@patimweb/pi-teams 1.3.1 → 1.4.0

package/README.md

@@ -82,8 +82,12 @@ What it does, and what it deliberately does not:
 - **Costs a model turn per wake.** That is what the filters and the hourly cap
   are for — narrow `chats` and `from`, and enable it for a handful of
   conversations rather than the whole company.
-- **Never answers the backlog.** The first poll records what is there; only what
-  arrives afterwards wakes pi.
+- **Answers what is still unread.** A chat wakes pi when two things are true: it
+  moved since pi last looked (a cursor per account, kept on disk), and its newest
+  message is still unread for you in Teams. So switching listen mode back on
+  answers what you missed while pi was not running — and a chat you already read
+  in Teams stays quiet. A backlog is drained a few chats per tick and capped by
+  `maxTriggersPerHour`, so a long absence does not produce a burst.
 - **Never wakes for its own messages.** pi posts as you, so its own reply comes
   back as "my own message" and stops the loop.
 - **Respects the read rules.** A chat excluded by `permissions.read.chats` is
@@ -352,6 +356,37 @@ teams_send_channel_message:
 Set globally, per account, or per tenant — the most specific setting wins. So
 your own company can be `confirm` while a customer tenant stays `readonly`.
 
+### AI disclosure footer
+
+Off by default. Switched on, every message, reply and edit pi sends in your name
+ends with a short note saying it was written by an AI:
+
+```json
+"aiFooter": { "enabled": true, "text": "🤖 Erstellt mit pi (KI-Assistent)" }
+```
+
+| Key | Default | Meaning |
+|-----|---------|---------|
+| `enabled` | `false` | append the note to everything pi sends |
+| `text` | `🤖 Generated with pi (an AI agent)` | the wording; empty means the default |
+
+Set it globally or per account (the account level wins field by field, so one
+account can use its own wording while another keeps the global one).
+
+Details worth knowing:
+
+- It is added by the tool that sends, not asked for in a prompt, so it cannot be
+  forgotten by the model. The confirmation dialog at `safetyLevel: confirm`
+  shows the text **with** the footer — you confirm what actually goes out.
+- It is idempotent: editing an already-footered message does not stack a second
+  one, and a model that copied the footer from the chat it is answering does not
+  produce two.
+- It applies to chat messages, channel posts and replies, the first message of a
+  newly created chat, and edits. It does **not** apply to things pi sends on
+  your behalf that are not messages — meeting invitations, presence changes.
+- It says nothing about the *content*: the note is a disclosure, not a
+  disclaimer, and it is the only part of an outgoing message pi adds on its own.
+
 ### Scope rules
 
 Rules exist per **category** (`teams`, `channels`, `chats`, `people`) and per
@@ -392,6 +427,7 @@ teams_permissions:
 | `maxMessages` | `25` | default page size for message listings |
 | `audit` | `true` | append every write to `~/.pi/agent/pi-teams-audit.jsonl` |
 | `scopes` | see above | override the requested Graph scopes per account/tenant |
+| `aiFooter` | off | append an AI disclosure to every message pi sends — see above |
 | `graphBaseUrl` / `authorityHost` | Microsoft public cloud | sovereign cloud endpoints |
 
 ---
@@ -548,11 +584,15 @@ teams_send_channel_message:
 | `~/.pi/agent/pi-teams.json` | accounts, tenants, safety levels, scope rules | `0600` |
 | `~/.pi/agent/pi-teams-tokens/` | one MSAL token cache per account+tenant | `0600` |
 | `~/.pi/agent/pi-teams-audit.jsonl` | one line per write: when, who, where, what | `0600` |
+| `~/.pi/agent/pi-teams-watch/` | listen mode's cursor: the newest message it has looked at per chat | `0600` |
 
 Both the config and the token cache are written through a private temp file and
-an atomic rename, so an interrupted write cannot truncate them. To revoke
-pi's access entirely, run `teams_logout` with `all: true` and remove the app's
-consent in Entra ID.
+an atomic rename, so an interrupted write cannot truncate them. The watch
+cursor is what makes listen mode survive a restart, and deleting it only costs
+one re-examination of the chats in the list — it is not silently re-answering
+anything, because the decision also asks Teams whether the message is still
+unread. To revoke pi's access entirely, run `teams_logout` with `all: true` and
+remove the app's consent in Entra ID.
 
