@patimweb/pi-teams 1.2.0 → 1.3.0

package/src/graph/messages.ts

@@ -9,7 +9,7 @@
 
 import type { TeamsConnection } from "../config/index.ts";
 import type { ChannelSummary, MessageLocation, MessageSummary, PersonRef } from "../types.ts";
-import { graphGetOptional, graphList, graphPost } from "./client.ts";
+import { graphGetOptional, graphList, graphPatch, graphPost } from "./client.ts";
 import { mapMessage } from "./mappers.ts";
 import { markdownToTeamsHtml } from "../utils/richtext.ts";
 
@@ -292,62 +292,76 @@ export async function replyToChannelMessage(
 }
 
 /**
- * Path for the softDelete / undoSoftDelete actions.
+ * Path to one message in a chat — the base for editing and deleting.
  *
- * The chat form takes an explicit user id — Graph does not accept `/me` here —
- * which is why every caller has to resolve the signed-in user first.
+ * The user id is explicit: Graph does not accept `/me` in this position, which
+ * is why every caller resolves the signed-in user first.
+ *
+ * There is no channel form. Editing or deleting a channel post needs the
+ * `ChannelMessage.ReadWrite` scope, and this package deliberately does not ask
+ * for a permission it cannot rely on being granted.
  */
-export function deletePath(
-	location: MessageLocation,
-	messageId: string,
-	userId: string,
-	replyId?: string,
-): string {
-	if (location.kind === "chat") {
-		return (
-			`/users/${encodeURIComponent(userId)}` +
-			`/chats/${encodeURIComponent(location.chatId!)}` +
-			`/messages/${encodeURIComponent(messageId)}`
-		);
-	}
-	const base = `${channelPath(location.teamId!, location.channelId!)}/${encodeURIComponent(messageId)}`;
-	return replyId ? `${base}/replies/${encodeURIComponent(replyId)}` : base;
+export function messagePath(chatId: string, messageId: string, userId: string): string {
+	return (
+		`/users/${encodeURIComponent(userId)}` +
+		`/chats/${encodeURIComponent(chatId)}` +
+		`/messages/${encodeURIComponent(messageId)}`
+	);
 }
 
 /**
- * Delete one of the signed-in user's own messages (soft delete, as in the app).
+ * Delete one of the signed-in user's own chat messages (soft delete, as in the app).
  *
  * Graph exposes this as an action, not an HTTP DELETE, and only for the sender.
  */
 export async function softDeleteMessage(
 	conn: TeamsConnection,
-	location: MessageLocation,
+	chatId: string,
 	messageId: string,
 	userId: string,
-	options: { replyId?: string; signal?: AbortSignal } = {},
+	options: { signal?: AbortSignal } = {},
 ): Promise<void> {
-	await graphPost(
-		conn,
-		`${deletePath(location, messageId, userId, options.replyId)}/softDelete`,
-		undefined,
-		{ signal: options.signal },
-	);
+	await graphPost(conn, `${messagePath(chatId, messageId, userId)}/softDelete`, undefined, {
+		signal: options.signal,
+	});
 }
 
 /** Restore a message that was soft-deleted. */
 export async function undoSoftDeleteMessage(
 	conn: TeamsConnection,
-	location: MessageLocation,
+	chatId: string,
 	messageId: string,
 	userId: string,
-	options: { replyId?: string; signal?: AbortSignal } = {},
+	options: { signal?: AbortSignal } = {},
 ): Promise<void> {
-	await graphPost(
-		conn,
-		`${deletePath(location, messageId, userId, options.replyId)}/undoSoftDelete`,
-		undefined,
-		{ signal: options.signal },
-	);
+	await graphPost(conn, `${messagePath(chatId, messageId, userId)}/undoSoftDelete`, undefined, {
+		signal: options.signal,
+	});
+}
+
+// ---------------------------------------------------------------------------
+// Editing
+// ---------------------------------------------------------------------------
+
+/**
+ * Rewrite one of the signed-in user's own chat messages.
+ *
+ * Only the body is patched: an edit replaces the text as it stands, and sending
+ * a fresh set of mention entities would silently re-notify people who were
+ * already notified by the original message.
+ */
+export async function updateMessage(
+	conn: TeamsConnection,
+	chatId: string,
+	messageId: string,
+	userId: string,
+	input: { body: string; html?: boolean },
+	options: { signal?: AbortSignal } = {},
+): Promise<void> {
+	const { body } = buildMessageBody({ body: input.body, html: input.html });
+	await graphPatch(conn, messagePath(chatId, messageId, userId), { body }, {
+		signal: options.signal,
+	});
 }
 
