agent-messenger 2.27.2 → 2.29.0

package/src/platforms/teams/device-login.ts

@@ -0,0 +1,206 @@
+import { getTeamsAppClientId } from './app-config'
+import { TeamsClient } from './client'
+import { TeamsCredentialManager } from './credential-manager'
+import {
+  type AadToken,
+  type DeviceCodeInfo,
+  decodeJwtTid,
+  exchangeDeviceCode,
+  exchangeForSkypeScope,
+  isConsumerTenant,
+  mintSkypeToken,
+  pollDeviceToken,
+  requestDeviceCode,
+  resolveWorkTenantId,
+} from './device-code'
+import { type TeamsAccountType, TeamsError } from './types'
+
+const PERSONAL_ACCOUNT_HINT =
+  'This looks like a personal Microsoft account. Run `agent-teams auth login --account-type personal` to sign in.'
+
+export interface DeviceCodePrompt {
+  verificationUri: string
+  verificationUriComplete: string
+  userCode: string
+  expiresAt: number
+}
+
+export interface DeviceLoginResult {
+  accountType: TeamsAccountType
+  userName: string
+  teams: Array<{ id: string; name: string }>
+  current: string | null
+}
+
+interface LoginCallbacks {
+  onCode: (prompt: DeviceCodePrompt) => void | Promise<void>
+  onPending?: () => void
+  debug?: (message: string) => void
+  clientId?: string
+  accountType?: TeamsAccountType
+}
+
+export async function startDeviceCode(
+  clientIdOverride?: string,
+  accountType: TeamsAccountType = 'personal',
+): Promise<{ info: DeviceCodeInfo; clientId: string }> {
+  const clientId = clientIdOverride ?? getTeamsAppClientId(accountType).clientId
+  const info = await requestDeviceCode(clientId, accountType)
+  return { info, clientId }
+}
+
+export async function completeDeviceCode(
+  deviceCode: string,
+  clientId: string,
+  credManager: TeamsCredentialManager = new TeamsCredentialManager(),
+  accountType: TeamsAccountType = 'personal',
+): Promise<DeviceLoginResult> {
+  const first = await exchangeDeviceCode(deviceCode, clientId, accountType)
+  if (first.status === 'pending' || first.status === 'slow_down') {
+    throw new PendingApprovalError()
+  }
+  if (first.status !== 'success') {
+    throw new Error(
+      first.status === 'expired'
+        ? 'Device code expired.'
+        : first.status === 'declined'
+          ? 'Authorization declined.'
+          : `Login failed: ${first.message}`,
+    )
+  }
+  return finalize(first.token, clientId, accountType, credManager)
+}
+
+export async function loginWithDeviceCode(
+  callbacks: LoginCallbacks,
+  credManager: TeamsCredentialManager = new TeamsCredentialManager(),
+): Promise<DeviceLoginResult> {
+  const accountType = callbacks.accountType ?? 'personal'
+  const { info, clientId } = await startDeviceCode(callbacks.clientId, accountType)
+  await callbacks.onCode({
+    verificationUri: info.verificationUri,
+    verificationUriComplete: info.verificationUriComplete,
+    userCode: info.userCode,
+    expiresAt: Date.now() + info.expiresIn * 1000,
+  })
+
+  const aad = await pollDeviceToken(info.deviceCode, info.interval, info.expiresIn, clientId, accountType)
+
+  // A work login can resolve to a personal (MSA) account, whose token carries a
+  // consumer tenant. Such accounts have no org tenant and can't be finished on
+  // the work flow, so stop with an actionable hint rather than fail obscurely.
+  if (accountType === 'work' && isPersonalAccount(aad)) {
+    throw new TeamsError(PERSONAL_ACCOUNT_HINT, 'teams_personal_account_on_work_login')
+  }
+
+  callbacks.onPending?.()
+  return finalize(aad, clientId, accountType, credManager, callbacks.debug)
+}
+
+function isPersonalAccount(aad: AadToken): boolean {
+  const tid = decodeJwtTid(aad.accessToken)
