agent-messenger 2.27.2 → 2.29.0

package/src/platforms/teams/commands/auth.ts

@@ -2,14 +2,178 @@ import { Command } from 'commander'
 
 import { collectBrowserProfileOption } from '@/shared/chromium'
 import { handleError } from '@/shared/utils/error-handler'
+import { isInteractive } from '@/shared/utils/interactive'
 import { formatOutput } from '@/shared/utils/output'
-import { debug } from '@/shared/utils/stderr'
+import { debug, info } from '@/shared/utils/stderr'
 
 import { TeamsClient } from '../client'
 import { TeamsCredentialManager } from '../credential-manager'
+import { completeDeviceCode, loginWithDeviceCode, PendingApprovalError, startDeviceCode } from '../device-login'
+import { probeAccountType } from '../realm-discovery'
 import { TeamsTokenExtractor } from '../token-extractor'
 import type { TeamsAccount, TeamsAccountType, TeamsConfig } from '../types'
 
+interface LoginOptions {
+  pretty?: boolean
+  debug?: boolean
+  deviceCode?: string
+  clientId?: string
+  accountType?: string
+  email?: string
+}
+
+export async function loginAction(options: LoginOptions): Promise<void> {
+  try {
+    const explicitAccountType = resolveLoginAccountType(options.accountType)
+    if (options.deviceCode) {
+      await finishDeviceCode(options, explicitAccountType)
+      return
+    }
+    if (!isInteractive()) {
+      const accountType = options.email
+        ? await resolveAccountTypeFromEmail(options, explicitAccountType)
+        : explicitAccountType
+      await startNonInteractiveLogin(options.clientId, accountType)
+      return
+    }
+
+    const debugLog = options.debug ? (msg: string) => debug(`[debug] ${msg}`) : undefined
+    const accountType = await resolveAccountTypeFromEmail(options, explicitAccountType)
+    const result = await loginWithDeviceCode({
+      clientId: options.clientId,
+      accountType,
+      onCode: async ({ verificationUri, userCode }) => {
+        info(`\nTo sign in, open ${verificationUri} and enter code ${userCode}\n`)
+        info(`Waiting for approval of code ${userCode}...`)
+      },
+      onPending: () => info('Approved. Finishing sign-in...'),
+      debug: debugLog,
+    })
+
+    console.log(
+      formatOutput(
+        {
+          authenticated: true,
+          account_type: result.accountType,
+          user: result.userName,
+          teams: result.teams.map((t) => `${t.id}/${t.name}`),
+          current: result.current,
+        },
+        options.pretty,
+      ),
+    )
+  } catch (error) {
+    handleError(error as Error)
+  }
+}
+
+function resolveLoginAccountType(value: string | undefined): TeamsAccountType {
+  if (value === undefined) return 'work'
+  if (value === 'work' || value === 'personal') return value
+  throw new Error('Invalid account type. Use "work" or "personal".')
+}
+
+// When the user did not force --account-type, look the account up by email so a
+// personal account is routed to the personal flow up front instead of failing
+// after approval. Any misstep falls back to the caller's default account type.
+async function resolveAccountTypeFromEmail(
+  options: LoginOptions,
+  fallback: TeamsAccountType,
+): Promise<TeamsAccountType> {
+  if (options.accountType !== undefined) return fallback
+
+  const email = options.email ?? (isInteractive() ? await promptEmail() : undefined)
+  if (!email) return fallback
+
+  const probed = await probeAccountType(email)
+  if (!probed) return fallback
+  if (probed === 'personal') {