 // ---------------------------------------------------------------------------

package/src/safety/index.ts

@@ -82,6 +82,14 @@ const APP_ONLY_FORBIDDEN = new Set<string>([
 	"teams_create_chat",
 	"teams_delete_message",
 	"teams_react",
+	// The read-cursor actions are delegated-only in Graph ("Application: not
+	// supported"), so an app-only token gets a 403 with no explanation.
+	"teams_mark_read",
+	// An app-only token may only touch messages for migration and DLP, and a
+	// membership change with no person behind it is exactly the kind of write
+	// this gate exists to stop.
+	"teams_update_message",
+	"teams_chat_members",
 	"teams_set_presence",
 	"teams_set_status_message",
 ]);
@@ -120,12 +128,18 @@ export function formatMutationSummary(
 			const people = Array.isArray(params.participants) ? params.participants.join(", ") : text(params.participants);
 			return `Create a new chat with: ${text(people, 200)}`;
 		}
-		case "teams_create_channel":
-			return `Create channel "${text(params.name, 60)}" in team "${text(params.team, 60)}"`;
 		case "teams_delete_message":
 			return `Delete your message ${text(params.messageId, 60)}`;
 		case "teams_react":
 			return `${params.remove ? "Remove" : "Add"} reaction ${text(params.reaction, 10)} on message ${text(params.messageId, 50)}`;
+		case "teams_mark_read":
+			return `${params.read === false ? "Mark as unread" : "Mark as read"}: chat "${text(params.chat, 60)}"`;
+		case "teams_update_message":
+			return `Edit your message ${text(params.messageId, 50)} in ${text(params.chat ?? params.channel, 60)}:\n\n${text(params.body, 400)}`;
+		case "teams_chat_members":
+			return `${params.action === "remove" ? "Remove" : "Add"} ${text(params.person, 80)} ${params.action === "remove" ? "from" : "to"} the chat "${text(params.chat, 60)}"`;
+		case "teams_respond_invite":
+			return `${text(params.response, 20)} the invitation ${text(params.eventId, 50)}${params.comment ? `: "${text(params.comment, 160)}"` : ""}`;
 		case "teams_set_presence":
 			return `Set your Teams presence to ${text(params.availability, 30)}${params.expiresIn ? ` for ${text(params.expiresIn, 20)}` : ""}`;
 		case "teams_set_status_message":

package/src/tools/shared.ts

@@ -88,6 +88,30 @@ export function connectionFor(
 	return resolveConnection(account, tenant);
 }
 
+// ---------------------------------------------------------------------------
+// Consent gates
+// ---------------------------------------------------------------------------
+
+/**
+ * Whether this account asks for a delegated scope.
+ *
+ * A delegated scope cannot be granted unless it was requested, so the
+ * configuration is a reliable gate: if it is missing here, the Graph call
+ * cannot succeed, and its failure would be a consent error that says nothing
+ * about the one-line fix.
+ */
+export function hasScope(conn: TeamsConnection, scope: string): boolean {
+	return conn.scopes.some((entry) => entry.toLowerCase() === scope.toLowerCase());
+}
+
+/** The message to return when a tool needs a scope the account does not request. */
+export function missingScopeError(scope: string, feature: string): string {
+	return (
+		`${feature} needs the Microsoft Graph scope "${scope}", which this account does not request. ` +
+		`Add it to "scopes" in pi-teams.json (or have an admin grant it in Entra ID) and run teams_login again.`
+	);
+}
+
 // ---------------------------------------------------------------------------
 // Identity cache
 // ---------------------------------------------------------------------------