+  return tid !== undefined && isConsumerTenant(tid)
+}
+
+async function finalize(
+  initialAad: AadToken,
+  clientId: string,
+  accountType: TeamsAccountType,
+  credManager: TeamsCredentialManager,
+  debug?: (message: string) => void,
+): Promise<DeviceLoginResult> {
+  if (!initialAad.refreshToken) {
+    throw new Error(
+      'Sign-in did not return a refresh token (needed to mint the Teams token). Retry `auth login`, or use `auth extract` if this persists.',
+    )
+  }
+
+  let tenantId: string | undefined
+  if (accountType === 'work') {
+    debug?.('Resolving Teams tenant...')
+    tenantId = await resolveWorkTenantId(initialAad.accessToken)
+  }
+
+  debug?.('Exchanging token for skype audience...')
+  const skypeScoped = await exchangeForSkypeScope(initialAad.refreshToken, clientId, accountType, tenantId)
+
+  debug?.('Minting skype token...')
+  const minted = await mintSkypeToken(skypeScoped.accessToken, accountType)
+
+  const client = await new TeamsClient().login({ token: minted.skypeToken, accountType })
+  const authInfo = await client.testAuth()
+  const teams = await client.listTeams()
+
+  const teamMap: Record<string, { team_id: string; team_name: string }> = {}
+  for (const team of teams) {
+    teamMap[team.id] = { team_id: team.id, team_name: team.name }
+  }
+  const currentTeam = teams[0]?.id ?? null
+
+  await credManager.setDeviceCodeAccount({
+    accountType,
+    token: minted.skypeToken,
+    tokenExpiresAt: minted.skypeTokenExpiresAt,
+    aadRefreshToken: skypeScoped.refreshToken,
+    aadClientId: clientId,
+    aadTenantId: tenantId,
+    region: minted.region ?? (accountType === 'work' ? client.getRegion() : undefined),
+    userName: authInfo.displayName,
+    teams: teamMap,
+    currentTeam,
+    authMethod: 'device-code',
+  })
+
+  return {
+    accountType,
+    userName: authInfo.displayName,
+    teams: teams.map((t) => ({ id: t.id, name: t.name })),
+    current: currentTeam,
+  }
+}
+
+export async function refreshDeviceCodeAccount(
+  accountType: TeamsAccountType,
+  credManager: TeamsCredentialManager = new TeamsCredentialManager(),
+  debug?: (message: string) => void,
+): Promise<boolean> {
+  const config = await credManager.loadConfig()
+  const account = config?.accounts[accountType]
+  if (!account || account.auth_method !== 'device-code' || !account.aad_refresh_token) {
+    return false
+  }
+  const clientId = account.aad_client_id ?? getTeamsAppClientId(accountType).clientId
+
+  try {
+    debug?.('Silently refreshing skype token...')
+    const tenantId = accountType === 'work' ? account.aad_tenant_id : undefined
+    const skypeScoped = await exchangeForSkypeScope(account.aad_refresh_token, clientId, accountType, tenantId)
+    const minted = await mintSkypeToken(skypeScoped.accessToken, accountType)
+
+    await credManager.setDeviceCodeAccount({
+      accountType,
+      token: minted.skypeToken,
+      tokenExpiresAt: minted.skypeTokenExpiresAt,
+      aadRefreshToken: skypeScoped.refreshToken,
+      aadClientId: clientId,
+      aadTenantId: tenantId,
+      region: minted.region ?? account.region,
+      userName: account.user_name,
+      teams: account.teams,
+      currentTeam: account.current_team,
+      authMethod: 'device-code',
+      makeCurrent: false,
+    })
+    return true
+  } catch (error) {
+    debug?.(`Silent refresh failed: ${(error as Error).message}`)
+    return false
+  }
+}
+
+export class PendingApprovalError extends Error {
+  constructor() {
+    super('Authorization pending. Approve in the browser, then retry.')
+    this.name = 'PendingApprovalError'
+  }
+}