 ## Architecture
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patimweb/pi-teams",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "description": "Microsoft Teams integration for pi coding agent — acts fully as the signed-in user across multiple accounts and tenants: chats, channels, meetings, presence, with configurable guardrails",
   "keywords": [
     "pi-package",

package/skills/teams-collaboration/SKILL.md

@@ -114,7 +114,11 @@ instead of trying anyway.
 ## How to write as the user
 
 - Write in **their** voice. No "As an AI…", no signature, no note that a model
-  composed it, unless they ask for one.
+  composed it, unless they ask for one. The one exception is configuration, not
+  judgement: with `aiFooter` switched on, the sending tools append the
+  disclosure themselves — do not write it into the body, or it arrives twice
+  (the tools detect it, but the user sees the text in the confirmation twice as
+  well, which looks like a mistake).
 - Match the register of the conversation you just read. A channel post and a
   quick reply to a colleague are not the same thing.
 - Show the exact text and the destination before sending whenever the request
@@ -219,6 +223,10 @@ as opening it, or re-marking it unread, in the app. Two rules:
 Channels have no equivalent: channel posts cannot be marked read or unread
 through Graph, so "mark the channel as read" is done in the Teams client.
 
+pi reads this same cursor when it decides what to answer in listen mode: a chat
+whose newest message is already read does not wake it. So marking a chat read is
+also how the user says "I have handled this, do not answer it for me".
+
 ## Correcting a message
 
 Both actions work on **chat** messages the user themselves sent, which is also
@@ -296,8 +304,13 @@ teams_watch:
   watches everything answers everything.
 - `/teams-listen on|off|status` switches it in the session; `teams_watch
   action: status` reports what is configured and what is actually running.
-- The first poll only records what is there — switching it on never answers the
-  backlog, only what arrives afterwards.
+- pi answers what is still **unread**: a chat wakes it when it has moved since
+  pi last looked (a cursor kept on disk per account) and its newest message is
+  still unread for the user in Teams. Switching listen mode back on therefore
+  answers what was missed while pi was not running; a chat the user has already
+  read in Teams stays quiet. A backlog is drained a few chats per tick, capped
+  by `maxTriggersPerHour` — so on a fresh start, say how many chats are waiting
+  rather than assuming silence means nothing happened.
 - pi never wakes for its own messages, so it cannot answer itself.
 - Listen mode does **not** bypass anything: a reply it decides to send is
   subject to the same safety level and scope rules as a reply you asked for. At

package/src/config/index.ts

@@ -134,6 +134,27 @@ export interface ResolvedWatchConfig {
 	maxTriggersPerHour: number;
 }
 
+/**
+ * The note pi can append to everything it sends in the user's name.
+ *
+ * Off by default, and deliberately so: pi writes as the user, and a disclosure
+ * a recipient did not expect is a statement the user did not make. Where an
+ * organisation wants it — a works council, a customer, a regulated process —
+ * switching it on is a one-line change.
+ */
+export interface AiFooterConfig {
+	/** Append the note to every outgoing message (default: false) */
+	enabled?: boolean;
+	/** The note itself (default: see AI_FOOTER_DEFAULT) */
+	text?: string;
+}
+
+/** An AI footer after the cascade has been applied. */
+export interface ResolvedAiFooter {
+	enabled: boolean;
+	text: string;
+}
+
 /** A Teams identity pi can sign in as. */
 export interface AccountConfig {
 	/** Short label used in tool parameters, e.g. "work" */
@@ -164,6 +185,8 @@ export interface AccountConfig {
 	permissions?: PermissionBlock;
 	/** Listen-mode overrides for this identity */
 	watch?: WatchConfig;
+	/** AI-footer override for this identity */
+	aiFooter?: AiFooterConfig;
 	/** Additional tenants this identity reaches */
 	tenants?: TenantConfig[];
 }
@@ -181,6 +204,8 @@ export interface TeamsRootConfig {
 	permissions?: PermissionBlock;
 	/** Global listen-mode settings */
 	watch?: WatchConfig;
+	/** Append an AI note to every outgoing message (default: off) */
+	aiFooter?: AiFooterConfig;
 	/** Default page size for message listings (default: 25) */
 	maxMessages?: number;
 	/** Append every write to ~/.pi/agent/pi-teams-audit.jsonl (default: true) */
@@ -212,6 +237,8 @@ export interface TeamsConnection {
 	permissions: ResolvedPermissions;
 	/** Listen-mode settings in force for this account+tenant */
 	watch: ResolvedWatchConfig;
+	/** AI-footer settings in force for this account */
+	aiFooter: ResolvedAiFooter;
 	maxMessages: number;
 	audit: boolean;
 	graphBaseUrl: string;
@@ -267,6 +294,7 @@ const DEFAULTS = {
 	authMode: "auto" as AuthMode,
 	maxMessages: 25,
 	audit: true,
+	aiFooter: false,
 	graphBaseUrl: "https://graph.microsoft.com/v1.0",
 	authorityHost: "https://login.microsoftonline.com",
 };
@@ -288,6 +316,14 @@ export const WATCH_DEFAULTS: ResolvedWatchConfig = {
 	maxTriggersPerHour: 10,
 };
 