package/src/tools/teams-availability.ts

@@ -0,0 +1,224 @@
+/**
+ * teams_availability — when everybody is free.
+ *
+ * Reads *free/busy*, not calendars: `getSchedule` is what a delegated token may
+ * see about a colleague's day, and it is also the reason this works with the
+ * scopes already granted — `findMeetingTimes` demands `Calendars.Read.Shared`,
+ * a scope nobody has consented to just to ask "Tuesday at two?".
+ *
+ * Scheduling is then a second step on purpose. This tool answers the question;
+ * `teams_create_meeting` acts on it once the user has agreed to a slot.
+ */
+
+import { Type } from "typebox";
+import { getSchedule } from "../graph/calendar.ts";
+import { resolveUserId } from "../graph/me.ts";
+import { assertAccess } from "../safety/index.ts";
+import {
+	formatNaiveDay,
+	formatSlotRange,
+	truncate,
+} from "../utils/formatting.ts";
+import {
+	describeBusy,
+	findCommonFreeSlots,
+	localDayStart,
+	localNow,
+	localTimeZone,
+	type BusyView,
+} from "../utils/slots.ts";
+import {
+	AccountParam,
+	LimitParam,
+	TenantParam,
+	connectionFor,
+	currentUser,
+	run,
+	textResult,
+	type ToolContext,
+	type ToolResult,
+} from "./shared.ts";
+
+/** How far ahead the default search looks. */
+const DEFAULT_SEARCH_DAYS = 7;
+
+export const teamsAvailabilityTool = {
+	name: "teams_availability",
+	description:
+		"Find when the signed-in user and other people are all free, using Microsoft Graph free/busy. " +
+		"Only availability is read — never the appointments themselves. " +
+		"By default it searches the next 7 days for slots on weekdays between 09:00 and 17:00; pass 'start' and " +
+		"'end' (ISO 8601 local date-times) to look at an exact window instead. " +
+		"Use it before teams_create_meeting when the goal is to find a time rather than to book one.",
+	parameters: Type.Object({
+		people: Type.Optional(
+			Type.Array(Type.String(), {
+				description:
+					"Names, e-mail addresses or UPNs of everyone who has to be there; the signed-in user is always included",
+			}),
+		),
+		start: Type.Optional(
+			Type.String({
+				description:
+					"ISO 8601 local date-time, e.g. '2026-09-15T09:00:00'. Default: today, in 'timeZone'",
+			}),
+		),
+		end: Type.Optional(
+			Type.String({
+				description:
+					"ISO 8601 local date-time. Default: 7 days after 'start'",
+			}),
+		),
+		durationMinutes: Type.Optional(
+			Type.Number({ description: "Length of the meeting to look for, in minutes (default 30)" }),
+		),
+		timeZone: Type.Optional(
+			Type.String({
+				description:
+					"IANA or Windows time zone the times are expressed in. Defaults to this machine's time zone",
+			}),
+		),
+		account: AccountParam,
+		tenant: TenantParam,
+		limit: LimitParam,
+	}),
+	promptSnippet: "Find a free slot for several people",
+	promptGuidelines: [
+		"Use teams_availability to find a time before creating a meeting; propose the slots it returns and let the user pick.",
+		"Availability is other people's data: pass it on as times, not as an account of how busy someone is.",
+	],
+
+	async execute(
+		_toolCallId: string,
+		params: {
+			people?: string[];
+			start?: string;
+			end?: string;
+			durationMinutes?: number;
+			timeZone?: string;
+			account?: string;
+			tenant?: string;
+			limit?: number;
+		},
+		signal: AbortSignal | undefined,
+		_onUpdate: undefined,
+		ctx: ToolContext,
+	): Promise<ToolResult> {
+		return run(async () => {
+			const conn = connectionFor(ctx, params.account, params.tenant);
+			const me = await currentUser(conn, signal);
+
+			const timeZone = params.timeZone ?? localTimeZone();