package/src/platforms/teams/ensure-auth.ts

@@ -2,6 +2,7 @@ import { warn } from '@/shared/utils/stderr'
 
 import { TeamsClient } from './client'
 import { TeamsCredentialManager } from './credential-manager'
+import { refreshDeviceCodeAccount } from './device-login'
 import { TeamsTokenExtractor } from './token-extractor'
 import type { TeamsAccount, TeamsAccountType, TeamsConfig } from './types'
 
@@ -12,6 +13,8 @@ export async function ensureTeamsAuth(): Promise<void> {
 
     if (config && hasValidToken(config)) return
 
+    if (config && (await trySilentRefresh(config, credManager))) return
+
     const extractor = new TeamsTokenExtractor()
     const extracted = await extractor.extract()
     if (extracted.length === 0) return
@@ -92,6 +95,14 @@ async function resolveAccountType(
   throw lastError ?? new Error('Token validation failed')
 }
 
+async function trySilentRefresh(config: TeamsConfig, credManager: TeamsCredentialManager): Promise<boolean> {
+  const key = TeamsCredentialManager.accountOverride ?? config.current_account
+  if (!key) return false
+  const account = config.accounts[key]
+  if (account?.auth_method !== 'device-code' || !account.aad_refresh_token) return false
+  return refreshDeviceCodeAccount(key as TeamsAccountType, credManager)
+}
+
 function hasValidToken(config: TeamsConfig): boolean {
   const key = TeamsCredentialManager.accountOverride ?? config.current_account
   if (!key) return false

package/src/platforms/teams/index.test.ts

@@ -13,7 +13,9 @@ import {
   TeamsFileSchema,
   TeamsMessageSchema,
   TeamsReactionSchema,
+  TeamsSearchResultSchema,
   TeamsTeamSchema,
+  TeamsTokenProvider,
   TeamsUserSchema,
 } from '@/platforms/teams/index'
 
@@ -29,6 +31,10 @@ it('TeamsCredentialManager is exported from barrel', () => {
   expect(typeof TeamsCredentialManager).toBe('function')
 })
 
+it('TeamsTokenProvider is exported from barrel', () => {
+  expect(typeof TeamsTokenProvider).toBe('function')
+})
+
 it('TeamsTeamSchema is exported from barrel', () => {
   expect(typeof TeamsTeamSchema.parse).toBe('function')
 })
@@ -41,6 +47,10 @@ it('TeamsMessageSchema is exported from barrel', () => {
   expect(typeof TeamsMessageSchema.parse).toBe('function')
 })
 
+it('TeamsSearchResultSchema is exported from barrel', () => {
+  expect(typeof TeamsSearchResultSchema.parse).toBe('function')
+})
+
 it('TeamsUserSchema is exported from barrel', () => {
   expect(typeof TeamsUserSchema.parse).toBe('function')
 })

package/src/platforms/teams/index.ts

@@ -1,6 +1,16 @@
 export { TeamsClient } from './client'
 export { TeamsCredentialManager } from './credential-manager'
-export { TeamsError } from './types'
+export { TeamsTokenProvider } from './token-provider'
+export {
+  completeDeviceCode,
+  loginWithDeviceCode,
+  PendingApprovalError,
+  refreshDeviceCodeAccount,
+  startDeviceCode,
+} from './device-login'
+export type { DeviceCodePrompt, DeviceLoginResult } from './device-login'
+export { TeamsListener } from './listener'
+export { TeamsAuthCapabilityError, TeamsError } from './types'
 export type {
   TeamsAccount,
   TeamsAccountType,
@@ -9,9 +19,13 @@ export type {
   TeamsConfigLegacy,
   TeamsCredentials,
   TeamsFile,
+  TeamsListenerEventMap,
   TeamsMessage,
+  TeamsRealtimeMessage,
   TeamsReaction,
+  TeamsSearchResult,
   TeamsTeam,
+  TeamsTrouterGenericEvent,
   TeamsUser,
 } from './types'
 export {
@@ -24,6 +38,7 @@ export {
   TeamsFileSchema,
   TeamsMessageSchema,
   TeamsReactionSchema,
+  TeamsSearchResultSchema,
   TeamsTeamSchema,
   TeamsUserSchema,
 } from './types'