+/**
+ * The disclosure appended to outgoing messages when `aiFooter` is on.
+ *
+ * Short, unambiguous and in the language of the package; an organisation that
+ * needs its own wording sets `aiFooter.text`.
+ */
+export const AI_FOOTER_DEFAULT = "🤖 Generated with pi (an AI agent)";
+
 const WATCH_BOUNDS = {
 	intervalSeconds: { min: 15, max: 3600 },
 	cooldownSeconds: { min: 0, max: 86400 },
@@ -529,6 +565,7 @@ export function resolveConnection(
 		safetyLevel: resolveEffectiveSafetyLevel(config.safetyLevel, account, tenant),
 		permissions: resolvePermissions([config.permissions, account.permissions, tenant?.permissions]),
 		watch: resolveWatchConfig(config.watch, account),
+		aiFooter: resolveAiFooter(config.aiFooter, account.aiFooter),
 		maxMessages: config.maxMessages ?? DEFAULTS.maxMessages,
 		audit: config.audit ?? DEFAULTS.audit,
 		graphBaseUrl: (config.graphBaseUrl ?? DEFAULTS.graphBaseUrl).replace(/\/+$/, ""),
@@ -696,6 +733,28 @@ export function resolveWatchConfig(
 	};
 }
 
+/**
+ * Effective AI-footer settings: account > global > default.
+ *
+ * Field by field, like every other setting in the cascade, so an account can
+ * turn the footer on with the global wording, or keep it off with its own.
+ * Exported for tests.
+ */
+export function resolveAiFooter(
+	global: AiFooterConfig | undefined,
+	account: AiFooterConfig | undefined,
+): ResolvedAiFooter {
+	const text = account?.text ?? global?.text;
+	const trimmed = typeof text === "string" ? text.trim() : "";
+
+	return {
+		enabled: account?.enabled ?? global?.enabled ?? DEFAULTS.aiFooter,
+		// A footer configured as whitespace would silently switch the feature on
+		// and add nothing, so it falls back to the default wording instead.
+		text: trimmed.length > 0 ? trimmed : AI_FOOTER_DEFAULT,
+	};
+}
+
 function clamp(value: unknown, bounds: { min: number; max: number }, fallback: number): number {
 	const number = typeof value === "number" && Number.isFinite(value) ? value : fallback;
 	return Math.min(bounds.max, Math.max(bounds.min, Math.round(number)));
@@ -841,7 +900,8 @@ const TEMPLATE_JSON = `{
   "defaultAccount": "work",
   "safetyLevel": "confirm",
   "maxMessages": 25,
-  "audit": true
+  "audit": true,
+  "aiFooter": { "enabled": false, "text": "🤖 Generated with pi (an AI agent)" }
 }
 `;
 

package/src/extension/index.ts

@@ -30,6 +30,7 @@ import {
 	type WatchLoop,
 } from "../watch/loop.ts";
 import { composeWatchPrompt } from "../watch/prompt.ts";
+import { readWatchCursor, writeWatchCursor } from "../watch/cursor.ts";
 
 import { teamsSetupTool } from "../tools/teams-setup.ts";
 import { teamsLoginTool, teamsLogoutTool } from "../tools/teams-login.ts";
@@ -147,9 +148,9 @@ export default function (pi: ExtensionAPI) {
 	 * The settings the running watcher was started from.
 	 *
 	 * Used to tell a real config change from a tool that merely *read* the
-	 * settings. Restarting resets the watcher's baseline, which discards every
-	 * chat it has already looked at and swallows whatever arrived just before —
-	 * so a `teams_watch status` must not be treated like an edit.
+	 * settings. A restart only costs the polls it skipped: what has already been
+	 * looked at is on disk (see ../watch/cursor.ts), so the next tick resumes
+	 * where the last one stopped instead of losing the interval in between.
 	 */
 	let watchSignature: string | undefined;
 