+			const duration = Math.min(Math.max(params.durationMinutes ?? 30, 5), 1440);
+
+			// Default: the coming week, searched inside working hours. An explicit
+			// window is honoured as-is — asking "are we free at 20:00?" is a
+			// legitimate question that a 09:00–17:00 filter would answer wrongly.
+			const explicit = !!params.start || !!params.end;
+			const start = params.start ?? localDayStart(0);
+			const end = params.end ?? localDayStart(DEFAULT_SEARCH_DAYS);
+
+			/** scheduleId (lower case) → what to call that person */
+			const names = new Map<string, string>();
+			const schedules: string[] = [];
+
+			const selfAddress = me.mail ?? me.upn;
+			schedules.push(selfAddress);
+			names.set(selfAddress.toLowerCase(), `${me.displayName} (you)`);
+
+			const unresolved: string[] = [];
+			for (const reference of params.people ?? []) {
+				const person = await resolveUserId(conn, reference, signal);
+				if (!person) {
+					unresolved.push(reference);
+					continue;
+				}
+
+				// Free/busy is other people's data, so the people rules apply.
+				assertAccess(conn, "read", "people", person.displayName, [
+					person.displayName,
+					person.upn,
+					person.mail,
+					person.id,
+				]);
+
+				const address = person.mail ?? person.upn;
+				if (!address) {
+					unresolved.push(reference);
+					continue;
+				}
+				if (!schedules.some((entry) => entry.toLowerCase() === address.toLowerCase())) {
+					schedules.push(address);
+					names.set(address.toLowerCase(), person.displayName);
+				}
+			}
+
+			const windows = await getSchedule(conn, {
+				schedules,
+				start,
+				end,
+				timeZone,
+				intervalMinutes: duration,
+				signal,
+			});
+
+			const views: BusyView[] = windows.map((window) => ({
+				name: names.get(window.scheduleId.toLowerCase()) ?? window.scheduleId,
+				view: window.availabilityView,
+			}));
+
+			const slots = findCommonFreeSlots(
+				views,
+				{
+					start,
+					intervalMinutes: duration,
+					notBefore: explicit ? undefined : localNow(),
+					workingHoursOnly: !explicit,
+				},
+				params.limit ?? 5,
+			);
+
+			const who = [...names.values()].map((name) => truncate(name, 60)).join(", ");
+			const windowLabel = explicit
+				? `${formatSlotRange(start, end)}`
+				: `${formatNaiveDay(start)} – ${formatNaiveDay(end)} on weekdays, 09:00–17:00`;
+
+			const lines = [
+				`## Free/busy — ${windowLabel} (${timeZone}), ${duration} min`,
+				"",
+				`Checked: ${who}`,
+				"",
+			];
+
+			if (slots.length === 0) {
+				lines.push("**No slot where everybody is free.**", "");
+				if (windows.length > 0) {
+					lines.push("Busy blocks:", ...describeBusy(windows, names), "");
+				}
+			} else {
+				lines.push(`**${slots.length} slot(s) with everybody free:**`, "");
+				for (const slot of slots) {
+					lines.push(`- ${formatSlotRange(slot.start, slot.end)}`);
+				}
+				lines.push("");
+			}
+
+			if (unresolved.length > 0) {
+				lines.push(`_Could not resolve: ${unresolved.join(", ")} — use teams_find_user._`, "");
+			}
+
+			// The individual blocks are only useful when a slot was proposed and the
+			// reader wants to sanity-check it, or when nothing was found at all.
+			if (slots.length > 0 && windows.some((window) => window.busy.length > 0)) {
+				lines.push("Busy blocks in the window:", ...describeBusy(windows, names), "");
+			}
+
+			return textResult(lines.join("\n").trimEnd(), {
+				slots: slots.length,
+				people: schedules.length,
+				unresolved: unresolved.length,
+				timeZone,
+			});
+		});
+	},
+};