package/src/platforms/teams/listener.ts

@@ -0,0 +1,295 @@
+import { randomUUID } from 'node:crypto'
+import { EventEmitter } from 'node:events'
+
+import WebSocket from 'ws'
+
+import type { TeamsClient } from './client'
+import {
+  buildActivityFrame,
+  buildAuthenticateFrame,
+  buildEventAck,
+  buildPingFrame,
+  buildRequestAck,
+  buildWebSocketUrl,
+  decodeMessageBody,
+  extractChatId,
+  fetchTrouterInfo,
+  fetchTrouterSessionId,
+  isMessageLossFrame,
+  parseRequestFrame,
+  registerEndpoint,
+  type TrouterInfo,
+} from './trouter'
+import { TeamsError } from './types'
+import type { TeamsListenerEventMap, TeamsRealtimeMessage } from './types'
+
+const PING_INTERVAL = 30_000
+const RECONNECT_BASE_DELAY = 1_000
+const RECONNECT_MAX_DELAY = 30_000
+const REGISTRATION_REFRESH_INTERVAL = (86400 - 60) * 1000
+const MESSAGE_CACHE_LIMIT = 500
+const TEXT_MESSAGE_TYPES = new Set(['Text', 'RichText/Html'])
+
+type EventKey = keyof TeamsListenerEventMap
+
+interface IncomingResource {
+  id?: string
+  messagetype?: string
+  content?: string
+  from?: string
+  imdisplayname?: string
+  conversationLink?: string
+  resourceLink?: string
+}
+
+export class TeamsListener {
+  private client: TeamsClient
+  private running = false
+  private ws: WebSocket | null = null
+  private emitter = new EventEmitter()
+  private endpointId = randomUUID()
+  private idToken: string | null = null
+  private info: TrouterInfo | null = null
+  private sequence = 0
+  private reconnectAttempts = 0
+  private pingTimer: ReturnType<typeof setInterval> | null = null
+  private reregisterTimer: ReturnType<typeof setInterval> | null = null
+  private reconnectTimer: ReturnType<typeof setTimeout> | null = null
+  private seenMessageIds = new Set<string>()
+
+  constructor(client: TeamsClient) {
+    this.client = client
+  }
+
+  async start(): Promise<void> {
+    if (this.running) return
+    this.running = true
+    this.reconnectAttempts = 0
+    await this.connect()
+  }
+
+  stop(): void {
+    this.running = false
+    this.clearTimers()
+    if (this.ws) {
+      this.ws.close()
+      this.ws = null
+    }
+  }
+
+  on<K extends EventKey>(event: K, listener: (...args: TeamsListenerEventMap[K]) => void): this {
+    this.emitter.on(event, listener as (...args: any[]) => void)
+    return this
+  }
+
+  off<K extends EventKey>(event: K, listener: (...args: TeamsListenerEventMap[K]) => void): this {
+    this.emitter.off(event, listener as (...args: any[]) => void)
+    return this
+  }
+
+  once<K extends EventKey>(event: K, listener: (...args: TeamsListenerEventMap[K]) => void): this {
+    this.emitter.once(event, listener as (...args: any[]) => void)
+    return this
+  }
+
+  private async connect(): Promise<void> {
+    if (!this.running) return
+
+    try {
+      const skypeToken = this.client.getToken()
+
+      // Re-extract on every attempt so a reconnect after token expiry picks up
+      // a fresh id_token rather than reusing the stale cached one.
+      this.idToken = await this.client.getIdToken()
+      if (!this.idToken) {
+        throw new TeamsError(
+          'Could not obtain Teams id_token for real-time auth. Ensure the Teams desktop app is logged in, then re-run "auth extract".',
+          'no_id_token',
+        )
+      }
+
+      const info = await fetchTrouterInfo(skypeToken, this.endpointId)
+      if (!this.running) return
+      const sessionId = await fetchTrouterSessionId(info, skypeToken, this.endpointId)
+      if (!this.running) return
+
+      this.info = info
+      const ws = new WebSocket(buildWebSocketUrl(info, sessionId, this.endpointId), {
+        headers: { 'X-Skypetoken': skypeToken, 'User-Agent': 'AgentMessenger' },
+      })
+      this.ws = ws
+
+      ws.on('message', (raw) => this.handleFrame(raw.toString()))
+
+      ws.on('close', () => {
+        this.clearTimers()
+        if (this.ws === ws) this.ws = null
+        if (this.running) {
+          this.emitter.emit('disconnected')
+          this.scheduleReconnect()
+        }
+      })
+
+      ws.on('error', (err) => {
+        this.emitter.emit('error', err instanceof Error ? err : new Error(String(err)))
+      })
+    } catch (error) {
+      this.emitter.emit('error', error instanceof Error ? error : new Error(String(error)))
+      if (this.running) this.scheduleReconnect()
+    }
+  }
+
+  private handleFrame(frame: string): void {
+    if (frame.startsWith('1::')) {
+      void this.onConnected()
+      return
+    }
+
+    if (frame.startsWith('3:::')) {
+      this.handleRequestFrame(frame)
+      return