@@ -173,7 +174,7 @@ export default function (pi: ExtensionAPI) {
 		const conn = refresh();
 
 		// Already watching this exact configuration: leave the loop alone, so its
-		// baseline and its cooldowns survive a look at the status.
+		// cooldowns survive a look at the status.
 		const signature = conn?.watch.enabled ? JSON.stringify(conn.watch) : undefined;
 		if (watchSignature !== undefined && signature === watchSignature && watchLoop) return;
 
@@ -184,6 +185,10 @@ export default function (pi: ExtensionAPI) {
 		reportedWatchError = undefined;
 		const loop = startWatchLoop({
 			connection: conn,
+			// Read once, here: the watch state belongs to the account+tenant, so a
+			// second account in the same session starts from its own cursor.
+			cursor: readWatchCursor(conn.account, conn.tenantId),
+			persistCursor: (seen) => writeWatchCursor(conn.account, conn.tenantId, seen),
 			onWake: (event) => {
 				pi.sendUserMessage(composeWatchPrompt(event, event.me), { deliverAs: "followUp" });
 			},
@@ -490,7 +495,7 @@ export default function (pi: ExtensionAPI) {
 
 		if (target.safetyLevel === "confirm") {
 			const scope = target.tenant === target.account ? target.account : `${target.account}/${target.tenant}`;
-			const summary = formatMutationSummary(event.toolName, params);
+			const summary = formatMutationSummary(event.toolName, params, target.aiFooter);
 			const approved = await ctx.ui.confirm(
 				"Microsoft Teams — acting as you",
 				`${summary}\n\nAccount: ${scope}\n\nAllow this?`,

package/src/graph/chats.ts

@@ -70,6 +70,47 @@ export async function getChat(
 	return raw ? mapChat(raw as Record<string, never>, options.meId) : undefined;
 }
 
+/**
+ * The signed-in user's own view of one chat.
+ *
+ * Graph returns this as `viewpoint` on the chat itself, and only for the
+ * signed-in user — it is the read cursor Teams shows as the unread badge. It
+ * cannot be `$expand`ed on the chat *list* (Graph answers "not a navigation
+ * property"), so the read state of a chat costs one extra call on that chat.
+ *
+ * Listen mode is the reason this exists: "answer what I have not read yet" is
+ * a different question from "answer what arrived since pi last looked", and
+ * only this answers the first one.
+ */
+export interface ChatViewpoint {
+	/** Chat hidden from the user's chat list */
+	isHidden?: boolean;
+	/** ISO time the user last read this chat; undefined when Graph withholds it */
+	lastMessageReadAt?: string;
+}
+
+export async function getChatViewpoint(
+	conn: TeamsConnection,
+	chatId: string,
+	options: { signal?: AbortSignal } = {},
+): Promise<ChatViewpoint | undefined> {
+	const raw = await graphGetOptional<Record<string, unknown>>(
+		conn,
+		`/chats/${encodeURIComponent(chatId)}`,
+		{ signal: options.signal },
+	);
+
+	const viewpoint = raw?.viewpoint as Record<string, unknown> | undefined;
+	if (!viewpoint) return undefined;
+
+	return {
+		isHidden: viewpoint.isHidden === true,
+		lastMessageReadAt: typeof viewpoint.lastMessageReadDateTime === "string"
+			? viewpoint.lastMessageReadDateTime
+			: undefined,
+	};
+}
+
 /**
  * Find an existing chat by label, topic or participant.
  *

package/src/graph/mappers.ts

@@ -143,10 +143,10 @@ export function teamCandidates(team: TeamSummary): (string | undefined)[] {
  * newest message arrived minutes ago still reported a `lastUpdatedDateTime`
  * from more than a year earlier.
  *
- * Everything that dates a chat depends on this — the chat list order, the
- * inbox window, and the freshness cut-off that decides whether listen mode
- * looks at a chat at all — so a stale value here silently disabled listen mode
- * for exactly the chats people write in. `lastUpdatedDateTime` stays as the
+ * Everything that dates a chat depends on this — the chat list order, the inbox
+ * window, and the question listen mode asks first, "has this chat moved since pi
+ * last looked?" — so a stale value here silently disabled listen mode for
+ * exactly the chats people write in. `lastUpdatedDateTime` stays as the
  * fallback for chats Graph returns without a preview.
  */
 function chatActivity(raw: Raw): string | undefined {