package/src/tools/teams-chat-members.ts

@@ -0,0 +1,148 @@
+/**
+ * teams_chat_members — bring someone into a group chat, or take them out.
+ *
+ * Teams has no "invite" for a chat: either the person is a member of the
+ * conversation or they cannot see it. That makes adding a real change to who
+ * can read the history, which is why it goes through the safety gates and the
+ * person is checked against the member rules before Graph is called.
+ */
+
+import { Type } from "typebox";
+import { addChatMember, listChatMembers, matchChatMember, removeChatMember } from "../graph/chats.ts";
+import { resolveUserId } from "../graph/me.ts";
+import { auditWrite } from "../safety/audit.ts";
+import { assertAccess } from "../safety/index.ts";
+import { requireChat } from "./resolve.ts";
+import {
+	AccountParam,
+	TenantParam,
+	connectionFor,
+	currentUser,
+	errorResult,
+	hasScope,
+	missingScopeError,
+	run,
+	textResult,
+	type ToolContext,
+	type ToolResult,
+} from "./shared.ts";
+
+export const teamsChatMembersTool = {
+	name: "teams_chat_members",
+	description:
+		"Add a person to an existing Microsoft Teams group chat, or remove one. " +
+		"Takes a chat ID, the group chat topic, or a participant's name/e-mail, plus who to add or remove. " +
+		"A 1:1 chat cannot be extended — use teams_create_chat with everyone in it to make it a group chat. " +
+		"Removing someone additionally needs the ChatMember.ReadWrite scope.",
+	parameters: Type.Object({
+		chat: Type.String({ description: "Chat ID, group chat topic, or a participant's name/e-mail" }),
+		action: Type.Union([Type.Literal("add"), Type.Literal("remove")], {
+			description: "'add' to bring someone in, 'remove' to take them out",
+		}),
+		person: Type.String({
+			description: "Who to add or remove, by name, e-mail address or user principal name",
+		}),
+		account: AccountParam,
+		tenant: TenantParam,
+	}),
+	promptSnippet: "Add or remove a member of a Teams chat",
+	promptGuidelines: [
+		"Adding a member gives them the chat's history from that point on, so confirm the person with the user when the name is ambiguous.",
+	],
+
+	async execute(
+		_toolCallId: string,
+		params: {
+			chat: string;
+			action: "add" | "remove";
+			person: string;
+			account?: string;
+			tenant?: string;
+		},
+		signal: AbortSignal | undefined,
+		_onUpdate: undefined,
+		ctx: ToolContext,
+	): Promise<ToolResult> {
+		return run(async () => {
+			const conn = connectionFor(ctx, params.account, params.tenant);
+			const me = await currentUser(conn, signal);
+			const chat = await requireChat(conn, params.chat, "write", signal);
+
+			if (params.action === "add") {
+				if (chat.chatType === "oneOnOne") {
+					return errorResult(
+						`"${chat.label}" is a 1:1 chat and cannot be extended. Use teams_create_chat with ` +
+							`everyone who should be in it to start a group chat.`,
+					);
+				}
+
+				const person = await resolveUserId(conn, params.person, signal);
+				if (!person) {
+					return errorResult(
+						`No person matching "${params.person}". Use teams_find_user to find the exact name or e-mail.`,
+					);
+				}
+
+				// The people already in the chat were checked by requireChat; the one
+				// about to join has to be checked on its own.
+				assertAccess(conn, "write", "people", person.displayName, [
+					person.displayName,
+					person.upn,
+					person.mail,
+					person.id,
+				]);
+
+				await addChatMember(conn, chat.id, person, { signal });
+
+				auditWrite(conn.audit, {
+					tool: "teams_chat_members",
+					account: conn.account,
+					tenant: conn.tenant,
+					actor: me.upn,
+					target: `chat:${chat.label}`,
+					summary: `added ${person.displayName} to the chat`,
+				});
+
+				return textResult(`✅ ${person.displayName} added to "${chat.label}".`, {
+					chatId: chat.id,
+					action: "add",
+				});
+			}
+
+			// Removal takes the membership id, not the user id — a scope the default
+			// configuration leaves out, so the answer is the fix rather than a 403.
+			if (!hasScope(conn, "ChatMember.ReadWrite")) {
+				return errorResult(
+					missingScopeError("ChatMember.ReadWrite", "Removing a member from a chat"),
+				);
+			}
+
+			const person = await resolveUserId(conn, params.person, signal).catch(() => undefined);
+			const members = await listChatMembers(conn, chat.id, { signal });
+			const reference = person?.id ?? person?.upn ?? person?.mail ?? params.person;
+			const member = matchChatMember(members, reference) ?? matchChatMember(members, params.person);
+
+			if (!member) {
+				const known = members.map((entry) => entry.displayName).join(", ") || "(none visible)";
+				return errorResult(`"${params.person}" is not a member of "${chat.label}". Members: ${known}.`);
+			}
+
+			await removeChatMember(conn, chat.id, member.membershipId, { signal });
+
+			auditWrite(conn.audit, {
+				tool: "teams_chat_members",
+				account: conn.account,
+				tenant: conn.tenant,
+				actor: me.upn,
+				target: `chat:${chat.label}`,
+				summary: `removed ${member.displayName} from the chat`,
+			});
+
+			return textResult(`✅ ${member.displayName} removed from "${chat.label}".`, {
+				chatId: chat.id,
+				action: "remove",
+				membershipId: member.membershipId,
+			});
+		});
+	},
+};