+    }
+
+    if (frame.startsWith('5:')) {
+      const ack = buildEventAck(frame)
+      if (ack) this.ws?.send(ack)
+      if (isMessageLossFrame(frame)) void this.register()
+    }
+  }
+
+  private async onConnected(): Promise<void> {
+    if (!this.ws || !this.info || !this.idToken) return
+
+    this.ws.send(buildAuthenticateFrame(this.info, this.idToken))
+    this.ws.send(buildActivityFrame(++this.sequence))
+
+    // Only report the endpoint as connected once it has actually registered;
+    // an unregistered endpoint receives no messages. On failure, drop the
+    // possibly-stale id_token and close so the reconnect path re-authenticates.
+    const registered = await this.register()
+    if (!registered) {
+      this.idToken = null
+      this.ws.close()
+      return
+    }
+
+    this.reconnectAttempts = 0
+    this.pingTimer = setInterval(() => {
+      if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(buildPingFrame(++this.sequence))
+    }, PING_INTERVAL)
+    this.reregisterTimer = setInterval(() => void this.register(), REGISTRATION_REFRESH_INTERVAL)
+
+    this.emitter.emit('connected', { endpointId: this.endpointId })
+  }
+
+  private async register(): Promise<boolean> {
+    if (!this.info || !this.idToken) return false
+    try {
+      await registerEndpoint(
+        this.info,
+        this.client.getToken(),
+        this.idToken,
+        this.endpointId,
+        this.client.getAccountType(),
+        () => randomUUID(),
+      )
+      return true
+    } catch (error) {
+      this.emitter.emit('error', error instanceof Error ? error : new Error(String(error)))
+      return false
+    }
+  }
+
+  private handleRequestFrame(frame: string): void {
+    const request = parseRequestFrame(frame)
+    if (!request) return
+
+    this.ws?.send(buildRequestAck(request.id))
+
+    if (!request.url?.endsWith('/messaging') || !request.body) return
+
+    try {
+      const decoded = decodeMessageBody(request.headers ?? {}, request.body) as {
+        resourceType?: string
+        resource?: IncomingResource
+      }
+      if (decoded.resourceType === 'NewMessage' && decoded.resource) {
+        this.emitMessage(decoded.resource)
+      }
+      this.emitter.emit('teams_event', { resourceType: decoded.resourceType ?? 'unknown', ...decoded })
+    } catch (error) {
+      this.emitter.emit('error', error instanceof Error ? error : new Error(String(error)))
+    }
+  }
+
+  private emitMessage(resource: IncomingResource): void {
+    if (!resource.messagetype || !TEXT_MESSAGE_TYPES.has(resource.messagetype)) return
+
+    const chatId = extractChatId(resource.conversationLink ?? resource.resourceLink)
+    if (!chatId || !resource.id) return
+    if (this.seenMessageIds.has(resource.id)) return
+    this.rememberMessageId(resource.id)
+
+    const message: TeamsRealtimeMessage = {
+      id: resource.id,
+      chatId,
+      content: stripHtml(resource.content ?? ''),
+      author: {
+        id: extractUserId(resource.from) ?? 'unknown',
+        displayName: resource.imdisplayname || extractUserId(resource.from) || 'unknown',
+      },
+      messageType: resource.messagetype,
+      timestamp: new Date().toISOString(),
+    }
+    this.emitter.emit('message', message)
+  }
+
+  private rememberMessageId(id: string): void {
+    this.seenMessageIds.add(id)
+    if (this.seenMessageIds.size > MESSAGE_CACHE_LIMIT) {
+      const oldest = this.seenMessageIds.values().next().value
+      if (oldest !== undefined) this.seenMessageIds.delete(oldest)
+    }
+  }
+
+  private scheduleReconnect(): void {
+    const delay = Math.min(RECONNECT_BASE_DELAY * 2 ** this.reconnectAttempts, RECONNECT_MAX_DELAY)
+    this.reconnectAttempts++
+    this.endpointId = randomUUID()
+    this.sequence = 0
+    this.reconnectTimer = setTimeout(() => void this.connect(), delay)
+  }
+
+  private clearTimers(): void {
+    if (this.pingTimer) {
+      clearInterval(this.pingTimer)
+      this.pingTimer = null
+    }
+    if (this.reregisterTimer) {
+      clearInterval(this.reregisterTimer)
+      this.reregisterTimer = null
+    }
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer)
+      this.reconnectTimer = null
+    }
+  }
+}
+
+function stripHtml(html: string): string {
+  return html
+    .replace(/<[^>]*>/g, '')
+    .replace(/&amp;/g, '&')
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/\s+/g, ' ')
+    .trim()
+}
+
+function extractUserId(from: string | undefined): string | null {
+  if (!from) return null
+  const match = from.match(/contacts\/(.+)$/)
+  return match ? match[1] : from
+}