package/src/safety/index.ts

@@ -18,8 +18,9 @@
  * which channel a message is actually headed for.
  */
 
-import type { ResolvedAuthMode, SafetyLevel, TeamsConnection } from "../config/index.ts";
+import type { ResolvedAiFooter, ResolvedAuthMode, SafetyLevel, TeamsConnection } from "../config/index.ts";
 import { checkScope, type ScopeCategory, type ScopeMode } from "../config/scope.ts";
+import { applyAiFooter } from "../utils/disclosure.ts";
 import { ScopeDeniedError } from "../utils/errors.ts";
 import { MUTATION_TOOLS } from "../tools/tool-names.ts";
 
@@ -103,30 +104,39 @@ const APP_ONLY_FORBIDDEN = new Set<string>([
  *
  * This is the last thing a user reads before pi speaks for them, so it shows
  * the destination and the actual text — never just the tool name.
+ *
+ * The AI footer is applied here as well, for the same reason: a confirmation
+ * that shows the body without the disclosure would be a confirmation of a
+ * different message than the one that gets sent.
  */
 export function formatMutationSummary(
 	toolName: string,
 	params: Record<string, unknown>,
+	footer?: ResolvedAiFooter,
 ): string {
 	const text = (value: unknown, max = 160): string => {
 		const str = String(value ?? "").replace(/\s*\n\s*/g, " ").trim();
 		return str.length > max ? `${str.slice(0, max - 1)}…` : str;
 	};
+	const disclosed = (value: unknown): string => applyAiFooter(text(value, 400), footer);
 
 	switch (toolName) {
 		case "teams_send_chat_message":
-			return `Send a chat message to "${text(params.chat, 60)}":\n\n${text(params.body, 400)}`;
+			return `Send a chat message to "${text(params.chat, 60)}":\n\n${disclosed(params.body)}`;
 		case "teams_send_channel_message": {
 			const where = params.team ? `${text(params.team, 40)}/${text(params.channel, 40)}` : text(params.channel, 60);
-			return `Post in channel ${where}:\n\n${text(params.body, 400)}`;
+			return `Post in channel ${where}:\n\n${disclosed(params.body)}`;
 		}
 		case "teams_reply_channel_message": {
 			const where = params.team ? `${text(params.team, 40)}/${text(params.channel, 40)}` : text(params.channel, 60);
-			return `Reply in thread ${text(params.messageId, 40)} (${where}):\n\n${text(params.body, 400)}`;
+			return `Reply in thread ${text(params.messageId, 40)} (${where}):\n\n${disclosed(params.body)}`;
 		}
 		case "teams_create_chat": {
 			const people = Array.isArray(params.participants) ? params.participants.join(", ") : text(params.participants);
-			return `Create a new chat with: ${text(people, 200)}`;
+			const first = typeof params.message === "string" && params.message.trim()
+				? `\n\nFirst message:\n${disclosed(params.message)}`
+				: "";
+			return `Create a new chat with: ${text(people, 200)}${first}`;
 		}
 		case "teams_delete_message":
 			return `Delete your message ${text(params.messageId, 60)}`;
@@ -135,7 +145,7 @@ export function formatMutationSummary(
 		case "teams_mark_read":
 			return `${params.read === false ? "Mark as unread" : "Mark as read"}: chat "${text(params.chat, 60)}"`;
 		case "teams_update_message":
-			return `Edit your message ${text(params.messageId, 50)} in ${text(params.chat ?? params.channel, 60)}:\n\n${text(params.body, 400)}`;
+			return `Edit your message ${text(params.messageId, 50)} in ${text(params.chat ?? params.channel, 60)}:\n\n${disclosed(params.body)}`;
 		case "teams_chat_members":
 			return `${params.action === "remove" ? "Remove" : "Add"} ${text(params.person, 80)} ${params.action === "remove" ? "from" : "to"} the chat "${text(params.chat, 60)}"`;
 		case "teams_respond_invite":

package/src/status.ts

@@ -31,6 +31,8 @@ export interface ConnectionCard {
 	watching?: boolean;
 	/** One line on what the watcher is doing, when it runs */
 	watchSummary?: string;
+	/** The AI disclosure in force, rendered as one line; undefined when off */
+	aiFooter?: string;
 }
 
 export function buildConnectionCard(
@@ -67,6 +69,9 @@ export function buildConnectionCard(
 					.filter(Boolean)
 					.join(" · ")
 			: undefined,
+		// Off is the normal state and needs no explanation; on gets the wording,
+		// because that is what every recipient is about to read.
+		aiFooter: conn.aiFooter.enabled ? `on — “${conn.aiFooter.text}”` : undefined,
 	};
 }
 