+    info('Detected a personal Microsoft account. Using personal sign-in.')
+  }
+  return probed
+}
+
+async function promptEmail(): Promise<string | undefined> {
+  const { createInterface } = await import('node:readline/promises')
+  const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true })
+  try {
+    const answer = await rl.question('Microsoft email (press Enter to skip): ')
+    return answer.trim() || undefined
+  } finally {
+    rl.close()
+  }
+}
+
+async function startNonInteractiveLogin(
+  clientIdOverride: string | undefined,
+  accountType: TeamsAccountType,
+): Promise<void> {
+  const { info: device, clientId } = await startDeviceCode(clientIdOverride, accountType)
+  const clientIdFlag = clientIdOverride ? ` --client-id ${clientIdOverride}` : ''
+  const accountTypeFlag = accountType === 'personal' ? ' --account-type personal' : ''
+  console.log(
+    formatOutput({
+      next_action: 'authorize',
+      account_type: accountType,
+      verification_uri: device.verificationUri,
+      verification_uri_complete: device.verificationUriComplete,
+      user_code: device.userCode,
+      device_code: device.deviceCode,
+      client_id: clientId,
+      expires_at: Date.now() + device.expiresIn * 1000,
+      message: `Show the user \`verification_uri\` and \`user_code\` (or \`verification_uri_complete\`) and ask them to approve in a browser. After they approve, run \`agent-teams auth login --device-code <device_code>${clientIdFlag}${accountTypeFlag}\` to finish.`,
+    }),
+  )
+  process.exit(0)
+}
+
+async function finishDeviceCode(options: LoginOptions, accountType: TeamsAccountType): Promise<void> {
+  const { getTeamsAppClientId } = await import('../app-config')
+  const clientId = options.clientId ?? getTeamsAppClientId(accountType).clientId
+  try {
+    const result = await completeDeviceCode(options.deviceCode!, clientId, undefined, accountType)
+    console.log(
+      formatOutput(
+        {
+          authenticated: true,
+          account_type: result.accountType,
+          user: result.userName,
+          teams: result.teams.map((t) => `${t.id}/${t.name}`),
+          current: result.current,
+        },
+        options.pretty,
+      ),
+    )
+  } catch (error) {
+    if (error instanceof PendingApprovalError) {
+      const clientIdFlag = options.clientId ? ` --client-id ${options.clientId}` : ''
+      const accountTypeFlag = options.accountType ? ` --account-type ${accountType}` : ''
+      console.log(
+        formatOutput(
+          {
+            next_action: 'still_pending',
+            device_code: options.deviceCode,
+            message: `User has not approved yet. Confirm they completed authorization in the browser, then run \`agent-teams auth login --device-code <device_code>${clientIdFlag}${accountTypeFlag}\` again.`,
+          },
+          options.pretty,
+        ),
+      )
+      process.exit(0)
+    }
+    console.log(
+      formatOutput(
+        {
+          next_action: 'restart',
+          error: (error as Error).message,
+          message: 'This device code is no longer valid. Run `agent-teams auth login` to start over.',
+        },
+        options.pretty,
+      ),
+    )
+    process.exit(1)
+  }
+}
+
 interface ValidatedTeamsToken {
   client: TeamsClient
   accountType: TeamsAccountType
@@ -308,7 +472,9 @@ export async function logoutAction(options: { pretty?: boolean }): Promise<void>
     const config = await credManager.loadConfig()
 