package/src/platforms/teams/realm-discovery.test.ts

@@ -0,0 +1,73 @@
+import { afterEach, describe, expect, it, mock } from 'bun:test'
+
+import { probeAccountType } from './realm-discovery'
+
+const originalFetch = globalThis.fetch
+
+function mockFetch(response: { status?: number; json?: unknown; reject?: boolean }): {
+  calls: Array<{ url: string; init: RequestInit }>
+} {
+  const calls: Array<{ url: string; init: RequestInit }> = []
+  globalThis.fetch = mock((input: string | URL | Request, init?: RequestInit) => {
+    calls.push({ url: String(input), init: init ?? {} })
+    if (response.reject) return Promise.reject(new Error('network down'))
+    const status = response.status ?? 200
+    return Promise.resolve({
+      ok: status >= 200 && status < 300,
+      status,
+      json: () => Promise.resolve(response.json),
+    } as Response)
+  }) as typeof fetch
+  return { calls }
+}
+
+afterEach(() => {
+  globalThis.fetch = originalFetch
+})
+
+describe('probeAccountType', () => {
+  it('posts the email to GetCredentialType as JSON', async () => {
+    const { calls } = mockFetch({ json: { EstsProperties: { DomainType: 3 } } })
+
+    await probeAccountType('user@contoso.com')
+
+    expect(calls[0].url).toBe('https://login.microsoftonline.com/common/GetCredentialType')
+    expect(calls[0].init.method).toBe('POST')
+    expect(JSON.parse(calls[0].init.body as string)).toEqual({ Username: 'user@contoso.com' })
+  })
+
+  it('maps a consumer DomainType to personal', async () => {
+    mockFetch({ json: { EstsProperties: { DomainType: 2 } } })
+    expect(await probeAccountType('user@outlook.com')).toBe('personal')
+  })
+
+  it('treats a known consumer domain as personal even without DomainType', async () => {
+    mockFetch({ json: { EstsProperties: { IsConsumerDomain: true } } })
+    expect(await probeAccountType('user@hotmail.com')).toBe('personal')
+  })
+
+  it('maps a managed DomainType to work', async () => {
+    mockFetch({ json: { EstsProperties: { DomainType: 3 } } })
+    expect(await probeAccountType('user@contoso.com')).toBe('work')
+  })
+
+  it('maps a federated DomainType to work', async () => {
+    mockFetch({ json: { EstsProperties: { DomainType: 4 } } })
+    expect(await probeAccountType('user@fabrikam.com')).toBe('work')
+  })
+
+  it('returns undefined when the domain type is missing', async () => {
+    mockFetch({ json: { EstsProperties: {} } })
+    expect(await probeAccountType('user@unknown.test')).toBeUndefined()
+  })
+
+  it('returns undefined on a non-ok response', async () => {
+    mockFetch({ status: 429, json: {} })
+    expect(await probeAccountType('user@contoso.com')).toBeUndefined()
+  })
+
+  it('returns undefined when the request throws', async () => {
+    mockFetch({ reject: true })
+    expect(await probeAccountType('user@contoso.com')).toBeUndefined()
+  })
+})