package/src/tools/teams-delete-message.ts

@@ -1,15 +1,19 @@
 /**
- * teams_delete_message — soft-delete one of the user's own messages.
+ * teams_delete_message — take back a message the user sent in a chat.
  *
  * Graph only permits this for the sender, which is also the only case that
  * makes sense here: pi may take back something it said in the user's name, not
  * edit anyone else's history.
+ *
+ * Chats only. Deleting a channel post needs the `ChannelMessage.ReadWrite`
+ * scope, which this package does not request — a channel post is deleted in
+ * Teams, or edited into what it should have said.
  */
 
 import { Type } from "typebox";
 import { softDeleteMessage, undoSoftDeleteMessage } from "../graph/messages.ts";
 import { auditWrite } from "../safety/audit.ts";
-import { requireChannel, requireChat } from "./resolve.ts";
+import { requireChat } from "./resolve.ts";
 import {
 	AccountParam,
 	TenantParam,
@@ -21,38 +25,31 @@ import {
 	type ToolContext,
 	type ToolResult,
 } from "./shared.ts";
-import type { MessageLocation } from "../types.ts";
 
 export const teamsDeleteMessageTool = {
 	name: "teams_delete_message",
 	description:
-		"Delete a message the signed-in user sent in Microsoft Teams (soft delete, exactly like deleting it in " +
-		"the app). Specify 'chat' or 'channel' (plus 'team') to say where it lives. " +
-		"Set undo: true to restore a message that was soft-deleted. Only the sender's own messages can be deleted.",
+		"Delete a message the signed-in user sent in a Microsoft Teams chat (soft delete, exactly like deleting " +
+		"it in the app). Set undo: true to restore a message that was soft-deleted. " +
+		"Only the sender's own messages can be deleted, and only in chats — a channel post cannot be deleted " +
+		"through Graph with the permissions pi asks for.",
 	parameters: Type.Object({
 		messageId: Type.String({ description: "ID of the message to delete" }),
-		chat: Type.Optional(Type.String({ description: "Chat ID or name, when the message is in a chat" })),
-		channel: Type.Optional(
-			Type.String({ description: "Channel name/ID or 'Team/Channel' path, when it is in a channel" }),
-		),
-		team: Type.Optional(Type.String({ description: "Team name or ID" })),
-		replyId: Type.Optional(
-			Type.String({ description: "Reply ID, when deleting a reply inside a channel thread" }),
-		),
+		chat: Type.String({ description: "Chat ID, group chat topic, or a participant's name/e-mail" }),
 		undo: Type.Optional(Type.Boolean({ description: "Restore a previously deleted message" })),
 		account: AccountParam,
 		tenant: TenantParam,
 	}),
 	promptSnippet: "Delete a message the user sent in Teams",
+	promptGuidelines: [