     if (!config || Object.keys(config.accounts).length === 0) {
-      console.log(formatOutput({ error: 'Not authenticated. Run "auth extract" first.' }, options.pretty))
+      console.log(
+        formatOutput({ error: 'Not authenticated. Run "auth login" or "auth extract" first.' }, options.pretty),
+      )
       process.exit(1)
     }
 
@@ -326,7 +492,9 @@ export async function statusAction(options: { pretty?: boolean }): Promise<void>
     const config = await credManager.loadConfig()
 
     if (!config || Object.keys(config.accounts).length === 0) {
-      console.log(formatOutput({ error: 'Not authenticated. Run "auth extract" first.' }, options.pretty))
+      console.log(
+        formatOutput({ error: 'Not authenticated. Run "auth login" or "auth extract" first.' }, options.pretty),
+      )
       process.exit(1)
     }
 
@@ -427,6 +595,17 @@ export async function switchAccountAction(accountType: string, options: { pretty
 
 export const authCommand = new Command('auth')
   .description('Authentication commands')
+  .addCommand(
+    new Command('login')
+      .description('Sign in via device code (no desktop app needed). Detects the account type from your email.')
+      .option('--pretty', 'Pretty print JSON output')
+      .option('--debug', 'Show debug output for troubleshooting')
+      .option('--device-code <code>', 'Finish a non-interactive login started earlier')
+      .option('--client-id <id>', 'Override the AAD client ID')
+      .option('--account-type <type>', 'Force account type: work or personal (skips email detection)')
+      .option('--email <email>', 'Microsoft email, used to auto-detect work vs personal')
+      .action(loginAction),
+  )
   .addCommand(
     new Command('extract')
       .description('Extract token from Microsoft Teams desktop app or a supported Chromium browser')

package/src/platforms/teams/commands/file.test.ts

@@ -1,13 +1,22 @@
 import { afterEach, beforeEach, expect, mock, spyOn, it } from 'bun:test'
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 
 import { TeamsClient } from '../client'
 import { TeamsCredentialManager } from '../credential-manager'
-import { infoAction, listAction, uploadAction } from './file'
+import { TeamsAuthCapabilityError } from '../types'
+import { downloadAction, infoAction, listAction, uploadAction } from './file'
 
 let clientUploadFileSpy: ReturnType<typeof spyOn>
 let clientListFilesSpy: ReturnType<typeof spyOn>
+let clientDownloadFileSpy: ReturnType<typeof spyOn>
 let credManagerLoadConfigSpy: ReturnType<typeof spyOn>
+let processExitSpy: ReturnType<typeof spyOn>
+const tempDirs: string[] = []
 const originalConsoleLog = console.log
+const originalConsoleError = console.error
+const originalCwd = process.cwd()
 
 beforeEach(() => {
   clientUploadFileSpy = spyOn(TeamsClient.prototype, 'uploadFile').mockResolvedValue({
@@ -35,6 +44,17 @@ beforeEach(() => {
     },
   ])
 
+  clientDownloadFileSpy = spyOn(TeamsClient.prototype, 'downloadFile').mockResolvedValue({
+    buffer: Buffer.from('downloaded-content'),
+    file: {
+      id: 'file_123',
+      name: 'folder\\test.pdf',
+      size: 18,
+      url: 'https://teams.microsoft.com/files/123/test.pdf',
+      contentType: 'application/pdf',
+    },
+  })
+
   credManagerLoadConfigSpy = spyOn(TeamsCredentialManager.prototype, 'loadConfig').mockResolvedValue({
     current_account: 'work',
     accounts: {
@@ -46,13 +66,24 @@ beforeEach(() => {
       },
     },
   })
+
+  processExitSpy = spyOn(process, 'exit').mockImplementation((code?: string | number | null | undefined): never => {
+    throw new Error(`process.exit:${code ?? 0}`)
+  })
 })
 
 afterEach(() => {
   clientUploadFileSpy?.mockRestore()
   clientListFilesSpy?.mockRestore()
+  clientDownloadFileSpy?.mockRestore()
   credManagerLoadConfigSpy?.mockRestore()
+  processExitSpy?.mockRestore()
   console.log = originalConsoleLog
+  console.error = originalConsoleError
+  process.chdir(originalCwd)
+  for (const dir of tempDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true })
+  }
 })
 