@@ -119,6 +124,7 @@ export function formatStatusText(card: ConnectionCard | undefined): string {
 	lines.push(
 		`- **Listen mode:** ${card.watching ? `on — ${card.watchSummary ?? "running"}` : "off"}`,
 	);
+	lines.push(`- **AI footer:** ${card.aiFooter ?? "off"}`);
 
 	lines.push("", "### What pi may do", "", card.permissionSummary);
 	return lines.join("\n");

package/src/tools/teams-create-chat.ts

@@ -10,6 +10,7 @@ import { createChat, resolveParticipants } from "../graph/chats.ts";
 import { sendChatMessage } from "../graph/messages.ts";
 import { auditWrite } from "../safety/audit.ts";
 import { assertAccess } from "../safety/index.ts";
+import { applyAiFooter } from "../utils/disclosure.ts";
 import { truncate } from "../utils/formatting.ts";
 import {
 	AccountParam,
@@ -94,16 +95,19 @@ export const teamsCreateChatTool = {
 			const lines = [`✅ Chat with **${label}** ready.`, "", `chatId: ${chat.id}`];
 
 			if (params.message?.trim()) {
-				const sent = await sendChatMessage(conn, chat.id, { body: params.message }, signal);
+				// The first message of a new chat is a message like any other, so the
+				// disclosure applies to it too.
+				const body = applyAiFooter(params.message, conn.aiFooter);
+				const sent = await sendChatMessage(conn, chat.id, { body }, signal);
 				auditWrite(conn.audit, {
 					tool: "teams_create_chat",
 					account: conn.account,
 					tenant: conn.tenant,
 					actor: me?.upn,
 					target: `chat:${label}`,
-					summary: truncate(params.message, 200),
+					summary: truncate(body, 200),
 				});
-				lines.push("", `Sent as ${me?.displayName ?? "you"}:`, "", `> ${truncate(params.message, 300)}`, "", `messageId: ${sent.id}`);
+				lines.push("", `Sent as ${me?.displayName ?? "you"}:`, "", `> ${truncate(body, 300)}`, "", `messageId: ${sent.id}`);
 			}
 
 			return textResult(lines.join("\n"), { chatId: chat.id, participants: resolved.length });

package/src/tools/teams-send-channel-message.ts

@@ -10,6 +10,7 @@ import { Type } from "typebox";
 import { replyToChannelMessage, sendChannelMessage } from "../graph/messages.ts";
 import { resolveUserId } from "../graph/me.ts";
 import { auditWrite } from "../safety/audit.ts";
+import { applyAiFooter } from "../utils/disclosure.ts";
 import { assertAccess } from "../safety/index.ts";
 import { truncate } from "../utils/formatting.ts";
 import { requireChannel } from "./resolve.ts";
@@ -115,13 +116,16 @@ export const teamsSendChannelMessageTool = {
 
 			const me = await currentUser(conn, signal).catch(() => undefined);
 			const target = `${team.displayName}/${channel.displayName}`;
+			// The disclosure is added here, not asked for: what leaves the account
+			// has to carry it whether or not the model remembered.
+			const body = applyAiFooter(params.body, conn.aiFooter, { html: params.html });
 
 			try {
 				const sent = await sendChannelMessage(
 					conn,
 					channel,
 					{
-						body: params.body,
+						body,
 						html: params.html,
 						subject: params.subject,
 						importance: params.importance,
@@ -136,14 +140,14 @@ export const teamsSendChannelMessageTool = {
 					tenant: conn.tenant,
 					actor: me?.upn,
 					target: `channel:${target}`,
-					summary: truncate(params.body, 200),
+					summary: truncate(body, 200),
 				});
 