+		"Prefer teams_update_message over deleting and resending: an edit keeps the message in place, a delete leaves a gap and the replacement arrives as a new notification.",
+	],
 
 	async execute(
 		_toolCallId: string,
 		params: {
 			messageId: string;
-			chat?: string;
-			channel?: string;
-			team?: string;
-			replyId?: string;
+			chat: string;
 			undo?: boolean;
 			account?: string;
 			tenant?: string;
@@ -63,37 +60,13 @@ export const teamsDeleteMessageTool = {
 	): Promise<ToolResult> {
 		return run(async () => {
 			const conn = connectionFor(ctx, params.account, params.tenant);
-
-			let location: MessageLocation;
-			let target: string;
-
-			if (params.chat) {
-				const chat = await requireChat(conn, params.chat, "write", signal);
-				location = { kind: "chat", chatId: chat.id };
-				target = `chat:${chat.label}`;
-			} else if (params.channel) {
-				const { team, channel } = await requireChannel(conn, params.team, params.channel, "write", signal);
-				location = {
-					kind: "channel",
-					teamId: team.id,
-					teamName: team.displayName,
-					channelId: channel.id,
-					channelName: channel.displayName,
-				};
-				target = `channel:${team.displayName}/${channel.displayName}`;
-			} else {
-				return errorResult("Specify either 'chat' or 'channel' so pi knows where the message lives.");
-			}
-
-			// Graph needs an explicit user id for the chat form of this action, and
-			// only the sender may delete — so failing here is better than a 403.
 			const me = await currentUser(conn, signal);
+			const chat = await requireChat(conn, params.chat, "write", signal);
 
-			const options = { replyId: params.replyId, signal };
 			if (params.undo) {
-				await undoSoftDeleteMessage(conn, location, params.messageId, me.id, options);
+				await undoSoftDeleteMessage(conn, chat.id, params.messageId, me.id, { signal });
 			} else {
-				await softDeleteMessage(conn, location, params.messageId, me.id, options);
+				await softDeleteMessage(conn, chat.id, params.messageId, me.id, { signal });
 			}
 
 			auditWrite(conn.audit, {
@@ -101,13 +74,13 @@ export const teamsDeleteMessageTool = {
 				account: conn.account,
 				tenant: conn.tenant,
 				actor: me.upn,
-				target,
+				target: `chat:${chat.label}`,
 				summary: `${params.undo ? "restored" : "deleted"} message ${params.messageId}`,
 			});
 
 			return textResult(
-				`✅ Message ${params.messageId} ${params.undo ? "restored" : "deleted"} in ${target}.`,
-				{ messageId: params.messageId, undone: !!params.undo },
+				`✅ Message ${params.messageId} ${params.undo ? "restored" : "deleted"} in "${chat.label}".`,
+				{ messageId: params.messageId, chatId: chat.id, undone: !!params.undo },
 			);
 		});
 	},