 it('upload: sends multipart request and returns file info', async () => {
@@ -90,3 +121,63 @@ it('info: returns single file details', async () => {
   expect(output).toContain('file_123')
   expect(output).toContain('test.pdf')
 })
+
+it('download: writes to a directory using a safe basename', async () => {
+  const consoleSpy = mock((_msg: string) => {})
+  console.log = consoleSpy
+  const dir = mkdtempSync(join(tmpdir(), 'teams-download-dir-'))
+  tempDirs.push(dir)
+
+  await downloadAction('team_123', 'ch_456', 'file_123', dir, { pretty: false })
+
+  const downloadedPath = join(dir, 'test.pdf')
+  expect(readFileSync(downloadedPath, 'utf8')).toBe('downloaded-content')
+  expect(clientDownloadFileSpy).toHaveBeenCalledWith('team_123', 'ch_456', 'file_123')
+  const output = consoleSpy.mock.calls[0][0]
+  expect(output).toContain(downloadedPath)
+})
+
+it('download: writes to an explicit output file path', async () => {
+  const consoleSpy = mock((_msg: string) => {})
+  console.log = consoleSpy
+  const dir = mkdtempSync(join(tmpdir(), 'teams-download-file-'))
+  tempDirs.push(dir)
+  const outputPath = join(dir, 'renamed.pdf')
+
+  await downloadAction('team_123', 'ch_456', 'file_123', outputPath, { pretty: false })
+
+  expect(readFileSync(outputPath, 'utf8')).toBe('downloaded-content')
+  const output = consoleSpy.mock.calls[0][0]
+  expect(output).toContain(outputPath)
+})
+
+it('download: writes to cwd when output path is omitted', async () => {
+  const consoleSpy = mock((_msg: string) => {})
+  console.log = consoleSpy
+  const dir = mkdtempSync(join(tmpdir(), 'teams-download-cwd-'))
+  tempDirs.push(dir)
+  process.chdir(dir)
+
+  await downloadAction('team_123', 'ch_456', 'file_123', undefined, { pretty: false })
+
+  const downloadedPath = join(dir, 'test.pdf')
+  expect(readFileSync(downloadedPath, 'utf8')).toBe('downloaded-content')
+  const output = consoleSpy.mock.calls[0][0]
+  expect(output).toContain(downloadedPath)
+})
+
+it('download: exits on capability error without writing a partial file', async () => {
+  const consoleErrorSpy = mock((_msg: string) => {})
+  console.error = consoleErrorSpy
+  const dir = mkdtempSync(join(tmpdir(), 'teams-download-capability-'))
+  tempDirs.push(dir)
+  const outputPath = join(dir, 'sharepoint.docx')
+  clientDownloadFileSpy.mockRejectedValue(new TeamsAuthCapabilityError())
+
+  await expect(downloadAction('team_123', 'ch_456', 'file_123', outputPath, { pretty: false })).rejects.toThrow(
+    'process.exit:1',
+  )
+
+  expect(existsSync(outputPath)).toBe(false)
+  expect(consoleErrorSpy.mock.calls[0][0]).toContain('Requires `agent-teams auth login`')
+})

package/src/platforms/teams/commands/file.ts

@@ -1,4 +1,5 @@
-import { resolve } from 'node:path'
+import { statSync, writeFileSync } from 'node:fs'
+import { basename, join, resolve } from 'node:path'
 
 import { Command } from 'commander'
 
@@ -8,6 +9,7 @@ import { formatOutput } from '@/shared/utils/output'
 import { TeamsClient } from '../client'
 import { TeamsCredentialManager } from '../credential-manager'
 import type { TeamsFile } from '../types'
+import { TeamsAuthCapabilityError } from '../types'
 
 export async function uploadAction(
   teamId: string,
@@ -122,6 +124,69 @@ export async function infoAction(
   }
 }
 