 				return textResult(
 					[
 						`✅ Posted in **${target}** as ${me?.displayName ?? "you"} (${connectionLabel(conn)}).`,
 						"",
-						`> ${truncate(params.body, 300)}`,
+						`> ${truncate(body, 300)}`,
 						"",
 						`messageId: ${sent.id}`,
 					].join("\n"),
@@ -156,7 +160,7 @@ export const teamsSendChannelMessageTool = {
 					tenant: conn.tenant,
 					actor: me?.upn,
 					target: `channel:${target}`,
-					summary: truncate(params.body, 200),
+					summary: truncate(body, 200),
 					error: err instanceof Error ? err.message : String(err),
 				});
 				throw err;
@@ -204,6 +208,9 @@ export const teamsReplyChannelMessageTool = {
 
 			const me = await currentUser(conn, signal).catch(() => undefined);
 			const target = `${team.displayName}/${channel.displayName}`;
+			// The disclosure is added here, not asked for: what leaves the account
+			// has to carry it whether or not the model remembered.
+			const body = applyAiFooter(params.body, conn.aiFooter, { html: params.html });
 
 			try {
 				const sent = await replyToChannelMessage(
@@ -211,7 +218,7 @@ export const teamsReplyChannelMessageTool = {
 					channel,
 					params.messageId,
 					{
-						body: params.body,
+						body,
 						html: params.html,
 						importance: params.importance,
 						mentions,
@@ -225,14 +232,14 @@ export const teamsReplyChannelMessageTool = {
 					tenant: conn.tenant,
 					actor: me?.upn,
 					target: `channel:${target}#${params.messageId}`,
-					summary: truncate(params.body, 200),
+					summary: truncate(body, 200),
 				});
 
 				return textResult(
 					[
 						`✅ Replied in **${target}** (thread ${params.messageId}) as ${me?.displayName ?? "you"}.`,
 						"",
-						`> ${truncate(params.body, 300)}`,
+						`> ${truncate(body, 300)}`,
 						"",
 						`messageId: ${sent.id}`,
 					].join("\n"),
@@ -245,7 +252,7 @@ export const teamsReplyChannelMessageTool = {
 					tenant: conn.tenant,
 					actor: me?.upn,
 					target: `channel:${target}#${params.messageId}`,
-					summary: truncate(params.body, 200),
+					summary: truncate(body, 200),
 					error: err instanceof Error ? err.message : String(err),
 				});
 				throw err;

package/src/tools/teams-send-chat-message.ts

@@ -12,6 +12,7 @@ import { sendChatMessage } from "../graph/messages.ts";
 import { resolveUserId } from "../graph/me.ts";
 import { auditWrite } from "../safety/audit.ts";
 import { assertAccess } from "../safety/index.ts";
+import { applyAiFooter } from "../utils/disclosure.ts";
 import { truncate } from "../utils/formatting.ts";
 import { requireChat } from "./resolve.ts";
 import {
@@ -108,12 +109,16 @@ export const teamsSendChatMessageTool = {
 
 			const me = await currentUser(conn, signal).catch(() => undefined);
 
+			// The disclosure is added here, not asked for: what leaves the account
+			// has to carry it whether or not the model remembered.
+			const body = applyAiFooter(params.body, conn.aiFooter, { html: params.html });
+
 			try {
 				const sent = await sendChatMessage(
 					conn,
 					chat.id,
 					{
-						body: params.body,
+						body,
 						html: params.html,
 						importance: params.importance,
 						mentions,
@@ -127,14 +132,14 @@ export const teamsSendChatMessageTool = {
 					tenant: conn.tenant,
 					actor: me?.upn,
 					target: `chat:${chat.label}`,
-					summary: truncate(params.body, 200),
+					summary: truncate(body, 200),
 				});
 
 				return textResult(
 					[
 						`✅ Message sent to **${chat.label}** as ${me?.displayName ?? "you"} (${connectionLabel(conn)}).`,
 						"",
-						`> ${truncate(params.body, 300)}`,
+						`> ${truncate(body, 300)}`,
 						"",
 						`messageId: ${sent.id}`,
 					].join("\n"),
@@ -147,7 +152,7 @@ export const teamsSendChatMessageTool = {
 					tenant: conn.tenant,
 					actor: me?.upn,
 					target: `chat:${chat.label}`,
-					summary: truncate(params.body, 200),
+					summary: truncate(body, 200),
 					error: err instanceof Error ? err.message : String(err),
 				});
 				throw err;