs no extra call.
+	const granted = tokenScopes(accessToken);
 	if (granted.length > 0) {
-		const wanted = (conn.scopes.length > 0 ? conn.scopes : DEFAULT_SCOPES).filter(
-			(scope) => !["openid", "profile", "offline_access"].includes(scope),
-		);
+		const wanted = conn.scopes.length > 0 ? conn.scopes : DEFAULT_SCOPES;
 		const missing = wanted.filter(
 			(scope) => !granted.some((g) => g.toLowerCase() === scope.toLowerCase()),
 		);
@@ -86,15 +104,6 @@ async function checkConnection(
 		}
 	}
 
-	if (offline) return lines;
-
-	try {
-		await getAccessToken(conn, signal);
-	} catch (err) {
-		lines.push(`- ❌ could not obtain a token: ${formatGraphError(err)}`);
-		return lines;
-	}
-
 	try {
 		const me = await getMe(conn, signal);
 		lines.push(`- ✅ acting as **${me.displayName}** <${me.upn}>`);
@@ -146,8 +155,11 @@ export const teamsDoctorTool = {
 
 			const lines = ["## Teams doctor", ""];
 			lines.push(`- config: \`${getConfigPath()}\``);
-			lines.push(`- tokens: \`${getTokenPath()}\``);
+			lines.push(`- tokens: \`${getCacheDir()}/\``);
 			lines.push(`- audit log: \`${getAuditPath()}\``);
+			lines.push(
+				`- browser sign-in: ${canOpenBrowser() ? "available" : `unavailable — ${browserUnavailableReason()}`}`,
+			);
 			lines.push("");
 
 			if (errors.length > 0) {