+export async function downloadAction(
+  teamId: string,
+  channelId: string,
+  fileId: string,
+  outputPath: string | undefined,
+  options: { pretty?: boolean },
+): Promise<void> {
+  try {
+    const credManager = new TeamsCredentialManager()
+    const cred = await credManager.getTokenWithExpiry()
+
+    if (!cred) {
+      console.log(formatOutput({ error: 'Not authenticated. Run "auth extract" first.' }, options.pretty))
+      process.exit(1)
+    }
+
+    const client = await new TeamsClient().login({
+      token: cred.token,
+      tokenExpiresAt: cred.tokenExpiresAt,
+      accountType: cred.accountType,
+      region: cred.region,
+    })
+    const { buffer, file } = await client.downloadFile(teamId, channelId, fileId)
+
+    const safeName = basename(file.name.replace(/\\/g, '/'))
+    let destPath = outputPath ? resolve(outputPath) : resolve(safeName)
+    let isDirectory = false
+    try {
+      isDirectory = statSync(destPath).isDirectory()
+    } catch (error) {
+      const err = error as NodeJS.ErrnoException
+      if (err.code !== 'ENOENT') {
+        throw error
+      }
+    }
+
+    if (isDirectory) {
+      destPath = join(destPath, safeName)
+    }
+
+    writeFileSync(destPath, buffer)
+
+    console.log(
+      formatOutput(
+        {
+          id: file.id,
+          name: file.name,
+          size: file.size,
+          content_type: file.contentType || null,
+          path: destPath,
+        },
+        options.pretty,
+      ),
+    )
+  } catch (error) {
+    if (error instanceof TeamsAuthCapabilityError) {
+      console.error(error.message)
+      process.exit(1)
+    }
+    handleError(error as Error)
+  }
+}
+
 export const fileCommand = new Command('file')
   .description('File commands')
   .addCommand(
@@ -150,3 +215,13 @@ export const fileCommand = new Command('file')
       .option('--pretty', 'Pretty print JSON output')
       .action(infoAction),
   )
+  .addCommand(
+    new Command('download')
+      .description('Download file from channel')
+      .argument('<team-id>', 'Team ID')
+      .argument('<channel-id>', 'Channel ID')
+      .argument('<file-id>', 'File ID')
+      .argument('[output-path]', 'Output file or directory path')
+      .option('--pretty', 'Pretty print JSON output')
+      .action(downloadAction),
+  )

package/src/platforms/teams/commands/message.test.ts

@@ -2,14 +2,17 @@ import { afterEach, beforeEach, expect, mock, spyOn, it } from 'bun:test'
 
 import { TeamsClient } from '../client'
 import { TeamsCredentialManager } from '../credential-manager'
-import { deleteAction, getAction, listAction, sendAction } from './message'
+import { deleteAction, getAction, listAction, repliesAction, searchAction, sendAction, strictParseInt } from './message'
 
 let clientSendMessageSpy: ReturnType<typeof spyOn>
 let clientGetMessagesSpy: ReturnType<typeof spyOn>
+let clientGetThreadRepliesSpy: ReturnType<typeof spyOn>
 let clientGetMessageSpy: ReturnType<typeof spyOn>
 let clientDeleteMessageSpy: ReturnType<typeof spyOn>
+let clientSearchMessagesSpy: ReturnType<typeof spyOn>
 let credManagerLoadSpy: ReturnType<typeof spyOn>
 const originalConsoleLog = console.log
+const originalConsoleError = console.error
 
 beforeEach(() => {
   clientSendMessageSpy = spyOn(TeamsClient.prototype, 'sendMessage').mockResolvedValue({
@@ -37,6 +40,18 @@ beforeEach(() => {
     },
   ])
 
+  clientGetThreadRepliesSpy = spyOn(TeamsClient.prototype, 'getThreadReplies').mockResolvedValue([
+    {
+      id: 'reply_123',
+      channel_id: 'ch_456',
+      author: { id: 'user_789', displayName: 'Test User' },
+      content: 'Thread reply',
+      timestamp: '2025-01-29T10:02:00Z',
+      root_message_id: 'msg_123',
+      is_thread_reply: true,
+    },
+  ])
+
   clientGetMessageSpy = spyOn(TeamsClient.prototype, 'getMessage').mockResolvedValue({
     id: 'msg_123',
     channel_id: 'ch_456',
@@ -47,6 +62,20 @@ beforeEach(() => {
 
   clientDeleteMessageSpy = spyOn(TeamsClient.prototype, 'deleteMessage').mockResolvedValue(undefined)
 
+  clientSearchMessagesSpy = spyOn(TeamsClient.prototype, 'searchMessages').mockResolvedValue([
+    {
+      id: 'search_123',
+      content: 'Deploy complete',
+      author: { id: 'user_789', displayName: 'Test User' },
+      channel_id: 'ch_456',
+      thread_id: 'thread_123',
+      team_name: 'Test Team',
+      channel_name: 'General',
+      timestamp: '2025-01-29T10:03:00Z',
+      permalink: 'https://teams.microsoft.com/l/message/search_123',
+    },
+  ])
+
   credManagerLoadSpy = spyOn(TeamsCredentialManager.prototype, 'loadConfig').mockResolvedValue({
     current_account: 'work',
     accounts: {
@@ -63,10 +92,13 @@ beforeEach(() => {
 afterEach(() => {
   clientSendMessageSpy?.mockRestore()
   clientGetMessagesSpy?.mockRestore()
+  clientGetThreadRepliesSpy?.mockRestore()
   clientGetMessageSpy?.mockRestore()
   clientDeleteMessageSpy?.mockRestore()
+  clientSearchMessagesSpy?.mockRestore()
   credManagerLoadSpy?.mockRestore()
   console.log = originalConsoleLog
+  console.error = originalConsoleError
 })
 
 it('send: returns message with id', async () => {
@@ -92,6 +124,68 @@ it('list: returns array of messages', async () => {
   expect(output).toContain('msg_124')
 })
 
+it('replies: returns array of thread replies', async () => {
+  const consoleSpy = mock((_msg: string) => {})
+  console.log = consoleSpy
+
+  await repliesAction('team_123', 'ch_456', 'msg_123', { limit: 10, pretty: false })
+
+  expect(clientGetThreadRepliesSpy).toHaveBeenCalledWith('team_123', 'ch_456', 'msg_123', 10)
+  expect(consoleSpy).toHaveBeenCalled()
+  const output = consoleSpy.mock.calls[0][0]
+  expect(output).toContain('reply_123')
+  expect(output).toContain('msg_123')
+})
+
+it('search: returns search results and passes pagination options', async () => {
+  const consoleSpy = mock((_msg: string) => {})
+  console.log = consoleSpy
+
+  await searchAction('deploy', { limit: 10, from: 5, pretty: false })
+
+  expect(clientSearchMessagesSpy).toHaveBeenCalledWith('deploy', { limit: 10, from: 5 })
+  expect(consoleSpy).toHaveBeenCalled()
+  const output = consoleSpy.mock.calls[0][0]
+  expect(output).toContain('search_123')
+  expect(output).toContain('Deploy complete')
+})
+
+it.each([
+  ['abc', Number.NaN],
+  ['1.5', Number.NaN],
+  ['1abc', Number.NaN],
+  ['', Number.NaN],
+  ['10', 10],
+  [' 10 ', 10],
+  ['-1', -1],
+])('strictParseInt(%p) -> %p (rejects truncatable strings)', (input, expected) => {
+  const result = strictParseInt(input)
+  if (Number.isNaN(expected)) {
+    expect(Number.isNaN(result)).toBe(true)
+  } else {
+    expect(result).toBe(expected as number)
+  }
+})
+
+it.each([
+  ['--limit abc', { limit: Number.NaN, from: 0 }],
+  ['--limit 0', { limit: 0, from: 0 }],
+  ['--limit -1', { limit: -1, from: 0 }],
+  ['--from -1', { limit: 20, from: -1 }],
+])('search: rejects invalid pagination %s', async (_label, options) => {
+  const consoleErrorSpy = mock((_msg: string) => {})
+  console.error = consoleErrorSpy
+  const exitSpy = spyOn(process, 'exit').mockImplementation((code?: string | number | null) => {
+    throw new Error(`exit:${code}`)
+  })
+
+  await expect(searchAction('deploy', { ...options, pretty: false })).rejects.toThrow('exit:1')
+
+  expect(consoleErrorSpy).toHaveBeenCalled()
+  expect(clientSearchMessagesSpy).not.toHaveBeenCalled()
+  exitSpy.mockRestore()
+})
+
 it('get: returns single message', async () => {
   const consoleSpy = mock((_msg: string) => {})
   console.log = consoleSpy